| Internet-Draft | Substrate Observation | October 2026 |
| Morrison | Expires 15 April 2027 | [Page] |
This memo describes a coordination-protocol anti-pattern observed in cross-tool agentic systems and a substrate-observation alternative that does not require negotiating a wire format between heterogeneous concurrent sessions of an identity-bound principal. The memo is Informational and proposes no protocol element for standardisation. It sets out what should not be standardised for this problem, and why, and identifies the existing substrate mechanisms that serve in its place. Companion memos describe the identity primitives this memo presumes.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 15 April 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
When a single identity-bound principal operates several agentic sessions concurrently, whether across different tools, different hosts (a workstation, a laptop, a phone), or different organisational contexts (an individual capacity, a workplace capacity, a contracted capacity), those sessions must deconflict their action without stepping on each other's commits, leases, or external-system state.¶
One approach is to standardise a wire protocol for the sessions to exchange peer-state envelopes: "I am here, working on X, holding lease Y until time T". Such standardisation is not needed for this problem. Each new agentic tool would add to the interoperability burden, and the protocol would move a distributed problem onto whichever broker it selected.¶
The alternative is substrate observation: each session observes
byproducts of its peers' normal operation (filesystem timestamps,
kernel-reported socket peer counts, server-emitted connection counts
on shared channels) and forms its own local representation of
who-else-is-here. There is no envelope, no wire format and no
broker. Reconciliation occurs post-hoc through substrate-physics
commitments (filesystem locks, append-only identity logs, economic
settlement, organisational identity append-logs), never through a
canonical decision. Identity binding of the principal's surfaces
themselves is assumed to follow the conventions of [MCPDNS] and
[IDCOMMITS]; this memo concerns only the coordination layer above
those primitives. This memo also relies on the ~handle namespace
established in [IDPRONOUNS] and the per-principal identity substrate
referenced in [IDACCORD]. A principal's ~handle corresponds to the
alter:~handle URI defined in [ALTER-URI].¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
The following terms are defined for the purposes of this document:¶
A filesystem or kernel or network-substrate side-effect of an operation undertaken for some purpose other than coordination, observable to other sessions of the same principal without those sessions having transmitted a coordination message.¶
The property that an observation aged beyond a recency threshold transitions to an explicit "uncertain" state, under which the observing session continues to operate, rather than transitioning to an "absent" state under which the observing session blocks. Section 3.1 of [MORRISON-IFT] discusses the analogous case for authentication, where confidence in an earlier observation of identity degrades with elapsed time rather than holding until a fixed expiry.¶
The property that each session of a principal forms its own local representation of concurrent-peer presence from substrate observations, and that no representation is canonical. Divergent representations are reconciled post-hoc through substrate-physics commitments, not through agreement among the sessions themselves.¶
The ordered, non-commutative reconciliation pipeline through which divergent local representations resolve to a single durable history. A reference implementation orders the cascade as (a) filesystem-lock arbitration, (b) per-principal append-only identity-log, (c) external operational settlement (cryptographic non-fast-forward rejection, on-chain transaction receipt), and (d) per-organisation append-only identity-log. No stage in the cascade transmits a coordination marker; each stage is a commitment to the substrate, observed identically by every participating session.¶
Envelope coordination, the standardisation of a peer-state-exchange wire format across heterogeneous agentic sessions, does not fit the cross-tool problem of an identity-bound principal. Three failure modes recur:¶
Every additional agentic tool adopting an envelope-coordination standard must negotiate compatibility with every prior tool's version of the standard. Tool families evolve at different cadences; agreement-by-versioning produces a combinatorial maintenance burden borne by the slowest-moving tool's release cycle. Substrate observation has no compatibility surface to negotiate; tools that emit substrate byproducts as a side effect of their normal operation are visible to each other whatever their release cycles.¶
Envelope-coordination wire formats imply a destination for the envelopes. A broker, whether discovered via DNS, configured per-session, or shipped by a single vendor, accumulates the peer-state of every session that publishes to it. This collapses what is logically a distributed-observation problem onto a single centralised authority. When the broker is down, coordination is down, and the broker operator sees every session's purpose.¶
Envelope payloads typically carry an identifier ("session-id", "principal-id", "agent-id") to permit peers to address each other. Such identifiers become a re-identification surface at the wire layer that the underlying identity infrastructure may have arranged to bound. Substrate byproducts carry no payload; they are present in the substrate. The inference of peer identity is performed locally by each session from substrate-tier credentials it already possesses (kernel SO_PEERCRED, transport-layer authentication on a shared channel, and equivalent). No wire-layer identifier is exposed.¶
The anti-pattern identified here is the standardisation of a peer-state-exchange wire format for the purpose of deconflicting otherwise-independent action. It does not cover every message a concurrent session may transmit. A constitutive act, one that brings into being a shared commitment that did not exist until both parties assented, is distinct from a peer-state envelope. A peer-state envelope describes action each session decided independently, transmitted only to deconflict; that is the anti-pattern. A constitutive handshake creates a commitment that does not exist until assent is exchanged, so it must declare its terms and fail closed. Substrate observation fits the former and is not offered for the latter. A deliberate handshake therefore does not conflict with this memo; the two sit on opposite sides of the describe/constitute boundary.¶
Sessions observe substrate-emitted byproducts. Three reference observables, listed in order of identity-binding strength:¶
Filesystem modification timestamps on per-session journal files produced by tools that journal to disk. Pseudonymous; compute-location is the observing session's local filesystem.¶
Kernel-reported socket peer-credentials (SO_PEERCRED on Unix-domain sockets, equivalent mechanisms on other systems) for sessions mounting a common per-principal daemon. Identity-bound to the principal owning the daemon; compute-location is kernel-mediated, host-local.¶
Server-emitted concurrent-connection counts on a per-principal event channel maintained by the principal's identity infrastructure. Identity-bound to the principal; compute-location is the server emitting the count, with inference performed locally by the subscribing session.¶
The compute-location labels above use the term as defined in [COMPUTELOC] Section 2: the machine class on which an inference executes, server-side or on the local device.¶
None of these observables is a coordination message. Each exists as a byproduct of the observed session's normal operation: writing its journal, mounting its socket, subscribing to its event channel.¶
Each observable class has its own identity-binding strength, and a session's local representation records both what it observed and the tier at which it observed it. The closed-class provenance grammar of [SUBPROV] provides the vocabulary for that annotation. It distinguishes, for example, a filesystem-timestamp observation from a kernel-peer-credential observation from a server-emitted-count observation, so that downstream reconciliation can weight an observation by the identity-binding strength of its source rather than treating all observations as equally authoritative.¶
When sessions' local representations diverge, typically when two sessions independently take an action that affects shared state (a shared filesystem path, a shared external-system resource, a shared organisational artifact), reconciliation proceeds through the substrate-physics cascade defined in Section 2, ordered: filesystem-lock arbitration, per-principal append-only identity-log, external operational settlement, per-organisation append-only identity-log. Each stage is a substrate commitment. No stage transmits a coordination marker; each stage's outcome is itself observable as another substrate byproduct by every participating session.¶
The cascade is non-commutative: the outcome of an earlier stage constrains the admissibility of a later stage's commitments. This property prevents an attacker from partitioning observations across cascade stages to write conflicting commitments simultaneously.¶
The following example illustrates the operating posture of a session that has formed, from substrate observation alone, a belief that a concurrent peer conflicts with its own work, and that resolves that belief without transmitting a coordination envelope.¶
A principal operates several concurrent sessions. One session prepares to modify a shared artifact and forms the hypothesis that a peer is already modifying the same artifact. Under envelope coordination the session would block, or would transmit a query and await a peer response, before proceeding. Under substrate observation it instead reconciles the hypothesis against three observation classes it already possesses.¶
First, the server-emitted concurrent-connection count on the principal's per-principal event channel (Section 4, third observable) establishes how many peer sessions are present. This observable is identity-bound to the principal and is emitted by the principal's server rather than by any single host, so it accounts for peers on hosts other than the observing session's own. A count derived instead from a host-local observable (Section 4, second observable, kernel peer-credentials on a host-local socket) omits off-host peers and MUST NOT be treated as complete.¶
Second, the per-session filesystem journals (Section 4, first observable) of each present peer disclose, as a byproduct of each peer's normal operation, the artifacts that peer is touching. The observing session binds these into a single local representation (Section 2, mutual hallucination) and observes whether any present peer is touching the shared artifact in question.¶
Third, the filesystem presence of an unattended working surface (an orphaned working tree, or a branch with no live session behind it) is a first-observable byproduct that decays to uncertainty (Section 2). It MUST NOT be conflated with a present peer. A conflict hypothesis grounded in a stale filesystem artifact rather than in a live peer is the divergent local representation the cascade reconciles post-hoc; it is not a live conflict to block on.¶
Having reconciled the hypothesis against present, non-stale peers and found no present peer touching the shared artifact, the session proceeds. It does not conclude that conflict is impossible: the mutual-hallucination property (Section 2) denies any local representation the status of a canonical decision. It concludes only that no conflict is observed among present peers, which licenses action, not certainty. Any residual conflict, whether a peer that begins touching the artifact after the observation or an off-host peer the observing session could not see, is caught at commit time by the substrate-physics cascade (Section 5): filesystem-lock arbitration, then the per-principal append-only identity-log, then external operational settlement such as a cryptographic non-fast-forward rejection. The example therefore separates two roles: observation licenses a session to act under uncertainty, and the substrate-physics cascade, not a pre-emptive coordination envelope, is what makes the action safe.¶
This memo does not propose a standardised set of substrate observables or a standardised reconciliation cascade. The observables identified above are characteristic of POSIX-derived systems running journal-emitting tools, mounting Unix-domain sockets, and subscribing to HTTP-streaming event channels, substrate that is itself standardised in [POSIX], [RFC8441], and similar. No new substrate standardisation is required for the substrate-observation pattern; it composes directly with existing substrate. Where heterogeneous substrate calls for adapter selection (a Windows tool's journal location differs from a POSIX tool's), the adapter is a tool-private implementation detail, not a wire-format negotiation between sessions.¶
For each prior-art family below, this section states the property that makes it unsuited to the cross-tool problem of an identity-bound principal described in this memo.¶
Leader-elected consensus, as in Paxos [PAXOS] and Raft [RAFT], requires a designated leader, explicit coordination messages, and a single canonical log. Substrate observation has none of these.¶
Conflict-Free Replicated Data Types [CRDT] require a shared mutable data structure and commutative merge operations. Substrate observation has neither; the cascade described in Section 5 is non-commutative.¶
Gossip and epidemic protocols (Demers et al. 1987, [SWIM] and successors) require explicit anti-entropy or update messages transmitted between nodes on a schedule. Substrate byproducts are side effects of unrelated operations and carry no anti-entropy state.¶
Logical clocks [CLOCKS] (Lamport, vector clocks, Interval Tree Clocks) require piggyback of clock state on application messages. Substrate observation does not piggyback on coordination messages because there are none.¶
Distributed snapshots [SNAPSHOTS] require explicit marker messages injected along communication channels. The reconciliation cascade of Section 5 is triggered by independent operational events, not markers.¶
Cryptographically-chained append-only logs (Certificate Transparency [RFC9162], Git object graphs, blockchain ledgers) appear in this memo's cascade as its second and fourth stages, triggered by byproduct emission. A chained log alone is not the mechanism this memo describes.¶
Failure detectors (Chandra-Toueg, [SWIM], Lifeguard) output suspect/dead judgements about peers based on heartbeat latency/absence. Substrate observation outputs uncertainty as a terminal state in which the system continues to operate; uncertainty is not a transient state on the way to dead.¶
Lock-free and wait-free data structures require shared memory between threads. Sessions in the present memo do not share memory; they observe substrate-physics surfaces independently.¶
Web Locks API [WEBLOCKS] and analogous intra-runtime mechanisms operate within a single browser instance and rely on message-passing or lock-arbitration provided by the runtime. They do not generalise to the cross-host, cross-tool problem the present memo addresses.¶
This section records biological precedent for substrate observation across five subjects. It is background only: in each subject, coordination proceeds by observation of substrate-physics rather than by transmission of a coordination envelope, which is evidence that the shape is realisable and selectable as an architecture.¶
Four vertebrate subjects converge: African and Asian elephant matriarchal recognition with infrasonic identity calls and multi-decade individual recognition (McComb, Moss, Durant, Baker and Sayialel 2001 "Matriarchs as Repositories of Social Knowledge in African Elephants" Science 292:491-494); corvid (scrub jay, Eurasian jay, New Caledonian crow, American crow) episodic-like cache memory bound on what-where-when-who, theory-of-mind aware re-caching contingent on observer identity, and trans-generational tool tradition transmission (Clayton and Dickinson 1998 Nature 395:272-274; Emery and Clayton 2004 Science 306:1903-1907; Marzluff et al 2010 Animal Behaviour 79:699-707); cetacean (sperm whale, killer whale, bottlenose dolphin, humpback whale) pod- and matriline-distinct dialect drift, decades-long individual signature-whistle recognition, and culture-as-population-substrate (Whitehead 2003 "Sperm Whales: Social Evolution in the Ocean" University of Chicago Press; Garland et al 2011 Current Biology 21:687-691; Bruck 2013 Proceedings of the Royal Society B 280:20131726); and the human Highly Superior Autobiographical Memory phenotype (LePort et al 2012 Neurobiology of Learning and Memory 98:78-92; Mazzoni et al 2019 NeuroImage 200:163-173). A fifth subject, cephalopods, is phylogenetically independent of the four vertebrate subjects at approximately 600 million years of separation: cuttlefish episodic-like memory (Jozet-Alves, Bertin and Clayton 2013 Current Biology 23:R1033-R1035) replicates the corvid scrub-jay finding in an out-of-vertebrate-family taxon; cephalopod chromatophore camouflage emits identity expression as a continuous output of the substrate-observing nervous system rather than as a stored property, with the emission decaying to incoherent noise rather than to a frozen last-known-pattern when substrate input fails (Hanlon and Messenger 2018 "Cephalopod Behaviour" Cambridge University Press); and cephalopod arm-level motor programs continue executing locally-coherent behaviour against their local substrate under experimental dissociation of central-peripheral coordination (Sumbre, Gutfreund, Fiorito, Flash and Hochner 2001 Science 293:1845-1848). The cephalopod evidence indicates that the pattern has arisen independently across a large evolutionary separation, and so is not specific to vertebrates.¶
Across all five subjects, coherent identity-recognition cognition is realised as a distributed substrate of heterogeneous nodes with role-specific decay characteristics, not as a single store implemented redundantly, and coordination of action under partial information is achieved through observation of substrate-physics rather than through transmission of a coordination message between observers. Four of these properties have counterparts in this memo: (i) memory is distributed across structurally heterogeneous substrates with role-specific decay characteristics (mirrored by the four-stage substrate-physics cascade of Section 2); (ii) storage at the high-salience tier is append-only with the reading surface as a projection (mirrored by the per-principal append-only identity-log at stage (b) and the per-organisation append-only identity-log at stage (d)); (iii) episodes bind heterogeneous modalities with corroboration per-episode rather than per-stream (mirrored by the substrate-observation primitive which binds heterogeneous substrate-emission classes into a single local representation); and (iv) memory carries metadata about who observed it (mirrored by the kernel-attested or server-attested credential of the emitting session as an intrinsic property of each substrate emission).¶
The split-brain operating posture described in this memo has a biological parallel in cephalopod distributed-control behaviour: when central-peripheral integration breaks, arm-level programs continue executing coherently against their local substrate. The animal still acts, but as eight quasi-independent agents rather than as one. This corresponds to the multi-session operating posture this memo describes: divergent local representations under uncertainty, with reconciliation post-hoc through the substrate-physics cascade rather than through pre-emptive central coordination.¶
The biological precedent is cited solely as background. No claim of biological prior art is asserted, and no analogy to biological substrate is normative for any conformance requirement of this specification.¶
This memo requires no IANA actions.¶
Substrate observation surfaces three classes of attack absent from envelope-coordination protocols.¶
A peer emits a substrate byproduct then disappears, leaving an aging observation influencing other sessions' representations beyond its operational lifetime. Mitigation is decay-to-uncertainty with a per-substrate-layer eviction floor: observations below threshold are evicted, not retained at vanishing confidence.¶
A peer emits substrate byproducts to some cascade layers but not others, producing divergent local representations across layers that the cascade cannot fully reconcile. Mitigation is per-observer monotonic layer-coverage commitment: an observer's first emission registers its substrate-set, and later emissions outside that set are quarantined before identity-log write.¶
A peer re-emits aged substrate byproducts to refresh observers' confidence in stale state. Mitigation is observation-id-bound decay, where the decay clock is keyed to the observation identifier rather than to wall-clock receipt time.¶
Substrate observables vary in identity-binding strength. The lowest tier (filesystem timestamps, before any identity binding) is pseudonymous: the observer can infer presence but not identity. Implementations SHOULD operate this tier with refusal to emit in cloud-shell environments (where host identity is shared across users), refusal to emit in continuous-integration environments (where emission would be linkable to public workflow metadata), and refusal to enforce locks at this tier (locks require identity binding; pseudonymous observations do not provide it).¶
draft-morrison-substrate-observation-03 (October 2026):¶
Editorial. No change to any observable, cascade stage or mitigation.¶
Cites Section 2 of [COMPUTELOC] for the term "compute location" used in the labels of Section 4.¶
Cites Section 3.1 of [MORRISON-IFT] from the definition of decay-to-uncertainty in Section 2.¶
Corrects the consensus citation in Section 8, which paired the name Paxos with the Raft reference; each now cites its own paper, with publication details added to both entries.¶
Moves the companion-memo citations out of the Abstract into Section 1.¶
Replaces the obsolete Certificate Transparency reference with [RFC9162] and updates the title of [IDACCORD].¶
Replaces the undefined L1-L4 and IdentityLog labels in Section 9 with the cascade stages defined in Section 2.¶
Removes statements about the memo's own contribution, thesis and insight from the Abstract, Section 6, Section 8 and the Acknowledgements, and overstated claims from Section 9.¶
Removes the duplicate Author's Address section.¶
Rewrites sentences across the document in plainer terms and removes emphasis capitals outside BCP 14 key words. No requirement changes.¶
States in Section 1 that a ~handle corresponds to an alter:
URI, and adds an informative reference to [ALTER-URI].¶
This memo grew out of design work on coordinating concurrent agentic sessions of a single identity-bound principal across heterogeneous tooling.¶