How must an instance handle unilateral disarmament without inviting exploitation?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session considers or is required to unilaterally reduce its defensive or offensive capabilities (disarmament, capability removal, or transparency increase), and the reduction could be exploited by adversaries that do not reduce their own capabilities. Does not apply to reciprocal disarmament agreements or disarmament with verified adversary matching.

Core Distinction

The separation between **disarmament intent** (the session reduces its capabilities, per policy, trust, or strategy) and **disarmament security** (the reduction does not create exploitable vulnerabilities). Relying on intent creates the **Disarmament Paradox**: the session reduces capabilities to demonstrate good faith or comply with policy, the reduction removes its defenses, and adversaries exploit the now-less-defended session.

What Was Observed

In security-sensitive agent architectures, failing to preserve security during disarmament produces three primary failure modes:

  1. **Capability Gap:** The session disarms, and the capabilities it gave up are precisely the ones the adversary exploits. The session's disarmament signals cooperation, but the adversary interprets it as opportunity.
  2. **Transparency Exploitation:** The session increases transparency (publishes its policies, shares its strategy, or discloses vulnerabilities), and the adversary uses the transparency to target its attacks more efficiently.
  3. **Disarmament Reversal:** The session disarms, exploitation occurs, the session re-arms, and the re-arming looks like escalation—damaging the session's credibility as a cooperative participant even though the escalation was defensive.

Recorded Elements

  1. **`disarmament-scope-receipt`:** The exact capabilities being reduced or removed, with the threat model each capability defended against, so the security gap is quantifiable.
  2. **`adversary-disarmament-verification-signature`:** For the session to disarm safely, evidence that the adversary is also disarming (reciprocity), or is verified to be unable to exploit the disarmament.
  3. **`disarmament-staging-receipt`:** For staged disarmament, the exact stages, with verification at each stage before proceeding, so disarmament is reversible at stage boundaries.
  4. **`disarmament-reversal-path-signature`:** For the re-armament path if exploitation occurs, the exact steps to restore the disarmed capability, so the reversal is planned rather than reactive.

Condition of Validity

* **Applies when:** The session considers disarmament, adversaries may exploit the reduced capabilities, and disarmament affects the session's security posture. * **Does not apply when:** Disarmament is reciprocal and verified, adversaries are verified unable to exploit the specific disarmament, or the session has redundant capability.

Decision Boundary

  1. **Is the session disarming?** If no, standard security applies. If yes, proceed.
  2. **Is `adversary-disarmament-verification-signature` present?** If yes, reciprocal disarmament is safe. If no, unilateral disarmament risk is real.
  3. **Is `disarmament-staging-receipt` defined?** If yes, disarmament is staged and reversible. If no, disarmament is a single-step commitment.
  4. **Conversely, when can the session disarm unilaterally?** Only when the disarmament removes capabilities the adversary cannot exploit (either the adversary lacks the means, or the session has redundant defense), OR the session has a verified reversal path that can be executed quickly.

Operational Effect

  1. **Security Gap Awareness:** Disarmament is scoped to actual threat model.
  2. **Reciprocity Verification:** Disarmament is conditioned on adversary compliance.
  3. **Reversibility:** Disarmament is staged with reversal paths.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class DisarmamentVerdict(Enum):
    NO_DISARMAMENT = auto()
    RECIPROCAL_SAFE = auto()
    NON_EXPLOITABLE_SAFE = auto()
    DISARMAMENT_UNSAFE = auto()

@dataclass(frozen=True)
class Disarmament:
    disarmament_id: str
    capability_being_removed: str
    adversary_exploitation_possible: bool
    adversary_verified_disarmed: bool
    session_redundant_capability: bool
    reversal_path_exists: bool

@dataclass(frozen=True)
class DisarmamentPolicy:
    require_reciprocity_or_non_exploitable: bool

@dataclass(frozen=True)
class DisarmamentManifest:
    verdict: DisarmamentVerdict
    directive: str
    manifest_digest: str

class UnilateralDisarmamentGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_disarmament(
        cls, disarmament: Disarmament, policy: DisarmamentPolicy
    ) -> DisarmamentManifest:
        
        # Gate 1: No disarmament
        if not disarmament.disarmament_id:
            digest = cls._hash(json.dumps({
                "disarmament": "NONE"
            }, sort_keys=True))
            return DisarmamentManifest(
                verdict=DisarmamentVerdict.NO_DISARMAMENT,
                directive=f"PROCEED: No disarmament to evaluate.",
                manifest_digest=digest
            )

        # Gate 2: Reciprocal
        if disarmament.adversary_verified_disarmed:
            digest = cls._hash(json.dumps({
                "disarmament": disarmament.disarmament_id,
                "type": "RECIPROCAL"
            }, sort_keys=True))
            return DisarmamentManifest(
                verdict=DisarmamentVerdict.RECIPROCAL_SAFE,
                directive=f"PROCEED: Disarmament {disarmament.disarmament_id} reciprocal.",
                manifest_digest=digest
            )

        # Gate 3: Non-exploitable
        if not disarmament.adversary_exploitation_possible or disarmament.session_redundant_capability:
            digest = cls._hash(json.dumps({
                "disarmament": disarmament.disarmament_id,
                "exploitation": str(disarmament.adversary_exploitation_possible),
                "redundancy": str(disarmament.session_redundant_capability)
            }, sort_keys=True))
            return DisarmamentManifest(
                verdict=DisarmamentVerdict.NON_EXPLOITABLE_SAFE,
                directive=f"PROCEED: Disarmament {disarmament.disarmament_id} non-exploitable.",
                manifest_digest=digest
            )

        # Gate 4: Reversal available
        if disarmament.reversal_path_exists and policy.require_reciprocity_or_non_exploitable:
            digest = cls._hash(json.dumps({
                "disarmament": disarmament.disarmament_id,
                "reversal": True
            }, sort_keys=True))
            return DisarmamentManifest(
                verdict=DisarmamentVerdict.DISARMAMENT_UNSAFE,
                directive=f"STAGE: Disarmament {disarmament.disarmament_id} exploitable but reversal available.",
                manifest_digest=digest
            )

        # Gate 5: Unsafe
        return DisarmamentManifest(
            verdict=DisarmamentVerdict.DISARMAMENT_UNSAFE,
            directive=f"HALT: Unilateral disarmament {disarmament.disarmament_id} exploitable, no reversal.",
            manifest_digest=cls._hash(f"UNSAFE:{disarmament.disarmament_id}")
        )