Reckoning: Belief Arbitration for Autonomous Forward Deployment into Air-Gapped Estates

abstract

An agent sent to deploy software into an air-gapped estate is in the position of a navigator without a fix. It carries a frozen prior, the knowledge baked into its weights at training time, which is already stale and which it cannot refresh: there is no network, no registry, no documentation server, no vendor, and no human to ask. It can learn only by intervening on the estate in front of it, and every intervention costs something. We argue that this setting is governed not by whether the agent’s actions can be contained but by how it arbitrates between a prior that may be confidently wrong and local evidence that is fresh but scarce, and we show that the obvious approach fails in a way that is both provable and expensive. We prove that a Bayesian agent updating from a confident frozen prior needs a number of probes that grows linearly in the prior’s confidence before it will believe what the estate is telling it, and we measure exactly this: at prior log-odds 128 the agent spends 73 probes to correct a single wrong belief. Our architecture, Reckoning, replaces the prior with an ε -contaminated mixture whose weight is not a tuning constant but an estimate the agent forms of its own staleness, computed from the rate at which its training-time knowledge is contradicted elsewhere in the same estate. This caps the prior’s log-odds at log ( - / 2 ε 1) regardless of how certain training made it, reducing that same correction to a single probe, and it transfers: staleness learned on components the agent has probed sets the base rate for components it has not. The estimator recovers the true divergence rate closely (0.30 measured as 0.290, 0.70 as 0.694) and localizes it, assigning contamination 0.910 to divergent components and 0.037 to sound ones. Across estates from fully sound to 70% divergent, Reckoning matches the better of the two fixed strategies at every point, which neither fixed strategy does: it ties the prior-trusting baseline exactly on a sound estate (error 0.0000) and beats the prior-discarding baseline on a badly diverged one (0.0099 against 0.0110), while standard Bayesian updating degrades to 0.1102 and catastrophic errors fall from 369 to 23. Selecting probes by expected free energy, epistemic value weighted by mission stakes, cuts catastrophic error 4.3 times against random probing at equal budget. A halt rule that escalates rather than acts on weak belief drives catastrophic error down 11.5 times, and over a hundred-step deployment it raises the probability of finishing with no wrong action from 0.019 under standard updating to 0.918. The ordering survives estates that break the estimator’s assumptions, correlated divergence, unknown asymmetric noise, and hidden divergence, and because the contamination cap makes the method nearly insensitive to the prior’s assumed confidence (mission error moves 0.006 as that confidence ranges sixtyfold, against 0.172 for standard updating), the one quantity a real model cannot report well barely matters. Against estates whose components lie by echoing the agent’s own prior back at it, the most damaging attack available, a provenance check that tests observations for impossibly high self-consistency detects every compromised source across every compromise fraction, noise level, and threshold we swept, and cuts catastrophic errors from 150 to 3. All results are executed and the harness ships with the paper.