[byapparov]

Closes #250

Intent

AICTRL_DISABLE_PROJECT_CONFIG=true currently leaves two automatic instruction paths active: project .opencode/AGENTS.md and nested instruction files attached by the read tool. Make the flag suppress both paths.

Expected Impact on Users

CI operators who set AICTRL_DISABLE_PROJECT_CONFIG=true stop receiving automatically discovered checkout instructions from .opencode/AGENTS.md and nested read-time reminders. This makes the flag match the caller's expectation while retaining trusted global/profile and explicitly configured instructions. It reduces unintended repository influence; it does not isolate repository data, credentials or subprocesses.

Expected Outcomes

• Disabled project config excludes root, legacy and nested project instruction files, including read-time reminders.
• Enabled discovery and trusted caller/global instructions retain their existing behavior.

Implementation

Gate the project fallback in globalFiles() and return before nested discovery in InstructionPrompt.resolve(). Add regression coverage through the actual read tool and document the boundary.

Scope Caveat

This controls automatic instruction discovery. Repository content and tool output remain untrusted data; callers still need scoped credentials, permissions and environment isolation. Keep the README deletion workaround until a fixed release is verified.

Test Plan

• Reproduce the existing leak on unchanged source with the new fixtures: three failures.
• Verify disabled/enabled discovery, actual read reminders and trusted explicit/global controls.
• Restore environment and headless state between cases.

Verification

• Isolated Bun 1.4.3 frozen-lockfile installation; MCP SDK 1.32.1 matches the declaration.

• Focused instruction/config/read suites: 123 passed, one existing skip, zero failures; 256 assertions across five files.

• bun run typecheck in packages/cli: passed.

• Prettier on changed files and git diff --check: passed.

• CI verify — passed at commit 24010dc58a7842e962499189cd33add7de5c2c7f (run).

• CodeQL Analyze (actions), Analyze (javascript-typescript) and aggregate CodeQL — passed for the same commit (run).

Automated review monitoring and released-artifact verification remain separate gates; no release readiness is claimed.

[byapparov]

Closing as superseded by #257 and #255. The instruction-discovery fix, regression test file and Project instruction isolation documentation are already on main through #255 (merge commit cd994a5). The source and test Git blobs match this PR exactly, so no separate merge is needed.