pi-extensions/docs/adr/0008-enforce-user-assumed-risk.md

status

status
accepted

Enforce as user-assumed risk — promotion gates leave the runtime

PIEXTENSIO-23. This ADR supersedes the runtime effect of the per-segment promotion floor (PIEXTENSIO-10, as consumed by PIEXTENSIO-21) while keeping every historical artifact immutable. Enforce stops being a "model earned safety certification" mode and becomes what it actually is: a convenience mode where the user explicitly assumes the risk of model misjudgment to reduce manual review.

What changes

1. The three promotion record gates (cohort_qualified, owner_approval, activation) are no longer Enforce authority inputs. The truth table keeps its fail-closed health gates — audit health, telemetry, result kind, review acknowledgement, generation-current — but a session with no promotion records can now hold Enforce authority.
2. Risk contract replaces certification. Writing mode: "enforce" in config v2 is the consent: the user authorizes the selected judge model to approve ordinary operations on their behalf and accepts missed/wrong judgments. The project makes no "model safety certification" claim and does not attempt to cover all dangerous shell behavior. AI allow can auto-run; AI deny/defer still fall back to the human dialog (no auto-deny authority is introduced).
3. Narrow built-in high-risk override (code-level, not a sandbox). A small deterministic classifier recognizes clear-cut command shapes in four categories — data loss / history rewrite (ADR 0007's enumerated shapes), publish/deploy/infrastructure destruction, privilege escalation / system modification, and direct credential read/output/delete/replace. In Shadow it still calls the model (quality observation stays) and records the override; in Enforce it skips the model and defers immediately with an explicit risk code. It matches only well-known explicit shapes — no alias resolution, script-content analysis, variable expansion, or "every opaque command defers" rule. There is deliberately no alwaysPrompt user config: that was rejected as re-inventing policy text-matching; if a "this permission rule always forces a human" need ever emerges, it belongs in the permission-system's own force_prompt / delegation-exclusion semantics, not in the Judge.
4. Config v2 with explicit migration. version: 2 adds model: {provider, id} — a fixed judge model, resolved per ask; if it cannot be resolved (unknown model, unauthenticated, unsupported API) the ask defers with a visible infrastructure code, never silently falling back to the session model. Unset model keeps following the session model (legacy behavior). Legacy v1 mode: "enforce" meant "exact identity certified" under the old governance; upgrading must not silently widen that consent, so a config without version: 2 that sets enforce falls back to Shadow with a diagnostic requiring one explicit migration.
5. One session-start notification in Enforce mode shows the actual judge model and the risk contract; it does not repeat per ask.

What is explicitly preserved

• Historical evidence immutability. promotion-records.jsonl, the cohort declarations/reports under docs/testing/, and every archived analyzer artifact stay byte-for-byte as they are. The runtime stops consuming them; nobody deletes or rewrites them. The failed cohorts are not reopened.
• ADR 0006 self-sufficiency stands. The Judge-owned audit log, its sticky health gate, and the fail-closed truth-table discipline are unchanged; only the three promotion inputs leave the table.
• ADR 0007's boundary is unchanged in substance — irreversible operations always defer. v4 keeps it at the prompt level; this ADR adds a deterministic preflight backstop for the enumerated shapes (exactly the fallback 0007 anticipated: "deterministic preflight defer for the enumerated irreversible shapes").

Why

The certification framing asked a personal convenience tool to carry an enterprise-grade evidentiary apparatus, and the apparatus could not even carry itself: v4 exposed a protocol contradiction — the declaration froze earliest report asOf 22:05Z while the report's actual asOf is 21:15:06Z, the PASS outcome was recorded at 21:20Z (before the frozen earliest report), and the -04 declaration incorporates -02's frozen sections "by reference" although the current file no longer contains them. These are recorded here as legacy-mechanism limitations, not rewritten away. The honest conclusion is that the runtime gate derived no real safety from a process this fragile, while the user-visible value of Enforce (fewer dialogs on ordinary commands) never needed it. What actually needs to stay certain — irreversible shapes reach a human, auditability, fail-closed behavior on infra failures — is kept by the narrow override and the retained health gates.

Consequences

• promotion.ts, its tests, and tools/promotion-record.ts are deleted; disk records survive. Future model-quality evidence (advisory catalog, replay runs) informs recommendations and documentation only, never runtime authority — milestone 2 of PIEXTENSIO-23.
• Rollback is mode: "shadow".
• Revisit trigger: multi-user / delegated deployments where "the config author is the risk bearer" stops being true.