promptdojo_

Privilege as code, and the log that survives a sanctions motion — step 8 of 8

Checkpoint

One last thing before we move on. Same surface as a write step — but the lesson doesn't complete until this passes.

Checkpoint: the whole chapter as one gate. A filing packet carries everything the three lessons produced — the routing verdict from the privilege table, the cite-check verdicts, and the review-log entry. Nothing leaves the building unless all three hold.

Write filing_gate(packet) returning a list of failure strings, checked in this order:

  1. packet["route"] doesn't START with "ALLOW""routing: blocked tool". P-101 carries the router's flagged verdict, "ALLOW + 502(d) flag" — the flag is a coverage to-do for a human, not a block, so a flagged allow still files.
  2. any verdict in packet["verdicts"] isn't "KEEP" → one string: "cite-check: N unresolved" (N = count of non-KEEP verdicts)
  3. any of the REQUIRED log fields absent-or-falsy in packet["log"] → one string: "log: missing <comma-joined fields>" (in REQUIRED order)

Empty list means the packet files. The report loop (provided) prints FILE or STOP — with the failures joined by "; ".

Expected output:

P-101: FILE
P-102: STOP — cite-check: 1 unresolved; log: missing signed_by
P-103: STOP — routing: blocked tool

full-screen editor opens — close anytime to keep reading.