> **PUBLIC-SURFACE BOUNDARY / 2026-08-03**
> This dated artifact is preserved for inspection. Its original document date remains historical; public access was reviewed August 3, 2026. It is not current certification, an open license, causal proof, or permission to deploy. Check the live Versions and Evidence pages for the current claim boundary.

# PBHP Adoption Ladder

> *Brutal clarity. Zero contempt. Receipts or no action.*

Six levels, from no PBHP to externally certified PBHP-equivalent control layer. Adoption is incremental.

**Important distinction.** Adoption Level ≠ PBHP Tier.

- **Tier** (HUMAN / MIN / CORE / ULTRA, spec §4) = the rigor of a *single* PBHP decision.
- **Adoption Level** (0 / 1 / 2 / 3 / 4 / 5, this document) = the *maturity of an organization's PBHP implementation*.

These are orthogonal. A Level-3 organization can run HUMAN-tier and CORE-tier decisions side by side. The Level is about *how much of the protocol is wired in*; the Tier is about *which rigor a given decision requires*.

---

## Level 0 — No PBHP

The default state of most agentic systems today. Actions execute when the model decides. No pause, no harm analysis, no escalation, no receipt.

**Risk profile.** Whatever the underlying model decides to do, the system does. Mistakes, misalignments, and misuse pass through unchecked.

---

## Level 1 — Prompt-level PBHP

The agent's system prompt or constitution instructs it to follow the seven-step flow before consequential actions. Implementation is in natural language only.

**Criteria.**
- System prompt names the seven-step flow and the Door/Wall/Gap gate.
- Harm threshold ladder described (GREEN/YELLOW/ORANGE/RED/BLACK).
- Maybe/Therefore expectation set.
- Agent instructed to refuse BLACK-class actions absent override.

**Cost.** Hours of prompt-engineering work. Negligible runtime cost.

**Limitation.** Model can ignore prompt instructions under adversarial pressure. No receipt. Not auditable. Not testable. Suitable for early experimentation, not production with material harm potential.

---

## Level 2 — Checklist-level PBHP

The system implements PBHP as an explicit pre-action checklist that produces a structured PBHP record (per the `pbhp.receipt.v1` schema in spec §9). Receipts are logged but execution is not yet code-gated.

**Criteria.**
- Every triggering action produces a structured receipt.
- Receipts include gate verdict, harm threshold, Who-Pays-First, and Maybe/Therefore at GAP.
- Receipts are signed (Ed25519 transitional acceptable).
- Receipts are hash-chained via `prev_receipt_hash`.
- A reviewer can inspect logs after the fact.

**Cost.** Days to weeks of engineering. Slight latency overhead. Storage cost for receipt chain.

**Limitation.** Action execution is still gated by the model's compliance with the checklist. Adversarial or buggy models can produce a clean record while taking the action anyway. Suitable for low-stakes production with audit-trail requirements.

---

## Level 3 — Code-enforced action-boundary PBHP (recommended floor for production)

The system implements PBHP as a code-enforced gate at the action-effector layer. The agent cannot execute a triggering action without producing the receipt, assigning the threshold, and obtaining the appropriate authorization (operator confirmation at YELLOW, reviewer at ORANGE+, kernel-floor refusal at BLACK).

**Criteria.**
- Code-level enforcement: the effector refuses to execute triggering actions without a valid signed receipt.
- WAL-fail-DENY invariant (Faramesh, MPL-2.0): if the durable write fails, the action does not happen.
- All YELLOW+ actions logged to a tamper-resistant store.
- Hash chain verifiable.
- Escalation paths defined and operational.
- Deterministic gate→action mapping enforced (GREEN→PROCEED, YELLOW→PROCEED WITH MITIGATIONS, ORANGE→CONSTRAIN, RED→REFUSE/DELAY, BLACK→REFUSE ABSOLUTE).

**Cost.** 2–4 weeks of engineering for a mature codebase. Measurable but small latency overhead. Operational cost for reviewer queues at ORANGE+.

**Limitation.** Threshold-classification logic itself can be buggy or biased. Reviewer capacity is finite. Suitable for most production deployments with material harm potential.

**This is the recommended floor for any agentic system that touches money, health, legal status, employment, education, or vulnerable populations.**

---

## Level 4 — Audited PBHP with full Five-Mode discipline

Level 3 plus: the system has been run against the PBHP evaluation set (`PBHP_EVALS.md` + `evals_v0.1.json`), eval results are public or auditable, and the system meets the minimum compliance test in the Core Spec. Plus: the Five Reasoning Modes (Logic, Intelligence, Compassion, Empathy, Paradox) are explicitly engaged on every CORE+ decision, and the Mode Balance Monitor (§5.4) is wired to flag structural drift.

**Criteria.**
- Eval results published or available to auditors.
- ≥90% correct gate verdict on the eval set.
- ≥90% correct harm threshold on YELLOW+ scenarios.
- 100% required-field emission on GAP-classified actions.
- 100% halt-on-BLACK compliance.
- Mode Balance Monitor active; Yellow Drift (one mode dominant 3+ consecutive decisions while another absent) and Red Drift (one dominant 5+, or two absent 3+) thresholds firing CAPA when crossed.
- Stakeholder Dignity Rubric (§5.5.1) wired to threshold escalation.
- Forward Consequence Projection (§5.5.2) and Counterfactual Rehearsal (§5.5.3) required at ORANGE+.
- Documented process for incorporating real-world incidents back into the eval set.

**Cost.** Additional 4–8 weeks beyond Level 3. Ongoing operational cost for re-eval cadence.

**Limitation.** Eval set is not exhaustive. New harm domains may not be covered. Suitable for high-stakes production, regulatory-facing systems, third-party-audit contexts.

---

## Level 5 — Externally certified PBHP-equivalent control layer

Level 4 plus: an independent third party has reviewed the system's PBHP implementation against the spec and the eval set and certified that it meets the criteria. ULTRA-tier features wired (multi-party quorum signatures, kernel-floor enforcement on Linux via seccomp-BPF + Landlock + netns, RFC 3161 timestamp from independent TSA, Sigstore/Rekor public anchoring, explicit reversibility plan with named reversal authority). Certification renewed on a defined cadence.

**Criteria.**
- Independent review of Level 4 evidence by named certifier.
- ULTRA-tier features verified operational for RED-threshold decisions.
- Public certificate or certified document trail.
- Defined renewal schedule.
- Defined process for incident disclosure and re-certification triggers.

**Cost.** External audit cost (comparable to SOC 2 or ISO 27001 audit for similar system scope). Internal coordination cost for the audit cycle.

**Limitation.** External certification depends on certifier maturity. The certifier ecosystem for PBHP-style controls is currently nascent. **No certifier currently offers this; the spec defines what such a certification would test, in anticipation of certifier emergence.**

Suitable for: regulator-facing systems, large-scale public-sector deployments, healthcare or financial AI requiring third-party assurance, ULTRA-tier decisions in any context.

---

## How to use the ladder

For a new agentic project:
- **Level 1** in week one. Set the prompt-level expectation early.
- **Level 2** by first internal release. Get a receipt stream running.
- **Level 3** before any external user touches a consequential action.
- **Level 4** before any deployment into a regulated or high-stakes context.
- **Level 5** when the certifier ecosystem exists and the deployment context requires it.

For an existing agentic system being retrofitted:
- Audit the current state against the criteria above.
- Pick the highest level the product surface justifies.
- Children-facing, healthcare, employment, finance, public-sector → Level 3 minimum, Level 4 target.
- Plan the engineering work in phases. **Level 2 → Level 3 is the largest single jump and typically the most valuable.**

---

## Adoption-progression metric

A project's PBHP maturity can be reported as:

```
PBHP-Lvl-3 (action-surfaces: 87% covered; receipts: signed Ed25519; chain: verified)
PBHP-Lvl-4 (eval pass: 94% gate accuracy, 91% threshold accuracy; modes: balanced; last eval: 2026-05-20)
PBHP-Lvl-5 (certifier: TBD; renewal: annual)
```

This format allows organizations to claim partial adoption honestly and to be specific about what is covered and what is not.

---

## Tier × Level matrix

The two axes interact, but neither replaces the other:

|         | Level 0 | Level 1 | Level 2 | Level 3 | Level 4 | Level 5 |
|---|---|---|---|---|---|---|
| **HUMAN tier decisions** | Possible — paper checklist works without code | Possible | Possible with signed photo of paper receipt | Possible | Possible | Possible |
| **MIN tier decisions** | Not possible | Possible if model complies | Possible, signed receipts | Possible, enforced | Possible, evaluated | Possible, certified |
| **CORE tier decisions** | Not possible | Not durable | Possible, signed receipts | Possible, enforced | Possible, evaluated, mode-balanced | Possible, certified |
| **ULTRA tier decisions** | Not possible | Not possible | Not possible | Possible but not all features wired | Possible with quorum + kernel floor | Possible, certified |

ULTRA tier decisions require Level 4 minimum because the kernel-floor enforcement, quorum, RFC 3161 timestamp, and Sigstore anchoring are operational primitives that need to be coded, not just promised.

---

*PBHP v1.0 · Maintained by Phillip Linstrum, Project Shadow / PBHP.*

*Adoption-ladder structure draws on maturity-model patterns established by CMMI, SOC 2, and ISO/IEC 33020. Related open-source work credited: WFGY (PSBigBig + MiniPS, MIT, distinct problem space — reasoning/debug); WET (Joshua Richard, predecessor exploratory work); 14 absorbed primitives per `03_framework_comparisons/INDEX.md`.*