How to catch out-of-scope coding-agent tasks before execution

Описание и применение

ARC позволяет обнаруживать попытки записи файлов вне разрешённого диапазона до выполнения кода, предотвращая несанкционированные изменения.

Задача

Coding agents may be given tasks that modify files outside their declared write scope, leading to unauthorized changes.

Результат

ARC successfully identifies out-of-scope write requests before execution, preventing unauthorized file modifications.

Рабочий процесс

• Clone the ARC repository at the pinned v1.0.0 release
• Run npm run demo --silent to execute the bundled example checks
• Observe PASS → FAIL → PASS sequence confirming detection of scope mismatch
• Run the invalid task directly with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task-outside-scope.json --format text to see the explicit failure message
• Run an allowed task with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task.json --format text to confirm PASS
• Integrate the ARC preflight into CI or task dispatch, treating exit codes 1 or 2 as stop conditions

Доказательства

The task conflicts with the declared write scope. The useful response is a deterministic preflight failure, before an agent or tool attempts the write.

Источник

The demo reads the packaged example declarations and exercises the actual checker. Its relevant output is: 1. Normal task Scope: src/example.mjs; allowed: src/** PASS: declarations are consistent.

Источник

FAIL: explain (declarations only; execution NOT authorized) Accountable: implementer Implementers: implementer Reviewers: reviewer Human approval required: true TASK_WRITE_SCOPE_OUTSIDE_AUTHORITY task/inputs/scope: Task scope is outside declared write scopes for role implementer: secrets/production.txt

Источник