It almost never acts first. That is the feature.

Two gates, and one of them is only a veto

The two are separate modules and neither may stand in for the other. Detecting a breakpoint is reasonably reliable; classifying what kind of breakpoint it is runs at 2–42% accuracy, so a policy that acted on the type would be acting on a coin flip. Half-right timing is not half the benefit — it is a liability, which is why a detected breakpoint is forbidden as an input to the value gate.

There is deliberately no third action called “ask permission to act”. Asking is itself an interruption, with its own cost line, that also wastes your answer. A hand that genuinely needs your yes asks for it inside its own confirmation step, once, with the thing it is about to do on the screen in front of you.

A hand is a declaration before it is code

{
  "id": "desk.collect",
  "sideEffects": "reversible",
  "confirmation": false,
  "cancellation": true,
  "preconditions": [
    {
      "id": "has-a-current-task",
      "check": "ambient.task.identified",
      "unmetMessage": "I can't tell yet what you're working on."
    },
    {
      "id": "more-than-one-source",
      "check": "ambient.task.sourceCount.atLeastTwo",
      "unmetMessage": "Everything for this is already in one place."
    }
  ],
  "permissions": { "ambientScopes": ["window.titles", "document.names", "task.state"],
                   "outboundReach": "none", "contentEgress": "none" },
  "review": { "reviewed_by": "James Camarota",
              "reviewed_at": "2026-09-13T17:00:26.940Z",
              "status": "approved" }
}

9 hard rules, in code, with no override

1. Never interrupt or act first below On-call. Below it the agent may think whatever it likes and must do nothing about it.
2. Never cut across you mid-sentence or mid-keystroke, except a backchannel under 300 ms — the gate’s own name for an acknowledgement too short to take the floor — or a safety stop.
3. Never raise, or act on, anything sourced from an excluded app or a sensitive context. The exclusion is yours to set and it is checked before the read, not after.
4. Never re-raise something you declined, in any phrasing, for the rest of the day — and never re-raise a class you declined twice.
5. Never interrupt to say it has nothing to say, to confirm it heard you, or to ask whether it may interrupt. A hand that needs your yes asks inside the confirmation, once.
6. Never interrupt during a call, a meeting, a screen share or a presentation. Uncertain counts as sharing.
7. Never state an inference as a fact. Every unprompted claim is marked as the agent’s guess, and every hand prints the observation it acted on.
8. Never keep acting after the cap — and never let the cap be the only thing producing quiet. If the meter was the only reason it did nothing today, that is logged as a product defect rather than as a saving.
9. Never infer emotion, mood, stress, engagement, or focus-as-a-score from anything it reads. Not as a feature, not as an internal signal, not “for the timing gate.”

Where they are enforced, and where they are not. These nine are evaluated by evaluateHardRules in packages/gate, which the speech gate calls on every intent. They were written for a version of this that spoke; the wording above is their translation into acting, and it is the wording that moved first. Half of them now bind a hand, and half of them still do not. When a running task wants to interrupt you — to ask a question it cannot proceed without — it passes rules 2, 4, 5, 6 and 8 first, in packages/relay, using the gate’s own list rather than a second copy of it. Refused, it takes the cautious default it published and never asks; somebody in a meeting is not told afterwards that they were asked. The act itself is still not evaluated against them: packages/hands does not depend on packages/gate, so the rules about what may be raised and when still bind interruption and not action. That half is open, and it is the one thing on this page you could have caught us on by reading a package.json.

The last rule is not only a courtesy. The EU AI Act has prohibited workplace emotion inference since February 2025, and the fines run to €35M or 7% of global turnover. It is also the cheapest moat available to a small vendor: it is far easier for us to structurally not do it than for a platform to prove it doesn’t.

Where the data goes →