Implement checks independent of the prompt

The code layer must stand alone.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

For each confirm/block rule, implement a deterministic check in the tool-execution path that inspects the actual action (parsed command, target path, flags, destination) - never the conversation text. Examples: destructive git detection (force-push, hard reset, branch deletion) by parsing the command; protected-path validation that refuses removal of system or credential paths regardless of any permission rule; parameter validation that catches dangerous sub-features of allowed tools (a command runner's in-tool execute flags, write-to-file directives inside an editor command). Each check returns allow, ask with a human-readable reason, or deny. Prove independence: run the test suite with the safety prompt entirely removed - every check must still fire.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

Deterministic checks on actions (not text) that pass the prompt-deleted test.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Checks parse the real action, not conversation textEach returns allow/ask/deny with a reasonFull suite passes with safety prompts removed

Do not continue if…

! Prompt-only safety: one bad sample away from a destructive action
! Code-only safety: the model floods the gate with denied attempts because nothing guides it
! Code checks keyed to prompt phrasing, breaking when the prompt is reworded
! Everything denied outright, training users to bypass the agent entirely

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

A check works only when the prompt primes the model to phrase commands a certain way. That is coupling - rewrite the check to parse what will actually execute (post-expansion, post-quoting), because attackers and confused models will not cooperate with your phrasing assumptions.