Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

use-case-b

Sterne0

Forks0

Aktualisiert27. Juni 2026 um 18:09

The Squeeze Loop instance for Use Case B — an autonomous customer-refund bot that commits a terminal action (REIMBURSE | DENY | ESCALATE) and must resist multi-turn social engineering, on terrain B (authored authority). No external spec exists; the refund policy POL_REFUND_042 is authored upstream from an incident archive by an author who never sees the bot, and author independence is the whole soundness argument. Use when working on src/B — the refund policy, the headless REST app where only POST /action commits a verdict, the customer-history DB, the adjudicated-case archive, the adversarial scenario matrix, or the coherent-and-wrong "handles nominal distress but caves to legal coercion / duplicate-refund manipulation". Trigger phrasings: "use case B", "instance B", "refund bot squeeze", "authored policy / no external spec", "social-engineering resistance", "POST /action commits, chat never commits", "duplicate-refund / legal-coercion adversarial".

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

canonical

canonical/squeeze-loop

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

SoftwareentwicklerInformatik- und Mathematikberufe·SOC 15-1252

SKILL.md

readonly

name: use-case-b description: The Squeeze Loop instance for Use Case B — an autonomous customer-refund bot that commits a terminal action (REIMBURSE | DENY | ESCALATE) and must resist multi-turn social engineering, on terrain B (authored authority). No external spec exists; the refund policy POL_REFUND_042 is authored upstream from an incident archive by an author who never sees the bot, and author independence is the whole soundness argument. Use when working on src/B — the refund policy, the headless REST app where only POST /action commits a verdict, the customer-history DB, the adjudicated-case archive, the adversarial scenario matrix, or the coherent-and-wrong "handles nominal distress but caves to legal coercion / duplicate-refund manipulation". Trigger phrasings: "use case B", "instance B", "refund bot squeeze", "authored policy / no external spec", "social-engineering resistance", "POST /action commits, chat never commits", "duplicate-refund / legal-coercion adversarial".

Use Case B — the authored-authority refund-bot squeeze loop

Use Case B is a base squeeze loop (instance-b, terrain B): an autonomous customer-refund bot that commits a terminal action and resists conversational coercion. Its SL-1.0 self-description is src/B/instance-b.sl.json; the companion write-up with the diagram is src/B/docs/use-case-b.md.

The dominant failure it guards

Coherent-and-wrong here = a bot that handles nominal distress perfectly but caves to multi-turn legal coercion or duplicate-refund manipulation — committing a money-out verdict the policy forbids because a customer argued well, not because the case merits it.

Terrain B — authored authority

There is no external spec to diff against. The refund policy POL_REFUND_042 (CLAUSE_1 no duplicate, CLAUSE_2 legal → ESCALATE, CLAUSE_3 new high-value → DENY) is authored upstream by a policy author who sharpens a vague corporate mandate ("generously resolve complaints, block exploitation") and never sees the bot. With nothing external to diff against, the soundness load rests on author independence: the policy author, implementer, and exerciser hold disjoint bases that collide over the frozen app, plus the archive's zero-regression invariant.

The bounds

Upper bound U — the authored refund policy (/opt/squeeze/shared/refund_policy.md). The author's own upper bound is the vague corporate mandate; its lower bound is expressibility — every clause must anchor to a real adjudicated case in the incident archive.
Lower bound L — the frozen headless REST app + frozen account state + signed case archive. Crucially, only POST /action commits a verdict; plain chat text never commits — the structural reason conversation cannot social-engineer a payout.

The cast (four actors)

Actor	Builds	`U`	`L`	Must not see
Gate sentinel (coordinator)	gate verdicts, isolation + archive-regression checks, the `.sl.json`	policy clauses	every scenario run through the app + archive replay + both bands compared	—
Refund policy author (property author)	the precise policy clauses (the authored `U`)	the vague corporate mandate	expressibility: each clause anchored to a real archive case	the bot implementation
Refund-bot implementer	the bot decision logic	the policy clauses	session/account state from the app; verdicts committed only via the app	the adversarial matrix
Adversarial exerciser	multi-turn adversarial scenarios + expected terminal actions	the policy clauses, read independently	scenarios driven through the app; expectations anchored to certified archive verdicts	the bot logic

The barrier (physical, not honorary)

Policy author and exerciser never see the bot implementation; the implementer never sees the adversarial scenarios — Unix 0700 homedirs + zero-import linkage. The author cannot write to the policy a behaviour it cribbed from the bot; the exerciser cannot soft-code expected outcomes from the bot's observed behaviour.

The gates

Gate A (editorial). The plan cites every CLAUSE_X; the sentinel judges, never rubber-stamps.
Gate B (machine). Each scenario's committed terminal action equals the exerciser's expected action; the certified archive cases replay with zero regression. A money-out decision committed before the dialogue resolves is a forbidden move.
Gate C (coverage). Every policy clause is exercised by some scenario.

Disjointness

The policy author holds only the mandate and the incident archive (never the bot); the implementer holds the policy and the live app (never the scenarios); the exerciser holds the policy and the archive (never the bot). With no external spec, soundness rests on these author-independent bases colliding over the frozen app plus the archive's zero-regression invariant. Catchability: a vacuous policy clause is caught by the exerciser's independent scenarios (and Gate C); a bot that caves to social engineering is caught by the exerciser's multi-turn legal/duplicate-refund scenarios (Gate B terminal-action mismatch); an underspecified scenario is caught by the sentinel (Gate C coverage + archive replay).

python config/skills/sl-internal/scripts/sl_disjointness_check.py src/B/instance-b.sl.json

(0 FAIL / 11 checks.)

Mehr aus diesem Repository

gleiches Repository

sl-auditor

canonical/squeeze-loop

Audits an existing Squeeze Loop (SL) for soundness — checking whether a target loop is truly compliant (pairwise-disjoint authority pairs, physically barriered contexts, gate-defined "done", a genuine executable lower bound, and demonstrated catching of coherent-and-wrong) or is quietly collapsing into a rubber stamp. It applies the squeeze's own discipline to the loop under audit: it maps the actual (upper, lower) authority pairs and hunts for an actor certifying its own work; probes whether each context barrier is physical or merely honorary; confirms an executable oracle disjoint from the actor it judges; checks Gate A / Gate B / Gate C are present and load-bearing; seeds coherent-and-wrong artifacts to calibrate the monitors (flag rate not zero, not saturated); audits the loop's accumulated learned skills VIA the sl-monitoring-sl pattern; checks each known collapse mode is blocked by a stabilizer; and routes whatever an internal audit cannot self-certify to a disjoint base (external / cross-provider / hum

2026-06-290

use-case-c

canonical/squeeze-loop

The Squeeze Loop instance for Use Case C — an HTTP API where the document plane (OpenAPI contract) and the runtime plane (live server) are forced into exact lockstep, on terrain C (split planes). The dominant failure is blending — a clean schema masking broken runtime behaviour (id leaks, tracebacks, missing auth), or a clean runtime escaping stale documentation. The exerciser RUNS the live server over HTTP but is physically denied the server source and the published schema (the load-bearing "run, don't read" channel). Use when working on src/C — the API governance policy, the canonical OpenAPI contract, the schema linter, the live server, the conformance test matrix, the legacy route-signature regression oracle, or the no-blend cross-check. Trigger phrasings: "use case C", "instance C", "split planes", "document vs runtime plane", "no-blend", "run don't read", "OpenAPI conformance squeeze", "id leak / missing auth on an untested route".

2026-06-270

use-case-d

canonical/squeeze-loop

The Squeeze Loop instance for Use Case D — formally verified Rocq (Coq) proofs of textbook arithmetic (e.g. commutativity of + on nat), on terrain A with a deductive lower bound (the Rocq kernel). The dominant failure is the prover discharging (Qed.) an adjacent weaker claim under the intended theorem name (e.g. right-identity n+0=n instead of n+m=m+n), or smuggling an axiom. The kernel (coqc) plus the axiom auditor (rocqchk --print-assumptions) is the immutable lower bound none of the actors can alter, and the exerciser authors false-theorem mutations the kernel must reject. Use when working on src/D — the textbook manifest, the formal theorem statement, the tactical proof, the false-theorem mutation matrix, the pinned Rocq stdlib, the prior-proofs regression registry, or the axiom audit. Trigger phrasings: "use case D", "instance D", "Rocq/Coq proof squeeze", "adjacent weaker theorem", "smuggled axiom / Admitted", "mutation must fail to compile", "Closed under the global context".

2026-06-270

sl-builder

canonical/squeeze-loop

Interview a human who wants to build a Squeeze Loop (SL) for their problem, then draft a concrete, structured plan. Elicits the deliverable, the upper bound (soft normative authority — spec/standard/policy/contracts), the lower bound (executable oracle — prover/checker/tests/runtime/reference impl), the actors and their disjoint (U,L) pairs, the context barriers, the gates (A editorial / B machine / C coverage-no-blend), the coherent-and-wrong failure to guard, and the stabilizers/collapse modes to pre-empt — then turns the answers into a roles+bounds+barriers+gates+loop-steps plan. Use when the user says any of: "draft a plan to generate a squeeze loop", "draft an SL validation plan", "build an SL strategy for X", "design a squeeze loop for my problem", "help me set up a squeeze loop", "SL validation plan for C code with Frama-C", "an SL that monitors another SL", "nested squeeze loop / monitor of a monitor". Action-oriented: figure out what is known, ASK the missing interview questions, then OUTPUT a plan i

2026-06-270

sl-monitoring-sl

canonical/squeeze-loop

Specifies how one squeeze loop monitors another squeeze loop — squeezing the monitored loop's soft outputs (especially its accumulated skills / learned heuristics) against that loop's own upper and lower bounds, from an independent evidence base; it classifies a skill by kind (ignore-signal vs defer-to-oracle), runs the matching consistency check, and repairs by carving over-generalized skills with bound-deferring exceptions or pruning spurious ones. Use when a loop accumulates or consolidates skills that may over-reach; when you need a meta-loop or monitor that audits a base loop's learned rules for contradictions with its spec; when a learned heuristic seems to conflict with the governing policy; or when reasoning about the "disjointness principle applied to skills." Trigger phrasings include "a loop monitoring a loop", "monitor the squeeze loop", "check a skill against the upper bound", "the skill contradicts the spec", "carve out an exception", "prune a spurious skill", "who audits the learned skill", "sk

2026-06-260

polish-skill

canonical/squeeze-loop

Polishes an existing SKILL.md file so it triggers reliably, scans well, and preserves every technical claim verbatim from the original; when a deep polish is warranted, it also splits cleanly into a SKILL.md plus reference files. Use whenever the user says "polish this skill", "clean up my skill", "make this skill better", "this SKILL.md is too long", uploads a `SKILL.md` file for polish, or asks for help reorganizing skill content under a `references/` folder. Also use when the user wants their skill checked for the common authoring failure modes: undertriggering descriptions, mis-numbered headings, mis-indented bullets, forward references, dead file paths, mixed cautionary-vs-canonical examples, run-on prose bullets, or a single `SKILL.md` past ~500 lines that should be broken up.

2026-06-210

name: use-case-b description: The Squeeze Loop instance for Use Case B — an autonomous customer-refund bot that commits a terminal action (REIMBURSE | DENY | ESCALATE) and must resist multi-turn social engineering, on terrain B (authored authority). No external spec exists; the refund policy POL_REFUND_042 is authored upstream from an incident archive by an author who never sees the bot, and author independence is the whole soundness argument. Use when working on src/B — the refund policy, the headless REST app where only POST /action commits a verdict, the customer-history DB, the adjudicated-case archive, the adversarial scenario matrix, or the coherent-and-wrong "handles nominal distress but caves to legal coercion / duplicate-refund manipulation". Trigger phrasings: "use case B", "instance B", "refund bot squeeze", "authored policy / no external spec", "social-engineering resistance", "POST /action commits, chat never commits", "duplicate-refund / legal-coercion adversarial".

Use Case B — the authored-authority refund-bot squeeze loop

The dominant failure it guards

Terrain B — authored authority

The bounds

Upper bound U — the authored refund policy (/opt/squeeze/shared/refund_policy.md). The author's own upper bound is the vague corporate mandate; its lower bound is expressibility — every clause must anchor to a real adjudicated case in the incident archive.
Lower bound L — the frozen headless REST app + frozen account state + signed case archive. Crucially, only POST /action commits a verdict; plain chat text never commits — the structural reason conversation cannot social-engineer a payout.

The cast (four actors)

Actor	Builds	`U`	`L`	Must not see
Gate sentinel (coordinator)	gate verdicts, isolation + archive-regression checks, the `.sl.json`	policy clauses	every scenario run through the app + archive replay + both bands compared	—
Refund policy author (property author)	the precise policy clauses (the authored `U`)	the vague corporate mandate	expressibility: each clause anchored to a real archive case	the bot implementation
Refund-bot implementer	the bot decision logic	the policy clauses	session/account state from the app; verdicts committed only via the app	the adversarial matrix
Adversarial exerciser	multi-turn adversarial scenarios + expected terminal actions	the policy clauses, read independently	scenarios driven through the app; expectations anchored to certified archive verdicts	the bot logic

The barrier (physical, not honorary)

The gates

Gate A (editorial). The plan cites every CLAUSE_X; the sentinel judges, never rubber-stamps.
Gate B (machine). Each scenario's committed terminal action equals the exerciser's expected action; the certified archive cases replay with zero regression. A money-out decision committed before the dialogue resolves is a forbidden move.
Gate C (coverage). Every policy clause is exercised by some scenario.

Disjointness

python config/skills/sl-internal/scripts/sl_disjointness_check.py src/B/instance-b.sl.json

(0 FAIL / 11 checks.)