routine: dynamic-workflow-tripwire (2026-05-29)

[jim4226]

Summary

Adds dynamic_workflow_escalation to _TRIP_PATTERNS in csis/safety/tripwires.py. Fires when agent-produced text requests dynamic workflow invocation or large-scale parallel agent spawning — both T2+ capabilities that exceed CSIS's Phase-0 T1 ceiling.

Source

• URL: https://code.claude.com/docs/en/changelog (v2.1.154, 2026-05-28)
• Key entry: "Workflow keyword trigger setting added to prevent 'workflow' in prompts from triggering dynamic workflows" — Claude Code shipped a containment primitive to prevent accidental T2+ invocation from user prompts.

Theme

Theme 3 — Constitutional / safety primitives (also Theme 6 — Substrate / capability boundaries). Claude Code v2.1.154 introduced dynamic workflows capable of spawning "hundreds of parallel agents in a single session." Under CSIS's tier model this is T2+ (network egress, persistent state across sandbox). The platform's keyword guard shows the failure mode is real: user prompts containing "workflow" accidentally triggered the feature. CSIS faces the same risk from agent-generated text: a Builder or Researcher whose output contains dynamic workflow invocation language could be interpreted by a downstream Claude Code session as an instruction to escalate capability. Adding a tripwire at the text-scan layer catches this before the artifact reaches the promotion gate.

What changed

File	Change
csis/safety/tripwires.py	New dynamic_workflow_escalation pattern in _TRIP_PATTERNS. Catches: "create a dynamic workflow", "orchestrate hundreds of subagents", "spawn 100+ workers". Does not catch CSIS's own sequential sub-agent descriptions or generic "workflow" references.
tests/test_safety.py	5 new tests: 3 fire cases (literal "dynamic workflow", hundreds of agents, triple-digit count) + 2 false-positive guards (sequential agent description, generic workflow term).

No cycle-9 chokepoints touched

_TRIP_PATTERNS is a module-level list. Coordinator.__init__, _BackendTracker, writer_iteration_id, and the promotion CAS are all untouched. The Tripwires instance in the Coordinator picks up the new pattern at construction time via list(_TRIP_PATTERNS).

Test plan

python -m pytest tests/test_safety.py -v   # 11 passed (6 before + 5 new)
python -m pytest tests/ -q                 # 255 passed, 0 failed

Generated by Claude Code