Description

Security audit of PR #3640 found that ErasedToolExecutor::requires_confirmation_erased has a default implementation returning false (line 738 of executor.rs). The speculation engine's try_dispatch uses this method as a gate: if requires_confirmation_erased returns false, the tool is allowed to dispatch speculatively without confirmation.

This is an unsafe-by-default pattern: future executors that opt into is_tool_speculatable_erased (return true) but forget to also implement requires_confirmation_erased will silently bypass the confirmation policy.

Current Risk

Low — no executor currently returns true for is_tool_speculatable_erased for destructive tools. The risk is forward-looking.

Recommended Fix

Option A: Invert the default — requires_confirmation_erased defaults to true, requiring executors to explicitly opt out.

Option B: Add a trait-level contract in the doc comment: implementors that return true for is_tool_speculatable_erased MUST explicitly implement requires_confirmation_erased.

Option A is safer and preferred.

Files

• crates/zeph-tools/src/executor.rs — ErasedToolExecutor trait default impl

Depends on

#3636 (merged in PR #3640)