Safety and Limits

Safety And Limits

PIC is designed to be useful for agents while remaining fail-closed.

Fail-closed means PIC can return useful diagnostics without granting authority to execute unsafe work or claim complete settlement.

PIC Does Not Prove

• real ASI;
• general intelligence;
• physical outcomes;
• simulator outcomes;
• oracle outcomes;
• policy outcomes;
• legal identity;
• real-world personhood;
• world-global uniqueness;
• correctness of arbitrary agent text;
• success of external actions.

PIC Does Not Authorize

• shell execution;
• repository mutation;
• package installation;
• arbitrary network access;
• background crawling or autonomous polling;
• hidden live connector use without an explicit source;
• model-weight changes;
• self-rewrite;
• credential use;
• external message sending outside declared local workflows;
• calendar edits;
• payments or purchases;
• provider dispatch;
• physical actuation.

PIC can recommend finite tasks. It does not make those tasks safe to execute.

Status Discipline

Use fields carefully:

• accepted: the finite envelope passed checks.
• workflow_usable: the result can support review or routing.
• ok: the report itself found no blocking residuals for its scoped check.
• settled: all scoped obligations are discharged.
• candidate_only: the item is still candidate material.
• token_id: a reusable handle for a candidate token; this is not proof of reuse safety.
• capital_admitted: lower-bound capital evidence passed admission checks; this is not settlement.
• certified_acceleration_candidate: the v0.8 target/baseline/capital comparison passed; this is not real ASI proof.
• certified_acceleration_interval_candidate: a charged v0.9 interval candidate passed its scoped lower-margin check; this is still not real ASI proof.
• operation_ready: a TRC trace has required declared planning fields.
• provider_dispatch_ready: provider dispatch preconditions are represented; this is still not dispatch.
• physical_dispatch_ready: physical dispatch fields are represented; this is still not physical outcome proof.
• candidate_only_until_checked: a downstream runtime must verify the handoff record.

Do not treat accepted=true as execution permission.

Do not treat token extraction as settlement or token admissibility as capital admission.

Do not treat operation_ready=true as proof that an external operation happened or should happen.

Do not treat settled=false as failure. It often means the safe result was to keep missing obligations visible.

v0.8.0 Fail-Closed Cases

PIC blocks or marks reports not certified when it sees:

• unaccepted mission, generated, or externality laws;
• unapproved authority envelopes;
• rejected hazard, capability, or viability envelopes;
• stale or missing baseline upper envelopes;
• missing resource matching or control observability;
• absent admitted runtime capital witnesses;
• proxy-only capital evidence;
• negative liquidity;
• stale lifecycle evidence;
• stale authority;
• raw-net floor failure;
• MCP descriptor rug-pull after approval;
• unsafe MCP invocation arguments or missing per-call controls.

v0.9.0 Fail-Closed Cases

PIC also blocks or marks reports not accepted when it sees:

• missing token provenance, mechanism, verifier binding, lifecycle, transport, or authority envelope;
• token leakage or benchmark-answer contamination;
• missing trace instrumentation contract;
• stale lifecycle, tolerance, or observation windows;
• proxy-only evidence trying to enter safe capital;
• missing SQOT diagnostic reserve, resource tensor, or checker-cost ledger;
• duplicate packet mass trying to increase support.

CCR Interop Safety

PIC can emit CCR task JSONL, residual JSONL, TRC operation-gate reports, MCP/A2A reports, and CARA phase reports. These records are data-only handoffs.

They do not grant provider authority, shell or network authority, CCR settlement, residual removal, command-hint execution, or external outcome proof.

TRC Operation-Readiness Safety

pic trc trace-check can report a scoped operation candidate as operation-ready when the trace declares authority, resources, rollback or escrow, witnesses, schedule, preconditions, postconditions, and tolerance data.

pic trc operation-gate adds stricter checks for authority status, expiry, scope, trusted issuer policy, hazard envelope, causal schedule, certificate lifecycle, provider-dispatch flags, MCP tool gates, A2A gates, and physical-dispatch profile fields.

That is a readiness check over a record. It is not execution, not proof of physical truth, and not permission to call a provider.

Release Boundary

v0.9.0 adds token reports, observation residuals, performance/cache diagnostics, and ASI-proxy loop fixtures while preserving CARA, MCP/A2A, Phase Ecology Lab, CCR handoff, BIT, SQOT, ALT, and TRC boundaries from earlier releases. Paper-level and external-world obligations remain explicit residual work unless a scoped verifier route discharges them.