Task Class Differentiation Under Confidence Interruption

Mechanism

The mechanism, defined in Chapter 5 of the cognition patent, treats every admitted task as a member of exactly one task class. The class is assigned at admission time by a deterministic classifier that examines the task's effect surface, reversibility profile, and downstream commitments. Once assigned, the class is recorded in the task's lineage record alongside the confidence value and capability tier that were in force at admission. This three-tuple, that is, class, confidence, and tier, becomes the binding contract that governs every subsequent interruption decision affecting the task.

Four canonical task classes are recognized. Immediate-stop tasks must terminate within a single evaluation cycle whenever confidence falls below the class threshold; partial outputs are discarded and the substrate is returned to a quiescent state. Drain-then-stop tasks are permitted to complete the in-progress operation but are forbidden from initiating a new one; the task drains its work queue and halts at the next safe boundary. Queue-then-stop tasks continue to run but place all newly arriving units of work into a holding queue, where they remain until either confidence is restored or an external authority disposes of them. Never-interrupt tasks proceed to completion regardless of confidence excursions; the class is reserved for operations whose interruption would itself constitute a worse failure than completion under reduced confidence.

Class assignment is not free. Admission of a task into the never-interrupt class requires that the agent's capability tier exceed a configured floor and that confidence at admission exceed a configured ceiling. Admission of a task into immediate-stop is essentially unconditional and represents the safe default. Drain-then-stop and queue-then-stop occupy the middle band and require evidence, recorded in the lineage, that the task's effect surface satisfies the reversibility predicate associated with the class. The classifier itself is deterministic: identical inputs yield identical class assignments, and every assignment is reproducible from the lineage record alone.

The interruption decision is then a pure function of class and current confidence. When confidence crosses a class-specific lower threshold, the runtime emits an interruption directive whose contents are fully determined by the class. For immediate-stop, the directive carries a hard-stop opcode. For drain-then-stop, it carries a no-new-work opcode and a drain deadline. For queue-then-stop, it carries a queue-redirect opcode and a queue identifier. For never-interrupt, no directive is emitted; instead, the confidence excursion is logged as an annotation against the running task. Because the directive set is finite and the dispatch function is deterministic, the entire interruption protocol is amenable to formal verification.

Operating Parameters

Each task class exposes a tuple of governed parameters. The lower confidence threshold defines the value at which the class's interruption directive is emitted. The upper confidence threshold, used only by classes that admit resumption, defines the value at which a queued or drained task may be reactivated. The hysteresis margin, expressed as a non-negative scalar, separates the two thresholds and prevents oscillation when confidence trajectories noisily traverse the boundary. Drain deadlines and queue capacities are class-specific and are bound to the capability tier of the substrate that hosts the task.

The classifier itself is parameterized by the policy reference. The reversibility predicate is supplied as a structured expression evaluated against the task's declared effect surface. The capability tier floor for never-interrupt admission, the confidence ceiling for the same, and the default class for tasks that match no explicit rule are all declared in the policy and may be tuned per deployment without architectural change. Every parameter is versioned; the version in force at admission is recorded in the lineage so that historical interruption decisions can be reconstructed even after the policy has been amended.

Operating ranges are bounded to keep the mechanism analyzable. Confidence is normalized to the closed unit interval. Hysteresis margins are bounded above by a fraction of the interval to prevent pathological configurations in which a task can never be resumed. Drain deadlines are bounded above by the task's declared maximum duration. Queue capacities are bounded above by the substrate's declared memory envelope. When a parameter falls outside its declared range, the policy fails admission and the runtime falls back to the immediate-stop default for all tasks until the policy is repaired.

Alternative Embodiments

In a first embodiment, the four canonical classes are extended with domain-specific subclasses. A clinical embodiment, for example, may distinguish diagnostic-immediate-stop from diagnostic-drain-then-stop on the basis of whether the task has already issued an externally observable recommendation. The subclass mechanism is structurally identical to the canonical classes; only the classifier's rule set is enlarged.

In a second embodiment, the interruption directive is not merely a class-determined opcode but a structured plan that includes rollback steps, compensating actions, and notifications to upstream coordinators. This embodiment is appropriate where the substrate participates in distributed transactions and where bare interruption would leave external state inconsistent. The directive remains deterministic given the class and the current state of the transaction graph.

In a third embodiment, the capability tier itself is treated as a continuous quantity rather than an ordinal level. Class admission then becomes a function over a two-dimensional region in the confidence-tier plane. The mechanism is otherwise unchanged; the classifier evaluates an inequality rather than a discrete comparison.

In a fourth embodiment, multiple tasks share a class membership but receive individualized thresholds derived from their declared importance. The class supplies the structural protocol; the per-task thresholds tune the protocol's sensitivity. This embodiment is useful where a single substrate hosts a heterogeneous workload and where uniform thresholds would either over-pause critical work or under-pause exploratory work.

Composition With Other Primitives

Task class differentiation does not stand alone. It composes with confidence governance proper, which supplies the confidence value and its derivatives. It composes with capability awareness, which supplies the tier required for class admission. It composes with integrity-coherence, which supplies the policy reference under which the classifier and thresholds are declared. And it composes with lineage, which records the class, the parameters, and the directives so that the entire interruption history of any task is reconstructible from durable state.

The composition is structural, not incidental. Each primitive exposes a typed interface, and the interruption mechanism consumes those interfaces through declared coupling points. A change to the confidence computation that alters the units of the confidence value, for example, must propagate through the coupling and trigger a policy revalidation; the runtime refuses to operate when the coupling is inconsistent. The same is true of capability tier definitions and of the reversibility predicate. Cross-primitive consistency is enforced at admission rather than discovered at interruption time.

Distinction From Prior Art

Prior art in agent governance treats interruption as a binary capability: either the agent can be stopped or it cannot. Work-stealing and cooperative scheduling literature addresses fairness and throughput rather than confidence-conditioned correctness. Real-time systems literature addresses deadline guarantees but assumes that the deadline itself is unconditional. None of these traditions binds the interruption discipline to a continuously recomputed confidence value, and none partitions tasks into classes whose interruption semantics are individually specified, deterministic, and auditable.

The present mechanism differs structurally. It treats the interruption directive as a function of class, confidence, and tier rather than of a single global stop signal. It records the inputs to that function in lineage, making every interruption decision reproducible. And it requires that the classifier and its parameters be declared in policy rather than embedded in code, making the entire mechanism subject to governance review rather than to source-code audit.

Worked Examples

Consider an agent piloting a surgical instrument. The instrument's currently active suture pass is admitted as a never-interrupt task because mid-pass interruption would tear tissue, and the admission required both a high capability tier and a confidence value above the configured ceiling. A confidence excursion arising from a transient sensor noise event therefore produces an annotation in lineage but no interruption directive; the suture pass continues to completion, and the next admission decision will weigh the recorded annotation against the new task's class.

Consider next an agent processing a batch of speculative trades. Each trade is admitted as a queue-then-stop task because the effect of an unsubmitted trade is reversible by simply not submitting it. A confidence drop triggers the queue-redirect directive: in-flight trades complete or fail according to their own internal protocols, but newly arriving trades land in the holding queue. When confidence recovers above the upper threshold, the queue is drained in the order recorded; when confidence remains depressed beyond the queue's deadline, an external authority disposes of the queued trades by either admitting them under a different policy or discarding them, and the disposition is recorded in lineage.

Consider finally an agent operating a long-running research synthesis. The synthesis is admitted as a drain-then-stop task: a confidence drop allows the current synthesis step to complete, perhaps to produce an interim summary, but forbids the agent from initiating the next step. The drain deadline ensures that the synthesis cannot indefinitely block the substrate. The combination of class-conditional protocols, recorded admission contracts, and bounded drain windows is what allows a single agent to host this heterogeneous mix of work without collapsing into either undifferentiated halt-everything or undifferentiated continue-everything behavior.

Disclosure Scope

The disclosure encompasses the four canonical task classes, the deterministic classifier that assigns them, the class-conditional interruption directives, the parameter bindings to confidence and capability tier, the hysteresis discipline, the lineage recording, and the policy declaration of every governed quantity. It encompasses the alternative embodiments enumerated above and any embodiment in which interruption is conditioned jointly on a continuously recomputed confidence value, a discrete or continuous capability tier, and a class-conditional directive set that is declared in policy and recorded in lineage. The disclosure is independent of the specific numerical thresholds, of the specific task domain, and of the specific substrate on which the agent executes.