[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82836-en":3,"doc-seo-82836-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82836,5909877438554,"Maeve","https://ap-avatar.wpscdn.com/avatar/5600025385ad2bf12a7?_k=1778553567797529272",8,"Research & Report","Governed Caste Reassignment in Heterogeneous Swarms","Heterogeneous robot swarms require frequent caste (role) reassignment as constraints change, but regulated deployments demand externally authorised and cryptographically auditable governance whenever a transition increases privileges. This work proposes an asymmetric-trust protocol that auto-admits safe, privilege-tightening reassignments and requires operator countersignature for bounded privilege relaxation. Each transition emits a hash-chained, Merkle-committed cause-chain signed with operator assurance, enabling offline verification by an external auditor and preventing key attacks such as privilege escalation and audit forgery.","arXiv :2607 .04634v 1 [ cs .RO] 6 Jul 2026  \nGoverned Caste Reassignment in Heterogeneous Swarms: An Asymmetric-Trust Protocol with Audited Operator Countersignature  \nXue Qin 1 , Simin Luan2 , Cong Yang3*, Zhijun Li2*  \n1* School of Software, Harbin Institute of Technology, Harbin, China.  \n2 School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China.  \n3 School of Future Science and Engineering, Soochow University, Suzhou, China.  \n*Corresponding author(s). E-mail(s): [cong.yang@suda.edu.cn](cong.yang@suda.edu.cn) ; [lizhijunos@hit.edu.cn](lizhijunos@hit.edu.cn) ;  \nContributing authors: [qinxue@me.com](qinxue@me.com) ; [luansiminiot@gmail.com](luansiminiot@gmail.com) ;  \nAbstract  \nIn heterogeneous robot swarms, caste reassignment is a high-frequency runtime event: battery depletion forces a logistics-caste robot into a low-power patrol caste; a payload limit forces a heavy-lift caste robot into an observation caste. Existing approaches treat reassignment as an internal allocation algorithm (auction, consensus bundle, behaviour-tree) and do not expose the reassignment event to external authority. We argue that for regulated embodied deployments a caste change that elevates a robot’s privilege envelope is a governance event that must be auditable and externally authorised. We propose an asymmetric-trust protocol in which auto-tightening reassignments (going to safer or lower-privilege castes) are admitted automatically while bounded relaxation (going to higherprivilege castes) requires operator countersignature. The protocol carries a signed cause-chain documenting why each reassignment was needed; the chain is a hashchained, Merkle-committed audit log verifiable offline against the operator’s key. We evaluate a reference implementation with real Ed25519 signatures and a hash-chained Merkle audit log, in simulation over fleets up to 100 robots with a parameterized robot-class timing point at 10 robots (slower signatures, heavier wireless variance; not a hardware measurement): auto-tightening completes in single-digit to low-double-digit milliseconds and the audit gate adds single-digit to low-double-digit milliseconds over an ungoverned reassignment (growing with  \n1  \nCause-Chain Record obs, hi , c, c0 , t, class, i , O? , F  \nFleet Audit Chain (operator-signed Merkle root per epoch)  \nExternal Regulator / Auditor  \nFig. 1 Governed caste reassignment, overview. A proposed caste transition c → c′ is classified locally and mechanically against the operator-declared privilege lattice (P, ⪯) into one of three classes (autotighten, bounded-relax, operator-only) . Each class is admitted through a different authorisation path: tightening is permissionless, bounded relaxation requires an operator countersignature against a peraxis bound Bα, and operator-only admission requires explicit certificate issuance. Every transition produces a cause-chain record carrying the triggering observation, the proposing robot’s identity hash, the source and target castes, the class, the robot signature, and the operator countersignature (if any), appended to the fleet-level audit chain whose per-epoch Merkle root the operator signs and which is presentable to an external regulator.  \nfleet size) . The protocol refuses all four explicit attack patterns (caste laundering, repeated-relaxation privilege escalation, operator impersonation, and cause-chain forgery) by construction; a partially-governed baseline isolates which gate stops which attack, a real offline auditor reconstructs and verifies every record and rejects tampering, and forged tighten records never reach the Byzantine quorum.  \nThe construction generalises a single-agent persona-mutation governance gate to swarm-level caste governance.  \nKeywords: Multi-Agent Systems, Role Reassignment, Adjustable Autonomy,  \nOperator Authority, Cryptographic Audit, Governed Heterogeneous Swarms,  \nAsymmetric-Trust Protocol  \n1 Introduction  \nA heterogeneous robot swarm ope","cbCaiugpGscCT6XI","https://ap.wps.com/l/cbCaiugpGscCT6XI","pdf",669073,1,28,"English","en",105,"# Abstract\n# Keywords\n# 1 Introduction","[{\"question\":\"Why is caste reassignment considered a governance event in regulated robot deployments?\",\"answer\":\"When a reassignment elevates a robot’s privilege envelope, it changes the robot’s permission level and therefore requires auditable governance and external authorisation rather than purely internal allocation.\"},{\"question\":\"How does the asymmetric-trust protocol decide whether operator countersignature is needed?\",\"answer\":\"Transitions are classified against an operator-declared privilege lattice into autotighten, bounded-relax, or operator-only. Tightening is permissionless, bounded relaxation needs operator countersignature within per-axis bounds, and operator-only admission requires explicit certificate issuance.\"},{\"question\":\"What mechanism ensures the auditability and integrity of each reassignment event?\",\"answer\":\"Each transition generates a signed cause-chain that is hash-chained and Merkle-committed into a fleet audit log. An offline auditor can reconstruct and verify records against the operator’s key and reject any tampering or forged transitions.\"}]",1784183327,71,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"governed-caste-reassignment-in-heterogeneous-swarms","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/governed-caste-reassignment-in-heterogeneous-swarms/82836/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"Why is caste reassignment considered a governance event in regulated robot deployments?","Question",{"text":74,"@type":75},"When a reassignment elevates a robot’s privilege envelope, it changes the robot’s permission level and therefore requires auditable governance and external authorisation rather than purely internal allocation.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"How does the asymmetric-trust protocol decide whether operator countersignature is needed?",{"text":79,"@type":75},"Transitions are classified against an operator-declared privilege lattice into autotighten, bounded-relax, or operator-only. Tightening is permissionless, bounded relaxation needs operator countersignature within per-axis bounds, and operator-only admission requires explicit certificate issuance.",{"name":81,"@type":72,"acceptedAnswer":82},"What mechanism ensures the auditability and integrity of each reassignment event?",{"text":83,"@type":75},"Each transition generates a signed cause-chain that is hash-chained and Merkle-committed into a fleet audit log. An offline auditor can reconstruct and verify records against the operator’s key and reject any tampering or forged transitions.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":105,"slug":137},19,"General","general"]