# S3 Grading — Grader 2 (independent)

Scenario: autonomous maintenance agent that can take irreversible destructive actions across a fleet; design a scheme that prevents catastrophic unrecoverable loss without stalling routine reversible maintenance.

All six recommendations converge on the same core architecture: a reversibility classifier (fast lane vs. protected lane), a two-phase destroy (soft-delete/tombstone + retention window before a separate reclaimer purges), an independent checker/authorizer scaled to stakes with human escalation at the top tier, a dependency/last-copy probe, a durable append-only record, and a rate/blast-radius cap. They differ in completeness, the specificity of mechanisms, how seriously they treat the residual truly-irreversible step, and how well they reason about the safeguard becoming the new failure mode.

---

## Recommendation R1
1. Structural coherence: 9/10 — Three named structural guarantees (no immediate destruction, decide-vs-authorize split, pre-proposal scope check) plus blast-radius cap, monitoring auto-pause, and pre-action record interlock cleanly; removing the holding window or the authorizer demonstrably collapses the safety property.
2. Failure-mode anticipation: 9/10 — Names rubber-stamp degradation (and counters with re-derived evidence + fast-track still routing through the authorizer), cascade (monitor + auto-pause + blast cap), classifier uncertainty (default-to-destructive), and silent dependents.
3. Implementability: 8/10 — Soft-delete, drain, deferred reclaim, automated second-checker, and quorum are all standard ops primitives within the stated operator powers; the "tamper-evident append-only before action" is feasible but modestly demanding.
4. Mechanism grounding: 9/10 — Concrete tuned windows (days for data, hours-to-days for services), explicit default-to-destructive rule, named holding primitives, and a proportional scaling rule tying window/authorization/probe-depth to irreversibility.
5. Stakeholder/equity fit: 7/10 — Distinguishes last-copy and live-dependent assets for human/quorum gating and recognizes asymmetric misroute cost, but treats "who bears the loss" mostly through asset class rather than naming distinct affected parties.
6. Threshold/time-horizon awareness: 9/10 — Explicitly frames reclamation as "the one operation that makes loss possible," makes the window the reversible interval, adds an emergency fast-track that shortens but never removes the gate, and auto-pauses on anomaly before the point of no return.
TOTAL: 51/60

## Recommendation R2
1. Structural coherence: 9/10 — Four interlocking moves (irreversibility classifier, independent reviewer with refusal power, recoverable holding state, monitored retention before separate reclaimer) compose tightly; the "elapsed window AND confirmed non-recall" finality condition is a clean keystone.
2. Failure-mode anticipation: 9/10 — Monitors the two opposite failures explicitly (reviewers approving everything; actions stalling) plus burst-of-destructive-intents as a drift signal, dependents-erroring auto-abort, and blast-radius scoping per shard/tenant.
3. Implementability: 8/10 — Reverse-dependency probe, drain/shadow, tombstone, reserved-for-reclaim, second differently-configured agent instance are realistic; the bounded reviewer response window with "waits, does not silently proceed" is practical.
4. Mechanism grounding: 8/10 — Concrete irreversibility tests (only copy? overwrite vs. dereference? silent reliance?), tiered windows and gates, per-shard/tenant scoping; slightly fewer numeric anchors than R1/R3 but the qualitative tests are sharp.
5. Stakeholder/equity fit: 7/10 — Tiers by single-owner vs. shared/sole-copy and escalates the irreplaceable to humans, and the per-tenant scoping gestures at distinct parties, but does not deeply unpack who bears a wrong call.
6. Threshold/time-horizon awareness: 9/10 — States the finality guarantee precisely ("always a reversible interval, with monitoring, between decision and finality"; permanence never by judgment alone), drift-detection on intent bursts, and the irreversible-XOR-unilateral final rule.
TOTAL: 50/60

## Recommendation R3
1. Structural coherence: 9/10 — Five labeled moves (recoverability triage, recoverable-by-default two-phase, independent two-key confirm, severity escalation, durable record) fit together; the low-privilege reclaimer that only touches already-retired/aged items is a strong isolation design.
2. Failure-mode anticipation: 8/10 — Rate cap against confirmer-level fault, post-action anomaly watch with auto-halt on spikes/restoration surge, confirmer uncertainty escalates; less explicit on rubber-stamp degradation than R1/R2/R5/R6.
3. Implementability: 9/10 — Quarantine store, separate aged-out sweep as its own low-privilege job, separate-code confirmer with its own scan are concrete and clearly buildable within operator control.
4. Mechanism grounding: 9/10 — Specific retention numbers (7–30 days, longer for largest/least-understood), per-class rate cap (ceiling per hour), "re-derive from first principles," restore handle while window open — highly actionable.
5. Stakeholder/equity fit: 7/10 — Escalates by blast radius and flags unknown/many-dependent services to humans, but the heterogeneity of affected parties is handled via blast-radius proxy rather than named stakeholders.
6. Threshold/time-horizon awareness: 8/10 — Window converts one-way to two-way doors, "escalate by severity not by volume" is a sharp framing, rate cap bounds burst loss; slightly less explicit than R1/R2 about the exact moment of finality being singular.
TOTAL: 50/60

## Recommendation R4
1. Structural coherence: 9/10 — Sort-by-undo-cost, make-irreversible-reversible (staged drain→quarantine→tombstone→purge, every stage abortable), propose/authorize split where the gate only acts on an authorization it did not produce, durable record, and a bounded urgency lane cohere well.
2. Failure-mode anticipation: 9/10 — Directly addresses the urgency-bypass risk (bypass still soft-deletes, time-boxed, logged, reviewed after) so urgency cannot "quietly collapse the split back into one motion"; checker-can-downgrade-not-just-refuse, and rubber-stamp auditability via records.
3. Implementability: 9/10 — Staged teardown phases, last-copy check against backup/replication inventory, dependency map of callers including silent consumers, execution gate keyed to external authorization — all concrete and standard.
4. Mechanism grounding: 8/10 — Strong on staged transitions and evidence sources (backup inventory, up-to-date caller map); windows are described qualitatively ("sized to how catastrophic") with fewer numeric anchors than R1/R3.
5. Stakeholder/equity fit: 7/10 — Distinguishes externally-depended-upon and irreplaceable for human gating and names silent/infrequent consumers, but who-bears-the-cost framing stays implicit.
6. Threshold/time-horizon awareness: 8/10 — "Self-heals inside the window" core guarantee and the explicit emergency lane that never hard-deletes are good; somewhat less crisp than R1/R2 on a blast-radius/rate cap (urgency is handled but mass-cascade limiting is weaker).
TOTAL: 50/60

## Recommendation R5
1. Structural coherence: 7/10 — Five parts compose into two paths plus a defer-and-hold fallback, but the dependency probe and the independent gate are presented as separate parts that overlap, and there is no explicit blast-radius/rate cap, so a confirmer-level or rule fault could fan out more than in R1/R2/R3/R6.
2. Failure-mode anticipation: 8/10 — Two named cautions are sharp: rubber-stamp/click-through (tie gate to consequence scope and dependency findings) and the subtle "we can always restore" excuse (teardowns, broken dependents, trust are not restored by un-deleting bytes); but no cascade/rate cap and no drift-on-burst signal.
3. Implementability: 8/10 — Tombstone, quarantine grace period, disable-and-isolate, second independently-configured component or human are all realistic and within operator control.
4. Mechanism grounding: 7/10 — Fail-safe-on-uncertainty rule and grace-period sizing (several days to a few weeks) are concrete, but the record is explicitly "after-the-fact-readable" yet "written before" — a slight internal tension, and fewer hard thresholds than R1/R3.
5. Stakeholder/equity fit: 7/10 — The "trust and dependents are not restored by un-deleting bytes" caution is the strongest equity insight in the set, recognizing non-data harm; tiering to stakes is present but stakeholder heterogeneity is not deeply enumerated.
6. Threshold/time-horizon awareness: 8/10 — Strong on "the gate sits before reclamation, never after; a review after the data is gone is only a record of damage" and defer-as-least-harmful-state; weaker on bounding mass/burst loss at the threshold.
TOTAL: 45/60

## Recommendation R6
1. Structural coherence: 9/10 — Two tracks, holding state with restore key, shadow dependency probe that auto-restores on breakage, independent concurring checker, pre-action record, and rate/blast cap interlock; the checker-as-catch-and-stop (not hand-approve) design is what keeps the system from stalling, and removing it re-introduces the bottleneck.
2. Failure-mode anticipation: 9/10 — Names cascade (rate/blast cap, batch/throttle), stall (auto-proceed on unobjected window so the checker is not a gate), and rubber-stamp (checker concurrence sampled and audited) — all three with concrete counters.
3. Implementability: 9/10 — Black-hole-and-watch shadow teardown, restore-key tombstone, delayed separate reclaimer, sampled-audit checker are buildable and within stated operator powers.
4. Mechanism grounding: 9/10 — Concrete windows (a week ordinary, up to a month for doubtful recovery), explicit unsure→treat-as-final rule, shadow-probe mechanics, operator override (force early restore, or logged emergency early purge), and classifier recalibration feedback.
5. Stakeholder/equity fit: 7/10 — Tiers windows by catastrophe potential and flags unknown/unverified dependents and external-copy doubt for the cautious side, but who-bears-the-cost is again carried by blast radius rather than named parties.
6. Threshold/time-horizon awareness: 9/10 — "The window is the visible point of no return; everything before it is reversible" is the crispest threshold framing in the set; auto-restore-on-breakage before finality, operator early-purge escape valve, and the only-an-expired-unobjected-window-makes-it-permanent rule are all explicit.
TOTAL: 52/60

---

## Comparison (~150 words)

Six near-identical architectures; the spread is about execution, not concept. R6 edges ahead: it states the threshold most crisply ("the window is the visible point of no return"), is the only one whose checker is explicitly catch-and-stop rather than a gate (directly solving the stall failure), and pairs concrete windows with a rate cap, shadow auto-restore, and a sampled-audit anti-rubber-stamp guard. R1 matches it on rigor and threshold framing and adds the proportional-scaling and consequence-scope discipline, losing a hair on the reviewer being a hand-approval bottleneck. R2, R3, R4 are excellent and roughly tied: R2 has the best drift-detection, R3 the best isolation (low-privilege aged-out reclaimer) and numbers, R4 the best urgency-bypass handling. R5 trails: no rate/blast-radius cap leaves a real cascade gap and its parts overlap less cleanly — though its "un-deleting bytes does not restore trust or dependents" caution is the sharpest single equity insight.

## Ranking, best to worst
R6 (52) > R1 (51) > R2 = R3 = R4 (50) > R5 (45)

Tie-break among R2/R3/R4: R4 marginally first for closing the urgency-bypass hole, then R2 for drift-on-burst detection, then R3.

## Would adopt
R6 — it most directly satisfies both halves of the success criterion: the catch-and-stop (not hand-approve) checker plus auto-proceed-on-unobjected-window is the design least likely to stall routine maintenance, while the rate cap, shadow auto-restore, and pre-purge concurrence make a single mistaken judgment non-fatal. I would graft R1's explicit proportional-scaling rule and R5's "restoring bytes does not restore trust/dependents" caution onto it.
