How to catch out-of-scope coding-agent tasks before execution

说明与用途

ARC 在执行前检测到超出写入范围的文件写入请求，防止未授权的更改。

问题

Coding agents may be given tasks that modify files outside their declared write scope, leading to unauthorized changes.

结果

ARC successfully identifies out-of-scope write requests before execution, preventing unauthorized file modifications.

工作流

• Clone the ARC repository at the pinned v1.0.0 release
• Run npm run demo --silent to execute the bundled example checks
• Observe PASS → FAIL → PASS sequence confirming detection of scope mismatch
• Run the invalid task directly with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task-outside-scope.json --format text to see the explicit failure message
• Run an allowed task with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task.json --format text to confirm PASS
• Integrate the ARC preflight into CI or task dispatch, treating exit codes 1 or 2 as stop conditions

证据

The task conflicts with the declared write scope. The useful response is a deterministic preflight failure, before an agent or tool attempts the write.

来源

The demo reads the packaged example declarations and exercises the actual checker. Its relevant output is: 1. Normal task Scope: src/example.mjs; allowed: src/** PASS: declarations are consistent.

来源

FAIL: explain (declarations only; execution NOT authorized) Accountable: implementer Implementers: implementer Reviewers: reviewer Human approval required: true TASK_WRITE_SCOPE_OUTSIDE_AUTHORITY task/inputs/scope: Task scope is outside declared write scopes for role implementer: secrets/production.txt

来源