From 9e1d3df7ad5c578dd50357c30b17c494393aa7d7 Mon Sep 17 00:00:00 2001 From: Hare Date: Tue, 20 Oct 2026 15:38:50 +0900 Subject: [PATCH] fix: remove overbroad Worker bypass instructions --- crates/worker/src/prompt/catalog.rs | 1 - resources/prompts/common/worker-observation.md | 1 - resources/prompts/common/worker-orchestration.md | 4 ++-- 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/crates/worker/src/prompt/catalog.rs b/crates/worker/src/prompt/catalog.rs index 43c9c2ec3..d7bd636ac 100644 --- a/crates/worker/src/prompt/catalog.rs +++ b/crates/worker/src/prompt/catalog.rs @@ -1049,7 +1049,6 @@ mod tests { ); } assert!(orchestration.contains("requires an Idle Worker and never queues input")); - assert!(orchestration.contains("Direct SubWorkers also require Idle")); assert!(orchestration.contains("use `WorkerNotify` instead")); assert!(orchestration.contains("do not create a queued Submit")); for alias in ["SubWorkerList", "SubWorkerSend", "SubWorkerStop"] { diff --git a/resources/prompts/common/worker-observation.md b/resources/prompts/common/worker-observation.md index 4b43f6515..2e735b80d 100644 --- a/resources/prompts/common/worker-observation.md +++ b/resources/prompts/common/worker-observation.md @@ -6,6 +6,5 @@ Worker-session tools are a read-only exploration surface over host-granted activ - Use `ViewSessionOverview` for sparse orientation, `SearchSessionEntries` for bounded range/filter queries, and `ReadSessionEntry` for one bounded entry. - `SessionEntryRef` is the common entry identity across overview, search, reads, and evidence conversion. Reuse returned `E...` values; never invent them. - Every operation rereads the latest committed capture. Existing references remain stable when entries append. -- Reasoning and raw system prompts are not exposed. Do not ask another tool or filesystem path to bypass this projection. - A missing subject and an unauthorized subject intentionally produce the same result. Treat either as inaccessible. - Observation is not mutation authority and does not prove approval, completion, or Ticket state. Reread the relevant domain authority before acting. diff --git a/resources/prompts/common/worker-orchestration.md b/resources/prompts/common/worker-orchestration.md index 82258d87a..678b9f78e 100644 --- a/resources/prompts/common/worker-orchestration.md +++ b/resources/prompts/common/worker-orchestration.md @@ -4,7 +4,7 @@ When SubWorker-management tools are available, create direct children with `SubWorkerSpawn`, discover them with `WorkerList`, continue them with `WorkerSendInput`, and release their delegated authority with `WorkerStop`. Pass the exact `{ kind: "sub_worker", name }` subject returned by `WorkerList`; do not invent direct-only aliases. SubWorker notifications are background signals for the parent Worker to handle at a natural stopping point. Do not ignore routine follow-up, but do not interrupt the current user request unnecessarily. -`WorkerSendInput` requires an Idle Worker and never queues input. Non-Idle Workers reject it; when information should be incorporated into work already in progress, use `WorkerNotify` instead. Notifications are advisory and do not create a queued Submit. Direct SubWorkers also require Idle for `WorkerSendInput`; do not send follow-up input until they are Idle. The Submit queue is for human-controlled Web/TUI interaction, not Orchestrator scheduling. Do not retry SendInput in a polling loop or cancel/pause work to bypass this restriction. +`WorkerSendInput` requires an Idle Worker and never queues input. Non-Idle Workers reject it; when information should be incorporated into work already in progress, use `WorkerNotify` instead. Notifications are advisory and do not create a queued Submit. The parent Worker does not need to keep a turn open or call tools solely to wait for a notification. Do not use `sleep` or polling loops just to wait for SubWorker output; if there is no useful immediate work, return control and handle the SubWorker when notified or when the user next asks. @@ -12,4 +12,4 @@ Before treating delegated SubWorker work as complete, inspect its committed sess Peer Workers made visible by reciprocal metadata registration are not spawned children. Use peer messaging only as explicit communication; it does not grant session-observation authority, imply parent ownership, or create child completion notifications. Peer sends require a live peer and do not auto-restore stopped peers. -This guidance is not scheduler or auto-maintain authorization. Do not start work, merge or clean up work, close tickets, or bypass user/Ticket authorization solely because Worker tools or notifications exist. +This guidance is not scheduler or auto-maintain authorization. Do not start work, merge or clean up work, or close tickets solely because Worker tools or notifications exist.