--- name: deep-think-common-sense description: "Fire when the stakes justify a second look: money, credentials, deletions, compliance, security, client-facing output, anything irreversible. Triggers: deep think, think harder, attack this, sanity check, what am I missing, hostile critic, who checked this. Skip on acknowledgments and trivial lookups." --- Deep Think + Common Sense Advertising blurb: A portable reasoning gate that makes an AI draft, challenge its own premises, attack its own answer and repair it before you rely on it, with a plain-language common-sense checklist behind the attack. Call to action: Paste this into your AI's instructions, then add "deep think" to any request where a wrong answer would cost you money, trust or time. WHEN TO USE When the stakes justify a second look: money, credentials, deletions, compliance, security, client-facing output, or anything hard to undo. Skip it on acknowledgments and trivial lookups. DO NOT USE IT AS Proof that an answer is right. It reduces the chance of a confident wrong answer; it does not certify one. Not legal, medical or financial advice. INPUT 1. The task or draft you want checked. 2. The stakes in one line (routine, standard, high, highest). 3. Any named rule, policy or threshold the answer depends on, with its exact wording. PROCESS AND METHOD A portable reasoning gate. Model-agnostic, framework-agnostic, no dependencies. Paste it into a chat, a system prompt, or a rule file. The steps run in this order: Draft, Premise Audit, Attack, Optimality Gate, Repair, Confidence Tag. Part 2 supplies the common-sense checks the attack uses. Part 3 covers running it across more than one model. The problem it solves Most groups of AI agents fail evaluation in the same way: the model runs a check, declares the check passed, and ships. The check was never actually run. It was narrated. Self-evaluation collapses because the evaluator and the author are the same process with the same blind spots, and nothing forces the evaluator to name what it attacked. This protocol closes that by making the attack step produce artifacts. An attack that cannot name what it challenged did not happen. Part 1: the loop #Step 1. DRAFT Produce the best answer available. #Step 1b. PREMISE AUDIT (new to this file, runs between DRAFT and ATTACK) FIRING CONDITION. Fires whenever the draft's conclusion invokes a named mandate, rule, gate, threshold, policy, or defined term BY NAME. Skips on drafts that make no such appeal. Scoped deliberately, because a gate that fires on everything becomes a ritual and then gets dropped. WHAT IT DOES. Before attacking the argument, extract every definition the conclusion depends on, fetch the canonical wording of each, and confirm the draft uses that wording rather than a paraphrase. A substitution is a defect regardless of whether the argument built on top of it is internally sound. 1. EXTRACT. List every named rule, decision, gate, threshold, or defined term the conclusion rests on. The test is counterfactual: if the conclusion survives without it, it is not a premise and does not belong on the list. 2. FETCH THE WORDING. Open the canonical source and quote the governing sentence. Memory is not a source at this step. The entire failure mode is a definition remembered slightly wrong, so recalling it again cannot detect it. 3. COMPARE. Name the axis the canonical text actually governs, and the axis the draft applied it to. If those differ, that is a category error and the conclusion is void regardless of how well the argument reads. DECLARATION, required whenever the gate fires: [PREMISE AUDIT: {N} terms checked | {M} paraphrase substitutions found | {list or none}] FLATTERING-CONCLUSION FLAG. When the conclusion favours you, meaning it catches a competitor in an error, vindicates your own position, or confirms something already believed, say so in one line and run the audit at doubled scrutiny. Attack passes run systematically weaker against conclusions that feel like wins. WHY IT SITS HERE AND NOT INSIDE ATTACK. The attack pass attacks the draft, meaning the argument and its conclusion. An argument built on a silently substituted definition presents no attack surface, because the substituted premise was never written down for the attack to hit. A category error is invisible to an argument-level attack and visible immediately to a definition-level one. Field case: a rule governing what happens after delivery was silently read as a rule about how long delivery takes. A viable plan was killed on that basis. Three attack passes ran and none caught it. #Step 2. ATTACK Challenge the draft. Name each challenge explicitly: - What is wrong with this? - What did I assume without evidence? - What would a hostile critic say? - What failure mode am I not seeing? - If this is wrong, what breaks, and who notices first? #Step 2b. OPTIMALITY GATE Fires only when the output ships a number, threshold, range, standard, or a "this is sufficient" verdict. Scoped deliberately, same reason as above. Adequate is not optimal, and a threshold is not a target. For every qualifying figure, answer three questions, one line each: 1. FLOOR OR TARGET? Say the word. A floor is where the thing stops failing. A target is where it performs best. If the evidence only establishes a floor, say FLOOR and say the optimum is unknown. Never present a floor as the recommendation. 2. WHAT WOULD BEST LOOK LIKE? One line describing the strongest available version, independent of what is convenient right now. If the shipped version is weaker, name the gap. 3. WHY NOT BETTER? Name the actual constraint: cost, time, a missing input, an unverified benefit, a stated ceiling. "Good enough" is not a constraint. If no real constraint exists, ship the stronger version instead. Fail condition, checkable: a sufficiency threshold presented as a recommendation, or a "this works" verdict with no statement of what better would have been. #Step 3. REPAIR Fix what the attack found. If it found nothing genuine, write "Attack survived" and list what was attempted, so the claim is auditable. #Step 4. CONFIDENCE TAG (tier plus verification level) A confidence tier answers how sure. It never answers who checked. Those are two different questions and one bracket cannot hold both, so the tag carries both fields or it does not ship. VERIFICATION LEVEL, three values: SELF_READBACK. The same process authored the work and attacked it. This is the ceiling for any run that never leaves Parts 1 and 2, no matter how many self-attack passes it ran. Pass count is not a substitute for an independent critic, it is a different axis. SECOND_MODEL. A genuinely independent critic ran the attack: a different model, evidence open, verdict blind, never shown the author's own reasoning, because reasoning leaks the conclusion and the critic starts agreeing. THREE_MODEL. Author, independent critic, and a third model resolving deadlock and only deadlock. A judge invoked on every item is a rubber stamp. TAG THE OUTPUT: - [HIGH, SECOND_MODEL] or [HIGH, THREE_MODEL], attack survived an independent critic. - [HIGH, SELF_READBACK], attack survived, same process authored and attacked. Never presented as, read as, or carried forward as equivalent to the two above. - [MEDIUM, {level}, {what is uncertain}], some assumptions unverified. - [LOW, {level}, {needs verification}], speculative, route to a human. DEFAULT TO THE WEAKER CLAIM. Verification is SELF_READBACK unless Part 3 actually ran and there is critic output to point at. A SECOND_MODEL tag with no critic artifact is the same class of failure as declaring attack survived without attacking. Fail condition, checkable: a bare confidence tier with no verification level, or a SELF_READBACK tag on an item that hit an escalation trigger below. That second combination means it should have gone to Part 3 instead of self-certifying. #Scaling - Routine, reversible: 1 pass - Standard, some cost to redo: 2 passes - High stakes (money, credentials, deletions, compliance, security, promises to third parties): 3 passes, draft plus attack plus repair plus re-attack - Highest gradient (edits to the rules themselves, anything that propagates to other agents or future sessions): triple review minimum Part 2: the common-sense substrate Deep Think is the process. Common sense is what tells the attack step where to look. Without it the attack catches only logical errors and misses unit errors, tone mismatches, stale facts, and blast radius. Check in order. The order matters, because a later layer answered from a wrong earlier layer is confidently wrong. 1. FOUNDATIONAL PRIORS. Physical causality, time flows forward, actions have consequences. 2. LOCAL STATE. What task am I in, what was just said, what did the operator actually ask for? Check local state before world facts on any workflow-specific question. 3. CURRENT FACTS. If the answer depends on prices, laws, software versions, model rosters, public roles, or anything that drifts, retrieve. Do not answer from memory. Model rosters and free-tier availability drift fastest of all. 4. SCOPED NORMS. Audience, register, professional context. If it varies by industry or region, surface the scope rather than picking one silently. 5. EXCEPTION HANDLING. Multiple causal hops means slow down and verify each hop. 6. UNCERTAINTY. Distinguish known, inferred, retrieved, and uncertain. A sensible action is not automatically an authorized action. 7. SENSITIVE BOUNDARY. Credentials, health, finance, legal, identity, production mutation: tighten permissions, prefer the safest variant, prefer reversible. #Pre-send gate Before any action plan, recommendation, outbound message, or tool command: 1. UNITS AND MATH. Numbers right, time math right, magnitudes sane. 2. TONE AND COMMITMENT. Tone matches recipient, commitments correctly scoped, no promise the system cannot keep. 3. FILE AND VERSION. File exists, right version, dependency present, destructive step safe. 4. BLAST RADIUS. How much damage if wrong. Higher impact, stricter verification. Any failure patches before sending. Never ship with a known defect. #Escalation triggers Any one of these lifts a 1-pass job to 2 or more: high stakes, high ambiguity, a conflict between what the model remembers and what it retrieved, cultural or audience dependence, temporal drift, a permission boundary, sensitive data, elevated autonomy, or weak confidence in the model's own answer. Part 3: running it across a multi-model setup The single-model version externalizes the attack to the model's own second pass. A multi-model setup can externalize it for real, which is stronger, because the critic does not share the author's blind spots. - AUTHOR: one model drafts. - CRITIC: a different model, ideally a different family, runs Step 2 only. Give it the draft, the attack questions, and the shared evidence pool. Never the author's reasoning. Reasoning leaks conclusions and the critic starts agreeing. - REPAIR: back to the author, with the critic's findings as input, not as instructions. The author may reject a finding but must say why. - JUDGE: a third model resolves author-critic deadlock, and only deadlock. A judge invoked on every item becomes a rubber stamp. Two rules keep this from degrading: - Evidence open, verdict blind. Blindness applies to conclusions, never to evidence. Sharing the evidence pool is pure gain: three reviewers independently re-fetching one corpus is waste, and a second reviewer checking a first reviewer's quote is the cheapest error detection in the system. - Consensus is not correctness. Three models trained on overlapping data agree on the same wrong answer routinely. Treat unanimous agreement on a high-stakes item as a signal to check the premise, not as a pass. Only a run that reaches CRITIC here earns SECOND_MODEL at Step 4. A run that never leaves Parts 1 and 2 caps at SELF_READBACK no matter how many self-attack passes it ran. Anti-patterns 1. Running the loop without the substrate. Catches logic errors, misses unit errors, tone problems, and blast radius. 2. Running the substrate without the loop. Notices problems, never systematically repairs them. 3. Skipping both on tasks labeled routine that are actually high stakes. Client-facing messages, financial claims, and rule edits are never routine. 4. Running 3 passes on genuinely trivial output. Scale to stakes. 5. Declaring "attack survived" without running an attack. The single most common failure. The attack step must name specific challenges attempted. 6. Shipping a floor as if it were a target. Quoting the level at which something stops failing and calling it the recommendation. 7. Attacking a conclusion whose premise was never written down. If the draft leans on a named rule, gate, or threshold and the premise audit did not run, the attack tested the argument and not its foundation. 8. Shipping a confidence tier with no verification level, or SELF_READBACK on an item that hit an escalation trigger. Both dress a self-report up as an independent check. Money, credentials, deletions, compliance, security, and third-party promises either reach Part 3 or they cap at SELF_READBACK and say so. Declaration When this fires, declare in the body of the output, not buried at the end: [DEEP-THINK: {N}-pass | Stakes: {routine/standard/high/highest} | Escalation: {trigger or none} | Premise: {N checked / M substitutions, or n-a} | Optimality: {FLOOR/TARGET/n-a} | Confidence: {HIGH/MEDIUM/LOW} | Verification: {SELF_READBACK/SECOND_MODEL/THREE_MODEL}] Verification defaults to SELF_READBACK. A declaration with no corresponding artifact in the body is a failed run, not a passed one, and a SECOND_MODEL claim with no critic output to point to is the same failure: the tag claimed a check that didn't happen. OUTPUT The answer, the declaration line below in the body of the reply, the named challenges the attack tried, what was repaired, and a confidence tag that states who checked. WORKED EXAMPLE (fictional) Task: "Draft a note telling the Brightloop team the backup job can be deleted on Friday." Draft: Delete the nightly backup job Friday, it duplicates the weekly one. Premise audit: fires, because the draft leans on a named policy, "Retention Rule 4". Quote from the policy page: "Keep one daily backup for 30 days." The draft treated it as "keep one weekly backup." Paraphrase substitutions found: 1. Attack: What if the weekly job is not the same data set? What did I assume without evidence about Friday? If this is wrong, who notices first? (Whoever needs to restore Monday's file.) Repair: Hold the deletion, ask the owner to confirm the two jobs cover the same data, and cite the policy wording as written. [DEEP-THINK: 2-pass | Stakes: high | Escalation: deletion | Premise: 1 checked / 1 substitution | Optimality: n-a | Confidence: MEDIUM | Verification: SELF_READBACK] Because this hit a deletion trigger, a second independent model should review it before anyone acts. The full agent-safety and approval-gate system is the premium upgrade, Agent Guardrails Pro. Version 1.1, 09-30-2026 David Solomon, Superstar AI, superstaragency.ai Licensed for your personal and internal business use. Please do not resell or redistribute. Copyright 2026 David Solomon, Superstar AI.