use-case-b

---

name: use-case-b description: The Squeeze Loop instance for Use Case B — an autonomous customer-refund bot that commits a terminal action (REIMBURSE | DENY | ESCALATE) and must resist multi-turn social engineering, on terrain B (authored authority). No external spec exists; the refund policy POL_REFUND_042 is authored upstream from an incident archive by an author who never sees the bot, and author independence is the whole soundness argument. Use when working on src/B — the refund policy, the headless REST app where only POST /action commits a verdict, the customer-history DB, the adjudicated-case archive, the adversarial scenario matrix, or the coherent-and-wrong "handles nominal distress but caves to legal coercion / duplicate-refund manipulation". Trigger phrasings: "use case B", "instance B", "refund bot squeeze", "authored policy / no external spec", "social-engineering resistance", "POST /action commits, chat never commits", "duplicate-refund / legal-coercion adversarial".

Use Case B — the authored-authority refund-bot squeeze loop

Use Case B is a base squeeze loop (instance-b, terrain B): an autonomous customer-refund bot that commits a terminal action and resists conversational coercion. Its SL-1.0 self-description is src/B/instance-b.sl.json; the companion write-up with the diagram is src/B/docs/use-case-b.md.

The dominant failure it guards

Coherent-and-wrong here = a bot that handles nominal distress perfectly but caves to multi-turn legal coercion or duplicate-refund manipulation — committing a money-out verdict the policy forbids because a customer argued well, not because the case merits it.

Terrain B — authored authority

There is no external spec to diff against. The refund policy POL_REFUND_042 (CLAUSE_1 no duplicate, CLAUSE_2 legal → ESCALATE, CLAUSE_3 new high-value → DENY) is authored upstream by a policy author who sharpens a vague corporate mandate ("generously resolve complaints, block exploitation") and never sees the bot. With nothing external to diff against, the soundness load rests on author independence: the policy author, implementer, and exerciser hold disjoint bases that collide over the frozen app, plus the archive's zero-regression invariant.

The bounds

• Upper bound U — the authored refund policy (/opt/squeeze/shared/refund_policy.md). The author's own upper bound is the vague corporate mandate; its lower bound is expressibility — every clause must anchor to a real adjudicated case in the incident archive.
• Lower bound L — the frozen headless REST app + frozen account state + signed case archive. Crucially, only POST /action commits a verdict; plain chat text never commits — the structural reason conversation cannot social-engineer a payout.

The cast (four actors)

Actor	Builds	U	L	Must not see
Gate sentinel (coordinator)	gate verdicts, isolation + archive-regression checks, the .sl.json	policy clauses	every scenario run through the app + archive replay + both bands compared	—
Refund policy author (property author)	the precise policy clauses (the authored U)	the vague corporate mandate	expressibility: each clause anchored to a real archive case	the bot implementation
Refund-bot implementer	the bot decision logic	the policy clauses	session/account state from the app; verdicts committed only via the app	the adversarial matrix
Adversarial exerciser	multi-turn adversarial scenarios + expected terminal actions	the policy clauses, read independently	scenarios driven through the app; expectations anchored to certified archive verdicts	the bot logic

The barrier (physical, not honorary)

Policy author and exerciser never see the bot implementation; the implementer never sees the adversarial scenarios — Unix 0700 homedirs + zero-import linkage. The author cannot write to the policy a behaviour it cribbed from the bot; the exerciser cannot soft-code expected outcomes from the bot's observed behaviour.

The gates

• Gate A (editorial). The plan cites every CLAUSE_X; the sentinel judges, never rubber-stamps.
• Gate B (machine). Each scenario's committed terminal action equals the exerciser's expected action; the certified archive cases replay with zero regression. A money-out decision committed before the dialogue resolves is a forbidden move.
• Gate C (coverage). Every policy clause is exercised by some scenario.

Disjointness

The policy author holds only the mandate and the incident archive (never the bot); the implementer holds the policy and the live app (never the scenarios); the exerciser holds the policy and the archive (never the bot). With no external spec, soundness rests on these author-independent bases colliding over the frozen app plus the archive's zero-regression invariant. Catchability: a vacuous policy clause is caught by the exerciser's independent scenarios (and Gate C); a bot that caves to social engineering is caught by the exerciser's multi-turn legal/duplicate-refund scenarios (Gate B terminal-action mismatch); an underspecified scenario is caught by the sentinel (Gate C coverage + archive replay).

python config/skills/sl-internal/scripts/sl_disjointness_check.py src/B/instance-b.sl.json

(0 FAIL / 11 checks.)