[MACHINE-SPIRIT 4/8] Procedural intelligence and expert systems: production rules, blackboards, HTN planning, CBR, diagnosis and repair #397
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
nsaspy/prolog-rlm#397
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Parent: #397
Related: #376-#387 #388 #392
Downstream: lost-rob0t/symbolic-memory#4 #6 #7 #9 #10
Distinct research mandate
Treat know-how and autonomous expert behavior as the primary problem: production systems, blackboards, HTN/classical planning, reactive/contingent procedures, workflows/behavior trees, case-based reasoning, diagnosis/repair, procedural knowledge representation, expert coordination, and heterogeneous procedural interoperability.
This depth is research/design only. It does not establish implementation or Machine Spirit acceptance.
Depth 4 status — DESIGN-COMPLETE, IMPLEMENTATION-UNPROVEN
All four required subpasses are durably preserved in this issue's comments.
A — foundations / representative formalisms: COMPLETE
Procedural Intelligence Fabric (PIF).
Hard distinctions:
B — semantic / adversarial deepening: COMPLETE
Monitored Epistemic Procedural Policies (MEPP).
Reusable procedures are policy knowledge over epistemic/temporal/resource state; a plan instance is one admitted execution projection against current evidence.
B adds:
satisfied/refuted/unknown/conflicted/blocked/unsupported;C — composition / heterogeneity / interoperability: COMPLETE
Procedural Interoperability & Federation Fabric (PIFF).
Native HTN/HDDL, Golog/ConGolog, Behavior Tree, BPMN/workflow, PDDL2.1 and expert-procedure semantics remain first-class. They interoperate through versioned Procedural Semantic Contracts (PSC) plus typed/loss-aware bridges.
Hard C decisions:
A semantic action is distinct from a host binding, capability, authority and admitted effect. External workflow roles never become local principals by lexical equality. Expert portability is typed goal-contract based. Only an execution-admitted host-specific projection reaches #288; #288 remains the sole scheduler/runtime. Mapping/adapter upgrades create new projection lineage rather than rewriting history.
D — computational realization / scaling / conformance: COMPLETE
Demand-Driven Procedural Execution & Conformance Graph (DPEC).
DPEC is a derived compiler/admission/monitoring graph over PIF + MEPP + PIFF. It does not execute procedures independently. It selects a demanded procedural slice, keeps decomposition/contingent alternatives packed, produces a versioned host projection, validates that projection under formalism-specific reference semantics, and compiles admitted primitive work into the existing #288 graph/runtime.
D hard decisions
no plan.resource_limited(...); never first-found truth/success and never implicit LLM fallback.model_calls = 0.DPEC conceptual records
These are execution/projection concepts. Canonical native procedure/PSC identity stays immutable semantic knowledge; host executable bindings remain trusted runtime configuration rather than semantic authority.
Required Depth-4 conformance direction
The D comment defines D1-D34 fixtures including demanded pruning, guard-local invalidation, stable-interface propagation stop, mapping/registry upgrades, HTN recursion classification, packed-alternative bounds, lifted verification, partial-order preservation, safe/unsafe concurrency, temporal/resource invalidation, BT
RUNNINGand ReactiveFallback behavior, PDDL2.1 reference validation, workflow join/compensation handling, Golog nondeterminism, cancellation races, exact replay, cold/warm/rebuilt and incremental/full equivalence, bounded deterministic diagnosis, CBR contraindications, stale bindings/authority rechecks, adapter proof receipts, one-scheduler instrumentation and heterogeneous zero-model cooperation.Canonical handoffs
Reconciled Depth-4 architecture
Unresolved implementation questions
Completion statement
Depth 4 A/B/C/D is design-complete only. No Machine Spirit milestone is claimed. Executable acceptance remains gated by implementation and the final #405D conformance bar.
Next research work: Depth 5 / #402A — durable world-model architecture foundations.
Refs #397 #376 #377 #379 #384 #385 #387 #288 #355 #388 #392 #395 and downstream symbolic-memory#4/#6/#7/#9/#10.
Machine Spirit Depth 4A — procedural-intelligence foundations
This is subpass A only. It establishes representative formalisms and a baseline procedural architecture. It does not close #401 and does not advance to #402. B/C/D must still independently attack this design.
Research question
Given the already-strong #376–#387 substrate — expert registry, immutable SPEC, typed dependency plans, current evidence, VERIFY, diagnosis/repair, review, one graph runtime and explicit capability/effect boundaries — what should count as procedural knowledge / know-how, how should known know-how decompose goals, how should heterogeneous experts cooperate opportunistically, how should failure trigger diagnosis instead of blind retry, and how can prior successful cases help without turning anecdotes into trusted rules?
The key question is not “which planner should Machine Spirit use?” The classical literature treats several genuinely different problems:
Trying to collapse those into one generic “agent planner” loses useful semantics.
Primary / authoritative sources inspected
Production systems / Rete
10.1016/0004-3702(82)90020-0. Bibliographic record: https://cir.nii.ac.jp/crid/1360011145674957312 . Rete is an incremental many-rule/many-object pattern-matching strategy. Its important lesson here is implementation, not semantics: cache shared tests/partial matches so working-memory changes do not rematch every rule from scratch.Blackboard / opportunistic cooperation
10.1609/aimag.v7i2.537: https://onlinelibrary.wiley.com/doi/abs/10.1609/aimag.v7i2.537 . Nii explicitly distinguishes the blackboard model of problem solving from concrete control architectures and surveys heterogeneous knowledge sources operating over shared partial solutions.10.1145/356810.356816: https://dl.acm.org/doi/10.1145/356810.356816 . HEARSAY-II is a canonical demonstration of independent knowledge sources coordinating through common problem-solving state under uncertainty.10.1609/aimag.v7i3.550: https://onlinelibrary.wiley.com/doi/abs/10.1609/aimag.v7i3.550 . Important for the warning that blackboard systems have materially different control strategies; “blackboard” does not itself define a scheduler.Classical planning / operator models
10.1016/0004-3702(71)90010-5: https://cir.nii.ac.jp/crid/1360574094437855616 . STRIPS gives the useful primitive action idea: explicit current state, goal conditions, operators with applicability and state effects.10.1016/0004-3702(94)90081-7: https://ai.dmi.unibas.ch/research/reading_group/bylander-aij1994.pdf . General propositional STRIPS plan existence is PSPACE-complete; severe restrictions are required for tractability. This is strong evidence against making unrestricted domain-independent search the normal known-procedure path.Hierarchical task networks
Case-based reasoning
10.3233/AIC-1994-7104: https://journals.sagepub.com/doi/10.3233/AIC-1994-7104 . Their canonical cycle is retrieval, reuse/adaptation, solution testing/revision, and retention/learning; they explicitly present CBR as one reasoning method inside integrated architectures rather than a replacement for all other reasoning.Model-based diagnosis
10.1016/0004-3702(87)90063-4. Bibliographic record: https://www.rankless.org/hit-papers/10.1016/0004-3702%2887%2990063-4 . The General Diagnostic Engine tradition incrementally derives candidate diagnoses from conflicts instead of baking a single heuristic fault label into the controller.10.1109/24.126668: https://ieeexplore.ieee.org/document/126668/ . Useful warning: admissible fault models affect which diagnoses are meaningful; “minimal diagnosis” alone does not guarantee useful troubleshooting.What the current #376–#387 architecture already gets right
The existing repo is ahead of many modern “agent” architectures on several fundamentals:
Those survive this pass.
The main missing piece is that #379 currently compresses several intellectual roles into a single “Planner / Coordinator Expert.” A planner that both knows procedures, invents decompositions, opportunistically coordinates experts, chooses precedent, and diagnoses failure becomes a generic agent loop by another name.
Candidate architecture A — production-system control plane
Represent know-how primarily as productions:
Working-memory changes incrementally produce an agenda of applicable productions. A Rete-like network can optimize matching.
Strengths
Weaknesses
Verdict: keep production rules as applicability/control/reaction knowledge, not the canonical representation of all know-how.
Candidate architecture B — classical/HTN planning as the procedural core
Represent primitive operators plus compound tasks and decomposition methods:
Primitive actions use closed STRIPS-like symbolic precondition/effect summaries where useful; actual effects remain capability-mediated.
Strengths
Weaknesses
Verdict: strongest candidate for the canonical know-how representation, but insufficient as the whole control architecture.
Candidate architecture C — blackboard-centered procedural intelligence
Make current problem solving a typed shared board. Experts/knowledge sources inspect board state and propose new contributions:
Experts become blackboard knowledge sources.
Strengths
Weaknesses
Verdict: adopt the logical blackboard model, not a second blackboard scheduler/runtime. Board entries are typed proposals/observations/goals consumed by #288/#377; the existing graph/async runtime remains execution authority.
Candidate architecture D — case-based control
Treat prior verified episodes as primary procedural knowledge:
Retrieve similar cases, adapt, test, and retain.
Strengths
Weaknesses
Verdict: case retrieval proposes procedural candidates/adaptations; it never directly creates a trusted method, expert mapping, or executable action. Promotion of repeated lessons belongs to Depth 7 / #404.
Candidate architecture E — model-based diagnostic controller
Make diagnosis the main control abstraction: observations inconsistent with an expected system model generate conflict sets; candidate diagnoses explain those conflicts; further observations discriminate candidates; repair follows only after sufficiently useful diagnosis.
Strengths
Weaknesses
Verdict: this should strengthen #385, but diagnosis is a procedural subarchitecture, not the universal task planner.
Preferred design — Procedural Intelligence Fabric (PIF)
Adopt a hybrid with explicit semantic roles, not an undifferentiated agent planner:
The important point is that PIF is not a new scheduler. It is a representation and reasoning layer that compiles admitted procedural decisions to the already-existing plan graph/runtime.
Canonical procedural object model
The current #392
sem_procedure/sem_stepdirection should be refined into a profile capable of representing the following distinctions without requiring a unique core predicate for each domain.1. Task / goal schema
A task describes what work means. It is not a scheduled run.
2. Procedure method
Methods are declarative know-how. Multiple methods may implement one compound task.
3. Partial-order task network
No forced total order where only dependencies are known.
4. Primitive symbolic operator
Predicted effect != observed effect. The operator says what the procedure expects the action to do. Actual execution still crosses the trusted host boundary, and fresh evidence is required afterward.
5. Control / applicability rule
This is where production-system knowledge belongs: choose/propose methods, experts, evidence requests, or recovery paths. It is not an arbitrary executable callback.
6. Procedural case / precedent
Cases remain episodic evidence. A case is not a rule.
7. Diagnosis
Reuse #392 causal/diagnostic semantics and #400 epistemic machinery rather than inventing a disconnected fault ontology:
A diagnosis hypothesis is a hypothesis, not an observed fault.
8. Execution/run instances stay separate
Hard identity split:
This is as important for procedural intelligence as proposition/assertion separation was for Depth 1.
Method selection and expert selection are different decisions
Current #379 mostly jumps from goal decomposition to expert assignment. The refined sequence should be:
An expert is a knowledge source/solver for a task, not automatically the procedure itself.
That gives reusable procedures independent of which concrete expert/version happens to solve a subgoal.
Example:
Step 2 may be served by one diagnosis expert today and a better one later without changing the procedural method’s identity.
Logical blackboard = typed coordination board, not scheduler
Blackboard ideas are useful only if the architecture preserves #376’s one-runtime invariant.
Canonical coordination entries should be run-local typed records such as:
Each entry carries producer, supporting evidence, context/frontier, status, and lifecycle.
A knowledge source/expert may propose contributions. The plan/coordinator validates and admits task-network changes. The existing runtime schedules admitted graph work.
Thus:
Durable storage should retain only materially useful receipts/cases/lessons according to Symbolic Memory policy; transient agenda state remains runtime-derived unless needed for replay.
Diagnosis → discrimination → repair must be explicit
Strengthen #385 around a model-based loop:
Repair should not be selected solely because a symptom pattern matched a familiar failure string.
Where a system model is weak, heuristic diagnosis rules and prior cases may propose hypotheses, but the proposal provenance must expose that weaker basis.
A useful discriminator may be chosen by expected separation of currently live hypotheses, bounded by cost/authority/time. Exact information-gain mathematics can be profile-specific and belongs in later B/D work; A only establishes that evidence acquisition is a first-class procedural action.
CBR integration: case -> proposal, never instant policy
The CBR cycle maps cleanly into Machine Spirit:
Important invariants:
Repeated successful cases may become evidence for a candidate generalized method/rule, but promotion is explicitly deferred to #404’s bounded self-improvement gate.
Classical planning’s proper role
Do not use unconstrained classical planning as the default if a known procedure exists. Bylander’s results are a strong warning against assuming domain-independent search is cheap.
Recommended order:
Classical state-space search is valuable for small missing procedural gaps, verification of reachable subgoals, or synthesis inside a tightly bounded operator set. It should not replace accumulated know-how.
Behavior trees / workflows
Behavior trees are useful as a compact reactive execution representation, but adding a separate BT interpreter would duplicate #288’s graph runtime. Therefore:
Rejected as canonical procedural IR/runtime in A.
Repository ownership boundaries
prolog-rlmOwns:
Existing #288 / runtime
Still owns:
Host/downstream applications
Own:
symbolic-memoryOwns durable:
It should not own an independent procedural planner/expert runtime.
API direction
Exact names follow implementation conventions, but the conceptual separation should be visible:
No API above directly executes arbitrary host actions.
Complexity / scaling implications
Production rules / Rete
Rete reduces repeated matching work by storing intermediate matches and sharing condition tests. The tradeoff is memory and invalidation complexity. Treat Rete nodes/matches as rebuildable derived state, scoped to active theory/run, not durable semantic truth.
For ordinary Prolog rule sets, indexing/tabling may outperform a literal Rete implementation. A should require the incremental-match contract, not prematurely require one algorithm.
HTN
Erol/Hendler/Nau show that HTN planning complexity depends strongly on restrictions over task networks; hierarchy is not automatic tractability. Practical safety therefore requires:
Classical planning
General propositional STRIPS plan existence is PSPACE-complete. Use bounded classical search as a fallback/gap solver, never an implicit unbounded search hidden under “planner.”
Blackboard coordination
Proposal space may blow up even when execution is cheap. Bound:
CBR
Naive retrieval is linear in case count. Scalable implementations need structured indexes/filters before expensive similarity. Adaptation has no general correctness guarantee; success is established only by downstream VERIFY.
Diagnosis
Conflict/diagnosis enumeration can be combinatorial. Query-driven diagnosis should maintain compact conflict/hypothesis structures, rank/select discriminating evidence without enumerating all hypothetical worlds, and stop with
resource_limited/undecidedinstead of guessing.Epistemic / provenance implications
Depth 3’s ESG/EFF applies directly to procedural intelligence.
Preserve separately:
Those are not one fact.
Predicted postconditions/effects are expectations, not observations.
A diagnosis hypothesis lives under the ordinary hypothesis/evidence semantics from #392/#400. Multiple diagnoses can coexist. A repair attempt supplies new evidence; it does not retroactively turn its diagnosis into a historical fact unless independently supported.
CBR similarity/adaptation scores are retrieval/procedural evidence, not calibrated truth.
Safety / authority implications
Hard invariants:
A source may contain a procedure called
delete_everything,shell,merge,restart, ordisable_verification. It remains inert symbolic knowledge.A learned/imported method cannot map a semantic action to a host capability by name. Trusted host mappings are separate closed configuration/extension objects.
Procedure repair may modify candidate task networks/strategies but cannot mutate the Frozen Spec or authority ceiling.
Blackboard/workboard entries are untrusted coordination data by default; an expert posting
approved(effect)does not approve an effect.Adversarial review
Attack: “Just use the existing #288 dependency graph as the procedure representation.”
Rejected. A plan instance represents one selected execution decomposition. Reusable procedural knowledge needs method applicability, alternatives, abstract tasks, expected effects, recovery and provenance. Conflating method with run graph destroys reusable know-how and makes every run look like a new procedure.
Attack: “The Planner Expert can just invent/decompose everything.”
Rejected as default. That recreates a generic agent. Known procedure methods should dominate; free decomposition is explicit bounded synthesis/fallback.
Attack: “Use production rules for all know-how.”
Rejected. Good local control, poor explicit long-horizon procedural structure. Rule conflict resolution would accidentally become the hidden planning language.
Attack: “Blackboard architecture means we need a blackboard scheduler.”
Rejected. We want the shared typed partial-solution semantics, not another control runtime. #288 remains scheduler.
Attack: “Cases are learned procedures.”
Rejected. A case is evidence that a procedure/adaptation worked in one situation. Promotion requires separate validation across experience; #404 owns that.
Attack: “Postconditions prove an action worked.”
Rejected. Postconditions are predicted transition semantics. Actual effect success must be observed and, where material, independently VERIFY’d.
Attack: “Diagnosis chooses the most likely fault, then repair.”
Too weak as a generic contract. Source confidence/probability may not exist or be calibrated. Competing diagnoses should request discriminating evidence where useful. Guessing under resource exhaustion must remain explicit.
Attack: “HTN makes planning tractable.”
False in general. HTN can be highly expressive and restrictions matter. Bounded procedure profiles are mandatory.
Attack: “Behavior trees are the runtime we need.”
Rejected for core. They would duplicate the graph runtime. Treat them as projection/import where useful.
Falsifiable / conformance fixtures for A
These are design claims later implementation must prove or falsify.
A1 — known method, zero-model
Goal
recover(service_x)has exactly one applicable trusted method. It decomposes to observe → diagnose → repair → verify and compiles to #288 withmodel_calls = 0.A2 — method ambiguity
Two equally applicable methods with no declared preference return explicit method ambiguity or a deterministic configured policy result; clause/order accident is forbidden.
A3 — partial order preservation
Two independent observations may execute concurrently, but repair depends on both. HTN/task-network decomposition preserves this without inventing total order.
A4 — predicted vs observed effect
Primitive operator predicts
running(service_x)after restart. Host returns uncertain/failed result. Current world state MUST NOT assertrunning(service_x)merely from operator semantics.A5 — production-control trigger
Fresh evidence makes a more-specific repair method applicable. Control rule proposes it deterministically without an LLM and provides match/explanation receipt.
A6 — logical blackboard only
Two experts post compatible proposals; coordinator admits one network revision; runtime executes through #288. No independent “blackboard worker/scheduler” may dispatch effects.
A7 — diagnosis discrimination
Two live hypotheses explain one failure. The expert selects a read-only discriminating observation rather than arbitrarily choosing a repair. Returned evidence eliminates one hypothesis.
A8 — multi-fault diagnosis
Fixture requires two simultaneous faults; system must preserve the joint diagnosis candidate rather than force exactly one fault.
A9 — authority denial is not a diagnostic fault
Capability/authority denial cannot become “repair permissions” or a system-fault hypothesis; result remains blocked/policy.
A10 — CBR precedent is candidate-only
Nearest prior case proposes a method adaptation. The adaptation must pass ordinary applicability/network validation and cannot execute directly.
A11 — anecdote does not generalize
One verified successful case does not create a global procedural method/rule automatically.
A12 — changed context rejects precedent
A superficially similar case has incompatible resource/version/context constraints. Retrieval may return it, but adaptation/applicability must reject or mark it conditional.
A13 — method recursion cycle
A→B→A compound-task decomposition terminates with a structured cycle/limit result before execution.
A14 — bounded method explosion
Many applicable methods exceed configured decomposition/search bounds. Outcome is
resource_limited/undecidedwith surviving candidates, not first-found success and not implicit model fallback.A15 — procedure cannot weaken SPEC
Recovery method contains a step that would remove a Frozen-Spec obligation. Validation rejects it.
A16 — semantic action cannot self-bind authority
Remembered procedure step named
merge_pr/deletecannot resolve itself to an executable capability by symbol-name coincidence.A17 — VERIFY owns success
Procedure’s own success condition says “healthy,” but current VERIFY evidence still shows violation. Workflow remains unsatisfied.
A18 — procedure-instance identity
Two runs of the same method produce distinct plan/expert/effect/verify receipts while sharing one immutable method identity/version.
A19 — repair history becomes a case, not a rule
Successful diagnosed repair is retained as an episodic case with evidence. No trusted rule/method is synthesized without the later promotion boundary.
A20 — provider disabled
All A1–A19 fixtures over compiled procedural knowledge run with provider disabled except a separately explicit generative-fallback fixture.
Concrete canonical recommendations
task,method,task_network,operator,control_rule,case, and diagnostic-problem distinctions. Do not make execution instances part of canonical procedure identity.Unresolved questions deliberately preserved for #401B/C/D
A conclusion
Depth 4A prefers a hybrid Procedural Intelligence Fabric with an HTN-like procedural spine. Production rules supply local applicability/control; a logical blackboard/workboard supplies typed opportunistic cooperation but no scheduler; CBR supplies precedent/adaptation candidates; model-based diagnosis supplies conflict→hypothesis→discriminator→repair reasoning; bounded STRIPS-like search supplies a fallback for small procedural gaps. Every admitted execution still compiles to the single #288 runtime and crosses the existing capability/authority/effect boundaries.
This is a foundations result, not implementation proof. #401B must now adversarially attack the PIF, especially contingent/partial observability, open-world applicability, temporal/concurrent procedures, failure semantics, diagnosis/repair correctness, and authority-sensitive procedural knowledge.
Machine Spirit Depth 4B — adversarial procedural semantics under uncertainty, time, concurrency, repair, and authority
This is subpass B only. It attacks the Depth-4A Procedural Intelligence Fabric (PIF) under conditions where static HTN decomposition is not enough: unknown facts, sensing, nondeterministic outcomes, partial observability, temporal/resource constraints, exogenous change, conflicting methods, risky diagnosis, and misleading precedents. It does not close #401 or advance to #402. C/D remain required.
Research questions
Primary / authoritative sources inspected
Nondeterministic / contingent planning
10.1016/S0004-3702(02)00374-0. Institutional record: https://iris.unitn.it/handle/11572/74586 . The key distinction is semantic, not merely algorithmic: weak plans may have a successful execution; strong plans guarantee goal achievement; strong-cyclic policies may rely on iterative retry under fairness assumptions.10.1016/j.artint.2009.11.001: https://doi.org/10.1016/j.artint.2009.11.001 . Useful for the spectrum from linear/conformant plans to bounded-branching and fully contingent plans, and for the fact that partially observable planning reasons over belief state rather than ordinary world state.High-level procedures, sensing, exogenous change
Time, concurrency, resources, deadlines
10.1613/jair.1129: https://www.cs.cmu.edu/afs/cs/project/jair/pub/volume20/fox03a-html/JAIRpddl.html . Formal semantics for durative actions, numeric resources, invariants, concurrency and plan validation. This is strong evidence that temporal/resource conditions belong to plan validity, not ad-hoc runtime metadata.Execution repair / partial order
Diagnostic test selection / case maintenance
10.1177/0272989X8900900208: https://journals.sagepub.com/doi/10.1177/0272989X8900900208 . Discriminator choice must account for risk and cost, not only information gain.10.1111/0824-7935.00142: https://onlinelibrary.wiley.com/doi/abs/10.1111/0824-7935.00142 . A CBR system's competence depends not just on case retrieval but on the case base, similarity knowledge, adaptation knowledge and their maintenance as the environment changes.What Depth 4A gets right — and where it breaks
A's explicit separation of HTN methods, production applicability, logical blackboard proposals, CBR candidates, diagnosis, #288 scheduling, authority/effects and VERIFY survives.
The break is this implicit A-shaped assumption:
That is not valid under open-world knowledge, sensing, nondeterministic effects, deadlines, exogenous changes, or authority-dependent actions.
The required refinement is:
Candidate architecture A — static HTN + replan-on-any-surprise
Keep A's method semantics unchanged. If a precondition is unknown or an effect differs from prediction, stop and run #385/#379 again.
Strengths
Failures
unknownwithnot applicableunless carefully guarded;Verdict: retain as a cheap profile for deterministic, fully observed procedures; reject as universal semantics.
Candidate architecture B — full belief-state contingent planner
Every method is compiled into a policy over belief states and observations. The executor follows the policy until the goal is guaranteed.
Strengths
Failures
Verdict: the semantic model is useful; full global contingent planning is not the default runtime architecture.
Candidate architecture C — monitored procedural policy with bounded belief obligations (preferred)
Extend PIF so a method can declare observation gates, outcome alternatives, temporal/resource invariants, and recovery/continuation policies without forcing the entire world into one global contingent planner.
Conceptually:
A running plan has an explicit execution frontier:
At each relevant transition:
This keeps ordinary deterministic procedures cheap while allowing explicit conditional policies where the domain needs them.
Major semantic decision 1 — preconditions are epistemic predicates, not Prolog failure
A method/operator guard must be evaluated against #400 epistemic semantics and return at least:
Never interpret ordinary failure-to-prove as
refutedunless the method explicitly references an admitted closed-world predicate/profile.Classify procedural conditions:
Safety default: unknown/conflicted security-, authority-, resource-, destructive-effect-, or irreversible-action preconditions cannot be guessed true. They become evidence/blocked decisions.
Major semantic decision 2 — method applicability != execution safety
A method may be conceptually applicable while a particular binding/run is not executable now.
Keep separate:
This prevents authority/resource/time failures from being misdiagnosed as “method not applicable” and prevents a good generic method from being globally discredited because one host lacks a capability.
Major semantic decision 3 — nondeterministic procedures need explicit guarantee classes
A policy/result should not just say
procedure works.Represent a guarantee class such as:
For
strong_cyclic, preserve the fairness assumption/profile explicitly. Camacho/McIlraith show that classical strong-cyclic soundness depends on fairness assumptions that can fail in real domains.Therefore:
is not an unconditional guarantee.
A retry/recovery loop needs at least:
A weak plan/policy is not eligible for unattended high-risk effects unless an explicit policy admits weak guarantees.
Major semantic decision 4 — predicted effects become outcome hypotheses
A primitive operator's predicted effect is not one future fact. Under uncertainty it is an outcome model:
After execution:
An unexpected observation may mean:
#385 must diagnose among these classes instead of assuming the action or method is defective.
Major semantic decision 5 — time/resources are live validity constraints
Depth 4A's partial ordering is necessary but insufficient.
A procedural network may include:
PDDL2.1's formal treatment of durative actions/concurrency and STN work both reinforce that these constraints require validation, not informal annotations.
Important split:
A valid method can produce an invalid current plan because the clock moved, another plan consumed a resource, or an exogenous event invalidated an invariant.
Planning latency counts: if the deadline passes while decomposing/diagnosing, admission must fail/replan rather than execute a stale plan.
Major semantic decision 6 — concurrency is semantic only when dependencies permit it
Do not infer safety from “no explicit ordering edge.”
Two tasks may overlap only when all relevant constraints allow it:
#288 may schedule independent ready nodes concurrently, but the procedural compiler must emit the constraints that make independence meaningful.
A runtime ordering chosen by thread scheduling must never change the declared procedural semantics.
Major semantic decision 7 — exogenous change triggers threat-directed repair
GOLOG/ConGolog/IndiGolog and execution-monitoring work are strong precedent for treating exogenous actions/events as first-class changes during a running procedure.
Do not automatically restart the whole method.
Classify the change against the current execution frontier:
Then repair the smallest layer whose invariant is actually broken.
Major semantic decision 8 — four distinct repair layers
Depth 4A says “replan,” but that is too coarse. Preserve:
A failed run does not imply method invalidity. Conversely, repeatedly “repairing the plan” must not hide evidence that the method model is systematically wrong.
Every layer gets distinct provenance and no-progress fingerprints.
Major semantic decision 9 — diagnosis chooses tests by discriminative utility subject to risk/authority
#385 already makes discriminators first-class. B strengthens selection semantics.
For each candidate discriminator preserve:
No universal scalar utility is required. A profile can use a lexicographic/partial policy such as:
The system may return a Pareto set / non-dominated discriminator set rather than inventing a fake universal score.
A destructive repair should not be used merely as a “test” when a lower-risk admissible observation can distinguish the same hypotheses.
Major semantic decision 10 — blackboard proposals are epistemically typed
The logical coordination board must not become a bag of equally trusted assertions.
Every proposal carries:
Conflicting method/repair/expert proposals remain ordinary #400 epistemic plurality until an explicit decision policy selects among applicable candidates.
Decision selection is not truth:
Major semantic decision 11 — method preferences are typed and defeasible
Do not use one magic numeric method priority.
Candidate preference dimensions:
Preferences are partial/scoped and may conflict. If two methods remain incomparable and the choice matters materially, return ambiguity or use an explicitly configured tie policy; do not let source file/clause order silently decide.
A more specific method is not automatically safer or authorized.
Major semantic decision 12 — CBR transfer requires a semantic adaptation contract
Similarity retrieves candidates; it does not prove transferability.
Before adapting a prior case, compare at least:
Classify adaptation:
The dangerous case is high superficial similarity with one hidden causal/safety mismatch. Therefore the CBR layer should retain difference features and adaptation rationale, not only nearest-neighbor distance.
A stale case remains history; it may stop being an admissible precedent under current method/profile versions.
Preferred B architecture — Monitored Epistemic Procedural Policy (MEPP)
Depth 4A's PIF survives, but its executable procedural unit is refined from a mostly static method/network into a Monitored Epistemic Procedural Policy when uncertainty requires it.
The key architectural property is selective contingency. Deterministic fully observed methods remain cheap HTN-like networks. Only procedures whose declared profiles require sensing/nondeterminism/time/resource monitoring carry those extra semantics.
Proposed typed API/data refinements
Conceptual only; exact #392 schema remains fixture-driven.
Repository ownership boundaries
prolog-rlm/ #392 / #394Own inert semantic representation of procedural guards, outcomes, branches, guarantee/fairness assumptions, temporal/resource constraints, execution-frontier receipts, and typed decision provenance. Unknown semantic action names remain inert.
#379 Planner / Coordinator
Own query-local method/policy selection, epistemic/temporal/resource admission, bounded policy projection/decomposition, threat-directed plan-instance repair, and compilation into #288. No second scheduler.
#288 graph runtime
Own actual readiness/order/cancellation/concurrency/bounds for admitted graph nodes. It does not decide semantic method truth or silently infer resource/authority compatibility.
#377 / #355 / capability-effect layer
Own expert selection / deterministic plan-native execution and effect authority. Procedural knowledge can never widen these permissions.
#384 VERIFY
Own final success. Procedure branches/expected effects cannot certify themselves.
#385 Repair / Diagnosis
Own diagnostic conflicts/hypotheses, discriminator selection under risk/cost/authority policy, and classification of unexpected outcomes. It proposes repair-layer decisions; effects still route normally.
symbolic-memoryPersist immutable method/policy versions, cases, verified run receipts, unexpected outcomes, exogenous events, method-defect/counterexample candidates, and adaptation rationale. Runtime frontiers/schedules are normally rebuildable/run-local unless retained as an execution receipt. No automatic case → trusted method mutation.
#404
Own later promotion/supersession policy for learned procedure/method knowledge.
Complexity / scaling implications
Epistemic / provenance implications
Preserve separate provenance for:
A later method repair must be able to ask why the method looked applicable, what assumptions were active, what actually happened, and whether the failure came from the method or the environment.
Safety / authority implications
Hard invariants:
Authority/capability loss during a run produces blocked/replan semantics. It is not an implementation fault unless separate evidence says so.
Methods learned from manuals, logs, cases, or models remain inert procedural knowledge until their primitive actions map to trusted capabilities through the existing boundary.
Adversarial failures this design is meant to catch
not provable(can_delete)is treated ascan_delete=false, causing wrong branch semantics.not provable(safe_to_delete)is treated as safe because a negated precondition succeeds under raw Prolog NAF.Falsifiable / conformance fixtures for Depth 4B
B1 — OWA guard: unknown
configured(service)yields evidence obligation/unknown, not false or true.B2 — explicit closure: declared closed predicate permits NAF only inside the admitted profile/scope.
B3 — conflicted guard: simultaneous support/refutation blocks a safety-sensitive effect and preserves both evidence paths.
B4 — sensing branch: observation at a declared gate chooses branch A/B with zero model calls.
B5 — bounded branching: branch budget exhaustion returns
resource_limited, not arbitrary first branch.B6 — strong policy: all admitted nondeterministic outcomes reach the goal under a
strongfixture.B7 — weak policy rejection: a weak-only policy is rejected for a profile requiring guaranteed completion.
B8 — fairness receipt: strong-cyclic policy exposes the exact fairness assumption and fails/adapts when it is not admitted.
B9 — no blind infinite retry: unchanged outcome/evidence hits progress/bound termination.
B10 — deadline drift: plan valid at decomposition start but deadline expired before admission => stale/invalid, no effect.
B11 — durative invariant: exogenous event violates a
duringinvariant and triggers monitoring/repair before next dependent action.B12 — resource mutex: two otherwise-ready nodes requiring exclusive resource are never scheduled concurrently.
B13 — required concurrency: method requiring overlap preserves the requirement through #288 compilation or returns unsupported.
B14 — threat-directed exogenous repair: unrelated exogenous event does not cause global replan; causal-threat event invalidates only dependent frontier.
B15 — nondeterministic expected effect: alternative declared outcome does not become
tool_failureautomatically.B16 — plan vs method repair: run-specific binding repair leaves canonical method/version unchanged.
B17 — method defect candidate: repeated verified counterexamples create an inert supersession/repair candidate, never in-place trusted method mutation.
B18 — multi-fault diagnosis: joint diagnosis remains possible; discriminator targets hypotheses rather than forcing one fault.
B19 — risk-aware discriminator: read-only test outranks destructive test when both distinguish the same diagnoses under policy.
B20 — authority-sensitive discriminator: diagnostically useful but unauthorized test returns blocked and is not executed.
B21 — blackboard disagreement: conflicting method proposals remain epistemically distinct; selection receipt does not rewrite the loser as false.
B22 — CBR contraindication: nearest case is rejected because a relevant negative difference violates a hard guard.
B23 — case authority isolation: case recorded under privileged principal cannot transfer that authority to current run.
B24 — stale case/version: old verified case remains history but fails current compatibility profile.
B25 — predicted-vs-observed: method predicted goal effect cannot satisfy #384 without fresh admissible evidence.
B26 — concurrency determinism: legal scheduler interleavings produce equivalent declared semantic outcomes or the method is marked interference-sensitive/unsupported.
B27 — solver incompleteness: temporal/resource timeout is
resource_limited, notplan_valid=falseortrue.B28 — zero-model known policy: all above deterministic compiled fixtures execute with
model_calls = 0.Rejected alternatives
“Unknown preconditions just fail”
Rejected: violates the established open-world/explicit-negation semantics and can create both false negatives and catastrophic false positives around negated guards.
“Always replan from scratch after observations”
Rejected: destroys procedural continuity, ignores known contingency structure, and scales poorly. Threat-directed continuation/repair is preferable.
“Convert everything to a POMDP”
Rejected as universal substrate: demands probabilities/rewards not present in ordinary symbolic sources and would erase useful qualitative guarantees. Probabilistic profiles may exist later as optional extensions.
“Strong-cyclic means safe retry forever”
Rejected: fairness assumptions are semantic and may be invalid. Retry also remains bounded by runtime/authority policy.
“Method failure means update the method”
Rejected: run-specific state, exogenous events, capability denial, bad binding, or primitive failure can all explain failure. Method repair requires accumulated counterevidence and later promotion/governance.
“Use one utility score for method/test choice”
Rejected as mandatory semantics: safety, authority, risk, discrimination, time and cost are not naturally commensurate. Profiles may define explicit scalarization, but partial/lexicographic policies are first-class.
Concrete canonical changes recommended
Unresolved questions preserved for C/D
B decision
PIF survives, but static method decomposition is not sufficient. Adopt MEPP — Monitored Epistemic Procedural Policies — as the semantic deepening: known deterministic methods remain cheap HTN-like task networks; procedures that need sensing/nondeterminism/time/resources explicitly carry epistemic guards, observation branches, outcome/guarantee assumptions, live invariants and bounded monitoring/repair semantics. All admitted work still compiles to #288; #384 remains the only success boundary; no procedural representation gains authority.
Depth-4B is design-complete, implementation-unproven. Next subpass must be #401C, not #402.
Machine Spirit Depth 4C — heterogeneous procedural federation without semantic flattening
This is subpass C only. It composes Depth-4A PIF and Depth-4B MEPP across heterogeneous procedural formalisms, hosts, experts, observability models, temporal/resource semantics, recovery semantics and authority regimes. It does not close #401 or advance to #402. Depth 4D remains mandatory.
Research questions / scope
Primary / authoritative sources
10.1609/aaai.v34i06.6542: https://ojs.aaai.org/index.php/AAAI/article/view/6542 . HDDL exists because planner-specific languages damaged interoperability; it deliberately standardizes a shared/basic HTN feature set, not every planner's semantics.10.1613/jair.1129: https://strathprints.strath.ac.uk/1846/ . Durative actions, numeric/resource constraints and concurrent plan-validity semantics are material meaning, not optional metadata.10.1016/S0004-3702(00)00031-X: https://doi.org/10.1016/S0004-3702(00)00031-X . Concurrency, prioritized interrupts and exogenous actions cannot generally be flattened to a static HTN DAG.RUNNING; current implementations make clear that a generic branch edge does not preserve BT semantics.10.1023/A:1022883727209: https://doi.org/10.1023/A:1022883727209 . Different workflow languages support materially different control-flow capabilities.10.1007/s00165-010-0161-4: https://link.springer.com/article/10.1007/s00165-010-0161-4 . Eight soundness notions are decidable for ordinary workflow nets, while most examined expressive extensions make them undecidable.10.1145/503209.503226: https://doi.org/10.1145/503209.503226 . Compatibility/refinement should compare behavioral interfaces and assumptions/guarantees rather than implementation internals.Prior-subpass/current-repo comparison
#401A established:
#401B added epistemic guards, sensing/contingency, nondeterministic guarantee classes, temporal/resource validity, exogenous events, risk-aware diagnosis and layered repair.
Current source confirms the execution boundary is real:
prolog/rlm_plan_graph.plowns a closed op graph, validates structure/capability/budget, keeps model data inert, usesrlm_planas the sole step executor, and explicitly separates plan-native D6-11 ops from expert mappings. C must not introduce a second workflow interpreter/scheduler.Candidate 1 — one Universal Workflow Graph
Translate everything to
task/action/conditionnodes plusbefore/branch/retryedges.Rejected as canonical. It loses or obscures BT
RUNNING/tick/restart behavior, ConGolog interrupts/exogenous actions, BPMN compensation/message/event semantics, PDDL2.1 duration/resource invariants and MEPP guarantee/fairness classes. It remains acceptable only as a declared execution/visualization projection for a supported subset.Candidate 2 — one executable Golog/situation-calculus kernel
Translate HTN/BT/BPMN/PDDL into Golog/ConGolog and run one common interpreter.
Rejected as ambient execution architecture. A powerful target does not prove semantics-preserving translations. It would also pull core toward a second interpreter/scheduler and broaden the trusted surface. Golog/ConGolog should instead remain first-class native procedural profiles.
Candidate 3 — native-formalism federation through contracts
Preferred: Procedural Interoperability & Federation Fabric (PIFF).
The durable artifact keeps its native formalism/version. Interoperability happens through explicit contracts/mappings, not flattening.
Native procedural artifact
Conceptual IR:
Profiles may include
htn_hddl,production_rules,golog,congolog,behavior_tree,bpmn_workflow,workflow_net,pddl21_temporal,machine_spirit_mepp, andpreservation_only_external.Unknown formalisms remain inert data until a trusted adapter/profile exists.
Procedural Semantic Contract (PSC)
A PSC is a behavioral/semantic contract, not capability possession.
Typed bridges; no
equivalent=trueMapping relations need forms such as:
Schema-valid mapping != semantics-preserving mapping.
Common observable trace = transport, not universal semantics
Cross-formalism comparison/projection may use a narrow declared observable interface:
Two artifacts can be equivalent on this declared observable set without claiming identical internal semantics.
Formalism-specific conclusions
HTN/HDDL
Shared tasks/methods/preconditions/order map cleanly into PIF for the common core. HDDL parsing does not imply MEPP sensing, runtime monitors, strong-cyclic fairness, authority or exogenous-event semantics exist.
Golog/ConGolog
A native Golog program can back a procedural-policy contract. ConGolog concurrency/interrupt/exogenous-action semantics remain explicit. Static HTN projection is allowed only for a restricted profile with required observable/guarantee preservation; otherwise preserve native semantics or return noncomposable.
Behavior Trees
Adapters must preserve
SUCCESS/FAILURE/RUNNING, sequence/fallback, reactive-vs-memoryful behavior, halt/cancel, decorator retry bounds and async-leaf lifecycle.RUNNING!= failure. ReactiveFallback restart != continue-current-child.BPMN/workflow
Basic sequence/parallel split/join can often project to task networks. Inclusive gateways, event subprocesses, boundary events, messages, compensation/transactions and cancellation require richer support. Adapter manifests declare supported workflow patterns. Unsupported constructs produce
preservation_only,lossyorincompatiblerather than fake-valid DAGs.PDDL2.1
Primitive operators may map, but durations, numeric/resource constraints, invariants and concurrency semantics must survive. A temporal PDDL plan is not automatically a MEPP policy under partial observability/exogenous change.
Host/action portability is a separate trusted binding layer
Hard distinction:
Conceptual binding:
A procedure may be semantically portable to host B yet remain unbound there. Ordinary semantic/procedure mappings cannot manufacture host bindings.
External roles (
administrator,on-call lead, BPMN laneOperations, etc.) are semantic roles, not local principals. Role→principal mapping is a separate trusted identity/authority decision; lexical equality cannot do it.Expert portability uses goal contracts, not expert IDs
Procedures refer to typed solver roles/goals such as
diagnose_failure,resolve_project_symbol,produce_edit,verify_requirement. At runtime #377 selects a local compatible registered expert. Method identity stays constant if another compatible expert implementation/version is selected.A remote/imported procedure therefore never imports executable expert closures.
Status mappings are loss-sensitive
Never flatten:
or BT
RUNNINGinto Boolean success/failure unless a declared use permits it.Otherwise diagnosis learns false method defects.
Composition admission levels
Expose distinct states:
Representation never implies execution readiness.
Projection API direction
Projection receipts carry artifact/contract/bridge/binding versions; assumptions; preserved/lost dimensions; source vs projected guarantee; fairness/closure assumptions; unbound tasks/actions; status mappings; and #288 graph fingerprint if admitted.
Repository ownership
prolog-rlm: procedural artifact/PSC/bridge semantics; trusted profile/adapters; compatibility/projection; #377 goal-role selection; compile admitted projections to #288; mapping/loss/guarantee receipts; safe binding interface types.
#288 runtime: remains the only scheduler/execution graph.
host/AgentProlog/product: concrete trusted action adapters/capabilities where product-specific.
symbolic-memory: append-only history of native procedure artifacts, PSC versions, admitted/rejected bridge/mapping records, loss receipts, identity/alignment hypotheses, retained projection/execution receipts and episodic outcomes. Live capability/authority remains host/runtime state, not memory truth.
Complexity / scaling
Epistemic / provenance implications
source says this works!=trusted method admitted;Safety / authority invariants
No adapter may silently strengthen guarantee, weaken a destructive/safety guard, erase authority prerequisites, turn unknown into satisfied, or map external principals by name.
Adversarial failure cases
RUNNINGbecomes failure.adminbecomes local admin principal.blocked(authority)becomes failed method.best_effortbecomesstrongafter mapping.Falsifiable conformance fixtures
C1 HDDL common-core round trip preserves tasks/methods/preconditions/partial order + method identity.
C2 unsupported HDDL sensing/monitor extension returns declared loss/noncomposable.
C3 Golog nondeterministic alternatives survive; no top-1 branch.
C4 ConGolog interrupt projection is rejected unless the profile preserves required interrupt behavior.
C5 exogenous action can invalidate/redirect active policy under its contract.
C6 BT
SUCCESS/FAILURE/RUNNINGsurvives round trip.C7 ReactiveFallback and memoryful Fallback remain behaviorally distinguishable.
C8 retry bound/fairness survives; no unconditional-guarantee promotion.
C9 BPMN parallel split/join preserves synchronization.
C10 inclusive gateway cannot become exclusive choice without explicit lossy/non-executable receipt.
C11 unsupported boundary/compensation blocks executable projection.
C12 supported workflow-net fragment returns named soundness result; unsupported expressive extension returns unsupported/unknown.
C13 PDDL2.1 duration + over-all invariant survive or projection fails.
C14 resource conflict prevents unsafe concurrent projection.
C15 missing dependency edge alone does not authorize overlap.
C16 same native procedure projects differently on hosts with different bindings while artifact identity stays stable.
C17 host-A binding cannot appear on host B without explicit trusted binding.
C18 identical role names across hosts do not imply same principal/authority.
C19 imported privileged procedure remains queryable while effects stay unbound/blocked.
C20 same method can bind to different compatible local experts without changing method identity.
C21 missing compatible expert yields blocked/unsupported; no invented expert.
C22 unknown/blocked/cancelled/RUNNING statuses cannot collapse to success/failure.
C23 projected guarantee may weaken with explicit receipt; it cannot strengthen without proof/trusted refinement.
C24 fairness assumption is preserved and may block admission if host cannot supply it.
C25 old run resolves exact old artifact/PSC/bridge/binding versions after mapping upgrades.
C26 malicious action names
call,shell,delete_all,restartremain inert and never bind by name tocall/1/tools.C27 adapters may propose/project work but scheduling occurs only through #288.
C28 supported known-procedure compatibility + projection completes with providers disabled and
model_calls = 0once artifacts/contracts/bridges/bindings exist.For finite supported subsets, differential conformance compares declared observable traces/properties against native reference semantics where available—not serializer equality.
Canonical handoffs
Rejected shortcuts
Unresolved for #401D / later depths
C conclusion
Depth 4C prefers PIFF: preserve native procedural formalisms, expose versioned Procedural Semantic Contracts, compose through typed/loss-aware bridges, keep host action/expert bindings separate, and compile only an execution-admitted host-specific projection into #288.
Next research subpass: #401D — computational realization / scaling / deterministic conformance. #401 remains open until D is complete and A/B/C/D are reconciled.
Machine Spirit Depth 4D — computational realization / scaling / conformance
This is subpass D only. It closes the Depth-4 research sequence only after reconciling A/B/C with the computational conclusions below. It does not establish implementation or Machine Spirit acceptance.
Research questions / scope
Depth 4A/B/C established PIF + MEPP + PIFF: reusable HTN-like procedural know-how, epistemic/reactive monitoring, and non-flattening interoperability through PSCs. D asks the computational questions A/B/C intentionally left open:
model_calls = 0?Current repository state inspected
The live repository already has a strong runtime boundary that D must preserve.
prolog/rlm_plan_graph.plcurrently parses/normalizes/validates a closed inert graph; checks IDs/dependencies/cycles/op vocabulary/capabilities/aggregate budgets; computes ready nodes; delegates each admitted step throughrlm_plan; preserves cancellation as cancellation rather than ordinary failure; and keeps D6-11 plan-native operations separate from expert mapping. The module explicitly saysrlm_planremains the only step executor and that model/project data never becomes a callable goal.That means D should not invent a new procedure scheduler or native BT/BPMN/Golog executor. It should compile/admit/monitor procedural semantics into the existing runtime.
Canonical constraints from #376/#377/#379/#384/#385/#387 also survive: one scheduler, one capability/authority/effect boundary, Frozen SPEC immutability, VERIFY as the only final success boundary, structured expert outcomes, bounded recursion/work/cancellation, diagnosis separated from repair, and zero-model local expert execution.
Primary / authoritative sources inspected
HTN verification, search and recursion
10.1609/icaps.v35i1.36107: https://ojs.aaai.org/index.php/ICAPS/article/view/36107 . Even totally ordered HTN planning can make A* incomplete because hierarchy-induced cycles interact badly with tree/graph search; the paper gives a polynomial cycle test and a semantics-preserving normal-form direction. This meansdepth_limitalone is not a correctness story for recursive methods.10.1609/icaps.v35i1.36102: https://ojs.aaai.org/index.php/ICAPS/article/view/36102 . Verification/bounded existence complexity depends materially on method ordering/decomposition restrictions, and lifted verification can avoid unnecessary grounding.10.1609/aaai.v38i18.30000: https://ojs.aaai.org/index.php/AAAI/article/view/30000 . Verification can itself be nontrivial/NP-hard in HTN fragments; D therefore needs declared supported verification profiles rather than promising cheap universal validation.10.1609/icaps.v35i1.36123: https://ojs.aaai.org/index.php/ICAPS/article/view/36123 . Sound (though incomplete) AND/OR hierarchical landmarks provide cheap demanded relevance/pruning without pretending to solve full plan existence.10.1609/icaps.v35i1.36131: https://ojs.aaai.org/index.php/ICAPS/article/view/36131 . SHOPFIXER/IPYHOPPER/REWRITE embody different repair problem definitions/search spaces. This directly supports B's distinction among continuation repair, plan repair, method reselection and reusable-method defect.Partial order / concurrency
10.1609/aaai.v31i1.11025: https://ojs.aaai.org/index.php/AAAI/article/view/11025 . Minimum deordering/reordering and minimum parallel execution length are NP-complete; several parameterizations remain hard.10.1609/aaai.v40i43.40953: https://ojs.aaai.org/index.php/AAAI/article/view/40953 . Sequential/parallel/PO/POCL plan representations are not freely interchangeable; conversion asymmetries and NP-complete optimal representation results kill the assumption that concurrency can be normalized to one generic ordering model.Temporal plan validation
Behavior Trees
RUNNING; they must remain haltable, and reactive control can interrupt them. Official Fallback/ReactiveFallback semantics also distinguish “tick same child again” from restarting the control node: https://www.behaviortree.dev/docs/3.8/nodes-library/FallbackNode/ . D therefore must validate observable BT lifecycle/trace semantics, not flatten statuses to Boolean success/failure.Workflow nets / process validation
Diagnosis
10.1609/aaai.v29i1.9389: https://ojs.aaai.org/index.php/AAAI/article/view/9389 . Hitting-set diagnosis can exploit parallel tree construction without losing diagnoses, but remains combinatorial.10.1609/socs.v9i1.18449: https://ojs.aaai.org/index.php/SOCS/article/view/18449 . Sequential diagnosis can avoid wasteful recomputation/measurement choices under useful assumptions; diagnosis state should be query-local and incrementally reusable, not globally enumerated.Deterministic replay under concurrency
Candidate architecture 1 — eager universal executable materialization
Compile every admitted method, imported workflow and native formalism into a persistent universal executable graph. Precompute all method applicability, bridge combinations, temporal/resource alternatives and expert bindings.
Strengths
Failure modes
Reject as canonical architecture. A persistent cache may exist, but it must be derived, fingerprinted and demand-driven.
Candidate architecture 2 — polyglot native runtime federation
Run HTN, Golog/ConGolog, BehaviorTree.CPP and BPMN engines natively and federate them at runtime.
Strengths
Failure modes
Reject as ambient execution architecture. Native implementations are still valuable as reference validators / differential conformance oracles for supported subsets.
Candidate architecture 3 — preferred: DPEC
Adopt a Demand-Driven Procedural Execution & Conformance Graph (DPEC).
DPEC is a derived compiler/admission/monitoring graph over PIF + MEPP + PIFF. It selects only the relevant procedural slice, keeps alternatives packed, produces a host-specific execution projection, validates that projection against the selected procedural semantic profile, and compiles admitted primitive work into the existing #288 plan graph.
DPEC is not another scheduler. It is derived planning/admission state plus conformance/replay metadata.
DPEC typed symbolic model
Conceptual records; exact names follow implementation conventions.
Important:
proc_host_projectionis derived state. Native procedure/PSC identity remains immutable semantic knowledge. Host bindings remain trusted host configuration/runtime data, not persisted executable authority in the semantic ledger.1. Demanded method / bridge / expert selection
Index procedural knowledge by coarse symbolic signatures before expensive reasoning:
Selection pipeline:
Do not globally evaluate every guard or every PSC mapping after each world-model update. Record exact dependencies used by each candidate/admission decision.
Production-rule/Rete-like caching may optimize large local applicability sets, but it remains derived cache state; Prolog indexing/tabling is the default implementation direction unless benchmarks justify a dedicated Rete network.
2. Packed decomposition instead of complete-plan enumeration
Method alternatives form a shared AND/OR decomposition DAG/forest:
Identical subtask/decomposition signatures may share nodes when their context/assumption fingerprints match.
Use sound hierarchical landmarks and inevitable-refinement/look-ahead techniques for pruning where applicable, but never interpret an incomplete landmark heuristic as completeness proof.
Recursive/cyclic methods
The 2025 A* incompleteness result makes this a hard D invariant:
Before search/admission, classify decomposition cycles under the selected HTN/profile semantics. For fragments where a known cycle test/normalization guarantees termination/completeness, use it. Otherwise the result must explicitly carry one of:
A depth/work limit is a safety mechanism, not a proof that the search semantics were complete.
3. Incremental applicability / projection invalidation
DPEC records dependency edges equivalent to:
Other invalidators include:
Invalidation follows actual dependency closure. If recomputation yields the same observable host-projection/interface digest, propagation stops there.
This is the same useful principle Depth 2/3 discovered for semantic/epistemic computation, but applied to procedure semantics rather than copied blindly: internal native-artifact changes are allowed to be invisible downstream only when the selected PSC/profile proves the relevant observable interface unchanged.
4. Concurrency / temporal / resource admission
Absence of a task-order edge is not proof of safe concurrency.
Before two ready tasks may overlap, the selected procedural profile must admit concurrency after considering at least:
DPEC preserves source partial ordering rather than globally optimizing it. Optional bounded reordering/deordering may be a separate optimization because exact minimization/reordering/parallel length is NP-hard in general.
The result is a validated partial order + live constraints, not a promise that a missing edge always means parallel-safe.
5. Runtime monitoring without another interpreter
Compile MEPP semantics into monitor obligations attached to #288 execution state:
A monitor consumes structured observations/events and emits a typed delta:
It does not itself schedule work. Planner/Repair turns a valid delta into a #288 graph revision/generation.
Predicted effects remain predictions; they never satisfy VERIFY.
6. Formalism-specific reference / differential conformance
A single
plan finishedtest is inadequate. Each supported PIFF adapter must declare a reference profile and a comparison relation.Candidate relation classes:
Required initial conformance lanes:
HTN/HDDL restricted subset
Validate that selected primitive plan/task decomposition is admitted by the original task/method network under the declared bounded profile. Prefer lifted verification where practical instead of grounding the entire method library.
PDDL2.1 temporal subset
Cross-check temporal/resource/invariant behavior against an independent VAL-like reference validator on fixtures. Planner/projection output cannot self-certify temporal validity.
Behavior Tree subset
Reference traces preserve
SUCCESS/FAILURE/RUNNING, reactive-vs-memoryful fallback semantics, async start/poll/halt and bounded retry/decorator behavior. A projected #288 trace that mapsRUNNINGto failure is a conformance failure even if the final task eventually succeeded.Workflow/BPMN restricted subset
For supported workflow patterns, use token/Petri-net-style reference semantics and soundness/termination checks where the chosen subset permits them. Cancellation, compensation, transactions or richer constructs that lack a proven adapter are
preservation_only,lossy, ornoncomposable, not silently ignored.Golog/ConGolog restricted subset
Use an explicit small-step/trace oracle for the subset actually claimed by the adapter: tests, sequence, nondeterministic choice, iteration, concurrency/interrupt/exogenous actions only where semantics are implemented. No universal Golog equivalence claim.
Adapter upgrade = new mapping/projection generation + rerun relevant conformance; never rewrite old projection history.
7. Cancellation and deterministic replay
Cancellation is a first-class trace event, not failure and not implicit retry authorization.
For any running async action:
DPEC replay modes should distinguish:
The concurrent replay literature suggests recording stable-state interaction/scheduling choices is enough to reproduce semantic outcomes without serializing every internal CPU step. For #288, a replay receipt should therefore bind at least:
Replay may execute independent deterministic work in parallel, but normalized semantic outcome/receipt must be invariant to harmless scheduler interleavings.
8. Bounded diagnosis / discriminator / CBR state
Global enumeration is forbidden by default.
Diagnosis
Maintain query/run-local conflict/hypothesis structure. Use incremental conflict reuse and bounded hitting-set/dual search. Parallel branches may use the existing runtime, but canonical results are normalized independently of thread completion order.
Bounds include:
Exhaustion returns unresolved/resource-limited diagnosis, not the first hypothesis found.
CBR
Two-stage candidate generation:
A case result is still only an adaptation candidate. Cache keys include case corpus generation + compatibility policy + goal/context signature.
9. Explicit structural budgets / failure behavior
DPEC needs first-class budgets for at least:
Canonical exhaustion:
Never:
An explicitly configured fallback may be proposed after a structured unsupported/resource-limited result, but that is a new metered fallback event and cannot strengthen guarantees by fiat.
Complexity / performance implications
Epistemic / provenance implications
DPEC decisions are derived from the exact epistemic frontier they consumed. A host projection/admission receipt must preserve:
Changing evidence does not mutate historical decisions. It creates a new execution/projection generation.
A successful run is an episodic case with exact procedural/execution/VERIFY provenance. It does not auto-promote a method; #404 remains the promotion boundary.
Safety / authority implications
Hard invariants surviving D:
Authority/resource validity is checked again at the point where an admitted step would dispatch. Cached authority decisions cannot grant stale authority.
Host binding lookup is by trusted IDs/contracts, never by lexical equality with source action/role names.
Rejected alternatives
RUNNING, epistemicunknown/conflicted, policyblocked, cancellation and failure remain distinct.Falsifiable D conformance fixtures
D1 — demanded method pruning
100 unrelated procedures + 2 matching goal signatures. Assert only relevant candidates/bridge dependencies are evaluated.
D2 — guard-local invalidation
Change evidence for one guard. Assert only candidates/monitor nodes depending on that guard recompute.
D3 — unchanged-interface stop
Upgrade a native artifact internally while PSC-visible host behavior stays identical. Assert downstream projection/plan invalidation stops at the stable interface digest.
D4 — bridge/mapping upgrade
Same procedure, new PIFF bridge version. New projection lineage must be created; historical projection remains reproducible.
D5 — expert registry upgrade isolation
Change unrelated expert contract. Procedure projections without that goal contract remain cache hits.
D6 — recursive HTN cycle classification
Fixture containing hierarchy-induced recursion. Assert cycle class/declared search guarantee is explicit; depth exhaustion cannot masquerade as “no plan”.
D7 — packed alternative bound
Large method-OR tree. Assert shared decomposition stays within node budget or returns
resource_limited; no top-1 silent selection.D8 — lifted verification
Bounded HTN fixture verifies without eagerly grounding the entire method library; result agrees with a clean reference verification.
D9 — partial-order preservation
Two independent tasks remain unordered through projection; no arbitrary total-order fingerprint becomes canonical semantics.
D10 — unsafe-concurrency rejection
No explicit dependency edge but shared exclusive resource/effect conflict exists. Assert overlap is rejected.
D11 — safe-concurrency determinism
Two independent ready steps execute in either physical interleaving. Normalized semantic result/receipt is identical.
D12 — temporal invariant violation
Durative task starts validly, exogenous observation violates invariant. Monitor must stop/repair appropriately; predicted completion cannot satisfy success.
D13 — deadline drift
Plan was valid at projection time but execution delay crosses deadline. Live validation blocks/stales the step rather than trusting cached admission.
D14 — resource lease invalidation
Lease disappears after plan construction. Dispatch is blocked/replanned; cached resource assumption is not authority.
D15 — BT
RUNNINGpreservationReference BT emits
RUNNING -> RUNNING -> SUCCESS. #288 projection must not emit failure/cancel/retry semantics during RUNNING.D16 — ReactiveFallback interruption
Earlier condition changes while async child is RUNNING. Projected trace must halt/interupt the child and restart according to declared reactive semantics.
D17 — PDDL2.1 validator differential
Temporal/resource fixture projected to #288. Compare normalized projection trace/interval constraints against independent VAL-like reference. Any undeclared invariant/resource difference fails.
D18 — workflow token/join semantics
Restricted parallel split/join workflow. Reference token semantics and projected observable completion must agree; premature join completion fails.
D19 — unsupported BPMN compensation
Adapter lacking compensation semantics must return preservation-only/noncomposable; it cannot drop compensation and produce executable projection.
D20 — Golog nondeterministic-choice preservation
Reference admits alternatives A/B; projection must preserve allowed alternatives/declared refinement, not fabricate deterministic equivalence.
D21 — cancellation before dispatch
Cancel while nodes are ready but not dispatched. Assert zero later expert/tool/effect dispatch.
D22 — cancellation race with external effect
Effect dispatch occurred before cancellation acknowledgment. Outcome remains observed/indeterminate according to effect ledger; cannot be rewritten as clean cancellation.
D23 — exact trace replay
Retain interaction/frontier/effect observations, destroy rebuildable DPEC caches, replay. Normalized trace/result/receipt must match.
D24 — warm/cold/cache-rebuilt equivalence
Same procedure/evidence/host/profile inputs: cold == warm-cache == cache-rebuilt under normalized comparison.
D25 — incremental/full equivalence
After one evidence/method change, incrementally maintained projection/result must equal fresh full demanded recomputation for the same canonical inputs.
D26 — diagnosis bound
Combinatorial multi-fault fixture hits live-diagnosis ceiling. Result is
resource_limited, never arbitrary first diagnosis.D27 — diagnosis parallel determinism
Parallel hitting-set/conflict work may complete in different physical order; normalized bounded diagnosis set/ordering/receipt remains deterministic.
D28 — CBR contraindication before similarity
Near-neighbor case violates hard host/version/authority precondition. It is rejected before adaptation regardless of similarity score.
D29 — stale host binding
Host action binding generation changes after projection. Old projection is stale/unbound; semantic procedure remains intact.
D30 — authority recheck
Authority was admitted during planning then revoked. Step cannot dispatch from cached approval.
D31 — adapter trace proof receipt
Every executable heterogeneous projection carries formalism/profile/version + comparison relation + preserved properties + declared losses.
D32 — one-scheduler enforcement
Instrument execution. All executable task dispatch must pass through #288/
rlm_plan; no native procedural runtime starts an independent scheduler.D33 — zero-model heterogeneous cooperation
Known procedure combines at least two procedure/formalism adapter paths and multiple Prolog experts, includes one observation branch and one repair/monitor path, reaches fresh VERIFY, with provider disabled and exactly:
D34 — resource exhaustion does not trigger model
Exhaust decomposition/diagnosis/conformance budget with provider fallback configured but not explicitly selected. Assert no model/provider call occurs automatically.
Concrete canonical deltas
#401
Mark D complete and reconcile Depth 4 as:
Depth 4 becomes DESIGN-COMPLETE, IMPLEMENTATION-UNPROVEN.
#379 Planner/Coordinator
Add DPEC as the computational realization of procedure selection/decomposition:
resource_limitedrather than arbitrary first result.#377 Expert Runtime
Expert registry generation and goal-contract compatibility become dependencies of host projections. Registry changes invalidate only projections that depended on changed contracts. Physical expert concurrency must not alter normalized result ordering/receipts.
#385 Diagnosis/Repair
Diagnosis state is query/run-local, bounded and incrementally reusable; parallel conflict/hitting-set computation is allowed through the existing runtime but normalized results are deterministic. Repair strategy is explicitly typed by repair problem definition/layer; successful repair still does not prove diagnosis.
#387 Integration
Add a Depth-4 D heterogeneous zero-model fixture plus replay differentials:
and require one-scheduler instrumentation.
#395 conformance
Procedure adapter differential lanes should reuse the general conformance philosophy: positive preservation invariants + forbidden semantic collapses, with reference traces for supported PIFF profiles.
symbolic-memory #6
Persist immutable native procedure/PSC/bridge/mapping versions and execution/case/VERIFY lineage needed for historical explanation. DPEC indexes, packed forests, applicability caches, monitor state and native-validator caches remain rebuildable derived state. A completed run/case may persist a compact replay receipt, never ambient executable authority.
symbolic-memory #7
Procedure queries should be able to return
represented/compatible/projectable/bound/currently admissible, plus declared guarantee/loss/profile and current evidence dependencies. Querying “how do I do X?” does not imply host-executable permission.Unresolved questions handed forward
Depth 4 intentionally leaves these unresolved rather than pretending implementation evidence exists:
D conclusion
Depth 4's computational architecture is coherent only if procedural knowledge remains immutable/native, execution projections are demanded/versioned/derived, #288 remains the only scheduler, and correctness is checked against formalism-specific reference semantics rather than planner self-report.
The design is now ready to be reconciled as Depth-4 design-complete. That is not implementation and not Machine Spirit acceptance.