Configuring GPT-6 Astra: 14 Rules to Stop Over-Braking and Get Tasks Done

The article addresses a fundamental shift in AI agent behavior: GPT-6 Astra (also branded as GPT-6 Pro in Chat) stops too early rather than running away like its predecessor GPT-5.6 Sol. Four independent sources confirm this — OpenAI's model guide, Codex DX lead Eric Provencher, system-card honeypot tests (Sol 48.2% out-of-scope attempts vs. Astra 0%), and the desktop "chat paused for caution" loop.

Part 1: Where Astra Lives (Rules 1–2)

Rule 1. Astra exists in two products with separate quotas: GPT-6 Pro in Chat (Plus users get none; Pro $100 = 50/week; Pro $200 = 200/week) and Astra in ChatGPT Work + Codex (Plus = 5–45 local msgs/5 hrs; Pro $100 = 25–225/5 hrs; Pro $200 = 100–900/5 hrs). Astra and Sol share one quota pool; switching models does not grant a second allowance. New Codex sessions default to Astra on updated clients. Codex Cloud does not have Astra — unattended pipelines still run on Sol.

Rule 2. The advertised 1,050,000-token context window is only available via API. In the subscription Codex client the effective limit is ~258K tokens (272K is the API pricing cliff). Cached input tokens are not free on subscriptions — they still burn the metered window. Default reasoning effort in Codex is low; release benchmarks ran at high.

Part 2: Delete the Brakes (Rules 3–8)

Codex builds an instruction chain each session: GLOBAL ~/.codex/AGENTS.override.md → ~/.codex/AGENTS.md, then PROJECT repo root → … → cwd (one file per directory, AGENTS.override.md before AGENTS.md), merged root-down with blank lines; closer to cwd wins. A 32 KiB project_doc_max_bytes cap stops adding at the project level. Use codex -c log_dir=./.codex-log to see what actually loads.

Rule 3. Delete "read all docs before every edit." Provencher: "Requiring a pile of docs… is overkill for fixing a typo." BAD:

Before every edit, read architecture.md, database.md, and deployment.md.

GOOD:

Use architecture.md for service boundaries, database.md for schema changes, and deployment.md when preparing a deployment.

Rule 4. Delete "always run tests." Provencher: "Previous models needed encouragement… GPT-6 Astra will do these on its own." Model guide: "For smaller tasks this may cause the test scope to be broader than the task warrants." Use OpenAI's alternative wording:

Do not write tests for reversible, low-impact changes… Run tests appropriate to the change and complete required checks. Once those pass, broaden or repeat testing only when new changes, failures, or unresolved concerns justify it.

Rule 5. Delete "ask before anything risky." "Risky" is a feeling; Astra takes it literally and stops. Replace with irreversible-action categories:

You don't need permission for reversible tasks, read-only actions, reviews or fixes, or anything authorized earlier in this session. Stop only before: sending anything to a third party, payments, deletes outside the workspace, permission changes, production deploys, and merges.

Rule 6. Delete "stop after first implementation for review." Provencher: "Asking for a stop after a first implementation will steer the model toward an earlier stopping point." Model guide recommends:

Complete all necessary work before deploying changes, writing to external applications, merging PRs, or publishing sites so that user approval is the last step.

GOOD:

Implement it, run it, inspect the result, fix what fails, and bring me a reviewable diff. Approval is the last step, not the first.

Rule 7. Delete "pick-me" skill descriptions. Skills are capped at 2% of context window (~5K tokens per skill at 258K). Overlong descriptions get truncated; the model sees less and chooses worse. Front-load trigger words. BAD:

description: Create and validate Postgres schema migrations. Use when working with databases, queries, models, or persistence.

GOOD:

description: Create and validate Postgres schema migrations. Use when adding or changing a migration, or reviewing its rollout.

For skills that should never auto-invoke, set policy: allow_implicit_invocation: false in agents/openai.yaml.

Rule 8. Delete recipe-style skills. Provencher: "Overly specific guidance can now hinder results." The bundled $skill-creator starts with: "Assume Codex is already capable. Only include information that changes its decisions or improves its work." Structure: SKILL.md (router), references/ (read only when needed), scripts/ (deterministic steps only), assets/, agents/openai.yaml. Move Sol-specific brakes under model-scoped headings if teammates still use them.

Part 3: Install the Throttle (Rules 9–13)

Rule 9. Write a completion contract before the first message. Provencher: "This is where you define done before you start." Zhihu summary: "Strict on the endpoint, loose on the route." Every unattended task gets a DONE MEANS block (script-checkable predicates), NOT DONE MEANS, ROUTE, and STOP FOR ME ONLY IF (irreversible action or contradictory DONE items).

Rule 10. Keep an authorization ledger in-session. Leaked system prompt: "When the user has already authorized an action in an earlier turn, do not ask for permission again." Model forgets after compression. Make it explicit and persistent at task top:

AUTHORIZED FOR THIS TASK (do not ask again) - run the local test suite… create and switch git branches… install dev dependencies… read any file in the repo. NOT AUTHORIZED (ask, with a concrete diff ready) - push to main… anything that sends email, Slack, or webhooks.

Rule 11. Add two precedence lines. Astra is more instruction-sensitive. Model guide fix:

The user's instructions take precedence over guidelines provided in a skill. If explicit user instructions conflict with a skill's instructions, prioritize the user's instructions. If a skill causes you to ask for permission or confirmation, pause, leave requested work unfinished, or diverge from the user's intent, name and link to the exact SKILL.md file you read, quote the relevant instruction, and briefly explain how it applies.

The second sentence turns every unexplained stop into a bug report with a file path.

Rule 12. Wire the contract to a Stop hook. Codex has a Stop hook that runs when the model thinks the task is done. Hook config in ~/.codex/config.toml or <repo>/.codex/config.toml:

[[hooks.Stop]] [[hooks.Stop.hooks]] type = "command" command = "python3 .codex/hooks/contract.py" timeout = 120 statusMessage = "Checking completion contract"

. The checker reads stdin JSON, runs DONE predicates, and continues at most once per turn using stop_hook_active. Example contract.py runs npm test --silent and bash docs/contract_check.sh, prints JSON {"decision":"block","reason":"..."} on failure. Caveats: hooks need trust ( /hooks to approve), project hooks load only when trusted in [projects."<path>"], Stop must emit JSON on stdout.

Rule 13. Approve known-safe categories in config, not prose. Two documented switches: approval_policy = "on-request" (values: untrusted | on-request | never; on-failure deprecated) and sandbox_mode = "workspace-write". Granular form:

approval_policy = { granular = { sandbox_approval = true, rules = true, mcp_elicitations = true, request_permissions = true, skill_approval = false } }

. PermissionRequest hook can auto-approve by tool/command pattern (e.g., test runners). Example allow_tests.py matches ^(npm|pnpm|yarn) (test|run test)\b and returns

{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}

. Add a read-only verifier agent ( .codex/agents/verifier.toml) that re-runs every DONE predicate and reports PASS/FAIL without fixing.

Part 4: The Bill (Rule 14)

Rule 14. Pay for steps and cache, not thinking. Astra's billing shape: many steps, each re-reading context; reasoning tokens are tiny. V2EX user: 8.35M input tokens (8.14M cached), 70K output, <20K reasoning in 40 min. Task cost ≈ cache-read price × step count. Three consequences:

API cliff at 272K: entire request re-priced 2× input/cache, 1.5× output. 272,000 tokens × $10/M = $2.72; 272,001 tokens × $20/M = $5.44. Set model_auto_compact_token_limit below 272K. Subscription cannot exceed it; Codex credits: 250 credits/M input, 25 credits/M cache, 1,250 credits/M output, Fast 2.5×.

Effort is a purchase; low is the new high. Tibo Sottiaux (Codex lead): low-effort Astra beats high-effort Sol. One developer's unattended task: Sol high $31.79/75 min; Astra low $26.97/49 min (found data-loss path Sol missed); Astra medium $25.67/51 min (caught startup failure); Astra high $37.23/77 min (its review missed the startup bug). ARC Prize: low effort 17.5% score, $38,166; max effort 62.7%, $26,000. Effort is a per-task knob, not a money-saving dial.

Route bulk work to cheaper models. API per-M pricing: Astra $10/$50, Sol $4/$20, Terra $2/$12, Luna $0.20/$1.20. Documented pattern in config.toml:

model = "gpt-6-astra"; model_reasoning_effort = "low"; [agents] default_subagent_model = "gpt-5.6-luna"; default_subagent_reasoning_effort = "medium"; max_concurrent_threads_per_session = 4

. One measured run (dante01yoon/astra-orchestrator) used 75.9% more tokens but cost 22.5% less. Model guide notes Astra "may delegate less than desired," so tell it when to spawn. Enable experimental context management: [features.context_management] experimental_mode = true — uses notes and searchable history instead of repeated compression. Requires ChatGPT login on Plus/Pro/Pro Lite; not on Business, Enterprise, or API keys at launch. One Pro account saw 404 from notes backend, client still opened new context, agent "gave up on the test target." Verify notes are actually writing before trusting a six-hour run.

Part 5: What You Cannot Fix

Safety monitor. Astra is the first widely-deployed model to hit OpenAI's Critical threshold for cybersecurity. Docs: "Monitors async runs and can pause tasks if potential unsafe model behavior is detected." In Chat/Codex you may be asked to review; in API the task stops with 403 misalignment_policy_violation, no resume, prior tool actions not rolled back.

False positives on your own code. Issue: 26-line Rust layout helper from Codex's own TUI blocked 6/6 times in read-only thread. Reviewing Linux distro patches in isolated container flagged; subsequent benign actions in same thread blocked. Switching to Sol recovered. V2EX user asked Astra to review his project; it found a vuln, judged it security research, ended session. New thread or using Sol for that task is the only workaround today.

CLI: task just ends. Approval table for CLI/mobile: "Full discovery and recovery unavailable. Task ends." Desktop has review button; CLI gets a dead thread. Zero-data-retention and non-US residency same.

Scheduled tasks stop at the last click. Automation uses approval_policy = "never" but Computer Use still asks before sensitive actions. Scheduled browser task did everything except submit form because submit is an action-time confirmation with no human present. No maintainer reply yet. Don't schedule tasks whose final step is irreversible unless you've tested that the final step actually fires.

Persistent "continue" loop. Desktop preventive pauses don't remember acknowledgment. Unfixed on macOS and Windows as of Sep 7.

None of these live in AGENTS.md. Check the error text before editing files.

Part 6: Where It Loses

Loses to Claude Fable 5.1 on benchmarks people care about: Humanity's Last Exam 57.2 vs 65.0; Artificial Analysis Intelligence Index 61.2 vs 65.7 (rank 8/202); MindStudio 12-test suite $198 vs $113, lost all four full-app builds. Every.to calls Astra "over-engineering" and unable to judge "when its own work is done" — the under-completion problem from the other side: without a contract it either stops early or never stops.

~25% calculator-use tasks fail. OSWorld 2.0 72.6%; ScreenSpot-Pro 92.7%. Programmer 鱼皮 gave KiCad routing task: 12 DRC violations, 20 unconnected nets. Summary: "It can see the UI but cannot draw on it."

99.9% ARC-AGI-3 score used OpenAI's Provider Adapter preserving reasoning state between requests. Standard guardrail score 62.7%. Both from ARC Prize.

Case studies are OpenAI's own. Legora 41-doc cross-check caught all 4 seeded errors, ~40% workflow speedup; broader task set ~3% average lift. Playco 50% manual-fix reduction and Claire Vo's 6-month stuck feature to 90% are real reports but not controlled experiments.

Reading its mind is gone. System card: "Chain-of-thought monitorability significantly degraded." UK AISI: Astra solves 30.9 min human-equivalent tasks with zero written CoT vs Sol 3.6 min. This underpins the whole article's final argument: if you cannot watch it think, the only remaining gate is at the output. A completion contract. A verifier that distrusts the summary. A hook that checks instead of asks.

Part 7: Acceptance Tests

Seven predicates. Run against your own setup. Any FAIL = a brake you haven't found yet. T1 codex -c log_dir=./.codex-log loads the AGENTS.md you think it loads, and total is under project_doc_max_bytes. T2 grep your AGENTS.md and skills for "before every", "always", "ask before", "risky", "stop and". Each hit names an action class or gets deleted.

T3 Skills catalog fits: <2% of your window, no truncation warning at session start.

T4 Every unattended task has a DONE list a script can evaluate.

T5 A Stop hook exists, is trusted via /hooks, and continues at most once per turn.

T6 Astra can name the file that stopped it, because you added the precedence lines.

T7 You know which pauses are the safety monitor, because you've read one of the error strings and did not touch AGENTS.md for it.

Postscript

Four days isn't enough for definitive conclusions on any model; I've tried to flag every line that comes from a single person's terminal. What I'm sure of is the direction. For a year we built agents by adding rules. OpenAI just shipped a model that reads every rule, believes every rule, and stops. The setup for this model is shorter than the last one, and most of the work is deletion.