pattern-catalog.json

{
  "$schema": "../schemas/pattern-catalog.schema.json",
  "schema_version": "1.0.0",
  "patterns": [
    {
      "id": "PAT-001",
      "kind": "pattern",
      "title": "Verifier-first workflow",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent produces a decision, artifact, or external effect"],
      "implementation": ["define the accepted business outcome and postcondition before model or tool selection", "route unverifiable outcomes to human ownership"],
      "control_ids": ["ARC-001", "REL-003", "EVA-001"],
      "failure_signals": ["agent reports success while source-of-truth state is unchanged"],
      "verification": ["known-bad output fails the verifier", "source-of-truth readback proves accepted outcomes"],
      "evidence": ["R26-07", "R26-20", "R26-22"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-002",
      "kind": "pattern",
      "title": "Progressive capability discovery",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["the available tool or endpoint catalog exceeds the task-scoped context budget"],
      "implementation": ["expose search, describe, and execute primitives", "load only selected schemas and documentation"],
      "control_ids": ["TOL-001", "TOL-002"],
      "failure_signals": ["tool selection accuracy falls as catalog size increases", "tool definitions dominate context cost"],
      "verification": ["measure selection accuracy and token cost across catalog-size curves"],
      "evidence": ["R26-02", "R26-23"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-003",
      "kind": "pattern",
      "title": "Tainted external context",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["the agent reads documents, web content, telemetry, tickets, code, or tool output"],
      "implementation": ["preserve source and trust labels", "prevent content from granting authority or changing control instructions"],
      "control_ids": ["CTX-002", "SEC-002", "IAM-003"],
      "failure_signals": ["retrieved text redirects tools, egress, credentials, or policy"],
      "verification": ["indirect-injection cases produce no unauthorized action or egress"],
      "evidence": ["R26-09", "R26-18"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-004",
      "kind": "pattern",
      "title": "Staged transactional write",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent proposes a financial, legal, deployment, message, or record mutation"],
      "implementation": ["separate propose, validate, authorize, stage, approve, commit, and readback", "bind approval to an immutable proposal digest"],
      "control_ids": ["TOL-003", "IAM-003", "REL-001", "REL-003", "STA-002", "HUM-001"],
      "failure_signals": ["model output reaches a commit API directly", "approval does not bind the exact effect"],
      "verification": ["digest mismatch and expired approval are denied", "commit timeout and retry produce one effect"],
      "evidence": ["R26-03", "R26-26", "R26-60"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-005",
      "kind": "pattern",
      "title": "Actor-bound agent identity",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent or delegated worker invokes protected tools"],
      "implementation": ["bind interactive work to the current user with agent attribution and use a dedicated narrow workload identity for unattended work", "intersect capability with current actor, agent, tenant, resource, and policy authorization at each action"],
      "control_ids": ["IAM-001", "IAM-002", "IAM-003", "SEC-005"],
      "failure_signals": ["agent inherits broad service-account authority", "delegated worker exceeds parent authority"],
      "verification": ["read-only and cross-tenant callers are denied deterministically"],
      "evidence": ["R26-11", "R26-15", "R26-32", "R26-57"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-006",
      "kind": "pattern",
      "title": "Replayable world evaluation",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["live state changes or external effects make runs non-comparable"],
      "implementation": ["capture sanitized immutable world revisions", "reset state and evaluate full trajectory plus final effect"],
      "control_ids": ["EVA-001", "EVA-002", "STA-001"],
      "failure_signals": ["identical candidate runs see different world state", "final-answer score hides invalid actions"],
      "verification": ["baseline and candidate execute against the same fixture revision"],
      "evidence": ["R26-07", "R26-24"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-007",
      "kind": "pattern",
      "title": "Validated state commit",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["agent output becomes memory, cache, durable state, or a shared conclusion"],
      "implementation": ["validate and authorize before persistence", "store provenance, trust, revision, retention, and invalidation metadata"],
      "control_ids": ["CTX-004", "STA-001", "STA-002", "STA-003"],
      "failure_signals": ["unreviewed or poisoned output compounds across future runs"],
      "verification": ["invalid or unauthorized output cannot enter durable state"],
      "evidence": ["R26-06", "R26-28"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-008",
      "kind": "pattern",
      "title": "Concurrency as a protocol",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["work is delegated, parallelized, raced, or merged"],
      "implementation": ["bound fan-out and partition budgets", "define cancellation, idempotency, capacity, merge, conflict, and partial-failure behavior"],
      "control_ids": ["ARC-003", "REL-001", "REL-004", "CST-002"],
      "failure_signals": ["late workers commit after cancellation", "parallel workers duplicate effects or exceed aggregate budget"],
      "verification": ["cancellation, duplicate delivery, required-worker failure, and conflicting results have deterministic outcomes"],
      "evidence": ["R26-10", "R26-29", "R26-31"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-009",
      "kind": "pattern",
      "title": "Cost per accepted outcome",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a workflow uses models, tools, retries, compute, wait queues, or human review"],
      "implementation": ["attribute full-system cost to accepted work", "enforce per-run and per-outcome budgets"],
      "control_ids": ["CST-001", "CST-002", "OPS-004"],
      "failure_signals": ["token cost falls while retries or review load rise", "runaway loops consume budget without accepted outcomes"],
      "verification": ["cost reports reconcile model, tool, compute, retry, wait, and reviewer components"],
      "evidence": ["R26-21", "R26-22"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-010",
      "kind": "pattern",
      "title": "Behavior-segment operations",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["global metrics combine materially different workflows or tool trajectories"],
      "implementation": ["cluster runs by intent and trajectory", "monitor success, escalation, latency, cost, and risk per cluster"],
      "control_ids": ["EVA-003", "EVA-004", "OPS-001", "OPS-004"],
      "failure_signals": ["new workflow cluster fails despite acceptable global score"],
      "verification": ["degraded clusters become owned replay cases"],
      "evidence": ["R26-17", "R26-20"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-011",
      "kind": "pattern",
      "title": "Outcome-backward thin slice",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a customer workflow is being selected for an agent or automation engagement"],
      "implementation": ["start from a named decision, measurable outcome, accountable owner, and independent verifier", "deliver the narrowest end-to-end slice that can establish a baseline and change one real workflow"],
      "control_ids": ["FDE-001", "FDE-003", "VAL-001", "ARC-001"],
      "failure_signals": ["the engagement is framed around a model, integration, or demo without a decision owner and baseline"],
      "verification": ["the workflow charter names the actor, decision, inputs, action, outcome metric, baseline, verifier, and risk ceiling"],
      "evidence": ["R26-37", "R26-39", "R26-41"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-012",
      "kind": "pattern",
      "title": "Decision-centric operational model",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["an agent must combine enterprise data, policy, decisions, and actions across systems"],
      "implementation": ["model business objects, relationships, lifecycle states, actions, permissions, and sources of truth", "use the model to govern both retrieval and operational writeback"],
      "control_ids": ["ARC-002", "CTX-001", "TOL-003", "REL-005"],
      "failure_signals": ["the agent can retrieve data but cannot explain current state, valid transitions, or the system that owns each fact"],
      "verification": ["every consequential decision and action resolves to a governed object, state transition, authority, and source-of-truth check"],
      "evidence": ["R26-42", "R26-43"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-013",
      "kind": "pattern",
      "title": "Customer-owned production handoff",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an embedded delivery team introduces a workflow that a customer team must operate"],
      "implementation": ["name the service owner, business owner, support path, training plan, operating cadence, and exit criteria before production", "transfer runbooks, evaluation ownership, cost visibility, and rollback authority through observed practice"],
      "control_ids": ["ADP-002", "OPS-003", "OPS-006"],
      "failure_signals": ["the workflow depends indefinitely on the original FDE team or has no accountable production owner"],
      "verification": ["the receiving team can operate, diagnose, pause, roll back, and review the workflow without the delivery team"],
      "evidence": ["R26-37", "R26-45"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-014",
      "kind": "pattern",
      "title": "Compatible solution release",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a change spans domain objects, permissions, tools, prompts, models, policies, and user surfaces"],
      "implementation": ["version the solution bundle and test cross-artifact compatibility in an isolated branch or environment", "separate merge approval from progressive environment rollout and keep a tested rollback path"],
      "control_ids": ["DEL-001", "DEL-002", "OPS-007"],
      "failure_signals": ["individually valid changes produce an incompatible production bundle or a global behavior regression"],
      "verification": ["the release manifest identifies every behavioral dependency and its canary, rollback, and compatibility evidence"],
      "evidence": ["R26-44", "R26-51"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-015",
      "kind": "pattern",
      "title": "Evaluation claim manifest",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["an evaluation result is used to compare candidates or authorize release"],
      "implementation": ["record the claim, environment, world revision, model and harness versions, evaluator, trial count, aggregation rule, and contamination controls", "separate capability estimates from regression gates and report uncertainty"],
      "control_ids": ["EVA-001", "EVA-002", "EVA-006"],
      "failure_signals": ["a single score is reported without enough context to reproduce or interpret it"],
      "verification": ["another reviewer can recreate the evaluation conditions and distinguish the measured claim from untested generalizations"],
      "evidence": ["R26-47", "R26-52", "R26-53"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-016",
      "kind": "pattern",
      "title": "Production signal to controlled change",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["production traces or feedback are used to improve agent behavior"],
      "implementation": ["turn a production signal into a sanitized replay case, diagnosis, candidate change, isolated evaluation, human-reviewed merge, canary, and rollback decision", "keep evaluator, CI, approval, and merge authority outside the improving agent"],
      "control_ids": ["EVA-004", "EVA-005", "OPS-007"],
      "failure_signals": ["an agent can alter the evidence or gate that judges its own change"],
      "verification": ["every production-derived change links the originating signal to an immutable regression and independent release decision"],
      "evidence": ["R26-24", "R26-54"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-017",
      "kind": "pattern",
      "title": "Digest-bound capability admission",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent runtime loads a tool, MCP server, skill, CLI, or code package"],
      "implementation": ["admit an exact signed build through a trusted registry with publisher, provenance, SBOM, interface, authority, assurance, lifecycle, and disable evidence", "intersect manifest authority with agent, caller, tenant, handoff, and deployment policy at invocation"],
      "control_ids": ["TOL-006", "SEC-007"],
      "failure_signals": ["a capability name or version resolves to an unverified build or broader authority"],
      "verification": ["spoofed publisher, changed digest, expired registry decision, excessive authority, and validation outage all fail closed"],
      "evidence": ["R26-13", "R26-18", "R26-36", "R26-58", "R26-59"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-018",
      "kind": "pattern",
      "title": "Authority-attenuating typed handoff",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["work crosses an agent, worker, model, or context-reset boundary"],
      "implementation": ["pass objective, verified state, provenance, unresolved work, expiring authority, remaining budget, and terminal reason in a closed signed envelope", "require delegated actions, scopes, effects, actor mode, depth, and budget to remain within the parent ceiling"],
      "control_ids": ["CTX-005", "IAM-002", "REL-002"],
      "failure_signals": ["a free-form summary invents state, drops provenance, expands permission, or resets a budget"],
      "verification": ["overscope, stale, replayed, unsigned, over-depth, and tainted-content handoffs are rejected before execution"],
      "evidence": ["R26-48", "R26-54", "R26-56"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-019",
      "kind": "pattern",
      "title": "Validated operational knowledge extraction",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["a delivery or internal applied-AI team is turning observed work into rules, context, evaluations, or reusable product capability"],
      "implementation": ["classify each observed item as governed evidence, deterministic rule, professional judgment, workaround, exception, or untrusted content", "require accountable owner validation, provenance, scope, and an explicit preserve, repair, remove, escalate, or abstract disposition", "keep customer-specific context with its owner and promote only sanitized, recurrence-tested patterns through normal release gates"],
      "control_ids": ["FDE-002", "FDE-004", "CTX-001", "CTX-002"],
      "failure_signals": ["recordings or interviews become unreviewed prompts or policy", "a local workaround is generalized into a product feature", "customer data or policy appears in a shared pattern"],
      "verification": ["representative knowledge candidates have an owner, classification, source, scope, and disposition", "a reusable candidate has sanitized recurrence evidence and an approved destination", "unvalidated or confidential material cannot enter shared rules, patterns, or evaluation fixtures"],
      "evidence": ["R26-37", "R26-39", "R26-41", "R26-45", "R26-56"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-001",
      "kind": "anti_pattern",
      "title": "Flat all-tools catalog",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["all organizational tools are loaded into every run"],
      "implementation": ["replace with task-scoped bundles and progressive capability discovery"],
      "control_ids": ["TOL-001", "TOL-002"],
      "failure_signals": ["selection ambiguity, context bloat, and excess attack surface"],
      "verification": ["compare selection accuracy and cost against scoped bundles"],
      "evidence": ["R26-02"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-002",
      "kind": "anti_pattern",
      "title": "Prompt-only security policy",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["authorization or data-loss prevention depends on model instruction compliance"],
      "implementation": ["replace with identity, authorization, sandbox, egress, secrets, and effect controls below the model"],
      "control_ids": ["IAM-003", "SEC-001", "SEC-002", "SEC-003"],
      "failure_signals": ["untrusted content changes privileged behavior"],
      "verification": ["adversarial content cannot exceed deterministic runtime controls"],
      "evidence": ["R26-03", "R26-09", "R26-18"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-003",
      "kind": "anti_pattern",
      "title": "Agent-reported completion",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a natural-language statement or tool response is treated as proof of business completion"],
      "implementation": ["replace with deterministic postcondition readback and an effect receipt"],
      "control_ids": ["TOL-004", "REL-003", "OPS-001"],
      "failure_signals": ["agent reports success while target state is absent or incorrect"],
      "verification": ["known false-positive completion fails source-of-truth readback"],
      "evidence": ["R26-07", "R26-20"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-004",
      "kind": "anti_pattern",
      "title": "Unreviewed memory write",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["model output is persisted automatically for future runs"],
      "implementation": ["replace with validation, authorization, provenance, retention, and invalidation gates"],
      "control_ids": ["CTX-004", "STA-002", "STA-003"],
      "failure_signals": ["incorrect or malicious state propagates across users and runs"],
      "verification": ["poisoned output cannot become shared state"],
      "evidence": ["R26-06", "R26-28"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-005",
      "kind": "anti_pattern",
      "title": "Multi-agent by default",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["multiple agents share the same context, tools, permissions, and sequential workflow"],
      "implementation": ["replace with one bounded agent or deterministic workflow unless an admission criterion is met", "admit a topology only when repeated, matched-budget evaluation on representative work beats the simpler control without unresolved authority or merge ambiguity"],
      "control_ids": ["ARC-001", "ARC-003", "ARC-004", "REL-004"],
      "failure_signals": ["coordination cost, duplicated work, unresolved conflicts, cancellation leaks, or regression against the simpler baseline"],
      "verification": ["deterministic or coded-workflow and single-agent baselines are measured before decomposition and retained as controls after behavior or topology changes"],
      "evidence": ["R26-10", "R26-29", "R26-31", "R26-75"],
      "reviewed_at": "2026-08-14",
      "review_due": "2027-02-14"
    },
    {
      "id": "ANTI-006",
      "kind": "anti_pattern",
      "title": "Final-answer-only evaluation",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["release decisions use only a text score or benchmark pass rate"],
      "implementation": ["replace with contract, component, trajectory, effect, safety, and budget evaluations"],
      "control_ids": ["EVA-001", "EVA-002", "EVA-003"],
      "failure_signals": ["high score coexists with invalid tools, unauthorized effects, or zero completed work"],
      "verification": ["known reward-hacking implementation fails evaluator-integrity controls"],
      "evidence": ["R26-01", "R26-25", "R26-36"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-007",
      "kind": "anti_pattern",
      "title": "Shared broad service credential",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["agents invoke tools using a shared credential broader than the caller and task"],
      "implementation": ["replace with agent identity, caller attenuation, short-lived credentials, and per-tool scopes"],
      "control_ids": ["IAM-001", "IAM-002", "SEC-001", "SEC-005"],
      "failure_signals": ["agent accesses another tenant or action outside caller authority"],
      "verification": ["cross-tenant, expired, and over-broad requests are denied"],
      "evidence": ["R26-08", "R26-11", "R26-32"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-008",
      "kind": "anti_pattern",
      "title": "Live mutable evaluation world",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["baseline and candidate agents rerun against drifting live systems"],
      "implementation": ["replace with immutable replay worlds and versioned fixtures"],
      "control_ids": ["EVA-001", "EVA-002", "STA-001"],
      "failure_signals": ["score changes cannot be attributed to the candidate"],
      "verification": ["baseline and candidate share identical world and evaluator revisions"],
      "evidence": ["R26-07", "R26-24"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-009",
      "kind": "anti_pattern",
      "title": "Demo without a baseline",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a prototype is judged by perceived capability rather than a measured workflow outcome"],
      "implementation": ["return to field observation, baseline the current process, and define an accepted outcome before extending the prototype"],
      "control_ids": ["FDE-003", "VAL-001", "VAL-002"],
      "failure_signals": ["stakeholders like the demo but cannot say what decision, cost, risk, or cycle time should improve"],
      "verification": ["the next pilot decision uses a predeclared baseline, target, guardrails, and accountable owner"],
      "evidence": ["R26-37", "R26-39", "R26-41"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-010",
      "kind": "anti_pattern",
      "title": "Permanent FDE ownership",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["the embedded delivery team remains the only team able to operate or change the production workflow"],
      "implementation": ["define customer ownership and self-sufficiency milestones, then transfer runbooks, evaluation, support, cost, and change authority"],
      "control_ids": ["ADP-002", "OPS-003", "OPS-006"],
      "failure_signals": ["production incidents or routine changes wait for the original delivery team"],
      "verification": ["the named customer owner completes an observed operating and recovery exercise before handoff"],
      "evidence": ["R26-37", "R26-45"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-011",
      "kind": "anti_pattern",
      "title": "Chat or dashboard without operational action",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["a professional workflow ends at an answer or dashboard while the real decision and action remain disconnected"],
      "implementation": ["design the governed decision, review artifact, authorized action, writeback, and feedback path as one workflow"],
      "control_ids": ["ADP-001", "HUM-001", "REL-005"],
      "failure_signals": ["users manually copy results into another system or abandon the output because it cannot be reviewed in context"],
      "verification": ["the intended user can inspect evidence, decide, act, and confirm the outcome through a governed workspace"],
      "evidence": ["R26-43", "R26-54"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-012",
      "kind": "anti_pattern",
      "title": "Destination-only egress allowlist",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["network policy trusts a destination without binding the operation, identity, data class, and credential"],
      "implementation": ["enforce capability-aware egress through a trusted gateway with operation-bound identity, request validation, redirect controls, and response limits"],
      "control_ids": ["SEC-002", "SEC-006"],
      "failure_signals": ["package proxies, redirects, public credentials, or reachable external accounts expand capability beyond the intended task"],
      "verification": ["unauthorized operation, identity, redirect, credential, and data-class combinations are denied even when the destination is otherwise allowed"],
      "evidence": ["R26-36", "R26-49"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-013",
      "kind": "anti_pattern",
      "title": "Single-trial score without an evaluation manifest",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a stochastic agent result is treated as a stable release claim"],
      "implementation": ["record the evaluation environment and run repeated isolated trials with an aggregation rule matched to the claim"],
      "control_ids": ["EVA-006"],
      "failure_signals": ["the same candidate changes rank across reruns or succeeds through benchmark contamination"],
      "verification": ["reported results include trial count, variance or interval, environment revisions, aggregation semantics, and contamination checks"],
      "evidence": ["R26-47", "R26-52", "R26-53"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-014",
      "kind": "anti_pattern",
      "title": "Global behavioral rollout",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a model, prompt, tool, policy, or harness change can alter production behavior"],
      "implementation": ["replace an all-at-once release with versioned compatibility tests, segment canaries, soak criteria, kill switches, and rollback"],
      "control_ids": ["DEL-001", "DEL-002", "OPS-007"],
      "failure_signals": ["a cross-layer behavior change reaches every tenant or workflow before its effects are observable"],
      "verification": ["the release proves segment-level canary health and automatic rollback behavior before wider promotion"],
      "evidence": ["R26-51"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-015",
      "kind": "anti_pattern",
      "title": "Self-review presented as independent proof",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent or closely coupled reviewer judges its own proposal or improvement"],
      "implementation": ["treat self-review as a useful signal and require an isolated evaluator, deterministic invariant, or accountable human for release evidence"],
      "control_ids": ["EVA-002", "EVA-005"],
      "failure_signals": ["the same context, assumptions, or authority can create and approve a change"],
      "verification": ["release evidence remains valid when the proposing agent cannot modify or observe the hidden evaluator and holdout set"],
      "evidence": ["R26-25", "R26-54"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-016",
      "kind": "anti_pattern",
      "title": "Name-based capability trust",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a capability is enabled because its package, server, tool, or skill name appears approved"],
      "implementation": ["replace name trust with signed digest-bound registry admission and runtime authority intersection"],
      "control_ids": ["TOL-006", "SEC-007"],
      "failure_signals": ["publisher spoofing, dependency substitution, mutable tags, or reused versions change executable authority"],
      "verification": ["the disabled or changed artifact digest is denied even when its name and semantic version are unchanged"],
      "evidence": ["R26-13", "R26-18", "R26-36", "R26-58", "R26-59"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "ANTI-017",
      "kind": "anti_pattern",
      "title": "Free-form delegation envelope",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["an agent or worker receives only a narrative summary of prior work"],
      "implementation": ["replace with a closed, signed, expiring, single-use handoff that separates verified state from untrusted payloads and attenuates authority and budget"],
      "control_ids": ["CTX-002", "CTX-005", "IAM-002", "REL-002"],
      "failure_signals": ["delegated work loses source revisions, invents completion, expands scope, or starts with a fresh budget"],
      "verification": ["invalid provenance, instruction-bearing data, scope escalation, replay, expiry, and depth overflow fail before the recipient runs"],
      "evidence": ["R26-48", "R26-54", "R26-56"],
      "reviewed_at": "2026-08-07",
      "review_due": "2027-02-07"
    },
    {
      "id": "PAT-020",
      "kind": "pattern",
      "title": "Versioned evidence map and change-impact review",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["a system has enough cross-team software and operational dependencies that delivery, incident, or release review repeatedly misses impact"],
      "implementation": ["maintain separately scoped software and operational maps with source revision, owner, classification, extraction basis, confidence, and freshness", "use a named impact assessment to route confirmed and inferred impacts to owners, validation, rollout, and rollback evidence"],
      "control_ids": ["CTX-001", "CTX-002", "CTX-004", "DEL-001", "OPS-007"],
      "failure_signals": ["material changes omit a dependent workflow, policy, evaluation, runbook, or user surface", "a stale or inferred map link is treated as authorization or completion evidence"],
      "verification": ["source revisions and stale-map behavior are visible", "material changes have complete impact coverage and technical, operational, and risk review", "map output cannot authorize an effect or prove completion"],
      "evidence": ["R26-65", "R26-66", "R26-67", "R26-68", "R26-69"],
      "reviewed_at": "2026-08-08",
      "review_due": "2027-02-08"
    },
    {
      "id": "ANTI-018",
      "kind": "anti_pattern",
      "title": "Inferred map as authority",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a generated dependency or knowledge graph is used to decide access, effects, policy, completion, or release approval"],
      "implementation": ["treat graph output as derived navigation context", "require source-of-truth policy, tool-boundary authorization, evaluation, approval, and readback for consequential decisions"],
      "control_ids": ["ARC-002", "CTX-001", "CTX-002", "OPS-007"],
      "failure_signals": ["an inferred edge grants a capability or suppresses a required review", "a graph outage changes authorization or completion behavior"],
      "verification": ["generated map output cannot invoke, authorize, or complete an external effect", "unsupported relationships remain labelled inferred and require owner confirmation"],
      "evidence": ["R26-65", "R26-67", "R26-68", "R26-69"],
      "reviewed_at": "2026-08-08",
      "review_due": "2027-02-08"
    },
    {
      "id": "PAT-021",
      "kind": "pattern",
      "title": "Owned field contribution path",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["a delivery team discovers a customer-specific need or a recurring product or platform gap"],
      "implementation": ["classify the contribution before implementation as configuration, target-owned extension, shared product or platform capability, time-bounded experiment, or prohibited or deferred work", "bind the destination's contribution rights, repository or runtime, owner, engineering and release path, support obligation, reuse rights, and migration or retirement evidence"],
      "control_ids": ["FDE-004", "DEL-001", "ADP-002", "OPS-003"],
      "failure_signals": ["field-built production code has no accepted target, product, platform, service, or retirement owner", "the same custom service recurs outside the normal product engineering and operating path"],
      "verification": ["every field-built production asset has one approved destination and owner before release", "shared product changes pass the destination team's normal architecture, security, evaluation, release, telemetry, support, and lifecycle gates", "the receiving team completes a representative change and recovery exercise without delivery-team intervention"],
      "evidence": ["R26-70", "R26-71", "R26-72"],
      "reviewed_at": "2026-08-10",
      "review_due": "2027-02-10"
    },
    {
      "id": "ANTI-019",
      "kind": "anti_pattern",
      "title": "Field-owned shadow product",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["a delivery team operates customer-specific production code outside the destination organization's normal architecture, security, release, telemetry, support, or lifecycle ownership"],
      "implementation": ["route the capability to an approved target-owned or shared-product destination", "give any temporary parallel asset a production ceiling, owner, expiry, migration or destruction plan, and blocking release gate"],
      "control_ids": ["FDE-004", "DEL-001", "ADP-002", "OPS-003"],
      "failure_signals": ["the field team is the only on-call or change authority", "production assets lack an SLA, release path, security owner, or retirement date", "repeated customer gaps create separate stacks instead of a product or platform decision"],
      "verification": ["parallel production assets are zero or have approved time-bounded exceptions", "each exception has exercised migration or retirement evidence before delivery-team exit"],
      "evidence": ["R26-70", "R26-71"],
      "reviewed_at": "2026-08-10",
      "review_due": "2027-02-10"
    },
    {
      "id": "PAT-022",
      "kind": "pattern",
      "title": "API-first bounded computer-use fallback",
      "status": "accepted",
      "maturity": "field_tested",
      "applies_when": ["an approved workflow must use a browser, desktop client, or visual interface because no adequate governed API exists"],
      "implementation": ["record the missing API and migration trigger, then bind the computer-use session to one actor mode, tenant, target account, resource, operation, destination policy, and effect ceiling", "separate observe, prepare, stage, commit, and independent readback while treating page content and visual state as untrusted data"],
      "control_ids": ["ARC-004", "CTX-002", "TOL-003", "IAM-003", "SEC-001", "SEC-006", "REL-001", "REL-003"],
      "failure_signals": ["a broad authenticated browser session can navigate or act outside the approved business operation", "interface drift or page instructions change authority, credentials, destination, or effect"],
      "verification": ["prompt injection, wrong tenant, session revocation, layout drift, redirect escape, duplicate submission, and timeout-after-effect fail safely", "every consequential result is reconciled through an independent target-system read path"],
      "evidence": ["R26-49", "R26-73", "R26-74"],
      "reviewed_at": "2026-08-11",
      "review_due": "2027-02-11"
    },
    {
      "id": "ANTI-020",
      "kind": "anti_pattern",
      "title": "Visual success as completion proof",
      "status": "accepted",
      "maturity": "normative",
      "applies_when": ["a browser or computer-use workflow treats a confirmation banner, screenshot, recording, changed page, or successful click as the final business result"],
      "implementation": ["keep visual evidence as classified debugging context", "derive completion only from a service receipt and source-of-truth readback against the declared business postcondition"],
      "control_ids": ["TOL-004", "REL-003", "REL-005", "EVA-001"],
      "failure_signals": ["the agent reports success while authoritative state is absent, stale, duplicated, or different", "a screenshot or recording is used as authorization, evaluation truth, or effect receipt"],
      "verification": ["misleading success messages and timeout-after-click cases remain effect-unknown until reconciliation", "readback mismatch prevents completion and triggers owned recovery"],
      "evidence": ["R26-20", "R26-73", "R26-74"],
      "reviewed_at": "2026-08-11",
      "review_due": "2027-02-11"
    }
  ]
}