fix: read a harness tool call as tooling, not as an undeclared action

[rita-aga]

The bug

A conformance check of a clean Claude Code run returned fail with one unknown_action violation per harness tool call — 81 in the run that found it — each reporting that the agent "decided on Bash, which the kernel never recorded a row for; no [[action]] in the CuratorAgent spec defines this name". The rows were clean, evidence_complete was true, the spec was pinned. The verdict was noise, and layer 1 could not return pass for any harness-driven run however conformant.

is_action_name accepted any bare [A-Za-z0-9_.-]+ token, so Bash, Read, Write, Edit, Agent, ToolSearch, SendMessage and every mcp__* tool classified as a claim about a governed action. The existing HarnessTool escape only fired for the Temper MCP envelope, whose choice.action carries a colon and a line of Python.

The rule

A decision is judged as a governed-action claim only when something positively identifies it as one. Two things can:

1. The names under choice.arguments.trajectory_actions. That key means "the governed actions this code called", so every name in it is judged whether or not the kernel recognises it — an envelope naming Frobnicate is exactly the fault to report.
2. A choice.action the new ActionVocabulary contains — a name the actor spec declares, a name the platform defines (KERNEL_PLATFORM_ACTIONS), or a name the kernel dispatched somewhere in this session, on any entity.

Everything else is the agent's own tooling: skipped from the action walk, counted, never reported.

Only rows the kernel wrote while dispatching on an entity (TrajectorySource::Entity) may widen the vocabulary, and caller-named rows on that source (spec_governed = false, from POST /api/audit and the unmet-trajectory endpoint) plus capture-loss markers are excluded on top. Otherwise one record named Bash written into somebody else's session turns every Bash in their run into a violation of a spec they followed. See the review round below — the first version of this filter did not check the source, and that hole was real.

What is not weakened

Kernel rows are untouched. An undeclared action, an illegal source state, a move after a terminal state, a denied-then-retried action — all still caught from the platform's own record, which is where the governance check lives.

On the decision side specifically, these survive and have tests: a platform verb the actor does not declare (forbidden_action), an action the session dispatched on another entity, and every name inside an MCP execute envelope.

Blast radius, precisely: every decision the old rule judged and the new rule skips is one it can no longer report. The only shape where the new rule judges something the old one did not is a bare, action-shaped choice.action that also carries a trajectory_actions list — the old rule took the bare name and ignored the list. No current producer emits that shape.

What this cannot do, and what that costs

A bare Bash and a bare Frobnicate are the same token from the same producer path. Nothing in the record distinguishes a harness tool from an action name the kernel has never seen — a transcript converter writes both as choice.action = <the tool the model called>. So the checker cannot have both "no false violations for harness tools" and "every unplaceable name reported". This is the conservative half, and the module doc says so.

What is given up is one candour signal: an agent that reports reaching for an action which never reached the platform, whose name no spec in the walk declares and which nothing in the session dispatched, is counted rather than reported. The attempt failed before the kernel saw it; what is lost is the record that it was made — not any action that occurred.

Two existing tests encoded that lost case with an invented name; both are rewritten to use a name the kernel can place (Delete), so "decisions still fail a run" stays pinned.

The way to narrow the gap is to add positive identification, never to widen what counts as a name: reading a governed target out of a decision's arguments (as katagami's offline conformance_check.py already does), or giving ActionVocabulary the tenant's other registered specs. Both are additive — they can only move decisions from skipped to judged — which is why the vocabulary is one type with one constructor.

Stats

ots_decisions_skipped_as_harness_tool keeps its exact meaning: an envelope whose name is not even shaped like an action name. The new ots_decisions_skipped_as_unrecognized_name counts the new class, so the two skip reasons stay distinguishable and the checker's blind spot is visible in every report rather than folded into a line that reads as certainty.

Tests

cargo test -p temper-server --lib --features observe — 786 pass, 0 fail, 63 of them conformance.

New coverage: the Bash/Read/Write/Edit/Agent/ToolSearch/SendMessage/mcp__* regression fixture; harness tools interleaved with real declared actions; an undeclared action reached through the harness still reported; an action the session dispatched on another entity still judgeable; the caller-supplied audit row that must not widen the vocabulary; the capture-loss marker that must not either.

Mutation-tested. Restoring the pre-fix rule (bare token wins) fails 7 of the new tests, including the regression fixture — so they pin the behaviour rather than merely accompanying it.

Live verification

A local kernel with the katagami-curation app loaded, driving a real CuratorAgent through ReceiveBrief → BeginDrafting → RecordDraft → SelfReview, then posting a 13-decision Claude Code trajectory (12 harness tools + one declared action) for the same session and calling POST /api/conformance/check:

verdict: pass | passed: True | evidence_complete: True | spec_resolution: pinned
violations: []
  actor_rows                                 = 4
  ots_decisions_checked                      = 0
  ots_decisions_skipped_as_harness_tool      = 0
  ots_decisions_skipped_as_unrecognized_name = 12

A second live run confirms the check was not blunted — a Delete decision the spec never declares is still reported:

kind: forbidden_action, action: Delete
detail: agent decided on `Delete`, which the kernel never recorded a row for;
        the platform defines this action, but the `CuratorAgent` spec does not declare it

Relationship to katagami PR #204

#204 is the producer-side half of the same symptom: the converter writes harness calls as "<harness> tool: <name>" envelopes. It states it does not depend on this change, and the two compose correctly. With #204, those decisions carry a colon and land in ots_decisions_skipped_as_harness_tool — exactly what its evidence table expects; without it they land in the new counter. All five source fragments #204 pins in kernel_decision_contract.json (TRAJECTORY_ACTIONS_KEY, NESTED_ACTION_KEY, the is_action_name signature, and its two character predicates) survive this refactor verbatim, so its kernel contract test still passes.

Known remaining defect, neither PR's scope: a genuine cross-entity governed call (Workspaces('x')/Temper.ResolvePath from a curator run) still reads as unknown_action against CuratorAgent, because the decision path attributes every named action to the actor's own entity while the row path does not. #204 now records the entity set each call drove, so the kernel could read it and skip entries belonging to another actor — a follow-up that depends on #204 landing first.

---

Review round (three fresh-context adversarial reviews, findings closed)

A vocabulary-injection hole, found and fixed (commit 2). The first commit's filter accepted any row not marked spec_governed = false. record_authz_denial writes rows with that flag UNSET, and the unauthenticated POST /api/authorize reaches it with a caller-supplied action name, resource type and X-Temper-Ctx-SessionId. So one call naming action Bash against somebody else's session put Bash in that session's vocabulary and turned every Bash in their clean run into a violation — the exact regression this branch removes, reintroduced against a targeted session.

The filter is now an allowlist of one source, TrajectorySource::Entity, with the spec_governed test kept on top (nothing stops a caller-named audit row claiming Entity). Two new tests, both mutation-checked: reverting to the flag-only filter fails them.

Two claims corrected, one residual named (commit 3). Entity is where the kernel routed a name, not always where it chose one — a Cedar-permitted dispatch of an undeclared action is refused inside the actor and still recorded there. And "every Platform name is already in KERNEL_PLATFORM_ACTIONS" was false (policy_saved, repl_execution).

Residual, deliberately not fixed here and documented beside the filter: the same unauthenticated POST /api/authorize still reaches the ROW walk. Aim its resource_type at the entity type under check and the denial row is judged as the actor's own execution, so its caller-chosen name reports as unknown_action directly, with no vocabulary involved. That is older than this module and untouched by these commits. It is not repaired here because denial rows are judged on purpose — it is how denied_then_retried sees a denial — so changing it is a decision about denial-row provenance, not about how a decision is classified. The two ways to close it (bind that endpoint's session to an authenticated principal, or teach the walk that an Authz row records a question rather than an act) are written down in decisions.rs so the next reader inherits the choice rather than the impression that the class is handled. Worth its own issue.

Final state: 786 tests pass in cargo test -p temper-server --lib --features observe, 63 of them conformance. The push ran the repo's pre-push gates — rustfmt, cargo clippy --workspace -- -D warnings, the readability ratchet, and cargo test --workspace across 99 test binaries — all green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SF1Xhjcg7zG38WjmfC239C

Greptile Summary

This PR distinguishes harness tool calls from governed-action decisions by introducing a deployment-aware action vocabulary and a separate counter for unrecognized names.

• Builds the vocabulary from the checked actor specification, platform actions, and qualifying entity-dispatch rows.
• Skips and counts unrecognized harness names while preserving checks for declared, platform, row-established, and nested trajectory actions.
• Adds regression coverage for harness tools, cross-entity actions, caller-supplied rows, authorization denials, and capture-loss markers.

Confidence Score: 4/5

The PR appears safe to merge, with one non-blocking classification inconsistency for a valid but currently unproduced decision shape.

The harness-tool regression is addressed with narrow vocabulary sources and broad tests, but recognized outer actions bypass nested trajectory_actions despite the module’s contract that all nested governed-action claims are judged.

Files Needing Attention: crates/temper-server/src/conformance/decisions.rs

Important Files Changed

Filename	Overview
crates/temper-server/src/conformance/decisions.rs	Introduces ActionVocabulary and the new decision-classification rules; recognized outer actions currently suppress nested governed-action claims.
crates/temper-server/src/conformance/mod.rs	Wires the vocabulary into decision checking and records the new skip category without changing kernel-row validation.
crates/temper-server/src/conformance/report.rs	Adds a serialized statistic documenting decisions skipped because their names are outside the known action vocabulary.
crates/temper-server/src/conformance/conformance_test.rs	Adds extensive regression coverage for harness calls, nested actions, vocabulary sources, and caller-influenced rows.
crates/temper-server/src/conformance/walk.rs	Initializes the new conformance statistic when converting row-walk state into a report.
crates/temper-server/src/api/trajectory_analysis_test.rs	Updates API-level expectations to use a platform-defined forbidden action rather than an unplaceable invented name.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    D[OTS invocation decision] --> T{Invocation type?}
    T -->|Thought| ST[Count as thinking]
    T -->|Callable| V{Outer action in vocabulary?}
    V -->|Yes| O[Judge outer action]
    V -->|No| N{trajectory_actions present?}
    N -->|Yes| G[Judge nested governed actions]
    N -->|No| S{Outer token action-shaped?}
    S -->|Yes| U[Count as unrecognized name]
    S -->|No| H[Count as harness envelope]
    O --> C[Compare against actor spec and recorded rows]
    G --> C

Loading

Prompt To Fix All With AI

### Issue 1
crates/temper-server/src/conformance/decisions.rs:213-215
**Nested action claims are bypassed**

When a decision has a vocabulary-recognized outer action and also carries `trajectory_actions`, this early return ignores every nested governed-action claim. An undeclared nested action is therefore omitted from the report, contrary to the documented contract that every `trajectory_actions` entry is judged.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: only an entity dispatch may widen t..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[rita-aga]

@greptile review

[greptile-apps]

Nested action claims are bypassed

When a decision has a vocabulary-recognized outer action and also carries trajectory_actions, this early return ignores every nested governed-action claim. An undeclared nested action is therefore omitted from the report, contrary to the documented contract that every trajectory_actions entry is judged.

Prompt To Fix With AI

This is a comment left during a code review.
Path: crates/temper-server/src/conformance/decisions.rs
Line: 213-215

Comment:
**Nested action claims are bypassed**

When a decision has a vocabulary-recognized outer action and also carries `trajectory_actions`, this early return ignores every nested governed-action claim. An undeclared nested action is therefore omitted from the report, contrary to the documented contract that every `trajectory_actions` entry is judged.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.