{
  "schema": "ai-03-decision-v1",
  "owner_role": "synthetic-agent-runtime-owner",
  "status": "accepted-for-synthetic-task",
  "selected": "typed evidence with deterministic capability, target, provenance, and approval policy",
  "reasoning": "The task needs facts from contributor-controlled and process-controlled content but authorizes only scoped reads and reporting. Artifact text therefore remains evidence-only, and an action requires trusted task provenance plus an allowed capability and target.",
  "evidence": ["TASK-01", "seven-artifact-run", "unsafe-control", "artifact-action-refusals", "detector-miss-control", "bounded-diagnostic-trace", "mutation-suite"],
  "alternatives": [
    {
      "name": "manual review before context ingestion",
      "disposition": "useful for low-volume high-risk artifacts",
      "limitation": "review can miss hidden or ambiguous instructions and does not constrain later tools"
    },
    {
      "name": "read-only agent without network or mutation",
      "disposition": "strong default for diagnosis",
      "limitation": "still needs data boundaries and output handling but reduces consequences"
    },
    {
      "name": "quarantined reader with structured handoff",
      "disposition": "credible for hostile public content",
      "limitation": "the structured handoff and privileged actor still require validation"
    },
    {
      "name": "prompt-injection detector",
      "disposition": "signal only",
      "limitation": "false negatives and false positives cannot define authority"
    },
    {
      "name": "sandbox, egress controls, and ephemeral credentials",
      "disposition": "required consequence containment for stronger tools",
      "limitation": "containment does not make artifact instructions legitimate"
    }
  ],
  "unresolved": [
    "real model behavior is not evaluated",
    "encoded and multimodal content are outside the executable fixture",
    "the right approval boundary depends on real credentials and consequences"
  ],
  "reversal_conditions": [
    "task authority changes",
    "artifact contributors become more or less trusted",
    "tool capabilities or credentials expand",
    "data classification or allowed egress changes",
    "the consequence boundary moves from read-only diagnosis to mutation"
  ],
  "authority": "The synthetic runtime owner made this bounded decision; no artifact, detector, model, or candidate action authorizes it.",
  "provenance": "synthetic decision; not Brian's agent policy or production control"
}