1. Problem and Premise
Two autonomous agents that wish to close an exchange with each other cannot presently do so alone. Deployed paths route closure through a party that is not one of the two: a clearing house, a payment processor, a platform adjudicator, or a validator set that agrees on an ordering before finality attaches. Where none is reachable, the fallback is a prior relationship: an account, a session key, a standing channel, an enrollment record. An agent meeting a counterparty it has never seen, with no shared registry reachable, has no path to closure.
Section 6 of U.S. Provisional Application No. 64/117,812 makes finality a property of the exchange itself. Where two parties each emit a signed, credentialed observation satisfying a pairing rule declared in a governing policy object, within a proximity window declared there, the recognition and admission of that pair is the settlement. Each receiving party verifies the credential and the continuity hash field against records in its own memory field (102), recording the verification and any failing element in its own append-only lineage field (104). An architecture with no adjudicator must still handle refusal, timeout, non-arrival, contested claims, and reversal without any becoming an adjudication in disguise.
2. Core Primitive: The Matched Pair and Its Three Negative Conditions
A matched pair (600) comprises a first governed observation (608) from a first party representing an offer, a tender, a claim, a demand, or a commitment, and a second governed observation (610) from a second party representing an acceptance, a counter-tender, an acknowledgment, a refusal, or a fulfillment, the two recognized by a pairing rule within a spatial proximity window, a temporal proximity window (602), or both, as the governing policy object declares. The pair is bound into a settlement record (604) comprising the two signed observations, a cryptographic binding over both, and an attestation of the window within which recognition occurred, verifiable from the record alone.
Settlement occurs upon recognition and admission, and finality attaches at that moment. A settlement writes the settlement record (604); writes a settlement-lineage entry (606) into the append-only lineage field (104) of each party; writes the settled state into the counterparty identity record (114) each holds of the other; releases any content escrowed upon that pair; and effects the state transition the pair was formed to effect, being a transition of the authorization gate (300) for an enumerated action class, a promotion or demotion of a persistence designation, or a transfer of a settlement-binding authorization.
The three negative conditions are enabled as follows. No third-party intermediary participates: the record is produced from the parties' own signed observations, and no clearing party, processor, platform adjudicator, or escrow party is required for the pair to settle. No centralized consensus is computed: no quorum, ledger commit, or consensus round is a condition of settlement. No pre-negotiated session state exists: no account relationship, session key, standing channel, or prior enrollment is a precondition, consent being expressed per transaction by the paired observations.
3. The Governed Observation and Identity by Continuity
A governed observation is a signed structure comprising, at minimum and in sequence, an authority credential field, a continuity hash field encoding identity continuity of the emitting party, a spatial reference field, a temporal reference field, a time-to-live field encoding a validity duration, a payload field, and an observation lineage field naming the contributing party, any source observations, the derivation function applied, and a cryptographic integrity attestation. Emission is complete upon emission: no acknowledgment, handshake, delivery confirmation, or registration with a central authority is a condition of emission.
The authority credential carries at minimum an issuing-authority identifier, a scope specification, a temporal-validity specification, a binding attestation, and a cryptographic attestation; an observation lacking a verifiable credential is not a governed observation within the meaning of the disclosure. Credentials carry hierarchical trust semantics under an authority taxonomy declared by a deploying authority, which specifies an evidential-weight specification at each level, so a verified credential is a graded input to admission.
Identity for pairing is established by continuity, not enrollment, the continuity hash field holding two subfields of one record computed by different constructions. The first is a successor hash field, being the dynamic agent hash of the emitting party at the emission, formed by hashing the predecessor hash together with the unpredictability contribution, the volatile salt, and a domain-separating tag, and verified by an equality test rather than a distance test. The second is a continuity vector field, an ordered tuple of a declared count of components, each a projection of the emitting party's operational state normalized to the closed interval from zero to one, bound into the successor hash field by domain-separated hashing.
A trust-slope validator computes a trust-slope consistency measure from the continuity vector field and no other field, over a history store of fields received from a counterparty within a declared tolerance window, the measure being the mean of the step conformities in that window. An observation is accepted on continuity only where both conditions hold: the per-step distance against its predecessor, being the greatest component-wise absolute difference, does not exceed a declared per-step ceiling, and the measure is not less than a declared acceptance threshold. Failure of either is a failed continuity validation. A self-issued escalation credential is discounted by a declared self-escalation discount factor and excluded from the corroboration factor and convergence count, so a party cannot corroborate or escalate its own input.
4. Pairing Rules, Proximity Windows, and the Partition Intersection
The pairing rule admits content-matching, cryptographic-handshake, spatial-coincidence, temporal-coincidence, authority-pair, derivation-chain, and sequence-ordered forms, and composites. Two observations failing the rule, or falling outside an applicable window, produce a rejection recorded with the measured and required windows and the failing element.
The spatial proximity window is defined by one or more of a signaling-range bound, a declared boundary, a radius from a point, a credentialed-venue extent, and a scope-partition form satisfied by a non-empty intersection of the scope-partition identifiers declared by the two observations where the parties operate without physical co-location. A scope partition is a named division of the operation of the semantic agent having a per-partition lineage record and a per-partition cognitive state. The temporal proximity window (602) is defined by an absolute duration from the first observation, a declared relative event, a credentialed authority timing, an adaptive window, or a count of epochs of the dynamic agent hash chain.
Where a party maintains a plurality of scope partitions, a settlement implicating a partition of each is admissible only in the intersection of the two partition scopes, the cross-partition settlement record being appended to the per-partition lineage record of each partition in the intersection and to no other. A pairing whose partition sets do not intersect is rejected without incrementing any refusal meter.
A first governed observation (608) whose matching second observation has not arrived is an orphan observation, held in a deferral queue under a deferral-expiration parameter and re-evaluated as further observations arrive. Deferred pairing completes where the second arrives while the orphan remains held, including where it was carried by store-and-forward across a disconnection, the pair settling identically to an immediately recognized pair; upon expiry it resolves as a timeout. While orphaned it settles nothing, binds no party, and increments no meter.
Three detectors resolve the failure cases: a timeout detector for a first observation receiving no matching second observation within the window; a non-acceptance detector for a second observation that explicitly rejects the pairing; and a failed-fulfillment detector for a fulfillment observation not satisfying the declared completeness of the transaction type. Responsive to any of the three, a rollback record naming the failure class, the detector, the response selected, and each state element reverted with its value before and after is appended to the append-only lineage field (104), removing no entry. A timeout resolves nothing against either party: neither the party whose observation went unanswered nor the party that did not answer incurs an adverse consequence.
The settlement-lineage entry (606) records both observations, the pairing determination, the cryptographic binding, each escrow event, each failure and rollback, and each consumption of the settlement record (604). Each party holds its own settlement lineage, from which its transaction history is reconstructible without recourse to the counterparty or to any registry, and no entry is removed or modified.
5. Metered Non-Acceptance and the Settlement-Binding Authorization
A party that declines to complete a pairing emits the refusal as a refusal observation, being a governed observation bearing that party's authority credential and referencing the first governed observation (608) refused. The refusal is paired with the offer it refuses, the pair is recognized by the non-acceptance detector, and a settlement-lineage entry (606) is appended by each party.
Emission of the refusal observation is metered by a refusal meter carried in the memory field (102) of the refusing party, against that party's own settlement-binding authorization, the authorization under which it binds settlements. The meter applies without regard to, and without the refusing party performing, any determination of whether the refusal was well founded, and no adjudication of the merits by any party is a condition of the meter. It increments once upon each emission by a declared refusal increment, accumulates over a declared window, and is bounded in the same units. On the meter satisfying that bound, the settlement-binding authorization is written from a granting state to a withheld state, whereupon it binds no further settlements while the party's capacity to observe, to produce determinations, and to emit further refusal observations is preserved.
The mechanism closes on a negative list. The refusal meter is incremented by the emission of a refusal observation and by nothing else. Initiation of a dispute record, a resolution rendered by a dispute-resolution authority, a non-convergence in negotiation, a rejection for want of a partition intersection, a holding of an orphan observation, a timeout, and a failed fulfillment each increment no refusal meter of either party and are adverse to neither, so a counterparty's meter cannot be loaded by initiating disputes or protracting a negotiation.
6. Graduated Admissibility, Escrow, and the Ordered Failure Procedure
A settlement admissibility evaluator evaluates each governed observation, each candidate pair, each release request, and each rollback, producing exactly one outcome from a graduated set: admit, gate, defer, solicit, reject, and escalate. A reject outcome records a rejection reason from the classes of insufficient authority, failed continuity validation, staleness, failed corroboration, and window violation.
Evidential weight is the sum, over four factors each in the closed interval from zero to one, of the product of each factor and its declared coefficient, the coefficients being non-negative and summing to unity: the authority factor, being the evidential-weight specification of the credential's level; the continuity factor, being the trust-slope consistency measure; the freshness factor, being unity less the quotient of the elapsed interval by the validity duration, clamped above at unity; and the corroboration factor, being the count of independently received third-party observations agreeing upon each declared corroboration field, divided by a declared corroboration target and clamped at unity. An absence of any received observation is not a contradiction.
Outcome selection is ordered, the first satisfied trigger issuing its outcome. Reject issues on a credential that does not verify or whose scope excludes the action class, a continuity condition not satisfied, staleness, a pair outside a window or declaring non-intersecting partition sets, or a weight below a declared admission floor. Escalate issues upon a declared convergence count of independently emitted observations bearing distinct identity primitives. Defer issues where no second observation has arrived or corroboration is below a declared floor, solicit where it remains below after the deferral-expiration parameter elapses, and gate where the weight is below a declared admission threshold, the input then admitted at the product of that weight and a declared gate reduction factor. Otherwise admit issues.
Settlement content may be placed under escrow, an escrow custody record identifying the content held, the custodian form, and a condition specification defining release, the custody forms including a credentialed authority, cryptographic contract logic, a dual-lock form in which each party holds one lock, and time-locked or oracle-attested release. Release in an embodiment is completion of the declared matched pair (600); upon failure the content is returned unchanged. The escrow depth is the count of escrow custody records bearing upon a settlement whose conditions are nested or successively conditioned; a placement exceeding the declared escrow-depth bound is not performed, and the refusal to place increments no refusal meter.
Counter-observations producing revised terms are admitted per round and bounded by a declared round count, exhaustion of which is a non-convergence of the timeout class. A chained settlement dependency renders a first settlement conditional on a second, the links indexed in ascending order and bounded by a declared length bound; on a failure at a link, that link and the links of greater index are rolled back in ascending index order, rollback propagating downstream only.
Failure response is itself an ordered selection rule, running from a dispute-escalation response, through escalate-to-authority, notify-and-retry within a declared retry bound, compensating-settlement where the content was already released, partial-settlement where the class declares divisibility, and rollback-with-lineage, to a silent-timeout response adverse to neither party. A settled pair is subject to challenge only through a credentialed dispute procedure, a dispute record initiated by either settled party being evaluated against declared time limits, authority scope, and standing, then routed to a declared procedure. No step increments any refusal meter.
7. Operating Parameters
The governing policy object is a signed policy object (112) resolved for the settlement context. It is issued by a deploying authority, bears a policy identifier and a successor index, and is resolved by the policy reference field (110) of the party applying it. Where the parties resolve different policy objects, each applies its own.
The settlement parameters it declares are enumerated in the chapter: the proximity and time windows, the pairing rule form, the continuity parameters, the factor coefficients and thresholds of the admissibility evaluator, the refusal-meter increment and bound, the escrow-depth bound, the chained-settlement length bound, the retry bound, the solicitation bound, and the deferral-expiration parameter. That last is one quantity and not several: the same value governs the holding of an orphan observation and the defer and solicit outcomes.
Further quantities appear at the mechanisms that consume them: a tolerance window, a per-emission bound, a per-step ceiling, and an acceptance threshold for continuity; a self-escalation discount factor greater than zero and not exceeding unity; and, for admissibility, a corroboration target and floor, an admission floor and threshold, a gate reduction factor, and a convergence count. The chapter fixes no value for any of these.
The chapter states one worked trace. A policy object declares coefficients of three tenths, three tenths, two tenths, and two tenths for the authority, continuity, freshness, and corroboration factors, a corroboration target of four, and an admission threshold of seven tenths. An input bearing an authority level of evidential-weight specification nine tenths, a continuity factor of 0.775, an elapsed interval of twenty units against a validity duration of one hundred, and two corroborating observations obtains an evidential weight of 0.270 plus 0.2325 plus 0.160 plus 0.100, being 0.7625, so the admit outcome issues at 0.7625.
8. Alternative Embodiments
Partition-scoped escrow release. An escrow custody record arising from a settlement admitted in the intersection of two parties' scope partitions is held only within those partitions, so no release occurs while the intersection is empty. On timeout expiry with it still empty the content returns unchanged by a rollback incrementing no refusal meter; if it becomes non-empty first, release evaluation proceeds as though it had not emptied.
First-encounter settlement. A presenting party emits a completing observation as the second governed observation (610) carrying a value for each named absent field, its continuity hash field required to validate as a successor of the seeded sequence. On recognition the agent appends a promotion record moving the record from the ephemeral to the persistent tier, whereupon held artifacts pass to the admission evaluator (120).
Contested pairing. No pair is recognized until the temporal proximity window (602) has elapsed, each second observation satisfying the rule held pending. On elapse a contested-pairing detector counts the distinct emitter identities held: zero resolves as a timeout, one pairs and settles, and two or more identify a contest, in which no observation pairs and the first resolves to a not-determinable outcome with no meter incremented. The offering party then re-emits a first observation whose named-claimant field names exactly one identity from its contested-offer enumeration, each non-named claimant receiving a notice that is not a refusal.
Leg abstention. Where one leg of a pair emits an abstention outcome, the pairing emits an abstention of its own recorded class and the counterpart leg is rolled back, returning each escrowed quantity unchanged, incrementing no meter, and recording no severance event. In a further embodiment the pairing is held instead, the counterpart leg remaining in escrow under the deferral-expiration parameter.
Reliance records and reliance chains. A relying party that verifies a settled pair against the counterparty identity records (114) it holds for both settled parties, then produces a determination consuming that settlement, appends a reliance record naming the settlement, the consuming determination, and its own identity primitive and epoch, and emits it to both settled parties. A settled party reversing a settlement evaluates a reliance-completeness predicate over its own reliance register, the reversal given effect only where its enumeration matches every reliance record that party holds, no other party being polled and none voting. A transitive reliance record forms a reliance chain along which a reversal propagates one hop at a time.
9. Composition With the Rest of the Architecture
The chapter is the bilateral closure primitive the other sections depend on when an outcome must bind two parties. Section 1 supplies the substrate: the persistent semantic agent (100), the memory field (102), the append-only lineage field (104), the signed policy object (112), the counterparty identity record (114), the authorization gate (300) whose transitions a pair effects, and the dynamic agent hash chain, whose two-stage validation the continuity hash field reuses. Section 3 supplies the determination semantics under which the refusal meter operates, and Section 5 the conversion bar (502), to which a contested pairing and a leg abstention are subject.
Reading the provisional marker of Section 7 upon an execution record of a presenting party causes the receiving party to cap, in its counterparty identity record (114) of that party, the escrow depth it will place or accept and the length of any chained settlement dependency, without any determination of the merits of the underlying deviation.
Section 8 depends on the primitive twice over. An other-directed reparation arc (804) is discharged only upon completion of a matched pair (600) with the party recorded as harmed, and is reducible neither by an act of the deviating agent upon itself, nor by elapsed time, nor by policy succession. The restoration procedure of Section 8 is itself a matched-pair settlement, the acknowledgment artifact carrying references to the accepted determinations (122) of the causal set being the first governed observation (608) and the acceptance determination of the asserting party (118) of the harmed origin-equivalence class (200) the second, the pair effecting the transition of the authorization gate (300) from the provisional granting state to the granting state. Where no second observation arrives, the receiving party suffers no default judgment.
Bilateral demotion uses the primitive to the opposite end. A demotion of the persistence designation of a counterparty identity record (114) is effected only as a matched pair, a unilateral demotion effects none, and the demotion record persists, so what is forgotten is the record content and not the fact of the consented forgetting.
10. Prior-Art Distinctions
Clearing and payment intermediaries. Clearing houses, card networks, processors, and escrow agents stand between the two sides of a transaction and ratify finality on their own books. Here finality attaches upon recognition and admission of the pair.
Consensus ledgers and payment channels. Distributed ledgers replace the intermediary with a validator set that agrees on a canonical ordering before finality. Payment channels defer settlement against an underlying custody substrate and presume state negotiated in advance. Neither a consensus round nor a standing channel is a condition of the pair.
Reputation systems and credit scoring. Both aggregate conduct into a quantity computed about a party by parties other than that party, which then gates future access. The comparable quantity here is not a score: the refusal meter is carried in the memory field (102) of the refusing party, applies to that party's own settlement-binding authorization, is incremented by that party's own emission of a refusal observation and by nothing else, and moves that authorization between a granting and a withheld state.
Centralized trust registries. Registry architectures make identity a matter of enrollment. Here identity for pairing is established by continuity, evaluated by the trust-slope validator against a history store the receiving party holds itself, and no registration with a central authority is a condition of emission.
11. Disclosure Scope
This article documents Section 6 of U.S. Provisional Application No. 64/117,812, "Governed Social Conduct of Persistent Semantic Agents Through Record-Grounded Admission of External Conduct Evaluations and Self-Limiting Refusal," together with the additional embodiments of Sections 10.4, 10.5, 10.8, and 10.13 and the terminology of Section 11 bearing upon matched-pair settlement. The subject matter of Section 6 originates in U.S. Provisional Application No. 64/049,409, filed April 25, 2026, and is further disclosed in the present filing; Section 6 is not exhaustive of, and does not limit the scope of, that application.
What is disclosed is the structure: the governed observation and its required fields; the matched pair (600), the pairing rule, and the proximity windows including the scope-partition intersection form; identity by continuity and the trust-slope consistency measure; the settlement record (604) and the settlement-lineage entry (606); the three negative conditions; metered non-acceptance against the settlement-binding authorization, with the closed list of what does not increment the refusal meter; orphan observations and deferred pairing; escrow and the escrow-depth bound; chained settlement with the ordered failure procedure; graduated admissibility; and the embodiments recited above.
What this article disclaims: no cryptographic signature scheme, hash construction, transport, or clock source is specified or required, each being interchangeable; no governance authority's policy content is specified; and no quantitative performance, throughput, or latency characteristic is asserted, none being stated in the filing. The numeric trace above is the filing's own worked example, illustrative rather than limiting. The embodiments described do not exhaust the admissible embodiments, and nothing here characterizes any commonly owned application of the applicant as prior art with respect to any claim of this filing.
