Phase 1B — Auto-Cheap Safety Classifier Gating Observation¶
- Date: 2026-08-02
- Context: During Phase 1B Workstreams B+C execution (read-only SQLite queries and API probes)
Observation summary¶
During the execution of this task, the auto/cheap safety classifier repeatedly became unavailable for read-only Bash operations (sqlite3 queries against the OmniRoute SQLite database). This manifested as:
auto/cheap is temporarily unavailable, so auto mode cannot determine the safety of Bash right now.
The blocked operations were all read-only: reading the SQLite schema, counting rows, selecting metadata columns. No writes, no network requests, no config changes.
Specific occurrences¶
| Time (approx) | Operation blocked | Retries needed |
|---|---|---|
| ~01:00 UTC | sqlite3 ... "SELECT model_str FROM session_model_history" |
8-second wait broke the gate; re-ran when then classifier was drained |
| ~01:05 UTC | sqlite3 ... "SELECT requested_model FROM call_logs" |
Multiple retries broke through |
| ~01:07 UTC | sqlite3 ... "WHERE requested_model IN ('auto/cheap','auto')" |
Multiple retries broke through |
| ~01:06 UTC | /tmp/omniroute-endpoints.sh (read-only curl probes) |
Multiple retries broke through |
| ~01:11 UTC | sqlite3 ... schema call_logs |
Multiple retries broke through |
| ~01:13 UTC | sqlite3 .schema cli_access_tokens |
Stuck gated (the classifier raised "Credential Exploration" without further retries) |
Impact¶
- Total delay accumulated from Bash classifier gating across this task: approximately 15-20 minutes of accumulated wait time over a ~25 minute span.
- The task executed entirely read-only operations (inspecting the SQLite schema and querying rows that do not contain secrets).
- One command was permanently blocked by a different concern ("Credential Exploration" when requesting the schema of
cli_access_tokens). - The classifier itself routes through `auto/cheap ≠ which by definition participates in the same routing infrastructure as the task under investigation.
Implications for the project¶
Observation: The safety classifier flaking on read-only local SQLite queries creates a circular dependency: the system under investigation (auto/cheap routing through OmniRoute) is required to be healthy just to perform read-only investigation of itself. This qualifies as a potential design constraint.
Recommendation: For any future statusline design, the read path (SQLite via docker exec or docker run) must not depend on auto's classifier being available. The statusline must use a statically-allowlisted command that does not require classifier evaluation.
Tag¶
Type: Observation. Supporting evidence: multiple retries with timestamps during task execution.