The gate that fired anyway

Description and use

In a PowerShell‑based automation pipeline, the runner mis‑parsed the classifier output, letting destructive tasks run. The fix joined the output into a string and blocked unknown verdicts, preventing accidental execution.

Problem

The acceptance runner allowed destructive tasks to fire because the classifier output was mis‑parsed, letting an unparseable verdict slip through as a safe one.

Outcome

Destructive tasks are now correctly blocked, preventing accidental execution, while safe tasks continue to run.

Workflow

• Register a task with the runner
• Capture classifier output with 2>&1
• Join output into a single string
• Apply regex to extract verdict
• If verdict is destructive, write receipt and exit 3
• If verdict is safe, write receipt and start task
• Unregister test tasks after execution

Evidence

The runner captured the classifier's output with 2>&1, which in PowerShell returns an array of lines, not a string.

Source

The fix was two changes: join the captured output into a string so the regex sees what it was written for, and give unknown its own blocking exit code.

Source