Capability Envelope Negotiation

Mechanism

Negotiation is initiated when an agent's planner detects that a candidate plan touches a region of workspace, a shared resource, or an authority scope that is also covered by another agent's published envelope. The detection is structural: it is a set intersection between the canonical envelope projections of the agents involved, evaluated at the named version hashes. The agent does not begin negotiation because something feels contested; it begins negotiation because a deterministic intersection function returned a non-empty set.

The negotiation message is itself a structured record. It carries the requesting agent's identifier, the envelope version it is operating under, the specific projection of its envelope that triggered the negotiation, the proposed assignment of the contested scope, the duration for which the assignment is requested, and the priority tier the request is filed under. The receiving agent evaluates the request against its own envelope, its own pending plans, and the policy reference that governs the shared cell. The evaluation produces one of a small set of structured responses: accept, counter-propose, defer, or refuse-with-reason.

Counter-proposals are themselves structured records that name the dimension of the original proposal they modify, the new value they propose, and the rationale field that cites the policy clause justifying the modification. A negotiation may proceed through several counter-proposals, but the protocol is bounded: a maximum round count is declared in policy, and exceeding it forces a tier-break. The tier-break consults the priority field on each request, and within a tier consults a deterministic ordering derived from agent identifier and the wall-clock-independent timestamps in the request records. Two agents at the same tier with the same request never both win; the deterministic ordering produces a unique winner.

Cycle-freedom is enforced by construction. Every negotiation message carries the dependency graph of the negotiations it is waiting on, and an agent is forbidden from emitting a request whose dependency graph would close a cycle with its own pending requests. The check is local because each agent already holds the dependency information it needs to refuse a cycle-creating message. Agents that detect they are in a would-be cycle invoke the tier-break immediately, dissolving the cycle before it forms.

Grants are themselves first-class records. A successful negotiation produces a grant object naming the granting agent, the receiving agent, the contested scope, the duration, the effective version of each party's envelope at the moment of the grant, and the policy clauses that authorized it. The grant is the artifact that the receiving agent's planner cites at commitment time; without a current grant covering the contested scope, commitment is structurally blocked. Grants expire by their declared duration, by an explicit revocation message, or by an envelope-version change at either party that invalidates the assumptions under which the grant was issued. Expiration is deterministic and observable; nothing about a grant is implicit.

Revocation is symmetric with grant. A revoking party emits a structured record naming the grant being revoked and the policy clause that authorizes the revocation. The receiving agent must acknowledge the revocation, abandon any in-flight commitment that depended on it, and return to a state in which it holds no claim on the contested scope. The acknowledgement and the resulting state transition are logged, so a reviewer can confirm that no agent continued to operate on revoked scope.

Operating Parameters

Tier assignments are declared in the policy reference rather than discovered at runtime. Each agent is provisioned with one or more tier memberships, possibly per dimension; an agent may be tier-A for safety-critical scope and tier-B for throughput scope, and the negotiation framework consults the appropriate tier per dimension of the contested envelope. Tier assignments are versioned and auditable like the envelopes themselves.

A timeout parameter governs how long an agent will wait for a response before treating silence as refusal. A round-cap parameter governs how many counter-proposals are exchanged before forcing a tier-break. A grant-duration parameter caps how long any single negotiation can assign scope; longer-running coordination must be re-confirmed periodically rather than locked in indefinitely. A reservation parameter allows an agent to hold scope across a planned multi-step operation without renegotiating between steps, at the cost of a stricter justification requirement in the request record.

A reasons-vocabulary parameter constrains what may appear in the rationale field. Free-text justifications are not permitted; rationales must cite identifiers from a declared vocabulary of policy clauses and envelope dimensions. This constraint is what makes the negotiation log mechanically analyzable rather than merely human-readable.

A pre-emption parameter governs whether higher-tier requests may interrupt active grants held by lower-tier agents. Pre-emption is structurally similar to revocation but originates from the protocol itself rather than from the granting party, and is admitted only for dimensions and tiers explicitly tagged as pre-emptible in policy. A pre-empted agent receives the same structured notification as a revocation and follows the same return-to-no-claim procedure; the additional record marks the pre-emption as protocol-initiated and names the pre-empting request.

A confidentiality parameter controls how much of the envelope projection is exposed in negotiation messages. In competitive multi-tenant deployments, an agent may be required to negotiate without revealing its full envelope to peers; the protocol admits redacted projections accompanied by attestations from a trusted authority that the redacted projection accurately covers the contested scope. Redaction does not weaken the audit properties because the un-redacted envelope and the attestation are both retained in the lineage available to authorized reviewers.

Alternative Embodiments

The same protocol applies whether the negotiating parties are two embodied robots sharing a cell, two software agents sharing a tool quota, or an agent and a human supervisor sharing decision authority over a sensitive operation. In the human-in-the-loop case, the supervisor's envelope is the set of authorities they hold and the policy clauses they may invoke; their counter-proposals are entered through a structured interface rather than emitted by a planner, but they take the same shape and enter the same lineage.

Negotiation may be peer-to-peer or mediated. A mediator agent, often a cell-level coordinator, may centralize the negotiation graph and apply tier-breaks consistently across many simultaneous overlaps. The mediated form is structurally equivalent to the peer-to-peer form; the same records, the same rationales, the same cycle checks apply. The choice between forms is a deployment decision, not a protocol change.

Negotiation can also be predictive. An agent that anticipates a future overlap, based on its own plan and the published forecasts of peers, may open a negotiation in advance and obtain a conditional assignment that becomes active only if the predicted overlap materializes. Conditional assignments carry the same record schema with an additional precondition field.

Negotiation can be n-ary rather than pairwise. When three or more agents publish overlapping envelope projections in a single contested scope, the protocol admits a multi-party request whose response set is the cross-product of the individual responses, evaluated under a multi-party rule declared in policy. The multi-party form preserves cycle-freedom, tier-break determinism, and rationale-vocabulary discipline; it is structurally pairwise negotiation generalized rather than a separate protocol.

Negotiation can be hierarchical. A team-level agent may negotiate on behalf of subordinate agents, holding their envelopes by reference and committing them to grants the team-level agent has secured. The hierarchical form requires the subordinate envelopes to be projected to the team-level agent in a form sufficient for negotiation but not necessarily sufficient for execution; subordinates retain their own envelopes and own admissibility checks at commitment time, providing a structural defense against a team-level agent committing them to operations they cannot perform.

Composition with Other Mechanisms

Negotiation composes with embodied envelopes by relying on their declared projections; it cannot be sound without versioned envelopes to negotiate over. It composes with temporal forecasting by allowing forecasts to drive predictive requests and by allowing forecast revisions to invalidate outstanding assignments. It composes with the lineage system by recording every request, response, counter-proposal, tier-break, and grant under the same canonical schema, so a post-hoc reviewer can replay a contested situation and verify that the outcome was the only outcome the protocol could have produced.

In safety-regulated deployments, the negotiation log becomes part of the safety case. A regulator can confirm that contested scope was always assigned through declared procedures, that no agent acted on contested scope without a recorded grant, and that tier assignments matched the operator's declared policy.

Negotiation also composes with capability-aware planning by exposing a structured failure path: when no acceptable grant can be reached within the round-cap, the planner receives a typed refusal naming the contested dimension and the policy clauses cited by the refusing party, and can use that information to revise the plan, request preconditioning, or escalate to operator review. The revised plan and the negotiation it grew out of are linked in lineage, so a reviewer can trace why a particular plan ended up taking the form it did.

Distinction from Prior Art

Existing multi-agent coordination relies on locking, bidding, market mechanisms, or behavior-based avoidance. Locks produce deadlocks under contention and require external watchdogs to recover. Bidding and markets optimize for declared utility but lack the structural cycle-freedom and audit properties needed for safety-regulated domains. Behavior-based avoidance treats coordination as an emergent outcome of local rules, which makes post-hoc accountability difficult and makes regulatory certification a matter of statistical argument rather than structural proof.

The negotiation protocol disclosed here is structurally different. It operates on named, versioned envelopes; it constrains rationales to a declared vocabulary; it provides deterministic tie-breaking; it forbids cycles by construction; and it produces a complete audit trail under a single schema. Coordination outcomes are reproducible, contested situations are settled by procedure rather than speed, and the protocol's properties are checkable from the lineage rather than inferred from behavior.

Distributed-systems consensus protocols address related concerns, but at a different layer. Consensus produces agreement on a value; envelope negotiation produces agreement on the assignment of a structured scope, with rationales drawn from a policy-declared vocabulary and with grants that carry the envelope-version dependencies under which they are valid. The two layers compose: a consensus protocol can implement the message transport for negotiation in a deployment that requires it, but consensus alone does not produce the structured grants, the tier-break discipline, or the auditable rationales that the negotiation protocol specifies.

Disclosure Scope

This article discloses the message shapes, evaluation steps, tier-break procedure, cycle-freedom argument, and composition properties of capability envelope negotiation as defined in Chapter 6 of the cognition patent. It covers peer-to-peer, mediated, and predictive forms, and identifies the integration points with envelopes, forecasting, and lineage. Specific tier vocabularies, deployment-specific timeout values, and operator-tunable rationale ontologies are reserved for licensee implementation guidance and are not part of this public disclosure.