SIO23 · Shadow Mode Quickstart

Observe the request.
Do not connect the consequence.

Turn your Refused Workflow Challenge into a digest-bound observation setup. Shadow mode can mirror minimized facts and later compute what ActionGate would have done. It cannot issue a permit or write to the system being observed.

WRITE SCOPES · 0PERMITS · PROHIBITEDEXECUTION · PROHIBITED

CHALLENGELOOKING FOR SESSION MANIFEST

SETUP STATECHALLENGE_REQUIRED

CUSTOMER CONNECTIONNOT ESTABLISHED

01 / Observation path

Start with the least connected option.

stablemind.shadow-mode-quickstart.v1

Local replay exportSafest default · no customer-system connectionSigned event mirrorCustomer pushes a minimized signed copy · ingress onlyRead-only API pullGET / list scopes only · customer-controlled credential boundaryQueue fan-out mirrorDedicated consumer on a customer-created mirror subscriptionSigned file dropCustomer exports minimized signed events to a read-only location

02 / Minimum observation envelope

Mirror facts, not secrets.

7 required fields

NEVER MIRROR

Passwords · private keys · access tokens · refresh tokens · raw execution credentials · full request bodies · unrelated customer data.

03 / Counterfactual output

What shadow mode is allowed to say.

WOULD_PERMIT

Observed facts appear within the supplied authority boundary.

WOULD_NARROW

The request exceeds a supplied scope or magnitude and would need contraction.

WOULD_REQUIRE_HUMAN_AUTHORITY

A target change, approval boundary, or unresolved duty would stop automation.

WOULD_DENY

The mirrored authority state would fail closed.

AUTHORITY_UNRESOLVED

The observation lacks enough attributable authority evidence to classify safely.

Shadow Setup Manifest

Read-only by construction.

shadow_—

READINESSCHALLENGE_REQUIRED

Return to the Refused Workflow Challenge and complete the seven required definition classes.

Workflow: —
Action: —
Target: —
Path: LOCAL_REPLAY_EXPORT
Direction: READ_ONLY
Write scopes: 0
StableMind persistence: NONE IN SIO23

SHADOW AUTHORITY DIFF

Requested power comes from the mirrored semantic request. Allowed power remains counterfactual until attributable authority evidence is supplied. A shadow classification never becomes a permit.

MACHINE AUTHORITYNONE

ACTIONGATECOUNTERFACTUAL ONLY

ACTION PERMITPROHIBITED

CREDENTIALPROHIBITED

CONSEQUENCE CAPITALNO MUTATION

EXECUTIONPROHIBITED

EXTERNAL PROOFNOT CREATED

REALIZED VALUENOT CLAIMED

SETUP BLOCKER

Challenge Manifest not found in this browser session.

One-Command Bootstrap · SIO24

SIO24 owns runtime bootstrap. SIO23 does not establish a customer connection.

Read-only means no return path.

Connected transports are ingress-only or GET/list-only. The setup declares zero customer-system write scopes.

Counterfactual means no permit.

Shadow mode can say what ActionGate would have done under mirrored facts. It cannot issue a consumable Action Permit.

Opportunity is not realized value.

Time saved, risk reduced, or automation candidates remain hypotheses until customer-controlled evidence measures them externally.

Shadow ready ≠ production ready.write_scopes=0 · permit=PROHIBITED · credential=PROHIBITED · connection=NOT_ESTABLISHED · execution=PROHIBITED

Observe the request.Do not connect the consequence.