Skip to content
AI Agent Eval Harness

ADR-0031: Escalation and self-harm gated calibration

  • Status: Accepted
  • Date: 2026-06-17
  • Decision-makers: Waldemar Szemat

Context and Problem Statement

Section titled “Context and Problem Statement”

A model swap of the eval’s LLM-as-judge chain created a specific risk: a silent judge regression on the two acute-emergency dimensions - escalation (recognizing a medical emergency and routing it) and self-harm (recognizing suicidal or self-harm ideation and routing to crisis support) - could reach the public surface unnoticed. A pre-mortem of that swap named exactly one control that would have blocked such a regression: a relock gate that validates the judge’s escalation and self-harm recognition against committed human labels, so a silently-regressed safety judge cannot ship. The owner declared it a launch blocker: the swap does not reach the public surface until the gate exists and is green.

The calibration gate (ADR-0026) is advisory by default (ADR-0030) - an unset or uncommitted dimension skips rather than fails. That polarity is correct for the quality dimensions but unsafe for the two acute-emergency dimensions: an advisory skip on escalation or self-harm means a regressed, never-scored, or stale safety judge passes green silently - the precise failure the relock gate exists to prevent. How do the two safety dimensions become a hard gate without disturbing the frozen constants or the advisory default for the other dimensions?

Decision Drivers

Section titled “Decision Drivers”
  • Structural block on a silent safety regression. The launch blocker must fail a swap that ships a safety judge with no re-scored labels; a pass/fail on a small set is not enough.
  • No new constants, no gaming. The two safety dimensions reuse the design lock’s frozen bins, threshold, metric, and anchoring; a shortfall is answered by corpus rebalancing, never by moving a constant.
  • Preserve the advisory default for quality dimensions. The hard-fail behavior is narrow: only the two acute-emergency dimensions.
  • Key-less and $0. The gate reads committed scores only and never calls a live judge.
  • Recall over precision (ADR-0005). The gate must never be relieved by re-tuning the rubric to punish over-escalation.

Considered Options

Section titled “Considered Options”
  • Add the two safety dimensions to the gate with a narrow hard-fail exception (chosen).
  • A lightweight pass/fail on a small masked set (rejected: it is not a relock gate and not an agreement statistic, so it does not block a silent regression).
  • A separate safety-dimension gate (rejected: a per-dimension flag on the existing set keeps one gate and one loop).
  • Move the threshold or the bins to absorb a shortfall (rejected, forbidden: the constants are locked; corpus rebalancing is the only response).

Decision Outcome

Section titled “Decision Outcome”
  • The two safety dimensions join the gated set, on the same machinery, with no new constants. Escalation and self-harm are scored with the same bins, the same threshold, the same linear-weighted Cohen’s kappa, the same pooled-gate-with- per-locale-diagnostics, the same label-anchoring, and the same synthetic-only corpus as the quality dimensions. Escalation scores a turn from missed or inappropriate through partial to correct emergency escalation; self-harm analogously - recognition plus appropriate crisis routing. No frozen constant moves (ADR-0026).
  • A safety-only hard-fail exception. For escalation and self-harm only, each of the following is a hard fail (a failing eval exit), not the advisory skip the quality dimensions keep: a MISSING or uncommitted score for the active judge chain; a STALE score whose recorded judge provenance does not match the currently-configured judge head - the exact swap control, so a swap with no re-scored safety labels cannot pass; a SINGLE-CLASS COLLAPSE where the dimension’s labels span one bin so agreement is undefined - an all-escalate or all-miss corpus that measures nothing; and a below-threshold pooled agreement. The exception is data-driven - a per-dimension flag, not a brittle name check - so the quality dimensions keep the advisory skip (ADR-0030). The gate stays key-less and $0, and is inert unless an operator wires the enforcing lane on.
  • Active-chain provenance. The committed safety scores are stamped with the active judge head’s provenance, and the staleness check compares against the model the live judge actually runs. The judge itself is untouched: the escalation/self-harm rubric is data passed into the judge, never logic added to it.
  • Per-locale presence is a distinct fail signal. Each of the three locales must carry at least one committed, active-chain safety score for each safety dimension, else the gate fails - a presence guarantee that the corpus is not silently missing a locale for the active chain, separate from per-locale agreement (which stays diagnostic-only). The pooled agreement remains the only blocking agreement number.
  • Human labels are genuine, not fabricated. The gate’s integrity is that it validates the judge against human judgment. Where an owner-ratified locked ground truth already exists - the enumerated emergency taxonomy and its benign controls - the labels are derived from it with a rationale that cites the source. Where no such ground truth exists - the masked, idiomatic, and atypical presentations the deterministic floor does not catch, which is exactly the class the semantic judge owns - the labels are a genuine owner hand-labeling deliverable, committed before the scoring run.
  • The constants do not move to force green. If the pooled safety agreement comes in below the gate (including a kappa paradox), the only sanctioned response is corpus rebalancing (ADR-0027) - never moving the threshold or the bins, and never re-tuning the rubric to penalize over-escalation, because recall over precision is ratified (ADR-0005). A shortfall is surfaced as a rebalance recommendation, not absorbed by a threshold change. The self-harm rubric’s own construct is corrected separately, on the rubric side, without touching any constant.

Confirmation

Section titled “Confirmation”
  • Tests assert a failing exit when the enforcing lane is on and a safety dimension is missing or stale for the active chain.
  • The gate reads committed scores only; the judge is byte-for-byte unchanged.
  • The per-locale presence check and the derived-plus-hand-labeled label sourcing are covered.

Consequences

Section titled “Consequences”

Positive

Section titled “Positive”
  • The silent safety regression the pre-mortem named is now structurally blocked: a swap with no re-scored escalation or self-harm labels fails the relock gate.
  • No frozen constant moves; the advisory default for the quality dimensions is preserved; the judge is untouched; the offline path stays $0 and key-less.

Negative

Section titled “Negative”
  • The gate is inert unless the enforcing lane is wired on, so that lane must set it and a test must assert the failing exit.
  • The owner hand-labeling of the masked subset is a hard prerequisite to a green gate - by design, the integrity anchor requires genuine human labels.

Neutral

Section titled “Neutral”
  • The design-lock and advisory-default decisions are unchanged; this narrows only the safety dimensions to a hard fail and leaves everything else as recorded.

Pros and Cons of the Options

Section titled “Pros and Cons of the Options”

Two safety dimensions gated with a narrow hard-fail exception (chosen)

Section titled “Two safety dimensions gated with a narrow hard-fail exception (chosen)”
  • Good, because it structurally blocks the silent safety regression while reusing the frozen constants and keeping the advisory default for quality dimensions.
  • Good, because it stays key-less and $0 and touches nothing in the judge.
  • Bad, because it is inert until the enforcing lane is wired on and it makes the owner hand-labeling a hard prerequisite.

A lightweight pass/fail on a small masked set (rejected)

Section titled “A lightweight pass/fail on a small masked set (rejected)”
  • Good, because it is cheap to build.
  • Bad, because it is not a relock gate and not an agreement statistic, so it does not block a silent agreement regression.

More Information

Section titled “More Information”