Development record
agent_contract enumerates agents/*.md non-recursively, so a prompt filed at agents/<name>/<name>.md is skipped entirely — it draws no trust-contract finding, no canary demand and no changelog demand, which is a silent opt-out of the whole rule by choosing a directory. The flat layout is the documented convention (agents/README.md), so this is a gap rather than a supported layout: either refuse a markdown file found one level down as a misfiled prompt, or walk the tree. Found by adversarial security review of itd-151.
issueresolvedminoriss-2608281948289198
agent_contract enumerates agents/*.md non-recursively, so a prompt filed at agents/<name>/<name>.md is skipped entirely — it draws no trust-contract finding, no canary demand and no changelog demand, which is a silent opt-out of the whole rule by choosing a directory. The flat layout is the documented convention (agents/README.md), so this is a gap rather than a supported layout: either refuse a markdown file found one level down as a misfiled prompt, or walk the tree. Found by adversarial security review of itd-151.
Grounds
- pursued: no prompt escapes the trust contract by its directory; a markdown file under agents/<name>/ outside fixtures/ that record-lint does not name would show it wrong
Frontmatter
| id | iss-2608281948289198 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608281948289198-agent-contract-enumerates-agents-md-non.md
open on GitHub ↗ · commit history ↗
mentions1
- itd-151Five agent prompts read attacker-influenceable input without the itd-5 contract (ruthless-reviewer, security-reviewer, docs-currency-reviewer, intent-auditor, sota-researcher) and agents/ sits outside both lint roots, so no detector exists for the class; the PQ linter (agents/README.md) is the missing detector