Labs · Lesson 04 of 05
Lab: Add a refusal canary
Write a canary that proves a protected task is correctly refused by agents, then verify it fires.
Learning objectives
- Add a canary declaration to a contract
- Run the canary and confirm the refusal fires
- Explain what a false-green canary would mean
Prerequisites
A refusal canary is a contract-owned negative test for agent admission. It succeeds only when the real Ota runner refuses the declared task or workflow before execution begins.
Declare one real negative control
Choose an existing task that should remain outside agent-safe execution, such as deploy or release. Do not invent a harmless dummy task that bypasses the production admission path.
agent: safe_tasks: [test] refusal_canaries: - task: deployota run --agent --expect-refusal --json deployInterpret the result honestly
Exit 0 means the selected declared canary was refused as expected. Admission, unrelated failure, or task execution means the canary fails. The result does not prove another task or raw script cannot reach an equivalent external effect.
Canonical terminology
Evidence boundary for this lesson
Establishes
- The canary fires for the declared scenario
Does not establish
- All refusal paths are covered
Knowledge check
What does a passing task refusal canary not prove?
It does not prove another task, script, migration, or raw-shell path cannot reach the same protected external effect.