Coldstart has not been released. The behavior on this page runs in the development build; there is no release you can install today.
Before a tool call runs, Coldstart compares the call's visible text with a closed list of selected risk and session-mode rules. This risk floor does not decide whether the work is wise. It decides only whether a represented call may continue silently, must pause for a person, or must be refused.
In the order-app session, an ordinary serializer edit is silent, a production deploy asks, and a command that commits a protected environment file is denied.
Scroll sideways for the rest of the diagram
Ask: judgment stays human
The floor asks on selected consequential actions such as live deployment, database-schema change, publishing outside the machine, paid provisioning, DNS, authentication boundaries, destructive deletion, secrets handling, history rewriting, and changes to the agent's own setup. That is the list the matcher holds at the revision reviewed here; it grows only by a deliberate edit, so a later build may carry more.
An ask names the matched concern and holds the call. It does not recommend approval. Code may recognize the shape of a deploy command; only a person can judge timing, authority, and acceptable impact. Approving a deploy also does not approve a separate secrets or database action.
Deny: a narrower recorded rule
Deny is reserved for represented situations where approval is not the intended escape. A protected environment file handed to git is refused with a repair path. A planning-only session also refuses writes outside its plan surface because that work belongs in another session, not behind an approval click.
These refusals are narrow. They operate on what the pending call exposes, not on a complete model of the repository.
Silence: no match, not safety
Most calls produce no floor message. The ordinary CSV serializer edit follows this path.
Silence means no declared pattern matched the visible call. The floor does not know the project's state, the operator's intent, or every spelling of every risky action. It therefore cannot turn silence into “safe” or “approved.”
If the floor itself breaks
If the floor cannot run, it asks rather than silently disappearing. This failure posture protects the represented boundary at the cost of a possible unnecessary approval. Separate checks exercise both stopping and permitting examples, because a gate that blocks routine work is likely to be disabled.
That still does not make coverage universal. A command that hides a path, uses an unrepresented program, or depends on state outside the call can escape the patterns. The floor is a tested list of known routes on the supported coding agent, not a general safety judgment.
For a low-consequence local script, a manual pause may be enough. The floor earns its maintenance cost only where missing the pause or refusal at that exact moment would itself be a defect.
Next
The floor is one moment in a session. There are three others: hook timing.