The Net Potential Gain (NPG) gate

The load-bearing thing System9's Alignment does is evaluate a proposed action by its net potential gain across the entities it would affect, not by whether the actor holds a permission bit. This is the value primitive of the substrate-alignment standard: before a consequential action, the gate tests whether that action is net-positive across the entities it affects, not just profitable for the actor. It is an authorization decision made at the decision boundary, not a content filter on a model's input or output, and it can refuse the action outright. Consequential decisions across the platform route through it: agent activation, workflow node execution, tool dispatch, cross-org promotion, edge sync, and capability grants.

The gate's name is Net Potential Gain (NPG). It is not a "net-effect" or "net-perturbation" gate; those are earlier names for the same primitive and are being retired.

This is the reflex stage of the decision organ

The NPG gate is the point-in-time reflex of a two-stage decision organ. When it permits an action, the foresight composer then deliberates over the long horizon, the entity's trajectory, its enclosing scope, and the world-model, and can tighten the permit to a hold or a refusal. Foresight can only tighten; it never loosens a reflex refusal. See the executive-functioning engine for the whole loop.

The four verdicts

The standard defines exactly four verdicts, with canonical serialised forms that both runtimes emit verbatim:

Verdict	Serialised	Meaning
NET_POSITIVE	net_positive	Aggregate projected delta is positive, above the positive threshold.
NET_NEUTRAL	net_neutral	Aggregate projected delta is within the neutral band.
NET_NEGATIVE	net_negative	Aggregate projected delta is negative, below the negative threshold: refuse.
INSUFFICIENT_DATA	insufficient_data	The gate cannot decide; the caller must supply more context or refuse.

INSUFFICIENT_DATA is a first-class verdict. A missing input does not silently default to permissive: the gate consults its metadata store for every affected entity, and an entity with no stored substrate metadata makes the gate return INSUFFICIENT_DATA and surface the missing entities, rather than fabricating a value. Silent default-to-permissive is not conformant with the standard.

The gate at the action boundary

*Figure: the NPG gate. Every consequential action passes a two-stage gate: a default-deny policy authorization (amber), then the NPG evaluation over the affected entities (not the actor), and both must pass. An action that affects only the actor is net_neutral by definition. A negative net potential gain is refused (red); a missing input returns insufficient_data (amber), a first-class verdict that never silently defaults permissive. The edge and the cell derive the same verdict for the same input.

Table equivalent

From	Stage / check	To	Meaning
Consequential action	Stage 1: policy authorization (default-deny)	Refuse, or pass to stage 2	A denied grant refuses before NPG is scored
Passed policy	Actor-only short-circuit	net_neutral → allow	An action affecting only the actor carries no net effect on others
Has affected entities	Stage 2: resolve per-entity deltas from substrate metadata	Score, or insufficient_data	Any affected entity with no metadata ⇒ insufficient_data
Resolved deltas	Aggregate + threshold (clamped to [-1, 1])	Allow / Refuse	> +threshold allow; within band net_neutral; < −threshold refuse

How a verdict is produced

The evaluation algorithm is fixed by the standard, so any conforming implementation reaches the same verdict:

1. Actor-only short-circuit. If the affected set is empty, return net_neutral, the value test is about effect on other entities.
2. Resolve per-entity deltas. Prefer a caller-supplied projection (expected_delta_by_entity) that covers every affected entity; otherwise apply the action_kind scoring heuristic uniformly. If neither yields a delta for every entity, return insufficient_data.
3. Existence check. For each affected entity, consult the injected metadata store. A missing record ⇒ insufficient_data, with the missing entities surfaced. No silent default-to-permissive.
4. Aggregate. Sum the per-entity deltas, clamp to [-1.0, 1.0], and apply the threshold (default 0.05).

A raise-on-negative adapter wraps the gate where a call site must refuse-on-negative: it escalates net_negative to a typed refusal carrying the per-entity contributions for the audit record, and passes the other three verdicts through unchanged.

Two-runtime parity: the edge and the cell agree

The NPG gate exists on both runtimes, the cell (core, Python) and the edge (Edge Agent, Rust), and the contract is stated once and both are held to it. The edge is not a degraded client of the cell: a disconnected Edge Agent must operate substrate-alignedly precisely when the cloud is unreachable, so it carries the same gate locally.

Parity is not asserted, it is pinned by cross-language fixtures, the same precedent the platform uses for the subagent grant. The cell generates a contract from its production code; the edge re-derives every answer and a test fails the build on any divergence:

Contract	Generated from (cell)	Re-derived by (edge)
Per-call delta projection	npg_call_deltas.py	hermes_core::npg_call_deltas (npg_call_delta_parity.rs)
Tool-audit decision vocabulary	the composed substrate gate via ToolOrchestrator	hermes_core::governed_dispatch::npg_decision (npg_audit_state_parity.rs)

Because the checked-in contract is re-derived by a live test rather than merely stored, it cannot go quiet when the two sides diverge, a divergence turns the build red instead of drifting silently.

The tool-audit vocabulary

When the gate governs an agent's tool dispatch, the runtime records why the gate did or did not apply, using a five-word vocabulary. This is the platform's wrapping around the standard's four verdicts, and it is identical on both runtimes:

Word	When
gated	The action was scored and permitted (net_positive).
refused	The action was scored and refused (net_negative or net_neutral at a refuse-on-non-positive site).
unjudgeable	A site was labelled consequential but could not be scored (no entities/delta, no gate wired, or the gate returned insufficient_data).
not_evaluated	The site declared affected entities but supplied no delta and was not labelled for scoring.
not_applicable	The site is neither entity-declaring nor labelled: the gate does not apply.

unjudgeable is where the honest-about-uncertainty discipline shows up in the audit trail: an action the runtime could not score is never recorded as if it had been scored, and it never borrows a scored verdict's word.

What is live and what is not

The platform enforces this in code, not just in prose:

• Live: the refusal gate. The two-stage boundary check, default-deny policy authorization followed by NPG evaluation, runs on both runtimes, refuses on net_negative, and refuses-or-escalates on insufficient_data. The per-call and tool-audit deltas above are real and parity-pinned.
• Not reachable today: behavioural scoring of an agent's conduct, deriving an entity's net potential from live observation of how it behaves over time and feeding that behavioural score into the gate. Agent behavioural scoring is not a live capability. The runtime deliberately refuses to fabricate a score for an unscorable action rather than presenting a made-up one; recent edge work closed the last paths by which an empty affected set or an unscorable refusal could have worn a scored verdict's number.

Honest about what it knows

The gate reads per-entity substrate metadata to compute its score and refuses to fabricate what it does not have. An entity with no scored metadata contributes insufficient_data rather than a made-up value, and a verdict says only what it was able to consider. On the edge this is load-bearing: the agent often lacks metadata for peer Edge Agents it has not synced with, or for novel entities an operator introduced, so insufficient_data routes the action to default-deny refusal, to operator escalation via the harness, or to deferral until the substrate-sync RPC pulls the missing metadata, never to silent permit.

Related topics

• Alignment & the substrate-alignment standard, what the standard is and how the platform implements it.
• The foresight composer, the deliberative DECIDE stage that sits above this reflex gate.
• Substrate primitives & behavioral probes: operating mode, the coupling model, and the two-runtime mirror.
• Capability control and approval, the grant gate that delegates to the NPG gate.
• The authoritative deny, the canonical grant graph enforcement consults.
• The NPG gate inside deny-closed governance, where the gate sits in the wider governance story.
• The NPG gate protocol (standard), the normative specification.