1 Introduction↩︎

Intelligent industrial systems increasingly combine autonomous robots, industrial cyber-physical infrastructure, digital-twin state models, and artificial-intelligence modules that can perceive, reason, plan, and act in dynamic environments. Smart factories, automated logistics, remote construction, infrastructure inspection, and field maintenance all require multiple robots to coordinate over long horizons while task readiness, robot availability, resource ownership, and operational constraints evolve during execution [1]–[3]. In this setting, the central challenge is not only to generate a task allocation or a plan. The system must govern which agentic proposals are allowed to become committed mission state.

This governance problem has become more important as language-model, optimization, and heuristic modules are increasingly used as proposal sources for embodied agents. Such modules can decompose tasks, suggest assignments, explain failures, or propose repairs [4]–[8]. Yet an industrial robot team cannot safely treat every generated proposal as executable. A plausible assignment may violate a workstation mutex, residual-energy bound, precedence relation, spatial access condition, temporary protective hold, or already committed robot trace. Agentic AI for industrial systems therefore needs a mission-state layer that separates proposal generation from verified commitment.

Existing multi-robot allocation, symbolic planning, behavior-tree, and feedback-driven execution methods address important parts of this problem, but they rarely maintain persistent task hierarchy, online execution commitments, temporary operational constraints, cross-branch execution couplings, and repair boundaries as synchronized state records. Static task graphs can starve the executable frontier when delayed observations expose new work. Flat blackboard memories can record events without governing which updates remain consistent. Global replanning can recover feasibility, but may rewrite protected work outside the affected region. These limitations motivate a representation in which persistent hierarchy, transient industrial constraints, and verified execution commitments are governed together.

This paper proposes a verification-gated agentic mission-state governance framework for intelligent industrial multi-robot systems. The framework maintains an evolving task forest and a governed blackboard as two canonical state objects. It derives an execution coupling topology from their current snapshot to expose precedence, flow, resource, spatial, synchronization, and protective couplings without storing a third persistent state. Agentic, heuristic, or optimization modules may submit typed proposals, but assignments, deferrals, repairs, diagnostics, and constraint updates are committed only after deterministic verification and atomic state update. Disturbances are localized by hard-edge closure over the affected execution neighborhood.

The main contributions are:

• Agentic mission-state governance: a runtime layer that allows autonomous proposal generation while protecting industrial multi-robot mission state through deterministic verification and atomic commit.

• Task-forest blackboard representation: a two-object state model that separates persistent task hierarchy from online robot traces, resource locks, world beliefs, verification records, and scene-temporary constraints.

• Coupling-aware bounded repair: a derived execution coupling topology that restricts repair to the hard-coupled affected neighborhood while preserving protected work outside that scope.

• Industrial validation and stress testing: evaluation in an indoor factory scenario, 30-seed remote-construction benchmarks, structural ablations, and scale probes under modeled mission predicates.

2 Related Work↩︎

2.1 Task-Structured Long-Horizon Multi-Robot Execution↩︎

Long-horizon multi-robot autonomy requires task allocation, scheduling, path feasibility, and execution monitoring to be considered jointly. Classical and recent MRTA methods provide mature assignment tools under capability, time, energy, and coordination constraints [1], [2]. Recent studies further incorporate long-duration factors such as limited endurance, recharge, task relaying, coalition execution, dense-workspace coupling, and task-and-motion feasibility [3], [9], [10]. These methods show that mission performance depends on more than one-shot robot-task matching.

Symbolic and hierarchical planning provide a complementary reference point for long-sequence reasoning. PDDL/PDDL2.1, heuristic-search planners, HTN planners, and robotic planning infrastructures such as ROSPlan encode preconditions, effects, temporal constraints, resources, and decomposition knowledge in explicit models [11]–[15]. They are highly relevant to long-horizon execution, but they typically assume that the maintained domain model, current task instance, execution state, and update record are already consistent. Our work targets this runtime-maintenance problem: how to keep an evolving task hierarchy, temporary operational constraints, resource locks, committed traces, verification records, and repair boundaries synchronized during execution.

2.2 LLM-Assisted Multi-Robot Planning and Verifiable Proposals↩︎

LLMs and multimodal foundation models have recently been used for task interpretation, decomposition, grounding, and high-level robot coordination [4], [7], [16], [17]. Broader embodied-AI surveys organize this evolution around perception, decision, and execution modules, reinforcing the need to distinguish proposal generation from executable behavior in deployed robots [18]. Situated systems constrain language reasoning through available APIs, 3D value maps, scene graphs, path planners, precondition checks, or iterative feedback [5], [6], [19]. Multi-robot systems such as SMART-LLM, DART-LLM, COHERENT, LiP-LLM, and EmboTeam are especially close to our setting because they motivate task decomposition, dependency extraction, coalition formation, proposal–feedback execution, and planner or behavior-tree integration [8], [20]–[23].

These systems indicate the value of foundation models for semantic decomposition and high-level coordination, but they also show why generated plans should not be committed directly. PlanBench demonstrates that strong LLMs can still fail at systematic planning and reasoning about change [24]; practical robot systems therefore add affordance grounding, precondition checking, simulator feedback, geometric feasibility filtering, or planner interfaces [4], [6], [10], [19]. In multi-robot execution, a semantically plausible proposal may violate capability, residual energy, temporal order, resource exclusivity, safety boundaries, or already committed mission constraints. Recent surveys likewise identify hallucination, latency, scalability, and real-world adaptability as deployment risks for LLM-based multi-robot systems [25]. We therefore treat LLM or VLM reasoning as a proposal source rather than an authority: candidate repairs, diagnostic branches, and temporary constraints must pass deterministic mission-state verification before they become committed state.

2.3 Feedback, Contingency Handling, and Local Repair↩︎

Feedback-driven planning and online repair are necessary because delays, partial failures, blocked traversal, energy shortage, and resource conflicts can invalidate an initially feasible branch. SayPlan and COHERENT use feedback to refine plans or coordinate execution [6], [21], long-endurance MRTA methods incorporate online repair under dynamic conditions [3], and EmboTeam uses a shared state mechanism to coordinate embodied multi-robot collaboration [23]. Classical blackboard architectures provide a broader precedent for coordinating heterogeneous reasoning sources through shared problem-solving state and control [26], [27].

The remaining gap is not simply whether feedback exists, but how feedback changes are governed. Existing feedback loops or blackboard-like memories often serve as communication logs, state caches, or plan-adjustment buffers. They do not necessarily couple persistent task hierarchy, online commitments, temporary operational constraints, derived cross-branch dependencies, and verified repair boundaries. Without this separation, a repair module may update local assignments without updating the task structure, or a graph update may ignore active resource locks, completed segments, protective holds, or committed traces. Our framework makes this coupling explicit by separating persistent hierarchy, governed blackboard records, derived ECT snapshots, and verifier-gated commits.

2.4 Runtime Governance and Reconfiguration of Large Autonomous Systems↩︎

The proposed framework also connects to systems-engineering work on runtime governance, supervisory control, runtime assurance, and model-based system representation. Supervisory control for discrete-event systems frames control as restricting behavior to satisfy modeled constraints [28]. Model-based systems engineering emphasizes explicit system models, interfaces, requirements, and cross-view consistency [29]. Runtime-assurance architectures separate advanced decision components from an assurance layer that can restrict unsafe decisions when modeled constraints are at risk [30].

These ideas motivate explicit models and verification gates, but they do not by themselves specify how a long-horizon multi-robot mission should maintain an evolving task hierarchy, temporary constraints, resource locks, committed traces, derived execution coupling, and disturbance-localized repair in one execution loop. We adapt this systems perspective to mission-state governance. The forest maintains persistent mission structure, the governed blackboard maintains online records and temporary constraints, and the derived ECT exposes the current coupling surface used for deterministic verification and bounded reconfiguration.

3 Proposed Framework↩︎

3.1 Problem Setup and Mission-State Governance↩︎

We consider a heterogeneous robot team \[\mathcal{M}=\{r_1,\ldots,r_N\}\] executing a long-horizon mission initialized from a high-level task description \(\mathcal{T}^{0}\) and a partial world state \(\mathcal{X}_0\). During execution, robots acquire observations, complete or fail assigned work, occupy and release resources, and encounter scene-dependent operational constraints. The goal is not to compute a static optimal plan at deployment time; it is to maintain a high-level mission state that remains executable, verifiable, and locally repairable as these conditions evolve.

At decision epoch \(t\), the governance layer observes \[\mathcal{S}_t = (\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t,\Pi_t,\mathcal{U}_t), \label{eq:system95state}\tag{1}\] where \(\mathcal{F}_t\) is the evolving task forest, \(\mathcal{B}_t\) is the governed blackboard, \(\mathcal{G}_t\) is the derived ECT, \(\Pi_t\) is the candidate proposal set, and \(\mathcal{U}_t\) is the exposed execution-unit set. Only \(\mathcal{F}_t\) and \(\mathcal{B}_t\) are canonical maintained state objects; \(\mathcal{G}_t\) is recomputed from their current snapshot.

The framework maintains a modeled consistency invariant \[I(\mathcal{F}_t,\mathcal{B}_t)=1, \label{eq:state95invariant}\tag{2}\] covering dependency consistency, robot-capability feasibility, residual energy, temporal consistency, resource exclusivity, temporary constraints, and repair-boundary preservation. These predicates are high-level mission-state checks. The framework assumes that lower-level perception, motion planning, localization, and control modules provide conservative feasibility and execution-feedback records to the blackboard; it does not replace continuous collision avoidance, controller-level safety, or physical verification of task success.

Fig. 1 summarizes the framework as four layers: mission inputs and feedback, canonical mission state, derived coupling view, and governed transition. The remainder of this section follows the three technical pillars of the method: the two canonical state objects, the derived ECT, and the verification-gated transition and repair mechanism. Detailed state fields, verifier predicates, and the benchmark assignment cost are provided in Appendix 7.

3.2 Canonical Mission State: Task Forest and Governed Blackboard↩︎

The canonical state representation separates persistent mission structure from online execution records. The evolving task forest \(\mathcal{F}_t\) stores hierarchical decomposition, node-level contracts, delayed grounding, and repairable substructures. A node may be open, ready, committed, running, blocked, completed, failed, frozen, or abandoned, but these states are governed transitions rather than free planner outputs. In unfamiliar environments, delayed grounding allows task attributes or descendants to remain unresolved until observations make them reliable. The executable frontier is therefore restricted to grounded nodes whose predecessors and resources are feasible: \[\begin{align} \mathcal{V}^{\mathrm{front}}_t = \{\, v\in\mathcal{V}^{\mathrm{exec}}_t \mid\;&g_v(t)=\mathrm{grounded},\\ &\mathrm{Pred}(v,t),\\ &\mathrm{Res}(v,t),\\ &\chi_v(t)=\mathrm{ready}\,\}. \end{align} \label{eq:executable95frontier}\tag{3}\]

The governed blackboard \(\mathcal{B}_t\) stores the online records needed to evaluate this frontier and to commit verified updates: task-state projections, robot states, world belief, resource locks, committed traces, candidate proposals, verification records, and scene-temporary constraints. The blackboard is governed in three senses. It is node-anchored because execution-relevant state is bound to task-forest nodes; write-restricted because heuristic, optimization, rule-based, or semantic modules may write candidates but not committed state; and atomically committed because a verified update changes the forest and blackboard as one synchronized transition.

Scene-temporary constraints remain on the blackboard rather than being embedded permanently into the forest. Candidate constraints may originate from world-belief updates, resource locks, execution feedback, operator input, or semantic/VLM proposals, but only verified-hard constraints can induce hard ECT couplings. Verified-soft constraints affect ranking or costs, protective constraints block risky commitments until resolved, and safety-critical holds are never bypassed by diagnostic trials. A verified proposal induces the canonical state transition \[(\mathcal{F}_{t+1},\mathcal{B}_{t+1}) = \operatorname{Commit}(\mathcal{F}_{t},\mathcal{B}_{t},p), \label{eq:commit95rule}\tag{4}\] after which the ECT is regenerated rather than stored.

3.3 Derived Execution Coupling Topology↩︎

The ECT is a decision-time projection that exposes execution couplings among semantic subtree units. It is derived from the canonical state: \[\mathcal{G}^{\mathrm{ECT}}_t = \Pi_{\mathrm{ECT}}(\mathcal{F}_t,\mathcal{B}_t), \label{eq:ect95projection}\tag{5}\] and represented as \[\mathcal{G}^{\mathrm{ECT}}_t = (\mathcal{U}_t,\mathcal{R}_t). \label{eq:ect95graph}\tag{6}\] The units \(\mathcal{U}_t\) are selected from an exposed antichain of task-forest subtrees, so a branch and its descendant are not simultaneously treated as independent global execution units. This lets the verifier reason at the semantic level needed for the current decision rather than over every primitive action.

The typed edge set \(\mathcal{R}_t\) contains precedence, enabling-flow, resource-mutex, synchronization, spatial-coupling, and soft-preference edges: \[\mathcal{R}_t = \mathcal{R}^{\mathrm{pre}}_t\cup \mathcal{R}^{\mathrm{flow}}_t\cup \mathcal{R}^{\mathrm{mutex}}_t\cup \mathcal{R}^{\mathrm{sync}}_t\cup \mathcal{R}^{\mathrm{spatial}}_t\cup \mathcal{R}^{\mathrm{soft}}_t . \label{eq:ect95edges}\tag{7}\] Hard edges are induced only by persistent node contracts and verified-hard blackboard records. Candidate constraints do not enter the ECT, soft edges do not enter hard repair closure, and protective holds are handled as verifier guards. The absence of a hard ECT edge does not by itself authorize concurrent execution; it only makes two units eligible for parallel commitment, after which blackboard-level verification still checks capabilities, energy, resource locks, traces, spatial access, temporary constraints, and safety boundaries.

3.4 Verification-Gated Commit and Bounded Repair↩︎

The framework treats assignments, deferrals, reorderings, diagnostic actions, repairs, and constraint updates as typed proposals. Proposal generation is intentionally modular: it may use heuristics, optimization, rule-based repair, or language/VLM reasoning. These modules are proposal sources, not execution authorities. A proposal can modify the committed mission state only if it passes deterministic verification: \[\begin{align} \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)= &\;\Omega_{\mathrm{dep}} \wedge\Omega_{\mathrm{cap}} \wedge\Omega_{\mathrm{eng}}\\ &\wedge\Omega_{\mathrm{temp}} \wedge\Omega_{\mathrm{res}} \wedge\Omega_{\mathrm{bd}}. \end{align} \label{eq:proposal95verification}\tag{8}\] The predicate checks forest and ECT dependencies, robot capabilities, residual energy, temporal anchors, resource locks, active verified-hard constraints, safety holds, and repair-boundary consistency. The valid proposal set and selected update are \[\mathcal{P}^{\mathrm{valid}}_t= \{p\in\Pi_t\mid \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)=1\}, \label{eq:valid95proposals}\tag{9}\] \[p^{*}=\arg\min_{p\in\mathcal{P}^{\mathrm{valid}}_t}J(p). \label{eq:selected95proposal}\tag{10}\] If no valid proposal exists during normal execution, the framework makes no new high-level commitment in that decision cycle.

The proof is provided in Appendix 7.4. The proposition is intentionally limited to represented mission-state predicates; it does not claim physical safety, global optimality, or eventual mission completion.

When a disturbance occurs, the repair routine first localizes the affected region instead of globally replanning. Given disturbed forest nodes \(\mathcal{V}^{\mathrm{dist}}_t\), the disturbed units, hard-coupled affected units, and affected subforest are \[\begin{align} \mathcal{U}^{\mathrm{dist}}_t &=\{u_i\in\mathcal{U}_t\mid \operatorname{scope}(u_i)\cap\mathcal{V}^{\mathrm{dist}}_t\neq\emptyset\},\\ \mathcal{U}^{\mathrm{aff}}_t &=\operatorname{cl}_{\mathcal{R}^{\mathrm{hard}}_t} (\mathcal{U}^{\mathrm{dist}}_t),\\ \mathcal{F}^{\mathrm{aff}}_t &=\operatorname{SubtreeClosure}_{\mathcal{F}_t} \{\alpha(u_i)\mid u_i\in\mathcal{U}^{\mathrm{aff}}_t\}. \end{align} \label{eq:affected95subforest}\tag{11}\] Repairs are restricted to \(\mathcal{F}^{\mathrm{aff}}_t\) and its projected blackboard context. Completed work, protected commitments, resource locks, temporal anchors, downstream interfaces, safety-critical holds, and hard-coupled protected boundary units form the boundary context. If no verified repair or restricted fallback is valid, the affected branch is marked blocked or deferred rather than committing an unchecked update.

The proof is provided in Appendix 7.4. This result characterizes locality under the current hard ECT closure and boundary predicate, not a guarantee that every disturbance can be repaired.

4 Experimental Evaluation↩︎

4.1 Experimental Setup↩︎

We evaluate whether verification-gated mission-state governance improves audited progress in intelligent industrial multi-robot systems. The primary industrial validation is an indoor factory scenario with 12 heterogeneous robots, shared workstations, aisle-like resource locks, inspection and rework loops, and cross-tree production dependencies. To test stress behavior beyond the factory topology, we also use remote-construction benchmarks with sparse prior information, delayed grounding, high traversal cost, temporary spatial constraints, and expensive repair. Table 1 summarizes the generated scenarios.

2pt

All methods receive the same mission specification, robot capabilities, energy model, initial task forest, and execution feedback stream. We compare classical allocators, simulator reproductions of DART-DAG and LiP-LP, and two internal variants: flat-BB removes the governed ledger, while global-repair replans over all non-frozen tasks instead of using bounded repair. Non-governed methods submit allocator outputs to a shared baseline loop with coarse dependency, capability, energy, passability, duplicate, and lock checks. This makes completion comparable while auditing invalid commitments, abandoned affected work, lock conflicts, and disruption events. Table 2 summarizes the protocol.

2pt

4.2 Primary Industrial Factory Validation↩︎

Table 3 and Fig. 4 report the primary industrial validation. The factory scenario contains 72 executable nodes organized into replenishment, kitting, assembly, inspection/rework, and shipping. It tests whether the agentic governance layer can maintain safe progress when multiple robots share workstations, lanes, and cross-tree production dependencies.

3pt

In the base factory run, the static graph stalls because delayed grounding and structural repair do not refresh the exposed frontier. Several dependency-aware methods reach full raw completion, but their diagnostic records differ: flat-BB incurs duplicate assignments and lock conflicts, DART-DAG and LiP-LP accumulate invalid-commitment and lock burdens, and global-repair reduces some violations by rewriting committed regions, producing disruption node events. The full framework reaches full raw and safety-audited completion with zero recorded invalid, lock, duplicate, and disruption events in the five-seed factory run. The stress sweep preserves the same qualitative pattern as disturbance and resource contention increase.

4.3 Remote-Construction Stress Comparison↩︎

Table 4 reports the 30-seed Medium/Large remote-construction stress comparison. The full framework maintains high completion with zero invalid commitments, lock violations, duplicate assignments, abandoned executable nodes, and disruption node events in these modeled runs. The relevant comparison is the joint diagnostic profile rather than raw completion alone: equal displayed completion means indicate equal completed-node counts, not equal mission-state quality.

2.3pt

Fig. 5 shows that the proposed governance layer preserves verified progress with near-zero modeled governance violations. Randomized and greedy allocators are not bare random execution; their outputs pass through the shared feasibility audit. The evidence is therefore not strict dominance on every scalar metric, but the ability to maintain audited mission-state consistency while continuing long-horizon execution.

4.4 Ablation, Repair, and Runtime Diagnostics↩︎

Table 5 and Fig. 7 summarize the Medium ablation study. Static graphs stall because hidden executable work is not exposed after obstacle discovery. Removing verification can inflate raw task counts by accepting proposals that should be rejected, so the ablation comparison starts from safety-audited completion and raw diagnostics. Global repair increases disruption events, no structural repair abandons affected downstream nodes, and no verifier admits invalid commitments. The full method is the only variant that combines high audited progress with zero invalid commitments and zero disruption node events.

3pt

The full method is computationally heavier than simple assignment baselines because it maintains the forest–blackboard projection, verifies proposals, refreshes the execution coupling topology, and localizes repair. The runtime table instruments only the full method and identifies dominant internal costs. Times are Python simulation wall-clock times for mission-state decisions and exclude physical execution, low-level motion planning, sensing, and robot control. Verification dominates because the executable frontier increases the number of candidate proposals, while bounded repair remains local when disturbance closures are local.

5 Discussion↩︎

The results support a bounded claim: agentic proposal generation for industrial multi-robot systems benefits from a deterministic mission-state governance layer. The framework does not claim that every scalar metric is universally improved. Instead, it shows that generated assignments, repairs, and constraint updates can be converted into verified state transitions that preserve modeled hard constraints and local repair boundaries.

The analytical guarantees apply only to represented mission-state predicates under a conservative projected state. They do not guarantee optimal allocation, physical collision avoidance, task success under unmodeled low-level failures, or eventual completion under arbitrary disturbances. In deployment, the blackboard would need conservative inputs from localization, sensing, motion planning, controller-safety, and industrial digital-twin modules. Stale or optimistic lower-layer information would invalidate the assumptions behind the verifier.

The experiments expose four recurrent failure mechanisms. Static graphs suffer frontier starvation when delayed or recovery work cannot be grounded. Flat blackboard state and unverified proposals produce unsafe progress through duplicate assignments, stale locks, missing temporary-constraint updates, or invalid commitments. Local reassignment without structural repair abandons downstream nodes when a blocked branch changes preconditions. Global repair can restore feasibility but disturbs protected work outside the affected subforest. These failures correspond directly to removing the evolving hierarchy, governed blackboard, verifier, or bounded repair invariant.

The current implementation remains a high-level mission-state simulator. It does not yet model actuator faults, localization drift, perception false positives, degraded wireless links, or continuous collision avoidance. The safety-audited completion score is diagnostic rather than normative; deployments should report raw violation and disruption counts and tune aggregate penalties to mission risk. Future work should connect the verifier to low-level motion and sensing certificates, study decentralized blackboard substrates, and evaluate controlled access to real industrial data and hardware-in-the-loop experiments.

6 Conclusion↩︎

This paper presented a verification-gated agentic mission-state governance framework for intelligent industrial multi-robot systems. The framework separates persistent task hierarchy from online execution records, derives cross-branch coupling for verification and bounded repair, and admits agentic proposals only through deterministic verification and atomic commit. Factory validation, 30-seed remote-construction stress benchmarks, structural ablations, and scale probes show that this architecture improves verified mission-state progress and reduces invalid or disruptive state transitions under modeled mission predicates. The framework should be viewed as a high-level governance layer for agentic industrial autonomy, with guarantees bounded by represented constraints and lower-layer feasibility information.

7 Formal State and Verifier Details↩︎

This appendix records the formal details that support the condensed method section. They are kept outside the main text to preserve readability, but they specify the state variables, proposal interface, verifier gates, and bounded-repair fallback used in the simulator.

7.1 State Objects and Mission-State Invariant↩︎

The modeled invariant in 2 is decomposed as \[I = I_{\mathrm{dep}}\land I_{\mathrm{cap}}\land I_{\mathrm{eng}}\land I_{\mathrm{temp}}\land I_{\mathrm{res}}\land I_{\mathrm{bd}},\] where the terms respectively check dependency consistency, robot-capability feasibility, residual-energy feasibility, temporal consistency, resource exclusivity, and repair-boundary preservation. These predicates are evaluated over the two canonical state objects below; the ECT is derived from them and is not itself committed state.

The task forest is written as \[\mathcal{F}_t=(\mathcal{V}_t,\mathcal{E}^{\mathrm{h}}_t,\mathcal{E}^{\mathrm{p}}_t,\mathcal{E}^{\mathrm{c}}_t,\chi_t),\] where \(\mathcal{E}^{\mathrm{h}}_t\) stores decomposition edges, \(\mathcal{E}^{\mathrm{p}}_t\) stores precedence or enabling dependencies, \(\mathcal{E}^{\mathrm{c}}_t\) stores declarative mission annotations, and \(\chi_t\) stores node states. A node contract is \[\zeta(v)=(P_v,O_v,R_v,C_v,T_v,Z_v,S_v),\] where the entries denote preconditions, expected outputs, resource requirements, candidate robots or teams, temporal anchors, spatial zones, and compact verification summaries. For grounded executable nodes, task attributes are represented by \(\theta_v=\langle x_v,\kappa_v,W_v,e_v,\rho_v,\phi_v\rangle\).

The governed blackboard is written as \[\mathcal{B}_t=(\mathcal{B}^{\mathrm{task}}_t,\mathcal{B}^{\mathrm{robot}}_t,\mathcal{B}^{\mathrm{world}}_t,\mathcal{B}^{\mathrm{commit}}_t,\mathcal{B}^{\mathrm{prop}}_t,\mathcal{B}^{\mathrm{ver}}_t,\mathcal{B}^{\mathrm{cstr}}_t).\] A scene-temporary constraint record is \[c=\langle\tau,\operatorname{scope},g,\phi,s,q,\eta,\lambda\rangle,\] where \(\tau\) is the constraint type, \(\operatorname{scope}\) is the affected node/resource/robot/zone/unit scope, \(g\) is the activation guard, \(\phi\) is the deterministic check, \(s\) is the source, \(q\) is the status, \(\eta\) stores evidence, and \(\lambda\) stores lifetime or invalidation conditions. Status values include candidate, protective, verified-soft, verified-hard, rejected, and expired.

The blackboard also maintains robot committed traces \[\Gamma_r(t)=(a_{r,1},a_{r,2},\ldots,a_{r,m_r}),\] and node-bound blackboard records \(v\leftrightarrow b_v(t)\) containing readiness, owner, resource reservation, predicted interval, diagnostics, and active constraints. This binding is what lets the verifier test a proposal against both hierarchy-level contracts and online execution commitments.

The antichain execution-unit cut used for the ECT satisfies \[\forall v_i,v_j\in\mathcal{C}^{\mathrm{cut}}_t,\quad v_i\notin\operatorname{Desc}_{\mathcal{F}_t}(v_j),\quad v_j\notin\operatorname{Desc}_{\mathcal{F}_t}(v_i),\] with units \(u_i=\operatorname{Subtree}_{\mathcal{F}_t}(v_i)\) and anchors \(\alpha(u_i)=v_i\). The hard ECT edge set is \[\mathcal{R}^{\mathrm{hard}}_t = \mathcal{R}^{\mathrm{pre}}_t\cup \mathcal{R}^{\mathrm{flow}}_t\cup \mathcal{R}^{\mathrm{mutex}}_t\cup \mathcal{R}^{\mathrm{sync}}_t\cup \mathcal{R}^{\mathrm{spatial}}_t .\] Only verified-hard blackboard constraints can induce hard ECT edges. Candidate constraints remain hypotheses, verified-soft constraints affect ranking or costs, and protective holds are enforced by the verifier rather than promoted into persistent topology.

7.2 Typed Proposals and Verification Gates↩︎

The framework generalizes bids, repairs, deferrals, diagnostic insertions, and constraint updates into a common proposal interface: \[p=\left\langle \alpha, \mathcal{S}, C, \Delta\mathcal{F}, \Delta\mathcal{B}, J \right\rangle,\] where \(\alpha\) is the proposal type, \(\mathcal{S}\subseteq\mathcal{V}_t\) is the affected task-forest scope, \(C\subseteq\mathcal{M}\) is the selected robot or coalition, \(\Delta\mathcal{F}\) and \(\Delta\mathcal{B}\) are the proposed forest and blackboard updates, and \(J\) is the proposal cost. The type belongs to \[\begin{align} \alpha\in \{& \mathrm{assign},\mathrm{defer},\mathrm{swap},\mathrm{insert},\\ &\mathrm{diagnose},\mathrm{relax}, \mathrm{repair},\mathrm{constraint}\}. \end{align}\] Heuristic, optimization, rule-based, LLM, or VLM modules may generate such proposals, but none of them can directly modify \(\mathcal{F}_t\) or \(\mathcal{B}_t\).

3pt

For the construction benchmark, assignment proposals use a risk-aware travel model. For robot \(r\) and task \(v\), \[E_{\mathrm{trav}}^{(r\rightarrow v)}= \eta_r^E\sum_{k\in P^{(r\rightarrow v)}}(\mu_E(x_k)+\beta\sigma_E(x_k))\Delta s,\] \[\Delta t_{\mathrm{trav}}^{C}(v)= \max_{r\in C}\eta_r^T\sum_{k\in P^{(r\rightarrow v)}}(\mu_T(x_k)+\beta\sigma_T(x_k))\Delta s,\] with coalition execution duration \[\tau_v^C= \frac{W_v}{\sum_{r\in C}P_r},\] and assignment cost \[B(C,v)= \sum_{r\in C}E_{\mathrm{trav}}^{(r\rightarrow v)}+\gamma\tau_v^C.\] Coalitions must cover the required capabilities and satisfy the residual-energy bound: \[\begin{align} \kappa_v&\subseteq\bigcup_{r\in C}\kappa_r,\\ E_{\mathrm{trav}}^{(r\rightarrow v)}+e_v^{(r)}+E_{\mathrm{reserve}}^{(r)} &\leq E_r(t),\quad \forall r\in C. \end{align}\]

Atomic commitment is allowed only after verification: \[\begin{align} (\mathcal{F}_{t+1},\mathcal{B}_{t+1}) = \mathrm{Commit}(p,\mathcal{F}_t,\mathcal{B}_t),\\ \text{only if }\quad \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)=1 . \end{align}\] Under the modeled predicates, the intended invariant-preservation relation is \[I(\mathcal{F}_t,\mathcal{B}_t)=1 \land \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)=1 \Rightarrow I(\mathcal{F}_{t+1},\mathcal{B}_{t+1})=1.\] This implication is limited to represented task contracts, blackboard records, ECT couplings, and verifier predicates.

7.3 Repair Boundary, Diagnostics, and Fallback↩︎

For a disturbance \(\epsilon_t\), the implicated forest nodes \(\mathcal{V}^{\mathrm{dist}}_t\) induce disturbed units \[\mathcal{U}^{\mathrm{dist}}_t= \{u_i\in\mathcal{U}_t\mid \operatorname{scope}(u_i)\cap\mathcal{V}^{\mathrm{dist}}_t\neq\emptyset\},\] which are expanded by hard-edge closure: \[\mathcal{U}^{\mathrm{aff}}_t= \operatorname{cl}_{\mathcal{R}^{\mathrm{hard}}_t} (\mathcal{U}^{\mathrm{dist}}_t).\] The affected blackboard context is \[\mathcal{B}^{\mathrm{aff}}_t= \operatorname{Project}(\mathcal{B}_t,\mathcal{F}^{\mathrm{aff}}_t),\] including robot traces, resource locks, temporary constraints, world beliefs, active commitments, and verifier records associated with the affected subforest and its hard boundary.

The boundary context preserved during repair is \[\mathcal{C}^{\mathrm{bd}}_t= \{\mathcal{V}^{\mathrm{done}}, \mathcal{A}^{\mathrm{fixed}}, \mathcal{L}^{\rho}, \mathcal{T}^{\mathrm{anchor}}, \mathcal{I}^{\mathrm{down}}, \mathcal{H}^{\mathrm{safety}}\},\] where the sets denote completed nodes, protected active commitments, resource locks, temporal anchors, downstream interfaces, and safety-critical holds. Temporal anchors require \[t_{\mathrm{int}}^{\mathrm{start}}\geq t_{\mathrm{ext}}+\tau_{\mathrm{ext}}\] for an internal repaired task that depends on a fixed external execution segment. Resource conflicts are detected when mutually exclusive resources overlap in predicted execution intervals: \[\begin{align} \rho_v\cap\rho_u&\neq\emptyset,\\ \max(t_v^{\mathrm{start}},t_u^{\mathrm{start}}) &< \min(t_v^{\mathrm{start}}+\tau_v^C, t_u^{\mathrm{start}}+\tau_u^{C'}). \end{align}\]

Candidate repair proposals are generated only inside the affected subforest: \[\mathcal{P}^{\mathrm{repair}}_t= \operatorname{Repair}(\mathcal{F}^{\mathrm{aff}}_t, \mathcal{B}^{\mathrm{aff}}_t, \mathcal{C}^{\mathrm{bd}}_t),\] with valid set \[\mathcal{P}^{\mathrm{repair,valid}}_t= \{p\in\mathcal{P}^{\mathrm{repair}}_t\mid \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)=1\}.\] If no valid repair exists, deterministic fallback optimization is invoked only within the same affected scope: \[\mathcal{P}^{\mathrm{fb}}_t= \operatorname{FallbackOpt}(\mathcal{F}^{\mathrm{aff}}_t, \mathcal{B}^{\mathrm{aff}}_t, \mathcal{C}^{\mathrm{bd}}_t),\] \[\mathcal{P}^{\mathrm{fb,valid}}_t= \{p\in\mathcal{P}^{\mathrm{fb}}_t\mid \Omega(p,\mathcal{F}_t,\mathcal{B}_t,\mathcal{G}_t)=1\}.\] If this set is empty, the affected branch is marked blocked or deferred instead of committing an unchecked fallback. Non-safety-critical cycles may be handled by expiring stale weak constraints, refining one involved unit, or inserting one bounded diagnostic branch; safety-critical holds are never bypassed.

7.4 Proof Details for the Main Propositions↩︎

References↩︎