Trust Model

Sigil’s trust model is earned, per-service, and observable. Two separate things decide whether a service can auto-merge:

The policy mode (shadow, advisory, auto) is set by the operator with sigil policy set. It caps the decision: only auto can ever ALLOW. Sigil does not promote the mode automatically.
The earned trust level (NONE, LOW, MEDIUM, HIGH) is computed from ledger history. Since 0.36.0, sigil decide records each change as a trust.transition or trust.decay ledger event and gates on it.

An ALLOW needs both: auto mode and enough earned trust for the PR’s risk class.

Policy modes

Mode	Reachable decisions	Use
`shadow`	REVIEW, BLOCK	Sigil runs on every PR and records evidence. This is the only mode in which a service can earn its first trust level.
`advisory`	REVIEW, BLOCK	Decisions are posted as status checks; merges stay human.
`auto`	ALLOW, REVIEW, BLOCK	ALLOW can merge, when earned trust and risk allow it.
unset	REVIEW, BLOCK	Same ceiling as `shadow`, so a typo never widens autonomy. An unset mode does not earn trust: set `mode = "shadow"` explicitly. `sigil init` leaves the mode unset.

A clean run capped by the mode says so (shadow_mode_cap, "mode_capped": true), so it can be told apart from a REVIEW with findings.

Earned trust levels

sigil decide computes a trust score from the last 30 days of ledger history: an exponentially weighted pass rate, multiplied by stability, 1 - override rate, 1 - incident penalty, and recency. It then moves the earned level at most one step per decide:

Step	Needs (30-day window)
NONE → LOW	20 evals while in `shadow` mode, pass rate above 95%, score at least 0.3
LOW → MEDIUM	50 evals, pass rate above 95%, override rate below 5%, score at least 0.6
MEDIUM → HIGH	100 evals, pass rate above 95%, override rate below 3%, no incidents, score at least 0.8

These thresholds are fixed. A service with no recorded transitions starts at NONE, even with a high score.

Decide gates on the lower of the earned level and the level the current score implies, so a later decline counts at once.

What each level allows in `auto` mode

Risk class	NONE / LOW	MEDIUM / HIGH
R0, R1	REVIEW (`trust_level_insufficient:<none\|low>`)	ALLOW when thresholds are met
R2	REVIEW	ALLOW when thresholds are met, confidence is at least 0.8, and there is no P0 regression; otherwise REVIEW (`risk_class_r2_requires_high_certainty`)
R3	REVIEW (`risk_class_r3_requires_review`)	REVIEW

Independently of trust, any regression caps the decision at REVIEW (regression_detected), and a P0 regression BLOCKs. Improvements elsewhere never outweigh a regression.

Decay and downgrades

Inactivity. The earned level drops one step per 30 days since the service’s last eval. Decay is applied once per period and recorded as a trust.decay event.
Incidents. A significant incident (Sev-1 or Sev-2) in the window drops the level to LOW. Lower-severity incidents reduce the score. An incident with a severity sigil does not recognise weighs as Sev-1.
Override spikes. An override rate above 10% drops the level to LOW, whatever incidents are present.

Trust is never a one-way ratchet. A HIGH service drops to LOW after one Sev-1 incident, and has to climb again.

Human overrides

Humans can override Sigil decisions at any level via sigil override. Overrides are recorded to the ledger (override.record events) and feed the trust score. A pattern of humans overriding REVIEW to merge is a signal that the policy is too strict. A pattern of humans overriding ALLOW to block is a signal that the policy is too loose. Both are visible in the ledger projection.

Inspecting trust

sigil trust show --service api       # score, components, policy mode
sigil trust history --service api    # recorded transitions and decays

Rolling out a new service

Set the service to shadow (sigil policy set --service api --mode shadow, or mode = "shadow" under [policy.api]) and run Sigil on every PR. After 20 clean evals it earns LOW.
Keep going until it earns MEDIUM (50 evals, few overrides). sigil trust history shows each step.
Move to auto with sigil policy set --service api --mode auto. R0/R1 changes can now ALLOW.

Why earned autonomy

Trust that comes from the outside — a config flag, a permission grant, a model name — is not trust. It is permission with a different label. Sigil’s trust is built only from observed behavior, which means it is immune to the pathologies that come with trusting an agent by name.