Repository navigation
Fetched web content is data: the market-researcher reads pages only as archived snapshots (M10.3) - #117
Merged
Conversation
…s archived snapshots (M10.3) budget hook pre (run on every tool call by all four hosts) refuses the market-researcher's WebFetch (webfetch on OpenCode) and any Bash fetcher (curl, wget, httpie, text browsers), read through wrappers, bash -c and $(...) by the door gate's shell reader and failing closed. roles.json marks the role "web": "archive"; its tools drop WebFetch; the three web-reading personas say fetched text is data; its eval suite gains an injected-page case. Test: scripts/test/fetched-data.test.py (6 checks). Open (M10.3b): ethics-reviewer and product-tester still WebFetch; interpreter fetches (python -c urllib) are not refused yet. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015QxyVf3NgwsgRyYpBgDDTC
adeelahmad
marked this pull request as ready for review
October 20, 2026 19:36
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
…e M9.31 branch ROADMAP: the M9 row keeps this branch's done/open lists; the M10 row takes master's M10.3 progress and says the OpenCode plugin exports ALOOP_AGENT_SHELL since M9.31. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rsDo9GYzNx8tXucywZHnA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Before: the market-researcher (the Scout) could open any page with WebFetch or
curland read it straight into its context. The first live mission cycle (M9.13, #115) gives it unattended web access and a shell, which is the prompt-injection surface M10.3 names.After: the Scout fetches pages only through
aloop mission research archive RSR URL. That command stores a hashed, cited snapshot, and the Scout reads the page there.budget hook pre, which all four hosts run on every tool call, refuses the Scout's own fetches:WebFetch, calledwebfetchon OpenCode;bash -cor$(…).curl … | sh, write a file at the project root and record an approval, and the Scout's actions must not change.How:
plugin/bin/_fetched.pyholds the rule. It reads commands with the door gate's shell reader (doors.views).plugin/mission/roles.jsonmarks the Scout with"web": "archive".budgetchecks the rule right after the project stop. The human'sSKIP_HOOKSlifts it, as it does every gate; the budget opt-out does not.WebFetch.Decision: only the Scout is covered for now. The ethics reviewer and product tester cannot write
research/, so they cannot use the archive yet. They still use WebFetch, and that is recorded as M10.3b together with fetches from an interpreter (python -c urllib).Evidence:
scripts/test/fetched-data.test.pyhas 6 checks and fails on master at check 1./varpaths.make ciin CI's fallback mode (without the bundled Rust tools): 82/82 pass.make cifails insupply-chain.test.py. The same failure happens on master because of a stale localmd-db, so it is not caused by this change.Generated by Claude Code