Shadow mode isn't a trial — it's the whole point

Most security tools ask you to trust them before you can see what they’d do. You turn on enforcement, hope the false-positive rate is low, and find out the hard way when it blocks something you needed.

PinkyAI runs the other way around. Every rule — every one — can run in shadow mode first: observe-only, logging what it would have flagged, never blocking anything. You get a real report, against your own real sessions, before you ever decide whether a rule earns the right to enforce.

Why this matters more for an AI agent than for a human

A human developer notices immediately when a tool blocks something wrong. An AI agent working agentically against your repository doesn’t necessarily stop and complain the same way — it might just try a workaround, or silently give up on a step you needed. If your enforcement rules have a false-positive problem, an agent is often the last one to tell you.

Shadow mode sidesteps that entirely. You watch what would have fired, against real sessions, before enforcement is ever in the loop.

What “turning it on” actually looks like

Enforcement isn’t all-or-nothing. Once a shadow-mode report has convinced you a rule (or a whole category) is trustworthy, you turn just that on — rule by rule, category by category, or everything at once. The rest keeps running in shadow mode until you’re ready.

That’s the whole design. Deterministic rules you can read, a shadow-mode report you can actually evaluate, and enforcement only once you’ve decided it’s earned it — not before.