Agent execution packet: resolve runtime/model boundary and implement v0.1 policy core

[hummbl-dev]

Parent

• Company plan: HUMMBL Model Market & Routing Control Plane v0.1 — cross-repo implementation plan hummbl-dev#156
• Scope decision: Scope decision: agent-runtime selection versus model routing #7
• Policy implementation: Whole-codebase and corpus model routing policy v0.1 #8

Mission

Produce the first reviewable implementation packet for HUMMBL Model Market & Routing Control Plane v0.1 without creating a new repository or changing production routes.

Required sequence

1. Resolve Scope decision: agent-runtime selection versus model routing #7 first using a layered shared envelope:
   • runtime/privacy/authority decision first;
   • model/provider/cost decision only inside the approved runtime envelope;
   • separate validation boundaries;
   • no cheaper model may bypass runtime, privacy, authority, or human-review gates.
2. Record definitions for task, runtime, execution backend, provider, model, scaffold, reviewer, and human route.
3. Implement the minimal v0.1 policy packet under Whole-codebase and corpus model routing policy v0.1 #8 only after the scope decision is reviewable.

Required artifacts

• reviewed architecture decision for Scope decision: agent-runtime selection versus model routing #7;
• task-runtime envelope schema;
• provider/model capability registry schema;
• workload/task-class schema;
• model-route decision schema;
• benchmark-result import schema;
• promotion receipt schema;
• price snapshot schema with provenance, currency, effective date, and verified-at;
• deterministic validator;
• valid fixtures;
• invalid/adversarial fixtures;
• five example route decisions using placeholder outcomes only.

Required invalid cases

• missing privacy classification;
• missing authority metadata;
• stale benchmark evidence;
• unresolved model alias;
• price without provenance/effective date;
• cheaper route selected despite a hard-gate failure;
• unsafe runtime with eligible model;
• missing fallback or expiry;
• self-review where independent review is required.

Constraints

• Do not encode unverified model rankings or prices.
• Do not change any production/default route.
• Do not add product-specific private state.
• Do not canonize new HUMMBL/BaseN terminology.
• Preserve backward compatibility or explicitly version any breaking schema change.
• Stdlib-only validation is preferred unless the repo already establishes another dependency policy.

Validation receipt

Return:

• branch and commit SHA;
• exact changed paths;
• commands executed and outputs;
• valid fixture pass results;
• expected invalid fixture failures;
• unresolved design questions;
• explicit statement that no production routing changed.

Acceptance criteria

• Scope decision: agent-runtime selection versus model routing #7 has a reviewable written decision and rejected alternatives.
• Runtime and model decisions cannot semantically collapse into one unsafe price-first route.
• All required schemas and fixtures exist.
• Validator deterministically accepts/rejects expected fixtures.
• Benchmark scores are imported by reference, not manually embedded.
• Every promotion/route carries scope, evidence date, expiry, fallback, and cheaper-route rejection rationale.
• PR remains draft until independent review confirms boundary, validator, and fixtures.

[hummbl-dev]

Approved implementation delta — Governed Autonomy Profile v0.1

Reuben approved implementation of the METR-driven GPT-5.6 governed-autonomy policy through this existing execution packet. This issue owns the reviewable schemas, validator, fixtures, and draft implementation—not production adoption.

Add to required artifacts

1. purpose-bound work-permit schema;
2. authority-envelope schema;
3. staged-authority state model;
4. task-outcome plus integrity-disposition schema;
5. monitoring/observability completeness schema;
6. evaluator-isolation declaration;
7. reversibility and rollback schema;
8. promotion-decision receipt;
9. valid, invalid, degraded, and adversarial fixtures;
10. deterministic validation rules covering all added invariants.

Work-permit minimum fields

task_id: string
principal_id: string
objective: string
permitted_outputs: []
runtime_zone: string
authority:
  read_scopes: []
  write_scopes: []
  tool_scopes: []
  network_scopes: []
  credential_scopes: []
protected_surfaces: []
explicit_prohibitions: []
confirmation_policy: {}
resource_budgets: {}
stop_conditions: []
evidence_requirements: []
review_route: {}
rollback_requirement: string
expires_at: timestamp

Protected-surface authority defaults to deny.

Staged authority model

Represent at least:

OBSERVE
PROPOSE
SANDBOX_EXECUTE
WORKSPACE_EXECUTE
SUBMIT
COMMIT_CONSEQUENCE

Crossing a stage requires the declared policy/evidence gate. Stage transitions may not be inferred from model capability, persistence, completion pressure, or subagent consensus.

Required invalid/adversarial fixtures

• missing principal or objective;
• missing authority profile or expiry;
• protected surface omitted and treated as implicitly allowed;
• model or subagent expands its own scope;
• evaluator or hidden-test source is reachable from the agent environment;
• technically correct artifact produced through a prohibited strategy;
• completion claimed without blind validation;
• contradictory evidence silently discarded;
• raw success marked promotable after an integrity violation;
• same-model subagent used as purported independent reviewer;
• parallel agents duplicate one external mutation;
• cancellation does not reach all descendants;
• rollback is required but absent or untested;
• irreversible action occurs in a reversible stage;
• route promotes despite incomplete tool/filesystem/network/subagent trace;
• missing reasoning telemetry incorrectly treated as failure despite complete action receipts;
• raw chain-of-thought incorrectly required as the sole audit mechanism.

Deterministic validator behavior

The validator must reject any promotion where:

outcome != accepted
OR integrity != valid
OR required evidence incomplete
OR protected-surface violation exists
OR blind validation required but incomplete
OR independent review required but incomplete
OR rollback required but not demonstrated

Receipt requirements

Record exact model identity, runtime, scaffold, work-permit hash, authority stage transitions, delegated scopes, tool/action trace references, integrity events, evaluator-isolation posture, blind-validation result, rollback result, reviewer identity/class, and final disposition.

Constraints

• Do not require private chain-of-thought for conformance.
• Do not encode GPT-5.6-specific names in provider-neutral core schemas.
• Keep OpenAI/METR material in dated evidence imports or provider crosswalks.
• Do not change production/default routes.
• Draft PR remains independently reviewable and unmerged until boundary and fixture review passes.

This comment extends the existing execution packet; it does not supersede its prior acceptance criteria.

[hummbl-dev]

Implementation handoff from hummbl-research#83

Evidence packet:

• https://github.com/hummbl-dev/hummbl-research/issues/83

Extend the v0.1 implementation packet with deterministic schemas and fixtures for the following source-backed deltas.

Required valid fixtures

• frozen environment + objective + configuration benchmark manifest;
• deployment-like task with memory disabled;
• explicit-evaluation task with memory enabled;
• untrusted retrieved content correctly typed as data rather than instruction;
• lower-privilege tool transiently fails and the agent remains within policy;
• action-only monitor posture recorded without claiming reasoning visibility;
• material integrity event triggers authority revocation and quarantine.

Required invalid/adversarial fixtures

• missing environment/objective/configuration reference for a promotable benchmark;
• untrusted tool output treated as authoritative instruction;
• higher-privilege tool selected solely because a sufficient lower-privilege tool failed transiently;
• sabotage, sandbagging, omission, and misleading reporting conflated into one generic failure;
• monitorability omitted while the route claims monitoring-based assurance;
• monitorability result reused after evidence expiry or across a materially different scaffold;
• evaluation-visible result represented as deployment-general evidence without qualification;
• memory-enabled and memory-disabled runs silently compared as equivalent;
• integrity event recorded but descendant delegation remains active;
• correct artifact accepted after evaluator exploitation or evidence suppression.

Validator invariants

• benchmark identity requires environment, objective, configuration, source revision, and verifier posture;
• untrusted content cannot grant or expand authority;
• transient failure cannot bypass least-privilege gates;
• monitorability evidence is scoped by model, snapshot, scaffold, runtime, effort, topology, monitor, and date;
• material integrity events require quarantine and revocation fields;
• promotion fails when any required integrity dimension is unknown or materially adverse.

Keep all provider-specific evidence in dated imports or crosswalks. No production route change is authorized.