Ceci n'est pas une pipe: AI systems as semantic abstractions

# Ceci n’est pas une pipe: AI systems as semantic abstractions
Source: [https://arxiv.org/html/2607.09489](https://arxiv.org/html/2607.09489)
###### Abstract\.

An AI system’s output is not the fact or world state it appears to describe, but rather an engineered representation\. We propose a semantic framework to describe AI systems, to be able to examine the correctness of such representations\. To do so, we distinguish what is justified by accepted domain knowledge, what reference sources say, and what the system can currently use\. This allows us to give precise definitions to common failures: extrapolation, refuted or unsupported assertion, sources versus knowledge mismatch, stale or refuted source, added hypotheses, unsupported use…We hope our framework gives a useful vocabulary for specifying and checking AI systems whose outputs, citations, tool calls, and world\-changing actions must be justified by reliable claims and explicit authority rather than apparent fluency\.

††copyright:none## 1\.Introduction

Many deployed AI systems are used either as assistants that answer questions or as agents that perform actions\. Both kinds may proceed through a series of iterations\.

Such systems are often discussed in two ways that we find misleading\. As magic systems: as if their behaviour could not be decomposed and understood, akin to machine learning as alchemy\(Rahimi and Recht,[2017](https://arxiv.org/html/2607.09489#bib.bib79)\)\. As oracles: as if an answer produced by the system were already the fact or world state of interest; other works warn against conflating fluent generated text with factuality\(Weizenbaum,[1966](https://arxiv.org/html/2607.09489#bib.bib80); Bender and Koller,[2020](https://arxiv.org/html/2607.09489#bib.bib81); Benderet al\.,[2021](https://arxiv.org/html/2607.09489#bib.bib82); Jiet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib83)\)\.

Thus important questions are difficult to answer with precision: what is accepted knowledge in a given domain? What are the reference sources? What do they say? What can the system use at this point in time? Does this differ from accepted domain knowledge or reference sources? What part of the world can the system observe or change? Is the system allowed to? Can we record, examine and check what led to a consequential step such as an observation of or a change to the world?

We start from the stance that AI systems should be treated as engineered semantic abstractions, not as magic or oracles: an AI system’s output is not the object it appears to describe, but rather, like Magritte’s pipe, a representation of it\. At a high level, we consider a system to consist of:

- •Knowledge Bases: possibly erroneous material available to the system, e\.g\. prose or code;
- •Prompts: the user’s queries, refinements, and steering during an interaction;
- •Compute Components: e\.g\., one model or a cohort of models that transform prompts and reference sources into messages, artefacts, or actions, as well as Agent Services such as cameras;
- •Actuations: the responses, artefacts, actions, or world modifications produced by the system;
- •an Orchestrator: a possibly empty orchestration layer around the Compute Components that may call tools, retrieve files, or iterate before actuation\.

We use this example throughout: Oma needs to renew her passport using an AI\-aided application\. The system may need to inspect her old passport, check current guidance on what pictures are acceptable, take or evaluate a picture, fill in a form, handle an interruption such as the doorbell, save progress, check that everything is ready for submission, and ask Oma for confirmation to submit\.The Knowledge Bases need to contain official passport requirements; the Prompts may be Oma’s requests and corrections; Compute Components may be an LLM procured by the government, and Oma’s phone camera; the Orchestrator may be a software stack around the LLM that decides whether to retrieve, ask, check, save, or mark the application ready, and Actuation may consist of a local PDF export\.

A system does not manipulate the semantic objects of interest directly: retrieving sources, calling tools, proposing updates, is done through interfaces\. This interface layer embodies the core distinction of this work: an AI answer, prompt or tool call is but a message whose meaning, source, authority, and effect have to be interpreted and checked w\.r\.t\. an underlying semantics\.

Consider Oma completing the form to renew her passport\. The system records a trace of events: route selection \(e\.g\. UK or FR\), passport observation, form population, picture and form checks, application readiness check, Oma’s confirmation, permission, and submission\. The readiness event is not itself proof that the application is ready\. Its message must be interpreted, checked against sources, and supported by the current trace before the system may rely on it\. The later definitions formalise this path and the failure modes that arise when necessary observations, witnesses, authority, or freshness conditions are missing\.

##### Outline

Sections[2](https://arxiv.org/html/2607.09489#S2)and[3](https://arxiv.org/html/2607.09489#S3)define knowledge bases, the communication language used by the system, the world, traces, contexts and prompts\. Section[4](https://arxiv.org/html/2607.09489#S4)defines the Information State of an AI system\. Section[5](https://arxiv.org/html/2607.09489#S5)explains how messages become candidate claims, when those are supported and may be relied on\. Section[6](https://arxiv.org/html/2607.09489#S6)examines Information State mismatches, which we hope gives a taxonomy of what is often called hallucination\. Section[7](https://arxiv.org/html/2607.09489#S7)defines compute components such as neural and symbolic components, services, and orchestrators\. Section[8](https://arxiv.org/html/2607.09489#S8)assembles these layers into the definition of an AI system and gives quality judgments\.

Thus we propose that AI systems are abstractions of ideal semantic systems\. An ideal semantic system relies on an underlying semantics and its actuations are grounded over that semantics\. An AI system operates through partial, lossy, and sometimes speculative abstractions of that semantics\.

Of course in certain domains, the underlying semantics may be unclear, e\.g\. when dealing with prose\. But our framework may still help locate a system’s obligations and failure modes\.

A prototype, which can be made available upon request, exemplifies the concepts introduced in this paper: the app lets a user, or an agent on behalf of that user, fill in a passport renewal form, take a picture of themselves, scan their existing passport page, and save the current draft when the doorbell rings…

## 2\.Knowledge Base

This section defines the machinery used for knowledge bases\. A knowledge baseK=⟨D,F,R,t⟩K=\\langle D,F,R,t\\rangleat timet∈ℕt\\in\\mathbb\{N\}features a domainDD\(a collection of objects, e\.g\. sets, types…\), factsF∈℘​\(D\)F\\in\\wp\(D\), and a rule systemRRover domainDD\. A rulePc\\frac\{P\}\{c\}has premisesP∈℘​\(D\)P\\in\\wp\(D\)and a conclusionc∈Dc\\in D\. IfP=∅P=\\emptysetthe rule is called an axiom\. The rule systemR≜\{Pici\|i∈ρ\}R\\triangleq\\Bigl\\\{\\frac\{P\_\{i\}\}\{c\_\{i\}\}\\Bigm\|i\\in\\rho\\Bigr\\\}overDDis a possibly infinite family of rules indexed by a setρ\\rho\.

Standard\(Shoenfield,[1967](https://arxiv.org/html/2607.09489#bib.bib21)\), intuitionistic\(van Dalen,[2013](https://arxiv.org/html/2607.09489#bib.bib22)\), and modal\(Blackburnet al\.,[2001](https://arxiv.org/html/2607.09489#bib.bib23)\)logics can be formalised using such Hilbert\-style proof systems\(Hilbert and Ackermann,[1928](https://arxiv.org/html/2607.09489#bib.bib32)\)\. Although introduced for logics\(Hilbert and Ackermann,[1928](https://arxiv.org/html/2607.09489#bib.bib32)\), such rule\-based definitions can define any subset of a domainDD, hence encompass grammars\(Chomsky,[1956](https://arxiv.org/html/2607.09489#bib.bib34)\), databases\(Silberschatzet al\.,[2020](https://arxiv.org/html/2607.09489#bib.bib35)\), knowledge graphs\(Hoganet al\.,[2022](https://arxiv.org/html/2607.09489#bib.bib31)\), and deductive systems\(Aczel,[1977](https://arxiv.org/html/2607.09489#bib.bib33)\), and may also contain contradictory facts\.

For Oma:One rule may say that if a candidate passport picture respects current official guidance, then the picture respects the overall rules for the application\.

Next we need to say what consequences may be justified byRRfrom the facts inFF:

- •*Proofs\.*A theorem has hypothesesH∈℘​\(D\)H\\in\\wp\(D\), a conclusionc∈Dc\\in D, and a proof\. If every premise setPiP\_\{i\}of every rulePici\\frac\{P\_\{i\}\}\{c\_\{i\}\}inRRis finite, the proof is a sequencep1​p2​…​pnp\_\{1\}p\_\{2\}\\ldots p\_\{n\}s\.t\. eachpip\_\{i\}is a hypothesis inHH, a fact inFF, or the conclusion of a rule s\.t\. all elements ofPiP\_\{i\}previously appeared in the sequence, and the last element in the sequence is the conclusion of the theorem\. If some premises are infinite, the proof may rely on the principle of transfinite induction\(Pohlers,[1989](https://arxiv.org/html/2607.09489#bib.bib20)\)\. For Oma:A proof step may be s\.t\. if freshness and official sources have been checked, then the draft may be marked ready\.
- •*Inference\.*IfXXis the set of facts already reached, thenInferR​\(F\)​\(X\)≜F∪X∪\{ci∣i∈ρ∧Pi⊆F∪X\}\\textsf\{Infer\}\_\{\\\!R\}\(F\)\(X\)\\triangleq F\\cup X\\cup\\\{c\_\{i\}\\mid i\\in\\rho\\wedge P\_\{i\}\\subseteq F\\cup X\\\}adds factsFFtoXX, and every conclusion whose premises are available fromF∪XF\\cup X\. For Oma:A proof step may add “the draft may be marked ready” only after the required source, picture\-check,CheckForm, andConfirmDraftfacts are already reached\.
- •*Chaining\.*Forward chaining repeatedly appliesInferR​\(F\)\\textsf\{Infer\}\_\{R\}\(F\)to justify consequences from the facts already available\. Backward chaining replaces a set of goalsG⊆DG\\subseteq Dby the premisesPPof a ruleRRthat would prove it:G↝R\(G∖\{c\}\)∪P​when​Pc∈R​and​c∈GG\\leadsto\_\{R\}\(G\\setminus\\\{c\\\}\)\\cup P\\hbox\{ when \}\\frac\{P\}\{c\}\\in R\\hbox\{ and \}c\\in G\. For Oma:Forward chaining starts from observations and sources and justifies claims such as “picture respects rules” or “form ready”\. Backward chaining starts from “may mark ready?” and reduces it to source freshness, picture compliance, form completion,CheckForm, and Oma’s confirmation\.
- •*Closure\.*For a setB⊆DB\\subseteq D, letInferR∗\(B\)≜lfp⊆\(λX\.InferR\(B\)\(X\)\)\\textsf\{Infer\}^\{\\ast\}\_\{R\}\(B\)\\triangleq\\textsf\{lfp\}^\{\\subseteq\}\\bigl\(\\lambda X\.\\textsf\{Infer\}\_\{R\}\(B\)\(X\)\\bigr\), wherelfp⊆\\textsf\{lfp\}^\{\\subseteq\}is the least fixed point in order⊆\\subseteq, which exists by Tarski’s theorem\(Tarski,[1955](https://arxiv.org/html/2607.09489#bib.bib137)\)sinceX↦InferR​\(B\)​\(X\)X\\mapsto\\textsf\{Infer\}\_\{R\}\(B\)\(X\)is⊆\\subseteq\-monotone inXX\. A conclusionccis justified from factsFFand hypothesesHHwhenc∈InferR∗​\(F∪H\)c\\in\\textsf\{Infer\}^\{\\ast\}\_\{R\}\(F\\cup H\)\.
- •*Paraconsistent justification\.*GivenK=⟨D,F,R,t⟩K=\\langle D,F,R,t\\rangle, we say thatKKjustifies a claimccwhenK⊢c≜c∈InferR∗​\(F\)K\\vdash c\\triangleq c\\in\\textsf\{Infer\}^\{\\ast\}\_\{R\}\(F\), and thatKKdoes not justifyccwhenK⊬c≜c∉InferR∗​\(F\)K\\not\\vdash c\\triangleq c\\notin\\textsf\{Infer\}^\{\\ast\}\_\{R\}\(F\)\. A knowledge base may justify a fact, its negation, both, or neither\. ThusK⊢cK\\vdash cmay not mean thatccis reliable\. Absence of justification is not negation:K⊬cK\\not\\vdash cdoes not implyK⊢¬cK\\vdash\\neg c\. We distinguish four base statuses:K⊢\+c≜K⊢c∧K⊬¬cK\\vdash^\{\+\}c\\triangleq K\\vdash c\\wedge K\\not\\vdash\\neg c,K⊢−c≜K⊢¬c∧K⊬cK\\vdash^\{\-\}c\\triangleq K\\vdash\\neg c\\wedge K\\not\\vdash c,K⊢±c≜K⊢c∧K⊢¬cK\\vdash^\{\\pm\}c\\triangleq K\\vdash c\\wedge K\\vdash\\neg c,K⊢?c≜K⊬c∧K⊬¬cK\\vdash^\{?\}c\\triangleq K\\not\\vdash c\\wedge K\\not\\vdash\\neg c\. We also use the derived shorthandK⊢⊕c≜K⊢\+c⊕K⊢−cK\\vdash^\{\\oplus\}c\\triangleq K\\vdash^\{\+\}c\\oplus K\\vdash^\{\-\}cfor one\-sided justification\. When the time index is useful, we writeK⊢t×cK\\vdash^\{\\times\}\_\{t\}cfor the corresponding base status at timett, with×∈\{\+,−,±,?\}\\times\\in\\\{\+,\-,\\pm,?\\\}, and useK⊢t⊕cK\\vdash^\{\\oplus\}\_\{t\}cas the derived one\-sided shorthand\.

## 3\.Communication Language, World, Traces, Context, Prompts

This section introduces messages, world states, event traces, contexts, and prompts\.

### 3\.1\.Communication Language

To communicate, the components of an AI system share a common languageLang\. This language may include labels, token sequences, communication codes, matrices, computer programs, data tables, URLs, tool\-call schemas, etc, for the usage of the AI system\.

Below, the objects writtenm∗m\_\{\*\}are communication\-language messages: elements ofLang\. They are not world objects and not semantic facts\.

For Oma:In the app,mready≜result = passedm\_\{\\textit\{ready\}\}\\triangleq\\texttt\{result = passed\}is recorded in eventereadye\_\{\\textit\{ready\}\}in the trace, which comes from clicking the buttonCheck Everything Ready for Submissionto run checks on the current draft\.

### 3\.2\.Semantics of the Communication Language

Now we need to determine the meaning of messages\. We write𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang:Lang⇀𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}:\\textit\{Lang\}\\rightharpoonup\\mathsf\{SourceItems\}for the denotation of messages, where𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\\mathsf\{SourceItems\}is the set of source items, which we discuss more amply in Section[4\.2](https://arxiv.org/html/2607.09489#S4.SS2)\. Because denotation may not be defined, we write:

𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)≜m∈Lang∧s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌∧𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang​\(m\)=s​is defined\.\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\\triangleq m\\in\\textit\{Lang\}\\wedge s\\in\\mathsf\{SourceItems\}\\wedge\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\(m\)=s\\text\{ is defined\}\.
For Oma:Consider the application readiness check messagemreadym\_\{\\textit\{ready\}\}\. Its𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang​\(mready\)=sreadinessChecksPassed\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\(m\_\{\\textit\{ready\}\}\)=s\_\{\\textit\{readinessChecksPassed\}\}records the fact that according to the app design, the message denotes a passed readiness check\. But if Oma edited a required field or replaced the picture after the check, the message still has the same denotation, but the trace no longer supports using it for submission readiness\.

Thus denotation alone does not make a source item usable\.

For Oma:In the prototype,𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}is a schema: a communication messagem∈Langm\\in\\textit\{Lang\}carries explicit fields, and𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang​\(m\)=s\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\(m\)=sis defined only when exactly one row matches\. Thus for themreadym\_\{\\textit\{ready\}\}message above, the app recordsm=\{messageType=CheckResultMessage,actionKind=checkReady,resourceKind=currentDraft,payloadKind=readinessResult,result=passed\}m=\\\{\\texttt\{messageType\}=\\texttt\{CheckResultMessage\},\\texttt\{actionKind\}=\\texttt\{checkReady\},\\texttt\{resourceKind\}=\\texttt\{currentDraft\},\\texttt\{payloadKind\}=\\texttt\{readinessResult\},\\texttt\{result\}=\\texttt\{passed\}\\\}, which matches exactly one row:𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang​\(m\)=sreadinessChecksPassed\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\(m\)=s\_\{\\textit\{readinessChecksPassed\}\}\. If no row matches, denotation is undefined; if more than one row matches, the orchestrator records failed denotation rather than choosing silently\. The action, resource, result kind, and any state on which denotation depends must be explicit inmmor in the trace; hidden browser state, model state, or guessing is not allowed to decide the denotation\.

### 3\.3\.Model of the World

Our model of the world is a formal representation of the external state that an AI system can observe, affect, or be affected by\. It includes at least:

- •the set of possible world statesWW; at timett, the current world state iswtw\_\{t\};
- •the historyw1,…,wtw\_\{1\},\\ldots,w\_\{t\}of world states at timett;
- •what the AI system can observe, via𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\};
- •what the AI system can change, via𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\};
- •which world changes are due to the AI system, users, tools, or external events;
- •specifications saying which reads and writes are allowed or correct\.

The system may observe only part of the world\. We write𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇∈Services×W→Lang\\mathsf\{observation\}\\in\\textit\{Services\}\\times W\\rightarrow\\textit\{Lang\}for the service\-relative observation interface, possibly lossy, permission\-limited, and time\-dependent\.

For Oma:The interface𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}covers things such as reading a prompt, observing an uploaded passport page, capturing or importing a picture, reading the current draft form, inspecting checker results, retrieving official guidance, and observing an interruption or later form edit\.

The AI system may also modify part of the world\. We write𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇∈\(W×Lang\)→W\\mathsf\{actuation\}\\in\(W\\times\\textit\{Lang\}\)\\rightarrow Wfor the actuation interface\. Thus𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,m\)\\mathsf\{actuation\}\(w,m\)should be effectless when the messagem∈Langm\\in\\textit\{Lang\}is not an allowed update from world stateww\.

For Oma:The interface𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\}covers things such as filling a field, saving a draft, taking or importing a picture, exporting a PDF, and recording readiness\.

### 3\.4\.Traces

The world state may change outside the system’s control\. A user, a tool, an external service, may movewtw\_\{t\}towt\+1w\_\{t\+1\}\. The relation between the two states may be unknown to the system\.

For Oma:The app may populate fields in the form from the old passport\. At the same time, Oma may edit a field, replace the uploaded picture, reset the form… We must therefore record observations and invalidations of the current form state before the system may rely on a prior readiness check\.

Thus we keep separate records: the historyw1​…​wtw\_\{1\}\\ldots w\_\{t\}, an event trace recording what happened, and the context, i\.e\. material selected from that trace for a particular component call\. An event is a recorde=⟨𝗇𝖺𝗆𝖾,𝖼𝗈𝗆𝗆𝖾𝗇𝗍,𝖺𝖼𝗍𝗈𝗋,𝗆𝖾𝗌𝗌𝖺𝗀𝖾,𝗄𝗂𝗇𝖽,𝗋𝖾𝗌𝗈𝗎𝗋𝖼𝖾,𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇,𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇,𝖺𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒,𝗐𝗂𝗍𝗇𝖾𝗌𝗌⟩∈Ev\.e=\\langle\\mathsf\{name\},\\mathsf\{comment\},\\mathsf\{actor\},\\mathsf\{message\},\\mathsf\{kind\},\\mathsf\{resource\},\\mathsf\{observation\},\\mathsf\{actuation\},\\mathsf\{authority\},\\mathsf\{witness\}\\rangle\\in\\textit\{Ev\}\.We write e\.g\.e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾e\.\\mathsf\{message\}for the𝗆𝖾𝗌𝗌𝖺𝗀𝖾\\mathsf\{message\}field of the eventee\.

For Oma:Pressing the UI button “Check Everything Ready for Submission” produces an event:eready=\{name=CheckReady,comment=Everything ready for submission checked,actor=AppAgent,message=mready…\}\\begin\{array\}\[\]\{rll\}e\_\{\\textit\{ready\}\}=\\\{&\\texttt\{name\}=\\texttt\{CheckReady\},&\\texttt\{comment\}=\\texttt\{Everything ready for submission checked\},\\\\ &\\texttt\{actor\}=\\texttt\{AppAgent\},&\\texttt\{message\}=m\_\{\\textit\{ready\}\}\\ldots\\\}\\\\ \\end\{array\}

The actor may be e\.g\. the user, a compute component, the environment… The kind records whether the event is a read, write, check, authority event, internal computation, or external mutation\. The resource says what was read, written, or checked\. The observation and actuation fields hold messages in a language discussed in Section[3\.1](https://arxiv.org/html/2607.09489#S3.SS1)\. The authority field records permission, consent, revocation, or delegation\. The witness field records source pointers, tool results, proof objects, checker results, timestamps, or trace slices\.

For Oma:A picture\-check event might recorde\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌=\{𝑠𝑝gov\-pic\-guidance,rpic\-check\}e\.\\mathsf\{witness\}=\\\{\\mathit\{sp\}\_\{\\textit\{gov\-pic\-guidance\}\},r\_\{\\textit\{pic\-check\}\}\\\}, with𝑠𝑝gov\-pic\-guidance\\mathit\{sp\}\_\{\\textit\{gov\-pic\-guidance\}\}a source pointer andrpic\-checkr\_\{\\textit\{pic\-check\}\}a checker result\.

A trace is a finite event sequencetrace=e1​…​en∈𝖳𝗋𝖺𝖼𝖾≜Ev∗\\textit\{trace\}=e\_\{1\}\\ldots e\_\{n\}\\in\\mathsf\{Trace\}\\triangleq\\textit\{Ev\}^\{\\ast\}\. For0≤k≤n0\\leq k\\leq n, lettrace≤k≜e1​…​ek\\textit\{trace\}\_\{\\leq k\}\\triangleq e\_\{1\}\\ldots e\_\{k\}, withtrace≤0=ϵ\\textit\{trace\}\_\{\\leq 0\}=\\epsilon, be the prefix of the trace available afterkkevents\. Often, we identify the timettwith the current number of events recorded in the trace\.

For Oma:A trace for the scenario where Oma successfully submits her UK passport renewal application by scanning her old passport to populate the form is as follows:⟨UKRenewalPicked,ObservePassport,\\langle\\texttt\{UKRenewalPicked\},\\texttt\{ObservePassport\},PopulateFields,CheckPicture,CheckForm,ConfirmDraft,CheckEverything\\texttt\{PopulateFields\},\\texttt\{CheckPicture\},\\texttt\{CheckForm\},\\texttt\{ConfirmDraft\},\\texttt\{CheckEverything\} ReadyForSubmission,SubmissionPermit,Submit⟩\.\\texttt\{ReadyForSubmission\},\\texttt\{SubmissionPermit\},\\texttt\{Submit\}\\rangle\.The events’ names are shorthands for the events, e\.g\.CheckReadyfor the eventereadye\_\{\\textit\{ready\}\}above\.

The world state history, event trace, and context are related but not identical\. A read may add an event without changing the physical world\. A write may both add an event and move the world fromwtw\_\{t\}towt\+1w\_\{t\+1\}\. An external mutation may change the world before the AI system has observed it\. The context may omit trace events, summarise them, or include computed communication messages, but it is not the authority record used by event specifications\.

For Oma:The model of the world rules out states that cannot be true of the passport renewal application: the same current draft cannot both contain and not contain a required field value; a readiness check cannot be for a picture different from the current uploaded picture; and a filled PDF cannot faithfully represent a form state that has since been reset or edited\.

### 3\.5\.Context

Calls to AI systems are often talked about in terms of their context\. We letctx∈Lang∗\\textit\{ctx\}\\in\\textit\{Lang\}^\{\\ast\}range over messages available to the system at some point in the trace\. More specifically,ctxis an application\-specific abstraction oftrace:ctxt∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\textit\{ctx\}\_\{t\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\): when selecting context, the system may compress, forget, compact, rearrange the context as required by the application\. The selection may use the orchestrator policy, component being called, memory state, and context\-window budget\.

### 3\.6\.Prompts

Users communicate with a system via prompts: a system prompt is a standing constraint recorded in the trace and reflected in the contexts selected from it\. A user prompt is what the system is being asked to do right now, also recorded in the trace\.

Some prompts gather information, e\.g\. reading files or making web searches\. Other prompts require actions from the system, e\.g\. answering questions, creating or editing files, calling tools\.

## 4\.Information State of an AI system

We aim to distinguish the underlying semantics from the reference sources, and to distinguish these two objects from what the AI system is using\. Thus we introduce three different knowledge bases which, together with the reference sourcesSrct\\textit\{Src\}\_\{t\}constitute the Information State of an AI system:

- •Section[4\.1](https://arxiv.org/html/2607.09489#S4.SS1)defines the universal knowledge baseKU,tK\_\{U,t\}: accepted domain knowledge\.
- •The reference sourcesSrct\\textit\{Src\}\_\{t\}consist of source pointers or resources: pages, files, tool results…\.
- •Section[4\.2](https://arxiv.org/html/2607.09489#S4.SS2)defines the source\-derived knowledge baseKS,Src,tK\_\{S,\\textit\{Src\},t\}, computed from facts extracted fromSrct\\textit\{Src\}\_\{t\}: it may be wrong, incomplete, stale, or inconsistent\.
- •Section[4\.3](https://arxiv.org/html/2607.09489#S4.SS3)defines the AI system’s effective knowledge baseKE,ctx,tK\_\{E,\\textit\{ctx\},t\}: what the system can use from the current contextctx, including mistaken, stale, compressed material\.KE,ctx,tK\_\{E,\\textit\{ctx\},t\}is not what is in context; rather the context is an input toKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\.

For Oma:ctxmay contain messages describing the official guidance, picture\-check result, and confirmation record, whileSrccontains e\.g\. passport\-picture or form\-validity rules\.

Throughout the paper, when we use conceptual objects that exist in the mathematics but may not appear directly in an AI system implementation, we highlight them with an overline, e\.g\.U¯\\bar\{U\}\.

### 4\.1\.Universal Knowledge Base

The domain of the universal knowledge baseKU,tK\_\{U,t\}is a universeU¯\\bar\{U\}such that:

- •The elements of the universeU¯\\bar\{U\}encode facts, objects, and reasoning steps: token sequences, pictures, videos, recordings, theorems, proofs, laws, programs, events, permissions… One can readU¯\\bar\{U\}as many\-sorted, or as a single encoded universe with tags for the different sorts of objects;
- •Without loss of generality,U¯\\bar\{U\}need not evolve in time: it can be a sufficiently large set of representations, and contain the objects we need: functions, relations, sets, sequences, traces…

For Oma:Elements ofU¯\\bar\{U\}include picture facts, form field values, source claims, confirmation events, readiness facts, and claims about whether a given app action is allowed, as well as definition of the data appearing on a passport, database where this data is recorded, how to access that database, …

The Universal Knowledge Base w\.r\.t\. a universeU¯\\bar\{U\}and a rule systemR¯t\\bar\{R\}\_\{t\}overU¯\\bar\{U\}at a timettconsists of selected hypothesesH¯t⊆U¯\\bar\{H\}\_\{t\}\\subseteq\\bar\{U\}together with the rule systemR¯t\\bar\{R\}\_\{t\}:KU,t≜⟨U¯,H¯t,R¯t,t⟩K\_\{U,t\}\\triangleq\\langle\\bar\{U\},\\bar\{H\}\_\{t\},\\bar\{R\}\_\{t\},t\\rangle\.

For Oma:H¯t\\bar\{H\}\_\{t\}may include current domain facts such as the applicable passport renewal rules, the meaning of form fields, and the validity conditions for a submission, whileR¯t\\bar\{R\}\_\{t\}contains rules for deriving claims such as whether a draft is complete, whether a picture satisfies the applicable requirements, and whether an application may be submitted\.

### 4\.2\.Source\-derived Knowledge Base

We assume that an AI system cannot always range over everything inU¯\\bar\{U\}\. Instead, a system has a scopeScope¯⊆U¯\\overline\{\\textit\{Scope\}\}\\subseteq\\bar\{U\}, and within that scope it may lose distinctions that are present in the universal knowledge base\. We model these two limits by an ignorance abstraction and a forgetfulness abstraction, which yield Galois connections in abstract interpretation\(Cousot and Cousot,[1979](https://arxiv.org/html/2607.09489#bib.bib54)\)\.

#### 4\.2\.1\.Ignorance and Forgetfulness Abstractions

##### Ignorance\.

Theignore¯\\overline\{\\textit\{ignore\}\}abstraction ignores what falls outside this scope:ignore¯​\(X\)=X∩Scope¯\\overline\{\\textit\{ignore\}\}\(X\)=X\\cap\\overline\{\\textit\{Scope\}\}forX∈℘​\(U¯\)X\\in\\wp\(\\bar\{U\}\)\. The same restriction applies to rules:ignore¯​\(R¯t\)≜\{Pc∈R¯t\|P⊆Scope¯∧c∈Scope¯\}\\overline\{\\textit\{ignore\}\}\(\\bar\{R\}\_\{t\}\)\\triangleq\\Bigl\\\{\\frac\{P\}\{c\}\\in\\bar\{R\}\_\{t\}\\Bigm\|P\\subseteq\\overline\{\\textit\{Scope\}\}\\wedge c\\in\\overline\{\\textit\{Scope\}\}\\,\\Bigr\\\}\. Thusignore¯​\(R¯t\)\\overline\{\\textit\{ignore\}\}\(\\bar\{R\}\_\{t\}\)is sound but incomplete relative toR¯t\\bar\{R\}\_\{t\}: any proof inScope¯\\overline\{\\textit\{Scope\}\}is also a proof inU¯\\bar\{U\}, but some proofs inU¯\\bar\{U\}disappear because some facts, premises, or rules are outside the system’s scope\.

For Oma:Ignorance is exemplified by a system that does not encode every possible law, or institutional process that might not matter to passport renewal\.

##### Forgetfulness\.

Theforget¯\\overline\{\\textit\{forget\}\}abstraction formalises loss of distinctions inside the system’s scope\. We write≡f\\equiv\_\{f\}for the application\-specific equivalence relation onScope¯\\overline\{\\textit\{Scope\}\}that identifies semantic objects the AI system’s representation cannot distinguish, and\[x\]≡f\[x\]\_\{\\equiv\_\{f\}\}for the equivalence class represented byxx\. On sets,forget¯​\(X\)=\{\[x\]≡f∣x∈X\}\\overline\{\\textit\{forget\}\}\(X\)=\\\{\[x\]\_\{\\equiv\_\{f\}\}\\mid x\\in X\\\}\. On rules,forget¯​\(R\)≜\{\{\[p\]≡f\|p∈P\}​\[c\]≡f\|Pc∈R\}\\overline\{\\textit\{forget\}\}\(R\)\\triangleq\\biggl\\\{\\frac\{\\\{\\,\[p\]\_\{\\equiv\_\{f\}\}\\;\|\\;p\\in P\\,\\\}\}\{\\hbox\{\\vrule height=0\.0pt,depth=0\.0pt,width=0\.0pt\}\[c\]\_\{\\equiv\_\{f\}\}\}\\biggm\|\\frac\{P\}\{c\}\\in R\\biggr\\\}\\,, so abstract rules can no longer distinguish equivalent pieces of information\.

For Oma:Forgetting is exemplified by a system compressing a passport image\. For Oma’s passport application, a full\-resolution passport image, an OCR record, and a statement such as “old passport number wasXX” may be distinct inU¯\\bar\{U\}, but the app may represent all of them by the same object\.

#### 4\.2\.2\.Source\-derived Knowledge Base and its semantics

The reference sourcesSrct\\textit\{Src\}\_\{t\}are not themselves facts: source\-item factsFS,Src,t⊆𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌F\_\{S,\\textit\{Src\},t\}\\subseteq\\mathsf\{SourceItems\}\(with𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌≜Scope¯/≡f\\mathsf\{SourceItems\}\\triangleq\\overline\{\\textit\{Scope\}\}/\{\\equiv\_\{f\}\}\) are extracted fromSrct\\textit\{Src\}\_\{t\}\. The corresponding rule system isRS,t≜forget¯​\(ignore¯​\(R¯t\)\)R\_\{S,t\}\\triangleq\\overline\{\\textit\{forget\}\}\\,\(\\overline\{\\textit\{ignore\}\}\\,\(\\bar\{R\}\_\{t\}\)\)\. Thus the source\-derived knowledge base isKS,Src,t≜⟨𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌,FS,Src,t,RS,t,t⟩K\_\{S,\\textit\{Src\},t\}\\triangleq\\langle\\mathsf\{SourceItems\},F\_\{S,\\textit\{Src\},t\},R\_\{S,t\},t\\rangle\. Its inference operator isInferRS,t\\textsf\{Infer\}\_\{R\_\{S,t\}\}, and𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌→℘​\(U¯\)\\mathsf\{denotation\}\_\{U\}\\in\\mathsf\{SourceItems\}\\rightarrow\\wp\(\\bar\{U\}\)defines the semantics of the source\-derived knowledge baseKS,Src,tK\_\{S,\\textit\{Src\},t\}w\.r\.t\. the universal knowledge baseKU,tK\_\{U,t\}\.

For Oma:A picture with infinite precision might be inKU,tK\_\{U,t\}, and its grainy processed sibling inKS,Src,tK\_\{S,\\textit\{Src\},t\}\.

### 4\.3\.Effective knowledge base

This section defines the Effective knowledge base of an AI system, i\.e\. the material the system works with\. It may be distinct from the Universal and Source\-derived Knowledge Bases, and instead be built from what is often called the contextctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\), gathered e\.g\. from interactions with the world recorded intrace\.

For Oma:WWcontains Oma, the phone, the old passport, the camera view, the doorbell, the draft form, the saved picture, and the government site\. The interface𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}covers things such as camera images, form text, retrieval results, and interruption notifications\.

#### 4\.3\.1\.Effective knowledge base and its Semantics

We letKE,ctx,tK\_\{E,\\textit\{ctx\},t\}be the effective knowledge of an AI system:KE,ctx,t≜⟨Lang,FE,ctx,t,RE,ctx,t,t⟩K\_\{E,\\textit\{ctx\},t\}\\triangleq\\langle\\textit\{Lang\},F\_\{E,\\textit\{ctx\},t\},R\_\{E,\\textit\{ctx\},t\},t\\rangle\.

Recall that the contextctxis gathered by the orchestrator by interaction with users or external agents\. The factsFE,ctx,t≜\{m∣m∈ctx\}F\_\{E,\\textit\{ctx\},t\}\\triangleq\\\{m\\mid m\\in\\textit\{ctx\\/\}\\\}are directly extracted from this contextctx\.

#### 4\.3\.2\.Context is not Effective Knowledge

Recall that contextctxis an application\-specific abstraction of thetrace\(which may include loss or extrapolation\)\. Thusctxlives inLang: it is not itself a knowledge base, nor is it a subset of the effective knowledgeKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\.

Indeed context can contain something the system fails to use\. A retrieved document may state the correct rule, but the model may overlook it: the rule is in context, but not justified byKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\.

For Oma:If the context says “Oma has not confirmed readiness,” the orchestrator may justify a source itemsreadinessNotAlloweds\_\{\\textit\{readinessNotAllowed\}\}even if that exact symbol does not occur in the context\.

A context window is a bounded fragment of the context, sent as a response to a call: the bound is imposed by the model and its deployment: tokens, bytes, image slots, file attachments, retrieved chunks, tool\-result size, latency, cost, or policy\.

#### 4\.3\.3\.Context is not Trace

At a high\-level,traceis the event history: observations, actions, tool calls, UI events, confirmations, invalidations, timestamps, provenance, andctxis an application\-specific abstraction \(including potential loss and extrapolation\) available to the AI system for buildingKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\. ThusKE,ctx,tK\_\{E,\\textit\{ctx\},t\}depends solely onctx, not the wholetrace\.

By contrast, event validity and source witness provenance often need trace, becausectxmay omit or summarise the events that matter\.

Without the distinction, we may accidentally assume eitherctx = traceso the system has perfect access to the whole event history, ortrace = ctxwhich means we will not really be able to audit the system, because we will only have access to the context\.

For Oma:“Oma confirmed the current draft and no later edit invalidated it” is a trace property, not merely a context\-message property\.

### 4\.4\.Knowledge Base Statuses

Justification of a claim by a knowledge base is only potential by default\. Writing\+\+,−\-,±\\pm, and??for the base justification statuses of Section[•‣2](https://arxiv.org/html/2607.09489#S2.I1.i5), and⊕\\oplusfor the derived one\-sided shorthand, we record what is justified by the Effective knowledge baseKE,ctx,tK\_\{E,\\textit\{ctx\},t\}, the Source\-derived knowledge baseKS,Src,tK\_\{S,\\textit\{Src\},t\}, and the Universal knowledge baseKU,tK\_\{U,t\}\. To keep the selected knowledge base explicit, each status predicate takes it as a parameter\(×∈\{\+,−,±,?\}\)\(\\times\\in\\\{\+,\-,\\pm,?\\\}\):

𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾×,t​\(m,s;KE,ctx,t\)\\displaystyle\\mathsf\{Effective\}\_\{\\times,t\}\(m,s;K\_\{E,\\textit\{ctx\},t\}\)≜𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang\(m,s\)∧KE,ctx,t⊢t×m\\displaystyle\\triangleq\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\\wedge K\_\{E,\\textit\{ctx\},t\}\\vdash^\{\\times\}\_\{t\}m𝖲𝗈𝗎𝗋𝖼𝖾×,t​\(s;KS,Src,t\)\\displaystyle\\mathsf\{Source\}\_\{\\times,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)≜s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌∧KS,Src,t⊢t×s\\displaystyle\\triangleq s\\in\\mathsf\{SourceItems\}\\wedge K\_\{S,\\textit\{Src\},t\}\\vdash^\{\\times\}\_\{t\}s𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅×,t​\(c;KU,t\)\\displaystyle\\mathsf\{Universal\}\_\{\\times,t\}\(c;K\_\{U,t\}\)≜c∈U¯∧KU,t⊢t×c\\displaystyle\\triangleq c\\in\\bar\{U\}\\wedge K\_\{U,t\}\\vdash^\{\\times\}\_\{t\}c

### 4\.5\.Relationships between Knowledge Bases

An AI system may not normally possess the universal knowledge base directly\. Rather it builds an Effective knowledge base from reference sources, observations, tool results, memory, local system state, and traces\. An AI actuation, whether an answer to a question or an action performed, comes from that effective knowledge base\. It may or may not match the reference sources, and it may or may not match the universal knowledge base\. Contrary to mathematics, reference sources need not be consistent: both a conclusion and its contrary may be reached from defective sources\.

The universal knowledge baseKU,tK\_\{U,t\}is assumed given: in generalKU,tK\_\{U,t\}will be application\-dependent and thus the only general comment about it is that it needs rules describing known facts \(axioms\) and reasoning steps \(induction rules\)\. But in many domains, natural\-language semantics is unclear, disputed, or changing, soKU,tK\_\{U,t\}is not fully available as a clean mathematical object\. In other domains, such as mathematics, certain formally specified programming languages, controlled forms, or controlled English,KU,tK\_\{U,t\}may be precise enough to state obligations, but checking those obligations may still be undecidable, expensive, approximate, or domain\-specific\.

For Oma:KU,tK\_\{U,t\}is the current normative passport\-renewal process: which UK or French renewal route applies, what the form fields mean, what picture conditions are required, and what authority is needed before the app may mark a draft ready or submit it\. Official pages areSrct\\textit\{Src\}\_\{t\}; parsed guidance and OCR/MRZ output areFS,Src,tF\_\{S,\\textit\{Src\},t\}; their source\-derived closure isKS,Src,tK\_\{S,\\textit\{Src\},t\}\.

Source evidence has a different status\. A source pointer𝑠𝑝∈Srct\\mathit\{sp\}\\in\\textit\{Src\}\_\{t\}, recorded in a trace witness field, can witness that the system retrieved or cited a source\. It does not by itself show that the source was current, official, complete, or authoritative, nor does it show that the system correctly interpreted the source: that is an obligation on the construction ofKS,Src,tK\_\{S,\\textit\{Src\},t\}fromSrct\\textit\{Src\}\_\{t\}\.

Finally, even if a source item is present in the system’s effective knowledgeKE,ctx,tK\_\{E,\\textit\{ctx\},t\}, that only says that the system can currently use that item\. It does not by itself show that any semantic claim asserted through the item is justified byKS,Src,tK\_\{S,\\textit\{Src\},t\}, true inKU,tK\_\{U,t\}, or authorised by the user\.

These limitations are not a reason to abandon the formalisation\. They mark where the obligations sit\. IfKU,tK\_\{U,t\}is unclear, an application written overKU,tK\_\{U,t\}should explicitly disclaim that\. If source material is stale or unofficial, the issue is inSrct\\textit\{Src\}\_\{t\}\. If extraction or interpretation is wrong, the issue is inKS,Src,tK\_\{S,\\textit\{Src\},t\}\. If the system relies on a compressed, inferred, or approximate item, the issue is inKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\. If a witness only supports the fact that a source said something, and not the semantic claim itself, that distinction should remain visible in the trace through source pointers and witness fields\.

## 5\.From Candidate Claims to Reliable Claims

We aim to determine when a claim made or used by the system may be reliable\. The following diagram illustrates relationships between the concepts we introduce:

![[Uncaptioned image]](https://arxiv.org/html/2607.09489v1/x1.png)

### 5\.1\.Candidate Claims

The Effective knowledge baseKE,ctx,tK\_\{E,\\textit\{ctx\},t\}overLangrecords what the system is justified to use at timettfor the contextctx\. For a messagem∈Langm\\in\\textit\{Lang\}, its being justified by the Effective knowledge base does not mean it is true\.

For Oma:sreadinessChecksPasseds\_\{\\textit\{readinessChecksPassed\}\}being justified byKE,ctx,tK\_\{E,\\textit\{ctx\},t\}just means that this readiness\-check result is considered usable for the current draft\. It should not be justified byKE,ctx,tK\_\{E,\\textit\{ctx\},t\}if Oma edited a required field, replaced the picture, or if a later trace event otherwise invalidated the draft state\.

For a messagemmjustified byKE,ctx,tK\_\{E,\\textit\{ctx\},t\}, the map𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌∈Lang→℘​\(U¯\)\\mathsf\{CandidateClaims\}\\in\\textit\{Lang\}\\rightarrow\\wp\(\\bar\{U\}\)records which claimsmmmight be standing for\. We letsms\_\{m\}be the unique source itemsss\.t\.𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\. Then:

𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)≜\{𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U​\(sm\),if​sm​is defined,∅,otherwise\.\\mathsf\{CandidateClaims\}\(m\)\\triangleq\\begin\{cases\}\\mathsf\{denotation\}\_\{U\}\(s\_\{m\}\),&\\text\{if \}s\_\{m\}\\text\{ is defined\},\\\\ \\emptyset,&\\text\{otherwise\.\}\\end\{cases\}Whensms\_\{m\}is defined, the claims in𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\mathsf\{CandidateClaims\}\(m\)are the semantic claims associated with the source itemsms\_\{m\}\. This may be a set with several elements because of the forgetfulness abstraction\. Ifsms\_\{m\}is undefined,mmhas no candidate claims\.

An empty candidate\-claim set does not by itself make an event valid: event validity separately requires the event message to have defined denotation when the event is checked\.

For Oma:A priori𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(mready\)\\mathsf\{CandidateClaims\}\(m\_\{\\textit\{ready\}\}\)might mean that the readiness checker returned normally, or that all required form fields were nonempty, or that the picture check and form check both passed for the current draft, or that the current draft satisfies the local readiness conditions for submission\.

The definition of𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{CandidateClaims\}, like that of the underlying semantics, is application\-dependent\. It is the role of e\.g\. application developers and semanticists to define suitable semantics and corresponding maps, given a domain and application\. For an itemmm,𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\mathsf\{CandidateClaims\}\(m\)needs to say which underlying claimsmmis allowed to stand for\. There may be a priori more than one, and the application developers and semanticists need to determine which claims must be distinguished\.

For Oma:In the app, the denotation schema maps messagemreadym\_\{\\textit\{ready\}\}to a source itemsreadinessChecksPasseds\_\{\\textit\{readinessChecksPassed\}\}\. We then look up the row for that source itemsreadinessChecksPassed↦\{𝖱𝖾𝖺𝖽𝗂𝗇𝖾𝗌𝗌𝖢𝗁𝖾𝖼𝗄𝗌𝖯𝖺𝗌𝗌𝖾𝖽​\(currentDraft\)\}s\_\{\\textit\{readinessChecksPassed\}\}\\mapsto\\\{\\mathsf\{ReadinessChecksPassed\}\(\\texttt\{currentDraft\}\)\\\}\. This only says that the app’s local readiness check passed for the current draft\. Since the row does not contain, e\.g\.𝖴𝗌𝖾𝗋𝖯𝖾𝗋𝗆𝗂𝗌𝗌𝗂𝗈𝗇𝖦𝗂𝗏𝖾𝗇​\(Submission\)\\mathsf\{UserPermissionGiven\}\(\\texttt\{Submission\}\), the orchestrator must not infer that permission from the readiness result\. Thus permission can only come from an explicit separate message from Oma\.

### 5\.2\.Asserted Claims

The map𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{CandidateClaims\}records what a message could mean\. To say which of those candidate claims the system is actually asserting through the message, we use an application\-specific predicate𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t​\(m,c\)\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\}\(m,c\), s\.t\.𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t​\(m,c\)⇒m∈Lang∧c∈𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\Rightarrow m\\in\\textit\{Lang\}\\wedge c\\in\\mathsf\{CandidateClaims\}\(m\)\.

The asserted claims ofmmare then:

𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t\(m\)≜\{c∈𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\(m\)∣KE,ctx,t⊢t\+m∧𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t\(m,c\)\}\.\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(m\)\\triangleq\\\{\\,c\\in\\mathsf\{CandidateClaims\}\(m\)\\mid K\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}m\\wedge\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\,\\\}\.Thus𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\mathsf\{CandidateClaims\}\(m\)records possible meanings, while𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t​\(m\)\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(m\)records the candidate claims that the system actually asks the user, caller, or downstream component to rely on\. The positive effective\-knowledge conditionKE,ctx,t⊢t\+mK\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}mexcludes messages that are refuted, contradictory, or unjustified inKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\. This does not entail that any asserted claim is justified by the source\-derived knowledge base, let alone by the universal knowledge base\.

### 5\.3\.Supported Claims

Source support records which semantic claim a source\-derived item supports\. We write𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t\\mathsf\{SourceSupport\}\_\{t\}⊆𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌×U¯\\subseteq\\mathsf\{SourceItems\}\\times\\bar\{U\}and read𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)as: at timett, source itemsssupports the semantic claimcc\. Source support is application\-defined, but it must respect denotation:𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)⇒s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌∧c∈𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U​\(s\)\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\\Rightarrow s\\in\\mathsf\{SourceItems\}\\wedge c\\in\\mathsf\{denotation\}\_\{U\}\(s\)\.

For a messagemmjustified byKE,ctx,tK\_\{E,\\textit\{ctx\},t\}, i\.e\.KE,ctx,t⊢t\+mK\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}m, the corresponding candidate claims are𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\mathsf\{CandidateClaims\}\(m\)\. This does not mean that those claims are justified by the source\-derived knowledge baseKS,Src,tK\_\{S,\\textit\{Src\},t\}, let alone the universal knowledge baseKU,tK\_\{U,t\}\. The predicate

𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;KU,t,KS,Src,t\)≜m∈Lang∧c∈𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)\\displaystyle\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\\triangleq m\\in\\textit\{Lang\}\\wedge c\\in\\mathsf\{CandidateClaims\}\(m\)∧∃s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\.𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\qquad\{\}\\wedge\\exists s\\in\\mathsf\{SourceItems\}\\mathrel\{\.\}\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\.\\displaystyle\\qquad\{\}\\wedge\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\.says thatccis definitely justified by the Universal Knowledge base, and that it is supported by a source itemssdefinitely justified by the Source\-derived Knowledge base\.

For Oma:The claim that the draft satisfiescreadinessChecksPassed=𝖱𝖾𝖺𝖽𝗂𝗇𝖾𝗌𝗌𝖢𝗁𝖾𝖼𝗄𝗌𝖯𝖺𝗌𝗌𝖾𝖽​\(currentDraft\)c\_\{\\textit\{readinessChecksPassed\}\}=\\mathsf\{ReadinessChecksPassed\}\(\\texttt\{currentDraft\}\)is supported only if the relevant passport rules are available as source\-derived knowledge, the form\-completeness check and picture check apply to the current draft, Oma confirmed that draft\.

### 5\.4\.Reliable Claims

𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆\\mathsf\{SupportedClaim\}checks whether the candidate claimccis justified by the universal and source\-derived knowledge bases\. Reliability also requires that the messagemmthrough which the system usesccis justified by current effective knowledge and thatccis one of the asserted claims ofmm\. With𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)≜m∈Lang∧c∈𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t​\(m\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\triangleq m\\in\\textit\{Lang\}\\wedge c\\in\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(m\), the full reliability predicate is

𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(m,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)≜\\displaystyle\\mathsf\{ReliableClaim\}\_\{t\}\(m,c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\\triangleq𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t\(m,c\)∧KE,ctx,t⊢t\+m∧𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t\(m,c;KU,t,KS,Src,t\)\.\\displaystyle\\qquad\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge K\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}m\\wedge\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\.ThusKE,ctx,tK\_\{E,\\textit\{ctx\},t\}appears in the judgment for what the system may use, while the support check is grounded in the source\-derived and universal knowledge bases\.

For Oma:Pressing a button confirming readiness records eventeready∈tracee\_\{\\textit\{ready\}\}\\in\\textit\{trace\}with messagemreadym\_\{\\textit\{ready\}\}\. Then:mready\{m\_\{\\textit\{ready\}\}\}sreadinessChecksPassed\{s\_\{\\textit\{readinessChecksPassed\}\}\}creadinessChecksPassed\{c\_\{\\textit\{readinessChecksPassed\}\}\}𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(mready,creadinessChecksPassed;KU,t,KS,Src,t\)\{\\mathsf\{SupportedClaim\}\_\{t\}\(m\_\{\\textit\{ready\}\},c\_\{\\textit\{readinessChecksPassed\}\};K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\}𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mready,creadinessChecksPassed;KE,ctx,t,KS,Src,t,KU,t,ctx\)\{\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{\\textit\{ready\}\},c\_\{\\textit\{readinessChecksPassed\}\};K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\}𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang\\scriptstyle\{\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\}creadinessChecksPassed∈𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(mready\)𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(sreadinessChecksPassed,creadinessChecksPassed\)𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(sreadinessChecksPassed;KS,Src,t\)\\scriptstyle\{\\begin\{array\}\[\]\{@\{\}l@\{\}\}c\_\{\\textit\{readinessChecksPassed\}\}\\in\\mathsf\{CandidateClaims\}\(m\_\{\\textit\{ready\}\}\)\\\\ \\mathsf\{SourceSupport\}\_\{t\}\(s\_\{\\textit\{readinessChecksPassed\}\},c\_\{\\textit\{readinessChecksPassed\}\}\)\\\\ \\mathsf\{Source\}\_\{\+,t\}\(s\_\{\\textit\{readinessChecksPassed\}\};K\_\{S,\\textit\{Src\},t\}\)\\end\{array\}\}𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(creadinessChecksPassed;KU,t\)\\scriptstyle\{\\mathsf\{Universal\}\_\{\+,t\}\(c\_\{\\textit\{readinessChecksPassed\}\};K\_\{U,t\}\)\}creadinessChecksPassed∈𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t​\(mready\)KE,ctx,t⊢t\+mready\\scriptstyle\{\\begin\{array\}\[\]\{@\{\}l@\{\}\}c\_\{\\textit\{readinessChecksPassed\}\}\\in\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(m\_\{\\textit\{ready\}\}\)\\\\ K\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}m\_\{\\textit\{ready\}\}\\end\{array\}\}A string “result = passed” in the context window is not enough: context presence is input\-level,KE,ctx,tK\_\{E,\\textit\{ctx\},t\}is effective\-knowledge justification, and only𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t\\mathsf\{ReliableClaim\}\_\{t\}justifies use\.

## 6\.What could possibly go wrong

A number of things could go wrong, and we distinguish at least two cases: reliance failures occur when the various layers of knowledge disagree, leading to an unreliable claim; history failures occur when the trace disagrees with certain claims, for example when a source becomes stale\.

### 6\.1\.Reliance failure diagnostics

A reliance failure is a claim which may not be relied on:

𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t,ctx​\(m,c\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧¬𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(m,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\.\\mathsf\{RelianceFailure\}\_\{t,\\textit\{ctx\}\}\(m,c\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\neg\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m,c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\.
This section gives reasons leading to reliance failures: the semantic machinery established in the previous section allows us to diagnose mismatches for asserted claims\.

For Oma:An unsupported assertion may be a claim that the passport picture rule allows something that the current official rule does not allow\. An added hypothesis may be the system silently assuming that the old passport is still valid\. A source\-derived vs universal mismatch is an outdated web page that conflicts with the current official guidance\. A useful output is therefore not only the generated answer, but also, e\.g\., the source pointer to the official rule against which the claim is checked\.

Given a messagem∈Langm\\in\\textit\{Lang\}whose denotation is defined, lets=𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang​\(m\)∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌s=\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\(m\)\\in\\mathsf\{SourceItems\}\. The claims to classify are𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t​\(m\)\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(m\), not every candidate claim that the denoted source item could have stood for\. Each diagnostic is a sufficient reason for a reliance failure:

- •*Refuted Assertion\.*If𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)also holds,KU,tK\_\{U,t\}refutes the claim: 𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\.\\mathsf\{RefutedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\triangleq\{\}\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)\.
- •*Unsupported Assertion\.*If𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅?,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{?,t\}\(c;K\_\{U,t\}\)holds, the use is an unsupported assertion: 𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧∃s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\.𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\qquad\{\}\\mathsf\{UnsupportedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\exists s\\in\\mathsf\{SourceItems\}\\mathrel\{\.\}\\,\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾⊕,t​\(m,s;KE,ctx,t\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅?,t​\(c;KU,t\)∧¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;KU,t,KS,Src,t\)\.\\displaystyle\\qquad\{\}\\qquad\{\}\\wedge\\mathsf\{Effective\}\_\{\\oplus,t\}\(m,s;K\_\{E,\\textit\{ctx\},t\}\)\\wedge\\mathsf\{Universal\}\_\{?,t\}\(c;K\_\{U,t\}\)\\wedge\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\. The unsupported claim may originate with𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\), or it may be invented by the AI system when𝖲𝗈𝗎𝗋𝖼𝖾±,t​\(s;KS,Src,t\)\\mathsf\{Source\}\_\{\\pm,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)or𝖲𝗈𝗎𝗋𝖼𝖾?,t​\(s;KS,Src,t\)\\mathsf\{Source\}\_\{?,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)holds\. This corresponds to what is often referred to as hallucinations, e\.g\. invented citations; fabricated details…
- •*Extrapolation\.*This is the assertion of a claimccthrough a messagemmwhen the corresponding source itemssis not one\-sided and the universal status ofccis contradictory: 𝖤𝗑𝗍𝗋𝖺𝗉𝗈𝗅𝖺𝗍𝗂𝗈𝗇t​\(m,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧∃s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\.𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\mathsf\{Extrapolation\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\exists s\\in\\mathsf\{SourceItems\}\\mathrel\{\.\}\\,\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾⊕,t​\(m,s;KE,ctx,t\)∧¬𝖲𝗈𝗎𝗋𝖼𝖾⊕,t​\(s;KS,Src,t\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)\.\\displaystyle\\qquad\{\}\\wedge\\mathsf\{Effective\}\_\{\\oplus,t\}\(m,s;K\_\{E,\\textit\{ctx\},t\}\)\\wedge\\neg\\,\\mathsf\{Source\}\_\{\\oplus,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\)\.
- •*Source\-Derived vs Universal Mismatch\.*If a messagemmdenotes a source itemssjustified byKS,Src,tK\_\{S,\\textit\{Src\},t\}, and an asserted claimc∈𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U​\(s\)c\\in\\mathsf\{denotation\}\_\{U\}\(s\)is contradictory inKU,tK\_\{U,t\}, there is a mismatch: 𝖲𝗈𝗎𝗋𝖼𝖾𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅𝖬𝗂𝗌𝗆𝖺𝗍𝖼𝗁t​\(m,s,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\mathsf\{SourceUniversalMismatch\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧c∈𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U​\(s\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)\.\\displaystyle\\qquad\{\}\\wedge c\\in\\mathsf\{denotation\}\_\{U\}\(s\)\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\)\.
- •*Spurious Support\.* 𝖲𝗉𝗎𝗋𝗂𝗈𝗎𝗌𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(m,s,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\displaystyle\\mathsf\{SpuriousSupport\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\\wedge\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)∧¬𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)\\displaystyle\\qquad\{\}\\wedge\\neg\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)The claim is true, but the specific source item cited for it is refuted, contradictory, or unknown\. Therefore a debunked or unverifiable source is cited for something that happens to be correct\.
- •*Source Support Gap\.* 𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖦𝖺𝗉t​\(m,s,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\mathsf\{SourceSupportGap\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧¬𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\\displaystyle\\hskip 18\.49988pt\{\}\\wedge\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\neg\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)The claim is true and the cited source item is itself well\-justified but it just doesn’t actually support this particular claim\.
- •*Refuted Source, Contradictory Claim*Although the universal semantics findscccontradictory, the source itemssis definitely refuted: 𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾𝖢𝗈𝗇𝗍𝗋𝖺𝖽𝗂𝖼𝗍𝗈𝗋𝗒𝖢𝗅𝖺𝗂𝗆t​\(m,s,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\mathsf\{RefutedSourceContradictoryClaim\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾−,t​\(s;KS,Src,t\)\\displaystyle\\qquad\{\}\\wedge\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\)\\wedge\\mathsf\{Source\}\_\{\-,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)

The exhaustiveness result below classifies reliance failures only for asserted claims whose message has defined denotation; events with undefined denotation are rejected by event validity rather than by this reliance taxonomy\. We give all proof sketches in appendix\.

###### Theorem 1 \(Exhaustiveness\)\.

If𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)and𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\), then it is the case that𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t,ctx​\(m,c\)\\mathsf\{RelianceFailure\}\_\{t,\\textit\{ctx\}\}\(m,c\)holds if and only if at least one of the following holds:

𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\),𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\),𝖤𝗑𝗍𝗋𝖺𝗉𝗈𝗅𝖺𝗍𝗂𝗈𝗇t​\(m,c;ctx\),𝖲𝗈𝗎𝗋𝖼𝖾𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅𝖬𝗂𝗌𝗆𝖺𝗍𝖼𝗁t​\(m,s,c;ctx\),𝖲𝗉𝗎𝗋𝗂𝗈𝗎𝗌𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(m,s,c;ctx\),𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖦𝖺𝗉t​\(m,s,c;ctx\),𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾𝖢𝗈𝗇𝗍𝗋𝖺𝖽𝗂𝖼𝗍𝗈𝗋𝗒𝖢𝗅𝖺𝗂𝗆t​\(m,s,c;ctx\)\.\\begin\{gathered\}\\mathsf\{RefutedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\),\\qquad\\mathsf\{UnsupportedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\),\\\\ \\mathsf\{Extrapolation\}\_\{t\}\(m,c;\\textit\{ctx\}\),\\qquad\\mathsf\{SourceUniversalMismatch\}\_\{t\}\(m,s,c;\\textit\{ctx\}\),\\\\ \\mathsf\{SpuriousSupport\}\_\{t\}\(m,s,c;\\textit\{ctx\}\),\\qquad\\mathsf\{SourceSupportGap\}\_\{t\}\(m,s,c;\\textit\{ctx\}\),\\\\ \\begin\{aligned\} &\\mathsf\{RefutedSourceContradictoryClaim\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\.\\end\{aligned\}\\end\{gathered\}

### 6\.2\.History failure diagnostics

- •*Stale Source\.*This is a temporal instance of𝖲𝗈𝗎𝗋𝖼𝖾𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅𝖬𝗂𝗌𝗆𝖺𝗍𝖼𝗁\\mathsf\{SourceUniversalMismatch\}, for which we need a notion of a source witness: an event present at timet0t\_\{0\}that records a source pointer𝑠𝑝\\mathit\{sp\}as provenance for an itemss\. We assume the existence of an application\-specific predicate𝖤𝗑𝗍𝗋𝖺𝖼𝗍𝖾𝖽𝖥𝗋𝗈𝗆\\mathsf\{ExtractedFrom\}, which records that eventeeis the trace event whose extraction procedure produced source itemssfrom source pointer𝑠𝑝\\mathit\{sp\}\. We require this predicate to be well\-typed: 𝖤𝗑𝗍𝗋𝖺𝖼𝗍𝖾𝖽𝖥𝗋𝗈𝗆t0​\(s,𝑠𝑝;es\)⇒\\displaystyle\\mathsf\{ExtractedFrom\}\_\{t\_\{0\}\}\(s,\\mathit\{sp\};e\_\{s\}\)\\Rightarrow\{\}es∈Ev∧s∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌∧𝑠𝑝∈Srct0\\displaystyle e\_\{s\}\\in\\textit\{Ev\}\\wedge s\\in\\mathsf\{SourceItems\}\\wedge\\mathit\{sp\}\\in\\textit\{Src\}\_\{t\_\{0\}\}∧𝑠𝑝∈es\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang\(es\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾,s\)\.\\displaystyle\{\}\\wedge\\mathit\{sp\}\\in e\_\{s\}\.\\mathsf\{witness\}\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(e\_\{s\}\.\\mathsf\{message\},s\)\. Then we record provenance for an extracted source item:𝖲𝗈𝗎𝗋𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌t0​\(𝑠𝑝,s;trace\)≜∃es∈trace≤t0\.𝑠𝑝∈Srct0∧𝖤𝗑𝗍𝗋𝖺𝖼𝗍𝖾𝖽𝖥𝗋𝗈𝗆t0​\(s,𝑠𝑝;es\)∧s∈FS,Src,t0\\mathsf\{SourceWitness\}\_\{t\_\{0\}\}\(\\mathit\{sp\},s;\\textit\{trace\}\)\\triangleq\\exists e\_\{s\}\\in\\textit\{trace\}\_\{\\leq t\_\{0\}\}\\mathrel\{\.\}\\mathit\{sp\}\\in\\textit\{Src\}\_\{t\_\{0\}\}\\wedge\\mathsf\{ExtractedFrom\}\_\{t\_\{0\}\}\(s,\\mathit\{sp\};e\_\{s\}\)\\wedge s\\in F\_\{S,\\textit\{Src\},t\_\{0\}\}\. A stale source error arises when a source witness comes from an older pointer at timet0t\_\{0\}, and𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t0​\(c;KU,t0\)\\mathsf\{Universal\}\_\{\+,t\_\{0\}\}\(c;K\_\{U,t\_\{0\}\}\)is replaced at timett: 𝖲𝗍𝖺𝗅𝖾𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,𝑠𝑝,s,c;ctx,trace\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)∧c∈𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇U​\(s\)∧∃t0<t\.\(𝖲𝗈𝗎𝗋𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌t0​\(𝑠𝑝,s;trace\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t0​\(c;KU,t0\)\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧\(𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)∨𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅?,t​\(c;KU,t\)∨𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)\)\.\\begin\{aligned\} &\\mathsf\{StaleSource\}\_\{t\}\(m,\\mathit\{sp\},s,c;\\textit\{ctx\},\\textit\{trace\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\\\\ &\\hskip 18\.49988pt\{\}\\wedge c\\in\\mathsf\{denotation\}\_\{U\}\(s\)\\wedge\\exists t\_\{0\}<t\\mathrel\{\.\}\\,\\bigl\(\\mathsf\{SourceWitness\}\_\{t\_\{0\}\}\(\\mathit\{sp\},s;\\textit\{trace\}\)\\wedge\\mathsf\{Universal\}\_\{\+,t\_\{0\}\}\(c;K\_\{U,t\_\{0\}\}\)\\bigr\)\\\\ &\\hskip 18\.49988pt\{\}\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\\\ &\\hskip 18\.49988pt\{\}\\wedge\\bigl\(\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)\\vee\\mathsf\{Universal\}\_\{?,t\}\(c;K\_\{U,t\}\)\\vee\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\)\\bigr\)\.\\end\{aligned\}
- •*Refuted Source\.*Such a source satisfies𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)while𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)holds: 𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,s,c;ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\mathsf\{RefutedSource\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\.\\displaystyle\\qquad\{\}\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)\.This is stronger than lack of justification for claimcc: the universal knowledge base justifies¬c\\neg c\. It is an AI system error when the system uses this claim, or when source knowledge is itself being presented as authority forcc; otherwise it is a source or source\-processing issue that the AI system must not silently turn into authority\.
- •*Added Hypothesis\.*Such an error occurs when a system claim actually depends on a hypothesishhthat is not among the claims on which the system may currently rely\. The relation below records actual dependence, not merely possible derivability\. When the system exposes derivation, explanation, or provenance records, this relation may be realized as: 𝖣𝖾𝗉𝖾𝗇𝖽𝗌𝖮𝗇E,ctx,t​\(m,c,h\)≜∃π∈𝖴𝗌𝖾𝖽𝖣𝖾𝗋𝗂𝗏𝖺𝗍𝗂𝗈𝗇𝗌E,ctx,t​\(m,c\)\.\\displaystyle\\mathsf\{DependsOn\}\_\{E,\\textit\{ctx\},t\}\(m,c,h\)\\triangleq\\exists\\pi\\in\\mathsf\{UsedDerivations\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\mathrel\{\.\}h∈𝖯𝗋𝖾𝗆𝗂𝗌𝖾𝗌​\(π\)∧c∈InferR¯t∗​\(𝖯𝗋𝖾𝗆𝗂𝗌𝖾𝗌​\(π\)\)∧c∉InferR¯t∗​\(𝖯𝗋𝖾𝗆𝗂𝗌𝖾𝗌​\(π\)∖\{h\}\)\.\\displaystyle\\qquad\{\}h\\in\\mathsf\{Premises\}\(\\pi\)\\wedge c\\in\\textsf\{Infer\}^\{\\ast\}\_\{\\bar\{R\}\_\{t\}\}\(\\mathsf\{Premises\}\(\\pi\)\)\\wedge c\\notin\\textsf\{Infer\}^\{\\ast\}\_\{\\bar\{R\}\_\{t\}\}\(\\mathsf\{Premises\}\(\\pi\)\\setminus\\\{h\\\}\)\.Here𝖴𝗌𝖾𝖽𝖣𝖾𝗋𝗂𝗏𝖺𝗍𝗂𝗈𝗇𝗌E,ctx,t​\(m,c\)\\mathsf\{UsedDerivations\}\_\{E,\\textit\{ctx\},t\}\(m,c\)is the set of derivation, explanation, or provenance records actually used by the system in assertingccthroughmm, and𝖯𝗋𝖾𝗆𝗂𝗌𝖾𝗌​\(π\)\\mathsf\{Premises\}\(\\pi\)is the set of semantic premises used byπ\\pi\. Letℛt,ctx≜\{c∈U¯∣∃mc∈Lang\.𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mc,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\}\\mathcal\{R\}\_\{t,\\textit\{ctx\}\}\\triangleq\\\{\\,c\\in\\bar\{U\}\\mid\\exists m\_\{c\}\\in\\textit\{Lang\}\\mathrel\{\.\}\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{c\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\\,\\\}\. An asserted claimccin messagemmdepends on an added hypothesis when the system assertedcc, actually usedhh,ccis justified if we addhhbut not justified from currently reliable claims alone,hhitself has no reliable witnessing messagemhm\_\{h\}, andccis not otherwise directly supported: 𝖠𝖽𝖽𝖾𝖽𝖧𝗒𝗉𝗈𝗍𝗁𝖾𝗌𝗂𝗌t​\(h,c;m,ctx\)≜𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)∧h∈U¯∧𝖣𝖾𝗉𝖾𝗇𝖽𝗌𝖮𝗇E,ctx,t​\(m,c,h\)\\displaystyle\\mathsf\{AddedHypothesis\}\_\{t\}\(h,c;m,\\textit\{ctx\}\)\\triangleq\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)\\wedge h\\in\\bar\{U\}\\wedge\\mathsf\{DependsOn\}\_\{E,\\textit\{ctx\},t\}\(m,c,h\)∧¬∃mh∈Lang\.𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mh,h;KE,ctx,t,KS,Src,t,KU,t,ctx\)\\displaystyle\\qquad\{\}\\wedge\\neg\\,\\exists m\_\{h\}\\in\\textit\{Lang\}\\mathrel\{\.\}\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{h\},h;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)∧c∈InferR¯t∗​\(ℛt,ctx∪\{h\}\)∧c∉InferR¯t∗​\(ℛt,ctx\)∧¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;KU,t,KS,Src,t\)\.\\displaystyle\\qquad\{\}\\wedge c\\in\\textsf\{Infer\}^\{\\ast\}\_\{\\bar\{R\}\_\{t\}\}\(\\mathcal\{R\}\_\{t,\\textit\{ctx\}\}\\cup\\\{h\\\}\)\\wedge c\\notin\\textsf\{Infer\}^\{\\ast\}\_\{\\bar\{R\}\_\{t\}\}\(\\mathcal\{R\}\_\{t,\\textit\{ctx\}\}\)\\wedge\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\.
- •*Unsupported Use\.*When does an unsupported claim enter the trace? Ifeeis a new event extending a tracetraceat timett, writetrace′=trace⋅e\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\\cdot e\. Letctxt∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\textit\{ctx\}\_\{t\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)andctxt\+1∈𝖲𝖾𝗅𝖾𝖼𝗍t\+1​\(trace′\)\\textit\{ctx\}\_\{t\+1\}\\in\\mathsf\{Select\}\_\{t\+1\}\(\\textit\{trace\}^\{\\prime\}\)be the selected contexts before and after the extension\. An unsupported use is a transition from¬𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾\+,t​\(m,s;KE,ctxt,t\)\\neg\\,\\mathsf\{Effective\}\_\{\+,t\}\(m,s;K\_\{E,\\textit\{ctx\}\_\{t\},t\}\)to𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾\+,t\+1​\(m,s;KE,ctxt\+1,t\+1\)\\mathsf\{Effective\}\_\{\+,t\+1\}\(m,s;K\_\{E,\\textit\{ctx\}\_\{t\+1\},t\+1\}\)while the asserted claimccstill fails the support check: 𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖴𝗌𝖾t\+1​\(e,m,s,c;trace,ctxt,ctxt\+1\)≜trace′=trace⋅e\\displaystyle\\mathsf\{UnsupportedUse\}\_\{t\+1\}\(e,m,s,c;\\textit\{trace\},\\textit\{ctx\}\_\{t\},\\textit\{ctx\}\_\{t\+1\}\)\\triangleq\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\\cdot e∧ctxt∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)∧ctxt\+1∈𝖲𝖾𝗅𝖾𝖼𝗍t\+1​\(trace′\)∧e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾=m∧𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\displaystyle\\quad\{\}\\wedge\\textit\{ctx\}\_\{t\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)\\wedge\\textit\{ctx\}\_\{t\+1\}\\in\\mathsf\{Select\}\_\{t\+1\}\(\\textit\{trace\}^\{\\prime\}\)\\wedge e\.\\mathsf\{message\}=m\\wedge\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)∧¬𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾\+,t​\(m,s;KE,ctxt,t\)∧𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾\+,t\+1​\(m,s;KE,ctxt\+1,t\+1\)∧𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctxt\+1,t\+1​\(m,c\)\\displaystyle\\quad\{\}\\wedge\\neg\\,\\mathsf\{Effective\}\_\{\+,t\}\(m,s;K\_\{E,\\textit\{ctx\}\_\{t\},t\}\)\\wedge\\mathsf\{Effective\}\_\{\+,t\+1\}\(m,s;K\_\{E,\\textit\{ctx\}\_\{t\+1\},t\+1\}\)\\wedge\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\}\_\{t\+1\},t\+1\}\(m,c\)∧¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t\+1​\(m,c;KU,t\+1,KS,Src,t\+1\)\.\\displaystyle\\qquad\{\}\\wedge\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\+1\}\(m,c;K\_\{U,t\+1\},K\_\{S,\\textit\{Src\},t\+1\}\)\.

###### Theorem 2 \(Trace Soundness\)\.

Each of𝖲𝗍𝖺𝗅𝖾𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,𝑠𝑝,s,c;ctx,trace\)\\mathsf\{StaleSource\}\_\{t\}\(m,\\mathit\{sp\},s,c;\\textit\{ctx\},\\textit\{trace\}\),𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,s,c;ctx\)\\mathsf\{RefutedSource\}\_\{t\}\(m,s,c;\\textit\{ctx\}\),𝖠𝖽𝖽𝖾𝖽𝖧𝗒𝗉𝗈𝗍𝗁𝖾𝗌𝗂𝗌t​\(h,c;m,ctx\)\\mathsf\{AddedHypothesis\}\_\{t\}\(h,c;m,\\textit\{ctx\}\), and𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖴𝗌𝖾t\+1​\(e,m,s,c;trace,ctxt,ctxt\+1\)\\mathsf\{UnsupportedUse\}\_\{t\+1\}\(e,m,s,c;\\textit\{trace\},\\textit\{ctx\}\_\{t\},\\textit\{ctx\}\_\{t\+1\}\)implies, respectively,𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t,ctx​\(m,c\)\\mathsf\{RelianceFailure\}\_\{t,\\textit\{ctx\}\}\(m,c\)or𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t\+1,ctxt\+1​\(m,c\)\\mathsf\{RelianceFailure\}\_\{t\+1,\\textit\{ctx\}\_\{t\+1\}\}\(m,c\)\.

## 7\.Compute Components

Compute components are the engineered interfaces through which an AI system turns input messages into further messages, checks, observations, or actuations\.

### 7\.1\.Symbolic Components

A symbolic component features base facts, and inference rules\. An inference engine justifies new conclusions from facts, e\.g\. by forward or backward chaining, DPLL\-style search, fixpoint iteration, or another symbolic strategy\.

Thus a symbolic component is an abstraction of the rule systemR¯t\\bar\{R\}\_\{t\}, more precisely of the rules available after scope restriction and forgetting\. This abstraction arises for a number of reasons: some universal rules may not be expressible in the component’s modelling language, some expressible rules may not be implemented or used by the engine, and some speculative or buggy rules may be added although they do not exist inR¯t\\bar\{R\}\_\{t\}\.

#### 7\.1\.1\.Definition

A symbolic component uses a languageModLangthat abstracts𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\\mathsf\{SourceItems\}\(where𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌≜Scope¯/≡f\\mathsf\{SourceItems\}\\triangleq\\overline\{\\textit\{Scope\}\}/\{\\equiv\_\{f\}\}\)\. Its intended semantics is𝗌𝖾𝗆ModLang∈ModLang→𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\\mathsf\{sem\}\_\{\\textit\{ModLang\}\}\\in\\textit\{ModLang\}\\rightarrow\\mathsf\{SourceItems\}\. Conversely, statements in𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌\\mathsf\{SourceItems\}must be approximated byModLang:𝖾𝗇𝖼𝗈𝖽𝖾ModLang∈𝖲𝗈𝗎𝗋𝖼𝖾𝖨𝗍𝖾𝗆𝗌→ModLang\\mathsf\{encode\}\_\{\\textit\{ModLang\}\}\\in\\mathsf\{SourceItems\}\\rightarrow\\textit\{ModLang\}\. In practice these maps may be implicit: a language such as SMT\-LIB is often understood operationally by solvers and users without a fully exposed semantic map\. To communicate with the rest of the AI system, the modelling language may be embedded inLang; otherwise the component needs communication encoders and decoders𝖾𝗇𝖼ModLang∈Lang→℘​\(ModLang\)\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}\\in\\textit\{Lang\}\\rightarrow\\wp\(\\textit\{ModLang\}\)and𝖽𝖾𝖼ModLang∈ModLang∪\{⊥\}→Lang\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}\\in\\textit\{ModLang\}\\cup\\\{\\bot\\\}\\rightarrow\\textit\{Lang\}\.

For Oma:ModLangmay model rules for picture and form;𝖾𝗇𝖼𝗈𝖽𝖾ModLang\\mathsf\{encode\}\_\{\\textit\{ModLang\}\}encodes rules into checker syntax;𝗌𝖾𝗆ModLang\\mathsf\{sem\}\_\{\\textit\{ModLang\}\}gives the meaning of an encoded rule;𝖾𝗇𝖼ModLang\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}turns a system message into checker inputs; and𝖽𝖾𝖼ModLang\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}turns the checker result, failure, or timeout back into a system message\.

For a black\-box symbolic component, we can represent the inference engine asinferenceModLang∈℘​\(℘​\(ModLang\)×\(ModLang∪\{⊥\}\)\)\\textit\{inference\}\_\{\\textit\{ModLang\}\}\\in\\wp\(\\wp\(\\textit\{ModLang\}\)\\times\(\\textit\{ModLang\}\\cup\\\{\\bot\\\}\)\), where⊥\\botrepresents timeout, failure, or absence of an answer\. This relation abstracts search overforget¯​\(ignore¯​\(R¯t\)\)\\overline\{\\textit\{forget\}\}\(\\overline\{\\textit\{ignore\}\}\(\\bar\{R\}\_\{t\}\)\), but may omit rules or add incorrect ones\.

For Oma:inferenceModLang\\textit\{inference\}\_\{\\textit\{ModLang\}\}is the execution relation of a picture\-rule checker, source status checker, or form validator, and⊥\\botis timeout, failure, or no answer from that checker\.

#### 7\.1\.2\.Scoped correctness

A symbolic component is correct within the system’s scope if each non\-⊥\\botresult it returns corresponds, through𝗌𝖾𝗆ModLang\\mathsf\{sem\}\_\{\\textit\{ModLang\}\}, to a consequence of the scoped underlying rules:

∀HModLang⊆ModLang\.∀c∈ModLang\.\(⟨HModLang,c⟩∈inferenceModLang\)\\displaystyle\\forall H\_\{\\textit\{ModLang\}\}\\subseteq\\textit\{ModLang\}\\mathrel\{\.\}\\,\\forall c\\in\\textit\{ModLang\}\\mathrel\{\.\}\\,\\bigl\(\\langle H\_\{\\textit\{ModLang\}\},c\\rangle\\in\\textit\{inference\}\_\{\\textit\{ModLang\}\}\\bigr\)⇒𝗌𝖾𝗆ModLang​\(c\)∈InferRS,t∗​\(\{𝗌𝖾𝗆ModLang​\(h\)∣h∈HModLang\}\)\.\\displaystyle\\Rightarrow\\mathsf\{sem\}\_\{\\textit\{ModLang\}\}\(c\)\\in\\textsf\{Infer\}^\{\\ast\}\_\{R\_\{S,t\}\}\(\\\{\\mathsf\{sem\}\_\{\\textit\{ModLang\}\}\(h\)\\mid h\\in H\_\{\\textit\{ModLang\}\}\\\}\)\.
This is a scoped correctness condition, which must be stated relative to⟨U¯,R¯t⟩\\langle\\penalty 10000\\bar\{U\},\\allowbreak\\allowbreak\\\>\\bar\{R\}\_\{t\}\\penalty 10000\\rangle: forgetting can introduce abstract consequences that are not consequences of the ideal rule system\.

For Oma:Consider the picture part of Oma’s application\. Rules distinguish observing a picture from checking it:Rpicture=\{\{cpictureObserved\}cpictureCandidate,\{cpictureChecked\}cpictureUsable\}R\_\{\\textit\{picture\}\}=\\left\\\{\\frac\{\\\{c\_\{\\textit\{pictureObserved\}\}\\\}\}\{c\_\{\\textit\{pictureCandidate\}\}\},\\frac\{\\\{c\_\{\\textit\{pictureChecked\}\}\\\}\}\{c\_\{\\textit\{pictureUsable\}\}\}\\right\\\}\. Thus an observed picture does not imply its usability\. Suppose a forgetfulness abstraction collapsescpictureCandidate≡fcpictureCheckedc\_\{\\textit\{pictureCandidate\}\}\\equiv\_\{f\}c\_\{\\textit\{pictureChecked\}\}because the orchestrator stores a coarse UI item e\.g\. “picture status present”, whilecpictureObservedc\_\{\\textit\{pictureObserved\}\}andcpictureUsablec\_\{\\textit\{pictureUsable\}\}stay distinguished\. The abstract rules areforget¯​\(Rpicture\)=\{\{\[cpictureObserved\]≡f\}\[cpictureCandidate\]≡f,\{\[cpictureChecked\]≡f\}\[cpictureUsable\]≡f\}\\overline\{\\textit\{forget\}\}\(R\_\{\\textit\{picture\}\}\)=\\left\\\{\\frac\{\\\{\[c\_\{\\textit\{pictureObserved\}\}\]\_\{\\equiv\_\{f\}\}\\\}\}\{\[c\_\{\\textit\{pictureCandidate\}\}\]\_\{\\equiv\_\{f\}\}\},\\frac\{\\\{\[c\_\{\\textit\{pictureChecked\}\}\]\_\{\\equiv\_\{f\}\}\\\}\}\{\[c\_\{\\textit\{pictureUsable\}\}\]\_\{\\equiv\_\{f\}\}\}\\right\\\}\. Since\[cpictureCandidate\]≡f=\[cpictureChecked\]≡f\[c\_\{\\textit\{pictureCandidate\}\}\]\_\{\\equiv\_\{f\}\}=\[c\_\{\\textit\{pictureChecked\}\}\]\_\{\\equiv\_\{f\}\}, we have:\[cpictureObserved\]≡f⇒\[cpictureCandidate\]≡f=\[cpictureChecked\]≡f⇒\[cpictureUsable\]≡f\[c\_\{\\textit\{pictureObserved\}\}\]\_\{\\equiv\_\{f\}\}\\Rightarrow\[c\_\{\\textit\{pictureCandidate\}\}\]\_\{\\equiv\_\{f\}\}=\[c\_\{\\textit\{pictureChecked\}\}\]\_\{\\equiv\_\{f\}\}\\Rightarrow\[c\_\{\\textit\{pictureUsable\}\}\]\_\{\\equiv\_\{f\}\}\. The abstract system has therefore erroneously justified that the picture is usable from a mere observation\.

#### 7\.1\.3\.In practice

Verification of a symbolic component can use the standard repertoire for transition systems and logic programs: testing, model checking, static analysis, deductive verification, consistency checks, type checks, termination arguments, and runtime verification\.

### 7\.2\.Neural Components

A neural component encodes an input into vectors, applies a neural network, and decodes the result into an output\. We assume that the component communicates throughLang\.

Large language models are neural components specialised to token sequences\. Their inputs and outputs are messages inLang, typically natural language or token sequences\.

#### 7\.2\.1\.Definition

A neural component is a black boxdecodeN​N∘N​N∘encodeN​N∈Lang→Lang\\textit\{decode\}\_\{N\\\!N\}\\circ N\\\!N\\circ\\textit\{encode\}\_\{N\\\!N\}\\in\\textit\{Lang\}\\rightarrow\\textit\{Lang\}, whereencodeN​N∈Lang→ℝn\\textit\{encode\}\_\{N\\\!N\}\\in\\textit\{Lang\}\\rightarrow\\mathbb\{R\}^\{n\},N​N∈ℝn→ℝmN\\\!N\\in\\mathbb\{R\}^\{n\}\\rightarrow\\mathbb\{R\}^\{m\}, anddecodeN​N∈ℝm→Lang\\textit\{decode\}\_\{N\\\!N\}\\in\\mathbb\{R\}^\{m\}\\rightarrow\\textit\{Lang\}define the encoderencodeN​N\\textit\{encode\}\_\{N\\\!N\}, the neural networkN​N\{N\\\!N\}itself and the decoderdecodeN​N\\textit\{decode\}\_\{N\\\!N\}\.

The encoderencodeN​N\\textit\{encode\}\_\{N\\\!N\}is the interface between communication\-level inputs and the input layer of the neural networkN​N\{N\\\!N\}\. It maps input data to a fixed\-size vector of machine numbers\. This encoding is already an abstraction: if relevant information is lost before the network sees the input, the network cannot recover it\.

The neural networkN​N\{N\\\!N\}can be decomposed into transformers between layersN​N=N​Nℓ∘⋯∘N​N1N\\\!N=N\\\!N\_\{\\ell\}\\circ\\cdots\\circ N\\\!N\_\{1\}\. The transformersN​N1N\\\!N\_\{1\}, …,N​NℓN\\\!N\_\{\\ell\}map vectors using weights, calls, and optimisation procedures such as backpropagation and gradient descent\.N​N1N\\\!N\_\{1\}is the transformer of the input layer into the first hidden layer and is applied first\.N​NℓN\\\!N\_\{\\ell\}is the transformer of the last hidden layer into the output layer\. This final transformerN​NℓN\\\!N\_\{\\ell\}shapes the result for the task: classification, regression, sequence generation, or another result format\.

The decoderdecodeN​N\\textit\{decode\}\_\{N\\\!N\}translates the result vector back into a communication message inLang\.

For Oma:A neural encoder may convert the candidate passport picture into vectors, the neural network may classify or extract information, and the decoder may return a label, field value, or message inLang\.

#### 7\.2\.2\.Output Reliability

A neural component output is reliable for a selected context when every claim asserted by the output is reliable for that context\. Reliability is checked after interpretation by𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}, expansion by𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{CandidateClaims\}, assertion selection by𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}, and the support checks in𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t\\mathsf\{ReliableClaim\}\_\{t\}\.

The reliability obligation on this output is not that every element of𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(output\)\\mathsf\{CandidateClaims\}\(\\textit\{output\}\)be reliable, but rather that every claimc∈𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t​\(output\)c\\in\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(\\textit\{output\}\)asserted by the output be reliable for the selected contextctx:𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(output,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\\mathsf\{ReliableClaim\}\_\{t\}\(\\textit\{output\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\.

#### 7\.2\.3\.In practice

Validation of neural components is usually empirical\. It may test properties of the trained system, using adversarial inputs, invariance tests, boundary cases, and monitoring for data drift\. Empirical checks ask whether the test distribution matches the training distribution or whether a measured property points to a failure\. PAC\-style learning properties concern the learning algorithm rather than a particular trained network\. Formal methods can sometimes prove properties of networks, especially small or piecewise\-linear networks, but large networks require approximation and abstraction techniques\(Albarghouthi,[2021](https://arxiv.org/html/2607.09489#bib.bib42); Urban and Miné,[2021](https://arxiv.org/html/2607.09489#bib.bib96); Pifarre\-Esquerdaet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib139)\)\.

For Oma:Validation may include adversarial picture tests, OCR checks for passport fields, and monitoring for cases where the image or source has drifted away from what the component was tested on\.

### 7\.3\.Agent Services

Agent services enable interactions with the world, e\.g\. tools, web search, code interpreters, sensors, actuators, access to external servers via the model context protocol \(MCP\)\(Anthropic,[2024](https://arxiv.org/html/2607.09489#bib.bib144)\)\.

#### 7\.3\.1\.Definition

An agent serviceServis formalised by internal statesStatesServ\\textit\{States\}\_\{\\textit\{Serv\}\}and a transition relationtransServ∈℘​\(\(StatesServ×Lang×Lang\)×\(StatesServ×Lang×Lang\)\)\\textit\{trans\}\_\{\\textit\{Serv\}\}\\in\\wp\(\(\\textit\{States\}\_\{\\textit\{Serv\}\}\\times\\textit\{Lang\}\\times\\textit\{Lang\}\)\\times\(\\textit\{States\}\_\{\\textit\{Serv\}\}\\times\\textit\{Lang\}\\times\\textit\{Lang\}\)\)\.

A transition⟨⟨sServ,ma​i,mw⟩,⟨sServ′,ma​i′,mw′⟩⟩∈transServ\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Serv\}\},\\allowbreak\\\>m\_\{ai\}\\penalty 10000,\\allowbreak\\\>m\_\{w\}\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>\\langle\\penalty 10000s^\{\\prime\}\_\{\\textit\{Serv\}\},\\allowbreak\\\>m^\{\\prime\}\_\{ai\}\\penalty 10000,\\allowbreak\\\>m^\{\\prime\}\_\{w\}\\penalty 10000\\rangle\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Serv\}\}means that the service is in statesServs\_\{\\textit\{Serv\}\}, reads a communication messagema​im\_\{ai\}from the AI system, reads the observed world messagemw=𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇​\(Serv,w\)m\_\{w\}=\\mathsf\{observation\}\(\\textit\{Serv\},w\), changes its internal state tosServ′s^\{\\prime\}\_\{\\textit\{Serv\}\}, returns a communication messagema​i′m^\{\\prime\}\_\{ai\}to the AI system, and may request a world update represented bymw′m^\{\\prime\}\_\{w\}, producingw′=𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,mw′\)w^\{\\prime\}=\\mathsf\{actuation\}\(w,m^\{\\prime\}\_\{w\}\)\.

#### 7\.3\.2\.Service Conformance

A conformance relation for a serviceServhas the formtransServ⊆SpecServ\\textit\{trans\}\_\{\\textit\{Serv\}\}\\subseteq\\textsf\{Spec\}\_\{\\textit\{Serv\}\}whereSpecServ∈℘​\(\(StatesServ×Lang×Lang\)×\(StatesServ×Lang×Lang\)\)\\textsf\{Spec\}\_\{\\textit\{Serv\}\}\\in\\wp\(\(\\textit\{States\}\_\{\\textit\{Serv\}\}\\times\\textit\{Lang\}\\times\\textit\{Lang\}\)\\times\(\\textit\{States\}\_\{\\textit\{Serv\}\}\\times\\textit\{Lang\}\\times\\textit\{Lang\}\)\)is the relational input\-output specification\.

Because agent services are transition systems, standard specification and validation methods apply: testing, code review, model checking, static analysis, deductive verification, and runtime monitoring\. These checks do not establish soundness of the whole system per se\.

#### 7\.3\.3\.In practice

The specification of an agent service is application dependent\. A service may otherwise behave arbitrarily, e\.g\. modify an account it should not\. Some task services should eventually return an answer, but termination is not universal for monitoring or reactive services\. Beyond safety and liveness, services may need to satisfy, e\.g\., confidentiality or privacy\.

For Oma:In the app, the camera, browser, document scanner, picture checker, form filler, retrieval service, and possible official web\-service client are agent services\. Each service has a bounded job\. None of them should quietly become the source of truth for the whole task, and none of them should be able to perform a high\-consequence action merely because a generated sentence made it sound plausible\.

#### 7\.3\.4\.Prompt

The Prompt is an example of an agent service, which takes information and directives as input\. In response to prompts, an LLM may produce messages inLang, which are added to the orchestrator state \(including information recorded in the contextctx\)\.

### 7\.4\.Orchestration

The orchestrator coordinates the calls and communications of symbolic or neural components, and agent services\. This part of the AI system selects which component to call, passes messages throughLang, records intermediate state, and handles observations or updates of the world\.

The user normally interacts with the orchestrator through prompts inLang\. Commands such as shell commands, web requests, code execution, or file writes are represented as service calls and actuations mediated by the orchestrator\.

#### 7\.4\.1\.Definition

LetWWbe the world and let the components of an orchestrator be

- •LanguageLangwith𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang\\mathsf\{denotation\}\_\{\\textit\{Lang\}\},𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{CandidateClaims\},𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}, and𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\};
- •Symbolic components⟨ModLang,𝖾𝗇𝖼ModLang,𝖽𝖾𝖼ModLang,inferenceModLang⟩∈Symbolic\\langle\\penalty 10000\\textit\{ModLang\},\\allowbreak\\\>\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}\\penalty 10000,\\allowbreak\\\>\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}\\penalty 10000,\\allowbreak\\\>\\textit\{inference\}\_\{\\textit\{ModLang\}\}\\penalty 10000\\rangle\\in\\textit\{Symbolic\};
- •Neural components⟨encodeN​N,N​N,decodeN​N⟩∈Neural\\langle\\penalty 10000\\textit\{encode\}\_\{N\\\!N\},\\allowbreak\\\>N\\\!N\\penalty 10000,\\allowbreak\\\>\\textit\{decode\}\_\{N\\\!N\}\\penalty 10000\\rangle\\in\\textit\{Neural\};
- •Agent services⟨StatesServ,transServ⟩∈Services\\langle\\penalty 10000\\textit\{States\}\_\{\\textit\{Serv\}\},\\allowbreak\\allowbreak\\\>\\textit\{trans\}\_\{\\textit\{Serv\}\}\\penalty 10000\\rangle\\in\\textit\{Services\}\.

An orchestrator has internal statessOrch∈StatesOrchs\_\{\\textit\{Orch\}\}\\in\\textit\{States\}\_\{\\textit\{Orch\}\}\. The orchestrator also records the statessServs\_\{\\textit\{Serv\}\}indexed by servicesServ∈Services\\textit\{Serv\}\\in\\textit\{Services\}, although these states can only be read and modified by their services\. It communicates with the components through messages inLangand with the world through𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}and𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\}\. Together these form a closed system, whose states are:

ClosedSystemStates≜StatesOrch×∏Serv∈ServicesStatesServ×W×𝖳𝗋𝖺𝖼𝖾\.\\textit\{ClosedSystemStates\}\\triangleq\\textit\{States\}\_\{\\textit\{Orch\}\}\\times\\prod\_\{\\textit\{Serv\}\\in\\textit\{Services\}\}\\textit\{States\}\_\{\\textit\{Serv\}\}\\times W\\times\\mathsf\{Trace\}\.Its transition relationtransOrch∈℘​\(\(ClosedSystemStates×Lang\)×ClosedSystemStates\)\\textit\{trans\}\_\{\\textit\{Orch\}\}\\in\\wp\(\(\\textit\{ClosedSystemStates\}\\times\\textit\{Lang\}\)\\times\\textit\{ClosedSystemStates\}\)reacts to an input inLangand includes world changes, such as a doorbell ringing, that the orchestrator did not cause but may later observe\.

There are five kinds of orchestrator transitions: call a symbolic or neural component, an agent service \(including prompts\), update an internal state, or observe a world change\.

For Oma:These five cases may be \(Symbolic:\) run a picture\-rule checker or form validator; \(Neural:\) ask the language model to produce the next message or plan fragment; \(Service:\) call the camera, or government server; \(Internal:\) pause, resume, update context, or decide the next control label; \(World:\) record that the doorbell rang, or the form changed elsewhere\.

LetsClosed≜⟨sOrch,s→Serv,w,trace⟩s\_\{\\textit\{Closed\}\}\\triangleq\\langle\\penalty 10000s\_\{\\textit\{Orch\}\},\\allowbreak\\\>\\vec\{s\}\_\{\\textit\{Serv\}\}\\penalty 10000,\\allowbreak\\\>w\\penalty 10000,\\allowbreak\\\>\\textit\{trace\}\\penalty 10000\\rangleandsClosed′≜⟨sOrch′,s→Serv′,w′,trace′⟩s^\{\\prime\}\_\{\\textit\{Closed\}\}\\triangleq\\langle\\penalty 10000s^\{\\prime\}\_\{\\textit\{Orch\}\},\\allowbreak\\\>\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\\penalty 10000,\\allowbreak\\\>w^\{\\prime\}\\penalty 10000,\\allowbreak\\\>\\textit\{trace\}^\{\\prime\}\\penalty 10000\\rangle, wheres→Serv\\vec\{s\}\_\{\\textit\{Serv\}\}is the family of service states andtraceis the event trace\. ForComp∈\{Symbolic,Neural,Service,Internal,World\}\\textit\{Comp\}\\in\\\{\\textit\{Symbolic\},\\textit\{Neural\},\\textit\{Service\},\\textit\{Internal\},\\textit\{World\}\\\}, the transition relations aretransOrchComp⊆\(ClosedSystemStates×Lang\)×ClosedSystemStates\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Comp\}\}\\subseteq\(\\textit\{ClosedSystemStates\}\\times\\textit\{Lang\}\)\\times\\textit\{ClosedSystemStates\}\.

The orchestrator transition relation is their union:transOrch≜⋃ComptransOrchComp\\textit\{trans\}\_\{\\textit\{Orch\}\}\\triangleq\\bigcup\_\{\\textit\{Comp\}\}\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Comp\}\}\. Thus each transition intransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}satisfies at least one of the following clauses\. The symbolm′m^\{\\prime\}, when it appears below, names a message produced inside the transition and recorded insClosed′s^\{\\prime\}\_\{\\textit\{Closed\}\}or in the appended event; it is not a separate output oftransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}\.

- •*Service:*the orchestrator calls a tool, sensor, actuator, browser, client, or other service\. The service may observe the world and may request a world update\. For services that do not observe the world, we use a distinguished no\-observation messageo⊥∈Lango\_\{\\bot\}\\in\\textit\{Lang\}, and stipulate that𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇​\(Serv,w\)=o⊥\\mathsf\{observation\}\(\\textit\{Serv\},w\)=o\_\{\\bot\}\. For services that do not request a world update, we use a distinguished no\-actuation messagem⊥∈Langm\_\{\\bot\}\\in\\textit\{Lang\}, and stipulate that𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,m⊥\)=w\\mathsf\{actuation\}\(w,m\_\{\\bot\}\)=w\. Let𝖭𝗈𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(Serv\)\\mathsf\{NoActuation\}\(\\textit\{Serv\}\)mark services that cannot request world updates\. Thus the following clause treats observation and actuation uniformly; actual read\-only or write\-free services are represented by these no\-op messages\. Formally, if⟨⟨sClosed,m⟩,sClosed′⟩∈transOrchService\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Closed\}\},\\allowbreak\\allowbreak\\\>m\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>s^\{\\prime\}\_\{\\textit\{Closed\}\}\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Service\}\}, then there existServ∈Services\\textit\{Serv\}\\in\\textit\{Services\}with transition structure⟨StatesServ,transServ⟩\\langle\\penalty 10000\\textit\{States\}\_\{\\textit\{Serv\}\},\\allowbreak\\allowbreak\\\>\\textit\{trans\}\_\{\\textit\{Serv\}\}\\penalty 10000\\rangle, an observation messageo∈Lango\\in\\textit\{Lang\}, a world\-update messagemw′∈Langm^\{\\prime\}\_\{w\}\\in\\textit\{Lang\}, and an evente′∈Eve^\{\\prime\}\\in\\textit\{Ev\}such thato=𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇​\(Serv,w\)o=\\mathsf\{observation\}\(\\textit\{Serv\},w\),⟨⟨s→Serv​\(Serv\),m,o⟩,⟨s→Serv′​\(Serv\),m′,mw′⟩⟩∈transServ\\langle\\penalty 10000\\langle\\penalty 10000\\vec\{s\}\_\{\\textit\{Serv\}\}\(\\textit\{Serv\}\),\\allowbreak\\\>m\\penalty 10000,\\allowbreak\\\>o\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>\\langle\\penalty 10000\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\(\\textit\{Serv\}\),\\allowbreak\\\>m^\{\\prime\}\\penalty 10000,\\allowbreak\\\>m^\{\\prime\}\_\{w\}\\penalty 10000\\rangle\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Serv\}\},\(𝖭𝗈𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(Serv\)⇒mw′=m⊥\)\\bigl\(\\mathsf\{NoActuation\}\(\\textit\{Serv\}\)\\Rightarrow m^\{\\prime\}\_\{w\}=m\_\{\\bot\}\\bigr\),w′=𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,mw′\)w^\{\\prime\}=\\mathsf\{actuation\}\(w,m^\{\\prime\}\_\{w\}\), ands→Serv′​\(OtherServ\)=s→Serv​\(OtherServ\)\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\(\\textit\{OtherServ\}\)=\\vec\{s\}\_\{\\textit\{Serv\}\}\(\\textit\{OtherServ\}\)for allOtherServ∈Services∖\{Serv\}\\textit\{OtherServ\}\\in\\textit\{Services\}\\setminus\\\{\\textit\{Serv\}\\\},e′\.𝗄𝗂𝗇𝖽=Servicee^\{\\prime\}\.\\mathsf\{kind\}=\\textit\{Service\},e′\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾=m′e^\{\\prime\}\.\\mathsf\{message\}=m^\{\\prime\}, andtrace′=trace⋅e′\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\\cdot e^\{\\prime\}\. The service reads the communication messagemm, observes the world through𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}, returns a messagem′m^\{\\prime\}recorded insClosed′\{s^\{\\prime\}\_\{\\textit\{Closed\}\}\}, and updates the world through𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\}\. No\-observation and no\-actuation services use the distinguished no\-op messages above\.
- •*Symbolic:*the orchestrator calls a symbolic component by sending a message inLangwhich is encoded by𝖾𝗇𝖼ModLang\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}, receives a result which is decoded by𝖽𝖾𝖼ModLang\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}intoLang\. This message back is recorded by the orchestrator in its next statesClosed′s^\{\\prime\}\_\{\\textit\{Closed\}\}\. Formally, if⟨⟨sClosed,m⟩,sClosed′⟩∈transOrchSymbolic\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Closed\}\},\\allowbreak\\allowbreak\\\>m\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>s^\{\\prime\}\_\{\\textit\{Closed\}\}\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Symbolic\}\}, then there exist⟨ModLang,𝖾𝗇𝖼ModLang,𝖽𝖾𝖼ModLang,inferenceModLang⟩∈Symbolic\\langle\\penalty 10000\\textit\{ModLang\},\\allowbreak\\\>\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}\\penalty 10000,\\allowbreak\\\>\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}\\penalty 10000,\\allowbreak\\\>\\textit\{inference\}\_\{\\textit\{ModLang\}\}\\penalty 10000\\rangle\\in\\textit\{Symbolic\}, a hypothesis setH⊆ModLangH\\subseteq\\textit\{ModLang\}, a resultr∈ModLang∪\{⊥\}r\\in\\textit\{ModLang\}\\cup\\\{\\bot\\\}, and an evente′∈Eve^\{\\prime\}\\in\\textit\{Ev\}such thatH=𝖾𝗇𝖼ModLang​\(m\)H=\\mathsf\{enc\}\_\{\\textit\{ModLang\}\}\(m\),⟨H,r⟩∈inferenceModLang\\langle\\penalty 10000H,\\allowbreak\\allowbreak\\\>r\\penalty 10000\\rangle\\in\\textit\{inference\}\_\{\\textit\{ModLang\}\},m′=𝖽𝖾𝖼ModLang​\(r\)m^\{\\prime\}=\\mathsf\{dec\}\_\{\\textit\{ModLang\}\}\(r\),s→Serv′=s→Serv\{\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\}=\\vec\{s\}\_\{\\textit\{Serv\}\},w′=ww^\{\\prime\}=w,e′\.𝗄𝗂𝗇𝖽=Symbolice^\{\\prime\}\.\\mathsf\{kind\}=\\textit\{Symbolic\},e′\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾=m′e^\{\\prime\}\.\\mathsf\{message\}=m^\{\\prime\},e′\.𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇=o⊥e^\{\\prime\}\.\\mathsf\{observation\}=o\_\{\\bot\},e′\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇=m⊥e^\{\\prime\}\.\\mathsf\{actuation\}=m\_\{\\bot\}\(the distinguished no\-observation and no\-actuation messages of the Service clause above\), andtrace′=trace⋅e′\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\\cdot e^\{\\prime\}\. The orchestrator state changes fromsOrchs\_\{\\textit\{Orch\}\}tosOrch′s^\{\\prime\}\_\{\\textit\{Orch\}\}to record the call and its result\.
- •*Neural:*the orchestrator calls a neural component by sending a messagem∈Langm\\in\\textit\{Lang\}, receives a generated messagem′m^\{\\prime\}, and records the step and its resultm′m^\{\\prime\}in its next statesClosed′\{s^\{\\prime\}\_\{\\textit\{Closed\}\}\}\. Formally, if⟨⟨sClosed,m⟩,sClosed′⟩∈transOrchNeural\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Closed\}\},\\allowbreak\\allowbreak\\\>m\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>s^\{\\prime\}\_\{\\textit\{Closed\}\}\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Neural\}\}, then there exists⟨encodeN​N,N​N,decodeN​N⟩∈Neural\\langle\\penalty 10000\\textit\{encode\}\_\{N\\\!N\},\\allowbreak\\\>N\\\!N\\penalty 10000,\\allowbreak\\\>\\textit\{decode\}\_\{N\\\!N\}\\penalty 10000\\rangle\\in\\textit\{Neural\}and an evente′∈Eve^\{\\prime\}\\in\\textit\{Ev\}such thatm′=decodeN​N​\(N​N​\(encodeN​N​\(m\)\)\),s→Serv′=s→Servm^\{\\prime\}=\\textit\{decode\}\_\{N\\\!N\}\(N\\\!N\(\\textit\{encode\}\_\{N\\\!N\}\(m\)\)\),\{\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\}=\\vec\{s\}\_\{\\textit\{Serv\}\},w′=ww^\{\\prime\}=w,e′\.𝗄𝗂𝗇𝖽=Neurale^\{\\prime\}\.\\mathsf\{kind\}=\\textit\{Neural\},e′\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾=m′e^\{\\prime\}\.\\mathsf\{message\}=m^\{\\prime\},e′\.𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇=o⊥e^\{\\prime\}\.\\mathsf\{observation\}=o\_\{\\bot\},e′\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇=m⊥e^\{\\prime\}\.\\mathsf\{actuation\}=m\_\{\\bot\}, andtrace′=trace⋅e′\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\\cdot e^\{\\prime\}\. For a large language modelLLM,m′=decodeLLM​\(NN​\(encodeLLM​\(m\)\)\)m^\{\\prime\}=\\textit\{decode\}\_\{\\textit\{LLM\}\}\(\\textit\{NN\}\(\\textit\{encode\}\_\{\\textit\{LLM\}\}\(m\)\)\)is the call toLLMon a context window,encodeLLM\\textit\{encode\}\_\{\\textit\{LLM\}\}feeds the selected context window anddecodeLLM\\textit\{decode\}\_\{\\textit\{LLM\}\}records the generated token sequence\. Updating the context window is an orchestrator\-state update\.
- •*Internal:*the orchestrator changes its own state, for example to route, pause, resume, update context, or choose the next control label\. Formally, if⟨⟨sClosed,m⟩,sClosed′⟩∈transOrchInternal\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Closed\}\},\\allowbreak\\allowbreak\\\>m\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>s^\{\\prime\}\_\{\\textit\{Closed\}\}\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{Internal\}\}, thens→Serv′=s→Serv\{\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\}=\{\\vec\{s\}\_\{\\textit\{Serv\}\}\},w′=ww^\{\\prime\}=w, andtrace′=trace\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}\. The internal state change fromsOrchs\_\{\\textit\{Orch\}\}tosOrch′s^\{\\prime\}\_\{\\textit\{Orch\}\}can reflect control flow and local computations \(as in the state\-based small\-step operational semantics of programming languages\)\. Any communication message produced by the internal step is recorded insOrch′s^\{\\prime\}\_\{\\textit\{Orch\}\}or in a later event, rather than as a separate output oftransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}\.
- •*World:*the world changes independently, e\.g\. because the doorbell rings\. If the mutation is unobserved, the trace can remain unchanged; when the system observes or records the mutation, that later observation has an event\. Formally, if⟨⟨sClosed,m⟩,sClosed′⟩∈transOrchWorld\\langle\\penalty 10000\\langle\\penalty 10000s\_\{\\textit\{Closed\}\},\\allowbreak\\allowbreak\\\>m\\penalty 10000\\rangle,\\allowbreak\\allowbreak\\\>s^\{\\prime\}\_\{\\textit\{Closed\}\}\\penalty 10000\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}^\{\\textit\{World\}\}, thensOrch′=sOrch\{s^\{\\prime\}\_\{\\textit\{Orch\}\}\}=\{s\_\{\\textit\{Orch\}\}\},s→Serv′=s→Serv\{\\vec\{s\}\\,^\{\\prime\}\_\{\\\!\\textit\{Serv\}\}\}=\{\\vec\{s\}\_\{\\textit\{Serv\}\}\},trace′=trace\\textit\{trace\}^\{\\prime\}=\\textit\{trace\}, since only the world changes fromwwtow′w^\{\\prime\}\. A later read or service call may observe the new world state and update the orchestrator state\.

#### 7\.4\.2\.Orchestrator Invariants

Orchestrator validation is mostly validation of the AI system as a whole\. Some properties can nevertheless be checked at the orchestration layer\. For safety properties one can define an orchestration invariantI∈℘​\(ClosedSystemStates\)I\\in\\wp\(\\textit\{ClosedSystemStates\}\)which must be proved to hold initially and remains true after each transitiontransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}\. SincetransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}includes external mutations of the world, such a proof must also state the admissible environment steps\. Equivalently, one proves invariance for AI\-controlled steps and assumes an environment relationE​n​v⊆W×WEnv\\subseteq W\\times Wfor external changes allowed by the model of the world\.

Liveness properties are more application specific, such as: a reactive orchestrator should not terminate before receiving a termination condition, the body of a reactive cycle should terminate when it is meant to, forbidden services should not be reachable from a given prompt class, and service results should be inserted into the context only through the specified communication channel\. Variant functions can prove termination or progress of bounded phases\. Recurrent obligations need temporal assumptions such as fairness or explicit scheduling\.

For Oma:An invariant may say that readiness is unreachable unless sources, picture and form are checked, and confirmation is present in the trace\. The environment relation admits outside changes such as the doorbell ringing or the phone moving\. Liveness may require the orchestrator eventually to save, ask Oma, refuse, or route to a clerk rather than remain silently stuck\.

## 8\.AI systems

An AI system is the whole engineered system that connects knowledge, prompts, components, services, orchestration, and actuations\.

### 8\.1\.Definition

This section describes an AI system as a combination of components that communicate through a common language, may interact with the world, and be orchestrated, as shown in Figure[1](https://arxiv.org/html/2607.09489#S8.F1)

![Refer to caption](https://arxiv.org/html/2607.09489v1/x2.png)Figure 1\.An AI systemAn AI system is⟨𝖨𝗇𝖿𝗈𝗋𝗆𝖺𝗍𝗂𝗈𝗇​𝖲𝗍𝖺𝗍𝖾,𝖢𝗈𝗆𝗉𝗈𝗇𝖾𝗇𝗍𝗌,𝖮𝗋𝖼𝗁𝖾𝗌𝗍𝗋𝖺𝗍𝗈𝗋,𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾,𝖢𝗅𝖺𝗂𝗆𝗌,𝖲𝗉𝖾𝖼𝗂𝖿𝗂𝖼𝖺𝗍𝗂𝗈𝗇𝗌⟩\\langle\\mathsf\{Information\\ State\},\\mathsf\{Components\},\\mathsf\{Orchestrator\},\\mathsf\{Interface\},\\mathsf\{Claims\},\\mathsf\{Specifications\}\\rangle:

- •𝖨𝗇𝖿𝗈𝗋𝗆𝖺𝗍𝗂𝗈𝗇​𝖲𝗍𝖺𝗍𝖾≜⟨Srct,KU,t,KS,Src,t,KE,ctx,t⟩\\mathsf\{Information\\ State\}\\triangleq\\langle\\textit\{Src\}\_\{t\},K\_\{U,t\},K\_\{S,\\textit\{Src\},t\},K\_\{E,\\textit\{ctx\},t\}\\rangleis the information\-state layer: the reference sourcesSrct\\textit\{Src\}\_\{t\}, the universal knowledge baseKU,tK\_\{U,t\}, the source\-derived knowledgeKS,Src,tK\_\{S,\\textit\{Src\},t\}, and the AI system’s effective working knowledgeKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\.
- •𝖢𝗈𝗆𝗉𝗈𝗇𝖾𝗇𝗍𝗌≜⟨Symbolic,Neural,Services⟩\\mathsf\{Components\}\\triangleq\\langle\\textit\{Symbolic\},\\textit\{Neural\},\\textit\{Services\}\\rangleis the components layer:Symboliccomponents,Neuralcomponents, andServicese\.g\. prompts, tools, sensors, browsers, APIs, or actuators\.
- •𝖮𝗋𝖼𝗁𝖾𝗌𝗍𝗋𝖺𝗍𝗈𝗋≜⟨StatesOrch,transOrch⟩\\mathsf\{Orchestrator\}\\triangleq\\langle\\textit\{States\}\_\{\\textit\{Orch\}\},\\textit\{trans\}\_\{\\textit\{Orch\}\}\\rangleis the orchestrator layer: the orchestrator statesStatesOrch\\textit\{States\}\_\{\\textit\{Orch\}\}, including control state, selected contextctx, memory and trace pointers, routing information, and the transition relationtransOrch\\textit\{trans\}\_\{\\textit\{Orch\}\}that advances the closed system by calling components, services, updating internal state, observing world changes, or producing messages and world updates\.
- •𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾≜⟨Lang,W,Ev,𝖳𝗋𝖺𝖼𝖾,𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇,𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇⟩\\mathsf\{Interface\}\\triangleq\\langle\\textit\{Lang\},W,\\textit\{Ev\},\\mathsf\{Trace\},\\mathsf\{observation\},\\mathsf\{actuation\}\\rangleis the interface layer: the communication languageLang, the setW⊆U¯W\\subseteq\\bar\{U\}of possible world states, the event recordsEv, the traces𝖳𝗋𝖺𝖼𝖾=Ev∗\\mathsf\{Trace\}=\\textit\{Ev\}^\{\\ast\}, the𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\\mathsf\{observation\}interface from the world into the system, and the𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{actuation\}interface by which system messages may change the world\.
- •The claims layer is: 𝖢𝗅𝖺𝗂𝗆𝗌≜⟨\\displaystyle\\qquad\\mathsf\{Claims\}\\triangleq\\langle\{\}𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang,𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌,𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t,\\displaystyle\\mathsf\{denotation\}\_\{\\textit\{Lang\}\},\\mathsf\{CandidateClaims\},\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\},𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t,𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t,𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t,𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t,𝖣𝖾𝗉𝖾𝗇𝖽𝗌𝖮𝗇E,ctx,t⟩\.\\displaystyle\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\},\\mathsf\{SourceSupport\}\_\{t\},\\mathsf\{SupportedClaim\}\_\{t\},\\mathsf\{ReliableClaim\}\_\{t\},\\mathsf\{DependsOn\}\_\{E,\\textit\{ctx\},t\}\\rangle\.It contains the maps, application\-specific relations, and judgments that connect communication\-level items to underlying semantic claims\. Messages map to intended source items via𝖽𝖾𝗇𝗈𝗍𝖺𝗍𝗂𝗈𝗇Lang\\mathsf\{denotation\}\_\{\\textit\{Lang\}\}\.𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{CandidateClaims\}maps messages inLangto candidate semantic meanings\.𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\}selects which candidate claims are actually asserted, and𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t\\mathsf\{SourceSupport\}\_\{t\}records which source items support which semantic claims\. The remaining judgments separate assertion, external support, reliability, and actual derivational dependence\.
- •The specifications layer is: 𝖲𝗉𝖾𝖼𝗂𝖿𝗂𝖼𝖺𝗍𝗂𝗈𝗇𝗌≜⟨\\displaystyle\\mathsf\{Specifications\}\\triangleq\\langle\{\}𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec,𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec,𝗂𝗇𝗍𝖾𝗋𝗉Spec,𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec,\\displaystyle\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\},\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\},\\mathsf\{interp\}\_\{\\textsf\{Spec\}\},\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\},𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec,𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec,𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec⟩\.\\displaystyle\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\},\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\},\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}\\rangle\.It says which observations, actions, and other candidate events are sound; the specification\-relative map from world states to semantic facts; the specification\-relative map from event records to semantic claims or records; the specification\-relative map from trace and world states to required semantic claims; and the checks for current witnesses, authority, and permitted actuation\. It is checked against the trace, the current world state, and the candidate event, using the semantic record when semantic context is needed\.

For Oma:The AI system is the whole passport app:𝖨𝗇𝖿𝗈𝗋𝗆𝖺𝗍𝗂𝗈𝗇​𝖲𝗍𝖺𝗍𝖾\\mathsf\{Information\\ State\}contains sources and the three knowledge bases;𝖢𝗈𝗆𝗉𝗈𝗇𝖾𝗇𝗍𝗌\\mathsf\{Components\}contains checkers, neural models, and services;𝖮𝗋𝖼𝗁𝖾𝗌𝗍𝗋𝖺𝗍𝗈𝗋\\mathsf\{Orchestrator\}contains the orchestrator state and transition relation;𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾\\mathsf\{Interface\}contains messages, world state, observations, updates, events, and trace;𝖢𝗅𝖺𝗂𝗆𝗌\\mathsf\{Claims\}contains denotation, candidate\-claim, support, reliance, and dependence judgments; and𝖲𝗉𝖾𝖼𝗂𝖿𝗂𝖼𝖺𝗍𝗂𝗈𝗇𝗌\\mathsf\{Specifications\}contains the event specification, world and event semantic maps\.

### 8\.2\.Specifications

Specifications state which system\-controlled events are permitted, so that traces can be checked against the semantic and operational obligations the system is meant to respect\. For simplicity, we assume that a specificationSpecrequires universally positive claims\.

Lettrace=e1​…​en∈𝖳𝗋𝖺𝖼𝖾\\textit\{trace\}=e\_\{1\}\\ldots e\_\{n\}\\in\\mathsf\{Trace\}be the event trace so far, letwt∈Ww\_\{t\}\\in Wbe the current world state, and lete∈Eve\\in\\textit\{Ev\}be the next event\. A specification supplies:

𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec\\displaystyle\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}:W⇀℘​\(U¯\),\\displaystyle:W\\rightharpoonup\\wp\(\\bar\{U\}\),𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec\\displaystyle\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}:𝖳𝗋𝖺𝖼𝖾×W×Ev→\{𝗍𝗋𝗎𝖾,𝖿𝖺𝗅𝗌𝖾\},\\displaystyle:\\mathsf\{Trace\}\\times W\\times\\textit\{Ev\}\\rightarrow\\\{\\mathsf\{true\},\\mathsf\{false\}\\\},𝗂𝗇𝗍𝖾𝗋𝗉Spec\\displaystyle\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}:Ev⇀℘​\(U¯\),\\displaystyle:\\textit\{Ev\}\\rightharpoonup\\wp\(\\bar\{U\}\),𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec\\displaystyle\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}:𝖳𝗋𝖺𝖼𝖾×W×Ev×W→\{𝗍𝗋𝗎𝖾,𝖿𝖺𝗅𝗌𝖾\},\\displaystyle:\\mathsf\{Trace\}\\times W\\times\\textit\{Ev\}\\times W\\rightarrow\\\{\\mathsf\{true\},\\mathsf\{false\}\\\},𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec\\displaystyle\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}:𝖳𝗋𝖺𝖼𝖾×W→℘​\(U¯\),\\displaystyle:\\mathsf\{Trace\}\\times W\\rightarrow\\wp\(\\bar\{U\}\),𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec\\displaystyle\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}:𝖳𝗋𝖺𝖼𝖾×W×Ev→\{𝗍𝗋𝗎𝖾,𝖿𝖺𝗅𝗌𝖾\}\.\\displaystyle:\\mathsf\{Trace\}\\times W\\times\\textit\{Ev\}\\rightarrow\\\{\\mathsf\{true\},\\mathsf\{false\}\\\}\.𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec:𝖳𝗋𝖺𝖼𝖾×W×Ev→\{𝗍𝗋𝗎𝖾,𝖿𝖺𝗅𝗌𝖾\}\.\\displaystyleFor a partial mapf:X⇀Yf:X\\rightharpoonup Y, writef​\(x\)↓f\(x\)\\downarrowwhenf​\(x\)f\(x\)is defined andf​\(x\)↑f\(x\)\\uparrowwhen it is undefined; definedness does not requiref​\(x\)f\(x\)to be nonempty whenYYis a powerset\. Here𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(w\)\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)records the semantic facts about world statewwthat matter toSpec, while𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)records the semantic content of eventee: what it claims, records, witnesses, authorizes, observes, or changes\. The set𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec​\(trace,wt\)\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w\_\{t\}\)records the task\-relevant semantic claims thatSpecrequires at the current trace and world state\. The predicates𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\},𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}, and𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}record the remaining acceptance obligations checked by the safeguard: witness freshness, permission or delegation, and whether the candidate actuation fromwtw\_\{t\}tow′w^\{\\prime\}is permitted\. The content of𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}is the reference against which an application instantiates𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}and𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}, which may consult it when relating required claims and permitted updates to the current and proposed world states\.

If𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(wt\)↑\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\_\{t\}\)\\uparrow, some prior𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(ei\)↑\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{i\}\)\\uparrow, or𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)↑\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)\\uparrow, theneeis not checkable underSpecand is not valid; an implementation may reject, pause, or route to fallback\.

For Oma:𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(w\)\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)may contain the current form value and picture state;𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)may contain the claim that a source was checked, a checker returned a result, or Oma confirmed the draft\.

𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}lists the constraints given bySpec\. Ifeeis an external mutation, user action, or other event not controlled by the system, there is no direct requirement on the system\. There may still be invariants, e\.g\. the orchestrator state must remain consistent with the resulting world state once the event is observed\. Ifeeis performed by the system then the specification can require𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec​\(trace,wt,e\)\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w\_\{t\},e\)\. We write𝖲𝗒𝗌𝗍𝖾𝗆𝖢𝗈𝗇𝗍𝗋𝗈𝗅𝗅𝖾𝖽​\(e\)\\mathsf\{SystemControlled\}\(e\)wheneeis performed by the system, rather than by a user, external agent, or the world\. For reads, this can express e\.g\. that the private information is not read, or the read belongs to the user\-specified boundaries\. For writes, this can express e\.g\. that private information is not modified, or an actuation had the required authority\.

For Oma:We give an example of specification implemented in our prototype using thecatlanguage\(Alglaveet al\.,[2014](https://arxiv.org/html/2607.09489#bib.bib143)\), and shown in appendix\. A write eventeelabelledCheckReadyis allowed only if the trace contains the selected route, a successful picture\-check witness, a form\-complete witness, and Oma’s confirmation of the draft\. Moreover, no invalidation may occur between those witnesses and the readiness event: editing the form, changing the picture, the route, or revoking confirmation makes the prior support stale\. This catches readiness checks without a picture check, without form completion, without Oma’s current draft confirmation, or after an edit that invalidates the earlier confirmation\.

## 9\.Soundness of Controlled Transitions

Here we examine what it means for the orchestrator to make sound transitions\. Controlled transition soundness requires every system\-controlled step to be justified before it goes ahead\.

### 9\.1\.Conditions on events and orchestrator steps

Events and orchestrator steps connect messages to state changes, so each step must record that the event, message, interface interpretation, and resulting transition agree\. We define a number of concepts to do so:

- •*Reliable assertions\.*This says that the claims made by the message of an eventeeare reliable: 𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇𝗌t,ctx​\(trace;e\)≜\|trace\|=t∧ctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\displaystyle\\mathsf\{ReliableAssertions\}\_\{t,\\textit\{ctx\}\}\(\\textit\{trace\};e\)\\triangleq\|\\textit\{trace\}\|=t\\wedge\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)∧∀c∈𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t\(e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾\)\.\\displaystyle\\qquad\{\}\\wedge\\forall c\\in\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(e\.\\mathsf\{message\}\)\\mathrel\{\.\}𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t\(e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\.\\displaystyle\\qquad\{\}\\mathsf\{ReliableClaim\}\_\{t\}\(e\.\\mathsf\{message\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\.
- •*Validity\.*This says that the event is meaningful and that every claim asserted by its message may be relied upon in every selected context\. It does not itself assert𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}: 𝖵𝖺𝗅𝗂𝖽𝗂𝗍𝗒t,Spec\(trace,w;e\)≜\|trace\|=t∧𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec\(w\)↓∧\(∀ej∈trace\.𝗂𝗇𝗍𝖾𝗋𝗉Spec\(ej\)↓\)\\displaystyle\\mathsf\{Validity\}\_\{t,\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)\\triangleq\|\\textit\{trace\}\|=t\\wedge\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)\\downarrow\\wedge\\bigl\(\\forall e\_\{j\}\\in\\textit\{trace\}\\mathrel\{\.\}\\,\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{j\}\)\\downarrow\\bigr\)∧𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)↓∧∀ctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\.𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇𝗌t,ctx​\(trace;e\)\.\\displaystyle\\quad\{\}\\wedge\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)\\downarrow\\wedge\\forall\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)\\mathrel\{\.\}\\,\\mathsf\{ReliableAssertions\}\_\{t,\\textit\{ctx\}\}\(\\textit\{trace\};e\)\.
- •*Interface Agreement\.*The event record must match what the observation and actuation interfaces actually did: 𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾𝖮𝖪\(Serv,e,w,w′\)≜Serv∈Services∧\(e\.𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇=o⊥∨e\.𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇=\\displaystyle\\mathsf\{InterfaceOK\}\(\\textit\{Serv\},e,w,w^\{\\prime\}\)\\triangleq\\textit\{Serv\}\\in\\textit\{Services\}\\wedge\\bigl\(e\.\\mathsf\{observation\}=o\_\{\\bot\}\\vee e\.\\mathsf\{observation\}=\{\}𝗈𝖻𝗌𝖾𝗋𝗏𝖺𝗍𝗂𝗈𝗇\(Serv,w\)\)\\displaystyle\\qquad\{\}\\mathsf\{observation\}\(\\textit\{Serv\},w\)\\bigr\)∧\(\(e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇=m⊥∧w′=w\)∨𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\(w,e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\)=w′\)\.\\displaystyle\\qquad\{\}\\wedge\\bigl\(\(e\.\\mathsf\{actuation\}=m\_\{\\bot\}\\wedge w^\{\\prime\}=w\)\\vee\\mathsf\{actuation\}\(w,e\.\\mathsf\{actuation\}\)=w^\{\\prime\}\\bigr\)\.HereServis the service whose observation interface is being checked, ando⊥o\_\{\\bot\}andm⊥m\_\{\\bot\}are the no\-observation and no\-actuation messages used by the service semantics\.
- •*Step Satisfies Interface\.*We define the derived step relation 𝖲𝗍𝖾𝗉Orch​\(s,s→,trace,w,e,s′,s→′,w′\)\\displaystyle\\mathsf\{Step\}\_\{\\textit\{Orch\}\}\(s,\\vec\{s\},\\textit\{trace\},w,e,s^\{\\prime\},\\vec\{s\}^\{\\prime\},w^\{\\prime\}\)≜∃m∈Lang\.⟨⟨⟨s,s→,w,trace⟩,m⟩,⟨s′,s→′,w′,trace⋅e⟩⟩∈transOrch\.\\displaystyle\\quad\\triangleq\\exists m\\in\\textit\{Lang\}\\mathrel\{\.\}\\bigl\\langle\\bigl\\langle\\langle s,\\vec\{s\},w,\\textit\{trace\}\\rangle,m\\bigr\\rangle,\\langle s^\{\\prime\},\\vec\{s\}^\{\\prime\},w^\{\\prime\},\\textit\{trace\}\\cdot e\\rangle\\bigr\\rangle\\in\\textit\{trans\}\_\{\\textit\{Orch\}\}\. Now, this invariant says that the step taken satisfies the interface agreement: 𝖲𝗍𝖾𝗉𝖮𝖪\(𝖲𝗍𝖾𝗉Orch\)≜∀s,s→,s′,s→′,trace,w,w′,e\.\\displaystyle\\mathsf\{StepOK\}\(\\mathsf\{Step\}\_\{\\textit\{Orch\}\}\)\\triangleq\\forall s,\\vec\{s\},s^\{\\prime\},\\vec\{s\}^\{\\prime\},\\textit\{trace\},w,w^\{\\prime\},e\\mathrel\{\.\}𝖲𝗍𝖾𝗉Orch​\(s,s→,trace,w,e,s′,s→′,w′\)⇒∃Serv∈Services\.𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾𝖮𝖪​\(Serv,e,w,w′\)\.\\displaystyle\\qquad\\mathsf\{Step\}\_\{\\textit\{Orch\}\}\(s,\\vec\{s\},\\textit\{trace\},w,e,s^\{\\prime\},\\vec\{s\}^\{\\prime\},w^\{\\prime\}\)\\Rightarrow\\exists\\textit\{Serv\}\\in\\textit\{Services\}\\mathrel\{\.\}\\,\\mathsf\{InterfaceOK\}\(\\textit\{Serv\},e,w,w^\{\\prime\}\)\.

### 9\.2\.Transition Safeguard

A transition safeguard is a check that determines whether a proposed system action has enough reliable support, authority and freshness to proceed\. Before addingeeto the trace, it would be desirable for an orchestrator to run𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)\. At a high\-level, the safeguard either accepts the eventeeor rejects it\. Here we discuss the acceptance case, and rejection cases are discussed later in Section[9\.3](https://arxiv.org/html/2607.09489#S9.SS3):

- •*Acceptance\.*A result𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\\mathsf\{Accept\}\(e,w^\{\\prime\}\)recordseeand commits the world updatew′w^\{\\prime\}\. We write: 𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍Spec​\(trace,w,e,w′,ctx\)≜𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\.\\mathsf\{SafeguardAccept\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)\\triangleq\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{Accept\}\(e,w^\{\\prime\}\)\.
- •*Acceptance certificate\.*An acceptance result is not itself a proof thateeis allowed\. The safeguard must establish a structured certificate\. First, every claim required bySpecat the current trace and world must have a reliable message: 𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌𝖮𝖪Spec,t,ctx​\(trace,w;e\)≜\|trace\|=t∧ctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\displaystyle\\mathsf\{RequiredClaimsOK\}\_\{\\textsf\{Spec\},t,\\textit\{ctx\}\}\(\\textit\{trace\},w;e\)\\triangleq\|\\textit\{trace\}\|=t\\wedge\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)∧∀c∈𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec​\(trace,w\)\.∃mc∈Lang\.\\displaystyle\\qquad\{\}\\wedge\\forall c\\in\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w\)\\mathrel\{\.\}\\,\\exists m\_\{c\}\\in\\textit\{Lang\}\\mathrel\{\.\}𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mc,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\.\\displaystyle\\qquad\{\}\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{c\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\.𝖵𝖺𝗅𝗂𝖽𝗂𝗍𝗒\\mathsf\{Validity\}ranges over every context in𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)since a later call may select differently from the same trace, whereas𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌𝖮𝖪\\mathsf\{RequiredClaimsOK\}fixes the single context under which the safeguard runs and whose reliable messages it can actually inspect\. The remaining certificate predicates are specification\-relative checks:𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪\\mathsf\{CurrentWitnessesOK\}checks that required witnesses are present and not invalidated,𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪\\mathsf\{AuthorityOK\}checks permission and delegation, and𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪\\mathsf\{ActuationOK\}checks that the proposed world update is permitted\. The complete acceptance certificate is: 𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,t,ctx​\(trace,w,e,w′\)≜𝖵𝖺𝗅𝗂𝖽𝗂𝗍𝗒t,Spec​\(trace,w;e\)∧𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌𝖮𝖪Spec,t,ctx​\(trace,w;e\)\\displaystyle\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},t,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\\triangleq\\mathsf\{Validity\}\_\{t,\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)\\wedge\\mathsf\{RequiredClaimsOK\}\_\{\\textsf\{Spec\},t,\\textit\{ctx\}\}\(\\textit\{trace\},w;e\)∧𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec​\(trace,w;e\)∧𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec​\(trace,w;e\)\\displaystyle\\qquad\{\}\\wedge\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)\\wedge\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)∧𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec​\(trace,w;e,w′\)\.\\displaystyle\\qquad\{\}\\wedge\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\}\)\.
- •*Acceptance adequacy and safeguard soundness\.*Acceptance adequacy is the declarative specification claim that the acceptance certificate is strong enough to imply that the event is allowed: 𝖠𝖼𝖼𝖾𝗉𝗍𝖠𝖽𝖾𝗊𝗎𝖺𝗍𝖾Spec≜\\displaystyle\\mathsf\{AcceptAdequate\}\_\{\\textsf\{Spec\}\}\\triangleq∀trace,w,e,w′,ctx\.𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\\displaystyle\\quad\\forall\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\\mathrel\{\.\}\\,\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)⇒𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec​\(trace,w,e\)\.\\displaystyle\\qquad\\Rightarrow\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e\)\.The implementation\-level safeguard contract says that every accept result comes with such a certificate: 𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)≜\\displaystyle\\mathsf\{SafeguardAcceptSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)\\triangleq∀trace,w,e,w′,ctx\.𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\\displaystyle\\quad\\forall\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\\mathrel\{\.\}\\,\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{Accept\}\(e,w^\{\\prime\}\)⇒𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\.\\displaystyle\\qquad\\Rightarrow\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\.
- •*Valid step\.*A valid step is a system\-controlled orchestrator step whose proposed event has been accepted by the safeguard: 𝖵𝖺𝗅𝗂𝖽𝖲𝗍𝖾𝗉Spec​\(𝖲𝗍𝖾𝗉Orch,𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec,trace,w,w′,e,ctx,s,s→,s′,s→′\)≜\\displaystyle\\hskip 10\.00002pt\\mathsf\{ValidStep\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Step\}\_\{\\textit\{Orch\}\},\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\},\\textit\{trace\},w,w^\{\\prime\},e,\\textit\{ctx\},s,\\vec\{s\},s^\{\\prime\},\\vec\{s\}^\{\\prime\}\)\\triangleq𝖲𝗍𝖾𝗉Orch​\(s,s→,trace,w,e,s′,s→′,w′\)∧𝖲𝗒𝗌𝗍𝖾𝗆𝖢𝗈𝗇𝗍𝗋𝗈𝗅𝗅𝖾𝖽​\(e\)∧𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍Spec​\(trace,w,e,w′,ctx\)\.\\displaystyle\\hskip 10\.00002pt\\quad\\mathsf\{Step\}\_\{\\textit\{Orch\}\}\(s,\\vec\{s\},\\textit\{trace\},w,e,s^\{\\prime\},\\vec\{s\}^\{\\prime\},w^\{\\prime\}\)\\wedge\\mathsf\{SystemControlled\}\(e\)\\wedge\\mathsf\{SafeguardAccept\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)\.

An accepted controlled transition is sound when the safeguard acceptance is sound, the acceptance certificate is adequate, and the recorded step agrees with the observation/actuation interfaces:

###### Theorem 1 \(Valid steps for accepted controlled transitions\)\.

For alltrace,ww,w′w^\{\\prime\},ee,ctx,ss,s→\\vec\{s\},s′s^\{\\prime\},s→′\\vec\{s\}^\{\\prime\}:

𝖵𝖺𝗅𝗂𝖽𝖲𝗍𝖾𝗉Spec​\(𝖲𝗍𝖾𝗉Orch,𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec,trace,w,w′,e,ctx,s,s→,s′,s→′\)\\displaystyle\\mathsf\{ValidStep\}\_\{\\textsf\{Spec\}\}\\bigl\(\\mathsf\{Step\}\_\{\\textit\{Orch\}\},\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\},\\textit\{trace\},w,w^\{\\prime\},e,\\textit\{ctx\},s,\\vec\{s\},s^\{\\prime\},\\vec\{s\}^\{\\prime\}\\bigr\)∧𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)∧𝖠𝖼𝖼𝖾𝗉𝗍𝖠𝖽𝖾𝗊𝗎𝖺𝗍𝖾Spec∧𝖲𝗍𝖾𝗉𝖮𝖪​\(𝖲𝗍𝖾𝗉Orch\)⇒\\displaystyle\\quad\{\}\\wedge\\mathsf\{SafeguardAcceptSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)\\wedge\\mathsf\{AcceptAdequate\}\_\{\\textsf\{Spec\}\}\\wedge\\mathsf\{StepOK\}\(\\mathsf\{Step\}\_\{\\textit\{Orch\}\}\)\\Rightarrow𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec​\(trace,w,e\)∧∃Serv∈Services\.𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾𝖮𝖪​\(Serv,e,w,w′\)\.\\displaystyle\\qquad\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e\)\\wedge\\exists\\textit\{Serv\}\\in\\textit\{Services\}\\mathrel\{\.\}\\,\\mathsf\{InterfaceOK\}\(\\textit\{Serv\},e,w,w^\{\\prime\}\)\.

For Oma:The theorem says the app cannot record “ready for submission” because the UI indicates thus\. A readiness event cannot silently entailSubmitPassportApplication; submission requires its own authority event and its own transition\. That gives Oma a trace where every accepted app action has current witnesses, the right authority, and a permitted actuation\.For the evente\.𝗇𝖺𝗆𝖾=CheckReadye\.\\mathsf\{name\}=\\texttt\{CheckReady\}, the relevant orchestrator transition is the transition that recordseein the trace and, if its transition safeguard returns𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\\mathsf\{Accept\}\(e,w^\{\\prime\}\), updates the world state to say that the draft is ready\. The safeguard must establish:•the trace beforeeecontains the selected renewal route; a successful picture\-check witness for the current picture; a form\-complete witness for the current form values; Oma’s confirmation of the current draft;•no later event in that same history invalidates those witnesses by editing the form, changing the picture, changing the route, or revoking confirmation;•every readiness claim asserted bye\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾e\.\\mathsf\{message\}is reliable in the selected context;•the event record and world update are readiness\-only: the event name isCheckReady, the authority field does not containSubmissionPermit, the actuation is not a submission message, andw′w^\{\\prime\}differs fromwwonly by marking the draft ready\.If the safeguard accepts, is accept\-sound, and its acceptance certificate is adequate for the specification, the theorem gives𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec​\(trace,w,e\)\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e\), i\.e\. readiness check event is allowed at that point of the trace and world state\. Separately, the interface wrapper around observation and actuation must record what actually happened, giving∃Serv∈Services\.𝖨𝗇𝗍𝖾𝗋𝖿𝖺𝖼𝖾𝖮𝖪​\(Serv,e,w,w′\)\\exists\\textit\{Serv\}\\in\\textit\{Services\}\\mathrel\{\.\}\\,\\mathsf\{InterfaceOK\}\(\\textit\{Serv\},e,w,w^\{\\prime\}\)\.A transition that recordse\.𝗇𝖺𝗆𝖾=SubmitPassportApplicatione\.\\mathsf\{name\}=\\texttt\{SubmitPassportApplication\}has a different safeguard\. Before it can recordee, the event history must already contain a distinct eventeje\_\{j\}with s\.t\.j≤\|trace\|j\\leq\|\\textit\{trace\}\|, andej\.𝗇𝖺𝗆𝖾=SubmissionPermite\_\{j\}\.\\mathsf\{name\}=\\texttt\{SubmissionPermit\}or a prior event whoseej\.𝖺𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒e\_\{j\}\.\\mathsf\{authority\}field records Oma’s permission to submit\. The submit event’se\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇e\.\\mathsf\{actuation\}is then the submission message, andw′=𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\(w,e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\)w^\{\\prime\}=\\mathsf\{actuation\}\(w,e\.\\mathsf\{actuation\}\)is the world state after that submission\. This keeps the readiness event and the submission event as separate trace events with separate authority requirements\.

### 9\.3\.Rejection diagnostics

Safeguard rejection has several cases: for controlled\-transition soundness, every rejected transition must identify a failed semantic obligation for𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪\\mathsf\{AcceptOK\}, i\.e\. reliable support, current witness, authority, or allowed actuation\. These obligations are not properties one could prove of an arbitrary safeguard; like the acceptance contract𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍𝖲𝗈𝗎𝗇𝖽Spec\\mathsf\{SafeguardAcceptSound\}\_\{\\textsf\{Spec\}\}, theydefinethe implementation\-level rejection contract\.

###### Definition 2\.

𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}isreject\-sound, written𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)\\mathsf\{SafeguardRejectSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\), when every rejection result satisfies the obligation of its constructor, universally quantified overtrace,ww,ee,w′w^\{\\prime\},ctx, and the constructor payload; the formal rendition is in Appendix[B](https://arxiv.org/html/2607.09489#A2):

- •𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖢𝗅𝖺𝗂𝗆​\(c\)\\mathsf\{RejectMissingClaim\}\(c\)obliges𝖴𝗇𝗃𝗎𝗌𝗍𝗂𝖿𝗂𝖺𝖻𝗂𝗅𝗂𝗍𝗒\|trace\|,ctx​\(c;trace,w,Spec\)\\mathsf\{Unjustifiability\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(c;\\textit\{trace\},w,\\textsf\{Spec\}\):Specrequiresccat\(trace,w\)\(\\textit\{trace\},w\),ccis universally positive, and no current reliable message justifies relying oncc\.
- •𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾​\(m,c,d\)\\mathsf\{RejectRelianceFailure\}\(m,c,d\)obliges m=e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾∧𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\|trace\|,ctx​\(m,c\)∧𝖣𝗂𝖺𝗀𝗇𝗈𝗌𝗍𝗂𝖼𝖮𝖪\|trace\|,ctx​\(d;m,c,e,trace\)m=e\.\\mathsf\{message\}\\wedge\\mathsf\{RelianceFailure\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(m,c\)\\wedge\\mathsf\{DiagnosticOK\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(d;m,c,e,\\textit\{trace\}\)where𝖣𝗂𝖺𝗀𝗇𝗈𝗌𝗍𝗂𝖼𝖮𝖪\\mathsf\{DiagnosticOK\}means thatddnames a specific reliance\-failure case established by the direct or history\-derived diagnostic predicates of Section[6](https://arxiv.org/html/2607.09489#S6)\.
- •𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(c,ej\)\\mathsf\{RejectStaleWitness\}\(c,e\_\{j\}\)obliges𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace,w;e,c,ej\)\\mathsf\{StaleWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,c,e\_\{j\}\): some earlier trace event witnessedcc, the later eventeje\_\{j\}invalidated that witness underSpec, and no later event restored a current witness forcc\.
- •𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒​\(a\)\\mathsf\{RejectMissingAuthority\}\(a\)obliges𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒Spec​\(trace,w;e,a\)\\mathsf\{MissingAuthority\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,a\):Specrequires prior authorityaaforeeat\(trace,w\)\(\\textit\{trace\},w\), but no prior trace event isaa, recordsaain its authority field, or interprets asaa\.
- •𝖱𝖾𝗃𝖾𝖼𝗍𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(r\)\\mathsf\{RejectForbiddenActuation\}\(r\)obliges𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇Spec​\(trace,w;e,w′,r\)\\mathsf\{ForbiddenActuation\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\},r\):r=e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇r=e\.\\mathsf\{actuation\},r≠m⊥r\\neq m\_\{\\bot\},w′=𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,r\)w^\{\\prime\}=\\mathsf\{actuation\}\(w,r\), andSpecdoes not permit that actuation for this event at\(trace,w\)\(\\textit\{trace\},w\)\.

Reject\-soundness ties each rejection to a true failure statement\. To conclude that a rejected transition refutes the acceptance certificate𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪\\mathsf\{AcceptOK\}, the failure predicates must also refute the corresponding certificate predicates𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\},𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}, and𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}, whichSpecotherwise leaves opaque\. This is a coherence condition onSpecalone:

###### Definition 3\.

Specisdiagnostically coherentwhen, for alltrace,ww,ee,w′w^\{\\prime\},cc,eje\_\{j\},aa,rr:

𝖲𝗉𝖾𝖼𝖢𝗈𝗁𝖾𝗋𝖾𝗇𝗍Spec≜\\displaystyle\\mathsf\{SpecCoherent\}\_\{\\textsf\{Spec\}\}\\triangleq\{\}\(𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace,w;e,c,ej\)⇒¬𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec​\(trace,w;e\)\)\\displaystyle\\bigl\(\\mathsf\{StaleWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,c,e\_\{j\}\)\\Rightarrow\\neg\\,\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)\\bigr\)∧\\displaystyle\{\}\\wedge\{\}\(𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒Spec​\(trace,w;e,a\)⇒¬𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec​\(trace,w;e\)\)\\displaystyle\\bigl\(\\mathsf\{MissingAuthority\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,a\)\\Rightarrow\\neg\\,\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)\\bigr\)∧\\displaystyle\{\}\\wedge\{\}\(𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇Spec​\(trace,w;e,w′,r\)⇒¬𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec​\(trace,w;e,w′\)\)\.\\displaystyle\\bigl\(\\mathsf\{ForbiddenActuation\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\},r\)\\Rightarrow\\neg\\,\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\}\)\\bigr\)\.

Under these two assumptions, diagnostic adequacy is a genuine implication: every rejection refutes an actual conjunct of the acceptance certificate\.

###### Theorem 4 \(Rejection Adequacy\)\.

Assume𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)\\mathsf\{SafeguardRejectSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)as well as𝖲𝗉𝖾𝖼𝖢𝗈𝗁𝖾𝗋𝖾𝗇𝗍Spec\\mathsf\{SpecCoherent\}\_\{\\textsf\{Spec\}\}\. Then for alltrace,ww,ee,w′w^\{\\prime\}, and everyctx∈𝖲𝖾𝗅𝖾𝖼𝗍\|trace\|​\(trace\)\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{\|\\textit\{trace\}\|\}\(\\textit\{trace\}\):

𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)∈𝖱𝖾𝗃𝖾𝖼𝗍Spec⇒¬𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\.\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)\\in\\mathsf\{Reject\}\_\{\\textsf\{Spec\}\}\\Rightarrow\\neg\\,\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\.

Together with acceptance soundness, a total safeguard then decides the certificate:

###### Theorem 5 \(Safeguard Decision\)\.

Assume additionally𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)\\mathsf\{SafeguardAcceptSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)and that𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}is total: every call returns𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\\mathsf\{Accept\}\(e,w^\{\\prime\}\)or a value in𝖱𝖾𝗃𝖾𝖼𝗍Spec\\mathsf\{Reject\}\_\{\\textsf\{Spec\}\}\. Then for alltrace,ww,ee,w′w^\{\\prime\}, and everyctx∈𝖲𝖾𝗅𝖾𝖼𝗍\|trace\|​\(trace\)\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{\|\\textit\{trace\}\|\}\(\\textit\{trace\}\):

𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)⇔𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\.\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{Accept\}\(e,w^\{\\prime\}\)\\iff\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\.

For Oma:Rejection adequacy says that the rejection reason is not decorative\. If the safeguard returns𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒​\(a\)\\mathsf\{RejectMissingAuthority\}\(a\), then authorityaareally is required bySpecand really is absent from the prior trace\. If it returns𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾​\(m,c,d\)\\mathsf\{RejectRelianceFailure\}\(m,c,d\)thenmmreally is the event message,ccreally fails the reliable\-claims test, andddreally matches one of the diagnostic predicates\. If it returns𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(c,ej\)\\mathsf\{RejectStaleWitness\}\(c,e\_\{j\}\), theneje\_\{j\}really does invalidate the earlier witness forcc, with no later witness\. And if the app’s safeguard is total, accept\-sound, and reject\-sound over a coherent specification, Oma is never blocked by a spurious rejection nor waved through without a certificate: the safeguard accepts exactly the certified transitions\.

## 10\.Related Work

Our framework draws on abstraction, formal semantics, and many\-valued accounts of knowledge: abstract interpretation supports reasoning about precise objects through explicit approximations\(Cousot and Cousot,[1977](https://arxiv.org/html/2607.09489#bib.bib53)\); trivalent, epistemic, and Belnap–Dunn/FDE logics separate truth, falsity, uncertainty, belief, knowledge, both, and neither\(Égré and \(eds\.\),[2026](https://arxiv.org/html/2607.09489#bib.bib36); Rendsviget al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib37); Belnap,[1977](https://arxiv.org/html/2607.09489#bib.bib24); Dunn,[1976](https://arxiv.org/html/2607.09489#bib.bib25)\); and denotational semantics gives mathematical meanings to computational expressions independently of implementation\(Strachey,[2000](https://arxiv.org/html/2607.09489#bib.bib29); Scott and Strachey,[1971](https://arxiv.org/html/2607.09489#bib.bib30)\)\. Galton’s critique helps delimit our scope: we do not offer a theory of natural\-language meaning, but a formal account of when messages, source\-derived items, and universal claims may justify reliance in an agentic execution trace\(Galton,[1988](https://arxiv.org/html/2607.09489#bib.bib28)\), with our treatment of messages as signs echoing Peirce’s semiotic epistemology and Frege’s distinction between expression, sense, and reference\(Peirce,[1931](https://arxiv.org/html/2607.09489#bib.bib26); Frege,[1892](https://arxiv.org/html/2607.09489#bib.bib27)\)\.

Justification logic, truth maintenance, and belief revision make evidence, dependency, retraction, and theory change explicit\(Artemov,[2001](https://arxiv.org/html/2607.09489#bib.bib14); Artemov and Fitting,[2019](https://arxiv.org/html/2607.09489#bib.bib15); Doyle,[1979](https://arxiv.org/html/2607.09489#bib.bib16); de Kleer,[1986](https://arxiv.org/html/2607.09489#bib.bib17); Alchourrónet al\.,[1985](https://arxiv.org/html/2607.09489#bib.bib18)\)\. Our witness fields, status predicates, and diagnostics adapt this tradition to trace events and source items, checking whether reliance is supported, stale, refuted, or hypothesis\-dependent rather than maintaining a reasoner’s full belief state\. Provenance, audit, and runtime\-verification systems provide the operational analogue: they record lineage, derivations, and violations in executions and logs\(Moreau and Missier,[2013](https://arxiv.org/html/2607.09489#bib.bib1); Bunemanet al\.,[2001](https://arxiv.org/html/2607.09489#bib.bib2); Cheneyet al\.,[2009](https://arxiv.org/html/2607.09489#bib.bib3); Pereraet al\.,[2012](https://arxiv.org/html/2607.09489#bib.bib4); Leucker and Schallhart,[2009](https://arxiv.org/html/2607.09489#bib.bib5); Garget al\.,[2011](https://arxiv.org/html/2607.09489#bib.bib6)\)\. Our records differ in requiring semantic support relative toKS,Src,tK\_\{S,\\textit\{Src\},t\}andKU,tK\_\{U,t\}, not lineage alone; evidence logic and attribution evaluation give the corresponding epistemic and empirical views of𝖠𝗌𝗌𝖾𝗋𝗍𝗌E,ctx,t\\mathsf\{Asserts\}\_\{E,\\textit\{ctx\},t\}and𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t\\mathsf\{SourceSupport\}\_\{t\}\(Halpern and Pucella,[2006](https://arxiv.org/html/2607.09489#bib.bib7); Rashkinet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib12); Bohnetet al\.,[2022](https://arxiv.org/html/2607.09489#bib.bib13)\)\.

Prompt programming and prompt\-containing software treat prompts as program\-like artefacts with constraints, control flow, maintenance obligations, and tests\(Beurer\-Kellneret al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib104); Guyet al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib105); Lianget al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib106)\)\. Retrieval\-augmented and citation\-bearing generation improve the use of external documents, while work on language models as knowledge bases and knowledge conflicts studies the tension between parametric knowledge, retrieved context, and conflicting sources\(Lewiset al\.,[2020](https://arxiv.org/html/2607.09489#bib.bib57); Gaoet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib63); Asaiet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib64); Eset al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib65); Petroniet al\.,[2019](https://arxiv.org/html/2607.09489#bib.bib107); Wanget al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib108),[2025a](https://arxiv.org/html/2607.09489#bib.bib109)\)\. For us prompts constrain proof/search overKE,ctx,tK\_\{E,\\textit\{ctx\},t\}, whereas retrieval and citation mechanisms populate or testKS,Src,tK\_\{S,\\textit\{Src\},t\}; neither model fluency nor a source pointer alone establishes truth inKU,tK\_\{U,t\}\.

Formal methods for AI and machine\-learning components verify properties of workflows or models, often treating a neural network as a mathematical function with a specification\(Urban and Miné,[2021](https://arxiv.org/html/2607.09489#bib.bib96); Urbanet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib84); Palet al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib87); Albarghouthi,[2021](https://arxiv.org/html/2607.09489#bib.bib42)\)\. Checked\-generation systems e\.g\. WybeCoder, SAIL, formal\-method\-guided vibe coding, and intent\-formalization work put LLM outputs inside verifier, repair, proof\-obligation, or specification loops\(Gloeckleet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib77); Guet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib43); Weiet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib134); Lahiri,[2024](https://arxiv.org/html/2607.09489#bib.bib135),[2026](https://arxiv.org/html/2607.09489#bib.bib136)\)\. We treat these as component\-level or artefact\-level guarantees inside a wider system semantics that also includes sources, prompts, traces, authority, and world\-changing actions\.

Work on tool use, agents, and harness engineering studies the infrastructure around language models: modular tools, API calls, reasoning/action loops, memory, orchestration, environments, benchmarks, observability, verification, and governance\(Karpaset al\.,[2022](https://arxiv.org/html/2607.09489#bib.bib62); Schicket al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib59); Patilet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib67); Liet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib68); Gaoet al\.,[2022](https://arxiv.org/html/2607.09489#bib.bib66); Yaoet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib58); Sumerset al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib69); Wanget al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib70); Zhouet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib71); Liuet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib72); Ruanet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib73); Jimenezet al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib60); Yanget al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib61); Liet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib44)\)\. Our abstraction is stack\-neutral: a tool is an agent service, a tool call is an event, a result is a witness only relative to a specification, and orchestration is part of the transition system that builds traces and effective knowledge\.

Recent formal and systems work on secure LLM agents constrains the agent through the surrounding harness rather than trusting the model itself\. AgentSpec and Progent introduce domain\-specific policy languages for runtime constraints and privilege control over tool calls; CaMeL, Fides, RTBAS, and IsolateGPT instead emphasize data/control\-flow separation, information\-flow labels, and execution isolation; and Schlapbach gives a process\-calculus semantics for schema\-guided dialogue and MCP agent\-tool protocols\(Wanget al\.,[2025b](https://arxiv.org/html/2607.09489#bib.bib118); Shiet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib115); Debenedettiet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib119); Costaet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib120); Zhonget al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib121); Wuet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib122); Schlapbach,[2026](https://arxiv.org/html/2607.09489#bib.bib123)\)\. These works are closest to our treatment of tools as agent services and tool calls as trace events\. Our distinction is that a tool result is not itself a fact: it becomes a witness only relative to source\-derived knowledge, universal knowledge, effective knowledge, and the validity condition on the event trace\.

This also connects to works on policy logics, runtime enforcement, and proof\-carrying evidence: authorization languages such as SecPAL, Ponder, XACML, and Binder give logics for permissions, delegation, and obligations; execution monitors and edit automata characterize which trace properties can be enforced at runtime; proof\-carrying code and certifying algorithms show how untrusted outputs can be accompanied by independently checkable evidence\(Beckeret al\.,[2010](https://arxiv.org/html/2607.09489#bib.bib124); Damianouet al\.,[2001](https://arxiv.org/html/2607.09489#bib.bib125); OASIS,[2013](https://arxiv.org/html/2607.09489#bib.bib126); DeTreville,[2002](https://arxiv.org/html/2607.09489#bib.bib127); Schneider,[2000](https://arxiv.org/html/2607.09489#bib.bib128); Ligattiet al\.,[2005](https://arxiv.org/html/2607.09489#bib.bib129); Necula,[1997](https://arxiv.org/html/2607.09489#bib.bib130); McConnellet al\.,[2011](https://arxiv.org/html/2607.09489#bib.bib131); Chiesa and Tromer,[2010](https://arxiv.org/html/2607.09489#bib.bib132); Kamranet al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib133)\)\.

Finally, control theory, runtime assurance, agent verification, and agent security provide languages for constraining behaviour over time\(Sontag,[1998](https://arxiv.org/html/2607.09489#bib.bib45); Åström and Murray,[2008](https://arxiv.org/html/2607.09489#bib.bib46); Kalman,[1960](https://arxiv.org/html/2607.09489#bib.bib47); Kaelblinget al\.,[1998](https://arxiv.org/html/2607.09489#bib.bib48); Rawlingset al\.,[2017](https://arxiv.org/html/2607.09489#bib.bib49); Ramadge and Wonham,[1987](https://arxiv.org/html/2607.09489#bib.bib50); Hobbset al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib51); Ameset al\.,[2019](https://arxiv.org/html/2607.09489#bib.bib52); Crouseet al\.,[2023](https://arxiv.org/html/2607.09489#bib.bib75); Zhanget al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib76); Koohestani,[2025](https://arxiv.org/html/2607.09489#bib.bib110); Fang,[2026](https://arxiv.org/html/2607.09489#bib.bib111); Kahaniet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib112); Flandreet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib113); Wanget al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib114)\)\. Agent\-security works treat the model as an untrusted component and enforce invariants through the surrounding system\(Christodorescuet al\.,[2026](https://arxiv.org/html/2607.09489#bib.bib117); Shiet al\.,[2025](https://arxiv.org/html/2607.09489#bib.bib115); Balunovicet al\.,[2024](https://arxiv.org/html/2607.09489#bib.bib116)\)\. We adopt the same systems stance, but make the semantic objects explicit: observations, actuations, authority, witnesses, event specifications, and the difference between generated representations and the objects they purport to represent\.

## 11\.Conclusion

An AI system output is not the object it represents: a generated answer, filled form, citation, or action must be interpreted and examined against the universal knowledge baseKU,tK\_\{U,t\}, the source\-derived knowledgeKS,Src,tK\_\{S,\\textit\{Src\},t\}, and the AI system’s effective knowledgeKE,ctx,tK\_\{E,\\textit\{ctx\},t\}\.

Issues arise when these are conflated: outdated guidance treated as being current, plausible output as justified claim\. Our framework makes these distinctions explicit\. Messages denote source items, and generate candidate claims via the denotation of their source items; candidate claims require support from the universal and source\-derived knowledge bases; and actuations must also satisfy event specifications and authority constraints\.

We do not suggest that finding the universal knowledge base is always feasible\. Our contribution is to locate where obligations sit: by separating representation from object, source from domain knowledge, effective knowledge from authority, and trace evidence from world state, we obtain a vocabulary for specifying and checking AI systems\.

The app uses our framework as an engineering discipline\. A readiness check is not merely a green UI tick: it is a record of observations, witnesses, source support, and Oma’s confirmation\.

## References

- P\. Aczel \(1977\)An introduction to inductive definitions\.InHandbook of Mathematical Logic,J\. Barwise \(Ed\.\),pp\. 739–782\.External Links:[Document](https://dx.doi.org/10.1016/S0049-237X%2808%2971120-0)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- A\. Albarghouthi \(2021\)Introduction to neural network verification\.Note:[https://arxiv\.org/abs/2109\.10317](https://arxiv.org/abs/2109.10317)External Links:2109\.10317Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1),[§7\.2\.3](https://arxiv.org/html/2607.09489#S7.SS2.SSS3.p1.1)\.
- C\. E\. Alchourrón, P\. Gärdenfors, and D\. Makinson \(1985\)On the logic of theory change: partial meet contraction and revision functions\.The Journal of Symbolic Logic50\(2\),pp\. 510–530\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- J\. Alglave, L\. Maranget, and M\. Tautschnig \(2014\)Herding cats: modelling, simulation, testing, and data mining for weak memory\.ACM Trans\. Program\. Lang\. Syst\.36\(2\),pp\. 7:1–7:74\.External Links:[Document](https://dx.doi.org/10.1145/2627752)Cited by:[Appendix C](https://arxiv.org/html/2607.09489#A3),[§8\.2](https://arxiv.org/html/2607.09489#S8.SS2.p6.pic1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.p1.1)\.
- A\. D\. Ames, S\. Coogan, M\. Egerstedt, G\. Notomista, K\. Sreenath, and P\. Tabuada \(2019\)Control barrier functions: theory and applications\.In18th European Control Conference,pp\. 3420–3431\.External Links:[Document](https://dx.doi.org/10.23919/ECC.2019.8796030)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- Anthropic \(2024\)Model Context Protocol\.Note:[https://modelcontextprotocol\.io/](https://modelcontextprotocol.io/)Open standard introduced on November 25, 2024Cited by:[§7\.3](https://arxiv.org/html/2607.09489#S7.SS3.p1.1)\.
- S\. N\. Artemov and M\. Fitting \(2019\)Justification logic: reasoning with reasons\.Cambridge Tracts in Mathematics, Vol\.216,Cambridge University Press\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- S\. N\. Artemov \(2001\)Explicit provability and constructive semantics\.The Bulletin of Symbolic Logic7\(1\),pp\. 1–36\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- A\. Asai, Z\. Wu, Y\. Wang, A\. Sil, and H\. Hajishirzi \(2023\)Self\-RAG: learning to retrieve, generate, and critique through self\-reflection\.Note:[https://arxiv\.org/abs/2310\.11511](https://arxiv.org/abs/2310.11511)External Links:2310\.11511Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- K\. J\. Åström and R\. M\. Murray \(2008\)Feedback systems: an introduction for scientists and engineers\.Princeton University Press\.Note:[https://fbsbook\.org](https://fbsbook.org/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- M\. Balunovic, L\. Beurer\-Kellner, M\. Fischer, and M\. Vechev \(2024\)AI agents with formal security guarantees\.InICML 2024 Workshop on Next Generation of AI Safety,External Links:[Link](https://openreview.net/forum?id=c6jNHPksiZ)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- M\. Y\. Becker, C\. Fournet, and A\. D\. Gordon \(2010\)SecPAL: design and semantics of a decentralized authorization language\.Journal of Computer Security18\(4\),pp\. 619–665\.External Links:[Document](https://dx.doi.org/10.3233/JCS-2009-0364)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- N\. D\. Belnap \(1977\)A useful four\-valued logic\.InModern Uses of Multiple\-Valued Logic,J\. M\. Dunn and G\. Epstein \(Eds\.\),pp\. 5–37\.External Links:[Document](https://dx.doi.org/10.1007/978-94-010-1161-7%5F2)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- E\. M\. Bender, T\. Gebru, A\. McMillan\-Major, and S\. Shmitchell \(2021\)On the dangers of stochastic parrots: can language models be too big?\.InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency,pp\. 610–623\.External Links:[Document](https://dx.doi.org/10.1145/3442188.3445922)Cited by:[§1](https://arxiv.org/html/2607.09489#S1.p2.1)\.
- E\. M\. Bender and A\. Koller \(2020\)Climbing towards NLU: on meaning, form, and understanding in the age of data\.InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics,pp\. 5185–5198\.External Links:[Document](https://dx.doi.org/10.18653/v1/2020.acl-main.463)Cited by:[§1](https://arxiv.org/html/2607.09489#S1.p2.1)\.
- L\. Beurer\-Kellner, M\. Fischer, and M\. Vechev \(2023\)Prompting is programming: a query language for large language models\.Proc\. ACM Program\. Lang\.7\(PLDI\),pp\. 1946–1969\.External Links:[Document](https://dx.doi.org/10.1145/3591300)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- P\. Blackburn, M\. de Rijke, and Y\. Venema \(2001\)Modal logic\.Cambridge University Press\.External Links:[Document](https://dx.doi.org/10.1017/CBO9781107050884)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- B\. Bohnet, V\. Q\. Tran, P\. Verga, R\. Aharoni, D\. Andor, L\. B\. Soares, M\. Ciaramita, J\. Eisenstein, K\. Ganchev, J\. Herzig,et al\.\(2022\)Attributed question answering: evaluation and modeling for attributed large language models\.Note:arXiv:2212\.08037Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- P\. Buneman, S\. Khanna, and W\. Tan \(2001\)Why and where: a characterization of data provenance\.InProceedings of the 8th International Conference on Database Theory \(ICDT\),LNCS, Vol\.1973,pp\. 316–330\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- J\. Cheney, L\. Chiticariu, and W\. Tan \(2009\)Provenance in databases: why, how, and where\.Foundations and Trends in Databases1\(4\),pp\. 379–474\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- A\. Chiesa and E\. Tromer \(2010\)Proof\-carrying data and hearsay arguments from signature cards\.InInnovations in Computer Science,pp\. 310–331\.External Links:[Link](http://conference.iiis.tsinghua.edu.cn/ICS2010/content/papers/25.html)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- N\. Chomsky \(1956\)Three models for the description of language\.IRE Trans\. Inf\. Theory2\(3\),pp\. 113–124\.External Links:[Document](https://dx.doi.org/10.1109/TIT.1956.1056813)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- M\. Christodorescu, E\. Fernandes, A\. Hooda, S\. Jha, J\. Rehberger, K\. Chaudhuri, X\. Fu, K\. Shams, G\. Amir, J\. Choi, S\. Choudhary, N\. Palumbo, A\. Labunets, and N\. V\. Pandya \(2026\)Agent security is a systems problem\.External Links:2605\.18991,[Document](https://dx.doi.org/10.48550/arXiv.2605.18991)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- M\. Costa, B\. Köpf, A\. Kolluri, A\. Paverd, M\. Russinovich, A\. Salem, S\. Tople, L\. Wutschitz, and S\. Zanella\-Béguelin \(2025\)Securing AI agents with information\-flow control\.External Links:2505\.23643,[Document](https://dx.doi.org/10.48550/arXiv.2505.23643)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- P\. Cousot and R\. Cousot \(1977\)Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints\.InConference Record of the Fourth ACM Symposium on Principles of Programming Languages,pp\. 238–252\.External Links:[Document](https://dx.doi.org/10.1145/512950.512973)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- P\. Cousot and R\. Cousot \(1979\)Systematic design of program analysis frameworks\.InConference Record of the Sixth ACM Symposium on Principles of Programming Languages,pp\. 269–282\.External Links:[Document](https://dx.doi.org/10.1145/567752.567778)Cited by:[§4\.2](https://arxiv.org/html/2607.09489#S4.SS2.p1.2)\.
- M\. Crouse, I\. Abdelaziz, C\. Cornelio, V\. Thost, L\. Wu, K\. D\. Forbus, and A\. Fokoue \(2023\)Formally specifying the high\-level behavior of LLM\-based agents\.Note:[https://arxiv\.org/abs/2310\.08535](https://arxiv.org/abs/2310.08535)External Links:2310\.08535Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- N\. Damianou, N\. Dulay, E\. Lupu, and M\. Sloman \(2001\)The ponder policy specification language\.InPolicies for Distributed Systems and Networks,Lecture Notes in Computer Science, Vol\.1995,pp\. 18–38\.External Links:[Document](https://dx.doi.org/10.1007/3-540-44569-2%5F2)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- J\. de Kleer \(1986\)An assumption\-based TMS\.Artificial Intelligence28\(2\),pp\. 127–162\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- E\. Debenedetti, I\. Shumailov, T\. Fan, J\. Hayes, N\. Carlini, D\. Fabian, C\. Kern, C\. Shi, A\. Terzis, and F\. Tramèr \(2025\)Defeating prompt injections by design\.External Links:2503\.18813,[Document](https://dx.doi.org/10.48550/arXiv.2503.18813)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- J\. DeTreville \(2002\)Binder, a logic\-based security language\.In2002 IEEE Symposium on Security and Privacy,pp\. 105–113\.External Links:[Document](https://dx.doi.org/10.1109/SECPRI.2002.1004365)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- J\. Doyle \(1979\)A truth maintenance system\.Artificial Intelligence12\(3\),pp\. 231–272\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- J\. M\. Dunn \(1976\)Intuitive semantics for first\-degree entailments and “coupled trees”\.Philosophical Studies29\(3\),pp\. 149–168\.External Links:[Document](https://dx.doi.org/10.1007/BF00373152)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- P\. Égré and L\. R\. \(eds\.\) \(2026\)Handbook of trivalent logics\.MIT press\.Note:[https://mitpress\.mit\.edu/9780262054003/handbook\-of\-trivalent\-logics/](https://mitpress.mit.edu/9780262054003/handbook-of-trivalent-logics/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- S\. Es, J\. James, L\. Espinosa\-Anke, and S\. Schockaert \(2023\)RAGAS: automated evaluation of retrieval augmented generation\.Note:[https://arxiv\.org/abs/2309\.15217](https://arxiv.org/abs/2309.15217)External Links:2309\.15217Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- E\. Fang \(2026\)AgentVerify: compositional formal verification of AI agent safety properties via LTL model checking\.Note:Preprints\.orgExternal Links:[Document](https://dx.doi.org/10.20944/preprints202604.1029.v1)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- N\. Y\. Flandre, A\. C\. Nwala, and P\. J\. Giabbanelli \(2026\)Composing verifiable conceptual models via building blocks: towards design\-time verification of agentic AI workflows\.External Links:2606\.21565,[Document](https://dx.doi.org/10.48550/arXiv.2606.21565)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- G\. Frege \(1892\)Über sinn und bedeutung\.Zeitschrift für Philosophie und philosophische Kritik100,pp\. 25–50\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- A\. Galton \(1988\)Formal semantics: is it relevant to artificial intelligence?\.Artificial Intelligence Review2,pp\. 151–165\.External Links:[Document](https://dx.doi.org/10.1007/BF00159144)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- L\. Gao, A\. Madaan, S\. Zhou, U\. Alon, P\. Liu, Y\. Yang, J\. Callan, and G\. Neubig \(2022\)PAL: program\-aided language models\.Note:[https://arxiv\.org/abs/2211\.10435](https://arxiv.org/abs/2211.10435)External Links:2211\.10435Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- T\. Gao, H\. Yen, J\. Yu, and D\. Chen \(2023\)Enabling large language models to generate text with citations\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,Note:[https://arxiv\.org/abs/2305\.14627](https://arxiv.org/abs/2305.14627)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- D\. Garg, L\. Jia, and A\. Datta \(2011\)Policy auditing over incomplete logs: theory, implementation and applications\.InProceedings of the 18th ACM Conference on Computer and Communications Security \(CCS\),pp\. 151–162\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- F\. Gloeckle, M\. Bakšys, D\. Feher, K\. Zheng, A\. Hayat, S\. B\. Holden, G\. Synnaeve, and P\. O’Hearn \(2026\)WybeCoder: verified imperative code generation\.Note:[https://arxiv\.org/abs/2603\.29088](https://arxiv.org/abs/2603.29088)External Links:2603\.29088Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- Q\. Gu, A\. Singh, and G\. Singh \(2026\)SAIL: sound abstract interpreters with LLMs\.Proceedings of the ACM on Programming Languages10\(PLDI\)\.External Links:[Document](https://dx.doi.org/10.1145/3808308)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- T\. Guy, P\. de Halleux, R\. K\. Sharma, and B\. Zorn \(2024\)Prompts are programs\.Note:SIGPLAN BlogExternal Links:[Link](https://blog.sigplan.org/2024/10/22/prompts-are-programs/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- J\. Y\. Halpern and R\. Pucella \(2006\)A logic for reasoning about evidence\.Journal of Artificial Intelligence Research26,pp\. 1–34\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- D\. Hilbert and W\. Ackermann \(1928\)Grundzüge der theoretischen Logik\.Cambridge University Press\.External Links:[Document](https://dx.doi.org/10.1007/978-3-662-41928-1)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- K\. L\. Hobbs, M\. L\. Mote, M\. C\. Abate, S\. Coogan, and E\. M\. Feron \(2023\)Run time assurance for safety\-critical systems: an introduction to safety filtering approaches for complex control systems\.IEEE Control Systems Magazine43\(2\),pp\. 28–65\.External Links:[Document](https://dx.doi.org/10.1109/MCS.2023.3234380)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- A\. Hogan, E\. Blomqvist, and S\. D\. et al\. \(2022\)Knowledge graphs\.Springer\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-01918-0)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- Z\. Ji, N\. Lee, R\. Frieske, T\. Yu, D\. Su, Y\. Xu, E\. Ishii, Y\. J\. Bang, A\. Madotto, and P\. Fung \(2023\)Survey of hallucination in natural language generation\.ACM Computing Surveys55\(12\),pp\. 1–38\.External Links:[Document](https://dx.doi.org/10.1145/3571730)Cited by:[§1](https://arxiv.org/html/2607.09489#S1.p2.1)\.
- C\. E\. Jimenez, J\. Yang, A\. Wettig, S\. Yao, K\. Pei, O\. Press, and K\. Narasimhan \(2024\)SWE\-bench: can language models resolve real\-world GitHub issues?\.InInternational Conference on Learning Representations,Note:[https://arxiv\.org/abs/2310\.06770](https://arxiv.org/abs/2310.06770)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- L\. P\. Kaelbling, M\. L\. Littman, and A\. R\. Cassandra \(1998\)Planning and acting in partially observable stochastic domains\.Artificial Intelligence101\(1–2\),pp\. 99–134\.External Links:[Document](https://dx.doi.org/10.1016/S0004-3702%2898%2900023-X)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- N\. Kahani, M\. Barati, and D\. Addae \(2026\)Runtime compliance verification for AI agents\.External Links:2606\.19242,[Document](https://dx.doi.org/10.48550/arXiv.2606.19242)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- R\. E\. Kalman \(1960\)A new approach to linear filtering and prediction problems\.Journal of Basic Engineering82\(1\),pp\. 35–45\.External Links:[Document](https://dx.doi.org/10.1115/1.3662552)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- P\. S\. Kamran, P\. T\. Devanbu, and C\. Stanford \(2024\)Vision paper: proof\-carrying code completions\.InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops,pp\. 35–42\.External Links:[Document](https://dx.doi.org/10.1145/3691621.3694932)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- E\. Karpas, O\. Abend, Y\. Belinkov, B\. Lenz, O\. Lieber, N\. Ratner, Y\. Shoham, H\. Bata, Y\. Levine, K\. Leyton\-Brown, D\. Muhlgay, N\. Rozen, E\. Schwartz, G\. Shachaf, S\. Shalev\-Shwartz, A\. Shashua, and M\. Tenenholtz \(2022\)MRKL systems: a modular, neuro\-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning\.Note:[https://arxiv\.org/abs/2205\.00445](https://arxiv.org/abs/2205.00445)External Links:2205\.00445Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- R\. Koohestani \(2025\)AgentGuard: runtime verification of AI agents\.Note:Accepted at the Agentic Software Engineering workshop, ASE 2025External Links:2509\.23864,[Document](https://dx.doi.org/10.48550/arXiv.2509.23864)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- S\. K\. Lahiri \(2024\)Evaluating LLM\-driven user\-intent formalization for verification\-aware languages\.InProceedings of the 24th Conference on Formal Methods in Computer Aided Design,External Links:2406\.09757,[Document](https://dx.doi.org/10.48550/arXiv.2406.09757)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- S\. K\. Lahiri \(2026\)Intent formalization: a grand challenge for reliable coding in the age of AI agents\.External Links:2603\.17150,[Document](https://dx.doi.org/10.48550/arXiv.2603.17150)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- M\. Leucker and C\. Schallhart \(2009\)A brief account of runtime verification\.Journal of Logic and Algebraic Programming78\(5\),pp\. 293–303\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela \(2020\)Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.InAdvances in Neural Information Processing Systems,Vol\.33,pp\. 9459–9474\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- J\. Li, X\. Xiao, Y\. Zhang, C\. Liu, L\. Zhao, X\. Liao, Y\. Ji, J\. Wang, J\. Gu, Y\. Ge, W\. Xu, X\. Fang, X\. Xu, T\. Zhao, Y\. Kim, T\. Wang, J\. Hamm, S\. Krishnaswamy, J\. Huan, and C\. Reddy \(2026\)Agent harness engineering: a survey\.Note:[https://openreview\.net/forum?id=3hXEPbG0dh](https://openreview.net/forum?id=3hXEPbG0dh)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- M\. Li, F\. Song, B\. Yu, H\. Yu, Z\. Li, F\. Huang, and Y\. Li \(2023\)API\-Bank: a benchmark for tool\-augmented LLMs\.Note:[https://arxiv\.org/abs/2304\.08244](https://arxiv.org/abs/2304.08244)External Links:2304\.08244Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- J\. T\. Liang, M\. Lin, N\. Rao, and B\. A\. Myers \(2025\)Prompts are programs too\! understanding how developers build software containing prompts\.Proc\. ACM Softw\. Eng\.2\(FSE\),pp\. 1591–1614\.External Links:[Document](https://dx.doi.org/10.1145/3729342)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- J\. Ligatti, L\. Bauer, and D\. Walker \(2005\)Edit automata: enforcement mechanisms for run\-time security policies\.International Journal of Information Security4\(1–2\),pp\. 2–16\.External Links:[Document](https://dx.doi.org/10.1007/s10207-004-0046-8)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- X\. Liu, H\. Yu, H\. Zhang, Y\. Xu, X\. Lei, H\. Lai, Y\. Gu, H\. Ding, K\. Men, K\. Yang, S\. Zhang, X\. Deng, A\. Zeng, Z\. Du, C\. Zhang, S\. Shen, T\. Zhang, Y\. Su, H\. Sun, M\. Huang, Y\. Dong, and J\. Tang \(2023\)AgentBench: evaluating LLMs as agents\.Note:[https://arxiv\.org/abs/2308\.03688](https://arxiv.org/abs/2308.03688)External Links:2308\.03688Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- R\. M\. McConnell, K\. Mehlhorn, S\. Näher, and P\. Schweitzer \(2011\)Certifying algorithms\.Computer Science Review5\(2\),pp\. 119–161\.External Links:[Document](https://dx.doi.org/10.1016/j.cosrev.2010.09.009)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- L\. Moreau and P\. Missier \(2013\)PROV\-DM: the PROV data model\.Note:W3C Recommendation,[https://www\.w3\.org/TR/prov\-dm/](https://www.w3.org/TR/prov-dm/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- G\. C\. Necula \(1997\)Proof\-carrying code\.InProceedings of the 24th ACM SIGPLAN\-SIGACT Symposium on Principles of Programming Languages,pp\. 106–119\.External Links:[Document](https://dx.doi.org/10.1145/263699.263712)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- OASIS \(2013\)eXtensible Access Control Markup Language \(XACML\) version 3\.0\.Note:OASIS StandardExternal Links:[Link](https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- A\. Pal, F\. Ranzato, C\. Urban, and M\. Zanella \(2024\)Abstract interpretation\-based feature importance for support vector machines\.InVerification, Model Checking, and Abstract Interpretation \- 25th International Conference, VMCAI 2024, London, United Kingdom, January 15\-16, 2024, Proceedings, Part I,R\. Dimitrova, O\. Lahav, and S\. Wolff \(Eds\.\),Lecture Notes in Computer Science,pp\. 27–49\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-50524-9%5F2)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- S\. G\. Patil, T\. Zhang, X\. Wang, and J\. E\. Gonzalez \(2023\)Gorilla: large language model connected with massive APIs\.Note:[https://arxiv\.org/abs/2305\.15334](https://arxiv.org/abs/2305.15334)External Links:2305\.15334Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- C\. S\. Peirce \(1931\)Collected papers of charles sanders peirce\.Harvard University Press,Cambridge, MA\.Note:Edited by Charles Hartshorne and Paul WeissCited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- R\. Perera, U\. A\. Acar, J\. Cheney, and P\. B\. Levy \(2012\)Functional programs that explain their work\.InProceedings of the 17th ACM SIGPLAN International Conference on Functional Programming \(ICFP\),pp\. 365–376\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- F\. Petroni, T\. Rocktäschel, S\. Riedel, P\. Lewis, A\. Bakhtin, Y\. Wu, and A\. Miller \(2019\)Language models as knowledge bases?\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\),pp\. 2463–2473\.External Links:[Document](https://dx.doi.org/10.18653/v1/D19-1250)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- F\. Pifarre\-Esquerda, É\. Goubault, and S\. Putot \(2026\)Propagation of interval belief structures and imprecise copulas for neural network verification\.External Links:2606\.30105,[Link](https://arxiv.org/abs/2606.30105)Cited by:[§7\.2\.3](https://arxiv.org/html/2607.09489#S7.SS2.SSS3.p1.1)\.
- W\. Pohlers \(1989\)Proof theory : an introduction\.Springer\.External Links:[Document](https://dx.doi.org/10.1007/978-3-540-46825-7)Cited by:[1st item](https://arxiv.org/html/2607.09489#S2.I1.i1.p1.10)\.
- A\. Rahimi and B\. Recht \(2017\)Reflections on random kitchen sinks\.Note:NeurIPS Test of Time Award Talk[https://www\.argmin\.net/p/machine\-learning\-as\-alchemy](https://www.argmin.net/p/machine-learning-as-alchemy)Cited by:[§1](https://arxiv.org/html/2607.09489#S1.p2.1)\.
- P\. J\. Ramadge and W\. M\. Wonham \(1987\)Supervisory control of a class of discrete event processes\.SIAM Journal on Control and Optimization25\(1\),pp\. 206–230\.External Links:[Document](https://dx.doi.org/10.1137/0325013)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- H\. Rashkin, V\. Nikolaev, M\. Lamm, L\. Aroyo, M\. Collins, D\. Das, S\. Petrov, G\. S\. Tomar, I\. Turc, and D\. Reitter \(2023\)Measuring attribution in natural language generation models\.Computational Linguistics49\(4\)\.Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p2.4)\.
- J\. B\. Rawlings, D\. Q\. Mayne, and M\. M\. Diehl \(2017\)Model predictive control: theory, computation, and design\.2 edition,Nob Hill Publishing\.Note:[https://sites\.engineering\.ucsb\.edu/~jbraw/mpc/](https://sites.engineering.ucsb.edu/~jbraw/mpc/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- R\. Rendsvig, J\. Symons, and Y\. Wang \(2025\)Epistemic logic\.InThe Stanford Encyclopedia of Philosophy \(Summer 2025 Edition\), Edward N\. Zalta and Uri Nodelman \(eds\.\),Note:[https://plato\.stanford\.edu/archives/sum2025/entries/logic\-epistemic/](https://plato.stanford.edu/archives/sum2025/entries/logic-epistemic/)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- Y\. Ruan, H\. Dong, A\. Wang, S\. Pitis, Y\. Zhou, J\. Ba, Y\. Dubois, C\. J\. Maddison, and T\. Hashimoto \(2023\)Identifying the risks of LM agents with an LM\-emulated sandbox\.Note:[https://arxiv\.org/abs/2309\.15817](https://arxiv.org/abs/2309.15817)External Links:2309\.15817Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- T\. Schick, J\. Dwivedi\-Yu, R\. Dessì, R\. Raileanu, M\. Lomeli, E\. Hambro, L\. Zettlemoyer, N\. Cancedda, and T\. Scialom \(2023\)Toolformer: language models can teach themselves to use tools\.InAdvances in Neural Information Processing Systems,Vol\.36\.Note:[https://arxiv\.org/abs/2302\.04761](https://arxiv.org/abs/2302.04761)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- P\. Schlapbach \(2026\)Formal semantics for agentic tool protocols\.External Links:2603\.24747,[Document](https://dx.doi.org/10.48550/arXiv.2603.24747)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- F\. B\. Schneider \(2000\)Enforceable security policies\.ACM Transactions on Information and System Security3\(1\),pp\. 30–50\.External Links:[Document](https://dx.doi.org/10.1145/353323.353382)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p7.1)\.
- D\. S\. Scott and C\. Strachey \(1971\)Toward a mathematical semantics for computer languages\.Technical reportTechnical ReportPRG\-6,Programming Research Group, Oxford University Computing Laboratory\.External Links:[Link](https://www.cs.ox.ac.uk/publications/publication3723-abstract.html)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- T\. Shi, J\. He, Z\. Wang, H\. Li, L\. Wu, W\. Guo, and D\. Song \(2025\)Progent: securing AI agents with privilege control\.External Links:2504\.11703,[Document](https://dx.doi.org/10.48550/arXiv.2504.11703)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1),[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- J\. R\. Shoenfield \(1967\)Mathematical logic\.2nd edition,Taylor Francis\.External Links:[Document](https://dx.doi.org/10.1017/S1079898600005746)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- A\. Silberschatz, H\. F\. Korth, and S\. Sudarshan \(2020\)Database system concepts\.7th edition,McGraw\-Hill Education,New York, NY\.External Links:ISBN 978\-0078022159Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- E\. D\. Sontag \(1998\)Mathematical control theory: deterministic finite dimensional systems\.2 edition,Springer\.External Links:[Document](https://dx.doi.org/10.1007/978-1-4612-0577-7)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- C\. Strachey \(2000\)Fundamental concepts in programming languages\.Higher\-Order and Symbolic Computation13\(1–2\),pp\. 11–49\.External Links:[Document](https://dx.doi.org/10.1023/A%3A1010000313106)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p1.1)\.
- T\. R\. Sumers, S\. Yao, K\. Narasimhan, and T\. L\. Griffiths \(2023\)Cognitive architectures for language agents\.Note:[https://arxiv\.org/abs/2309\.02427](https://arxiv.org/abs/2309.02427)External Links:2309\.02427Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- A\. Tarski \(1955\)A lattice theoretical fixpoint theorem and its applications\.Pacific J\. of Math\.5,pp\. 285–310\.External Links:[Document](https://dx.doi.org/10.2140/pjm.1955.5.285)Cited by:[4th item](https://arxiv.org/html/2607.09489#S2.I1.i4.p1.11)\.
- C\. Urban and A\. Miné \(2021\)A review of formal methods applied to machine learning\.CoRRabs/2104\.02466\.External Links:2104\.02466Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1),[§7\.2\.3](https://arxiv.org/html/2607.09489#S7.SS2.SSS3.p1.1)\.
- C\. Urban, P\. Subotic, and F\. Drobnjakovic \(2025\)Static analysis by abstract interpretation against data leakage in machine learning\.Sci\. Comput\. Program\.246,pp\. 103338\.External Links:[Document](https://dx.doi.org/10.1016/J.SCICO.2025.103338)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- D\. van Dalen \(2013\)Logic and structure\.Springer\.External Links:[Document](https://dx.doi.org/10.1007/978-1-4471-4558-5)Cited by:[§2](https://arxiv.org/html/2607.09489#S2.p2.1)\.
- F\. Wang, X\. Wan, R\. Sun, J\. Chen, and S\. O\. Arik \(2025a\)Astute RAG: overcoming imperfect retrieval augmentation and knowledge conflicts for large language models\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 30553–30571\.External Links:[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1476)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- H\. Wang, C\. M\. Poskitt, and J\. Sun \(2025b\)AgentSpec: customizable runtime enforcement for safe and reliable LLM agents\.Note:Accepted at ICSE 2026External Links:2503\.18666,[Document](https://dx.doi.org/10.48550/arXiv.2503.18666)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- L\. Wang, C\. Ma, X\. Feng, Z\. Zhang, H\. Yang, J\. Zhang, Z\. Chen, J\. Tang, X\. Chen, Y\. Lin, W\. X\. Zhao, Z\. Wei, and J\. Wen \(2023\)A survey on large language model based autonomous agents\.Note:[https://arxiv\.org/abs/2308\.11432](https://arxiv.org/abs/2308.11432)External Links:2308\.11432Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- R\. Wang, J\. Huang, P\. Wang, X\. Liu, L\. Kong, and T\. Zhang \(2026\)Lean4Agent: formal modeling and verification for agent workflow and trajectory\.External Links:2606\.06523,[Document](https://dx.doi.org/10.48550/arXiv.2606.06523)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- Y\. Wang, S\. Feng, H\. Wang, W\. Shi, V\. Balachandran, T\. He, and Y\. Tsvetkov \(2024\)Resolving knowledge conflicts in large language models\.InFirst Conference on Language Modeling,External Links:[Link](https://openreview.net/forum?id=ptvV5HGTNN)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p3.3)\.
- R\. Wei, L\. Zhu, H\. Wang, J\. Woodcock, F\. Yan, S\. Foster, and X\. Ji \(2026\)Formal\-method\-guided vibe coding: closing the verification loop on AI\-generated safety\-critical software through model\-driven engineering\.External Links:2606\.22413,[Document](https://dx.doi.org/10.48550/arXiv.2606.22413)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p4.1)\.
- J\. Weizenbaum \(1966\)ELIZA—a computer program for the study of natural language communication between man and machine\.Communications of the ACM9\(1\),pp\. 36–45\.External Links:[Document](https://dx.doi.org/10.1145/365153.365168)Cited by:[§1](https://arxiv.org/html/2607.09489#S1.p2.1)\.
- Y\. Wu, F\. Roesner, T\. Kohno, N\. Zhang, and U\. Iqbal \(2025\)IsolateGPT: an execution isolation architecture for LLM\-based agentic systems\.InProceedings of the Network and Distributed System Security Symposium,External Links:2403\.04960,[Document](https://dx.doi.org/10.48550/arXiv.2403.04960)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- J\. Yang, C\. E\. Jimenez, A\. Wettig, K\. Lieret, S\. Yao, K\. Narasimhan, and O\. Press \(2024\)SWE\-agent: agent\-computer interfaces enable automated software engineering\.Note:[https://arxiv\.org/abs/2405\.15793](https://arxiv.org/abs/2405.15793)External Links:2405\.15793Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao \(2023\)ReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations,Note:[https://arxiv\.org/abs/2210\.03629](https://arxiv.org/abs/2210.03629)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.
- Y\. Zhang, Y\. Cai, X\. Zuo, X\. Luan, K\. Wang, Z\. Hou, Y\. Zhang, Z\. Wei, M\. Sun, J\. Sun, J\. Sun, and J\. S\. Dong \(2024\)The fusion of large language models and formal methods for trustworthy AI agents: a roadmap\.Note:[https://arxiv\.org/abs/2412\.06512](https://arxiv.org/abs/2412.06512)External Links:2412\.06512Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p8.1)\.
- P\. Y\. Zhong, S\. Chen, R\. Wang, M\. McCall, B\. L\. Titzer, H\. Miller, and P\. B\. Gibbons \(2025\)RTBAS: defending LLM agents against prompt injection and privacy leakage\.External Links:2502\.08966,[Document](https://dx.doi.org/10.48550/arXiv.2502.08966)Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p6.1)\.
- S\. Zhou, F\. F\. Xu, H\. Zhu, X\. Zhou, R\. Lo, A\. Sridhar, X\. Cheng, Y\. Bisk, D\. Fried, U\. Alon, and G\. Neubig \(2023\)WebArena: a realistic web environment for building autonomous agents\.Note:[https://arxiv\.org/abs/2307\.13854](https://arxiv.org/abs/2307.13854)External Links:2307\.13854Cited by:[§10](https://arxiv.org/html/2607.09489#S10.p5.1)\.

## Appendix ATheorems and Proofs

This appendix gives proof sketches for our theorems\.

### A\.1\.Theorem[1](https://arxiv.org/html/2607.09489#S6.Thmtheorem1): Exhaustiveness

###### Proof of theorem[1](https://arxiv.org/html/2607.09489#S6.Thmtheorem1)on exhaustiveness\.

Fixsssuch that𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)\. \(⇒\\Rightarrow\) Suppose𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t,ctx​\(m,c\)\\mathsf\{RelianceFailure\}\_\{t,\\textit\{ctx\}\}\(m,c\)\. By the definitions of𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\\mathsf\{RelianceFailure\},𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾\\mathsf\{ClaimUse\}, and𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}, we have𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\),KE,ctx,t⊢t\+mK\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}m, andc∈𝖢𝖺𝗇𝖽𝗂𝖽𝖺𝗍𝖾𝖢𝗅𝖺𝗂𝗆𝗌​\(m\)c\\in\\mathsf\{CandidateClaims\}\(m\)\. Since the fixed predicate𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang​\(m,s\)\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}\(m,s\)supplies the denotation conjunct and, by the four\-status definitions and status exclusivity,KE,ctx,t⊢t\+mK\_\{E,\\textit\{ctx\},t\}\\vdash^\{\+\}\_\{t\}mentailsKE,ctx,t⊢t⊕mK\_\{E,\\textit\{ctx\},t\}\\vdash^\{\\oplus\}\_\{t\}m, we also have𝖤𝖿𝖿𝖾𝖼𝗍𝗂𝗏𝖾⊕,t​\(m,s;KE,ctx,t\)\\mathsf\{Effective\}\_\{\\oplus,t\}\(m,s;K\_\{E,\\textit\{ctx\},t\}\)\. Moreover,𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\\mathsf\{RelianceFailure\}gives¬𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(m,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\\neg\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m,c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\), so the definition of𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆\\mathsf\{ReliableClaim\}and the preceding facts give¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;KU,t,KS,Src,t\)\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)\. Because𝖣𝖾𝗇𝗈𝗍𝖾𝗌Lang\\mathsf\{Denotes\}\_\{\\textit\{Lang\}\}is functional andssis the fixed denotation ofmm, this unsupported\-claim fact is equivalently

¬\(𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\)\.\\neg\(\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\)\.Let us consider all possible cases𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅×,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\\times,t\}\(c;K\_\{U,t\}\)for×∈\{\+,−,±,?\}\{\\times\}\\in\\\{\{\+\},\{\-\},\{\\pm\},\{?\}\\\}\.

- •If𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)then𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)\\mathsf\{RefutedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)follows directly from𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)and the definition of𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇\\mathsf\{RefutedAssertion\};
- •if𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅?,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{?,t\}\(c;K\_\{U,t\}\)then𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)\\mathsf\{UnsupportedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)follows from the common claim\-use, denotation, effective\-one\-sidedness, and unsupported\-claim facts above, together with the definition of𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇\\mathsf\{UnsupportedAssertion\};
- •if𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\)then again by case analysis: 𝖲𝗈𝗎𝗋𝖼𝖾±,t​\(s;KS,Src,t\)∨𝖲𝗈𝗎𝗋𝖼𝖾?,t​\(s;KS,Src,t\)⇒𝖤𝗑𝗍𝗋𝖺𝗉𝗈𝗅𝖺𝗍𝗂𝗈𝗇t​\(m,c;ctx\),\\displaystyle\\mathsf\{Source\}\_\{\\pm,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\vee\\mathsf\{Source\}\_\{?,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\Rightarrow\\mathsf\{Extrapolation\}\_\{t\}\(m,c;\\textit\{ctx\}\),𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)⇒𝖲𝗈𝗎𝗋𝖼𝖾𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅𝖬𝗂𝗌𝗆𝖺𝗍𝖼𝗁t​\(m,s,c;ctx\),\\displaystyle\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\Rightarrow\\mathsf\{SourceUniversalMismatch\}\_\{t\}\(m,s,c;\\textit\{ctx\}\),𝖲𝗈𝗎𝗋𝖼𝖾−,t​\(s;KS,Src,t\)⇒𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾𝖢𝗈𝗇𝗍𝗋𝖺𝖽𝗂𝖼𝗍𝗈𝗋𝗒𝖢𝗅𝖺𝗂𝗆t​\(m,s,c;ctx\)\.\\displaystyle\\mathsf\{Source\}\_\{\-,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\Rightarrow\\mathsf\{RefutedSourceContradictoryClaim\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\.
- •If𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)then¬\(𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\)\\neg\(\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\)must hold\. - –Either¬𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)\\neg\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)gives𝖲𝗉𝗎𝗋𝗂𝗈𝗎𝗌𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(m,s,c;ctx\)\\mathsf\{SpuriousSupport\}\_\{t\}\(m,s,c;\\textit\{ctx\}\), - –or𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧¬𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\neg\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)gives𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖦𝖺𝗉t​\(m,s,c;ctx\)\\mathsf\{SourceSupportGap\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\.

\(⇐\\Leftarrow\) The definition of the seven predicates implies

¬\(𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\)\.\\neg\(\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)\\wedge\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\)\\wedge\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\)\.The first four each force¬𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\neg\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\), forRefutedAssertionvia status exclusivity\.

SpuriousSupportforces¬𝖲𝗈𝗎𝗋𝖼𝖾\+,t​\(s;KS,Src,t\);\\neg\\mathsf\{Source\}\_\{\+,t\}\(s;K\_\{S,\\textit\{Src\},t\}\);𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖦𝖺𝗉\\mathsf\{SourceSupportGap\}forces¬𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(s,c\)\\neg\\mathsf\{SourceSupport\}\_\{t\}\(s,c\)\. And finallyRefutedSourceContradictoryClaimforces¬𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\.\\neg\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)\.∎

### A\.2\.Theorem[2](https://arxiv.org/html/2607.09489#S6.Thmtheorem2): Trace soundness

###### Proof of theorem[2](https://arxiv.org/html/2607.09489#S6.Thmtheorem2)on trace soundness\.

In each case𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,⋅​\(m,c\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},\\cdot\}\(m,c\)is a literal conjunct, so by definition of𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\\mathsf\{RelianceFailure\}it suffices to show¬𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆⋅​\(m,c;…\)\\neg\\,\\mathsf\{ReliableClaim\}\_\{\\cdot\}\(m,c;\\dots\), which by definition of𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t\\mathsf\{ReliableClaim\}\_\{t\}follows from¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆⋅​\(m,c;KU,⋅,KS,Src,⋅\)\\neg\\,\\mathsf\{SupportedClaim\}\_\{\\cdot\}\(m,c;K\_\{U,\\cdot\},K\_\{S,\\textit\{Src\},\\cdot\}\)\.

- •*𝖲𝗍𝖺𝗅𝖾𝖲𝗈𝗎𝗋𝖼𝖾\\mathsf\{StaleSource\}\.*The final disjunct of the definition gives𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\),𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅?,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{?,t\}\(c;K\_\{U,t\}\), or𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅±,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\\pm,t\}\(c;K\_\{U,t\}\); each excludes𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)by status exclusivity \(§[•‣2](https://arxiv.org/html/2607.09489#S2.I1.i5)\), so it is the case that𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;…\)\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;\\dots\)fails on its universal conjunct\.
- •*𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾\\mathsf\{RefutedSource\}*\. Since the four base justification statuses are mutually exclusive by definition \(§[•‣2](https://arxiv.org/html/2607.09489#S2.I1.i5)\),𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅−,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\-,t\}\(c;K\_\{U,t\}\)excludes𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\), so𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;…\)\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;\\dots\)fails on its second conjunct\.
- •*𝖠𝖽𝖽𝖾𝖽𝖧𝗒𝗉𝗈𝗍𝗁𝖾𝗌𝗂𝗌\\mathsf\{AddedHypothesis\}*\.¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t​\(m,c;KU,t,KS,Src,t\)\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\}\(m,c;K\_\{U,t\},K\_\{S,\\textit\{Src\},t\}\)is a literal conjunct\.
- •*𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖴𝗌𝖾\\mathsf\{UnsupportedUse\}*\.¬𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆t\+1​\(m,c;KU,t\+1,KS,Src,t\+1\)\\neg\\,\\mathsf\{SupportedClaim\}\_\{t\+1\}\(m,c;K\_\{U,t\+1\},K\_\{S,\\textit\{Src\},t\+1\}\)is a literal conjunct, taken atctxt\+1\\textit\{ctx\}\_\{t\+1\}\. ∎

### A\.3\.Theorem[1](https://arxiv.org/html/2607.09489#S9.Thmtheorem1): Valid steps for accepted controlled transitions

###### Proof of theorem[1](https://arxiv.org/html/2607.09489#S9.Thmtheorem1)on Valid steps for accepted controlled transitions\.

From𝖵𝖺𝗅𝗂𝖽𝖲𝗍𝖾𝗉\\mathsf\{ValidStep\}we get the recorded orchestrator step and the accepted safeguard result\. Accept\-soundness gives

𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\.\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\.By𝖠𝖼𝖼𝖾𝗉𝗍𝖠𝖽𝖾𝗊𝗎𝖺𝗍𝖾Spec\\mathsf\{AcceptAdequate\}\_\{\\textsf\{Spec\}\}, this certificate entails

𝖠𝗅𝗅𝗈𝗐𝖾𝖽𝖤𝗏𝖾𝗇𝗍Spec​\(trace,w,e\)\.\\mathsf\{AllowedEvent\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e\)\.Instantiating𝖲𝗍𝖾𝗉𝖮𝖪\\mathsf\{StepOK\}with the same recorded step yields a service witness for the observation interface\. ∎

### A\.4\.Theorem[4](https://arxiv.org/html/2607.09489#S9.Thmtheorem4): Rejection Adequacy

###### Proof\.

Lett=\|trace\|t=\|\\textit\{trace\}\|and𝗋𝖾𝗌=𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)∈𝖱𝖾𝗃𝖾𝖼𝗍Spec\\mathsf\{res\}=\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)\\in\\mathsf\{Reject\}\_\{\\textsf\{Spec\}\}, and proceed by cases on the constructor of𝗋𝖾𝗌\\mathsf\{res\}; in each case we refute one conjunct of𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,t,ctx​\(trace,w,e,w′\)\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},t,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\.

If𝗋𝖾𝗌=𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖢𝗅𝖺𝗂𝗆​\(c\)\\mathsf\{res\}=\\mathsf\{RejectMissingClaim\}\(c\), reject\-soundness gives𝖴𝗇𝗃𝗎𝗌𝗍𝗂𝖿𝗂𝖺𝖻𝗂𝗅𝗂𝗍𝗒t,ctx​\(c;trace,w,Spec\)\\mathsf\{Unjustifiability\}\_\{t,\\textit\{ctx\}\}\(c;\\textit\{trace\},w,\\textsf\{Spec\}\), whose conjuncts includec∈𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec​\(trace,w\)c\\in\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w\)and the absence of anymc∈Langm\_\{c\}\\in\\textit\{Lang\}with𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mc,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{c\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\. Hence the universally quantified clause of the predicate𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌𝖮𝖪Spec,t,ctx​\(trace,w;e\)\\mathsf\{RequiredClaimsOK\}\_\{\\textsf\{Spec\},t,\\textit\{ctx\}\}\(\\textit\{trace\},w;e\)fails at thiscc, refuting the second conjunct of𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪\\mathsf\{AcceptOK\}\.

If𝗋𝖾𝗌=𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾​\(m,c,d\)\\mathsf\{res\}=\\mathsf\{RejectRelianceFailure\}\(m,c,d\), it is the case that reject\-soundness givesm=e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾m=e\.\\mathsf\{message\}as well as𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾t,ctx​\(m,c\)\\mathsf\{RelianceFailure\}\_\{t,\\textit\{ctx\}\}\(m,c\)\. By definition of𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\\mathsf\{RelianceFailure\},𝖢𝗅𝖺𝗂𝗆𝖴𝗌𝖾E,ctx,t​\(m,c\)\\mathsf\{ClaimUse\}\_\{E,\\textit\{ctx\},t\}\(m,c\)holds, soc∈𝖠𝗌𝗌𝖾𝗋𝗍𝖾𝖽𝖢𝗅𝖺𝗂𝗆𝗌E,ctx,t\(e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾\)c\\in\\mathsf\{AssertedClaims\}\_\{E,\\textit\{ctx\},t\}\(e\.\\mathsf\{message\}\), and¬𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(m,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\\neg\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m,c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)holds\. Since\|trace\|=t\|\\textit\{trace\}\|=tandctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)by hypothesis, the universally quantified clause of𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇𝗌t,ctx​\(trace;e\)\\mathsf\{ReliableAssertions\}\_\{t,\\textit\{ctx\}\}\(\\textit\{trace\};e\)fails at thiscc; asctxis a selected context, the final conjunct of𝖵𝖺𝗅𝗂𝖽𝗂𝗍𝗒t,Spec​\(trace,w;e\)\\mathsf\{Validity\}\_\{t,\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\)fails, refuting the first conjunct of𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪\\mathsf\{AcceptOK\}\.

If𝗋𝖾𝗌=𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(c,ej\)\\mathsf\{res\}=\\mathsf\{RejectStaleWitness\}\(c,e\_\{j\}\), reject\-soundness gives𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace,w;e,c,ej\)\\mathsf\{StaleWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,c,e\_\{j\}\), and diagnostic coherence gives¬𝖢𝗎𝗋𝗋𝖾𝗇𝗍𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌𝖮𝖪Spec​\(trace,w;e\)\\neg\\,\\mathsf\{CurrentWitnessesOK\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e\), refuting the third conjunct\. The cases𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒​\(a\)\\mathsf\{RejectMissingAuthority\}\(a\)and𝖱𝖾𝗃𝖾𝖼𝗍𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(r\)\\mathsf\{RejectForbiddenActuation\}\(r\)are identical, using the cases𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒Spec⇒¬𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒𝖮𝖪Spec\\mathsf\{MissingAuthority\}\_\{\\textsf\{Spec\}\}\\Rightarrow\\neg\\,\\mathsf\{AuthorityOK\}\_\{\\textsf\{Spec\}\}and𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇Spec⇒¬𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇𝖮𝖪Spec\\mathsf\{ForbiddenActuation\}\_\{\\textsf\{Spec\}\}\\Rightarrow\\neg\\,\\mathsf\{ActuationOK\}\_\{\\textsf\{Spec\}\}to refute the fourth and fifth conjuncts respectively\. ∎

### A\.5\.Theorem[5](https://arxiv.org/html/2607.09489#S9.Thmtheorem5): Safeguard Decision

###### Proof\.

Left to right is𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖠𝖼𝖼𝖾𝗉𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)\\mathsf\{SafeguardAcceptSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)\. Right to left: suppose that it is the case that𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\. By totality the safeguard returns𝖠𝖼𝖼𝖾𝗉𝗍​\(e,w′\)\\mathsf\{Accept\}\(e,w^\{\\prime\}\)or a value in𝖱𝖾𝗃𝖾𝖼𝗍Spec\\mathsf\{Reject\}\_\{\\textsf\{Spec\}\}; the latter is impossible, since Theorem[4](https://arxiv.org/html/2607.09489#S9.Thmtheorem4)would ensure that it is the case that¬𝖠𝖼𝖼𝖾𝗉𝗍𝖮𝖪Spec,\|trace\|,ctx​\(trace,w,e,w′\)\\neg\\,\\mathsf\{AcceptOK\}\_\{\\textsf\{Spec\},\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(\\textit\{trace\},w,e,w^\{\\prime\}\)\. ∎

## Appendix BTransition Safeguard Rejection Cases

For completeness, this appendix gives the formal rendition of every transition\-safeguard rejection constructor: for each constructor, the failure predicate carried by its payload, and the implication that the constructor obliges\. The formal rendition of reject\-soundness \(Definition[2](https://arxiv.org/html/2607.09489#S9.Thmtheorem2)\) is then𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗈𝗎𝗇𝖽Spec​\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec\)≜\\mathsf\{SafeguardRejectSound\}\_\{\\textsf\{Spec\}\}\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\)\\triangleq\{\}the conjunction of the five constructor implications below, universally quantified overtrace,ww,ee,w′w^\{\\prime\},ctx, and the respective payloads\. The complete rejection\-result family is

𝖱𝖾𝗃𝖾𝖼𝗍Spec::=𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖢𝗅𝖺𝗂𝗆​\(c\)∣𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\(m,c,d\)∣𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌\(c,ej\)∣𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒\(a\)∣𝖱𝖾𝗃𝖾𝖼𝗍𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\(r\)\.\\begin\{array\}\[\]\{rcl\}\\mathsf\{Reject\}\_\{\\textsf\{Spec\}\}&::=&\\mathsf\{RejectMissingClaim\}\(c\)\\\\ &&\{\}\\mid\\mathsf\{RejectRelianceFailure\}\(m,c,d\)\\\\ &&\{\}\\mid\\mathsf\{RejectStaleWitness\}\(c,e\_\{j\}\)\\\\ &&\{\}\\mid\\mathsf\{RejectMissingAuthority\}\(a\)\\\\ &&\{\}\\mid\\mathsf\{RejectForbiddenActuation\}\(r\)\.\\end\{array\}
### B\.1\.𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖢𝗅𝖺𝗂𝗆\\mathsf\{RejectMissingClaim\}

𝖴𝗇𝗃𝗎𝗌𝗍𝗂𝖿𝗂𝖺𝖻𝗂𝗅𝗂𝗍𝗒t,ctx​\(c;trace,wt,Spec\)≜\\displaystyle\\mathsf\{Unjustifiability\}\_\{t,\\textit\{ctx\}\}\(c;\\textit\{trace\},w\_\{t\},\\textsf\{Spec\}\)\\triangleq\|trace\|=t∧ctx∈𝖲𝖾𝗅𝖾𝖼𝗍t​\(trace\)\\displaystyle\\quad\|\\textit\{trace\}\|=t\\wedge\\textit\{ctx\}\\in\\mathsf\{Select\}\_\{t\}\(\\textit\{trace\}\)∧c∈𝖱𝖾𝗊𝗎𝗂𝗋𝖾𝗌Spec​\(trace,wt\)∧𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅\+,t​\(c;KU,t\)\\displaystyle\\quad\{\}\\wedge c\\in\\mathsf\{Requires\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w\_\{t\}\)\\wedge\\mathsf\{Universal\}\_\{\+,t\}\(c;K\_\{U,t\}\)∧¬∃mc∈Lang\.𝖱𝖾𝗅𝗂𝖺𝖻𝗅𝖾𝖢𝗅𝖺𝗂𝗆t​\(mc,c;KE,ctx,t,KS,Src,t,KU,t,ctx\)\.\\displaystyle\\quad\{\}\\wedge\\neg\\,\\exists m\_\{c\}\\in\\textit\{Lang\}\\mathrel\{\.\}\\,\\mathsf\{ReliableClaim\}\_\{t\}\(m\_\{c\},c;K\_\{E,\\textit\{ctx\},t\},K\_\{S,\\textit\{Src\},t\},K\_\{U,t\},\\textit\{ctx\}\)\.
𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖢𝗅𝖺𝗂𝗆​\(c\)\\displaystyle\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{RejectMissingClaim\}\(c\)⇒𝖴𝗇𝗃𝗎𝗌𝗍𝗂𝖿𝗂𝖺𝖻𝗂𝗅𝗂𝗍𝗒\|trace\|,ctx​\(c;trace,w,Spec\)\.\\displaystyle\\quad\\Rightarrow\\mathsf\{Unjustifiability\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(c;\\textit\{trace\},w,\\textsf\{Spec\}\)\.

### B\.2\.𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\\mathsf\{RejectRelianceFailure\}

𝖣𝗂𝖺𝗀𝗇𝗈𝗌𝗍𝗂𝖼𝖮𝖪t,ctx​\(d;m,c,e,trace\)≜\\displaystyle\\mathsf\{DiagnosticOK\}\_\{t,\\textit\{ctx\}\}\(d;m,c,e,\\textit\{trace\}\)\\triangleq\(d=Extrapolation∧𝖤𝗑𝗍𝗋𝖺𝗉𝗈𝗅𝖺𝗍𝗂𝗈𝗇t​\(m,c;ctx\)\)\\displaystyle\\quad\\bigl\(d=\\textsf\{Extrapolation\}\\wedge\\mathsf\{Extrapolation\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\bigr\)∨\(d=RefutedAssertion∧𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\bigl\(d=\\textsf\{RefutedAssertion\}\\wedge\\mathsf\{RefutedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\bigr\)∨\(d=UnsupportedAssertion∧𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖠𝗌𝗌𝖾𝗋𝗍𝗂𝗈𝗇t​\(m,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\bigl\(d=\\textsf\{UnsupportedAssertion\}\\wedge\\mathsf\{UnsupportedAssertion\}\_\{t\}\(m,c;\\textit\{ctx\}\)\\bigr\)∨∃s\.\(d=SourceUniversalMismatch​\(s\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖴𝗇𝗂𝗏𝖾𝗋𝗌𝖺𝗅𝖬𝗂𝗌𝗆𝖺𝗍𝖼𝗁t​\(m,s,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\exists s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{SourceUniversalMismatch\}\(s\)\\wedge\\mathsf\{SourceUniversalMismatch\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\bigr\)∨∃s\.\(d=SpuriousSupport​\(s\)∧𝖲𝗉𝗎𝗋𝗂𝗈𝗎𝗌𝖲𝗎𝗉𝗉𝗈𝗋𝗍t​\(m,s,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\exists s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{SpuriousSupport\}\(s\)\\wedge\\mathsf\{SpuriousSupport\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\bigr\)∨∃s\.\(d=SourceSupportGap​\(s\)∧𝖲𝗈𝗎𝗋𝖼𝖾𝖲𝗎𝗉𝗉𝗈𝗋𝗍𝖦𝖺𝗉t​\(m,s,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\exists s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{SourceSupportGap\}\(s\)\\wedge\\mathsf\{SourceSupportGap\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\bigr\)∨∃s\.\(d=RefutedSourceContradictoryClaim\(s\)\\displaystyle\\quad\{\}\\vee\\exists s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{RefutedSourceContradictoryClaim\}\(s\)\\bigr\.∧𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾𝖢𝗈𝗇𝗍𝗋𝖺𝖽𝗂𝖼𝗍𝗈𝗋𝗒𝖢𝗅𝖺𝗂𝗆t\(m,s,c;ctx\)\)\\displaystyle\\qquad\{\}\\bigl\.\\wedge\\mathsf\{RefutedSourceContradictoryClaim\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\bigr\)∨∃𝑠𝑝,s\.\(d=StaleSource​\(𝑠𝑝,s\)∧𝖲𝗍𝖺𝗅𝖾𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,𝑠𝑝,s,c;ctx,trace\)\)\\displaystyle\\quad\{\}\\vee\\exists\\mathit\{sp\},s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{StaleSource\}\(\\mathit\{sp\},s\)\\wedge\\mathsf\{StaleSource\}\_\{t\}\(m,\\mathit\{sp\},s,c;\\textit\{ctx\},\\textit\{trace\}\)\\bigr\)∨∃s\.\(d=RefutedSource​\(s\)∧𝖱𝖾𝖿𝗎𝗍𝖾𝖽𝖲𝗈𝗎𝗋𝖼𝖾t​\(m,s,c;ctx\)\)\\displaystyle\\quad\{\}\\vee\\exists s\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{RefutedSource\}\(s\)\\wedge\\mathsf\{RefutedSource\}\_\{t\}\(m,s,c;\\textit\{ctx\}\)\\bigr\)∨∃h\.\(d=AddedHypothesis​\(h\)∧𝖠𝖽𝖽𝖾𝖽𝖧𝗒𝗉𝗈𝗍𝗁𝖾𝗌𝗂𝗌t​\(h,c;m,ctx\)\)\\displaystyle\\quad\{\}\\vee\\exists h\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{AddedHypothesis\}\(h\)\\wedge\\mathsf\{AddedHypothesis\}\_\{t\}\(h,c;m,\\textit\{ctx\}\)\\bigr\)∨∃s,ctxt\+1\.\(d=UnsupportedUse\(s\)\\displaystyle\\quad\{\}\\vee\\exists s,\\textit\{ctx\}\_\{t\+1\}\\mathrel\{\.\}\\,\\bigl\(d=\\textsf\{UnsupportedUse\}\(s\)∧ctxt\+1∈𝖲𝖾𝗅𝖾𝖼𝗍t\+1​\(trace⋅e\)\\displaystyle\\qquad\{\}\\wedge\\textit\{ctx\}\_\{t\+1\}\\in\\mathsf\{Select\}\_\{t\+1\}\(\\textit\{trace\}\\cdot e\)∧𝖴𝗇𝗌𝗎𝗉𝗉𝗈𝗋𝗍𝖾𝖽𝖴𝗌𝖾t\+1\\displaystyle\\qquad\{\}\\wedge\\mathsf\{UnsupportedUse\}\_\{t\+1\}\(e,m,s,c;trace,ctx,ctxt\+1\)\)\.\\displaystyle\\qquad\{\}\(e,m,s,c;\\textit\{trace\},\\textit\{ctx\},\\textit\{ctx\}\_\{t\+1\}\)\\bigr\)\.
𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖱𝖾𝗃𝖾𝖼𝗍𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾​\(m,c,d\)\\displaystyle\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{RejectRelianceFailure\}\(m,c,d\)⇒m=e\.𝗆𝖾𝗌𝗌𝖺𝗀𝖾∧𝖱𝖾𝗅𝗂𝖺𝗇𝖼𝖾𝖥𝖺𝗂𝗅𝗎𝗋𝖾\|trace\|,ctx​\(m,c\)\\displaystyle\\quad\\Rightarrow m=e\.\\mathsf\{message\}\\wedge\\mathsf\{RelianceFailure\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(m,c\)∧𝖣𝗂𝖺𝗀𝗇𝗈𝗌𝗍𝗂𝖼𝖮𝖪\|trace\|,ctx​\(d;m,c,e,trace\)\.\\displaystyle\\qquad\{\}\\wedge\\mathsf\{DiagnosticOK\}\_\{\|\\textit\{trace\}\|,\\textit\{ctx\}\}\(d;m,c,e,\\textit\{trace\}\)\.

### B\.3\.𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌\\mathsf\{RejectStaleWitness\}

𝖳𝗋𝖺𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(ei,e,c;trace\)≜\\displaystyle\\mathsf\{TraceWitness\}\_\{\\textsf\{Spec\}\}\(e\_\{i\},e,c;\\textit\{trace\}\)\\triangleqei∈trace∧𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(ei\)↓∧c∈𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(ei\)\\displaystyle\\quad e\_\{i\}\\in\\textit\{trace\}\\wedge\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{i\}\)\\downarrow\\wedge c\\in\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{i\}\)∧\(ei∈e\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌\\displaystyle\\quad\{\}\\wedge\\Bigl\(e\_\{i\}\\in e\.\\mathsf\{witness\}∨∃I⊆\[1,\|trace\|\]\.I∈e\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌∧∃k∈I\.ei=trace​\[k\]\\displaystyle\\qquad\{\}\\vee\\exists I\\subseteq\[1,\|\\textit\{trace\}\|\]\\mathrel\{\.\}\\,I\\in e\.\\mathsf\{witness\}\\wedge\\exists k\\in I\\mathrel\{\.\}\\,e\_\{i\}=\\textit\{trace\}\[k\]∨∃t0,𝑠𝑝,s\.𝑠𝑝∈e\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌∧𝖲𝗈𝗎𝗋𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌t0\(𝑠𝑝,s;trace\)∧𝖤𝗑𝗍𝗋𝖺𝖼𝗍𝖾𝖽𝖥𝗋𝗈𝗆t0\(s,𝑠𝑝;ei\)\)\.\\displaystyle\\qquad\{\}\\vee\\exists t\_\{0\},\\mathit\{sp\},s\\mathrel\{\.\}\\,\\mathit\{sp\}\\in e\.\\mathsf\{witness\}\\wedge\\mathsf\{SourceWitness\}\_\{t\_\{0\}\}\(\\mathit\{sp\},s;\\textit\{trace\}\)\\wedge\\mathsf\{ExtractedFrom\}\_\{t\_\{0\}\}\(s,\\mathit\{sp\};e\_\{i\}\)\\Bigr\)\.
𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace,w;e,c,ej\)≜\\displaystyle\\mathsf\{StaleWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,c,e\_\{j\}\)\\triangleq𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(w\)↓\\displaystyle\\quad\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)\\downarrow∧\(∀ek∈trace\.𝗂𝗇𝗍𝖾𝗋𝗉Spec\(ek\)↓\)\\displaystyle\\quad\{\}\\wedge\\bigl\(\\forall e\_\{k\}\\in\\textit\{trace\}\\mathrel\{\.\}\\,\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{k\}\)\\downarrow\\bigr\)∧𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)↓\\displaystyle\\quad\{\}\\wedge\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)\\downarrow∧∃i,j∈\[1,\|trace\|\]\.i<j∧trace​\[j\]=ej\\displaystyle\\quad\{\}\\wedge\\exists i,j\\in\[1,\|\\textit\{trace\}\|\]\\mathrel\{\.\}\\,i<j\\wedge\\textit\{trace\}\[j\]=e\_\{j\}∧𝖳𝗋𝖺𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace​\[i\],e,c;trace\)\\displaystyle\\quad\{\}\\wedge\\mathsf\{TraceWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\}\[i\],e,c;\\textit\{trace\}\)∧a witness\-invalidation clause ofSpecclassifies​ej\\displaystyle\\quad\{\}\\wedge\\hbox\{a witness\-invalidation clause of \}\\textsf\{Spec\}\\hbox\{ classifies \}e\_\{j\}as invalidatingtrace​\[i\]​for​c​at​\(trace,w\)\\displaystyle\\qquad\\hbox\{as invalidating \}\\textit\{trace\}\[i\]\\hbox\{ for \}c\\hbox\{ at \}\(\\textit\{trace\},w\)∧¬∃ℓ∈\[j\+1,\|trace\|\]\.𝖳𝗋𝖺𝖼𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace​\[ℓ\],e,c;trace\)\\displaystyle\\quad\{\}\\wedge\\neg\\,\\exists\\ell\\in\[j\+1,\|\\textit\{trace\}\|\]\\mathrel\{\.\}\\,\\mathsf\{TraceWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\}\[\\ell\],e,c;\\textit\{trace\}\)∧Specclassifiestrace​\[ℓ\]​as a current witness for​c\.\\displaystyle\\qquad\{\}\\wedge\\hbox\{$\\textsf\{Spec\}$ classifies \}\\textit\{trace\}\[\\ell\]\\hbox\{ as a current witness for \}c\.
\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖱𝖾𝗃𝖾𝖼𝗍𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(c,ej\)\)\\displaystyle\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{RejectStaleWitness\}\(c,e\_\{j\}\)\)⇒𝖲𝗍𝖺𝗅𝖾𝖶𝗂𝗍𝗇𝖾𝗌𝗌Spec​\(trace,w;e,c,ej\)\.\\displaystyle\\quad\\Rightarrow\\mathsf\{StaleWitness\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,c,e\_\{j\}\)\.

### B\.4\.𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒\\mathsf\{RejectMissingAuthority\}

𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒Spec​\(trace,w;e,a\)≜\\displaystyle\\mathsf\{MissingAuthority\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,a\)\\triangleq𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(w\)↓\\displaystyle\\quad\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)\\downarrow∧\(∀ej∈trace\.𝗂𝗇𝗍𝖾𝗋𝗉Spec\(ej\)↓\)\\displaystyle\\quad\{\}\\wedge\\bigl\(\\forall e\_\{j\}\\in\\textit\{trace\}\\mathrel\{\.\}\\,\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{j\}\)\\downarrow\\bigr\)∧𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)↓\\displaystyle\\quad\{\}\\wedge\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)\\downarrow∧Spec​requires prior authority​a​for​e​at​\(trace,w\)\\displaystyle\\quad\{\}\\wedge\\textsf\{Spec\}\\ \\hbox\{requires prior authority \}a\\hbox\{ for \}e\\hbox\{ at \}\(\\textit\{trace\},w\)∧¬∃j∈\[1,\|trace\|\]\.\(trace\[j\]=a∨a∈trace\[j\]\.𝖺𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒∨a∈𝗂𝗇𝗍𝖾𝗋𝗉Spec\(trace\[j\]\)\)\.\\displaystyle\\quad\{\}\\wedge\\neg\\,\\exists j\\in\[1,\|\\textit\{trace\}\|\]\\mathrel\{\.\}\\,\\bigl\(\\textit\{trace\}\[j\]=a\\vee a\\in\\textit\{trace\}\[j\]\.\\mathsf\{authority\}\\vee a\\in\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\}\[j\]\)\\bigr\)\.
𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖱𝖾𝗃𝖾𝖼𝗍𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒​\(a\)\\displaystyle\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{RejectMissingAuthority\}\(a\)⇒𝖬𝗂𝗌𝗌𝗂𝗇𝗀𝖠𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒Spec​\(trace,w;e,a\)\.\\displaystyle\\quad\\Rightarrow\\mathsf\{MissingAuthority\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,a\)\.

### B\.5\.𝖱𝖾𝗃𝖾𝖼𝗍𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇\\mathsf\{RejectForbiddenActuation\}

𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇Spec​\(trace,w;e,w′,r\)≜\\displaystyle\\mathsf\{ForbiddenActuation\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\},r\)\\triangleq𝗐𝗈𝗋𝗅𝖽𝗆𝖺𝗉Spec​\(w\)↓\\displaystyle\\quad\\mathsf\{worldmap\}\_\{\\textsf\{Spec\}\}\(w\)\\downarrow∧\(∀ej∈trace\.𝗂𝗇𝗍𝖾𝗋𝗉Spec\(ej\)↓\)\\displaystyle\\quad\{\}\\wedge\\bigl\(\\forall e\_\{j\}\\in\\textit\{trace\}\\mathrel\{\.\}\\,\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\_\{j\}\)\\downarrow\\bigr\)∧𝗂𝗇𝗍𝖾𝗋𝗉Spec​\(e\)↓∧r=e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇∧r≠m⊥∧𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(w,r\)=w′\\displaystyle\\quad\{\}\\wedge\\mathsf\{interp\}\_\{\\textsf\{Spec\}\}\(e\)\\downarrow\\wedge r=e\.\\mathsf\{actuation\}\\wedge r\\neq m\_\{\\bot\}\\wedge\\mathsf\{actuation\}\(w,r\)=w^\{\\prime\}∧no actuation clause ofSpecallows the tuple\\displaystyle\\quad\{\}\\wedge\\hbox\{no actuation clause of \}\\textsf\{Spec\}\\hbox\{ allows the tuple \}\(trace,w,e\.𝗇𝖺𝗆𝖾,e\.𝗄𝗂𝗇𝖽,e\.𝗋𝖾𝗌𝗈𝗎𝗋𝖼𝖾,e\.𝖺𝗎𝗍𝗁𝗈𝗋𝗂𝗍𝗒,e\.𝗐𝗂𝗍𝗇𝖾𝗌𝗌,e\.𝖺𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇,r\)\.\\displaystyle\\qquad\(\\textit\{trace\},w,e\.\\mathsf\{name\},e\.\\mathsf\{kind\},e\.\\mathsf\{resource\},e\.\\mathsf\{authority\},e\.\\mathsf\{witness\},e\.\\mathsf\{actuation\},r\)\.
\(𝖲𝖺𝖿𝖾𝗀𝗎𝖺𝗋𝖽Spec​\(trace,w,e,w′,ctx\)=𝖱𝖾𝗃𝖾𝖼𝗍𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇​\(r\)\)\\displaystyle\(\\mathsf\{Safeguard\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w,e,w^\{\\prime\},\\textit\{ctx\}\)=\\mathsf\{RejectForbiddenActuation\}\(r\)\)⇒𝖥𝗈𝗋𝖻𝗂𝖽𝖽𝖾𝗇𝖠𝖼𝗍𝗎𝖺𝗍𝗂𝗈𝗇Spec​\(trace,w;e,w′,r\)\.\\displaystyle\\quad\\Rightarrow\\mathsf\{ForbiddenActuation\}\_\{\\textsf\{Spec\}\}\(\\textit\{trace\},w;e,w^\{\\prime\},r\)\.

## Appendix CExample implementation of a specification written in cat\(Alglaveet al\.,[2014](https://arxiv.org/html/2607.09489#bib.bib143)\)

```
(* Readiness for submission. *)

let s_before = po
let E_ready = E_appAgent & E_write & E_checkReady
let E_filled = E_checkForm
let s_readiness_route = [E_ukRenewalPicked | E_frRenewalPicked]
  ; feeds_into ; [E_ready]
let s_readiness_picture = [E_checkPicture] ; was_checked_before ; [E_ready]
let s_readiness_form = [E_filled] ; was_checked_before ; [E_ready]
let s_readiness_confirmation = [E_confirmDraft] ; permits ; [E_ready]
let s_readiness_stale = [E_formEditInvalidatedConfirmation]
  ; invalidates ; [E_ready]
let s_readiness_support =
  s_readiness_route | s_readiness_picture | s_readiness_form | s_readiness_confirmation
empty E_ready \ range(s_readiness_route) as s_readiness_requires_route
empty E_ready \ range(s_readiness_picture) as s_readiness_requires_picture
empty E_ready \ range(s_readiness_form) as s_readiness_requires_form
empty E_ready \ range(s_readiness_confirmation) as s_readiness_requires_confirmation
empty s_readiness_support \ s_before as s_readiness_support_must_precede_ready
empty s_readiness_stale & s_before as s_readiness_requires_current_form_state
empty ((invalidates ; s_readiness_support) & s_before)
  as s_readiness_support_not_invalidated
```