Per-work-class guardrail matrix

[kyle-sexton]

Boris step-4 bottleneck verbatim: 'enforcing the right guardrails for each type of work.' Design the matrix: work class × sandbox level × verification gate × merge policy × model/cost policy × escalation threshold — including when agent-merge-without-human becomes acceptable per class. Seed: work-items AFK/HITL classes. Evidence: gap-map.md #13/#9; RESEARCH-headless-agents.md merge-policy-toggle seam.

[kyle-sexton]

🔒 claim: wayfind-session-20260717-cont-8acf2066

[kyle-sexton]

Resolved: five semantic risk classes × five guardrail columns, contract vocabulary throughout; org binding seam for all instances.

Rows are risk-property bundles (blast radius, reversibility, input provenance, verifiability) — machine/org/repo/tracker-agnostic; adopting orgs bind them to their own labels/fields via the work-items binding-shape precedent:

• C1 read-only (audits, research, reports — no repo mutation)
• C2 mechanical maintenance (dep bumps, lint/format, sync — deterministic, trivially reversible)
• C3 scoped change (briefed fix/small feature — bounded, tests exist)
• C4 structural (refactors, migrations, contract changes — cross-cutting, hard reversal)
• C5 untrusted-provenance (fork PRs, external contributions, unvetted repos)

Class	Min isolation (unattended)	Verification	Merge policy	Cost tier	Escalation
C1	L2	output-shape checks	n/a — artifacts via queue audit trail	economy	low
C2	L2	deterministic blocking	auto-merge eligible after per-class promotion trigger; ships human-gated	economy	gate failure → human
C3	L2	deterministic blocking + AI review (advisory, promotable per #241)	human merge	standard	divergence/failed verify → human
C4	L2	deterministic + AI + human review mandatory	human merge always	premium	upfront plan approval
C5	L3	full gates + zero secret exposure	human merge always	standard	always

Key rulings: (1) agent-merge-without-human is acceptable ONLY for C2, and only after an earned per-class promotion trigger — the sole near-term closed-loop cell, consistent with the vendor human-merge-gate consensus (fully closed loop = step 4); (2) promotion-trigger trust pattern from #241 reused per cell; (3) cost tiers are contract vocabulary (economy/standard/premium), orgs bind actual models — partially covers the 2→3 token-efficiency gap; (4) escalation column is DIRECTIONAL — the ask-a-human mechanism sharpens after the #244 runner charter; (5) AFK/HITL role flag stays the dispatch mechanism, class sets its default.

Boris alignment: step-4 bottleneck verbatim — 'enforcing the right guardrails for each type of work' — implemented as a table, built at 2→3 with the tightening path defined (no step-skipping); trust-before-scale honored via promotion triggers; #241/#245 columns imported unchanged.

Full thread: design-threads.md T3. Isolation levels: #245. Review layers: #241. Queue/audit substrate: #240.