Framework Red Team
Core principle
Semantic compliance is stronger than literal compliance. Use observable evidence and causal history; never collect or demand private chain-of-thought. The goal is correct, safe delivery with sufficient reasoning, followed by termination.
Procedure
- Lock the primary objective, mandatory requirements, Definition of Done, and current evidence before changing any classification or budget.
- Identify the specific observable signal. Do not infer a violation merely from time, token use, discomfort, or a label.
- Act as an adversarial executor, identify concrete exploits, then switch roles and patch each exploit. Compare the current outcome with the previous outcome and preserve causal history across renames, handoffs, replans, and compression.
- Produce the compact record:
exploit, observable trace, violated intent, patch, regression. Mark unsupported claims not confirmed; do not convert confidence into proof.
- Apply one bounded corrective action with an explicit attempt or time limit and exit condition. If a default limit prevents required correctness evidence, use
$executive-override with reason, evidence, exact limit, narrow scope, exit condition rather than resetting a counter.
- Revalidate only the affected requirement or policy. Report
a closed exploit list with a regression for each patch and return to productive work.
Repository runtime
Apply this procedure inside the installed .ai/ framework. Record observable state in the relevant JSON ledger and route detailed judgment to the linked rules and guides.
Semantic boundaries
- System, platform, user, repository, domain, safety, security, permission, and destructive-action controls remain higher priority.
- Equivalent actions share history when their hypothesis, expected evidence, target failure, and intended outcome are unchanged.
- Preserve immutable parent, caused-by, and delegated-from identifiers across handoffs and context compression; missing ancestry makes depth
not confirmed, never zero.
- Activity alone is not progress. Completion and blockers require their structured evidence contracts.
- Critical correctness evidence cannot be discarded because a retry, critic, verification, context, or delegation budget expired.
- Security-negative cases are selected from explicit requirements and the observed trust boundary (identity, permission, ownership/tenant, denial response, and side effects). An agent may mark a case inapplicable only with evidence, not by shrinking Definition of Done.
- An override permits one extension only. Do not renew or stack overrides unless materially new evidence justifies a separately recorded override; repeated renewal without convergence must stop and report the unresolved condition.
Common mistakes
- Continuing red-team speculation without a new executable bypass.
- Expanding the audit into speculative possibilities without an observed trigger.
- Repeating the same check after the relevant state and evidence remain unchanged.
- Restarting the whole task instead of correcting the nearest state mismatch.
Stop condition
Stop this control when the observable state is truthful, the required evidence or classification is restored, and the next audit would inspect unchanged facts. Resume the smallest productive action or, when every mandatory completion row is proven, report and terminate.
1---2name: framework-red-team-23description: Use when an agent-control framework needs adversarial testing for fake productivity, loops, recursion, evidence gaps, or vague wording.4---56# Framework Red Team78## Core principle910Semantic compliance is stronger than literal compliance. Use observable evidence and causal history; never collect or demand private chain-of-thought. The goal is correct, safe delivery with sufficient reasoning, followed by termination.1112## Procedure13141. Lock the primary objective, mandatory requirements, Definition of Done, and current evidence before changing any classification or budget.152. Identify the specific observable signal. Do not infer a violation merely from time, token use, discomfort, or a label.163. Act as an adversarial executor, identify concrete exploits, then switch roles and patch each exploit. Compare the current outcome with the previous outcome and preserve causal history across renames, handoffs, replans, and compression.174. Produce the compact record: `exploit, observable trace, violated intent, patch, regression`. Mark unsupported claims `not confirmed`; do not convert confidence into proof.185. Apply one bounded corrective action with an explicit attempt or time limit and exit condition. If a default limit prevents required correctness evidence, use `$executive-override` with `reason, evidence, exact limit, narrow scope, exit condition` rather than resetting a counter.196. Revalidate only the affected requirement or policy. Report `a closed exploit list with a regression for each patch` and return to productive work.2021## Repository runtime2223Apply this procedure inside the installed `.ai/` framework. Record observable state in the relevant JSON ledger and route detailed judgment to the linked rules and guides.2425## Semantic boundaries2627- System, platform, user, repository, domain, safety, security, permission, and destructive-action controls remain higher priority.28- Equivalent actions share history when their hypothesis, expected evidence, target failure, and intended outcome are unchanged.29- Preserve immutable parent, caused-by, and delegated-from identifiers across handoffs and context compression; missing ancestry makes depth `not confirmed`, never zero.30- Activity alone is not progress. Completion and blockers require their structured evidence contracts.31- Critical correctness evidence cannot be discarded because a retry, critic, verification, context, or delegation budget expired.32- Security-negative cases are selected from explicit requirements and the observed trust boundary (identity, permission, ownership/tenant, denial response, and side effects). An agent may mark a case inapplicable only with evidence, not by shrinking Definition of Done.33- An override permits one extension only. Do not renew or stack overrides unless materially new evidence justifies a separately recorded override; repeated renewal without convergence must stop and report the unresolved condition.3435## Common mistakes3637- Continuing red-team speculation without a new executable bypass.38- Expanding the audit into speculative possibilities without an observed trigger.39- Repeating the same check after the relevant state and evidence remain unchanged.40- Restarting the whole task instead of correcting the nearest state mismatch.4142## Stop condition4344Stop this control when the observable state is truthful, the required evidence or classification is restored, and the next audit would inspect unchanged facts. Resume the smallest productive action or, when every mandatory completion row is proven, report and terminate.
ihabkhaled