Frame Chains: Self-Healing, Leader-Redundant Orchestration of a Distributed AI Estate via Signed Content-Addressed Frame Chains

Kody Wildfeuer · RapterBox LLC · First public disclosure: August 27, 2026

Preprint. Conceived and reduced to practice 2026-08-24/25 on the author's eight-device estate; the engineering record of every experiment below is maintained by the author. The substrate protocol (rapp/1) is separately published at github.com/kody-w/rapp-1; this paper discloses the orchestration methods built on it. © 2026 RapterBox LLC.

Abstract

AI agents now accumulate on personal and organizational devices the way services once accumulated on servers: organically, unwatched, and drifting. We present frame chains, an orchestration architecture that maintains a heterogeneous fleet of AI agents and devices (an “AI estate”) as verifiable state on an append-only, cryptographically content-addressed substrate — with no central server, no election traffic, and no reliance on synchronized clocks. One signed genesis frame (a scan tile) fans an estate-wide observation across devices; child frames return findings content-linked to the tile; a deterministic merge yields a single report whose payload (the data exhaust) is the sole trigger set for subsequent work, making follow-up cost O(delta) rather than O(estate). A homeostatic loop (scan → deterministic repair on isolated branches → diff → append tick) converges the estate to a stable floor without human input. Leadership is governed by lease-and-roster frames with staggered-by-rank succession, structurally preventing split-brain without elections. Because chain validity derives from content addresses rather than recency, a dimension disconnected for arbitrarily long resumes by appending to its own head, and a purely local estate can enrich itself from federated public chains through a one-way membrane. Logical time is carried by the chain itself: on live hardware with a 17.6-second clock disagreement, ordering was unaffected. We report the system reduced to practice on a real eight-device estate: a five-frame verifiable observation across the live fleet; automated healing of compliance findings from 66 to a deterministic floor with convergence declared after two stable ticks; a 29-frame recursive drill that re-dimensioned one drifted node; a five-scenario succession proof; a deterministic no-LLM re-attach of a stranded chain; and an independent-determinism event in which two uncoordinated computations of a migrated identity met byte-identically across the federation.

1 · Introduction

The sprawl is concrete, not hypothetical: on a single owner's estate of eight devices we inventoried roughly twenty undeclared local AI services on one node, autonomous agents running unwatched, four-way version drift, and three incompatible “frame” shapes. The thesis of this work is that estate health should be verifiable state on an append-only substrate — not a dashboard's opinion — and that next actions should derive from a signed state delta, never from polling everything again.

Contributions: scan-tile orchestration; exhaust-driven O(delta) precision; homeostatic convergence; a recursive dimension drill; lease/roster succession without elections; structural (non-temporal) resume; a deterministic re-attach ladder requiring no model judgment; federated read-only enrichment (the membrane); tick-granular logical time with a global heartbeat; and graded merge fidelity between independently formed histories.

2 · Substrate

The substrate is the separately published rapp/1 protocol: content-addressed eleven-key frames, mint-once identity, deterministic eggs, with a public specification, reference implementation, and conformance suite. The substrate is prior art by the same author and is not claimed here; this paper claims the orchestration methods built on it.

#0 genesis is a1b2c3… #1 holds a1b2c3… is d4e5f6… #2 holds d4e5f6… is 7a8b9c… #3 next… holds 7a8b9c… each frame CONTAINS the fingerprint of the one before it — order is structural, not claimed
The substrate in one picture. A frame chain: every entry embeds the SHA-256 fingerprint of its predecessor, so the sequence proves itself — no clock, no server, no trust in whoever wrote it down.

3 · Design

3.1 Scan tiles

One genesis frame describes an estate-wide observation; N devices append child frames content-linked to the tile; a “dreamcatcher” merge produces one report frame. The whole observation is a single verifiable chain.

SCAN TILE is t1a2b3… 💻 mac 🎮 deck 📺 apple-tv child: 4 findings holds t1a2b3… child: 3 findings holds t1a2b3… child: 1 finding holds t1a2b3… REPORT 8 findings (the exhaust)
§3.1 — One question, one chain. The tile asks; every device answers with a child frame that holds the tile's fingerprint; a deterministic merge yields one report. The whole observation verifies end to end.

3.2 Exhaust-driven precision

The report's payload is the only trigger set for the next round: unimplicated nodes bear zero cost, and successive tiles are diffed so work is O(delta), not O(estate). The estate's current truth becomes an addressable object — a virtual table.

the exhaust (last report's payload) mac:4 · deck:3 · tv:1 · bstation:0 · r1:0 💻 macworked 🎮 deckworked 📺 apple-tvworked 🖥 bstationuntouched · 0 cost 🤖 rappteroneuntouched · 0 cost
§3.2 — Work is O(delta), not O(estate). The exhaust is the only trigger set: devices it doesn't name are never invoked. Follow-up cost scales with what changed, not with how big the fleet is.

3.3 Homeostatic convergence

Loop: scan tile → deterministic, identity-preserving repairs on isolated branches → diff against the prior tile → append a tick frame to an append-only history chain. Convergence is declared after K stable ticks. Authority to merge stays with the owner; repairs are reversible.

SCANmint a tile HEALon branches DIFFvs prior tile TICKappend to history …and around again, on its own two stable ticks → CONVERGED → the estate goes quiet
§3.3 — Homeostasis. The loop that ran live: 66 findings → healed floor → quiet, no human in it. Repairs happen on branches; the owner stays the merge authority.

3.4 Recursive dimension drill

An event on the top tile (a drifted node) spawns a finer sub-chain scoped to that node, whose findings are re-dimensioned by required-fix class and reassimilated under the parent. Observation depth is purchased only where events occurred — sparse invocation applied to attention itself.

3.5 Lease/roster succession

Who may mint new intent on a stream is governed by (a) a signed roster frame fixing succession rank, (b) a lease declared in each tick, (c) staggered-by-rank entitlement after expiry (rank r waits (r−1)×grace), and (d) signed succession/resumption frames. Continuation requires no authority; history is never rewritten; latency cannot cause a false takeover; split-brain is structurally impossible with zero election traffic.

rank 1 rank 2 tick · lease tick · lease ✗ leader dies lease expires rank 2 waits its grace succession frame tick · lease ❤️ rank 1 returns — defers to the live lease …until the boundary rank 3 would wait 2× grace — hearing late only ever ADDS waiting. Latency cannot crown anyone.
§3.5 — Succession without elections. The roster is signed in advance; the lease drains in public; ranks act only after their staggered wait; the returning leader re-enters at a boundary with a resumption frame. History is append-only throughout.

3.6 Structural resume and the membrane

Validity is hash-structural, not temporal: a dimension dark for a month resumes by appending to its own head, and parallel dimensions of one organism merge at read time. A fully private estate participates in the global federation read-only — pulling and assimilating public chain data while its own frames never leave the boundary. Disconnection tolerance and privacy are the same mechanism at different budget settings.

YOUR ESTATE (private) its frames never leave 🏠 PUBLIC FEDERATED CHAINS read-only raw data 🌐 reads IN — verified, contradiction-gated ✗ nothing goes out
§3.6 — The membrane. Privacy and enrichment are not a trade-off: the same mechanism that tolerates disconnection makes federation one-way. Reads in; nothing out.

3.7 Deterministic re-attach and the quantum drill

Frames declare their reads as {name → content-address}. A stranded frame conflicts with a candidate base iff the base's upstream declares a different address for a declared read — a pure set intersection, no model judgment. The ladder (local → other local dimensions → federated chains) short-circuits at the first contradiction-free base; a dry hole is a no-op, not an error. Transplants carry grafted_from provenance; superseded originals are preserved. Search is anytime: the first hit bounds latency, and each further non-contradicting dimension found monotonically enriches the frame, re-gated by the contradiction check at merge time — search budget controls completeness, never correctness. An interruption is not an error path but the trigger for assimilation: a frame emerges from disconnection richer, not stalled.

3.8 Tick-granular logical time

The atomic unit of trackable time is the tick frame: one sequence increment, one dependent frame. Ordering authority is the dependency chain, never the wall clock — the timestamp is annotation and sanity bound. A designated global stream beats one discrete anchor per tick; what grows is the anchor's dimension: dependent frames from any device referencing that instant, conflict-gated as always. Resolution is fractal on demand (sub-tick anchors under a covering tick). Ownership of a timeline vests at spine genesis and deepens by continuity of stewardship and adoption, not tick density.

tick N−1 ❄ tick N ❄ tick N+1 ❄ holds holds 💻 mac's frame — holds N 🎮 deck's frame — holds N 📺 tv arrives LATE — still attaches
§3.8 — The chain is the clock. Each anchor is frozen at mint; what grows is its dimension — frames from any device attaching to that instant, conflict-gated. On real hardware, a 17.6-second clock error changed nothing.

3.9 Merge fidelity

When two frame histories that formed with no contact meet, the boolean drill generalizes to a graded score: join both histories on the tick key; a dimension is mergeable iff its declarations are contradiction-free across every shared tick; the score is mergeable over shared dimensions. Aligned dimensions merge and continue; conflicted ones remain parallel, never forced; one-sided dimensions assimilate freely. The computation is deterministic on every node.

3.10 A practice note: heterogeneous chains

Because history is corrected by appending amendment frames rather than editing, every long-lived stream becomes heterogeneous, and consumers must filter by kind. Observed live: a single correction frame crashed an unrelated trend computation that assumed homogeneity. The append-only law is sound; the cost it imposes is kind-aware readers.

4 · Reduction to practice

  1. Estate survey: eight devices, five reachable over the private network; the sprawl inventory above.
  2. Scan tile, live: one genesis frame across all reachable devices produced a five-frame chain, every frame verified by the reference implementation; 15 artifact-bearing repositories; 66 non-compliant findings across six rules.
  3. Healing: exhaust-driven deterministic repairs on isolated branches took findings 66 → 35 on healable repositories; a collision rule correctly skipped a repository with uncommitted changes; nothing was pushed; the owner authorizes by merge.
  4. Homeostasis, live: tick 0 (66) → tick 1 (55 effective) → tick 2 converged — the estate healed to its deterministic floor and went quiet without human input; hourly automation armed.
  5. Drill: a single DRIFT(27) event spawned a 29-frame verifying sub-chain that re-dimensioned 27 opaque findings into required-fix classes.
  6. Succession: a five-scenario harness passed in full — a follower refused to mint during a live lease; rank 2 succeeded only after lease+grace; a returned leader deferred to the live interim lease; rank 1 reclaimed at the lease boundary; all chains verify and history was never rewritten — plus a single-node live run under a real two-hour lease. Honest denominator: fleet rollout staged, not yet fleet-live at time of writing.
  7. Structural resume: a stream dark across a simulated month re-appended to its own head; both dimensions verify in parallel.
  8. Deterministic re-attach, live: a stranded genesis chain re-attached with no model call; candidate 0 was rejected on a real content-hash conflict; the grafted chain was judged compliant by the oracle; provenance was bridged and the superseded original preserved.
  9. Federated pull and independent determinism: a global public chain was continued locally as if nothing changed — and the pulled stream's derived identity was byte-identical to a tail derived independently hours earlier by a separate computation. Two uncoordinated derivations, one answer, met across the federation.
  10. Heartbeat on real hardware: tick anchors minted under a live lease; frames minted on three machines; one clock was 17,620 ms off and ordering was unaffected — the chain is the clock; a sealed tick's dimension grew late with its anchor byte-identical; a contradicting read was refused while an agreeing read attached; spine and dimensions verify. A global spine runs live with CI verification and a ten-minute beat.
  11. Merge fidelity: two independently formed estates scored 0.667 — roster and notes merged, configuration parked parallel on a real contradiction, disjoint dimensions imported.

5 · Related work and position

Shipped systems coordinate by isolation (parallel coding agents in per-agent worktrees; vendor guidance describes that design as not an agent orchestration system), by conversation, or by a central runtime. The 2026 research trend — CRDT-based agent memory, event-sourced message pools — converges on pieces of this pattern but is unshipped. The claim here is architectural rather than “faster”: partition-native, O(delta) by construction, verifiable end-to-end, self-healing, with election-free leader redundancy, as a working combination on a signed content-addressed substrate with an identity law.

6 · Limitations

Single-owner estate; one evaluator; succession fleet rollout pending; scale unmeasured beyond eight devices; the healing floor is the oracle's, not an absolute; anytime enrichment trades completeness against search budget by design.

7 · Conclusion

An AI estate can govern itself the way its artifacts are addressed: by content, on chains, with authority carried in frames rather than in servers or clocks. Interruption becomes the trigger for enrichment; recovery and growth are the same operation.