Governed Actuator Execution

Mechanism and Primitive Description

The primitive operates through a structured actuation chain that runs from observation consumption through execution to verification. The executing agent consumes governed observations pertinent to the actuation context through the governed mesh, ingests a proposed actuation specifying an actuator, an actuation command, and one or more actuation parameters, and evaluates that proposed actuation through the composite admissibility evaluator jointly with the consumed observations, the dispositional field, the forecasting observations, and the capability envelope. A graduated-actuation mode selector then selects an actuation mode in accordance with the composite admissibility determination, an actuator driver commands the physical actuator at the selected mode, a post-actuation verification mechanism compares observed effects against expected effects, and an actuation-state broadcast mechanism emits a governed actuation-state observation to the mesh. The complete actuation provenance is recorded in the lineage field both before and after execution.

Reversibility evaluation is a first-class step. A reversibility-aware commitment-point evaluator classifies each proposed actuation into one of a plurality of reversibility classes, comprising at minimum reversible actuations, partially reversible actuations, irreversible actuations, time-bounded reversible actuations, condition-bounded reversible actuations, probabilistically reversible actuations, and composite actuations whose sub-actuations have mixed reversibility classes. The evaluator prefers reversible actuations to irreversible actuations among admissible candidates of comparable projected outcome, prefers composite actuations with late commitment points over those with early commitment points, and prefers stage-gated execution of irreversible composite actuations over unstaged execution. The reversibility preference is governance-policy-configurable per actuator class and per deployment domain, and the preference itself is recorded in the lineage field. A harm-minimization deviation mechanism selects an actuation path that minimizes composite projected harm when no available path avoids all harm, and it admits self-damaging actuation paths as candidates where they minimize composite projected harm rather than excluding them categorically.

Post-actuation verification closes the loop. The post-actuation verification mechanism compares observed effects of the actuation against expected effects for closed-loop refinement, and the actuator publishes an actuation-state observation back to the mesh, enabling cross-unit coordination. The verification outcome is recorded in the lineage field and re-enters the governance chain as a governed observation available for downstream admissibility evaluation.

Operating Parameters and Engineering Envelope

The graduated-actuation mode selector selects one of a plurality of actuation modes, the plurality being governance-policy-defined per actuator class, per authority level, per deployment domain, and per admissibility-determination output. The plurality of modes comprises at minimum, without being limited to, the enumerated modes: a disabled mode in which the actuator does not execute the proposed actuation and the non-execution is lineage-recorded; a simulated mode in which the actuator executes a dry-run without physical effect; an advisory mode in which the actuator emits a governance-credentialed advisory observation recording what actuation would have been taken without executing it; a consultative mode in which the actuator emits a consultation request to a human operator, a higher-authority agent, or a governance-policy-defined endpoint and awaits confirmation; a shadowed mode in which the actuator executes the actuation and additionally emits an advisory observation recording an alternative path; a partial mode in which the actuator executes at fractional magnitude, reduced rate, reduced precision, or reduced scope; a constrained mode in which execution is subject to additional governance-policy-defined constraints; a stage-gated mode in which execution proceeds in a sequence of stages with admissibility re-evaluation between stages; a deferred mode in which execution occurs at a later time upon satisfaction of a deferral condition; a full mode in which the actuator executes at nominal magnitude, rate, precision, and scope; and an emergency-accelerated mode in which the actuator executes at elevated magnitude, rate, or priority upon emergency preemption.

The mode selector produces a continuous and bounded mapping from composite-admissibility determination to actuation mode rather than a binary permit-or-deny decision, and the mapping is governance-policy-configurable per actuator class. As composite admissibility rises, the selector transitions through increasingly autonomous modes, for example disabled to simulated to advisory to consultative to constrained to stage-gated to full; as composite admissibility falls, the selector transitions toward less autonomous modes. The continuous mapping enables graceful degradation under reduced confidence without forcing a binary outcome of either unconstrained execution or complete cessation.

An emergency-preemption mechanism permits authority-credentialed override of ordinary confidence thresholds subject to preemption-budget and expiration constraints, and supports mode escalation upon an emergency-authority preemption directive. The actuation chain admits multiple concurrent proposed actuations through a governance-policy-defined actuation arbitration mechanism: when a plurality of proposed actuations is concurrently present at an actuator driver, the arbitration mechanism produces a single selected actuation through governance-policy-defined priority, authority weighting, composite-admissibility comparison, or any governance-policy-defined arbitration function, and each arbitration event is recorded in the lineage field.

A commitment-point detector identifies, for each staged actuation, the stage beyond which continuation becomes irreversible, enabling the graduated-actuation mode selector to interrupt a staged actuation prior to the commitment point. The primitive is medium-agnostic, substrate-agnostic, modality-agnostic, and domain-agnostic, and a system implementing it over the governance chain is within scope regardless of specific actuator type, specific sensing modality producing the consumed observations, specific signaling medium, specific computing substrate, specific safety-integrity level, or specific deployment domain.

Alternative Embodiments

The primitive admits embodiments across actuator classes of any physical domain. The actuator driven by the actuator driver is of any type, including mechanical actuators such as brake-by-wire, steer-by-wire, throttle-by-wire, gate, barrier, valve, and manipulator-arm actuators; propulsion actuators such as electric-motor, jet-engine, rocket-engine, thruster, and control-surface actuators; electrical actuators such as switch, breaker, contactor, and inverter actuators; medical actuators such as infusion-pump, ventilator, defibrillator, and surgical-tool actuators; weapon-system actuators such as guidance, fuze, payload-release, and fire-control actuators; agricultural actuators such as irrigation and fertigation actuators; and transit actuators such as signal-phase, lane-control, and switch-point actuators. In each class the graduated modes, the reversibility classification, and the harm-minimization deviation are bound to the actuator's capability envelope and to governance policy for that class and deployment domain.

The reversibility classification reflects the physical character of the actuator. A braking actuation, for example, is partially reversible, reversible in kinematic effect but irreversible in elapsed time and consumed stopping distance, while a weapon-system terminal actuation, a suppressant-deployment actuation, or a medication-dispensing actuation is irreversible because no inverse actuation returns the physical system to its pre-actuation state. A gate-opening actuation is reversible by a subsequent gate-closing actuation, and a lane-change actuation is reversible by a subsequent return-to-prior-lane actuation. The primitive is medium-agnostic and substrate-agnostic, so an embodiment is within scope so long as the actuator can execute at a selected graduated mode and emit a governed actuation-state observation recording the executed actuation.

Composition with Adjacent Primitives

Within the five-property chain, this primitive consumes the composite admissibility evaluation of Property 3 and emits the actuation provenance recorded under Property 5, lineage-recorded provenance. Upstream, it depends on authority-credentialed observation for state evidence and on evidential weighting in the shared governed observation store; downstream, its actuation-state observations re-enter the chain as governed observations available for admissibility evaluation and for dispute, replay, and after-action review. Each actuation provenance record is itself an admissible event, so any subsequent evaluation that acts on the consequence of an actuation begins from a credentialed pre-image.

The primitive composes with the stage-gated mode so that a single logical actuation can be decomposed into a sequence of bounded physical stages with admissibility re-evaluation between stages. It composes with self-attestation mechanisms so that an actuator can refuse operation upon detected firmware tampering. It composes with cross-mesh reconciliation so that authority admitted in one mesh and execution committed in another preserve lineage across the boundary, and with the actuation arbitration mechanism so that an actuator presented with conflicting proposed actuations executes a single governance-resolved selection rather than colliding commands.

Prior-Art Distinctions

The disclosure frames the governed actuator execution primitive as structurally distinguished from prior sensor-actuator architectures in a plurality of respects. First, the proposed actuation is evaluated through a cognitive composite admissibility evaluator consuming authority-credentialed observations, the dispositional field, forecasting observations, and the capability envelope, whereas prior architectures evaluate sensor readings through fixed algorithms without authority differentiation. Second, the actuator driver executes at a selected mode drawn from a plurality of graduated modes, whereas prior architectures execute or suppress in a binary fashion.

The remaining distinctions follow the same pattern. Authority-credentialed preemption overrides ordinary confidence thresholds subject to budget and expiration, whereas prior architectures provide interlocks without budget semantics. Commitment-point evaluation prefers reversible paths where feasible, whereas prior architectures treat actuations uniformly regardless of reversibility. Harm-minimization deviation evaluates self-damaging paths as admissible candidates when they minimize composite projected harm, whereas prior architectures exclude self-damaging paths categorically. Post-actuation verification compares observed effects against expected effects with lineage recording, whereas prior architectures terminate at the actuator command without verification closure. The actuator publishes actuation-state observations back to the mesh, enabling cross-unit coordination, whereas prior architectures confine actuation state to the executing system. A system that senses, evaluates through a fixed algorithm, and actuates without these properties is a conventional sensor-actuator system; a system that implements them as a unified chain implements the governed spatial mesh architecture.

Disclosure Scope

This article describes the governed actuator execution aspect of U.S. Provisional Application No. 64/049,409, the fourth property of the five-property governance chain. The disclosure encompasses the actuation chain from observation consumption through composite admissibility evaluation, graduated mode selection, actuator execution, post-actuation verification, and actuation-state broadcast; the graduated-actuation mode selector and its continuous mapping from composite admissibility to a plurality of actuation modes; the reversibility-aware commitment-point evaluator and its plurality of reversibility classes; the emergency-preemption mechanism subject to budget and expiration; the harm-minimization deviation mechanism that minimizes composite projected harm; and the lineage recording of every actuation evaluation, mode selection, preemption event, commitment-point determination, harm-minimization selection, and verification outcome.

Embodiments expressly contemplated include actuators of any physical domain, the disclosure being medium-agnostic, substrate-agnostic, modality-agnostic, and domain-agnostic, so that a system implementing the primitive over the governance chain is within scope regardless of specific actuator type, sensing modality, signaling medium, computing substrate, safety-integrity level, or deployment domain. The plurality of actuation modes is not limited to the enumerated modes, and any future governance-policy-defined actuation mode that preserves the governance chain is within scope.

This article concerns U.S. Provisional Application No. 64/049,409.