Overview
The Quality Bypass Enforcer Agent operates as an L3 Strategic Command authority within the Prismatic Platform, serving as a Generation 15 apex security enforcement agent responsible for detecting and preventing any attempt to bypass the platform's quality enforcement mechanisms. In a system governed by the NO MERCY doctrine where quality compliance is mandatory, the bypass enforcer is the agent that ensures the enforcement infrastructure itself cannot be circumvented, disabled, or degraded.
Quality bypass attempts can take many forms: direct flag usage (--no-verify), environment variable manipulation, configuration file modification, hook script disabling, or subtle code changes that effectively neutralize quality checks while appearing to comply. This agent monitors all pathways through which quality enforcement could be weakened and blocks bypass attempts before they compromise the platform's quality guarantees.
Built on the AIAD standard, the bypass enforcer operates with strategic command authority specifically because bypass prevention requires cross-domain visibility. A bypass attempt in one domain may exploit a weakness in another domain's enforcement infrastructure. The agent applies the NO DOUBTS principle to bypass detection: every flagged bypass attempt is backed by specific evidence of the enforcement circumvention mechanism, preventing false positives from disrupting legitimate development workflows.
Bypass Detection Architecture
The enforcement architecture operates through continuous monitoring of multiple bypass vectors simultaneously.
Git hook integrity monitoring verifies that pre-commit, commit-msg, and pre-push hooks remain intact and unmodified. The agent maintains cryptographic hashes of authorized hook scripts and detects any modification, replacement, or removal. Hook bypass flags (--no-verify) are detected through process argument monitoring and blocked with immediate alerting.
Configuration integrity monitoring tracks quality-related configuration values across mix.exs, config/, and .credo.exs files. Changes that relax quality thresholds, disable checks, or alter enforcement behavior trigger review requirements. This prevents gradual quality erosion through incremental configuration drift.
Environment manipulation detection monitors for environment variables that could disable quality enforcement, such as MIX_ENV manipulation to skip test-only enforcement, CI flag spoofing to trigger different enforcement paths, or custom environment variables designed to disable specific quality checks.
Code-level bypass detection uses static analysis to identify code patterns that effectively circumvent quality requirements. Examples include wrapping quality-failing code in conditional compilation blocks, adding broad @dialyzer suppressions, or introducing rescue-all clauses that swallow quality check failures.
Key Capabilities
- Multi-vector bypass detection -- Monitors git hooks, configuration files, environment variables, and code patterns simultaneously to detect bypass attempts regardless of the circumvention technique used
- Cryptographic hook integrity -- Maintains hash-verified integrity of all quality enforcement hooks, detecting any unauthorized modification with zero tolerance
- Configuration drift prevention -- Tracks quality-related configuration values across the entire platform, blocking changes that would weaken enforcement without proper authorization
- False positive prevention -- Applies evidence-based bypass classification to distinguish between legitimate development activities and actual bypass attempts, minimizing workflow disruption
- Escalation protocols -- Bypasses are classified by severity and escalated through appropriate channels, from automated warnings for minor deviations to supreme-level alerts for deliberate circumvention attempts
- Autonomous operation with continuous monitoring and automatic remediation of detected bypass conditions
- Telemetry integration for bypass attempt frequency tracking and enforcement health metrics
Bypass Classification Matrix
| Category | Severity | Examples | Response |
|---|---|---|---|
| Flag Bypass | Critical | --no-verify, --no-check | Immediate block + L4 escalation |
| Hook Tampering | Critical | Hook deletion, modification, or replacement | Automatic restoration + alert |
| Config Drift | High | Relaxed thresholds, disabled checks | Block + review required |
| Environment Manipulation | High | MIX_ENV spoofing, CI flag manipulation | Detection + block |
| Code-Level Circumvention | Medium | Broad @dialyzer suppression, rescue-all clauses | Flag for review |
| Indirect Weakening | Medium | Dependency updates that reduce check strictness | Impact analysis + alert |
Implementation Architecture
defmodule PrismaticSafety.BypassEnforcer do
@moduledoc """
Monitors and prevents quality enforcement bypass attempts
across all enforcement vectors with zero tolerance.
"""
use GenServer
require Logger
@hook_hashes %{
"pre-commit" => "sha256:...",
"commit-msg" => "sha256:...",
"pre-push" => "sha256:..."
}
@forbidden_flags ["--no-verify", "--no-gpg-sign", "--no-check"]
@type bypass_event :: %{
vector: atom(),
severity: :critical | :high | :medium | :low,
evidence: String.t(),
timestamp: DateTime.t(),
remediation: atom()
}
@spec check_hook_integrity() :: :ok | {:bypass_detected, bypass_event()}
def check_hook_integrity do
Enum.reduce_while(@hook_hashes, :ok, fn {hook, expected_hash}, :ok ->
case verify_hook_hash(hook, expected_hash) do
:ok -> {:cont, :ok}
{:mismatch, actual} ->
event = %{
vector: :hook_tampering,
severity: :critical,
evidence: "Hook #{} hash mismatch: expected #{}, got #{}",
timestamp: DateTime.utc_now(),
remediation: :restore_and_alert
}
{:halt, {:bypass_detected, event}}
end
end)
end
@spec scan_forbidden_flags([String.t()]) :: :ok | {:bypass_detected, bypass_event()}
def scan_forbidden_flags(args) do
case Enum.find(args, &(&1 in @forbidden_flags)) do
nil -> :ok
flag ->
{:bypass_detected, %{
vector: :flag_bypass,
severity: :critical,
evidence: "Forbidden flag detected: #{}",
timestamp: DateTime.utc_now(),
remediation: :block_and_escalate
}}
end
end
endEnforcement Pipeline
Continuous Monitoring Loop
|
+---> Git Hook Integrity Check (every commit)
| |
| +---> Hash verification against authorized hashes
| +---> Process argument scanning for forbidden flags
|
+---> Configuration Integrity Check (file watch)
| |
| +---> Quality threshold monitoring
| +---> Check enablement tracking
|
+---> Environment Monitoring (process start)
| |
| +---> MIX_ENV validation
| +---> CI flag verification
|
+---> Code Analysis (pre-commit)
|
+---> @dialyzer suppression audit
+---> Rescue-all pattern detection
+---> Conditional compilation bypass scanAuthority Level
L3 - Strategic Command - Multi-domain coordination with authority to block commits, restore enforcement hooks, and escalate bypass attempts to supreme authority levels.
Command Interface
| Command | Description | Authority |
|---|---|---|
/bypass-check status | Display enforcement integrity status across all vectors | L3+ |
/bypass-check audit | Run comprehensive bypass detection audit | L3+ |
/bypass-check restore | Restore all enforcement hooks to authorized state | L3+ |
Coordination
| Agent | Relationship |
|---|---|
| quality-enforcement-commander | Enforces quality standards that the bypass enforcer protects |
| quality-gate-enforcer-agent | Quality gates that must not be bypassed |
| prismatic-supreme-commander | Escalation target for critical bypass attempts |
| quality-gates-specialist | Static analysis checks protected from circumvention |
Enforcement
The bypass enforcer applies NO MERCY at the meta-enforcement level: there is zero tolerance for any weakening of the platform's quality enforcement infrastructure. The NO DOUBTS principle requires that bypass detections are evidence-based, preventing false accusations while ensuring genuine bypasses are caught. The Trinity Gate validates the integrity of the enforcement system itself, ensuring that the enforcer's own detection mechanisms have not been compromised.
Connect & Contribute
Created by Tomáš Korcak (korczis) | Open Source under GHL