A hop count the record itself cannot protect

A counter carried inside a forwarded record, decremented at each hop and treated as exhausted at zero, constrains circulation only insofar as every party that handles the record decrements it. The value travels inside the object it is supposed to bound. An agent that admitted a record at some remaining depth, and that would therefore emit it at one less, can instead emit it at a higher value, and the next receiver holds a well formed record carrying a number for which the record supplies no test.

The object crossing the agent boundary in U.S. Provisional Application No. 64/117,812 is an accepted determination (122) concerning a counterparty's conduct, and admission of the record modifies a value of the admitting agent's scoped integrity vector (106) only through the state modifier and only under the coupling functions. Section 10.8, paragraph [0455] of that filing addresses re-emission at a raised value, its stated consequence being that an admitting agent does not restore a depleted depth by re-emitting the determination at a raised value.

Depth carried in the record, ceiling held by the receiver

Section 5.10 of the filing describes the propagated object. Where a first persistent semantic agent (100) produces an accepted determination (122) upon a conduct evaluation artifact (116) concerning conduct within a scope partition shared with a second semantic agent, that first agent emits a determination propagation record as a governed observation. The record comprises at least the determination class identifier of the accepted determination (122), the scope-partition identifier, the identity primitive of the asserting party (118), an epoch identifier of the first agent's dynamic agent hash chain, an implicated action-class enumeration naming action-class identifiers alone, and a propagation depth field. Paragraph [0191] states that the record carries a governance object and not a magnitude, and is thereby distinguished from a cognitive field value.

The depth field behaves conventionally at the outset. It is decremented upon each admission, and a record whose depth reaches zero is not further propagated. Paragraph [0455] then fixes the emission value: an admitting agent that further propagates the determination emits the record carrying the propagation depth field at the value obtained upon its own admission, being one less than the value at which the record was admitted to it. What the agent emits is thus determined by what it received.

The ceiling is a receiver-side record, not a field in the message. Each admitting agent maintains, per determination class identifier and per asserting party (118), a propagation depth ceiling being the least propagation depth value it has admitted for that determination. That ceiling is monotonically non-increasing under the anti-rollback discipline.

Two operands govern the gate. A record carrying a depth exceeding the ceiling then standing, or exceeding the declared initial depth, fails the propagation admissibility gate, is appended as an attempted propagation, and is given no effect. Both operands sit outside the arriving record: one is the least value the receiver has itself admitted for that determination from that asserting party (118), the other is the declared initial depth. Where the ceiling is not yet standing for a given determination and asserting party (118), the declared initial depth remains as a stated failure condition of the gate.

The failing path is appended rather than discarded, and it is inert. A record that fails the gate is appended as an attempted propagation and given no effect, so the arrival is recorded without any value being moved by it.

A structurally parallel construction appears one paragraph earlier for the abstention type. Under paragraph [0450], a relay non-execution attestation carries a relay depth field whose value at the first relay emission is a declared relay depth and at each subsequent relay emission is one less than the value carried by the carried abstention entry relied upon; an agent whose entry carries a relay depth of zero emits no relay attestation for that entry. Each agent maintains, per counterparty and per action class, a relay depth ceiling being the least relay depth value it has admitted, monotonically non-increasing under the anti-rollback discipline. A relay attestation carrying a relay depth above that ceiling, or whose chain of carried abstention entries names the admitting agent as a prior agent of the chain, is appended under the failing-element path of the receiver verification and is not admitted, whereby a cycle of agents each holding an entry of the other terminates rather than re-emitting without bound. Both classes of matter that cross the agent boundary in this architecture, the carried withholding and the carried determination, are therefore bounded by a ceiling of the same form, with the keying differing: per counterparty and per action class for the relay attestation, per determination class identifier and per asserting party (118) for the propagated determination.

Declared bounds for which the filing fixes no value

Several quantities relevant to this mechanism are declared as parameters in the filing rather than assigned values.

  • The declared initial depth. The filed text refers to a declared initial depth, and to a record exceeding it as a gate failure condition. No numeric value is stated.
  • The ceiling key. The ceiling is maintained per determination class identifier and per asserting party (118). This is a structural parameter rather than a tunable quantity.
  • The declared relay depth. Paragraph [0450] gives the relay depth field a declared relay depth at the first relay emission, again without stating a value.
  • The anti-amplification fraction. Under paragraph [0451], the magnitude by which the scoped integrity vector (106) of an admitting agent is modified upon a determination propagation record is bounded above by a declared fraction, less than unity, of a reference displacement magnitude, the fraction being declared in the signed policy object (112). The filing constrains the fraction to be less than unity and states no value.
  • The propagation rate bound and its window. Under paragraph [0454], a rate of determination propagation records received within a single scope partition exceeding a bound declared in the signed policy object (112), while a mean rate across the remaining scope partitions remains below that bound, is itself a condition of the suspension. Each rate is measured over a common window declared in the signed policy object (112) and expressed as a count of successor epochs of the second agent, so that the window is not advanced by any other party. Where no remaining partition exists, the mean-rate conjunct is treated as not satisfied and the suspension is governed by the per-partition rate condition alone.
  • The relation types for origin equivalence. Assignability to a common origin-equivalence class (200) is computed under relation types declared in the signed policy object (112).

No latency figure, benchmark, or default depth is declared for this mechanism in the filing.

Where the depth ceiling sits among the other conjuncts

The depth ceiling is one conjunct of a gate having several. Section 5.10 gives the determination propagation record effect only where the emitting agent and the asserting party (118) are not assignable to a common origin-equivalence class (200) under any relation type declared in the signed policy object (112), that class being computed by the second agent from records carried in its own memory field (102); where they are so assignable, the record is appended and given no effect. Paragraph [0453] adds a self-execution conjunct: the carried scope-partition identifier must resolve to a scope partition recorded in the admitting agent's own per-partition lineage record, being that agent's record of the actions it has itself executed within each scope partition, as one within which that agent has itself executed an action of an action class enumerated in the record's implicated action-class enumeration. The conjunct is not satisfied where the intersection is empty, and a record failing it is appended as an attempted propagation and given no effect. Paragraph [0454] suspends propagation entirely, no record being given effect, while the containment determination stands for the scope partition concerned in either agent.

Those conjuncts condition who may propagate and into what context. The depth ceiling conditions how far. Paragraph [0451] supplies a separate bound on magnitude: the admitting agent computes the reference displacement magnitude itself, from the determination class identifier carried by the record, as the magnitude by which its own scoped integrity vector (106) would be modified were it to produce an accepted determination (122) of that class under the parameters declared in its own signed policy object (112), so no magnitude of the emitting agent need be carried by the record. Under the variant at paragraph [0464], a record instead carries a propagated displacement magnitude field recording the magnitude by which the emitting agent's scoped integrity vector (106) was modified, whereupon the anti-amplification bound is taken as the declared fraction of that carried value; the carried field is admitted as a bound upon the admitting agent's own modification and never as an input to the function that modifies the admitting agent's scoped integrity vector (106), and where the field is absent the bound is taken against the computed reference displacement magnitude.

Also within Section 10.8 sits the abstention machinery on which the propagation rules are layered: the conversion bar (502) of Section 5, which applies to a carried abstention entry across the agent boundary, and the attestation origin-equivalence gate of paragraph [0452], under which a further attestation from a party of an origin-equivalence class (200) already represented beyond a declared bound is appended under the failing-element path and is not written as a carried abstention entry, whereby a set of agents of a common origin equivalence does not, by attesting in concert, foreclose the receiving agent's dispatch-authority predicate across an unbounded set of action classes. That gate is computed over the origin-equivalence class (200) and not over any per-counterparty count, appends nothing adverse to any counterparty identity record (114), modifies no value of the scoped integrity vector (106), and increments no counter of any disclosing agent.

Distinguishing hop limits, gossip suppression, and trust transitivity

Hop-limit fields in packet-forwarding protocols are the closest structural relative. A forwarding element decrements a counter and discards the datagram at zero, so the bound resides in the field carried by the datagram. Such schemes do not, as a rule, maintain a per-source record at the receiver against which an arriving value is compared. In the mechanism described here the operative bound is the receiver's own monotonically non-increasing ceiling, and the carried field is a value tested against it.

Gossip and flooding protocols suppress redundant delivery by retaining message identifiers already seen and dropping duplicates. A seen-set answers whether a message was observed before; it does not record the remaining budget at which it was observed. Retaining the least admitted propagation depth, keyed per determination class identifier and per asserting party, is a different quantity to hold, and it is the quantity the filed gate compares against.

Trust and reputation propagation schemes attenuate transitive trust by discounting a value at each transfer, so that indirect endorsements weigh less than direct ones. Attenuation of that kind operates on the magnitude being propagated. The filed construction operates on a record that carries a governance object and not a magnitude, places the bound on effect in a separate conjunct at paragraph [0451], and enforces the traversal bound through a monotone receiver-side record.

Anti-rollback and monotonic counter techniques in secure storage and firmware versioning supply the discipline the filing names, ordinarily binding a monotone value to a device or a module. Here the monotone value is a per-asserting-party, per-determination-class propagation depth ceiling held by an agent about assertions made by other parties. None of the above categories is described as practicing this mechanism.

Disclosure Scope

The mechanism described in this article, being the propagation depth ceiling and its anti-restore-depth rule, is disclosed in U.S. Provisional Application No. 64/117,812, at Section 10.8, paragraph [0455], with the determination propagation record and the propagation depth field disclosed at Section 5.10, paragraphs [0190] through [0192], the relay depth ceiling at paragraph [0450], and the remaining conjuncts of the propagation admissibility gate at paragraphs [0451] through [0454] and [0464]. This article is published to establish public, timestamped disclosure of that mechanism. It states no parameter value, threshold, or measured result beyond what the application declares, and it identifies no party as practicing the described subject matter.