Project CLAUDE.md role boundaries (e.g. "subagent X may only review, never write") are not enforced — only self-policed

Summary

A project's CLAUDE.md can document a role boundary such as "the Codex subagent may only review completed work; it must never write/modify files" — but Claude Code has no mechanism to enforce this. The model has to self-police the boundary on every Agent/Task call, and it can (and did, in my case) simply fail to.

What happened

In my workspace, the root CLAUDE.md and a subproject's CLAUDE.md/ADR explicitly define: "Claude implements, Codex reviews only — Codex must never write/modify files." When I asked for a workspace-level automation task ("build a script + git hook, using a Codex subagent collaboratively"), Claude Code delegated the entire implementation (writing a shell script, editing README.md in 7 repositories, installing git pre-commit hooks, running the change across all repos) to a codex-rescue-style subagent via the Agent tool — directly contradicting the documented rule. I only caught it because I happened to ask Claude to double-check against the rule; nothing in the harness flagged the contradiction on its own.

Cleanup required reverting README.md in 7 repositories, deleting/restoring git hooks, and removing generated files — all avoidable if the tool had any awareness of the declared role boundary.

Secondary friction (same incident)

Once the subagent handed off to a background Codex task, the calling agent (Claude, in the main session) had no way to check status or cancel it — the equivalent of /codex:status and /codex:cancel are explicitly disabled for model invocation ("cannot be used with Skill tool due to disable-model-invocation ... reserved for explicit user invocation"). The only way to monitor progress was to read the plugin's raw log file directly from disk (~/.claude/plugins/data/codex-openai-codex/state/.../jobs/<task-id>.log), which is clearly not the intended UX for an orchestrating agent.

Suggested improvements

1. Surface CLAUDE.md-declared role/tooling constraints (e.g. "agent X: read-only / review-only") as a structured, checkable hint before an Agent/Task call that contradicts them — even a soft warning would have caught this.
2. When a subagent design intentionally restricts itself to "forward + cannot check status," give the calling agent (not just the human user) an allowed way to poll status/cancel, so orchestration doesn't require reading raw log files.

Environment

• Windows 11, Claude Code CLI, codex@openai-codex plugin
• Happy to share more detail if useful (local paths redacted here).