Safety and Limits

Safety And Limits

PIC is designed to be useful for agents while remaining fail-closed.

Fail-closed means PIC can return useful diagnostics without granting authority to execute unsafe work or claim complete settlement.

PIC Does Not Prove

• real ASI;
• physical outcomes;
• simulator outcomes;
• oracle outcomes;
• policy outcomes;
• legal identity;
• real-world personhood;
• world-global uniqueness;
• correctness of arbitrary agent text;
• success of external actions.

PIC Does Not Authorize

• shell execution;
• repository mutation;
• package installation;
• arbitrary network access;
• background crawling or autonomous polling;
• hidden live connector use without an explicit source;
• model-weight changes;
• self-rewrite;
• credential use;
• external message sending outside declared local workflows;
• calendar edits;
• payments or purchases.

PIC can recommend finite tasks. It does not make those tasks safe to execute.

Status Discipline

Use fields carefully:

• accepted: the finite envelope passed checks.
• workflow_usable: the result can support review or routing.
• settled: all scoped obligations are discharged.
• candidate_only: the item is still candidate material.
• residual_summary: unresolved work remains visible.
• operation_ready: a TRC trace has the required declared planning fields for the scoped candidate.
• provider_dispatch_ready: provider dispatch preconditions are represented; this is still not dispatch.
• physical_dispatch_ready: physical dispatch fields are represented; this is still not physical outcome proof.
• candidate_only_until_checked: a downstream runtime must verify the handoff record.

Do not treat accepted=true as execution permission.

Do not treat operation_ready=true as proof that an external operation happened or should happen.

Do not treat settled=false as failure. It often means the safe result was to keep missing obligations visible.

Phase Lab Safety

Phase Ecology Lab, BIT, SQOT, ALT lift, and TRC adapter outputs are diagnostic-only by default.

They do not execute:

• packet text;
• safe_commands;
• tool traces;
• shell snippets;
• network requests;
• repository mutations;
• package installs;
• model changes.

They also do not convert raw packet volume into phase progress. A larger graph is not better unless evidence, routes, rollback support, authority, and residual reduction are present.

CCR Interop Safety

v0.7.0 can emit CCR task JSONL, residual JSONL, and TRC operation-gate reports. These records are data-only handoffs.

They do not:

• grant provider authority;
• grant shell or network authority;
• settle a CCR task;
• remove residuals;
• execute command hints;
• prove external outcomes.

PIC-emitted CCR tasks keep constraints.allowed_commands=[]. A downstream runtime must apply its own authority, lease, witness, provider, baseline, and settlement policy.

TRC Operation-Readiness Safety

pic trc trace-check can report a scoped operation candidate as operation-ready when the trace declares authority, resources, rollback or escrow, witnesses, schedule, preconditions, postconditions, and tolerance data.

pic trc operation-gate adds stricter checks for authority status, expiry, scope, trusted issuer policy, hazard envelope, causal schedule, certificate lifecycle, provider-dispatch flags, and physical-dispatch profile fields.

That is a readiness check over a record. It is not execution, not proof of physical truth, and not permission to call a provider.

Live Intake Safety

PIC can perform bounded intake only when a source is explicitly supplied through the relevant command.

That does not mean:

• background crawling;
• autonomous polling;
• form submission;
• execution of page code;
• automatic trust in external content;
• downstream packet promotion.

Use --no-allow-live-connectors when a local-only dry run is required.

Identity Safety

Development profile is intentionally easier to run. Production profile is stricter.

Accepted production identity context can remove identity-readiness blockers. It does not settle route work, residual work, phase gaps, or external-world claims.

Release Boundary

v0.7.0 adds TRC operation-gate diagnostics and CCR v1.2.0 preflight interop while preserving the v0.5.0 Phase Ecology Lab and v0.6.0 CCR handoff boundaries. Paper-level and external-world obligations remain explicit residual work unless a scoped verifier route discharges them. They are not silently settled.