Skip to content
Auto Mode Gate

Understand decisions

Auto Mode Gate applies deterministic rules before the permission judge. Version 0.2.0 sends only an eligible sanitized Git request to a user-selected Pi model; version 0.1.0 does not invoke a judge.

Decision flow

Section titled “Decision flow”
action
└─ deterministic policy
   ├─ allow-final              -> continue without AI
   ├─ deny-final               -> block without AI
   ├─ unresolved-ineligible    -> block without AI
   └─ unresolved-eligible
      ├─ Pi judge allow        -> continue
      └─ deny/unavailable/fail -> block

The core returns a structured decision. The adapter then converts a blocked decision into the host-specific denial behavior.

Safe is narrow

Section titled “Safe is narrow”

A read-only allowance requires all of the following:

  • one supported simple Bash, PowerShell, or CMD command;
  • an exact absolute executable path at the start of the command;
  • that exact path in the global trusted-path list;
  • matching executable evidence supplied by the adapter;
  • no unsupported operators, redirections, substitutions, expansions, or malformed input.

Bare command names, shell builtins, relative paths, and unconfigured absolute paths remain ambiguous. The gate does not resolve PATH or rewrite a command to manufacture executable identity.

Dangerous and ambiguous

Section titled “Dangerous and ambiguous”

Known mutating or process-launching commands remain denied without requiring resolution evidence. Operators, redirections, substitutions, expansions, unsupported commands, missing evidence, and malformed input are ambiguous and fail closed.

The deterministic precedence is:

  1. Internal evaluation error.
  2. Unknown action or shell.
  3. Missing, truncated, oversized, or malformed input.
  4. Explicit dangerous command or option.
  5. Missing or mismatched executable identity.
  6. Unsupported or ambiguous syntax.
  7. Narrow safe-command allowance.

Every result other than allow has a stable denial code. Ineligible ambiguity uses AMG_DENY_AMBIGUOUS. Eligible failures use judge-specific unavailable, timeout, cancelled, invalid-response, or error codes.

Permission judge

Section titled “Permission judge”

Deterministic allowances and denials skip the model, which reduces calls and prevents the judge from weakening fixed policy. Eligibility requires a configured exact Git path, simple literal syntax, and a closed diff, log, show, or status request. The model receives only shell, operation, option-risk, and argument-kind enums. It receives no command text, values, paths, URLs, secrets, history, objectives, host context, or IDs.

Pi uses one isolated model-registry call with tools: [], no history, maxRetries: 0, cancellation, and a local deadline that does not wait for late providers. Only one canonical JSON allow or deny response is accepted. OpenCode has no verified transport and blocks eligible cases as unavailable.

Next steps

Section titled “Next steps”