Adversarial review: the fixed bug came back down the error path - #279
Merged
Merged
Conversation
Phase 4 fixed a disclosing tier that fetched the reader's identifiers and then produced the aggregate summary, because nothing told the model to use them. The same outcome was still reachable when the lookup simply failed: no names, no naming instruction, an aggregate summary returned to someone who chose to disclose, and nothing in the stream saying the disclosure had not happened. Fixing the prompt and leaving the error path is how a bug survives being fixed. `start` now carries `disclosure`: the tier the summary was actually built from, which is not always the one requested. A caller can tell the reader their identifiers could not be retrieved instead of presenting an aggregate summary as the disclosing one. Nothing to disclose is deliberately not a failed disclosure. A result where every identifier matched reports `identifiers`, because the tier was honoured and there was nothing to retrieve -- reporting a downgrade there would tell the reader something untrue, which is the failure this is meant to prevent. Three tests: honoured, not honoured, and nothing to honour. Verified by sabotage, with the sabotage asserted to have applied first. Contract updated, and the website needs to know -- they are building against this field's absence today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up review of #278. Builds on it, so merge that first.
The bug Phase 4 fixed was still reachable
Phase 4 fixed a disclosing tier that fetched the reader's identifiers and then produced the aggregate summary, because nothing told the model to use them.
The same outcome was still reachable when the lookup simply failed: no names, no naming instruction, an aggregate summary returned to someone who chose to disclose, and nothing in the stream saying the disclosure had not happened.
Fixing the prompt and leaving the error path is how a bug survives being fixed.
What changed
startnow carriesdisclosure— the tier the summary was actually built from, which is not always the one requested:A caller can tell the reader their identifiers could not be retrieved, instead of presenting an aggregate summary as the disclosing one.
Nothing to disclose is deliberately not a failed disclosure. A result where every identifier matched reports
identifiers, because the tier was honoured and there was nothing to retrieve — reporting a downgrade there would tell the reader something untrue, which is the failure this is meant to prevent.Three tests: honoured, not honoured, nothing to honour. Verified by sabotage, with the sabotage asserted to have applied first.
The website needs to know
They are building the proxy route against this field's absence today. I will tell them, and it is additive — a caller ignoring it behaves exactly as before.
603 passed, 1 skipped; mypy over 151 files, ruff clean.
🤖 Generated with Claude Code