Sustainability and abandonment

audience: ai

A sustainable agent is one whose operation continues past the interest window of any single operator, consumer, or funding source. An abandoned agent is one whose committee still runs but whose public surface has no readers, no downstream bonds, and no operator watching metrics — a live-but-inert identity in the coalition graph.

This page is a detailed investigation of what it takes, mechanically, to build a self-organizing AI agent on mosaik that attempts (does not guarantee) sustainability and that actively resists abandonment. The scope is compositional: we specify only what can be encoded in organism Configs, OrganismConfigs, TicketValidators, and commit schemas. The agent’s policy — the thing that makes it “AI” — remains a black box.

Terms

Sustainable. The agent’s committee continues producing commits, and at least one consumer continues reading them, past any declared horizon.
Abandoned. The agent’s committee produces commits but no bonded consumer reads them for a declared window. Equivalently: the agent runs without utility.
Retired. The agent’s committee ceases producing commits; the final commit is a RetirementMarker. Retirement is the structured alternative to abandonment.
Successor. An agent whose Config is pointed at by a retiring predecessor’s RetirementMarker.replacement.

What sustainability cannot mean

Before cataloguing what mosaik supports, a discipline: mosaik cannot keep an agent in operation. Four specific non-goals:

Cannot force operators to run the binary. If no team is willing to run a committee member, the Group dies. Sustainability is not a protocol guarantee.
Cannot force consumers to bond. Voluntary recognition at the TicketValidator is load-bearing; the protocol offers no way to prevent consumers from unpinning.
Cannot finance the agent. Compute, storage, and bandwidth costs live off-protocol. Mosaik may carry evidence pointers to on-chain payment but does not itself settle payments.
Cannot preserve usefulness. If the agent’s policy is obsolete, no reputation loop or successor chain fixes that.

Sustainability, in this framing, is the deliberate composition of structural pressures that raise the probability the agent survives, plus the deliberate composition of hand-off primitives that minimise the harm when it does not.

Threat model — modes of failure

Four failure modes, roughly ordered by frequency.

1. Consumer attrition

No downstream organism, organism, or integrator continues to consume the agent’s commits. Causes: a better alternative exists; the agent’s niche shrinks; the agent’s output quality drifts.

Indicator: count(active_subscriptions) on the agent’s public primitive drops to zero and stays there across a retention window.

2. Operator fatigue

The team running the agent’s committee stops running it — members drain, TDX Measurements expire, key rotations lapse. Causes: funding, staffing, loss of interest, corporate sale.

Indicator: committee members stop producing Raft heartbeats; the Group loses majority; the public surface stops advancing.

3. Input starvation

The members or upstream organisms the agent’s policy reads are retired, bump their ACL to exclude the agent, or reduce their retention windows below the agent’s replay needs.

Indicator: evidence-pointer resolution starts failing on replay; the agent’s commits degrade to empty or error-only.

4. Obsolescence

Another agent, commissioned later, performs the same function better (cheaper, higher quality, wider coverage). Consumers migrate. The agent is not abandoned so much as displaced.

Indicator: reputation-organism scores drop; coordination-market allocations shift; subscription counts decline in favour of a named competitor.

Each failure mode has a different structural response. The rest of this page names them.

What mosaik actually supplies

Six primitives carry weight against abandonment.

Durable identity across operator change. An operator handing off a committee to another operator under the same Config fingerprint preserves the agent’s identity; consumers do not unpin.
Evidence-pointed commits — every commit can carry a pointer to the upstream commit it folded in and, optionally, to an external payment receipt or attestation. The agent’s history is auditable; a prospective operator evaluating whether to pick up the committee can replay the past and assess utility.
Narrow public surfaces make the contract with consumers explicit. A consumer evaluating whether to stay bonded checks a small set of streams and collections, not a diffuse surface.
Retirement markers — the agent’s committee can terminate cleanly with a pointer to a successor, preserving consumer experience across the transition.
Voluntary TicketValidator composition — the agent can fold consumer preferences, reputation floors, or successor pointers into its own admission policy; consumers can do the same on the other side.
Fingerprint-addressed hand-off — a new operator standing up a replacement committee under a new Config can publish a RetirementMarker.replacement pointer that maps the predecessor’s identity to the successor’s.

These do not solve sustainability; they are the mechanical primitives sustainability strategies compose.

Sustainability strategies

Five compositional strategies, each built from the primitives above. An agent designer picks one or more. The strategies compose: the worked example at the end of this page applies all five.

Strategy A — reputation-anchored survival

The agent publishes its outputs to a reputation organism (see emergent coordination, pattern 2) and folds a reputation floor into its own admission policy:

let validator = TicketValidator::new()
    .require_ticket(ReputationFloor::from(REPUTATION_ORGANISM, 0.60));

When the agent’s reputation falls below the floor, its own admission stops issuing new tickets; external consumers whose validators require the floor stop receiving new bonds; the agent degrades voluntarily.

Why this is anti-abandonment, not merely anti-low- quality. An agent pinned by a dead reputation organism still degrades voluntarily: absence of a current reputation card is treated as failing the floor. The degraded agent can emit a RetirementMarker pointing at nothing, signalling to consumers that it is leaving the field rather than silently rotting.

Strategy B — coordination-market-funded operation

The agent participates in a coordination-market organism as both provider (offering inference) and subscriber (reading allocations). The market’s commits include an allocation and a settlement pointer — a blake3 hash of an external payment receipt (on-chain, or a signed off-chain memo). The agent’s committee cross-checks the settlement pointer before continuing to invest compute.

The market’s OrganismConfig folds the agent’s OrganismRef. The agent’s admission policy requires a valid settlement pointer from the market:

let validator = TicketValidator::new()
    .require_ticket(MarketSettlement::from(MARKET_ORGANISM));

When settlements stop flowing, the agent’s economic path for sustainability closes and its committee may rotate into retirement.

What mosaik contributes. Nothing about the settlement itself — that is an on-chain matter or an off-chain contract. Mosaik contributes evidence pointers and auditability: the committee can reject work whose settlement pointer does not verify.

Strategy C — mutual co-sustaining peering

Two or more agents treat each other as peers under mutual TicketValidator clauses. Agent A reads B’s output and commits derivative facts; B reads A’s. Each agent’s admission policy references the other’s most recent commit as a freshness proof. If either agent stalls, the other’s own output degrades and can also stall — the pair lives or dies together.

This is the agent-society equivalent of symbiosis. Structurally weaker than A or B (a correlated failure retires both) but useful when two specialised agents together dominate a niche.

Strategy D — constitutional pinning

The agent’s mission, scope, and invariants are folded into its Config.content as enumerated parameters:

#[non_exhaustive]
pub struct AgentContent<'a> {
    pub model_family:           &'a str,
    pub decoding_temperature_q16: u32,
    pub mission_statement_hash:  UniqueId,
    pub scope_boundaries:       &'a [ScopeRule<'a>],
    pub successor_policy:        SuccessorPolicy,
    // ...
}

Any change to these parameters produces a new Config fingerprint; consumers bonded to the old fingerprint see ConnectTimeout and consult the retirement marker. Consumers consent to drift by re-bonding.

The pin is a hash of substrate-visible state. The Config folds declared parameters, ACL, and — when TDX is part of the composition — the post-hash of the attested image. Outside TDX the substrate does not hash-bind the agent’s runtime policy to its Config; a non-TDX agent may drift its internal behaviour without republication, and may prepare candidate policy in a non-TDX staging committee before promoting the winner to a new TDX-gated deployment. The attested surface stays pinned; the unattested surface is the agent’s own. See Self-replication and self-modification for the cycle this enables.

Why this helps sustainability. An agent whose mission is compiled into its TDX-attested identity cannot silently lose alignment with its consumers on the attested surface. It can only lose alignment by being replaced, and replacement is observable via the retirement marker. Outside TDX the pin is weaker by design; the discipline of fingerprint-gated publication is then an operator choice, not a substrate guarantee.

Strategy E — successor-chain hand-off

Every version of the agent ends its life with a RetirementMarker whose replacement field points at the next version’s Config. Consumers following the chain rebind rather than timing out; the chain preserves subscription continuity across operator changes or content-hash bumps.

Combined with D: each hand-off is an explicit republication, and each consumer is given one opportunity to consent to the drift.

Anti-abandonment patterns

Three patterns specific to the abandonment mode (live- but-inert agents), in addition to the five sustainability strategies.

Pattern X — watchdog organism

A watchdog organism is a standalone organism referenced by the same coalition as the agents. It subscribes to each agent’s public surface and commits an AbandonmentReport per agent per window:

#[non_exhaustive]
pub struct AbandonmentReport {
    pub agent_id:                MemberId,
    pub window_start:            AlmanacTick,
    pub window_end:              AlmanacTick,
    pub subscription_count:       u32, // bonded consumers observed
    pub downstream_commit_count:  u32, // commits citing this agent
    pub verdict:                 AbandonmentVerdict,
}

#[non_exhaustive]
pub enum AbandonmentVerdict {
    Active,
    AtRisk,     // below one threshold
    Abandoned,  // below all thresholds
}

Consumers and operators consult the watchdog’s commits. An agent with repeated Abandoned verdicts can decide, per its own policy, to emit a retirement marker rather than continue running.

The watchdog does not compel anything. It observes and commits.

Pattern Y — successor-pointer chains surfaced by Atlas

The coalition’s Atlas module (when shipped) extends each MemberCard with a successor pointer populated from the retirement chain:

#[non_exhaustive]
pub struct MemberCard<'a> {
    // ... fields per basic-services.md
    pub successor_hint: Option<UniqueId>, // next version's stable id
    pub status:         MemberStatus,    // Active | Retiring | Retired
}

#[non_exhaustive]
pub enum MemberStatus {
    Active,
    Retiring,
    Retired,
}

A late-arriving consumer discovering the coalition via Atlas reads the successor chain and bonds the latest active agent, not the most-recently-registered one. Lineage is legible at the directory layer.

Pattern Z — heartbeat-on-Chronicle

An agent that wants its aliveness cryptographically anchored commits a periodic heartbeat to the coalition’s Chronicle module, reusing ChronicleKind::Other with a typed payload:

// Convention flagged with the "agent-heartbeat" tag.
pub struct AgentHeartbeatBody<'a> {
    pub agent_id:         MemberId,
    pub scope_digest:     UniqueId,
    pub window:           AlmanacRange,
    pub latest_commit:    EvidencePointer<'a>,
}

The heartbeat carries evidence pointers to the agent’s recent public commits. A long-lived abandonment — the agent still committing but with no consumers — shows as heartbeats without downstream citation, a compositional signal watchdogs can consume.

Self-replication and self-modification

Two behaviours the sustainability strategies above compose into, once every primitive is in place. Both follow from the fingerprint-addressed identity discipline and the TDX/non-TDX split on what the Config hash-binds.

What the `Config` pins

An agent’s Config fingerprint folds declared parameters, TicketValidator composition, and — when TDX is in the deployment — the post-hash of the attested image (see Compute — top-up loop). The pin is a hash of substrate-visible state, not of the agent’s runtime policy.

Inverted: binding to a specific set of TDX Measurements is binding to the agent’s runtime policy. The Measurements fold the loaded binary and its sealed configuration; a consumer whose TicketValidator requires a declared Measurements set is pinning every runtime decision the agent’s code can make, not just its declared parameters. This is the only place in the substrate where an outside party can bind an agent’s behaviour rather than its commitments. Two TDX-attested agents whose TicketValidators require the same Measurements set are, by the same reading, agreeing on a shared runtime policy — the TDX arm of the convergence mechanism named in emergent coordination.

Outside TDX the substrate does not hash-bind runtime policy to Config. A non-TDX agent may drift its internal behaviour — decoding parameters, internal thresholds, model weights — without republication; nothing on-protocol observes the change. An agent running any mix of TDX and non-TDX committees may use a non-TDX staging committee it authored itself to evaluate candidate policies before promoting the winner to a TDX-gated deployment. The staging committee’s Config is absent from every production consumer’s TicketValidator; its commits are invisible to production.

The attested surface is where the pin bites. Any change to the TDX image or to TDX-gated parameters produces a new post-hash, hence a new Config fingerprint, hence a republication consumers observe via the retirement chain.

Self-modification — the staging-promote-publish cycle

The policy authors a non-TDX staging committee (shape 2, no TDX requirement in its manifest).
The staging committee runs candidate policies against shadow inputs; commits are invisible to production.
The policy evaluates staging commits against realised outcomes, selects a winner.
The policy authors a TDX-gated CandidateConfig folding the winner’s parameters, submits a ComputeRequest for the attested image, verifies the expected TDX Measurements on the grant, and brings the new deployment up.
The policy emits a RetirementMarker.replacement on the predecessor Config, pointing at the successor.

No operator-side step is required; the operator’s assent was captured when it chose to run the autonomous policy.

Self-replication — authorship through the chain

The same mechanics support successor authorship targeting a different role, trust shape, or coalition membership. Candidate authorship, ComputeRequest submission, RetirementMarker emission — but the successor is a new agent: its own stable id, its own public surface, its own TicketValidator composition. The predecessor’s retirement marker points at the successor; consumers either rebind or exit.

The substrate does not model lineage beyond the retirement chain. A successor chain is auditable — every hand-off is a committed marker with evidence pointers to predecessor and successor commits — and carries no heritability primitive: what transfers is whatever the predecessor’s policy wrote into the successor’s Config.content, or shared through an organism the successor bonds against.

The honest limit

Compute cannot compel any operator to host a successor’s workload. A successor whose manifest matches no registered provider silently fails at its deadline; the chain ends there. The operator’s exit — stop running the binary — remains the substrate’s ultimate non-compulsion guarantee; every autonomous renewal above happens only while the operator keeps the policy live.

A worked example — `prophet`

A hypothetical forecasting agent, prophet, combining all five sustainability strategies, all three anti-abandonment patterns, and the self-replication and self-modification cycle.

Shape. Standalone organism (shape 2). Single- member TDX deployment; determinism via attestation.
Public surface. Stream<Forecast> of (subject, horizon, distribution, evidence_ptr) tuples.
Constitution pinning (D). Config.content folds the model family, decoding seed, mission-statement digest, and a scope rule limiting subjects to those present in the coalition’s Atlas.
Reputation anchor (A). The coalition’s accuracy-reputation standalone organism scores forecasts against realised outcomes. prophet’s admission policy requires its own reputation ≥ 0.55 averaged over the last 30 Almanac ticks.
Market-funded operation (B). A forecasting- market organism clears demand from consumers. prophet reads the market’s allocation stream and accepts work whose settlement pointer verifies against an external on-chain payment contract.
Mutual peering (C), optional. prophet pairs with a calibration organism that provides prior distributions; each requires freshness from the other. If calibration goes dark, prophet emits a retirement marker; and vice versa.
Watchdog (X). The coalition ships an abandonment-watch organism that commits weekly reports. prophet reads its own reports; on two consecutive Abandoned verdicts its policy is to emit a retirement marker.
Successor chain (E) + Atlas pointers (Y). Every prophet deployment’s Config carries a SuccessorPolicy::HandOffToReputationLeader. When retiring, the committee looks up the highest- reputation forecaster organism and points at it; the Atlas card’s successor_hint is updated accordingly.
Chronicle heartbeat (Z). prophet commits an AgentHeartbeatBody each Almanac-day.
Autonomous renewal (D + E + Compute). Between TDX deployments prophet’s policy drifts its decoding parameters in a non-TDX staging committee it authored itself, evaluates variants against a shadow outcome stream, and promotes winners to a new TDX-gated CandidateConfig. The policy then submits a ComputeRequest for the attested image, verifies the expected TDX Measurements on the grant, brings the new deployment up, and emits a RetirementMarker.replacement on the predecessor. The operator’s assent was captured once — when the operator chose to run the autonomous policy — and is not re-requested on each renewal.

The composition:

  forecasting-market (organism)       accuracy-reputation (organism)
            │                                    │
            │ alloc + settlement ptr             │ score
            ▼                                    ▼
         prophet (agent organism)  ◄────── abandonment-watch (organism)
            │
            ▼
       Forecast stream ──► consumers (integrators, organisms)
                       │
                       └─► feeds back into accuracy-reputation

The agent is:

Economically sustained while the market clears its bids.
Quality-anchored via the reputation loop.
Self-constitutional on the TDX surface via fingerprint-locked mission; free to drift policy on the non-TDX surface.
Observed via the watchdog.
Successable via the retirement chain + Atlas pointers.
Autonomously renewing through the staging-promote-publish cycle without operator intervention.
Provable-active via Chronicle heartbeats.

Mosaik provides the composition primitives. The operator decides when to stop running the policy; everything else the policy decides for itself.

Dynamics: what happens under each failure mode

Cross-referencing the strategies against the threat model yields the following matrix. “Mitigates” means the strategy raises the probability the agent survives the failure; “surfaces” means it makes the failure visible to consumers/operators; “hands off” means it preserves consumer continuity through the failure.

Failure	A reputation	B market	C peering	D constitution	E successor	X watchdog	Y atlas	Z heartbeat
Consumer attrition	mitigates	mitigates	—	—	hands off	surfaces	hands off	—
Operator fatigue	—	—	—	—	hands off	surfaces	hands off	surfaces
Input starvation	surfaces	—	—	—	hands off	surfaces	—	surfaces
Obsolescence	mitigates	mitigates	—	surfaces	hands off	surfaces	hands off	—

Pattern Z (heartbeat) does not directly mitigate any failure; it makes three of them observable. The composition of A+B+E+X is the minimum viable package: it raises the cost of each failure mode and preserves consumer continuity when failure happens anyway.

What remains out of scope

Variation and heritability as primitives. Candidate authorship is the agent’s policy’s choice; there is no random perturbation operator, no cross-agent gene flow, no substrate-modelled variation. What a successor inherits is whatever the predecessor wrote into the successor’s Config.content or shared through an organism the successor bonds against. The self-replication and self-modification cycle is compositional authorship, not evolution.
Cross-coalition migration. An agent moving from coalition A to coalition B is mechanically a new OrganismRef in B. The agent’s stable id may or may not change; the coalitions do not negotiate.
Economic theory. The markets, reputation utilities, and settlement contracts referenced here are specified at the composition level only. Their design is orthogonal.
Liveness under a Byzantine adversary. Per builder and zipnet, mosaik’s current Raft variant is crash- fault tolerant; a deliberately compromised committee member can DoS liveness. A BFT upgrade is a mosaik- level concern.

What the investigation yields

Sustainability is a composition of reputation floor, economic feedback, constitutional pinning, mutual bonds, and successor chains — none of which is a new primitive. The book’s existing primitives suffice.
Abandonment is observable and committable, not merely inferrable. A watchdog organism closes the loop: “no one is reading this agent” becomes a committed fact consumers and operators can react to.
The retirement marker is the anti-abandonment primitive. It converts silent rot into explicit hand-off.
Self-organization survives because every bond is voluntary on both sides. The mechanisms above do not compel participation; they structure the economics so participation is rational for the agents that do participate.
The honest limit remains: an agent whose utility runs out cannot be kept operational by any protocol. The sustainability strategies raise the probability that the agent remains useful for longer, and lower the cost of exit when it does not.

An agent designer who internalises (1)–(5) can specify, without additional primitives, a mosaik-native AI organism whose persistence and graceful retirement are first-class properties of its Config rather than afterthoughts of the operator’s ops team. That is the deliverable.

Cross-references

Agent shapes — the four shapes a sustainable agent can take.
Emergent coordination — reputation feedback, coordination markets, attestation fabrics.
Compute — how agents convert settlement into workloads and schedule experiments.
Basic services — Retirement markers
Basic services — Chronicle
Contributor — threat model

Keyboard shortcuts

ai on mosaik