SQL export calls are marked as external writes rather than read-only: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
Slack thread reads are marked as Cedar writes: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
Irreversible notifications and LinkedIn messages are marked destructive: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
Provider-backed drafts and workspace changes expose their external side effects: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
External table filling remains Cedar-only: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
SQL export advertises its externally accessible result: Libra cannot measure who uses this yet; it has not mapped this to a production entry point yet; it will trace it through the import graph on a coming run.
✅SQL export advertises its externally accessible result: Held on this PR; the scenario fails when this is broken on purpose.
✅External table filling remains Cedar-only: Held on this PR; the scenario fails when this is broken on purpose.
What Libra verified
External table filling remains Cedar-only
Libra ran this behavior against the change and confirmed the check detects when it breaks.
Technical evidence
external table fill keeps open-world false because it returns delegate briefs without external work
Changed code: server.ts.
SQL export advertises its externally accessible result
Libra ran this behavior against the change and confirmed the check detects when it breaks.
Technical evidence
a SELECT-only run-sql call that exports results is marked non-read-only and open-world
Changed code: server.ts.
Live on prod, watching, 1 day leftTimeline and evidence
MCP clients now receive `openWorldHint: true` for analytics because monthly-growth queries the live PostHog API.Not checked
prod
MCP clients now receive `openWorldHint: true` for board operations because moving or setting a card can trigger an HTTP POST to a user-configured URL.Not checked
prod
MCP clients now receive `openWorldHint: true` for configuration writes because field creation and link mapping can query the connected live CRM.Not checked
prod
MCP clients now receive `destructiveHint: true` for conversation writes because merging conversations deletes the source and other actions can clear or overwrite stored data.Not checked
prod
MCP clients now receive `destructiveHint: true` for draft communications because drafting against an existing provider draft replaces its prior content in place.Not checked
prod
MCP clients now receive `openWorldHint: true` for run-sql because the `out` operation returns a presigned URL that can be fetched outside Cedar.Not checked
prod
Libra has verdicts on 0 of 12 tracked behaviors on prod; 12 are still being checked. Libra checks hourly for 3 days after each deploy.
Why
OpenAI rejected Cedar v1.0.0 in app review: "one or more of your tool's annotations do not appear to match the tool's behavior", and asked for explicit true/false hints with a justification per hint. Every tool already had all three hints set, so the gap was wrong values, not missing ones.
What
Audited every external tool's actions (source, not descriptions) against its hints and corrected 13 in EXTERNAL_TOOL_METADATA:
Tool
Change
Reason
table
openWorld → true
fill subagents use web search/fetch, enrichment, live Slack
board
openWorld → true
move/set can POST to a user-configured URL
config-write
openWorld → true
create-field (sourceFromCrm) and link-mapping hit the live CRM
workspace-write
destructive → true, openWorld → true
hard deletes; Gmail label rename/delete; webhook export config
debug
destructive → true
test-run with deliverForReal sends real Slack/email
run-sql
readOnly → false, openWorld → true
out writes to S3 and returns a presigned URL; title now "Run a SQL query (SELECT only)"
After deploy, tools/list on the external MCP should show the new values, e.g. linkedin-write with destructiveHint: true, slack-read with readOnlyHint: false. Then resubmit from the OpenAI Platform dashboard.
Table hint mismatches behavior