Guarded review was blocking or prompting on any non-empty hard gap even when the
reviewer had already determined the missing evidence was irrelevant — a file the
command only writes (an output that does not exist yet), a benign parser
misclassification, or a data file that is only read. The reviewer's own reason
would say the action is safe, then defer anyway.
- Reviewer prompt: a hard gap is missing evidence, not proof of danger. After
inspecting, the model judges whether the gap could change the action's effect —
allow when it cannot, block when it could hide a dangerous effect it cannot rule
out, and defer only for genuine ambiguity. It no longer blocks or defers merely
because a gap remains.
- Remove the code override that forced an incomplete-evidence "allow" into a defer
(interactive) or block. The reviewer's verdict now stands, gated by the existing
confidence threshold: an unsure allow still defers to the human.
Headless runs are unchanged — incomplete evidence still fails closed before the
reviewer, preserving the autonomous guarantee. Forced inspection and the
inspection-failure guard remain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
