zara-coding: do not let model-authored evidence satisfy task completion #154

New issue

Closed

opened 2026-09-08 02:03:05 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:05 +00:00

Owner

Problem

zara-coding currently exposes coding.task.record-evidence as a normal model-callable tool. The caller supplies kind, status, and detail, including status="passed". Prolog task completion accepts any stored passing evidence. A model can therefore manufacture the exact evidence that gates coding.task.complete, violating #1's requirement that completion depend on verification evidence rather than model assertion.

Required behavior

deterministic RED proving a caller cannot self-author passing completion evidence through the public tool surface;
fail closed: do not paper over this with approval metadata, because authorization to invoke a tool is not evidence that verification passed;
passing evidence must originate from a plugin-owned verifier/adapter that derives status from observed execution/repository results;
retain bounded Prolog task state and failed evidence where useful, but no public path may turn an arbitrary caller string into trusted passed evidence;
document the trust boundary;
plugin tests, registry compatibility, and generated Nix package builds green.

This advances #1 and does not require Zara Core changes for the immediate fail-closed fix. Cross-plugin test/build/GitHub composition remains separately blocked on Core #400.

## Problem `zara-coding` currently exposes `coding.task.record-evidence` as a normal model-callable tool. The caller supplies `kind`, `status`, and `detail`, including `status="passed"`. Prolog task completion accepts any stored passing evidence. A model can therefore manufacture the exact evidence that gates `coding.task.complete`, violating #1's requirement that completion depend on verification evidence rather than model assertion. ## Required behavior - deterministic RED proving a caller cannot self-author passing completion evidence through the public tool surface; - fail closed: do not paper over this with approval metadata, because authorization to invoke a tool is not evidence that verification passed; - passing evidence must originate from a plugin-owned verifier/adapter that derives status from observed execution/repository results; - retain bounded Prolog task state and failed evidence where useful, but no public path may turn an arbitrary caller string into trusted `passed` evidence; - document the trust boundary; - plugin tests, registry compatibility, and generated Nix package builds green. This advances #1 and does not require Zara Core changes for the immediate fail-closed fix. Cross-plugin test/build/GitHub composition remains separately blocked on Core #400.

nsaspy closed this issue

2026-09-08 02:03:05 +00:00