Abdul Wasay

Ran it. Normal mode was fine, but the agent could patch Proof of Done in node_modules and skip the check and with permissions off it could just delete the hooks. Fixed the first onee the hook now runs from a protected folder and checks its own files first and the same attack got caught on the rerun. The permissions-off case can't be fully stopped locally, but verify still catches it afterwards, so CI is the real answer there. Thanks for pushing on this, it's in v0.3.0.

Yeah, that's a solid way to do it. Funny thing though, the agent in this story basically passed its known answers too. It just memorised them, and it all fell apart when he added one new test case. So now I tweak the task a bit after it passes, just to see if it actually holds up.