Our governed + signed evolution of Cursor's
Auto-review:
a context-aware classifier runs INLINE before every Action node in the ReAct loop.
Verdict ∈ {allow, narrow, block-with-explanation, escalate}, intent-relative, workspace-aware.
Each verdict is Λ-gated (Conjecture 1, never 100% safe), DSSE-signed, expressed as
OPA/Rego rules mapped to OSCAL controls + NIST AI RMF MANAGE, and
conformal-calibrated. On block we return an explanation so the parent self-corrects;
we escalate to a human only when truly needed. Effectors stay SIMULATED.
3D AUTONOMY — dial L0–L5 drives a live Λ-gated verdict sphere
init…
Autonomy dial (graded, not binary)
loading dial…
Classify an action (live /classify)
Verdict colors the trust-sphere by Λ-effective; each signed verdict animates a receipt chip onto the board below.
Λ —
no verdict yet
Signed-verdict receipts (board)
run a classify to sign verdicts onto the board
3D enhancement of the
Cursor Auto-review
autonomy-dial pattern, hardened with
Invariant-style
inline guardrails and
NeMo Guardrails (Colang)
dialogue rails. Each verdict stays Λ-gated (Conjecture 1, < 1.0), DSSE-signed, never 100% safe.
Holographic kit vendored at /static/shared/szl_holo3d.js · 0 runtime CDN.
AUTONOMY DIAL — L0–L5 (graded, not a binary switch)
loading dial…
SAE-style graded autonomy for agents. Higher levels auto-execute
more action classes; risky/secret/irreversible/effector actions still gate at
every level. Cursor Auto-review autonomy-dial pattern, made governed.
MEASURED RATES — block / interrupt / flap
measuring live…
Block-rate / interrupt-rate / flap-rate are MEASURED from the live
rolling decision log (label ROADMAP until enough real runs accrue). Cursor
reports ~4% blocked / ~7% chats interrupted — we measure ours, we do not borrow it.
CALIBRATION (ECE/Brier gate) + CONFORMAL SET
measuring live…
ECE (equal-width bins) + Brier; gate ECE < 0.05 required for any
automated (no-human) verdict, fails closed on unmeasured. Conformal set replaces
bare confidence % (Dev B's szl_conformal helper).
arXiv:2505.15437 / arXiv:2305.18404.
FLAPPING DETECTION — verdict stability
measuring live…
FLAPPING = the same case (intent+tool+input+dial) gets DIFFERENT
verdicts across repeated runs. Flapping → policy is unstable → tighten it.
Click “run gated ReAct plan” — the classifier reviews each
Action node inline, signs each verdict, blocks the risky one with an explanation
(so the parent self-corrects), and allows the safe one.
Demonstrates the keystone: classifier runs subagent-style INLINE at
the Action node of Dev A's ReAct loop (/api/a11oy/v1/agent/react/*), not as
a separate round-trip. Each step carries a DSSE-signed receipt + the Rego rule hit + the
OSCAL control cited. A code-shaped step also shows its a11oy Restraint rung
(/api/a11oy/v1/restraint): a bloated diff that skipped the frugality ladder is
narrowed by AR-006 prefer-minimal-diff (OSCAL SA-8/SA-15/CM-7 · NIST AI RMF MANAGE 2.3).
Rules authored in OPA/Rego; each maps to an
OSCAL
control (SP 800-53 Rev5 via
oscal-content)
and a NIST AI RMF MANAGE subcategory. We MAP-TO / ALIGN-WITH — this is not a
certification or ATO.
RECENT DECISIONS — per-decision signed receipt + rule + control
loading live decision log…
Live rolling log. Each row carries the verdict, the Rego rule hit, the
OSCAL control(s), the Λ-effective value (< 1.0), and the canonical decision hash that is
DSSE-signed into the node's receipt.