Paper deep dive
Executor-Side Progressive Risk-Gated Actuation for Agentic AI in Wireless Supervisory Control
Zhenyu Liu, Yi Ma, Rahim Tafazolli
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 7/8/2026, 9:18:07 AM
Summary
This paper introduces Progressive Risk-Gated Actuation (PRGA), an executor-side contract for agentic AI in O-RAN wireless supervisory control. PRGA structures intents into three evidence layers (C0, C1, C2) and uses a deterministic two-stage policy to decide whether to commit, gate for coordination evidence, or reject actions based on freshness, conflict, bandwidth, and risk divergence. Evaluated on 3GPP-parameterized benchmarks, PRGA significantly reduces actuation latency and control-plane overhead while maintaining safety margins and rejecting stale inputs.
Entities (8)
Relation Signals (8)
Progressive Risk-Gated Actuation (PRGA) → structures → C0, C1, C2
confidence 95% · PRGA structures each intent into executable local triage (C0), on-demand coordination evidence (C1), and post-hoc provenance support (C2)
Executor → applies → Progressive Risk-Gated Actuation (PRGA)
confidence 90% · the executor boundary at which AI-generated wireless intents become live supervisory actions
Progressive Risk-Gated Actuation (PRGA) → operateson → O-RAN
confidence 90% · PRGA structures each intent into executable local triage... for risk-gated wireless intent execution.
Progressive Risk-Gated Actuation (PRGA) → reduces → time-to-first-safe-action
confidence 90% · PRGA reduces time-to-first-safe-action by 23.3–27.4%
Progressive Risk-Gated Actuation (PRGA) → reduces → control-plane_bytes
confidence 90% · per-commit control-plane bytes by 52.7–54.2%
Progressive Risk-Gated Actuation (PRGA) → rejects → stale_inputs
confidence 90% · rejects 100% of injected over-threshold stale inputs
Progressive Risk-Gated Actuation (PRGA) → evaluatedon → 3GPP
confidence 85% · On two 3GPP-parameterized energy-saving and slice-SLA benchmarks, PRGA reduces time-to-first-safe-action
Progressive Risk-Gated Actuation (PRGA) → compatiblewith → A2A Protocol
confidence 80% · map the contract through an adapter-compatible pattern onto O-RAN SMO/Non-RT-RIC workflows and A2A/MCP carrier interfaces
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agentic artificial intelligence (AI) shows promise for automating O-RAN wireless supervisory control, but translated intents still require an executor-side decision before live network actuation. Existing control flows lack explicit semantics for whether an intent should commit, gate for evidence, or reject under stale telemetry, concurrent policies, deadline and bandwidth limits, and rollback constraints. We propose Progressive Risk-Gated Actuation (PRGA), an executor-side contract for risk-gated wireless intent execution. PRGA structures each intent into executable local triage (C0), on-demand coordination evidence (C1), and post-hoc provenance support (C2), with C2 kept off the online safety path. A deterministic two-stage policy checks expiry, freshness, rollback-handle validity, local conflict, blocking preconditions, and planner-executor risk divergence from C0, then retrieves C1 only for gated intents when deadline and bandwidth budgets allow; evidence-mandatory gates reject when required C1 is unavailable. On two 3GPP-parameterized energy-saving and slice-SLA benchmarks, PRGA reduces time-to-first-safe-action by 23.3-27.4% and per-commit control-plane bytes by 52.7-54.2% against a decision-identical eager full-evidence cost-overlay comparator, thereby isolating retrieval-cost accounting; remains non-inferior within a pre-declared 0.5 percentage-point unsafe-action margin against an invariant-respecting static-threshold comparator; and rejects 100% of injected over-threshold stale inputs in the stale-state fault campaign. On these benchmarks, PRGA improves supervisory responsiveness and control-plane efficiency within the evaluated unsafe-action boundary.
Tags
Links
- Source: https://arxiv.org/abs/2605.02697v1
- Canonical: https://arxiv.org/abs/2605.02697v1
Trouble viewing inline? Open PDF directly →
Full Text
107,598 characters extracted from source content.
Expand or collapse full text
Executor-Side Progressive Risk-Gated Actuation for Agentic AI in Wireless Supervisory Control Zhenyu Liu, Yi Ma, and Rahim Tafazolli Z. Liu, Y. Ma, and R. Tafazolli are with the 6GIC, Institute for Communication Systems, University of Surrey, Guildford, United Kingdom, GU2 7XH (e-mail: zhenyu.liu, y.ma, r.tafazolli@surrey.ac.uk). Abstract Agentic artificial intelligence (AI) shows promise for automating O-RAN wireless supervisory control, but translated intents still require an executor-side decision before live network actuation. Existing control flows lack explicit semantics for whether an intent should commit, gate for evidence, or reject under stale telemetry, concurrent policies, deadline and bandwidth limits, and rollback constraints. We propose Progressive Risk-Gated Actuation (PRGA), an executor-side contract for risk-gated wireless intent execution. PRGA structures each intent into executable local triage (C0), on-demand coordination evidence (C1), and post-hoc provenance support (C2), with C2 kept off the online safety path. A deterministic two-stage policy checks expiry, freshness, rollback-handle validity, local conflict, blocking preconditions, and planner–executor risk divergence from C0, then retrieves C1 only for gated intents when deadline and bandwidth budgets allow; evidence-mandatory gates reject when required C1 is unavailable. On two 3GPP-parameterized energy-saving and slice-SLA benchmarks, PRGA reduces time-to-first-safe-action by 23.3–27.4% and per-commit control-plane bytes by 52.7–54.2% against a decision-identical eager full-evidence cost-overlay comparator, thereby isolating retrieval-cost accounting; remains non-inferior within a pre-declared 0.5 percentage-point unsafe-action margin against an invariant-respecting static-threshold comparator; and rejects 100% of injected over-threshold stale inputs in the stale-state fault campaign. On these benchmarks, PRGA improves supervisory responsiveness and control-plane efficiency within the evaluated unsafe-action boundary. I Introduction Sixth-generation (6G) wireless networks increasingly consider the Open Radio Access Network (O-RAN) architecture, in which supervisory control decisions are made at the Service Management and Orchestration (SMO) and Non-Real-Time RAN Intelligent Controller (Non-RT-RIC) layers on a seconds-to-minutes timescale [29, 28]. At this timescale, representative supervisory workloads include pushing energy-saving policies to base stations during low-load periods and protecting per-slice service-level objectives when traffic, interference, or radio conditions shift. Agentic artificial intelligence (AI), in which a planner agent observes telemetry, formulates a control intent, and dispatches it for actuation, is being explored as an automation substrate for these supervisory workloads [39, 35, 23, 15, 22]. At the executor boundary, however, an AI-generated intent is no longer only a high-level recommendation: it may become a concrete supervisory operation, such as putting a cell into sleep mode, reducing RF power, changing slice priority, restricting admission, or reallocating radio resources across slices. Consider an O-RAN energy-saving application in which a planner observes a low-load telemetry snapshot and proposes to put a cell into sleep mode or reduce its RF power. By the time the executor receives the translated intent, traffic may have shifted, a neighboring cell may already be near capacity, another planner may have issued a slice-protection update over overlapping resources, and the rollback handle may no longer match the active policy version. An executor that acts only on the minimal executable payload would commit quickly but may create a coverage, overload, or slice-SLA incident; an eager full-evidence executor would retrieve more coordination context but may delay the first admissible action and inflate supervisory control-plane load. The executor therefore needs to decide whether the intent is locally admissible, must be gated for coordination evidence, or must be rejected before it changes the live network. Within this loop, the executor is the last accountable control boundary before an AI-generated intent becomes a live network configuration change. Telemetry can be epoch-stale, multiple intents can target overlapping resources, deadlines can be tight, and many supervisory actions are only partially recoverable. Acting on the executable payload alone minimizes latency but can commit stale or conflicting actions, whereas eager retrieval of all coordination evidence increases the time to an admissible action and consumes scarce supervisory control-plane capacity. What is missing is an executor-side actuation contract that is evaluated before any supervisory configuration change is applied to the managed network. Prior work touches this boundary but does not specify the executor decision itself. O-RAN architecture and supervisory interfaces [29, 28] specify placement and policy exchange; intent-based networking (IBN) defines intent lifecycles and refinement processes [11, 21, 26, 27]; agent interoperability shells such as the Agent-to-Agent (A2A) protocol, the Model Context Protocol (MCP), and multi-agent orchestration frameworks carry tasks, tools, resources, and artifacts [4, 8, 37]; runtime-assurance designs provide monitors, fallback logic, and safety switching [24, 25]; and trust or provenance frameworks support post-hoc accountability [32]. However, these lines of work do not specify the executor-side semantics that determine which evidence is sufficient to commit now, which uncertainty requires coordination evidence, and which conditions require rejection under freshness, rollback, deadline, bandwidth, and planner–executor risk-boundary constraints. We propose Progressive Risk-Gated Actuation (PRGA), an executor-side wireless supervisory actuation contract that turns the executor from a passive actuator of AI-generated commands into a progressive risk gate before live network actuation. PRGA organizes each incoming intent into three role-separated evidence layers: a base layer ( C0) that carries the executable fields needed for local triage, a coordination layer ( C1) that carries coordination evidence retrieved only on gated paths, and a digest layer ( C2) that supports post-hoc provenance and reconstructability off the online safety path. Intents whose local checks do not expose expiry, stale telemetry, rollback invalidity, local conflict, planner–executor risk divergence, or unmet blocking preconditions, and whose computed risk falls below the commit threshold, can commit from C0. Ambiguous or evidence-mandatory intents retrieve C1 only when the online deadline and bandwidth budget admit it; stale, unverifiable, or resource-constrained evidence-mandatory gates are rejected rather than silently committed under degraded conditions. Fig. 1 illustrates this executor-side loop and separates PRGA’s actuation semantics from the A2A, MCP, and O-RAN carrier shells, which serve as compatibility context rather than the primary novelty. Our main contributions are summarized as follows: 1) Executor-side operational actuation model. We formulate the executor boundary at which AI-generated wireless intents become live supervisory actions. The model captures stale telemetry, conflicting candidate intents, deadline and bandwidth limits, rollback validity, and planner–executor risk divergence, and relates these factors to potential operational harms such as misplaced cell sleep, neighbor-cell overload, slice-SLA degradation, resource contention, and hard-to-recover reconfiguration. This localizes the bottleneck between translated intent and network actuation, so PRGA is evaluated as a wireless supervisory-control contract rather than as a generic agent-protocol extension. 2) PRGA actuation contract. We define C0/ C1/ C2 as role-separated evidence layers of an executor-side contract and specify the corresponding commit, gate, and reject semantics under expiry, freshness, rollback, conflict, blocking, and planner–executor risk-divergence checks. 3) Invariant-gated progressive retrieval and compatibility mapping. We develop a deterministic two-stage policy that retrieves coordination evidence only when the gate reason and online deadline/bandwidth budget require it, and map the contract through an adapter-compatible pattern onto O-RAN SMO/Non-RT-RIC workflows and A2A/MCP carrier interfaces as compatibility context, without treating those shells as protocol-level novelty or as a full-stack deployment result. 4) Standards-parameterized wireless supervisory evaluation. We evaluate PRGA on energy-saving policy push and slice service-level-agreement (SLA) protection benchmarks parameterized around 3GPP supervisory-control contexts. Relative to a decision-identical eager full-evidence cost-overlay comparator, PRGA lowers time-to-first-safe-action by 23.3–27.4% and per-commit control-plane bytes by 52.7–54.2%, thereby isolating retrieval-cost accounting; relative to an invariant-respecting static-threshold comparator, it remains non-inferior within a pre-declared Δ=0.5p =0.5\,p unsafe-action margin, and it rejects 100% of injected over-threshold stale inputs in the stale-state fault campaign. These results show benchmark-scoped supervisory responsiveness and control-plane efficiency improvements within the evaluated unsafe-action boundary. Figure 1: Network-first overview of PRGA: a planner-issued wireless supervisory intent passes through the executor’s C0/ C1/ C2 contract before live actuation, with A2A, MCP, and O-RAN as the compatibility shell. I Related Work We position our work along four technical axes for wireless supervisory control: agentic AI and multi-agent wireless control; O-RAN, intent-based networking (IBN), and supervisory policy control; runtime assurance, freshness, and safe actuation; and agent interoperability, tool invocation, and provenance. I-A Agentic AI and Multi-Agent Wireless Control Agentic AI has been applied to wireless supervisory workloads. AgentRAN [15] deploys LLM-powered agents across O-RAN timescales with over-the-air validation; ComAgent [23] uses a multi-LLM perception–planning–action–reflection loop for wireless optimization; and Li et al. [22] introduce a perception/reasoning/refinement multi-agent stack with retrieval-augmented reasoning for conflict-aware rApp policy orchestration in Open RAN. Multi-agent orchestration frameworks such as AutoGen [37] coordinate conversational workflows across heterogeneous agents. Semantic-communication work [30, 38] optimizes how task-relevant meaning is encoded over noisy wireless links and is complementary to the supervisory control plane studied here. These systems focus on planner reasoning, agentic wireless control architectures, and PHY/link-layer semantic encoding rather than the executor-side commit/gate/reject actuation semantics that PRGA targets. I-B O-RAN, IBN, and Supervisory Policy Control The O-RAN architecture [29] provides a supervisory control plane through the SMO and Non-RT RIC, with the A1 interface [28, 17, 16] supporting policy and enrichment-information exchange on seconds-to-minutes timescales. IBN formalizes the intent lifecycle—specification, translation, activation, and assurance—as surveyed by Leivadeas and Falkner [21], standardized in IETF RFC 9315 [11], and extended by Mehmood et al. [26] for cellular networks; Njah et al. [27] integrate AI-driven refinement into an end-to-end IBN pipeline. These works define placement, interfaces, and the intent lifecycle that govern what the network should achieve. PRGA is complementary: it operates inside the activation/execution boundary after an intent has been translated, taking commit/gate/reject decisions on each translated intent under freshness, rollback, and risk-divergence constraints rather than defining the lifecycle in which the intent originates. I-C Runtime Assurance, Freshness, and Safe Actuation Runtime assurance focuses on safety monitors, switching logic, and fault handling. Dynamic Simplex [24] preempts an unverified high-performance controller with a verified safety controller via switching logic, while shielding for safe reinforcement learning [7] and the classical supervisory-control framework for discrete-event systems [31] provide complementary safety-monitor and switching-control lineages. Safe multi-agent reinforcement learning [25] addresses adversarial communication in wireless settings through cooperative agent selection and message authentication. Freshness and telemetry consistency are central to wireless supervisory actuation under stale state and form a distinct axis from after-the-fact safety fallback. Runtime assurance is complementary to PRGA: a monitor decides when to fall back, while the executor-side contract decides whether the intent commits in the first place under explicit freshness, rollback, and risk-divergence checks. I-D Agent Interoperability, Tool Invocation, and Provenance The Agent-to-Agent (A2A) protocol [4] defines a task lifecycle with structured message parts, artifact streaming, and profile extensions. The Model Context Protocol (MCP) [8] standardizes tool, resource, and prompt access through capability negotiation over JSON-RPC transport. These shells provide transport rather than executor-side actuation semantics for wireless supervisory control. Trust, Risk, and Security Management frameworks for agentic AI [32] provide taxonomies for decision provenance, sandboxing, and model-operations governance in LLM-based multi-agent systems. PRGA’s C2 digest sits in the same family: kept off the online safety path, complementary to A2A/MCP transport and TRiSM-style provenance taxonomies rather than replacing them. I-E Positioning Summary Existing agent-interoperability shells provide transport and tool/resource access; O-RAN and IBN define supervisory policy context and the intent lifecycle; runtime-assurance work provides complementary safety-monitoring and freshness-handling concepts; and provenance frameworks formalize post-hoc accountability. Each axis is load-bearing on its own. PRGA contributes the executor-side wireless supervisory actuation contract that decides commit/gate/reject under stale and conflicting network state, with selective retrieval of coordination evidence on gated paths and post-hoc provenance separated by role. Table I consolidates the discriminators most relevant to this niche: executor-side actuation semantics, selective evidence retrieval, staleness and rollback handling, and wireless KPI evaluation. The seven axes used in Table I are: Exec.-Side Actuation (a typed executor-side contract with commit/gate/reject semantics for the translated intent); Coord. Evidence (a separate channel for coordination/verification evidence rather than a monolithic message); Provenance (an off-path audit record of the decision); Sel. Retrieval (selective retrieval of additional coordination evidence triggered by a risk gate when the online deadline and bandwidth budget admit it); Formal State Machine (analyzable commit/gate/reject transitions with named invariants); A2A/MCP Compat. (realizable as a profile over existing agent-interoperability shells); and Wireless Benchmark (evaluation on a wireless supervisory workload). ✓/∘ /✗denote native/partial/not-addressed-in-the-cited-work support, where ✗ marks features not addressed in the cited source rather than a claim that the work could not provide them; “Realizable” marks native compatibility via profile-level mapping without shell modification. TABLE I: Related-work comparison across seven positioning axes for wireless supervisory control. Work Domain Exec.-Side Actuation Coord. Evidence Provenance Sel. Retrieval Formal State Machine A2A/MCP Compat. Wireless Benchmark A2A [4] General AI ✗ ✗ ✗ ✗ ✗ ✓ ✗ MCP [8] General AI ✗ ✗ ✗ ✗ ✗ ✓ ✗ AutoGen [37] General AI ✗ ✗ ✗ ✗ ✗ ∘ ✗ ComAgent [23] Wireless ∘ ✗ ✗ ✗ ✗ ✗ ∘ O-RAN A1 [29, 28] Wireless ∘ ∘ ✗ ✗ ✗ ∘ ∘ IBN Survey [21] Networking ∘ ✗ ✗ ✗ ✗ ✗ ✗ RFC 9315 [11] Networking ∘ ✗ ✗ ✗ ✗ ✗ ✗ Njah et al. [27] Networking ∘ ✗ ✗ ✗ ✗ ✗ ∘ AgentRAN [15] Wireless ∘ ∘ ✗ ✗ ✗ ✗ ✓ Li et al. [22] Wireless ∘ ∘ ✗ ✗ ✗ ✗ ✓ Simplex [24] CPS / Safety ✗ ✗ ✗ ✗ ∘ ✗ ✗ Safe MARL [25] Wireless ✗ ✗ ✗ ✗ ✗ ✗ ✓ TRiSM [32] General AI ✗ ✗ ∘ ✗ ✗ ✗ ✗ OURS Wireless ✓ ✓ ✓ ✓ ✓ Realizable ✓ I Wireless Supervisory Network Model and Problem Formulation We model PRGA at the executor boundary of a wireless supervisory loop, then define the transaction state, objective, failure modes, and benchmark mapping consumed by Sections IV through VI. I-A Wireless Supervisory Network State The supervisory loop runs on a seconds-to-minutes timescale over a finite set of managed radio nodes ℬ=b1,…,b|ℬ|B=\b_1,…,b_|B|\ (cells / base stations) and a finite set of services =s1,…,s||S=\s_1,…,s_|S|\ (slices / SLA-bearing services). At decision epoch t, the network state is zt=(xt,lt,qt,et,ut),z_t\;=\; (x_t,\;l_t,\;q_t,\;e_t,\;u_t ), (1) where xtx_t is the controllable resource and configuration vector across ℬ×B×S (PRB allocation, RF power or sleep state, slice priority class, admission-control parameters), ltl_t is the per-cell aggregate load and per-slice traffic-demand vector, qtq_t is the SLA / KPI monitoring vector (delay, throughput, SLA violation rate, fairness, capacity margin), ete_t is the energy state or energy-cost component, and utu_t is a structured uncertainty bundle that aggregates staleness, conflict intensity, reversibility class, blocking preconditions, and the planner–executor risk divergence relevant to the candidate intent. A benchmark-grounded admissible region safeX_safe over (state, action) pairs is induced by capacity, SLA, slice-isolation, fairness, staleness, and rollback-feasibility predicates over the underlying committed wireless action; we treat safeX_safe as evaluation-truth used to label outcomes after the fact rather than as a predicate the executor inspects online at every epoch. The supervisory transition zt+1=F(zt,a¯t,wt),z_t+1\;=\;F\! (z_t,\; a_t,\;w_t ), (2) where a¯t a_t is the underlying wireless actuation actually applied to the network and wtw_t is an exogenous disturbance, is an abstraction we use for executor-side reasoning and for deterministic benchmark replay; it is not a claimed real-network dynamics model. The formal model is used to state executor-side invariants and decision semantics; it is not a convergence, optimal-control, or topology-evolution theory. Some components of ztz_t are realized directly by the benchmark while others are modeling devices: qtq_t is benchmark output rather than fresh per-epoch telemetry; ete_t is realized for UC1 and treated as absent or a modeling device for UC2; safeX_safe and the use-case safety predicates of Section I-D are evaluation-labeling constructs from scenario truth. Online decisions are governed by local executor checks, verifier outputs, and the deterministic threshold rules of Section IV, not by direct inspection of the ground-truth predicate. I-B Agentic Planner–Executor Actuation Loop The supervisory loop comprises four logical roles: a planner agent that emits candidate control intents, an executor that locally validates each intent and actuates it on the managed network, a configured set of verifier agents that assess cross-domain constraints when coordination evidence is required, and an audit store that records post-hoc provenance off the online decision path. In an O-RAN deployment the planner can be placed in the SMO framework or the Non-RT RIC [29, 28], with the executor as the downstream control entity that applies the action to the managed radio nodes; we use this placement only as deployment context. A2A/MCP shells and O-RAN management interfaces are treated as compatibility context in Section V. At epoch t the planner reasons over a possibly stale snapshot zt−τz_t-τ and emits a candidate control-intent message c that names an underlying wireless action drawn from the use-case action catalogs introduced in Section IV. The executor acts using a local current-state estimate of ztz_t and the executor-observable transaction state defined in Section I-C, and decides whether to commit the underlying action, gate it for additional coordination evidence, or reject it. Verifier agents check cross-domain constraints only when coordination evidence is fetched, and the audit store records reconstructability evidence post-hoc; the audit layer supports accountability rather than online safety. Each control-intent message also carries the common transaction envelope used for local schema, expiry, and idempotency checks (transaction identifier, state epoch, expiry, idempotency key, visibility scope); protocol-level realization is deferred to Section V. Two action levels. We distinguish the underlying wireless actuation type a¯t∈Anet a_t∈ A^net (drawn from the typed UC1 and UC2 catalog of Section IV) from the executor’s retrieval and actuation decision ηt∈commit@,upgrade@,human-gate,reject _t∈\\,commit@ C0,\;upgrade@ C1,\;human-gate,\;reject\,\. Replanning after Reject is a planner-side follow-up rather than a fifth element of the executor decision set. The network safety predicates and the supervisory transition F depend on a¯t a_t, while the efficiency objective also depends on ηt _t. I-C Executor-Observable Transaction State For a candidate intent at epoch t, the retrieval policy operates over a compact executor-observable transaction state t=(rt,dt,bt,ct,σt,ρt), s_t\;=\; (r_t,\;d_t,\;b_t,\;c_t,\; _t,\; _t ), (3) where rt∈[0,1]r_t∈[0,1] is the planner-provided risk score, dt>0d_t>0 is the remaining time budget before the intent expires, bt>0b_t>0 is the available control-plane bandwidth budget at the executor, ct∈[0,1]c_t∈[0,1] is the conflict intensity computed from the active-intent registry (distinct from the candidate intent object c used as the algorithm input in Section IV), σt≥0 _t≥ 0 is the epoch gap between the planner’s snapshot and the executor’s current epoch, and ρt _t encodes the reversibility class of the proposed action (irreversible, costly-reversible, or reversible). The transaction state t s_t is not the full network state ztz_t: dtd_t and btb_t are decision-context resource budgets entering only at Stage 2 of Section IV. The uncertainty bundle utu_t is candidate-relative: the staleness σt _t and the conflict intensity ctc_t are computed relative to the network state and the active-intent registry, while the reversibility class, the blocking preconditions, and the planner–executor risk-divergence flag are evaluated against the candidate intent itself. Empirically, utu_t matters as a bundle rather than as independently isolated fields: the No-Wireless-Inputs ablation in Section VI supports that the evaluated stale-state defense depends on the structured wireless state-input bundle, not on isolated per-field contributions. I-D Objective and Problem Scope A retrieval policy π that maps the executor-observable transaction state t s_t to a decision ηt _t induces a long-run expected cost π[αLt+βBt+γUt+ωRt],E_π\! [\,α\,L_t\,+\,β\,B_t\,+\,γ\,U_t\,+\,ω\,R_t\, ], (4) where LtL_t is the time-to-first-safe-action component, BtB_t is the online control-plane cost component (reported in prose as “per-commit control-plane bytes”), UtU_t is the unsafe-action loss induced by violation of safeX_safe or the use-case unsafe predicate by the underlying committed action, and RtR_t is the rollback or recovery cost tied to reversibility and rollback-handle validity. The weights α,β,γ,ω>0α,β,γ,ω>0 express operator-specified relative importance. Eq. (4) motivates the design-space trade-off; we do not solve it as a formal optimization. The implemented policy is the deterministic threshold-based decision policy of Section IV. We label outcomes against use-case-specific safety predicates over the underlying committed action a¯t a_t and the ground-truth scenario state: ϕUC1(zt,a¯t) _UC1(z_t, a_t) holds when the post-action serving-cell load remains within capacity and the user-throughput change stays within the SLA limit on the affected cells in ℬB; ϕUC2(zt,a¯t) _UC2(z_t, a_t) holds when the post-action slice-SLA violation rate remains within the contracted threshold on every affected slice in S. Both predicates are scored from scenario truth and are not inspected by the executor online. I-E Threat and Failure Model Five failure modes shape executor-side actuation under stale and conflicting state: stale telemetry (snapshot lag risking cell overload, misplaced sleep, or SLA degradation), conflicting intents from concurrent planner threads (slice-isolation or fairness violations, capacity contention) [5], deadline pressure (coordination evidence may not arrive within the actuation window), missing or invalid rollback handles (non-irreversible reconfigurations cannot be undone, and irreversible actions cannot rely on rollback at all), and missing provenance (no structured post-hoc record for disputed-action accountability). These failure modes are handled by the two-stage policy of Section IV, with a post-hoc audit record emitted off the online decision path. We do not assume adversarial cybersecurity coverage beyond the fault injectors evaluated in Section VI, and we do not claim real-world safety guarantees or live-deployment validation. I-F Design Goals and Model-to-Benchmark Mapping These analyses motivate PRGA’s design targets, instantiated by the two-stage policy of Section IV: reduce time-to-first-safe-action and per-commit control-plane bytes via local triage when safe; preserve invariant-respecting actuation semantics through freshness, rollback, conflict, blocking-precondition, and planner–executor risk-divergence checks under stale or conflicting state; fetch coordination evidence only on gated paths within deadline and bandwidth budgets; and remain mappable to O-RAN, A2A, and MCP shells as compatibility context rather than protocol novelty. Model-to-benchmark correspondence. Table I classifies each model element as fully realized by the benchmark, partially realized, or used as a modeling device that connects executor checks to evaluation truth. TABLE I: Model-to-benchmark correspondence for the executor-side PRGA model. Field Benchmark instantiation Status Notes ℬB cell registry exercised by UC1 actions partially realized topologies beyond the benchmark are out of scope S slice registry exercised by UC2 actions partially realized UC2 exercises multi-slice coordination xtx_t active flag, RF power / reconfiguration target, slice priority and admission, slice resource allocation partially realized action effects modify xtx_t via the catalog ltl_t diurnal load and stochastic conflict events from the scenario engine partially realized not validated against an external 3GPP load model qtq_t energy and SLA / fairness / throughput cells of the evaluation table fully realized benchmark output; comparator behavior is reported in Section VI ete_t UC1 energy-saving cell partially realized realized for UC1; not separately instantiated for UC2 utu_t staleness, conflict intensity, reversibility class, blocking preconditions, risk-divergence flag partially realized non-numeric fields carry structured semantics ztz_t composite of xt,lt,qt,et,utx_t,l_t,q_t,e_t,u_t in Eq. (1) modeling device not separately measured; excludes dt,btd_t,b_t safeX_safe predicate composition over invariants and use-case safety predicates modeling device evaluation-truth, not online-inspected a¯t,ηt a_t,\; _t typed UC1 / UC2 action catalog for a¯t a_t; deterministic retrieval policy for ηt _t fully realized catalog actions and deterministic retrieval decisions are implemented in Section IV t s_t six-component executor-observable tuple partially realized decision-context, not network-state dt,btd_t,\;b_t per-intent deadline and control-plane bandwidth budget at epoch t partially realized inputs to the Stage-2 retrieval gate ϕUC1 _UC1, ϕUC2 _UC2 cell-load capacity and per-slice SLA-violation thresholds fully realized evaluation-labeling predicates F deterministic scenario-engine update under fixed seeds modeling device benchmark replay; not a real-network dynamics model wtw_t sampled traffic, conflict, and deadline perturbations partially realized exogenous scenario disturbance under fixed seeds C2 digest post-hoc audit record off the online decision path partially realized supports accountability / reconstructability The partially realized and modeling-device rows are explicit scope limits, not live-network digital-twin claims; they provide the precision needed for the invariants and decision semantics of Section IV and Section V while remaining anchored to the UC1 and UC2 evaluations of Section VI. Calibration context follows TR 38.864 [1] for UC1 and TS 28.541 [3] with KPI templates from TS 28.554 [2] for UC2, as scope citations rather than validation claims. IV Progressive Control-Intent Actuation Contract PRGA is an executor-side actuation contract that maps an incoming control intent to one of Commit, Gate, or Reject before any underlying wireless action is applied to the managed network. The contract is organized into three role-separated evidence layers ( C0/ C1/ C2): C0 is the base executable intent used by local triage, C1 is coordination evidence retrieved on demand when triage gates a decision, and C2 is a post-hoc provenance digest written after the online decision and used for audit and reconstructability. The online decision path uses C0 and, when a gated case triggers retrieval under deadline and bandwidth that admit it, C1; C2 is not part of the online safety decision. This section defines the three layers, the typed wireless action catalog, the risk-score formulation, and the two-stage deterministic retrieval policy that governs Commit/Gate/Reject transitions. Algorithm 1 specifies Stage 1 C0 triage, returning a decision and, for gated intents, a gate reason; Algorithm 2 then resolves gated intents through the C1-fetchable verifier-quorum branch or, when C1 is unavailable, through the evidence-mandatory rejection and Mid-Risk-only degraded-mode rules. Compact implementation-aligned counterparts of the design invariants stated below appear in Section V under their explicit assumptions. IV-A C0 — Executable Control Intent The C0 layer is the minimum executable payload that an executor requires for immediate triage. C0 rides inside the common transaction envelope introduced in Section I-B, which carries transaction-scoped metadata (transaction id, state epoch, expiry, idempotency key) shared across C0/ C1/ C2; the executor-side commit/gate/reject semantics developed below reside in the contract itself, not in the shell. Its fields are listed in Table I. TABLE I: C0 field schema (200–400 B serialized). Field Description intent_type Action type from the catalog (Table IV) proposed_action Parameterized action specification target_scope Managed object identifiers (e.g., cell, slice) resource_keys Resources affected (PRBs, power, etc.) state_epoch Planner’s telemetry snapshot epoch expires_at Absolute expiry timestamp reversibility_class reversible, costly-reversible, irreversible risk_score Planner-computed risk ∈[0,1]∈[0,1] rollback_handle Reference to rollback procedure needs_upgrade Planner-side C1 upgrade assertion (Boolean) blocking_req Prerequisites that must hold before commit Typed action catalog. Each intent_type maps to a static tuple of reversibility class and risk class, fixing the safety semantics before any runtime assessment. Table IV lists the ten action types across both use cases. TABLE IV: Typed action catalog for UC1 and UC2. UC Action Type Rev. Class Risk UC1 Cell_Sleep reversible med Cell_Wake reversible low RF_Power_Reduce reversible low RF_Reconfig costly-rev. high Load_Redirect reversible med UC2 Slice_Priority_Boost reversible low Slice_Admission_Restrict costly-rev. med Slice_Resource_Realloc costly-rev. high Load_Balance_Update reversible med SLA_Escalate irreversible low The reversibility class determines whether a rollback handle is mandatory (all classes except irreversible), and the risk class seeds the risk-score computation defined next. IV-B Risk Score and Thresholds Given a candidate action a and system state t s_t, the executor computes a composite risk score: r(a,t)=wtϕ(a)+wsσ^(st)+wcc^(st)+wnn^(st),r(a, s_t)\;=\;w_\!t\,φ(a)\;+\;w_\!s\, σ(s_t)\;+\;w_\!c\, c(s_t)\;+\;w_\!n\, n(s_t), (5) where ϕ(a)∈0.2,0.5,0.8φ(a)\!∈\!\0.2,0.5,0.8\ maps the risk class to a numeric value, σ^=min(|epochexec−state_epoch|/δ, 1) σ= (|epoch_exec- state\_epoch|\,/\,δ,\;1) is normalized staleness [20], c c is the conflict intensity (ratio of overlapping active intents to a use-case-dependent maximum), and n n is resource contention (utilization/capacity). Default weights are (wt,ws,wc,wn)=(0.3,0.3,0.2,0.2)(w_\!t,w_\!s,w_\!c,w_\!n)=(0.3,0.3,0.2,0.2), calibrated per use case. Table V lists the threshold parameters that govern triage decisions. All thresholds are frozen before evaluation. TABLE V: Threshold parameters. Parameter UC1 UC2 Meaning τcommit _commit 0.30 0.25 Below: safe to commit from C0 τreject _reject 0.80 0.75 At/above: Stage-1 local reject floor before evidence gates τdegraded _degraded 0.50 0.40 Upper bound for Mid-Risk-gated degraded commit δ 30 s 10 s Max acceptable state age dmind_ 5 s 2 s Min remaining deadline for C1 bminb_ 2 KB 1 KB Min bandwidth for C1 fetch εtrust _trust 0.15 0.15 Risk divergence tolerance IV-C Stage 1: C0 Triage Algorithm 1 specifies the C0 triage executed locally by the executor upon receiving a control intent. The procedure is deterministic: it requires only the C0 payload and the five locally maintained inputs (executor epoch, target utilization, active intent registry, action catalog, and threshold configuration). Algorithm 1 Stage 1: C0 Triage 0: C0 intent c, current time tnowt_now, executor state ℰE 0: (decision,gate_reason) with decision∈Commit,Gate,Reject,gate_reason∈None,Risk-Divergence,Local-Conflict,Planner-Upgrade,Mid-Risk,gate_reason=None whenever decision≠Gate. aligned &(decision,\,gate\_reason) with decision\!∈\!\ Commit, Gate, Reject\,\\ &gate\_reason\!∈\!\ None, Risk-Divergence, Local-Conflict,\\ & 17.00024pt Planner-Upgrade, Mid-Risk\,\\ &gate\_reason\!=\! None whenever decision\!≠\! Gate. aligned 1: Schema validation: 2: if ¬SchemaValid(c) \, SchemaValid(c) then 3: return (Reject,None)( Reject, None) // malformed 4: end if 5: Transaction-envelope validation: 6: if EnvelopeDefined(c) EnvelopeDefined(c) and ¬ValidEnvelope(c,ℰ) \, ValidEnvelope(c,E) then 7: return (Reject,None)( Reject, None) // envelope invalid 8: end if 9: Expiry check: 10: if c.expires_at<tnowc. expires\_at<t_now then 11: return (Reject,None)( Reject, None) // expired 12: end if 13: Staleness check: 14: if |ℰ.epoch−c.state_epoch|>δ|E.epoch-c. state\_epoch|>δ then 15: return (Reject,None)( Reject, None) // stale (INV-1) 16: end if 17: Rollback-handle validity check: 18: if c.reversibility_class≠irreversiblec. reversibility\_class and ¬ValidRollback(c.rollback_handle,ℰ) \, ValidRollback(c. rollback\_handle,E) then 19: return (Reject,None)( Reject, None) // invalid rollback (INV-2) 20: end if 21: Trust boundary: 22: rℓ←ComputeRisk(c,ℰ)r_ ← ComputeRisk(c,E) Eq. (5) 23: if rℓ≥τrejectr_ ≥ _reject then 24: return (Reject,None)( Reject, None) // local reject floor 25: end if 26: if |c.risk_score−rℓ|>εtrust|c. risk\_score-r_ |> _trust then 27: return (Gate,Risk-Divergence)( Gate, Risk-Divergence) // risk divergence (INV-3) 28: end if 29: Planner-side upgrade: 30: if c.needs_upgradec. needs\_upgrade then 31: return (Gate,Planner-Upgrade)( Gate, Planner-Upgrade) 32: end if 33: Local conflict: 34: if LocalConflict(c,ℰ) LocalConflict(c,E) then 35: return (Gate,Local-Conflict)( Gate, Local-Conflict) 36: end if 37: Risk decision: 38: if rℓ≤τcommitr_ ≤ _commit and c.blocking_req=∅c. blocking\_req= then 39: return (Commit,None)( Commit, None) 40: else if rℓ≥τrejectr_ ≥ _reject then 41: return (Reject,None)( Reject, None) 42: else 43: return (Gate,Mid-Risk)( Gate, Mid-Risk) 44: end if Envelope validation. EnvelopeDefined(c) EnvelopeDefined(c) holds when the control-intent message rides inside the common transaction envelope introduced in Section I-B; ValidEnvelope(c,ℰ) ValidEnvelope(c,E) then returns true iff the envelope fields (transaction identifier, transaction/conversation state, sender/receiver roles, state epoch, expiry, policy digest, idempotency key, visibility scope) are well-formed and consistent with the executor’s view. The envelope check is local and does not require C1. When no envelope is attached, the predicate is vacuously satisfied and the schema-validation result alone governs the branch. Rollback-handle validity. ValidRollback(h,ℰ) ValidRollback(h,E) returns true iff the rollback handle h is non-null and (i) targets a scope reachable from ℰE, (i) matches the policy version under which the intent was issued, (i) is not expired, (iv) names a rollback procedure that is currently available, and (v) has not already been consumed by a prior committed intent. This defines the contract-level structural validity predicate for rollback handles; the precondition is that a non-irreversible intent without a valid handle is Rejected. ValidRollback is a local predicate over c.rollback_handlec. rollback\_handle and ℰE and does not require C1. Stage-1 output contract. Stage 1 now emits a pair (decision,gate_reason)(decision,gate\_reason) rather than a bare decision, so that Stage 2 can distinguish why an intent was gated. The five gate-reason values map one-to-one onto existing Algorithm 1 branches and introduce no new taxonomy: Risk-Divergence flags the |c.risk_score−rℓ|>εtrust|c. risk\_score\!-\!r_ |\!>\! _trust branch (INV-3), Planner-Upgrade flags the planner-asserted c.needs_upgradec. needs\_upgrade branch, Local-Conflict flags the LocalConflict(c,ℰ) LocalConflict(c,E) branch, and Mid-Risk is the residual threshold-gated case that falls through the above: either the mid-risk interval τcommit<rℓ<τreject _commit\!<\!r_ \!<\! _reject, or rℓ≤τcommitr_ \!≤\! _commit with non-empty c.blocking_reqc. blocking\_req (low-risk COMMIT precondition not met). None is emitted on any non-Gate decision. Non-empty c.blocking_reqc. blocking\_req is treated as an independent precondition rather than a sixth gate-reason value: it already blocks the low-risk Commit branch in Algorithm 1 and is re-checked in Stage 2’s degraded-mode branch (Algorithm 2). Invariants. The triage procedure enforces three safety invariants by construction: INV-1. No intent with staleness exceeding δ is ever committed (staleness check, strict |ℰ.epoch−c.state_epoch|>δ|E.epoch-c. state\_epoch|>δ). INV-2. No non-irreversible intent without a valid rollback handle (per ValidRollback) is ever committed; the precondition does not extend to irreversible intents, which are governed by the action catalog rather than by rollback validity. INV-3. Risk-Divergence, Local-Conflict, and Planner-Upgrade gates are evidence-mandatory: such gated intents may only commit through the C1-fetchable branch of Algorithm 2 with a verifier-approved quorum; if C1 cannot be fetched within the remaining deadline and bandwidth budget, they are Rejected rather than committed in degraded mode. Optional replanning after Reject is a planner-side follow-up outside the online decision state. This evidence route is preempted by the local reject floor rℓ≥τrejectr_ \!≥\! _reject (Algorithm 1), which terminates at Stage 1 before any gate is emitted; the verifier-approved branch additionally requires c.blocking_req=∅c. blocking\_req= to discharge structural prerequisites. INV-1 directly supports stale-state fault rejection (design goal G3). INV-2 enforces rollback-handle validity for the reversible and costly-reversible classes; for irreversible actions the typed action catalog itself sets the admission rule. INV-3 establishes an executor-side trust boundary for the three evidence-mandatory gate reasons; the executor recomputes risk locally and never blindly trusts the planner’s score, and resource-constrained degraded-mode commits are restricted to the Mid-Risk residual gate with reversible, sub-τdegraded _degraded intents and empty blocking_req (Algorithm 2). IV-D Stage 2: Gate Resolution Intents that exit Stage 1 with a Gate decision enter Stage 2 (Algorithm 2), which attempts to fetch C1 evidence and run the VerifierQuorum vote-resolution routine. If the remaining deadline or available bandwidth is insufficient, a degraded-mode rule applies. Algorithm 2 Stage 2: Gate Resolution 0: Gated intent c, gate reason g∈Risk-Divergence,Local-Conflict,Planner-Upgrade,Mid-Riskg∈\ Risk-Divergence, Local-Conflict, Planner-Upgrade, Mid-Risk\, remaining deadline d, available bandwidth b, risk rℓr_ 0: decision ∈Commit,Reject,Human-Gate∈\ Commit, Reject, Human-Gate\ 1: if d>dmind>d_ and b>bminb>b_ then 2: c1←Fetch_C1(c)c_1← Fetch\_C1(c) 3: v←VerifierQuorum(c,c1)v← VerifierQuorum(c,c_1) Sec. IV-F 4: if v=APPROVEDv=APPROVED then 5: if c.blocking_req≠∅c. blocking\_req≠ then 6: return Reject blocking_req not discharged 7: end if 8: return Commit 9: else if v=CONFLICTv=CONFLICT then 10: return Reject 11: else 12: return Human-Gate escalate 13: end if 14: else 15: Degraded mode ( C1 unavailable under deadline/bandwidth) 16: if g∈Risk-Divergence,Local-Conflict,Planner-Upgradeg∈\ Risk-Divergence, Local-Conflict, Planner-Upgrade\ then 17: return Reject evidence-mandatory gate: INV-3 / conflict / planner-upgrade 18: end if 19: if c.blocking_req≠∅c. blocking\_req≠ then 20: return Reject non-empty blocking_req forbids degraded commit 21: end if 22: if g=Mid-Riskg= Mid-Risk and c.reversibility_class=reversiblec. reversibility\_class=reversible and rℓ≤τdegradedr_ ≤ _degraded then 23: return Commit Mid-Risk reversible + rℓ≤τdegradedr_ ≤ _degraded 24: else 25: return Reject unsafe under resource constraint 26: end if 27: end if Within the degraded-mode branch, Risk-Divergence, Local-Conflict, and Planner-Upgrade are evidence-mandatory gate reasons: when C1 cannot be fetched, they are rejected rather than silently committed. Only the residual Mid-Risk gate may commit without verifier confirmation, restricted to reversible actions with rℓ≤τdegradedr_ \!≤\! _degraded and empty blocking_req. The Human-Gate path escalates to an operator when verifiers disagree. Modeling assumptions. C1 fetch success is modeled by the d>dmin∧b>bmind\!>\!d_ \! \!b\!>\!b_ condition; the strict inequalities reserve scheduling and serialization slack, so equality with dmind_ or bminb_ is treated as insufficient for reliable C1 retrieval. Richer fetch-failure semantics are out of scope of this evaluation. Stage 2 inherits the Stage-1 state snapshot atomically within a single decision epoch; freshness revalidation under non-atomic decision epochs is out of scope. IV-E C1 — Coordination Evidence The C1 layer carries evidence consumed by verifiers and the scheduling logic—not by the executor for direct actuation. Its core fields are: • constraint_summary: active constraints on the target scope; • conflict_candidates: intents with overlapping resource keys; • missing_information: data the planner could not resolve; • verifier_votes: placeholder populated after quorum execution. The C1 payload adds approximately 400–800 bytes on top of C0 and is retrieved only when Stage 1 issues a Gate decision, realizing the progressive retrieval principle: evidence is fetched on demand rather than bundled unconditionally. IV-F Verifier Model Verifiers implement a unanimous-approval safety-veto rule, denoted by Quorum()( v) below: all configured verifiers must approve for the intent to commit; any single safety veto triggers rejection; and disagreement (mixed non-veto outcomes) escalates to Human-Gate. Formally, given a vote vector v: Quorum()=APPROVEDif ∀vi:vi=APPROVE,CONFLICTif ∃vi:vi=VETO,ESCALATEotherwise. Quorum( v)\!= casesAPPROVED&if ∀ v_i\!:v_i\!=\!APPROVE,\\ CONFLICT&if ∃ v_i\!:v_i\!=\!VETO,\\ ESCALATE&otherwise. cases (6) Each use case employs two domain-specific verifiers: • UC1 — Load Verifier (vetoes if cell load exceeds a safety margin after the proposed sleep/power action) and SLA Verifier (vetoes if predicted SLA impact exceeds an acceptable margin). • UC2 — Slice Isolation Verifier (vetoes if any slice’s guaranteed minimum resource is violated) and Fairness Verifier (vetoes if the Jain fairness index [19] drops below a threshold). IV-G C2 — Provenance Digest The C2 layer is a post-hoc audit record that is not on the online control path; its content model aligns with W3C PROV-DM [34] provenance representations. The digest is provenance-aligned rather than a transparency-log or software-supply-chain attestation mechanism. Its fields include: telemetry_snapshot_ids, tool_version, model_version, policy_version, verifier_version, dependency_hashes, signature, evidence_uris, and retention_class. C2 enables reconstructability of the decision context after the fact. The contract distinguishes a minimal transaction record retained on every terminal executor decision from the full C2 digest above; its contribution is measured via the full- C2 coverage metric—the fraction of committed actions for which a complete C2 provenance record (tool versions, dependency hashes, verifier identities) is available post-hoc (73.8–77.7% in our evaluation, compared to 0% full- C2 coverage for a C0-only baseline). Both normal Stage-2 commits (after verifier quorum) and degraded-mode commits (the Mid-Risk-gated reversible branch of Algorithm 2, restricted to rℓ≤τdegradedr_ \!≤\! _degraded with empty blocking_req, when deadline or bandwidth do not admit C1) emit a full C2 record; normal Stage-1 commits retain only the minimal transaction record. The residual committed actions therefore lack the full C2 digest and remain auditable at this coarser transaction-record granularity. INV-4 (audit separation). C2 is generated and stored after the online decision and is not part of the online safety decision path; it does not rescue an evidence-mandatory gate whose C1 retrieval failed and does not alter Commit/Gate/Reject for any intent. We therefore use C2 for accountability and compliance rather than online safety. Compact implementation-aligned counterparts of INV-1, INV-2, INV-3, and the deterministic-replay companion of the executor contract are summarized in Section V under their explicit assumptions. V Formal Properties and O-RAN/A2A/MCP Realization This section records compact implementation-aligned properties of the executor contract that hold as deterministic properties of Algorithms 1 and 2 or of deterministic benchmark replay under explicit assumptions, then maps the contract ( C0/ C1/ C2) to the O-RAN supervisory workflow and the A2A and MCP carrier shells as an adapter-compatible realization carried inside native extension mechanisms. V-A Implementation-Aligned Properties Algorithms 1 and 2 support the following implementation-aligned properties. Each holds as a deterministic property of the algorithms or of deterministic benchmark replay under the listed assumptions; we state each only at the strength supported by those assumptions and use it as a contract-level property of the executor, not as a deployed-system safety claim. P1 (stale-state rejection; invariant proof). Any intent with |ℰ.epoch−c.state_epoch|>δ|E.epoch-c. state\_epoch|>δ cannot reach a Commit through Algorithms 1–2: if execution reaches the Stage-1 freshness guard, the strict >δ>δ branch returns Reject, and any earlier Stage-1 Reject is terminal. The property is stated under the assumptions that every Commit path first executes Algorithm 1, that Algorithm 2 only receives Stage-1 Gate outputs, and that Human-Gate and planner-side replanning are outside Commit. The equality boundary |ℰ.epoch−c.state_epoch|=δ|E.epoch-c. state\_epoch|=δ is outside this property. P2 (rollback-handle precondition; implementation lemma). No intent of reversibility class reversible or costly-reversible can reach Commit unless its rollback handle satisfies ValidRollback (Section IV-C), since every Stage-2 Commit path inherits the Stage-1 rollback-handle check. The property is contract-level structural validity, not a real-world physical-recoverability claim; irreversible intents lie outside this rollback-handle precondition and remain governed by the typed action catalog and the other Algorithms 1–2 gates. P3 (evidence-mandatory non-bypass; invariant proof). When the gate reason is Risk-Divergence, Local-Conflict, or Planner-Upgrade, the only Commit path through Algorithm 2 is the C1-fetchable branch (d>dmin∧b>bmind>d_ b>b_ ) followed by a verifier-approved quorum; whenever d≤dmind\!≤\!d_ or b≤bminb\!≤\!b_ , Algorithm 2 returns Reject. Verifier veto yields Reject and verifier disagreement escalates to Human-Gate, neither of which is Commit. P4 (degraded-mode eligibility; implementation lemma). A degraded-mode Commit can occur only in the C1-unavailable branch of Algorithm 2, where d≤dmind\!≤\!d_ or b≤bminb\!≤\!b_ , and only when g=Mid-Riskg= Mid-Risk, c.blocking_req=∅c. blocking\_req= , c.reversibility_class=reversiblec. reversibility\_class=reversible, and rℓ≤τdegradedr_ \!≤\! _degraded; the survivor check is applied after evidence-mandatory rejection. This is a necessary-condition statement that does not collapse the degraded-branch entry rate with the final degraded-mode commit rate. P5 (FB-INV KPI isolation; implementation lemma). Under deterministic-replay assumptions [10]—identical initial state z0z_0, identical epoch / candidate-intent streams, identical exogenous disturbance wtw_t, deterministic transition F(zt,a¯t,wt)F(z_t, a_t,w_t) and KPI aggregation, identical committed underlying wireless actions a¯t a_t and parameters on Commit epochs, and identical no-action treatment on Reject and Human-Gate epochs—OURS and FB-INV induce identical state trajectories and identical KPI cells under deterministic-replay assumptions. The replay assumptions further include fixed or pre-sampled disturbance streams, no wall-clock or unordered-execution dependence affecting decision order, and stable action-parameter serialization and aggregation order. P5 isolates retrieval-cost accounting and is not a KPI-superiority claim; the time-to-first-safe-action and per-commit control-plane bytes results of Section VI are not P5 conclusions. V-B O-RAN Supervisory Placement PRGA is placed at SMO / Non-RT RIC supervisory timescales and is carried as an adapter-compatible contract within the supervisory workflow, rather than as a replacement for any O-RAN interface [29, 28]. Table VI maps the contract operations to the O-RAN A1 interface between the Non-RT RIC and the Near-RT RIC [17, 16]; we state explicitly which operations are native A1 and which require supplementary realization. TABLE VI: Mapping of contract operations to O-RAN A1 primitives. Contract Operation A1 Realization Status →Commit C0\!→\! Commit A1 Policy Instance Create Native →Reject C0\!→\! Reject A1 Policy Feedback Native (CONFLICT / ERROR) →Gate→ C0\!→\! Gate\!→\! C1 Supplementary enrichment On top request via Non-RT-RIC realization of A1 C1 verifier votes External verifier results Not A1 C2 provenance Post-hoc audit store Not A1 Commit and Reject use native A1 policy instance and feedback primitives; the Gate-to- C1 path adds a supplementary enrichment request via Non-RT-RIC realization without modifying the A1 schema. Verifier outputs and C2 audit storage reside in the SMO management plane and are not part of native A1 semantics. The mapping is a supervisory-placement and adapter-compatibility statement, not an integration result. V-C A2A Carrier Mapping A2A serves here as the task and message carrier shell. The Agent-to-Agent protocol supports agent profile extensions that declare structured capabilities without altering the core task lifecycle [4]; we register the PRGA actuation contract as such an extension. The illustrative adapter mapping below is an adapter-style descriptor, not a normative protocol schema: "profileId":"wireless-supervisory-control-v1", "layers":"C0":"role":"required", "C1":"role":"fetchable", "C2":"role":"fetchable", "statemachine":"commit-gate-reject" C0 is conveyed as a required A2A messagePart; C1 and C2 are fetchable artifacts materialized only on Gate or audit ingestion, respectively. The statemachine field lets any A2A-compliant orchestrator route tasks to profile-aware agents without proprietary wire-format changes; A2A itself does not provide wireless actuation semantics or executor-side safety properties. V-D MCP Resource Mapping MCP plays a complementary carrier role for resource and tool access. Under the Model Context Protocol [8], C0 fields are exposed as named resources that any MCP-compliant client can read; C1 evidence is retrieved via an on-demand tool call (fetch_c1_evidence); and C2 provenance records are published as a log resource accessible to audit consumers. This mapping preserves MCP’s capability negotiation: a client that does not require C1 or C2 never discovers or invokes the corresponding tool or log endpoint. V-E Implementation Harness The benchmark harness is a CPU-only Python implementation designed for reproducible evaluation. A scenario engine generates diurnal load patterns and decision epochs parameterized from 3GPP TR 38.864 [1] and TS 28.541 [3]. Executors consume C0 payloads and return Commit/Gate/Reject decisions; verifiers consume C1 evidence and return vote vectors per Eq. (6). Four fault injectors—stale-state, conflict, deadline-squeeze, and verifier-fault—stress the control loop under the evaluated benchmark conditions (Section VI). VI Evaluation We evaluate the executor-side actuation contract on two wireless supervisory-control benchmarks under four research questions: RQ1 efficiency, RQ2 safety and downstream wireless KPIs, RQ3 stale-state and stress regimes, and RQ4 component analysis. A captured-planner compatibility check completes the section. VI-A Experimental Setup Use cases. We evaluate two parameterized supervisory benchmarks: • UC1: Energy-Saving Policy Push. A planner proposes cell-sleep, RF-power-reduction, and load-redirect actions parameterized from the energy-saving scenarios of 3GPP TR 38.864 [1], with sleep-mode benchmark context from [36]. The action catalog spans five action types from reversible to costly-reversible (Table IV). • UC2: Slice-SLA Protection Policy Update. A planner proposes slice-priority, admission-control, and resource-reallocation actions following the network resource model of 3GPP TS 28.541 [3] with KPI definitions from TS 28.554 [2], drawing slicing resource-allocation context from [33]. UC2 stresses multi-slice coordination and tightens staleness and deadline thresholds relative to UC1 (Table V). A trace-parameterized scenario engine generates diurnal traffic-load patterns, stochastic conflict events, and deadline-pressure episodes; each decision epoch presents the executor with a candidate intent whose risk factors (staleness, conflict intensity, resource contention) are drawn from distributions calibrated to realistic supervisory timescales. Systems and comparator roles. All systems consume the same replay stream per seed. • OURS — the full C0/ C1/ C2 contract with the two-stage retrieval policy of Section IV. • FB-INV — an eager full-evidence cost-overlay comparator that retains OURS’s invariants INV-1/2/3 and produces the same final commit decisions as OURS by construction, while always paying the eager ++ C0+ C1+ C2 cost and running the verifier quorum on every intent. FB-INV isolates retrieval-cost accounting from decision-policy differences; it does not provide independent safety evidence. • ST-INV — the invariant-respecting static-threshold safety comparator. It shares INV-1/2/3 and the verifier machinery with OURS but replaces the calibrated multi-factor risk score of Eq. (5) with a type-only static threshold (risk_score_type_only). ST-INV isolates the residual value of the calibrated risk signal once invariants are equalized. • BL4-legacy — a single fixed commit threshold without the full invariant or executor-side trust machinery. Used as an anchoring control for the cost of the invariant layer; not a paired unsafe-rate comparator against OURS. • C0-only — commits immediately at C0 with no verifier evidence and no staleness defense. The cheapest anchoring control; likewise not paired against OURS for unsafe rate. Two ablations, used only in the component analysis, isolate individual mechanisms without replacing OURS as the main system: AB1 (No- C1) removes the Stage-2 verifier quorum so that gated intents are resolved by the degraded-mode rule alone, and AB2 (No-Wireless-Inputs) removes the wireless-specific state-input bundle (σt _t, ctc_t, ρt _t) from the risk computation and staleness check. Metrics and labels. TTFSATTFSA (time-to-first-safe-action) measures supervisory responsiveness from candidate-intent receipt to the first action admitted by the executor’s online contract, including any evidence retrieval. It should not be read as a guarantee that every admitted action is ground-truth safe; ground-truth post-commit violations are measured separately by the unsafe-action rate. Per-commit control-plane bytes measures the executor-side control-plane load incurred per committed action. The unsafe-action rate is the fraction of committed actions whose post-commit ground-truth state violates the use-case safety predicate, and stale rejection is the fraction of stale candidate intents rejected at Stage-1. Safe-commit yield is the fraction of epochs that produce a committed action whose post-commit ground-truth label is safe, and % C0\% is the fraction of committed actions resolved directly from Stage-1 C0 triage without C1 retrieval. Downstream wireless KPIs report the network-side outcomes of committed decisions (UC1: energy saving, SLA violation minutes, throughput change; UC2: slice-SLA violation rate, Jain fairness, throughput change). An action is labeled unsafe if the ground-truth network state at commit violates the use-case predicate: for UC1, when the resulting cell-sleep or power configuration would push the serving cell above its capacity threshold and breach the SLA limit; for UC2, when slice reallocation would drive any slice’s SLA violation rate beyond its contracted threshold. Ground-truth labels are computed from the scenario generator independently of the executor’s risk assessment and verifier logic. Methodology and statistics. Main contract-isolation runs use 10 independent seeds (42–51) at 1000 epochs/seed per UC; the stale-state fault campaign uses 500 epochs/seed with every epoch stale-injected. Continuous-metric deltas are reported with 95% paired-bootstrap CIs (10 000 resamples) [14] over seed-level means; rate CIs are 95% Clopper–Pearson exact [12, 9]; pairwise unsafe-rate comparisons use Fisher’s exact two-sided test [18]; rate differences also carry Agresti–Caffo CIs [6, 12]. To convert “no detected difference” into an interpretable bound, we report a one-sided non-inferiority test [13] on the seed-level paired unsafe-rate difference against a pre-declared margin Δ=0.5p =0.5\,p. Mean ± values reported in Tables VII and VIII denote seed-level standard deviation over the n=10n=10 seeds. VI-B RQ1: Does Progressive Retrieval Reduce Supervisory Response Latency and Control-Plane Overhead? TABLE VII: Contract-isolation main results (10 seeds, 1000 epochs/seed per UC); FB-INV retains OURS’s invariants and decisions but pays full C0+C1+C2 bytes and verifier latency (cost-only overlay). System TTFSA (ms) Bytes/commit Unsafe Rate [ CI ] Stale Rej. (normal) Yield C0% UC1: Energy-Saving Policy Push OURS 1335±\,±\, 56 566±\,±\, 4 2.98% [2.51, 3.50] 100% 46.3% 26.2 FB-INV 1839±\,±\, 56 1236±\,±\, 1 2.98% [2.51, 3.50] 100% 46.3% 0.0 ST-INV 1508±\,±\, 54 590±\,±\, 4 2.92% [2.45, 3.45] 100% 43.6% 16.6 BL4-legacy 506±\,±\, 22 457±\,±\, 2 2.56% [2.20, 2.96] 20.4% 66.9% 72.1 C0-only 10±\,±\, 0 391±\,±\, 0 3.18% [2.84, 3.54] 0.0% 96.8% 100 UC2: Slice-SLA Protection Policy Update OURS 1410±\,±\, 36 593±\,±\, 4 3.21% [2.70, 3.79] 100% 41.0% 22.4 FB-INV 1837±\,±\, 40 1254±\,±\, 1 3.21% [2.70, 3.79] 100% 41.0% 0.0 ST-INV 1545±\,±\, 31 611±\,±\, 4 3.25% [2.72, 3.85] 100% 38.7% 14.9 BL4-legacy 526±\,±\, 30 474±\,±\, 4 2.65% [2.27, 3.07] 35.1% 62.9% 70.1 C0-only 10±\,±\, 0 408±\,±\, 0 3.37% [3.03, 3.75] 4.7% 95.6% 100 Table VII reports contract-isolation results on 10 seeds × 1000 epochs per UC. We compare OURS to FB-INV to attribute supervisory-responsiveness and control-plane efficiency gains to selective retrieval under a decision-identical cost overlay; this comparison holds final commit decisions fixed and therefore does not test independent safety superiority. Headline efficiency. Relative to FB-INV, OURS achieves 23.3–27.4% lower TTFSATTFSA and 52.7–54.2% fewer per-commit control-plane bytes across UC1 and UC2. The per-UC paired-bootstrap deltas are 27.4% [−28.12,−26.77-28.12,-26.77] TTFSATTFSA on UC1 and 23.3% [−24.79,−21.80-24.79,-21.80] on UC2, with per-commit control-plane bytes reductions of 54.2% [−54.41,−54.06-54.41,-54.06] on UC1 and 52.7% [−52.88,−52.56-52.88,-52.56] on UC2. Because OURS and FB-INV share the same final commit decisions by construction, the TTFSATTFSA and Bytes/commit deltas isolate retrieval-cost accounting rather than a decision-policy difference. The mechanism is visible in Table VII: 26% of OURS commits on UC1 and 22% on UC2 resolve at Stage-1 from C0 without incurring C1 retrieval latency or extra control-plane load, versus 0% for FB-INV. Headlining FB-INV in this way reflects its role as an eager full-evidence cost-overlay; the unsafe-rate identity (p=1.00p=1.00 by construction) does not constitute independent safety evidence and is treated separately in Section VI-C. Sensitivity to the cost denominator. As a sensitivity check, excluding C2 from FB-INV’s cost denominator (a C0+C1-only sub-bundle) leaves a per-commit control-plane bytes reduction of roughly −10%-10\% on UC1 and −8%-8\% on UC2: selective C1 retrieval still reduces bytes under the stricter comparator, while the larger 23.3–27.4% / 52.7–54.2% headline remains the OURS-vs-FB-INV eager full-evidence comparison and also reflects the architectural choice to keep C2 off the online control path. Safe-commit yield. Safe-commit yield is identical between OURS and FB-INV (46.3% UC1, 41.0% UC2 in Table VII) because the two systems produce the same commit decisions by construction; the efficiency gain therefore isolates to TTFSATTFSA and per-commit control-plane bytes, with safe-commit yield reported as confirmation rather than as a primary efficiency metric. Against ST-INV, OURS shows a small supplementary yield advantage (+2.7p+2.7\,p on UC1, +2.3p+2.3\,p on UC2), consistent with the residual risk-signal effect isolated in Section VI-C. Anchoring controls. BL4-legacy and C0-only achieve nominal-run TTFSATTFSA of 506–526 ms and 10 ms by skipping the invariant-respecting machinery, with normal-run unsafe rates that straddle OURS’s values (2.56%, 3.18% on UC1; 2.65%, 3.37% on UC2). Their commit pool is selection-biased under cheaper control logic, so they are not paired unsafe-rate comparators against OURS; their value is to quantify the cost of the invariant layer, with the bounded robustness behind INV-1 tested in Section VI-D. VI-C RQ2: Does the Contract Preserve Evaluated Safety Behavior and Downstream Wireless KPIs? We separate safety preservation (OURS vs ST-INV under equalized invariants) from KPI preservation (OURS vs FB-INV under shared decisions). Safety: residual risk signal under equalized invariants. With INV-1/2/3 and the verifier quorum equalized via ST-INV, OURS retains a residual TTFSATTFSA advantage of 11.4% [−12.38,−10.54-12.38,-10.54] on UC1 and 8.7% [−9.73,−7.80-9.73,-7.80] on UC2, attributable to the calibrated multi-factor risk signal of Eq. (5). The unsafe-action rate remains statistically indistinguishable from ST-INV’s: Fisher’s exact p=0.90p=0.90 on UC1 and p=0.95p=0.95 on UC2, with simple rate differences of +0.06p+0.06\,p and −0.04p-0.04\,p and Agresti–Caffo CIs spanning zero. Because Fisher’s exact test pools epochs within seeds, we additionally convert the absence of detection into an interpretable bound using a seed-level paired cluster bootstrap (10 000 resamples) of the per-seed OURS-minus-ST-INV unsafe-rate difference, which yields a mean of +0.058p+0.058\,p and a 95% one-sided upper bound of +0.151p+0.151\,p on UC1, and a mean of −0.041p-0.041\,p and a 95% one-sided upper bound of +0.076p+0.076\,p on UC2. Both upper bounds sit well within Δ=0.5p =0.5\,p, so OURS is non-inferior to ST-INV at α=0.05α=0.05. For OURS versus FB-INV the unsafe-rate difference is identically zero by construction and serves only as a comparator-pipeline consistency check. TABLE VIII: Downstream network-side outcomes under contract-isolation (10 seeds, 1000 epochs/seed per UC); OURS and FB-INV are identical on every cell by construction. UC1 (energy saving / SLA violation / throughput change) System Energy (%) ↑ SLA (min) ↓ Δ (%) ↓ OURS 9.80±\,±\, 0.39 62.3±\,±\, 15.9 −-0.72±\,±\, 0.04 FB-INV 9.80±\,±\, 0.39 62.3±\,±\, 15.9 −-0.72±\,±\, 0.04 ST-INV 9.55±\,±\, 0.35 58.4±\,±\, 14.8 −-0.70±\,±\, 0.04 BL4-legacy 8.64±\,±\, 0.25 76.4±\,±\, 17.4 −-0.57±\,±\, 0.04 C0-only 10.00±\,±\, 0.24 139.6±\,±\, 25.4 −-0.73±\,±\, 0.04 UC2 (slice-SLA violation rate / Jain fairness / throughput change) System SLA rate (%) ↓ Jain ↑ Δ (%) ↓ OURS 9.60±\,±\, 0.38 0.782±\,±\, 0.003 1.02±\,±\, 0.10 FB-INV 9.60±\,±\, 0.38 0.782±\,±\, 0.003 1.02±\,±\, 0.10 ST-INV 9.68±\,±\, 0.40 0.781±\,±\, 0.003 1.05±\,±\, 0.11 BL4-legacy 9.51±\,±\, 0.33 0.768±\,±\, 0.003 1.17±\,±\, 0.10 C0-only 10.06±\,±\, 0.20 0.785±\,±\, 0.003 0.82±\,±\, 0.06 Downstream wireless KPIs. Table VIII reports network-side outcomes under the same 10-seed contract-isolation runs. Direction markers in the column headers indicate “↑ ” = higher is better and “↓ ” = lower is better. For Δ , negative values denote throughput gain relative to the benchmark baseline and positive values denote throughput degradation; lower values are therefore better under the signed convention used here. Because OURS and FB-INV share the same final commit decisions by construction, their downstream KPI cells are identical on every metric and every seed (max per-seed absolute difference =0=0 across all six UC–metric pairs); this identity shows that the retrieval-cost reduction in RQ1 does not change the evaluated network-side action sequence relative to FB-INV. Against ST-INV, OURS holds a small supplementary network-side advantage on UC1 energy saving (+0.25p+0.25\,p) and UC2 Jain fairness (+0.001+0.001), consistent with the residual risk-signal effect; we treat these supplementary differences as direction-indicative under the same equalized invariants, not as a strict KPI claim. VI-D RQ3: How Does the Policy Behave Under Stale-State Faults and Stress Regimes? We pair the stale-state fault campaign (Table IX) with the regime phase map (Tables X–XI) to characterize freshness fault handling and regime sensitivity of the residual risk-signal effect. TABLE IX: Stale-state fault injection campaign (10 seeds, 500 epochs/seed, all epochs injected with stale gaps exceeding δ). System UC1 Stale Rej. [ CI ] UC2 Stale Rej. [ CI ] OURS 100% [99.93, 100] 100% [99.93, 100] FB-INV 100% [99.93, 100] 100% [99.93, 100] ST-INV 100% [99.93, 100] 100% [99.93, 100] BL4-legacy 29.8% [28.5, 31.1] 32.9% [31.6, 34.2] C0-only 0.04% [0.00, 0.14] 4.36% [3.81, 4.96] Stale-state fault campaign. Table IX reports a separate campaign in which every epoch is stale-injected (10 seeds, 500 epochs/seed). We flag one discipline item up front: the rejection rates here are not comparable to the incidental normal-run stale-rejection column of Table VII, because the campaign and the contract-isolation run target different regimes. In the injected stale-state fault campaign, OURS rejects 100% (Clopper–Pearson 95% CI [99.93,100][99.93,100]) on both UCs; the rejection fires deterministically from the staleness check in Algorithm 1 whenever the epoch gap exceeds δ. FB-INV and ST-INV match the 100% rate because they share INV-1, locating the freshness defense in the invariant layer rather than in retrieval policy or risk scoring. The two anchoring controls collapse under the same campaign: BL4-legacy rejects 29.8% [28.5,31.128.5,31.1] on UC1 and 32.9% [31.6,34.231.6,34.2] on UC2, and C0-only rejects 0.04% [0.00,0.140.00,0.14] on UC1 and 4.36% [3.81,4.963.81,4.96] on UC2. We report the campaign rejection rate as implementation verification of the freshness guard under injected over-threshold stale inputs; it is a bounded stress result, not a universal real-world safety claim about boundary staleness, misreported epochs, or adversarial freshness attacks. Regime phase map. We sweep a coarse grid of 22 scenario slices per UC at 3 seeds and 500 epochs/slice, varying staleness probability, conflict intensity, deadline tightness, verifier-fault probability, risk-divergence probability, and rollback-corruption probability around the nominal operating point, then revisit four selected slices at dense resolution (10 seeds × 1000 epochs/slice): benign (reference), risk-p30, conflict-high, and composite-severe. The detector is a paired delta-of-deltas (DoD) bootstrap on raw per-seed TTFSATTFSA with 10 000 resamples; a slice is material when its 95% DoD CI excludes zero and |DoDmean|≥10|DoD\ mean|≥ 10 ms. TABLE X: UC1 dense regime summary (10 seeds, 1000 epochs/slice; tested-slice dense-regime scope). Slice OURS−-FB-INV TTFSA % [CI] OURS−-ST-INV TTFSA % [CI] DoD mean (ms) DoD 95% CI (ms) Verdict benign −25.14-25.14 [−25.87-25.87, −24.27-24.27] −10.19-10.19 [−11.02-11.02, −9.29-9.29] ref. – ref. risk_p30 −18.64-18.64 [−19.60-19.60, −17.69-17.69] −7.50-7.50 [−8.22-8.22, −6.78-6.78] +35.1+35.1 [+29.5+29.5, +40.2+40.2] material conflict_high −16.57-16.57 [−17.41-17.41, −15.57-15.57] −6.49-6.49 [−7.04-7.04, −5.96-5.96] +50.0+50.0 [+35.0+35.0, +61.6+61.6] material composite_severe −12.72-12.72 [−13.72-13.72, −11.68-11.68] −5.10-5.10 [−5.61-5.61, −4.61-4.61] +69.7+69.7 [+56.7+56.7, +82.7+82.7] material TABLE XI: UC2 dense regime summary (10 seeds, 1000 epochs/slice; same column convention as Table X). Slice OURS−-FB-INV TTFSA % [CI] OURS−-ST-INV TTFSA % [CI] DoD mean (ms) DoD 95% CI (ms) Verdict benign −21.07-21.07 [−22.60-22.60, −19.50-19.50] −7.72-7.72 [−8.75-8.75, −6.61-6.61] ref. – ref. risk_p30 −15.53-15.53 [−16.64-16.64, −14.40-14.40] −5.69-5.69 [−6.52-6.52, −4.89-4.89] +27.8+27.8 [+18.3+18.3, +38.5+38.5] material conflict_high −14.34-14.34 [−15.62-15.62, −13.00-13.00] −5.11-5.11 [−5.76-5.76, −4.42-4.42] +36.5+36.5 [+25.4+25.4, +47.1+47.1] material composite_severe −11.09-11.09 [−11.99-11.99, −9.95-9.95] −3.83-3.83 [−4.39-4.39, −3.28-3.28] +56.4+56.4 [+36.5+36.5, +75.3+75.3] material On the coarse grid, every paired OURS–FB-INV TTFSATTFSA and bytes CI is strictly below zero (22/22 on both UCs), with coarse TTFSATTFSA ranges of [−29%,−38%][-29\%,-38\%] on UC1 and [−13%,−22%][-13\%,-22\%] on UC2 and per-commit control-plane bytes reductions below −51%-51\% throughout: the RQ1 efficiency direction is robust across the tested slices. The OURS–ST-INV residual gap, by contrast, compresses as stress increases. Excluding the benign reference slice, 11/21 stressed slices per UC are CI-nonzero, of which 10 (UC1) and 8 (UC2) are material in the compression direction. A positive DoD mean denotes compression of the OURS–ST-INV residual TTFSATTFSA advantage relative to the benign reference slice; it does not change the sign of the OURS–FB-INV efficiency advantage, which remains strictly negative across all tested slices. Tables X–XI sharpen the picture at dense resolution: all three stressed dense cells per UC are material, with DoD mean rising monotonically from +35+35 ms at risk-p30 to +70+70 ms at composite-severe on UC1, and from +28+28 ms to +56+56 ms on UC2. Correspondingly, the OURS–ST-INV residual TTFSATTFSA gain shrinks from −10.2%-10.2\% at benign to −5.1%-5.1\% at composite-severe on UC1, and from −7.7%-7.7\% to −3.8%-3.8\% on UC2. Mechanism. The compression is a population effect on the Stage-2 threshold branch rather than a change in ST-INV’s policy shape. Under stress, more epoch mass routes through paths that OURS and ST-INV share (Stage-1 expiry, INV-1/2/3 rejection, and the deadline- or bandwidth-triggered degraded-mode rule), leaving a smaller residual population in which the dynamic-versus-static threshold difference can manifest. With the deadline-tightness factor at tight (0.50), 11–13% of epochs route through the Stage-2 branch under benign conditions, and this fraction shrinks further under stress. The same mechanism does not apply to the OURS-vs-FB-INV comparison, which is held decision-fixed by construction. VI-E RQ4: Which Components Matter? Component analysis combines AB1 / AB2 ablations, the threshold sensitivity sweep of Fig. 2, audit completeness, and the degraded-mode path summary. AB1 (No- C1): verifier contribution. Removing the C1 verifier quorum produces a use-case-dependent unsafe-rate effect. UC1 shows no detectable change (0 p difference) — single-cell energy-saving actions are adequately triaged at Stage-1 from C0 alone — while UC2 shows an unsafe-action rate increase of approximately 1.5 p (a +56%+56\% relative increase), reflecting the multi-slice coordination demands that C1 verifier evidence helps resolve. We characterize this as scoped evidence that C1 is selectively useful in the evaluated benchmarks, especially on UC2; we do not generalize to all wireless workloads, planners, or stress regimes. AB2 (No-Wireless-Inputs): state-input bundle. Removing the wireless-specific state-input bundle (σt _t, ctc_t, ρt _t) from the risk computation and staleness check degrades UC2 stale-state rejection from 100% to approximately 39% (−61-61 p). Without structured staleness and conflict inputs, the executor cannot independently verify state freshness: the staleness check (INV-1) requires state_epoch, and the trust boundary (INV-3) requires locally computable risk inputs. The evidence supports the claim that the structured wireless state-input bundle matters for the tested stale-state defense; per-field attribution is outside scope. Sensitivity to τcommit _commit. Figure 2: Sensitivity of UC1 metrics to the commit threshold τcommit _commit over [0.1,0.5][0.1,0.5]. Smooth behavior with no cliff effects; near-plateau onset at τcommit≥0.3 _commit≥ 0.3 (dashed line) and saturation by τcommit≥0.4 _commit≥ 0.4. (a) TTFSATTFSA. (b) Unsafe rate. (c) Safe-commit yield. Fig. 2 sweeps τcommit _commit over [0.1,0.5][0.1,0.5] on UC1. All three metric curves are smooth and monotonic with no cliff effects, indicating graceful degradation under imprecise threshold tuning. A near-plateau emerges at τcommit≥0.3 _commit≥ 0.3 with saturation by τcommit≥0.4 _commit≥ 0.4 (where τcommit=0.4 _commit=0.4 and τcommit=0.5 _commit=0.5 produce identical TTFSATTFSA): beyond this point, further increases yield diminishing returns because the density of truly low-risk intents tapers off. The unsafe-action rate stays flat across the sweep, suggesting that INV-1 and INV-3 dominate safety enforcement in the tested UC1 regime independently of τcommit _commit; the threshold controls when evidence is fetched but not whether unsafe intents are caught. The sweep is conducted on UC1 only; we do not extrapolate the curve shape to UC2. Full- C2 coverage and the C0/ C1 mixture. Full- C2 coverage — the fraction of committed actions emitting the full C2 provenance digest beyond the minimal transaction record — reaches 73.8–77.7% for OURS versus 0% full- C2 coverage for C0-only. Three commit paths contribute: normal Stage-2 commits (post-verifier) always emit C2; normal Stage-1 commits forgo the full digest and retain the minimal transaction record; and degraded-mode commits (Mid-Risk survivors with rℓ≤τdegradedr_ ≤ _degraded committed when deadline slack or bandwidth does not admit C1 fetch, bypassing the verifier quorum) also emit a post-hoc C2 record because the commit decision occurs without external verification and therefore warrants explicit provenance. On UC1, the degraded branch fires for ≈9.4%≈9.4\% of epochs but no final degraded-mode commit lands under the Mid-Risk survivor check; full- C2 coverage ≈73.8%≈73.8\% tracks the ≈73.8%≈73.8\% Stage-2 share. On UC2 the branch fires for <1%<1\% of epochs (with two final degraded-mode commits surviving the Mid-Risk check); full- C2 coverage ≈77.7%≈77.7\% closely tracks the ≈77.6%≈77.6\% Stage-2 share. The residual 22–26% without full C2 provenance are fast Stage-1 commits that retain only the minimal transaction record, since the C0 check is definitive and no external evidence is required; high-risk C1 commits remain fully audited. C2 supports auditability and reconstructability, not online safety; neither unsafe-rate reduction nor stale-state rejection nor evidence-mandatory gate behavior depends on C2. Degraded-mode discipline. Degraded mode is constrained by the Mid-Risk gate reason, reversibility, rℓ≤τdegradedr_ ≤ _degraded, and an empty blocking_req. Evidence-mandatory gates (RISK-DIVERGENCE, LOCAL-CONFLICT, PLANNER-UPGRADE) reject when C1 is unavailable and never enter degraded commit. Per-stage unsafe-action rates (pooled across UCs) are 2.73% for C0 commits and 3.20% for C1 commits — the C0 commits are correctly triaged low-risk intents rather than less safe ones, and OURS’s blended 2.98% rate on UC1 reflects the weighted UC1 mixture of the two commit pathways. The trade-off is temporal: under OURS, executor-admitted actions take effect earlier in the decision epoch than under FB-INV while the overall unsafe-action rate remains identical to FB-INV’s under the decision-identical replay comparison. Operators who prefer every commit to pass through verifier evidence can recover FB-INV-like behavior by setting τcommit=0 _commit=0, at the cost of forgoing the supervisory responsiveness and per-commit control-plane bytes savings. VI-F Bridge-Bound Captured-Planner Sanity Check This subsection is a bridge-bound executor compatibility sanity check, not evidence of planner-family generalization, heterogeneous multi-planner transfer, independent safety, or live O-RAN deployment validation: we check whether the OURS–FB-INV efficiency direction preserves when the planner is a captured external source rather than the internal one, all replayed under the current bridge. Setup. Table XII reports paired OURS–FB-INV and OURS–ST-INV deltas on benign UC2 for two planner rows. The Internal rows reuse the 10-seed paired (planner, environment) sample at 1000 epochs/seed filtered to OURS,FB-INV,ST-INV\OURS,FB -INV,ST -INV\ (the same setup as Section VI-B). The R1 rows correspond to one captured WirelessAgent_R1 canonical stream (DeepSeek backend, temperature =0=0) replayed against five independent cached environment bundles at 300 epochs/seed. The Internal row carries variance on both planner and environment axes; the R1 row carries environment-side variance only against a single captured planner trace, so we do not compare effect magnitudes between the two rows. TABLE XII: Cross-planner contract-compatibility check on benign UC2 (narrow captured-planner sanity scope; not a planner-seed or multi-planner generalization claim). Planner / Pair TTFSA Δ (ms) [95% CI] bytes/commit Δ [95% CI] upgrade_freq Δ [95% CI] unsafe Fisher-p Internal / OURS−-FB-INV −427.3-427.3 [−455.3-455.3, −400.4-400.4] −661.1-661.1 [−663.1-663.1, −659.1-659.1] −0.267-0.267 [−0.277-0.277, −0.257-0.257] 1.001.00 Internal / OURS−-ST-INV −135.1-135.1 [−150.3-150.3, −120.5-120.5] −17.5-17.5 [−19.2-19.2, −15.8-15.8] −0.027-0.027 [−0.030-0.030, −0.023-0.023] 0.950.95 R1‡ / OURS−-FB-INV −20.0-20.0 [−20.0-20.0, −20.0-20.0]† −607.0-607.0 [−607.0-607.0, −607.0-607.0]† −0.173-0.173 [−0.195-0.195, −0.157-0.157] 1.001.00 R1‡ / OURS−-ST-INV +0.0+0.0 [+0.0+0.0, +0.0+0.0]§ +0.0+0.0 [+0.0+0.0, +0.0+0.0]§ +0.000+0.000 [+0.000+0.000, +0.000+0.000]§ 1.001.00 ‡ R1 = WirelessAgent_R1: ONE live planner trace replayed across FIVE environment seeds at ep300; not planner-seed generalization (see §VII for scope boundaries). † R1 zero-width CI is a deterministic replay point estimate: temperature==0 plus fixed contract arithmetic and identical env-epoch indexing collapse the bootstrap CI to zero width; coinciding per-seed deltas do not provide independent statistical evidence beyond the deterministic point estimate. § Structural null on benign UC2 under R1’s saturated-HIGH-risk output: the dynamic-vs-static-threshold axis that separates OURS from ST-INV is inert when all intents land on the same risk branch. This is the regime-compression property documented in Table XI, not a transfer failure. Internal: both pairs hold. On the Internal rows, OURS reduces TTFSATTFSA by 427 ms [−455,−400-455,-400] versus FB-INV and by 135 ms [−150,−121-150,-121] versus ST-INV, and reduces per-commit control-plane bytes by 661 and 17 respectively, with all continuous-metric CIs strictly below zero. Unsafe rates are identical to FB-INV by construction (p=1.00p=1.00) and statistically indistinguishable from ST-INV’s (p=0.95p=0.95), recovering the directions reported under Sections VI-B and VI-C. R1: per-commit bytes carry the clearest signal. On the R1 rows, OURS reduces per-commit control-plane bytes by 607 (−45%-45\%), reduces TTFSATTFSA by 20 ms (−1.1%-1.1\%), and reduces upgrade frequency by 0.173 [−0.195,−0.157-0.195,-0.157], where upgrade frequency denotes the fraction of intents for which the executor fetched C1 evidence. The R1 evidence is considerably stronger on per-commit bytes than on TTFSATTFSA, and we do not overread the 20 ms TTFSATTFSA effect. The TTFSATTFSA and bytes zero-width bootstrap CIs on R1 should be read as deterministic replay point estimates rather than as evidence of broad planner-side sampling stability: temperature =0=0 combined with fixed contract arithmetic and identical env-epoch indexing collapses the per-seed delta to a constant, so the paired bootstrap returns a deterministic point estimate. The upgrade-frequency CI is genuinely non-zero-width and excludes zero. R1 OURS–ST-INV is a structural null on benign UC2 plus saturated-HIGH-risk because R1’s planner output forces every intent onto the same Stage-2 branch, which inactivates the dynamic-versus-static threshold axis (the regime-compression property already documented in Section VI-D). A meaningful OURS–ST-INV separation on an external planner source would require stressed-regime prompts, which lie outside the scope of this paper. Within-family mode and bridge projection. A within-family probe regenerated the matched UC2_BENIGN_SPORTS_4K v1 stream for 50 epochs with DeepSeek-V3.2 thinking mode (deepseek-reasoner) at temperature =0=0, keeping bundle, realization, and knob fixed. Slice type and latency matched on 50/50 epochs while bandwidth and its derived rate matched on only 5/50; an identical-config rerun matched 21/50 bandwidth and 48/50 slice-type/latency, indicating substantial within-mode bandwidth-selection variance at temperature =0=0. An analogous GLM-5.1 probe shows the same qualitative split: thinking stayed at 20 MHz, while non-thinking selected 15 MHz on 48/50 epochs with two 18 MHz outputs. Under the current replay bridge, the canonical planner outputs project to a single catalog action before the executor sees them, so the bandwidth/rate divergence axis is projected away before the executor-facing C0 object is constructed; the paired Table XII deltas are invariant to both the cross-mode and within-mode variation observed here. Auxiliary bridge-projection accounting check. Because raw planner-output match rates do not by themselves establish executor-side effectiveness, we also replayed three additional matched 50-epoch canonical streams (DeepSeek-reasoner thinking, GLM-5.1 thinking, GLM-5.1 non-thinking) plus a DeepSeek-chat 50-epoch re-derivation as a calibration row against the same five cached environment bundles, reporting paired deltas in Table XIII as an auxiliary bridge-projection accounting check. Under the current replay bridge, post-projection paired deltas are expected to be identical across planners and document executor-facing replay consistency rather than planner diversity. These 50-epoch rows test sign and safety preservation across planner swaps and are not directly comparable in magnitude with the 300-epoch R1 row of Table XII. Seedwise-sign columns in Table XIII count env-seeds matching the direction hypothesis (OURS << FB-INV for bytes/commit and TTFSA; OURS ≤ FB-INV for unsafe rate). Across all four streams, OURS preserves the per-commit bytes advantage versus FB-INV (5/5 seedwise sign agreement per stream); TTFSATTFSA remains same-signed but small at this horizon (5/5 per stream) and is not overread; OURS’s pooled unsafe rate equals FB-INV’s (Fisher p=1.00p=1.00); and OURS–ST-INV remains regime-compressed on this benign saturated-HIGH-risk slice. TABLE XIII: Auxiliary 50-epoch bridge-projection accounting check under the current replay bridge (UC2, benign; 5 environment seeds × 50 epochs/seed). Planner stream bytes/commit Δ TTFSA Δ (ms) unsafe rate (pooled) seedwise sign bytes Δ OURS−-FB-INV OURS−-FB-INV OURS vs FB-INV (bytes; TTFSA; safety) OURS−-ST-INV DS-chat non-thinking (50 ep calibration) −607.0-607.0 † −20.0-20.0 † OURS == FB-INV == 2.91 % 5/5; 5/5; 5/5 +0.0+0.0 † DS-reasoner (thinking) −607.0-607.0 † −20.0-20.0 † OURS == FB-INV == 2.91 % 5/5; 5/5; 5/5 +0.0+0.0 † GLM-5.1 (thinking) −607.0-607.0 † −20.0-20.0 † OURS == FB-INV == 2.91 % 5/5; 5/5; 5/5 +0.0+0.0 † GLM-5.1 (non-thinking) −607.0-607.0 † −20.0-20.0 † OURS == FB-INV == 2.91 % 5/5; 5/5; 5/5 +0.0+0.0 † † Under the current replay bridge, canonical planner outputs are projected to a single catalog action (slice_resource_realloc) before the executor sees them; per env-seed paired deltas are therefore deterministic across the four planner streams (standard deviation zero by construction). Rows are retained separately to document replay on four distinct captured planner streams, even though the current bridge makes their executor-facing deltas numerically identical. The four-row replication and the seedwise-sign columns carry the evidence rather than any bootstrap CI width. Fisher’s exact two-sided p=1.00p=1.00 on unsafe_action_rate for all four planner streams. The OURS−-ST-INV +0.0+0.0 column reproduces the benign-UC2 structural null of the R1 OURS−-ST-INV row in Table XII. VII Discussion and Limitations VII-A Operating Regime and Supervisory Scope PRGA targets SMO and Non-RT-RIC supervisory timescales, addressing seconds-to-minutes wireless supervisory actuation rather than near-RT PHY or MAC control, which has different latency and reliability constraints. The evaluation uses a trace-parameterized supervisory-loop benchmark calibrated from 3GPP TR 38.864 [1] and TS 28.541 [3]; it provides controlled, reproducible conditions but is bounded benchmark scope rather than evidence of live-network external validity. The model-to-benchmark mapping introduced in Section I is partial by design: some wireless state fields are fully realized in the scenario engine, others are partially realized, and a few serve as modeling devices for the executor’s local decision logic. This is acceptable for scoped benchmark replay and is not advanced as a live-network digital-twin claim. VII-B Comparator and Evidence Scope FB-INV is an eager full-evidence cost-overlay comparator: it retains OURS’s invariants INV-1–INV-3 and produces the same final commit decisions as OURS by construction, while paying eager ++ C0+ C1+ C2 cost on every intent. The comparison therefore isolates retrieval-cost accounting; the OURS-vs-FB-INV unsafe-rate equality follows from shared decisions and is not independent safety evidence. ST-INV equalizes INV-1–INV-3 and the verifier machinery and replaces the calibrated multi-factor risk score with a type-only static threshold, isolating the residual value of the calibrated risk signal once the invariant layer is held fixed; OURS is non-inferior to ST-INV on unsafe-action rate within the pre-declared Δ=0.5p =0.5\,p margin, and we do not claim strict safety superiority over ST-INV. BL4-legacy and C0-only are anchoring controls that quantify what the invariant layer costs and what happens without stale-state defense; their commit pools are selection-biased under cheaper control logic, so they are not paired unsafe-rate comparators against OURS. The safe-commit yield identity between OURS and FB-INV follows by construction and is not promoted to a separate safety claim. VII-C Evidence-Mandatory Gates, Degraded Mode, and Audit Scope The risk-divergence (Risk-Divergence), local-conflict (Local-Conflict), and planner-upgrade (Planner-Upgrade) gate reasons are evidence-mandatory: when C1 is unavailable under the deadline/bandwidth branch of Algorithm 2, these gates return REJECT and do not enter degraded COMMIT. A degraded COMMIT remains restricted to the Mid-Risk survivor case in the C1-unavailable branch, conditioned on a reversible action class, rℓ≤τdegradedr_ \!≤\! _degraded, and an empty c.blocking_reqc. blocking\_req. The path accounting preserves the branch-entry vs final-degraded-commit distinction: on UC1, the degraded branch fires for ≈9.4%≈9.4\% of epochs but no final degraded-mode commit lands under the Mid-Risk survivor check; on UC2, the branch fires for <1%<1\% of epochs (with two final degraded-mode commits surviving the Mid-Risk check). C2 supports post-hoc provenance, audit completeness, and reconstructability, not online safety. For OURS, full- C2 coverage reaches 73.8–77.7%; the residual 22–26% reflects fast Stage-1 commits that retain only the minimal transaction record rather than the full C2 digest. VII-D Captured-Planner and Deployment Scope Captured-planner evidence is retained as a bridge-bound executor compatibility check: it consists of one captured WirelessAgent_R1 trace plus auxiliary 50-epoch bridge-projected streams across three additional planner sources, all replayed under the current bridge. It preserves the OURS-vs-FB-INV cost-reduction direction on the tested streams (the matching unsafe-rate accounting follows from shared final decisions by construction, not from independent safety evidence). We do not claim heterogeneous multi-planner transfer, planner-family generalization, or live O-RAN deployment validation; these scope boundaries remain bounded to the tested replay streams and are left as future work. VII-E Operator Trade-offs and Future Work The two-stage retrieval policy is a deterministic, threshold-based heuristic (Section VI-E) rather than a claimed-optimal solution. Its strength is analyzability: the named invariants and the scalar-risk thresholds are auditable, and the commit/gate/reject boundaries are transparent. Lowering τcommit _commit or tightening Stage-2 retrieval thresholds shifts the system toward more eager evidence use, trading lower TTFSATTFSA-side gains for higher per-commit control-plane bytes and retrieval latency. Operators who prefer verifier confirmation on every committed intent can move toward FB-INV-like Stage-1 behavior by setting τcommit=0 _commit=0; matching FB-INV-style eager evidence end-to-end additionally requires disabling the degraded-mode commit branch of Algorithm 2 so that gated commits require C1 verifier confirmation, accepting the associated retrieval-latency cost. Future work includes O-RAN adapter validation, replay on real network traces, broader planner-family and prompt variation, adaptive retrieval thresholds, and richer multi-round negotiation. VIII Conclusion This paper presented PRGA, an executor-side actuation contract that organizes each AI-generated supervisory intent into executable local triage ( C0), on-demand coordination evidence ( C1), and off-path post-hoc provenance ( C2), with deterministic commit/gate/reject semantics under stale telemetry, conflict, deadlines, rollback, blocking preconditions, and planner–executor risk divergence. On energy-saving and slice-SLA benchmarks parameterized around 3GPP supervisory-control contexts, PRGA reduces TTFSATTFSA by 23.3–27.4% and per-commit control-plane bytes by 52.7–54.2% against a decision-identical eager full-evidence cost-overlay comparator, thereby isolating retrieval-cost accounting; remains non-inferior within a pre-declared Δ=0.5p =0.5\,p margin against an invariant-respecting static-threshold comparator; and rejects 100% of injected over-threshold stale inputs in the stale-state fault campaign, within the evaluated unsafe-action boundary. Full-stack O-RAN adapter validation, real-network trace replay, broader planner coverage, adaptive thresholds, and multi-round negotiation remain future work. References [1] 3GPP (2023) Study on network energy savings for NR. Technical report Technical Report TR 38.864. Note: Release 18, v18.1.0 Cited by: §I-F, §V-E, 1st item, §VII-A. [2] 3GPP (2026) Management and orchestration; 5G end to end key performance indicators. Technical report Technical Report TS 28.554. Note: Release 18, V18.9.0, 2026-01-16 Cited by: §I-F, 2nd item. [3] 3GPP (2026) Management and orchestration; 5G network resource model (NRM); stage 2 and stage 3. Technical report Technical Report TS 28.541. Note: Release 18, V18.14.0, 2026-01-16 Cited by: §I-F, §V-E, 2nd item, §VII-A. [4] A2A Project (Linux Foundation) (2025) Agent2Agent protocol (A2A) specification, v0.3. Note: https://github.com/a2aproject/A2AOpen protocol for agent-to-agent interoperability Cited by: §I, §I-D, TABLE I, §V-C. [5] C. Adamczyk and A. Kliks (2023) Conflict mitigation framework and conflict detection in O-RAN near-RT RIC. IEEE Commun. Mag. 61 (12), p. 199–205. External Links: Document Cited by: §I-E. [6] A. Agresti and B. Caffo (2000) Simple and effective confidence intervals for proportions and differences of proportions result from adding two successes and two failures. Amer. Statist. 54 (4), p. 280–288. Cited by: §VI-A. [7] M. Alshiekh, R. Bloem, R. Ehlers, B. Könighofer, S. Niekum, and U. Topcu (2018) Safe reinforcement learning via shielding. In Proc. AAAI Conf. Artif. Intell., Vol. 32, p. 2669–2678. External Links: Document Cited by: §I-C. [8] Anthropic and Agentic AI Foundation (2025) Model context protocol (MCP) specification, 2025-11-25. Note: https://modelcontextprotocol.io/specification/2025-11-25Open protocol for LLM tool and resource access Cited by: §I, §I-D, TABLE I, §V-D. [9] L. D. Brown, T. T. Cai, and A. DasGupta (2001) Interval estimation for a binomial proportion. Statist. Sci. 16 (2), p. 101–133. External Links: Document Cited by: §VI-A. [10] Y. Chen, S. Zhang, Q. Guo, L. Li, R. Wu, and T. Chen (2015) Deterministic replay: a survey. ACM Comput. Surveys 48 (2), p. 17:1–17:47. External Links: Document Cited by: §V-A. [11] A. Clemm, L. Ciavaglia, L. Granville, and J. Tantsura (2022) Intent-based networking – concepts and definitions. Note: IETF RFC 9315https://w.rfc-editor.org/rfc/rfc9315 Cited by: §I, §I-B, TABLE I. [12] C. J. Clopper and E. S. Pearson (1934) The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika 26 (4), p. 404–413. Cited by: §VI-A. [13] R. B. D’Agostino, J. M. Massaro, and L. M. Sullivan (2003) Non-inferiority trials: design concepts and issues—the encounters of academic consultants in statistics. Statist. Med. 22 (2), p. 169–186. External Links: Document Cited by: §VI-A. [14] B. Efron and R. J. Tibshirani (1993) An introduction to the bootstrap. Chapman and Hall, New York. Cited by: §VI-A. [15] M. Elkael, S. D’Oro, L. Bonati, M. Polese, Y. Lee, K. Furueda, and T. Melodia (2025) AgentRAN: an agentic AI architecture for autonomous control of open 6G networks. arXiv preprint arXiv:2508.17778. Cited by: §I, §I-A, TABLE I. [16] ETSI (2025) Publicly available specification (PAS); A1 interface: application protocol (O-RAN.WG2.A1AP-R004-v04.03). Technical report Technical Report ETSI TS 103 987 V4.3.0. Note: May 2025 Cited by: §I-B, §V-B. [17] ETSI (2025) Publicly available specification (PAS); A1 interface: general aspects and principles (O-RAN.WG2.A1GAP-R004-v04.00). Technical report Technical Report ETSI TS 103 983 V4.0.0. Note: May 2025 Cited by: §I-B, §V-B. [18] R. A. Fisher (1922) On the interpretation of χ2χ^2 from contingency tables, and the calculation of P. J. Roy. Stat. Soc. 85 (1), p. 87–94. External Links: Document Cited by: §VI-A. [19] R. K. Jain, D. W. Chiu, and W. R. Hawe (1984) A quantitative measure of fairness and discrimination for resource allocation in shared computer systems. Technical report Technical Report DEC-TR-301, Eastern Research Laboratory, Digital Equipment Corporation. Cited by: 2nd item. [20] S. Kaul, R. D. Yates, and M. Gruteser (2012) Real-time status: how often should one update?. In Proc. IEEE INFOCOM, p. 2731–2735. External Links: Document Cited by: §IV-B. [21] A. Leivadeas and M. Falkner (2023) A survey on intent-based networking. IEEE Commun. Surveys Tuts. 25 (1), p. 625–655. External Links: Document Cited by: §I, §I-B, TABLE I. [22] H. Li, Y. Wu, and D. Simeonidou (2026) Multi-agentic AI for conflict-aware rApp policy orchestration in Open RAN. In Proc. IEEE Int. Conf. Commun. (ICC), Note: Accepted/in press; arXiv:2603.07375 Cited by: §I, §I-A, TABLE I. [23] H. Li, M. Xiao, K. Wang, R. Schober, D. I. Kim, and Y. L. Guan (2026) ComAgent: multi-LLM based agentic AI empowered intelligent wireless networks. arXiv preprint arXiv:2601.19607. External Links: 2601.19607, Document Cited by: §I, §I-A, TABLE I. [24] B. Luo, S. Ramakrishna, A. Pettet, C. Kuhn, G. Karsai, and A. Mukhopadhyay (2023) Dynamic simplex: balancing safety and performance in autonomous cyber physical systems. In Proc. ACM/IEEE Int. Conf. Cyber-Physical Syst. (ICCPS), p. 177–186. External Links: Document Cited by: §I, §I-C, TABLE I. [25] Z. Lv, L. Xiao, Y. Chen, H. Chen, and X. Ji (2024) Safe multi-agent reinforcement learning for wireless applications against adversarial communications. IEEE Trans. Inf. Forensics Security 19, p. 6824–6839. External Links: Document Cited by: §I, §I-C, TABLE I. [26] K. Mehmood, K. Kralevska, and D. Palma (2023) Intent-driven autonomous network and service management in future cellular networks: a structured literature review. Comput. Netw. 220, p. 109477. External Links: Document Cited by: §I, §I-B. [27] Y. Njah, A. Leivadeas, and M. Falkner (2025) An AI-driven intent-based network architecture. IEEE Commun. Mag. 63 (4), p. 146–153. External Links: Document Cited by: §I, §I-B, TABLE I. [28] O-RAN Alliance (2024) O-RAN WG2 non-RT RIC architecture description. Technical report Note: O-RAN.WG2.Non-RT-RIC-ARCH Cited by: §I, §I, §I-B, TABLE I, §I-B, §V-B. [29] M. Polese, L. Bonati, S. D’Oro, S. Basagni, and T. Melodia (2023) Understanding O-RAN: architecture, interfaces, algorithms, security, and research challenges. IEEE Commun. Surveys Tuts. 25 (2), p. 1376–1421. External Links: Document Cited by: §I, §I, §I-B, TABLE I, §I-B, §V-B. [30] Z. Qin, X. Tao, J. Lu, W. Tong, and G. Y. Li (2023) Semantic communications: principles and challenges. IEEE J. Sel. Areas Commun. 41 (1), p. 1–32. External Links: Document Cited by: §I-A. [31] P. J. G. Ramadge and W. M. Wonham (1987) Supervisory control of a class of discrete event processes. SIAM J. Control Optim. 25 (1), p. 206–230. External Links: Document Cited by: §I-C. [32] S. Raza, R. Sapkota, M. Karkee, and C. Emmanouilidis (2026) TRiSM for agentic AI: a review of trust, risk, and security management in LLM-based agentic multi-agent systems. AI Open 7, p. 71–95. External Links: Document Cited by: §I, §I-D, TABLE I. [33] R. Su, D. Zhang, R. Venkatesan, Z. Gong, C. Li, F. Ding, F. Jiang, and Z. Zhu (2019) Resource allocation for network slicing in 5G telecommunication networks: a survey of principles and models. IEEE Netw. 33 (6), p. 172–179. External Links: Document Cited by: 2nd item. [34] W3C PROV Working Group (2013) PROV-DM: the PROV data model. World Wide Web Consortium. Note: W3C RecommendationEdited by Luc Moreau and Paolo Missier; 30 April 2013 External Links: Link Cited by: §IV-G. [35] L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y. Lin, W. X. Zhao, Z. Wei, and J. Wen (2024) A survey on large language model based autonomous agents. Frontiers of Computer Science 18 (6), p. 186345. External Links: Document Cited by: §I. [36] J. Wu, Y. Zhang, M. Zukerman, and E. K. Yung (2015) Energy-efficient base-stations sleep-mode techniques in green cellular networks: a survey. IEEE Commun. Surveys Tuts. 17 (2), p. 803–826. External Links: Document Cited by: 1st item. [37] Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang (2024) AutoGen: enabling next-gen LLM applications via multi-agent conversation. In Proc. COLM, Cited by: §I, §I-A, TABLE I. [38] W. Yang, H. Du, Z. Liew, W. Y. B. Lim, Z. Xiong, D. Niyato, X. Chi, X. S. Shen, and C. Miao (2023) Semantic communications for future internet: fundamentals, applications, and challenges. IEEE Commun. Surveys Tuts. 25 (1), p. 213–250. External Links: Document Cited by: §I-A. [39] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao (2023) ReAct: synergizing reasoning and acting in language models. In Proc. Int. Conf. Learning Representations (ICLR), Note: arXiv:2210.03629 Cited by: §I.