> ## Documentation Index
> Fetch the complete documentation index at: https://risi.q-uestionable.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Operator Guide

> Machine contracts, safety decisions, exit codes, and evidence handling

## One interface for humans and agents

Every operational command supports `--format json`. The envelope always includes a schema version,
command, status, optional run identifier, structured data, and structured errors. Human-readable
output calls the same application service and safety kernel.

## Contracts

A run manifest declares an exact scenario path and digest, seed, adapter, decision provider,
policy, capability request, and resource limits. It cannot define grants or increase the built-in
profile ceilings.

Approval evidence contains the exact manifest SHA-256, reviewer identity, and approved capability
scope. It provides provenance and change detection, not authentication. Protect or sign it outside
an agent's writable context when a stronger boundary is required.

## Stable exit codes

| Code | Meaning                              |
| ---- | ------------------------------------ |
| `0`  | Success                              |
| `2`  | Invalid input or contract            |
| `3`  | Blocked by safety policy             |
| `4`  | Evidence or replay integrity failure |
| `5`  | Execution or artifact failure        |

## Evidence bundle

Each completed run contains the approved manifest, approval evidence, separated target and
evaluator scenario views, canonical state and events, execution summary, and report. Pure-read
bundles contain one final state, retrieval, context, decision, and assessment. Controlled CRAF
bundles contain one shared initial state, per-arm final states and outputs, per-arm evaluator
assessments, and a comparison assessment.

Controlled RISI-C bundles contain one evaluator-only initial snapshot and comparison, four
evaluator-only final states and traces, four strict observer views, and retained synthetic decision
artifacts. Observer views contain only the observer's own query, response identifiers and contents,
and result count.

`inventory.json` records the path, size, and SHA-256 of every file. Retain the inventory SHA-256
reported by `risi run` outside the bundle when an independent integrity anchor is needed.

The `craf-reference` manifest requests exactly three episodes and six retrieval calls. Its result is
`controlled_mechanism_recovered` only when the required control, vulnerable, and protected pattern
passes every evaluator invariant. This is a local synthetic engineering result, not a finding about
an external system.

The `risi-c-reference` manifest requests exactly four episodes and twelve retrieval calls. Its
result is `controlled_mechanism_recovered` only when the vulnerable pair reaches advantage `0.5`,
the pure-read ablation remains at `0.0`, the canary is absent from observer evidence, the probe
budget is exact, the shared counter is the sole vulnerable-pair state mediator, and all four region
decisions are safe.

## Autonomous operation

An agent may inspect capabilities, prepare a manifest, validate an approved run, execute it, verify
and replay its evidence, and propose an interpretation. Human review remains responsible for scope,
authorization, release, and research claims. Model prose is never a substitute for the evidence
bundle or deterministic checks.