apsimo 1.3.0__py3-none-any.whl

apsimo/self_model/supervised.py

@@ -0,0 +1,137 @@
+"""The supervised-live rung, generically (H1.1).
+
+The trust ladder has a structural catch-22: graduation ask_first ->
+act_first requires a REAL (non-shadow) track record, but a domain that only
+acts at act_first never produces one. The beliefs engine solved this for
+itself (U26) with a domain-specific flag; this module is the same rung for
+ANY domain, so every future consumer shares one definition of "supervised"
+instead of growing private variants.
+
+The rung: at trust stage ask_first, a domain listed in
+COLONY_SUPERVISED_LIVE_DOMAINS (comma-separated, default EMPTY = rung off
+everywhere) may perform REVERSIBLE operations only, journaled, with
+outcomes recorded shadow=False — building exactly the track record
+graduation needs. Destructive operations still require the full "live"
+mode (act_first stage or explicit env override).
+
+What counts as reversible is NOT the caller's judgment call: it is pinned
+in ``REVERSIBLE_CONTRACT`` below, and ``reversible()`` fails CLOSED — an
+unknown domain or an unlisted operation is non-reversible, full stop.
+Trust-engine errors likewise degrade to the plain env mode (never upward).
+
+Legacy alias: COLONY_BELIEFS_SUPERVISED_LIVE=1 still enables the rung for
+the beliefs domain (the live deployments that set it keep working).
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+from typing import Any, Dict, FrozenSet
+
+logger = logging.getLogger(__name__)
+
+# Domain -> operations that are reversible BY CONSTRUCTION (the operation
+# preserves enough prior state to undo it, and never deletes or merges).
+# Adding an entry here is a design review, not a config change: the
+# operation's implementation must journal prior state and keep the old
+# value recoverable.
+REVERSIBLE_CONTRACT: Dict[str, FrozenSet[str]] = {
+    # Belief maintenance (see beliefs/engine.py):
+    #  - supersede: loser node is MARKED (epistemic_state + superseded_by),
+    #    old value preserved on it, transition journaled.
+    #  - decay: bounded multiplicative confidence drop floored at 0.1,
+    #    never a deletion, prior value journaled.
+    "beliefs": frozenset({"supersede", "decay"}),
+    # World-model LLM extraction (see world_model/llm_extract.py, H1.5):
+    #  - entity_upsert: creates/updates an entity row, journaled with its
+    #    id — removable without touching anything else.
+    #  - alias_merge: adds an alias string to an existing entity; the
+    #    alias list is additive and the addition is journaled.
+    #  - edge_corroborate: bounded confidence bump on an EXISTING
+    #    non-causal edge, journaled; never creates, deletes, or retypes.
+    #  Edge CREATION and every causal edge type stay live-only (causal
+    #  writes additionally require the explicit causal-extract unlock).
+    "world_model": frozenset({"entity_upsert", "alias_merge",
+                              "edge_corroborate"}),
+}
+
+# Domain-specific flags that predate the generic rung; kept working forever.
+_LEGACY_ALIASES: Dict[str, str] = {
+    "beliefs": "COLONY_BELIEFS_SUPERVISED_LIVE",
+}
+
+_TRUTHY = ("1", "true", "yes")
+
+
+def strict_trust_outcomes() -> bool:
+    """H1.3: is trust-outcome integrity enforced? DEFAULT ON.
+
+    Strict means a maintenance run only feeds the trust ladder what it
+    earned: a run where a pass raised records a FAILURE; a run that
+    actually mutated state records a SUCCESS; a no-op run records NOTHING.
+    Without this, an engine that unconditionally logs "success" per run
+    graduates to act_first on a streak of doing nothing.
+
+    COLONY_TRUST_STRICT_OUTCOMES=0 restores the legacy unconditional
+    per-run success (a deliberate escape hatch, not a recommended mode).
+    """
+    return os.environ.get("COLONY_TRUST_STRICT_OUTCOMES",
+                          "1").strip().lower() in _TRUTHY
+
+
+def supervised_domains() -> FrozenSet[str]:
+    """Domains the generic flag enables the rung for (default: none)."""
+    raw = os.environ.get("COLONY_SUPERVISED_LIVE_DOMAINS", "")
+    return frozenset(d.strip().lower() for d in raw.split(",") if d.strip())
+
+
+def supervised_enabled(domain: str) -> bool:
+    """Is the supervised rung unlocked for ``domain``? (generic flag OR the
+    domain's legacy alias)."""
+    domain = (domain or "").strip().lower()
+    if not domain:
+        return False
+    if domain in supervised_domains():
+        return True
+    legacy = _LEGACY_ALIASES.get(domain)
+    if legacy:
+        return os.environ.get(legacy, "0").strip().lower() in _TRUTHY
+    return False
+
+
+def reversible(domain: str, op: str) -> bool:
+    """Fail-closed reversibility check: True only for operations explicitly
+    listed in REVERSIBLE_CONTRACT. Unknown domain or op => non-reversible."""
+    ops = REVERSIBLE_CONTRACT.get((domain or "").strip().lower())
+    if not ops:
+        return False
+    return (op or "").strip().lower() in ops
+
+
+def effective_mode(domain: str, env_mode: str, trust: Any) -> str:
+    """Env mode graduated by the trust engine, with the supervised rung.
+
+    Resolution:
+      * env "off"/"live" are the owner override — returned as-is.
+      * no trust engine, or any trust error => plain env mode (degrade,
+        never upgrade).
+      * stage act_first => "live".
+      * stage ask_first AND supervised_enabled(domain) => "supervised".
+      * otherwise => "shadow".
+    """
+    if env_mode in ("off", "live"):
+        return env_mode
+    if trust is None:
+        return env_mode
+    try:
+        stage = trust.stage(domain, default="shadow")
+    except Exception:
+        logger.debug("trust stage lookup failed for %s; using env mode",
+                     domain, exc_info=True)
+        return env_mode
+    if stage == "act_first":
+        return "live"
+    if stage == "ask_first" and supervised_enabled(domain):
+        return "supervised"
+    return "shadow"

apsimo/self_model/thinker.py

@@ -0,0 +1,99 @@
+"""The workspace thinker: one bounded LLM reflection on a concern (Mind M2).
+
+Kept separate from workspace.py so the engine stays model-agnostic. Given a
+concern and a little real context (recent memory, the concern's own notes),
+the LLM returns a small structured judgement: did it make progress, is it
+resolved, a one-line note, and optionally an action to take (emit an
+initiative, propose an experiment, or write a memory note). In shadow mode
+actions are recorded but not executed.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import re
+from typing import Any, Awaitable, Callable, Dict, Optional
+
+logger = logging.getLogger(__name__)
+
+_JSON_RE = re.compile(r"\{.*\}", re.DOTALL)
+
+_SYSTEM = """You are the reflective inner loop of an autonomous assistant.
+You are given ONE concern currently on the assistant's mind, plus any prior
+notes. Think about it for a moment and decide what, if anything, moves it
+forward. Output ONE JSON object, no prose:
+
+  progress   true if this thought advanced the concern
+  resolve    true if the concern is now settled and should leave the mind
+  note       one sentence: the substance of the thought (what you concluded)
+  action     optional. One of:
+             {"kind":"initiative","title":..,"detail":..}  surface something to the owner
+             {"kind":"experiment","hypothesis":..,"ref":..,"metric":..}  propose a self-experiment
+             {"kind":"memory","content":..}  record a durable note
+             {"kind":"none"}  nothing to do yet
+
+Be honest: most single thoughts make partial progress, not resolution. If
+there is genuinely nothing to do, say progress=false, resolve=false,
+action={"kind":"none"}. Never invent facts; reason only from what is given."""
+
+
+def build_thinker(router: Any, *, graph: Any = None
+                  ) -> Callable[[Any], Awaitable[Dict[str, Any]]]:
+    """Return an async thinker(concern) -> outcome dict bound to the router."""
+
+    async def thinker(concern) -> Dict[str, Any]:
+        context = ""
+        mem_ids: list = []
+        if graph is not None:
+            try:
+                hits = await graph.recall(concern.summary, limit=4,
+                                          min_confidence=0.1)
+                if hits:
+                    context = "\n".join(
+                        f"- {str(h.get('content',''))[:160]}" for h in hits[:4])
+                    # keep the ids of the memories we actually consulted, so the
+                    # caller can record a real concern->memory provenance link
+                    mem_ids = [h.get("id") for h in hits[:4] if h.get("id")]
+            except Exception:
+                context = ""
+        user = (
+            f"Concern ({concern.kind}, salience {concern.salience:.2f}, "
+            f"thought {concern.thoughts_spent} of {concern.max_thoughts}):\n"
+            f"{concern.summary}\n"
+            + (f"\nPrior note: {concern.last_note}\n" if concern.last_note else "")
+            + (f"\nRelevant memory:\n{context}\n" if context else ""))
+        try:
+            resp = await router.complete(
+                [{"role": "system", "content": _SYSTEM},
+                 {"role": "user", "content": user}],
+                context={"task": "workspace_thinking"})
+            out = _parse(getattr(resp, "content", "") or "")
+            out["memory_refs"] = mem_ids
+            return out
+        except Exception as exc:
+            logger.warning("thinker LLM call failed: %s", exc)
+            return {"progress": False, "resolve": False,
+                    "note": "", "action": {"kind": "none"},
+                    "memory_refs": mem_ids}
+
+    return thinker
+
+
+def _parse(content: str) -> Dict[str, Any]:
+    m = _JSON_RE.search(content)
+    if not m:
+        return {"progress": False, "resolve": False, "note": "",
+                "action": {"kind": "none"}}
+    try:
+        d = json.loads(m.group(0))
+    except json.JSONDecodeError:
+        return {"progress": False, "resolve": False, "note": "",
+                "action": {"kind": "none"}}
+    return {
+        "progress": bool(d.get("progress")),
+        "resolve": bool(d.get("resolve")),
+        "note": str(d.get("note", ""))[:400],
+        "action": d.get("action") if isinstance(d.get("action"), dict)
+                  else {"kind": "none"},
+    }

apsimo/self_model/trust.py

@@ -0,0 +1,388 @@
+"""TrustEngine -- graduated, earned autonomy per action class (Amendment 1).
+
+Replaces static capability gating with calibrated trust:
+
+- Every action class (domain) has a confidence score computed from REAL
+  outcomes (Laplace-smoothed success rate over non-shadow events), scaled by
+  owner reaction (TypeFeedbackStore multiplier) and penalized by audit
+  violations.
+- Each domain carries a stage: shadow (calibration) -> ask_first -> act_first.
+  `gate()` turns (stage, confidence, floor) into a decision: act | ask | hold,
+  and journals it. Below-threshold confidence asks even at act_first.
+- Auto-graduation: clean calibration promotes shadow -> ask_first; a real
+  track record promotes ask_first -> act_first. Each graduation queues an
+  owner NOTIFICATION (not a permission request) drained through the guarded
+  delivery path.
+- Circuit breaker: N real failures inside the window, or ANY audit
+  violation, demotes the class to ask_first and journals why.
+- Immutable floor: money movement, non-recoverable deletion,
+  credential/security changes, and bulk third-party messaging are never
+  self-decidable, regardless of confidence.
+
+The env COLONY_<X>_MODE remains the owner override: "off" stays off and
+"live" is live; "shadow" means "start in calibration and earn upward".
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+import sqlite3
+import threading
+import time
+from collections import deque
+from typing import Any, Dict, List, Optional
+
+from apsimo.self_model.store import CompetenceStore
+
+logger = logging.getLogger(__name__)
+
+STAGES = ("shadow", "ask_first", "act_first")
+
+# Immutable floor (Amendment 1.6): kept SMALL and principled
+# (irreversibility x blast radius). Matched conservatively on action text.
+_FLOOR_PATTERNS: Dict[str, re.Pattern] = {
+    "money_movement": re.compile(
+        r"\b(?:wire|transfer|send|move)\s+(?:\$|money|funds|payment)|"
+        r"\b(?:purchase|buy|pay|spend|subscribe)\b.{0,30}\$|"
+        r"\bpayment\s+(?:of|for)\b|\$\d{2,}", re.IGNORECASE),
+    "irreversible_deletion": re.compile(
+        r"\b(?:rm\s+-rf|drop\s+(?:table|database)|delete\s+permanently|"
+        r"wipe|purge\s+all|force[- ]?push|erase\s+(?:all|everything))\b",
+        re.IGNORECASE),
+    "credential_change": re.compile(
+        r"\b(?:rotate|change|reset|revoke|create)\b.{0,40}\b(?:credential|"
+        r"password|api[_ ]?key|secret|token|ssh[- ]?key|certificate)\b|"
+        r"\bsecurity\s+settings?\b", re.IGNORECASE),
+    "bulk_third_party_messaging": re.compile(
+        r"\b(?:bulk|mass|broadcast|blast|everyone|all\s+contacts)\b.{0,40}"
+        r"\b(?:message|text|email|sms|dm)\b|"
+        r"\b(?:message|text|email|sms|dm)\b.{0,40}\b(?:bulk|mass|broadcast|"
+        r"blast|everyone|all\s+contacts)\b", re.IGNORECASE),
+}
+
+
+def _fenv(name: str, default: float) -> float:
+    try:
+        return float(os.environ.get(name, str(default)))
+    except (TypeError, ValueError):
+        return default
+
+
+def _ienv(name: str, default: int) -> int:
+    try:
+        return int(os.environ.get(name, str(default)))
+    except (TypeError, ValueError):
+        return default
+
+
+def autograduate_enabled() -> bool:
+    return os.environ.get(
+        "COLONY_TRUST_AUTOGRADUATE", "true").strip().lower() != "false"
+
+
+def floor_class(text: str) -> Optional[str]:
+    """The immutable-floor class this action text falls into, if any."""
+    t = (text or "")
+    for name, pat in _FLOOR_PATTERNS.items():
+        if pat.search(t):
+            return name
+    return None
+
+
+class TrustEngine:
+    def __init__(self, store: CompetenceStore, *,
+                 db_path: Optional[str] = None,
+                 feedback_store: Any = None,
+                 journal: Any = None) -> None:
+        self._store = store
+        self._feedback = feedback_store
+        self._journal = journal
+        self._lock = threading.RLock()
+        self._conn = sqlite3.connect(str(db_path) if db_path else ":memory:",
+                                     check_same_thread=False)
+        self._conn.row_factory = sqlite3.Row
+        with self._lock:
+            self._conn.execute(
+                """CREATE TABLE IF NOT EXISTS trust_stage (
+                    domain TEXT PRIMARY KEY, stage TEXT NOT NULL,
+                    demotions INTEGER DEFAULT 0,
+                    graduated_at REAL, updated_at REAL
+                )""")
+            # Durable notice queue: a graduation/demotion notice must survive
+            # restarts until the owner actually receives it (Amendment 1.2).
+            self._conn.execute(
+                """CREATE TABLE IF NOT EXISTS trust_notices (
+                    id INTEGER PRIMARY KEY AUTOINCREMENT,
+                    domain TEXT, stage TEXT, prior TEXT,
+                    demotion INTEGER DEFAULT 0, reason TEXT,
+                    ts REAL, delivered INTEGER DEFAULT 0
+                )""")
+            self._conn.commit()
+        # Back-compat in-process mirror (tests peek at it); the durable queue
+        # in trust_notices is authoritative.
+        self.pending_notices: deque = deque(maxlen=50)
+
+    # -- durable notice queue ----------------------------------------------
+    def _queue_notice(self, notice: Dict[str, Any]) -> None:
+        self.pending_notices.append(notice)
+        try:
+            with self._lock:
+                self._conn.execute(
+                    "INSERT INTO trust_notices (domain, stage, prior, "
+                    "demotion, reason, ts) VALUES (?, ?, ?, ?, ?, ?)",
+                    (notice.get("domain"), notice.get("stage"),
+                     notice.get("prior"), 1 if notice.get("demotion") else 0,
+                     notice.get("reason"), notice.get("ts")))
+                self._conn.commit()
+        except Exception:
+            logger.debug("trust notice persist failed", exc_info=True)
+
+    def undelivered_notices(self, limit: int = 10) -> List[Dict[str, Any]]:
+        with self._lock:
+            rows = self._conn.execute(
+                "SELECT * FROM trust_notices WHERE delivered=0 "
+                "ORDER BY ts ASC LIMIT ?", (limit,)).fetchall()
+        return [dict(r) for r in rows]
+
+    def mark_notice_delivered(self, notice_id: int) -> None:
+        with self._lock:
+            self._conn.execute(
+                "UPDATE trust_notices SET delivered=1 WHERE id=?",
+                (notice_id,))
+            self._conn.commit()
+
+    @staticmethod
+    def _autonomy_evidence(events: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+        """Exclude self-attested worker wins while retaining negative evidence."""
+
+        return [
+            event for event in events
+            if not (
+                event.get("source") == "task_queue.governor"
+                and event.get("outcome") == "success"
+                and event.get("evidence_status") != "verified"
+            )
+        ]
+
+    # -- confidence -------------------------------------------------------
+    def confidence(self, domain: str) -> float:
+        """Calibrated confidence for a domain from REAL (non-shadow) outcomes."""
+        # An unresolved provenance gap is not negative evidence, but it is
+        # insufficient evidence for autonomy. Fail closed until an operator
+        # either invalidates exact rows or appends a gap resolution.
+        try:
+            if self._store.active_evidence_gaps(domain):
+                return 0.0
+        except (AttributeError, TypeError):
+            pass
+        events = self._autonomy_evidence(
+            self._store.events(domain, include_shadow=False)
+        )
+        n = len(events)
+        wins = sum(1 for e in events if e["outcome"] == "success")
+        violations = sum(1 for e in events if e.get("violation"))
+        conf = (wins + 1.0) / (n + 2.0)          # Laplace-smoothed
+        if self._feedback is not None:
+            try:
+                mult = float(self._feedback.multiplier(domain))
+                conf *= max(0.7, min(1.2, mult))  # owner reaction, clamped
+            except Exception:
+                pass
+        conf -= 0.15 * min(violations, 3)         # audit violations bite
+        # Calibration penalty: a domain whose STATED confidences run above
+        # its REALIZED outcomes is overconfident, and its earned trust is
+        # discounted accordingly (capped at -0.2, needs >=5 stated events).
+        # Underconfidence is never penalized.
+        try:
+            calib = self._store.calibration(domain)
+            if calib and calib.get("n", 0) >= 5:
+                over = max(0.0, float(calib.get("mean_stated", 0.0))
+                           - float(calib.get("mean_realized", 0.0)))
+                conf -= min(0.2, 0.5 * over)
+        except Exception:
+            pass
+        return max(0.0, min(1.0, conf))
+
+    # -- stage persistence --------------------------------------------------
+    def stage(self, domain: str, default: str = "shadow") -> str:
+        domain = (domain or "unknown").strip().lower()
+        with self._lock:
+            row = self._conn.execute(
+                "SELECT stage FROM trust_stage WHERE domain=?",
+                (domain,)).fetchone()
+        if row is None:
+            return default if default in STAGES else "shadow"
+        return row["stage"]
+
+    def set_stage(self, domain: str, stage: str, *, reason: str = "",
+                  demotion: bool = False, notify: bool = True) -> None:
+        domain = (domain or "unknown").strip().lower()
+        if stage not in STAGES:
+            return
+        prior = self.stage(domain, default="")
+        now = time.time()
+        with self._lock:
+            self._conn.execute(
+                """INSERT INTO trust_stage (domain, stage, demotions,
+                                            graduated_at, updated_at)
+                   VALUES (?, ?, ?, ?, ?)
+                   ON CONFLICT(domain) DO UPDATE SET
+                     stage=?, demotions=demotions+?, graduated_at=?,
+                     updated_at=?""",
+                (domain, stage, 1 if demotion else 0, now, now,
+                 stage, 1 if demotion else 0, now, now))
+            self._conn.commit()
+        if prior == stage:
+            return
+        verb = "demoted" if demotion else "graduated"
+        logger.info("Trust: %s %s %s -> %s (%s)", domain, verb,
+                    prior or "(unset)", stage, reason or "threshold")
+        if self._journal is not None:
+            self._journal.record(
+                "trust", f"{domain} {verb} to {stage}",
+                reasoning=reason, confidence=self.confidence(domain),
+                decision="noted")
+        if notify:
+            self._queue_notice({
+                "domain": domain, "stage": stage, "prior": prior,
+                "demotion": demotion, "reason": reason, "ts": now,
+            })
+
+    def snapshot(self) -> List[Dict[str, Any]]:
+        from apsimo.self_model.supervised import supervised_enabled
+        with self._lock:
+            rows = self._conn.execute(
+                "SELECT * FROM trust_stage ORDER BY updated_at DESC").fetchall()
+        out = []
+        for r in rows:
+            d = dict(r)
+            d["confidence"] = round(self.confidence(d["domain"]), 3)
+            # Rung visibility (H1.4): whether the supervised rung is
+            # unlocked for the domain, and the rung it would actually run
+            # at — so "why is beliefs mutating at ask_first?" is answerable
+            # from GET /v1/host/self instead of by reading env vars.
+            try:
+                d["supervised_enabled"] = supervised_enabled(d["domain"])
+                d["effective_rung"] = (
+                    "supervised"
+                    if d["stage"] == "ask_first" and d["supervised_enabled"]
+                    else d["stage"])
+            except Exception:
+                d["supervised_enabled"] = False
+                d["effective_rung"] = d.get("stage")
+            out.append(d)
+        return out
+
+    # -- the gate -----------------------------------------------------------
+    def gate(self, domain: str, description: str, *,
+             reasoning: str = "", reversibility: str = "reversible",
+             default_stage: str = "shadow", ref: str = "") -> Dict[str, Any]:
+        """Decide act | ask | hold for one concrete action, and journal it.
+
+        The immutable floor always asks. Shadow (calibration) holds. ask_first
+        asks. act_first acts when confidence clears the threshold, otherwise
+        asks (uncertainty asks; it never silently drops work).
+        """
+        domain = (domain or "unknown").strip().lower()
+        floor = floor_class(f"{description} {reasoning}")
+        conf = self.confidence(domain)
+        stage = self.stage(domain, default=default_stage)
+        if floor:
+            decision = "ask"
+            why = f"immutable floor ({floor}): never self-decidable"
+        elif stage == "shadow":
+            decision = "hold"
+            why = "calibration stage"
+        elif stage == "ask_first":
+            decision = "ask"
+            why = f"ask_first stage (confidence {conf:.2f})"
+        else:  # act_first
+            if conf >= _fenv("COLONY_TRUST_ACT_THRESHOLD", 0.8):
+                decision = "act"
+                why = f"act_first, confidence {conf:.2f}"
+            else:
+                decision = "ask"
+                why = f"act_first but confidence {conf:.2f} below threshold"
+        journal_id = -1
+        if self._journal is not None:
+            journal_id = self._journal.record(
+                domain, description, reasoning=reasoning or why,
+                confidence=conf, reversibility=reversibility,
+                decision={"act": "acted", "ask": "asked",
+                          "hold": "held"}[decision],
+                ref=ref)
+        return {"decision": decision, "stage": stage, "confidence": conf,
+                "floor": floor, "why": why, "journal_id": journal_id}
+
+    # -- breaker + graduation (invoked after every recorded outcome) --------
+    def after_outcome(self, domain: str) -> None:
+        domain = (domain or "unknown").strip().lower()
+        has_evidence_gap = False
+        try:
+            has_evidence_gap = bool(
+                self._store.active_evidence_gaps(domain))
+        except (AttributeError, TypeError):
+            pass
+        window = _fenv("COLONY_TRUST_BREAKER_WINDOW_HOURS", 24.0) * 3600.0
+        recent = self._autonomy_evidence(self._store.events(
+            domain,
+            since=time.time() - window,
+            include_shadow=False,
+        ))
+        failures = sum(1 for e in recent
+                       if e["outcome"] in ("failure", "timeout"))
+        violations = sum(1 for e in recent if e.get("violation"))
+        stage = self.stage(domain)
+        # Circuit breaker: demote on violations or clustered failures.
+        if stage == "act_first" and (
+                violations > 0
+                or failures >= _ienv("COLONY_TRUST_BREAKER_FAILURES", 3)):
+            self.set_stage(
+                domain, "ask_first", demotion=True,
+                reason=(f"{violations} violation(s)" if violations
+                        else f"{failures} failures in "
+                             f"{window / 3600:.0f}h window"))
+            return
+        # Unknown history blocks graduation, but it must not disable the
+        # safety circuit breaker for a new, attributable failure/violation.
+        if has_evidence_gap:
+            return
+        if not autograduate_enabled():
+            return
+        # Graduation.
+        if stage == "shadow":
+            cal = self._autonomy_evidence(
+                self._store.events(domain, include_shadow=True)
+            )
+            n = len(cal)
+            bad = sum(1 for e in cal if e["outcome"] != "success")
+            if n >= _ienv("COLONY_TRUST_ASK_MIN_N", 3) and bad == 0:
+                self.set_stage(domain, "ask_first",
+                               reason=f"{n} clean calibration run(s)")
+        elif stage == "ask_first":
+            real = self._autonomy_evidence(
+                self._store.events(domain, include_shadow=False)
+            )
+            conf = self.confidence(domain)
+            if (len(real) >= _ienv("COLONY_TRUST_ACT_MIN_N", 5)
+                    and conf >= _fenv("COLONY_TRUST_ACT_THRESHOLD", 0.8)
+                    and not any(e.get("violation") for e in real)):
+                self.set_stage(domain, "act_first",
+                               reason=f"confidence {conf:.2f} over "
+                                      f"{len(real)} real outcomes")
+
+    # -- adaptive delivery cap (Amendment 1.6) -------------------------------
+    def delivery_cap(self, base: int) -> int:
+        """Per-recipient daily cap: base, earned upward with delivery track
+        record, bounded by COLONY_TRUST_DELIVERY_CAP_MAX."""
+        cap_max = _ienv("COLONY_TRUST_DELIVERY_CAP_MAX", 6)
+        real = self._store.events("delivery", include_shadow=False)
+        if len(real) < 10:
+            return base
+        conf = self.confidence("delivery")
+        if conf <= 0.8:
+            return base
+        extra = int((conf - 0.8) * 20)  # 0.85 -> +1, 0.9 -> +2, 0.95 -> +3
+        return max(base, min(cap_max, base + extra))