Stage-Gated Commitment for Irreversible Actions

Mechanism

Stage-gated mode is one of the graduated-actuation modes available to the actuator. In this mode the actuator physically executes the proposed actuation in a sequence of stages with admissibility re-evaluation between stages, enabling interruption or modification between stages rather than committing the actuation through a single output step. The mode sits within the graduated-actuation mode selector's continuous and bounded mapping from composite-admissibility determination to actuation mode, between the constrained and full modes, and is selected under governance policy for actuations whose reversibility class warrants it.

A reversibility-aware commitment-point evaluator governs which actuations are routed into stage-gated execution. The evaluator includes a reversibility classifier that classifies each proposed actuation into one of a plurality of reversibility classes, including reversible actuations, partially reversible actuations, irreversible actuations, time-bounded reversible actuations, condition-bounded reversible actuations, probabilistically reversible actuations, and composite actuations comprising sequences of sub-actuations with mixed reversibility classes. A threshold modulator elevates admissibility thresholds for proposed actuations classified as irreversible or as having irreversible sub-steps, and a path-preference engine prefers reversible actuation paths over irreversible paths and prefers stage-gated execution of irreversible composite actuations over unstaged execution where both are admissible candidates. The reversibility preference is governance-policy-configurable per actuator class and per deployment domain.

A commitment-point detector identifies, for each staged actuation, the stage beyond which continuation becomes irreversible. The detector enables the graduated-actuation mode selector to interrupt a staged actuation prior to the commitment point upon receipt of a newly-consumed observation reducing composite admissibility, a newly computed forecasting observation, a newly updated dispositional field, or any newly-arriving input indicating reduced admissibility, without incurring the consequences of the irreversible final stages. Each commitment-point transit is a lineage-recorded event.

Admissibility is re-evaluated between stages. The unit does not advance to the next stage by inertia: at each stage boundary the composite admissibility evaluator re-confirms that the actuation remains admissible against the current observation set and the governance policy in force, operating on the observation set as it stands at the boundary rather than as it stood at stage entry. A re-evaluation indicating reduced admissibility prior to the commitment point allows the mode selector to interrupt the staged actuation or to transition it to a reduced mode such as constrained, partial, simulated, or disabled. Mode de-escalation during execution is recorded in the lineage field with the triggering input and the transition timestamp.

Each commitment-point transit and each mode transition is recorded in the lineage field. The lineage field carries provenance information with cryptographic attestation, and contributions compose through the lineage field to produce a deterministic provenance record. Audit walking the lineage can reconstruct which commitment points were or were not transited and which stage transitions occurred, supporting post-hoc analysis of the actuation's progression.

Operating Parameters

The stage decomposition, the placement of the commitment point within the stage sequence, and the admissibility thresholds applied at each stage are governance-policy-configurable per actuator class and per deployment domain. Governance policy specifies which actuations are routed into stage-gated execution and which may be executed at full mode directly, with high-consequence actuators requiring elevated composite admissibility across multiple contributing factors before full execution and low-consequence actuators requiring only baseline admissibility. The disclosure describes these parameters as policy-configurable without committing to particular stage counts, window durations, or threshold values.

The confidence thresholds that gate execution at each mode are dynamically modulated in accordance with the dispositional field, the forecasting observations, and the capability envelope. An actuator operating in a bounded region with elevated dispositional values on dimensions indicating abnormal conditions operates under elevated confidence thresholds, as does an actuator with a depleted capability envelope or one in a region of high forecast uncertainty. The threshold modulation produces location-aware, time-aware, and capability-aware threshold sets without explicit per-location or per-time governance-policy configuration.

The confidence thresholds additionally support operator-configurable threshold selection within governance-policy-defined bounds. An operator-authorized user of a governed unit selects a threshold set from a governance-policy-defined plurality of threshold sets, for example conservative, nominal, or aggressive, with the selected set governing the unit's actuation behavior within governance-policy-imposed outer limits. Each operator threshold selection is recorded in the lineage field with the operator identifier and selection timestamp.

Stage-gated execution composes with the reversibility preference such that the executing agent prefers composite actuations with late commitment points over composite actuations with early commitment points. Deferring the commitment point keeps the interruption window open across more of the stage sequence, and the resulting preference is itself recorded in the lineage field alongside the actuation determination.

Stage-progression evidence is exposed through the lineage record. Because each commitment-point transit and each mode transition is a lineage-recorded event, credentialed audit can examine which actuations were interrupted prior to their commitment point and which proceeded to completion, supporting operational analysis of the protocol's behavior across action classes.

Alternative Embodiments

In a first alternative embodiment, the stage sequence is decomposed into a larger number of stages for action classes whose procedural decomposition is more granular, each additional stage carrying its own admissibility re-evaluation. The commitment-point detector continues to identify, within the expanded sequence, the stage beyond which continuation becomes irreversible, so that the interruption capability is preserved across the more granular decomposition.

In a second alternative embodiment, the stage-gated mode interoperates with emergency preemption. A governance-credentialed observation carrying emergency-preemptive authority may escalate the actuator's selected mode to an emergency-accelerated mode, subject to the preemption-budget and preemption-expiration constraints, with the mode escalation recorded in the lineage field together with the preemption authority credential and the preemption scope.

In a third alternative embodiment, admissibility re-evaluation at a stage boundary results not in interruption but in modification, transitioning the in-progress actuation to a constrained or partial mode that executes the actuation at reduced magnitude, reduced rate, reduced precision, or reduced scope while continuing the stage sequence under the additional governance-policy-defined constraints.

In a fourth alternative embodiment, stage-gated execution composes with harm-minimization deviation. Where a stage boundary re-evaluation indicates that no available continuation path avoids harm, the candidate-path generator and harm projector select the continuation path that minimizes composite projected harm across entities in the spatial region under the governance-policy-defined entity-class harm ordering, with the candidate-path set, the harm projections, and the selected path recorded in the deviation lineage.

In a fifth alternative embodiment, the reversibility classifier treats an actuation as time-bounded reversible or condition-bounded reversible, so that the commitment point is defined by the elapse of a governance-policy-defined temporal window or the cessation of an external condition rather than by a fixed stage. The stage-gated protocol then keeps the interruption window open until the temporal window elapses or the condition ceases to hold.

Composition with Other Primitives

Stage-gated commitment composes with lineage-recorded provenance directly: each commitment-point transit and each mode transition is recorded in the lineage field with cryptographic attestation, and the lineage field composes contributions into a deterministic provenance record permitting reconstruction of the actuation's progression. Audit walking the lineage reconstructs not only that an actuation occurred but the stage sequence and the boundary re-evaluations through which it advanced.

Composition with the composite admissibility evaluator supplies the per-stage re-evaluation: the same composite admissibility framework that gates initial mode selection is re-applied at each stage boundary against the observation set as it stands at the boundary, so that newly arrived observations are reflected in the boundary decision without a separate configuration surface.

Composition with the graduated-actuation mode selector situates stage-gated mode within the continuous and bounded mapping from composite admissibility to actuation mode. A boundary re-evaluation indicating reduced admissibility can transition the in-progress actuation toward a less autonomous mode, and a governance-credentialed emergency preemption can escalate it toward the emergency-accelerated mode, with both transitions recorded in lineage.

Composition with the policy-distribution mechanism ensures that the stage decomposition, the commitment-point placement, the reversibility ontology, and the per-mode confidence thresholds are themselves governed by the governance policy in force. A change in operating posture propagates as updated governance policy that the platform admits, and the stage-gated protocol reflects the updated parameters through the same authority channel that governs every other aspect of the platform's behavior.

Distinction over Prior Art

Prior interlock, e-stop, and functional-safety emergency mechanisms handle interruption of an irreversible action as an out-of-band emergency override rather than as an admissibility re-evaluation within the normal actuation path. The disclosed stage-gated mode re-evaluates composite admissibility between stages and interrupts prior to the commitment point as an ordinary outcome of that re-evaluation, with each transit and transition recorded in the lineage field rather than producing limited audit.

Prior centralized control architectures execute an actuation through a single output step without an intermediate reversibility classification or commitment-point evaluation. The disclosed mechanism classifies each proposed actuation into a reversibility class, identifies the stage beyond which continuation becomes irreversible, and elevates admissibility thresholds for irreversible actuations, so that an irreversible composite actuation is preferentially staged and remains interruptible up to its commitment point.

Prior emergency mechanisms provide no rate or temporal constraint on overriding authority and are domain-specific. Within this disclosure, the stage-gated mode and its interaction with emergency preemption operate uniformly across actuator classes and deployment domains, and the preemption that can escalate a staged actuation is itself constrained by preemption-budget and preemption-expiration mechanisms and recorded with its full provenance chain.

Disclosure Scope

This article describes subject matter disclosed in U.S. Provisional Application No. 64/049,409. The disclosure encompasses the stage-gated actuation mode with admissibility re-evaluation between stages; the reversibility-aware commitment-point evaluator with its reversibility classifier, commitment-point detector, threshold modulator, and path-preference engine; interruption of a staged actuation prior to the commitment point upon a newly-consumed input reducing composite admissibility; mode de-escalation and emergency-preemption escalation during staged execution; the alternative embodiments described above; and the composition with lineage-recorded provenance, the composite admissibility evaluator, the graduated-actuation mode selector, and the policy-distribution mechanism. The scope extends to staged commitment by platforms operating across vehicular, aviation, surgical, industrial-process-control, energy-grid, and defense deployment domains, and to any irreversible or partially irreversible actuation that admits procedural decomposition, with the reversibility classifier and the stage-gated parameters governed by the governance policy in force.