Composite Admissibility Evaluator

Mechanism

The composite admissibility evaluator is a deterministic aggregation function defined within Chapter 5 of the cognition patent. It accepts as input the outputs of plural independent component evaluators, each of which assesses a distinct dimension of a proposed mutation, and produces a single admissibility determination governing whether the mutation may proceed to execution. The component evaluators operate concurrently and independently, observing the same proposed mutation but applying disjoint analytical methods so that no two evaluators are derived from the same underlying signal.

The statistical evaluator examines the proposed mutation against historical distributional baselines, computing a deviation score relative to expected ranges, prior outcomes, and observed variance. The structural evaluator examines the proposed mutation against schema, type, referential, and constraint requirements declared in the agent's policy reference, returning a structural admissibility score that is independent of statistical likelihood. The lineage evaluator examines the chain of antecedent operations, evidence, and authorizations on which the proposed mutation depends, returning a provenance integrity score that reflects whether the supporting record is complete, consistent, and traceable to admissible sources.

Each component evaluator emits a normalized score within a bounded interval together with a calibration tag identifying the evaluator version, the calibration epoch under which the score was produced, and the policy parameters in effect. The composite aggregation function applies a weighted combination of the component scores using weights drawn from the active policy reference. The weights are themselves bounded: no weight may exceed a configured ceiling, no weight may fall below a configured floor, and the sum of active weights is normalized so that no single evaluator can unilaterally determine the composite outcome. This bounded-weight property is the structural mechanism by which agreement across heterogeneous signals is required rather than encouraged.

The composite output is then compared against admissibility thresholds, producing a determination of admit, defer, or reject. Defer outcomes route the proposed mutation to a secondary evaluation cycle in which additional evidence may be requested, while reject outcomes terminate the mutation and emit a structured rejection record. Every component score, weight, threshold, and determination is recorded in the agent's lineage so that the full evaluation can be replayed deterministically from the recorded inputs.

Operating Parameters

The evaluator is parameterized by a set of declarative configuration values held in the policy reference. The component-weight vector specifies the relative contribution of each evaluator and is constrained by ceiling and floor values that prevent any single evaluator from dominating or being silently disabled. The admissibility threshold specifies the minimum composite score required for an admit determination, while a separate defer threshold defines the band within which secondary evaluation is invoked rather than outright rejection.

Calibration parameters govern how raw component scores are mapped into the normalized interval. Each evaluator carries a calibration curve — typically a monotonic transform with documented anchor points — that translates its native output into the composite's common scale. The calibration curves are held in the policy reference and are subject to mandatory audit: any change to a calibration curve must be accompanied by a calibration audit record identifying the prior curve, the new curve, the validation evidence, and the approving authority. Operation under an unaudited calibration is structurally prohibited; the evaluator refuses to produce admit determinations when the calibration audit record is absent or stale.

Hysteretic margins are applied at the threshold boundaries to prevent oscillation between admit and defer states under marginal inputs. A proposed mutation whose composite score sits within the hysteresis band relative to a prior determination of the same lineage retains its prior determination unless the new score crosses the band fully. Rate-of-change parameters detect rapid trajectory shifts in component scores; sustained negative trajectory across multiple evaluators triggers a precautionary defer even when the instantaneous composite score remains above the admit threshold.

Audit cadence parameters specify the maximum interval between calibration audits, the maximum number of admit determinations permitted under a given calibration epoch before re-audit is required, and the retention period for component-score traces. These parameters are policy-configurable but bounded: minimum audit cadences and maximum retention horizons are enforced structurally so that no policy configuration can disable auditability.

Alternative Embodiments

In a first alternative embodiment, the component evaluators are extended beyond the statistical, structural, and lineage triad to include a behavioral evaluator that compares the proposed mutation against a profile of prior agent behavior, and a counterparty evaluator that incorporates trust scores associated with external sources of evidence on which the mutation depends. The bounded-weight property is preserved by adjusting the ceiling and floor parameters; the aggregation function is otherwise unchanged.

In a second alternative embodiment, the aggregation function is replaced with an order-statistic combiner — for example, a trimmed mean or a median over the component scores — rather than a weighted sum. This embodiment is appropriate where the dominant failure mode is single-evaluator corruption, since order statistics are inherently resistant to a minority of compromised inputs. The calibration audit requirement is unchanged.

In a third alternative embodiment, the composite output is not a scalar admit/defer/reject but a structured admissibility certificate that includes the per-component scores, the weights applied, the thresholds in force, and the calibration epoch identifiers. Downstream stages that consume admit determinations may apply additional policy logic over the certificate, allowing multi-tier authorization regimes in which different classes of mutation require different agreement profiles.

In a further alternative embodiment, the evaluator emits not only an admit, defer, or reject determination but a continuous admissibility score that downstream stages may consume directly to weight the impact of the proposed mutation. Continuous-score consumers are required to honor the same threshold structure as discrete-determination consumers; the policy reference enforces this by binding the continuous score to a derivation rule that yields the discrete determination on demand. In yet a further alternative embodiment, the component evaluators are themselves composite, so that the structural pattern of plural-evaluator independence under bounded weighting is applied recursively. Recursion depth is bounded by policy and is enforced structurally to prevent unbounded composition.

In a fourth alternative embodiment, the evaluator operates in a shadow mode in which determinations are produced and recorded but execution proceeds under a legacy authorization mechanism. Shadow mode is used during calibration onboarding to gather distributional evidence without exposing live execution to a newly calibrated evaluator. The transition from shadow to active mode is itself an audited event recorded in the policy reference.

Composition With Adjacent Mechanisms

The composite admissibility evaluator is positioned between the proposal stage of the agent's cognitive cycle and the execution stage. Upstream, the proposal stage produces candidate mutations together with their supporting evidence; downstream, the execution stage applies admitted mutations to the agent's verified state. The evaluator therefore acts as the structural gate through which all state-affecting operations must pass.

The evaluator composes with the confidence-governance subsystem by consuming confidence-floor signals: when the agent's overall confidence has fallen below a configured floor, the admissibility threshold is automatically raised, narrowing the set of mutations that can be admitted until confidence is restored through the structured recovery process. The evaluator composes with the forecasting engine by treating speculative branches as proposed mutations that are evaluated but not executed; admit determinations on speculative branches authorize promotion rather than direct execution. The evaluator composes with the lineage subsystem by emitting structured determination records that are themselves lineage entries, ensuring that admissibility decisions are first-class artifacts in the agent's audit trail.

Distinction From Prior Art

Prior art in admissibility and validation typically employs a single-evaluator design — for example, a learned classifier whose output is compared against a threshold — or an unbounded ensemble in which arbitrary numbers of weak signals are summed without structural constraint on individual contribution. Single-evaluator designs are vulnerable to evaluator failure modes; unbounded ensembles permit silent dominance by one signal when its weight drifts upward through training or tuning.

The composite admissibility evaluator distinguishes itself by combining plural independent evaluators under explicitly bounded weights, by mandating calibration audit as a structural precondition of admit determinations, and by recording the full determination as a lineage artifact. The bounded-weight property and the calibration audit requirement are not optimizations but structural properties of the mechanism: removing either yields a system outside the scope of the disclosed embodiments.

Implementation Properties

The evaluator's implementation preserves several invariants that follow from its structural definition. First, determinism: given identical component scores, identical weights, identical thresholds, and identical calibration epochs, the evaluator produces identical determinations. The aggregation function does not consult ambient state, wall-clock time, or non-recorded inputs; replays of recorded determinations from lineage are bit-exact reproductions. Second, monotonicity in component scores: with weights and thresholds held fixed, an increase in any component score cannot produce a less favorable determination. This monotonicity is a structural property of the weighted-sum aggregation and is preserved by the alternative order-statistic embodiments under their respective monotonicity definitions.

Third, separation of concerns: the component evaluators do not consult one another's outputs, do not share intermediate state, and do not see each other's calibration parameters. Each evaluator operates on the proposed mutation and on its own policy-declared inputs; the aggregation function alone has visibility into the full set of component scores. This separation is the structural mechanism by which evaluator independence is preserved across calibration changes and across model substitution. Fourth, fail-closed behavior: if any component evaluator fails to produce a score within its declared latency budget, or produces a score outside its declared range, the aggregation function emits a defer or reject determination according to the policy's fault-handling rule and emits a structured fault record into lineage.

Disclosure Scope

The disclosure encompasses any deterministic admissibility evaluator that combines plural independent component evaluators under bounded weighting and audited calibration to produce a structured admit, defer, or reject determination recorded in lineage, regardless of the specific component evaluators used, the specific aggregation function selected, or the specific representation of the determination. Embodiments described herein are exemplary; the structural properties of plural-evaluator independence, bounded contribution, mandatory calibration audit, lineage-recorded determination, deterministic replay, monotonic component contribution, and fail-closed fault handling define the scope of the claim and constrain the space of admissible implementations.