SHRIKETwo Rows Moved on Our Coverage Map
We keep a public coverage map: the 17 agentic attack techniques from the published taxonomies, each with an honest tier. Enforced means an inline control governs the technique before an action executes. Partial means real coverage with a named boundary. Roadmap means we say so. The point of publishing it is that it has to move by shipping, not by rewording. This week it moved twice.
Row one: Tool Rug Pull, partial to enforced
A rug pull is a tool whose definition changes after it was reviewed: the version an operator approved was benign, and a later update quietly swaps the description or parameters. Our schema screen already caught poisoned definitions at connect, and the gateway path already compared each tool listing against what it had seen before. The named boundary was the direct scan path: agents that vet servers themselves, without routing through the gateway, got the screen but not the memory.
Now both paths remember. The first clean sighting of a tool definition is recorded as the trusted baseline; every later sighting is compared against it. A changed definition returns an unsafe verdict with a drift signal and stays held until the operator re-reviews the tool and explicitly accepts the new version. Cosmetic differences, like the same schema re-serialized with keys in a different order, do not raise the alarm; any change to what the tool says it is or what it accepts does. Trust the first sight after screening; verify every sight after that.
Row two: Resource Exhaustion, partial to enforced
An agent driven into a loop that looks like work burns compute, quota, and money at machine speed. A declared scope already bounded how long a task may run; the map honestly said that declarative budget ceilings were roadmap. That line is now shipped for action counts: a scope can declare max_actions, and the scan after the ceiling is held for approval with a resource-exhaustion signal until the operator re-declares. The ceiling is chosen by the operator, reset by re-declaration, and inert for every scope that does not set it.
One honest print from the docs carries over here: the counter is a tripwire, not an invoice. Under horizontal scaling it can overshoot slightly before firing. That trade is deliberate; a ceiling exists to stop a runaway loop, and stopping it a few actions late is a rounding error against not stopping it at all. Spend and token budgets, as opposed to action counts, remain on the map as roadmap.
Why we work this way
Both promotions follow the same pattern as the scope declaration itself: the operator states intent once, and the governance layer turns departures from that intent into governed events. A pinned schema is a declaration about what a tool is; an action ceiling is a declaration about how much work a task should take. The operator declares; Shrike enforces what was declared.
The map still shows six partial rows and one roadmap row, each with its standing layers named. That is the deal we made when we published it: the tiers move when the code does. The current map is here; the scope API, including the new field, is in the agent scope docs.