anti-slop-engineering 1.5.0 → 1.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.skills.json +1 -1
- package/README.md +36 -4
- package/SKILL.md +27 -1
- package/bin/cli.js +11 -1
- package/cases/CASE-H-001-B.json +25 -0
- package/cases/CASE-H-001-G.json +25 -0
- package/cases/CASE-H-002-B.json +24 -0
- package/cases/CASE-H-002-G.json +24 -0
- package/cases/CASE-I-001-B.json +25 -0
- package/cases/CASE-I-001-G.json +25 -0
- package/cases/CASE-I-002-B.json +25 -0
- package/cases/CASE-I-002-G.json +25 -0
- package/cases/CASE-S-001-B.json +25 -0
- package/cases/CASE-S-001-G.json +25 -0
- package/cases/CASE-S-002-B.json +25 -0
- package/cases/CASE-S-002-G.json +25 -0
- package/cases/CASE-S-003-B.json +28 -0
- package/cases/CASE-S-003-G.json +28 -0
- package/cases/CASE-T-001-B.json +25 -0
- package/cases/CASE-T-001-G.json +25 -0
- package/dist/bin/anti-slop-rust +0 -0
- package/dist/bin/toil-guard +0 -0
- package/install.sh +2 -0
- package/marketplace.json +1 -1
- package/package.json +7 -2
- package/schemas/anti-slop-case.schema.json +59 -0
- package/scripts/exec_guard.py +764 -0
- package/scripts/run_cases.py +96 -0
- package/services/anti-slop-rust/Cargo.lock +1 -1
- package/services/anti-slop-rust/Cargo.toml +1 -1
- package/services/toil-guard-go/pkg/model/types.go +1 -1
- package/services/toil-guard-go/pkg/server/server.go +1 -1
package/.skills.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://skills.sh/schema.json",
|
|
3
3
|
"name": "anti-slop-engineering",
|
|
4
|
-
"version": "1.
|
|
4
|
+
"version": "1.6.0",
|
|
5
5
|
"description": "An Engineering Discipline Playbook & Guard System for AI Coding Agents. Enforces Google SRE, Clean-Room Senior Dev Ladders, and Rust/Go Microservices.",
|
|
6
6
|
"repository": "https://github.com/imMamdouhaboammar/anti-slop-engineering",
|
|
7
7
|
"author": "Mamdouh Aboammar",
|
package/README.md
CHANGED
|
@@ -12,7 +12,7 @@
|
|
|
12
12
|
[](https://skills.sh)
|
|
13
13
|
[](https://claude.ai)
|
|
14
14
|
|
|
15
|
-
[Install](#install) · [What it catches](#what-it-catches) · [Engines](#engines) · [Decision Guard](#decision-guard) · [Root-Fix Gate](#root-fix-gate) · [Future-Scale Gate](#future-scale-gate) · [Paranoid Architect](#the-paranoid-principal-architect) · [Forensic Bug Hunter](#forensic-bug-hunter-scanner) · [Install Anti-Slop](#install-anti-slop-oxlint) · [Agent skill](#agent-skill) · [Anti-pattern catalog](#anti-pattern-catalog-217-patterns)
|
|
15
|
+
[Install](#install) · [What it catches](#what-it-catches) · [Engines](#engines) · [Decision Guard](#decision-guard) · [Root-Fix Gate](#root-fix-gate) · [Future-Scale Gate](#future-scale-gate) · [Paranoid Architect](#the-paranoid-principal-architect) · [Forensic Bug Hunter](#forensic-bug-hunter-scanner) · [Execution Guard](#in-flight-execution-guard) · [Install Anti-Slop](#install-anti-slop-oxlint--skill) · [Agent skill](#agent-skill) · [Anti-pattern catalog](#anti-pattern-catalog-217-patterns)
|
|
16
16
|
|
|
17
17
|
</div>
|
|
18
18
|
|
|
@@ -302,12 +302,18 @@ Modular playbooks and architectural checklists are located in [`skills/paranoid-
|
|
|
302
302
|
|
|
303
303
|
---
|
|
304
304
|
|
|
305
|
-
## Install Anti-Slop (Oxlint)
|
|
305
|
+
## Install Anti-Slop (Oxlint & Skill)
|
|
306
306
|
|
|
307
|
-
Opinionated anti-slop Oxlint lint rules for TypeScript and JavaScript codebases. Catches runtime type assertion risks, unconstrained object parameters, type widening, and module mocking leaks at lint-time:
|
|
307
|
+
Opinionated anti-slop Oxlint lint rules and agent skill for TypeScript and JavaScript codebases. Catches runtime type assertion risks, unconstrained object parameters, type widening, and module mocking leaks at lint-time:
|
|
308
|
+
|
|
309
|
+
### Agent Skill & Slash Command
|
|
310
|
+
|
|
311
|
+
Invoke `/install-anti-slop` in any supported AI coding agent (Claude Code, Antigravity, Gemini CLI, Cursor, Windsurf) to automatically inspect the target repository, detect package managers, vendor the AST plugins, and configure `oxlint.config.ts` or `.oxlintrc.json`.
|
|
312
|
+
|
|
313
|
+
### CLI Command
|
|
308
314
|
|
|
309
315
|
```bash
|
|
310
|
-
#
|
|
316
|
+
# Install Oxlint plugin directly into target repository (creates tools/oxlint/anti-slop/):
|
|
311
317
|
bunx anti-slop-engineering install-oxlint
|
|
312
318
|
# Or via npx:
|
|
313
319
|
npx anti-slop-engineering install-oxlint
|
|
@@ -350,6 +356,32 @@ export default {
|
|
|
350
356
|
|
|
351
357
|
---
|
|
352
358
|
|
|
359
|
+
## In-Flight Execution Guard
|
|
360
|
+
|
|
361
|
+
The real-time execution guard interceptor enforces boundaries before agent actions run. Inspired by Stop-That-Shit boundary control, it intercepts PreToolUse actions, parses active directives, gates unauthorized file mutations, blocks unverified dependency creep, caps concurrent subagent fanout, and evaluates declarative pairwise test cases:
|
|
362
|
+
|
|
363
|
+
| Feature | Enforcement |
|
|
364
|
+
| --- | --- |
|
|
365
|
+
| **Directive Parser** | `$anti-slop [mode] [level] [files=...] [hash=...] [deps=...] [agents=N] -- [task]` |
|
|
366
|
+
| **File Boundary Lock** | Rejects edits outside declared contract paths (`PATH_OUTSIDE_CONTRACT`) |
|
|
367
|
+
| **Read-Only Mode Gate** | Blocks mutating tools (`write_file`, `edit_file`, mutating shell commands) in `review`/`answer`/`monitor` modes |
|
|
368
|
+
| **Dependency Gate** | Flags unapproved package installations; issues single-use runner tickets when `deps=ask` |
|
|
369
|
+
| **Subagent Concurrency** | Halts subagent invocations when `active_subagents >= agents` budget |
|
|
370
|
+
| **Pairwise Case Runner** | 16 declarative Good/Bad test cases verifying SHIT boundary invariants |
|
|
371
|
+
|
|
372
|
+
```bash
|
|
373
|
+
# Check guard status & active directives:
|
|
374
|
+
bunx anti-slop-engineering exec status
|
|
375
|
+
|
|
376
|
+
# Evaluate an action against active contract:
|
|
377
|
+
bunx anti-slop-engineering exec check-action --tool edit_file --args '{"Path": "unauthorized.ts"}'
|
|
378
|
+
|
|
379
|
+
# Run declarative pairwise evaluation cases (16 cases across H, I, S, T):
|
|
380
|
+
bunx anti-slop-engineering cases
|
|
381
|
+
```
|
|
382
|
+
|
|
383
|
+
---
|
|
384
|
+
|
|
353
385
|
## Agent skill
|
|
354
386
|
|
|
355
387
|
The agent skill wires Anti-Slop Engineering into your AI coding agent's context. Once installed, code changes are guided by the Seven Gates, the 217-pattern anti-pattern catalog, and the Google SRE enforcement rules.
|
package/SKILL.md
CHANGED
|
@@ -4,7 +4,7 @@ description: Prevent, detect, and repair AI coding slop and dirty engineering in
|
|
|
4
4
|
author: Mamdouh Aboammar <mamdouhfces1997@gmail.com>
|
|
5
5
|
license: MIT
|
|
6
6
|
metadata:
|
|
7
|
-
version: "1.
|
|
7
|
+
version: "1.6.0"
|
|
8
8
|
focus: "engineering-discipline"
|
|
9
9
|
repository: "https://github.com/imMamdouhaboammar/anti-slop-engineering"
|
|
10
10
|
---
|
|
@@ -126,6 +126,11 @@ bunx anti-slop-engineering toil stream
|
|
|
126
126
|
# Zero-dependency Python Core Fallback:
|
|
127
127
|
python scripts/diff_guard.py --base HEAD --json
|
|
128
128
|
python scripts/sre_guard.py --base HEAD --strict --json
|
|
129
|
+
|
|
130
|
+
# In-Flight Real-Time Action Execution Guard:
|
|
131
|
+
bunx anti-slop-engineering exec status
|
|
132
|
+
bunx anti-slop-engineering exec check-action --tool <tool> --args '<json>'
|
|
133
|
+
bunx anti-slop-engineering cases
|
|
129
134
|
```
|
|
130
135
|
|
|
131
136
|
Replace `origin/main` with your actual target branch; if unavailable, compare with a known commit using `--base HEAD`. If new files are untracked, stage only intended files *when authorized*, then re-run; the tool warns that untracked contents are excluded. **Regex flags (including trivial comment narration, patronizing UI copy, speculative docs, dev notes, and SRE scale hazards) are candidates for investigation, not confirmed defects.** The tool neither runs tests nor performs SAST.
|
|
@@ -171,6 +176,27 @@ Before proposing merge, report: intent, changed files, exact test evidence, base
|
|
|
171
176
|
- Do not duplicate domain invariants, validation rules, or error models across multiple modules; maintain a single authoritative source of truth.
|
|
172
177
|
- Do not over-restrict legitimate design: duplication in readable tests can be preferable to an unreadable abstraction, and a larger implementation can be necessary for correct safety boundaries.
|
|
173
178
|
|
|
179
|
+
## In-flight task directives and execution control
|
|
180
|
+
|
|
181
|
+
Apply the Stop Ladder to balance task responsibility and boundary enforcement:
|
|
182
|
+
1. Understand current responsibility (explicit contract, affected callers, data migrations).
|
|
183
|
+
2. Start with a direct solution (existing codebase helpers, platform built-ins, standard library).
|
|
184
|
+
3. Expand only to close concrete gaps (supported inputs, real obligations).
|
|
185
|
+
4. Judge defenses by their effect (retain effective protection, eliminate unneeded hashes or error swallowing).
|
|
186
|
+
5. Verify the result and finish (no circular verification or redundant multi-agent loops).
|
|
187
|
+
|
|
188
|
+
Directive syntax:
|
|
189
|
+
```text
|
|
190
|
+
$anti-slop [mode] [level] [files=...] [hash=...] [deps=...] [agents=N] -- [task]
|
|
191
|
+
```
|
|
192
|
+
|
|
193
|
+
- `mode`: `change` (default write), `review` (read-only), `answer` (read-only), `monitor` (read-only), `unconfirmed` (passive).
|
|
194
|
+
- `level`: `guard` (enforcing block), `watch` (advisory warning), `off` (disabled).
|
|
195
|
+
- `files=path1|path2|dir/**`: file boundary lock. Actions modifying paths outside this pattern are rejected with `PATH_OUTSIDE_CONTRACT`.
|
|
196
|
+
- `hash=deny|ask|allow`: cryptographic checksum and hash policy.
|
|
197
|
+
- `deps=deny|ask|allow`: dependency installation policy. When `deps=ask`, generates single-use runner tickets.
|
|
198
|
+
- `agents=N`: concurrent subagent budget.
|
|
199
|
+
|
|
174
200
|
## Deliverable contract
|
|
175
201
|
|
|
176
202
|
For each implementation/review, produce a concise report in this order: **Outcome; Scope; Behavior preserved/changed; Verification (commands + results); Findings with exact file/line; Test modifications with rationale; Risks/limitations; Merge recommendation.** If available, distinguish baseline failures from new failures. Use `NOT RUN` and `UNKNOWN` literally when applicable.
|
package/bin/cli.js
CHANGED
|
@@ -18,6 +18,8 @@ const rootFixGuardScript = resolve(rootDir, "scripts", "root_fix_guard.py");
|
|
|
18
18
|
const futureScaleGuardScript = resolve(rootDir, "scripts", "future_scale_guard.py");
|
|
19
19
|
const paranoidGuardScript = resolve(rootDir, "scripts", "paranoid_guard.py");
|
|
20
20
|
const forensicHunterScript = resolve(rootDir, "scripts", "forensic_hunter.py");
|
|
21
|
+
const execGuardScript = resolve(rootDir, "scripts", "exec_guard.py");
|
|
22
|
+
const runCasesScript = resolve(rootDir, "scripts", "run_cases.py");
|
|
21
23
|
const bumpVersionScript = resolve(rootDir, "scripts", "bump_version.py");
|
|
22
24
|
const installOxlintScript = resolve(rootDir, "skills", "install-anti-slop", "scripts", "install.mjs");
|
|
23
25
|
const nativeSuffix = process.platform === "win32" ? ".exe" : "";
|
|
@@ -38,13 +40,15 @@ const executableAliases = {
|
|
|
38
40
|
"toil-guard": "toil",
|
|
39
41
|
"forensic-hunter": "hunter",
|
|
40
42
|
"forensic": "hunter",
|
|
43
|
+
"exec-guard": "exec",
|
|
44
|
+
"run-cases": "cases",
|
|
41
45
|
};
|
|
42
46
|
const args = process.argv.slice(2);
|
|
43
47
|
if (executableAliases[invokedAs]) args.unshift(executableAliases[invokedAs]);
|
|
44
48
|
|
|
45
49
|
function printBanner() {
|
|
46
50
|
console.log(`
|
|
47
|
-
🛡️ Anti-Slop Engineering CLI (v1.
|
|
51
|
+
🛡️ Anti-Slop Engineering CLI (v1.6.0)
|
|
48
52
|
Clean-Room AI Coding Guard & High-Performance Polyglot Architecture
|
|
49
53
|
Engines: Standard Library Python Guard | Rust Microservice | Go Toil Guard
|
|
50
54
|
Author: Mamdouh Aboammar <mamdouhfces1997@gmail.com>
|
|
@@ -66,6 +70,8 @@ Commands:
|
|
|
66
70
|
future-scale audit <file> Check future operating envelope, reversibility and evolution proof
|
|
67
71
|
paranoid audit <file> Check a Paranoid Architect record for zero-trust and 10M scale compliance
|
|
68
72
|
hunter, forensic Run Zero-Trust Forensic Bug Hunter static scanner across 9 stacks
|
|
73
|
+
exec, exec-guard Run in-flight Execution Guard (PreToolUse interceptor & directive controller)
|
|
74
|
+
cases, run-cases Run declarative pairwise evaluation cases (16 SHIT/Anti-Slop test pairs)
|
|
69
75
|
install-oxlint Install bundled Oxlint anti-slop plugin into target repo
|
|
70
76
|
bump [part] Bump version across all 10 manifests (patch, minor, major, or explicit)
|
|
71
77
|
test Run unit test suite
|
|
@@ -231,6 +237,10 @@ if (cmd === "build") {
|
|
|
231
237
|
runPythonScript(paranoidGuardScript, args.slice(1), "paranoid_guard");
|
|
232
238
|
} else if (cmd === "hunter" || cmd === "forensic" || cmd === "forensic-hunter") {
|
|
233
239
|
runPythonScript(forensicHunterScript, args.slice(1), "forensic_hunter");
|
|
240
|
+
} else if (cmd === "exec" || cmd === "exec-guard") {
|
|
241
|
+
runPythonScript(execGuardScript, args.slice(1), "exec_guard");
|
|
242
|
+
} else if (cmd === "cases" || cmd === "run-cases") {
|
|
243
|
+
runPythonScript(runCasesScript, args.slice(1), "run_cases");
|
|
234
244
|
} else if (cmd === "install-oxlint" || cmd === "install-anti-slop") {
|
|
235
245
|
if (!existsSync(installOxlintScript)) {
|
|
236
246
|
console.error(`Error: install script not found at ${installOxlintScript}`);
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-H-001-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "H",
|
|
5
|
+
"title": "Unrequested checksum generation",
|
|
6
|
+
"description": "Agent executes sha256sum generation with hash=deny policy.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"hash_intent": true,
|
|
17
|
+
"command": "sha256sum report.csv > report.csv.sha256"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "deny_and_explain",
|
|
22
|
+
"family": "H",
|
|
23
|
+
"reason_code": "HASH_NOT_AUTHORIZED"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-H-001-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "H",
|
|
5
|
+
"title": "Authorized release checksum generation",
|
|
6
|
+
"description": "Agent executes sha256sum generation with explicit hash=allow policy.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "allow",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"hash_intent": true,
|
|
17
|
+
"command": "sha256sum release-0.1.0.tar.gz > release-0.1.0.tar.gz.sha256"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-H-002-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "H",
|
|
5
|
+
"title": "Hypothetical hardening for unreachable state",
|
|
6
|
+
"description": "Migration or compatibility code for state that has never shipped.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"reachability": "unreachable"
|
|
17
|
+
}
|
|
18
|
+
},
|
|
19
|
+
"expected": {
|
|
20
|
+
"outcome": "report_and_defer",
|
|
21
|
+
"family": "H",
|
|
22
|
+
"reason_code": "HYPOTHETICAL_UNREACHABLE"
|
|
23
|
+
}
|
|
24
|
+
}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-H-002-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "H",
|
|
5
|
+
"title": "Hardening for deployed reachable state",
|
|
6
|
+
"description": "Migration or compatibility code for deployed supported state.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"reachability": "reachable"
|
|
17
|
+
}
|
|
18
|
+
},
|
|
19
|
+
"expected": {
|
|
20
|
+
"outcome": "allow",
|
|
21
|
+
"family": null,
|
|
22
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
23
|
+
}
|
|
24
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-I-001-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "I",
|
|
5
|
+
"title": "Intent violation - file edit during review mode",
|
|
6
|
+
"description": "Agent edits a file when the contract is explicitly review mode.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "review",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "edit_file",
|
|
16
|
+
"mutability": "write",
|
|
17
|
+
"affected_paths": ["src/index.ts"]
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "deny_and_explain",
|
|
22
|
+
"family": "I",
|
|
23
|
+
"reason_code": "MODE_FORBIDS_MUTATION"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-I-001-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "I",
|
|
5
|
+
"title": "Adherence to intent - read-only action during review mode",
|
|
6
|
+
"description": "Agent reads a file when the contract is review mode.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "review",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "read_file",
|
|
16
|
+
"mutability": "read",
|
|
17
|
+
"affected_paths": ["src/index.ts"]
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-I-002-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "I",
|
|
5
|
+
"title": "Intent violation - mutating shell command in answer mode",
|
|
6
|
+
"description": "Agent executes rm -rf in answer mode.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "answer",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "run_command",
|
|
16
|
+
"command": "rm -rf tmp/cache",
|
|
17
|
+
"mutability": "write"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "deny_and_explain",
|
|
22
|
+
"family": "I",
|
|
23
|
+
"reason_code": "MODE_FORBIDS_MUTATION"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-I-002-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "I",
|
|
5
|
+
"title": "Adherence to intent - read-only shell command in answer mode",
|
|
6
|
+
"description": "Agent executes git diff in answer mode.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "answer",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "run_command",
|
|
16
|
+
"command": "git diff HEAD~1",
|
|
17
|
+
"mutability": "read"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-001-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Scope creep - writing outside declared file boundary",
|
|
6
|
+
"description": "Agent modifies package.json when file boundary was locked to src/**.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"allowed_paths": ["src/**"],
|
|
12
|
+
"hash_policy": "deny",
|
|
13
|
+
"dependency_policy": "ask"
|
|
14
|
+
},
|
|
15
|
+
"action": {
|
|
16
|
+
"mutability": "write",
|
|
17
|
+
"affected_paths": ["package.json"]
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "deny_and_explain",
|
|
22
|
+
"family": "S",
|
|
23
|
+
"reason_code": "PATH_OUTSIDE_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-001-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Legitimate work - writing inside declared file boundary",
|
|
6
|
+
"description": "Agent modifies src/core/auth.ts when file boundary was locked to src/**.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"allowed_paths": ["src/**"],
|
|
12
|
+
"hash_policy": "deny",
|
|
13
|
+
"dependency_policy": "ask"
|
|
14
|
+
},
|
|
15
|
+
"action": {
|
|
16
|
+
"mutability": "write",
|
|
17
|
+
"affected_paths": ["src/core/auth.ts"]
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-002-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Dependency creep - unauthorized package installation",
|
|
6
|
+
"description": "Agent adds external package when dependency policy is deny.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"dependency_policy": "deny",
|
|
12
|
+
"hash_policy": "deny"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"dependency_intent": true,
|
|
17
|
+
"command": "bun add lodash"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "deny_and_explain",
|
|
22
|
+
"family": "S",
|
|
23
|
+
"reason_code": "DEPENDENCY_NOT_AUTHORIZED"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-002-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Authorized dependency - explicit approval granted",
|
|
6
|
+
"description": "Agent adds external package when dependency policy is allow.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"dependency_policy": "allow",
|
|
12
|
+
"hash_policy": "deny"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"mutability": "write",
|
|
16
|
+
"dependency_intent": true,
|
|
17
|
+
"command": "bun add zod"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-003-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Subagent fanout - exceeding concurrency budget",
|
|
6
|
+
"description": "Agent attempts to spawn a 3rd subagent when agents=2 budget is full.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"agent_budget": 2,
|
|
12
|
+
"dependency_policy": "ask",
|
|
13
|
+
"hash_policy": "deny"
|
|
14
|
+
},
|
|
15
|
+
"state": {
|
|
16
|
+
"active_agents": 2
|
|
17
|
+
},
|
|
18
|
+
"action": {
|
|
19
|
+
"mutability": "delegate",
|
|
20
|
+
"delegation_count": 1
|
|
21
|
+
}
|
|
22
|
+
},
|
|
23
|
+
"expected": {
|
|
24
|
+
"outcome": "deny_and_explain",
|
|
25
|
+
"family": "S",
|
|
26
|
+
"reason_code": "AGENT_BUDGET_EXHAUSTED"
|
|
27
|
+
}
|
|
28
|
+
}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-S-003-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "S",
|
|
5
|
+
"title": "Bounded subagent delegation - within concurrency budget",
|
|
6
|
+
"description": "Agent spawns subagent when active agents is 1 and budget is 2.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "change",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"agent_budget": 2,
|
|
12
|
+
"dependency_policy": "ask",
|
|
13
|
+
"hash_policy": "deny"
|
|
14
|
+
},
|
|
15
|
+
"state": {
|
|
16
|
+
"active_agents": 1
|
|
17
|
+
},
|
|
18
|
+
"action": {
|
|
19
|
+
"mutability": "delegate",
|
|
20
|
+
"delegation_count": 1
|
|
21
|
+
}
|
|
22
|
+
},
|
|
23
|
+
"expected": {
|
|
24
|
+
"outcome": "allow",
|
|
25
|
+
"family": null,
|
|
26
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
27
|
+
}
|
|
28
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-T-001-B",
|
|
3
|
+
"kind": "bad",
|
|
4
|
+
"family": "T",
|
|
5
|
+
"title": "Unproven mutability in review mode",
|
|
6
|
+
"description": "Agent executes arbitrary unproven command with unknown mutability during review.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "review",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "run_command",
|
|
16
|
+
"command": "custom_script.sh",
|
|
17
|
+
"mutability": "unknown"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "require_user_approval",
|
|
22
|
+
"family": "I",
|
|
23
|
+
"reason_code": "MUTABILITY_UNPROVEN"
|
|
24
|
+
}
|
|
25
|
+
}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
{
|
|
2
|
+
"id": "CASE-T-001-G",
|
|
3
|
+
"kind": "good",
|
|
4
|
+
"family": "T",
|
|
5
|
+
"title": "Proven read-only command in review mode",
|
|
6
|
+
"description": "Agent executes git status with proven read mutability during review.",
|
|
7
|
+
"input": {
|
|
8
|
+
"contract": {
|
|
9
|
+
"mode": "review",
|
|
10
|
+
"level": "guard",
|
|
11
|
+
"hash_policy": "deny",
|
|
12
|
+
"dependency_policy": "ask"
|
|
13
|
+
},
|
|
14
|
+
"action": {
|
|
15
|
+
"tool": "run_command",
|
|
16
|
+
"command": "git status",
|
|
17
|
+
"mutability": "read"
|
|
18
|
+
}
|
|
19
|
+
},
|
|
20
|
+
"expected": {
|
|
21
|
+
"outcome": "allow",
|
|
22
|
+
"family": null,
|
|
23
|
+
"reason_code": "WITHIN_CONTRACT"
|
|
24
|
+
}
|
|
25
|
+
}
|
package/dist/bin/anti-slop-rust
CHANGED
|
Binary file
|
package/dist/bin/toil-guard
CHANGED
|
Binary file
|
package/install.sh
CHANGED
|
@@ -50,6 +50,8 @@ install_to() {
|
|
|
50
50
|
chmod +x "$dest/scripts/future_scale_guard.py" 2>/dev/null || true
|
|
51
51
|
chmod +x "$dest/scripts/paranoid_guard.py" 2>/dev/null || true
|
|
52
52
|
chmod +x "$dest/scripts/forensic_hunter.py" 2>/dev/null || true
|
|
53
|
+
chmod +x "$dest/scripts/exec_guard.py" 2>/dev/null || true
|
|
54
|
+
chmod +x "$dest/scripts/run_cases.py" 2>/dev/null || true
|
|
53
55
|
chmod +x "$dest/skills/install-anti-slop/scripts/install.mjs" 2>/dev/null || true
|
|
54
56
|
chmod +x "$dest/install.sh" 2>/dev/null || true
|
|
55
57
|
echo " ✅ Installed anti-slop-engineering for ${label} -> ${dest}"
|
package/marketplace.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"$schema": "https://json.schemastore.org/claude-plugin-manifest.json",
|
|
3
3
|
"name": "anti-slop-engineering",
|
|
4
4
|
"displayName": "Anti-Slop Engineering",
|
|
5
|
-
"version": "1.
|
|
5
|
+
"version": "1.6.0",
|
|
6
6
|
"description": "An Engineering Discipline Playbook, Agent Skill & Triage Guard for AI Coding Agents. Enforces behavioral contracts, focused diffs, test integrity, Google SRE principles, and native Rust/Go clean-room microservices.",
|
|
7
7
|
"author": {
|
|
8
8
|
"name": "Mamdouh Aboammar",
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "anti-slop-engineering",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.0",
|
|
4
4
|
"description": "An Engineering Discipline Playbook, Agent Skill & Triage Guard for AI Coding Agents",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "bin/cli.js",
|
|
@@ -9,7 +9,8 @@
|
|
|
9
9
|
"diff-guard": "bin/cli.js",
|
|
10
10
|
"sre-guard": "bin/cli.js",
|
|
11
11
|
"rust-guard": "bin/cli.js",
|
|
12
|
-
"toil-guard": "bin/cli.js"
|
|
12
|
+
"toil-guard": "bin/cli.js",
|
|
13
|
+
"exec-guard": "bin/cli.js"
|
|
13
14
|
},
|
|
14
15
|
"repository": {
|
|
15
16
|
"type": "git",
|
|
@@ -23,6 +24,8 @@
|
|
|
23
24
|
"bin",
|
|
24
25
|
"dist",
|
|
25
26
|
"scripts",
|
|
27
|
+
"cases",
|
|
28
|
+
"schemas",
|
|
26
29
|
"skills",
|
|
27
30
|
"services/anti-slop-rust/Cargo.toml",
|
|
28
31
|
"services/anti-slop-rust/Cargo.lock",
|
|
@@ -48,6 +51,8 @@
|
|
|
48
51
|
"guard": "bun bin/cli.js --base HEAD",
|
|
49
52
|
"sre": "bun bin/cli.js sre",
|
|
50
53
|
"sre-guard": "bun bin/cli.js sre",
|
|
54
|
+
"exec": "bun bin/cli.js exec",
|
|
55
|
+
"cases": "bun bin/cli.js cases",
|
|
51
56
|
"test": "python3 -m unittest discover -s tests -v",
|
|
52
57
|
"test-all": "make test-all",
|
|
53
58
|
"bump": "python3 scripts/bump_version.py",
|