From a2404adcdeab01ae5b735d358470e45dcbe12087 Mon Sep 17 00:00:00 2001
From: Sujal Maheshwari <sujalmaheshwari07@gmail.com>
Date: Mon, 24 Aug 2026 02:00:06 +0530
Subject: [PATCH] Hold on a missing verdict instead of reloading, and accept a
 token
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The example treated an empty classification as safe to auto-reload. The server
returns "" when it could not classify a change at all — an unreachable or
misconfigured embedding endpoint, say — and publishes anyway, because the
version is durable and the verdict is only advisory. So "" does not mean "safe";
it means nobody checked.

Treating it as safe inverts the gate exactly when it matters: the moment the
safety check breaks, every change sails through unreviewed, and the log looks
identical to a run of harmless edits. A forged notification carries no verdict
either. It now fails closed, and says which case it is hit rather than the bare
"needs review", so an operator can tell "this edit is risky" from "the classifier
is down".

Also: the agent could not authenticate. It built its client with no token, so it
could only ever talk to a server running open — while the whole point of the
example is to stand in for a production agent. It now reads PRIOMPT_TOKEN.

Verified against a live server, all three paths: a minor edit reloads, a
structural edit holds, and with the embedding endpoint unreachable the empty
verdict holds and keeps serving the previous version.
---
 stub-agent.js | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/stub-agent.js b/stub-agent.js
index ea84f9d..14bef41 100644
--- a/stub-agent.js
+++ b/stub-agent.js
@@ -8,16 +8,30 @@
 // hold a structural one. The verdict rides along with the notification, so the
 // decision needs no extra round trip.
 //
-// env: PRIOMPT_HOST (localhost:8443), PRIOMPT_NATS (nats://127.0.0.1:4222)
+// env: PRIOMPT_HOST  (localhost:8443)
+//      PRIOMPT_TOKEN (bearer token, if the server requires one)
+//      PRIOMPT_NATS  (nats://127.0.0.1:4222 — carry the broker credential in the
+//                     url when it needs one: nats://<token>@host:4222)
 
 const { PromptClient } = require("./client");
 
 const HOST = process.env.PRIOMPT_HOST || "localhost:8443";
+const TOKEN = process.env.PRIOMPT_TOKEN || "";
 const NATS = process.env.PRIOMPT_NATS || "nats://127.0.0.1:4222";
 
-// Verdicts an agent may take without a human. Anything else — today that means
-// "structural" — is held.
-const AUTO_RELOAD = new Set(["minor edit", "localized tweak", "new", ""]);
+// Verdicts an agent may act on without a human. Anything else is held.
+//
+// The empty verdict is deliberately NOT in this set. The server returns "" when
+// it could not classify the change at all — a misconfigured or unreachable
+// embedding endpoint, for instance — and it publishes anyway, because the new
+// version is durable and the verdict is only advisory. So "" does not mean
+// "safe"; it means "nobody checked".
+//
+// Treating it as safe inverts the whole point of the gate: the moment the
+// safety check breaks, every change would sail through unreviewed, and it would
+// look exactly like a run of harmless edits. An unauthenticated forged
+// notification carries no verdict either. Fail closed.
+const AUTO_RELOAD = new Set(["minor edit", "localized tweak", "new"]);
 
 // Stand-in values so a rendered prompt looks like a real call.
 const SAMPLES = {
@@ -62,7 +76,7 @@ async function load(client, uri) {
 }
 
 async function main() {
-	const client = new PromptClient({ host: HOST, natsUrl: NATS });
+	const client = new PromptClient({ host: HOST, token: TOKEN, natsUrl: NATS });
 
 	for (const uri of uris) {
 		const v = await load(client, uri);
@@ -86,7 +100,11 @@ async function main() {
 				log("", `  serving: ${render(uri)}`);
 			} else {
 				held.set(uri, version);
-				log("HELD", `${uri}  ${verdict} — needs review`);
+				const why = classification
+					? `${verdict} — needs review`
+					: `no verdict — the server could not classify this change; ` +
+						`check its embedding endpoint`;
+				log("HELD", `${uri}  ${why}`);
 				log("", `  still serving @${short(current && current.version)}, ` +
 					`pending @${short(version)}`);
 			}