Bounded Action Schemas and Validation
The typed contracts that define every copilot tool call — arguments, ranges, side-effect flags — and reject anything malformed before it runs.
A schema per tool
Every copilot tool is defined by a machine-checkable schema. The schema fixes the argument names and types, the valid ranges for physical arguments, whether the tool has a side effect, and the resource bounds. A tool call is validated against its schema before execution; a call that omits a required argument, uses an out-of-range value, or claims the wrong class is rejected and returned to the planner as an error to reason about.
Why ranges live in the schema
Physical arguments carry hard ranges drawn from the machine's canon and the certified envelope. A proposed plasma-current setpoint above the breeder's 9.66 MA design point, or a plug-field argument above the burner's 26.49 T, fails schema validation before it ever reaches L4. This is a first, cheap line of defense: obviously invalid actions never become proposals.
{
"tool": "propose.set_current_reference",
"class": "propose",
"args": {
"machine": {"enum": ["breeder"]},
"Ip_MA": {"type": "number", "min": 0, "max": 9.66},
"dIpdt": {"type": "number", "max": "ramp_limit"}
},
"side_effect": true,
"authorization": ["L4", "human"]
}Validation pipeline
- Structural: required args present, types correct, class matches
- Range: physical args inside canonical and envelope bounds
- Consistency: args mutually consistent (e.g. machine matches tool)
- Authorization tag: side-effecting tools must declare L4 + human
| Well-typed | In-range | Side-effect declared | Result |
|---|---|---|---|
| 1 | 1 | n/a (read) | execute |
| 1 | 1 | 1 | forward to L4 |
| 1 | 0 | 1 | reject (out of bounds) |
| 0 | - | - | reject (malformed) |
Schema validation is deterministic and lives outside the model, so a copilot cannot argue its way past it. It complements — it does not replace — the semantic checks L4 performs (envelope membership over the full state, authorization, rate limiting). Together they form defense in depth: the schema stops the malformed and the obviously invalid; envelope checks and L4 authorization stop the contextually unsafe.