Skip to content

Constitution command: scope ambiguity allows unintended feature execution; add explicit guard #896

Description

@hmanicka

Summary
Invoking /speckit.constitution with additional feature or implementation directives (e.g., “deliver a Todo app”) can cause the agent to both amend the constitution and generate application code in the same run. This couples governance changes with feature implementation and reduces auditability.

Current Behavior
If the operator runs a single message like:

/speckit.constitution Deliver a minimal, production‑style, React Router v7 Todo application

the agent may (depending on model interpretation) both:

  1. Update constitution.md
  2. Implement new application routes/components

Expected Behavior

The constitution command should:

  • Perform only constitution update + template sync.
  • Extract any non-constitution intents and present them as suggested follow-up commands (e.g., /speckit.specify ..., /speckit.plan ...).
  • Never modify app source files directly.

Reproduction Steps

  1. Use a project with an unfilled or editable constitution.md template.
  2. Run the mixed directive shown above.
  3. Observe that new source files may be created in addition to constitution edits.

Impact

  • Harder to review governance-only changes.
  • Risk of unintentional code churn in regulated or audited environments.
  • Inconsistent behavior (sometimes only constitution updates; other times dual action).

Root Cause
Prompt lacked an explicit single-task scope guard, allowing the LLM to merge independent imperatives.

Proposed Solution (Implemented and Tested Locally)
Added a SCOPE GUARD section to speckit.constitution.prompt.md:

  • Forbids executing extra feature/code intents.
  • Introduces an “extra intent extraction” heuristic.
  • Adds a “Next Actions” section after constitution update summarizing suggested follow-up commands.

Example After Patch
Input:

/speckit.constitution Deliver a minimal, production‑style, React Router v7 Todo application

Output:

  • Constitution updated only.
  • “Next Actions”:
    • Intent: Deliver a minimal, production‑style, React Router v7 Todo application
    • Suggested Command: /speckit.specify minimal React Router v7 Todo application

Acceptance Criteria

  • Mixed instruction invocation changes only constitution + synced templates.
  • Extra intents listed; no feature code added.
  • Guard text appears in prompt file.
  • Maintainers confirm phrasing aligns with template style.

speckit.constitution.prompt.md

Follow-Up Recommendations

  • Propagate similar guard to /speckit.plan, /speckit.specify, /speckit.tasks.
  • Optionally add regression test harness for prompt behavior.

AI Assistance Disclosure

The issue text and the new SCOPE GUARD / intent extraction guard wording were generated with assistance from an AI coding agent and then human‑reviewed and validated.

Metadata

Metadata

Assignees

Fields

No fields configured for Feature.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions