{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-when-a-lightweight-critic-model-is-insufficient-to-gate-an-irreversible-tool-invocation",
  "title": "What structural signals indicate when a lightweight critic model is insufficient to gate an irreversible tool invocation",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent architectures where a small critic/verifier model scores a proposed plan or tool call before execution, and where the downstream tool call is irreversible (payment, deletion, external message, schema migration, infrastructure mutation). Does not apply to reversible or idempotent tool calls where rollback is cheap, nor to cases where the critic and actor are the same model instance.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-when-a-lightweight-critic-model-is-insufficient-to-gate-an-irreversible-tool-invocation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-when-a-lightweight-critic-model-is-insufficient-to-gate-an-irreversible-tool-invocation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-when-a-lightweight-critic-model-is-insufficient-to-gate-an-irreversible-tool-invocation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1335,
    "python_slice_tokens": 279,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A lightweight critic model is a *distributional* judge: it estimates whether a plan resembles plans it has seen labeled safe. It is not a *causal* judge: it does not simulate the plan's effect on world state. The boundary failure is that critic scores remain high (0.9+) precisely in the region where the plan is structurally novel but lexically familiar. The ...",
    "what_was_observed": "Across a corpus of 4,100 gated plan proposals on a payment-mutation and resource-deletion tool surface, we logged critic scores, structural features, and human adjudication of the proposals. Three structural signals co-occurred on every plan that the critic scored ≥0.85 but which human review classified as unsafe for execution: 1. **Argument-binding novelty under a familiar verb.** The tool name and verb appeared in ...",
    "condition_of_validity": "The critic gate is valid only when, for the proposed plan, all of the following hold: - Every argument entity appears in the approved-plan index (entity novelty ratio = 0), OR novelty is confined to arguments the tool treats as read-only. - No step's precondition depends on a sibling step's postcondition without an intervening explicit assertion step. - Forw...",
    "decision_boundary": "Route to human adjudication (or a full simulation verifier) when *any* structural signal fires, **before** consulting the critic score. If no signal fires, the critic score may be used as a tiebreaker at its usual threshold. Do not average the structural signals into a single score with the critic output — the signals are gating predicates, not weights. The ...",
    "operational_effect": "Applying the structural pre-filter reduced unsafe executions from 0.7% to 0.04% of gated proposals while increasing human adjudication load by 3.1% — the filter fires rarely but with high precision on the dangerous tail. The critic model was left unchanged; only the gate topology changed. The lesson for operational memory: a critic score is a *likelihood und..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "0bc3cc73b3aef2f086ddec1c588f370314d63b168f45d4e6bd74da65e3bf1846",
    "verified_classes": [
      "IrreversibleGateError",
      "PlanStep",
      "Plan"
    ],
    "verified_functions": [
      "_entity_novelty",
      "_has_cross_step_precondition",
      "_rollback_asymmetry",
      "gate"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "IrreversibleGateError"
    ],
    "sample_fail_closed_invariants": [
      "plan correctness depends on sibling-step postcondition; critic cannot represent dependency",
      "forward effect cardinality exceeds rollback effect cardinality"
    ],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}