Semantic State Object Schema

Mechanism

The semantic state object schema is a closed enumeration of the phases through which an inference loop is permitted to pass during its lifetime. Each phase is a typed object carrying a fixed set of fields - intent, active context, constraint memory, admissibility history, lineage anchors, and the trust slope inherited from prior steps - and each phase has an explicit list of permitted successor phases. The five canonical phases defined in Chapter 8 of the cognition patent are cold-start (the agent has just been instantiated and has no warm context), warm (initial bindings have been resolved but the loop has not yet stabilised), steady (the agent is operating within its declared envelope and producing committed transitions), fade (residual context is being decayed and a quiescent shutdown is approaching), and quarantined (an integrity violation has been detected and the agent is held inert pending operator review).

The schema is enforced structurally rather than advisorily. At every inference transition the runtime computes the candidate successor phase from the current phase, the proposed transition class, and the policy reference that governs the agent. The candidate is then checked against the enumeration. A candidate that is not present in the enumeration cannot be dispatched: the dispatcher itself refuses to bind work to a phase identifier that the schema does not define. This is the meaning of "out-of-schema state non-execution." There is no permissive default phase, no implicit "other," and no mechanism by which an undefined phase can be invented at runtime by the agent's own outputs. The closed enumeration is the gate.

Every phase entry, every phase exit, and every refused transition is written to the agent's lineage with a deterministic record identifier. The record carries the prior phase, the candidate phase, the policy clauses that were consulted, the trust slope at the moment of evaluation, and the admit/reject/decompose decision returned by the semantic admissibility gate. Because the enumeration is finite and the records are total, an external auditor can replay the agent's phase history and arrive at the identical sequence given the same inputs and policy reference. The schema therefore performs a dual role: it constrains what the agent can do, and it guarantees that what it did is reconstructable.

Operating Parameters

The schema is parameterised along four axes. The first axis is the phase set itself. Although the canonical embodiment uses the five phases listed above, the patent contemplates domain-specific extensions - for example, a regulated-medical embodiment may add a "supervised" phase between warm and steady in which a human reviewer must counter-sign each candidate transition, and an industrial-control embodiment may add a "graceful-degrade" phase that sits between steady and fade. Extensions are permitted only through the policy reference and only at agent instantiation; the phase set cannot be mutated at runtime by the agent's own inferences.

The second axis is the transition matrix. For each ordered pair of phases the policy reference declares whether the transition is permitted, conditionally permitted (subject to a named predicate over the semantic state), or forbidden. Forbidden transitions are not merely unlikely - the dispatcher will not emit them. Conditional transitions are evaluated by the admissibility gate, which consults the constraint memory, the admissibility history, and the trust slope before committing.

The third axis is the field schema of each phase object. Intent is a typed reference into the agent's goal lattice. Active context is a bounded set of canonical field bindings. Constraint memory is the running set of constraints that have been admitted and not yet retired. Admissibility history is the ordered log of admit, reject, and decompose decisions taken since the most recent cold-start. Lineage anchors are the cryptographic identifiers that bind the current phase object to its predecessors. The trust slope is the signed scalar carried forward from the trust-continuity mechanism.

The fourth axis is the quarantine policy. When the admissibility gate or any structural check raises an integrity violation, the agent is forced into the quarantined phase regardless of the transition matrix. From quarantine the only permitted exit is back to cold-start, and only after an external operator has issued a signed reset against the policy reference. The agent cannot self-rehabilitate.

A fifth, advisory parameter governs the dwell discipline of each phase. The policy reference may declare a minimum dwell, a maximum dwell, or both, on any phase, and the dispatcher consults the dwell budget at every transition opportunity. Cold-start, for example, typically carries a maximum dwell beyond which the agent must transition to warm or back to quiescence; steady typically carries no maximum but a reporting cadence so that long-lived steady episodes still emit lineage anchors at known intervals. Dwell violations are themselves treated as transitions and recorded as such, which means an agent that lingers in a phase past its budget is observable to an external auditor as a distinct event class rather than as silence.

Alternative Embodiments

In a companion-AI embodiment the steady phase is partitioned into "engaged" and "ambient" sub-phases to reflect whether the user is actively interacting; the schema then enforces that long-running tool invocations may be initiated only from engaged. In an autonomous-vehicle embodiment the fade phase is split into "controlled-handover" and "minimum-risk-manoeuvre" so that the schema itself records which shutdown discipline was chosen. In a multi-agent enterprise embodiment a "negotiating" phase is added in which the agent may exchange candidate transitions with a peer agent but may not commit them locally; commit is permitted only after a return to steady.

The schema may also be embodied as a hardware enforcement in environments where software-only enforcement is insufficient. In such embodiments the dispatcher consults a separate trusted module that holds the enumeration in tamper-evident storage, and the agent process is given no path to mutate the enumeration. Cross-embodiment, the structural property is preserved: a phase that the enumeration does not name cannot host execution.

Composition

The state-schema composes directly with the trust-slope continuity mechanism, the semantic admissibility gate, and the LLM-skill-gating pipeline. The trust slope is a field of every phase object, so every transition both consumes and updates the slope, and a slope that crosses the configured threshold compels a transition into quarantined irrespective of the agent's own preference. The admissibility gate reads the current phase to select which policy clauses apply, so the schema both constrains what the gate evaluates and is constrained by what the gate admits. Skill gating consults the current phase before composing a skill chain; skills whose preconditions reference a phase the agent is not currently in are filtered out at composition time rather than failing at dispatch.

Because the schema, the gate, and the slope share a common record format and a common lineage anchor scheme, an external auditor can join their records and reconstruct, for any committed inference, the phase that was active, the policy clauses that were consulted, the slope that was carried forward, and the admit/reject/decompose decision that was returned. This is the structural property that makes the cognition architecture certifiable.

Distinction from Prior Art

Prior approaches to runtime governance of generative systems fall into three families: post-generation filtering, soft-prompt steering, and reinforcement-time reward shaping. Post-generation filters cannot constrain the inference itself - they observe completed outputs and decide whether to release them, which leaves the generation pipeline to consume resources and to contaminate downstream context with material that will then be suppressed. Soft-prompt steering biases the distribution from which tokens are drawn but does not enumerate the phases of cognition or refuse undefined ones; the agent retains the capacity to enter operating modes that the deployer has not anticipated. Reward-shaping operates at training time and is therefore not available as a runtime guarantee.

The state-schema differs in kind. It is not a probability bias, not a post-hoc filter, and not a training-time signal. It is a structural enumeration enforced by the dispatcher, and the structural property it provides - that an undefined phase cannot host execution - cannot be obtained by any of the prior families regardless of how those families are tuned.

A second family of prior art - finite-state machines used in conventional control software - resembles the state-schema superficially but lacks the integration with semantic admissibility, lineage anchoring, and trust-slope continuity. A bare state machine has no notion of admissibility decisions, of policy references that may be amended without code changes, or of cryptographic anchors binding state entries to their predecessors. The state-schema is not a state machine grafted onto a generative system; it is a structural component designed for systems whose transitions are themselves the subject of admissibility evaluation.

Disclosure Scope

This disclosure covers the closed enumeration of inference phases, the typed field schema of each phase object, the transition matrix and its conditional predicates, the quarantine discipline and its operator-signed reset, the dispatcher-level refusal of out-of-schema phases, the lineage record format that binds phase entries and exits, and the composition of the schema with the trust-slope, admissibility-gate, and skill-gating mechanisms. The disclosure extends to embodiments that vary the phase set, the transition matrix, the field schema, and the enforcement substrate (software, hardware-attested, or hybrid), provided that the structural property of out-of-schema non-execution is preserved.

The disclosure further covers the dwell discipline and its reporting cadence, the per-phase compute envelope that binds available skills to the active phase, the operator-signed reset path that is the unique exit from quarantine, and the certificate format by which an external auditor reconstructs a phase trajectory. It covers domain-specific extensions of the phase set - including the engaged/ambient partition of steady, the controlled-handover and minimum-risk-manoeuvre split of fade, the supervised intermediate phase, the negotiating phase used in multi-agent embodiments, and the graceful-degrade phase used in industrial-control embodiments - provided in each case that extensions are introduced through the policy reference at instantiation rather than by runtime mutation. It also covers the integration of the schema with downstream consumers that read the active phase as part of their own admissibility logic, including the skill composer and the trust-slope evaluator, so that the schema is not merely a record of what the agent did but an active participant in deciding what the agent may do next.