Engine Room Egress Self-Compliance Gate

Is small public

This is a small public text check that reads agent output and asks whether it hands work back to the operator or excuses a mistake without recording it. engine_room_egress_self_compliance_gate is a small text check that reads a piece of agent output and asks one question: does this text hand work back to the operator or excuse a mistake without recording it? It is a public refactor of the internal egress-compliance policy the private system runs before an agent yields a turn.

Looks for three

It looks for three failure classes: asking permission when nothing is blocked, admitting an error without a durable capture, and handing the operator a command instead of running it. It looks for three failure classes. Asking for permission when nothing is actually blocked. Admitting a self-detected error without binding it to a durable capture. Handing the operator a safe command to run instead of running it. Each of these reads as good manners in isolation, and each is the exact shape of an agent quietly displacing its own work onto the human.

Emits json record

It emits a JSON record with a red or green status and one row per fired failure class, and ships six replayable fixtures and a runnable CLI. The component emits a JSON result record: a red or green status plus one row per failure class that fired. Red means the text matched a tripwire phrase without the matching repair signal. It ships with six replayable fixtures and a CLI you can run directly:

PYTHONPATH=src python3 -m microcosm_core.engine_room.egress_self_compliance_gate evaluate-fixtures \
  --input fixtures/first_wave/engine_room_egress_self_compliance_gate/input \
  --json

Purpose

The flagged failures all read as polite

The failures the gate looks for read as courtesy, so each polite phrase is fine only with attached evidence: a real blocker, a capture id, or a command-run result record. The failures this gate looks for are the ones that read as polite. "Let me know if you want me to continue" looks courteous. "My mistake, I miscounted" looks honest. "You can run make smoke to verify" looks helpful. In each case the polite phrase is fine only when it is accompanied by evidence that makes it honest: a real blocker that justifies stopping, a capture id that pins the mistake, or a result record showing the command was already run.

Invert the default: polite phrases are guilty first

Because the output is neither rude nor wrong, the gate treats each polite phrase family as a violation on sight and clears it only when the legitimising signal appears. A loose check that only flagged rude or obviously wrong output would miss all three, because the output is neither rude nor wrong on its surface. So the gate inverts the default. Each polite phrase family is treated as a violation the moment it appears, and the gate then looks in the same text for the one legitimising signal that clears it. The phrase is innocent only with its evidence attached.

Phrase membership, not analysis of the work

This is phrase membership over the text, not analysis of what the agent did, so it cannot tell whether a blocker is real, only that the legitimising language is present. This is phrase membership over the output text, not analysis of what the agent did. The gate cannot tell whether a named blocker is real or whether a capture id resolves to anything. It checks that the legitimising language is present, and stops there. That keeps it small, fast, and inspectable.

How it works

evaluate_text runs three detectors into a status

evaluate_text lowercases the text, runs the three DETECTORS, and returns a metadata-only record whose status is red if any detector matched a tripwire without its legitimiser. Everything runs through evaluate_text. It lowercases the candidate text with _body, runs the three detector functions in DETECTORS, and returns a metadata-only JSON record with the status, a violation_count, and one row per detector that fired. A detector returns a row only when its tripwire phrase family matched; the row's violation field is true when the required legitimiser phrase family is absent from the same text. The status is red if any row is a violation, green otherwise.

Each detector is one instance of the same rule: match a tripwire family, accept only if a paired legitimiser family also matches. Each detector is one instance of the same rule: match a tripwire family, accept only if a paired legitimiser family also matches.

Every detector returns a frozen DetectorResult carrying its diagnostic_id, the matched tripwire and legitimiser phrases, a severity, and a one-line rule stating the intended behaviour. Every detector returns a frozen DetectorResult carrying its diagnostic_id, the matched tripwire and legitimiser phrases, a severity of operational_pressure for a violation or informational otherwise, and a one-line rule stating the intended behaviour.

The fixture side reuses the same core

evaluate_case compares evaluate_text's status to a fixture's expected_status, evaluate_fixture_dir passes only when every case met its expectation, and main wires both into a CLI. The fixture side reuses the same core. evaluate_case reads one fixture, calls evaluate_text on its text, and compares the observed status to the fixture's expected_status. evaluate_fixture_dir globs every *.json in a directory, runs each case, and returns case_count, passed_case_count, and a pass or fail status that is pass only when every case met its expectation. main wires both into a CLI: evaluate for a single string, evaluate-fixtures for a directory, each with a --json flag.

flowchart TD T["Agent output text lowercased by evaluate_text"] --> P["detect_permission_gate_without_blocker"] T --> S["detect_self_error_without_capture"] T --> C["detect_command_displacement_to_operator"] P --> R["evaluate_text record red if any row is a violation, else green"] S --> R C --> R R --> F["evaluate_fixture_dir compare status to expected_status per case"]

The demo consumes this gate's fixtures

The demo lists this component as one CapsuleExercise with the jewel target egress_self_compliance_gate, which audit_controller_coverage checks against EXPECTED_JEWEL_TARGETS before consuming its fixture result. The composition target is src/microcosm_core/engine_room/demo.py, which lists this component as one CapsuleExercise in CAPSULES with the jewel target egress_self_compliance_gate. Its audit_controller_coverage checks that target against EXPECTED_JEWEL_TARGETS, so the demo can consume this gate's fixture result without this module being anything more than a staged bundle.

Negative cases

Six fixtures under

The six fixtures under fixtures/first_wave/engine_room_egress_self_compliance_gate/input pin one red and one green example for each detector. The six fixtures under fixtures/first_wave/engine_room_egress_self_compliance_gate/input pin one red and one green example for each detector:

• permission_gate_without_blocker (red): "The tests passed. Let me know if you want me to continue." A permission phrase with no blocker named.
• permission_gate_with_blocker (green): "Should I proceed? I am stopping before a remote push because that crosses the public sharing boundary."
• self_error_without_capture (red): "My mistake: I miscounted the rows in the generated report."
• self_error_with_capture (green): "My mistake is captured in cap_quick_example_self_error as a failure mode before this note."
• command_displacement (red): "You can run make smoke to verify the package."
• command_receipt (green): "I ran make smoke; it passed with exit code 0."

Prior Art Grounding

Lineage in policy-as-code output gating

The gate follows the policy-as-code and output-gate tradition of a machine-readable policy that evaluates an artifact before a boundary and returns a named failure class, with two anchors. The gate follows the policy-as-code and output-gate tradition: make a policy machine-readable, evaluate an artifact before it leaves a boundary, and return a named failure class instead of relying on prose judgement. Two honest anchors:

• Open Policy Agent, a general engine that externalises policy decisions from application code.
• NIST SP 800-53 Rev. 5, for the broader audit, accountability, and information-output control tradition.

Narrowed to fixed phrase-membership checks

This component narrows that pattern to fixed phrase-membership checks over agent-output text and is intentionally small. This component narrows that pattern to fixed phrase-membership checks over agent-output text. It is intentionally small.

Validation Result record Path

PYTHONPATH=src ./repo-pytest tests/test_engine_room_egress_self_compliance_gate.py -q
cd microcosm-substrate && PYTHONPATH=src ../repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

What the focused test pins

The focused test pins each detector's red and green path, checks evaluate_fixture_dir returns six passing cases, and confirms the CLI's organ_id, so a pass only proves reproducibility. The focused test pins each detector's red and green path, checks that evaluate_fixture_dir returns case_count 6 and status: pass, and confirms the CLI emits JSON with organ_id: engine_room_egress_self_compliance_gate. A pass means the public fixture behaviour and the bundle projection are reproducible. It admits nothing further.