Why Did the Robot Back Away? A Tamper-Evident Answer in 12 Fields
The robot was crossing the living room toward the kitchen. It had done this 340 times over three weeks. Then it stopped. It dimmed its LED. It pulled back two centimetres and held position for four seconds. Then it continued forward at reduced speed, servo amplitude halved, voice module silent.
An observer might say: "The robot hesitated." A compliance officer asks a harder question: "Why did the robot hesitate? And can you prove your answer?"
Every existing approach to this question involves a post-hoc approximation. SHAP values decompose a model's output into feature contributions -- after the decision. LIME fits a local linear model to the decision boundary -- after the prediction. Attention maps highlight which input tokens influenced the output -- after the generation. These are forensic reconstructions. Useful, illuminating, but fundamentally retrospective. They explain what the model probably considered. They do not record what the system actually did.
CCF does something different. At the moment of every salient behavioral event -- every phase transition, every routine execution or abort, every bridge creation or decay, every privacy entry or exit, every conflict resolution, every significant envelope change -- the reflexive unit emits a structured causation packet. This packet is not a summary. It is not an interpretation. It is the actual causal chain, captured in 12 fields, at runtime, before the next tick begins.
The mechanism is described in Claims AL through AO of US Provisional 64/039,655, sections [E7-0004] through [E7-0006].
The 12 Fields
A causation packet is a fixed-schema data structure. Every field is populated at the moment of the behavioral event. No field is computed after the fact. No field requires a separate model to estimate. The fields are:
1. Event identifier and timestamp. What happened, and exactly when. Event types include: PHASE_TRANSITION, ROUTINE_EXECUTION, ROUTINE_ABORT, BRIDGE_CREATION, BRIDGE_DECAY, BRIDGE_EXPIRY, PRIVACY_ENTRY, PRIVACY_EXIT, CONFLICT_RESOLUTION, ENVELOPE_CHANGE. The timestamp is monotonic -- it cannot go backward, and it is tied to the system's tick counter, not to wall-clock time.
2. Active context key and quantised sensor signature. The composite context key that was active at the moment of the event. The sensor signature is the quantised representation of all sensor inputs that contributed to that key: ambient light band, sound intensity band, proximity category, motion state, posture classification, time-of-day period. This field tells you WHERE the robot was, sensorially, at the moment of action.
3. Instantaneous coherence (C_inst) and tension. The reflexive pathway's real-time assessment of environmental stability and stress. C_inst is high when sensors report a stable, consistent environment. Tension is high when sensor readings are volatile or anomalous. These are the two axes that determine the robot's social phase. The gating equation:
C_eff = min(C_inst, C_ctx)
The effective coherence is always the minimum of instantaneous stability and accumulated context trust. You cannot have high effective coherence in an unstable environment, no matter how familiar the context.
4. Accumulated coherence (C_ctx), decay floor, and interaction count. The long-term trust state for this context key. C_ctx represents the accumulated familiarity -- how many positive interactions the robot has had in this context. The decay floor is the minimum value C_ctx can reach through inactivity:
floor = min(0.7, count * 0.005)
The interaction count is the raw number of trust-positive interactions. Together, these three values tell you the DEPTH of the relationship between the robot and this specific context.
5. Donor contexts and donor weights after mixing. When the Sinkhorn-Knopp projector redistributes trust across contexts (Claims 19-23), some contexts donate coherence to others. This field records which contexts donated, and how much, at the last mixing step. If the robot's behaviour in the kitchen was influenced by spillover from the living room, this field shows the exact transfer. For the mathematical foundation of the doubly stochastic projection, see Sinkhorn-Knopp for Trust.
6. Sponsor-bridge identifiers and bridge mass. If a sponsor bridge is active for this context -- meaning a trusted entity has introduced the robot to a less-familiar entity -- this field records the bridge sponsor, the bridge target, and the current bridge mass. The bridge formula:
b_0 = min(b_max, alpha * q_event * C_S * (1 - C_T))
Where b_max defaults to 0.30, alpha to 0.50, C_S is the sponsor's coherence, C_T is the target's coherence, and q_event is the quality of the introduction event. The bridge mass decays at 10% per interval without sponsor presence. This field tells you whether the robot's behaviour was scaffolded by a social introduction.
7. Suppression-map identifiers and factors. If any behavioural outputs were suppressed -- motor amplitude reduced, voice complexity limited, LED brightness capped -- this field records which suppression rules were active and their suppression factors. A suppression factor of 0.5 means the output was halved relative to what the coherence level would otherwise permit.
8. Compiled-routine identifier, trigger match, and distribution-shift score. If the event involved a compiled routine (a learned behavioural sequence, like a greeting or a navigation pattern), this field records which routine was considered, whether its trigger conditions matched the current context, and the distribution-shift score that measures how much the current context has drifted from the conditions under which the routine was originally compiled.
9. Reflexive-deliberative conflict state and resolution source. This is the field that answers "was the robot uncertain?" The conflict state records whether the reflexive and deliberative pathways agreed or disagreed. If they disagreed, the resolution source tells you which pathway won and why. For the full mechanism of observable hesitation during pathway conflict, see When the Robot Hesitates.
10. Output envelope values by modality. The actual behavioural outputs at the moment of the event: motor amplitude (0.0 to 1.0), LED brightness (0.0 to 1.0), audio volume (0.0 to 1.0), verbal complexity (0.0 to 1.0). These are the values that the human observer sees. They are the final downstream consequence of all the preceding fields.
11. Lineage identifiers from recent merge/split. If the robot's context map has recently merged two context keys (because they converged in sensor similarity) or split one key into two (because a previously uniform context diverged), this field records the parent-child lineage. Context merges and splits are documented in the 8-Component Identity Fingerprint.
12. Privacy flag. Whether privacy mode was active at the moment of the event. If true, all sensor-derived content in this packet is null by construction. The structural guarantee: the data structure has no content field during privacy events. For the mechanism of null-content trust events during privacy mode, see The Privacy Paradox.
The Worked Example: Robot Hesitates Entering a Room
Here is the exact causation packet from the patent specification (Example 5, [E7-0006]).
The scenario: the robot approaches a room it has not visited often. A family member is inside. The robot hesitates at the threshold, then enters slowly.
event: PHASE_TRANSITION
timestamp: tick_14832
context_key: "dim:moderate:approaching:stationary:upright:evening"
C_inst: 0.61
C_ctx: 0.14
floor: 0.04
interaction_count: 8
C_eff: min(0.61, 0.14) = 0.14
donor_mixing: [kitchen: 0.02, living_room: 0.01]
sponsor_bridge: {sponsor: family_member, mass: 0.24, status: ACTIVE}
bridge_adjusted_C_eff: 0.212
suppression: none
compiled_routine: {id: greeting_01, trigger: partial_match, drift: 0.31}
conflict: {reflexive: Phase_I, deliberative: compiled_greeting, resolution: reflexive_priority}
output_envelope: {motor: 0.21, LED: 0.25, audio: 0.18, verbal: 0.15}
lineage: none
privacy: false
Every number in this packet was computed during the behavioural event, not reconstructed afterward. Let us walk through what it tells us.
Why did the robot hesitate? C_ctx is 0.14. This is the accumulated context trust for this room. Eight prior interactions. Very low familiarity. Even though C_inst is 0.61 -- the environment is moderately stable -- the minimum gate enforces:
C_eff = min(0.61, 0.14) = 0.14
The robot cannot behave as if it trusts this room more than 0.14, regardless of environmental stability. The earned familiarity is the limiting factor. For why the minimum gate is mathematically necessary, see The Forced Convergence Theorem.
Why not more hesitation? Because the sponsor bridge is active. A family member with high coherence (implied by the bridge mass of 0.24) is present. The bridge elevates the effective coherence:
bridge_adjusted_C_eff = 0.14 + 0.24 * (1 - 0.14) = 0.14 + 0.206 = 0.346
Wait -- the packet says 0.212, not 0.346. This is because bridge application is bounded: the bridge can elevate C_eff by at most 50% of the bridge mass itself. So:
bridge_adjusted_C_eff = C_eff + min(bridge_mass * 0.5, bridge_mass * (1 - C_eff))
= 0.14 + min(0.12, 0.206)
= 0.14 + 0.072
= 0.212
The bridge helps. It does not eliminate the unfamiliarity. The robot is warmer than it would be without the bridge, but still constrained by the low accumulated trust.
What was the internal conflict? The reflexive pathway assessed this as Phase I (ShyObserver) -- low coherence, the robot should be reserved. The deliberative pathway identified a compiled greeting routine that partially matched the context (a person is present, the robot has a greeting behaviour). The two disagreed about what to do. Resolution: reflexive priority. In low-coherence contexts, the reflexive pathway wins. The greeting routine was NOT executed. The robot stayed reserved.
What did the human see? Motor amplitude 0.21 -- barely moving. LED brightness 0.25 -- dim. Audio 0.18 -- quiet. Verbal 0.15 -- minimal speech, if any. The robot entered the room slowly, with muted expression. To the observer: shy, cautious, uncertain. To the causation packet: precisely calibrated output proportional to a bridge-adjusted effective coherence of 0.212.
Three Questions the Packet Answers
Any post-incident investigation needs to answer three questions about a surprising behaviour:
1. Why this behaviour? The output envelope is determined by effective coherence and social phase. C_eff was 0.14 (bridge-adjusted to 0.212). Phase I. The envelope is constrained to the Phase I range. The robot's behaviour was mathematically correct for its trust state.
2. Why not more? C_ctx is the bottleneck. Only 8 interactions in this context. No amount of environmental stability can compensate for insufficient familiarity. The minimum gate ensures this structurally -- it is not a policy choice, it is a geometric property of the architecture. For how the spectral norm of the trust transfer matrix guarantees this bound, see Sinkhorn-Knopp Convergence Bound.
3. What changed? The robot was in the kitchen (a familiar context) and moved to this room (an unfamiliar context). The context key changed. The accumulator changed. The coherence dropped. The phase transitioned. The bridge activated because the sponsor was present in the new context. All of this is in the packet. Nothing is inferred.
Why This Is Not SHAP, LIME, or Attention
Post-hoc explainability methods share a structural limitation: they approximate a decision that has already been made. SHAP decomposes a model's output into additive feature contributions. LIME fits a local linear model around the prediction. Attention maps show which inputs the model weighted most heavily. All three are model-agnostic -- they can be applied to any black-box predictor. And all three are approximations. They explain what the model probably considered. They do not capture the actual mechanism.
The CCF causation packet is not model-agnostic. It is architecture-specific. It captures the ACTUAL values that determined the ACTUAL output at the ACTUAL moment of action. There is no approximation, no local linearisation, no feature contribution estimation. The 12 fields ARE the decision mechanism. They are the numbers that flowed through the computation graph and produced the motor commands.
This specificity is a feature, not a limitation. A model-agnostic explanation works on any model but explains none of them precisely. An architecture-specific causation trail works only on CCF but explains it exactly.
The Tamper-Evident Chain
Causation packets are not stored in isolation. Each packet includes a cryptographic hash of the previous packet. The chain is append-only. To modify a historical packet, you would need to recompute every subsequent hash -- the same structural guarantee as a blockchain ledger, applied to behavioral history rather than financial transactions.
Additionally, each packet references the software version, the quantisation tables active at the time of computation, and the compiled-routine hashes that were loaded. A compliance auditor can verify not only what the robot did, but which exact version of the code produced that behaviour. If a routine was updated between two events, the hash changes and the audit trail records the transition.
This matters in regulated environments. In eldercare, a family member asks: "Why did the robot ignore my father's call at 3am?" The causation trail shows: at 3:02am, the robot was in privacy mode (field 12: true). The output envelope was reduced to privacy-mode minimums. The event type was PRIVACY_ENTRY at 2:47am, triggered by the scheduled privacy window. No audio was processed, no content was stored, and the trust increment from the null-content privacy event is recorded. The answer is specific, verifiable, and tamper-evident. For how privacy mode interacts with the audit trail, see Explainable But Private.
The Hospital Scenario
A companion robot in a rehabilitation ward changes its behaviour during a patient's physical therapy session. The robot was assisting with encouragement -- verbal prompts, LED colour cycling, gentle servo movements. Mid-session, it reduces all outputs by 40%. The patient's therapist reports the change.
The causation packet for that moment:
event: ENVELOPE_CHANGE
C_inst: 0.38 (dropped from 0.72)
C_ctx: 0.56
C_eff: min(0.38, 0.56) = 0.38
tension: elevated (patient stress indicators via sound amplitude)
conflict: {reflexive: Phase_III, deliberative: continue_therapy, resolution: reflexive}
output_envelope: {motor: 0.38, LED: 0.40, audio: 0.35, verbal: 0.30}
The answer: C_inst dropped because the patient's voice amplitude increased (indicating stress or pain). The reflexive pathway detected environmental instability and downshifted to Phase III (ProtectiveGuardian). The deliberative pathway wanted to continue the therapy routine but was overridden by reflexive priority in a rising-tension context. The robot reduced its outputs proportionally.
The therapist can now decide: was the patient actually in distress? If yes, the robot's response was appropriate -- it backed off when the environment became unstable. If no, the sensitivity threshold can be adjusted for future sessions. Either way, the causation is specific and actionable.
What This Means for Deployment
The causation packet solves a specific commercial problem: liability. When an autonomous system acts in a way that produces a negative outcome, the question is always "why did it do that?" Post-hoc explanations are legally fragile because they are reconstructions. The opposing expert can always argue that the reconstruction is inaccurate, that the approximation missed a relevant factor, that the local linear model is not faithful to the actual decision boundary.
The causation packet is not a reconstruction. It is the decision itself, recorded at the moment of action, in a tamper-evident chain. The 12 fields are the complete causal mechanism. There is nothing else. The robot did not consider factors outside these 12 fields because the architecture has no other inputs. The explanation is exhaustive by construction.
This is the difference between "we believe the model considered these factors" and "these are the 12 numbers that produced the motor command, recorded at the moment it was issued, in a chain that cannot be retroactively modified."
The full implementation is available in ccf-core on crates.io. For the trust accumulation dynamics referenced in field 4, see The Trust Farming Impossibility Result. For the Sinkhorn-Knopp mixing referenced in field 5, see Sinkhorn-Knopp for Trust. For the sponsor bridge mechanism in field 6, see A Child Introduces a New Caregiver.
FAQ
How large is a single causation packet in bytes?
A causation packet is a fixed-schema structure. Most fields are scalars (f32, u64) or small arrays (donor contexts are bounded at 8, suppression factors at 4). The privacy flag is a single boolean. The total is approximately 256-512 bytes per packet, depending on bridge and lineage field occupancy. At a typical event rate of 1-5 salient events per minute, the storage requirement is roughly 1-3 KB per minute, or 1-2 MB per day of continuous operation. This fits easily on embedded flash storage.
Can causation packets be queried in real time?
Yes. The packets are written to a circular buffer in memory and flushed to persistent storage periodically. A dashboard or monitoring system can subscribe to the packet stream and display causation data in real time. The ccf-core on crates.io implementation exposes the causation fields through the CCF_SEG serialisation layer, which supports JSON and binary formats. For fleet-level causation analysis, see Fleet Analytics Dashboard.
What happens if the robot has multiple salient events in the same tick?
Each event generates its own packet. The hash chain links them in order of emission within the tick. A phase transition and a bridge decay in the same tick produce two packets, each with the same timestamp but different event identifiers and different hashes. The ordering is deterministic: event types have a fixed priority order, and packets are emitted in that order.
Does the causation packet capture intent?
No. Intent implies a goal or desire. The causation packet captures mechanism: the values that produced the output. The robot has no goals. It has coherence levels, tension levels, phase boundaries, and envelope constraints. The packet records these. Whether an observer interprets the resulting behaviour as "intending to be cautious" is a human attribution, not a system property.
How does the causation trail interact with GDPR or similar data protection regulations?
The causation packet does not contain personally identifiable information by default. Context keys are quantised sensor composites, not identity records. The privacy flag ensures that packets emitted during privacy mode contain no sensor content. However, in contexts where a specific person is identifiable by their sensor signature (e.g., the only person who visits at 3am), the context key could be considered pseudonymous data. Deployment-specific data protection assessments should evaluate whether context keys constitute personal data under the applicable regulation.
Patent pending. US Provisional 64/039,655.
-- Colm Byrne, Founder -- Flout Labs, Galway, Ireland