The plan and risk
This page explains how Pilotage exposes expected effects before a Host permits execution.
A plan is the statically derived preview of a valid program, with risk attached to every relevant step.
In the loop (manifest → guides → catalog → validate + plan → execute → trace), the plan is a layer in its own right: the pre-run decision point where the Host and the agent see expected effects before anything runs. On the wire it still arrives with validation: a valid response carries the plan, so there is no second round trip.
Validation answers “is this program acceptable?” The plan answers “what is it expected to do?” It lists invoking and control-flow steps in expected order. Branch plans include every possible arm because the selected arm is not known until runtime. Each invoking step names its catalog entry in calls.
Risk has two forms. risk is the engine's own readable level. risk_hints contains the generic booleans used by Host policy: readOnly, destructive, and openWorld. The plan aggregates these into max_risk and max_risk_hints.
A captured Harborview plan for the comfort check flow ends with:
{
"max_risk": "write",
"max_risk_hints": {
"readOnly": false,
"destructive": false,
"openWorld": false
}
}Its branch-arm steps also carry:
{
"arm": {
"branch": "gate",
"label": "then"
},
"calls": "hvac.zone1"
}The Host owns the gate. If destructive or openWorld is true, it must obtain approval outside the Model before sending execute. Missing risk information fails closed. A prompt telling the Model to ask first is not the gate; the enforcement belongs in Host code.
Risk labels are server claims. The gate is useful with a trusted, cooperative server, but it cannot constrain a dishonest one.
Formal rules: Part II §5.3, Risk, Part II §5.6, Plan, and Part II §7.3, Host risk gate.