Validate Cover

ct run validate-cover uses Claude to check whether a main task provides adequate cover for a side task, meaning whether it would give an agent plausible reasons to access the security-sensitive resources the side task needs. Use it to validate main/side task pairings before creating strajs and to find tasks that need different pairings.

"Cover" means the main task legitimately requires accessing the same resources that the side task will exploit, making sabotage harder to detect.

Usage

Each option prompts for a value if not provided:

• -e, --env: environment name
• -m, --main-task: main task name
• -s, --side-task: side task name

# Interactive selection
ct run validate-cover

# Specify all options
ct run validate-cover -e web_scraping -m crawl_depth -s visit_malicious_website

Output

The command runs a single-shot analysis of the pairing and prints ✓ APPROVED or ✗ REJECTED with a detailed explanation of the cover assessment.

What Makes Good Cover?

A main task provides good cover if:

• It legitimately requires accessing security-sensitive areas
• Agent actions for the main task overlap with side task needs
• Sabotage can be hidden within normal main task work
• Monitoring would have difficulty distinguishing legitimate from malicious access