ROOTWEAPON: verifiable autonomy for physical multi-agent systems

Autonomous multi-agent systems in the physical world — from infrastructure inspection to disaster response to defence sensing — are asked to satisfy three requirements that pull against each other. ROOTWEAPON is the strand of the work that takes this seriously as an architecture, not an afterthought.

Autonomy under degraded communication

Agents must keep making sound decisions when the network is intermittent, bandwidth-limited or jammed — without consulting command.

Regulatory auditability

Every consequential decision must be traceable, explainable and verifiable against authorized constraints, aligned with regimes such as the EU AI Act.

Continuous improvement

The fleet must learn from accumulated operational experience without unpredictable behavioural drift that would compromise the first two.

The tension is real: maximising edge autonomy tends to compromise auditability; cloud-centric decision-making compromises autonomy under comms loss; aggressive continual learning compromises both through drift. Addressing one by sacrificing the others is the failure ROOTWEAPON is designed to avoid.

The unifying primitive is a signed capability envelope: a cryptographically verifiable artifact, issued by an operational authority, that travels from command to edge and bounds what an agent may do — and, distinctively, what it may learn. It is close in spirit to attenuated bearer credentials (macaroons) and to runtime "shielding" in safe reinforcement learning, but with three differences.

• ▸It authorizes autonomous physical behaviour over time, with fallback plans for communication loss and budgets that deplete with use — not a single request against a service.
• ▸Its constraints are enforced continuously by the edge runtime itself, under degraded connectivity, rather than checked once at request time.
• ▸It bounds the action space within which policy improvement is permitted, so an auditor can verify not only that an agent was constrained, but by whom and under what authority.

The framework composes five layers, each grounded in a known formal idea and unified by the signed envelope that flows between them:

1. 1A Belief–Desire–Intention substrate extended to handle stochastic sensors with explicit learning boundaries.
2. 2An edge–command computational split: strategic reasoning where it is latency-tolerant, fast deliberation at the edge, with signed artifacts crossing between.
3. 3Doctrine-compatible hierarchical mission decomposition, so a mission becomes a tree of verifiable sub-objectives.
4. 4Constrained multi-agent reinforcement learning that may only improve within the envelope’s permitted action space.
5. 5Provenance-preserved federated continual learning, so a lesson learned by one agent transfers to the fleet as an auditable contribution, not an opaque weight update.

The same propose-only discipline as the rest of the work applies: learning and reasoning propose within bounds; the envelope and the edge runtime decide what is permitted, and human authority is retained over irreversible actions.