Paper deep dive
Before Agents Act: Assurance-Aware Semantic Scheduling for Evidence Acquisition in Distributed Systems
Jun He, Deying Yu
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Tool-using agents can initiate consequential infrastructure changes, yet evidence required for admission may expire while other checks run or depend on a shared fault domain. We formulate evidence acquisition as joint witness selection and scheduling under quorum, diversity, freshness, deadline, and resource constraints. Assurance-Aware Semantic Scheduling (AAS) combines integer-program selection, dispatch-aware temporal scheduling, bounded diagnostic expansion, and receipt-aware repair. Formal results state the assumptions needed for dispatch-time freshness and finite diagnostic expansion. In three generated infrastructure workloads, AAS produces 1,075/1,200 valid candidates versus 647/1,200 for constraint-aware forward scheduling; stale candidates fall from 440 to 12. Paired sensitivity studies reuse the same instances and operation latency draws across parameter settings. A corrected timeout intervention finds 18/20 admissions with repair or full resynthesis versus 0/20 for a static plan, with lower committed cost when receipts are reused. On 20 constructed cases requiring a certified decomposition cut, refinement recovers an oracle-matching feasible plan every time. These are controlled simulation results; the bounded oracle shares a temporal search component, and transfer to deployed systems remains untested.
Tags
Links
- Source: https://arxiv.org/abs/2609.34376v1
- Canonical: https://arxiv.org/abs/2609.34376v1
Trouble viewing inline? Open PDF directly →
Full Text
175,429 characters extracted from source content.
Expand or collapse full text
Before Agents Act: Assurance-Aware Semantic Scheduling for Evidence Acquisition in Distributed Systems Jun He Affiliation: OpenKedge.io Deying Yu Affiliation: OpenKedge.io Abstract Tool-using agents can initiate consequential infrastructure changes, yet evidence required for admission may expire while other checks run or depend on a shared fault domain. We formulate evidence acquisition as joint witness selection and scheduling under quorum, diversity, freshness, deadline, and resource constraints. Assurance-Aware Semantic Scheduling (AAS) combines integer-program selection, dispatch-aware temporal scheduling, bounded diagnostic expansion, and receipt-aware repair. Formal results state the assumptions needed for dispatch-time freshness and finite diagnostic expansion. In three generated infrastructure workloads, AAS produces 1,075/1,200 valid candidates versus 647/1,200 for constraint-aware forward scheduling; stale candidates fall from 440 to 12. Paired sensitivity studies reuse the same instances and operation latency draws across parameter settings. A corrected timeout intervention finds 18/20 admissions with repair or full resynthesis versus 0/20 for a static plan, with lower committed cost when receipts are reused. On 20 constructed cases requiring a certified decomposition cut, refinement recovers an oracle-matching feasible plan every time. These are controlled simulation results; the bounded oracle shares a temporal search component, and transfer to deployed systems remains untested. 1 Introduction Agents that operate shared infrastructure may propose database failover, network isolation, access-control changes, or deployment rollouts. Authorization alone does not establish that the current system state supports a proposed action. Cognitive Admission Control (CAC) [1] expresses this additional requirement as risk-conditioned obligations Ω(q,s)=ω1,…,ωk (q,s)=\ _1,…, _k\ for action q in modeled state s. The admission gateway discharges each obligation against typed evidence before allowing dispatch. The gateway defines the evidence required for admission. It does not select verifiers or schedule their execution. The resulting systems question is: Given a set of assurance obligations, how should an autonomous system acquire, schedule, refresh, and compose the evidence needed to satisfy them under cost, latency, freshness, dependency, and fault-domain constraints? Cognitive Admission Control (CAC) “What evidence is required?” Maps risk ρ(q,s)ρ(q,s) to obligations Ω(q,s) (q,s) Assurance-Aware Semantic Scheduling (AAS) “How is that evidence acquired in time?” Selects and schedules operations in plan π Transactional Context Tracking & Execution (TCT) “When can the action commit?” Enforces atomic dispatch and single-use admission Obligations Ω(q,s) (q,s)Witness Manifest qW_q & Cert qC_q Figure 1: The Post-Deterministic Distributed Systems (PDDS) control stack. AAS bridges the architectural gap between declarative admission specification (CAC) and transactional execution (TCT). Consider a concrete operational scenario: an autonomous agent proposes a failover of a primary PostgreSQL cluster. CAC dictates that admission requires: (i) a verified cluster topology snapshot, (i) an independent confirmation of replication lag ≤100≤ 100 ms, (i) a cryptographically signed node fencing receipt, (iv) an Epistemic Fault Domain (EFD) diversity cut κE≥2 _E≥ 2, and (v) evidence freshness Δt≤5 t≤ 5 s. Although the admission requirements are explicit, the execution runtime faces a complex web of operational dilemmas: • Operation Selection & Multi-Obligation Coverage: Should the runtime query low-level telemetry, invoke a heavyweight formal verification tool, run an in-memory simulation, or query a redundant model verifier? An attestation from a consensus coordinator might satisfy both topology and fencing obligations simultaneously. • Temporal Freshness Intersection: If fencing verification requires 6 s, while replication lag evidence expires after 5 s, a serial schedule A→B→CA→ B→ C will arrive at dispatch with stale replication evidence. The scheduler must coordinate operations such that their validity intervals overlap at dispatch time: ⋂iValidityInterval(ei)≠∅ _iValidityInterval(e_i)≠ . • Epistemic Dependencies vs. Cost: An optimizer selecting the cheapest verifiers may select two distinct services that secretly depend on the same faulty upstream telemetry broker, violating κE≥2 _E≥ 2 and inducing common-mode admission failure. • Consequential Diagnostic Actions: To verify rollback feasibility, the system might need to execute an active database probe or snapshot lock. But that diagnostic probe is itself a mutating, consequential operation that requires its own admission certificate, risking recursive deadlocks. • Adaptive Replanning Under Shifted Risk: If early evidence reveals that the candidate replica is partially degraded, the risk profile shifts from ρ0 _0 to ρ1 _1, altering the required obligation set Ω0→Ω1 _0→ _1 and requiring dynamic schedule adaptation. The timing problem matters because agent tool use increasingly crosses an authorization boundary at execution time [2]. Additional reasoning cannot replace a current observation of a partitioned switch, and an early observation can expire before a slow independent check completes. Verification-portfolio work, including VP-CONTROL [3], studies verifier selection, evidence-source diversity, and commit-time guards; AAS adds an explicit schedule for expiring operational evidence and for diagnostics that themselves require admission. Classical task scheduling supplies precedence and capacity constraints, but the admissibility of an evidence plan also depends on witness independence and validity at dispatch. 1.1 Contributions We study Assurance-Aware Semantic Scheduling (AAS) through five contributions: 1. Problem formulation. ASP selects and schedules evidence-producing operations under hard admission, budget, and deadline constraints. It separates prospective feasibility from the gateway’s decision on realized receipts (Section 3). 2. Temporal scheduling. A dispatch-time freshness criterion and backward scheduler place short-lived observations after slower checks when precedence permits. The guarantee is conditional on modeled latency and clock bounds; runtime receipts are checked again at the gateway (Section 4). 3. Fault-domain-aware selection. An integer program assigns witnesses to obligations while enforcing modeled EFD cuts and charging shared operations once. A decomposed solver coordinates selection with temporal feasibility; cost optimality requires exact subproblem search and full cost modeling (Section 5). 4. Consequential diagnostics and repair. Risk stratification bounds recursive sub-admission under explicit timeout assumptions. A generation-aware controller replans from the live clock, excludes failed operations, and reuses receipts only while their original observations remain valid (Sections 6 and 7). 5. Controlled evaluation. Generated infrastructure workloads and paired sensitivity studies measure admission, freshness, diversity, and cost. Selected-operation timeout trials isolate receipt reuse from resynthesis and a static control; constructed cut-producing cases test both supported refinement certificates against a bounded exact oracle (Section 9). Section 8 gives the reference controller and algorithms; Section 9 describes the evaluation. 2 Background and Motivation 2.1 Cognitive Admission Control (CAC) Recap Cognitive Admission Control (CAC) [1] defines an admission boundary for agentic systems operating in high-consequence environments. When an agent proposes a mutating action q at modeled state s, the control plane evaluates a multidimensional risk vector: ρ(q,s)=⟨C,Bblast,I,U,Dexp,P⟩∈ℛ,ρ(q,s)= C,B_blast,I,U,D_exp,P , (1) capturing consequence severity (C), blast radius (BblastB_blast), irreversibility (I), observational uncertainty (U), dependency exposure (DexpD_exp), and adverse plausibility (P). Based on ρ(q,s)ρ(q,s), the admission policy Π resolves a set of mandatory assurance obligations: ΩΠ(q,s)=FΠ(ρ(q,s),q,s)=ω1,ω2,…,ωk. _ (q,s)=F_ (ρ(q,s),q,s)=\ _1, _2,…, _k\. (2) Each obligation ω∈Ωω∈ defines a formal predicate ϕω _ω, acceptable evidence classes ℰωE_ω, structural quorum constraints, validity duration Δtω t_ω, and epistemic diversity requirements κE(ω)≥k _E(ω)≥ k. To satisfy an obligation ω, the system must provide a set of cryptographic evidence receipts W⊆EW E. The evaluator computes a deterministic ternary discharge: Discharge(ω,E,s,χ)∈ (ω,E,s,χ)∈\ Satisfied(W), Satisfied(W), (3) Violated(W),Unknown(c), Violated(W), Unknown(c)\, where χ denotes the evaluation context. If all required obligations return Satisfied, the controller mints a single-use admission certificate qC_q containing an immutable proposal digest, the witness manifest q=(ω,Wω)W_q=\(ω,W_ω)\, state version guards GqG_q, and an expiry bound texpt_exp. The execution gateway validates qC_q and performs an atomic compare-and-swap on the certificate nonce before forwarding the action to external infrastructure. 2.2 Reasoning vs. Evidence Acquisition A critical theoretical finding in CAC is the non-fungibility of cognitive resources and empirical evidence. Let R denote a cognitive resource budget encompassing model reasoning tokens T, context window CctxC_ctx, tool invocations AtoolA_tool, and verification compute VcpuV_cpu. The epistemic lifecycle follows a strict two-stage transformation: R→acquisitionE→discharge under ΠAdmission Verdict.R acquisitionE discharge under Admission Verdict. (4) Allocating additional cognitive compute (e.g., test-time reasoning tokens [4] or self-reflection [5]) can synthesize more sophisticated proof strategies or optimize query parameters. However, compute cannot conjure external truth: no amount of internal reasoning can prove that an external replication stream is unpartitioned without acquiring an authentic, current receipt from an external observation channel. Consequently, cognitive resource planning must not be treated as an isolated prompt-engineering problem. Instead, cognitive compute is simply one resource category within a general systems scheduling problem that allocates both computational reasoning and empirical observation bandwidth. A. Serial forward schedule: lag evidence expires before dispatchtt (s)atopoa_topo00–1.21.2alaga_lag1.21.2–2.42.4afencea_fence (fencing verification), 2.42.4–8.48.4 selage_lag valid: [2.4,7.4][2.4,7.4] sefencee_fence valid after 8.48.4 selage_lag expires at 7.47.4 s << dispatch at 8.48.4 sB. Assurance-aware schedule: all receipts are fresh at dispatchtt (s)atopoa_topo00–1.21.2afencea_fence (long check), 1.21.2–7.27.2 salaga_lag66–7.27.2etopoe_topo validefencee_fence validelage_lag validCommon validity: [7.2,12.2][7.2,12.2] s Figure 2: Motivating failure under naive scheduling versus Assurance-Aware Semantic Scheduling. In Case A, serial forward execution causes short-lived evidence (elage_lag, validity 5 s, finished at t=2.4t=2.4 s) to expire at t=7.4t=7.4 s while long-latency fencing verification (afencea_fence, latency 6 s) completes at t=8.4t=8.4 s, aborting dispatch. In Case B, AAS pre-fetches long-lived topology evidence, schedules long-latency fencing early, and fires alaga_lag Just-in-Time on [6.0,7.2][6.0,7.2] s, guaranteeing a valid dispatch freshness intersection [7.2,12.2][7.2,12.2] s. 2.3 Motivating Failures in Naive Schedulers To demonstrate why existing schedulers fail to satisfy assurance obligations, consider three concrete pathologies: Pathology 1: Dispatch-Time Freshness Decay. Suppose a database failover requires three obligations: ωtopo _topo (cluster topology, valid for 30 s), ωlag _lag (replication lag under 100 ms, valid for 5 s), and ωfence _fence (independent confirmation that the dead primary is isolated, valid for 10 s). Measuring topology takes 1.2 s, measuring lag takes 1.2 s, while executing fencing verification requires 6.0 s. A standard serial workflow engine executes tasks in declared sequence (ωtopo→ωlag→ωfence _topo→ _lag→ _fence), as illustrated in Figure 2(Case A). Under serial dispatch, atopoa_topo executes on [0,1.2][0,1.2] s, alaga_lag on [1.2,2.4][1.2,2.4] s (yielding receipt elage_lag valid on [2.4,7.4][2.4,7.4] s), and afencea_fence on [2.4,8.4][2.4,8.4] s. By the time fencing verification concludes at t=8.4t=8.4 s, the replication lag receipt issued at t=2.4t=2.4 s has already expired at t=7.4t=7.4 s (7.4<8.47.4<8.4). At the execution gateway, the certificate is rejected for stale evidence. In contrast, AAS pre-fetches long-lived topology evidence, executes long-latency fencing on [1.2,7.2][1.2,7.2] s, and launches alaga_lag Just-in-Time on [6.0,7.2][6.0,7.2] s, ensuring all validity intervals overlap at dispatch tdispatch=7.2t_dispatch=7.2 s (Case B). Pathology 2: Common-Mode Epistemic Correlation. Assume ωlag _lag requires an Epistemic Fault Domain cut κE≥2 _E≥ 2, mandating two structurally independent witnesses. The scheduler can query three verifiers: • Verifier VAV_A: cost $0.01, latency 400 ms, queries Prometheus node-exporter S1S_1. • Verifier VBV_B: cost $0.01, latency 450 ms, queries CloudWatch agent S2S_2. • Verifier VCV_C: cost $0.10, latency 2000 ms, executes a direct Postgres replication query S3S_3. A cost-minimizing scheduler (such as classic knapsack or greedy cost solvers) selects VA,VB\V_A,V_B\ for a total cost of $0.02. However, unbeknownst to the scheduler, both S1S_1 and S2S_2 pull their metrics from a shared telemetry proxy that has stalled due to memory pressure. Both verifiers return identical, stale lag reports. Because they share an underlying epistemic fault domain ((VA)∩(VB)≠∅X(V_A) (V_B)≠ ), their structural diversity cut is κE=1 _E=1. The admission controller rejects the pair. A semantic scheduler must understand epistemic dependency topology: it must recognize that VA,VC\V_A,V_C\ ($0.11) is the minimal admissible set, whereas VA,VB\V_A,V_B\ is an inadmissible waste of resources. Pathology 3: Remediation Deadlock from Consequential Diagnostics. To satisfy an obligation regarding storage rollback feasibility, the scheduler selects a diagnostic operation adiaga_diag that executes an ephemeral filesystem freeze and snapshot probe. However, freezing production storage is itself a consequential operation that carries high risk (ρ(adiag,s)≥τΠρ(a_diag,s)≥ _ ). Under CAC, adiaga_diag cannot execute without its own admission certificate, which demands evidence of cluster quiescence! If the scheduler spawns recursive diagnostics without well-foundedness constraints, the system enters an infinite admission cycle or deadlocks under shared budget depletion. 3 The Assurance Scheduling Problem The Assurance Scheduling Problem (ASP) maps declarative CAC obligations to a feasible, cost-aware evidence-acquisition plan. Optimality applies only under the exact-search and full-model conditions stated in Section 5.3. 3.1 Formal Problem Inputs An instance of the Assurance Scheduling Problem is defined by the 5-tuple: =⟨Ω,,B,,⟩,P= ,A,B,D,T , (5) where each component is specified as follows: Definition 1 (Assurance Obligations Ω ). Ω=ω1,…,ωk =\ _1,…, _k\ is the finite set of required obligations emitted by the CAC policy resolver ΩΠ(q,s)=FΠ(ρ(q,s),q,s) _ (q,s)=F_ (ρ(q,s),q,s). Each obligation ω=⟨ϕω,ℰω,Δtω,κEmin(ω),ω⟩ω= _ω,E_ω, t_ω, _E (ω),Q_ω specifies: • a semantic predicate ϕω:∗×inst∗→true,false _ω:S^*×E_inst^*→\true,false\, • acceptable evidence classes ℰω⊆E_ω (e.g., attestation, telemetry receipt, proof trace), • a maximum allowable evidence age Δtω∈ℝ+ t_ω ^+, • a minimum epistemic diversity cut threshold κEmin(ω)∈ℕ≥1 _E (ω) _≥ 1, • a quorum rule ω=⟨kω,polω⟩Q_ω= k_ω,pol_ω specifying required witness counts (kω∈ℕ≥1k_ω _≥ 1) and authorization polarities. Definition 2 (Assurance Operations A). =a1,…,amA=\a_1,…,a_m\ represents the catalogue of available evidence-producing operations. Each operation a∈a is a typed systems action characterized by: a=⟨ a= c(a),ℓ(a),ℓ^(a),tok(a),Cov(a), c(a), (a), (a),tok(a),Cov(a), (6) Δt(a),Pre(a),(a),ρ(a)⟩, t(a),Pre(a),X(a),ρ(a) , where: • c(a)∈ℝ≥0c(a) _≥ 0 is financial or monetary cost (e.g., API charges, egress fees), • ℓ(a)∈ℝ+ (a) ^+ is nominal execution latency, and ℓ^(a)≥ℓ(a) (a)≥ (a) is a conservative upper bound accounting for network jitter and tail variance, • tok(a)∈ℕ0tok(a) _0 is cognitive token consumption (for LLM verifiers or reasoning-based checkers), • Cov(a)⊆Ω×Cov(a) ×E denotes the modeled potential coverage: pairs (ω,ε)(ω, ) indicating that a can produce evidence of class ε∈ℰω _ω relevant to evaluating obligation ω, • Δt(a)∈ℝ+ t(a) ^+ is the intrinsic physical lifespan of evidence emitted by a, • Pre(a)⊆Pre(a) is the set of operational prerequisites that must successfully terminate before a can execute, • (a)⊆X(a) is the epistemic exposure set, enumerating all underlying shared fault domains (e.g., host kernels, DNS resolvers, metrics daemons, model weights) in the fault domain universe =f1,…,fpF=\f_1,…,f_p\, • ρ(a)∈ℛρ(a) is the operational risk vector of a, determining whether a is non-consequential (ρ(a)≺τΠρ(a) _ ) or consequential (ρ(a)⪰τΠρ(a) _ ). When operation a executes, it produces a non-empty set of concrete evidence receipts Emit(a)⊆instEmit(a) _inst. A single operation a may emit multiple receipts, and a single receipt e∈Emit(a)e (a) may supply witness evidence supporting multiple obligations ω∈Ωω∈ . Each receipt e records an observation timestamp tobs(e)≤C(a)t_obs(e)≤ C(a), where C(a)C(a) is the completion timestamp of a. Definition 3 (Resource Budgets B). B=⟨B$,Blat,Btok,Brisk,Kmax⟩B= B_\$,B_lat,B_tok,B_risk,K_ bounds total allowable dollar expenditure, end-to-end wall-clock latency, cognitive reasoning tokens, cumulative operational risk perturbation, and the maximum number of concurrent active operations Kmax∈ℕ≥1∪∞K_ _≥ 1∪\∞\. Definition 4 (Assurance Dependencies D). =⟨Dop,Depi⟩D= D_op,D_epi encodes: • Operational precedence constraints Dop⊆×D_op ×A, where (ai,aj)∈Dop(a_i,a_j)∈ D_op implies aja_j cannot start until aia_i successfully completes (⋃a∈(u,a)∣u∈Pre(a)⊆Dop _a \(u,a) u (a)\ D_op), • Epistemic dependency topology Depi=(∪,ℰdep)D_epi=(A ,E_dep), defining the bipartite graph linking operations to shared failure domains (ℰdep=(a,f)∣a∈,f∈(a)E_dep=\(a,f) a ,f (a)\). Definition 5 (Temporal Constraints T). =⟨t0,Tdead,δexec,δverify,δmint,δdisp,ϵskew⟩T= t_0,T_dead, _exec, _verify, _mint, _disp, _skew specifies the scheduling epoch, proposal deadline, protected execution window, receipt-verification time, certificate-minting time, gateway dispatch delay, and clock uncertainty bound, respectively. All delays are nonnegative. Define the post-completion readiness delay once as δready=δverify+δmint+δdisp _ready= _verify+ _mint+ _disp. 3.2 Assurance Plan Representation An assurance plan π is a scheduled directed acyclic graph: π=⟨Vπ,Eπ,σπ,ℳπ⟩,π= V_π,E_π, _π,M_π , (7) where: • Vπ⊆V_π is the subset of scheduled operations, • Eπ⊆Vπ×VπE_π V_π× V_π is the set of precedence edges satisfying Dop∩(Vπ×Vπ)⊆EπD_op∩(V_π× V_π) E_π, • σπ:Vπ→[t0,Tdead] _π:V_π→[t_0,T_dead] assigns a scheduled start time to each operation, • ℳπ:Ω→2VπM_π: → 2^V_π assigns candidate witness operations ℳπ(ω)⊆VπM_π(ω) V_π to each obligation ω∈Ωω∈ . Under conservative latency bounds ℓ^(a) (a), the modeled completion time of operation a∈Vπa∈ V_π is C^π(a)=σπ(a)+ℓ^(a) C_π(a)= _π(a)+ (a). The nominal completion time is Cπ(a)=σπ(a)+ℓ(a)C_π(a)= _π(a)+ (a). The proposed target dispatch time of the primary action q is: tdispatch(π)≥maxa∈VπC^π(a)+δready.t_dispatch(π)≥ _a∈ V_π C_π(a)+ _ready. (8) 3.3 Prospective Feasibility vs. Realized CAC Discharge Pre-execution plan feasibility does not establish actual obligation discharge: 1. Prospective Plan Feasibility (π⊧prosπ _prosP): Evaluated at compile time by AAS. A plan is prospectively feasible if, under modeled capabilities Cov(a)Cov(a), latency bounds ℓ^(a) (a), and exposure sets (a)X(a), its schedule satisfies precedence, budgets, deadline windows, quorum cardinalities, and epistemic diversity cuts. Actual execution can still exceed the latency bound or fail to emit affirmative evidence. 2. Realized Obligation Discharge (q⊧CACΩW_q _CAC ): Evaluated at runtime by CAC. When operations execute, they emit concrete evidence receipts Estore=⋃a∈VπEmit(a)E_store= _a∈ V_πEmit(a). CAC evaluates the formal predicate Discharge(ω,Estore,s,χ)Discharge(ω,E_store,s,χ) for each ω∈Ωω∈ . An operation a with (ω,ε)∈Cov(a)(ω, ) (a) may fail, timeout, or return evidence refuting the predicate (Violated). Only when all obligations return Satisfied(Wω) Satisfied(W_ω) does CAC mint certificate qC_q, granting dispatch eligibility. Definition 6 (Prospectively Admissible Assurance Plan). A plan π=⟨Vπ,Eπ,σπ,ℳπ⟩π= V_π,E_π, _π,M_π is prospectively admissible for P, written π⊧prosπ _prosP, if and only if it strictly satisfies all of the following hard invariants: 1. Precedence Feasibility: ∀(u,v)∈Eπ:σπ(u)+ℓ^(u)≤σπ(v).∀(u,v)∈ E_π: _π(u)+ (u)≤ _π(v). (9) 2. Deadline and Execution Window Feasibility: tdispatch(π)+δexec≤Tdead.t_dispatch(π)+ _exec≤ T_dead. (10) 3. Resource Budget Invariants: Costtotal(π) _total(π) =∑a∈Vπc(a)≤B$, = _a∈ V_πc(a)≤ B_\$, (11) Latency(π) (π) =tdispatch(π)−t0≤Blat, =t_dispatch(π)-t_0≤ B_lat, (12) Tokens(π) (π) =∑a∈Vπtok(a)≤Btok, = _a∈ V_πtok(a)≤ B_tok, (13) Exposure(π) (π) =∑a∈Vπ‖ρ(a)‖≤Brisk, = _a∈ V_π\|ρ(a)\|≤ B_risk, (14) where VπV_π includes each operation of any admitted diagnostic sub-plan exactly once. Shared prerequisites are likewise charged once. If a concurrency limit Kmax<∞K_ <∞ is specified, then for all t∈[t0,Tdead]t∈[t_0,T_dead]: |a∈Vπ∣σπ(a)≤t<σπ(a)+ℓ^(a)|≤Kmax. |\a∈ V_π _π(a)≤ t< _π(a)+ (a)\ |≤ K_ . (15) 4. Prospective Witness Quorum Coverage: For each obligation ω∈Ωω∈ , the assigned operation set ℳπ(ω)⊆VπM_π(ω) V_π satisfies: ∀a∈ℳπ(ω):∃ε∈ℰω s.t. (ω,ε)∈Cov(a),∀ a _π(ω):\;∃ _ω s.t. (ω, ) (a), (16) and the candidate witness cardinality meets the quorum rule: |ℳπ(ω)|≥kω.|M_π(ω)|≥ k_ω. (17) 5. Prospective Dispatch Freshness Overlap: For every obligation ω∈Ωω∈ and assigned operation a∈ℳπ(ω)a _π(ω), let the effective lifespan be Δteff(a,ω)=min(Δtω,Δt(a)) t_eff(a,ω)= ( t_ω, t(a)). The target dispatch time tdispatch(π)t_dispatch(π) and execution window δexec _exec must be covered by the prospective validity window: tdispatch(π)+δexec≤σπ(a)+Δteff(a,ω)−ϵskew.t_dispatch(π)+ _exec≤ _π(a)+ t_eff(a,ω)- _skew. (18) 6. Epistemic Fault Domain Diversity Cut: For every obligation ω∈Ωω∈ , candidate witnesses ℳπ(ω)M_π(ω) satisfy: κE(ℳπ(ω),Γω)≥κEmin(ω), _E(M_π(ω), _ω)≥ _E (ω), (19) where Γω _ω is the positive kωk_ω-of-|W||W| approval rule and κE(W,Γω) _E(W, _ω) is the decision-rule-relative cut in Definition 7. 7. Diagnostic Admission Invariance: For every consequential diagnostic operation a∈Vπa∈ V_π (where ρ(a)⪰τΠρ(a) _ ), VπV_π contains an admitted prerequisite sub-plan πa≺a _a a prospectively satisfying ΩΠ(a,s) _ (a,s). Let Πadm()=π∣π⊧pros _adm(P)=\π π _prosP\ denote the set of all prospectively admissible plans. Under our canonical optimization contract (Contract C: Constrained Cost Minimization), the primary objective of AAS is to synthesize an admissible plan π∗π^* that minimizes total financial expenditure subject to hard bounds on latency (BlatB_lat), cognitive reasoning tokens (BtokB_tok), operational risk perturbation (BriskB_risk), and CAC quorums and EFD cuts: π∗ π^* =argminπ∈Πadm()Costtotal(π) = _π∈ _adm(P)Cost_total(π) =argmin∑a∈Vπ∈Πadm()c(a). = _π∈ _adm(P) _a∈ V_πc(a). (20) When multiple candidate plans achieve identical minimum financial expenditure, AAS resolves ties lexicographically by minimizing dispatch latency Latency(π)=tdispatch(π)−t0Latency(π)=t_dispatch(π)-t_0 and cumulative operational risk Exposure(π)=∑a∈Vπ‖ρ(a)‖Exposure(π)= _a∈ V_π\|ρ(a)\|. If Πadm()=∅ _adm(P)= , AAS returns Infeasible, triggering deterministic safe refusal at the admission boundary. 4 Temporal Freshness and Validity Intersections A distinguishing characteristic separating assurance scheduling from standard DAG scheduling (e.g., job-shop or workflow scheduling) is that outputs expire. In traditional systems, once an intermediate artifact is computed, it remains valid indefinitely unless explicitly evicted. In epistemic systems, an evidence receipt e reflects a dynamic distributed state whose fidelity decays over time. 4.1 Validity Intervals, Latency, and Readiness Lifecycle When an assurance operation a∈a executes, it inspects external system state at an observation timestamp tobs(e)t_obs(e) and completes processing at completion timestamp Cπ(a)≥tobs(e)C_π(a)≥ t_obs(e). Distinguishing tobs(e)t_obs(e) from Cπ(a)C_π(a) is vital: a distributed telemetry probe, log aggregator, or formal model checker may sample state at start, yet finish computation seconds or minutes later. To establish sound scheduling, we track the complete evidence and dispatch readiness lifecycle: 1. Observation Time tobs(e)t_obs(e): The physical moment at which system state is sampled. For an operation scheduled at start time σπ(a) _π(a) with conservative upper-bound latency ℓ^(a) (a) and actual latency ℓact(a)≤ℓ^(a) _act(a)≤ (a), observation occurs at σπ(a)≤tobs(e)≤Cπ(a) _π(a)≤ t_obs(e)≤ C_π(a). In the conservative worst case for expiration, state is assumed observed at invocation: tobs(e)≥σπ(a)t_obs(e)≥ _π(a). 2. Operation Completion Cπ(a)C_π(a): The timestamp when computation finishes: Cπ(a)=σπ(a)+ℓact(a)≤σπ(a)+ℓ^(a)=C^π(a)C_π(a)= _π(a)+ _act(a)≤ _π(a)+ (a)= C_π(a), where C^π(a) C_π(a) is conservative predicted completion. Post-observation computation duration is ℓpost(a)=Cπ(a)−tobs(e)≥0 _post(a)=C_π(a)-t_obs(e)≥ 0. 3. Receipt Availability & Verification tavail(e)t_avail(e): Emitting, cryptographically signing, transmitting, and verifying the receipt requires non-zero duration δverify≥0 _verify≥ 0. The receipt is available in the receipt store only at tavail(e)≥Cπ(a)+δverifyt_avail(e)≥ C_π(a)+ _verify. 4. Certificate Minting tmintt_mint: CAC evaluates the composite witness manifest qW_q and mints admission certificate qC_q. Minting requires that all required witness receipts have completed verification: tmint≥maxa∈VπCπ(a)+δverify+δmint.t_mint≥ _a∈ V_πC_π(a)+ _verify+ _mint. (21) 5. Gateway Dispatch tdispatcht_dispatch: Proposal q and certificate qC_q arrive at the execution gateway and complete mediation after network transit delay δdisp _disp: tdispatch≥tmint+δdisp≥maxa∈VπCπ(a)+δready,t_dispatch≥ t_mint+ _disp≥ _a∈ V_πC_π(a)+ _ready, (22) where δready _ready is the post-completion lead time defined in Section 3.1. 6. Protected Execution Window: The action executes during [tdispatch,tdispatch+δexec][t_dispatch,\;t_dispatch+ _exec]. Clock Uncertainty Model. Each observer node records tobs(e)t_obs(e) on its local clock CiC_i, while gateway dispatch is evaluated against the gateway clock CgwC_gw. We model clock synchronization uncertainty under bounded skew: |Ci(t)−Cgw(t)|≤ϵskew|C_i(t)-C_gw(t)|≤ _skew for all physical times t. Hence, when an observer records tobs(e)t_obs(e), the physical observation time expressed in the gateway’s reference frame satisfies tsamplegw∈[tobs(e)−ϵskew,tobs(e)+ϵskew]t_sample^gw∈[t_obs(e)- _skew,\;t_obs(e)+ _skew]. In the worst case, physical observation occurred at the lower bound tobs(e)−ϵskewt_obs(e)- _skew. When two independent observer nodes i and j compare raw timestamps directly without gateway mediation, the relative clock skew is at most |Ci(t)−Cj(t)|≤2ϵskew|C_i(t)-C_j(t)|≤ 2 _skew (reconciling Section 10). Each receipt e∈Emit(a)e (a) carries an intrinsic validity lifespan Δt(e) t(e). For obligation ω∈Ωω∈ with policy freshness bound Δtω t_ω, the effective lifespan is Δteff(e,ω)=min(Δtω,Δt(e)) t_eff(e,ω)= ( t_ω, t(e)). If e supports multiple obligations Ωe⊆Ω _e , its effective lifespan across all supported obligations is: Δteff(e)=minω∈ΩeΔteff(e,ω). t_eff(e)= _ω∈ _e t_eff(e,ω). (23) Evaluated at the gateway, receipt e expires at texpgw(e)=tobs(e)+Δteff(e)−ϵskewt_exp^gw(e)=t_obs(e)+ t_eff(e)- _skew, yielding the conservative validity interval: I(e)=[tobs(e)−ϵskew,tobs(e)+Δteff(e)−ϵskew].I(e)= [t_obs(e)- _skew,\;t_obs(e)+ t_eff(e)- _skew ]. (24) Freshness, Admissibility, and Physical Truth. Sound systems engineering requires rigorously distinguishing three distinct properties: 1. Receipt Freshness: Receipt e is fresh at gateway time t if t∈I(e)t∈ I(e), i.e., t≤tobs(e)+Δteff(e)−ϵskewt≤ t_obs(e)+ t_eff(e)- _skew. 2. Certificate Admissibility: Certificate qC_q is admissible at dispatch time tdispatcht_dispatch if all state version guards hold (Gq=νs=νliveG_q=\ _s= _live\), all obligation quorums and EFD cuts are satisfied, and all constituent witnesses remain continuously valid throughout the protected execution window: [tdispatch,tdispatch+δexec]⊆⋂e∈WallI(e),[t_dispatch,\;t_dispatch+ _exec] _e∈ W_allI(e), (25) where Wall=⋃(ω,Wω)∈qWωW_all= _(ω,W_ω) _qW_ω. 3. Physical Predicate Truth: The underlying physical safeguard ϕω(s(t)) _ω(s(t)) holds continuously in the environment: ∀t∈[tdispatch,tdispatch+δexec],ϕω(s(t))=∀ t∈[t_dispatch,t_dispatch+ _exec], _ω(s(t))=true. Remark 1 (Temporal Freshness vs. Physical Truth). Temporal freshness and certificate admissibility (Properties 1 and 2) are necessary epistemic proxies, but do not guarantee physical predicate truth (Property 3). If the environment experiences unmodeled out-of-band state mutations (e.g., a physical power cut or external manual override), or if policy freshness Δtω t_ω is set more permissively than the physical state drift rate τdrift(ϕω) _drift( _ω), a temporally fresh certificate will attest to a condition that has already ceased to hold physically. AAS and CAC guarantee rigorous epistemic admissibility under the modeled policy; ensuring physical truth requires that policy authors configure Δtω≤τdrift(ϕω) t_ω≤ _drift( _ω). Theorem 1 (Completion-Aware Dispatch Freshness Intersection). Fix an executed assurance plan π with completed operations VπV_π, actual completions Cπ(a)\C_π(a)\, observation timestamps tobs(e)\t_obs(e)\, and composite witness manifest WallW_all. Let Vreq⊆VπV_req V_π denote the set of all operations whose completion is mandatory prior to proposal dispatch, including both witness-producing operations Vmanifest=a∈Vπ∣∃e∈Wall,e∈Emit(a)V_manifest=\a∈ V_π ∃ e∈ W_all,e (a)\ and prerequisite operational dependencies AncDop(Vmanifest)Anc_D_op(V_manifest). For a fixed completed plan and its receipts, a dispatch timestamp satisfying readiness and freshness throughout the protected execution window exists if and only if: maxa∈VreqCπ(a) _a∈ V_reqC_π(a) +δready+δexec+ϵskew + _ready+ _exec+ _skew (26) ≤mine∈Wall(tobs(e)+Δteff(e)). ≤ _e∈ W_all (t_obs(e)+ t_eff(e) ). This condition concerns the freshness interval. Full admission additionally requires tdispatch+δexec≤Tdeadt_dispatch+ _exec≤ T_dead and the latency budget; equivalently, their upper bounds must also exceed the readiness lower bound. Equivalently, the condition holds if and only if for every required operation a∈Vreqa∈ V_req and every witness receipt ei∈Walle_i∈ W_all: Cπ(a)−tobs(ei)≤Δteff(ei)−δready−δexec−ϵskew.C_π(a)-t_obs(e_i)≤ t_eff(e_i)- _ready- _exec- _skew. (27) Furthermore, for any witness-producing operation a∈Vmanifesta∈ V_manifest emitting receipt ej∈Walle_j∈ W_all with observation time tobs(ej)t_obs(e_j) and post-observation latency ℓpost(a)=Cπ(a)−tobs(ej)≥0 _post(a)=C_π(a)-t_obs(e_j)≥ 0: tobs(ej)−tobs(ei)≤ t_obs(e_j)-t_obs(e_i)≤ Δteff(ei)−ℓpost(a) t_eff(e_i)- _post(a) (28) −δready−δexec−ϵskew. - _ready- _exec- _skew. Non-witness prerequisite operations u∈Vreq∖Vmanifestu∈ V_req V_manifest emit no admission receipts and therefore have no tobst_obs terms, but their completions Cπ(u)C_π(u) participate in the readiness bound (27) against all ei∈Walle_i∈ W_all. Proof. By Equation (22), dispatch cannot occur until all mandatory operations in VreqV_req have completed and candidate receipts have been verified and minted: tdispatch≥maxa∈VreqCπ(a)+δreadyt_dispatch≥ _a∈ V_reqC_π(a)+ _ready. Simultaneously, condition (25) requires that for every witness receipt e∈Walle∈ W_all, the execution window end does not exceed receipt expiration on the gateway clock: tdispatch+δexec≤mine∈Wall(tobs(e)+Δteff(e)−ϵskew)t_dispatch+ _exec≤ _e∈ W_all(t_obs(e)+ t_eff(e)- _skew). Thus, admissible dispatch timestamps form the closed interval [tlower,tupper][t_lower,t_upper], where: tlower t_lower =maxa∈VreqCπ(a)+δready, = _a∈ V_reqC_π(a)+ _ready, tupper t_upper =mine∈Wall(tobs(e)+Δteff(e)−ϵskew)−δexec. = _e∈ W_all (t_obs(e)+ t_eff(e)- _skew )- _exec. This interval is non-empty if and only if tlower≤tuppert_lower≤ t_upper, which rearranges directly to Equation (26). Condition (26) holds if and only if each term in the maximum is bounded by each term in the minimum, directly establishing pairwise equivalence (27) for all a∈Vreqa∈ V_req and ei∈Walle_i∈ W_all. For witness-producing operations a∈Vmanifesta∈ V_manifest, substituting Cπ(a)=tobs(ej)+ℓpost(a)C_π(a)=t_obs(e_j)+ _post(a) yields Equation (28). ∎ Example 1 (Counterexample: Failure of Observation-Only Dispatch Bounds). Consider an operation averifya_verify that samples database state at tobs(e)=0t_obs(e)=0, but executes complex consistency checking requiring latency ℓ^(a)=10 (a)=10 s, completing at C(a)=10C(a)=10 s. Let effective evidence lifespan be Δteff(e)=8 t_eff(e)=8 s, with lead times δready=0.2 _ready=0.2 s, execution window δexec=1.0 _exec=1.0 s, and ϵskew=0 _skew=0. If dispatch feasibility were naively bounded by observation time alone (maxtobs+δready+δexec≤min(tobs+Δt) t_obs+ _ready+ _exec≤ (t_obs+ t)), the inequality would evaluate to 0+0.2+1.0=1.2≤8.00+0.2+1.0=1.2≤ 8.0. An observation-only scheduler would falsely declare this schedule feasible, planning dispatch at t=1.2t=1.2 s. In physical reality, receipt e does not exist at t=1.2t=1.2 s because averifya_verify is still running. Earliest legal dispatch cannot occur before tready=10+0.2=10.2t_ready=10+0.2=10.2 s. At t=10.2t=10.2 s, the evidence collected at t=0t=0 has already expired (10.2+1.0=11.2>8.010.2+1.0=11.2>8.0). Theorem 1 correctly flags this as infeasible because maxC(a)+δready+δexec=11.2>8.0 C(a)+ _ready+ _exec=11.2>8.0. 4.2 Why Forward Scheduling Fails Traditional workflow engines apply earliest-deadline-first (EDF) or as-soon-as-possible (ASAP) forward scheduling: operations dispatch immediately once precedence dependencies are met. Consider three operations from Section 2.3: • atopoa_topo: latency 1.2 s, lifespan Δt=30 t=30 s, • alaga_lag: latency 1.2 s, lifespan Δt=5 t=5 s, • afencea_fence: latency 6.0 s, lifespan Δt=10 t=10 s. Under forward scheduling starting at t=0t=0, atopoa_topo finishes at t=1.2t=1.2 s (valid on [1.2,31.2][1.2,31.2] s). Next, alaga_lag completes at t=2.4t=2.4 s, producing receipt elage_lag whose validity window is [2.4,7.4][2.4,7.4] s. Finally, long-latency fencing afencea_fence executes from t=2.4t=2.4 s to t=8.4t=8.4 s. Here: tlower=8.4s+δready>7.4s=tupper,t_lower=8.4\,s+ _ready>7.4\,s=t_upper, (29) yielding an empty validity intersection! ASAP forward execution guarantees dispatch failure whenever short-lived telemetry is gathered prior to long-latency operations. 4.3 Backward Just-in-Time Scheduling To satisfy Theorem 1 without delaying action execution unnecessarily, AAS implements Backward Just-in-Time (JIT) Scheduling. Analysis of Target Dispatch Feasibility: Continuous Monotonicity vs. Heuristic Artifacts. A critical theoretical question is whether the set of feasible target dispatch timestamps feas⊆[tmin,tmax]T_feas [t_ ,t_ ] is continuous and monotonic, or whether it can fragment into disconnected sub-intervals. Proposition 1 (Time-Translation Invariance of Continuous ASP Feasibility). For any static ASP instance in continuous time with release epoch t0t_0, deadline TdeadT_dead, execution window δexec _exec, and latency budget BlatB_lat, define the maximum legal dispatch horizon: Tmax=min(Tdead−δexec,t0+Blat).T_ = (T_dead- _exec,\;t_0+B_lat). (30) If (σπ,tdispatch)( _π,t_dispatch) is a prospectively feasible schedule, then for all forward shifts Δ∈[0,Tmax−tdispatch] ∈[0,\;T_ -t_dispatch], the uniform time-translated schedule defined by σπ′(u)=σπ(u)+Δσ _π(u)= _π(u)+ and tdispatch′=tdispatch+Δt _dispatch=t_dispatch+ is also prospectively feasible. Consequently, feasT_feas is either empty or a single connected interval [tmin∗,Tmax][t^*_ ,\;T_ ]; it is never a disconnected union of sub-intervals. Proof. Let (σπ,tdispatch)( _π,t_dispatch) be feasible. Under translation by Δ≥0 ≥ 0: (i) release constraints hold since σπ′(u)=σπ(u)+Δ≥t0+Δ≥t0σ _π(u)= _π(u)+ ≥ t_0+ ≥ t_0; (i) precedence constraints σπ′(u)+ℓ^(u)≤σπ′(v)σ _π(u)+ (u)≤σ _π(v) hold identically; (i) dispatch readiness tdispatch′≥maxu(σπ′(u)+ℓ^(u))+δreadyt _dispatch≥ _u(σ _π(u)+ (u))+ _ready is preserved since Δ appears on both sides; (iv) receipt freshness at dispatch satisfies tdispatch′+δexec−(σπ′(u)+ℓ(u))=tdispatch+δexec−(σπ(u)+ℓ(u))≤Δteff(u)−ϵskewt _dispatch+ _exec-(σ _π(u)+ (u))=t_dispatch+ _exec-( _π(u)+ (u))≤ t_eff(u)- _skew, since Δ cancels identically; (v) instantaneous concurrency |u∣σπ′(u)≤t<σπ′(u)+ℓ^(u)||\u σ _π(u)≤ t<σ _π(u)+ (u)\| at time t equals concurrency at t−Δt- , preserving KmaxK_ ; (vi) the deadline condition tdispatch′+δexec≤Tdeadt _dispatch+ _exec≤ T_dead holds because tdispatch′≤Tmax≤Tdead−δexect _dispatch≤ T_ ≤ T_dead- _exec; and (vii) the latency budget condition Latency(π′)=tdispatch′−t0=(tdispatch−t0)+Δ≤BlatLatency(π )=t _dispatch-t_0=(t_dispatch-t_0)+ ≤ B_lat holds because tdispatch′≤Tmax≤t0+Blatt _dispatch≤ T_ ≤ t_0+B_lat. ∎ Why, then, do practical temporal schedulers encounter non-monotonic behavior across candidate targets? Non-monotonicity is strictly an artifact of heuristic placement algorithms, rather than a property of the underlying continuous scheduling problem: 1. Epoch Clamping: Backward propagation anchors completions to ttarget−δreadyt_target- _ready and pushes starts backwards. When ttargett_target is small, unconstrained starts fall before t0t_0. Heuristically clamping starts to σπ(u)≥t0 _π(u)≥ t_0 alters inter-operation spacing; as ttargett_target is increased without uniformly translating the earliest operations, the elapsed duration ttarget−σπ(u)t_target- _π(u) grows, causing clamped receipts to expire before dispatch. 2. Concurrency Collisions (Kmax<∞K_ <∞): Under finite concurrency, greedy placement heuristics serialize overlapping operations using local priority rules. Shifting ttargett_target changes which operations collide, producing discrete reorganizations of the schedule where a greedy heuristic may succeed at t1t_1, fail at t2>t1t_2>t_1, and succeed again at t3>t2t_3>t_2. Accordingly, universal binary search over [tmin,tmax][t_ ,t_ ] is unsound for backward heuristics. AAS evaluates candidates across a discrete grid with step τgrid _grid. If grid search exhausts without finding a placement, it returns NotFound; provable Infeasible is reserved strictly for certified structural violations. Backward Propagation with Safety Margins. Given candidate target dispatch ttargett_target, operations are scheduled in reverse topological order. For each operation u∈Vπu∈ V_π, the latest permissible completion time Tlatest(u)T_latest(u) is bounded by successors in EπE_π and target dispatch: Tlatest(u) T_latest(u) ≤min(u,v)∈Eπσπ(v), ≤ _(u,v)∈ E_π _π(v), (31) Tlatest(u) T_latest(u) ≤ttarget−δready, ≤ t_target- _ready, (32) σπ(u) _π(u) =Tlatest(u)−ℓ^(u)−ϵguard, =T_latest(u)- (u)- _guard, (33) where ℓ^(u) (u) is the conservative upper-bound latency and ϵguard _guard is an operational safety buffer absorbing network round-trip jitter. Algorithm 1 Two-Tier Backward Just-in-Time Temporal Scheduler 1: Plan DAG (Vπ,Eπ)(V_π,E_π), manifest assignments ℳπM_π, conservative latencies ℓ , lifespans Δteff t_eff, epoch t0t_0, deadline TdeadT_dead, latency budget BlatB_lat, concurrency KmaxK_ , guards δexec,δready,ϵguard,ϵskew _exec, _ready, _guard, _skew, grid step τgrid _grid 2: Feasible schedule (σπ,tdispatch)( _π,t_dispatch), Infeasible (certified structural failure), or NotFound (heuristic exhaustion) 3: tCP←ComputeCriticalPath(Vπ,Eπ,ℓ^+ϵguard)t_CP (V_π,E_π, + _guard) 4: tmin←t0+tCP+δreadyt_ ← t_0+t_CP+ _ready; tmax←min(Tdead−δexec,t0+Blat)t_ ← (T_dead- _exec,\;t_0+B_lat) 5: if tmin>tmaxt_ >t_ then 6: return Infeasible ⊳ Structural critical path exceeds deadline or latency budget 7: end if 8: Vmanifest←a∈Vπ∣∃ω,a∈ℳπ(ω)V_manifest←\a∈ V_π ∃ω,a _π(ω)\ ⊳ Tier 1: Fast Parallel Backward-JIT Search 9: for ttarget←tmint_target← t_ to tmaxt_ step τgrid _grid do 10: feasible←feasible 11: Initialize Tlatest(u)←ttarget−δreadyT_latest(u)← t_target- _ready for all u∈Vπu∈ V_π 12: for each u∈Vπu∈ V_π in reverse topological order do 13: Tlatest(u)←min(Tlatest(u),min(u,v)∈Eπσπ(v))T_latest(u)← (T_latest(u),\; _(u,v)∈ E_π _π(v) ) 14: σπ(u)←Tlatest(u)−ℓ^(u)−ϵguard _π(u)← T_latest(u)- (u)- _guard 15: if σπ(u)<t0 _π(u)<t_0 then 16: feasible←feasible ; break ⊳ Insufficient lead time from epoch 17: end if 18: if u∈Vmanifestu∈ V_manifest then 19: Δtmin(u)←minω:u∈ℳπ(ω)min(Δtω,Δt(u)) t_ (u)← _ω:u _π(ω) ( t_ω, t(u)) 20: if ttarget+δexec>σπ(u)+Δtmin(u)−ϵskewt_target+ _exec> _π(u)+ t_ (u)- _skew then 21: feasible←feasible ; break ⊳ Witness receipt expires before window ends 22: end if 23: end if 24: end for 25: if feasiblefeasible then 26: if Kmax=∞∨maxt|u∈Vπ∣σπ(u)≤t<σπ(u)+ℓ^(u)|≤KmaxK_ =∞ _t|\u∈ V_π _π(u)≤ t< _π(u)+ (u)\|≤ K_ then 27: return (σπ,ttarget)( _π,t_target) ⊳ Fast parallel JIT placement succeeds 28: end if 29: end if 30: end for⊳ Tier 2: Authoritative Slack-Aware Temporal Solver 31: if Kmax<∞K_ <∞ then 32: res←AuthTemporal(π,Kmax,tmin,tmax,τgrid)res← AuthTemporal(π,K_ ,t_ ,t_ , _grid) 33: if res≠NotFoundres≠ NotFound then 34: return resres ⊳ Slack-aware serialization succeeds 35: end if 36: end if 37: return NotFound ⊳ Grid search exhausted without valid placement Two-Tier Architecture, Completeness, and Limits. Tier 1 evaluates candidate target dispatch timestamps over Kgrid=⌈(tmax−tmin)/τgrid⌉K_grid= (t_ -t_ )/ _grid discrete breakpoints in reverse topological order, requiring O(Kgrid⋅(|Vπ|+|Eπ|))O(K_grid·(|V_π|+|E_π|)) time. When concurrency is constrained (Kmax<∞K_ <∞) and parallel placement collides, Tier 1 fails conservatively. To prevent heuristic parallel failure from being mistaken for problem infeasibility, Tier 2 activates the Authoritative Temporal Solver (SolveAuthoritativeTemporalSolveAuthoritativeTemporal). For each candidate ttargett_target, Tier 2 establishes the admissible release-due interval [s¯(u),s¯(u)][ s(u), s(u)] for each operation u: s¯(u) s(u) =max(t0,ttarget+δexec+ϵskew−Δtmin(u)), = (t_0,\;t_target+ _exec+ _skew- t_ (u) ), (34) s¯(u) s(u) =ttarget−δready−ℓ^(u)−ϵguard. =t_target- _ready- (u)- _guard. (35) Tier 2 then executes an event-driven forward simulation under KmaxK_ , prioritizing ready operations by minimum slack (s¯(u) s(u)). If slack-aware serialization finds a valid placement, it returns the sound schedule (σπ,ttarget)( _π,t_target). We formally distinguish the levels of completeness and their cut semantics: 1. Soundness: Any schedule returned by Tier 1 or Tier 2 strictly satisfies all precedence, deadline, concurrency (KmaxK_ ), and freshness window constraints. 2. Certified Critical-Path Infeasibility: If the directed critical path of prerequisites exceeds available lead time (tCP+δready>Tdead−t0−δexect_CP+ _ready>T_dead-t_0- _exec), the instance is provably infeasible in continuous time, generating a sound structural Benders cut (47). 3. Finite-Grid Exhaustion vs. Certified Infeasibility: When candidate evaluation over a finite grid τgrid _grid terminates without finding a placement, Algorithm 1 returns NotFound, not certified Infeasible. Under continuous time, feasibility is a single connected interval (Proposition 1); failure of finite-grid heuristic placement cannot prove continuous infeasibility. Crucially, no heuristic failure (NotFound) generates a globally valid Benders cut in the Master ILP. Exact certificates of infeasibility under general concurrency bounds require exhaustive Simple Temporal Network permutation enumeration, as implemented by our Exact Oracle (Section 9.5). Non-manifest operations are excluded from freshness checks, preventing artificial restriction of the dispatch window. 4.4 Robustness to Tail Latency and Staging Protocol Real distributed environments exhibit heavy-tailed execution latencies [6]. Let actual latency be a random variable ℓact(a)∼a _act(a) _a with conservative quantile bound ℓ^(a)=infℓ∣ℙ(ℓact(a)≤ℓ)≥1−αtail (a)= \ ( _act(a)≤ )≥ 1- _tail\. If an unpredicted stall occurs in a long-latency operation aslowa_slow, pushing completion beyond ℓ^(aslow) (a_slow), any short-lived receipts collected earlier may expire before dispatch. To decouple short-lived validity from long-latency variance, AAS employs a Dual-Stage Staging Protocol: 1. Stage 1 (Pre-fetch & Long-Latency Execution): Operations with long validity horizons (Δteff(a)≫ℓ^(a) t_eff(a) (a)) and long latencies are dispatched early. Stochastic completion variance is absorbed while short-lived operations remain dormant. 2. Stage 2 (Synchronization Barrier & JIT Burst): As soon as all Stage 1 operations finish and their receipts are verified, the scheduler locks the exact completion timestamp tsync=maxa∈Vstage1Cπ(a)+δverifyt_sync= _a∈ V_stage1C_π(a)+ _verify. It recomputes target dispatch ttarget=tsync+maxu∈Vjit(ℓ^(u)+ϵguard)+δreadyt_target=t_sync+ _u∈ V_jit( (u)+ _guard)+ _ready and fires all short-lived operations in a tightly synchronized parallel burst. Theorem 2 (Temporal Freshness Invariant under Bounded Latency). Suppose execution latencies are bounded by ℓact(a)≤ℓ^(a) _act(a)≤ (a) for all a∈Vπa∈ V_π. If Algorithm 1 returns a schedule (σπ,tdispatch)( _π,t_dispatch), then (σπ,tdispatch)( _π,t_dispatch) satisfies the common post-schedule validation conditions across both Tier 1 and Tier 2: 1. Release validity: σπ(u)≥t0 _π(u)≥ t_0 for all u∈Vπu∈ V_π. 2. Topological precedence: σπ(u)+ℓ^(u)≤σπ(v) _π(u)+ (u)≤ _π(v) for all (u,v)∈Eπ(u,v)∈ E_π. 3. Lead-time readiness: tdispatch≥σπ(u)+ℓ^(u)+δreadyt_dispatch≥ _π(u)+ (u)+ _ready for all u∈Vπu∈ V_π. 4. Witness freshness: tdispatch+δexec≤σπ(u)+Δtmin(u)−ϵskewt_dispatch+ _exec≤ _π(u)+ t_ (u)- _skew for all manifest operations u∈Vmanifestu∈ V_manifest. 5. Capacity bound: |u∈Vπ∣σπ(u)≤t<σπ(u)+ℓ^(u)|≤Kmax|\u∈ V_π _π(u)≤ t< _π(u)+ (u)\|≤ K_ for all t. 6. Deadline feasibility: tdispatch+δexec≤Tdeadt_dispatch+ _exec≤ T_dead. Consequently, executing π strictly preserves completion-aware dispatch readiness and witness freshness during target execution: tdispatch t_dispatch ≥maxa∈VπCπ(a)+δready,and ≥ _a∈ V_πC_π(a)+ _ready, [tdispatch,tdispatch+δexec] [t_dispatch,\;t_dispatch+ _exec] ⊆⋂e∈WallI(e). _e∈ W_allI(e). Proof. Let (σπ,tdispatch)( _π,t_dispatch) be any schedule returned by Algorithm 1. Both Tier 1 and Tier 2 explicitly gate schedule emission upon satisfying validation conditions (1)–(6). For every operation u∈Vπu∈ V_π, actual completion satisfies Cπ(u)=σπ(u)+ℓact(u)≤σπ(u)+ℓ^(u)C_π(u)= _π(u)+ _act(u)≤ _π(u)+ (u) because execution latency is bounded by ℓ^(u) (u). By validation condition (3), σπ(u)+ℓ^(u)≤tdispatch−δready _π(u)+ (u)≤ t_dispatch- _ready, directly implying tdispatch≥maxu∈VπCπ(u)+δreadyt_dispatch≥ _u∈ V_πC_π(u)+ _ready. Next, for each admitted witness receipt e∈Walle∈ W_all emitted by manifest operation u∈Vmanifestu∈ V_manifest, physical observation occurs at or after start: tobs(e)≥σπ(u)t_obs(e)≥ _π(u). The gateway receipt validity interval is I(e)=[tobs(e)−ϵskew,tobs(e)+Δteff(e)−ϵskew]I(e)=[t_obs(e)- _skew,\;t_obs(e)+ t_eff(e)- _skew]. By condition (3), tdispatch≥σπ(u)+ℓ^(u)≥tobs(e)≥tobs(e)−ϵskewt_dispatch≥ _π(u)+ (u)≥ t_obs(e)≥ t_obs(e)- _skew since ϵskew≥0 _skew≥ 0. By condition (4), tdispatch+δexec≤σπ(u)+Δtmin(u)−ϵskew≤tobs(e)+Δteff(e)−ϵskewt_dispatch+ _exec≤ _π(u)+ t_ (u)- _skew≤ t_obs(e)+ t_eff(e)- _skew. Therefore, [tdispatch,tdispatch+δexec]⊆I(e)[t_dispatch,t_dispatch+ _exec] I(e) holds for every witness receipt e∈Walle∈ W_all, preserving the freshness invariant throughout proposal execution. ∎ Remark 2 (Stochastic Latency Safety Invariant). If realized latency exceeds ℓ^(a) (a), the runtime admission boundary preserves fail-closed freshness under the stated clock and receipt assumptions: it rejects a manifest containing any receipt that expires before tdispatch+δexect_dispatch+ _exec, triggering replanning (Section 7) or refusal. Tail latency can reduce admission availability. Freshness alone does not establish that the underlying physical predicate remains true. 5 Epistemic-Dependency-Aware Scheduling CAC specifies when high-consequence operations require independent witnesses. AAS encodes their declared Epistemic Fault Domain (EFD) dependencies as constraints on witness selection. 5.1 Epistemic Fault Domains and Structural Cuts Let =f1,f2,…,fpF=\f_1,f_2,…,f_p\ denote the set of modeled epistemic fault domains. A fault domain f∈f represents an unobserved, shared point of failure—such as an operating system kernel, a hypervisor, a local network switch, a metrics scraping daemon, an external SaaS API, or a base foundation model. Each assurance operation a∈a has an exposure set (a)⊆X(a) enumerating modeled roots on which its correctness depends. The completed fault basis includes a distinct local root fa∈(a)f_a (a) for each witness operation; shared roots represent correlated dependencies. Its receipts inherit at least this exposure. The gateway unions additional receipt-declared roots with the catalogued set. Safe Default for Unknown Dependencies. If an assurance operation a has an unmapped or unknown dependency structure ((a)=⊥X(a)= or unspecified), it must never default to the empty set ∅ . Setting (a)=∅X(a)= would imply that a is completely immune to all known failure domains (∀C⊆,(a)∩C=∅∀ C ,X(a)∩ C= ), falsely granting the unmapped operation artificial epistemic independence from all other verifiers. Instead, AAS enforces the Conservative Exposure Principle: any operation with unknown shared dependencies is assigned the universal infrastructure exposure set (a)=infra⊆X(a)=F_infra (or F if infrastructure partitions are undefined), in addition to its local root. It cannot establish independence from another witness sharing standard infrastructure. Definition 7 (Epistemic Diversity Cut κE _E). For candidate witness set W and obligation ω, let Γω _ω be its positive kωk_ω-of-|W||W| approval rule. Write min=Wd⊆W:|Wd|=kωW_ =\W_d W:|W_d|=k_ω\ for its minimal decisive coalitions. A root f exposes DW(f)=a∈W:f∈(a)D_W(f)=\a∈ W:f (a)\. Following decision-rule-relative EFD theory [7], define κE(W,Γω)=min|C|: _E(W, _ω)= \\,|C|: C⊆, C , (36) ∃Wd∈min, ∃ W_d _ , Wd⊆⋃f∈CDW(f). W_d _f∈ CD_W(f)\,\. Set the cut to zero if |W|<kω|W|<k_ω. With local roots present, 1≤κE(W,Γω)≤kω1≤ _E(W, _ω)≤ k_ω once a quorum is assigned. Refuting evidence vetoes admission before this positive approval rule is evaluated; arbitrary nonmonotone rules are outside the implemented model. If κE(W,Γω)=1 _E(W, _ω)=1, one root exposes a decisive approval coalition, even if other signatures remain independent. For three independent witnesses the cut is 2 under a 2-of-3 rule and 3 under unanimity. CAC requires κE(W,Γω)≥κEmin(ω) _E(W, _ω)≥ _E (ω). This structural guarantee requires a complete exposure map and a sound causal account of what exposure permits; it does not establish physical predicate truth. 5.2 The Cost-Minimization Vulnerability Standard portfolio optimization and LLM routing algorithms [8, 3] rank verifiers primarily by financial cost and marginal accuracy. In distributed systems, this creates a catastrophic vulnerability: Proposition 2 (Correlated Selection Under Cost Minimization). Let an obligation ω require k affirmative witnesses. Suppose available verifiers partition into two sets: • Correlated cluster corr=v1,…,vmV_corr=\v_1,…,v_m\ (m≥km≥ k) sharing a single common telemetry exporter fproxy∈f_proxy , with per-operation cost bounded by c(vi)≤cmaxc(v_i)≤ c_ . • Independent verifier vindepv_indep with disjoint exposure ((vindep)∩(vi)=∅X(v_indep) (v_i)= ) but higher financial cost satisfying c(vindep)>k⋅cmaxc(v_indep)>k· c_ . Any cost-minimizing scheduler that optimizes cost ∑ic(vi) _ic(v_i) without enforcing κE(W,Γω)≥2 _E(W, _ω)≥ 2 will select k verifiers exclusively from corrV_corr. The resulting witness set has κE(W,Γω)=1 _E(W, _ω)=1 and will be rejected by the admission controller. Proof. Any candidate selection W⊆corrW _corr of size k incurs total cost ∑v∈Wc(v)≤k⋅cmax _v∈ Wc(v)≤ k· c_ . Conversely, any candidate selection W′⊂corr∪vindepW _corr∪\v_indep\ of size k containing vindepv_indep must include vindepv_indep and k−1k-1 other verifiers; since costs are non-negative (c(v)≥0c(v)≥ 0), Cost(W′)=c(vindep)+∑v∈W′∖vindepc(v)≥c(vindep)>k⋅cmax≥Cost(W)Cost(W )=c(v_indep)+ _v∈ W \v_indep\c(v)≥ c(v_indep)>k· c_ (W). Therefore, any cost-minimizing selection strictly chooses k verifiers exclusively from corrV_corr. However, fproxy∩(vi)≠∅\f_proxy\ (v_i)≠ for all vi∈corrv_i _corr. Thus C=fproxyC=\f_proxy\ exposes a decisive coalition, so κE(W,Γω)=1<2 _E(W, _ω)=1<2, causing deterministic gateway rejection. ∎ 5.3 Optimization Architecture: Decomposed Master-Subproblem Solver The joint assurance scheduling problem (Equation (20)) requires simultaneously choosing a witness portfolio satisfying quorums, EFD diversity, and resource budgets, while constructing a feasible temporal schedule (σπ,tdispatch)( _π,t_dispatch) satisfying precedence DopD_op and evidence freshness intervals. Because joint mixed-integer non-linear optimization over continuous time and combinatorial fault cuts is computationally intractable in real-time control loops, AAS adopts a Decomposed Optimization Architecture based on Logic-Based Benders Decomposition (LBBD): 1. Master Selection Problem (0-1 ILP): Solves the combinatorial witness selection and obligation assignment problem, minimizing financial cost subject to quorums, EFD cuts, and hard resource budgets (B$,Btok,BriskB_\$,B_tok,B_risk). 2. Temporal Scheduling Subproblem (Algorithm 1): Solves the continuous backward JIT scheduling pass over the candidate witness assignments ∗y^* and operational DAG G[V∗]G[V^*] under precedence DopD_op and freshness intervals. 3. Sound Conflict Generation & Refinement: If the subproblem detects temporal infeasibility, it distinguishes assignment-induced freshness conflicts from structural precedence bottlenecks, generating provably sound Benders cuts. Operation Roles and Distinctions. To guarantee soundness in cut generation, AAS strictly distinguishes five categories of operations: 1. Selected Operations (V∗=a∣xa=1V^*=\a x_a=1\): Operations committed for execution, which consume financial cost c(a)c(a), tokens tok(a)tok(a), and risk budget ‖ρ(a)‖\|ρ(a)\|. 2. Witness Assignments (∗=(a,ω)∣ya,ω=1y^*=\(a,ω) y_a,ω=1\): Operations whose emitted receipts are actively assigned to discharge obligation ω. Freshness constraints apply only to assigned pairs. 3. Manifest Contributors (Vmanifest=a∈V∗∣∃ω,ya,ω=1V_manifest=\a∈ V^* ∃ω,y_a,ω=1\): The subset of selected operations that produce receipts for the final admission certificate. 4. Precedence Prerequisites (Vprec=AncDop(Vmanifest)∖VmanifestV_prec=Anc_D_op(V_manifest) V_manifest): Operations selected through prerequisite closure that must complete before a manifest contributor can launch, even if they emit no admission receipts. Thus Vprec⊆V∗V_prec V^*. 5. Nonmanifest Operations (Vnonmanifest=V∗∖VmanifestV_nonmanifest=V^* V_manifest): Selected operations whose receipts are unassigned or superseded, including mandatory prerequisites. Their receipt freshness does not constrain dispatch, but their completion and resource use still do. Counterexample: Unsoundness of Operation-Set Conflict Cuts. A naive Benders formulation adds the conflict cut ∑a∈Vconflictxa≤|Vconflict|−1 _a∈ V_conflictx_a≤|V_conflict|-1 whenever portfolio VconflictV_conflict fails temporal scheduling. This cut is unsound: Example 2 (Alternative Witness Relief). Suppose Master ILP selects V∗=a1,a2V^*=\a_1,a_2\ with assignments ya1,ω1=1y_a_1, _1=1 and ya2,ω2=1y_a_2, _2=1. Operation a1a_1 has long latency ℓ^(a1)=8 (a_1)=8 s, but obligation ω1 _1 has a short freshness lifespan Δtω1=3 t_ _1=3 s. The temporal subproblem determines that assigning a1a_1 to ω1 _1 is infeasible ([tmin,tmax]=∅[t_ ,t_ ]= ). If the scheduler appends an operation-set cut xa1+xa2≤1x_a_1+x_a_2≤ 1, it permanently forbids selecting both a1a_1 and a2a_2 in any future solution. Now suppose there exists an alternative operation a3a_3 with short latency ℓ^(a3)=1 (a_3)=1 s that also covers ω1 _1, while operation a1a_1 is also eligible to cover a third obligation ω3 _3 with a generous lifespan Δtω3=45 t_ _3=45 s. Consider the expanded portfolio V′=a1,a2,a3V =\a_1,a_2,a_3\ with reassigned witnesses ya3,ω1=1y_a_3, _1=1, ya2,ω2=1y_a_2, _2=1, and ya1,ω3=1y_a_1, _3=1. This solution is completely feasible and may be cost-optimal! However, the naive cut xa1+xa2≤1x_a_1+x_a_2≤ 1 incorrectly excludes V′V , pruning a valid, optimal solution. The Sound Master Selection ILP. For each operation a∈a and obligation ω∈Ωω∈ , let Eligible(a,ω)⇔∃ε∈ℰω s.t. (ω,ε)∈Cov(a)Eligible(a,ω) ∃ _ω s.t. (ω, ) (a). We formulate the Master ILP under Contract C: min, _x,y ∑a∈c(a)⋅xa _a c(a)· x_a (37) subject to ya,ω≤xa∀a∈,ω∈Ω, y_a,ω≤ x_a ∀ a ,\;ω∈ , (38) xa≤xu∀a∈,∀u∈Prereq(a), x_a≤ x_u ∀ a ,\;∀ u (a), (39) ya,ω=0∀a,ω with ¬Eligible(a,ω), y_a,ω=0 ∀ a,ω with (a,ω), (40) ∑a∈ya,ω≥kω∀ω∈Ω, _a y_a,ω≥ k_ω ∀ω∈ , (41) ∑a:(a)∩C≠∅ya,ω≤kω−1 _a:X(a)∩ C≠ y_a,ω≤ k_ω-1 (42) ∀ω∈Ω,∀C⊂ s.t. |C|<κEmin(ω), ∀ω∈ ,\;∀ C s.t. |C|< _E (ω), ∑a∈c(a)⋅xa≤B$, _a c(a)· x_a≤ B_\$, (43) ∑a∈tok(a)⋅xa≤Btok, _a tok(a)· x_a≤ B_tok, (44) ∑a∈‖ρ(a)‖⋅xa≤Brisk, _a \|ρ(a)\|· x_a≤ B_risk, (45) ∑(a,ω)∈Aconflictya,ω≤|Aconflict|−1 _(a,ω)∈ A_conflicty_a,ω≤|A_conflict|-1 (46) ∀Aconflict∈assign, ∀ A_conflict _assign, ∑a∈Vchainxa≤|Vchain|−1 _a∈ V_chainx_a≤|V_chain|-1 (47) ∀Vchain∈chain, ∀ V_chain _chain, xa∈0,1,ya,ω∈0,1∀a∈,ω∈Ω. x_a∈\0,1\,\;y_a,ω∈\0,1\ ∀ a ,\;ω∈ . (48) The diversity row forbids any fault set smaller than the required cut from exposing kωk_ω assigned witnesses. The implementation synthesizes local roots for exact validation. In the master ILP it enumerates shared-root rows: a local root can be replaced by a declared shared root of the same witness without shrinking the exposed set, while local roots alone cannot expose a quorum with fewer than kωk_ω failures. Thus the omitted local rows are redundant when the required threshold is at most kωk_ω. Formulation and Cut Semantics. • Exact Financial and Prerequisite Accounting: Constraint (38) links witness assignments to operation selection, while Constraint (39) enforces transitive operational prerequisite closure (xa≤xux_a≤ x_u). This guarantees that selecting an operation automatically forces the selection of all required predecessor operations, charging each operation c(a)c(a) exactly once in objective (37) and budget (43), regardless of multi-obligation witness coverage (∑ωya,ω≥2 _ωy_a,ω≥ 2). • Assignment-Aware No-Good Cuts (assignK_assign): When temporal scheduling fails due to evidence expiration or lack of freshness intersection, the authoritative subproblem isolates the certified minimal conflicting assignments Aconflict=(a,ω)∣ya,ω∗=1 active in conflictA_conflict=\(a,ω) y_a,ω^*=1 active in conflict\. Constraint (46) eliminates this specific assignment without forbidding operations in AconflictA_conflict from being selected or reassigned to other obligations. When heuristic placement exhausts without certified proof (NotFound), the solver applies a safe full-candidate combinatorial no-good cut (∑a:xa∗=1(1−xa)+∑a:xa∗=0xa≥1 _a:x_a^*=1(1-x_a)+ _a:x_a^*=0x_a≥ 1) to avoid over-pruning alternative witness assignments. • Precedence-Chain Structural Cuts (chainK_chain): When failure is caused by an unavoidable directed precedence chain Vchain⊆V_chain in DopD_op whose cumulative conservative latency exceeds available deadline: ∑u∈Vchain(ℓ^(u)+ϵguard)+δready+δexec>Tdead−t0, _u∈ V_chain( (u)+ _guard)+ _ready+ _exec>T_dead-t_0, (49) latency monotonicity guarantees that any portfolio containing VchainV_chain is temporally infeasible. Only in this structural case is the operation-level cut (47) valid. Financial Optimization Scope and Consequential Coordination. The Master ILP objective (37) minimizes the direct financial cost Cost(π)=∑a∈c(a)xaCost(π)= _a c(a)x_a. When all assurance operations in A are non-consequential (ρ(a)≺τΠρ(a) _ ), direct cost equals total cost: Costtotal(π)=Cost(π)Cost_total(π)=Cost(π) (Section 3). When consequential operations require diagnostic sub-plans (Section 6), cost optimization has two cases: 1. Statically Modeled / Flattened Instances: If candidate diagnostic trees are fully expanded and flattened into the catalog A with their prerequisites, risks, and shared costs accounted for, the Master ILP jointly minimizes CosttotalCost_total. 2. Runtime Consequential Coordination: In dynamic systems where diagnostic sub-plans are synthesized recursively at runtime via local risk stratification (Algorithm 3), the static Master ILP optimizes direct operational cost, while recursive admission coordinates sub-plan synthesis and budget reservation dynamically. We note that direct-cost minimization does not guarantee joint consequential optimality without flattening: Example 3 (Cheap Verifier with Expensive Diagnostics). Suppose obligation ω can be satisfied by either a1a_1 (c(a1)=$1.00c(a_1)=\$1.00, but consequential with diagnostic sub-plan πa1 _a_1 costing c(πa1)=$100.00c( _a_1)=\$100.00) or a2a_2 (c(a2)=$5.00c(a_2)=\$5.00, non-consequential with c(πa2)=$0.00c( _a_2)=\$0.00). A static optimizer minimizing only direct cost strictly selects a1a_1 ($1.00 vs. $5.00). Upon runtime admission, a1a_1 admits its diagnostic sub-plan, yielding total cost Costtotal=$101.00≫$5.00Cost_total=\$101.00 \$5.00. While shadow reservation ledgers prevent budget overruns, global cost-optimality CosttotalCost_total requires pre-flattening diagnostic expansions into A. Decomposition Interface, Convergence, and Optimality. The master-subproblem solver operates in an iterative loop: 1. Solve Master ILP (37)–(48). If infeasible, terminate with safe refusal (Πadm()=∅ _adm(P)= ). 2. Pass candidate assignments ∗y^* and operational DAG G[V∗∪AncDop(V∗)]G[V^* _D_op(V^*)] to the Authoritative Temporal Solver (Algorithm 1). 3. If the temporal solver returns a valid schedule (σπ,tdispatch)( _π,t_dispatch), terminate. Plan π is prospectively admissible. 4. If the temporal solver proves Infeasible: • If the critical path of an induced precedence chain exceeds Tdead−t0−δexecT_dead-t_0- _exec, append structural cut (47) to chainK_chain. • Otherwise, when certified by the exact oracle, isolate minimal conflicting witness assignments Aconflict⊆∗A_conflict ^* and append assignment cut (46) to assignK_assign. If heuristic search exhausts without certified proof (NotFound), append a safe full-candidate combinatorial no-good cut to avoid unsound pruning of unvisited assignments. Return to Step 1. Theorem 3 (Convergence and Conditional Global Optimality). The decomposed LBBD algorithm terminates in a finite number of iterations. Furthermore, for any fully modeled or flattened problem P, if the master solver executes to completion without timeout (Tctrl=∞T_ctrl=∞) and the subproblem is evaluated authoritatively via an exact temporal oracle (Section 9.5), the returned plan π∗π^* is globally cost-optimal over all prospectively admissible plans: Cost(π∗)=min∑a∈Vπ∈Πadm()c(a).Cost(π^*)= _π∈ _adm(P) _a∈ V_πc(a). (50) When evaluated under bounded concurrency Kmax<∞K_ <∞ with the polynomial-time slack-priority heuristic, or upon solver timeout Tctrl<∞T_ctrl<∞, the returned plan is approximately optimized and prospectively feasible, with no claim of global optimality. Dynamic consequential sub-plans admitted at runtime are coordinated outside this static optimality guarantee. Proof. The assignment space 0,1||×|Ω|\0,1\^|A|×| | and portfolio space 2||2^|A| are finite. Each iteration generates either an assignment cut (46) (or safe full-candidate cut) that prunes at least one integer assignment vector ∗y^* or a structural cut (47) that prunes at least one operation subset. Both cut families are sound: structural cuts prune operation subsets whose topological critical path latency strictly exceeds the deadline window (tCP+δready>Tdead−t0−δexect_CP+ _ready>T_dead-t_0- _exec), while assignment cuts prune certified conflicting witness assignments. When subproblem feasibility is determined via exact temporal search, no prospectively admissible plan π∈Πadm()π∈ _adm(P) is ever falsely pruned. Because the Master ILP optimizes the exact linear cost objective ∑ac(a)xa _ac(a)x_a over an admissible outer relaxation, the first verified feasible candidate achieves global cost optimality over the flattened instance P. ∎ 5.4 Complexity and EFD Cut Separation To understand the computational tractability of AAS, we rigorously distinguish four related problem variants: 1. Checking Diversity of a Fixed Witness Set: Given W⊆W and threshold h, determining whether κE(W,Γω)≥h _E(W, _ω)≥ h requires checking that each C⊆C with |C|<h|C|<h exposes fewer than kωk_ω assigned witnesses. For fixed h, there are O(||h−1)O(|F|^h-1) candidates and each check costs O(|W|h)O(|W|h). 2. Separating Violated ILP Diversity Cuts: Given candidate assignments (,)(x,y), finding a violated cut C for Constraint (42) requires evaluating the O(||k−1)O(|F|^k-1) candidate fault sets. For k=2k=2, |C|=1|C|=1, so there are only |||F| cuts per obligation, which can be instantiated statically! 3. Unbounded Cut Computation: Finding a minimum root coalition exposing a decisive quorum generalizes set-cover variants and is NP-hard for arbitrary thresholds [9]. Small fixed thresholds (h∈2,3h∈\2,3\) permit polynomial-time checking. 4. The ASP Decision Problem: Selecting a minimum-cost witness set satisfying multi-obligation coverage and quorums is NP-hard. Theorem 4 (NP-Hardness of ASP Decision Problem). The decision version of the Assurance Scheduling Problem (ASP-DEC)—determining whether there exists a prospectively admissible plan π⊧prosπ _prosP with financial cost Cost(π)≤KCost(π)≤ K—is NP-hard, even in the absence of precedence constraints (Dop=∅D_op= ) and with unit operation latencies. Proof Sketch. We establish a polynomial-time reduction from Minimum Weight Set Cover to ASP-DEC. Given universe =u1,…,unU=\u_1,…,u_n\ and candidate subsets =S1,…,SmS=\S_1,…,S_m\ with weights w(Sj)w(S_j), we map each universe element uiu_i to an obligation ωi∈Ω _i∈ and each subset SjS_j to an assurance operation aj∈a_j with cost c(aj)=w(Sj)c(a_j)=w(S_j) and coverage Cov(aj)=(ωi,ε)∣ui∈SjCov(a_j)=\( _i, ) u_i∈ S_j\. Setting unit quorums, a set cover of weight at most K exists if and only if there exists an admissible plan of cost at most K. Full bidirectional reduction and equivalence proofs are given in Appendix A. ∎ 5.5 Progress-Based Greedy Fallback Heuristic When the controller computation budget is constrained (Tctrl<5T_ctrl<5 ms), AAS executes an efficient Progress-Based Marginal Score Heuristic: For an active partial plan with selected operations VπV_π and assigned witnesses Wω⊆VπW_ω V_π, define the provisional cut κ~E(W,ω)=κE(W,Γmin(kω,|W|)) κ_E(W,ω)= _E(W, _ (k_ω,|W|)) for nonempty W, and zero for empty W. This provisional score rewards distinct roots while a quorum is assembled; admission always checks the fixed rule Γω _ω. 1. Quorum Progress: Δ(a,ω)=1 (a,ω)=1 if Eligible(a,ω)Eligible(a,ω) and |Wω|<kω|W_ω|<k_ω; 0 otherwise. 2. Diversity Progress: Δκ(a,ω)=max(0,min(κ~E(Wω∪a,ω),κEmin(ω))−κ~E(Wω,ω)) κ(a,ω)= (0,\; ( κ_E(W_ω∪\a\,ω), _E (ω))- κ_E(W_ω,ω)). 3. Marginal Cost: If a∈Vπa∈ V_π, c~(a)=0 c(a)=0; if a∉Vπa∉ V_π, c~(a)=c(a) c(a)=c(a). 4. Temporal Feasibility Guard: temp(a)=11_temp(a)=1 if adding a to VπV_π preserves a feasible JIT completion window within remaining latency and deadline bounds; 0 otherwise. At each iteration, the heuristic selects: a∗=argmaxa:temp(a)=1∑ω∈Ω[Δ(a,ω)+λκΔκ(a,ω)]c~(a)+ϵ,a^*= _a:1_temp(a)=1 _ω∈ [ (a,ω)+ _κ κ(a,ω) ] c(a)+ε, (51) where λκ>0 _κ>0 weights fault-cut diversity relative to quorum count. The reference heuristic computes the exact provisional cut by enumerating root coalitions up to min(kω,|Wω|+1) (k_ω,|W_ω|+1); with local roots, its worst-case enumeration is O((||+|Wω|)kω)O((|F|+|W_ω|)^k_ω) for bounded quorum size. It may fail after choosing an unfavorable quorum; it is not a completeness guarantee. Example 4 (Greedy Heuristic Execution Trajectories). To illustrate heuristic behavior under trade-offs: • Quorum vs. EFD Diversity: Suppose obligation ω1 _1 requires quorum kω1=2k_ _1=2 and diversity κEmin=2 _E =2. Let current witness set be W=a1W=\a_1\ with exposure (a1)=f1X(a_1)=\f_1\. Candidate acheapa_cheap (c=$0.01c=\$0.01) has exposure f1\f_1\, while candidate aindepa_indep (c=$0.03c=\$0.03) has exposure f2\f_2\. Candidate acheapa_cheap yields Δ=1 =1, but κ~E(a1,acheap,ω1)=1 κ_E(\a_1,a_cheap\, _1)=1 (since f1\f_1\ hits both), so Δκ=0 κ=0. Its score is 1/(0.01+ϵ)≈1001/(0.01+ε)≈ 100. Candidate aindepa_indep yields Δ=1 =1 and Δκ=1 κ=1. With λκ=3 _κ=3, its score is (1+3)/(0.03+ϵ)≈133(1+3)/(0.03+ε)≈ 133. The heuristic strictly prefers the independent verifier aindepa_indep, successfully steering away from the correlated trap. • Diversity vs. Temporal Deadlines: Suppose obligation ω2 _2 requires diversity κEmin=2 _E =2. Candidate asolvera_solver provides perfect epistemic diversity (Δκ=1 κ=1), but is a heavy formal model checker requiring conservative latency ℓ^(asolver)=8 (a_solver)=8 s. If the remaining deadline budget is Tdead−tnow=5T_dead-t_now=5 s, Backward JIT scheduling detects that asolvera_solver cannot complete before dispatch. The temporal guard evaluates temp(asolver)=01_temp(a_solver)=0, immediately pruning asolvera_solver from consideration and preventing a dead-end plan commitment. 6 Recursive and Consequential Acquisition The CAC paper [1] identifies a remediation-liveness problem: a diagnostic action may require another diagnostic action to be admitted first. Budget bounds alone do not ensure progress. We give graph and risk conditions for finite diagnostic expansion and state the additional assumptions needed for operational liveness. 6.1 When Evidence Acquisition is Consequential Not all evidence acquisition is passive telemetry scraping. In real-world distributed architectures, establishing that a complex predicate holds often requires active systems probing: • Storage Rollback Validation: Freezing a database tablespace and mounting a copy-on-write snapshot to verify point-in-time recovery. • Network Isolation Verification: Injecting synthetic probe traffic or testing border gateway BGP route filtering. • Failover Readiness: Initiating an ephemeral dry-run transition on an auxiliary standby replica. Under CAC, any action whose modeled operational risk equals or exceeds the policy threshold τΠ _ is classified as consequential: ρ(a)⪰τΠ⟹a is consequential.ρ(a) _ a is consequential. (52) Because the execution gateway completely mediates all infrastructure interactions, a consequential diagnostic operation a∈a cannot bypass the admission boundary. The gateway will reject a unless presented with a valid admission certificate aC_a satisfying its own obligations ΩΠ(a,s) _ (a,s). Target Action q(Primary Failover)ωlag _lag (Lag)ωrb _rb (Rollback Feasibility)atelemetrya_telemetry(Passive scrape)asnapa_snap (Snapshot Probe)Consequential (ρ(a2)⪰τΠρ(a_2) _ )Ω(a2) (a_2)(Quiescence Verification)alocka_lock (Flush & Check)Recursive CAC Figure 3: The Assurance Dependency Graph (ADG). Consequential diagnostic action asnapa_snap requires its own admission obligations Ω(asnap) (a_snap), spawning recursive sub-scheduling. 6.2 The Assurance Dependency Graph (ADG) This recursive dependency induces a directed bipartite graph of alternating actions and obligations (Figure 3): Definition 8 (Assurance Dependency Graph (ADG)). The Assurance Dependency Graph ADG=(A∪Ω,ℰ)G_ADG=(V_A _ ,E) is a directed bipartite graph where: • A⊆∪qV_A ∪\q\ are action nodes, • Ω⊆⋃u∈AΩ(u)V_ _u _A (u) are obligation nodes, • Edge (u,ω)∈ℰ(u,ω) indicates that action u requires obligation ω, • Edge (ω,a)∈ℰ(ω,a) indicates that operation a is scheduled to produce a witness discharging ω. Without formal safeguards, recursive acquisition risks two structural pathologies: 1. Cyclic Admission Deadlock: Operation a1a_1 requires evidence from a2a_2, while a2a_2 requires evidence from a1a_1 (e.g., verifying replication requires snapshot lock, while snapshot lock requires replication sync). 2. Infinite Remediation Regress: Each diagnostic probe requires a further diagnostic probe of equal or greater consequence, depleting budgets without reaching base evidence. 6.3 Structural Acyclicity and Bounded Expansion To prevent cyclic dependencies and infinite regress during plan synthesis, AAS enforces a Risk Stratification Discipline. Definition 9 (Strict Risk Stratification of Finite Height). Let ≺ℛ _R be a strict partial order on the risk space ℛR with finite height Hℛ=height(ℛ)<∞H_R=height(R)<∞ (i.e., every strictly descending chain has length at most HℛH_R). An admission policy is strictly risk-stratified if, for every consequential action u, any diagnostic action a invoked to discharge ω∈Ω(u)ω∈ (u) satisfies: ρ(a)≺ℛρ(u).ρ(a) _Rρ(u). (53) Furthermore, non-consequential operations form a base stratum ℛbase=a∈∣ρ(a)≺τΠR_base=\a ρ(a) _ \ whose obligations are empty by policy definition: ∀a∈ℛbase,Ω(a)=∅∀ a _base, (a)= . Proposition 3 (Structural Acyclicity of the ADG). If an admission policy Π is strictly risk-stratified, then the Assurance Dependency Graph ADGG_ADG is a directed acyclic graph (DAG). Proof. Suppose for contradiction that ADGG_ADG contains a directed cycle: u1→ω1→u2→ω2→⋯→um→ωm→u1u_1→ _1→ u_2→ _2→·s→ u_m→ _m→ u_1. By Definition 9, every composite step ui→ωi→ui+1u_i→ _i→ u_i+1 implies ρ(ui+1)≺ℛρ(ui)ρ(u_i+1) _Rρ(u_i). By transitivity of the strict partial order, ρ(u1)≺ℛρ(u1)ρ(u_1) _Rρ(u_1), contradicting irreflexivity. Thus ADGG_ADG contains no directed cycles. ∎ Proposition 4 (Bounded Recursive Expansion of Bipartite ADG). Assume admission policy Π is strictly risk-stratified of finite height Hℛ=height(ℛ)<∞H_R=height(R)<∞. Let KΩ=maxu∈∪q|Ω(u)|<∞K_ = _u ∪\q\| (u)|<∞ be the maximum number of obligations per action, and let each obligation require at most Kinst<∞K_inst<∞ concrete action instances dynamically instantiated from capability templates capT_cap (Kinst≤|cap|⋅KinstperK_inst≤|T_cap|· K_inst^per). Then: 1. The maximum action-recursion depth of ADGG_ADG is strictly bounded by the ordering height: depthA(ADG)≤Hℛ<∞depth_A(G_ADG)≤ H_R<∞. 2. The effective action branching factor is finite: Bact≤KΩ⋅Kinst<∞B_act≤ K_ · K_inst<∞. 3. The total number of concrete action nodes AV_A in the expanded ADG is strictly bounded by the sum: MA=|A|≤∑d=0HℛBactd=1if Bact=0,Hℛ+1if Bact=1,BactHℛ+1−1Bact−1if Bact>1,M_A=|V_A|≤ _d=0^H_RB_act^d= cases1&if B_act=0,\\ H_R+1&if B_act=1,\\ B_act^H_R+1-1B_act-1&if B_act>1, cases (54) where MA<∞M_A<∞ in all cases. The total number of obligation nodes satisfies |Ω|≤KΩ⋅MA<∞|V_ |≤ K_ · M_A<∞. Proof. Every directed path of action nodes in bipartite graph ADGG_ADG corresponds to a strictly descending sequence of risk values ρ(u0)≻ℛρ(u1)≻ℛ⋯≻ℛρ(ud)ρ(u_0) _Rρ(u_1) _R·s _Rρ(u_d) alternating through obligation nodes ωi∈Ω(ui−1) _i∈ (u_i-1). Because (ℛ,≺ℛ)(R, _R) has finite height HℛH_R, any such chain contains at most HℛH_R action transitions. Each action node expands into at most KΩK_ obligation nodes, each of which links to at most KinstK_inst candidate diagnostic actions, establishing branching factor Bact≤KΩ⋅KinstB_act≤ K_ · K_inst. Summing action nodes across depths 0≤d≤Hℛ0≤ d≤ H_R yields the geometric sum (54). Leaves terminate in non-consequential base actions ℛbaseR_base with Ω(a)=∅ (a)= , terminating expansion in finite steps. ∎ 6.4 Operational Diagnostic Liveness We emphasize an essential systems distinction: structural acyclicity and bounded expansion do not automatically imply operational termination during physical execution. A structurally acyclic plan may still hang at runtime due to unhandled controller delays, unbounded retries, deadlock on shared physical locks, or event-loop stalls. To establish operational liveness, AAS couples risk stratification with six explicit systems execution bounds: Theorem 5 (Conditional Operational Diagnostic Liveness). Assume an admission policy is strictly risk-stratified of finite height Hℛ<∞H_R<∞ with bounded concrete instances Bact<∞B_act<∞, yielding an expanded ADG of at most MAM_A actions. Diagnostic evidence acquisition is guaranteed to terminate deterministically in finite wall-clock elapsed time—either minting certificate qC_q or safely refusing proposal q—provided the distributed runtime satisfies: 1. Bounded Operation Latency: Every executed operation a∈a has an enforced wall-clock timeout ℓ^(a)≤ℓ^max<∞ (a)≤ _ <∞. 2. Bounded Cancellation and Cleanup Delay: Transmitting cancellation signals and terminating an in-flight worker thread requires at most δcancel<∞ _cancel<∞ time, and controller state cleanup requires at most δcleanup<∞ _cleanup<∞ time. 3. Bounded Controller Computation: Every invocation of the plan synthesizer, ILP solver, or replanning monitor terminates within controller computation timeout Tctrl<∞T_ctrl<∞ (falling back to greedy heuristic or refusal upon timeout). 4. Finite Retry and Generation Limits: The controller permits at most Nretrymax<∞N_retry <∞ adaptive repair or retry attempts across the entire lifecycle of proposal q. 5. Deadlock-Free Resource and RPC Execution: Mutating locks or physical hardware mutexes required by concurrent diagnostic operations are acquired in a canonical total order and released within bounded time δrel<∞ _rel<∞ (or executed in copy-on-write sandboxes). All remote RPCs and network verifiers enforce non-blocking socket timeouts ℓ^max _ , preventing unbounded waiting on external queues. 6. Non-Blocking Event Loop & Epoch-Relative Deadline Abort: The controller event loop never blocks indefinitely awaiting external messages; if physical wall-clock time reaches proposal deadline TdeadT_dead, all active workers are cancelled, state is reconciled, and the workflow deterministically aborts via safe refusal. Under these conditions, the total elapsed wall-clock time TtermT_term from scheduling epoch t0t_0 until complete system quiescence (all worker threads terminated and resources released) is strictly bounded by: Tterm≤min(CLOSE T_term≤ ( (Tdead−t0)+δcancel+δcleanup, (T_dead-t_0)+ _cancel+ _cleanup, (55) (Nretrymax+1)⋅Tctrl (N_retry +1)· T_ctrl +(Nretrymax+1)⋅MA⋅(ℓ^max+δrel) +(N_retry +1)· M_A·( _ + _rel) +Nretrymax⋅(δcancel+δcleanup))<∞. +N_retry ·( _cancel+ _cleanup) )<∞. Proof. By Proposition 4, the number of actions in any synthesized plan DAG is bounded by MA<∞M_A<∞. Under condition (5), diagnostic operations cannot deadlock on shared physical mutexes or block indefinitely on remote RPCs. Under condition (1), every launched operation either finishes or times out in at most ℓ^max _ . If an operation fails, times out, or refutes a predicate, condition (2) guarantees that cancellation halts all in-flight workers within δcancel _cancel and controller cleanup finishes within δcleanup _cleanup. Under condition (3), each scheduling pass completes in at most TctrlT_ctrl wall-clock time. Because condition (4) limits the number of repair attempts to NretrymaxN_retry , the controller can execute at most Nretrymax+1N_retry +1 planning phases (1 initial synthesis plus at most NretrymaxN_retry repairs) and at most NretrymaxN_retry cancellation/cleanup cycles before aborting. Finally, condition (6) enforces an absolute hard stop when wall-clock time reaches TdeadT_dead, with in-flight worker cancellation and cleanup completing within δcancel+δcleanup _cancel+ _cleanup after the deadline. Hence, the system cannot livelock, deadlock, or stall indefinitely, guaranteeing deterministic termination within bound (55). ∎ 6.5 Bounded Diagnostic Capabilities In high-throughput environments, deep recursive admission introduces unacceptable latency overhead. AAS supports Bounded Diagnostic Capabilities: pre-authorized, ephemeral execution tokens with strictly constrained blast radiuses (e.g., read-only filesystem snapshots, dedicated diagnostic tenant namespaces, or sandboxed eBPF probes). When an operation executes using a certified diagnostic capability, its effective operational risk is pre-attenuated below the policy threshold: ρeff(a)≺τΠ _eff(a) _ . This places a immediately in the base stratum ℛbaseR_base, collapsing the ADG depth to 1 and eliminating recursive overhead. 7 Adaptive Replanning Under Partial Information Static workflow planners assume that the environment remains stationary while an evidence plan executes. In reality, evidence acquisition is an active discovery process: acquiring evidence updates the controller’s knowledge of the world, which can fundamentally alter both the perceived risk of the action and the obligations required to admit it. Initial CAC Evaluation ρ0=ρ(q,s0)⟹Ω0=FΠ(ρ0,q,s0) _0=ρ(q,s_0) _0=F_ ( _0,q,s_0) AAS Dynamic Scheduler Synthesize & dispatch plan π0 _0 Execute Assurance Op a1a_1 Returns receipt e1e_1 State Update & Risk Shift s1=Update(s0,e1)⟹ρ1=ρ(q,s1)s_1=Update(s_0,e_1) _1=ρ(q,s_1) CAC Obligation Escalation Ω1=FΠ(ρ1,q,s1) _1=F_ ( _1,q,s_1) with ΔΩ+=Ω1∖Ω0 ^+= _1 _0 Dynamic Replan:Splice Δπ π Figure 4: The closed-loop adaptive assurance cycle. Incoming evidence updates system state s, triggering risk escalation ρ0→ρ1 _0→ _1 and online schedule replanning. 7.1 Risk Dynamics and Obligation Escalation Consider the execution timeline illustrated in Figure 4: 1. At t0t_0, the controller observes state snapshot s0s_0 and evaluates baseline risk ρ0=ρ(q,s0) _0=ρ(q,s_0). The policy emits obligations Ω0=FΠ(ρ0,q,s0) _0=F_ ( _0,q,s_0). 2. The scheduler constructs plan π0 _0 and dispatches an initial operation a1a_1 (e.g., query replica replication stream). 3. Operation a1a_1 completes, returning evidence receipt e1e_1. The payload of e1e_1 reveals that the secondary replica has accumulated 45 GB of unapplied Write-Ahead Logs (WAL) and disk I/O throughput is severely degraded. 4. The world state updates to s1=Update(s0,e1)s_1=Update(s_0,e_1). Under this degraded condition, observational uncertainty and adverse consequence plausibility increase, shifting the risk profile: ρ1=ρ(q,s1)withρ1⋠ρ0. _1=ρ(q,s_1) _1 _0. (56) 5. The admission engine re-evaluates obligations under updated risk ρ1 _1: Ω1=FΠ(ρ1,q,s1). _1=F_ ( _1,q,s_1). (57) Because risk increased, Ω1 _1 contains new mandatory obligations: ΔΩ+=Ω1∖Ω0≠∅, ^+= _1 _0≠ , (58) such as requiring an attestation of secondary memory headroom or escalating to human dual-control. If the scheduler executed π0 _0 blind to environment updates, it would arrive at the gateway with an evidence manifest satisfying Ω0 _0 but lacking ΔΩ+ ^+, resulting in an immediate rejection and wasted work. 7.2 Authoritative Runtime State Machine Σ To ensure sound execution across asynchronous events, AAS defines a single authoritative runtime state Σ : Σ=⟨ = q,s,ρ,Ω,g,π,Brem,Bcommit,Bresv, q,s,ρ, ,g,π,B_rem,B_commit,B_resv, (59) run,Vdone,Estore,q,tdispatch,Tdead⟩, _run,V_done,E_store,W_q,t_dispatch,T_dead , where: • q is the active action proposal, • s is the modeled environment state (with version vector νs _s), • ρ=ρ(q,s)ρ=ρ(q,s) is current evaluated operational risk, • Ω=FΠ(ρ,q,s) =F_ (ρ,q,s) is the active mandatory obligation set, • g∈ℕg is the monotonically increasing plan generation tag, • π=⟨Vπ,Eπ,σπ,ℳπ⟩π= V_π,E_π, _π,M_π is the active plan DAG stamped with generation g, • Brem,Bcommit,BresvB_rem,B_commit,B_resv partition total resource budgets, • runJ_run is the set of currently executing worker jobs ⟨a,ga,tlaunch,ℓ^(a)⟩ a,g_a,t_launch, (a) , • VdoneV_done is the set of terminated operations, • EstoreE_store is the pool of verified evidence receipts, • qW_q is the candidate witness manifest, • tdispatcht_dispatch is the prospective gateway dispatch target timestamp, • TdeadT_dead is the proposal hard wall-clock deadline. 7.3 Ten-State Operation Lifecycle Across Plan Generations Every scheduled operation a∈a transitions through an explicit 10-state lifecycle: Reserved Reserved ⟶Ready⟶Running Ready Running (60) ⟶Completed,Failed,TimedOut \ Completed, Failed, TimedOut\ ⟶CancelReq→CancelConf \ CancelReq→ CancelConf\ ⟶Superseded,Reconciled \ Superseded, Reconciled\ 1. Reserved: Budget is set aside (Brem→BresvB_rem→ B_resv); operational prerequisites are executing. 2. Ready: Prerequisites in DopD_op have terminated; awaiting scheduled start time σπ(a) _π(a). 3. Running: Launched into an asynchronous worker thread; tagged with current generation g; financial cost committed (Bresv→BcommitB_resv→ B_commit) exactly once. 4. Completed: Finished execution within timeout ℓ^(a) (a); emitted receipts ingested into EstoreE_store. 5. Failed: Threw an unhandled software exception or network connection failure. 6. TimedOut: Wall-clock elapsed time exceeded ℓ^(a) (a) without completion; worker is sent an abort signal. 7. CancelRequested: Cancellation signal dispatched due to plan replacement or affirmative refutation. 8. CancelConfirmed: Remote worker confirmed thread termination and resource cleanup. 9. Superseded: The active plan generation advanced (g′>g >g) before or during execution; the operation’s witness role in qW_q is revoked, but its physical state side-effects are preserved. 10. Reconciled: Terminal accounting complete; any genuine unspent reservations returned to BremB_rem. Handling Seven Asynchronous Runtime Scenarios. The controller state machine resolves race conditions via strict semantic rules: 1. Diagnostic Completing Post-Supersession: If an operation launched in generation g completes when the active generation is g′>g >g, its receipts are not automatically assigned to the new manifest qW_q. However, any physical telemetry or state mutation in its payload is incorporated into environment state s. 2. Multi-Receipt Operations: An operation producing multiple receipts emits them all into EstoreE_store, but financial cost c(a)c(a) is charged strictly once upon launch into BcommitB_commit. 3. Cancellation Racing with Completion: If completion arrives before cancellation confirmation, the operation is marked Completed and receipts are ingested. If cancellation confirms first, the operation enters CancelConfirmed, receipts are discarded, and unspent reservations are refunded. 4. Timed-Out Operations Continuing Remotely: An operation marked TimedOut cannot resurrect its witness role if late output arrives; its results are treated as discardable. 5. Non-Rollback Mutations: If a consequential diagnostic mutates external state and subsequent admission fails, the state change is retained in s, and compensation actions are scheduled via TCT. 6. Earlier-Generation Evidence: Receipts acquired in earlier generations remain in EstoreE_store and are eligible for reuse if they satisfy version match G(e)=s|G(e)G(e)=s|_G(e) and freshness against the repaired dispatch target. 7. New Obligations at Minting Boundary: Handled via atomic Compare-And-Swap (CAS) on state version νs _s; if state changed while minting, the certificate is discarded and replanning is re-entered. 7.4 Atomic Incremental Plan Repair Transaction Algorithm 2 formalizes how state Σ transitions upon an asynchronous event without corrupting plan generation invariants or masking real-world state mutations. To maintain physical and algorithmic integrity, AAS strictly distinguishes: 1. Irreversible Physical Effects: Actual mutations in external systems, hardware state, or non-refundable financial/token expenditure. These effects are authoritatively reflected in Σ.s .s and Σ.Bcommit .B_commit and are never rolled back merely because replacement plan synthesis fails. 2. Authoritative Environment State (Σ.s .s): The true, known state of the physical world. 3. Tentative Repair State: Shadow evaluations of risk ρcand _cand and active obligations Ωlive _live. 4. Candidate Schedule (Δπ,tdispatch′ π,t _dispatch): The prospective replacement sub-plan. 5. Candidate Reservations (Bresvcand,BremcandB_resv^cand,B_rem^cand): Tentative resource ledger allocations. Plan repair executes as a structured PREPARE–VALIDATE–COMMIT transaction: Algorithm 2 Atomic Adaptive Plan Repair Transaction 1: Runtime state Σ , triggering event ℰE, wall-clock time tnowt_now 2: Updated state Σ or Abort 3: ⊳ Phase I: Authoritative Physical State Reconciliation 4: if ℰE carries irreversible physical mutations then 5: Σ.s←ApplyPhysicalEffects(Σ.s,ℰ) .s ( .s,E) ⊳ Authoritative physical state updated 6: end if 7: if ℰE is Affirmative Refutation then 8: CancelAll(Σ.run)CancelAll( .J_run); refund unspent Bresv→BremB_resv→ B_rem 9: return Abort(Predicate Refuted) Abort(Predicate Refuted) 10: end if 11: ⊳ Phase I: PREPARE (Shadow State & Tentative Ledgers) 12: ρcand←ρ(Σ.q,Σ.s) _cand←ρ( .q, .s); Ωlive←FΠ(ρcand,Σ.q,Σ.s) _live← F_ ( _cand, .q, .s) 13: Let ΔΩ+←Ωlive∖Σ.Ω ^+← _live . and ΔΩ−←Σ.Ω∖Ωlive ^-← . _live 14: Vcand←Σ.VπV_cand← .V_π; Bremcand←Σ.BremB_rem^cand← .B_rem; Bresvcand←Σ.BresvB_resv^cand← .B_resv 15: for each unlaunched u∈Σ.Vπu∈ .V_π witnessing only ΔΩ− ^- do 16: Vcand←Vcand∖uV_cand← V_cand \u\; Bremcand←Bremcand+c(u)B_rem^cand← B_rem^cand+c(u); Bresvcand←Bresvcand−c(u)B_resv^cand← B_resv^cand-c(u) 17: end for 18: Ereusable←e∈Σ.Estore∣G(e)=Σ.s|G(e)∧¬e.refutedE_reusable←\e∈ .E_store G(e)= .s|_G(e) e.refuted\ 19: Determine Ωunresolved⊆Ωlive _unresolved _live lacking quorums/cuts under EreusableE_reusable 20: if Ωunresolved=∅ _unresolved= then 21: tdisp′←max(tnow,Σ.tdispatch)t_disp ← (t_now,\; .t_dispatch) 22: if tdisp′+δexec≤mine∈Ereusable(tobs(e)+Δteff(e)−ϵskew)∧tdisp′+δexec≤Σ.Tdeadt_disp + _exec≤ _e∈ E_reusable(t_obs(e)+ t_eff(e)- _skew) t_disp + _exec≤ .T_dead then 23: Σ.ρ←ρcand .ρ← _cand; Σ.Ω←Ωlive . ← _live; Σ.Vπ←Vcand .V_π← V_cand 24: Σ.Brem←Bremcand .B_rem← B_rem^cand; Σ.Bresv←Bresvcand .B_resv← B_resv^cand; Σ.tdispatch←tdisp′ .t_dispatch← t_disp ; Σ.g←Σ.g+1 .g← .g+1; return Σ 25: else 26: Mark expired obligations in Ωlive _live as unresolved →Ωunresolved→ _unresolved 27: end if 28: end if 29: ⊳ Phase I: SYNTHESIZE & VALIDATE (Transaction Guard) 30: (Δπ,tdisp′)←SynthPlan(Ωunresolved,Bcand,Σ.Tdead)( π,t_disp )← SynthPlan( _unresolved,B_cand, .T_dead) 31: if Δπ=Infeasible∨tdisp′+δexec>Σ.Tdead∨Cost(Δπ)>Bcand π= Infeasible t_disp + _exec> .T_dead ( π)>B_cand then 32: ⊳ ABORT: Retain authoritative physical state Σ.s .s; cancel unlaunched candidate 33: CancelAll(Σ.run)CancelAll( .J_run); Σ.Brem←Bremcand+Bresvcand .B_rem← B_rem^cand+B_resv^cand; Σ.Bresv← .B_resv 0 34: return Abort(Infeasible within Budget/Deadline) Abort(Infeasible within Budget/Deadline) 35: end if 36: ⊳ Phase IV: COMMIT (Publish Schedule & Advance Generation) 37: Σ.g←Σ.g+1 .g← .g+1 ⊳ Advance plan generation monotonically 38: Σ.ρ←ρcand .ρ← _cand; Σ.Ω←Ωlive . ← _live 39: Σ.Bresv←Bresvcand+Cost(Δπ) .B_resv← B_resv^cand+Cost( π); Σ.Brem←Bremcand−Cost(Δπ) .B_rem← B_rem^cand-Cost( π) 40: Σ.Vπ←Vcand∪Δπ.Vπ .V_π← V_cand∪ π.V_π; Σ.π←SpliceDAG(Σ.π,Δπ,tnow) .π ( .π, π,t_now) 41: Σ.tdispatch←tdispatch′ .t_dispatch← t_dispatch ; return Σ Semantic Receipt Reuse and Atomicity Guarantees. AAS permits reusing previously acquired receipts in EstoreE_store across plan repair if and only if three conditions hold simultaneously: 1. Repaired Dispatch Freshness: The receipt’s expiration bound extends beyond the prospective repaired dispatch and execution window (tdispatch′+δexec≤tobs(e)+Δteff(e)−ϵskewt_dispatch + _exec≤ t_obs(e)+ t_eff(e)- _skew), rather than merely the current timestamp tnowt_now. 2. State Invariance: The underlying state versions guarded by the receipt (G(e)G(e)) match live state: G(e)=Σ.s|G(e)G(e)= .s|_G(e). 3. Epistemic Independence: The receipt’s exposure set (e)X(e) satisfies the EFD diversity cuts required by current live obligations Σ.Ω . . Algorithm 2 specifies a validation guard before generation advancement. The current prototype cancels running jobs and reconciles reservations before solving the replacement problem; a failed repair can therefore leave the prior execution canceled. It enforces budget conservation but does not implement full transactional rollback of external jobs. The prototype removes receipts with invalid versions or insufficient remaining lifetime, represents potentially reusable receipts as zero-cost observation proxies, and checks their original observation timestamps against the proposed dispatch. The joint solver checks diversity with any new witnesses. In the matched 20-trial selected-operation timeout study, receipt-aware repair and full resynthesis each admit 18 cases, while the static control admits none; reuse lowers mean committed cost (Section 9.6). 8 Reference Scheduler Architecture and Algorithms The AAS reference scheduler separates plan synthesis, evidence execution, admission, and repair into four components. 8.1 Component Architecture Obligation CompilerParse Ω(q,s) (q,s) & EFD requirementsPlan SynthesizerJoint EFD & Temporal SolverOperation CatalogueSignatures, latencies, (a)X(a)Execution DispatcherAsync worker pool & timeoutsReplanning MonitorRisk tracking & dynamic repairAdmission Mint InterfaceFreshness check & manifest qW_qParsed Ω π∗π^*ReceiptsValid E Figure 5: The AAS reference scheduler. The synthesizer selects and times evidence operations, the dispatcher handles execution and consequential sub-admission, and the monitor triggers repair after modeled state changes. Optimality requires the exact-search conditions of Theorem 3. The AAS architecture comprises six decoupled subsystems (Figure 5): 1. Obligation Compiler: Ingests Ω(q,s) (q,s) from the CAC policy resolver, extracts predicate requirements, epistemic diversity thresholds κEmin(ω) _E (ω), and temporal lifespans Δtω t_ω. 2. Operation Catalogue & Exposure Index: Indexes registered operations A by covered claims, conservative latencies ℓ^(a) (a), costs c(a)c(a), token consumption tok(a)tok(a), and exposure sets (a)⊆X(a) . 3. Plan Synthesizer: Implements the joint optimization engine. It selects an admissible subset of operations Vπ⊆V_π via ILP (Section 5.3) or progress-based greedy fallback (Section 5.5) and synthesizes execution start times σπ _π via Backward JIT scheduling (Algorithm 1). 4. Execution Dispatcher: Manages an asynchronous worker pool enforcing strict per-operation timeouts ℓ^(a) (a). Crucially, any consequential diagnostic operation is intercepted and subjected to recursive CAC admission before dispatch. 5. Replanning Monitor: Listens to incoming receipts, detects whether new observations alter world state s, recalculates risk ρ(q,s)ρ(q,s), and triggers incremental plan repair (Algorithm 2) upon risk escalation, timeout, or negative evidence. 6. Admission Mint Interface: Verifies composite witness manifests q=(ω,Wω)W_q=\(ω,W_ω)\ and forwards them to the authoritative CAC engine for formal discharge evaluation and certificate minting. 8.2 Complete Scheduling Loop Algorithm 3 formalizes the complete end-to-end scheduling and execution loop operating on authoritative state Σ . Algorithm 3 Complete AAS Scheduling and Execution Loop 1: Proposal q, initial state s0s_0, context χ, deadline TdeadT_dead, budget B, constraints ,D,T 2: Admission certificate qC_q or Refuse 3: Initialize Σ.s←s0 .s← s_0; Σ.ρ←ρ(q,s0) .ρ←ρ(q,s_0); Σ.Ω←FΠ(Σ.ρ,q,s0) . ← F_ ( .ρ,q,s_0); Σ.g←0 .g← 0 4: Σ.Bcommit← .B_commit 0; Σ.Bresv← .B_resv 0; Σ.Brem←B .B_rem← B; Σ.Vdone,Σ.Estore,Σ.Eseen,Σ.run←∅ .V_done, .E_store, .E_seen, .J_run← 5: Σ.π←SynthesizePlan(Σ.Ω,,Σ.Brem,,) .π ( . ,A, .B_rem,D,T) 6: if Σ.π=Infeasible .π= Infeasible then return Refuse(No plan within budget/deadline) Refuse(No plan within budget/deadline) 7: end if 8: Σ.Bresv←Cost(Σ.π) .B_resv ( .π); Σ.Brem←Σ.Brem−Cost(Σ.π) .B_rem← .B_rem-Cost( .π); Σ.tdispatch←TargetDispatch(Σ.π) .t_dispatch ( .π) 9: while tnow<Tdeadt_now<T_dead do 10: for each ready operation a∈Σ.Vπa∈ .V_π with σπ(a)≤tnow _π(a)≤ t_now in state Ready do 11: if ρ(a)⪰τΠρ(a) _ then ⊳ Consequential sub-admission 12: a←RecursiveCAC(a,Σ.s,Σ.Brem)C_a (a, .s, .B_rem) 13: if a=RefuseC_a= Refuse then 14: CancelAll(Σ.run)CancelAll( .J_run); return Refuse(Sub-admission failed) Refuse(Sub-admission failed) 15: end if 16: end if 17: Transition a→Runninga→ Running; move c(a)c(a) from Σ.Bresv→Σ.Bcommit .B_resv→ .B_commit ⊳ Charged once at launch 18: Launch a into Σ.run .J_run tagged with generation Σ.g .g and timeout ℓ^(a) (a) 19: end for 20: Await next asynchronous event ℰE or timeout until earliest scheduled launch 21: if Wall-clock timeout with tnow≥Tdeadt_now≥ T_dead then 22: CancelAll(Σ.run)CancelAll( .J_run); refund unspent Bresv→BremB_resv→ B_rem; return Refuse(Deadline exceeded) Refuse(Deadline exceeded) 23: end if 24: if ℰ.id∈Σ.EseenE.id∈ .E_seen then 25: continue ⊳ Discard duplicate event idempotently 26: end if 27: Σ.Eseen←Σ.Eseen∪ℰ.id .E_seen← .E_seen∪\E.id\ 28: if ℰE is an operation termination event (job a) then 29: Σ.run←Σ.run∖ℰ.job .J_run← .J_run \E.job\; Σ.Vdone←Σ.Vdone∪a .V_done← .V_done∪\a\ 30: if ℰE carries stale generation gℰ<Σ.g_E< .g then 31: Transition a→Supersededa→ Superseded; reconcile physical effects via AdaptiveRepair(Σ,ℰ,tnow)AdaptiveRepair( ,E,t_now) 32: continue 33: end if 34: Transition a→Completeda→ Completed (or Failed/TimedOut); refund unused reservations 35: end if 36: if ℰE is Affirmative Refutation then 37: CancelAll(Σ.run)CancelAll( .J_run); return Refuse(Predicate refuted) Refuse(Predicate refuted) 38: else if ℰE returns valid receipt e from operation a then 39: Ingest e into Σ.Estore .E_store only if a was verified (including aC_a if consequential) 40: end if 41: if ℰE alters state s or is operation fault/timeout then 42: Σ←AdaptiveRepair(Σ,ℰ,tnow) ( ,E,t_now) 43: if Σ=Abort = Abort then return Refuse(Repair failed) Refuse(Repair failed) ⊳ Retain physical state Σ.s .s; refuse safely 44: end if 45: end if 46: Σ.q←ExtractWitnesses(Σ.Ω,Σ.Estore) .W_q ( . , .E_store) 47: if Σ.q .W_q satisfies quorums and EFD cuts for all Σ.Ω . then 48: if Readiness (22) and execution-window freshness (25) hold for Σ.q .W_q at tnowt_now then 49: ssnap←Σ.s_snap← .s; verdict←CAC.Discharge(Σ.Ω,Σ.q,ssnap,χ)verdict .Discharge( . , .W_q,s_snap,χ) 50: if verdict=Satisfiedverdict= Satisfied then 51: q←CAC.MintCert(q,ssnap,Σ.q)C_q .MintCert(q,s_snap, .W_q) 52: if Σ.s.ν≠ssnap.ν .s.ν≠ s_snap.ν then ⊳ CAS check: concurrent state invalidation 53: Discard qC_q; Σ←AdaptiveRepair(Σ,VersionConflict,tnow) ( ,VersionConflict,t_now) 54: else 55: return qC_q ⊳ Authoritative admission succeeded 56: end if 57: end if 58: end if 59: end if 60: end while 61: CancelAll(Σ.run)CancelAll( .J_run); refund unspent Bresv→BremB_resv→ B_rem; return Refuse(Deadline exceeded) Refuse(Deadline exceeded) 8.3 Computational Complexity and Scalability Profile While arbitrary epistemic cut minimization is NP-hard (Theorem 4), our generated instances have at most 16 obligations and 48 operations. On the reference benchmark platform (Apple Silicon, 12-core ARM64, 36 GB RAM, macOS/Darwin, Python 3.13, HiGHS branch-and-cut solver): • In the corrected feasible scaling sweep, end-to-end solver time averages 0.58 ms at four operations and 10.66 ms at 48 operations; neither value isolates Master ILP time. • The greedy fallback (Equation (51)) enumerates fault coalitions up to quorum size for its provisional score. It remains polynomial for fixed small quorums but provides no feasibility certificate when it stops without a plan. • Two-tier Backward JIT scheduling is measured as part of the end-to-end solver time above; the sweep does not separately estimate its latency under bounded concurrency. • In the corrected 20-trial selected-operation timeout study, all 20 cases trigger repair. Receipt-aware repair and full resynthesis each admit 18; local-process repair computation averages 2.05 and 2.32 ms, respectively, in the rerun (Section 9.6). These measured times are small relative to simulated operation latencies. The ordinary size sweep contains no refinement cuts; a separate 20-case constructed suite exercises the supported cut certificates but does not bound worst-case online planning time. 9 Empirical Evaluation We evaluate the AAS reference implementation with generated infrastructure workloads and small constructed counterexamples. The primary comparison applies six policies in two evaluation modes to the same 1,200 instances, yielding 14,400 policy-mode records. A policy-mode record is not an independent deployment. Targeted paired studies test freshness, fault-domain diversity, repair, and decomposition cuts. 9.1 Workloads and Protocol The generator creates 400 instances each for PostgreSQL standby promotion, Kubernetes node remediation, and cloud IAM/network reconfiguration (seeds 1000–2199). They contain 4–12 obligations, operation costs and precedence edges, evidence lifetimes of 3–30 s, and an exposure map with 24 modeled fault domains. Actual operation latency is sampled from a log-normal distribution centered on nominal latency (σ=0.35σ=0.35); this is a simulator assumption, not a measured cloud model. Domain faults are injected into 15% of instances. The selected operation catalogue and gateway policy are held fixed across the main policy comparisons. The six primary policies are serial forward acquisition (B1), cheapest-witness greedy selection (B2), constraint-aware parallel forward scheduling (B3/B5), full AAS (B4), and constraint-aware selection followed by scheduling without decomposition refinement (B6). B3 and B5 share an implementation and are shown separately only to preserve the original policy nomenclature. B2 is deliberately simple and is not an implementation of prior portfolio methods such as VP-CONTROL [3]. A bounded exact solver (B7) is used only for the oracle study; full resynthesis (B8) is used in the repair study. In Mode A, the admission gateway scores a candidate manifest retrospectively. In Mode B, it enforces the admission boundary and blocks invalid candidates. We distinguish valid admission, gateway rejection, proven safe refusal, and planning indeterminacy. A recorded invalid candidate in Mode A is a simulated proposal, not an unauthorized physical action. Each main-table outcome count uses the full 1,200-instance denominator. Table latency and cost means are conditional on valid admission; rejected attempts and safe refusals are excluded from those means. Scheduler Policy Valid Dispatch Stale Failures Correlated Failures Safe Refusal Admitted Latency (s) Admitted Cost ($) Replan (ms) Serial Forward (ASAP) 29.75% (357/1200) 0.0% (0/1200) 61.5% (738/1200) 8.75% (105/1200) 7.70 (p95: 7.70) $0.11 — Greedy Cost Portfolio 28.17% (338/1200) 1.58% (19/1200) 61.5% (738/1200) 8.75% (105/1200) 2.40 (p95: 2.40) $0.11 — Static Parallel 53.92% (647/1200) 36.67% (440/1200) 0.0% (0/1200) 9.42% (113/1200) 4.18 (p95: 6.51) $0.14 — AAS (Proposed) 89.58% (1075/1200) 1.0% (12/1200) 0.0% (0/1200) 9.42% (113/1200) 5.50 (p95: 12.40) $0.15 — Constraint-Aware Forward 53.92% (647/1200) 36.67% (440/1200) 0.0% (0/1200) 9.42% (113/1200) 4.18 (p95: 6.51) $0.14 — Separate Sched (No Refinement) 89.58% (1075/1200) 1.0% (12/1200) 0.0% (0/1200) 9.42% (113/1200) 5.50 (p95: 12.40) $0.15 — Table 1: Mode A on 1,200 generated instances per policy. Outcome counts use all instances; latency and cost means condition on valid admission. The gateway scores candidate manifests retrospectively. Scheduler Policy Valid Admitted Stale Refused Correlated Blocked Explicit Safe Refusal Admitted Latency (s) Admitted Cost ($) Serial Forward (ASAP) 29.75% (357/1200) 0.0% (0/1200) 61.5% (738/1200) 8.75% (105/1200) 7.70 $0.11 Greedy Cost Portfolio 28.17% (338/1200) 1.58% (19/1200) 61.5% (738/1200) 8.75% (105/1200) 2.40 $0.11 Static Parallel 53.92% (647/1200) 36.67% (440/1200) 0.0% (0/1200) 9.42% (113/1200) 4.18 $0.14 AAS (Proposed) 89.83% (1078/1200) 0.75% (9/1200) 0.0% (0/1200) 9.42% (113/1200) 5.50 $0.15 Constraint-Aware Forward 53.92% (647/1200) 36.67% (440/1200) 0.0% (0/1200) 9.42% (113/1200) 4.18 $0.14 Separate Sched (No Refinement) 89.58% (1075/1200) 1.0% (12/1200) 0.0% (0/1200) 9.42% (113/1200) 5.50 $0.15 Table 2: Mode B on 1,200 generated instances per policy. The gateway blocks invalid candidates before physical proposal execution. Latency and cost means condition on valid admission. 9.2 Main Comparison In Mode A, AAS produces 1,075/1,200 valid candidates (89.58%), 12 stale candidates (1.00%), and 113 proven safe refusals (9.42%). Constraint-aware forward scheduling produces 647 valid candidates (53.92%), 440 stale candidates (36.67%), and the same 113 refusals. Thus, on these paired generated instances, backward placement changes 428 outcomes from stale candidate to valid admission. B6 matches B4 on this workload because no refinement cut is generated by its ordinary instances; this comparison alone does not establish a decomposition benefit. Greedy cost selection and serial forward acquisition each produce 738/1,200 correlated-failure classifications (61.50%) under the declared exposure map. No B4 candidate is classified as structurally correlated. In Mode B the gateway admits 1,078 AAS candidates, blocks nine stale candidates, and records 113 safe refusals. Three of the 12 Mode A stale cases are recovered by the controller in Mode B; no physical proposal executes on a blocked candidate. The gateway blocks 738 serial-forward and 757 greedy-cost candidate dispatches. Mean wasted committed cost over all 1,200 proposals is $0.013 for B4 and $0.106 for B2. These are simulator outcomes under the modeled faults and budgets. Figure 6: RQ1: Valid admission under matched evidence-lifetime scales. Each point uses the same 30 PostgreSQL base instances and operation-keyed latency draws for both policies and all three scales. 9.3 RQ1: Paired Freshness Sensitivity We vary only evidence lifetimes (0.6×0.6×, 1.0×1.0×, 1.5×1.5×) on 30 PostgreSQL base instances (seeds 7000–7029). Each operation receives a fixed latency draw keyed by base seed and operation identifier, so the same trace is reused across policies and scales. At 0.6×0.6×, AAS admits 14/30 while constraint-aware forward scheduling admits 0/30; the other 16 AAS cases are proven infeasible and refused. At nominal lifetime, the counts are 30/30 versus 0/30; at 1.5×1.5×, they are 30/30 versus 23/30. The paired admission difference at 1.5×1.5× is 7/30 (23.3 percentage points; percentile bootstrap 95% interval 10.0–40.0 points over base instances). The gap narrows as evidence remains valid longer. The separate Kmax=1K_ =1 fixture verifies that a two-operation serial schedule is feasible, but does not distinguish policies. Figure 7: RQ2: Valid admission and unconditional attempted cost on 30 matched base instances under fixed 2-of-q quorums. Threshold 3 is structurally infeasible because κE≤2 _E≤ 2; its zero attempted cost reflects refusal, not a cost improvement. 9.4 RQ2: Diversity and Cost We vary required EFD threshold κEmin∈1,2,3 _E ∈\1,2,3\ on the same 30 base instances (ten per scenario; seeds 8000–8029), fixing 2-of-q quorum rules, operation-keyed latency, and injected domain faults. AAS admits 23 and 25 instances at thresholds 1 and 2; the greedy cost baseline admits 18 and 10. The different admission counts reflect both diversity and realized faults, so the threshold-2 arm is not a monotone availability claim. At threshold 3, all 30 AAS instances are proven infeasible because a completed local fault basis implies κE≤kω=2 _E≤ k_ω=2 for the varied obligations. Greedy cost selection produces no valid admission either. The zero attempted cost of AAS in this arm records safe refusal. Cost comparisons among admitted proposals must therefore use the feasible threshold-1 and threshold-2 arms; unconditional cost is $0.139 and $0.151 per instance, respectively. For the declared exposure map and positive authorization rule, κE(W,Γω)≥h _E(W, _ω)≥ h means that fewer than h modeled roots cannot expose a decisive approving coalition. This is a conditional structural guarantee; unmodeled shared dependencies or an incorrect causal account of exposed approvals can defeat it. 9.5 RQ3: Bounded Joint Optimality On 20 bounded instances (|Ω|≤4| |≤ 4, ||≤10|A|≤ 10), AAS and the exact oracle both find feasible plans at the same cost. Mean local solve times in the corrected rerun are 2.15 and 5.44 ms, respectively; this small paired sample does not establish a general speed advantage. The revised solver uses exhaustive temporal-order fallback for portfolios of at most six operations, and the oracle shares that temporal search component. The comparison checks selection and cost on small cases, not independent temporal correctness or general completeness. Figure 8: RQ4: Matched mean repair computation and committed cost on 20 selected-operation timeout trials. Receipt reuse and resynthesis each admit 18; the static control admits none. Computation times are local-process measurements. 9.6 RQ4: Repair After a Selected-Operation Timeout The corrected intervention faults an operation selected by the same initial plan in every arm (20 trials, seeds 5000–5019). It compares incremental repair with receipt reuse, the same controller with reuse disabled, full resynthesis, and a static no-repair control. All 20 cases trigger repair in the three enabled arms. Reuse, no-reuse, and resynthesis each admit 18/20; static planning admits 0/20. The two failures in each repair arm occur on different instances, so equal totals do not imply identical recovery. Receipt reuse records 2.85 reused receipts per case and mean committed cost $0.223 versus $0.296 for either no-reuse or resynthesis. The paired cost difference (reuse minus no-reuse) is −$0.073-\$0.073 with a percentile bootstrap 95% interval of approximately [−$0.100,−$0.047][-\$0.100,-\$0.047] over 20 instances. Mean local repair computation in the corrected rerun is 2.05 versus 2.21 ms for no-reuse and 2.32 ms for resynthesis; these small timing differences are process dependent and do not establish a deployment latency advantage. This study injects operation timeouts, not environmental version changes. 9.7 RQ5: Consequential Diagnostics Twelve deterministic fixtures test prospective recursive admission: ten finite stratified trees are admitted, while a cycle and a non-descending-risk tree are rejected. These fixtures check specific invariants; they do not estimate distributed liveness or resource-leak rates. Figure 9: RQ6: Solver time on seven generated sizes (4–48 operations). This ordinary scaling sweep generates no refinement cuts; the separate constructed suite below exercises both supported cut certificates. 9.8 RQ6: Solver Scaling and Certified Refinement On seven feasible generated sizes, each with 2-of-q obligations and separate witness roots, mean solver time rises from 0.58 ms at four operations to 10.66 ms at 48 operations (p95 11.63 ms at the largest size). Every fixture admits a plan; this assertion prevents timing structural refusals. The sweep supports neither an asymptotic claim nor a bound for repeated refinement, and generates zero cuts. We therefore add 20 constructed, seeded small cases: ten violate a witness’s intrinsic lifetime, and ten contain a cheap precedence chain that misses the deadline. In every case the unrefined master selects a temporally infeasible portfolio; one certified cut leads the decomposed solver to a feasible alternative in the second iteration. Both cut types occur ten times, and the refined cost matches the exact oracle in all 20. These cut-producing cases demonstrate the implemented mechanism, not its frequency in deployed workloads. Ablation Variant Valid (%) Stale (%) Corr (%) Refusal (%) Lat (s) Cost ($) A: no EFD selection 33.33% (10/30) 0.0% (0/30) 66.67% (20/30) 0.0% (0/30) 2.40 $0.11 B: no JIT scheduling 63.33% (19/30) 36.67% (11/30) 0.0% (0/30) 0.0% (0/30) 4.19 $0.14 C: no adaptive repair 63.33% (19/30) 36.67% (11/30) 0.0% (0/30) 0.0% (0/30) 4.19 $0.14 D: no receipt reuse 93.33% (28/30) 6.67% (2/30) 0.0% (0/30) 0.0% (0/30) 5.15 $0.15 E: no refinement 93.33% (28/30) 6.67% (2/30) 0.0% (0/30) 0.0% (0/30) 5.15 $0.15 F: greedy forward 33.33% (10/30) 0.0% (0/30) 66.67% (20/30) 0.0% (0/30) 7.70 $0.11 G: full AAS 93.33% (28/30) 6.67% (2/30) 0.0% (0/30) 0.0% (0/30) 5.15 $0.15 Table 3: General ablation study on the same 30 generated instances per policy. Latency and cost means condition on valid admission. Figure 10: General ablation outcomes on 30 generated instances per policy. No-reuse and no-refinement coincide with full AAS here because these trials do not trigger repair or refinement. 9.9 Ablations and Interpretation On 30 shared generated instances, full AAS admits 28/30. Greedy selection without EFD constraints admits 10/30 and produces 20 correlated-failure classifications. Forward scheduling admits 19/30 with 11 stale outcomes. The nominal “No Adaptive Repair” general ablation shares the forward policy implementation and therefore cannot isolate repair; the dedicated timeout study above supplies that intervention. No-reuse and no-refinement each admit 28/30, matching full AAS because the general workload activates neither mechanism. The paired repair and cut-producing studies identify their effects under controlled activation. These are mechanism tests on synthetic data, not estimates of production reliability. 10 Discussion and Limitations Scope of Empirical Evidence. The three main scenario families still use generated operations, costs, exposure maps, latencies, and faults. Policy and mode records share instances. The new sensitivity studies pair base instances, fault injections, and operation-keyed latency draws, but retain the same generator and small sample sizes. The 20-instance oracle comparison shares a bounded temporal-search component; the 20 cut-producing cases are constructed to activate the supported certificates. The corrected timeout study demonstrates recovery under selected-operation faults, but does not test production state shifts, distributed cancellation, or transactional rollback. Independent workloads and live integrations are required to assess transfer and worst-case solve behavior. Clock Synchronization and Distributed Skew. Theorem 1 defines evidence validity evaluated at the execution gateway clock CgwC_gw, deducting maximum gateway-observer skew ϵskew _skew (|Ci(t)−Cgw(t)|≤ϵskew|C_i(t)-C_gw(t)|≤ _skew). In distributed architectures lacking hardware-synchronized clocks (such as GPS/atomic reference clocks in TrueTime [10]), relative clock drift between two independent observers i and j can reach 2ϵskew2 _skew. If peer observers compare timestamps directly without mediation through an authoritative gateway, soundness requires deducting 2ϵskew2 _skew: Δteffectivepeer(e)=max(0,Δt(e)−2ϵskew). t_effective^peer(e)= (0,\; t(e)-2 _skew ). (61) If clock drift exceeds evidence validity, short-lived telemetry cannot be safely scheduled across disparate clock domains without atomic local re-observation at the gateway. Proactive Pre-fetching vs. Invalidation Risk. Pre-fetching long-lived evidence (e.g., reading cluster topology 30 s prior to failover) amortizes scheduling latency. However, if concurrent background mutations modify the underlying resource versions, the pre-fetched witness becomes obsolete. The CAC admission gateway enforces state version guards Gq=νs=νliveG_q=\ _s= _live\. If any guarded version changes between pre-fetching and dispatch, the certificate CAS fails, forcing an abort. Thus, aggressive pre-fetching in high-concurrency environments increases the probability of optimistic concurrency aborts. Incomplete Epistemic Dependency Maps. The structural diversity guarantees of Section 5 depend on the fidelity of the exposure map :→2X:A→ 2^F. If two ostensibly independent services share an undisclosed transitive dependency—such as a common DNS resolver, power bus, or base model—the calculated cut κE(W,Γω) _E(W, _ω) can overstate diversity. Establishing complete epistemic independence remains an empirical challenge. Human-in-the-Loop Latency Asymmetry. Human approval can dominate automated evidence-acquisition latency. The current simulator does not model an asynchronous human response or re-fire short-lived telemetry after approval. Such a workflow would need an explicit provisional state, a new dispatch-time freshness check, and another admission decision. 11 Related Work Admission Control and Mediated Agent Execution. Access-control models such as ABAC [11] decide whether a principal may invoke an operation. Proof-Carrying Code [12] made consumer-side proof checks explicit. Recent agent-tool work, including ToolGuardian [2], characterizes tool behavior and applies task-aware runtime authorization. CAC [1] specifies risk-conditioned assurance obligations. AAS addresses the intervening planning problem: which observations to obtain and when to obtain them before mediated execution. Verification Portfolios and Model Routing. FrugalGPT [8] and RouteLLM [13] trade inference cost against model capability. VP-CONTROL [3] studies cost-aware verifier portfolios, common-mode evidence failures, and commit-time guards, including a live HTTP/SQLite study. Its portfolio problem motivates source-aware selection. Our formulation additionally schedules observations with finite validity intervals and treats consequential evidence acquisition as a recursively admitted operation. The evaluations address different workloads and should not be read as a direct performance comparison. Real-Time and Dependency Scheduling. Real-time scheduling [14, 15] and resource-constrained project scheduling [16] address deadlines, precedence, and capacity. Assurance scheduling adds a policy-defined validity interval to each selected witness. A feasible task schedule can therefore yield an inadmissible dispatch if evidence expires before the protected execution window ends. Fault Tolerance and Epistemic Diversity. N-Version Programming [17] and Byzantine fault-tolerant replication [18] use redundancy against specified failures. EFD theory [7] defines a structural cut relative to the authorization rule and an explicit fault basis. AAS imports that cut into witness selection and admission, then adds temporal freshness and budget constraints. Its guarantee remains relative to the declared exposure map; an undisclosed common dependency can invalidate it. 12 Conclusion AAS formulates evidence acquisition for consequential agent actions as a joint selection and scheduling problem. Its witness assignment enforces declared fault-domain cuts; its temporal scheduler places expiring observations near dispatch; and its controller admits consequential diagnostics and repairs plans after state changes. The formal guarantees depend on modeled dependencies, bounded latencies, and exact search where optimality is claimed. On three generated workload families, AAS raises valid candidate admission from 647/1,200 for constraint-aware forward scheduling to 1,075/1,200 and reduces stale candidates from 440 to 12. Paired sensitivity studies hold the base instance and latency draws fixed while varying freshness and diversity. In 20 constructed cut-producing cases, certified refinement recovers an oracle-matching feasible alternative; in 20 selected-operation timeout trials, receipt-aware repair admits 18 and lowers committed cost relative to resynthesis. The bounded oracle shares temporal search with the solver, and neither constructed cuts nor simulator timeouts establish production reliability. Independent workloads and live gateway integrations remain the next tests. AI-Use Disclosure. OpenAI Codex and Google Antigravity assisted with draft structuring, language and notation editing, implementation debugging, experiment auditing, figure preparation, and reference formatting. The authors are responsible for verifying the code, proofs, sources, and reported results. References [1] J. He and D. Yu (2026) Cognitive admission control: risk-conditioned assurance for consequential actions in agentic distributed systems. arXiv preprint arXiv:2609.16313. External Links: 2609.16313 Cited by: §1, §11, §2.1, §6. [2] A. Ravindran and S. Deochake (2026) ToolGuardian: declarative security for AI agent-tool interactions. arXiv preprint arXiv:2607.21835. External Links: 2607.21835 Cited by: §1, §11. [3] Z. Zheng, B. Li, J. Yao, and J. Long (2026) Engineering reliable commit gates for agentic ai: cost-aware verification portfolios under common-mode data failures. arXiv preprint arXiv:2609.10969. External Links: 2609.10969 Cited by: §1, §11, §5.2, §9.1. [4] C. Snell, J. Lee, K. Xu, and A. Kumar (2024) Scaling LLM test-time compute optimally can be more effective than scaling model parameters. arXiv preprint arXiv:2408.03314. External Links: 2408.03314 Cited by: §2.2. [5] N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao (2023) Reflexion: language agents with verbal reinforcement learning. Advances in Neural Information Processing Systems 36, p. 8634–8652. Cited by: §2.2. [6] J. Dean and L. A. Barroso (2013) The tail at scale. Communications of the ACM 56 (2), p. 74–80. External Links: Document Cited by: §4.4. [7] J. He and D. Yu (2026) The illusion of independent quorums: epistemic fault domains and correlated cognitive failures in agentic quorums. arXiv preprint arXiv:2609.02925. External Links: 2609.02925 Cited by: §11, Definition 7. [8] L. Chen, M. Zaharia, and J. Zou (2023) FrugalGPT: how to use large language models while reducing cost and improving performance. arXiv preprint arXiv:2305.05176. External Links: 2305.05176 Cited by: §11, §5.2. [9] R. M. Karp (1972) Reducibility among combinatorial problems. In Complexity of Computer Computations, R. E. Miller and J. W. Thatcher (Eds.), p. 85–103. External Links: Document Cited by: §A.2, item 3. [10] J. C. Corbett, J. Dean, M. Epstein, A. Fikes, C. Frost, J. J. Furman, S. Ghemawat, A. Gubarev, C. Heiser, P. Hochschild, W. Hsieh, S. Kanthak, E. Kogan, H. Li, A. Lloyd, S. Melnik, D. Mwaura, D. Nagle, S. Quinlan, R. Rao, L. Rolig, Y. Saito, M. Szymaniak, C. Taylor, R. Wang, and D. Woodford (2013) Spanner: Google’s globally distributed database. ACM Transactions on Computer Systems 31 (3), p. 8:1–8:22. External Links: Document Cited by: §10. [11] V. C. Hu, D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone (2014) Guide to attribute based access control (ABAC) definition and considerations. Technical report Technical Report SP 800-162, National Institute of Standards and Technology. External Links: Document Cited by: §11. [12] G. C. Necula (1997) Proof-carrying code. In Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), p. 106–119. External Links: Document Cited by: §11. [13] I. Ong, A. Almahairi, V. Wu, W. Chiang, T. Wu, J. E. Gonzalez, M. W. Kadous, and I. Stoica (2024) RouteLLM: learning to route LLMs with preference data. arXiv preprint arXiv:2406.18665. External Links: 2406.18665 Cited by: §11. [14] C. L. Liu and J. W. Layland (1973) Scheduling algorithms for multiprogramming in a hard-real-time environment. Journal of the ACM 20 (1), p. 46–61. External Links: Document Cited by: §11. [15] G. C. Buttazzo (2011) Hard real-time computing systems: predictable scheduling algorithms and applications. 3rd edition, Springer Science & Business Media. External Links: Document Cited by: §11. [16] R. L. Graham, E. L. Lawler, J. K. Lenstra, and A. H. G. R. Kan (1979) Optimization and approximation in deterministic sequencing and scheduling: a survey. Annals of Discrete Mathematics 5, p. 287–326. Cited by: §11. [17] A. Avižienis (1985) The N-version approach to fault-tolerant software. IEEE Transactions on Software Engineering SE-11 (12), p. 1491–1501. External Links: Document Cited by: §11. [18] F. B. Schneider (1990) Implementing fault-tolerant services using the state machine approach: a tutorial. ACM Computing Surveys 22 (4), p. 299–319. External Links: Document Cited by: §11. Appendix A Formal Proofs This appendix provides complete formal proofs for the theoretical statements established in the main manuscript. A.1 Proof of Theorem 1 (Dispatch Freshness Intersection) Theorem 6 (Restatement of Theorem 1). Fix an executed assurance plan π with completed operations VπV_π, actual completions Cπ(a)\C_π(a)\, observation timestamps tobs(e)\t_obs(e)\, and composite witness manifest WallW_all. Let Vreq⊆VπV_req V_π denote mandatory operations prior to dispatch (Vmanifest∪AncDop(Vmanifest)V_manifest _D_op(V_manifest)), and δready=δverify+δmint+δdisp _ready= _verify+ _mint+ _disp. A dispatch timestamp satisfying readiness and freshness throughout the protected execution window exists, before imposing the independent deadline and budget guards, if and only if condition (26) holds: maxa∈VreqCπ(a) _a∈ V_reqC_π(a) +δready+δexec+ϵskew + _ready+ _exec+ _skew (62) ≤mine∈Wall(tobs(e)+Δteff(e)). ≤ _e∈ W_all (t_obs(e)+ t_eff(e) ). which is equivalent to pairwise operational skew bound (27) and observation skew bound (28). Non-witness prerequisites u∈Vreq∖Vmanifestu∈ V_req V_manifest participate directly in readiness bound (27). Proof. By Definition 6 and Equation (25), dispatch requires that for every witness receipt e∈Walle∈ W_all, the entire protected execution window [tdispatch,tdispatch+δexec][t_dispatch,\;t_dispatch+ _exec] is contained within the conservative gateway-evaluated validity interval I(e)=[tobs(e)−ϵskew,tobs(e)+Δteff(e)−ϵskew]I(e)=[t_obs(e)- _skew,\;t_obs(e)+ t_eff(e)- _skew]. Furthermore, proposal dispatch cannot legally occur until all mandatory operations in VreqV_req (both witness producers and precedence prerequisites) have completed execution, receipts have been emitted and verified (δverify _verify), the admission certificate has been minted by CAC (δmint _mint), and gateway mediation delay (δdisp _disp) has elapsed: tdispatch≥maxa∈VreqCπ(a)+δready,t_dispatch≥ _a∈ V_reqC_π(a)+ _ready, (63) where δready=δverify+δmint+δdisp _ready= _verify+ _mint+ _disp. Simultaneously, the completion of the protected execution window cannot exceed the gateway-evaluated expiration timestamp of any witness receipt: tdispatch+δexec≤mine∈Wall(tobs(e)+Δteff(e)−ϵskew).t_dispatch+ _exec≤ _e∈ W_all (t_obs(e)+ t_eff(e)- _skew ). (64) Combining (63) and (64), an admissible dispatch timestamp tdispatcht_dispatch exists if and only if the feasible dispatch interval [tlower,tupper][t_lower,t_upper] is non-empty, where: tlower t_lower =maxa∈VreqCπ(a)+δready, = _a∈ V_reqC_π(a)+ _ready, (65) tupper t_upper =mine∈Wall(tobs(e)+Δteff(e)−ϵskew)−δexec. = _e∈ W_all (t_obs(e)+ t_eff(e)- _skew )- _exec. (66) The interval [tlower,tupper][t_lower,t_upper] is non-empty if and only if tlower≤tuppert_lower≤ t_upper: maxa∈VreqCπ(a) _a∈ V_reqC_π(a) +δready≤mine∈Wall(tobs(e)CLOSE + _ready≤ _e∈ W_all (t_obs(e) (67) OPEN+Δteff(e)−ϵskew)−δexec. + t_eff(e)- _skew )- _exec. Moving constants δready _ready, δexec _exec, and ϵskew _skew directly establishes Equation (62). To establish equivalence with pairwise condition (27): • (⟹)( ) Suppose condition (62) holds. For any operation a∈Vreqa∈ V_req and any witness ei∈Walle_i∈ W_all, we have Cπ(a)≤maxu∈VreqCπ(u)C_π(a)≤ _u∈ V_reqC_π(u) and mine∈Wall(tobs(e)+Δteff(e))≤tobs(ei)+Δteff(ei) _e∈ W_all(t_obs(e)+ t_eff(e))≤ t_obs(e_i)+ t_eff(e_i). Substituting these bounds gives Cπ(a)+δready+δexec+ϵskew≤tobs(ei)+Δteff(ei)C_π(a)+ _ready+ _exec+ _skew≤ t_obs(e_i)+ t_eff(e_i), yielding Cπ(a)−tobs(ei)≤Δteff(ei)−δready−δexec−ϵskewC_π(a)-t_obs(e_i)≤ t_eff(e_i)- _ready- _exec- _skew. For a∈Vmanifesta∈ V_manifest, substituting Cπ(a)=tobs(ej)+ℓpost(a)C_π(a)=t_obs(e_j)+ _post(a) gives Equation (28). • (⟸)( ) Conversely, suppose (27) holds for all operations a∈Vreqa∈ V_req and witnesses ei∈Walle_i∈ W_all. Choosing a∗=argmaxa∈VreqCπ(a)a^*= _a∈ V_reqC_π(a) and ei∗=argmine∈Wall(tobs(e)+Δteff(e))e_i^*= _e∈ W_all(t_obs(e)+ t_eff(e)) directly recovers condition (62). This completes the proof. ∎ A.2 Proof of Theorem 4 (NP-Hardness of ASP-DEC) Theorem 7 (Restatement of Theorem 4). The decision version of the Assurance Scheduling Problem (ASP-DEC) is NP-hard, even when operational precedence is empty (Dop=∅D_op= ) and operation latencies are uniform. Proof. We establish NP-hardness by constructing a polynomial-time reduction from the classical NP-complete problem Minimum Weight Set Cover (WSC) [9] to ASP-DEC. The WSC Decision Problem. An instance of Minimum Weight Set Cover is defined by a 4-tuple ⟨,,w,K⟩ ,S,w,K : a finite universe =u1,…,unU=\u_1,…,u_n\, a collection of subsets =S1,…,SmS=\S_1,…,S_m\ with Sj⊆S_j and ⋃j=1mSj= _j=1^mS_j=U, a non-negative cost function w:→ℝ≥0w:S _≥ 0, and a target cost threshold K∈ℝ≥0K _≥ 0. The problem asks whether there exists a sub-collection ′⊆S such that ⋃Sj∈′Sj= _S_j S_j=U and ∑Sj∈′w(Sj)≤K _S_j w(S_j)≤ K. Polynomial-Time Construction. Given an arbitrary instance ⟨,,w,K⟩ ,S,w,K of WSC, we construct an instance of ASP-DEC =⟨Ω,,B,,⟩P= ,A,B,D,T with cost bound K as follows: 1. Assurance Obligations Ω : For each ui∈u_i , create obligation ωi=⟨ϕωi,ℰωi,Δtωi,κEmin(ωi),ωi⟩ _i= _ _i,E_ _i, t_ _i, _E ( _i),Q_ _i with eligible evidence ℰωi=εstdE_ _i=\ _std\, freshness lifespan Δtωi=10 t_ _i=10, diversity threshold κEmin(ωi)=1 _E ( _i)=1, and quorum threshold kωi=1k_ _i=1. Thus |Ω|=||=n| |=|U|=n. 2. Assurance Operations A: For each subset Sj∈S_j , create an operation aj∈a_j with financial cost c(aj)=w(Sj)c(a_j)=w(S_j), latencies ℓ(aj)=ℓ^(aj)=1 (a_j)= (a_j)=1, cognitive tokens tok(aj)=0tok(a_j)=0, risk ρ(aj)=≺τΠρ(a_j)=0 _ (non-consequential), potential coverage Cov(aj)=(ωi,εstd)∣ui∈SjCov(a_j)=\( _i, _std) u_i∈ S_j\, lifespan Δt(aj)=10 t(a_j)=10, prerequisites Pre(aj)=∅Pre(a_j)= , and distinct epistemic exposure (aj)=fjX(a_j)=\f_j\ for distinct fj∈=f1,…,fmf_j =\f_1,…,f_m\. Thus ||=||=m|A|=|S|=m. 3. Dependencies D: Set Dop=∅D_op= and Depi=(aj,fj)∣1≤j≤mD_epi=\(a_j,f_j) 1≤ j≤ m\. 4. Budgets B and Temporal Constraints T: Set B$=KB_\$=K, Blat=10B_lat=10, Btok=0B_tok=0, Brisk=0B_risk=0, and Kmax=∞K_ =∞. Set t0=0t_0=0, Tdead=10T_dead=10, δexec=1 _exec=1, δverify=δmint=δdisp=0 _verify= _mint= _disp=0, and ϵskew=0 _skew=0. This construction maps universe elements to obligations and subsets to multi-obligation operations in time O(||⋅||)O(|U|·|S|), which is polynomial in the input size. Equivalence Proof. We now prove that there exists a valid set cover ′⊆S with ∑Sj∈′w(Sj)≤K _S_j w(S_j)≤ K if and only if there exists a prospectively admissible plan π⊧prosπ _prosP with Cost(π)≤KCost(π)≤ K: • (⟹)( ) Suppose ′⊆S is a valid set cover with ∑Sj∈′w(Sj)≤K _S_j w(S_j)≤ K. Construct assurance plan π=⟨Vπ,Eπ,σπ,ℳπ⟩π= V_π,E_π, _π,M_π as follows: – Set of operations: Vπ=aj∈∣Sj∈′V_π=\a_j S_j \, – Precedence edges: Eπ=∅E_π= , – Scheduled start times: σπ(aj)=0 _π(a_j)=0 for all aj∈Vπa_j∈ V_π, – Witness mapping: For each ωi∈Ω _i∈ , since ′S covers U, there exists at least one Sj∈′S_j such that ui∈Sju_i∈ S_j. Choose one such aj∈Vπa_j∈ V_π and set ℳπ(ωi)=ajM_π( _i)=\a_j\. We verify prospective admissibility of π: 1. Precedence: Eπ=∅E_π= , trivially satisfied. 2. Latency & Deadlines: All operations start at 0 and have latency ℓ^=1 =1, so C^π(aj)=1 C_π(a_j)=1. With δdisp=0 _disp=0, target dispatch is tdispatch=1t_dispatch=1. Then tdispatch+δexec=1+1=2≤10=Tdeadt_dispatch+ _exec=1+1=2≤ 10=T_dead, satisfying deadline feasibility. Latency is 1−0=1≤Blat1-0=1≤ B_lat. 3. Cost Budget: Cost(π)=∑aj∈Vπc(aj)=∑Sj∈′w(Sj)≤K=B$Cost(π)= _a_j∈ V_πc(a_j)= _S_j w(S_j)≤ K=B_\$. Token and risk budgets are identically zero, satisfying all budget invariants. 4. Quorum Coverage: For each ωi _i, (ωi,εstd)∈Cov(aj)( _i, _std) (a_j) because ui∈Sju_i∈ S_j. The quorum requirement is |ℳπ(ωi)|=1≥kωi=1|M_π( _i)|=1≥ k_ _i=1. 5. Freshness: Effective lifespan is Δteff=min(10,10)=10 t_eff= (10,10)=10. Then tdispatch+δexec=2≤σπ(aj)+Δteff=0+10=10t_dispatch+ _exec=2≤ _π(a_j)+ t_eff=0+10=10. 6. Epistemic Diversity: Each obligation requires κEmin(ωi)=1 _E ( _i)=1. The singleton witness aj\a_j\ is decisive for its 1-of-1 rule and is exposed by fj\f_j\, so κE(ℳπ(ωi),Γωi)=1≥κEmin(ωi) _E(M_π( _i), _ _i)=1≥ _E ( _i). 7. Diagnostics: All operations have risk ρ=≺τΠρ=0 _ , so no diagnostic sub-plans are required. Thus π⊧prosπ _prosP with Cost(π)≤KCost(π)≤ K. • (⟸)( ) Conversely, suppose there exists a prospectively admissible plan π=⟨Vπ,Eπ,σπ,ℳπ⟩π= V_π,E_π, _π,M_π for P with Cost(π)≤KCost(π)≤ K. Define the sub-collection ′=Sj∈∣aj∈VπS =\S_j a_j∈ V_π\. By the resource budget invariant (11): ∑Sj∈′w(Sj)=∑aj∈Vπc(aj)=Cost(π)≤K. _S_j w(S_j)= _a_j∈ V_πc(a_j)=Cost(π)≤ K. Now consider any arbitrary universe element ui∈u_i . In the constructed ASP instance, uiu_i corresponds to obligation ωi∈Ω _i∈ . By prospective quorum coverage (Definition 6), π must assign candidate witness operations ℳπ(ωi)⊆VπM_π( _i) V_π satisfying: |ℳπ(ωi)|≥kωi=1and |M_π( _i)|≥ k_ _i=1 ∀a∈ℳπ(ωi),(ωi,εstd)∈Cov(a). ∀ a _π( _i),\;( _i, _std) (a). Thus, there exists at least one operation aj∈Vπa_j∈ V_π such that (ωi,εstd)∈Cov(aj)( _i, _std) (a_j). By our polynomial construction, (ωi,εstd)∈Cov(aj)( _i, _std) (a_j) holds if and only if ui∈Sju_i∈ S_j. Since aj∈Vπa_j∈ V_π, the corresponding subset SjS_j belongs to ′S . Because this holds for every ui∈u_i , we conclude that: ⋃Sj∈′Sj=. _S_j S_j=U. Hence, ′S is a valid set cover of U with total weight at most K. Since Minimum Weight Set Cover is NP-complete, the decision problem ASP-DEC is NP-hard. Complexity Analysis: Multi-Obligation Coverage vs. EFD Cut Verification. We emphasize that Theorem 4 formally establishes that ASP-DEC is NP-hard due to multi-obligation witness coverage via reduction from Minimum Weight Set Cover. Regarding epistemic diversity: (1) Fixed thresholds: To verify κE(W,Γω)≥h _E(W, _ω)≥ h, enumerate each fault coalition C⊆C with |C|<h|C|<h and check whether it exposes fewer than kωk_ω assigned witnesses. For fixed h, this costs O(|W|h||h−1)O(|W|\,h\,|F|^h-1). (2) ILP separation: At h=2h=2, singleton-root cuts can be instantiated statically. At h=3h=3, root pairs are also polynomial to enumerate. (3) Decision-rule bound: The completed local-root basis implies κE(W,Γω)≤kω _E(W, _ω)≤ k_ω once a quorum exists. Hence a threshold above the quorum cardinality is infeasible before scheduling. The NP-hardness reduction uses h=kω=1h=k_ω=1 and is unaffected by this correction. ∎ Operation Class Example Implementation Mean Cost Nominal Latency Lifespan Δt t Consequential? (ρ≥τΠρ≥ _ ) Primary Epistemic Fault Domains (X) Passive Telemetry Prometheus scrape / eBPF $0.0001 40 ms 5 s No Local kernel, metrics daemon Log Audit Loki / OpenSearch query $0.002 250 ms 30 s No Log forwarder, search index Hardware Attestation TPM quote / AWS Nitro quote $0.005 350 ms 300 s No Hardware root-of-trust, CA Static SMT Proof Z3 / Dafny verification $0.02 1.8 s ∞ No Solver binary, CPU architecture Redundant Model Independent LLM judge $0.03 1.2 s 60 s No Model weights, inference stack Consensus Query Raft / Paxos quorum read $0.001 80 ms 10 s No Consensus network quorum Filesystem Freeze LVM / ZFS snapshot probe $0.01 1.5 s 15 s Yes Storage controller, I/O bus Network Probe Synthetic BGP / ping burst $0.005 600 ms 8 s Yes Network fabric, firewall Failover Dry-Run Staging replica promotion $0.25 6.5 s 45 s Yes Database engine, replication stream Human Sign-off Slack / PagerDuty sign-off $5.00 180 s 600 s No Human operator, IdP token Table 4: Taxonomy of heterogeneous assurance operations in AAS, detailing financial expense, observation latency, temporal decay, and operational consequence. A.3 Proof of Theorem 3 (Convergence and Conditional Global Optimality) Theorem 8 (Restatement of Theorem 3). The decomposed Logic-Based Benders Decomposition (LBBD) algorithm terminates in a finite number of iterations. Furthermore, for any fully modeled or flattened problem instance P, if the master solver executes to completion without timeout (Tctrl=∞T_ctrl=∞) and the subproblem is evaluated authoritatively, the returned plan π∗π^* is globally cost-optimal over all prospectively admissible plans: Cost(π∗)=min∑a∈Vπ∈Πadm()c(a)Cost(π^*)= _π∈ _adm(P) _a∈ V_πc(a). If the solver reaches computation timeout Tctrl<∞T_ctrl<∞ and returns the best incumbent integer solution, or falls back to the greedy heuristic (Section 5.5), the resulting plan is approximately optimized and prospectively feasible, with no claim of global optimality. Consequential diagnostic sub-plans admitted dynamically at runtime are coordinated outside this static optimality theorem. Proof. We divide the proof into two parts: finite termination and global optimality. Part 1: Finite Termination. Let |||A| denote candidate assurance operations and |Ω|| | denote mandatory obligations. The decision space of the Master ILP is bounded by binary assignments ∈0,1||,∈0,1||×|Ω|x∈\0,1\^|A|,y∈\0,1\^|A|×| |. The total number of integer assignment configurations is at most 2||⋅(|Ω|+1)2^|A|·(| |+1), which is strictly finite. At each iteration k where candidate solution ((k),(k))(x^(k),y^(k)) is rejected by the Authoritative Temporal Solver: (1) If rejection is caused by an unavoidable directed precedence chain whose critical path exceeds available lead time (tCP+δready>Tdead−t0−δexect_CP+ _ready>T_dead-t_0- _exec), structural cut (47) (∑a∈Vchainxa≤|Vchain|−1 _a∈ V_chainx_a≤|V_chain|-1) is added. This strictly forbids VchainV_chain and all supersets from being generated in future iterations, pruning at least one point in 0,1||\0,1\^|A|. (2) Otherwise, the failure is caused by freshness expiration or concurrency collision among assigned witnesses. When certified by an exact subproblem evaluation, the solver identifies active conflicting assignment pairs Aconflict=(a,ω)∣ya,ω(k)=1A_conflict=\(a,ω) y_a,ω^(k)=1\, and appends assignment cut (46) (∑(a,ω)∈Aconflictya,ω≤|Aconflict|−1 _(a,ω)∈ A_conflicty_a,ω≤|A_conflict|-1). If heuristic evaluation exhausts without certified proof (NotFound), a safe full-candidate combinatorial no-good cut (∑a:xa(k)=1(1−xa)+∑a:xa(k)=0xa≥1 _a:x_a^(k)=1(1-x_a)+ _a:x_a^(k)=0x_a≥ 1) is appended. Each cut strictly eliminates candidate assignment ((k),(k))(x^(k),y^(k)) without pruning unvisited alternatives. Because each iteration strictly eliminates at least one previously unvisited integer assignment point and the total number of integer assignments is finite, the LBBD loop must terminate in a finite number of iterations (at most 2||⋅(|Ω|+1)2^|A|·(| |+1)). Part 2: Soundness of Cuts and Global Optimality. To establish global cost optimality upon non-timeout termination: 1. Outer Relaxation Property: The initial Master ILP (37)–(48) without conflict cuts enforces all necessary conditions of prospective admissibility: operational prerequisite closure (xa≤xux_a≤ x_u), multi-obligation quorum coverage, EFD diversity cuts, and resource budgets. Thus, the feasible region of the Master ILP is an outer relaxation of Πadm() _adm(P). 2. Soundness of Pruning: A cut is valid if it prunes no prospectively admissible plan π∈Πadm()π∈ _adm(P). Structural cuts are sound because if a subset of operations VchainV_chain has a topological critical path exceeding Tdead−t0−δready−δexecT_dead-t_0- _ready- _exec, latency monotonicity guarantees that no schedule containing VchainV_chain can complete before the hard deadline under conservative latencies. Assignment cuts are sound when subproblem infeasibility is certified authoritatively by an exact temporal oracle (evaluating all discrete topological serializations and continuous dispatch intervals via STN enumeration). Tier 1 and Tier 2 backward heuristics operate on a discrete grid and provide polynomial-time sound schedule admission, but heuristic exhaustion (NotFound) cannot mathematically prove continuous infeasibility; hence, heuristic failures use safe full-candidate combinatorial cuts to avoid unsound over-pruning. 3. Optimality of the First Feasible Candidate: The Master ILP minimizes the exact non-decreasing linear objective function Z()=∑a∈c(a)xaZ(x)= _a c(a)x_a. When subproblems are evaluated with exact completeness, cuts prune only provably infeasible points, so the sequence of optimal objective values returned by the Master ILP is monotonically non-decreasing: Z((1))≤Z((2))≤⋯≤Z(∗)Z(x^(1))≤ Z(x^(2))≤·s≤ Z(x^*). When candidate ∗x^* is first verified as temporally feasible, it satisfies all constraints of Πadm() _adm(P) and its cost is a valid lower bound on all unvisited feasible candidates. Hence, Cost(π∗)=min∑aπ∈Πadm()c(a)Cost(π^*)= _π∈ _adm(P) _ac(a), proving conditional global optimality on the modeled instance P. This completes the proof. ∎ Appendix B Catalogue of Assurance Operations Table 4 provides a representative taxonomy of assurance operations supported in the AAS reference implementation, categorized across operational risk, latency, cost, and typical validity windows. Appendix C Open Problems and Roadmap Negative Knowledge Induction (The Hardknock Bridge). When an assurance plan fails to reach admission—or an admitted action triggers an unexpected incident—the execution trace can reveal omitted epistemic dependencies and correlated failures. A remaining research question is how to use such traces to revise future admission obligations Ω without overfitting to individual incidents. Human-Referential Fidelity and Intent Drift. While AAS models physical state freshness and epistemic diversity, it treats intent predicate ϕω _ω as fixed. In long-running autonomous workflows, operator intent or business context may drift while evidence is gathered. Formulating formal fidelity metrics connecting physical evidence directly to human-referential intent remains an active research direction. Multi-Tenant Cross-Sovereignty Scheduling. When orchestrating operations across multiple cloud domains, assurance must navigate heterogeneous trust roots, non-comparable clocks, and data-residency boundaries. Extending AAS to federated epistemic markets is a compelling direction for future architectures.