Block Everything But Recipes

A runtime overlay that stops improvisation

The Problem

You asked it to run the recipe. It improvised instead.

You ask the agent to run your PR-review recipe. Instead of invoking the recipe engine, a helpful agent performs the review steps by hand — routing around the one system built to run them reproducibly.

The recipe it skipped is not a toy. Here's what it actually is.

The Recipe Is Real

The PR-review recipe is real and rigorous

code-review-comprehensive is a 6-step conditional review with per-step model routing across haiku, sonnet, and opus — a substantial artifact worth running, not something to redo by hand.

And recipes like this have a proper execution path the agent skipped.

analyze-structuresonnet
identify-issuessonnet
assess-severityhaiku
suggest-improvementsopus · if severity ≠ none
validate-suggestionsopus · if critical/high
quick-approvalhaiku · if severity = none

The Right Path

Recipes have a proper execution path

The tool-recipes module is the execution engine for Amplifier recipes. It exposes four operations — the correct way to run a recipe is recipe_execute with a recipe_path, not to redo the steps by hand.

The rule against improvising is already written down. That's the catch.

recipe_executerun a recipe (recipe_path + optional context)
recipe_resumecontinue a run
recipe_listlist recipes
recipe_validatevalidate a recipe

The Catch

The rule already exists — just not where it can stop you

The recipes bundle declares a Required Workflow (Non-Negotiable): delegate to recipes:recipe-author, validate with recipes:result-validator, and "Do NOT write recipe YAML directly." But that discipline lives in docs — nothing at runtime stops the agent from improvising anyway.

Amplifier already has a primitive that can move that rule from docs into runtime.

The Primitive

Modes are runtime overlays that moderate every tool

Amplifier modes are lightweight runtime overlays that modify assistant behavior without changing the bundle. Each tool gets a policy — and if a tool isn't listed, default_action applies, which defaults to block.

That default is what makes a recipes-only mode possible — if enforcement holds.

safetool works normally
warnblocked once with warning; retry proceeds
confirmrequires user approval via hook
blocktool disabled entirely

Strict And Safe

Enforcement fails closed — but never locks you out

The mode pre-tool hook (1,256 lines) denies any tool not in tools.safe when default_action is block, returning action='deny' and emitting mode:tool_blocked. Infrastructure tools — mode and todo — always bypass, so a block-by-default mode is not a trap.

Strict enough to enforce, safe enough to trust. Now assemble the mode.

Unlisted toolHookResult(action='deny') → mode:tool_blocked
Exception in hookdeny — fail closed
mode, todobypass the cascade — never locked out

Recipe-Runner Mode

Everything but recipes blocked — so the only way forward is to run the recipe

Recipe-runner mode is just tools.safe:[recipes] with default_action:block. And recipes already ships whitelisted in the careful and plan modes — so it's expressible from primitives that ship today. Improvisation becomes reproducible execution.

The lesson generalizes past this one mode.

# recipe-runner mode
tools:
  safe:
    - recipes
default_action: block

# write_file, edit_file, bash → blocked
# only path forward:
recipe_execute(recipe_path=...)

The Pattern

Don't just document the rule — make the right path the only path

When you want a system used the right way, a documented rule can be routed around. A runtime overlay that blocks everything else can't be. Make the correct path the only available path.

Sources

Research MethodologyShipped & Maintained

Data as of: 2026-07-21. Feature status: modes system shipped and actively maintained (microsoft/amplifier-bundle-modes v1.3.1, latest commit 64894a5, 2026-07-16); recipes tool shipped (microsoft/amplifier-bundle-recipes, "recipes" v1.0.0).

Every claim independently re-derived via:

Modes as runtime overlays + policies + default_action='block': cat amplifier-bundle-modes/README.md context/modes-instructions.md
Fail-closed deny path (1,256-line hook, deny lines 861–869, mode:tool_blocked): wc -l modules/hooks-mode/.../__init__.py; read lines 800–877; grep -n MODE_TOOL_BLOCKED events.py
Infrastructure bypass {mode, todo}: grep -n infrastructure_tools __init__.py
"recipes" whitelisted in shipped modes: cat modes/careful.md modes/plan.md
tool-recipes operations (recipe_execute/resume/list/validate): gh api repos/microsoft/amplifier-bundle-recipes/contents/modules/tool-recipes/README.md?ref=main
6-step code-review-comprehensive recipe + haiku/sonnet/opus routing: gh api repos/microsoft/amplifier-bundle-recipes/contents/examples/code-review-recipe.yaml?ref=main
Required Workflow / "Do NOT write recipe YAML directly": gh api repos/microsoft/amplifier-bundle-recipes/contents/bundle.md?ref=main
Timeline (recipe initial commit 9919a8d8, 2025-12-15; model-selection 8da835ab, 2026-01-13; modes initial 10c0016, 2026-01-14): gh api .../commits?path=...&sha=main; git log --reverse --date=short

Owners: microsoft (org) — amplifier-bundle-modes and amplifier-bundle-recipes.

Gaps / honest framing: No committed mode file literally named recipe-runner.md exists (modes/ holds careful, explore, mode-design, plan) — the mode is a correct application of verified primitives, expressible today, not a located artifact. The specific "user asked, agent improvised, so they built it" incident is illustrative narrative framing, not documented history; the building blocks are all independently verified.