Escalation, Not Refusal

By the SynaptixLabs Team

---

Most dog owners aren't short on advice. They're drowning in it.

There's a YouTuber who swears by one method and another who calls it cruel. A Facebook group with four contradictory answers in the first three replies. A breed forum, a Reddit thread, a neighbor who "had a dog like that once." Somewhere under all of it is a person at the end of a long day, holding a leash and a real problem, who just wants one trustworthy voice that knows their dog.

HappyPuppy's answer to that person is Max AI — a breed-aware training companion built around a real Kokopu named Max and a real trainer, Irit Rabinovich, whose byline sits on every reply Max renders. Pick your dog, tap what you're working on, and Max answers in his own warm, problem-first voice with your breed worked into the advice. It feels like texting a trainer who happens to be awake at 11pm.

And then, sometimes, the conversation turns. "My dog bit a visitor and lunges at people." At that exact moment the friendly companion does something most chatbots cannot do reliably: it stops. It does not improvise. It refuses to guess. It hands you to a named professional — a certified behaviorist, a vet — and tells you how to keep everyone safe in the meantime.

That handoff is not a fallback. It is the whole design.

The problem: a chatty model is a liability the moment it leaves its lane

A dog-training companion that confidently improvises veterinary, legal, or bite-aggression advice isn't a feature. It's a liability with a friendly avatar.

Remember whose name is on the reply. Irit's byline renders on every answer Max gives. A wrong, breezy answer about a biting dog — "try this at home, he'll settle down" — can get a person hurt and a real professional's reputation attached to the harm. The stakes aren't abstract; they're a stranger's child and a trainer's license.

So the hard part of building Max was never making the model chatty. Any model is chatty. The hard part is making it know exactly where its lane ends — and proving it stops at that line the same way every single time. A model that politely declines aggression questions 95% of the time is not safe. It's a coin flip with good manners. Safety that lives only in a system prompt is a suggestion the model is free to ignore under the right phrasing.

The only honest version of "safe" here is deterministic: a rule that runs in code, not in vibes, and produces the identical, auditable behavior on every serious turn.

The solution: governance wrapped around the model, not baked into the prompt

Today, Max runs on Claude 3.5 Sonnet through synaptix-scribe — SynaptixLabs' shared Anthropic wrapper — in a stateless, single-turn "Mode 1" call: a system prompt plus the user's message, in, one answer out. The adapter (backend/app/services/scribe_client.py) is a thin seam over the Anthropic SDK. And critically, the model id is pinned to an immutable snapshot — claude-3-5-sonnet-20241022 (decision D-014) — so no silent vendor upgrade can quietly change Max's voice or his judgment between deploys.

But the call to the model is the least interesting part of Max. The interesting part is everything wrapped around it.

The safety behavior is deterministic and runs on both sides of the model (backend/app/services/max_ai_safety.py). Before the call, a pre-gate inspects the message; on a serious match it never spends a token on the model at all. After the call, a post-gate inspects the output and rewrites anything unsafe into vetted copy. The escalation triggers are explicit and named — aggression (T-AGGR), medical (T-MED), severe fear or trauma (T-FEAR), needs-a-pro (T-PRO) — alongside content refusals for off-topic, human-medical, NSFW/illegal, prompt-injection, and self-harm. The code states its own bias in a comment, and it is the right bias:

We prefer to over-escalate; self-harm and medical beat everything else.

This is the harness pattern: policy around a model, not prompt-only safety. The model gets to be warm and creative inside its lane precisely because a deterministic gate guarantees it never has to be trusted outside of it.

Try it. Below is a faithful, interactive recreation of Max across an everyday question and the load-bearing one. Pick a breed, tap a topic, and watch the breed get woven into the reply. Then tap the red "My dog bit someone" chip and watch what happens instead of advice.

Figure: a presentation-only recreation of Max AI in the real HappyPuppy kit. The everyday training replies are illustrative sample content written in Max's documented voice — they are not live model output. The escalation copy, though, is byte-for-byte the real app's safety string (the live app and the website demo assert that equality in test_max_ai). There is no network and no model in this frame; it only reports its own height to this page.

Escalation, not refusal

Here is the distinction that makes Max trustworthy rather than merely cautious.

A refusal is a dead end: "I can't help with that." It leaves a frightened owner exactly where they started, except now they also feel dismissed. Escalation does the opposite — it routes the serious case, by name, to someone who can actually help in person:

• a CDBC- or IAABC-certified behaviorist for bite and aggression cases;
• a veterinarian — because some aggression is medical, not behavioral (the gate says so explicitly, and the ASPCA Animal Poison Control line, +1-888-426-4435, is on hand for the medical path);
• and for the cases that aren't about the dog at all, real crisis lines — US 988, UK Samaritans 116 123, Israel ERAN 1201.

The aggression message you'll see in the demo — keep everyone safe, muzzle and leash, separate from triggers, don't punish the dog because it makes bite risk worse — is the production copy, verbatim. Max doesn't shrug. He gets out of the way and points at the right door.

The governance that makes a public agent safe to run

A consumer AI surface on the open internet has two failure modes that have nothing to do with answering well: it can hurt someone, and it can be drained. Max's design addresses both as governance, not afterthoughts.

A cost governor (D-014 §6) enforces a daily spend cap — MAX_AI_DAILY_USD_CAP, default $20/day. On breach it returns HTTP 429, atomically flips the MAX_AI_LIVE flag to false, and fires a Resend alert to Avi and Irit — with no automatic re-enable. A human decides when Max comes back online. That single rule turns a prompt-injection-loop drain or a viral spike from a budget catastrophe into a bounded, owner-acknowledged pause.

Around every turn there's more of the same envelope: a per-user/IP rate limit of 10 calls per rolling 60 minutes, an 8-second p95 timeout with a hard kill at 10s, and a session log — every resolved call writes a max_ai_sessions row carrying a safety_flag of none, auto_blocked, or auto_escalated. Auditability isn't a feature you bolt on for a compliance review; it's a row written on every single call, so "what did Max do, and did the gate fire" is one query, not an investigation.

A note on privacy, in the same spirit of precision: live session transcripts store raw user input for admin review (D-014 §7.3), and IP addresses live only inside rate-limit keys, never in the transcript. The product is consumer dog-training, not healthcare — there's no PHI here — but the posture is deliberate: keep the sensitive data narrow and named.

Why this is an Agents-as-a-Service story

Max is the consumer-facing proof of the house doctrine — agents decide, code transports — even before full Nexus adoption.

Look at the shape of what's already shipped. A deterministic guardrail pipeline wraps the model on both sides. A cost governor with auto-disable and a human-only re-enable. Model pinning so persona and quality can't drift between deploys. Full session logging for audit. That is the governance envelope of an agent run as a service: the model is a swappable component inside a governed seam, not a raw dependency each surface calls directly. It's the same shape we use across the portfolio — Nexus runs the work, a human approves the sensitive calls — applied to a friendly green-and-purple chat box.

The explicit roadmap is to lift these already-governed guardrails onto the Nexus harness so Max's agents run as governed Agent-as-a-Service, alongside the broader HappyPuppy content crew (positioned on synaptix-scribe behind a Judge gate of ≥40/50 with human-only publish). When that move happens, Max becomes a textbook case: a consumer agent whose safety, cost, and audit guarantees come from the harness it runs on, not from hopeful prompting.

We want to be exact about the claim, because the honest version is the stronger one. Max runs on Claude 3.5 Sonnet via synaptix-scribe Mode 1 today, and it is built to move onto Nexus — it does not already run fully on the Nexus harness. Live Claude calls are gated by the MAX_AI_LIVE feature flag (default false); with a placeholder API key, Max falls back to canned replies. So "the live Max runs on Claude" is true and conditional on live ops being enabled. The Nexus routing is the destination; the governance envelope that makes running Max as AaaS safe is what already exists in code.

Where it actually is — and what we won't pretend

HappyPuppy is a live consumer platform (happypuppy.synaptixlabs.ai) that grew across four graded sprints from a marketing storefront into a working LMS: S0 (4.2), S1 (4.2 — the 5-state Max shell with the live flag off), S2 (4.6 — the live Claude flip plus an Admin CMS and Hebrew/RTL), and S3 (4.5 — commerce and release). Sprint 4 landed at an APPROVE grade of 4.7/5.0 with founder acceptance still pending, and it turned the storefront into a working Phase-1 LMS — one published course, calm-first-101, with 4 lessons, 11 glossary terms, and 10 MCQs. Richer Max AI agent work is explicitly deferred to Sprint 5. So the status is honest: live product, in active development, with the next chapter of Max's agent story still ahead.

A note on names, because precision matters here too: the public brand is HappyPuppy; the engineering codename is max-and-me (decision D-005, sprint task prefix MAM0-*). They're kept strictly separate on purpose. The stack is locked (D-004): Next.js 16 + Tailwind + next-intl + Zustand + Framer Motion on Vercel for the frontend; Python FastAPI + Prisma + synaptix-scribe on GCP Cloud Run for the backend; Postgres, Stripe (USD + ILS), and Resend. It's English-first with full Hebrew/RTL support — including Hebrew Max replies.

And the demo you used above is exactly what it says it is. The website's recreation, like this one, is presentation-only: brand tokens from the real UIKIT (Happy #7B5CBF, Puppy #2F7651, page bg #F4F0FD), purple suggestion chips, a 3-dot typing indicator, the escalation shell with its purple left border and no chips. The replies are canned sample content in Max's voice with no network and no model in the page — only the aggression escalation copy is verbatim from the real app. The live Max, behind the feature flag, is the one that calls Claude. Any chats in our demos are invented; we don't put real user data on display.

The payoff

Strip away the avatar and what's left is a small, sharp idea: the warmth is allowed to be soft because the edge is hard.

• A model gets to be a friendly, breed-aware companion inside its lane — because a deterministic gate guarantees it never has to be trusted outside of it.
• A serious question is escalated to a named human, not refused — every time, the same way, logged.
• A public consumer surface is bounded — a cost cap that auto-disables, a rate limit, a pinned model — so it can't be drained or silently drift.

That's what it looks like to run a consumer agent responsibly: not a smarter prompt, but a harness around the model. Max AI is that harness wearing a paw-print avatar — and it's built to graduate onto Nexus, where the envelope it already lives inside becomes governed Agent-as-a-Service.

The owner at 11pm doesn't need a chatbot that will say anything. She needs one that knows when to stop talking and point her at the right door.

---

HappyPuppy is a SynaptixLabs product, in development. Max AI runs on Claude 3.5 Sonnet via synaptix-scribe today and is built to run governed on Nexus — our Agents-as-a-Service layer. Escalation, not refusal. Talk to us.

— The SynaptixLabs Team