Partial Agent Structural Validity: Fewer Fields, Still Deterministic

Mechanism

A canonical agent object is defined by its schema as having a fixed set of fields, each with a declared type and a declared presence requirement. Conventional schema systems treat presence as binary: a field is either present and conformant or the object is invalid. Partial validity replaces this binary with a three-valued model in which each field is either present and conformant, declared absent with a gap descriptor, or absent without declaration. Only the third state produces invalidity; the first two states are both admissible and are distinguished structurally rather than by convention.

A gap descriptor is a typed structure carried in place of a missing field's value. It contains a gap reason code drawn from a schema-declared enumeration, an optional pointer to a producer of the eventual value, an optional expiry after which the gap is considered stale, and a coherence assertion stating that the gap's presence does not violate any schema-level invariant whose evaluation depends on the missing field. The gap descriptor is itself part of the canonical record of the instance and is committed to lineage exactly as a field value would be.

Coherence thresholds are schema-level declarations that constrain which combinations of present and gapped fields are admissible. A coherence threshold may, for example, declare that a particular pair of fields must be either both present or both gapped, or that at least three of six fields must be present, or that a specific field's presence is required whenever a specific other field is gapped. Coherence thresholds are evaluated as part of the same deterministic validation pass that evaluates field interaction rules, and their violation produces refusal under the same scope semantics described in the field interaction rules disclosure.

A consumer reading a partial instance receives both the present field values and the gap descriptors as structurally distinct elements. The schema reference embedded in the instance specifies, for each field, whether the value-or-gap status is exposed to read-only consumers or restricted to consumers holding additional capabilities. This per-field exposure control allows partial instances to participate in cross-organization workflows without leaking the existence of fields whose mere presence would itself be sensitive.

Gap fill is a transition that replaces a gap descriptor with a conformant field value. The transition is governed by the same rule set that governs any other field write, with one additional structural requirement: the transition must reference the gap descriptor it replaces and must record, in the lineage event, the identity of the producer that supplied the new value, the time at which the value was supplied, and any auxiliary attestation that the producer chose to include. This gap-fill audit trail is mandatory; a gap-fill transition that omits any of these elements is refused.

Operating Parameters

The operating envelope of partial validity is characterized by four parameters: the minimum field count, the gap reason vocabulary, the gap expiry window, and the gap-fill audit retention horizon. The minimum field count is a schema-level declaration of the smallest number of canonical fields that must be present for an instance to be admissible at all; it bounds the degree to which an instance may be reduced before it ceases to convey enough structure to be useful. The minimum may differ across schema profiles and may be raised in subsequent schema versions, with version-aware migration governing the transition.

The gap reason vocabulary is the enumeration of allowed reason codes that a gap descriptor may carry. The vocabulary is itself part of the schema and is content-addressed, meaning that the introduction of a new reason code produces a new schema version. Reason codes typically distinguish between "not yet known," "withheld by policy," "not applicable in this profile," and "deferred for performance," among others; each code carries declared semantics that consumers may rely on without inspecting the producer's intent.

The gap expiry window, where supplied, bounds the time during which a gap may remain unfilled before the instance becomes structurally stale. A stale instance is not invalid but is admissible only for a restricted set of operations declared by the schema; common restrictions include refusing the instance as an input to derivations that would propagate the gap into downstream artifacts. Expiry is measured against a monotonic clock committed to lineage rather than against wall-clock time, ensuring that staleness determinations are themselves deterministic.

The gap-fill audit retention horizon specifies the minimum duration for which gap-fill events must remain accessible in the lineage record. Conforming runtimes may compact older lineage segments but must retain gap-fill events for at least the declared horizon, and may retain them indefinitely. The horizon is set per schema and is typically aligned with the longest regulatory retention obligation that the schema's intended workflows are expected to encounter.

Performance characteristics are favorable. The marginal cost of admitting partial instances over an all-or-nothing model is the cost of carrying gap descriptors and of evaluating coherence thresholds whose inputs include gap status. Both costs scale linearly with the number of declared gaps and are independent of the size of present field values. The audit retention horizon imposes storage cost proportional to the rate of gap-fill events, which in typical workflows is small relative to the rate of ordinary field writes.

Alternative Embodiments

In a first embodiment, the gap descriptor carries an opaque commitment to the eventual field value rather than a typed reason code; this commitment is later opened by the producer during gap fill and verified by the consumer against the original commitment. This embodiment is useful when the schema requires that the producer have committed to a specific value at the time the gap was created, even though the value is not yet released.

In a second embodiment, gap fill is permitted only by a producer whose identity matches the producer pointer recorded in the original gap descriptor. This restriction is enforced structurally by the schema rather than by external access policy, ensuring that the correspondence between gap creator and gap filler is part of the deterministic validation pass. This embodiment is suited to workflows in which the right to supply a missing value is itself a contractual position.

In a third embodiment, multiple gap descriptors may share a coherence group such that all gaps in the group must be filled in a single transition or none. This embodiment supports atomic completion of related fields and is useful in workflows where partial completion of a coherence group would produce an instance that, while structurally admissible, is semantically misleading.

In a fourth embodiment, the gap descriptor includes a derivation function that produces a default value from the values of present fields, allowing consumers that do not require the canonical value to operate on a deterministic derivation while preserving the gap status for consumers that do. The derivation function is constrained by the same expression grammar as field interaction rule predicates, ensuring that derivations are deterministic and total.

In a fifth embodiment, expired gaps may be auto-converted to a distinct "abandoned" status that is structurally distinct from both "present" and "gapped." Abandoned status is irreversible and prevents subsequent gap fill, ensuring that downstream consumers can rely on the absence of the field rather than continuing to defer derivations in anticipation of an eventual fill.

Composition With Other Schema Capabilities

Partial validity composes with field interaction rules by allowing rule predicates to inspect gap descriptors as inputs alongside field values. A rule whose participating field is currently gapped may be configured to skip evaluation, to refuse the gap as itself a violation, or to evaluate the rule against the gap's reason code and any derivation function it carries. This three-way choice is part of the rule declaration rather than a runtime decision.

Partial validity composes with lineage commitment by recording gap creation, gap expiry, gap fill, and gap abandonment as distinct event types in the lineage record. Each event type carries its own structurally-required fields and is cryptographically committed exactly as ordinary write events are, ensuring that the gap history of an instance is as auditable as its value history.

Partial validity composes with schema versioning through gap-aware migration. A schema migration that adds a new field declares whether existing instances are migrated with the new field gapped, with a derived default, or with the migration refused for instances that do not supply the new field's value. A migration that removes a field declares whether existing values become abandoned gaps or are dropped from lineage. These choices are part of the migration declaration and are evaluated deterministically.

Partial validity composes with access policy by allowing per-field exposure of value-or-gap status to be governed by the same policy fields that govern read access to values themselves. A consumer without read capability for a particular field may still observe whether the field is present or gapped, or may be denied even that observation, depending on the policy's exposure declaration.

Distinction From Prior Art

Conventional schema systems address missing data through three mechanisms: nullable fields, optional fields, and sparse representations. Nullable fields allow a value to be explicitly null but do not distinguish between "known to be absent" and "not yet known"; the consumer cannot tell which interpretation applies and must rely on out-of-band conventions. Optional fields allow a field to be absent from the serialized form but offer no structural carrier for the reason of absence and no audit of subsequent fills.

Sparse representations, common in document databases and key-value stores, treat any absent key as undefined and offer no schema-level guarantee that absence is intentional. None of these mechanisms supports a typed gap reason vocabulary, a coherence threshold model, a mandatory gap-fill audit trail, or deterministic interaction with cross-field validation rules. The capability described here differs from prior art by providing all of these elements as a single structural primitive whose evaluation is deterministic and whose history is committed to lineage.

Disclosure Scope

This disclosure encompasses the admission of agent objects with fewer than all canonical fields when each absent field carries a typed gap descriptor; the use of schema-declared coherence thresholds to constrain admissible combinations of present and gapped fields; the use of a content-addressed gap reason vocabulary versioned with the schema; the use of monotonic-clock-bound gap expiry and abandonment; the mandatory recording of gap-fill events in lineage with producer identity, time, and attestation; the per-field control of value-or-gap exposure to consumers; the embodiments employing opaque commitments, identity-bound gap fill, coherence groups, derivation functions, and irreversible abandonment; and the composition of partial validity with field interaction rules, lineage commitment, schema versioning, and access policy. Variations in the surface form of the gap descriptor, in the choice of monotonic clock, and in the encoding of audit attestations fall within the scope of this disclosure provided they preserve the deterministic validation and audit properties described in the mechanism and operating parameters sections.