Differential Rate Alarm Conditions

Mechanism

The differential alarm is a deterministic comparator that runs once per cognitive cycle. At each cycle the agent has already produced two scalar values bound to canonical fields: an observed confidence, computed from the live evidence available at the current step, and an expected confidence, computed by a separate forward predictor that projects what confidence should hold at this cycle given prior trajectory, prior policy actions, and the declared workload class. The comparator forms a signed differential by subtracting expected from observed and emits that differential, together with its first derivative across cycles, as a structured alarm record.

Three distinct alarm shapes are recognized within the same comparator. A decay rate spike occurs when the differential becomes sharply negative within a single cycle, indicating that observed confidence has collapsed faster than the predictor allowed for. A recovery rate collapse occurs when the differential remains negative across multiple cycles even though absolute confidence is rising, indicating that recovery is real but lagging the schedule the predictor committed to. A sustained negative differential occurs when the signed gap remains below a configured floor for a configured number of consecutive cycles, regardless of derivative behavior. Each shape maps to a distinct response class, and the mapping is declared in policy rather than encoded in code.

Because the differential is signed and bounded, it can be compared against banded thresholds without reference to the absolute confidence value. This is the structural innovation: the alarm is independent of the operating point. An agent running at high absolute confidence can still trigger a severe alarm if its observed confidence falls meaningfully below what its own predictor expected, and an agent running at low absolute confidence will not trigger an alarm so long as its observation tracks its prediction. The alarm therefore detects model failure rather than mere uncertainty.

Every alarm record is committed to the agent's lineage with the inputs that produced it, the predictor version that generated the expected value, the policy version that mapped the differential to a response class, and the response that was actually issued. This produces a fully auditable trail in which any past response can be reconstructed deterministically from the recorded inputs, satisfying the reproducibility requirement that governs the cognition architecture as a whole.

Operating Parameters

The comparator is parameterized by a set of declared values that fully determine its behavior. A spike threshold governs the per-cycle delta at which a decay rate spike is recognized; a recovery deficit threshold governs the persistent negative differential at which a recovery rate collapse is recognized; a floor and a duration jointly govern the sustained negative differential. Each threshold may be expressed as an absolute scalar or as a fraction of the predictor's declared standard error, allowing the same policy to be ported across agents with different predictor calibrations.

Hysteretic margins are applied symmetrically around each threshold to prevent oscillation when the differential idles near a band boundary. The hysteresis width is itself a declared parameter and is recorded with each alarm so that downstream auditors can verify that a transition was not the result of threshold flutter. A debounce parameter requires the threshold to be crossed for a configured number of consecutive cycles before the alarm is committed; a hold parameter requires the alarm to remain in force for a configured number of cycles after the threshold is recovered.

The response ladder itself is a declared mapping. Each band of the differential is associated with a response class drawn from a fixed enumeration: log only, attenuate output, narrow workload class, suspend new transitions, and hard stop. The mapping is monotone, so a more severe differential can never produce a less severe response. Severity escalation is one-way within a single alarm episode; de-escalation requires the alarm to clear and a fresh episode to begin, which prevents response chattering under noisy differentials.

Alternative Embodiments

Several embodiments of the differential alarm are contemplated within the disclosure. In a single-predictor embodiment, a single forward predictor produces the expected confidence and the comparator runs against that single reference. In a predictor-ensemble embodiment, multiple predictors run in parallel and the expected value is taken as a tier-weighted aggregate; the comparator additionally tracks predictor disagreement and treats high disagreement as an independent alarm input. In a self-predicting embodiment, the agent's own prior cycle output, smoothed across a declared window, serves as the expected value, eliminating the need for a separate predictor at the cost of weaker early-cycle behavior.

The response ladder admits domain-specific extensions. In a vehicular embodiment, the ladder terminates in a controlled handover to a human operator. In a clinical decision support embodiment, the ladder terminates in an explicit deferral that records the unmet differential and the missing evidence. In a trading embodiment, the ladder includes a position-flattening band between attenuation and hard stop. In each case the structural mechanism is unchanged; only the response enumeration is extended.

The differential itself can be generalized beyond a scalar. In a vector embodiment, observed and expected confidence are decomposed across declared evidence channels and a per-channel differential is produced; the alarm fires on the worst channel rather than on the aggregate, exposing the failing channel to lineage. In a time-windowed embodiment, the differential is integrated across a sliding window so that small persistent deficits accumulate into an alarm even when no single cycle crosses a threshold.

Composition

The differential alarm composes with the broader confidence governance subsystem through canonical fields. It consumes the observed and expected confidence fields produced upstream and emits an alarm field consumed downstream by the response governor, by the workload classifier, and by the lineage writer. Because the interface is field-typed rather than function-typed, the comparator can be replaced without disturbing adjacent components, and adjacent components can be replaced without disturbing the comparator.

The alarm is also composable with the transition governor and with the multi-model arbitration subsystem. A pending transition that would otherwise be admitted may be rejected on the basis of an active differential alarm, and a tier-weighted arbitration may down-weight or exclude a model whose contribution coincides with sustained negative differentials in its outputs. These cross-subsystem couplings are declared in policy and recorded in lineage, preserving determinism across the integrated system.

Prior-Art Distinction

Conventional confidence-thresholding systems compare an absolute confidence value against a fixed threshold and act on the absolute value. Such systems cannot detect a confidence collapse that occurs entirely within the admissible range, and they cannot distinguish a recovering trajectory from a stalled one. Conventional anomaly detectors that operate on raw signals lack a structured expected value and therefore cannot bind their alarms to a declared predictive model. The differential alarm is distinguished from both classes by its reliance on a signed, predictor-relative differential and by its explicit binding to a declared response ladder under deterministic policy.

Implementation Considerations

A correct implementation of the differential alarm requires that observed and expected confidence be produced from disjoint evidence at the cycle in which they are compared. If the predictor is permitted to consume the observation it is supposed to predict, the differential collapses to noise around zero and the alarm becomes structurally incapable of detecting model failure. The disclosure contemplates this isolation as a structural requirement: the predictor must be invoked on inputs that exclude the live evidence used to produce the observation, typically by binding the predictor to a frozen view of the prior cycle's state.

The predictor's calibration governs the meaning of the differential. A predictor that systematically underestimates confidence will produce persistent positive differentials that the comparator must tolerate, and a predictor that systematically overestimates will produce persistent negative differentials that the comparator must distinguish from genuine collapse. The disclosure contemplates a bias correction phase recorded in lineage so that long-run mean differential is held at zero under nominal operation; alarms then fire on departures from the corrected baseline rather than from raw zero.

Recovery semantics are non-trivial. A naive implementation that clears the alarm as soon as the differential returns above the threshold will cycle responses on and off as the differential idles near the boundary, producing user-visible chattering. The hysteresis and hold parameters defined above address this directly, and the disclosure further contemplates a recovery confirmation requirement under which a prior alarm episode is closed only after a configured number of cycles in which both the differential and its first derivative are within nominal bounds. This guards against the case in which a transient stabilization is mistaken for genuine recovery.

Domain-specific calibration may require periodic recalibration of the predictor against accumulated lineage, and the disclosure contemplates a calibration epoch under which the predictor is refit on a sliding window of recorded observations and expected values. The recalibration itself is a mutation event subject to audit under the mutation taxonomy described in the transition-mutation subsystem; it is not a free operation and is recorded with the policy version under which it was admitted, the window over which it was fit, and the residuals it produced. This binds the long-run validity of the differential alarm to the same auditable discipline that governs the rest of the cognitive architecture, rather than treating recalibration as an opaque maintenance task.

The alarm record schema is itself a published interface and is held stable across implementations. Downstream subsystems consume the schema directly, so a change to the schema is itself a structural mutation subject to audit under the cognition architecture's broader mutation discipline. This is what permits the differential alarm to be replaced or upgraded without disturbing the response governor or the lineage writer.

Disclosure Scope

The disclosure covers the comparator, the predictor binding, the threshold and hysteresis parameterization, the response ladder, the alternative embodiments enumerated above, the implementation considerations enumerated above, and any system that reproduces the structural relationship between a declared expected confidence, a deterministic differential, and a policy-mapped response. Implementations that reproduce the structural relationship through equivalent fields fall within scope regardless of the underlying predictor family or the specific response enumeration adopted. The disclosure further covers any system that materializes the signed differential as a first-class field consumed by adjacent governance subsystems, regardless of whether the alarm itself is implemented as a discrete component or as a function distributed across the cognitive architecture.