Safety and Limits

Safety And Limits

PIC-TS is designed to be useful for agents while remaining fail-closed.

Fail-closed means the package can return useful diagnostics without granting authority to execute unsafe work or claim complete settlement.

It Does Not Prove

• real ASI;
• general intelligence;
• physical outcomes;
• simulator outcomes;
• oracle outcomes;
• policy outcomes;
• legal identity;
• real-world personhood;
• correctness of arbitrary agent text.

It Does Not Authorize

• shell execution;
• repository mutation;
• arbitrary network access;
• background crawling;
• hidden live connector use;
• package installation;
• model-weight changes;
• self-rewrite;
• credential use;
• external message sending;
• payments or purchases;
• provider dispatch;
• physical actuation.

Status Discipline

Use fields carefully:

• accepted: the input was accepted for this route.
• workflow_usable: the report can guide the next workflow step.
• operationally_usable: the report can guide routing under the selected profile.
• ok: the scoped report found no blocking residuals.
• capital_admitted: lower-bound capital evidence passed admission checks; this is not settlement.
• certified_acceleration_candidate: the v0.8 target/baseline/capital comparison passed; this is not real ASI proof.
• operation_ready: a TRC trace has required declared planning fields for a scoped candidate.
• provider_dispatch_ready: provider dispatch preconditions are represented; this is still not dispatch.
• physical_dispatch_ready: physical dispatch fields are represented; this is still not physical outcome proof.
• settled: scoped finite obligations are discharged.

A report can be accepted and useful while still not settled.

operation_ready=true is not execution and not physical proof.

v0.8.0 Fail-Closed Cases

PIC-TS blocks or marks reports not certified when it sees unaccepted target laws, unapproved authority, stale or missing baseline envelopes, missing resource matching, absent admitted capital witnesses, proxy-only capital, negative liquidity, stale lifecycle evidence, stale authority, raw-net floor failure, MCP descriptor rug-pull, unsafe MCP arguments, or missing per-call invocation controls.

Packet And Trace Boundary

Packet files and trace files are data. Packet inspection and TRC trace adapter commands may detect command-like text, but they do not execute it.

Command-like strings such as npm install, npx, node, docker run, kubectl, curl, bash, and powershell are report-only.

CCR Interop Boundary

CCR task JSONL, residual JSONL, TRC operation-gate reports, MCP/A2A reports, and CARA reports are data-only handoffs. They do not settle CCR work, execute commands, call providers, or remove residuals.

Safe Agent Rule

Generated agent output is candidate work. PIC-TS reports are diagnostic artifacts. The agent must still follow the host runtime's sandbox, allowlist, permission, and security policy.