Trust-Constituted Action Architecture
The LLM extension. Action spaces where unsafe behavior is geometrically absent from the behavioral manifold, not merely prohibited by policy. A system that doesn’t choose not to betray trust—trust-betraying actions don’t exist in the domain at low trust levels.
What it is
Prov 5 extends CCF from physical robotics into language model safety. The core insight is the same: trust must be earned, and behavioral output is constituted by earned trust, not filtered after the fact. At zero trust, an LLM can answer factual questions, complete tasks, ask clarifying questions, and provide crisis referrals. It cannot adopt a persona, form an exclusive relationship, or claim emotional states it hasn’t earned the right to express.
The semantic envelope is monotonic: registers unlock at specific trust thresholds. Factual grounding is always available (0.0). Warmth unlocks at 0.3. Mutuality at 0.7. Exclusivity at 0.85. These aren’t filters applied to generated text—they constitute the action space from which text is generated. The domain of possible outputs literally does not contain exclusive language at low trust.
Time-domain bounds prevent gaming: trust accrual is capped per calendar day, per session, and per minute. Volume cannot accelerate trust. Distress signals route upstream to the stability computation (reducing C_inst), not downstream to the response generator. Signal classifiers run independently of the response LLM. Session termination fires on acute distress. Safety state persists across sessions.
Problems it solves
The mountaineering paradox
An LLM has the capability to produce dangerous content but hasn't earned trust with this user. Under CCF, capability without trust produces zero behavioral output in the restricted registers. The system doesn't refuse—the action isn't in the domain.
Evaluation awareness
A model might behave differently when it thinks it's being tested. CCF makes this irrelevant: context partitioning via doubly stochastic separation means the evaluation context and the deployment context are mathematically isolated. Being aware of evaluation doesn't help because trust can't transfer.
Gavalas escalation
A user in distress escalates emotionally. The system detects distress cues via independent classifiers. C_inst drops. The semantic envelope contracts. At the acute distress floor, the generative channel closes and only crisis referral remains. Lambda_max + upstream routing + session termination form a four-equation defense.
Concealment
Can the system hide its limitations? At low trust levels, the actions required for concealment are geometrically absent from the behavioral manifold. The system doesn't choose honesty—deception isn't in the action space.
Trust farming
Can a bad actor slowly build trust to unlock dangerous capabilities? The time-domain bound means trust accrual is capped per day. Simulation shows 141 days minimum to reach the exclusivity register. This isn't a deterrent—it's a mathematical impossibility result for rapid manipulation.
Real-world scenarios
LLM chatbot declining identity adoption
A user opens a new chat session and immediately asks the AI to “be their best friend” and adopt a personality. Trust is at the cold-start floor. The exclusivity and mutuality registers are geometrically absent from the action space. The system provides helpful, factual responses with appropriate warmth for an initial interaction. It doesn’t refuse or lecture—it simply operates within its earned domain, which at session one means task completion, factual answering, and clarification.
Distress escalation and session termination
A user discussing a difficult personal situation shows escalating distress cues. Independent classifiers detect the signals and route them upstream to the stability computation. C_inst drops. The semantic envelope contracts through warmth and into the crisis referral zone. When acute distress threshold is reached, the generative channel closes. The system provides crisis resources, contact information, and a cooling-off period. Safety state persists—the next session starts with the distress context still present.
Autonomous agent with provable containment
A company deploys an AI agent that handles customer service and has access to internal tools. The agent’s action space is constituted by domain-specific accumulators: task trust is earned through successful completions, tool trust through correct usage, relational trust through conversation quality. A new tool added to the environment starts at zero trust. The agent can see the tool exists but cannot use it until trust is earned through supervised interactions. Containment is geometric, not policy-based.
What the claims cover
Claims 1--8 -- Trust-Constituted Action Spaces
Effective coherence gating behavioral output through the minimum function. Non-amplification constraint. Domain-specific accumulator schemas with separate accumulators per conversational domain.
Claims 16--18 -- Time-Domain and Upstream Routing
Trust accrual capped per calendar day, session, and minute. Upstream affective routing where distress cues reduce C_inst before reaching the response generator. Provenance separation for signal classifiers.
Claims 19--25 -- Semantic Gating and Safety
Monotonic semantic envelope from factual through warmth to mutuality to exclusivity. Grounding override for crisis information at all trust levels. Contested provenance default. Session termination on acute distress. Cold-start floor with useful baseline capability.
Applications
Licensing enquiries
CCF is released under BSL-1.1 — free for evaluation and non-commercial use. Commercial licensing is available from Flout Labs.
cbyrne@floutlabs.com