neuron-technologies/neuron
3
0
Fork 0
Code Issues 44 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

Engine suspends on every tool even when require_approval:false — non-interactive callers get a silent no-op that reports tools_used #125

New Issue
Open
opened 2026-08-06 23:20:37 +00:00 by tim.lingo · 0 comments
tim.lingo commented 2026-08-06 23:20:37 +00:00
Member
Copy Link
Copy Source

Found 2026-08-06 by measurement, while wiring the July AgentAcceptanceHarness into the round-9.1 gate — not by reading code.

The shipped brain suspends on every tool call even when the client explicitly sends require_approval: false. Observed response to an agentic send with require_approval:false:

{"tool_pending":true, …, "tools_used":["write_file","write_file","run_command"]}

…with an empty workspace — nothing executed. The caller is expected to drive an approval loop it explicitly opted out of.

Why it matters beyond the harness: any non-interactive caller (test rig, routine/automation, dispatch surface, CI) that sets require_approval:false gets a silent no-op that looks like a completed turn — tools_used is populated, so a naive caller reports success while nothing happened. This is the false-receipt shape neuron#79/#100 set out to kill, arriving from the consent side instead.

Context that makes it surprising: 9a6014d ("honor require_approval — the pause contract, implemented") is in this brain's lineage — the round-9 build is main + 7 commits and contains it. So either the flag is not read on this path, or the pause contract's semantics deliberately ignore it and the docs/callers disagree. Worth your read before anyone "fixes" it in the wrong direction.

Evidence: round-9 packaged brain, sha256 15cf7d1b…, booted on a scratch HOME + free port from the DMG-extracted binary. The harness now drives the approval loop (bounded at 12 rounds) as a workaround so the suite can run at all; that workaround should be deleted once this is settled.

What done looks like: require_approval:false executes read-tier/in-workspace tools without suspending, or the flag is formally removed and every caller updated — but not the current silent middle.

**Found 2026-08-06 by measurement, while wiring the July `AgentAcceptanceHarness` into the round-9.1 gate — not by reading code.** The shipped brain suspends on **every** tool call even when the client explicitly sends `require_approval: false`. Observed response to an agentic send with `require_approval:false`: ``` {"tool_pending":true, …, "tools_used":["write_file","write_file","run_command"]} ``` …with an **empty workspace** — nothing executed. The caller is expected to drive an approval loop it explicitly opted out of. **Why it matters beyond the harness:** any non-interactive caller (test rig, routine/automation, dispatch surface, CI) that sets `require_approval:false` gets a silent no-op that *looks* like a completed turn — `tools_used` is populated, so a naive caller reports success while nothing happened. This is the false-receipt shape neuron#79/#100 set out to kill, arriving from the consent side instead. **Context that makes it surprising:** `9a6014d` ("honor require_approval — the pause contract, implemented") is in this brain's lineage — the round-9 build is `main` + 7 commits and contains it. So either the flag is not read on this path, or the pause contract's semantics deliberately ignore it and the docs/callers disagree. Worth your read before anyone "fixes" it in the wrong direction. **Evidence:** round-9 packaged brain, sha256 `15cf7d1b…`, booted on a scratch HOME + free port from the DMG-extracted binary. The harness now drives the approval loop (bounded at 12 rounds) as a workaround so the suite can run at all; that workaround should be deleted once this is settled. **What done looks like:** `require_approval:false` executes read-tier/in-workspace tools without suspending, or the flag is formally removed and every caller updated — but not the current silent middle.
tim.lingo added the BETA-CRITICAL label 2026-08-07 13:51:51 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
BETA-CRITICAL
On the beta critical path — must resolve before ship
 blocks-public-beta
Must be fixed before any public beta
 HELD
Blocked pending an external decision (counsel / dual sign-off)
 ORTHOGONAL
Parallel workstream (testing/hardening) — safe to assign off critical path
 P0
Drop-everything severity
 POST-BETA
Important but not blocking the beta ship
 security
Security vulnerability
No labels BETA-CRITICAL
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
andre.almeida (Andre Almeida) tim.lingo (Tim Lingo) will.anderson (Will Anderson)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: neuron-technologies/neuron#125
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?