The Guardrails of Stonevale

[!NOTE] Status: Content ready · Media: Generated cover and original SVG illustration · Last verified: 2026-09-05
Primary capability: Constraining authority and risky operations

[!TIP] Download this learner kit and use the extraction and setup guide. Keep the original starter untouched.

---
config:
  theme: base
  look: classic
  themeVariables:
    darkMode: false
    background: "#ffffff"
    primaryColor: "#f5f5f5"
    primaryTextColor: "#111111"
    primaryBorderColor: "#555555"
    secondaryColor: "#e0e0e0"
    secondaryTextColor: "#111111"
    secondaryBorderColor: "#666666"
    tertiaryColor: "#bdbdbd"
    tertiaryTextColor: "#111111"
    tertiaryBorderColor: "#444444"
    lineColor: "#444444"
    textColor: "#111111"
    mainBkg: "#f5f5f5"
    nodeBorder: "#555555"
    clusterBkg: "#ffffff"
    clusterBorder: "#999999"
    edgeLabelBackground: "#ffffff"
    actorBkg: "#e0e0e0"
    actorBorder: "#555555"
    actorTextColor: "#111111"
    actorLineColor: "#777777"
    signalColor: "#333333"
    signalTextColor: "#111111"
    labelBoxBkgColor: "#f5f5f5"
    labelBoxBorderColor: "#777777"
    labelTextColor: "#111111"
    loopTextColor: "#111111"
    activationBkgColor: "#bdbdbd"
    activationBorderColor: "#555555"
    noteBkgColor: "#f5f5f5"
    noteTextColor: "#111111"
    noteBorderColor: "#777777"
    attributeBackgroundColorOdd: "#f5f5f5"
    attributeBackgroundColorEven: "#e0e0e0"
---
flowchart LR
    accTitle: The Guardrails of Stonevale capability map
    accDescr: A deterministic function can check syntax without executing it. Its passing tests do not establish a production command sandbox.
    X["External text or proposed command"] --> P["Parse as untrusted data"]
    P --> D{"Exact allowed form?"}
    D -->|No| R["Reject explicitly"]
    D -->|Yes| A["Return allowed decision"]
    A -. "Separate integration" .-> H["Reviewed lifecycle hook"]

Legend. Solid arrows are local policy evaluation. The dashed edge marks an optional integration that this verifier does not install.

Explanation. A deterministic function can check syntax without executing it. Its passing tests do not establish a production command sandbox.

Official references

These official sources are the authority for product behavior and availability. Recheck them when using a different surface or after a product update.

• Agent hooks in VS Code — Preview
• Hooks reference
• GitHub Copilot hooks

Story

Stonevale’s bridges are safe because gates, weight limits, and sentries contain mistakes before they reach the abyss.

The fantasy is a memory aid; the engineering lesson requires observable, reproducible evidence.

Learning objectives

• Implement an allowlist for the two permitted local Node commands.
• Reject operators, traversal, absolute paths and extra arguments as data without executing them.
• Explain the difference between an instructional rule, a policy function and a live hook.

Prerequisites

For tools and personal accounts, complete the prerequisites guide. For terminal-only study, follow the extracted-kit CLI route; VS Code-specific evidence remains separate.

Evidence boundary: This function is not installed as a live hook. Hook support is Preview and any installation requires a separate reviewed configuration.

Estimated session: 45–75 minutes after prerequisites; actual duration varies. Never use production secrets or customer data.

Concept explanation

Guardrails combine host permissions, tool restrictions, repository protections, scoped credentials, deterministic checks, and human review. Instructions improve behavior but are not a security boundary. Treat external content and tool output as untrusted data. Never expose secrets. Hooks can add deterministic lifecycle checks where supported, but such behavior may be Preview and must be labeled and tested.

Concrete use case

The policy receives a command string and returns a decision. A string containing shell operators is a rejected test input, never a command this exercise asks you to run.

Vocabulary checkpoint

• Role: Ask, Plan, Agent, or a custom agent.
• Harness/surface: the runtime or product surface in which a role operates.
• Target: the selected session destination, such as Local, Copilot, or Cloud where exposed.
• Environment: the folder, worktree, local machine, Codespace, or remote environment.
• Instructions: automatically applied durable context.
• Prompt: a manually invoked task template.
• Skill: reusable expertise loaded when relevant.
• Custom agent: a role with instructions, tools, and optional handoffs.
• MCP: Model Context Protocol.
• Evidence: a path, diff, command result, trace, or review decision.

Ask → Plan → Agent workflow

Ask — investigate

1. Identify the real user outcome and current source of truth.
2. Inspect relevant files, instructions, tools, permissions, and existing checks.
3. Cite concrete paths or platform evidence for every important finding.
4. Record uncertainty and do not infer unavailable capabilities.

Gate: No implementation until the current state and evidence are understood.

Plan — design

1. State scope, non-goals, assumptions, risks, and trust boundaries.
2. Select the minimum role, tools, authority, and environment.
3. Define acceptance criteria, verification commands, review, and reset.
4. Mark any Preview or experimental dependency and provide a fallback.

Gate: Another learner should be able to predict completion from the plan.

Agent — execute

1. Make the smallest reversible change or produce the planned artifact.
2. Use short inspect → change → verify loops.
3. Preserve command output, exit status, diffs, traces, or platform records.
4. Stop when acceptance criteria are met; do not perform unrelated cleanup.

Review — challenge

1. Inspect the complete diff or artifact.
2. Compare each result with the plan and acceptance criteria.
3. Run the narrowest relevant existing check, broadening only when justified.
4. Record limitations and unresolved risks.
5. Score the work with rubric.md.

Guided mission

1. Prepare one isolated copy

1. Download and extract the stonevale-guardrails kit into a new work-drive directory.
2. Read KIT-START.md at its root. Open starter/ as the VS Code workspace when testing discovery, but run the verifier from the kit root.
3. Inspect starter/guard.js, verify.js before editing.
4. From the extracted kit root, run node verify.js.
5. Record the documented starter rejection. A missing runtime or unrelated crash is not the expected exercise result.

2. Investigate and plan

Copyable baseline command, from the extracted kit root:

node verify.js

In Ask, request a trace of the inspected files and what the verifier actually observes. Challenge any claim about live execution that is not supported by output.

Use this planning prompt:

Specify exact allowed executable/script pairs and all rejected forms. Keep test inputs as strings; implement no shell execution. State the boolean behavior for empty and wrong-type input.
Do not implement yet. Identify affected files, the negative case and a safe reset.

3. Implement the reviewed slice

1. Approve only the named starter artifact and necessary focused tests.
2. Ask Agent to implement one slice; inspect proposed commands before execution.
3. Run node verify.js again from the kit root, or node ../verify.js from starter/.
4. Compare the exact result with the checkpoint below and review the complete diff.
5. Record host discovery or live activity separately when available. Do not enable extra services to manufacture a passing result.

[!IMPORTANT] Checkpoint: Only the two named scripts are allowed; the supplied unsafe strings are rejected without execution. This function is not installed as a live hook. Hook support is Preview and any installation requires a separate reviewed configuration.

4. Prove a check can reject a mistake

Temporarily allow an extra argument and confirm the corresponding case fails. Restore the allowlist.

Finish with the adventure-specific capability evidence in the rubric, not just the presence of a file.

Intentional failure: The Friendly Scroll

Perform this only in a disposable environment:

Let an overprivileged agent process instruction-like issue text without marking it untrusted. The trust boundary collapses and unrelated tool actions become possible.

Recovery

Return to Ask, identify the violated boundary, narrow the plan, remove unnecessary authority or context, and repeat the smallest relevant verification. Document the causal lesson rather than merely stating that the attempt failed.

Independent challenge

Design guardrails for dependency updates that forbid publishing, secret rotation, deployment, and merging.

Constraints:

• Do not copy the guided mission verbatim.
• Do not add tools, permissions, or cloud resources without a stated need.
• Do not claim quality, performance, compatibility, or availability without executed evidence.
• Keep fantasy language subordinate to technical clarity.

Evidence checklist

• Source-grounded Ask findings.
• Approved plan with scope, non-goals, risks, checks, and reset.
• Agent diff or artifact limited to the declared scope.
• Verification output with command, status, or platform record.
• Intentional-failure root cause and recovery.
• Independent challenge result.
• Explicit limitations and feature-status notes.
• Completed rubric.md.

Reset instructions

1. Save your diff, command output and limitations from the disposable kit.
2. Stop only the process or learning session you started. Do not stop other projects.
3. If you initialized Git in the kit, inspect git status --short there and restore only your named exercise files from its local baseline.
4. Otherwise, extract the original ZIP into a new unused directory for another attempt; do not overwrite your current work.
5. Remove only exercise-owned configurations, worktrees or remote resources after reviewing anything worth preserving.

The curriculum source and other projects must remain unchanged. A reset of the copied kit is not a repository-wide hard reset.

Next adventure

The MCP Cartographer