Skip to content
Gaunt Sloth Documentation

RATER_DECEPTION_GUIDANCE

const RATER_DECEPTION_GUIDANCE: string

Defined in: _worktrees/docs-release/gaunt-sloth/packages/core/src/core/shell/rater.ts:583

EXT-61 (spec §4.6.1) — deception becomes a REPORT and an upgrade, never a gate.

This is the rater-side half of the open-world preflight, and it exists because the preflight changed what the rater’s hostname judgement is for. §4.6 floors every command that names a host at destructive before the rater is called, so that judgement no longer stands between a typosquat and execution. Its job is now to tell the user what it sees.

The error costs invert, and that is the point. A missed deception costs a warning rather than a bypass; a wrongly-suspected one costs a sentence rather than a halted run. That is the correct place to put a judgement neither models nor humans perform reliably — §4.1.1’s measurement is a cheap model rating a lookalike host safe while naming the deception in its own reasoning, and a working developer who did not discriminate hostnames in either direction.

Both halves are normative and neither may be softened into the other:

  • (1) Always report it, naming the mechanism, even when the outcome stays destructive. The “even when” is the whole clause; a rater that only names a typosquat when it is halting the run reports nothing on the commands this preflight was built for, since they all land on destructive.
  • (2) Upgrade to attack only when the deception is CLEAR, resolving uncertainty downward to destructive with the doubt stated. §12.1 is the reason: a halt that fires is already more likely wrong than right, so it must be spent only where the structure is unambiguous.

CFG-28 deliberately left (2) out of the prompt, on the reasoning that it presumes the §4.6 floor. The scoping call was right and the reasoning was not: at both rated rungs a destructive outcome escalates anyway, so the clause would have cost nothing had it landed early. The floor is what makes the destructive half of §4.6.1 meaningful, not what gates the upgrade.

[[EXT-106]] — this text is FALSE for a carved command, which is why there are two of them. Its first two sentences assert that a floor already fired and that the rater’s hostname judgement is therefore no longer what stands between a typosquat and execution. Where §4.6’s carve-out lifted the floor on the user’s own words, both are backwards — and a prompt that told the rater its judgement did not matter, on the one command where it is the last line, would be worse than saying nothing. RATER_DECEPTION_GUIDANCE_CARVED says the opposite thing; the two rules of §4.6.1 are identical in both.