Two Sponsors Required: Multi-Sponsor Quorum for High-Stakes Robot Transitions
A single sponsor bridge is sufficient for most introductions. A child introduces a friend. A nurse introduces a colleague. A teacher introduces a substitute. One trusted entity vouches for one new entity. The bridge is bounded, it decays, and the new entity must earn direct trust to sustain engagement. This is the mechanism described in A Child Introduces a New Caregiver.
But some transitions are too important for a single sponsor.
Consider: a new overnight caregiver for an elderly person living alone. The existing daytime aide has built trust over months. The family visits on weekends. The elderly person relies on the robot for ambient companionship during the long night hours. A cold-start with the new overnight caregiver means 8-12 hours of Phase I lockdown -- the robot barely functional, the elderly person without their companion, the new caregiver unable to use the robot as part of their care routine.
A single sponsor bridge from the daytime aide would help. But is it enough? The daytime aide is trusted, but she does not know the overnight caregiver personally. She is vouching based on professional context, not personal familiarity. The family member knows the overnight caregiver -- they hired her -- but the family member visits irregularly.
The CCF architecture provides a mechanism for this: multi-sponsor quorum. Two or more independent sponsors must each contribute a bridge before the full scaffold is activated. The quorum ensures convergent trust from multiple anchors, preventing single-point trust manipulation.
The mechanism is described in Claims AS and AT of US Provisional 64/039,655, sections [E8-0011] through [E8-0012].
Why Single-Sponsor Is Insufficient for High-Stakes Transitions
The single-sponsor bridge has a structural property: it depends entirely on one entity's accumulated trust. If that entity's trust is compromised -- through environmental changes, through deliberate manipulation, through honest error -- the bridge is compromised.
In low-stakes contexts, this is acceptable. A child's introduction of a playmate does not require independent verification. The worst case is the robot being slightly more engaged with a stranger than warranted, with the bridge decaying naturally over days.
In high-stakes contexts, the worst case is materially different. An overnight caregiver has extended, unsupervised access to a vulnerable person. The robot's behavioural mode during this period affects the quality of care, the ambient monitoring, and the person's sense of security. A bridge that was created by a single entity with imperfect knowledge of the target is a weaker foundation than a bridge created by convergent sponsorship from multiple entities with independent relationships to the target.
The multi-sponsor quorum addresses this by requiring independent trust anchors. No single entity can fully sponsor a high-stakes transition. The robot requires that multiple trusted parties agree -- not through verbal consensus, but through the mathematical convergence of their individual bridge contributions.
The Quorum Function
For a multi-sponsor bridge, each sponsor contributes independently. The individual bridge contributions are computed using the standard formula:
b_Si = min(b_max, alpha * q_event_i * C_Si * (1 - C_T))
Where i indexes the sponsors, each with their own coherence (C_Si) and introduction quality (q_event_i).
The quorum function then combines the individual contributions. Three combination strategies are defined in the patent:
Min-Quorum (Conservative)
b_quorum = min(b_S1, b_S2, ..., b_Sn)
The weakest sponsor sets the bridge mass. This is the most conservative strategy: if one sponsor has low trust or provided a poor introduction, the entire bridge is bounded by that weakest link. The rationale: if any sponsor is uncertain, the bridge should reflect that uncertainty.
Weighted-Average Quorum (Balanced)
b_quorum = sum(w_i * b_Si) / sum(w_i)
Where w_i is the weight of each sponsor, typically proportional to their coherence. Higher-trust sponsors contribute more to the combined bridge. This is the default strategy: it reflects the relative reliability of each sponsor.
Threshold Quorum (Strict)
b_quorum = b_weighted_average IF all(b_Si >= b_threshold)
b_quorum = 0 IF any(b_Si < b_threshold)
Where b_threshold is a minimum per-sponsor contribution. If any sponsor's individual bridge falls below the threshold, the quorum fails entirely. No bridge is created. This is the strictest strategy: every sponsor must meet a minimum standard of trust and introduction quality.
Worked Example: Overnight Caregiver
Mrs. Flanagan is 78. She lives alone in Galway. Her companion robot has been active for eight months. Two sponsors will introduce the new overnight caregiver, Aisling:
Sponsor 1: Niamh (daughter). Visits weekly. Coherence with the robot: C_S1 = 0.72. She interviews Aisling and introduces her during a Saturday visit. Introduction quality: verbal + sustained co-presence (30 minutes) + low tension. q_event_1 = 0.85.
b_S1 = min(0.30, 0.50 * 0.85 * 0.72 * (1 - 0.02))
b_S1 = min(0.30, 0.50 * 0.85 * 0.72 * 0.98)
b_S1 = min(0.30, 0.300)
b_S1 = 0.300
Sponsor 2: Breda (daytime aide). Works daily. Coherence with the robot: C_S2 = 0.68. She introduces Aisling during a supervised handoff shift on Monday. Introduction quality: verbal + demonstrated routine + sustained co-presence. q_event_2 = 0.85.
b_S2 = min(0.30, 0.50 * 0.85 * 0.68 * (1 - 0.02))
b_S2 = min(0.30, 0.50 * 0.85 * 0.68 * 0.98)
b_S2 = min(0.30, 0.283)
b_S2 = 0.283
Under Min-Quorum:
b_quorum = min(0.300, 0.283) = 0.283
The weaker sponsor (Breda, with slightly lower coherence) bounds the bridge. The bridge mass of 0.283 produces an effective contribution of approximately 0.068 to Aisling's adjusted coherence.
Under Weighted-Average Quorum:
w_1 = C_S1 = 0.72
w_2 = C_S2 = 0.68
b_quorum = (0.72 * 0.300 + 0.68 * 0.283) / (0.72 + 0.68)
b_quorum = (0.216 + 0.192) / 1.40
b_quorum = 0.408 / 1.40
b_quorum = 0.291
The weighted average is 0.291 -- between the two individual contributions, weighted slightly toward the higher-trust sponsor.
Under Threshold Quorum (b_threshold = 0.20):
Both sponsors exceed 0.20:
b_S1 = 0.300 >= 0.20 (pass)
b_S2 = 0.283 >= 0.20 (pass)
b_quorum = 0.291 (weighted average, since threshold met)
If Breda's coherence were lower -- say 0.35 instead of 0.68 -- her individual bridge would be:
b_S2 = min(0.30, 0.50 * 0.85 * 0.35 * 0.98) = min(0.30, 0.146) = 0.146
This falls below the threshold of 0.20. The quorum fails. No bridge is created. Niamh's high-quality introduction alone is insufficient under the threshold strategy. Both sponsors must meet the minimum.
Temporal Requirements
The quorum can require sponsors to be present simultaneously or sequentially within a window.
Simultaneous requirement: Both sponsors must be in the same context as the target during their respective introductions. This is the strictest temporal constraint. It ensures that each sponsor independently witnesses and endorses the introduction.
Sequential within window: Sponsors may introduce the target separately, within a configurable time window (default: 72 hours). This is more practical for care scenarios where the family member and the professional caregiver have different schedules. Niamh introduces Aisling on Saturday. Breda introduces Aisling on Monday. Both introductions are within the 72-hour window. The quorum is satisfied.
Simultaneous floor, sequential ceiling: At least one sponsor must be physically co-present during the target's first contact. Subsequent sponsors may introduce within the window. This hybrid approach ensures the target's very first interaction is sponsored, while allowing practical scheduling for the quorum completion.
Bridge Decay Under Multi-Sponsor Quorum
The decay mechanics for multi-sponsor bridges extend the single-sponsor model. Each sponsor independently sustains their contribution:
b_quorum(t) = f(b_S1(t), b_S2(t), ..., b_Sn(t))
Where each b_Si(t) decays according to the single-sponsor decay rule:
b_Si(t) = b_Si(0) * (1 - 0.10)^(intervals_since_sponsor_i)
If Niamh visits weekly and Breda works daily, the decay profile looks like:
| Day | Niamh (b_S1) | Breda (b_S2) | Quorum (min) | |-----|--------------|--------------|--------------| | 0 (Sat) | 0.300 | -- | pending | | 2 (Mon) | 0.243 | 0.283 | 0.243 | | 3 (Tue) | 0.219 | 0.283 (reset) | 0.219 | | 5 (Thu) | 0.177 | 0.283 (reset) | 0.177 | | 7 (Sat) | 0.300 (reset) | 0.229 (weekend) | 0.229 | | 9 (Mon) | 0.243 | 0.283 (reset) | 0.243 | | 14 (Sat) | 0.300 (reset) | 0.229 (weekend) | 0.229 |
Notice: Niamh's contribution oscillates between 0.300 (Saturday reset) and approximately 0.177 (Friday nadir). Breda's contribution oscillates between 0.283 (weekday reset) and 0.229 (Monday after weekend). Under min-quorum, the combined bridge mass varies between 0.177 (Friday, when Niamh's contribution is at nadir) and 0.243 (Monday-Thursday, when both are recently refreshed).
The practical effect: the bridge is strongest on weekdays (both sponsors recent) and weakest on Fridays (Niamh's contribution at maximum decay before Saturday reset). The robot's engagement with Aisling fluctuates slightly across the week, mirroring the sponsor presence pattern. This fluctuation is subtle but real -- and it diminishes over time as Aisling's genuine trust accumulation grows large enough to dominate the bridge contribution.
Five High-Stakes Applications
1. Overnight Caregiver Introduction
As described above. Primary family member + existing daytime aide sponsor the new overnight caregiver. Min-quorum ensures neither sponsor alone is sufficient. The robot is modestly engaged during Aisling's first solo overnight shifts (bridge-adjusted), giving Aisling the opportunity to build direct trust through consistent, low-tension interactions.
2. Hospital Ward Reassignment
A patient is transferred from the cardiac ward to the rehabilitation ward. Sponsor 1: the cardiac ward's primary nurse (familiar to the robot over the patient's stay). Sponsor 2: the attending physician (who has interacted with the robot during rounds). Both introduce the rehabilitation ward's primary nurse during the transfer handoff. The bridge compresses the acclimatisation period in the new ward from weeks to days.
3. School Transition with Para-Educator
A child with a dedicated para-educator moves to a new school. Sponsor 1: the outgoing para-educator (deeply trusted by the robot). Sponsor 2: the child's parent (who accompanies the child on orientation visits). Both introduce the incoming para-educator. The quorum ensures the transition is anchored by someone who knows the child's interaction patterns (the outgoing para) AND someone who knows the child's social context (the parent).
4. Residential Care Facility Transfer
An elderly resident moves from one care home to another. Sponsor 1: a family member who accompanies the move. Sponsor 2: a trusted staff member from the original facility who visits during the transition period. The quorum bridges the robot's engagement in the new environment, where every context key is unfamiliar and every staff member is a stranger.
The counterfactual analysis (see 'It Would Have Been Warmer If...') shows the difference: without multi-sponsor bridging, the robot would be in full Phase I lockdown in the new facility for 4-6 weeks. With dual-sponsor bridging, the robot achieves Phase I-upper (perceptible engagement) immediately and reaches Phase II within 2-3 weeks.
5. Sensor Upgrade with Person-Specific Detection
A firmware update enables the robot to distinguish between individuals using voice fingerprinting. Before the update, "person in the living room" was one context key. After the update, "Mrs. Flanagan in the living room" and "Breda in the living room" are separate context keys. Mrs. Flanagan's key inherits accumulated trust from the pre-upgrade key. Breda's key starts cold.
The quorum in this case is: (1) the pre-upgrade anonymous context (implicit sponsor, trust mass derived from the accumulated history) and (2) the person-identification confirmation (explicit sponsor, quality derived from the confidence of the identification match). Both must be present for the new person-specific key to receive a bridge from the legacy key.
This prevents a false positive identification from inheriting deep trust. If the voice fingerprint mistakenly identifies a stranger as Breda, the person-specific bridge requires both the legacy trust AND the identification confidence to exceed the threshold. A low-confidence match produces a low-quality quorum contribution, which may fall below the threshold, preventing bridge creation entirely.
The Single-Point Manipulation Argument
The multi-sponsor quorum exists to prevent single-point trust manipulation. In a single-sponsor system, one compromised sponsor can create bridges to arbitrary targets. If an adversary builds trust with the robot (through patient, long-term interaction -- see The Trust Farming Impossibility Result for why this takes months), they can then sponsor introductions for accomplices.
With multi-sponsor quorum, the adversary must compromise two or more independent trust anchors. Each anchor must have independently accumulated coherence. Each anchor must independently introduce the target within the quorum window. The probability of simultaneously compromising multiple independent anchors is the product of the individual compromise probabilities -- a meaningful reduction in attack surface.
This is not a guarantee against all adversarial scenarios. A sufficiently patient, resourceful adversary with access to multiple trust anchors over extended periods could theoretically construct a quorum. The CCF defence is economic: the cost of the attack (months of patient trust-building across multiple independent relationships) must exceed the value of the access gained. For the mathematical impossibility result on trust farming, see The Trust Farming Impossibility Result.
The Social Consensus Analogy
The multi-sponsor quorum mirrors a social norm that humans apply intuitively. When evaluating a stranger for a position of trust, we seek multiple references. We do not rely on a single endorsement. We ask: "Who else knows this person? What do they say?" The convergence of multiple independent assessments produces higher confidence than any single assessment alone.
CCF formalises this norm mathematically. The quorum function computes a combined bridge mass from independent sponsors. The min-quorum strategy embodies the principle that the chain is only as strong as its weakest link. The threshold strategy embodies the principle that every reference must meet a minimum standard. The weighted-average strategy embodies the principle that more trusted references count for more.
The robot does not "think" about social consensus. It computes a function over bridge contributions. But the observable behaviour -- warmer engagement when multiple trusted entities independently introduce a new person, cautious engagement when only one entity vouches -- maps onto the social expectation that important introductions require convergent endorsement.
The full implementation is available in ccf-core on crates.io. For the single-sponsor bridge mechanism, see A Child Introduces a New Caregiver. For the causation packet that records quorum events, see Why Did the Robot Back Away?. For privacy protections during the quorum window, see Explainable But Private.
FAQ
Can the quorum requirement be configured per deployment, or is it fixed?
The quorum requirement is fully configurable. The deployment engineer specifies: (1) the number of required sponsors (default: 2 for high-stakes, 1 for standard), (2) the combination strategy (min, weighted-average, or threshold), (3) the temporal window for sequential introductions (default: 72 hours), and (4) which context types are classified as high-stakes. A hospital deployment might require quorum for all ward-transfer introductions but single-sponsor for visitor introductions. A home care deployment might require quorum only for overnight caregiver introductions.
What if one sponsor's trust decays below the threshold after the quorum was initially satisfied?
The quorum is evaluated at bridge creation time AND at each decay interval. If a sponsor's current coherence drops below the quorum threshold (e.g., because the sponsor has not visited in weeks and their accumulator has decayed), the bridge enters accelerated decay. If the sponsor's coherence drops to zero, their contribution to the quorum is invalidated, and if the remaining sponsors do not satisfy the quorum requirement, the bridge is terminated immediately. This ensures the quorum guarantee is maintained throughout the bridge's lifetime, not just at creation.
Can Mrs. Flanagan herself sponsor a bridge?
Yes. Mrs. Flanagan has the highest coherence in the deployment (0.79). Her sponsorship would produce a bridge mass near the cap. However, in a multi-sponsor quorum configuration, her sponsorship alone is insufficient -- a second independent sponsor is required. This protects against scenarios where a vulnerable person might be pressured or deceived into sponsoring an introduction for someone who should not be trusted. The quorum requires at least one sponsor external to the immediate care relationship.
How does the quorum interact with the causation packet?
When a quorum is satisfied and a multi-sponsor bridge is created, the causation packet records: event type BRIDGE_CREATION_QUORUM, the list of sponsor identifiers with their individual contributions, the quorum function used, the resulting combined bridge mass, and the temporal window over which the quorum was accumulated. When the bridge decays or expires, the packet records: event type BRIDGE_EXPIRY_QUORUM, the final bridge mass, the duration, and whether the target achieved sufficient direct trust to sustain engagement independently. For the full causation packet architecture, see Why Did the Robot Back Away?.
Is there a practical upper limit on the number of sponsors in a quorum?
The patent describes quorums of 2-4 sponsors. In practice, requiring more than 3 sponsors becomes logistically difficult -- finding 4+ independently trusted entities who can each introduce the target within a 72-hour window is uncommon in care settings. The reference implementation supports up to 8 sponsors per quorum, but deployments rarely use more than 3. The diminishing returns are real: beyond 3 sponsors, additional contributions have minimal effect on the combined bridge mass because the min-quorum is already bounded by the weakest contributor.
Patent pending. US Provisional 64/039,655.
-- Colm Byrne, Founder -- Flout Labs, Galway, Ireland