Shopify operator tripwire in the fleet implementer's system prompt - #27
Merged
mcarter-astronautdev merged 3 commits intoAug 2, 2026
Merged
Conversation
… system prompt Copied VERBATIM from driver-agents docs/agent-instructions-shopify.md (the canonical source — edit there first, re-copy on the kit bump that ships it). Extends the existing single-quoted --append-system-prompt string, so the static flag reaches every rail that can hold store credentials; the read-only review rails never provision the tool. Verified: YAML parses, the quoted token stays apostrophe-free (claude_args tokenizer constraint), and the copied text is whitespace-normalized byte parity with the canonical blockquote. Pairs with the DRIVER_AGENTS_REF bump to 4d63371 on this branch: the fleet gets the wrapper and its instruction block in one wave. Records the release decision in the changelog: ships as v1.11.0.
…onduct block's self-scoping Adversarial review finding: the conduct text opening the same quoted string self-scopes to human-addressed comments (documented in the SCOPE note as model-interpreted prose), so a model could read the tripwire as inheriting that scope and discount it on the issue rail — the one rail where store credentials are provisioned. The lead-in is kit-side framing, not canonical text; verbatim parity with the canonical blockquote still holds.
…rd, citations Review ran 33 agents; 12 findings survived adversarial verification. Parity with driver-agents docs/agent-instructions-shopify.md @ 4d63371 is byte-exact after whitespace collapse (978 chars both sides) and holds after these edits. Two backtick-safety findings were refuted: shell-quote is a parser, the SDK spawns without shell:true, and the hazard character would be $, of which there are zero. - claude.yml:416 said the tripwire lead-in matters on "the issue rail — the one rail where store credentials are actually provisioned". Wrong, and contradicted by the file 245 lines earlier: the gate at :175 excludes only /code-review, and :170-172 explicitly warns against restating it as the issues event. The newest comment in the file was inviting the exact simplification the older one forbids. - A tripped tripwire was silent. allowedTools has no exit-code mechanism, so a failing Bash call fails a tool call and the job still reports green; the if: failure() surfacing step never fires; and a model that correctly refuses to call anything writes no audit line, so the artifact sink no-ops. Canonical's own rationale asks for a loud failure. Added one sentence to the kit-side lead-in (declared non-canonical at :412-416, so parity is unaffected) telling the model to post a SHOPIFY-TRIPWIRE comment before stopping. - lint.yml: new step asserting claude_args holds exactly 4 single quotes and the system prompt contains no apostrophe or $. One apostrophe typed into canonical upstream silently TRUNCATES the prompt — shell-quote does not throw, every flag still parses, YAML stays valid, actionlint exits 0, and the wave would copy the truncated prompt to 18 branches green. Measured: an apostrophe mid-tripwire drops the exit-3 clause; one in the first sentence drops the whole tripwire. Verified the guard passes here and fires on an injected apostrophe. - Citations: the tripwire is +11 at :403 and the gate-comment fix +1, so claude.yml is 460 -> 477 and every citation at or past the insertion shifts +12, not the +11 the review computed before the last fix. Anchored all six by content rather than arithmetic: :461->:473, :463->:475, :459-465->:471-477, :454-457->:466-469, :450->:462, plus the counts (465->477, 296/465 63% -> 308/477 64%). Reverted rcs.md:41 to 460 instead of advancing it — that paragraph is the v1.9.0 snapshot and 465+190 broke its own 650 arithmetic. - Provenance stamps in both docs claimed verification against a54c91e only; they now record the v1.11.0 re-verification, since that is what makes them true. - READMEs: the re-copy instruction now says to preserve the kit-side lead-in (it was already dropped once inside this PR — the READMEs landed in 267f994 and the lead-in in a later claude.yml-only commit), and documents the no-apostrophe constraint. Release order step 1 now requires re-running the parity check on any DRIVER_AGENTS_REF bump, with the mandatory whitespace-collapse recipe. Deferred to a driver-agents PR (cannot be fixed here without breaking parity): the credential enumeration misses the store credential file, "Do not retry it" collides with the redirectNewHandle guard's own remediation text, and "extend the allowlist with one reviewed line" is false for the argument guards. actionlint clean. Parity re-checked after every edit.
mcarter-astronautdev
force-pushed
the
feat/shopify-tripwire-kit
branch
from
August 2, 2026 04:35
5703d01 to
230a7bb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #26, as coordinated in #26 (comment) — merge into
chore/repin-v1.10.0so the tripwire ships in the same v1.11.0 release as theDRIVER_AGENTS_REFbump it pairs with.templates/github/claude.yml: the canonical tripwire block (driver-agentsdocs/agent-instructions-shopify.md, blockquote only — the rationale footer deliberately stays private) appended VERBATIM inside the existing single-quoted--append-system-promptstring. Same string rather than a second flag, so no repeated-flag last-wins behavior can drop either block. Static flag = reaches every rail that can hold store credentials; review rails never provision the tool.templates/github/README.md: the Shopify-tooling bullet now names the tripwire and its canonical source.README.md: the unreleased-changes paragraph now covers the tripwire and records the decision — this ships as v1.11.0 (content changes get their own tag), then stub repin, then one wave.Verified: YAML parses; the quoted token is apostrophe-free (
claude_argstokenizer constraint); whitespace-normalized parity check against the canonical blockquote passes.