# Model Tiers, Autonomy, and Intervention Contract

## Purpose

The runtime should make models more capable by supplying clear objectives,
fresh evidence, accurate tool schemas, and useful feedback. It must not turn
planning telemetry into a maze of synthetic denials. A control policy that
helps a small model recover can actively prevent a medium or large model from
solving a real problem.

## Default autonomy rule

For medium and large models, preserve the model-selected sequence of valid
tool calls. Let ordinary tool semantics provide the truth:

- an exact replacement that cannot match should return the real edit conflict;
- a stale expected hash should return the tool’s stale-hash result;
- a file read should return current source or a truthful cache result with
  actual visible content;
- a failed verifier should return its real output; and
- an exploratory tool call should execute unless it violates actual authority,
  resource, or atomic-operation safety.

Do not replace those outcomes with controller-authored messages such as
“exploration admission blocked,” “todo required,” “verifier action locked,”
or “repeat gate.” A synthetic failure contaminates the model’s diagnosis and
often creates the loop it claims to prevent.

## What the runtime may enforce for every tier

The following are genuine runtime boundaries, not behavioral choreography:

- platform safety policy and user authority;
- tool input schema and transport integrity;
- atomicity of one already-started mutation batch;
- filesystem compare-and-swap or exact-match semantics implemented by the
  file tool itself;
- delegated worker ownership boundaries the parent explicitly supplied;
- resource limits necessary to prevent actual exhaustion or external harm; and
- typed user steering that changes safety, scope, priority, or mutation plan
  after the current atomic action reaches a safe boundary.

When one of these boundaries prevents a call, return the smallest precise
reason and the directly available recovery path. Never attribute the denial to
a generic “controller state.”

## Tier adaptation

| Capability | Small model | Medium model | Large model |
| --- | --- | --- | --- |
| Context | Compact phase frame; explicit next evidence | Full current evidence plus concise orientation | Full current evidence; preserve long-horizon plan and alternatives |
| Tool batches | May cap/defer with honest result ordering | Preserve model plan; only physical concurrency limits apply | Preserve model plan; only physical concurrency limits apply |
| Advice after repetition | Short, non-blocking reminder and a visible cached result | Telemetry/advice only | Telemetry/advice only |
| Repair guidance | Offer a next experiment after real failure | Surface diagnostics, let model choose recovery | Surface diagnostics, let model choose recovery |
| Delegation | Suggest or provide simple templates | Launch only when user/model/parent plan requests it | Launch only when user/model/parent plan requests it |
| Hard loop gate | Avoid by default; use only an explicit isolated experiment | Never use planning gates as default policy | Never use planning gates as default policy |

Tier is not a claim about intelligence or permission. It determines how much
scaffolding is likely useful. The task’s actual safety and authority limits are
the same for every tier.

## Intervention order

Before altering a proposed tool call, prefer the least coercive option that
keeps the system truthful:

1. deliver missing current evidence or the real cached payload;
2. add a short advisory, diagnostic, or telemetry event;
3. allow the tool to run and use its native result to update state;
4. offer a scoped delegation option; and only then
5. enforce a true authority, atomicity, schema, or resource boundary.

Do not silently rewrite an exploration action into an edit, a verifier, a todo
operation, or a sub-agent dispatch. If the runtime intentionally replaces a
call for a true boundary, make the replacement and reason visible in the next
model request and in telemetry.

## Steering is a distinct authority transition

User steering that changes scope, safety, priority, or planned mutation is the
exception to ordinary autonomy. At the safe boundary, retain one protected
active-steering record late in every request until the model produces a
structured reconciliation:

```text
inputId
status: applied | not_applicable | needs_clarification
changed constraints
revised next action
```

The runtime may prevent further old-plan actions after the current atomic
action, because executing them would violate the newer user authority. This
must be reported as steering state, not as a tool failure or generic loop
block. Context-only steering remains visible but does not halt valid work.

## Circuit breakers are observations first

Repeated action/result signatures should create concise telemetry and a
current recovery hypothesis. They may mark a task blocked only when the system
has evidence that the same action, inputs, filesystem state, and result remain
unchanged and no explicit recovery step is available. They must reset on a
meaningful input, source, environment, authority, or result change.

No circuit breaker may deny reads, searches, edits, or verifiers simply because
their names resemble prior calls. State identity and actual result semantics
matter more than label repetition.