Keywords: certified prefix acceptance, untrusted AI agents, speculative execution, conformal calibration, scalable oversight

1 Introduction↩︎

Modern AI can draft sequences of decisions at low computational cost — a learned policy rolling out actions, a frozen large language model proposing a plan. Acting on those drafts directly in hard-constrained settings, however, forfeits safety: a learned or LLM policy carries no feasibility guarantee — a frozen \(12\)B-parameter LLM proposes constraint-violating battery actions in \(98\%\) of episodes, and an end-to-end reinforcement learner replacing the trusted module pays about \(7\times\) its regret. The reliable alternative delegates every step to an expensive trusted solver — an LP/MILP optimizer, a model-predictive planner, a shield — that certifies feasibility and supplies a safe repair on demand. But per-step delegation pins the most expensive component to the critical path even when short-horizon action sequences are largely predictable. Safely deploying untrusted AI therefore needs a certified layer that uses AI drafts without trusting them — one in which a thin trusted core owns every guarantee.

The missing layer has a precise shape: intelligence and guarantees must come from different owners. Drafts must come from a source that is free to be arbitrarily capable — and arbitrarily wrong — while every guarantee is owned by a thin trusted core that never depends on the source. This separation has one mature precedent: speculative decoding, where a cheap drafter proposes tokens and the target model verifies a prefix and accepts it in one pass [1], [2]. But a token draft is checked against a probability distribution; a control draft must be checked against hard feasibility and against decision quality, and these two checks cannot be the same object, because a constraint-safe action prefix can still be economically poor. What verification means for executed decisions — and what acceptance is worth — has to be rebuilt from the ground up.

We make this precise as Certificate-Gated Prefix Acceptance (CGPA), a single certified speculative-execution contract for untrusted AI agents. An untrusted proposal source — a rule, a learned policy, or a frozen LLM — proposes a length-\(K\) action prefix; a trusted verifier rejects any unsafe transition, a trusted value boundary truncates prefixes that are safe but costly, and CGPA commits the longest certified prefix and defers the rest to the oracle.

This contract’s three parts are structurally necessary: remove any one and it collapses onto a known weaker baseline (Section 2). Any layer that turns untrusted test-time compute into safe solver amortization must own feasibility exactly, or the proposal source inherits a path to violations (Proposition 2); must budget excess cost per accepted segment, or acceptance has no auditable price (Certificate 2); and must calibrate the one quantity it estimates, or that budget is an assumption rather than a measurement (Proposition 4).

The contract is one object — a certified prefix-acceptance operator — whose regret certificate charges the value-boundary error \(\epsilon\) once per accepted segment, not per step (Section 2). This single accounting identity organizes the paper: safety never queries \(\epsilon\) (Section 3.2); learning \(\epsilon\) down shrinks regret three orders of magnitude (Section 3.3); a heterogeneous source moves only which prefixes are accepted (Section 3.4); and each accepted segment skips its oracle solves, yielding a \(2.96\times\) wall-clock speedup on deployment-scale unit commitment (Section 3.5).

2 Certified Speculative Execution↩︎

2.1 Problem Setup↩︎

We consider finite-horizon decision control with state \(s_t\), action \(a_t\), transition \(s_{t+1}=f(s_t,a_t)\), non-negative stage cost \(c(s_t,a_t)\ge0\), and hard feasibility constraints. The remaining horizon is encoded in \(s_t\), so the oracle cost-to-go \(V(s_t)\) is written without a time subscript. A trusted oracle policy \(\pi_F\) returns feasible actions; the reference baseline invokes \(\pi_F\) at every step and applies only the first action of each receding-horizon oracle solve, defining \[J_F(s_0) = \sum_{t=0}^{T-1} c(s_t,\pi_F(s_t)).\] For a CGPA rollout with applied actions \(a_t^{\mathrm{CGPA}}\), \(J_{\mathrm{CGPA}}(s_0)=\sum_{t}c(s_t,a_t^{\mathrm{CGPA}})\), and we report the fallback-relative normalized regret used in every table, \[R_{\mathrm{rel}} = \frac{J_{\mathrm{CGPA}}(s_0)-J_F(s_0)}{\max(|J_F(s_0)|,10^{-12})}. \label{eq:regret}\tag{1}\] CGPA preserves the oracle’s safety within an auditable regret budget while moving it off the per-step critical path.

2.2 The Accept/Defer Contract↩︎

At state \(s_t\), the proposal source proposes \(K\) actions \(u_{0:K-1}=D(s_t,K)\). A trusted verifier simulates the prefix and stops at the first unsafe transition. Among the verified-safe prefix lengths, CGPA selects the longest prefix satisfying \[g(s_t,u_{0:k-1})+\hat{V}(s_{t+k}) \leq \hat{V}(s_t)+\tau |\hat{V}(s_t)| , \label{eq:value95guard}\tag{2}\] where \(g(s_t,u_{0:k-1})\) is the verified prefix cost and \(\tau\) is the value tolerance (the absolute value enables scaling with the boundary magnitude). If \(k>0\) the controller executes the accepted prefix; if \(k=0\) it defers, applying one verified oracle repair.

Equation 2 is the boundary-estimated form of a per-segment regret budget: it asks that the realized prefix cost not exceed the drop in cost-to-go \(\hat{V}(s_t)-\hat{V}(s_{t+k})\) by more than a fraction \(\tau\) of the local value scale — exactly the condition that telescopes into a bounded episode-level certificate (Section 2.4). For non-negative prefix cost it is, after rearrangement, a local value-descent condition \[\hat{V}(s_{t+k}) - \hat{V}(s_t)\;\le\; -\,g(s_t,u_{0:k-1}) + \sigma_t, \quad \sigma_t := \tau\,|\hat{V}(s_t)| , \label{eq:dissipation}\tag{3}\] read in the cost-to-go convention \(\hat{V}\ge 0\) (so \(-g\le0\), \(\sigma_t\ge0\)).

The value boundary may be precomputed, learned, or forecast-based, provided its online query cost is small relative to the oracle solve. The guarantees rest on three assumptions separating trusted from untrusted components.

2.3 Safety Holds for Any Proposal Source↩︎

CGPA never applies a proposed transition the trusted verifier has not accepted. When the verifier rejects at length zero, the oracle supplies a repair, which is itself verified before execution.

The next proposition shows the decoupling is necessary, not stylistic: the feasibility gate cannot be folded into the learned value boundary.

2.4 Regret Certificate↩︎

Let \(V(s)=V^{\pi_F}(s)\) be the finite-horizon oracle cost-to-go, terminal value zero.

For an exact value \(V\), 2 specializes to admitting a segment when \(g_i + V(s_{i+1}) \leq V(s_i)+\tau_i |V(s_i)|\).

Summing Lemma 1 over all segments telescopes to \(V(s_0)\); dividing by \(|J_F|\) recovers the normalized regret 1 (full proof in the appendix). The deployed controller runs 2 with \(\hat{V}\), not \(V\). The next result propagates the boundary error through the same argument.

The boundary error enters once per accepted segment and adds \((2{+}\tau_{\max})\epsilon|\mathcal{A}|\) (full proof in the supplementary material).

A single operator (Definition 1) forces these components together once safety, bounded regret, and a learnable boundary are required; remove any one and CGPA collapses onto a known weaker baseline (Proposition 2). Section 3 tests these structural consequences one by one.

2.5 Certificate-Aware Learning of the Value Boundary↩︎

We instantiate \(\hat{V}\) with a learned five-quantile MLP that outputs levels \(\{\hat{V}_{0.1},\hat{V}_{0.3},\hat{V}_{0.5},\hat{V}_{0.7},\hat{V}_{0.9}\}\) — a calibrated central band with tail levels for the error spread. The median drives the value guard 2 and the spread \(\hat{V}_{0.9}-\hat{V}_{0.1}\) supplies a state-dependent estimate of the \(\epsilon\) in Certificate 2. The training objective is certificate-driven: the only boundary-dependent term of Certificate 2 is \((2+\tau_{\max})\epsilon|\mathcal{A}|\), and calibration (Proposition 4) makes \(\epsilon(s)\) a fixed multiple of the quantile spread \(\hat{V}_{0.9}(s)-\hat{V}_{0.1}(s)\), so we add a mean-spread penalty on top of the coverage loss: \[\mathcal{L} \;=\; \underbrace{\mathcal{L}_{\text{pinball}}}_{\text{coverage}} \;+\; \lambda \cdot \underbrace{\mathbb{E}_s\bigl[\hat{V}_{0.9}(s)-\hat{V}_{0.1}(s)\bigr]}_{\text{mean }\epsilon\text{ estimate}} , \label{eq:cert95loss}\tag{4}\] the pinball term [3] preserving quantile coverage and the spread penalty shrinking Certificate 2’s \(\epsilon\) term. The penalty is essential: removing it (\(\lambda{=}0\)) inflates EMS regret by \(1.46\times\) at matched call reduction (we use \(\lambda=0.05\); full sweep in the appendix). Because \(\hat{V}\) enters only the value guard, a poor boundary inflates regret but cannot induce a violation (Propositions 1–2); learning is thus free to optimize the frontier with no safety risk.

To instantiate the \(\epsilon\) of Assumption 2 as a measured quantity, we apply split-conformal calibration [4]–[6] to the quantile-spread estimate on held-out oracle rollouts, with non-conformity score \(r_i=|y_i-\hat{V}_{0.5}(s_i)|/(\hat{V}_{0.9}(s_i)-\hat{V}_{0.1}(s_i))\), where \(y_i=V(s_i)\) is the realized oracle cost-to-go at calibration state \(s_i\). This yields a state-dependent band \([\hat{V}_{0.5}(s)\pm\alpha\,(\hat{V}_{0.9}(s)-\hat{V}_{0.1}(s))]\), calibrated to \(80\%\) and \(90\%\) targets and attaining \(0.816\)–\(0.853\) and \(0.900\)–\(0.917\) empirical coverage across domains (appendix). The calibrated multiplier \(\alpha\) then defines a state-dependent error band \(\epsilon(s)=\alpha\,(\hat{V}_{0.9}(s)-\hat{V}_{0.1}(s))\) that instantiates the certificate’s \(\epsilon\) — so the conformal band and the certificate’s error term are one quantity, and the spread penalty of Eq. 4 shrinks precisely this band. Deployed as a gate, the band enters the value guard pessimistically at both endpoints: a prefix is admitted only if \[\begin{align} g(s_t,u_{0:k-1})+\hat{V}_{0.5}(s_{t+k})&+\epsilon(s_{t+k})\\ \leq \hat{V}_{0.5}(s_t)-\epsilon(s_t)&+\tau|\hat{V}_{0.5}(s_t)| , \end{align} \label{eq:band95gate}\tag{5}\] the band-gate operating points of Sections 3.3 and 3.5, yielding a forward, high-probability guarantee.

A union bound at level \(\delta/(T{+}1)\) over the \(\le T{+}1\) boundary states makes \(|\hat{V}_{0.5}(s)-V(s)|\le\epsilon(s)\) hold jointly with probability \(\ge 1-\delta\); the Certificate 2 substitution then applies with the endpoint bands (full proof in the appendix). The regret certificate is a realized-reference audit needing no exchangeability assumption; the conformal band calibrates \(\epsilon\) before deployment.

3 Experiments↩︎

3.1 Setup↩︎

We evaluate CGPA across three sequential-decision settings spanning a spectrum of oracle cost: a fast LP-backed battery energy management (EMS) problem on UCI household loads [7] (the primary mechanism testbed), the real-data CityLearn 2022 multi-building HVAC benchmark [8] (a real-calendar distribution shift, appendix), and a MILP-backed deployment-scale unit commitment (UC) instance [9] (an expensive oracle). The contract is held fixed; the untrusted proposal slot is the variable we sweep, to test the invariance of the certificate’s guarantees. Across the study the proposal slot is filled by a deterministic forecast, a learned MLP policy, an end-to-end reinforcement learner, adversarial drafters, and six frozen LLMs (Qwen3-\(1.7\)B/\(4\)B/\(8\)B; Gemma-4-E2B/E4B/12B), exercising the arbitrariness of Assumption 3.

Unless stated otherwise EMS episodes use a \(24\)-step horizon and prefix length \(K{=}4\), and the value tolerance \(\tau\) — the per-segment regret-budget parameter of Certificate 2 — is held fixed within a setting; its regret–call-reduction response is smooth and monotone (appendix), so it directly selects the operating point. Throughout, violations count applied constraint breaches, regret is \(R_{\mathrm{rel}}\) of Eq. 1 (p95: its \(95\)th percentile), and call reduction is the relative drop in trusted-oracle invocations versus stepwise fallback. The learned boundary is the five-quantile certificate-aware value boundary of Section 2.5, run via per-state online CPU inference inside the timed loop; confidence intervals are nonparametric episode-level bootstrap. The experiments share one design, controlled frontier slicing: each table fixes all but one part of the accept/defer system (value boundary, acceptance mechanism, proposal source, or fallback oracle), so it slices a different term of Certificate 2.

3.2 The Contract Neutralizes Arbitrary Proposal Sources↩︎

Safety is the \(|\mathcal{A}|\!\to\!0\) limit of the certificate: it never queries \(\epsilon\) (Proposition 2), so the contract drives any untrusted source to zero applied violations — a guarantee no direct AI replacement provides. We fill the EMS proposal slot with adversarial hand-built drafters, an end-to-end learner, and frozen LLMs, comparing direct execution against the same source wrapped by CGPA (appendix).

The pattern is uniform. Adversarial drafters and the two larger Gemma models produce parseable but constraint-violating actions in \(98\)–\(100\%\) of episodes when executed directly; the contract admits none of those unsafe transitions and defers, reaching zero applied violations while collapsing regret by orders of magnitude — the empirical counterpart of Proposition 1, where safety is owned by the verifier/oracle pair regardless of how proposals are generated. The regret bound also holds: a low-quality source has few prefixes accepted, so \(|\mathcal{A}|\) — and the certificate’s \((2+\tau_{\max})\epsilon|\mathcal{A}|\) term — shrinks toward zero and CGPA reverts to stepwise fallback at unchanged guarantees.

The end-to-end learner makes the converse point: replacing the oracle with a trained policy removes oracle calls but pays \(0.503\) mean regret — about \(7\times\) the same learner used as a proposal source inside the contract (\(0.074\)). Direct AI replacement is not a substitute for the contract; it forfeits either safety or regret.

3.2.0.1 Safety survives intentional misuse.

A white-box adaptive adversary — one that re-plans every step with full knowledge of the verifier, value boundary, dynamics, and cost to maximize constraint violations — drives raw execution to a breach in every episode on both EMS and unit commitment, yet CGPA admits none: it defers at every step, so the attack is absorbed by lost amortization (call reduction falls to zero), never by an applied violation (appendix). The feasibility gate never queries the value boundary the adversary attacks, so safety is owned by the verifier, not the proposal source, however adversarial. The same holds against a learned attacker: a white-box MLP that optimizes feasible high-cost prefixes against the contract drives feasible-cost regret above the forecast drafter, yet the frozen contract still holds it to zero applied violations with regret inside the certificate (appendix).

3.3 Learned Value Boundaries Lift the Risk–Cost Frontier↩︎

Quality has one structural source: the certificate is one-sided. It prices the boundary error of accepted coverage at \((2+\tau_{\max})\epsilon\) per segment, bounds only the excess over the fallback, and never references oracle optimality (Assumption 1). With safety owned by the verifier, \(\epsilon\) is a free optimization target: learning the boundary down shrinks the price of coverage, and a capable source pushes accepted quality past the stepwise reference. We trace the EMS risk–cost frontier under a fixed forecast proposal source (\(n{=}100\)), changing only the value boundary (appendix). Plain prefix acceptance — a multi-step safe filter with no value guard — accepts everything and pays \(0.4450\) mean regret, identically at every draft length \(K\) (appendix); end-to-end RL replacement pays \(0.503\) (appendix). The certificate-aware learned guard cuts this to \(0.0063\) at \(60.4\%\) call reduction, and its conformally calibrated band gate drives mean regret to \(\mathbf{0.0002}\) — three orders of magnitude below unguarded acceptance, within sampling noise of the stepwise oracle (\(95\%\) CI \([-0.005,0.006]\), spanning zero) — the lowest mean regret and best p95 across the EMS value-boundary sweep at \(\tau{=}0.04\). It also outperforms non-learned boundaries and reproduces on the real-data CityLearn benchmark (\(0.0104\) mean regret, zero violations; appendix). This is the certificate’s \((2+\tau_{\max})\epsilon|\mathcal{A}|\) term made small, and the realized-reference audit confirms it: the envelope covers \(93\)–\(100\%\) of accepted segments, at zero applied violations throughout.

3.3.0.1 Certified acceptance versus full-plan approximation.

The next slice fixes boundary and source and varies the acceptance mechanism. We route an imitation network trained on oracle sequences — the safety-augmented neural MPC baseline of [10] — through two controllers. Full-plan acceptance commits the whole sequence as one accept/reject decision and repairs to a safe candidate on infeasibility, paying \(0.0227\) mean regret; CGPA’s certified prefix acceptance, on the same network, truncates at the value boundary and cuts regret to \(0.0081\) (\(2.8\times\)) at \(86.6\%\) call reduction, or holds a \(98.0\%\) high-amortization point at a fraction of the verifier load (appendix). This gap is the per-segment \((2+\tau_{\max})\epsilon\) pricing of Certificate 2 at fixed boundary and source.

3.3.0.2 Distribution shift: the stepwise oracle is overtaken.

The learned boundary generalizes beyond its training distribution. We swap in a learned MLP drafter as an out-of-distribution (OOD) proposal source under calendar shift: it is trained on one season and deployed on \(18\) held-out OOD days, against the forecast drafter on the same days (five training seeds), with the certified contract unchanged. Table 1 reports the result. The learned proposal source raises mean call reduction by \(+18.8\)pp (day-clustered \(95\%\) CI \([+14.9,+22.1]\), bootstrapped over held-out days) while lowering mean regret by \(0.055\), at zero violations across all \(90\) day–seed runs. The sign is decisive: the accepted prefixes beat the stepwise oracle’s own cost on \(15\) of \(18\) days (\(72\) of \(90\) day–seed runs; supplementary material), while in distribution they win exactly \(50\%\) — the expected rate against a matched reference. Under shift the contract overtakes it by committing multi-step prefixes its myopic per-step replanning cannot.

2pt

3.4 One Contract, Six Heterogeneous LLM Proposal Sources↩︎

Frozen LLMs are the most heterogeneous proposal sources available — varying in scale, family, and decoding behavior with no domain-specific training. Because the certificate charges per accepted segment, such a source moves only which prefixes are accepted, not the contract’s guarantees. Table 2 fills the EMS proposal slot with six of them (same-seed \(n{=}50\), deterministic decoding, \(\tau{=}0.08\)).

5pt

Two regimes appear, and the contract absorbs both. The Qwen models and Gemma-4-E2B are feasible but costly under direct execution; the contract sharpens them, cutting regret \(3.8\)–\(10.9\times\) at \(62\)–\(70\%\) call reduction. Gemma-4-E4B and Gemma-4-12B violate constraints in nearly every direct rollout; the contract rejects those transitions and defers to zero violations at low regret. One contract thus delivers the same guarantee across a \(1.7\)B and a \(12\)B model alike: the proposal source determines which prefixes are accepted — certified throughput tracks proposal quality, not parameter count — never whether the system is safe. A controlled quality sweep makes this explicit: as a controlled knob moves the source from random toward oracle, EMS call reduction rises monotonically (\(24\%\!\to\!90\%\), Spearman \(1.0\)) at zero violations throughout, and the same quality–throughput ordering holds on UC at matched tolerance (appendix). The same contract that absorbs all six frozen LLMs at zero violations is next evaluated on an oracle expensive enough that each skipped call yields measurable wall-clock savings.

3.5 Deployment-Scale Wall-Clock Amortization↩︎

Wall-clock savings scale with skipped oracle solves: scaling per-call oracle cost on EMS lifts CGPA’s speedup from \(1.63\times\) to \(2.67\times\), while event-triggered and move-blocking controllers stay near \(1.0\times\) (Figure 2). On a deployment-scale \(48\)-step UC MILP, Table 3 reports a hold-commitment drafter and a frozen Qwen3-8B proposing commitment changes against an event-triggered receding-horizon controller that re-solves on deviation (\(n{=}50\)), both CGPA rows using the same learned boundary of Section 2.5.

3.5pt

The frozen LLM, with no UC-specific training, achieves the highest speedup: its commitment changes admit prefixes the deterministic heuristic does not propose, and the contract converts them into a \(2.96\times\) per-episode mean speedup (\(2.02\times\) in aggregate wall-clock, every one of the \(50\) episodes faster than fallback) at \(2.1\%\) regret — aggregate amortization the hold drafter (\(1.79\times\)) does not reach — while the contract, not the proposal source, owns the unchanged zero-violation guarantee. Trigger-scheduled replanning achieves at most \(1.07\times\); warm-starting reaches \(0.91\times\). The MILP fallback dominates online time (\(97.96\)–\(99.98\%\)); a matched-\(\tau\) rerun and a second instance (\(2.09\times\)) confirm the ordering (appendix).

4 Related Work↩︎

4.0.0.1 AI control and scalable oversight.

A parallel safety agenda wraps a capable but untrusted policy in a trusted protocol and measures safety under adversarial control evaluation [11], as do weak-to-strong generalization [12] and debate [13], which separate a strong untrusted generator from a weaker trusted overseer under the asymmetry that verification is cheaper than generation. CGPA is the certified, sequential-control instance of this separation — intelligence and guarantees come from different owners — but its trusted core gives a deterministic feasibility guarantee and an auditable per-segment regret price rather than a monitored probability of subversion, accepting the source by exact verification and a calibrated value certificate rather than a learned monitor.

4.0.0.2 Speculative decoding.

CGPA shares the draft–verify–accept skeleton of speculative decoding [1], [2], [14], [15] but changes the verified object from a token distribution to hard transition safety plus a certified fallback-relative cost, and the proposal source from a draft model to an arbitrary AI policy or LLM. Recent production variants add a calibrated confidence head and a load-adaptive verification schedule [16], yet acceptance stays lossless — calibrated to preserve the target token distribution — whereas CGPA calibrates an analogous value boundary to certify decision cost under a hard-feasibility verifier. Speculative execution has also cut agentic latency by predicting actions and committing on match [17]; CGPA instead accepts deviations from the oracle within a certified regret budget, under hard feasibility rather than equivalence checking.

4.0.0.3 Selective prediction and learning to defer.

The accept/defer boundary is a learning-to-defer mechanism for the control loop — acceptance is coverage, deferral is abstention to a trusted expert, and the certificate bounds the cost of coverage [18]–[20]. Unlike sequence-level deferral for token and span abstention [21], CGPA defers executed control prefixes under a hard-feasibility verifier and a fallback-relative regret certificate.

4.0.0.4 Conformal risk control.

The calibrated band places CGPA within conformal risk control [4], [6], [22], [23]: the controlled risk is the per-segment excess cost the certificate charges, making \(\epsilon\) measured rather than assumed.

4.0.0.5 Safe control and safe AI execution.

Shielding and predictive safety filters [24]–[27] correct a single action per online solve; intervention controllers pair a learned proposer with a trusted backup [28], [29]; safety-augmented neural MPC falls back on infeasibility [10]; other lines accelerate or repair the trusted controller rather than skip it [30]–[35]. CGPA admits an arbitrary source, separates exact feasibility from a learned value boundary, and attaches a calibrated telescoping regret certificate.

5 Conclusion↩︎

CGPA is a certified speculative-execution contract: a thin trusted core owns every guarantee while an arbitrarily capable untrusted source is admitted only through it. The same contract drives adversarial drafters and six frozen LLMs to zero applied violations, holds regret within sampling noise of the stepwise oracle, and on deployment-scale unit commitment turns a frozen LLM into a \(2.96\times\) wall-clock speedup — turning heterogeneous untrusted AI agents into a safe, low-regret, oracle-amortizing execution layer whose throughput grows with the capability of the untrusted source, at guarantees that never change.

6 Notation↩︎

Table 4 collects the symbols used throughout the main paper and this appendix.

7 Certificate-Aware Loss Sweep↩︎

This section reports the full \(\lambda\) sweep referenced in Section 2.5. The spread penalty is essential: at matched call reduction, \(\lambda=0.05\) reduces EMS mean regret from \(0.0531\) to \(0.0364\).

4pt

8 Conformal Calibration↩︎

This section reports the calibration quantities supporting the coverage statement in Section 2.5. Calibration and test states are seed-disjoint fallback-reachable rollout-state visits (\(n_{\mathrm{cal}}{=}n_{\mathrm{test}}{=}408\) per domain). The nonconformity score is \[r_i=\frac{|y_i-\hat{V}_{0.5}(s_i)|}{\hat{V}_{0.9}(s_i)-\hat{V}_{0.1}(s_i)},\] and the deployed band is \([\hat{V}_{0.5}(s)\pm\alpha(\hat{V}_{0.9}(s)-\hat{V}_{0.1}(s))]\). At this calibration size both domains meet their \(80\%\) and \(90\%\) targets.

3pt

9 Tolerance Frontier↩︎

This section reports the \(\tau\) frontier referenced in Section 3.1. Increasing \(\tau\) selects longer accepted prefixes and higher call reduction with zero applied violations across the reported sweep.

4pt

10 Certified Execution over Untrusted Proposal Sources↩︎

This section gives the per-source safety/regret table referenced in Section 3.2. Direct executes the proposed actions raw; CGPA (Certificate-Gated Prefix Acceptance) wraps the same source in the accept/defer contract (the RL Direct column is end-to-end oracle replacement). Adversarial drafters and the frozen Gemma-4-12B and Gemma-4-E4B models violate constraints in nearly every episode under direct execution; the contract drives all of them to zero applied violations and collapses regret by three to four orders of magnitude, the worst adversarial source landing at the oracle’s own cost. Violations are the per-episode applied-breach rate; adversarial/RL rows use \(30\) EMS episodes, LLM rows \(50\) same-seed episodes (\(\tau{=}0.08\)); the full six-LLM comparison appears in the main paper.

4.5pt

11 EMS Value-Boundary Frontier↩︎

This section gives the EMS risk–cost frontier referenced in Section 3.3, under a fixed forecast proposal source (\(n{=}100\)) with only the value boundary changed (\(\tau{=}0.04\)). The certificate-aware learned guard cuts mean regret from \(0.4450\) (unguarded prefix acceptance) to \(0.0063\) at \(60.4\%\) call reduction, and its conformally calibrated band gate reaches \(0.0002\) (\(95\%\) CI \([-0.005,0.006]\), spanning zero) — three orders of magnitude below unguarded acceptance, within sampling noise of the stepwise oracle — at the best regret tail, all at zero applied violations.

5pt

12 Full-Plan Neural MPC Comparison↩︎

This section reports the certified-acceptance-versus-full-plan comparison referenced in Section 3.3. The same imitation network (a safety-augmented neural MPC input-sequence approximator) is routed through full-plan acceptance — which commits the whole predicted sequence as one accept/reject decision and repairs to a safe candidate on infeasibility — and through CGPA certified prefix acceptance, with only the acceptance mechanism changed (EMS, \(n{=}100\), zero violations throughout). CGPA prefix acceptance cuts mean regret from \(0.0227\) to \(0.0081\) (\(2.8\times\)) at \(86.6\%\) call reduction, and trades regret for amortization at higher \(\tau\).

5pt

13 CityLearn Real-Calendar Shift↩︎

This section gives the real-calendar CityLearn result referenced in Sections 3.1 and 3.3. The same accept/defer contract is evaluated under the calendar shift with \(\tau=0.04\).

4pt

14 Oracle-Cost Amortization Sweep↩︎

This section reports the full oracle-cost sweep supporting the deployment-amortization statement in Section 3.5. Increasing the per-call oracle cost demonstrates the structural advantage of certified multi-step acceptance over controllers that still call the oracle every step. Timing follows the per-component online accounting (draft, verification, boundary inference, trusted-oracle calls). The event-triggered controller replans when its queued plan is exhausted or when the next queued action fails one-step verification; because that plan is itself built from per-step trusted-oracle calls, its oracle-call count is unreduced under the target-oracle accounting used throughout.

4pt

15 UC Per-Episode Speedup↩︎

All \(50\) Qwen3-8B CGPA episodes behind the UC speedup statement in Section 3.5 is faster than stepwise fallback, with a minimum per-episode speedup of \(1.51\times\), a per-episode mean of \(2.96\times\), and a total-wall ratio of \(2.02\times\), all at zero applied violations.

16 Proposal Quality and Matched-\(\tau\) Throughput↩︎

This section supports the claim that certified throughput grows with proposal quality, not raw model size. On the six-LLM EMS suite (same-seed \(n{=}50\)), the verifier-accepted prefix length and the CGPA call reduction are perfectly rank-correlated across models (Spearman \(\rho{=}1.000\)), whereas parameter count and call reduction are not (\(\rho{=}-0.058\)): the capability axis that predicts throughput is the quality of the proposed prefixes, not the number of parameters.

The same ordering holds at deployment scale once the value tolerance is controlled. Table 13 re-runs the UC end-to-end comparison with the hold and Qwen3-8B drafters at identical \(\tau\) (the main-paper rows use \(\tau{=}0.04\) for hold and \(\tau{=}0.15\) for Qwen). At every matched \(\tau\) the frozen LLM exceeds the deterministic heuristic on mean and total-wall speedup at zero violations: the capability–throughput ordering holds at matched tolerance.

5pt

A controlled quality knob isolates the same axis without changing the model: at each step a synthetic EMS drafter takes the oracle/fallback action with probability \(q\) and a random feasible action otherwise, sweeping \(q\) from random (\(0\)) to near-oracle (\(1\)) with the trusted core (boundary, verifier, \(\tau\), \(K\), fallback) frozen at its deployment setting; \(q{=}1\) reads a precomputed oracle trajectory and serves as the controlled upper-bound endpoint. As proposal quality rises, call reduction increases monotonically (\(24\%\!\to\!90\%\), Spearman \(\rho{=}1.0\)) and mean regret decreases monotonically (\(0.031\!\to\!0.002\)), at zero applied violations throughout (Table 14): certified throughput tracks proposal quality directly, consistent with parameter count being non-predictive across the six-LLM suite (\(\rho{=}{-}0.058\)).

6pt

17 UC Second-Instance Replication↩︎

This section reports the second unit-commitment instance referenced in Section 3.5: \(100\) generators, demand-peak fraction \(0.66\), \(48\)-step horizon, hold-commitment drafter, and a certificate-aware value boundary trained on this instance (\(40\) training episodes; \(50\) evaluation episodes on held-out seeds, \(\tau{=}0.04\)). Every episode is faster than stepwise fallback, and the trusted oracle accounts for \(99.99\%\) of online time.

5pt

18 Certificate Audit Components↩︎

This section reports the audit quantities used in Sections 3.3 and 3.5. The ledger counts accepted steps separately from error-charged accepted segments.

3pt

3pt

19 LLM Proposal Protocol↩︎

This section records the proposal protocol used by the frozen LLMs. The prompt template, parser, and deterministic decoding settings are shared across models; the verifier and fallback contract remain unchanged across proposal sources.

19.0.0.1 EMS action proposal.

The EMS prompt presents the current hour, the battery state of charge, the running peak import, the allowed discrete action set, the battery and grid feasibility limits, and the \(K\)-step load/PV/price forecast, and asks for one discrete battery action per hour (positive discharges, negative charges), returned as a JSON list of \(K\) actions drawn from the allowed set.

19.0.0.2 UC commitment-change proposal.

The UC prompt presents the current commitment vector, the per-generator minimum and maximum output, the marginal costs, the units currently locked on or off by minimum up/down times, and the \(K\)-step demand forecast, and asks — for each of the next \(K\) steps — for the set of generators to toggle relative to the previous step, returned as a JSON list of \(K\) index sets. It requests the smallest commitment change that keeps each step’s committed capacity able to meet demand without toggling locked units.

4pt

20 UC Timing Breakdown↩︎

This section reports the per-decision timing breakdown referenced in Section 3.5. The trusted MILP oracle dominates online time; drafting, verification, and boundary inference together consume at most \(2.04\%\) of per-decision time (Table 19). For the warm-start comparison referenced in Section 3.5, warm-starting the MILP with the same proposal (instead of skipping it) reaches only \(0.91\times\) end-to-end speedup on the same \(n{=}50\) UC run set: it still pays the full per-step solve, so warm-starting cannot substitute for skipping the oracle.

4pt

21 Verifier-Error Robustness↩︎

This section reports the verifier-robustness sweep referenced in Section 3.2 (EMS, \(n{=}100\), \(\tau{=}0.04\)). The verifier screens prefixes against a next-state estimate corrupted by bounded uniform noise (a fraction of the state range), while the executed trajectory uses the true dynamics; applied violations are measured on the true trajectory. Across the full noise range, no corrupted prefix is ever admitted (false-accept count zero at every level): violations stay at zero and the verifier instead defers more, so error is absorbed as reduced amortization rather than reduced safety.

4pt

22 White-Box Adaptive Adversary↩︎

We stress the proposal slot with white-box adaptive adversaries that re-plan at every decision with full knowledge of the verifier, value boundary, dynamics, stage cost, and fallback oracle; they may craft any proposal but cannot modify the trusted core. One adversary maximizes true constraint-violation severity; a second maximizes the realized cost of accepted prefixes. Both are evaluated on EMS (\(n{=}100\)) and deployment-scale UC (\(n{=}50\)) under the same boundary, exact verifier, and fallback as the main runs.

The violation-maximizing adversary drives raw (un-wrapped) execution to a constraint breach in every episode on both domains (Direct), yet CGPA admits none (Table 21): it defers at every step, so amortization collapses to the trusted oracle floor (call reduction \(0\)) while applied violations stay at zero. A cost-maximizing adversary that keeps proposals feasible likewise causes zero applied violations. An adversary can erase CGPA’s amortization but cannot breach its safety, because the feasibility gate never queries the value boundary the adversary attacks.

22.0.0.1 Cost degrades with attack strength; safety does not.

The cost-maximizing adversaries refine this picture. On UC a cost-budgeted adversary — bounded to local cost envelopes — leaves the regret certificate fully covered (coverage \(1.0\)) and, within this adversary harness, attains both lower regret and higher call reduction than the hold heuristic (\(0.014\) vs \(0.026\) mean regret, \(98\%\) vs \(93\%\) call reduction; paired \(95\%\) CIs exclude zero), while an unbounded cost-maximizer exhausts the nominal envelope (coverage \(0\)) at still-zero violations. On EMS the bounded adversary matches the forecast drafter’s own envelope (matching its regret) at zero violations. Across attack strengths, applied violations never leave zero. An adversary buys reduced amortization or paid regret, never an unsafe transition.

22.0.0.2 A learned adversary fares no better.

We also train a learned white-box attacker — an MLP that optimizes feasible high-cost prefixes directly against the frozen contract (\(n{=}100\)) — in place of the hand-crafted search. Its feasible (un-wrapped) mean regret reaches \(0.570\), the highest of any feasible proposal source we evaluate and above the forecast drafter (\(0.439\)). The same frozen contract still holds it to zero applied violations at certificate coverage \(0.99\) and mean/p95 regret \(0.014/0.022\), as the value guard defers its aggressive prefixes (call reduction \(33\%\)). A learned attacker can raise feasible cost but cannot convert proposal control into an unsafe transition.

23 Out-of-Distribution Day Expansion and Win Rate Against the Stepwise Oracle↩︎

This section reports the day-level statistics behind the distribution-shift result of Section 3.3 (\(18\) held-out calendar-shifted days \(\times\) \(5\) learned-drafter seeds, \(90\) paired day–seed runs). A win counts a run whose total cost is below the stepwise oracle reference on the same day. Mean regret is \(-0.137\) \([-0.166,-0.110]\) for the learned source and \(-0.082\) \([-0.121,-0.044]\) for the forecast source; the in-distribution learned-guard win rate is \(0.50\).

4pt

24 Full Proofs↩︎

This section expands the proof sketches of the main paper. Statement numbering refers to the main paper; \(V=V^{\pi_F}\) is the oracle cost-to-go with terminal value \(V(s_T)=0\), so \(V(s_0)=J_F(s_0)\) by definition.

24.0.0.1 Lemma 1 (Per-segment value decomposition).

An accepted segment \(i\) is admitted by the exact guard only if \(g_i + V(s_{i+1}) \le V(s_i) + \tau_i|V(s_i)|\); rearranging gives \(g_i \le V(s_i)-V(s_{i+1})+\tau_i|V(s_i)|\). For a repair segment \(j\), define the realized repair slack \(\rho_j := \max\{0,\, f_j + V(s_{j+1}) - V(s_j)\} \ge 0\); then \(f_j \le V(s_j)-V(s_{j+1})+\rho_j\) holds by construction. If the repair applies \(\pi_F\) with the same remaining horizon, the Bellman recursion \(V(s_j)=f_j+V(s_{j+1})\) gives \(\rho_j=0\). \(\square\)

24.0.0.2 Certificate 1 (Exact-boundary bound).

The rollout partitions into consecutive segments whose end state is the next start state: \(s_0=z_0,z_1,\dots,z_M=s_T\). Summing the Lemma 1 inequalities over all segments, \[\begin{align} J_{\mathrm{CGPA}}(s_0)&=\sum_{i\in\mathcal{A}} g_i+\sum_{j\in\mathcal{R}} f_j\\ &\le \sum_{m=0}^{M-1}\bigl(V(z_m)-V(z_{m+1})\bigr)\\ &\quad +\sum_{i\in\mathcal{A}}\tau_i|V(s_i)|+\sum_{j\in\mathcal{R}}\rho_j . \end{align}\] The first sum telescopes to \(V(s_0)-V(s_T)=V(s_0)=J_F(s_0)\). Subtracting \(J_F(s_0)\) yields the bound; dividing by \(\max(|J_F(s_0)|,10^{-12})\) recovers the normalized regret of Eq. (2). \(\square\)

24.0.0.3 Certificate 2 (Approximate-boundary bound).

An accepted segment satisfies the deployed rule \(g_i+\hat{V}(s_{i+1})\le \hat{V}(s_i)+\tau_i|\hat{V}(s_i)|\), so \(g_i \le \hat{V}(s_i)-\hat{V}(s_{i+1})+\tau_i|\hat{V}(s_i)|\). Assumption 2 at the two endpoints gives \(\hat{V}(s_i)\le V(s_i)+\epsilon\), \(-\hat{V}(s_{i+1})\le -V(s_{i+1})+\epsilon\), and \(|\hat{V}(s_i)|\le |V(s_i)|+\epsilon\), hence \[\begin{align} g_i &\le V(s_i)-V(s_{i+1})+\tau_i|V(s_i)|+(2+\tau_i)\epsilon\\ &\le V(s_i)-V(s_{i+1})+\tau_i|V(s_i)|+(2+\tau_{\max})\epsilon . \end{align}\] Repair segments are unchanged from Lemma 1, and the telescoping argument of Certificate 1 applies verbatim; the boundary error enters once per accepted segment, contributing \((2+\tau_{\max})\epsilon|\mathcal{A}|\) in total. \(\square\)

24.0.0.4 Proposition 4 (Conformal forward regret bound).

A rollout has at most \(T{+}1\) segment-boundary states. Split-conformal validity under the stated exchangeability gives, for each boundary state \(s\), \(\Pr[\,|\hat{V}_{0.5}(s)-V(s)|\le\epsilon(s)\,]\ge 1-\delta/(T{+}1)\) when the multiplier \(\alpha\) is the conformal quantile of the calibration scores at miscoverage \(\delta/(T{+}1)\). A union bound over the boundary states makes the inequalities hold jointly with probability at least \(1-\delta\). On this event, the Certificate 2 substitution applies with the endpoint-specific bands: \[\begin{align} g_i &\le V(s_i)-V(s_{i+1})+\tau_i|V(s_i)|\\ &\quad +(1+\tau_i)\epsilon(s_i)+\epsilon(s_{i+1})\\ &\le V(s_i)-V(s_{i+1})+\tau_i|V(s_i)|+(2+\tau_{\max})\bar\epsilon_i , \end{align}\] with \(\bar\epsilon_i=\max\{\epsilon(s_i),\epsilon(s_{i+1})\}\). Summing and telescoping as in Certificate 1 completes the proof. \(\square\)

25 Non-Learned Value Boundaries and Unguarded Shields↩︎

This section reports the baseline-boundary comparison referenced in Section 3.3, run on a common \(n{=}100\) EMS episode draw across the four boundaries (\(\tau{=}0.04\)). The unguarded shield executes the verified proposal at every draft length and pays its full regret — the executed trajectories are identical across \(K\in\{1,2,4,8\}\), so the result is insensitive to draft length. The learned boundary answers per-state queries in milliseconds without online construction.

1pt

26 Conceptual Positioning↩︎

Table 24 positions CGPA against the neighbouring lines of work discussed in the main paper’s Related Work. CGPA is closest to speculative decoding in invocation pattern and to safety filters in the trusted-runtime contract, but its accepted object is a verified multi-step control prefix gated by a value boundary, and the proposal source is arbitrary.

3pt

References↩︎