the orchestrate dangerous-verify refusal ends by naming the surface that still allows it #567

New issue

Open

opened 2026-09-21 21:09:02 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-21 21:09:02 +00:00

Owner

Part of #563.

The defect

internal/mcp/tools_orchestrate.go:131-141 refuses a verify command that matches a dangerous-pattern list held in the service layer. The refusal is correct up to its final clause, which tells the caller that the CLI keeps warn-only behaviour and names the command to reach it.

That is the shape ADR 0029 removed. The record describes the killed gateForcedWorktreeRemove string as the same deny-message-recommends-the-escape flaw ADR 0009 removed the opt-out keys for, and clause 3 says a refusal never hands back a runnable madtea flag or incantation that performs the destruction. This one does.

Two further points make it more than a wording slip:

The guard is per surface, not per operation. ADR 0029 clause 1 says a per-surface gate is not a substitute for omission, because it degrades and the degraded path is the one with the fewest other guards.
The refusal turns on what the caller believes about the command. ADR 0029's carve-out excludes a caller assertion by name: the proof must be structural and computed.

The same closing advice ships a second time in the orchestrate help topic, internal/mcp/tools_help.go:820-823.

Both strings are self-contained and carry no record or issue number, so ADR 0023 is satisfied. The defect is clause 3 only.

What needs deciding

I do not think this is only a string fix, so I do not want it closed by deleting one clause.

A verify command runs with the caller's full shell access and re-runs on every bisection step. If that is destruction the MCP surface refuses, the question is whether the CLI should keep it at all, or whether the refusal simply stops advertising it.
If the CLI keeps it, clause 3 needs an escape that is not a madtea command. The honest escape is a shell outside madtea, running a command the caller wrote.

Acceptance criteria

No shipped refusal in the orchestrate path names a madtea command, flag, or subcommand that performs the refused act.
The help topic carries the same wording as the refusal, so the two cannot drift.
The per-surface split is either recorded as a deliberate exception to clause 1, with its reasoning, or removed.
The reasoning is recorded before the string changes.

Part of #563. ## The defect `internal/mcp/tools_orchestrate.go:131-141` refuses a `verify` command that matches a dangerous-pattern list held in the service layer. The refusal is correct up to its final clause, which tells the caller that the CLI keeps warn-only behaviour and names the command to reach it. That is the shape ADR 0029 removed. The record describes the killed `gateForcedWorktreeRemove` string as the same deny-message-recommends-the-escape flaw ADR 0009 removed the opt-out keys for, and clause 3 says a refusal never hands back a runnable madtea flag or incantation that performs the destruction. This one does. Two further points make it more than a wording slip: - The guard is per surface, not per operation. ADR 0029 clause 1 says a per-surface gate is not a substitute for omission, because it degrades and the degraded path is the one with the fewest other guards. - The refusal turns on what the caller believes about the command. ADR 0029's carve-out excludes a caller assertion by name: the proof must be structural and computed. The same closing advice ships a second time in the `orchestrate` help topic, `internal/mcp/tools_help.go:820-823`. Both strings are self-contained and carry no record or issue number, so ADR 0023 is satisfied. The defect is clause 3 only. ## What needs deciding I do not think this is only a string fix, so I do not want it closed by deleting one clause. 1. A verify command runs with the caller's full shell access and re-runs on every bisection step. If that is destruction the MCP surface refuses, the question is whether the CLI should keep it at all, or whether the refusal simply stops advertising it. 2. If the CLI keeps it, clause 3 needs an escape that is not a madtea command. The honest escape is a shell outside madtea, running a command the caller wrote. ## Acceptance criteria - No shipped refusal in the orchestrate path names a madtea command, flag, or subcommand that performs the refused act. - The help topic carries the same wording as the refusal, so the two cannot drift. - The per-surface split is either recorded as a deliberate exception to clause 1, with its reasoning, or removed. - The reasoning is recorded before the string changes.

hexajon added a new dependency

2026-09-21 21:09:54 +00:00

#563 Epic: the destructive surface has outgrown ADR 0029's classification table

hexajon referenced this issue

2026-09-21 23:49:09 +00:00

chore(agents): track repo-scoped agent definitions, add the destruction-model auditor #574

hexajon referenced this issue from a commit

2026-09-21 23:49:10 +00:00

chore(agents): add a repo-scoped auditor for the destruction model