The CLI’s --apply gate expresses intent to attempt a write. It does not establish that
the requested action is correct, authorized by every business policy, or completed externally.
Direct native accessors write when called; they do not use the CLI flag.
Start with observation
Read production data only with appropriate access. Reads can disclose sensitive information;
preview is not an OS sandbox or a substitute for access control.
Choose deterministic operations
Natural-language commands depend on model interpretation. For scripts use explicit commands
or typed application APIs, retain exact IDs and inspect structured results. Deterministic
syntax does not make a multi-step workflow atomic or give every create idempotency.
stateset-direct has a coarse --apply gate and calls native accessors. It is not the same
strict governed-write endpoint as configured MCP/agent execution. For policy, scoped identity,
optimistic guards and durable governed receipts, use
typed kernel execution.
MCP/agent apply mode loads operator-owned policy, principal and logical store configuration.
Policy is deny by default; delegation, capabilities, scope, versions, approval, signed authority
and budgets apply where required by the command rule. A model’s arguments cannot grant itself
those rights. Strict discovery filters unsupported writes instead of implying they are governed.
--kernel-allow-legacy-writes is an explicit migration escape hatch, not the default authority
model. A policy filename, successful preview, or literal approval string does not prove an
independent reviewer approved the actual operation.
Keep original requests through uncertainty
Retain key, payload, scope, versions and original observations before dispatch. Inspect receipt
status and retry disposition. After a timeout, changing the key can create a second effect.
HTTP retry receipts, governed command receipts and domain-specific native keys have different
contracts; do not transfer one layer’s rules to another.
A shipped status does not consume physical stock; a local capture/refund is not a verified
provider transfer. Check stock fulfillment and
HTTP receipt recovery.
Use a consistent test copy
Do not cp a live SQLite file while WAL writers are active. Create a consistent snapshot via
native maintenance, keep its manifest, restore to a new path, and verify it before testing.
The backup/restore guide covers this.
Native simulations use private episode stores and need no
copy of production data; their result grants no live execution authority. Last modified on October 20, 2026
