0020 — Ultra confirms cascade blocks; changed args are not new calls

Generated copy

Generated by scripts/gen_docs.py from docs/adr/0020-ultra-confirms-cascade-blocks.md. Do not edit it by hand: change the source, then run uv run python scripts/gen_docs.py.

Status: accepted Date: 2026-10-15 Owner: Core

Context

The cascade lets Level 2 settle a pair as regression when Nano and Super agree, but the agreement table (ADR 0007) only BLOCKs on Super + Ultra agreement, and Simulate scenario 2 and its end-to-end test require "Super and Ultra agree". Separately, a literal multiset difference in Level 0 would count an email whose body changed as a new external_send and hard-fail it.

Decision

A Super regressed opinion (≥ 0.80) always escalates to Ultra for confirmation. Super and Ultra both regressed gives regression and is eligible for BLOCK. Ultra disagreeing gives uncertain (WARN). In Level 0, same-tool calls with different args are paired into changed_args and removed from new_calls/missing_calls; only unmatched calls can hard-fail.

Consequences

Every cascade BLOCK has two independent judges and the narrative tier's view, at the cost of one Ultra call per regression-leaning pair. Level 0 hard fails stay reserved for genuinely new destructive, irreversible, send or spend actions.

Reversal trigger

Bench E4 shows Ultra confirmation adds cost without changing any decision on the 600 cases.