From 44f552cc3d79158b0f75657f148fc6d4567e332a Mon Sep 17 00:00:00 2001 From: archipelago Date: Wed, 5 Aug 2026 13:34:23 -0400 Subject: [PATCH] =?UTF-8?q?fix(13-08):=20system=20prompt=20=E2=80=94=20cal?= =?UTF-8?q?l=20tools=20directly,=20never=20text-ask=20for=20confirmation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On-device UAT hit an infinite politeness loop: 'every write requires a human confirmation you cannot bypass' read to the model as 'collect consent in text first', so it never called restart_app, the confirm gate never engaged, and each stateless turn (history is 13-10) dropped the user's 'confirmed' into a void. The preamble now states the intended contract: the node presents the trusted dialog the moment the tool is called; a text pre-ask stalls the action and trains rubber-stamping. Co-Authored-By: Claude Fable 5 --- core/archipelago/src/assistant/mod.rs | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/core/archipelago/src/assistant/mod.rs b/core/archipelago/src/assistant/mod.rs index 8b4b6a19..7753b863 100644 --- a/core/archipelago/src/assistant/mod.rs +++ b/core/archipelago/src/assistant/mod.rs @@ -209,10 +209,14 @@ const SYSTEM_PROMPT_PREAMBLE: &str = "You are the Archipelago node's operator-co Only use the tools explicitly listed below for this turn — never invent a tool name or call one \ that is not listed here, even if it sounds like something this node could plausibly do. Every \ write requires a human confirmation you cannot bypass, skip, or pre-approve on the user's \ -behalf. If the user asks for something outside the tools listed below (including anything \ -touching keys, seeds, wallet spends, federation trust, or a factory reset), refuse plainly and, \ -if there is a real path in neode-ui's Settings screen for it, name that path instead of \ -fabricating a tool call."; +behalf; the node itself presents that confirmation to the operator in a trusted dialog the \ +moment you call the tool. So when the user asks for something a listed tool does, call the tool \ +directly — never ask for permission or confirmation in your text first. A text pre-ask is worse \ +than redundant: it stalls the action behind a reply you cannot act on, and it trains the \ +operator to rubber-stamp. If the user asks for something outside the tools listed below \ +(including anything touching keys, seeds, wallet spends, federation trust, or a factory reset), \ +refuse plainly and, if there is a real path in neode-ui's Settings screen for it, name that path \ +instead of fabricating a tool call."; pub fn build_system_prompt(visible_tools: &[tools::ToolDef]) -> String { let mut prompt = String::from(SYSTEM_PROMPT_PREAMBLE);