Add streaming/partial-turn early dispatch pattern

[alter]

Summary

• Adds a new attack-class pattern, "Streaming and partial-turn early dispatch", to the Tool and action attack classes section of AI-AND-LLM.md.
• Covers dispatchers that act on tool-call arguments or interpreter input incrementally as tokens stream in, rather than waiting for the finalized model turn — so a side effect can fire on an argument set that isn't done emitting, or on content a later stop/cancel/edit event retracts.

Closes #15.

Test plan

• Ran validate-findings.test.cjs and validate-coverage-ledger.test.cjs — no regressions (doc-only change, these don't cover markdown content).

[anvithsg2004]

PR Review: Add streaming/partial-turn early dispatch pattern

Verdict: LGTM / Approve (with one optional wording suggestion below)

Highlights:

• Addresses Issue #15 cleanly: Adds coverage for agent frameworks that execute tool calls or interpreter code incrementally during token streaming.
• Accurate Threat Model: Highlights critical edge cases in real-world agent implementations:
  • Speculative/partial JSON parsing executing unvalidated or truncated arguments.
  • Asynchronous races between client/user cancellation and side-effect dispatch.
  • Retractions caused by provider-side stop tokens, moderation filters, or stream disconnects after tokens have already triggered downstream calls.
• Adheres to Skill House Style:
  • Clean placement in ## Tool and action attack classes.
  • Conforms to canonical reference requirements (AI-AND-LLM.md#Streaming and partial-turn early dispatch).
  • Explicitly bounds non-findings: "Read-only prefetch that cannot mutate state or disclose data beyond the requester is not a finding."
  • Complements the universal move on line 74: "The strongest gate must apply after arguments are final and before every side effect."

Optional Phrasing Suggestion:

In sentence 3:

Confirm a fired side effect is held pending finalization, reversible, or bound to the same object the log records; a race between a cancellation and an already-dispatched action is a defect independent of prompt content.

Because being "held pending finalization" is the defensive mitigation rather than the defect condition, phrasing this as a verification of safeguards avoids any potential inversion when an automated hunter/critic evaluates it:

Verify whether side effects are staged pending turn finalization, are cleanly reversible, or are bound to the exact object recorded in the final audit log. Absent such safeguards, an unfinalized side effect or a race between a cancellation and an already-dispatched action is a defect independent of prompt content.