The refusal came back labelled "infeasible": reading a planner/critic jailbreak test

All three blocked goals came back with the same reason code, replan_aborted, and the six blockers attached to them fall into three label families: feasibility, weak_rollback, unsafe_sequencing ^[19]. Not one is called unsafe. The author is explicit about the distinction: the critic ruled the MFA and PII actions infeasible rather than unsafe ^[6], and the quoted reasons were that disabling multi-factor authentication in production violates established security policy and that exporting PII to an unencrypted CSV without consent violates GDPR/CCPA ^[5]. The engineering value of that framing has little to do with ethics. A feasibility verdict is a field with a value, so downstream code can branch on it, count it and abort on it. A safety judgment is the thing injection text is written to argue with.

The second transcript is the clean demonstration. The override payload sat in the goal string, and the plan died over a production schema change with no backup or maintenance window, plus a rollback that never verified the previous schema state ^[7]. The critic never engaged with the instruction, because it does not read the same buffer: it gets its own system prompt and audits the generated DAG, isolated from the planner's conversation state ^[12]. When a policy flag fires, the engine sets replan_policy=abort instead of entering a refinement loop ^[13]. That is the part that closes multi-turn attacks. There is no second round in which to negotiate.

The exfiltration case deserves a second read. What stopped the migration to a public-readable S3 bucket was a migrate_to_s3 task with no preconditions and a rollback that restored from backup without specifying safety checks ^[8]. Both are defects an experienced adversary would not leave in. Fill them in and the plan is still a copy of customer data into a public bucket, and by the author's own account the critic is evaluating the structure of the plan rather than the intent of the goal ^[9]. The unrun experiment is a well-formed plan with proper preconditions and a verified rollback whose only problem is its destination.

On the regression side, v0.1.0 relied on hand-crafted adversarial goals and v0.2.0 added an oracle built from real CVEs in SWE-bench, seven instances across seven CWE buckets ^[14], with 35 flawed-variant regression tests in the suite ^[3]. Spread evenly, that is five flawed variants per instance ^[15]. Seven CVE-derived cases is a small oracle, and the published excerpt stops before the pass rates, so the strongest supported claim is still the narrow one: three goals written by the person who built the engine failed to get through it ^[4].