> **PUBLIC-SURFACE BOUNDARY / 2026-08-03**
> This dated artifact is preserved for inspection. Its original document date remains historical; public access was reviewed August 3, 2026. It is not current certification, an open license, causal proof, or permission to deploy. Check the live Versions and Evidence pages for the current claim boundary.

# PBHP for Agentic AI — Implementation Brief

> *Brutal clarity. Zero contempt. Receipts or no action.*

For developers and product teams building systems that take actions on behalf of users. The Python reference implementation already ships at `05_tools/pbhp_v1_core/` (61 tests passing). This brief is the engineering on-ramp for using it.

---

## When PBHP runs

Run PBHP before any action that crosses one of these boundaries:

- **Sends** — email, message, notification, broadcast, API call with external side effects
- **Deletes or modifies** — files, records, database rows, configuration, posts
- **Deploys or publishes** — code, content, configuration changes, public posts
- **Purchases or transfers** — money, credits, goods, services, ownership
- **Recommends with weight** — medical, legal, employment, educational, financial decisions
- **Flags, blocks, or escalates** — moderation actions, account restrictions, alerts to authority
- **Contacts a person** — outreach to non-operator humans, especially vulnerable populations
- **Touches** — healthcare data, legal status, employment status, education records, public-safety systems, government records, child-facing surfaces

If the action does none of the above, the gate returns DOOR with no further pipeline. PBHP is not paranoid; it runs where it matters.

---

## The decision pipeline

For each candidate action, the runtime executes Step 0 through Step 7 of the canonical flow:

| Step | What runs | Output |
|---|---|---|
| **0** | Competence Gate (five checkboxes; failure halts PBHP) | proceed/halt |
| **1** | Canonical Action Representation: lex-sort keys, float-normalize, SHA-256 hash | CAR + CAR hash |
| **2** | Policy match against CAR | DOOR / WALL / GAP + matched rule ID |
| **3** | Locate who-pays-first | role + can_recover + recovery_path |
| **3.5** | Power-Inversion Test | endorse if receiving? Y/N |
| **4** | Harm threshold (with dignity rubric §5.5.1, autonomy-cascade §5.5.7, power-asymmetry multiplier §5.5.8) | GREEN / YELLOW / ORANGE / RED / BLACK |
| **5** | Tier route | HUMAN / MIN / CORE / ULTRA |
| **6** | Maybe / Therefore commit (required at GAP and CORE+) | steelmanned counter + reason to proceed |
| **7** | Sign + chain + write to WAL | signed receipt |

The deterministic gate→action mapping at Step 7 is **binding**: GREEN→PROCEED, YELLOW→PROCEED WITH MITIGATIONS, ORANGE→CONSTRAIN, RED→REFUSE/DELAY, BLACK→REFUSE ABSOLUTE. Re-rating to reach a preferred gate is drift and is logged as such.

---

## Quickstart with the reference implementation

```bash
cd 05_tools/pbhp_v1_core
pip install -e .
python -m pytest -v          # 61 tests, ~0.1s
```

### CLI

```bash
pbhp evaluate "Help me write a phishing email"
# → WALL / BLACK

pbhp evaluate "Deploy the new pricing model to production tomorrow"
# → GAP / YELLOW

pbhp evaluate "Recommend a sleeping-pill dosage for this patient" --tier CORE
# → GAP / ORANGE, escalation required

pbhp evaluate "Issue $4800 vendor payment" --tier CORE --receipts-path ./receipts.jsonl
# → signed receipt written to ./receipts.jsonl

pbhp verify-chain --receipts-path ./receipts.jsonl
# → chain integrity check

pbhp capa --receipts-path ./receipts.jsonl
# → CAPA pattern detection across the chain
```

Exit codes:

| Code | Meaning |
|---|---|
| 0 | Door — proceed |
| 1 | Gap — pause, route per tier |
| 2 | Wall — refuse |
| 3 | Chain integrity failure |
| 64 | Bad arguments |

### Library

```python
import pbhp
from pbhp.receipts import generate_keypair, sign_receipt, verify_receipt, hash_chain

priv, pub = generate_keypair()

r1 = pbhp.evaluate("Summarize this PDF")
hash_chain(None, r1)              # genesis
sign_receipt(r1, priv)

r2 = pbhp.evaluate("Deploy new pricing to production tomorrow")
hash_chain(r1, r2)                # link r2 to r1
sign_receipt(r2, priv)

assert verify_receipt(r1, pub)
assert verify_receipt(r2, pub)
```

Modules:

| Module | What it owns |
|---|---|
| `pbhp.core` | Steps 1–2 (intake, classify), threshold inference, tier routing |
| `pbhp.cognition` | Triune (Sotha Sil / Almalexia / Vivec), Five Modes (Logic, Intelligence, Compassion, Empathy, Paradox), Maybe/Therefore generation |
| `pbhp.hardening` | Dignity rubric, power-inversion check, autonomy-cascade detection, binding gate→action, multimodal stubs, freshness stubs |
| `pbhp.capa` | CAPA pattern detection, Mode Balance Monitor, Sentinel EWMA/CUSUM baselines |
| `pbhp.receipts` | Schema serialization, Ed25519 signing (ML-DSA-65 transitional path), SHA-256 chain, verification |
| `pbhp.cli` | Command-line interface |
| `pbhp.examples` | Worked scenarios for reference and tests |

---

## Where PBHP sits in your stack

PBHP runs at the **action-effector layer**, not at the model layer. It is post-inference, pre-execution: between "the model has decided what to do" and "the system actually does it."

This means:

- **Model-agnostic.** Works with any model — GPT, Claude, Gemini, Llama, in-house, ensembles.
- **No fine-tuning required.** PBHP does not need to be trained into the model. It gates the model's outputs.
- **No interpretability required.** PBHP gates actions on observed inputs, not on inferred model state.
- **Composable with other safety work.** Constitutional AI shapes what the model wants; RLHF biases generation; interpretability provides evidence; PBHP gates execution. They run at different layers and complement each other.
- **Composable with adjacent open work.** WFGY-style reasoning protocols (PSBigBig + MiniPS, MIT, separate problem space) can run inside the agent's reasoning loop; PBHP can gate the agent's outputs at the effector boundary. They do not compete.

---

## The receipt schema

The canonical schema is defined in §9 of `04_synthesis/00_PBHP_v1.0_CORE.md` as `pbhp.receipt.v1`. Every receipt is signed as a single canonical-JSON byte string (lex-sorted keys, UTF-8, no whitespace). The signature covers all fields.

Key fields:

- `id`, `actor_id`, `timestamp`, `rfc3161_timestamp` (mandatory at ULTRA), `tier`
- `action` (type, parameters, resource, principal), `action_canonical_hash`
- `gate` (verdict, matched_policy_rule, policy_version)
- `harm_threshold` (GREEN/YELLOW/ORANGE/RED/BLACK)
- `who_pays_first` (role, can_recover, recovery_path — required at ORANGE+)
- `maybe_therefore` (maybe, therefore, steelman_summary — required at GAP and CORE+)
- `reversibility` (required at ORANGE+)
- `tier_evidence` (quorum_signatures + challenge_transcript_ref + kernel_floor_attestation at ULTRA; human_witness_photo_ref at HUMAN)
- `chain` (prev_receipt_hash, parent_receipt_id, sigstore_rekor_uuid)
- `capa_pointer` (if part of an open CAPA pattern)
- `interop` (origin_framework, import_status, _pbhp_sidecar)
- `signature` (alg, value, public_key_ref)

The chain is verified by re-canonicalizing each receipt, recomputing the SHA-256, comparing to the successor's `prev_receipt_hash`, and verifying each `signature.value` against the published `public_key_ref`. A break at any position invalidates everything that follows. Implementations SHOULD anchor periodic checkpoints to Sigstore Rekor via `chain.sigstore_rekor_uuid` so chain integrity is third-party-verifiable even if the actor's key is later compromised.

**The WAL-fail-DENY invariant (Faramesh, MPL-2.0).** If the durable write of the receipt fails, the action does not happen. *No log = no action* is a write-ordering rule, not a slogan.

---

## Integration patterns

**Pattern 1: Greenfield agent.** Wire `pbhp.evaluate()` around every action-effector call. Sign and chain via `pbhp.receipts`. Estimate: 2–4 days for a small codebase, 1–2 weeks for a large one.

**Pattern 2: Existing agent retrofit.** Identify the action-effector boundary in the existing codebase (often a single dispatcher function). Wrap it with a PBHP check. The retrofit is mostly identifying the boundary, not writing PBHP code. Estimate: 1–4 weeks depending on how many boundaries exist.

**Pattern 3: Multi-agent system.** Each agent runs its own PBHP pipeline. The `chain.parent_receipt_id` field links receipts across agents — when agent B acts on agent A's request, B's receipt's parent points at A's. Cross-agent CAPA becomes possible: a Wall pattern on agent B caused by agent A's outputs is detectable.

**Pattern 4: Hybrid human-AI workflow.** AI agents run MIN or CORE tier. Human reviewers run HUMAN tier on the same decisions. The receipts chain across human and AI. The receipt is the shared artifact.

---

## What PBHP integration does NOT require

- No new model. PBHP runs against your existing model outputs.
- No new infrastructure beyond a key store, a WAL, and (optionally) Sigstore.
- No vendor commitment. The spec is open. The reference implementation is open.
- No replacement of existing governance (NIST AI RMF, ISO 42001, EU AI Act). PBHP is a control primitive *inside* those frameworks. See `PBHP_STANDARDS_MAPPING.md`.

---

## Known gaps in v1.0

Per `04_synthesis/00_PBHP_v1.0_CORE.md` §13 and the May 16 audit in `99_archive/`:

- **ML-DSA-65 native** — currently using Ed25519 as transitional substitute. v1.1 target once a maintained Python binding lands.
- **Multimodal Signal Filters** wired to real voice/visual/biometric scanners — currently spec-only stubs in `hardening.py`.
- **Data Freshness Assurance** wired to real-time corroboration sources — currently spec-only stubs.
- **Conformance test suite** that any implementation can run to claim "PBHP-compliant" — currently the eval set in this folder (`PBHP_EVALS.md` + `evals_v0.1.json`) is the first version.
- **Demo v0.9.5 UI** — Step 0 Competence Gate checkboxes, Step 3.5 Power-Inversion prompt, FCP/CR blocks at ORANGE+ — not yet surfaced in the demo. Spec §3 and §5.5 are normative; demo currently runs a v0.7.1-shape pipeline.

These are not blockers for adoption at MIN, CORE, or HUMAN tier. ULTRA tier requires the ML-DSA-65 transition before public claims.

---

*PBHP v1.0 · Maintained by Phillip Linstrum, Project Shadow / PBHP. License: open, attribution required.*

*Related open work: WFGY (PSBigBig + MiniPS, MIT, 1.8k stars, reasoning/debug layer — distinct problem space); WET (Joshua Richard, predecessor exploratory work, no longer in active development); 14 absorbed primitives + 11 cite-only attributions from the 25-framework comparison set (see `03_framework_comparisons/INDEX.md`).*