When the Governor Cannot Answer

A governor sets how much authority the next action carries, and it has to set it before the action runs. Every governor has states where it returns nothing inside that window. What the enforcement point does in those states is not an operational detail. It is the bound.

The run sets the governor's clock.

An agent proposes an action. The action is about to execute. The governor has until that instant to return a grant, and the instant is fixed by the run, not by a latency target the operator picked. A control that returns its answer after the effect landed produced a description of the action. It did not govern it.

That deadline is real work. The governor is reading how far realized behavior has diverged from the assured trajectory and projecting where the next step is heading. The forward look is the part that takes time, and it is the part that can grant less authority on a step whose present trust reads higher, because it caught a divergence before the outcome landed. A governor that drops the forward look to make its deadline has kept the schedule and given up the reason it was in the path.

So the deadline is not always met. That holds for any control doing real work under a clock the work does not set.

The states where nothing comes back.

There is more than one way for the window to close with no grant in hand.

The forward look can fail to resolve in time. The telemetry the governor reads can stop arriving, leaving it nothing to project from. The governor process can be starved, crashed, or restarting. The path between the enforcement point and the governor can be partitioned while both ends are healthy.

Different causes, one shape. The enforcement point is holding an action, the clock has run out, and there is no grant.

The default was set at build time.

Two systems can match in every part a demo touches and part here. One forwards the held action as the agent proposed it. The other holds it at a grant fixed before the run, one that does not depend on the governor being reachable.

On every day the governor is up, those two builds behave identically. They differ on the day it is not, and that is the day the control exists for. Nobody chooses this at the moment it happens. It was chosen when the enforcement point was written, and often it was not chosen at all, because the branch that forwards the action is the branch that gets written when the case is treated as an error path.

An error path returns control to the caller. A governed path returns the action to the failsafe grant.

Fail open makes the governor a target.

If the absence of a grant means the action runs as written, then the cheapest route past the bound is not through the governor's judgment. It is around its availability. Starve it. Flood it. Partition it. Cut off the telemetry it reads.

An adversary who cannot beat a forward look can beat an availability target, and the second is ordinary work. The same result arrives with no adversary at all. A saturated host and a bad deploy produce the identical outcome, and the outcome is a run of actions that carried whatever authority they asked for. A bound that lifts when the control becomes unreachable has an off switch, and the switch is on the outside.

The failsafe grant does not live in the governor.

Whatever holds when the governor is gone cannot be held by the governor. It sits in the enforcement point, on the path the action takes, in force before anything is asked of anyone.

That grant is not zero on every path. The safe state of a payment is to do nothing. The safe state of a vehicle at speed is not to do nothing, and a control that answers every failure with a full stop has traded one uncontrolled outcome for another. The failsafe grant is graded for that reason. The total hold is reserved for the class of action where doing nothing is the safe state. The reduced but live grant carries the classes where the action has to continue under a bound.

Which class an action falls into is a declaration. It is made in the safety envelope, before the run, by the party accountable for the outcome. It is not a runtime choice, and it is not a value the operator adjusts when the holds get inconvenient. The envelope names the failsafe grant for each class of action the same way it names the bound the governor modulates against.

Then the case that arrives at three in the morning has an answer already in force, and the answer is the one the accountable party wrote down.

What we are building.

Velma is a runtime governor. It sits in the execution path, below the model that decides and before the actuator that commits, and sets how much authority each action carries against a declared safety envelope. It reads how far realized behavior is diverging from the assured trajectory, modulates the authority of the next action to match, and enforces that grant on the only path to the effect, so the system acts only inside what the governor grants. The enforcement point holds the envelope's failsafe grant on its own, so an action taken while the governor is late, starved, or unreachable carries the declared grant rather than whatever it asked for. Each decision it governs is sealed to a tamper-evident record as it happens. The governor is the product. The record is what it emits.