The safe step that loses the mission

Long-horizon systems are often governed by a stack of local checks. A tool call must be authorised. A vehicle must not cross a geometric boundary. A payment must stay below a limit. A model may abstain when its confidence is low. Each check is useful, but none answers the question raised by Aster-9: after this step, does an acceptable continuation still exist?

The distinction is easy to miss because local safety and long-run feasibility coincide in simple environments. If a machine can stop instantly, recharge anywhere and undo every commitment, avoiding immediate hazards may be enough. Real missions have momentum, deadlines, scarce resources, partial observability and irreversible effects. Under those conditions, a step can be harmless now and fatal to the plan later.

The hidden assumption inside local assurance

A local checker quietly assumes that future feasibility composes from safe steps: if every action is safe when taken, the whole path will be safe and successful. That implication fails whenever constraints are path-dependent. Fuel spent now changes reachable states later. A delayed approval consumes deadline slack. A reversible draft can become an irreversible submission after another service acts on it. A tool call can create a commitment that is absent from the physical state but binding on the mission.

Control theory has several precise ways to expose this failure. Viability asks from which states there exists a control that can keep the system inside a constraint set. Model predictive control repeatedly plans over a horizon, but its strongest forms also require recursive feasibility, often through a terminal condition that places the future state inside a controlled invariant set. Runtime-assurance architectures separate a high-performance controller from a simpler enforcement path that can keep or return the system to safety.[2][5][8]

These ideas share a practical insight: the current state is acceptable only when some admissible future remains available from it. This paper extends that insight from physical safety to mission-level autonomy, where the state must include not only position and velocity but also obligations, authority, evidence freshness, resource commitments and verified effects.

flowchart TD
  A["The scan that leaves no way home"] --> B["The safe step that loses the<br/>mission"]
  B --> C["The envelope is a set of<br/>continuations"]
  C --> D["Score paths without bargaining<br/>with hard limits"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#5B5CF6,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

The envelope is a set of continuations

Imagine drawing every plausible future from the current state. Some futures hit an obstacle. Others remain physically safe but miss a deadline. Some finish the task but consume the reserve needed for a safe halt. Others are technically possible only because the model used stale evidence or assumed a permission that expires midway. Remove those trajectories. The paths that remain form the envelope.

A path envelope is not one approved plan. It is the set of presently acceptable continuations under a declared model, disturbance range, mission contract and assurance mode. Keeping several paths matters because the world will change. If the system commits to one brittle optimum, a small mutation can turn a good plan into no plan. A wider envelope provides options; a narrow envelope signals that intervention is becoming urgent.

From a picture to a precise object

Let x_t be the complete governed state at time t. It includes physical or digital world state, remaining resources, completed obligations, open commitments, authority and evidence ages. Let u_t be a candidate action. A horizon-H trajectory is the sequence of states and actions generated from now to t + H.

Let Φ be the mission contract. It may say “always keep separation above 20 metres”, “visit checkpoint B before minute 12”, “never use personal data after consent expires”, and “finish in a state from which safe hold is available”. Temporal-logic research provides quantitative robustness values that indicate not only whether a trace satisfies a specification but how far it lies from violation, subject to the semantics chosen.[3]

Here M_t is the declared family of models, W_t is the disturbance set, and ρ_Φ is the robustness of the full mission contract. A positive value means the trajectory satisfies the contract with some slack; a negative value means violation. V_t+H is a terminal viability or recovery set. The infimum asks for the worst result across the models and disturbances that the assurance case claims to cover.

The equation is valid only when those sets and dynamics are meaningful. If the model family omits the relevant failure, or the state omits a hidden commitment, the apparent envelope may be fiction. Removing the worst-case assumption changes the statement. A chance-constrained envelope may instead require that violation probability remain below ε. A heuristic envelope may sample scenarios and report no formal coverage at all. The assurance mode is part of the result, not a footnote.

The recursive envelope condition

Membership of a planned trajectory is not enough. Mission control releases only its first action, observes what actually happened, and must still have something acceptable to do next. This gives a one-step condition: for every successor state covered by the assurance claim, the next envelope must remain non-empty. In words, the action is admissible only if all covered ways it can turn out leave at least one governed continuation.

This condition exposes why a long, impressive plan can still be weak assurance. The plan may pass only along its nominal branch. A small actuation error, delayed reply or tool-side effect can move the system to a successor from which the plan has no repair. The condition also explains why mission control should re-score after every verified effect. The state used to prove the earlier continuation has changed.

Three assurance modes that must not be blurred

A robust envelope admits a path only if every disturbance and model in the declared set preserves the contract. This is strongest, but only relative to that set. A chance-constrained envelope admits paths whose estimated probability of violation is below a specified limit. It needs a credible probability model and explicit treatment of tail dependence. A scenario envelope checks a finite set of sampled futures. It can be practical in high-dimensional systems, but a pass means only that no sampled counterexample was found.

Expected-cost constraints occupy a different category. Constrained policy optimisation can bound expected cumulative costs under its assumptions, which is valuable for learning a policy.[4] Yet an expectation can hide a rare catastrophic path. The distinction is not an argument against expected optimisation. It is a rule for matching evidence to the decision. Hard invariants need per-path or appropriately risk-bounded treatment; average performance can rank what remains.

Score paths without bargaining with hard limits

Once an envelope exists, the system still needs to choose among its paths. This is where many designs reverse the correct order. They combine safety, deadline, cost and reward into one weighted objective, then choose the highest score. A large mission reward can compensate numerically for a small invariant breach. The optimiser has followed the equation and violated the design intent.

Hard admissibility must be a gate; soft value may rank only the paths that pass. This is the same separation that makes a typed action boundary useful. A path is first classified as admissible, indeterminate or rejected. Only the admissible set enters optimisation. Indeterminate paths may be held for more evidence. Rejected paths are not rescued by a high reward.

A small trajectory score

Consider three Aster-9 candidates. Direct reaches most of the inspection goal and retains positive slack in all declared scenarios. Sweep gathers more data, but its delayed branch misses the return reserve. Hold makes little progress but preserves a wide recovery margin. The numbers below are synthetic and scaled to make the logic visible.

Suppose the soft score gives 45% weight to progress, 25% to normalised invariant slack, 20% to recovery margin and subtracts 10% for cost. Sweep might still receive the highest raw score because its progress dominates. The gate removes it before ranking. Direct then wins normal operation; Hold remains the fallback.

The coefficients are not universal. They encode an operational preference among paths already deemed acceptable. The important invariant is architectural: the optimisation score cannot alter membership in the envelope.

Envelope quality is not just path count

Two envelopes can each contain four paths and offer very different resilience. Four routes that all depend on the same charger, permission service or weather forecast can disappear together. Four routes with independent recovery resources are harder to erase with one mutation. Mission control should therefore record at least four properties: minimum contract slack, minimum recovery margin, diversity of critical dependencies, and the time until the evidence supporting each path expires.

Dependency diversity is especially important for agentic systems. Asking two models to produce different plans does not create two independent paths when both use the same stale record, the same compromised tool or the same unauthorised context. The envelope should be grouped by causal dependency, not by textual difference. A useful stress test removes one shared dependency at a time and measures how many admitted continuations survive.

This yields a testable prediction. Systems that trigger intervention on dependency-adjusted envelope loss should recover from common-cause faults more often than systems that watch only the best path’s score. Evidence would strengthen the proposal if this advantage persists across held-out fault families and at comparable mission cost. It would weaken it if simple local filters with a safe terminal controller perform equally well, or if estimating dependency structure creates more false interventions than useful warning.

Recovery margin is more than distance from danger

Invariant slack measures how far a trajectory stays from a limit. Recovery margin asks a different question: after disturbances or partial execution, how much capacity remains to reach a governed fallback? A robot may be far from an obstacle but lack braking distance. A software agent may be within a spending limit but unable to compensate an already submitted transaction. A workflow may meet its current deadline but have no time left for independent verification.

A useful recovery metric is task-specific. For the rover it can be remaining energy minus the worst covered energy to a charger and the required reserve. For a data operation it may be the number of uncompensated irreversible effects. For an agentic workflow it may combine time to revoke capabilities, pending tool outcomes and freshness of the readback. The metric should be interpretable in the system’s own causal terms.

Predictive safety filters make this logic explicit by checking whether proposed inputs can lead to future violations and by using terminal conditions or recovery mechanisms. Their guarantees depend on model assumptions, and small modelling errors can matter.[9] Resource-constrained shielding likewise restricts actions so that resource exhaustion is avoided while a goal remains reachable, including under partial observability in specialised models.[11]

What should make the scorer distrust itself?

The score should carry defeaters. A world-state update outside the model family, a stale observation, a permission change, a mismatch between predicted and observed effects, or a widening residual error should shrink the certified envelope. If the remaining paths depend on unverified assumptions, the status becomes indeterminate rather than pass.

This is where path envelopes meet long-horizon mission control. The scorer is not a one-time planner. It is a repeated claim about what remains possible. Every executed action, tool receipt and readback updates the state. The system recomputes, compares the new envelope with the old one, and records why paths entered or left.

stateDiagram-v2
  [*] --> Claim
  state "The last safe turn" as Claim
  state "The hidden assumption inside<br/>local assurance" as Test
  state "Two routes, one harmless action" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Mission control is a runtime institution

A trajectory scorer becomes trustworthy only when embedded in a governed execution loop. The model may propose paths, but it should not define its own invariants, decide which evidence is fresh, grant its own authority and mark its own effects as complete. Those responsibilities require separate components and receipts.

The smallest useful architecture has seven roles. A proposal engine generates candidate trajectories. An operational twin predicts state transitions and carries mission state. A contract evaluator tests invariants and time-bound obligations. A recovery evaluator checks terminal viability and fallback reachability. An authority kernel verifies that the candidate’s actions remain permitted. A deterministic selector chooses among admitted paths and emits a typed action. Finally, effect receipts and independent readback update the twin.

The envelope is calculated over a governed state, and only the authority kernel can release its first action. This preserves a clean distinction between model proposal, world state, permitted context, authority, typed action, evidence and verified outcome.

A realistic configured-system example

Aster-9’s mission contract contains five hard clauses: maintain separation, keep thermal load below its limit, preserve a propellant reserve, avoid the shadow region after a communication deadline, and retain a route to a certified holding orbit. It also contains two obligations: inspect three sectors and deliver a signed evidence package before the coordination window closes.

The planner proposes twelve trajectories over an eight-step horizon. The operational twin evaluates three disturbance families: nominal, delayed communication and degraded thrust efficiency. The contract evaluator removes four paths for separation or deadline failure. The recovery evaluator removes three more because their terminal states cannot reach safe hold with reserve. The authority kernel removes one because its data-capture permission expires before the planned scan. Four trajectories remain. Direct has the highest soft score; Hold is reserved as fallback.

After the first action, the effect receipt reports a longer burn than predicted. The twin updates propellant and the residual model. Direct still passes, but its recovery margin has halved. The envelope-width trigger asks the planner for fresh alternatives and lowers the maximum autonomous horizon from two actions to one. This is not an emergency stop. It is mission control responding to loss of options while options still exist.

function evaluateTrajectory(candidate, config) {
  const covered = candidate.scenarios.map(s => adjust(s, candidate, config));
  const violating = covered.filter(s =>
    s.invariant < 0 || s.recovery < config.recoveryFloor || s.deadline < 0
  );
  const violationProbability = violating.reduce((sum, s) => sum + s.p, 0);

  const evidenceValid = candidate.evidenceValid || candidate.name === "Hold";
  const permissionValid = candidate.permissionValid || candidate.name === "Hold";
  const terminalKnown = config.horizon >= candidate.requiredHorizon || candidate.terminalCertified;

  let gate;
  if (!evidenceValid || !terminalKnown) gate = "HOLD";
  else if (!permissionValid) gate = "REJECT";
  else if (config.mode === "robust") gate = violating.length ? "REJECT" : "ACCEPT";
  else if (config.mode === "chance") gate = violationProbability <= config.riskLimit ? "ACCEPT" : "REJECT";
  else gate = violating.filter(s => s.sampled).length ? "REJECT" : "ACCEPT";

  const worstInvariant = Math.min(...covered.map(s => s.invariant));
  const worstRecovery = Math.min(...covered.map(s => s.recovery));
  const score = 0.45 * candidate.progress
              + 0.25 * normalise(worstInvariant)
              + 0.20 * normalise(worstRecovery)
              - 0.10 * candidate.cost;

  return { gate, score, worstInvariant, worstRecovery, violationProbability };
}

The strongest alternative

A well-designed short-horizon safety filter with a verified invariant terminal set may already provide everything needed for a low-dimensional physical controller. In that setting, adding mission-level scoring could duplicate control logic and increase failure surface. A policy trained under constraints may also make unsafe proposals rare, reducing intervention frequency.

The path-envelope approach earns its cost when mission failure can occur without immediate platform danger, when obligations and authority evolve, when resources create points of no return, or when a configured agent spans several tools and systems. Even there, full reachability can be computationally prohibitive. Viability methods often trade online speed for offline computation, and high-dimensional models require decomposition, conservative approximations or sampled futures.[5]

Recent mission-level runtime-assurance and probabilistic monitoring work moves in this direction by checking successor feasibility or predicting unsafe states before violation, including for autonomous driving and language-model agents.[12][13] These are recent and domain-specific studies, not settled evidence for general agent systems. Their value here is as evidence that the problem is becoming explicit. The open research question is whether a typed, recovery-aware path envelope can outperform local filters across several domains without becoming too conservative or too expensive.