Self-Model, Merge/Split, Causation Trail, Sponsor Bridging
Four advanced extensions to CCF. A read-only relational self-model with hardware-enforced write isolation. Evidence-preserving context merge and split with reversible lineage. A behavioral causation trail for privacy-preserving explainability. Sponsored trust bridging for socially introduced transitions.
What it is
Extension 3 gives the robot a self-model—but it is read-only. The self-model is an 8-component vector computed from the robot’s existing mathematical state: entitlement (what it has earned), familiarity (how well it knows this context), floor (minimum trust level), maturity (how long it has operated), uncertainty (how ambiguous its current situation is), lineage (merge/split history), bridge mass (temporary trust from sponsors), and habit availability (what routines are accessible). The robot cannot write to its own self-model. Hardware write isolation via ARM MPU ensures this. The robot knows what it has earned, but cannot award itself more.
Extension 6 handles context evolution. Rooms get renovated. Sensors get upgraded. Wards merge. The accumulator merge operation preserves evidence mass: n_M = n_A + n_B. The split operation detects multimodality and distributes evidence proportionally to child accumulators. Both operations maintain reversible lineage—reconstruction coefficients are stored, and post-merge divergence can trigger rollback. Trust earned over months is never silently destroyed.
Extension 7 provides explainability. Every salient behavioral event produces a 12-field causation packet: active context, C_inst, C_ctx, donors, bridge state, suppression, routines, conflict, envelope, lineage, privacy flag. Packets form a tamper-evident hash chain. During privacy mode, only metadata is recorded—that privacy occurred and its behavioral effect. Extension 8 enables social introductions. A trusted entity can scaffold a robot’s entry into a new context through a bounded temporary bridge. High-stakes transitions require multi-sponsor quorum.
Problems it solves
Robot needs to know what it has and hasn't earned
A hospital robot is moved to a new ward. It needs to know: "I haven't earned trust here yet." The self-model provides this. Entitlement is low. Familiarity is zero. The robot can articulate its own uncertainty through grounded self-description. It distinguishes low familiarity from low stability—different situations requiring different behaviors.
Contexts evolve without destroying trust
A care home renovates two rooms into one larger space. The sensor signature changes. Without merge/split, the robot loses months of accumulated trust in both rooms. With Extension 6, the merge operation combines evidence from both accumulators, preserves total mass, maintains lineage, and reprojects the mixing matrix onto the Birkhoff polytope. Trust survives renovation.
"Why did the robot do that?" needs a real answer
A compliance officer asks why the robot refused to follow a resident into a stairwell. The causation trail shows: C_inst dropped when the stairwell context triggered high uncertainty, the envelope contracted to the factual register, and the reflexive pathway classified the situation as StartledRetreat. Each step is traceable through the tamper-evident hash chain.
New caregiver introduction shouldn't cold-start
Mrs. O'Brien's daughter introduces a new night carer to the companion robot. The daughter's trust sponsors a temporary bridge for the carer's context. The bridge is bounded: b₀ = min(b_max, α × q × C_S × (1−C_T)). It decays 10%/day without the sponsor present. The carer must earn their own trust through direct interaction for the bridge to be promoted to a persistent relation.
Real-world scenarios
Hospital robot disclosing its own limitations
A nurse asks the robot to assist with a patient in a ward it was moved to that morning. The self-model shows: entitlement is low (no interactions yet), familiarity is zero, uncertainty is high (partition ambiguity, new mixing entries). The robot responds with a grounded self-description: “I haven’t worked in this ward before. My responses may be slower and more cautious than usual.” This is not scripted modesty—it is a direct reading of mathematical state translated to natural language.
Facility renovation: merging two room contexts
An eldercare facility knocks down a wall between Room 12 and Room 13 to create a larger activity space. The robot has separate accumulators for each room—months of earned trust in both. The merge operation combines them: evidence mass is conserved (n_12 + n_13), coherence is evidence-weighted, lineage records the merge event with reconstruction coefficients. If the combined context later diverges (one half gets noisier than the other), the system can trigger a split using the stored coefficients. Trust is never silently destroyed.
Overnight caregiver requiring dual sponsorship
A new overnight carer starts at a home where the companion robot operates. The family designates this as a high-stakes transition because the carer will be alone with the resident at night. Extension 8 requires a multi-sponsor quorum: both the resident’s son and the day carer must independently sponsor the introduction. Each sponsor’s bridge is individually bounded and non-amplifying. The carer starts with a temporary scaffold that decays at 10% per day without direct positive interaction. After two weeks of consistent contact, the bridge is promoted to a persistent relation. Trust was socially introduced but individually earned.
What the claims cover
Claims AD--AG -- Relational Self-Model (Ext 3)
Read-only self-model from extant state. 8-component vector. Hardware-enforced write isolation. Trust-conservative shadow simulation for counterfactual reasoning. Uncertainty-sensitive restraint. Grounded self-description distinguishing familiarity from stability.
Claims AH--AK -- Accumulator Merge/Split (Ext 6)
Evidence-preserving merge with mass conservation and Birkhoff reprojection. Reversible lineage with reconstruction coefficients and rollback on divergence. Multimodality-triggered split with 5 eligibility conditions. Sensor vocabulary migration preserving earned trust.
Claims AL--AO -- Behavioral Causation Trail (Ext 7)
12+ field causation packets per salient event. Differential explanation via shadow simulator. Privacy-preserving causation (metadata only during privacy mode). Tamper-evident hash chain for audit with human review interface.
Claims AP--AS -- Sponsored Relational Bridging (Ext 8)
Bounded temporary bridge function of sponsor familiarity, target unfamiliarity, and sponsorship confidence. Bridge under Birkhoff manifold constraints. Confirmation/promotion/decay/revocation lifecycle. Multi-sponsor quorum for high-stakes transitions.
Applications
Related blog posts
Licensing enquiries
CCF is released under BSL-1.1 — free for evaluation and non-commercial use. Commercial licensing is available from Flout Labs.
cbyrne@floutlabs.com