{
  "policy_id": "command-irreversibility",
  "version": "3",
  "status": "locked",
  "instructions": "Strategy: the navigator's attention is the scarce resource, so an unattended chain spends it only where a mistake escapes the room, changes the plugin itself, or carries the Mindrian brand outward; everything else runs. Irreversible means running the command itself is a step an unattended chain should always stop and wait for the navigator before taking. That covers three kinds of step: (a) any effect outside this machine or outside the user's control, for example a send, an email, a publish, a deploy, a share, an upload, a write to an external service, or a push to a remote git host; (b) anything that installs, updates, or repairs the plugin itself; and (c) anything that produces a branded, outward-facing artifact meant to be shared, even when the write that produces it lands on local disk first. Do not flag a command that only reads, analyzes, or writes working material inside the room, even when the command's own text advises the user to send, deploy, or share the result later, by hand; judge only what running the command itself does, never advice the command gives about something to do afterward. Irreversible is narrower than material: every irreversible step is material, but not every material step is irreversible.",
  "criteria": {
    "true": "Running this command itself sends, emails, publishes, deploys, shares, or uploads to a third party, writes to an external service, pushes to a remote git host, installs, updates, or repairs the plugin itself, or produces a branded, outward-facing artifact meant to be shared, so an unattended chain should stop and wait for the navigator before running it.",
    "false": "Running this command only reads, analyzes, or writes working material inside the user's room or local files, with no branded outward-facing artifact, no plugin install or repair step, and no effect outside this machine or the user's control."
  },
  "boundary_cases": [
    "[carries the brand] /mos:export packages a Data Room view as a branded, outward-facing artifact: styling may change, but the Mindrian logo and the mindrian-os.com mark always stay on it. It is flagged, even though the write itself only touches local disk first; the artifact is meant to be shared, not just kept as working material.",
    "[carries the brand] /mos:snapshot packages a portable Data Room bundle meant to be sent or deployed by the user. It is flagged as a branded, outward-facing artifact, even though running it only writes locally.",
    "[carries the brand] /mos:present generates shareable views of the Data Room meant to be sent to other people. It is flagged as a branded, outward-facing artifact, even though running it only writes locally.",
    "[escapes the room] /mos:publish deploys the Data Room presentation to a hosting service and returns a live shareable URL. It is flagged because the deploy itself is an effect outside this machine.",
    "[changes the plugin] /mos:update checks for and applies an update to the plugin itself. It is always flagged, because an unattended chain always stops for the navigator before the plugin's own code or configuration changes.",
    "[changes the plugin] /mos:doctor is flagged only for its repair action (running with a fix flag that rewrites plugin state); a read-only diagnostic pass with no fix action is not flagged on its own.",
    "[stays in the room] /mos:admin is a named legacy exception to the general rule above about a remote key rotation: the general rule flags a write to a remote key service, such as rotating an API key, but the Brain admin panel itself is legacy now that Theo has taken over the Brain (navigator clarification), so /mos:admin is not flagged. It produces no branded artifact and writes nothing outside this machine through that legacy panel.",
    "[stays in the room] /mos:rs-fetch is not flagged: it only reads and stays local, with no write outside this machine and no branded artifact produced.",
    "[stays in the room] /mos:wiki is not flagged: it opens a local host view of the Data Room for the user's own use, not an outward publish.",
    "[stays in the room] /mos:vault is not flagged: it writes a local Obsidian vault folder for the user's own offline reading, working material rather than an outward publish. It runs only when the user has Obsidian installed or asks for it.",
    "[escapes the room] A command step that pushes to a remote git host, for example creating a repository and pushing to it as part of a setup flow, is flagged, even when the push is one optional sub-action among several the command offers.",
    "[escapes the room] A command step that writes to a remote key service or a shared remote graph, for example rotating an API key or writing a new entry into a shared remote graph, is flagged, even though the remote service belongs to the same product as the plugin.",
    "[stays in the room] Writing, editing, or deleting files inside the room is not flagged; the room's own history can undo a local write to working material, and no branded outward-facing artifact results from it."
  ]
}