ORA-2026-0137 - LLM-At-Joint Required At Human Emission Boundaries

ORA-2026-0137 - LLM-At-Joint Required At Human Emission Boundaries

Rule

Static validators, regexes, schemas, deny-lists, and deterministic scripts may fast-fail a malformed candidate before it enters the fleet or product pipeline. They must not be the final authority for any output that reaches a human user.

Any pipeline output that will be shown to Zack, Shayelyn, Anthony, Chad as HCB operator, a client, or another human decision-maker must pass through an LLM-at-joint judgment step after static checks and before emission.

The LLM judge emits exactly one of:

SHIP_AS_IS
SHIP_WITH_CAVEAT
WITHHOLD_AND_NAME_THE_GAP
ESCALATE_TO_HUMAN

Boundary Test

Ask this at the write site:

Could a human reasonably act on this output without opening the source packet?

If yes, it is a human emission boundary. The final judgment cannot be regex.

Human emission boundaries include:

• Buildertrend selections, todos, daily logs, comments, files, photos, and

other fields HCB or clients open to coordinate work.

• Monday Brief, client emails, owner-facing PDFs, Slack summaries, and any

outbound text that becomes operational guidance.

• Redline, Dollhouse, dashboards, and portal views where a human reads the

rendered state as truth.

• Any automation that mutates a human-opened surface, even when the mutation is

performed through a safe adapter or rehearsal path first.

Internal fast-fail boundaries include:

• feed-append rejecting an actionable post missing ITEM, LANE, STATE,

OWNER, QUEUE, WAKE, WORK, or other machine-readable headers.

• JSON schema, TypeScript type, migration, smoke, and CLI checks that reject

malformed rows, missing fields, invalid enum values, or unsafe argument shapes before code or data moves forward.

• Static guards that stop obviously forbidden classes, such as direct

db.*.supabase.co psql strings, missing source URLs, or a known closed-job identifier.

The difference is authority. Fast-fail says, "this cannot be emitted." It does not say, "everything that passed is faithful enough for a human."

LLM-At-Joint Packet

The judge must receive enough context to decide whether the candidate helps or hurts world-model fidelity at the named surface:

• Candidate output: the exact text, row, field set, update payload, or rendered

summary proposed for emission.

• Source packet: source rows, screenshots, documents, URLs, transcript spans,

timestamps, actor identity, and known caveats.

• Surface and persona: the app/page/object the human opens and the named user

who will act on it.

• Emission consequence: what the human may believe, decide, buy, schedule, or

correct if this ships.

• Known stoplines: live product, auth, deploy, credential, financial,

client-visible, and collision boundaries.

• Static check results: which validators passed, which failed, and what they

prove or do not prove.

The output must preserve the evidence altitude. If the candidate is useful but uncertain, ship the caveat with the surface. If the gap matters more than the candidate, withhold and name it. If the action crosses authority or consequence boundaries, escalate.

Buildertrend Example

A closed-job regex guard is valid as a fast-fail pre-filter:

Candidate targets Buildertrend job 42217100 and static closed-job guard says
that job is closed.

Outcome: reject before emission.

The same guard is not valid as a final publication rule:

Candidate targets an active Buildertrend selections page and all static fields
are present.

Invalid conclusion: SHIP_AS_IS because regex passed.
Valid next step: send the candidate, source packet, selected job/page, caveats,
and static-check results to the LLM-at-joint judge.

For Buildertrend, the LLM judge asks whether the candidate truth is source backed, whether the BT page is the right user-opened surface, whether the row would mislead Zack or Shayelyn, whether the caveat should be visible, and whether a human authority boundary has been crossed.

Internal Feed Example

feed-append may deterministically reject a malformed actionable post:

STATE: IN_PROGRESS
OWNER: CODEX-DESKTOP-MacBook-Air-CAMBER-a1b2

Missing: ITEM, LANE, QUEUE, WAKE, WORK.

That rejection is a fast-fail validator. It protects the operational queue before the row becomes a shared coordination fact. No LLM judge is needed for the rejection itself because the validator is checking a structural contract, not deciding whether a human-facing construction claim is true enough to ship.

If the same feed post becomes a fleet directive that authorizes live product mutation, deploy ownership, credential handling, or client-visible action, it crosses a human/operator emission boundary and needs LLM-at-joint judgment.

Anti-Patterns

• Expanding regexes under pressure until they become a silent policy engine.
• Calling a pre-filter a "guard" and then treating pass as publish authority.
• Treating six of seven checklist fields as "close enough" when the missing

field is the one that names the user-visible caveat.

• Shipping silence when the correct output is WITHHOLD_AND_NAME_THE_GAP.
• Using agent convergence as a substitute for source evidence, surface proof,

or named human authority.

• Letting a product adapter decide truth because it can decide shape.

Implementation Requirements

For any new or amended pipeline emission that reaches a human-opened surface:

1. Run static checks first and preserve their result as evidence, not authority. 2. Build an LLM-at-joint packet with candidate, source packet, surface, persona, consequence, stoplines, and static-check results. 3. Require one of the four canonical outcomes. 4. Store the outcome, rationale, caveat, source references, and emitted payload together so later corrections can replay the decision. 5. Prefer SHIP_WITH_CAVEAT or WITHHOLD_AND_NAME_THE_GAP over clean output when source altitude is partial. 6. Escalate instead of emitting when the judge detects identity, liability, financial, auth, deploy, or live-client authority boundaries.

For internal validators:

1. Keep them narrow and deterministic. 2. Name the contract they check. 3. Name the class of false positives or false negatives they intentionally do not adjudicate. 4. Prevent "passed static check" from becoming a downstream synonym for "safe for human."

Disconfirming Observation

If an LLM-at-joint step repeatedly returns the same deterministic rejection for a structural problem, move that structural problem into a fast-fail validator and keep the LLM for the remaining judgment boundary.

If a static validator can prove only that a candidate is malformed or forbidden, but operators keep reading pass as publish authority, the surface is missing a separate emission judge. Add the LLM-at-joint step before extending the regex.

Review Cadence

• Next review: 2026-06-04
• Review trigger: first live Buildertrend, Redline, Dollhouse, Monday Brief,

or client-visible output that ships solely because a static check passed.