ADR-051: Ordered Restrict-Only Autonomy Gates

• Status: Accepted
• Date: 2026-07-17

Context

Auto-send already depended on an ordered set of safety checks. A plugin policy must be able to hold a reply without moving a core check, creating a new approval source, or changing an installation that has no plugin gates.

Decision

All core final gates run first in their fixed order. Bundled plugin gates append afterward in generated catalog order. The public result is exactly { outcome: 'no-objection' } or { outcome: 'objection', reason }; there is no approval or send result.

The host reauthorizes immediately before each invocation and supplies only a copied, frozen mail projection plus an abort signal. Missing, disabled, revoked, stale, timed-out, failed, or malformed gates object and route the reply to human review. Plugin text is bounded and scrubbed and never enters audit metadata.

Consequences

Plugins can only narrow autonomy. Core order and dispatch-time reference monitoring remain host-owned, and an empty gate catalog preserves prior behavior. See Capabilities & Trust.