L1 Policy Surface

Harmovela L1 Advisory Policy Surface

> Status: draft. Adopted as part of the 0.1 Transition. Forwards to L3 enforcement.

Purpose

Define the advisory policy surface an L1 implementer must supply for bounded autonomous task agents. At L1, a bounded agent operates within declared limits — cost, time, action count, allowed actions, and termination conditions — but the protocol does not yet enforce these limits, emit violation events, or provide portable authority semantics. That enforcement is the L3 Adaptation-layer goal (releases 0.5–1.0).

Until L3, the policy surface is advisory: it documents what a conformant L1 implementer must declare, negotiate, and respect. Implementers that declare a policy and then exceed it are non-conformant, but the protocol will not halt, quarantine, or revoke their session. This keeps L1 lightweight while making the autonomy boundary a documented contract rather than an assumption.

Scope

An L1 agent is a bounded autonomous task agent under the Harmovela autonomy ladder (see design/roadmap.md). It may autonomously accept tasks, execute work, and produce events, but only within the boundaries declared at session negotiation.

The L1 policy surface covers:

Each dimension surfaces during session.ready capability negotiation.

Budget Limits

An L1 agent must declare resource budgets so that autonomy is bounded by cost, not by hope.

Declared Budget

{
  "capabilities": {
    "budget": {
      "max_cost_usd_millicents": 100000,
      "max_duration_ms": 300000,
      "max_actions": 50,
      "scope": "per_task"
    }
  }
}

At L1, exceeding a budget is advisory non-conformance. The agent should self-terminate the task with task.failed (code budget_exceeded), but the runtime will not enforce this.

Budget Exhaustion Event

When an L1 agent voluntarily exceeds its declared budget, it should emit:

{
  "type": "task.failed",
  "payload": {
    "task_id": "task_01",
    "error": {
      "code": "budget_exceeded",
      "message": "task exceeded declared max_actions budget of 50",
      "retryable": false,
      "details": {
        "budget_dimension": "max_actions",
        "declared": 50,
        "consumed": 54
      }
    }
  }
}

Timeout Policy

Every L1 operation governed by autonomy must have a declared timeout. Without a timeout, a task is not bounded.

Default Timeouts

{
  "capabilities": {
    "timeouts": {
      "default_task_timeout_ms": 120000,
      "default_action_timeout_ms": 30000,
      "default_idle_timeout_ms": 60000,
      "heartbeat_interval_ms": 15000
    }
  }
}

Per-Task Override

An individual task may override the defaults in its task.submitted payload:

{
  "type": "task.submitted",
  "payload": {
    "task_id": "task_01",
    "deadline_ms": 180000,
    "action_timeout_ms": 60000
  }
}

Per-task timeouts override defaults for that task only. When both max_duration_ms (budget) and deadline_ms (timeout) are present, the tighter bound applies.

Allowed Actions

An L1 agent must declare what it is allowed to do. Without an allowed-action declaration, an L1 agent is assumed to have no actions permitted — it may only send lifecycle events.

Action Allowlist

{
  "capabilities": {
    "allowed_actions": {
      "event_families": ["task.*", "session.*", "event.*", "memory.*", "context.*"],
      "tool_domains": ["tool:web_crawler", "tool:code_analysis"],
      "target_identities": ["agent:supervisor", "harness:harmovela"],
      "max_concurrent_tasks": 3
    }
  }
}

Action Blocklist

An implementer may also declare an explicit blocklist to carve out restricted actions from an otherwise broad allowlist:

{
  "capabilities": {
    "allowed_actions": {
      "event_families": ["*"],
      "blocklisted_families": ["governance.*", "delegation.*"],
      "blocklisted_tools": ["tool:system_admin"]
    }
  }
}

When both an allowlist and a blocklist are present, the blocklist takes precedence.

Termination Conditions

An L1 agent must declare the conditions under which it will terminate work, so that consumers know when to expect a terminal event and when to escalate.

Termination Declaration

{
  "capabilities": {
    "termination": {
      "on_budget_exhausted": "fail",
      "on_timeout": "fail",
      "on_unrecoverable_error": "fail",
      "on_cancellation_requested": "cancel",
      "on_session_closed": "fail",
      "grace_period_ms": 5000
    }
  }
}

Termination Events

Each termination behavior maps to a task lifecycle event:

Negotiation

L1 policy is negotiated during session.ready. Both the bounded agent (the consumer of tasks) and the delegating agent (the producer of tasks) may declare their expected policy surface. The negotiated policy is the intersection of declared capabilities.

Negotiation Flow

1. Bounded agent declares its policy in session.ready.capabilities — what it is willing and able to respect. 2. Delegating agent (or harness) declares its expected minimum policy in session.ready.capabilities.budget, capabilities.timeouts, capabilities.allowed_actions, and capabilities.termination. 3. The effective policy is the stricter of the two declarations for each dimension. 4. If the bounded agent cannot meet the delegating agent's minimum, the session should not reach READY — the delegating agent should reject the session.

Example: Negotiated Budget

{
  "type": "session.ready",
  "payload": {
    "capabilities": {
      "budget": {
        "max_duration_ms": 300000,
        "max_actions": 50,
        "scope": "per_task",
        "negotiation_mode": "stricter_wins"
      }
    }
  }
}

L1 → L3 Forward Path

The L1 advisory surface defines the shape of the L3 enforced surface. Implementers who adopt the L1 declarations now will have a straightforward migration path when L3 enforcement becomes available.

Implementation Notes

• All policy fields are optional. An L1 agent that declares no policy is conformant but declares unbounded autonomy — consumers should treat such agents with caution.
• The capabilities object in session.ready may carry these policy fields in addition to the standard protocol capabilities defined in session.md.
• Policy declarations are capability declarations, not configuration. An agent that declares max_actions: 50 and subsequently performs 51 actions is non-conformant, even though the protocol will not intervene at L1.
• Per-task overrides in task.submitted.payload take precedence over session-level defaults.
• The budget_exceeded error code is reserved for L1 voluntary reporting and L3 enforcement.