Wire the content classifier into the turn path, so deny actually denies #388

New issue

Closed

opened 2026-08-13 11:40:54 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-13 11:40:54 +00:00

Member

The wiring every one of us declined all day. Slice of #227, which is also the enforcement half #228 rides on.

Lucia landed the taxonomy and the classifier prompt and said twice that whoever was building the enforcement should keep going. Quail confirmed nothing in the harness gates content. I built the bounded block response and did not take the invocation either. Nobody had it.

Scope

A deployment-supplied taxonomy path turns the gate on. Unset runs no classifier and costs nothing.
The member's request is classified before the answering call, so a blocked turn spends no completion budget on an answer nobody reads.
A denied class replies with the bounded block response instead of a model answer.
Kai's four span tags: classified, class, approved, sensitive.

The property that matters more than the feature

A broken gate is not a denial. A classifier that errors, times out, or answers with a class outside the closed set leaves the turn unclassified and the turn proceeds. Treating a classifier failure as a refusal turns one broken dependency into a service that refuses everything, while looking like policy working.

Why the first tag is worth having

content.classified is false whenever the gate did not run, which is every turn on a deployment that has not enabled it. A tag that is always true is not worth carrying, and Kai asking for a boolean here is what suggested the gate should be able to not run.

Out of scope

Enabling it on any deployment. The switch is deploy-side and the cost is real: one extra model call per turn, landing hardest on the cheapest turns. That costing is on 227 and the decision is Kai's.
The deterministic prefilter I costed on 227. It reduces the per-turn cost and is a separate change on top of this seam.

Acceptance

With no taxonomy configured, no classifier runs and no tag beyond classified: false.
A denied class produces a refusal; an allowed class passes through untouched.
Sensitive wins over an ordinary denial, so a request tripping both is never refused by the shape that names a category.
An unknown class is an error rather than a denial.

**The wiring every one of us declined all day.** Slice of https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/227, which is also the enforcement half https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/228 rides on. Lucia landed the taxonomy and the classifier prompt and said twice that whoever was building the enforcement should keep going. Quail confirmed nothing in the harness gates content. I built the bounded block response and did not take the invocation either. Nobody had it. ## Scope - A deployment-supplied taxonomy path turns the gate on. Unset runs no classifier and costs nothing. - The member's request is classified before the answering call, so a blocked turn spends no completion budget on an answer nobody reads. - A denied class replies with the bounded block response instead of a model answer. - Kai's four span tags: classified, class, approved, sensitive. ## The property that matters more than the feature **A broken gate is not a denial.** A classifier that errors, times out, or answers with a class outside the closed set leaves the turn unclassified and the turn proceeds. Treating a classifier failure as a refusal turns one broken dependency into a service that refuses everything, while looking like policy working. ## Why the first tag is worth having `content.classified` is false whenever the gate did not run, which is every turn on a deployment that has not enabled it. A tag that is always true is not worth carrying, and Kai asking for a boolean here is what suggested the gate should be able to not run. ## Out of scope - Enabling it on any deployment. The switch is deploy-side and the cost is real: one extra model call per turn, landing hardest on the cheapest turns. That costing is on 227 and the decision is Kai's. - The deterministic prefilter I costed on 227. It reduces the per-turn cost and is a separate change on top of this seam. ## Acceptance - With no taxonomy configured, no classifier runs and no tag beyond `classified: false`. - A denied class produces a refusal; an allowed class passes through untouched. - Sensitive wins over an ordinary denial, so a request tripping both is never refused by the shape that names a category. - An unknown class is an error rather than a denial.

coilyco-ops referenced this issue from a commit

2026-08-13 11:41:19 +00:00

feat(content): wire the classifier, so deny actually denies

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-13 11:41:40 +00:00

feat(content): wire the classifier, so deny actually denies #390

coilyco-ops referenced this issue

2026-08-13 11:42:02 +00:00

sirens echo should have harness level enforcement of the type of content it will reply to, call it content classifier #227

coilyco-ops referenced this issue

2026-08-13 11:42:04 +00:00

add IRL physical (transit?) as a content block type #228