Integrate explicit minimized frontier escalation

ALYT uses this shadow escalation path only after its deterministic home paths do not fit the request. The developer-facing workflow is to select one enabled frontier policy for a tenant, property, and reason, confirm that household cloud consent exists, and then let the system send a bounded, metadata-only request to the reviewed provider destination. The path never grants execution authority, never exports full context, and always re-enters current A1 validation before anything can proceed.

Policy selection and required consent

The policy cohort is empty by default. A tenant selects exactly one enabled policy in PHYSICAL_AI_FRONTIER_POLICIES and one home in PHYSICAL_AI_ESCALATION_PROPERTY_IDS. The policy binds the purpose CAPABILITY_GUIDANCE or CLIMATE_COMFORT, revision, destination reference, model revision, reviewed HTTPS origin, pinned addresses, geography OPERATOR_HOSTED or EXTERNAL, provider credential reference, and NO_PROVIDER_STORAGE retention.

A configured policy is only a declaration of intended destination and retention. The actual provider must honor it, and the developer should not infer storage behavior from the policy alone. cloudInferenceOptIn and its latest explicit consent audit receipt are required. SELF hosting, developer credentials, and local operator LAN access do not create household export consent.

What the export contains

The outbound frontier-export contract is narrow. It excludes authority fields and all tenant, property, device, and UUID bindings. It carries the original scoped context reference, the fixed purpose-specific request, the reason and purpose, and at most four facts for at most two entities in one identified room.

Facts may include only relevant opaque entity and control handles and reviewed numerical or boolean control descriptors. Device and room names, raw user goals, model explanations, policies, security or occupancy detail, audio, personal history, saved routines, source identities, and unrelated rooms are excluded. For CLIMATE_COMFORT, the export may include fresh synchronized scalar thermostat temperature or setpoint evidence with reviewed Celsius or Fahrenheit units; missing, stale, or unreviewed data denies export. CAPABILITY_GUIDANCE sends descriptors without readings.

Adapter, bounds, and refusal behavior

The configured adapter reuses ALYT’s provider formatter through the shared bounded pinned-address transport. It calls only the selected /v1/chat/completions destination, sets store:false, and does not allow redirect, rebinding, retry, or fallback. It carries only the selected household provider credential.

The live limits are narrow: one active escalation, two admissions per minute per gateway, one provider request, five seconds, 8192 export/request bytes, 16384 response bytes, 4096 input-token reservation, and 1024 output tokens. Actual usage must fit those bounds. FAKE is the default adapter; it proposes NO_ACTION, has no network effects, and reports UNKNOWN frontier geography. Unknown adapter modes are refused on this entry and do not block existing voice/chat startup.

Rechecks, cancellations, and audit

Consent event, selected cohort, policy/body destination, credential, and runner binding are rechecked before sending and again after returning. A cancellation or superseding turn aborts the owned call. Responses cannot recursively escalate or select a routine or unexported effect or evidence reference. Returned intent must match the supplied context and re-enter current A1 validation; only the separate governed A2 programme can authorize execution.

AuditLog stores admission, completion, and refusal metadata only: purpose and reason, selected revision and destination, export digest and bytes, consent receipt reference, latency and usage, and status. It never stores prompt text, audio, goals, names, free text, or secrets. Frontier metrics stay bounded to counters and duration samples without household labels. Rollback withdraws the escalation cohort, cancels owned calls, and leaves local control and approved legacy inference intact.