Abhyasa: Custody Transfer of Governance Obligations over Unreliable Channels in Agent Networks

Abstract

Agent communication protocols and their transport bindings (HTTP/SSE, WebSocket, and recent Media-over-QUIC mappings) deliver messages reliably. None addresses whether a governance obligation carried by a message, such as a consent revocation or a corrective welfare signal, survives a channel that is lossy, intermittent, or partitioned. A silently dropped governance message leaves an agent acting on stale authority, with no party aware the signal was lost; as agents move to the edge, such channels become the operating regime rather than the fault case. Guaranteed delivery is impossible over an unreliable channel (the Two Generals Problem), and by the end-to-end argument the guarantee must be supplied at the endpoints, not by an intermediary queue. But an obligation whose loss carries asymmetric cost can declare a fail-safe polarity: a safe default the sender applies locally when delivery is not confirmed, which makes the problem tractable. We propose Abhyasa, a transport-agnostic framework that delivers governance obligations under a deliver-or-report guarantee: custody transfer adapted from delay-tolerant networking, at-least-once delivery with idempotent application for effectively-once semantics, and a principal-side fail-safe that holds without a working reverse channel. Every admissible obligation is applied, explicitly declined, or escalated to the principal; none is silently lost. We instantiate the framework on two governance invariants, Anumati (consent) and Phala (welfare feedback), as extensions to the Agent2Agent protocol and the Model Context Protocol. v2: - expands motivation with the edge-deployment setting and the current IETF drafts mapping agent protocols onto MOQ; - adds §2.5 (transport progress does not narrow the gap) and the custody-plus-leases edge pattern in §4.1; - specifies custodian behavior on `deferred` acknowledgments; - makes decline handling normative (v1 discharged custody on a decline without principal-side protection; v2 requires `safe(O)` by default or a surfaced principal decision, never a silently ignored decline); - adds receiver-side deadline expiry and the late-acknowledgment reconciliation, bounding that race to over-protection; - adds the two-sided supersession guard, making application last-writer-wins per governed key on both sides, so neither a timed-out obligation's `safe(O)` nor an out-of-order delivery can regress a newer decision; - restates the spurious-escalation bound over round-trip time rather than forward delay and differentiates its cost by polarity (for fail-closed invariants the withhold already stands, so no state changes); - makes explicit that custody is end-to-end and never transferred to intermediaries, unlike DTN's hop-by-hop custody; - states the dual-write boundary of AB-3 for external, non-transactional effects, the mechanisms that restore effectively-once application there, and the conditions outside which effectively-once is explicitly not claimed; - corrects the admissibility of consent grants (inadmissible under AC-1, like token issuance; v1 classified Anumati as admissible as a whole); - adds the `_meta` mapping for the MCP binding, with envelope-before-request ordering at the receiver; - states the `max_retries` sizing rule in AB-2. The custody state machine and invariants AB-1 through AB-4 as model-checked are unchanged from v1.