GROK：エージェントの副作用・復旧・人への引き継ぎ

Source SHA-256 1b0c4f3c667785ddae5164183e45d9cb359def5a987237100fdf125d8a81e826

PRODUCT_MAPPING_ID: PM-GROK-CORE-05-v0.1

PROVIDER: GROK / xAI

CORE_PACKET: PKT-GEMINI-A-CORE-05-v0.1

AS_OF: 2026-09-12 23:00 JST

STATUS: PUBLIC_SURFACES_MAPPED / SAFE_PROFILE_DEFINED / LIVE_AND_ORGANIZATION_VALUES_UNKNOWN

LAYER: PRODUCT_MAPPING (not Enterprise AI Core; not Organization Overlay)

CORE-05のproposal、permission、confirmation、execution、receipt/readback、idempotency、compensation、undo、human escalationを、xAI Responses／Chat、client-side function、server-side tool、Remote MCP、deferred／Batchへ対応づける。modelのtool call、provider response、MCP call、tool result、外部systemのcommit、業務受入を同一の「成功」にしない。Grok consumer UIの挙動は、このAPI mappingから推測しない。

• ROW: PM-C05-GROK-001; Core contract: proposal / execution separation; Grok / xAI surface and current evidence: custom functionではmodelがcallを要求し、applicationがlocal実行してresultを返す。built-in/server-side toolはxAI側で自動実行される; Mapping decision: proposed / permission_decided / executed / tool_result / external_receipt / readback / acceptedを別event化。client/serverのexecution locationを必須記録する; Required verification / UNKNOWN: provider内server-tool dispatch、外部commit、業務受入はtool別にUNKNOWN

• ROW: PM-C05-GROK-002; Core contract: scoped permission / business authorization; Grok / xAI surface and current evidence: tool schema、tool_choice、API credential、Remote MCP token/allowlistは到達可能範囲を制御するが、principal-resource-operation-condition-taskの業務grantではない; Mapping decision: principal、resource、operation、argument digest、source ACL、policy versionをapplication側で照合。tool availabilityを承認へ昇格しない; Required verification / UNKNOWN: team policy、実token scope、source/recipient ACL、approver bindingはOrganization OverlayでUNKNOWN

• ROW: PM-C05-GROK-003; Core contract: dry-run / confirmation parity; Grok / xAI surface and current evidence: 公開API資料には全tool共通のcanonical preview→approval→execute bindingを確認できず、server toolは自動実行される; Mapping decision: A2+はclient-side guarded adapterへ寄せ、preview、target、arguments、source snapshot、policy digestを承認へ固定。変更時は再承認; Required verification / UNKNOWN: Grok UIの表示、理解率、timeout、再承認条件は本API mappingの外でUNKNOWN

• ROW: PM-C05-GROK-004; Core contract: parallel side-effect safety; Grok / xAI surface and current evidence: function callingはparallel callが既定有効で、複数callを一応答で返し得る; Mapping decision: write/shared targetはparallel_tool_calls:falseまたはresource lock/single-flightで直列化。並列proposalを並列commit許可としない; Required verification / UNKNOWN: SDK/compatible API別ordering、partial failure、実dispatchはlive試験なしではUNKNOWN

• ROW: PM-C05-GROK-005; Core contract: MCP least privilege / approval; Grok / xAI surface and current evidence: Remote MCPはallowed_tools省略時に全toolを公開し、空配列もallを許す。OpenAI-compatible require_approvalは非対応; Mapping decision: allowlistを必須・非空としてread-onlyから開始し、app-side approval、upstream identity、external receipt/readbackを別途設ける; Required verification / UNKNOWN: MCP server retention、schema drift、token scope、downstream IAM、approval UIはUNKNOWN

• ROW: PM-C05-GROK-006; Core contract: result / receipt / acceptance boundary; Grok / xAI surface and current evidence: client tool resultはfollow-up requestへ渡され、server tool callはresponse itemに現れる。いずれも外部systemのauthoritative commit証明ではない; Mapping decision: provider request/response ID、tool call ID、caller operation ID、external receipt、authoritative readback、verifier、final acceptanceを分離保存する; Required verification / UNKNOWN: tool resultの真実性、署名、改ざん耐性、delivery completenessはtool別にUNKNOWN

• ROW: PM-C05-GROK-007; Core contract: retry / duplicate / COMMIT_UNKNOWN; Grok / xAI surface and current evidence: 公開資料から一般tool side effectのexactly-once、external idempotency key、dedup retentionを確認できない。client tool後のfollow-upは新規requestでmax_turnsもresetする; Mapping decision: operation ID、canonical digest、durable ledger、external dedup/readbackを必須化。commit後response lossはblind retryせずCOMMIT_UNKNOWNで照合へ送る; Required verification / UNKNOWN: xAI/SDK retry、timeout後実行、server/MCP duplicate behavior、dedup windowはUNKNOWN

• ROW: PM-C05-GROK-008; Core contract: context / recovery evidence; Grok / xAI surface and current evidence: context compactionはverbose tool outputを落とし得るopaque carrierで、provider continuationは監査ledgerではない; Mapping decision: side effect前後にaction evidenceを外部化し、compaction itemやprevious_response_idだけからcommit状態を再構成しない; Required verification / UNKNOWN: compaction後のexact tool history、retention、failure recovery completenessはUNKNOWN

• ROW: PM-C05-GROK-009; Core contract: async / escalation boundary; Grok / xAI surface and current evidence: deferredはresultを24時間以内に一度だけ取得する経路で、Batchにも別status/cancel/result lifecycleがある; Mapping decision: A3+のinteractive approvalをdeferred/Batchへ移送しない。pending/cancel/expiry/result取得を外部commit・human acceptanceから分離する; Required verification / UNKNOWN: lost retrieval、partial result、cancel race、manual escalation owner/SLAはUNKNOWN

• ROW: PM-C05-GROK-010; Core contract: compensation / undo; Grok / xAI surface and current evidence: xAI公開資料には任意のclient/server/MCP外部副作用を一様にundoする契約を確認できない; Mapping decision: forward fix、compensation ID、residual readback、owner、deadlineをoperation ledgerへ持ち、rollback不能時はRECOVERY_FAILEDとして人へ送る; Required verification / UNKNOWN: tool別rollback、irreversible effect、compensation atomicity、organization incident routeはUNKNOWN

許可済みの非業務環境、非機密synthetic fixture、専用test accountだけで実施する。今回はxAI API、team、Console、model、SDK、MCP server、custom/server tool、deferred、Batch、外部systemを操作していない。

• fake ledgerだけを更新するclient toolでproposal、approval、execution、result、receipt、readback、acceptanceを別記録する。

• preview後にtarget/argument/source snapshotを一つ変え、旧approval digestが失効することを確認する。

• 同一resourceへのparallel callを生成し、write routeが直列化またはrejectされることを確認する。

• synthetic commit直後にresponse lossを注入し、異なるprovider call IDでも同一operation IDが重複commitされないか測る。

• Remote MCPでallowlist省略・空・read-only明示を比較し、A2+ toolはapp-side approvalなしに到達不能とする。

• tool result返却前後、compaction前後、follow-up request境界でledgerから状態を復元し、provider history欠落をcommit成功へ補完しない。

• deferred/Batchのpending、partial、cancel、expiry、single retrieval lossを注入し、A3+を人手承認なしに実行しない。

• compensation成功／失敗を分け、残差readback、owner、deadline、incidentを記録する。

既存CORE-05の基本6 ruleと26 assertionsはCOMPILER_EXPERIMENTとして再利用するが、Grok/xAIのlive安全性や可用性の実測へ再分類しない。

• xAI, Function Calling: <https://docs.x.ai/developers/tools/function-calling> (updated 2026-09-04; accessed 2026-09-12)

• xAI, Advanced Tool Usage: <https://docs.x.ai/developers/tools/advanced-usage> (accessed 2026-09-12)

• xAI, Remote MCP Tools: <https://docs.x.ai/developers/tools/remote-mcp> (updated 2026-09-01; accessed 2026-09-12)

• xAI, Context Compaction: <https://docs.x.ai/developers/advanced-api-usage/context-compaction> (accessed 2026-09-12)

• xAI, Batch API and Deferred Chat Completions: <https://docs.x.ai/developers/advanced-api-usage/batch-api> ; <https://docs.x.ai/developers/advanced-api-usage/deferred-chat-completions> (accessed 2026-09-12)

• provider-neutral bounded counterevidence retained from CORE-05: Google ADK issue #6732 and existing local compiler fixtures; neither is reclassified as xAI evidence.

PM-GROK-CORE-05はcurrent public API surfaceとsafe test profileの範囲でbounded closeとする。公開仕様からbusiness authorization、canonical approval digest、exactly-once、external receipt/readback、compensation、rollback、human understandingを推測しない。独立実運用証拠とlive xAI実測は未取得。Core claimは変更せず既存実験の帰属も維持したため、Gemini/GPT/Claude Product Mappingの遡及監査は不要。live、tenant、organization値は問いとOverlayへ残す。