Scoring rules

The math behind the composite score — caps, sums, reputation discount, hard gates.

This page is the reference for how filter contributions combine into the final composite. See Composite scoring for the conceptual overview.

The algorithm

1. Run all filters in their phase order.
2. Each filter emits a contribution `c_i ∈ ℝ`.
3. Cap: c_i' = clamp(c_i, -∞, ceiling_filter_threshold)
4. Sum: composite_raw = Σ c_i'
5. Reputation discount:
     if observations ≥ auto_allow_min_observations
        and trust ≥ auto_allow_trust:
        d = min(max_score_reduction, composite_raw × (trust − 0.5) × 2)
        composite = max(0, composite_raw − d)
     else:
        composite = composite_raw
6. Hard gates (capability deny, canary detection):
     if any filter returned DENY: composite ← auto_deny_threshold + 1
7. Decide:
     composite < auto_allow_threshold → ALLOW
     composite ≥ auto_deny_threshold → DENY
     otherwise → QUEUE

The exact constants live in [reputation] and [proxy] config sections. Defaults:

[proxy]
auto_allow_threshold = 3.0
auto_deny_threshold  = 8.0

[reputation]
ceiling_filter_threshold     = 5.0
auto_allow_min_observations  = 8
auto_allow_trust             = 0.92
max_score_reduction          = 4.0

Per-filter caps

Step 3 caps each filter's contribution at ceiling_filter_threshold. The intent: no single filter can dominate the composite. A buggy filter that fires too hard is limited; the operator can investigate without the call being incorrectly denied.

The exception is hard gates (DENY-returning filters), which bypass the cap by forcing the composite past auto_deny_threshold directly.

Reputation discount

Step 5 is where adaptive trust pays off. The discount is bounded by max_score_reduction (default 4.0) — so a fully-trusted shape can knock at most 4 points off the composite. The discount is also gated:

Need observations ≥ 8 (default). Newer shapes don't qualify, however high-trust they look — the trust score on a tiny sample size is unreliable.
Need trust ≥ 0.92 (default). Anything less, no discount.
Linear scaling: d ∝ (trust − 0.5) × 2. Trust at the threshold (0.92) earns less discount than trust at 1.0.

The discount never makes the composite go negative — composite = max(0, …).

Fixed thresholds

Every call is evaluated against the same thresholds, from the first call of a session onwards. There is no call-count "cold-start" widening: an earlier mode that temporarily widened the escalation zone for the first N calls of a fresh install was removed, because it under-scored destructive or exfiltrating operations issued early in a session. See the changelog.

Worked examples

See Composite scoring for worked examples with real filter contributions.

Inspecting scoring decisions

Every decision is captured in the audit log with per-filter contributions, the raw and final composite, the reputation discount applied (if any), and any DENY short-circuit. Inspect with:

grith audit export --format json   # records carry the per-filter breakdown
grith proxy test '<json>'           # for arbitrary call shapes