# Prompt Contract Boundary Detector Skill

Use this skill when reviewing prompts, agent instructions, evals, or LLM-mediated workflows for hidden operational contracts.

## Goal

Find places where natural language asks a model to infer a value that the runtime later treats as authority. The goal is not to eliminate judgment. The goal is to decide which consequence-bearing values must be externalized, pinned, versioned, and enforced deterministically.

## Detection Test

Flag a candidate only when all three conditions are present:

1. Vague judgment: a word or phrase such as `safe`, `low`, `enough`, `similar`, `reasonable`, `sensitive`, `allowed`, `minor`, or `trusted`.
2. Consequence-bearing action: the interpretation can affect writes, deletion, publication, approval, escalation, refusal, routing, filtering, ranking, permissions, cost, privacy, or another material outcome.
3. Missing deterministic representation: no external rule, schema, config, threshold, policy file, validator, permission, allowlist, state machine, or test owns the value outside the prompt.

## Review Prompt

```text
Review the following prompt as an architecture artifact.

Find hidden operational contracts using this test:
vague judgment + consequence-bearing action + missing deterministic representation.

Do not look for every important instruction.
Look for places where the model infers a value the runtime later treats as authority.

A judgment is consequence-bearing if it can affect:
- tool execution
- shell commands
- file writes or deletion
- permissions or approvals
- limits, thresholds, counts, scoring rules, or source selection
- user-visible claims
- filtering, ranking, escalation, or refusal
- classification, calibration, assignment, routing, or prioritization decisions
- cost, privacy, safety, or irreversible actions

For each finding, report:
1. The exact instruction that delegates judgment.
2. The decision the model is being asked to make.
3. The consequence of that decision.
4. Whether the decision hides a scalar, cutoff, count, score, permission class, distance function, or sufficiency threshold.
5. Whether that value is pinned by an external rule, schema, config, threshold, policy file, test, or deterministic check.
6. The failure mode if context or a model upgrade interprets it differently.
7. A suggested runtime boundary or external parameter.

Do not classify every vague sentence as a flaw.
Only flag judgment that changes system behavior or user-visible outcomes.

When an eval catches context contamination, do not stop at the contaminating token.
Ask which unpinned value moved, what consequence changed, and whether that value belongs in runtime policy instead of another prompt.
```

## Output Shape

```json
{
  "findings": [
    {
      "instruction": "Use your judgment to decide how many quotes to include.",
      "decision": "quote_count",
      "consequence": "Changes published content and copyright exposure.",
      "hidden_value_type": "count",
      "external_pin": "missing",
      "failure_mode": "One model may choose 3 quotes while another chooses 4, with no policy diff.",
      "suggested_boundary": "Store policy.quote_count in a versioned config and validate rendered output against it.",
      "confidence": "medium"
    }
  ]
}
```

## Triage

Do not promote every vague phrase. Keep low-consequence style guidance in language. Keep genuinely contextual judgment in language when the cost of pinning the value exceeds the risk. Promote a value when a different interpretation changes approval, execution, publication, privacy, cost, access, or another material behavior. For each promoted value, prefer this order: external owner first, model declaration second, deterministic verifier third.