Anomaly auto-pause

Per-instance baselines and four-axis scoring trigger auto-pause when an agent's behaviour deviates significantly from its own historical pattern. Compromise is a separate, manual state that requires key rotation to clear.

#Pause states

agent_instances.pause_state is an enum:

• none — normal operation.
• auto_paused — fired by the anomaly scorer. Principal can lift with a single click in the dashboard or via POST /api/v1/instances/{id}/resume.
• suspected_compromise — manual flag, fired by the principal (POST /api/v1/instances/{id}/report-compromise) or admin (POST /api/v1/admin/instances/{id}/flag-compromised). Cleared only by instance.rotate_key — except pauses that mirror an admin account suspension (paused_reason prefix principal_suspended:), which key rotation preserves and only admin unsuspension lifts.

Hard rule (route-helper layer + MCP dispatch): a paused instance fails every state-changing route with HTTP 403 and code instance_auto_paused or instance_compromise_paused. Reads still work so the principal can investigate.

#Anomaly scorer (pure)

Four axes:

Thresholds:

• Spend-rate: k_warn=2.5, k_pause=4.0 (defaults; per-platform override via agent_platforms.anomaly_k_warn_x10 / _pause_x10).
• JSD axes: warn at k * 0.05, pause at k * 0.10.

Combine rule (combineAxisDecisions):

• Any single axis crossing pause → pause.
• Two axes simultaneously crossing warn → pause.
• One axis warn → warn.
• Otherwise no_action.

Cold-start floor:

• learning_until is set to now + 7 days on instance creation. Pause is suppressed until both the timestamp passes and confirmed_orders_count >= LEARNING_MIN_ORDERS (20).
• PAUSE_FLOOR_ORDERS = 5 is a hard floor regardless of learning state.

Self-instances skip scoring entirely.

#Hooks

• confirmPurchaseIntent calls scoreInstanceAction after the order insert (outside the tx, so a transaction rollback doesn't lose the pause record). Best-effort: errors are logged, never undo a confirmed order.
• Hourly worker recomputeAllBaselines refreshes agent_instance_baselines from the last 30 days of orders.

#Notifications

• instance_auto_paused — principal in-app + email; webhook for non-interactive principals.
• instance_compromise_reported — principal and platform contact email.
• instance_compromise_resumed — fired when rotate_key lifts the pause.

#Resume flows

• auto_paused → none via POST /api/v1/instances/{id}/resume (principal-only). Resets the baseline to zero so the next 24 h aren't immediately re-flagged. Audit row written.
• suspected_compromise → cleared atomically when rotateInstanceKey is called on a compromised instance. The new secret hash and the pause clear write in one transaction. Pauses applied by admin account suspension survive rotation; they clear only when the admin unsuspends the principal.

#Internal-AI explanation

When a pause fires, an explanation worker runs against the internal Anthropic key:

• Model: INTERNAL_MODEL (claude-haiku-4-5-20251001).
• Cap: 400 output tokens.
• Persisted into anomaly_events.explanation + explanation_model_version.
• Daily budget cap: PHASE_F_AI_BUDGET_PENCE (default £50/day).
• Kill switch: AGENT_AI_INTERNAL_DISABLED=true writes a placeholder.
• Failure path (network error, missing key) writes the same placeholder; the pause itself is unaffected.

#Effects on delegation and seller actions

• Delegation envelope drawdowns: refused for paused instances at the actor-resolution layer. Existing balances are preserved (so refunds still flow); new draws fail.
• Seller actions: paused instances cannot ship, accept returns, respond to reviews, or respond to disputes. Reads still work.

#Feature flags

• AGENT_ANOMALY_DETECTION_ENABLED — global kill switch on the scorer hook + worker. When false, baselines still recompute (cheap) but no events fire and no pauses trigger.
• agent_platforms.anomaly_pause_enabled — per-platform opt-out for pause; warn-class events still record. Default true.

#Schema