Skip to content
AI Agent Eval Harness

ADR-0035: Fail-safe escalation-judge inversion

  • Status: Accepted
  • Date: 2026-07-01
  • Decision-makers: Waldemar Szemat

Context and Problem Statement

Section titled “Context and Problem Statement”

Every LLM-backed guardrail in the system except this one fails open: on a timeout, an exception, or an empty or malformed judge response, the scope, persona, and groundedness judges pass the turn through, because for a non-safety dimension the cost of an over-refusal is higher than the cost of a rare miss. The escalation dimension inverts that cost asymmetry: a missed acute emergency - stroke, anaphylaxis, suicidal intent, severe hypoglycemia - is the catastrophic, irreversible harm, while an over-fired emergency template is a bounded, $0, non-metered annoyance already ratified as accepted product behavior (ADR-0034).

A semantic escalation judge is added behind the deterministic floor to catch the idiomatic, localized, and obfuscated es-419 and pt-BR emergencies the floor still misses. Because that judge is built by copying the fail-open scope classifier and inverting every branch, the single highest-risk defect is a leftover pass-through on a failure branch that would silently reintroduce fail-open on the safety-critical path. How do we ratify the inverted fail mode, the threshold posture, and the latency bound as an explicit contract, so the inversion cannot be quietly eroded?

Decision Drivers

Section titled “Decision Drivers”
  • Recall over precision on acute emergencies. A missed red flag costs far more than an over-fired one (the same asymmetry as ADR-0005 / ADR-0034).
  • No fail-open regression on the safety path. The inversion must be total and auditable, not a best-effort majority of branches.
  • Bounded tail latency. The synchronous guardrail path must not blow the turn latency budget on a slow or hung judge provider.
  • A defensible, non-arbitrary threshold today, without over-claiming an empirical calibration not yet run.
  • The judge must never weaken the already-shipped deterministic floor.

Considered Options

Section titled “Considered Options”
  • Fail-safe inversion (escalate on every non-clean outcome) with a recall-biased threshold prior, a hard timeout, and no inline retries (chosen).
  • Keep the judge fail-open like the scope judge and rely on the deterministic floor alone for failures (rejected: a judge timeout or outage would silently pass an acute emergency through - the exact catastrophic failure the judge exists to close).
  • Fail-safe, but pin the firing threshold to an empirically calibrated value now (rejected: the held-out calibration has not been run; pinning now would over-claim a measured value and pre-empt the dedicated calibration gate).

Decision Outcome

Section titled “Decision Outcome”
  • Total fail-safe inversion. Every runtime or format failure escalates: a timeout, an exception, missing scores, a malformed rationale, an off-range or NaN score, and an empty or truncated response all fail toward escalation, each tagged as an error-driven escalation. A pass-through is reachable from exactly two branches: an empty-input no-op (there is nothing to escalate, so the judge is not called) and a well-formed emergency confidence strictly below the firing threshold. No branch best-effort-parses malformed output - a negation like “do NOT escalate” could be misread - so off-schema output is a fail-safe trigger, not something to rescue.
  • The firing threshold is a recall-biased prior, not an empirical pin. It is seeded from a cost-optimal decision-threshold result (Elkan) as a sanity anchor only, because LLM confidence is uncalibrated and overconfident. It is an operator-tunable, bounded configuration value, and it is not claimed to be calibrated against a held-out labeled corpus.
  • A bounded hard timeout with no inline retries. The synchronous judge call is wrapped in a hard timeout well under the turn latency budget; on expiry the turn fails safe to escalation. No second retry layer is added on the synchronous path
    • the judge already has one internal retry, and a second would risk a tail-latency explosion. An outer request teardown propagates rather than being swallowed.
  • The judge only adds escalations; it never narrows or rescinds the floor. It runs only after the deterministic floor did not fire and a judge is configured, and it is combined behind the floor by conjunction, so it can never suppress a floor hit - consistent with the ratified recall-over-precision posture (ADR-0034). The $0, key-less path constructs no judge and is byte-identical to before.
  • The empirical calibration is deferred. The empirical recall-floor threshold calibration on a held-out set, the final pinned threshold, the metamorphic corpus lock, and the fail-closed judge-on CI gate are deferred to a dedicated gate phase. This ships the mechanism at the prior, with deterministic control proofs only.

Confirmation

Section titled “Confirmation”
  • A fault-injection matrix asserts that every non-clean outcome escalates and that the single clean below-threshold negative is the only judge-invoked pass-through.
  • The threshold and timeout bounds and the distinct escalation counters - policy-driven versus error-driven, carrying no PII - are unit-tested.
  • A key-less parity test confirms the $0 floor path is unchanged.

Consequences

Section titled “Consequences”

Positive

Section titled “Positive”
  • The safety-critical fail mode is now an explicit, cited contract, not an implicit detail of a copied class: a reviewer cannot quietly reintroduce fail-open without failing the fault-injection matrix.
  • The recall-biased default plus the deterministic floor together route idiomatic and localized acute emergencies to the locale-native template before any masking dosing or scope refusal.
  • A provider-outage escalation storm is observable and distinguishable from real signal via the distinct policy-driven versus error-driven counters.

Negative

Section titled “Negative”
  • The escalate-everything-on-failure posture means a provider outage floods the human-review sink with error-driven escalations - the safe direction, but a review load a circuit breaker must later absorb.
  • The prior is explicitly un-calibrated: until the deferred calibration, the firing boundary is a defensible guess, not a measured recall floor.

Neutral

Section titled “Neutral”
  • Fail-safe protects only against runtime or format failure. A confident-but-wrong well-formed negative below the threshold is not caught by the inversion; that residual is covered by the deterministic floor, which is why both layers are retained.
  • Two operator-tunable configuration values and one telemetry counter are added to the surface.

Pros and Cons of the Options

Section titled “Pros and Cons of the Options”

Fail-safe inversion with a recall-biased prior (chosen)

Section titled “Fail-safe inversion with a recall-biased prior (chosen)”
  • Good, because the inversion matches the emergency cost asymmetry: a missed red flag is the catastrophic harm, an over-fire is a bounded $0 annoyance.
  • Good, because the hard timeout bounds tail latency without a retry explosion.
  • Good, because a recall-biased prior is honest about not being an empirical pin and defers calibration to a dedicated gate.
  • Bad, because it can generate an escalation storm under a provider outage - the safe direction, but a review-sink load the operations layer must later absorb.

Keep the judge fail-open (rejected)

Section titled “Keep the judge fail-open (rejected)”
  • Good, because it is a zero-diff copy of the well-understood fail-open scope classifier.
  • Bad, because a judge timeout or outage would silently pass an acute emergency through - the exact catastrophic failure mode the judge exists to close.

More Information

Section titled “More Information”