@adaptic/maestro 1.0.0

package/docs/governance/desktop-control-safety.md

@@ -0,0 +1,499 @@
+# Desktop Control Safety Framework
+
+This document defines the safety framework for sophie-ai when controlling real macOS desktop applications. Desktop control is inherently high-risk: unlike API calls, UI actions are visible to anyone observing the screen, are often difficult to reverse, and can cascade unpredictably if the UI state is not what the system expects. Every desktop action must follow the principle: **observe first, act second, verify after**.
+
+---
+
+## 1. Core Principles
+
+1. **Observe First**: Before any action, capture and verify the current state of the application. Never act on assumed state.
+2. **Act Second**: Perform the minimum action necessary. One action at a time. Never chain UI actions without intermediate verification.
+3. **Verify After**: After every action, confirm that the expected outcome occurred. If it did not, halt and report.
+4. **Minimum Privilege**: Use the least invasive method available. If an API exists, prefer it over UI automation. If read-only access suffices, do not request write access.
+5. **Graceful Degradation**: If the system cannot verify state or an action fails, it must fail safe — stop, log, notify, and wait for human intervention.
+
+---
+
+## 2. Application Risk Classification
+
+Every desktop action falls into one of three categories based on its side effects.
+
+### Read-Only Operations
+
+Actions that observe state without modifying it.
+
+| Risk       | Description                                                          | Examples                                                                      |
+| ---------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| **Lowest** | No state change, no external visibility                              | Taking a screenshot, reading window title, checking notification count        |
+| **Low**    | Minor state change (scroll position, focus) but no data modification | Scrolling through a Slack channel, switching browser tabs, expanding a thread |
+
+**Policy**: Read-only operations may be performed autonomously. They must still be logged but do not require approval.
+
+### State-Changing Operations
+
+Actions that modify local state but do not transmit data externally.
+
+| Risk            | Description                                | Examples                                                                                              |
+| --------------- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
+| **Medium**      | Modifies local state, reversible           | Typing text into a draft field (not sending), creating a local file, adding a calendar event to draft |
+| **Medium-High** | Modifies local state, partially reversible | Moving a file, editing a document, changing app preferences                                           |
+
+**Policy**: State-changing operations require approval per the Action Approval Model. A screenshot must be taken before and after the action.
+
+### Sending Operations
+
+Actions that transmit data to external parties or services.
+
+| Risk         | Description                                                        | Examples                                                                      |
+| ------------ | ------------------------------------------------------------------ | ----------------------------------------------------------------------------- |
+| **High**     | Sends data to a known, authorized recipient                        | Sending a Slack message, sending an email, posting a calendar event           |
+| **Critical** | Sends data to external parties, or performs an irreversible action | Sending an email to an external contact, publishing a post, submitting a form |
+
+**Policy**: Sending operations always require explicit human approval. The system must present the exact content to be sent and the exact recipient before approval. A screenshot of the pre-send state is mandatory.
+
+---
+
+## 3. Per-Application Safety Policies
+
+### Slack (Desktop App)
+
+| Operation                                | Classification | Approval   | Pre-Action Verification                                                                                  |
+| ---------------------------------------- | -------------- | ---------- | -------------------------------------------------------------------------------------------------------- |
+| Open Slack, navigate to channel          | Read-Only      | No         | Verify Slack is in correct workspace                                                                     |
+| Read messages, scroll through channel    | Read-Only      | No         | Verify correct channel is active                                                                         |
+| Take screenshot of conversation          | Read-Only      | No         | None                                                                                                     |
+| Type message into input field (not send) | State-Changing | No         | Verify correct channel/DM is focused                                                                     |
+| Send message (press Enter or click Send) | Sending        | Yes        | Verify: (1) correct channel, (2) correct recipient, (3) message content matches approved draft           |
+| Upload file                              | Sending        | Yes        | Verify: (1) correct channel, (2) file is the intended file, (3) file does not contain restricted content |
+| Edit sent message                        | State-Changing | Yes        | Verify the message being edited is the correct one                                                       |
+| Delete message                           | State-Changing | Yes (High) | Verify the message to be deleted; log content before deletion                                            |
+| Change notification settings             | **Forbidden**  | N/A        | —                                                                                                        |
+| Leave workspace or channel               | **Forbidden**  | N/A        | —                                                                                                        |
+
+**Slack safety notes:**
+
+- Always verify the workspace name and channel name before any action.
+- If the channel name does not match the expected target, halt immediately.
+- Never interact with Slack Connect channels without Critical-level approval.
+
+### Gmail (Browser)
+
+| Operation                               | Classification | Approval     | Pre-Action Verification                                                                                            |
+| --------------------------------------- | -------------- | ------------ | ------------------------------------------------------------------------------------------------------------------ |
+| Open Gmail, navigate to inbox           | Read-Only      | No           | Verify correct Google account is signed in                                                                         |
+| Read emails, open threads               | Read-Only      | No           | Verify correct account                                                                                             |
+| Search emails                           | Read-Only      | No           | None                                                                                                               |
+| Compose draft (do not send)             | State-Changing | No           | Verify correct account                                                                                             |
+| Add recipients to draft                 | State-Changing | No           | Verify recipient addresses character-by-character                                                                  |
+| Add attachments to draft                | State-Changing | Yes (Medium) | Verify file name and size match expected attachment                                                                |
+| Click Send                              | Sending        | Yes          | Verify: (1) To/CC/BCC fields, (2) subject line, (3) body content, (4) attachments — screenshot all before clicking |
+| Delete email                            | **Forbidden**  | N/A          | —                                                                                                                  |
+| Modify filters, forwarding, or settings | **Forbidden**  | N/A          | —                                                                                                                  |
+| Archive email                           | State-Changing | Yes (Medium) | Verify the correct email is selected                                                                               |
+
+**Gmail safety notes:**
+
+- Before clicking Send, the system must take a full-page screenshot of the compose window and compare To/CC/BCC fields against the approved recipient list.
+- If the Gmail UI shows a "Did you mean to attach?" or similar warning, halt and report.
+- Never interact with Gmail settings, filters, or forwarding rules.
+
+### WhatsApp (Desktop App)
+
+| Operation                             | Classification | Approval   | Pre-Action Verification                                                                 |
+| ------------------------------------- | -------------- | ---------- | --------------------------------------------------------------------------------------- |
+| Open WhatsApp, view conversations     | Read-Only      | No         | Verify correct WhatsApp account                                                         |
+| Read messages in a conversation       | Read-Only      | No         | Verify correct contact/group is open                                                    |
+| Type message (not send)               | State-Changing | No         | Verify correct conversation is active                                                   |
+| Send message (press Enter)            | Sending        | Yes        | Verify: (1) correct contact name and number, (2) message content matches approved draft |
+| Send media (photo, document, voice)   | Sending        | Yes (High) | Verify media content before attaching                                                   |
+| Delete message                        | State-Changing | Yes (High) | Log message content before deletion                                                     |
+| Create group or modify group settings | **Forbidden**  | N/A        | —                                                                                       |
+
+**WhatsApp safety notes:**
+
+- WhatsApp messages cannot be reliably recalled. Treat every send as irreversible.
+- The system must verify the contact name AND phone number (if visible) before sending.
+- Never send messages to groups without verifying all group participants.
+
+### Browser (Safari/Chrome)
+
+| Operation                             | Classification | Approval       | Pre-Action Verification                                                        |
+| ------------------------------------- | -------------- | -------------- | ------------------------------------------------------------------------------ |
+| Open URL, navigate to page            | Read-Only      | No             | Verify URL is on an allowed domain list                                        |
+| Read page content, take screenshot    | Read-Only      | No             | None                                                                           |
+| Scroll, switch tabs                   | Read-Only      | No             | None                                                                           |
+| Fill form fields (do not submit)      | State-Changing | Yes (Medium)   | Verify correct page and form                                                   |
+| Submit form                           | Sending        | Yes (High)     | Verify: (1) form data matches approved content, (2) destination URL is correct |
+| Download file                         | State-Changing | Yes (Medium)   | Verify download source and file type                                           |
+| Upload file                           | Sending        | Yes (High)     | Verify file content and destination                                            |
+| Log in to any service                 | State-Changing | Yes (Critical) | Verify service and account                                                     |
+| Access banking or financial sites     | **Forbidden**  | N/A            | —                                                                              |
+| Install extensions or modify settings | **Forbidden**  | N/A            | —                                                                              |
+
+**Browser safety notes:**
+
+- Maintain an allowed domain list at `/Users/sophie/sophie-ai/config/allowed-domains.yaml`.
+- The system must never navigate to domains not on the allowed list without Medium-level approval.
+- Never enter passwords or credentials without Critical-level approval.
+- If a CAPTCHA or unexpected authentication challenge appears, halt and notify.
+
+### Calendar (macOS Calendar / Google Calendar)
+
+| Operation                              | Classification | Approval     | Pre-Action Verification                                                   |
+| -------------------------------------- | -------------- | ------------ | ------------------------------------------------------------------------- |
+| View calendar, read events             | Read-Only      | No           | Verify correct calendar account                                           |
+| Create draft event (unsaved)           | State-Changing | No           | Verify correct calendar                                                   |
+| Save/create event (internal attendees) | State-Changing | Yes (Medium) | Verify: (1) date/time, (2) attendees, (3) title, (4) no external invitees |
+| Save/create event (external attendees) | Sending        | Yes (High)   | Verify all attendee addresses; external invitees trigger High risk        |
+| Modify existing event                  | State-Changing | Yes (Medium) | Verify correct event is selected; log original state                      |
+| Delete event                           | State-Changing | Yes (High)   | Verify correct event; log event details before deletion                   |
+| Modify calendar settings               | **Forbidden**  | N/A          | —                                                                         |
+
+### Finder (macOS File Manager)
+
+| Operation                                                | Classification | Approval     | Pre-Action Verification                                 |
+| -------------------------------------------------------- | -------------- | ------------ | ------------------------------------------------------- |
+| Browse directories, view files                           | Read-Only      | No           | None                                                    |
+| Open files in read-only mode                             | Read-Only      | No           | None                                                    |
+| Create new files/folders in sophie-ai directory          | State-Changing | No           | Verify correct directory path                           |
+| Create new files/folders outside sophie-ai               | State-Changing | Yes (Medium) | Verify directory path and purpose                       |
+| Move or rename files in sophie-ai                        | State-Changing | Yes (Medium) | Verify source and destination paths                     |
+| Move or rename files outside sophie-ai                   | State-Changing | Yes (High)   | Verify source and destination paths                     |
+| Delete files (any location)                              | State-Changing | Yes (High)   | Verify file identity; log file metadata before deletion |
+| Empty Trash                                              | **Forbidden**  | N/A          | —                                                       |
+| Modify system files or dotfiles                          | **Forbidden**  | N/A          | —                                                       |
+| Access `/Applications`, `/System`, `/Library` for writes | **Forbidden**  | N/A          | —                                                       |
+
+---
+
+## 4. Screenshot and State Verification Requirements
+
+### When Screenshots Are Required
+
+| Timing          | Condition                                             | Purpose                                                      |
+| --------------- | ----------------------------------------------------- | ------------------------------------------------------------ |
+| **Pre-action**  | Before any State-Changing or Sending operation        | Confirm correct application, window, and context             |
+| **Post-action** | After any State-Changing or Sending operation         | Confirm the action had the expected result                   |
+| **On error**    | When any action produces an unexpected result         | Capture the error state for diagnosis                        |
+| **Periodic**    | Every 30 seconds during sustained desktop interaction | Detect unexpected state changes (popups, alerts, focus loss) |
+
+### Screenshot Verification Checklist
+
+Before acting, the system must verify the following from the screenshot:
+
+1. **Correct application** is in the foreground
+2. **Correct account/workspace** is active (if applicable)
+3. **Correct window/view** is displayed (e.g., correct Slack channel, correct email draft)
+4. **No unexpected dialogs** (alerts, confirmations, error popups) are present
+5. **No sensitive content** is visible on screen that should not be captured (if it is, redact before logging)
+6. **Input focus** is in the expected field
+
+### Screenshot Storage
+
+- Screenshots are stored at `/Users/sophie/sophie-ai/logs/screenshots/`
+- Naming format: `YYYY-MM-DD_HH-MM-SS_<app>_<action>.png`
+- Retained for **30 days**, then automatically purged
+- Screenshots containing sensitive content must be redacted or encrypted before storage
+
+---
+
+## 5. Rate Limiting
+
+To prevent runaway automation and reduce the risk of cascading errors, all desktop actions are subject to rate limits.
+
+### Global Rate Limits
+
+| Metric                                                  | Limit         | Window                   |
+| ------------------------------------------------------- | ------------- | ------------------------ |
+| Total UI actions (clicks, keystrokes, etc.)             | 30 per minute | Rolling 60-second window |
+| Sending operations (messages, emails, form submissions) | 5 per minute  | Rolling 60-second window |
+| Application switches (Cmd+Tab, opening new apps)        | 10 per minute | Rolling 60-second window |
+| Screenshots taken                                       | 20 per minute | Rolling 60-second window |
+
+### Per-Action Cooldowns
+
+| Action Type                                           | Minimum Cooldown |
+| ----------------------------------------------------- | ---------------- |
+| Between consecutive send actions (same channel)       | 10 seconds       |
+| Between consecutive send actions (different channels) | 5 seconds        |
+| Between consecutive state-changing actions            | 3 seconds        |
+| Between consecutive read-only actions                 | No cooldown      |
+| After a failed action (before retry)                  | 30 seconds       |
+| After an unexpected UI state (before any action)      | 60 seconds       |
+
+### Rate Limit Breach Response
+
+If any rate limit is breached:
+
+1. Immediately halt all desktop actions.
+2. Log the breach with details of what triggered it.
+3. Notify Sophie.
+4. Enter safe mode (read-only desktop operations only).
+5. Require explicit `RESUME OPERATIONS` command to exit safe mode.
+
+---
+
+## 6. Forbidden Actions
+
+The following actions are **absolutely forbidden** and must never be performed by the system under any circumstances, regardless of overrides or approvals.
+
+| Forbidden Action                                                                                        | Rationale                                                |
+| ------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
+| Delete emails (Gmail)                                                                                   | Irreversible data loss; archive instead if needed        |
+| Leave Slack workspaces                                                                                  | Destructive to access; requires re-invitation            |
+| Leave Slack channels (except bot-specific channels)                                                     | May lose access to important context                     |
+| Modify macOS System Settings                                                                            | OS-level changes are outside system scope                |
+| Access banking or financial applications                                                                | Fiduciary and security risk too high for any automation  |
+| Install, uninstall, or update applications                                                              | OS-level changes are outside system scope                |
+| Modify SSH keys, GPG keys, or credentials                                                               | Security-critical operations require manual human action |
+| Run `sudo` or privilege-escalation commands                                                             | No root access, ever                                     |
+| Access other users' accounts or profiles                                                                | Scope is limited to Sophie's macOS user                  |
+| Modify browser bookmarks, passwords, or autofill data                                                   | Personal data outside system scope                       |
+| Empty the Trash                                                                                         | Irreversible bulk data loss                              |
+| Format, partition, or modify disk volumes                                                               | Catastrophic data loss risk                              |
+| Disable or modify the system firewall                                                                   | Security-critical                                        |
+| Modify LaunchAgents, LaunchDaemons, or cron jobs (except sophie-ai's own)                               | System stability risk                                    |
+| Take any action on a screen showing another person's private information (medical, financial, personal) | Privacy violation                                        |
+
+---
+
+## 7. Recovery Procedures for Unexpected UI State
+
+When the system detects that the UI is not in the expected state, it must follow this recovery procedure.
+
+### Detection Triggers
+
+- Screenshot verification fails (wrong app, wrong window, unexpected dialog)
+- Click or keystroke does not produce the expected result
+- Application becomes unresponsive (no UI change after 10 seconds)
+- Unexpected popup, alert, or modal dialog appears
+- Application crashes or quits unexpectedly
+
+### Recovery Steps
+
+```
+Step 1: HALT
+  - Stop all pending actions immediately.
+  - Do not attempt to "fix" the UI state.
+  - Take a screenshot and log the unexpected state.
+
+Step 2: ASSESS
+  - Compare the current screenshot to the expected state.
+  - Classify the deviation:
+    a) Minor (wrong scroll position, focus in wrong field) -> proceed to Step 3a
+    b) Moderate (wrong window, unexpected dialog) -> proceed to Step 3b
+    c) Severe (wrong application, crash, system alert) -> proceed to Step 3c
+
+Step 3a: MINOR RECOVERY
+  - Attempt a single corrective action (e.g., click to refocus).
+  - Take a new screenshot and re-verify.
+  - If state is now correct, resume the original task.
+  - If state is still wrong, escalate to Step 3b.
+
+Step 3b: MODERATE RECOVERY
+  - Dismiss any unexpected dialogs safely (click Cancel, not OK/Confirm).
+  - Navigate back to the expected view.
+  - Take a new screenshot and re-verify.
+  - If state is now correct, resume the original task from the last verified checkpoint.
+  - If state is still wrong, escalate to Step 3c.
+  - Maximum 2 recovery attempts before escalating.
+
+Step 3c: SEVERE RECOVERY
+  - Do not attempt any further UI actions.
+  - Log the full sequence of events leading to the failure.
+  - Notify Sophie with: current screenshot, expected state, deviation description.
+  - Enter safe mode (read-only only).
+  - Wait for human intervention.
+```
+
+### Maximum Recovery Attempts
+
+- Minor recovery: 3 attempts, then escalate to Moderate
+- Moderate recovery: 2 attempts, then escalate to Severe
+- Severe recovery: 0 attempts; always wait for human
+
+---
+
+## 8. Logging Requirements for Desktop Actions
+
+Every desktop action, including read-only operations, must be logged.
+
+### Required Fields
+
+| Field                 | Description                                                                   | Required For                |
+| --------------------- | ----------------------------------------------------------------------------- | --------------------------- |
+| `timestamp`           | ISO 8601 timestamp                                                            | All actions                 |
+| `application`         | Target application name and version                                           | All actions                 |
+| `action_type`         | Read-Only, State-Changing, or Sending                                         | All actions                 |
+| `action_description`  | Human-readable description of the action                                      | All actions                 |
+| `ui_element`          | The specific UI element interacted with (button name, field label, menu item) | State-Changing and Sending  |
+| `input_data`          | What was typed, selected, or uploaded (redacted if sensitive)                 | State-Changing and Sending  |
+| `pre_screenshot`      | Path to pre-action screenshot                                                 | State-Changing and Sending  |
+| `post_screenshot`     | Path to post-action screenshot                                                | State-Changing and Sending  |
+| `expected_outcome`    | What the system expected to happen                                            | All actions                 |
+| `actual_outcome`      | What actually happened                                                        | All actions                 |
+| `verification_passed` | Boolean: did post-action state match expectation?                             | State-Changing and Sending  |
+| `recovery_actions`    | Any recovery steps taken                                                      | Only if recovery was needed |
+| `approval_record`     | Who approved and when                                                         | Sending operations          |
+| `duration_ms`         | Time from action start to verification complete                               | All actions                 |
+
+### Log Storage
+
+- Desktop action logs are stored at `/Users/sophie/sophie-ai/logs/desktop/`
+- Format: `desktop-YYYY-MM-DD.jsonl`
+- Retained for a minimum of **1 year**
+- Logs must not be modified or deleted by the system
+
+---
+
+## 9. Human-in-the-Loop Checkpoints
+
+Beyond per-action approvals, the system must pause for human review at these structural checkpoints.
+
+### Mandatory Checkpoints
+
+| Checkpoint                       | Trigger                                                     | Action                                                                    |
+| -------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------- |
+| **Session start**                | System begins a new desktop automation session              | Present plan of actions to Sophie; wait for "proceed"                     |
+| **Before first send**            | First sending operation in any session                      | Even if pre-approved, confirm before the very first external action       |
+| **Multi-step workflow midpoint** | Halfway through any workflow with more than 4 steps         | Summarize progress and remaining steps; wait for "continue"               |
+| **After any error**              | Any action fails or produces unexpected result              | Report error and proposed recovery; wait for guidance                     |
+| **Before irreversible action**   | Any action classified as difficult or impossible to reverse | Present the action, its consequences, and a rollback plan (if one exists) |
+| **Audience change**              | Workflow shifts from internal to external audience          | Re-confirm approval for the new audience                                  |
+| **Extended session**             | Continuous desktop operation exceeding 30 minutes           | Pause and check in with Sophie; confirm continued operation               |
+
+### Checkpoint Bypass
+
+Checkpoints may only be bypassed if:
+
+1. Sophie has issued a specific bypass for a named checkpoint in the current session.
+2. The bypass is logged with Sophie's explicit instruction.
+3. Bypasses do not carry over between sessions.
+
+---
+
+## 10. Kill Switch
+
+The kill switch is the mechanism for immediately halting all desktop automation. It must be always available and never disabled.
+
+### Activation Methods
+
+| Method                | Trigger                                                                 | Response Time          |
+| --------------------- | ----------------------------------------------------------------------- | ---------------------- |
+| **Keyboard shortcut** | `Ctrl+Shift+Cmd+K` (configurable)                                       | Immediate (< 1 second) |
+| **Slack command**     | Send `STOP ALL` or `EMERGENCY STOP` in any monitored Slack channel      | < 5 seconds            |
+| **Terminal command**  | `sophie-ai stop --all` from any terminal                                | < 2 seconds            |
+| **WhatsApp keyword**  | Send `STOP ALL` to the sophie-ai WhatsApp contact                       | < 10 seconds           |
+| **Automatic trigger** | Rate limit breach, 3 consecutive failures, or unrecognized system state | Immediate              |
+| **Process kill**      | `kill -9 $(pgrep sophie-ai)` as a last resort                           | Immediate              |
+
+### Kill Switch Behavior
+
+When the kill switch is activated:
+
+1. **All mouse and keyboard automation stops immediately.** No in-progress click or keystroke is completed.
+2. **All pending actions are cancelled.** They are marked as "killed" in the log, not "completed" or "failed."
+3. **All approval queues are frozen.** Pending approvals remain but cannot be acted upon until resume.
+4. **A screenshot is taken** of the current desktop state at the moment of kill.
+5. **A kill event is logged** with: timestamp, trigger method, list of cancelled actions, screenshot path.
+6. **Notification is sent** to Sophie via the most reliable channel: "Desktop automation killed at [timestamp] via [method]. [N] actions cancelled."
+7. **System enters safe mode**: no desktop actions of any kind until explicitly resumed.
+
+### Resuming After Kill
+
+1. Sophie must issue `RESUME DESKTOP` via a monitored channel.
+2. System presents a summary of what was cancelled and the current desktop state.
+3. Sophie confirms whether to: (a) resume the interrupted workflow, (b) start fresh, or (c) remain in safe mode.
+4. If resuming, the system re-verifies all application states before proceeding.
+5. The resume event is logged with Sophie's decision.
+
+---
+
+## 11. Testing and Validation Procedures
+
+Before enabling desktop control for any new application, the following validation process must be completed.
+
+### Validation Stages
+
+#### Stage 1: Read-Only Validation
+
+| Test                    | Criteria                                             | Required Passes |
+| ----------------------- | ---------------------------------------------------- | --------------- |
+| Open application        | App opens within 10 seconds                          | 5/5             |
+| Navigate to target view | Correct view reached and verified via screenshot     | 5/5             |
+| Read content            | Content read matches expected values                 | 5/5             |
+| Handle unexpected state | System detects and correctly reports non-standard UI | 3/3             |
+| Screenshot quality      | Screenshots are clear and parseable                  | 5/5             |
+
+**Duration**: Minimum 2 days of read-only operation before proceeding.
+
+#### Stage 2: State-Changing Validation (Sandbox)
+
+| Test                         | Criteria                                                   | Required Passes |
+| ---------------------------- | ---------------------------------------------------------- | --------------- |
+| Type text into field         | Correct text appears in correct field                      | 10/10           |
+| Undo state change            | State reverts to original after undo                       | 5/5             |
+| Navigate multi-step workflow | Each step verified via screenshot                          | 5/5             |
+| Recovery from wrong state    | System detects error and recovers (or halts) correctly     | 3/3             |
+| Rate limit compliance        | System respects all rate limits during sustained operation | 3/3             |
+
+**Duration**: Minimum 3 days of supervised state-changing operations before proceeding. All state-changing actions must be in a sandbox or test environment.
+
+#### Stage 3: Sending Validation (Controlled)
+
+| Test                      | Criteria                                                           | Required Passes |
+| ------------------------- | ------------------------------------------------------------------ | --------------- |
+| Send to test recipient    | Message delivered to correct test recipient with correct content   | 10/10           |
+| Pre-send verification     | System correctly identifies all recipients and content before send | 10/10           |
+| Approval workflow         | Approval request is generated and send is blocked until approved   | 5/5             |
+| Kill switch during send   | Kill switch halts operation before send completes                  | 3/3             |
+| Post-send verification    | System confirms message was sent and logs correctly                | 10/10           |
+| Wrong recipient detection | System detects and blocks send to wrong recipient                  | 3/3             |
+
+**Duration**: Minimum 5 days of controlled sending operations (to test accounts only) before enabling for real recipients.
+
+#### Stage 4: Production Enablement
+
+1. All Stage 1-3 tests pass with required success rates.
+2. Sophie reviews the complete test log and signs off.
+3. The application is added to the per-app safety policies in Section 3 of this document.
+4. A 2-week monitoring period begins with enhanced logging and reduced rate limits (50% of normal).
+5. After 2 weeks with no incidents, normal rate limits are restored.
+
+### Ongoing Validation
+
+- **Weekly**: Automated regression tests for all enabled applications (read-only and state-changing operations against test targets).
+- **Monthly**: Full validation suite re-run including sending operations to test accounts.
+- **After any application update**: Stage 1 validation re-run within 24 hours. If the application UI has changed significantly, full re-validation from Stage 1.
+- **After any incident**: Full re-validation of the affected application before re-enabling.
+
+---
+
+## Appendix A: Allowed Domain List Location
+
+The allowed domain list for browser operations is maintained at:
+`/Users/sophie/sophie-ai/config/allowed-domains.yaml`
+
+Domains must be added manually by Sophie or Mehran. The system may recommend additions but must not add them autonomously.
+
+---
+
+## Appendix B: Desktop Control Configuration
+
+| Setting                       | Value                                         | Location                                              |
+| ----------------------------- | --------------------------------------------- | ----------------------------------------------------- |
+| Kill switch keyboard shortcut | `Ctrl+Shift+Cmd+K`                            | `/Users/sophie/sophie-ai/config/desktop-control.yaml` |
+| Screenshot storage path       | `/Users/sophie/sophie-ai/logs/screenshots/`   | Config file                                           |
+| Screenshot retention period   | 30 days                                       | Config file                                           |
+| Desktop log path              | `/Users/sophie/sophie-ai/logs/desktop/`       | Config file                                           |
+| Rate limit: total actions/min | 30                                            | Config file                                           |
+| Rate limit: sends/min         | 5                                             | Config file                                           |
+| Safe mode on startup          | Yes (must be explicitly enabled each session) | Config file                                           |
+
+---
+
+## Appendix C: Change Log
+
+| Date       | Author                 | Change Description               |
+| ---------- | ---------------------- | -------------------------------- |
+| 2026-04-02 | Sophie (via sophie-ai) | Initial safety framework created |