Five autonomy levels; reversibility is computed and is the boundary

Context

“The agent has full control over itself” must be true by design and safe by default. The review’s strongest objection to the first draft was that reversibility was asserted: enabling sshd, adding a user or opening a port are covered by generation rollback and irreversible in effect.

The three plans

• Grok (Q-12): propose only, apply after confirm, or autonomous inside a declared playground.
• Fable: capability grants auto | ask | deny per category; every action a diff; undo.
• Codex: levels 0–4 (Explain, Ask, Trusted workspace, Policy autonomy, YOLO); Ask by default; YOLO explicit with a persistent indicator and hard boundaries.

Decision

Reversibility is computed by the keeper over the rendered option diff. Unknown is irreversible. The explicit irreversible list: exposure, principals, secrets, boot and encryption, external devices, data deletion, git push, egress of file content. Taint: a turn whose context contains untrusted content is capped at level 1 for side effects; voice-origin intents are capped at level 2 unless confirmed on a physical input. Budgets per session (transactions per hour, closure delta, egress bytes, spend) downgrade to level 1 when exceeded. Tool visibility is scoped per session.

Three of the four this decision named exist, and all three are fed. The keeper records a transaction and its closure delta at the moment it applies one, and both refuse; the day’s egress is the proxy’s, kept where the bytes are and read back from its own ledger at startup (ADR-0058). Cloud spend is not built at all: not a field on Budgets, not an option, nothing counting it. It is a provider’s arithmetic over tokens rather than a count of bytes, so it belongs to the model router and not to either of the two processes that keep the others — and the router does not do it. Carrying a number nobody feeds would be worse than the gap, so there is no number. PLAN.md says the same.

The two caps are not independent, and the voice one is the looser, noted 2026-09-07. A voice turn’s own words carry Provenance::Voice, which is untrusted, so such a turn is tainted — and the taint rule above caps at level 1, one below where the voice rule caps. So “voice-origin intents are capped at level 2” describes a ceiling nothing reaches: the stricter rule is what applies.

That was latent until something in the running machine started producing the label. Nothing did. The only place in the tree that had ever constructed Provenance::Voice was the injection corpus, which builds it by hand; the three places that turned a principal into the provenance of its words fell through to Provenance::System, which means “produced by Tacid itself” and is trusted. So a voice turn was being read with the weight of a fact off the kernel, and would have been the day voice was built. It is labelled correctly now, and the consequence is that speech is capped at 1.

Left there deliberately. Voice input is not built, so nothing is constrained by this today, and whether a person in the room should reach Reversible — and what “confirmed on a physical input” should mean mechanically — is a decision worth making when there is a microphone to make it about. Until then the machine takes the stricter of the two rules rather than the one it cannot yet justify.

The default is level 2 because an agent that must ask before every reversible change is a chatbot with a confirm button, not an operating system; it is safe because the classifier, taint, budgets and the immune system (ADR-0013) ship in Phase 1 before any model is trusted.

Consequences

• Codex’s “YOLO” becomes sovereign with an expiry.
• Fable’s capability grants survive as level-3 declarations and per-category auto | ask | deny.
• The classifier needs tests before the agent loop does.

Alternatives rejected

• Ask by default: contradicts the manifesto and trains owners to approve blindly.
• Privilege as the boundary: root is the wrong axis; a user-level rm -rf ~ is irreversible.