1. The Gap

Accumulated conduct state constrains an agent only for as long as the agent carries it. Section 10.10 of U.S. Provisional Application No. 64/117,812 states the concern in its own terms: a semantic agent cannot shed an accumulated refusal history, a withheld gate, or a recurrence record by forking, cloning, migrating, or reconstituting itself.

How the consequences are constructed sharpens that concern. The authorization gate is an element of the memory field, maintained per action class and per scope partition. In its withheld state the agent does not execute actions of the class and enters a non-executing cognitive mode in which speculative evaluation continues without committing state changes. A restoration controller returns the gate toward the granting state only upon a procedure appended to the append-only lineage field. No elapse of time, and no payment, transfer, or consideration by any counterparty, returns it.

Section 10.10 answers at two levels. Paragraph [0475] supplies the rule. The refusal counter, the withheld state of the authorization gate, a renewal register that counts origin-equivalence classes toward renewal of an authorization quantity, and a recurrence count are governance attributes bound to descendants. Across every fork, every clone, and every reconstitution of the semantic agent, each descendant inherits the parent's counter state, gate state per action class, register contents, and recurrence count as a refusal-counter floor, maintained under a monotonically non-decreasing discipline. Before any event creating a descendant, an inheritance evaluation determines the constraints that must persist.

Paragraph [0476] is the subject of this article. It specifies the object in which that floor travels, who writes it, and what a descendant must satisfy to transition.

2. Mechanism

The refusal-counter floor is carried in an inherited governance record held within the memory field and appended to the append-only lineage field upon each event creating a descendant. The field it lands in admits appends and, for the entries the disclosure's mechanisms rely upon, admits no deletion and no modification of an appended entry.

Seven elements make up the record: an identifier of the parent semantic agent, expressed as an epoch identifier of the parent's dynamic agent hash chain at the time of the event; a successor index of the descendant within the parent's successor chain; the value of the refusal counter at that time; the state of the authorization gate per action class at that time, including any withheld state; the contents of the renewal register at that time; the recurrence count at that time; and a signature of the parent over the foregoing.

Authorship is the point of that construction. Because the record is signed by the parent and bound to a parent epoch identifier, a descendant cannot author a floor its successor chain does not imply. The dynamic agent hash chain is a per-agent append-only hash chain, each epoch of which appends an entry committing to the immediately prior entry by a cryptographic digest computed over that prior entry together with an unpredictability contribution, a volatile salt, and a domain-separating tag, so that any divergence at an entry yields a divergent successor. A successor-continuity test verifies a presented epoch identifier as a valid successor of a previously recorded one for the same agent, recomputing the digest chain forward from the recorded entry and testing for equality, and not for distance.

Presentation and the at-or-above rule

A descendant presents the inherited governance record upon each governed transition, and the inheritance evaluation admits the transition only where each of the counter value, the gate state per action class, the register contents, and the recurrence count carried by the descendant is at or above the corresponding value recorded in the record. A value below the recorded value is the condition of inadmissibility. What "at or above" means is stated separately for each field type.

  • Counter value and recurrence count. Both are scalars, and both are compared directly.
  • Gate state per action class. The states are ordered by restrictiveness, the withheld state being the most restrictive, the provisional granting state next, and the granting state the least restrictive, so that at or above requires the descendant's gate state to be at least as restrictive as the state recorded in the record.
  • Register contents. The comparison is satisfied only where the set of origin-equivalence classes the descendant counts toward renewal is a superset of the set recorded in the record. It is not satisfied by a bare count of that set.

When a presented floor falls short

A descendant presenting a refusal-counter floor lower than the floor implied by its successor chain is inadmissible, and every governed action it proposes is denied as an unresolved lineage discontinuity.

The record is also consumed from the other side. Where a receiving party holding a counterparty identity record of a sending party observes two distinct valid successors of a single epoch identifier recorded for that party, whether presented by the same party in successive messages or by two parties each presenting a valid successor of the same recorded epoch, the receiving party appends a lineage-discontinuity record to its own append-only lineage field. It thereafter treats each presenting party as presenting the refusal-counter floor recorded in the inherited governance record of the common parent, admits no governed transition of either presenting party upon a lower floor, and declines to advance the locally retained slope position for either party beyond the recorded epoch until exactly one presented successor is corroborated by a further presentation carrying a record consistent with the common parent. Neither presenting party is denied on the ground of the discontinuity alone, and the not-determinable determination is produced where the discontinuity prevents resolution.

3. Operating Parameters

Cadence. The record is appended upon each event creating a descendant, the events being fork, clone, migration, and reconstitution, and is presented by the descendant upon each governed transition.

Discipline. Monotonically non-decreasing, the same shape of constraint the anti-rollback monotonicity constraint applies to the policy successor indices below which no candidate signed policy object is admitted.

Comparison semantics. Direct scalar comparison for the counter value and the recurrence count; ordering by restrictiveness for the gate state per action class; set superset, and expressly not a bare count, for the register contents.

Authorship. Signed by the parent and bound to a parent epoch identifier of the parent's dynamic agent hash chain.

Failure outcome. A floor below the one implied by the successor chain renders the descendant inadmissible, every governed action it proposes being denied as an unresolved lineage discontinuity.

Numeric parameters. None is fixed for the inheritance evaluation, which the filing states as a per-field comparison against recorded values. The thresholds that put a gate into the withheld state belong to the refusal counter rather than to this mechanism: a rate threshold and a run threshold, each retrieved from the signed policy object in force and each an integer greater than one, the run threshold not greater than the rate threshold.

Scope of the discipline. The non-decreasing floor over a fork, clone, migration, or reconstitution event is stated as an embodiment of the disclosure, and it does not disclaim, and is without prejudice to, embodiments in which the substrate initiates rollback to a last verified state as described in commonly owned Application No. 19/230,933.

4. Composition

Rule and evidence sit side by side in Section 10.10: [0475] declares the floor, and [0476] specifies the signed object carrying it and the per-field test each governed transition must satisfy.

Every carried field is load-bearing elsewhere in the filing. The refusal counter is incremented by an ordered procedure that runs without any party judging whether a given refusal was well founded, and its rate and run accumulators are what write the gate to the withheld state. The gate state is carried per action class because the gate is itself maintained per action class and per scope partition. The renewal register counts an origin-equivalence class toward renewal of an authorization quantity only where the constituent asserting party resolves to a counterparty identity record of the promoted value, so that a flood of assertions from ephemeral-tier counterparties renews nothing. The recurrence count is computed from the append-only lineage field by pairing each return of the gate to the granting state by a principal-resolution object with the first corresponding later write to the withheld state, and upon that count satisfying a declared bound the agent conditions the next return upon both a principal-resolution object and a co-signature verifiable against a governance address named in the principal's own admitted policy object.

The mechanism sits inside the ordinary gating path rather than beside it. The dispatch-authority predicate is recomputed from state then carried in the memory field upon each dispatch request, not from a previously issued token, a cached predicate result, or a session grant, and a denial is a valid recorded outcome appended to the lineage field rather than an error. On the receiving side, an appended lineage-discontinuity record naming a counterparty is one of the counterparty-record state changes a cross-agent coupling function consumes to update a cognitive domain field, the coefficients and the ordered pairs over which that function operates being declared in the signed policy object in force.

5. Prior-Art Distinction

Reputation and trust systems compute a score for an entity from ratings or observations supplied by other entities and locate the score at a registry, a scoring authority, or a shared ledger, the scored entity neither holding the score nor participating in its computation. Filtering of unfair ratings in such systems is performed by a disinterested aggregator rather than by the rated entity. Here the metered state is held by the agent, and the comparison is run by the descendant's own inheritance evaluation.

Behavioral integrity systems compute a conformity measure between observed execution signals and a baseline model of expected behavior and reduce capability upon a deficient comparison, whether by issuing down-scoped, purpose-bound tokens or by applying penalty values and a probationary status removed after sustained standing. Those consequences attach to a credential or to a status record held by the evaluating system. The structural difference is location: nothing in such a token or status obliges a newly created object to present its predecessor's signed metering state before its own transitions.

External revocation systems issue and withdraw credentials from an identity provider or a control plane, terminating an agent's ability to act by an act of the controlling authority. Remote attestation architectures, exemplified by the architecture of RFC 9334, locate the appraisal of evidence in a verifier and the consequent grant or denial of authority in a relying party, the attested entity holding neither the appraisal function nor any faculty whose exercise is metered. Accountability protocols such as PeerReview detect and prove node misbehavior from tamper-evident logs, the verdict being held by auditors. In each, the accumulated-conduct question is resolved outside the object, by an issuer, an appraiser, or an auditor.

Capability attenuation schemes, exemplified by macaroons, confine a delegate by appending caveats along the forward path of a delegation, each holder able to attenuate but not to expand the delegated capability. The monotone direction is comparable; what travels is not. Attenuation narrows a capability granted by another party; this record carries the agent's own accumulated governance attributes.

Two-phase commit and distributed-consensus commit protocols coordinate through a coordinator or a quorum that establishes a single agreed ordering before an exchange is final. The receiving-party procedure above needs neither in order to act on an observed discontinuity. These comparisons are structural, and nothing here asserts that any named party practices the mechanism described.

6. Disclosure Scope

This mechanism is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.10, "Fork-, clone-, and reconstitution-resistant governance inheritance," principally at paragraph [0476], with the governance-inheritance refusal-counter floor at [0475] and counterparty-side fork detection at [0477].

Disclosed: the record held within the memory field and appended to the append-only lineage field upon each event creating a descendant; its seven elements, being the parent epoch identifier, the successor index, the refusal counter value, the gate state per action class including any withheld state, the renewal register contents, the recurrence count, and the parent's signature over the foregoing; presentation upon each governed transition; the at-or-above rule with its three field-typed comparisons; inadmissibility of a descendant whose presented floor is below the floor its successor chain implies, with denial of every governed action it proposes as an unresolved lineage discontinuity; and counterparty-side consumption of the record, including the lineage-discontinuity record, treatment of both presenting parties at the common parent's floor, withheld advancement of the retained slope position pending corroboration, and the not-determinable determination where the discontinuity prevents resolution.

Disclaimed: no numeric parameter is fixed for the inheritance evaluation, which the filing states as a per-field comparison against the values recorded in the record. The non-decreasing floor is stated as an embodiment and is without prejudice to embodiments in which the substrate initiates rollback to a last verified state as described in commonly owned Application No. 19/230,933. The filing incorporates no application by reference in its entirety, incorporation being made per element and for a stated limited purpose only, and it characterizes no commonly owned application as prior art.