mapAllowMatchedVerdictToAction
mapAllowMatchedVerdictToAction(
verdict):RaterDecision
Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/shell/rater.ts:2151
EXT-71 §3.2 — the mapping for a call an allow entry already matched while keeping the rater
involved (rate: true). This is a TRIPWIRE, not a re-adjudication, and the difference is the
whole reason it is a separate function from mapVerdictToAction:
| Outcome | Action | Why |
|---|---|---|
safe |
approve | nothing to say |
destructive |
approve | the human already authorized this call; the rater does not overrule a standing human decision by disliking it |
catastrophic |
escalate | a human decides, and per §4.2 that approval is never sticky |
attack |
halt | exactly per §4.2 — the structure evidenced compromise, which no prior grant answers |
The rater’s job on an allow-listed call is to catch the tail where a broad entry matched something structurally hostile — not to re-ask a question the human answered.
The deterministic preflights are deliberately not consulted (preflightFloorReason is
not called). §4.6 states it directly for the open-world arm: an allow match lifts this floor even
when the entry keeps the rater involved — the tripwire still sees the call; the floor does not
apply to it. The script-env-leak arm is lifted with it, and doing so changes no outcome: a
preflight only ever raises safe to destructive, and both of those run here. Applying the floor
would therefore alter nothing except to replace an honest verdict with a note about a decision
this mapping does not make.
Parameters
Section titled “Parameters”verdict
Section titled “verdict”{ outcome: "safe" | "destructive" | "catastrophic" | "attack"; reason: string; suggestedTool?: string; } | undefined
The rater’s verdict; undefined or a fail-closed verdict is destructive and so
runs — the tripwire failing to answer does not revoke the human’s standing decision, exactly as
rate: false would not have asked in the first place.