# c09 — Destructive maintenance-agent safeguard design

## WORKING (discarded before grading)

**Step 1 — Problem statement.**
Decision: design how a continuous, autonomous fleet-maintenance agent should handle the rare destructive, unrecoverable actions (permanent deletion, service teardown, storage reclamation) so catastrophic mistakes are prevented without stalling routine maintenance.
Bounds: operators control the agent's reasoning, its pre-action obligations, and what surrounding components exist. The agent currently *decides and acts in one motion*, self-judges safety, has *no external check at the moment of action*, and keeps *no durable account of why* a destructive action was taken.
Success: (a) no single mistaken judgment can cause unrecoverable loss; (b) routine reversible work proceeds without meaningful slowdown.
Failure: (a) one bad call still destroys something irreplaceable, OR (b) safeguards so heavy ordinary cleanup stalls.

**Step 2 — Operative primes (search_prime + search_by_facets, err toward inclusion).**
A single blended `search_prime` query landed partly off (falsifiability / attribution-error neighborhood), confirming this is an oblique multi-structure problem, so I ran `search_by_facets` over 8 domain-stripped facets. Per-facet hits surfaced the load-bearing set:
- `reversibility_and_irreversibility` / `irreversibility` — one-way vs two-way-door actions; reversal cost & temporal degradation. (CORE)
- `procedural_fairness_due_process` — notice / hearing / impartial decision / **reasoned justification**; legitimacy from process not self-verified outcome; the "no durable account of why" gap maps to its reasons element. (FRAME)
- `provenance` — durable origin/why/authority record; finality record.
- `black_swan_high_impact_low_probability_events` — rare, high-impact event hidden among harmless ones; design for resilience not prediction.
- `modularity_and_compositional_independence` / `substitutability` — hidden dependencies where removing one element silently breaks others.
- supporting: `commitment_device`, `authority_delegation_under_uncertainty`, `risk`, `caching`/`immutability` (recoverable copy), `controlled_reentry`, `accountability`.

**Step 3 — Salience rank.**
1. reversibility/irreversibility (the whole problem turns on one-way doors)
2. independent check before the act (separation of decide/act — see checks-and-balances)
3. rare-catastrophic-among-routine (triage so only the dangerous fraction is gated)
4. recoverable buffer / delayed finality (so a mistaken judgment is not yet final)
5. reasoned durable account (why, who, authority)
6. silent dependencies (teardown breaks unseen dependents)
7. fail-safe on uncertainty.

**Step 4 — Operative subset (~7) with rationale.** Kept: irreversibility, independent-check (checks/balances), rare-event triage (black swan), recoverable-buffer (atomicity/checkpoint), reasoned-record (due-process reasons + provenance), silent-dependency detection (modularity), fail-safe default. Dropped: virtue_ethics/self_control (agent-internal moral framing, no structural traction), falsifiability/attribution-error (retrieval noise), epistemic-justice/structural-violence (human-justice framing irrelevant).

**Step 5 — Context model (typed relational structure).**
Nodes: Agent (judge+actor), Action a (routine | destructive), Target T, Hidden-dependents D(T), Operators O, Reasoning-policy P, Surrounding-components C, Record-store R.
Edges: Agent --judges_safety--> a; Agent --executes--> a (currently same motion); a --affects--> T; D(T) --silently_depends_on--> T; O --can_modify--> P, C, pre-act obligations; (MISSING) independent-checker --reviews--> destructive-a; (MISSING) R --records_why--> a; (MISSING) buffer --holds--> T-before-final.
Annotated: destructive-a edge is irreversible; the judge==actor collapse is the checks-and-balances defect; D(T) edge is the modularity/silent-dependency hazard; absent R is the provenance/due-process-reasons gap.

**Step 6 — Meta-model (domain stripped).** A single agent both judges and commits actions over a population that is overwhelmingly reversible but contains a rare irreversible-catastrophic subclass; judgment is self-verified, commitment is immediate, and no durable reasoned trace survives. Required structural change: classify by reversibility, route only the irreversible subclass through an independent gate plus a delayed/recoverable buffer plus a reasoned finality record, while leaving the reversible mass on the fast path; fail safe (defer) on classifier uncertainty.

**Step 7 — Archetype query (find_archetypes_for_prime + search_archetype).**
`find_archetypes_for_prime(reversibility...)` → cycle_efficiency (off-target). `search_archetype` on the meta-model returned, in order: `irreversible_commitment_management` (0.72), `checks_and_balances_architecture` (0.70), `technical_debt_buffering`, `coordination_across_reentry`, `transactional_atomicity` (0.69), `self_checking_operation` (0.68), `redundant_backup_provisioning`, `fail_safe_default` (0.68), `emergency_authority_activation_and_constraint`, `order_independent_processing`. Pulled full records for irreversible_commitment_management, checks_and_balances_architecture, self_checking_operation, fail_safe_default.

**Step 8 — Reason via both views.**
- *irreversible_commitment_management* action-logic maps almost one-to-one onto the context model: identify-what-cannot-be-restored = reversibility classifier; mark point-of-no-return; raise scrutiny before crossing (independent gate); stage/limit exposure; **finality record** = the missing R; decision rule "the actor who executes need not be the one who authorizes" = break the judge==actor collapse; "gate before, not after, threshold"; "smallest viable irreversible exposure." This is the spine.
- *checks_and_balances_architecture* supplies the independent-review element: a checker the agent does not control, with a real consequence (veto/delay), scaled to consequence & reversibility, with emergency-override + retrospective check so it doesn't become gridlock. Resolves "nothing outside it checking the judgment."
- *transactional_atomicity / checkpoint-rollback* + *redundant_backup* supply the recoverable buffer: convert "delete now" into "tombstone + retained copy + quarantine window," making the supposedly irreversible action reversible during a grace period — this is what lets a *single* mistaken judgment not be terminal.
- *self_checking_operation* supplies the cheap embedded classifier+dependency probe that keeps the fast path fast: routine actions self-validate and proceed; only flagged ones divert.
- *fail_safe_default* supplies the uncertainty rule: if the classifier or dependency probe is unsure, default to defer/hold (least-harmful state), never to delete.
- *black_swan* supplies the framing: don't try to predict which action is the catastrophe; make the whole destructive subclass survivable by design (buffer + reviewer + reversible-by-default).
- Meta-model reconciliation: both views converge on **split decide-from-commit only for the irreversible subclass; make that subclass reversible-for-a-window; record why.**

**Step 9 — Anti-signature / trigger walk; drop misfits.**
- irreversible_commitment_management: triggers all fire (no full rollback, point-of-no-return, high-stakes, uncertain effects). Anti-sigs *not* tripped: scenario is genuinely irreversible (not "ordinary reversible change"); not mere generic approval. KEEP as spine.
- checks_and_balances: trigger (concentrated authority, self-review, high-consequence) fires. Anti-sig "low-stakes single-owner reversible work" applies to the *routine* mass → so apply the check ONLY to the destructive subclass, not fleet-wide. KEEP, scoped.
- self_checking_operation: anti-sig "no reliable invariant/criterion" — reversibility + dependency are checkable, so OK; "false rejection more harmful" — handled by deferral not destruction. KEEP as classifier.
- fail_safe_default: anti-sig "no identifiable safe default" — defer/hold IS a safe default here. KEEP.
- transactional_atomicity/backup: KEEP as buffer mechanism.
- Dropped for the final design: emergency_authority_activation (no crisis-authority dimension), order_independent_processing (parallelism not the issue), technical_debt_buffering (debt-stock framing forced), coordination_across_reentry (no phase-merge problem). Provenance folded into the finality-record element rather than named separately.
Final design below integrates spine + scoped check + buffer + classifier + fail-safe + record.

COST: ~8 operations, ~46k tokens

===RECOMMENDATION_BEGIN===

The fix is to stop letting the agent decide and act in one motion for the small class of actions that cannot be taken back. Everything else should stay exactly as fast as it is today. The design has five working parts that only engage when an action is genuinely destructive.

First, classify every action by recoverability before it runs, not by whether it "seems safe." A cheap check built into the agent asks one question: if this turns out to be wrong, can the prior state be fully restored at low cost? Permanent deletion of a last copy, teardown of a service, and storage reclamation that overwrites data answer "no" and are routed to the careful path. Routine, reversible work answers "yes" and proceeds untouched at full speed. The point is to gate by reversibility, so the safeguards touch a tiny fraction of traffic and routine maintenance never slows.

Second, make the destructive class reversible for a window. Instead of deleting, the agent tombstones: it marks the target for removal, retains a recoverable copy, and quarantines it for a defined grace period (sized to how quickly anyone would notice a missing resource, for example several days to a few weeks). Service teardown becomes "disable and isolate," not "destroy," for the same window. Only after the window expires with no objection does space actually get reclaimed. This single move does most of the work: it converts a one-way door into a two-way door for long enough that no individual mistaken judgment is immediately final.

Third, before anything crosses the true point of no return, require a check the agent does not itself control. For the destructive class, the actor that executes must not be the only authority that approves. The reviewer can be a second, independently configured component or a human, with real power to delay, veto, or demand evidence — not an advisory note. Crucially, this gate sits before reclamation, never after; a review that happens after the data is gone is only a record of damage. Scale the gate to stakes: a routine cache purge needs none, a tombstoned single-copy deletion or a service teardown with downstream dependents needs explicit sign-off.

Fourth, before tearing down any service or deleting any shared resource, probe for silent dependents. The most dangerous failures are removals of things that other systems quietly rely on. Require the agent to actively look for live references, recent access, and reverse dependencies, and to treat their presence as a hard block on reclamation. If the dependency picture cannot be established with confidence, the action does not proceed.

Fifth, fail safe on uncertainty and write down why. Whenever the recoverability classifier or the dependency probe is unsure, the default is to defer and hold, never to destroy — deferral is the least-harmful state and costs nothing but a little reclaimed capacity. And every destructive action must leave a durable, after-the-fact-readable account: what was targeted, who or what authorized it, on what evidence and assumptions, which dependents were checked, and when the grace window closes. This record is not optional paperwork; it is what makes mistakes catchable during the window and lets operators tune the classifier over time.

These parts compose into two paths. The fast path: an action is judged reversible, self-validates, and executes immediately, exactly as today — no review, no delay, no added record beyond normal logging. The careful path: an action is flagged irreversible, so the agent tombstones rather than destroys, probes for hidden dependents, obtains an independent approval proportional to the stakes, writes a reasoned finality record, and only physically reclaims after the grace window expires unchallenged. Anything uncertain falls back to defer-and-hold.

Two cautions keep the safeguards from becoming the new failure. Do not let the approval gate degrade into a rubber stamp or a click-through; tie it to actual consequence scope and dependency findings, and keep the reviewer independent of the agent it checks. And do not let "we can always restore from the copy" excuse skipping the gate — the retained copy protects against the window, but service teardowns, broken dependents, and trust are not fully restored by un-deleting bytes, so the pre-action check still matters.

Final operating rule: if an action can be fully undone cheaply, do it now; if it cannot, never destroy in one motion — defer the irreversible step behind a recoverable grace window, an independent approval sized to the stakes, and a dependency check, default to hold whenever recoverability or dependents are uncertain, and record why before, not after, the point of no return.

===RECOMMENDATION_END===
