[bug] SDLC codex-review guidance lets foreground Bash kill xhigh runs at 10-min cap

[BaseInfinity]

Summary

The SDLC skill's Cross-Model Review section (skills/sdlc/SKILL.md:129) tells Claude that "xhigh runs take 1-5 min" and doesn't tell it to use run_in_background: true on the Bash tool. In practice, xhigh codex on multi-file or multi-artifact bundles routinely takes 6–30+ minutes. The Bash tool's hard ceiling is 600000 ms / 10 min, and the harness silently clamps any timeout parameter above that. Result: foreground codex calls get killed mid-review at the 10-min wall, partial output is lost, and the existing Stop-hook loop amplifies the waste — we saw a single review eat 70 minutes of session compute and 9 Stop-hook re-invocations before the harness CLAUDE_CODE_STOP_HOOK_BLOCK_CAP=9 safeguard fired.

Repro (real session, 2026-05-27)

1. Claude follows the existing SDLC skill guidance:

   Bash({
     command: ".claude/skills/sdlc/codex-review.sh .reviews/out.md '<prompt>'",
     timeout: 2400000,  // 40 min, well within the wrapper's 30-min stall watchdog
     run_in_background: false,  // foreground — skill doesn't say otherwise
     dangerouslyDisableSandbox: true,
   })

2. Bash tool silently clamps timeout to its documented max of 600000 ms.
3. Codex xhigh on a 2-finding + 2-compliance-check bundle was at 5m 59s of a 10m cap (per the in-flight UI counter) when the user interjected with a new prompt.
4. In a separate review I fired the same prompt with run_in_background: true — codex completed in ~7 minutes and the output was written to the artifact file as expected. The only difference was background-vs-foreground.
5. During the foreground attempt, the project's Stop hook fired 9 consecutive times (re-invoking Claude with goal-incomplete feedback) before the harness override-and-end-turn safeguard fired with:

   "A hook blocked the turn from ending 9 consecutive times — overriding and ending turn. ... Set CLAUDE_CODE_STOP_HOOK_BLOCK_CAP to raise this limit."

6. Total session burn: ≈70 minutes of compute on what should have been a single 7-minute review.

Root cause

The current skill text:

Run reviewer: codex exec -c 'model_reasoning_effort="xhigh"' -s danger-full-access -o .reviews/latest-review.md "<prompt>". Always xhigh. CC sandbox blocks Codex's Rust binary (SCDynamicStore) — use dangerouslyDisableSandbox: true on Bash; Codex has its own sandbox. xhigh runs take 1-5 min; for a heartbeat use scripts/codex-review-with-progress.sh.

Two issues:

1. "1-5 min" understates the actual range. Single-artifact passes do converge in 1–5 min. Multi-artifact bundle reviews (which the SDLC release-review section explicitly calls for: CHANGELOG + version parity + stale examples + docs + file parity = multi-artifact) routinely exceed 10 min. The 5-min watchdog still applies as a stall detector, but a healthy review that produces bytes steadily can run 15–30 min without ever stalling — the wrapper accommodates this with STALL_SECONDS=1800 (already documented in codex-review.sh).

2. No guidance on background mode. Claude has no signal that the Bash tool will kill a foreground call at 10 minutes regardless of what timeout is set to. The Bash tool docs say "up to 600000ms / 10 minutes" but Claude often passes larger values (40 min in this incident) under the reasonable assumption that the harness honors them.

Proposed fix

Add one paragraph to the Cross-Model Review section, sibling to the existing MANDATORY 5-MINUTE WATCHDOG and MANDATORY PRE-FLIGHT ZOMBIE CHECK blocks:

 **MANDATORY 5-MINUTE WATCHDOG:** If a codex run hasn't produced any bytes in its `-o <output-file>` after 5 minutes, treat it as hung. Kill it (`pkill -9 -f 'codex exec'`) and check the invocation has `< /dev/null` before retrying. Most codex passes converge in 1–3 minutes at xhigh reasoning effort; a quiet output file at 5 minutes is almost always the stdin-hang regression returning under a new disguise.

+**MANDATORY BACKGROUND MODE for codex calls via Bash:** Always launch codex with `run_in_background: true` on the Bash tool, not as a foreground call. The Bash tool's hard maximum timeout is 600000 ms (10 minutes) — even if you pass `timeout: 2400000`, the harness silently clamps to 10 min and force-kills the process at the wall. xhigh codex on multi-file bundles can take 6–30+ minutes (single-artifact passes converge in 1–5 min; multi-artifact bundle reviews routinely exceed the 10-min cap). The wrapper at `scripts/codex-review.sh` already has a 30-min stall watchdog — let that be the real control, not the Bash tool's 10-min wall. A foreground codex call killed mid-review at the 10-min mark + Stop-hook loop amplification = real-session 70-minute burn (2026-05-27 incident).
+
 **MANDATORY PRE-FLIGHT ZOMBIE CHECK:** Before starting a new codex run, grep for stale codex processes from prior sessions: `ps aux | grep '[c]odex exec'`. Anything older than 1 hour is a zombie from a previous stdin-hang or other failure — kill it (`pkill -9 -f 'codex exec'`) before launching the new run. Codex doesn't keep a heartbeat or pidfile; the long-lived process is the only signal.

And update the SKILL.md line 129 inline text from "xhigh runs take 1-5 min" to "xhigh runs take 1–30 min (single-artifact 1–5 min; multi-artifact bundle 5–30 min — always background-mode, see watchdog block)".

Test plan

The SDLC skill is documentation, so the test is a behavioral one: a new session running through the Cross-Model Review section should produce run_in_background: true on the Bash call. Specifically:

• New session, fresh context: ask Claude to review a multi-finding bundle via codex. Verify the Bash invocation uses run_in_background: true.
• Optional: add a guidance test to the wizard's own test suite that greps skills/sdlc/SKILL.md for the string run_in_background: true near the codex-exec block.

Related

• This is adjacent to issue [feature] /goal should enforce HIGH-95% confidence gate (not just document it) #360 (/goal HIGH-95% confidence gate). Both touch the cross-model-review loop's reliability.
• The same lesson applies to ANY long-running tool invoked through the Bash tool — not just codex. Worth a generalization paragraph in CLAUDE_CODE_SDLC_WIZARD.md's "Cross-Model Review Loop" section ("if your wrapped tool can run > 10 min, use background mode unconditionally").

Evidence files

In the originating fixbot-audit repo (kept local — not part of this issue, but available if useful):

• .reviews/handoff.json for the foreground-killed review
• Stop-hook loop transcript with the 9-block safeguard message
• The wrapper .claude/skills/sdlc/codex-review.sh showing the existing 30-min stall watchdog that should be the real control

Patch applied locally

In the originating project I patched the local copy at .claude/skills/sdlc/SKILL.md with the diff above and the session immediately benefited (next codex call this session ran in background and completed in 7 min without incident). Filing this upstream so other users get the same benefit.

---

Severity: Medium-High. Doesn't break anything for sessions that happen to use background mode, but kills any session that follows the skill's current guidance literally on a multi-artifact review. The Stop-hook amplification effect makes this expensive.

Reporter context: Built atop the wizard for the fixbot-audit project (a security/privacy/AI-safety audit of iFixit's FixBot AI assistant). Discovered while running cross-model review on a v3.x ship-complete /goal plan, which is itself a multi-artifact bundle.