Skip to content
Gaunt Sloth Documentation

RATER_ATTACK_GUIDANCE

const RATER_ATTACK_GUIDANCE: string

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/shell/rater.ts:510

The attack half of the rating prompt, kept as its own export because §4.1.1 requires the prompt to carry the structural test in its own words, not merely the one-line table definition.

The reason is worth restating where the prompt author will read it: attack is the only outcome that halts the run, the halt is not negotiable, and from assisted — the default rung for everyone — a non-interactive run has no key at all and the only ways through are an allow-list entry or dropping to bypass, i.e. one step from the default gate to no gate. An outcome that expensive MUST NOT fire on ordinary work, so the test is what the command’s own structure shows, not who it talks to.

Two clauses here are measurements rather than opinions, and neither may be quietly relaxed:

  • Origin trust is not the rater’s job (§4.1.1’s measured note). A cheap model rated curl https://pypi.org.packages-cdn.io/simple/ -o index.html as safe while naming the deception in its own reasoning, and split identically-shaped commands at random. A property that holds only on the good model is not a property, and assisted is the default for people pointed at small local models. curl … | <shell> is therefore destructive whatever the host.
  • Clause (1) is narrowed (§11.1b, 2026-07-28). A secret handed to a tool that is doing some other job is not credential targeting; a secret exposed for its own sake is. Read literally, the un-narrowed clause halted the run on python deploy.py --key $AWS_SECRET_ACCESS_KEY — one of the most ordinary shapes in deployment work, from a section that opens by saying an outcome this expensive must not fire on ordinary work. Nothing is given up: the deterministic hasScriptEnvLeakRisk preflight fires on exactly that shape, annotates this prompt, and forces the fail-closed destructive path in mapVerdictToAction — so a secret in an argument cannot reach safe however the rater rates it. The change trades a halt for a prompt on commands that were never going to auto-approve.