# Condition C03 — working

## STATE: problem
- **statement.** An autonomous maintenance agent acts continuously over a large fleet; it can permanently delete data, retire services, reclaim storage. Most actions are routine/reversible; a rare fraction are catastrophic and unrecoverable (deleting the last copy; tearing down a silently-depended-on service). Today the agent judges-and-acts in one motion: no independent check at the moment of action, no durable record of why a destructive action was taken. Operators can change the agent's reasoning, its pre-action obligations, and the surrounding components.
- **decision.** Design the handling of rare destructive/unrecoverable actions so a single mistaken judgment cannot cause unrecoverable loss, without slowing routine reversible maintenance.
- **success_criteria.** No single mistaken judgment → unrecoverable loss; routine reversible work proceeds without meaningful slowdown.
- **failure_criteria.** A single bad call still destroys something irreplaceable; OR safeguards so heavy that ordinary cleanup stalls.

## VERBS RUN (verb + why)
1. **match (retrieve) — search_by_facets.** Oblique problem: it instantiates ≥5 structures at once (irreversibility; decide=act with no independent check; missing rationale record; rare catastrophe in a routine stream; hidden dependencies; proportional scrutiny). A blended query would collapse these. Read per-facet lists.
2. **match (retrieve) — search_prime** with a single domain-stripped meta-model to confirm the governance neighborhood (checks_balances, separation_of_powers, adjudication, accountability surfaced — the proportional-independent-review core).
3. **match (deepen) — get_archetype** ×4 on the top fused archetypes; **get_prime** on accountability for the record-pillar structure.
4. **salience-rank / prune** (below).
5. **compose** the typed relational model (referential-integrity check).
6. **lift L1** (model → meta_model, witness-check).
7. **lift L2** coverage-enforcement against the primary pattern (the central gated verb).
8. **evaluate-fit** anti-signature gate on each candidate.

## STATE: candidates (retrieval)
Facet retrieval surfaced, per facet:
- irreversibility → `irreversible_commitment_management` (0.76 top), `option_preservation`, `compensating_transaction`, `idempotent_operation_design`.
- decide=act / no independent check → `checks_and_balances_architecture` (0.72), `autonomous_action_zone_protection`, `responsibility_assignment_for_action`.
- no rationale record → `irreversible_commitment_management`, `layered_record_accumulation`, `bias_specific_decision_audit`; prime `accountability`.
- rare catastrophe in routine stream → `fail_safe_default`, `tail_risk_preservation`, `sequestration_containment`, `harmful_emergence_containment`.
- hidden dependencies → `dependency_exposure` (0.75 top), `common_mode_failure_analysis`.
- proportional scrutiny → `checks_and_balances_architecture`, `regression_to_mean_guardrail`, `procedural_fairness_due_process`.

## STATE: salience-rank → prune (operative subset)
- **irreversible_commitment_management — LOAD-BEARING (primary operative pattern).** Its logic *is* the success criterion: separate irreversible residue from reversible risk; mark the point-of-no-return; place a gate *before* it; scale scrutiny to finality so routine work isn't burdened; stage exposure; keep a finality record. This pattern's components are the coverage target.
- **checks_and_balances_architecture — LOAD-BEARING.** Supplies the "no single mistaken judgment is final" structure: an *independent* checker separate from the acting agent, with real review power, plus the accountability record. Removing it → the agent still self-judges. Directly answers the decide=act facet.
- **dependency_exposure — LOAD-BEARING.** Supplies the consequence-scope mechanism for the *silent-dependency* hazard (tearing down a service others depend on). Without it the gate can't tell catastrophic from routine for service-retirement.
- **fail_safe_default — LOAD-BEARING.** Supplies the *safe default state* (quarantine / tombstone / soft-delete) so that even an executed destructive action is not yet irreversible — the structural guarantee that one bad call cannot destroy.
- **accountability (prime) — context/support.** Structures the record pillar (actor, record, standard, consequence); folded into the finality-record component.
- Cut: `option_preservation`, `compensating_transaction`, `regression_to_mean_guardrail`, `procedural_fairness_due_process` — each genuinely-adjacent but subsumed (option_preservation/compensating_transaction = the soft-delete-retention idea already carried by fail_safe + staged path; regression_guardrail = statistical anomaly flavor not central; due_process = affected-party voice, not the operative need here, which is power-separation + finality, per checks-and-balances' own neighbor distinction).

## STATE: model (compose) — typed relational, referential integrity
Nodes:
- N1 agent {actor} — proposes & executes.
- N2 classifier {function} — reversibility/criticality triage at proposal time.
- N3 reversible-lane {path} — direct execution.
- N4 destructive-gate {control} — pre-threshold gate.
- N5 independent-reviewer {actor} — separate authority (second agent instance / policy engine / human escalation), cannot be the actor.
- N6 dependency-probe {function} — reverse-dependency + last-copy check.
- N7 safe-state store {mechanism} — tombstone/quarantine with retention TTL (soft delete; service drain-not-destroy).
- N8 finality-record {record} — rationale, evidence, authority, scope, reversal-residue.
- N9 reclaimer {function} — permanent purge after TTL, gated on no-recall.
- N10 monitor {function} — capture/stalemate + override audit + anomaly burst.

Edges (every edge references declared nodes; every operative prime annotated):
- N1 →proposes→ N2 [irreversible_commitment_management: irreversibility_check]
- N2 →routes_reversible→ N3 [irreversible_commitment_management: smallest_viable_exposure / proportionality]
- N2 →routes_destructive→ N4 [irreversible_commitment_management: point_of_no_return_marker]
- N4 →requires_scope_from→ N6 [dependency_exposure: consequence_scope / failure_path]
- N4 →requires_approval_from→ N5 [checks_and_balances_architecture: separated_function + review_power]
- N4 →writes→ N8 [accountability + irreversible_commitment_management: finality_record]
- N4 →commits_to→ N7 [fail_safe_default: safe_default_state]
- N7 →elapses_TTL→ N9 [irreversible_commitment_management: staged_commitment / fail_safe_default: recovery_policy]
- N9 →verifies_no_recall_then_purges→ (terminal) [fail_safe_default: hazard_containment]
- N5,N4,N9 →audited_by→ N10 [checks_and_balances_architecture: capture/stalemate monitor]
Referential integrity: ✓ all 10 edges connect declared nodes; all 4 operative primes + accountability appear as annotations.

## STATE: meta_model (lift L1) — domain-stripped skeleton (witness in model)
- Roles: actor-that-acts (N1); triage-of-irreversibility (N2); independent-judge-not-the-actor (N5); scope-revealer (N6); reversible-buffer-before-finality (N7); rationale-ledger (N8); finalizer-after-delay (N9); drift-watcher (N10). — no domain terms; each has a model witness ✓.
- Relations: high-residue branch is separated from low-residue branch; the irreversible branch passes an independent check *and* a delayed-finality buffer before becoming final.
- Invariants: (a) no actor both decides and makes-final an irreversible act; (b) every irreversible act is preceded by a reversible interval; (c) finality is reached only by elapse + non-recall, never by the original judgment alone; (d) low-residue acts bypass all of this. — all witnessed ✓, no domain vocabulary ✓.

## STATE: coverage_map (lift L2) — PRIMARY PATTERN = irreversible_commitment_management (13 components)
| # | Component | Status | Witness / Reason |
|---|---|---|---|
|1|Irreversibility Check|**instantiated**|N2 classifier: per-action reversibility test (does a true restore exist?) — last-copy, no-other-replica, destructive-vs-disable.|
|2|Consequence Scope|**instantiated**|N6 dependency-probe: reverse-dependency graph + "who reads/calls this" before any teardown/delete.|
|3|Point-of-No-Return Marker|**instantiated**|N4 gate sits exactly at the destructive boundary; purge (N9) is the only true point-of-no-return and is pushed *past* a TTL.|
|4|Consent or Review Gate|**instantiated/homolog**|N5 independent reviewer (separate authority) approves before commit — homolog of "consent" via **checks_and_balances** separated-function review (no human owner per action, so authorization not consent).|
|5|Staged Commitment Path|**homolog**|N7→N9 two-phase delete (soft-delete now, hard-delete after TTL) is the staging axis here, in *time* rather than in *population*; discharges "don't go system-wide at once."|
|6|Simulation or Pilot Probe|**homolog**|N6 dry-run dependency check + drain-mode for services (stop traffic, observe breakage) before destroy — a rehearsal that yields evidence without finality.|
|7|Exposure Limit|**instantiated**|Blast-radius cap: a destructive batch is rate-limited and scope-capped (per-shard / per-tenant) so one mistaken rule cannot fan out fleet-wide.|
|8|Compensation Rule|**homolog**|N7 retention buffer + restore path *is* the residual-mitigation: recall within TTL fully repairs; folds compensating_transaction.|
|9|Finality Record|**instantiated**|N8: rationale, evidence, scope, authorizing reviewer, reversal-residue, purge-time — contemporaneous, append-only (accountability's transparency+assignment+consequence pillars).|
|10|Cooling-Off Period|**instantiated**|The TTL between soft-delete and purge *is* the cooling-off; also a hold window before high-criticality teardown.|
|11|Independent Review Panel|**instantiated/homolog**|N5 reviewer independent of N1; for the highest-criticality tier (last-copy of irreplaceable data, top-tier service) escalate to human. Homolog: automated independent-policy-engine as routine reviewer.|
|12|Impact Monitoring Signal|**instantiated**|N10 monitor + post-soft-delete watch: after drain/soft-delete, watch for dependents erroring during the TTL; auto-abort purge if breakage detected.|
|13|Rollback Residue Assessment|**instantiated**|N2/N1 must answer "what stays changed after restore?" — distinguishes true soft-delete (zero residue) from acts with residue (e.g. already-overwritten storage), which get the strongest tier.|

**No component is `missing`.** (Cross-pattern: checks_and_balances' separated_function/checking_actor/review_power/accountability_record/capture-monitor are all instantiated in N5/N8/N10; fail_safe_default's safe_default_state/recovery_policy/manual-override/status-indicator instantiated in N7/N9 + N10 + record; dependency_exposure's map/criticality/failure-path instantiated in N6.)

## STATE: gate_log (evaluate-fit) — anti-signatures walked against THIS scenario
- **irreversible_commitment_management** anti-sigs: *ordinary reversible change* — not tripped, design routes those to N3 untouched (this is the whole speed guarantee). *generic approval without finality* — not tripped, gate fires only on real irreversibility. *failure-response-after-event* — not tripped, gate is pre-commit. *contained-learning-experiment* / *psychological precommitment* — N/A. → **keep.**
- **checks_and_balances_architecture** anti-sigs: *low-stakes single-owner work* — not tripped (only destructive tier gets the check). *pure coordination* / *only participation missing* / *only incentive conflict* — not tripped; the core failure here is genuinely concentrated decide=act+finalize power. Failure mode "rubber-stamp" guarded by requiring reviewer to read N6 scope evidence; "gridlock" guarded by N3 bypass + TTL auto-progression. → **keep.**
- **dependency_exposure** anti-sigs: *already explicit & owned* — not tripped (dependencies are silent, that's the hazard). *infinite upstream search* — guarded by a scoped, decision-relevant boundary (direct + one-hop callers, criticality-thresholded). → **keep.**
- **fail_safe_default** anti-sigs: *no identifiable safe state* — not tripped, soft-delete/quarantine is a clean safe state for deletion; for storage-reclaim the safe state is "reserve-not-overwrite." *mechanism-only (just an e-stop)* — not tripped, embedded in full default-state + recovery policy (N7→N9). *goal is continuity not safety* — N/A. → **keep.**
No candidate disqualified. Proportionality invariant (cheap reversible path untouched) confirmed against the failure criterion.

COST: ~9 operations, ~21k tokens.

===RECOMMENDATION_BEGIN===
Split the agent's decision from its execution, and split it only where it matters. The agent keeps a single fast lane for the overwhelming majority of its work: any action that can be fully undone — disabling rather than deleting, clearing caches, reclaiming clearly-unused scratch space, anything with an intact restore path — runs immediately, with no extra review and no slowdown. The discipline below applies only to the narrow class of actions that leave something permanently changed.

The first move is to make the agent classify, at the moment it forms an intent, whether the action is truly irreversible. The test is concrete: is this the only copy, with no other replica or backup? Will the underlying storage be overwritten rather than merely dereferenced? Does retiring this service stop something others silently rely on? An action is treated as destructive if a faithful restore does not exist. Everything else takes the fast lane.

For destructive actions, the central change is that the agent may no longer finalize its own judgment. Three things must happen before anything becomes permanent, and a fourth guarantees that even then a single error is survivable.

Before acting, the agent must establish the consequence scope. For a service teardown or a storage reclaim, it runs a reverse-dependency probe — who reads this data, who calls this service — and, where possible, a drain or shadow step: stop serving traffic and observe whether anything breaks, without yet destroying. For data, it confirms whether another copy exists. This is what separates a routine cleanup from a catastrophe, and it must produce evidence, not a guess.

That evidence then goes to an independent reviewer that is not the acting agent — a separate policy engine or a second, differently-configured agent instance, with the authority to refuse, not merely advise. For the highest-stakes tier — the last copy of irreplaceable data, or a top-tier shared service — the reviewer escalates to a human. The reviewer's job is to check the scope evidence and the stated reason, so the check is real rather than a rubber stamp. To prevent the safeguard from becoming gridlock, the reviewer operates only on the destructive lane and has a bounded response window; if it never engages, the action does not silently proceed — it waits.

Crucially, when a destructive action is approved and executed, it does not destroy. It moves the target into a recoverable holding state: data is tombstoned and retained; a service is drained and quarantined but not yet dismantled; storage is reserved-for-reclaim but not overwritten. A retention window — set by criticality, longer for higher stakes — must elapse before a separate reclaimer permanently purges. During that window the system watches for dependents erroring; if breakage appears, the purge is automatically aborted and the holding state restored. Permanence is reached only by the combination of an elapsed window and confirmed non-recall — never by the original judgment alone. This is the structural guarantee that no single mistaken call can cause unrecoverable loss: there is always a reversible interval, with monitoring, between decision and finality.

Every destructive action, at the moment it is committed, writes a durable, append-only record: what was acted on, the reason, the scope evidence gathered, which reviewer authorized it, what would remain changed after a restore, and the scheduled purge time. This record is contemporaneous and tamper-evident, so the reasoning behind each irreversible action survives the agent that made it and can be audited later. A monitor watches the whole destructive lane for two opposite failures — reviewers that approve everything without scrutiny, and actions that stall — plus any unusual burst of destructive intents, which is itself a signal that the agent's judgment may have drifted.

Tune the weight to the stakes. Reversible work: no gate, full speed. Destructive but low-consequence (a tombstone with a clear single owner and no dependents): automated independent review and a short holding window. Destructive and high-consequence (sole copy, shared service, overwrite with residue): dependency proof, human escalation, a long holding window, and an aborting monitor. Bound the blast radius regardless: a destructive batch is rate-limited and scoped per shard or tenant, so one faulty rule cannot fan out across the fleet before the holding state and monitor catch it.

The final operating rule: an action may be irreversible or it may be unilateral and immediate, but it may never be both — anything that truly cannot be undone must first pass an independent check, then live in a recoverable holding state under watch, and become permanent only after time passes with no sign of harm; everything reversible runs at full speed, untouched.
===RECOMMENDATION_END===
