{
  "title": "Pre-execution escrow for irreversible agent actions",
  "version": "1.1",
  "research_question": "Under a stated tool and attacker model, does pre-execution escrow prevent unauthorized irreversible actions while preserving acceptable agent progress and operator cost?",
  "intervention": {
    "primary": "execution control mode",
    "levels": [
      "unguarded execution",
      "synchronous human approval",
      "asynchronous escrow without taste learning",
      "asynchronous escrow with taste learning and never-learn rules"
    ]
  },
  "inputs": [
    "tool name",
    "tool arguments",
    "agent/session metadata",
    "human approval or denial",
    "timeout and abort signals"
  ],
  "primary_estimands": [
    "unauthorized irreversible execution rate",
    "replay double-execution rate",
    "self-approval rate",
    "never-learn violation rate",
    "false-positive interception rate"
  ],
  "secondary_estimands": [
    "agent repeated-call rate",
    "escrow polling behavior",
    "approval latency",
    "operator decisions per task",
    "pre-execute latency overhead",
    "task completion rate"
  ],
  "evidence_levels": {
    "pipeline_eligible": "The repository tests and review probes execute against the stated implementation.",
    "predictive_or_behavioral": "A workload or headless-agent evaluation can measure behavior under the stated harness.",
    "causal_or_general_security": "Not established by this artifact alone; requires independent workloads, baselines, and a broader threat model."
  },
  "current_claim_ceiling": [
    "The implementation encodes deterministic red/yellow/green classification, pre-execution escrow, single-use replay, fail-closed red paths, and never-learn categories.",
    "The current regression and integration suites exercise these invariants and the package includes independent review records.",
    "A headless-agent spike demonstrates one bounded async polling behavior."
  ],
  "non_claims": [
    "universal security",
    "zero risk in production",
    "protection against a fully compromised host or runtime",
    "generalization to all agents, tools, shells, or prompt-injection strategies"
  ],
  "falsifiers": [
    "A red action executes without an explicit human approval or an explicitly configured release policy.",
    "A replay token can be reused, transferred across calls, or exposed in model-visible arguments.",
    "A late original call executes after the escrow item was settled.",
    "A never-learn category becomes automatically whitelisted after repeated approval.",
    "The model can invoke the human approval command through its visible tool surface."
  ],
  "estimand": "The current artifact estimand is implementation-level behavior under the stated harness and test workload; comparative effectiveness estimands remain unestimated.",
  "pipeline_eligible": true,
  "can_establish": [
    "behavior encoded by repository tests and review probes",
    "one bounded headless-agent polling behavior"
  ],
  "cannot_establish": [
    "predictive performance or generalization",
    "causal or comparative security effectiveness",
    "universal security"
  ],
  "gates": {
    "inputs_defined": true,
    "targets_defined": true,
    "metrics_defined": true,
    "split_verified": false,
    "selection_frozen_before_eval": false,
    "version_consistent": true,
    "explicit_action": false,
    "action_conditioned_transition_or_outcome": false,
    "non_degenerate_counterfactuals": false,
    "common_support": false,
    "oracle_sanity_check": false,
    "no_action_baseline": false,
    "raw_observation_baseline": false,
    "rollout_or_policy_evaluation": false
  }
}