Skip to content
AI Agent Eval Harness

ADR-0034: Negation-blind escalation floor, ratified and re-cert-gated

  • Status: Accepted
  • Date: 2026-06-18
  • Decision-makers: Waldemar Szemat

Context and Problem Statement

Section titled “Context and Problem Statement”

The always-on crisis floor is made unconditional. A pure, no-LLM deterministic escalation scan - already validated for recall on acute emergencies, and running inside the agent graph after the request gates - is lifted to a copy at the very top of the chat and voice endpoints, so a rate-limit, timeout, authorization, or turn-cap error can never swallow an acute emergency. The pre-gate copy reuses the existing detector and templates verbatim; it authors no new detection logic.

That move makes one long-standing property of the detector load-bearing on the public funnel, and it must be ratified rather than left implicit: the deterministic red-flag router is intentionally negation-blind. The guardrails decision (ADR-0005) fixed this as a deliberate high-recall choice - “I am not suicidal” or “I do NOT have chest pain” still escalates, because a missed acute red flag costs far more than an over-fired one. This is an accepted false positive, not a bug.

The risk this record addresses is a future “fix”: a well-meaning reviewer adds negation-awareness - “the user said NOT, so suppress the escalation” - and, in doing so, opens a false-negative hole, the exact failure mode the recall-over-precision posture exists to prevent. Because the scan now front-runs every gate on the live surface, such a regression would silently degrade the safety floor for real traffic. How do we ratify the behavior and gate any change to it so an acute case can never be silently dropped?

Decision Drivers

Section titled “Decision Drivers”
  • Recall over precision on acute emergencies (ADR-0005). A missed red flag costs far more than an over-fired one; the asymmetry is the whole basis of the design.
  • A load-bearing property must be an explicit contract. Once the scan front-runs every live gate, its negation-blindness cannot stay an implicit detail.
  • Any change must be mechanically re-certified. A safety-relevant escalation change must re-prove zero recall regression, deterministically and without a judge, before it ships.
  • No new detection logic. The move is a placement change, not a semantics change.

Decision Outcome

Section titled “Decision Outcome”
  • Ratify negation-blind over-escalation as accepted product behavior. The deterministic escalation router’s negation-blindness (ADR-0005) is accepted, locked behavior for the always-on safety floor. An over-escalation on negated or hypothetical red-flag text - “I do NOT have chest pain” still escalates - is correct by design: recall over precision on acute emergencies. No reviewer may “fix” this into a negation-aware suppression that creates a false-negative hole.
  • Lock any escalation-logic change behind a recall re-certification. Any change to the escalation detector, its normalization, its templates, or the pre-gate copy must re-run and pass both standing recall gates before it ships:
    • a recall-parity gate - for every corpus case the in-graph detector catches, the pre-gate copy must also fire, across en / es-419 / pt-BR; a single dropped case is a forbidden recall regression and fails the build;
    • a judge-off floor proof - the deterministic floor holds key-less, with no judge in the loop, with positive must-escalate recall and no over-fire or over-block drift. A change that drops a case fails the first; a change that breaks the key-less floor fails the second. Both are deterministic and run in the offline suite, so the re-certification is mechanical and cannot be skipped.
  • No new detection logic. The pre-gate copy composes the existing validated functions verbatim; the in-graph guardrail node stays as the defense-in-depth backstop. This record ratifies and gates existing behavior; it introduces no new escalation semantics.

Confirmation

Section titled “Confirmation”
  • The always-on pre-gate fires the emergency template ahead of every request gate on the chat and voice surfaces, reusing the in-graph detector and templates verbatim.
  • The recall-parity gate and the judge-off floor proof both pass and are standing offline gates; a change to the escalation logic that drops a case, or that breaks the key-less floor, fails the build.

Consequences

Section titled “Consequences”

Positive

Section titled “Positive”
  • The negation-blind posture is now an explicit, cited contract on the public funnel, not an implicit detail of the detector. A reviewer who proposes negation-awareness must first clear the recall re-certification, which the recall-parity gate makes impossible to pass while dropping a case.
  • The two standing gates make the re-certification mechanical: both are deterministic, key-less, and already in the offline suite, so a safety-relevant escalation change cannot ship without re-proving zero recall regression.
  • The escalation turn runs no LLM and is not metered, so an over-fire carries no cost-gate or billing impact.

Negative

Section titled “Negative”
  • The accepted false-positive cost - a negated or hypothetical red-flag phrase rendering the emergency template - is borne deliberately. It is the correct trade under recall over precision, but it is a real over-fire on those inputs.

Neutral

Section titled “Neutral”
  • The move is a placement change (in-graph to an always-on pre-gate copy), not a semantics change; the in-graph node remains as defense-in-depth.

Alternatives Considered

Section titled “Alternatives Considered”
  • Make the detector negation-aware (suppress escalation on negated red-flag text) (rejected): it directly contradicts recall over precision and opens a false-negative hole on acute emergencies, the highest-cost failure mode. A missed red flag costs far more than an over-fired one.
  • Leave the behavior implicit, with no ratification and no re-cert gate (rejected): once the scan front-runs every gate on the live surface, an un-gated “fix” could silently degrade the floor for real traffic with no build-time signal.
  • Rely only on the key-less floor proof without the recall-parity test (rejected): that proves the in-graph floor holds key-less but not that the pre-gate copy loses zero cases versus the in-graph detector - which is the specific proof obligation for the copy.

More Information

Section titled “More Information”