Autonomy ladder

Three levels

The autonomy ladder decides how far Mori can go on shell commands before it has to stop and get your yes. There are three rungs:

• Guided (the default) — asks before anything that changes things. Every dangerous command raises a confirmation dialog.
• Trusted — runs routine work on its own, and auto-runs the specific dangerous commands you've whitelisted, while still confirming anything you haven't.
• Commander — full autonomy for a time-boxed window: dangerous commands run without a prompt until the grant expires. Every one of them is written to an append-only ledger first.

This is a different, newer control from the permission levels (safe / standard / full) covered in Security & approvals. Permission levels decide *which categories of tool exist at all* for a session; the autonomy ladder decides *how much confirmation* command execution needs. Both are real and both apply at once. Shipped in 1.3.0 SOVEREIGN.

Guided     ·  asks before anything that changes things
Trusted    ·  runs routine work; auto-runs your whitelisted dangerous commands
Commander  ·  full autonomy for a time-boxed window (every action ledgered)

How a command is classified

Every command that reaches a shell — whether through run_terminal_command or a terminal_run in a named session — passes one chokepoint that sorts it into three tiers. Before matching, the command is de-obfuscated so a disguise can't slip past: quotes used to split tokens are stripped, line-continuations collapsed, unresolved ${VAR} expansions blanked, and a base64 -d | sh payload is decoded and inspected for what it actually runs.

• ok — ordinary commands. They run.
• dangerous — legitimate but destructive: sudo, any recursive or forced rm, git push --force, git reset --hard, git clean -f, chmod 777, killall / pkill, npm uninstall / npm prune. These are what the ladder gates.
• hardline — the un-bypassable set (below). Refused at every level.

How a dangerous command is treated depends on your level: Guided always confirms it; Trusted auto-runs it only if it matches one of your allow-globs; an active Commander grant runs it and records it.

The hardline floor never moves

Some commands are never worth the risk, so they are refused outright — at Guided, at Trusted, and even under an active Commander grant. There is no setting, glob, or mode that turns them on.

The hardline patterns are: a recursive delete of / or ~ (or $HOME), formatting or raw-overwriting a disk (mkfs, dd of=/dev/…, diskutil erasedisk), a fork bomb, a power-state change (shutdown, reboot, halt), killing Mori or its updater process, and piping a download straight into a shell (curl … | sh). If you genuinely intend one of these, Mori tells you to run it yourself in a real terminal.

This floor is the thing the ladder is built on top of. Commander removes the *prompts* on dangerous commands; it does not, and cannot, lower this line.

> terminal_run { name: "cleanup", command: "rm -rf ~" }
Blocked (hardline safety): "rm -rf ~" matches an un-bypassable
danger pattern (recursive delete of / or ~, disk format/overwrite,
fork bomb, shutdown/reboot, killing Mori/its updater, or
curl-piped-to-shell). This is never run — not even in commander
mode. Run it yourself in a real terminal if you truly intend it.

Commander is a deliberate, expiring grant

You cannot drift into Commander. Reaching it takes a double opt-in: you explicitly choose Commander, then confirm in a dialog and pick how long the grant lasts. The main process refuses to elevate without that explicit confirmation, so a stray click — or anything Mori reads — can never flip it on.

• Time-boxed. The confirm dialog offers 15, 30, or 60 minute grants (a grant is capped at 24 hours). When it expires, autonomy drops back on its own.
• A live countdown. While a grant is active, a countdown chip shows exactly how much time is left, with an X to revoke it instantly. Revoking ends the grant and returns you to Guided.
• You can steer it any time. The autonomy chip in the composer cycles the level; the /autonomy guided | trusted | commander slash command does the same. Choosing Commander either way still routes through the same confirm-and-grant dialog.

Crucially, the level and the grant are set *only* from the settings UI. Tool output, web pages, memory, and message content are always treated as data — none of them can change your autonomy, no matter what they say.

The Commander ledger

Everything that runs under a Commander grant, and every hardline attempt that gets blocked, is written to an append-only ledger. It is a write-ahead record: the line is written *before* the command executes, so the trail survives even if the command crashes the process.

Each entry captures the timestamp, the action, the exact command, the backend it ran on, the autonomy level, the grant's expiry, the decision (run or blocked), and the reason. The file lives in the app's user-data folder as mori-commander-ledger.jsonl, and there is a read-only viewer for it in the app.

The ledger is data, and only data. Its path is refused at the same dispatch chokepoint every command passes through, so no tool — no write_file, edit_file, or delete_file — can touch it. Mori can never doctor its own audit trail.

{"ts":1752_,"action":"terminal_run","command":"rm -rf node_modules","backend":"local","autonomyLevel":"commander","grantExpiresAt":1752_,"decision":"run","reason":"commander grant active (dangerous)"}
{"ts":1752_,"action":"run_terminal_command","command":"rm -rf ~","backend":"local","autonomyLevel":"commander","grantExpiresAt":1752_,"decision":"blocked","reason":"hardline pattern — un-bypassable"}

What never changes, at any level

The ladder governs how much confirmation *command execution* needs. It has no reach into the other safety gates, so those hold at every level — including under a live Commander grant:

• The hardline floor holds. The catastrophic patterns above are refused at Guided, Trusted, and Commander alike.
• Purchases still stop at the pay button. The purchase gate lives in the browser and computer-use loops, not in command execution — a Commander grant simply doesn't touch it. Mori holds every checkout at the final step and places the order only after you approve it.
• Credentials are never entered. Mori does not type card numbers, passwords, or the final spend tap. Those stay with you, always.
• Only you change the level. Autonomy state moves only through the settings UI. Nothing Mori reads — a web page, a file, a message, a tool result — can raise its own permissions.

See Security & approvals for the permission-level system, typed remote approvals, checkpoints, and the durable audit log that sits underneath all of it.