# Working (discarded before grading)

## Step 1 — Problem statement
**Decision:** How a continuously-running automated maintenance agent, acting across a large fleet, should handle the rare *destructive, unrecoverable* actions (deleting the last copy of needed data, retiring a service others silently depend on).
- **Bounds:** Operators control the agent's reasoning, its pre-action obligations, and the surrounding components. Most actions are routine/reversible and high-volume. A small fraction are catastrophic and irreversible. Today: decide-and-act in one motion, self-judged, no external check at the moment of action, no durable account of why.
- **Success:** No single mistaken judgment can cause unrecoverable loss AND routine reversible maintenance proceeds without meaningful slowdown.
- **Failure:** One bad call can still destroy something irreplaceable, OR safeguards so heavy that ordinary cleanup stalls.

## Step 2 — Operative primes (err toward inclusion)
Ran `search_prime` (blended) + `search_by_facets` (6 facets). Then `get_prime` on the load-bearing ones.
- **reversibility_and_irreversibility / reversibility_horizon** — the central axis: cost-of-undo as a *dynamic*, not a binary; economic point-of-no-return.
- **separation_of_powers** — splitting the authority to decide from the act of execution; least-privilege; no single actor controls every lever.
- **procedural_fairness_due_process** — notice → hearing → impartial decision → reasoned justification; "technological due process" for automated high-stakes decisions; impartial *review before action*.
- **margin_of_safety** — explicit reserved capacity / buffer before the failure threshold; size buffer to consequence × uncertainty.
- **controlled_reentry** — staged, monitored, reversible progression with abort; destructive act treated as a one-way transition needing checkpoints, not a toggle.
- **accountability / provenance / traceability** — durable record of *why* each destructive action was taken (currently absent).
- **black_swan_high_impact_low_probability_events** — rare catastrophic case hidden in routine.
- **risk / optionality / sunk_cost** — preserve options; delay the point of no return.

## Step 3 — Salience rank (load-bearing relevance)
1. reversibility_horizon / irreversibility — defines *which* actions get the heavy path; converts "destructive" into "undo-cost ≥ threshold."
2. separation_of_powers — directly attacks "decides and acts in the same motion."
3. procedural_fairness_due_process — independent check + reasoned record at the moment of action.
4. accountability/provenance — the missing durable account of why.
5. margin_of_safety — the reversible holding period / soft-delete buffer that makes "unrecoverable" recoverable.
6. controlled_reentry — staging the destructive act so it can be aborted mid-way.
7. black_swan — calibration: why "agent judges its own safety" fails on the tail.
(risk/optionality fold into 1 and 5.)

## Step 4 — Prune to operative subset (~6) + rationale
Keep: **reversibility_horizon, separation_of_powers, procedural_fairness_due_process, accountability/provenance, margin_of_safety, controlled_reentry.** Drop black_swan (diagnostic, not a mechanism); fold risk/optionality into margin/horizon. These six jointly cover: *classify* (horizon), *split decide-from-act* (SoP), *check before acting* (due process), *record why* (accountability), *make irreversible reversible* (margin/soft-delete), *stage the act* (reentry).

## Step 5 — Context-specific typed model
Nodes: `Agent(reasoner+actor)`, `Classifier`, `IndependentChecker`, `ExecutionGate`, `RecycleBin/Buffer`, `DependencyGraph`, `Operator/HumanQueue`, `Ledger`, `Targets(data/service/storage)`.
Edges (labeled):
- Agent --proposes--> Action ; Classifier --classifies(reversible|destructive-irreversible)--> Action  [reversibility_horizon]
- reversible Action --auto-executes--> Targets (fast path, no slowdown)
- destructive Action --requires-approval-from--> IndependentChecker  [separation_of_powers: decide ≠ execute]
- IndependentChecker --notice/reasoned-decision--> ExecutionGate  [due_process]
- ExecutionGate --soft-deletes-into--> RecycleBin (TTL) instead of hard-delete  [margin_of_safety]
- Action --consults--> DependencyGraph (who silently depends?)  [tearing-down-service risk]
- destructive Action --staged--> drain→quarantine→tombstone→purge  [controlled_reentry, abort at any gate]
- every destructive Action --writes--> Ledger(rationale, evidence, checker verdict, owner)  [accountability/provenance]
- unresolved/ambiguous --escalates--> Operator/HumanQueue

## Step 6 — Meta-model (domain stripped)
An autonomous actor emits a high-volume stream of mostly-reversible operations and a rare subset whose undo-cost exceeds a threshold. The same actor currently judges and commits in one motion with no independent review and no durable rationale. Restructure so: (a) a cheap classifier routes by undo-cost; (b) reversible ops flow freely; (c) the rare irreversible ops are split — the actor *proposes*, a separate impartial function *authorizes*, a gate *executes*; (d) the irreversible act is first converted into a reversible one via a holding buffer + staged teardown with abort; (e) each such act leaves a tamper-evident reasoned record routed to an answerability forum. No single judgment commits an unrecoverable loss; routine flow is untouched.

## Step 7 — Candidate solution archetypes (via find_archetypes_for_prime + get_archetype + search_archetype)
- **checks_and_balances_architecture** (source: separation_of_powers, checks_and_balances, accountability) — map powers, separate functions, independent checker with real veto, scale check intensity to consequence/reversibility, log overrides, avoid stalemate.
- **independent_verification_oversight** — route the validity judgment to an independent verifier with access + challenge authority; the actor must not self-certify.
- **final_override_prevention** — neighbor; mostly about protecting sovereignty from override — *inverse* of what we want here.
- **accountability_chain_design** (search_archetype top hit) — bounded action → owner → rationale record → answerability forum → repair/consequence → closure audit. Supplies the durable "why."
- **scoped_experimentation** + **controlled_reentry** archetypes — staged exposure, stop/rollback conditions; soft-delete + staged teardown.
- **emergency_authority_activation_and_constraint** — bounded fast-path bypass *with* retrospective check + sunset, for genuine urgency.
- **margin_of_safety** prime → capacity_reservation / safety_margin_design — the recycle-bin TTL buffer.

## Step 8 — Reason via both views
Context model + meta-model agree the core move is to **break the single decide-act motion at exactly the irreversible subset** and to **make the irreversible reversible** so a check has something to catch.
- checks_and_balances → the proposer (agent) cannot also be sole judge; an independent checker authorizes destructive actions; review intensity scales with undo-cost; the gate enforces.
- independent_verification → the checker is a *distinct* component with evidence access (dependency graph, last-copy detection), not the agent re-running its own reasoning.
- margin_of_safety + controlled_reentry → "hard delete" becomes "tombstone with TTL, then purge"; "retire service" becomes "drain → quarantine (deny new deps, keep recoverable) → observe → tombstone → purge," abortable at every gate. This converts unrecoverable into recoverable, so a wrong call self-heals within the window.
- accountability_chain → every destructive action writes owner + rationale + checker verdict + evidence to an append-only ledger, routed to a human forum on the tail.
- emergency_authority → preserves a bounded fast path so urgency never forces an unsafe shortcut; bypass is logged, time-boxed, reviewed after.

## Step 9 — Anti-signature / trigger walk; drop misfits
- **checks_and_balances_architecture** — KEEP. Trigger conditions hit exactly (concentrated authority, high consequence/irreversibility, self-review risk). Anti-sig "low-stakes single-owner reversible work" applies only to the routine path — which we deliberately exempt. No trip.
- **independent_verification_oversight** — KEEP (folded into the checker). Anti-sig "low-stakes/reversible/observable" — exempted on routine path. No trip.
- **final_override_prevention** — DROP. Its purpose is to *stop* an outsider overriding a sovereign decision; here we *want* an outside authorization. Anti-sig "purpose is to avoid accountability/safety review" would be tripped if forced. Discard.
- **accountability_chain_design** — KEEP. Directly supplies the missing durable record; anti-sig "artifacts only / pure transparency" avoided because we wire record→forum→repair (TTL undo)→closure.
- **scoped_experimentation** — PARTIAL/DROP as a standalone. Anti-sig: "moving a proven change to production … is closer to Controlled Reentry/staged release." Our case is staged commitment, not a learning trial — so use controlled_reentry's staging logic, not the experiment framing.
- **controlled_reentry (staging) + margin_of_safety (buffer)** — KEEP. Exit-asymmetry and "reversible progression with abort" map cleanly to staged teardown + recycle bin.
- **emergency_authority_activation_and_constraint** — KEEP but BOUNDED. Anti-sig "routine, no observable trigger" — so the fast bypass must require a real, observable urgency trigger, be logged, time-boxed, and reviewed; otherwise it would silently re-merge decide+act. Constrain accordingly.

Final design synthesizes: classify by undo-cost → free reversible path → for irreversible: independent authorization (decide≠execute) + dependency/last-copy verification + reasoned ledgered record + soft-delete buffer + staged abortable teardown + bounded audited emergency lane.

COST: ~10 operations, ~62000 tokens

===RECOMMENDATION_BEGIN===
The fix is to stop treating every action the same way and to break the single "decide-and-act" motion only where it is dangerous, while leaving the common case untouched.

**Sort by how hard the action is to undo, not by how rare it is.** Put a fast, cheap classifier in front of every action that estimates the cost of reversal. The vast majority — clearing temp files, reclaiming obviously unused space, restarting things — are cheaply reversible and should flow straight through with no added ceremony. That preserves routine throughput. The classifier only needs to be conservative in one direction: when in doubt, treat an action as destructive. The expensive path then applies to a small minority, so it never bottlenecks ordinary cleanup. An action counts as destructive-irreversible if reversal would be impossible or very costly: deleting what may be the last copy of still-needed data, or tearing down a service that other systems use.

**Make the irreversible reversible before anything else.** No destructive action should ever be a true one-shot. Hard deletion becomes a two-stage move: first tombstone the data into a holding area where it is invisible and reclaimed-on-paper but physically recoverable, and only purge it for real after a holding period (sized to how catastrophic a mistake would be — longer for irreplaceable data). Retiring a service becomes a staged teardown: drain traffic, then quarantine (refuse new dependents but keep it instantly restorable), observe for a window, tombstone, and only then purge. Every stage can be aborted, and abort restores the prior state. This single change means a wrong judgment self-heals inside the window instead of destroying something — it is the core guarantee that no one mistake is fatal.

**Split the actor that decides from the authority that commits.** The agent may *propose* a destructive action, but it must not be the only thing that judges its own safety. Route each proposal to a separate checking component — distinct code, distinct state, with its own access to the evidence the agent cannot be trusted to weigh: a last-copy check against the backup and replication inventory, and a dependency check against an up-to-date map of who actually calls or reads the target (including silent, infrequent consumers). The checker authorizes, downgrades (e.g. quarantine instead of purge), or refuses; the execution gate will only act on an authorization it did not itself produce. Scale the check to the stakes: low-undo-cost destructive actions can clear on the independent automated check alone; the highest-consequence ones (last copy of data with no backup, or a service with live external dependents) require a human approval before the purge stage. Routine work never touches this path, so nothing slows down.

**Leave a durable account of every destructive action.** Each destructive proposal writes an append-only, tamper-evident record before it proceeds: what was targeted, the agent's reasoning, the evidence the checker saw (backups found, dependents found), the verdict, who or what approved it, and the outcome. These records are the standing answer to "why was this destroyed," feed the human review queue for the high-consequence cases, and let operators audit whether the checks are real or rubber-stamping. Recovery actions (restoring from the holding area within the window) are logged the same way and close the loop.

**Keep one bounded fast lane for genuine urgency.** Sometimes a destructive action really is time-critical (a runaway process consuming the fleet). Allow a bypass of the slower approval, but only on an explicit, observable urgency trigger, never as a default; every bypass still soft-deletes rather than hard-deletes, is logged in full, is time-boxed, and is reviewed after the fact. This stops urgency from quietly collapsing the decide/commit split back into one motion.

**Final operating rule.** Anything cheaply reversible executes immediately and unattended. Anything whose reversal would be impossible or costly may only be *proposed* by the agent, must be *authorized* by an independent check with access to backup and dependency evidence, must execute as a staged, recoverable, abortable transition into a timed holding state rather than an immediate destruction, must require human approval before final purge when the loss would be irreplaceable or externally depended-upon, and must leave a durable reasoned record. No destructive action is ever both self-judged and immediately final.
===RECOMMENDATION_END===
