# ADR-002: Controlled Agent Delegates Validation To System Boundaries

- Status: Accepted
- Date: 2026-07-29
- Source: User clarification in the current session

## Context

The ARR data-processing Agent is a dedicated Agent that accepts only business-system messages from a fixed,
controlled entrypoint. Earlier Main Prompt revisions repeated contract, attachment, identity, hash and source
checks already enforced by ARR code. A manual SuperAgent chat test also encouraged chat-input rejection logic,
even though that entrypoint is outside the production contract.

The implementation already has three authoritative boundaries:

1. `ProcessingRequest` and `OssProcessingMessageBuilder` validate and construct the fixed PROGRAM_INPUT.
2. `arr-opera-daily-ingest` owns deterministic business processing and output validation.
3. ARR MCP validates the grant and payload, independently replays the source XML, and commits in a database
   transaction.

## Decision

1. Main Prompt trusts PROGRAM_INPUT supplied by the controlled ARR entrypoint and does not repeat field,
   attachment, source, identity, hash or Schema validation.
2. The Agent performs only fixed orchestration: one OSS fetch, one Skill run, one result read, at most one MCP
   submission, and one final output.
3. Processing failure does not call MCP. MCP `committed` or `already_committed` remains the only successful
   submission outcome recognized by the Agent.
4. Manual chat-upload behavior is not a production acceptance criterion. End-to-end testing starts at ARR Web
   or the equivalent controlled business-system entrypoint.
5. If the Agent is ever exposed to untrusted/general inputs, validation must be added at the API/gateway boundary
   and this decision revisited; prompt prose must not be treated as the security boundary.

## Consequences

- The Main Prompt is shorter and avoids redundant LLM work and token/latency overhead.
- Business and security validation remains deterministic in code rather than probabilistic in the Agent.
- The fixed entrypoint and its access controls become an explicit operational prerequisite.
- Direct SuperAgent chat tests may be useful for isolated Skill experiments but cannot prove or invalidate the
  production ingestion flow.