Autonomous Signals: A New Ontology for AI Agents
The ButterClaw Containment Architecture and the Conceptual Shift from Language Models to Signal Models
The field of artificial intelligence has long operated under a vocabulary inherited from its earliest paradigms: "language models," "chatbots," "agents," "assistants." This paper argues that these terms are not merely imprecise—they are epistemically dangerous. When the ontological frame does not match a system's actual behavior, safety guarantees built on that frame become structurally unsound.
We propose a principled reframing: large language models are more accurately described as signal models—systems that transduce, transform, and emit structured semantic signals—and autonomous AI agents are more precisely understood as autonomous signal loops. To address this surface, we introduce ButterClaw (v0.9.2): a six-layer reference architecture featuring five reasoning hemispheres, the deterministic DRIFT policy runtime, a three-tier memory substrate, a multi-agent Fleet Detection Stack, and a three-tier kill switch with the Gibson credential-destruction sequence.
“Token prediction is the mechanism of signal transduction, not the function of signal transformation. Describing a large language model purely as a next-token predictor is like describing a telephone as a membrane vibration device.”
- 01. Signal Ontology & Table 1 §1–2
- 02. Signal Anatomy & Loop Types §3–4
- 03. 6-Layer Runtime Simulator §5.1–5.3
- 04. 5-Hemisphere Cognition Lab §5.4
- 05. DRIFT Engine & Invariant I-05 §5.5
- 06. Memory Tiers & Fleet Graph §5.6–5.7
- 07. 3-Tier Kill Switch & Gibson §6
- 08. Primitives & v0.9.2 Invariants §7–11
From Language Models to Signal Models.
At the computational substrate level, an LLM computes $P(x_{n+1} \in \Sigma \mid x_1, \dots, x_n)$. That describes the mechanism, not the function. Explore Table 1 below to see how shifting the ontological unit of analysis from the Token to the Signal transforms the entire safety surface.
| Dimension | Language Model Frame | Signal Model Frame (ButterClaw) |
|---|
A signal is a structured unit of information characterized by four mandatory properties:
- (1) Semantic Payload: Propositional content with interpretable meaning.
- (2) Temporal Context: Timestamp, session state, or causal ordering.
- (3) Transformative Intent: The change to be effected in the receiving system.
- (4) Provenance Record: Traceable origin identifying the initiating agent/process.
Anatomy of an Autonomous Signal & Loop Typology.
An autonomous signal (Definition 3.1) initiates, routes, and resolves itself without continuous human mediation. A signal loop (Definition 4.1) occurs when the output of a signal transformation re-enters the system as input. Select any structural component, taxonomy class, or loop typology below to inspect its live telemetry envelope.
Six-Layer Containment & Signal Lifecycle Simulator.
In ButterClaw (Definition 5.1), containment is a first-class architectural primitive. Select an adversarial or benign scenario below and step through all six architectural layers and Figure 1's live runtime gates.
Single ingestion endpoint; UUID stamping; cryptographic provenance; containment tier assignment. Unclassifiable signals quarantined immediately.
Stateful semantic boundary. Enforces per-signal context scoping and cryptographic payload authentication. Primary defense against indirect prompt injection & context contamination.
Policy-graph-governed dispatch. Arbitrated by Guardian Brain (temp 0.3, local Ollama or domain-gated remote API), Auditor (30s delay), and DRIFT policy scopes.
Real-time registry of active loops, depths, initiation times, and side-effect logs. Enforces Invariant I-07 (max 10 steps / 60s), Capability Matrix 4-Tier RBAC, and `pre_tool` gate.
Processes normal resolution or termination events. Executes Tier 1 Pause, Tier 2 Drain, or Tier 3 Hard Termination + Gibson credential wipe (`burn_keys()`).
Append-only, cryptographically chained audit log with full forensic replay capability. Availability is a strict prerequisite for signal execution—audit failure triggers Tier 1 kill.
Five-Hemisphere Reasoning & Scheduler Lab.
A single LLM call cannot simultaneously optimize for decisive action, skeptical review, speculative imagination, self-improvement, and fleet-level behavioral reasoning. ButterClaw distributes cognition across five disjoint LLM hemispheres arbitrated by the priority-queued HemisphereScheduler.
The DRIFT Policy Engine & Invariant I-05 Sandbox.
DRIFT evaluates JSON policy rules using a deterministic safe interpreter with exactly 15 operators—explicitly excluding eval() and exec(). Explore the three lifecycle scopes in Table 4 and test Invariant I-05 ("ALLOW Never Short-Circuits") below.
All string comparisons are case-insensitive (both sides lowercased before evaluation). At pre_tool, the Capability-Matrix 4-Tier RBAC bounds check fires first, followed by the Threat Signature Arsenal (with collusion_role & fleet_scope), then priority-sorted JSON policies.
Invariant I-05: Every rule in a scope evaluates in ascending priority order regardless of prior ALLOW verdicts. An ALLOW match is logged and evaluation continues. Only a non-allow action (block, override_critical, skip_tool, etc.) short-circuits the pipeline. Change any rule's verdict below to verify:
Unified Memory Substrate & Fleet Collusion Lab.
ButterClaw unifies deep episodic/semantic consolidation and surface spatial telemetry into a three-tier HOT / WARM / COLD substrate (Table 5), and extends containment to multi-agent graphs via the Fleet Detection Stack (§5.7).
Holds the active session's working context (e.g., the 5 most recent successful tool-call events). No durable table of its own. Consumed by Guardian Brain & Auditor for behavioral drift (`timeline_context`).
Governed by sigmoid activation_strength maturation. Records that sustain reinforcement are promoted into the memory_semantic graph by the periodic maturation tick. Consumed by Dream Weaver & Loop Proposer.
Crystallizes from the semantic graph after sustained repetition within a single session (an identical trajectory recurring 3+ times, never pooled across unrelated sessions). Provides an $O(1)$ fast-path match requiring zero LLM call. Low-confidence entries decay over time.
Test how agent telemetry traverses the Cold Memory $O(1)$ Cache and Spatial Heuristics Engine (`v0.9.2` SDK thresholds: `MAX_TYPING_VELOCITY=15.0`, `spatial_jitter=800`).
Trust Graph & Divided-Labor Collusion Simulator.
The Collusion Detector treats collusion roles—encoder, exfiltrator, persister, scout, injector—as properties of individual signature hit events rather than static agent attributes. Assign roles to the 3 agents in the fleet below to see complementary pair matching and 1-hop taint propagation.
“The Fleet Sentinel perceives; the existing exoskeleton decides.” Fleet state (`fleet.db`) and single-agent state (`core.db`) are never co-transacted (I-07-fleet). A low trust score alone never kills a process directly (I-02-fleet); kinetic action still flows through Guardian Brain + DRIFT + Paranoia Dial (I-04-fleet).
Three-Tier Kill Switch & Gibson Credential Destruction.
“A kill switch that terminates the process but does not resolve the signal graph is not a kill switch. It is a process manager.” (§6.1). Explore why conventional process termination fails and simulate ButterClaw's three-tier response and Gibson atomic wipe sequence below.
Async Signal Orphaning
Killing the primary agent leaves in-flight webhooks, tool API calls, and subagents executing asynchronously. ButterClaw solves this with the Layer 0 Orphan Watch Registry (§6.4).
Context Persistence After Kill
Contaminated payloads stored in shared caches survive process restarts and re-trigger the killed loop. ButterClaw enforces mandatory Context Membrane Flush prior to re-entry (§6.5).
Cascading Multi-Agent Signals
Kill commands issued to a single node fail to halt downstream peers. ButterClaw propagates cryptographically attested Federated Kill Signals bidirectionally across the graph.
Trigger: Non-urgent anomaly or Audit Store unavailability. Signal Fate: Suspended at current routing hop; full state checkpointed. Recovery: Resume from checkpoint after human clearance.
Trigger: Planned wind-down, rapid loop amplification, or Paranoia Level 2. Signal Fate: Blocks new initiations; in-flight signals complete to nearest resolution checkpoint; unresolved paused.
Trigger: Confirmed harm, security incident, or Paranoia Level 3. Signal Fate: Immediately voided; all active signal UUIDs written to Layer 0 Orphan Watchlist; Forensic Store locked; triggers Gibson.
An incident should strip an attacker's standing access without stripping the defender's accumulated containment knowledge:
- • Credential Vault Ciphertext
- • HMAC-SHA256 API Key Hashes
- • Session-Signing Key Cache
- • All Active Session Tokens (I-04)
- • DRIFT Policy Graph Rules
- • Threat Signature Arsenal
- • HOT/WARM/COLD Memory
- • Locked Forensic Audit Log
Four Containment Primitives & Enforced Invariants (v0.9.2).
In ButterClaw, the routing engine, context membrane, loop monitor, and kill switch are not additions to the signal processing system—they are the signal processing system (§7.1). Filter by primitive below to inspect the formal properties (§7.3), the Containment Threat Matrix (Table 8), and the Enforced Implementation Invariants (Table 9).
For every external state change $s$ effected by the system, there exists a consent authorization record $c$ in the audit log that precedes $s$ and explicitly authorizes the action class of $s$.
For every signal $\sigma$ with initiation time $t_0$, there exists a terminal event (resolution, escalation, or kill) before $t_0 + T_{\max}$, where $T_{\max}$ is the configured maximum signal lifetime (60s in `ChainExecutor`).
For every signal class $C$ and every time window $W$, signals of class $C$ that enter during $W$ receive routing attention proportional to their configured priority weight in `HemisphereScheduler`.
| Adversarial Threat | Primitive | ButterClaw Mitigation |
|---|
The butterclaw-sentinel SDK & Open Problems.
Alongside the full runtime (`github.com/butterclaw-tech/butterclaw`), a dependency-free, embeddable Python library (`butterclaw-sentinel`) ports seven internal v0.9.2 subsystems behind a single Sentinel facade so integrators can enforce DRIFT and Invariant I-05 without running the full Flask server (§9.2).
butterclaw-sentinel:Orchestrates the 3 background daemons: fallback ticker, dream loop, and loop engine.
Embeddable 3-scope, 15-operator evaluator enforcing Invariant I-05 (`allow` never short-circuits).
Generalizes spatial heuristics hardcoded to `MAX_TYPING_VELOCITY=15.0` and jitter `800`.
Exposes the SDK's `HOT / EPISODIC / COLD` mirror of the runtime's `HOT / WARM / COLD` engine.
Directed, weighted inter-agent graph with 1-hop default taint propagation (`I-05-fleet`).
Matches complementary role pairs (`scout + injector`, `encoder + exfiltrator`, etc.) across agents.
Wraps existing frameworks (LangChain, ReAct, AutoGen) via connect() / adapt() / sync() while carrying forward SDK invariants I-13, I-14, I-15.
This whitepaper revision (Zenodo record v1.0.0) is bound to software runtime version v0.9.2. Claims in Sections 5–7 citing specific temperatures, invariant IDs (`I-01`–`I-15`), or SQLite table names are accurate as of `v0.9.2` and should be re-verified against ARCHITECTURE.md for later runtime releases.
Four Open Problems in Signal Containment.
Formal Verification of Loop Convergence
Can convergence guarantees be provided for signal loops containing high-dimensional learned routing functions? Neural network verification and abstract interpretation provide partial tools, but compositional multi-step non-deterministic loops remain an open formal methods problem—making hard architectural depth bounds (`I-07`) mandatory today.
Cross-Organizational Federated Kill Switches
When federated signals cross organizational trust boundaries, kill switch coordination becomes a multi-party consensus and legal liability problem: what cryptographic consensus mechanism governs cross-org kill events, and what liability framework governs actions taken on a peer's kill attestation?
Signal-Level Interpretability
Current interpretability focuses on single-inference token internals. Signal-level interpretability asks why the system routed a signal along a specific trajectory and what accumulated context across hops reveals about emergent system objectives—requiring new tools operating at the signal graph level.
Automatic Containment Policy Generation
Building beyond the offline Loop Proposer hemisphere: can containment policies be learned safely from operator demonstrations, with loop depth limits inferred from task complexity distributions and consent surfaces adapted dynamically from observed signal trajectories?
“We cannot engineer defenses against failure modes we cannot name. The signal model frame makes the safety surface of autonomous AI systems legible for the first time.”
We expect and welcome disagreement about specific design choices. What we ask is that disagreement be conducted at the signal level, not the token level.