Loading ToolBench
Consensus Hardening Protocol — Profile B capital gate, canonical JSON, and signed audit ledger for TypeScript
CHP Adapter exposes 5 tools with domain-specific cryptographic and policy-evaluation logic. All tools have descriptions (10 - 200 chars, within baseline 34 - 392 range) and input schemas with type declarations. However, schemas use generic 'unknown' types for payload parameters, defeating type safety. Descriptions lack LLM-optimized guidance on WHEN to call each tool or what downstream actions follow. No output schemas documented. Error handling is minimal, responses are bare JSON with no recovery guidance. Tool names are verb-noun compliant (canonical_json, evaluate_gate, approve_human) but lack parameter-level descriptions in the visible schema. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles (READ_ONLY vs WRITE). Composition is sound, each tool has one responsibility, but the interface assumes domain expertise; a naive LLM would struggle to chain these correctly.
Promote HITL_REQUIRED to LOCKED (spec §6.5). Re-runs full evaluation — approval may cross the HITL threshold, never the hard rules.
CHP canonical JSON (spec §3.1) with recursive lexicographic key sort, no insignificant whitespace, UTF-8 literals, NaN/Infinity rejection, and array order preservation
Generate chain hash from previous signature and entry
Generate SHA256 hash of canonical JSON payload
Evaluate a capital-moving action against policy (spec §6.3). Hard violations are collected first → BLOCKED. Only a clean action reaches the HITL threshold test (inclusive: notional == threshold requires a human).
Input schemas use 'unknown' type for payload/entry/action/policy parameters, defeating type safety and forcing LLMs to guess structure. Should declare explicit object/array schemas with required fields.
No output schemas documented. LLMs cannot predict return structure (e.g., does evaluate_gate return {status, reason, threshold_met}?). Blocks downstream tool chaining and forces trial-and-error.
Tool annotations missing. evaluate_gate and approve_human have clear risk profiles (READ_ONLY vs WRITE) but no readOnlyHint/destructiveHint. Agents cannot distinguish safe from unsafe operations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2026-07-28+ | v2 |
Error handling is minimal. adapter.ts catches exceptions and returns {ok:false, error:msg} with no recovery guidance. 'unsupported op' and generic error messages give LLMs no actionable next steps.
Descriptions lack WHEN/WHY guidance. 'Generate SHA256 hash of canonical JSON payload' does not explain when to call this vs chain_hash, or what downstream tools consume the hash. LLMs must infer intent from context.