Skip to content
AIGP

RFC-010: AIGP Runtime Governance Protocol — 17. AIGP-Light Embedded Runtime

AIGP Specification › RFC-010: AIGP Runtime Governance Protocol › 17. AIGP-Light Embedded Runtime

← 16. Post-Hoc Evaluation Loop (RFC-032) · Section index · 18. Non-Linguistic Invocation Governance →

17. AIGP-Light Embedded Runtime

17.1 Purpose

AIGP-Light is a self-contained embedded runtime for DDIL (Denied, Disrupted, Intermittent, Limited) environments. It evaluates governance admission decisions locally without network dependency and reconciles with the ground-based governance server on uplink restoration.

17.2 DDIL State Machine

The runtime SHALL track connectivity state as a formal state machine:

State Meaning Governance Behavior
connected Full uplink available Server-delegated governance
degraded High latency / partial uplink Local decisions with partial sync
disconnected No uplink available Fully autonomous local governance

State transitions SHALL be triggered by configurable thresholds (latency, timeout, recovery window).

17.3 Autonomy Ceiling

When disconnected, the runtime SHALL enforce hard limits on unsupervised operation:

  • max_decisions: Maximum local decisions before DENY
  • max_time_seconds: Maximum autonomous operation duration
  • max_cumulative_risk: Risk budget ceiling

When ANY ceiling is breached, ALL subsequent requests SHALL be DENIED. A human operator MAY extend the ceiling with a time-bounded override code.

17.4 Decision Store

Every local decision SHALL be recorded in an append-only, content-hash-chained log with:

  • Monotonic sequence number
  • SHA-256 content hash (chained to previous event)
  • Incremental Merkle root
  • ddil_state field indicating connectivity at invocation time
  • Mode flag (Mode-1 user-facing / Mode-2 internal)

17.5 Trace Reconciliation

On uplink restoration, AIGP-Light SHALL reconcile buffered events with the ground server:

  1. RECONCILE_INIT: Client sends last_ack_hash, buffered_count, Merkle root
  2. RECONCILE_ACK: Server responds with its last-known hash, gap detection
  3. RECONCILE_BATCH[1..N]: Client sends events in chronological batches
  4. RECONCILE_RESULT: Server confirms ingestion, flags conflicts

Reconciliation SHALL be idempotent, resumable, and bandwidth-efficient. The ground server SHALL NOT retroactively alter admission decisions.

17.6 Mode-2 Internal AI Governance

AI invocations made by the governance substrate itself (model-as-judge, corpus generation) SHALL be governed under Mode-2:

  • governance_mode: "internal" field distinguishes from Mode-1
  • Separate policy pool (rate limits, allowlist, budget)
  • autonomy_level ceiling: OBSERVE / SUGGEST / ACT_WITH_APPROVAL / ACT_AUTONOMOUS
  • Admission witness prepended to operation’s witness chain
  • Recursion prevention: Mode-2 evaluation is always local policy (no recursive Mode-2)

← 16. Post-Hoc Evaluation Loop (RFC-032) · Section index · 18. Non-Linguistic Invocation Governance →