planner-judge-executor

The loop is deliberately split into three roles so each is auditable on its own. The planner can be expensive and creative because it can't act; the judge is intentionally cheaper because enforcing a bounded policy is a narrower task than generating a plan; the executor is boring by design.

The three roles

• Planner — reads state, proposes candidate actions with the evidence used. Never writes.
• Judge — scores each candidate 0.0–1.0 against policy gates and the evidence chain.
• Executor — applies actions that clear the gates, logging each as a decision row that can be reverted.

A cycle trace

cycle#7711
  planner → 14 candidates (model: large)
  judge   → 9 pass, 5 rejected (model: small)
            reject: discount_test blocked (cost tier B, needs A)
  executor→ 9 writes, each logged as a revertible decision row
            kill_switch: off · rate_limit: 9/120

Gates per action

The gates are not global — they're per action type. Soft, reversible actions clear on evidence alone; the one price action, discount_test, additionally requires Tier A cost confidence and a margin floor. Rejected candidates are still logged, with the gate that blocked them.