bchanot/claude
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(effort): max at the verify-secure caps and ship-feature 4b; STOP texts suggest /effort-max

Browse Source
This commit is contained in:
bastien
2026-09-28 20:02:56 +02:00
parent a117e7ed67
commit 557e4cc317
4 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/verify-secure-loop.md
+5 -4
View File
@@ -35,7 +35,7 @@ single `GATES — VERDICT:` line:
- `UNMET(n)` → hand the dev the CONTRACT path + the `NOT-MET` rows verbatim,
nothing else; re-run GATE 0. **No verifier is dispatched** — a red build or
a red suite is not a judgement call, and paying an LLM to discover it is
waste. **Max 3 floor iterations** → STOP + human escalation with the rows.
waste. **Max 3 floor iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the rows.
- `ABANDONED(n)` → floor green but a handoff stands. Continue to GATE 1; the
verifier surfaces it and its `ABANDONED(n)` verdict routes to the human
gate.
@@ -74,7 +74,7 @@ Parse its single `VERIFY — VERDICT:` line:
lines (NOT-MET / out-of-scope), nothing else: re-dispatch a FRESH executor
with those inputs only, never redo the fix by hand. Then re-run GATE 0 and
re-dispatch a FRESH verifier. Repeat.
**Max 3 conformity iterations** → STOP + human escalation with the
**Max 3 conformity iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the
CRITERIA table (the contract-vs-realized diff).
- `ABANDONED(n)` → direct human gate, never a dev loop (a dev cannot close
what was proven impossible). The human lifts the abandonment or accepts
@@ -104,8 +104,9 @@ Parse its single `SECURITY — VERDICT:` line:
(re-dispatch a FRESH executor, never fix by hand). Then re-run GATE 0, then
**re-verify the REQUEST first** (GATE 1, fresh verifier) — a security fix
can drift the behavior — **then re-run GATE 2** (fresh auditor), in that
order. **Max 3 security iterations** → STOP + human escalation with the
BLOCKING table.
order. **Max 3 security iterations** → `Skill(effort-max)` (effort-shift: cap reached, diagnose at max before escalating; send it in the same message as the first tool call that gathers the escalation evidence), then STOP + human escalation with the
BLOCKING table. Every STOP text names the level reached (`$CLAUDE_EFFORT`)
and suggests `/effort-max` for the relaunch.
- `DEGRADED` (semgrep absent) → does NOT block on the tool's absence; surface
the checklist result + recommend `make plugin`. A DEGRADED run that still
BLOCKs (grep-caught secret/injection) blocks like any other.