Guardian ignores later approvals in child agent runs #2450

When Guardian blocks a child agent's action with ask, a later approval from the user in the root conversation does not clear it. The child retries the same action after the user says yes, and Guardian blocks it again with unresolved_prior_ask. The parent then asks the user to confirm again, and this repeats.

Observed (Oct 30): a child agent updated the title and body of a PR that Junior made.

• 18:40 UTC: github_updatePullRequest returned ask (risk medium, authorization low).
• 18:42 UTC: the user replied "yes you can do that" to the exact proposal in the root conversation.
• 18:43 UTC: the same edit returned ask again, now with authorization high. Reason: "the same PR edit it blocked before, and the user has not confirmed it again since that rejection."
• In the same retry, a +1 on a review comment went through. That action had no earlier rejection.

Root cause (high confidence):

• A child's user intent is the fixed CHILD_AGENT_USER_INTENT (packages/junior/src/chat/agent/index.ts). For Guardian, the intent of a child never changes, so the policy rule "under unchanged user intent, a materially equivalent side effect matches the same rule again" (guardian/policy.ts) always applies.
• The user's messages come only from the root user instructions section (rootConversationSection in guardian/reviewer.ts). It labels each line with its author, but has no time or position.
• The earlier rejection is in the child's own evidence (buildToolActionEvidence over the child's whole history). That evidence has no root messages and no times.
• So Guardian cannot tell if the user's "yes" came before or after the rejection. The parent task says that the approval came later, but parent text is correctly untrusted.

Not in scope: Guardian also asks a child before routine feedback upkeep on a PR that Junior made. That is #2438.

Proposed in discussion: put the root messages and the child's evidence on one timeline, for example with the time that each message was written, so that a later root approval can resolve an earlier ask. Cover it with a Guardian eval in evals/guardian/child-agent-approval.eval.ts.

via David Cramer.

--

View Session [Sentry]