Structural Starvation Composability

Mechanism

The cognition architecture treats every skill as a node whose firing is conditioned on the presence of declared evidence inputs in the agent's canonical state. Each skill publishes, as part of its declarative manifest, the evidence classes it consumes and the evidence classes it produces. A composition is the directed graph formed when one or more skills are wired together such that the outputs of upstream skills become the evidence inputs of downstream skills. The composition is itself a first-class object: it is named, versioned, and admitted to the agent only after passing a structural check.

The structural check operates on the composition graph in three passes. The first pass verifies acyclicity: a topological sort is attempted, and any back-edge causes the composition to be rejected with a precise diagnostic identifying the offending skills and the evidence classes that close the cycle. The second pass verifies evidence closure: for every declared input of every skill in the graph, the check confirms that either an upstream producer in the same composition emits the required evidence class or the agent's ambient evidence base is structurally guaranteed to carry it. Inputs satisfied by neither are flagged as dangling and the composition is rejected. The third pass verifies starvation-freedom: for every skill in the graph, the check confirms that there exists at least one execution path through the upstream producers under which the skill's evidence preconditions are jointly satisfiable without contradiction. A skill whose preconditions can never be jointly satisfied — because two upstream producers emit mutually exclusive evidence on the same channel, or because a precondition references an evidence class that no admitted producer is ever permitted to emit — is starved by construction, and the composition that contains it is refused.

The output of the structural check is not a probability or a score. It is a deterministic admit/refuse decision accompanied by a machine-readable certificate. The certificate enumerates the topological order, the evidence-closure proof for each input, and the witness path establishing satisfiability for each skill. The certificate is recorded in the agent's lineage alongside the composition itself, so that any future audit can reconstruct the reasoning by which the composition was admitted.

Because the check is structural and operates on declarations rather than executions, it runs in time polynomial in the size of the composition graph and is independent of the agent's runtime workload. A composition that passes the check carries a structural guarantee: at runtime, no skill in the chain will silently fail to fire because an upstream skill never produced its evidence; no cycle will deadlock the chain; and no skill will be admitted into the live agent in a configuration where it cannot, in principle, ever execute.

Operating Parameters

The composition graph is bounded in practice by the agent's policy reference. Policy specifies the maximum permitted graph depth (the longest path from a source skill to a sink skill), the maximum permitted fan-in per skill (the number of upstream evidence producers feeding a single input channel), and the maximum permitted fan-out per skill (the number of downstream consumers a single producer may serve). Compositions that exceed any bound are rejected at the structural-check stage; the bounds are themselves part of the certificate so that downstream auditors can confirm the composition was admitted under the policy in force at the time.

Evidence classes are drawn from a published taxonomy. The taxonomy is partitioned into observation evidence (sourced from the perception layer), inferred evidence (produced by upstream skills), and authoritative evidence (asserted by governance). The structural check distinguishes these origins so that a skill which declares an authoritative-evidence precondition cannot be satisfied solely by inferred evidence from an upstream skill, regardless of how the inferred evidence is labeled. This origin-aware closure is enforced at composition time.

Temporal preconditions are first-class. A skill may declare that an evidence input must be no older than a stated freshness bound, or that two evidence inputs must originate within a stated coincidence window. The structural check verifies that the upstream producers, in combination with the agent's policy on producer cadence, can in principle satisfy the temporal envelope; producers whose worst-case cadence exceeds the consumer's freshness bound are flagged as starvation sources at composition time rather than being discovered as silent failures at runtime.

The check is incremental. When a single skill is added to or removed from an admitted composition, the certificate is recomputed only for the affected sub-graph rather than for the whole composition. This keeps the structural-check cost proportional to the change rather than to the cumulative size of the agent's skill library.

Alternative Embodiments

In a first embodiment, the structural check is performed by a dedicated composition admission service that holds the canonical skill manifests and the policy reference. Compositions are submitted to the service over a credentialed interface; only certificates signed by the service are accepted by the runtime. This embodiment is suitable for fleet deployments in which composition policy is centrally curated and individual agents enforce admission by signature verification.

In a second embodiment, the structural check is performed in-process within each agent at the moment a composition is loaded. The agent holds its own copy of the skill manifests and policy reference; the certificate is generated locally and recorded in the agent's local lineage. This embodiment is suitable for offline or air-gapped deployments where no central admission service is reachable.

In a third embodiment, the check is split across composition time and load time. A compile-time pass produces a partial certificate that fixes the topological order and the evidence-closure proof; a load-time pass binds the certificate to the current policy reference and verifies that the policy under which the composition was authored is still in force. Compositions whose authoring policy has been superseded are refused at load even if the compile-time certificate remains structurally valid.

In a fourth embodiment, the satisfiability witness is computed by a constraint solver rather than by exhaustive path enumeration. This embodiment scales to composition graphs with rich precondition logic at the cost of solver-dependence; the certificate records the solver identity and version so that future audits can reproduce the witness.

In a fifth embodiment, the composition is permitted to carry conditional starvation: a skill may be declared as optionally-fireable, in which case the structural check verifies that the rest of the composition remains starvation-free when the optional skill never fires. This embodiment supports compositions that include speculative or exploratory skills without forcing the rest of the chain to depend on their output.

Composition with the Surrounding Architecture

The starvation-composability check sits between the agent's skill library and its three-engine pipeline. The skill library exposes manifests; the structural check consumes manifests and emits certificates; the certificates gate which compositions the mutation, validation, and arbitration engines will subsequently execute. A composition that has not been admitted carries no certificate, and the runtime refuses to load it; a composition that has been admitted carries a certificate that the runtime verifies on every load.

Because the check is declarative, it composes with the policy-governance layer without bespoke integration. When policy changes — for example, when a new evidence class is added to the taxonomy, or when the maximum permitted graph depth is reduced — the admission service re-runs the structural check against the new policy and re-issues certificates. Compositions that no longer satisfy the new policy are flagged for revision; their certificates are revoked and the runtime refuses to load them on the next admission cycle.

The check also composes with the lineage layer. Every certificate, every revocation, and every re-admission is recorded in the lineage with the policy reference, the manifest versions, and the witness paths in force at the time. The lineage record is sufficient for an external auditor to reconstruct, from the structural artifacts alone, why a given composition was admitted on a given date and why it was, or was not, still admissible at any later date.

Prior-Art Distinction

Workflow engines have long performed acyclicity checks on directed graphs of tasks, and dataflow systems routinely verify that producer outputs are typed-compatible with consumer inputs. The structural starvation-composability check is distinguished from these prior approaches in three respects. First, the check operates on evidence classes drawn from an origin-aware taxonomy rather than on opaque data types, so that authoritative-evidence preconditions cannot be silently satisfied by inferred outputs. Second, the check verifies joint satisfiability of precondition logic across the entire graph rather than pairwise type-compatibility along edges, so that compositions in which a skill's preconditions are individually feasible but jointly contradictory are caught at composition time. Third, the check produces a machine-readable certificate that is bound into the agent's lineage, so that the admission decision is reproducible and auditable rather than embedded in the implementation of a particular engine.

Plan-validation systems in classical planning verify that a candidate plan achieves a goal under a domain model. The structural check disclosed here does not validate plans; it validates the composability of the skill graph from which plans are subsequently drawn, and it does so independently of any particular goal. A composition admitted under this check will not, by construction, contain a starvation path regardless of the goal the agent later pursues.

Disclosure Scope

The disclosure covers the structural check, the certificate format, the policy-bound bounds on graph depth and fan-in/fan-out, the origin-aware evidence taxonomy, the temporal-precondition handling, the incremental recomputation strategy, and the embodiments enumerated above. It also covers the integration of the check with the policy-governance and lineage layers and the use of certificate revocation on policy change.

The disclosure is independent of any particular skill, evidence class, or operational domain. The same structural check applies to compositions over perception skills, planning skills, communication skills, or actuation skills; to evidence classes drawn from sensor data, language-model proposals, or governance assertions; and to deployments in companion AI, autonomous vehicles, fleet operations, or enterprise workflows. The disclosure is the structural primitive that makes any of these compositions admissible without surrendering the guarantee that no admitted skill is starved by construction.