13 lines
1.2 KiB
Markdown
13 lines
1.2 KiB
Markdown
|
# Adversarial Bug Report: Phase-Scoped Prompts
|
||
|
|
|
||
|
|
## Deep Review
|
||
|
|
The ALLOWED/FORBIDDEN sections create hard boundaries that prevent phase-skipping. The user override resistance instructions give agents a standard refusal template. The orchestrate.md reduction from 493 to 143 lines is significant and removes state machine duplication.
|
||
|
|
|
||
|
|
## Potential Issues
|
||
|
|
1. **FORBIDDEN section is advisory only**: An agent that ignores the prompt can still perform forbidden actions. The enforcement relies on the agent following instructions. `status.py --validate-folder` catches violations after the fact, but cannot prevent them in real-time.
|
||
|
|
|
||
|
|
2. **Agent can fabricate APPROVED signal**: The approval gate says "wait for user approval," but a non-compliant agent could call `status.py --approve` itself without waiting. This is mitigated by the spec requirement that `--approve` is an explicit user action, but a truly adversarial agent could simulate it.
|
||
|
|
|
||
|
|
3. **decompose.md length**: At over 150 lines, decompose.md pushes against the prompt discipline target. Not a functional bug but a maintenance concern.
|
||
|
|
|
||
|
|
## Verdict: PASS — no security or logic flaws. Enforcement is prompt-based with status.py as a post-hoc check, which is the intended design.
|