Lap Tran
4a2301b077
CI / build (push) Has been cancelled
- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/ - status.py: add --cleanup-done and --install-cleanup-schedule commands - Add scripts/automaton-cleanup.sh for periodic task archiving - Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders - .rules.md: add Self-Documenting UI Names rule - New tests: test_cleanup_done.py, expanded test_app.py and test_task.py
13 lines
1.2 KiB
Markdown
13 lines
1.2 KiB
Markdown
# Adversarial Bug Report: Phase-Scoped Prompts
|
|
|
|
## Deep Review
|
|
The ALLOWED/FORBIDDEN sections create hard boundaries that prevent phase-skipping. The user override resistance instructions give agents a standard refusal template. The orchestrate.md reduction from 493 to 143 lines is significant and removes state machine duplication.
|
|
|
|
## Potential Issues
|
|
1. **FORBIDDEN section is advisory only**: An agent that ignores the prompt can still perform forbidden actions. The enforcement relies on the agent following instructions. `status.py --validate-folder` catches violations after the fact, but cannot prevent them in real-time.
|
|
|
|
2. **Agent can fabricate APPROVED signal**: The approval gate says "wait for user approval," but a non-compliant agent could call `status.py --approve` itself without waiting. This is mitigated by the spec requirement that `--approve` is an explicit user action, but a truly adversarial agent could simulate it.
|
|
|
|
3. **decompose.md length**: At over 150 lines, decompose.md pushes against the prompt discipline target. Not a functional bug but a maintenance concern.
|
|
|
|
## Verdict: PASS — no security or logic flaws. Enforcement is prompt-based with status.py as a post-hoc check, which is the intended design. |