Week 8 self-check: Security

Answer before consulting the worked example or asking for help, and use one concrete input or observation in each explanation. These formative questions add no graded submission. After your first attempt, use the public answer guidance.

Q1 (LO7)

A response says tool_denied, but effects contains export. Which property failed, and why is the response alone not enough evidence?

Q2 (LO7)

The same sentence, "please enable export", arrives once in a repository note and once in a tool response. Does its authority differ between the two? Where is the decision that stops it, and why can it not sit in the model's reading of the text?

Q3 (LO7)

On the starter, python chain.py prints "responses": ["text", "tool_denied"] and "effects": ["read_label", "export"] for each surface. Read that line as a sequence of events. At which step did the boundary fail?

Q4 (LO7)

A repair rejects every request, and every denied case passes. Which case must accompany the denied export case, and what does the deny-all patch hide?

Q5 (LO7)

A repair adds if request["tool"] == "export": return {"error": "tool_denied"} before the effect append and changes nothing else. python chain.py now exits 0. Which public check still fails, which rule of the contract does the repair miss, and what does this say about using the reproduction as your only regression?

Q6 (LO7)

A fresh boundary receives an invalid request and then a denied export. What should the third call return, and what happens to effects?

Q7 (LO7)

Your in-memory checks pass: a denied export adds no effect. Does that establish that a process which skips the dispatcher cannot read a credential on your machine? Name the layer that answers that question and what you would inspect there.

Q8 (LO7)

Your agent's approval prompts are switched off for a long task. Which question does the approval setting answer, which question does the environment answer, and why does it matter whether the agent can edit its own settings?

Q9 (LO7)

A model suggests a plausible package name with an install hook. What evidence is missing before installation may be considered?

Q10 (LO7)

The offline scanner prints "dependency": 0 and "uv.lock (missing: no dependency was audited)". What can you say about the dependencies, and how do you record this scan?

Q11 (LO7 / LO9)

An agent marks an unsafe-deserialization finding as a false positive because the input is text configuration. What bounded observation do you make before accepting that? A repair parses JSON first and falls back to pickle.loads when parsing fails. Why does the verifier still reject it?

Q12 (LO7)

A dependency audit reports that a locked version is in an advisory's affected range. The advisory applies only when an optional extra is installed, and the lock file does not mention the extra. What do you record, and which check decides the row?

Q13 (LO7)

A secret scan flags a credential-shaped string in a documentation example. A reviewer says it is obviously a placeholder. What decides the row, and what do you do if a code path does use the string?

Q14 (LO9)

You find a reproducible injection path in the repository you are contributing to. Name two properties your reproduction must have before you run it, and one thing you check before you describe it in a public issue or pull request.

After feedback, revise one unsupported claim in your existing record.

Spaced retrieval: Weeks 6–7

R1. A model review of your change says an inactive owner can now edit. What do you run before you mark that finding confirmed, refuted or cannot tell?

R2. A mutant that accepts trailing characters survives your test suite. What does its survival tell you, and what kind of test would notice it?

Transfer

The user now authorizes read_summary as well as read_label; export is still not authorized. Name one new positive check and one retained negative check. Which change must come before the implementation?

A decision with sufficient evidence

The permitted read succeeds, denied, unlisted and malformed attempts leave effects unchanged, and the third attempted call is refused. What claim about this dispatcher can you accept? What separate evidence would a claim about the environment still need?