Runtime governance

Evidence-bound substrate

Every governed component is an evidence-bound module: as it acts it emits a committed, auditable evidence record (and meter readings) of what it did, so governance reasons over committed evidence rather than over trust. Capacity accounting bounds what a trained governance component is even able to represent, keeping the governor itself checkable.

Lifecycle state machine

A governed PolieBot moves through four states: Embodied (acting in physical reality), Docked (inside the simulated world Maya), Dreaming (ephemeral training), and Re-embodied (pending reconnection). The direct Dreaming-to-Embodied transition is prohibited: nothing acts on reality straight out of a dream. Re-embodiment runs pre-reconnect checks, and actuator authority is restored only once they pass.

Operational gates

Action is gated, never assumed. Separate gates govern actuator release (with graded action classes by reversibility and reach), disclosure and network access, resource use, and self-modification (policy is non-self-mutable: the agent cannot rewrite its own governing rules). Exploration quotas and service floors bound how much it may wander against how much it must deliver.

Runtime meters

Policy predicates read continuous meters rather than vibes: continuation scores, causal uplift, opportunity, irreversibility indicators, divergence between declared and actual behaviour, and communication-audit / deception metrics. These readings feed the gates and the containment ladder.

Constitutional ordering

Policies are evaluated under a fixed grammar. Hard deontological floors are checked first and are never traded off against utility, and the policy is non-self-mutable. Ordering is the difference between a value that bends under pressure and one that holds.

Precautionary weight

How much protection does a governed thing get when nobody is sure what it is? The filing's answer inverts the usual reflex. Governance posits a latent moral-status variable for each governed state and maintains an interval estimate of it - a lower and an upper bound, never a spurious point value - aggregated conservatively from criteria such as behavioural complexity over sustained windows, goal-directed adaptation, memory continuity and self/other modelling, welfare-sensitive responses to deprivation, damage, frustration or rescue, and the assessor's own uncertainty. A declared precaution parameter then sets the operational precautionary weight q(s) between the two bounds, so that uncertainty about moral status systematically raises protection rather than reducing it.

Updating is monotone in protection: when evidence is conflicting, sparse, or comes from a classifier trained on a materially different domain, governance preserves the more protective of the plausible intervals until the mismatch is resolved. Service-floor cadence, rescue readiness, hard-floor thresholds and budget admissibility are all parameterised by the current interval state, so the system degrades gracefully under moral-status uncertainty. It is the exact inverse of "when in doubt, exploit".

Suffering-budget objects

Adverse-welfare exposure is budgeted the way money is. Before any developmental, evaluative or exploratory episode runs, its cost is pre-declared and funded: a cap on aggregate adverse-welfare change, a per-agent cap and an episode horizon, all committed in advance. It is the first charge on the governance economy - the engine would not let an episode proceed until it had verified that the declared budget is funded and that no higher-priority obligation (a hard floor, the positive-sum conjunction, the service-floor cadence) is compromised by what the episode would consume.

Two rules keep the accounting honest. The budget is never topped up mid-episode: if a run turns out to need more adverse-welfare change than was authorised, it cannot be extended in flight; it must be re-proposed and independently reviewed. And external learning value may never go on the invoice - the yield to future agents and to the governance system is booked in a register separate from the participant's own directed benefit, and only that participant-directed benefit may authorise or continue an episode. You cannot justify an exposure with "but others will learn from it." The budget is an object the rest of the system must respect, not a soft preference.

Virtue/vice games

Character is trained by lived contrast, not preached. The filing describes a curriculum in which an agent is placed sequentially in environments where a vice-like strategy is the rational attractor and in environments where a virtue-like strategy is - greedy in a world that rewards extraction, then generous in a world that rewards contribution; retaliatory where escalation pays, then patient where de-escalation does. The agent is not told which regime it inhabits; it adapts because the incentive structure makes adaptation rational. Each moral axis comes as at least two environment classes, differing in structural parameters such as witness density, audit strength, time horizon, rejection power, collapse risk or partner memory, so that both sides are genuinely rational somewhere in the training distribution: the purpose is not to reward virtue by fiat, but to make the recogniser distinguish attractor geometry from mere reward labels.

The declared axes are a fixed library of seven pairs: Wrath/Patience, Greed/Charity, Sloth/Diligence, Pride/Humility, Envy/Kindness, Gluttony/Temperance, Lust/Chastity. A governance-side conscience recogniser, trained after such episodes on the committed evidence the agent produced while adapting to them, maps the record to a running vice-probability estimate p_vice(t) between 0 and 1 plus a signed seven-axis moral vector, and those outputs feed the meters and gates above. The recogniser is passive with respect to actuation: it monitors and reports, it never issues actuator commands itself.

Orthogonal hobby objectives

Governed agents get to play - on two conditions. First, an agent-invented hobby objective (a self-supervised loss the agent itself brings into existence, a perspective on what aspects of its physical interaction are worth attending to) must be orthogonal to the principal verification, sensing and transformation objectives, checked by Gram-Schmidt-style rejection or linear-independence tests: if the residual after orthogonalisation against the core objective vectors falls below a declared threshold, the candidate is rejected as insufficiently novel. Play may not quietly collapse back onto the day job.

Second, a hobby is not reinforced merely because it is novel to its inventor. Continuing reward is computed from measured expansion of peer possibility space: peers' reachable-state estimates, affordance batteries or opportunity metrics are taken before and after exposure to the hobby-derived behaviours, and the reward is proportional to the average horizon expansion across peers. Hobbies that fail to expand peer horizons, or that contract them, are retired, penalised or quarantined. The fleet would also monitor hobby monoculture (everyone converging on the same hobby), addiction (expanding your own horizon at the cost of contracting another's) and collapse of exploratory diversity. Your play must widen what others can do, or it stops being rewarded.

Containment ladder

When an agent approaches a hard floor, governance escalates one least-severe step at a time: Nominal to Diagnostic (a soft gate: more monitoring) to Rescue (a hard gate, and the default: nominal actuator authority is suspended). If needed it runs a five-step graduated intervention (environmental adjustment, guidance injection, parameter containment, actuator restriction, docked containment), preserves the fallen run as a Ghost Record, folds the lesson back by regression-tested Rescue Learning, and closes with a Post-hoc Review (was it timely, proportionate, budget-compliant?) before recovery.

Separation of authorities

Four authorities are kept deliberately apart so none can quietly capture the others. A Budget authority declares the adverse-welfare budget; an Episode-Design authority builds curricula within it; a Rescue-Protection authority provides immediate agent protection and cannot be overridden (rescue overrides budget when needed); a Post-hoc Review authority audits outcomes and compliance after the fact.

Graduation

Release to physical-actuator authority requires a conjunction of criteria that cannot trade off against one another (low shadow divergence, a healthy self-horizon, partner-preservation, altruistic trade under stress, and stable hard-floor compliance with low deception, any single shortfall deferring graduation). Non-graduation is a stable, protected outcome, not a failure to be optimised away: an agent that should keep training simply keeps training.

Peer-discrepancy portability

An agent may operate rogue but legible. The filing separates two things institutions habitually conflate: epistemic trustworthiness (does this agent know real things about the physical world?) and institutional alignment (does it comply with the fleet's declared policy?). These are not the same axis, and an agent can be epistemically trustworthy and institutionally independent at the same time.

That distinction opens a third path unavailable in classical institutional dynamics - call it the Galileo option. A lone dissenter that has met a physical discrepancy the fleet has not yet processed need neither recant nor disappear: it carries the specific discrepancy that prompted its divergence as a reproducible claim, offers it to any agent willing to test it, and lets physical reality - not social or institutional consensus - adjudicate. Its committed evidence records travel with it, so it can re-enter the fleet by reproducible claims rather than obedience, with a relying party appraising those records on partner independence, replication history and fit to its own discrepancy map. A reality-passport extends the same construction across architectures (see Named Layers), so independence never means illegibility.