# Control-policy working — destructive maintenance agent

## STATE: problem
- statement: A continuous maintenance agent across a large fleet can permanently delete data, retire services, reclaim storage. Most actions routine/reversible; a small fraction are catastrophic/unrecoverable. Today the agent judges AND acts in one motion, with no external check at the moment of action and no durable account of why. Operators control its reasoning, pre-action requirements, and surrounding components.
- success_criteria: No single mistaken judgment can cause unrecoverable loss; AND routine reversible maintenance proceeds without meaningful slowdown.
- failure_criteria: A single bad call can still destroy something irreplaceable; OR safeguards so heavy ordinary cleanup stalls.

## Verbs run (verb + why)

1. **match (retrieve)** — `corpus_stats` (sanity: engine + graph available) then `search_by_facets` with 6 domain-stripped facets, because this is OBLIQUE: it instantiates several structures at once (irreversibility, self-judging actor, no independent review, no record, rare-in-routine, recoverability). Read PER-FACET lists, not just fusion.
   - Per-facet signal (the latent patterns a blended query would bury):
     - "irreversible action that cannot be undone" → prime `irreversibility`/`reversibility_and_irreversibility`; archetype `irreversible_commitment_management` (0.76), `idempotent_operation_design`, `compensating_transaction`.
     - "no independent review before the consequential act" → archetype `checks_and_balances_architecture`, `independent_verification_oversight`.
     - "actor that acts is the same one that judges itself" → `checks_and_balances_architecture` (0.69), `principal_agent_alignment`, `reflexive_self_monitoring`, prime `incentive_compatibility`.
     - "no durable record of why" → `accountability_chain_design`, `bias_specific_decision_audit`, prime `accountability`, `traceability`.
     - "rare high-consequence case hidden in routine stream" → `tail_risk_preservation` (0.74), `deviant_case_analysis`, prime `black_swan...`, `risk`.
     - "make destructive step reversible/recoverable instead of final" → `fail_safe_default`, `controlled_reentry`, prime `fail_safe`, `reversibility`.
2. **match (retrieve)** — pulled full archetype records: `irreversible_commitment_management`, `fail_safe_default`, `checks_and_balances_architecture`, `independent_verification_oversight`, `tail_risk_preservation`, `accountability_chain_design`. These six carry the components + anti-signatures I need.
3. **salience-rank** — see below.
4. **prune** — to operative subset.
5. **compose** — typed relational model (referential integrity check).
6. **lift L1** — model → domain-stripped skeleton (witness check).
7. **lift L2 (coverage-enforcement)** — coverage map against the operative pattern + supporting patterns.
8. **evaluate-fit (gate)** — anti-signatures of each operative pattern walked against THIS scenario.

## STATE: operative_primes / candidates → salience-rank

| prime / pattern | type | salience | rationale (ablation: remove it → does the recommendation change?) |
|---|---|---|---|
| `irreversibility` (prime) + `irreversible_commitment_management` (archetype) | structural / mixed | **load_bearing** | The entire problem IS the irreversible subset. Remove → no point-of-no-return marker, no staging, no compensation; design collapses to ordinary change control. THE operative pattern. |
| `checks_and_balances` / `checks_and_balances_architecture` (maker/checker) | framed→structural core | **load_bearing** | "Acts and judges in the same motion" = concentrated authority + self-review. Remove → a single mistaken judgment can still execute. Directly hits success criterion #1. Used for the *separation* core, NOT the full power-distribution doctrine. |
| `fail_safe_default` | mixed | **load_bearing** | Supplies what happens when the agent is *unsure* a thing is safe: default to the non-destructive (recoverable) state, not the destructive one. Remove → uncertain cases still act destructively. |
| `tail_risk_preservation` | structural | **load_bearing** | Supplies the routine/rare *separation* that protects success criterion #2 (no slowdown). Remove → either everything gets heavy review (stall) or nothing does (catastrophe). It is the criticality classifier + coverage floor. |
| `accountability_chain_design` (rationale/finality record) | framed | context→**load_bearing** | The "no durable account of why" facet. Remove → can't audit, can't learn, can't reconstruct a near-miss. Discharged as the finality/decision record. |
| `independent_verification_oversight` | framed | context | The check actor; its *function* is subsumed by checks-and-balances maker/checker here (no separate org needed). Kept as the source of "independence must be real, with evidence access" but not instantiated as a standalone body. |
| `compensating_transaction` / `idempotent_operation_design` | structural | context | Inform the recoverability mechanism (soft-delete / quarantine = compensable). Folded into the staged-commitment path. |

**prune verdict:** operative subset = {irreversible_commitment_management (primary), checks_and_balances (maker/checker core), fail_safe_default, tail_risk_preservation, accountability/finality record}. Cut: full separation-of-powers doctrine, standalone external audit body, generic dispute adjudication — justified under gate below.

## STATE: model (compose — typed relational, referential-integrity checked)

Nodes:
- N1 `agent` (kind: actor) — judges+executes
- N2 `action` (kind: event) — a proposed maintenance op
- N3 `reversibility_classifier` (kind: gate) — routine-reversible vs destructive-unrecoverable
- N4 `recoverable_buffer` (kind: state) — soft-delete / quarantine / tombstone region
- N5 `checker` (kind: actor) — second independent judgment, distinct from N1's reasoning
- N6 `dependency_probe` (kind: gate) — tests whether other systems silently rely on N2's target
- N7 `finality_record` (kind: store) — durable why/who/evidence log
- N8 `safe_default` (kind: state) — non-destructive fallback when uncertain
- N9 `reclaimer` (kind: process) — delayed, post-expiry permanent purge

Edges (every edge references declared nodes; every operative prime appears as a prime_annotation):
- E1 N1→N2 `proposes` {irreversible_commitment_management: identify-finality}
- E2 N2→N3 `classified_by` {tail_risk_preservation: criticality_classification; irreversibility: irreversibility_check}
- E3 N3→N2 `routes_reversible_fast` {tail_risk_preservation: main-focus-rule preserved}
- E4 N3→N4 `routes_destructive_to_buffer` {irreversible_commitment_management: staged_commitment + compensation; fail_safe_default: safe-default}
- E5 N4→N6 `triggers_probe` {checks_and_balances: review_power; dependency-detection}
- E6 N4→N5 `requires_second_judgment` {checks_and_balances: separated_function + checking_actor; independent_verification_oversight: verifier_independence}
- E7 N1→N7 / N5→N7 `writes_rationale` {accountability_chain_design: rationale_record + finality_record}
- E8 N3→N8 `defaults_when_uncertain` {fail_safe_default: shutdown/isolation rule}
- E9 N4→N9 `purges_after_window` {irreversible_commitment_management: point_of_no_return marker + cooling_off}
- E10 N5→N9 `can_block_or_release` {checks_and_balances: veto/remedy; fail_safe_default: recovery_policy}
**Referential integrity: PASS** — all 10 edges connect declared nodes N1–N9; all five operative patterns appear ≥1 as annotations.

## STATE: meta_model (lift L1 — domain-stripped skeleton + witness check)

Roles: ACTOR-that-both-judges-and-commits; PROPOSED-COMMITMENT; CRITICALITY-SORTER separating low-stakes-reversible from high-stakes-final; HOLDING-STATE that makes a "final" act provisionally undoable; INDEPENDENT-SECOND-JUDGE; DEPENDENCY-DETECTOR; DURABLE-RATIONALE-STORE; CONSERVATIVE-DEFAULT-on-uncertainty; DELAYED-FINALIZER.
Relations: sort→(fast-path | holding-state); holding-state→(second-judgment ∧ dependency-detect ∧ record); uncertainty→conservative-default; elapsed-window∧no-objection→finalize.
Invariants: (a) no single judgment crosses the point-of-no-return alone; (b) the common reversible case bypasses all heavy machinery; (c) every final act has a reconstructable reason; (d) "final" is converted to "delayed + recoverable" wherever physically possible.
**Witness check (every role/relation has a witness in model; no domain terms):** ACTOR=N1, COMMITMENT=N2, SORTER=N3, HOLDING-STATE=N4, SECOND-JUDGE=N5, DEPENDENCY-DETECTOR=N6, RATIONALE-STORE=N7, CONSERVATIVE-DEFAULT=N8, DELAYED-FINALIZER=N9; relations = E2,E3/E4,E6,E5,E8,E9. No domain-specific terms remain. **PASS.**

## STATE: coverage_map (lift L2 — THE coverage check)

Primary pattern: **irreversible_commitment_management** (13 components). Statuses below; supporting-pattern components folded in as homologs where they serve the same function.

| # | Component | Status | Witness / reason |
|---|---|---|---|
| 1 | Irreversibility Check | **instantiated** | N3 reversibility_classifier: flags any op whose target is the only copy / has unknown dependents / is a hard purge. |
| 2 | Consequence Scope | **instantiated** | N6 dependency_probe maps who/what silently depends on target before purge; classifier records blast radius. |
| 3 | Point-of-No-Return Marker | **instantiated** | N9: the purge window boundary is the explicit PONR; before it, recoverable; after it, final. |
| 4 | Consent or Review Gate | **homolog** | No human "consent" per action; discharged by N5 independent second-judgment (checks_and_balances checking_actor) gating any purge — function = authority must exceed the executing actor. |
| 5 | Staged Commitment Path | **instantiated** | N4 recoverable_buffer = stage 1 (provisional/soft-delete), N9 = stage 2 (permanent). Destructive act is split. |
| 6 | Simulation or Pilot Probe | **instantiated** | N6 dependency_probe runs the retirement in "shadow"/blackhole mode (cut traffic, watch for breakage) before teardown. |
| 7 | Exposure Limit | **instantiated** | Rate/blast-radius cap: no single decision may purge above a small fraction of fleet/storage class per window; bulk = batched + throttled. |
| 8 | Compensation Rule | **homolog** | "Restitution" → recoverability itself: buffered data/services are restorable for the retention window; tombstone keeps restore key. (compensating_transaction folded in.) |
| 9 | Finality Record | **instantiated** | N7 finality_record: who/what/why/evidence/classification for every destructive act (accountability_chain rationale_record homolog merged here). |
| 10 | Cooling-Off Period | **instantiated** | The retention window (e.g. 7–30 d by criticality) before N9 purges = enforced delay. |
| 11 | Independent Review Panel | **homolog** | Not a human panel; N5 = a *distinct, independently-reasoning* checker component (different ruleset/model instance) that must concur. independence = it cannot be the same judgment path that proposed. |
| 12 | Impact Monitoring Signal | **instantiated** | After teardown-in-buffer, monitor dependents/error rates during window; spike → auto-restore (fail_safe recovery_policy). |
| 13 | Rollback Residue Assessment | **instantiated** | Classifier explicitly asks "does restore truly recover this?" (e.g. external copies, downstream consumers) — residue cases get longest window + mandatory checker. |

Supporting-pattern coverage (components that must not be left missing):

- **fail_safe_default** — Hazardous Failure Mode = wrong destructive judgment: **instantiated** (N3). Safe Default State = N8 (provisional/recoverable, never hard-purge under uncertainty): **instantiated**. Failure Detector = uncertainty/low-confidence + dependency-probe alarm: **instantiated** (E8). Shutdown/Isolation Rule = route to buffer not purge: **instantiated** (E4). Manual Override = operator can force-restore or force-purge with logged reason: **instantiated** (operators control surrounding components). Recovery Policy = monitored window + auto-restore: **instantiated** (N9/E10). Status Indicator = buffer state visible to dependents/operators: **instantiated**.
- **checks_and_balances (maker/checker core)** — Separated Function: **instantiated** (judge≠sole-committer for destructive class). Checking Actor: **instantiated** (N5). Review Power / Veto-Remedy: **instantiated** (E10 block/release). Capture/Stalemate Monitor: **homolog** — auto-finalize on window-expiry-with-no-objection prevents stalemate/paralysis; sampling audit of checker concurrence prevents rubber-stamp. Power Map / Coordination / Escalation / Emergency Override: **correctly_declined** — full org power-distribution doctrine would distort a single-agent automation case; over-lift guard: the problem is one decision path needing one separation, not a multi-actor government. Reason recorded.
- **tail_risk_preservation** — Criticality Classification: **instantiated** (N3). Coverage Floor (every destructive case gets ≥ buffer+record): **instantiated**. Exception Rule (route off fast path): **instantiated** (E4). Mainstreaming Trigger / Periodic Tail Review: **homolog** — periodic recalibration of the classifier thresholds from observed near-misses. Tradeoff Budget: **instantiated** as the rate-cap/exposure-limit. Abuse/Gaming Control: **correctly_declined** — no adversarial gaming actor here (internal agent, not hostile users); forcing it adds nothing. Reason recorded.
- **accountability_chain_design** — Action/Decision, Accountable Owner (the agent + checker), Rationale Record, Evidence Record, Closure Audit (post-window outcome logged): all **instantiated** via N7. Answerability Forum / Repair-Consequence Path: **homolog** — operator review of the record + auto-restore is the repair path; no separate forum needed for an automated single-actor system.

**No component left `missing`.** Finalize permitted.

## STATE: gate_log (evaluate-fit — anti-signatures walked against THIS scenario)

- **irreversible_commitment_management** anti-sigs: "ordinary reversible change" → NOT tripped (we *only* engage the heavy path for the irreversible subset; reversible ops keep ordinary control). "generic approval without finality" → NOT tripped (finality is the trigger). "failure response after event" → NOT tripped (we gate BEFORE the point-of-no-return). "psychological precommitment only" → NOT tripped (externally consequential). **VERDICT: keep.**
- **fail_safe_default** anti-sigs: "no identifiable safe default state" → NOT tripped (the recoverable/provisional state is strictly safer than hard-purge and exists). "intervention is only a device" → NOT tripped (full default-state policy, not just a stop button). "core need is continuity not safety" → NOT tripped (we accept delaying a purge). **VERDICT: keep.**
- **checks_and_balances** anti-sigs: "low-stakes single-owner reversible work" → NOT tripped for destructive class (high-stakes, irreversible); IS true for routine class, which is exactly why routine bypasses the check. "pure coordination" / "only participation missing" / "only incentives conflict" → NOT tripped. **VERDICT: keep (scoped to destructive class only).**
- **tail_risk_preservation** anti-sigs: "tail low-frequency AND low-stakes" → NOT tripped (rare but catastrophic). "main task is Pareto focus" / "unlimited accommodation with no criteria" → NOT tripped (bounded by criticality + rate cap). **VERDICT: keep.**
- **independent_verification_oversight** anti-sig: "primary problem is a missing built-in check inside a process; use self_checking_operation first" / "reciprocal power → checks_and_balances first" → PARTIALLY tripped → correctly demoted to context: we use its *independence* requirement but implement the check via maker/checker, not a standalone audit body. **VERDICT: fold, not standalone.**

No surviving anti-signature disqualifies the design.

COST: ~9 operations (1 corpus_stats, 1 search_by_facets[6 facets×2 targets], 6 get_archetype, 1 write), ~32k tokens.

===RECOMMENDATION_BEGIN===
Split the agent's work cleanly into two tracks, decided by a single fast judgment made before anything is touched: is this action recoverable, or is it final?

For the recoverable, everyday majority — clearing caches, deleting things that have other copies, reclaiming space that nothing depends on — keep the agent exactly as it is. It judges and acts in one motion, with no extra steps, no waiting, and no second opinion. This is the common case, it must stay fast, and nothing below should touch it. The whole point of the design is that the heavy machinery only ever engages for the rare final action, so routine maintenance does not slow down at all.

An action is treated as final whenever the agent cannot be confident it is recoverable: it would remove the last remaining copy of something, it would tear down a service whose dependents are unknown or unverified, or it is a hard, unrecoverable purge. Crucially, when the agent is *unsure* which track an action belongs to, it must treat it as final. Uncertainty always routes to the cautious side, never the destructive one.

For the final track, the core move is to make "final" stop being final at the moment of action. Instead of destroying immediately, the agent moves the target into a recoverable holding state — soft-deleted data kept behind a tombstone with a restore key, or a service that is cut off from traffic and quarantined but not yet dismantled. From the rest of the fleet's point of view the thing is gone; in reality it can be brought back in full for a retention window whose length scales with how catastrophic an error would be (for example a week for ordinary destructive ops, up to a month for anything where recovery is doubtful or external copies may not exist). Only after that window expires, with no objection raised, does a separate, delayed reclaimer perform the actual permanent purge. The window is the visible point of no return; everything before it is reversible.

Before an item can move past that point, two independent things must happen. First, a dependency probe runs the teardown in shadow form — traffic to a retiring service is black-holed and the fleet is watched for breakage; reads against to-be-deleted data are monitored — so silent dependencies surface while restoration is still trivial. If anything breaks, the item is automatically restored and the action is escalated rather than completed. Second, a checker that reasons independently of the path that proposed the action must concur. This checker is not the same judgment that decided to act; it is a distinct component with its own logic and access to the evidence, and it has the power to block the purge or release it. No single line of reasoning may carry a destructive action all the way to permanence by itself — that is what guarantees that one mistaken judgment cannot, on its own, destroy something irreplaceable.

Every action on the final track writes a durable record before it proceeds: what was targeted, why it was judged safe, what the dependency probe found, the checker's verdict, the classification, and the scheduled purge time. This record is the account that is missing today. It makes near-misses auditable, lets operators force an early restore or, in a genuine emergency, force an earlier purge with a logged reason, and feeds back into recalibrating the classifier when the agent misjudges a case.

Two limits keep this from becoming either toothless or paralysing. A rate-and-blast-radius cap forbids any single decision from sweeping a large fraction of a storage class or service tier into the holding state at once; large jobs are batched and throttled so a bad rule cannot cascade. And to avoid stalling, the checker is not a bottleneck that must actively approve everything — items proceed to scheduled purge automatically once the window elapses with no objection and no probe alarm; the checker's role is to *catch and stop*, not to hand-approve, and its concurrence on the destructive subset is sampled and audited so it never degrades into a rubber stamp.

The operating rule: routine reversible work runs untouched at full speed; anything final, or anything the agent is not sure is reversible, is first made reversible — moved to a monitored holding state, probed for hidden dependents, concurred by an independent checker, and recorded — and only an unobjected, expired waiting period, never a single judgment in the moment, is allowed to make it permanent.
===RECOMMENDATION_END===
