An Uncertainty-Aware Resilience Micro-Agent for Causal Observability in the Computing Continuum Suvi De Silva‡ , Alfreds Lapkovskis‡ , Alaa Saleh† , Sasu Tarkoma† , and Praveen Kumar Donta‡ ‡ Department of Computer Systems and Sciences, Stockholm University, Stockholm 164 25, Sweden
arXiv:2605.10718v1 [cs.DC] 11 May 2026
[email protected], {alfreds.lapkovskis, praveen}@dsv.su.se † Department of Computer Science, University of Helsinki, Helsinki 00014, Finland {alaa.saleh, sasu.tarkoma}@helsinki.fi
Abstract—Grey failures in the computing continuum produce ambiguous overlapping symptoms that existing approaches fail to diagnose reliably, either due to a lack of causal awareness or acting under high epistemic uncertainty, risking destructive interventions. This paper presents an uncertainty-aware resilience micro-agent for causal observability (AURORA), a lightweight framework for diagnosing and mitigating grey failures in edge-tier environments. The framework employs parallel micro-agents that integrate the free-energy principle, causal do-calculus, and localized causal state-graphs to support counterfactual root-cause analysis within each fault’s Markov blanket. Restricting inference to causally relevant variables reduces computational overhead while preserving diagnostic fidelity. AURORA further introduces a dual-gated execution mechanism that authorizes remediation only when causal confidence is high and predicted epistemic uncertainty is bounded; otherwise, it abstains from local intervention and escalates the diagnostic payload to the fog tier. Our experiments demonstrate that AURORA outperforms baselines, achieving a 0% destructive action rate, while maintaining 62.0% repair accuracy and a 3ms mean time to repair. Index Terms—Active Inference, Bayesian Networks, Computing Continuum, Micro-Agent, Resilience
I. I NTRODUCTION OMPUTING continuum enables services to place computation closer to data sources while retaining access to higher-capacity processing resources when needed. However, heterogeneity also complicates runtime resilience, as faults may arise from interactions among constrained compute resources, variable network conditions, and tierdependent orchestration policies [1]. A major challenge in such environments is the occurrence of gray failures [2], including network congestion, CPU contention, and memory leakage, which can produce overlapping symptoms such as throughput degradation, increased latency, and servicelevel objective (SLO) violations. Because these symptoms can also arise from transient workload fluctuations, reliable diagnosis requires causal reasoning rather than relying solely on threshold-based or correlation-driven monitoring. Research on resilience in the computing continuum is still emerging; accordingly, this section reviews the most recent and closely related works. Donta et al. [3] introduced a big data approach to the governance and sustainability
C
of distributed continuum systems. While providing a robust, high-level control plane for data lifecycle management, this macro-level governance approach faces challenges in executing real-time, autonomous triage natively on strictly resource-constrained edge devices. Further, [2], [4] construct causal fault graphs from operational logs and manage epistemic uncertainty through Markov blankets, demonstrating the feasibility of active inference (AIF) on resource-constrained edge hardware. Decentralized multiagent frameworks such as Symphony [5] further show that lightweight coordination can be distributed across edge nodes to reduce single-node processing bottlenecks. However, these approaches do not explicitly regulate remediation under diagnostic uncertainty. To address scalability, Saleh et al. [6] proposed a bio-inspired agentic self-healing framework that provides an organically adaptable topology. Similarly, Ye et al. [7] advanced the domain by proposing a neuro-symbolic approach to trustworthy self-healing, enhancing logical rule mapping to neural observations. While highly innovative, these architectures are computationally heavy and lack explicit mathematical safety bounds that prevent an agent from acting when epistemic uncertainty is dangerously high. Further, rule-based policies and static thresholds that map symptoms to predefined remediation actions [8], [9]. However, without causal representation, they cannot reliably distinguish among competing fault hypotheses, leading to remediation being triggered under uncertainty and potentially missing the true root cause. In grey failure scenarios, incorrect interventions may restart healthy services, obscure faults through threshold changes, or propagate contention through workload redistribution. This limitation is especially critical at the edge, where constrained CPU, memory, and energy limit the use of heavyweight diagnostic models, motivating lightweight, uncertainty-aware resilience mechanisms. In this context, we present an uncertainty-aware resilience micro-agent for causal observability (AURORA), a lightweight framework for failure diagnosis and mitigation at the edge. The main technical contributions are summarized as follows:
AURORA defines a lightweight parallel micro-agent architecture for grey failure management, in which agents perform localized causal observability and AIFbased recovery reasoning under posterior fault belief and epistemic uncertainty. • It constructs causal models using Bayesian networks (BNs) with Markov blanket-constrained inference to enable bounded-complexity, real-time counterfactual rootcause diagnosis via do-calculus. • AURORA introduces a dual-gated execution mechanism that authorizes local recovery only when the inferred causal hypothesis satisfies a posterior confidence constraint, and the candidate intervention satisfies a bounded variational-free-energy (VFE) criterion; otherwise, unresolved cases are escalated to the fog tier. The remainder of this paper is organized as follows. Section II presents the preliminary technical foundations of AURORA. Section III describes the proposed AURORA framework. Section IV presents the results and discussion. Finally, Section V concludes the paper and outlines future directions. •
II. P RELIMINARIES This section summarizes AURORA’s technical foundations. Some design choices follow Sedlak et al. [10]. A. Bayesian Networks and Posterior Queries A BN [11] is a directed acyclic graph (DAG) in which nodes represent random variables, and edges encode conditional dependencies. Given observed evidence X, posterior inference over a target variable Y follows P (Y | X) ∝ P (X | Y ) P (Y ).
(1)
In practice, posterior queries are computed via variable elimination, which marginalizes out non-target variables in a fixed elimination order [11]. B. Structure Learning and BIC BN structure can be learned from data using Bayesian network structure learning (BNSL) [12]. AURORA uses hillclimbing search scored by the Bayesian information criterion (BIC), which balances goodness-of-fit against model complexity to prevent overfitting on data-sparse edge devices [10]. C. Markov Blankets The Markov blanket MB(v) of a node v consists of its parents, children, and co-parents in the DAG, and satisfies: P (v | V \ v) = P (v | MB(v)) .
(2)
This conditional independence allows posterior inference over v to be restricted to MB(v) without loss of accuracy [13], [14], making real-time causal inference tractable on resource-constrained devices.
D. Pearl’s do-Calculus Pearl’s do-calculus [15] formalizes intervention reasoning. The operator do(X = x) sets X to x by severing its incoming DAG edges, thereby blocking non-causal paths: P (Y = y | do(x))
(3)
estimates the probability of Y = y if action x is applied, without executing it on the live system. This is the quantity that AURORA’s safety gate evaluates before dispatching any remediation. E. Active Inference and Variational Free Energy AIF [16] is a neuroscience-grounded framework in which an agent minimizes its VFE, a measure of surprise between its generative model and observations. Given approximate posterior Q(s) over latent states s and generative model P (o, s) with observations o, VFE is defined as F ≜ EQ(s) [ln Q(s) − ln P (o, s)] .
(4)
Low VFE indicates that the agent’s model is consistent with current observations; high VFE signals epistemic surprise. AURORA uses F as a second safety gate: an action is authorized only when its predicted post-intervention VFE remains below a threshold, ensuring the model is calibrated before any physical remediation is executed. For the full AIF cycle and its application to edge SLO enforcement, see [10]. III. P ROPOSED AURORA F RAMEWORK The design of AURORA is motivated by a fundamental tension in edge computing. Edge devices must diagnose and resolve faults autonomously, without incurring the roundtrip latency of a cloud consultation, yet their constrained CPU and memory budgets preclude the exhaustive inference models that reliable autonomous action requires. AURORA addresses this gap through three coordinated design principles: (i) compact causal models that fit the resourceconstrained devices while supporting counterfactual intervention reasoning; (ii) a parallelized, single-responsibility micro-agent pipeline that maximizes observational coverage without creating processing bottlenecks on edge threads; (iii) and a dual-gated execution mechanism that checks the confidence of the inferred root cause and the uncertainty of the proposed remediation before taking action. If either condition is not satisfied, the micro-agent abstains from local remediation and forwards the case for deeper analysis. Fig. 1 illustrates how these principles are distributed across the three tiers of the computing continuum. Diagnostic autonomy is decentralized to the edge tier, where micro-agents perform causal inference directly on live telemetry. When local recovery is probabilistically unviable, as determined by the safety gates, the continuum bridge serializes the diagnostic payload and forwards it to a fog-tier node for deeper analysis. The following subsections describe each component in detail.
Cloud Tier
TABLE I: Action→Patch Map: structural intervention applied by do(a).
Global Log Archival Orchestration
Model Transfer
Fog Tier
Inference Cluster
Action a
Patch applied by do(a)
restart scale_up offload_to_fog reduce_load
{cpu=normal, delay=normal} {memory=normal, cpu=normal} {network_quality=high, delay=normal} {cpu=normal, delay=normal}
Cluster Coordination Knowledge Transfer
Intentional Abstention
Continuum Bridge Fail
Healing Agent
Restart
Fail
Pass
Scale-up
Gate 2 Pass
VFE < Fth?
Reduce Load
Gate 1
Posterior >= τ?
Offload to Fog
Dual-Gate Safety Check dynamic threshold τ scaling
counterfactual best action
Variational Free Energy Compute
do-calculus counterfactual composite ranking score
do-calculus counterfactual
Edge Tier
Best Root Cause
SLO Violated Network Quality
CPU Stress
Delay Memory Leak
.....
Bayesian Network with Markov blanket
Causal Inference Network Delay Agent
Node Load Agent
Camera Traffic Agent
delay > ϕ1, spike
CPU > ϕ2, memory
fps > ϕ4, excess
detected?
> ϕ3?
frames?
Bandwidth Check Agent throughput < ϕ5?
Parallel Observation Layer
Real-time Telemetry fps, delay, throughput, cpu, memory
Fig. 1: AURORA micro-agent pipeline architecture for the computing continuum.
A. Causal Models AURORA requires a diagnostic model that is lightweight, probabilistic, and intervention-aware. The model must run on resource-constrained edge devices, estimate posterior fault probabilities for the safety gates, and support queries about the effect of candidate remediation actions. BNs [11] satisfy these requirements and are therefore used as the causal backbone of AURORA.
Concretely, AURORA represents the runtime system state as a BN over telemetry variables, including CPU utilization, memory usage, network throughput, delay, and a binary SLO outcome node S. Posterior root-cause queries P (C | Ot ) are evaluated over candidate causes C using variable elimination restricted to the Markov blanket MB(S) in Eq. (2), which keeps inference tractable on Raspberry Pi-class edge hardware. Interventional queries P (S = 1 | do(a)) in Eq. (3) are evaluated by graph mutilation, where incoming edges to the intervened variable are removed, and the required adjustment is applied internally. AURORA’s causal graph is pre-specified from domain knowledge and held fixed across trials; only the conditional probability tables are fitted from a held-out training sample. While dynamic structure and parameter learning were investigated as candidate extensions, they were disabled for the reported experiments, as greedy search on small synthetic samples can silently introduce structural errors that can mislead root-cause analysis. Each recovery action is represented as a structural patch, i.e., the set of causal state variables whose values are fixed by the intervention and passed to do(·). Table I summarizes these patches; for example, do(restart) fixes {cpu = normal, delay = normal} in the BN. This mapping allows Gate 2 in Section III-C to compute the expected SLO state under each candidate recovery action before applying the action in the real-time system. B. Parallel Diagnostic Pipeline Given the causal backbone described above, AURORA executes diagnosis and recovery through an ordered microagent pipeline. Observation agents operate in parallel over disjoint system facets, while downstream inference and safety checks proceed sequentially before any recovery action is executed. Fig. 1 illustrates the pipeline transitions, which consist of the following phases. 1) Parallel Diagnostic Monitoring: AURORA begins with telemetry ingestion. At each observation step, the telemetry vector Ot is passed to a coordination agent, which dispatches monitoring tasks to four concurrent singleresponsibility micro-agents. Each micro-agent evaluates a distinct SLO predicate ϕi over a specific system facet, as shown in Fig. 1: • Network Delay Agent: flags when end-to-end delay exceeds ϕ1 ms.
Node Load Agent: flags when CPU utilization exceeds ϕ2 or memory utilization exceeds ϕ3 . • Camera Traffic Agent: flags when per-camera frame rate exceeds ϕ4 fps, (from our use case in the experiments). • Bandwidth Check Agent: flags when throughput drops below ϕ5 MB/s. Partitioning telemetry into four facets limits each microagent to the metrics required for its SLO predicate, reducing per-agent state and avoiding a serial monitoring bottleneck on the edge device. It also decouples the thresholds ϕi , allowing each predicate to be tuned independently without affecting the remaining detection logic. When a predicate is violated, the corresponding micro-agent emits an anomaly flag. The coordination agent aggregates these flags into an anomaly vector At ⊆ Ot and forwards it to the next stage only if At ̸= ∅, thereby bypassing causal inference during nominal operation. 2) Causal Inference and Root Cause Extraction: Let S ∈ {0, 1} denote a binary SLO random variable, where 1 indicates fulfillment and 0 violation. Upon receiving anomaly vector At ̸= ∅, a dedicated inference agent first queries the Markov-blanket-bounded BN B for the posterior distribution over candidate root causes C ∈ MB(S), as shown in Eq. (5), •
P (C | Ot ) ∝ P (Ot | C) P (C).
(5)
Markov blanket restriction makes variable elimination feasible on resource-constrained devices, since nodes outside the blanket are conditionally independent of the symptom, as defined in Eq. (2), and can be excluded without loss of diagnostic accuracy. Although the Markov blanket posterior provides a tractable estimate of candidate root causes, posterior probability alone can be insufficient for ranking faults under greyfailure conditions. Multiple SLO predicates may degrade concurrently, and telemetry variables may remain correlated across fault classes, causing the posterior to favor a plausible but incorrect hypothesis, such as attributing a delay spike to CPU contention when the actual cause is bandwidth degradation. To reduce this correlation-induced ambiguity, AURORA ranks each candidate cause using an interventional contrast. This score measures the change in symptom probability between the observed state and a benign counterfactual assignment of C under the do-operator. Since the intervention severs incoming causal links to C, the score suppresses associations induced by common ancestors and emphasizes the causal effect of C on the observed symptom. The interventional contrast is defined as ∆(C) ≜ P (S = 0 | do(C = vobs ), Z) −P (S = 0 | do(C = vbenign ), Z) ,
(6)
where Z is the conditioning set obtained by removing C, its descendants, and S from Ot . Conditioning on a descendant
of the intervened variable would open a non-causal path and bias the contrast, so descendant pruning of Z is required for the contrast to be a valid causal-effect estimate. Each candidate cause is then assigned a composite score ρ(C) that combines interventional contrast with supporting diagnostic evidence. This score integrates the estimated causal effect of C on the symptom with corroborating posterior and telemetry-based signals, providing a more stable ranking under correlated grey-failure observations. The score is defined as ρ(C) ≜ w1 ∆(C)+w2 σ(C)+w3 1 [C ∈ Pa(S)]+r(C) (7) where ∆(C) denotes the interventional contrast, σ(C) ∈ [0, 1] is the normalized observed severity of candidate cause C, 1 [C ∈ Pa(S)] assigns an additional weight to direct parents of the symptom node S, and r(C) is structural prior r(C) that assigns bonus for root nodes in B and penalty for mediator nodes, reflecting the assumption that true fault causes are more likely to originate at source nodes than along intermediate causal paths. The weights w1 + w2 + w3 = 1.0 control the relative contributions of causal contrast, observed severity, and direct-parent evidence, respectively. The topranked cause is selected as Cbest ≜ arg maxC ρ(C), and its posterior probability Pmax is forwarded to the dual-gated safety evaluation. C. Dual-Gated AIF and Dynamic Scaling The dual-gated design is motivated by the distinction between diagnostic confidence and intervention reliability. Existing AIF-based frameworks [2], [10] typically authorize execution using the maximum posterior probability Pmax , allowing the agent to act when the inferred root cause is sufficiently probable. Although this tests diagnostic certainty, it does not verify whether the generative model can reliably predict the effect of the selected action under the current system state. In grey-failure conditions, posterior belief may concentrate on a plausible cause even when the model remains poorly calibrated to the observed dynamics, increasing the risk of unsafe recovery actions. AURORA addresses this limitation through a second gate based on VFE. Gate 1 verifies that the diagnosis is sufficiently confident, while Gate 2 verifies that the predicted intervention remains consistent with the current observations. The complete procedure is formalized in Algorithm 1. 1) Dual-Gated Safety Mechanism: The two gates are deliberately chosen to enforce orthogonal safety properties. Gate 1 is a diagnostic-ambiguity test that operates on the posterior over causes, P (C | Ot ); it can be satisfied by any sharply concentrated posterior. Gate 2 is a model-consistency test that operates on the post-intervention generative model; it can be satisfied only when the proposed action’s predicted effects are consistent with the current observations. Either failure mode alone is sufficient to trigger a destructive intervention: a concentrated but incorrect posterior may bypass
Algorithm 1 AURORA Dual-Gated Active Inference Loop Require: Observation Ot ; Bayesian Network B; gate parameters τbase , τmin , λ, Fth Ensure: Mitigation action a∗ or abstention signal ⊥ 1: if Ot shows no SLO violation then 2: return HEALTHY 3: end if 4: // Stage 1: Parallel Monitoring & Posterior Ranking 5: At ← ParallelMonitor(Ot , {ϕi }5i=1 ) {anomaly vector} 6: P (Ci | Ot ) ∝ P (Ot | Ci ) P (Ci ), ∀Ci ∈ MB(S) {Eq. (5), exact via Variable Elimination} 7: C(1) ← arg maxi ρ(Ci ) {top-ranked cause, Eq. (7)} 8: Pmax ← P (C(1) | Ot ) 9: // Stage 2: Action-Conditional Free-Energy Decomposition 10: a ← π(C(1) ) {policy lookup; patch from Table I} 11: (Fpragmatic , Fepistemic ) ← VFEDecompose(B, Ot , a) {Eqs. (8), (9)} 12: F ← Fpragmatic + Fepistemic 13: // Stage 3: Dynamic Threshold Scaling 14: τ ← max(τmin , τbase − λ · min(|At | − 1, 2)) {Eq. (11)} 15: // Stage 4: Dual-Gated Safety Check 16: if Pmax < τ then 17: return ⊥low-certainty {Posterior Certainty Gate → fog tier} 18: else if F ≥ Fth then 19: return ⊥high-VFE {VFE Safety Gate → fog tier} 20: else 21: a∗ ← a {both gates passed} 22: Execute(a∗ on affected node) 23: return a∗ 24: end if
Gate 1, while an inconsistent generative model may bypass Gate 2. Therefore, both gates must pass for execution to proceed. The Posterior Certainty Gate (Gate 1) enforces Pmax ≥ τ , where τ is the certainty threshold with default value τbase . When the maximum posterior falls below this threshold, the posterior mass is spread across multiple root-cause hypotheses, indicating that the agent cannot reliably distinguish which fault class it is observing. Because incorrect mitigations in a heterogeneous multi-tier environment frequently amplify the original fault rather than resolving it, Gate 1 treats diagnostic ambiguity as a sufficient reason for abstention. The VFE Safety Gate (Gate 2) addresses a failure mode that Gate 1 cannot catch: a confident diagnosis whose predicted effects under action are inconsistent with the observed telemetry. This gate computes VFE F . For the gate to be op-
erationally useful on edge hardware, AURORA decomposes F into two additive terms Fpragmatic and Fepistemic , defined as Fpragmatic ≜ − log P (S = 1 | do(a), E) , 1 X DKL [Ppost (v) ∥ Ppre (v)] , Fepistemic ≜ ′ |V | ′
(8) (9)
v∈V
where a is a mitigation action, E is the current evidence with S = 0 and the intervened variable removed, V ′ is the set of non-target nodes in B, and Ppost , Ppre are the predictive marginals after and before applying the action’s patch from Table I. Fpragmatic penalizes actions whose predicted postintervention SLO recovery probability is low, while Fepistemic penalizes actions that destabilize the model’s posterior across the rest of the network, regardless of whether they are individually beneficial. The total VFE score is defined as F ≜ Fpragmatic + Fepistemic .
(10)
If F < Fth , the candidate intervention is treated as epistemically admissible, and execution proceeds. The threshold is selected based on the separation observed between the VFE distributions of safe and unsafe recovery outcomes during simulation, so that actions with high predictive inconsistency are rejected. Otherwise, AURORA abstains from local execution. This VFE-based gate is the primary mechanism that prevents destructive interventions. 2) Dynamic Threshold Scaling: A fixed certainty threshold introduces a practical problem in severe multi-fault scenarios. When several SLOs are simultaneously violated, as frequently occurs during cascading grey failures, the posterior distribution over root causes is naturally flatter: multiple concurrent anomaly signals are consistent with several overlapping fault hypotheses, so no single hypothesis accumulates the posterior mass required by τbase . Applying the base threshold rigidly in this regime would cause AURORA to abstain from nearly every multi-fault scenario, including cases where one root cause is clearly dominant and partial intervention is operationally necessary to prevent total service collapse. To address this, AURORA relaxes the Gate 1 certainty threshold as a bounded linear function of the anomaly count n: τ = max(τmin , τbase − λ · min(n − 1, 2)) ,
(11)
where τbase is the base threshold value, τmin is the minimal threshold, and λ is a constant that weights the impact of anomaly count. The linear schedule is used because posterior concentration decreases approximately linearly as concurrent anomalies increase in our simulations, making Eq. (11) consistent with the observed uncertainty trend. The function is also monotone, bounded, and simple to audit on edge hardware, which is important when the threshold controls recovery execution. The clipping term min(n − 1, 2) limits relaxation to two additional anomalies, so τ reaches its lower bound for n ≥ 3. The lower bound τmin preserves
a minimum confidence requirement, ensuring that recovery is not authorized when the posterior remains broadly ambiguous. Importantly, Gate 2 is not relaxed with τ . Even under multiple concurrent anomalies, a candidate recovery action is executed only if it satisfies F < Fth , ensuring that increased responsiveness does not bypass the modelconsistency check. 3) Mitigation or Intentional Abstention: If both safety gates are satisfied (Algorithm 1, line 21), the mitigation agent selects the action that maximizes the do-calculus posterior of SLO recovery [15], a∗ = arg max P (S = 1 | do(a)) , a
where do(a) applies the structural patch listed in Table I, and dispatches the corresponding remediation script. Conversely, if either safety constraint is violated, the framework formally engages the abstention paradigm: the edge node halts local execution, serializes the diagnostic payload ⟨Ot , P (C | Ot ), Cbest , F ⟩, and offloads it via the continuum bridge to a fog-tier orchestration node [2], [6]. This structured handoff reflects a deliberate design choice: rather than treating uncertainty as an error state to be suppressed, AURORA treats it as a signal that the diagnostic problem exceeds the local capacity of the edge tier, and routes it to the tier best equipped to resolve it. The result is a graceful degradation of autonomy across the continuum, rather than a binary choice between blind local action and high-latency cloud escalation. The design and evaluation of fog-tier re-inference from the escalated payload, as well as the cloud-tier orchestration and global-log-archival layers depicted in Fig. 1, are out of scope for this paper and constitute a natural direction for future work. The present contribution evaluates AURORA’s edgetier diagnosis and safety-gate behavior. IV. R ESULTS AND D ISCUSSION A. Simulation setup To evaluate the proposed AURORA framework, we modeled a computing continuum environment and implemented it as a Python-based simulator. The environment emulates telemetry from a resource-constrained video-streaming edge device, such as a Raspberry Pi 4, and generates runtime state vectors comprising CPU utilization, memory usage, transmission delay, frame rate, and network throughput. Nominal operating states are sampled around predefined SLO thresholds using Gaussian perturbations, after which controlled grey-failure conditions are injected into selected telemetry dimensions. The evaluation includes 30,006 independent Monte Carlo trials, with 10,002 trials per agent variant (3,334 per fault type). In each trial, an agent observes the synthesized telemetry state, performs a diagnosis, and either executes a recovery action or abstains according to its decision logic. All experimental parameter values are listed in Table II. The SLO thresholds ϕ1 –ϕ5 were grounded in
TABLE II: Experimental parameters. Parameter
Value
SLO Thresholds ϕ1 33 ms ϕ2 85 % ϕ3 85 % ϕ4 35 fps ϕ5 1.6 MB/s
Description Network delay threshold CPU saturation threshold Memory saturation threshold Camera over-rate threshold Bandwidth shortage threshold
Root-Cause Ranking Weights (Eq. 7) w1 0.65 Causal contrast weight w2 0.25 Observation severity weight w3 0.10 Direct-parent weight r(·)root +0.15 Root-node bonus r(·)mediator −0.10 Mediator-node penalty Gate 1: Posterior Certainty (Eq. 11) τbase 0.70 Base certainty threshold τmin 0.50 Minimum certainty floor λ 0.15 Threshold decay rate Gate 2: VFE Safety Fth 3.85
VFE execution threshold
the physical constraints of the target hardware and stream format. The ranking weights w1 –w2 and structural priors r(C) were assigned by causal evidence strength, with the docalculus contrast weighted most heavily, observed severity as secondary evidence, and a structural bias toward source nodes over downstream mediators. The Gate 1 base threshold requires the top hypothesis to carry substantially more posterior mass than the uniform-prior baseline, the floor is set at the point where the top hypothesis becomes less probable than all alternatives combined, and the decay rate is sized so the threshold reaches the floor when only a few SLO predicates are simultaneously violated. The Gate 2 threshold was selected at the empirical boundary between VFE distributions of safe and unsafe fault classes. The implementation and simulation scripts are publicly available for reproducibility.1 The proposed AURORA framework was subjected to a dynamic, synthetically generated stream of “grey faults.” These faults are characterized by their ambiguous symptoms, which often trigger destructive cascading responses in traditional automated systems. The three fault classes injected during the trials were: • Network Bandwidth: Characterized by elevated delays and collapsed throughput. • Anomalous Processing: Characterized by processing starvation and rapid SLO violations. • Memory Exhaustion: Characterized by compounding RAM exhaustion without immediate bandwidth impacts. B. Baselines AURORA’s performance was formally evaluated against two control baselines representing heuristic and ungated 1 https://github.com/SuviDeSilva94/AURORA
inference-based approaches to edge orchestration: • Rule-Based Agent: A static, heuristic-driven model mapping observed symptoms to predefined actions via rigid thresholds (e.g., if CPU > 80%, execute restart). It possesses no causal reasoning capabilities. • AIF (No Gate) Agent: A standard AIF model that utilizes BNs for root cause isolation but lacks the epistemic safety bounds. It natively executes the mitigation associated with the highest posterior probability without evaluating the VFE limits. C. Numerical Results Table III reports the aggregate metrics for the three agent architectures over the 30,006-trial Monte Carlo evaluation. Fig. 2 further shows the per-trial distributions of the continuous metrics, including VFE score, decision latency, posterior certainty, and outcome score. Together, the table and figure capture both summary performance and variability across the i.i.d. fault samples. 1) Destructive Action Rate: An important metric of success for edge autonomy is preventing actions that exacerbate system instability. In the event of an ambiguous fault (such as misclassifying a network drop as a CPU failure), executing a container restart constitutes a destructive action. AURORA successfully eliminated all destructive actions across the entire 10,002-trial subset, validating the efficacy of the dual-gated execution mechanism. Crucially, because the framework successfully intercepted all deceptive anomalies, 3,411 out of 3,411 executed mitigations were diagnostically correct (Fig. 4a), yielding a 100% action precision rate for actions that passed the dual gate. 2) Resolution Rate: The resolution rate measures the percentage of trials where the agent successfully intervened and resolved the fault. Formally, it is defined as (Nresolved / Ntotal ) × 100, where Nresolved represents the count of true-positive mitigations that successfully recovered SLO compliance. While AURORA possesses the lowest raw resolution rate, this is an expected outcome of its safety architecture. The system is mathematically constrained from guessing under high uncertainty. 3) Abstention Rate: The abstention rate defines the frequency at which the agent explicitly refuses to act due to high epistemic surprise or insufficient causal confidence. The baseline agents act blindly, resulting in their high destructive action rates. AURORA’s 65.9% abstention rate acts as a safety buffer, pausing edge execution and offloading the ambiguous payload to a fog-tier orchestration node for human-in-the-loop or heavy-compute evaluation. Fig. 3 plots each trial in the joint (Pmax , F) decision space and reveals the precise mechanism behind this rate. Of 10,002 trials, the Posterior Certainty Gate fires on 4,433 trials (44.3%) and the VFE Safety Gate fires on 2,158 trials (21.6%). The two gates overlap on a subset and together
account for 100% of AURORA’s abstentions (Fig. 4a). Both gates are operationally active under the studied fault distribution. The dual-gated mechanism is therefore not redundant; each gate contributes distinct trials that the other does not catch. Fig. 4d decomposes each agent’s performance into perfault outcome categories, revealing the precise mechanism behind the aggregate numbers in Table II. The contrast between AIF (No Gate) and AURORA on CPU Spike faults is particularly illustrative: both agents receive identical telemetry, yet AURORA’s VFE gate converts potential destructive actions into safe fog-tier offloads. 4) Accuracy: When evaluating the mean trial score accuracy, the framework assigns partial credit for safe isolation and catastrophic penalties for destructive interventions. Formally, the trial score Si is defined piecewise as +1.0 for a correct mitigation, +0.6 for a safe abstention on a recoverable fault class, +0.25 for a safe abstention on an unrecoverable fault class, +0.15 for an incorrect but benign action, and 0.0 for PaN destructive action. The overall accuracy is defined as N1 i=1 Si . Under this score map, the 3,411 correct AURORA mitigations contribute 3,411 · 1.0, the recoverable-class abstentions on memory-leak trials contribute ∼3,257 · 0.6, and the unrecoverable-class abstentions on CPU-spike trials contribute ∼3,334 · 0.25, summing to 0.620, as demonstrated in Table III. Fig. 4b illustrates perfault accuracy across the agents. AURORA maintains diagnostic accuracy on par with unbounded AIF, demonstrating that the safety constraints do not fundamentally impair the framework’s ability to understand the system state. 5) Mean Time to Repair: Computational latency is a severe bottleneck on edge nodes. As detailed in Fig. 4c, despite the mathematical overhead of calculating Bayesian posteriors, Markov blankets, and VFE constraints, AURORA maintained an average Mean Time to Repair (MTTR) of ∼0.003 seconds. This confirms the computational feasibility of deploying advanced causal mechanisms natively on resource-constrained hardware. D. Discussion and Summary The Fig. 2a provides the mechanistic explanation for AURORA’s abstention behavior. Network-drop trials generate F scores tightly below the gate and execute correctly; CPUspike trials generate uniformly high F and always abstain; memory-leak trials exhibit a bimodal distribution driven by stochastic fault severity. Together with Fig. 2b, this confirms that the two gates measure orthogonal forms of uncertainty: a BN can be simultaneously confident (high Pmax ) and epistemically surprised (high F) when its causal model mismatches the observed telemetry, and only the VFE gate captures this distinction. The results confirm a fundamental trade-off: the more autonomously an agent resolves faults, the more destructive
TABLE III: Aggregated experimental results (10,002 trials per agent)..
Rule-Based AIF (No Gate) AURORA
Repair Acc.
95% CI
Resolution
Destructive
95% Wilson CI
Abstention
95% Wilson CI
MTTR (s)
26.2% 66.7% 62.0%
[25.3%, 27.1%] [65.7%, 67.6%] [61.4%, 62.6%]
46.2% 66.7% 34.1%
33.3% 33.3% 0.0%
[32.4%, 34.3%] [32.4%, 34.3%] [0.00%, 0.04%]
0.0% 0.0% 65.9%
[0.0%, 0.04%] [0.0%, 0.04%] [65.0%, 66.8%]
0.0001 0.003 0.003
Posterior certainty Pmax
1.0
4 F th = 3.85
0.6
2 0
(a) VFE per fault class (AURORA).
0.0
0.4
0.01
0.2
Network Drop CPU Spike Memory Leak
0.6
0.02
0.4
1
0.8
0.03
MTTR (s)
VFE Score F 3
1.0
0.04
0.8 τ = 0.70
Accuracy Si
Agent
Rule-Based AIF (No Gate) AURORA
(b) Posterior certainty Pmax per agent.
0.00
0.2
Rule-Based AIF (No Gate) AURORA
(c) Decision latency per agent.
0.0
Rule-Based AIF (No Gate) AURORA
(d) Per-trial outcome score Si per agent.
Fig. 2: Per-trial distributions over the 10,002-trial Monte Carlo sweep. Each violin estimates the underlying distribution; the inner box reports the median and inter-quartile range with Tukey 1.5×IQR whiskers, with outliers as × markers. Flat distributions reflect constant-by-design agent behavior: network-drop trials produce a single VFE value (F ≈ 3.64); RuleBased certainty is fixed at 1.00 and AIF (No Gate) clips at τ = 0.70. AURORA spans Pmax ∈ [0.54, 0.87].
5 4
High Uncertainty (abstain) Safe Zone (execute)
Correct execution Abstained (high VFE) VFE gate F = 3.85 Certainty gate = 0.7
VFE F
3 2 1 0
0.2
0.3
0.4
0.5
0.6
0.7
Posterior Certainty Pmax
0.8
0.9
Fig. 3: Safety gate decision space for AURORA across all 10,002 trials. Each point is one trial plotted by posterior certainty Pmax (x-axis) and VFE score F (y-axis). Marker shape encodes fault type. The bottom right region marks the joint admissible zone (Pmax ≥ 0.70 and F < 3.85).
actions it risks, and the safer it acts, the fewer faults it resolves. While the standard ungated AIF model successfully resolved 66.7% of anomalies, it did so at an unacceptable cost of a 33.3% destructive action rate, which in a realworld computing continuum could lead to catastrophic cascading network failure. In contrast, AURORA trades a ∼32.6 percentage-point reduction in autonomous blind resolution (as shown in Fig. 4a) for a 100% elimination of destructive actions. Through the “intentional abstention” paradigm, the framework shows that recognizing and bounding uncertainty
is more valuable than forced autonomy in unpredictable grey-fault conditions. Although AURORA demonstrates the feasibility of uncertainty-aware micro-agent resilience at the edge, several limitations remain. The current SLO predicates, recovery actions, action-to-patch mappings, and gate thresholds are manually configured and should be calibrated using representative ground-truth traces for deployment-specific operation. Additionally, the Monte Carlo environment does not fully capture physical edge–fog effects such as telemetry noise, actuation delay, clock drift, contention, and signaling overhead as the number of micro-agents and monitored variables increases. V. C ONCLUSIONS This paper presented AURORA, an uncertainty-aware micro-agent framework for grey failure diagnosis and mitigation on resource-constrained edge devices in the computing continuum. AURORA performs localized causal reasoning without requiring full continuum-wide state evaluation, and its dual-gated execution mechanism permits remediation only when posterior causal confidence is sufficient, and VFE remains bounded; otherwise, unresolved cases are escalated to the fog tier. Monte Carlo evaluation across network collapse, memory leak, and processing spike scenarios showed that AURORA eliminated destructive interventions, achieving a 0.0% destructive action rate compared with 33.3% for rule-based and ungated AIF baselines, while maintaining 62.0% repair accuracy and approximately 3ms MTTR. These results confirm that uncertainty-aware abstention can improve the safety of autonomous edge remediation
High VFE AIF
AURORA
25 CPU Spike
(b)
Rule-Based
4000 3000 2000 1000 0
Correct
Outcome Abstained Destructive
Incorrect
Memory Leak Network Drop (c)
CPU Spike
sed No G AU ate) RO RA
Ba
F(
leRu
le-
Ba
sed No G AU ate) RO RA
F(
Network Drop
AI
CPU Spike
AI
Ru
le-
0.001
F(
0.002
Ba sed No G AU ate) RO RA
MTTR (s)
Trial Count
0.003
0.000
Network Drop
50
(a)
0.004
Memory Leak
75
0
Low Certainty No Abstention
Rule-Based
AI
0
2158 (21.6%)
AURORA
Ru
2000
3411 (34.1%)
Repair Accuracy (%)
Number of Trials
4000
AIF
100
4433 (44.3%)
Memory Leak
(d)
Fig. 4: (a) AURORA’s 10,002 trial outcomes by gate decision. Both safety gates contribute: the Posterior Certainty Gate fires on 4,433 trials (44.3%), the VFE Safety Gate on 2,158 trials (21.6%), with 3,411 trials passing both gates and executing locally. (b) and (c) per-fault repair accuracy and decision latency over 10,002 trials per agent, respectively. (d) Per-fault outcomes across 3,334 trials per fault class per agent.
without imposing significant latency overhead. Future work will focus on deploying AURORA on a physical edge–fog testbed to evaluate performance under realistic conditions and assess scalability under live grey-failure conditions. R EFERENCES [1] M. Khan, F. Sarhaddi, A. Zuniga, H. Flores, S. Tarkoma, and P. Nurmi, “Governance at the edge: Agent-driven privacy mediation for mobile and iot data,” in Proceedings of the 27th International Workshop on Mobile Computing Systems and Applications, pp. 85–90, 2026. [2] P. K. Donta, A. Lapkovskis, E. Mingozzi, and S. Dustdar, “Resilient by design–active inference for distributed continuum intelligence,” arXiv preprint arXiv:2511.07202, 2025. [3] P. K. Donta, B. Sedlak, V. Casamayor Pujol, and S. Dustdar, “Governance and sustainability of distributed continuum systems: A big data approach,” Journal of Big Data, vol. 10, no. 1, p. 53, 2023. [4] N.-M. Rouska, V. Casamayor-Pujol, I. M. de Abril, and S. Dustdar, “Equilibrium-driven antifragility in computing continuum systems,” IEEE Internet Computing, vol. 29, no. 5, pp. 55–64, 2026. [5] J. Wang et al., “Symphony: A decentralized multi-agent framework for scalable collective intelligence,” arXiv preprint arXiv:2508.20019, 2025. [6] A. Saleh, P. K. Donta, R. Morabito, S. Tarkoma, A. Lindgren, Q. Zhang, S. Dustdar, S. Pirttikangas, and L. Lovén, “Bio-inspired agentic self-healing framework for resilient distributed computing continuum systems,” arXiv preprint arXiv:2601.00339, 2026.
[7] P. Ye, A. Lapkovskis, A. Saleh, Q. Zhang, and P. K. Donta, “Nesyedge: Neuro-symbolic trustworthy self-healing in the computing continuum,” arXiv preprint arXiv:2603.21145, 2026. [8] D. P. Abreu, K. Velasquez, B. Faria, M. Curado, and E. Monteiro, “Resilience in the cloud-to-things continuum,” in Cyber Resilience: Applied Perspectives, pp. 159–179, Springer, 2025. [9] M. Parashar, “Autonomic computing rebooted: Taming the computing continuum,” ACM Transactions on Autonomous and Adaptive Systems, 2025. [10] B. Sedlak, P. K. Donta, V. Casamayor Pujol, and S. Dustdar, “Equilibrium in the computing continuum through active inference,” Future Generation Computer Systems, vol. 160, pp. 92–108, 2024. [11] A. Darwiche, “Bayesian networks,” Foundations of Artificial Intelligence, vol. 3, pp. 467–509, 2008. [12] M. Scutari, C. Vitolo, and A. Tucker, “Learning bayesian networks from big data with greedy search: computational complexity and efficient implementation,” Statistics and Computing, vol. 29, pp. 1095– 1108, 2019. [13] C. Aliferis et al., “Local causal and markov blanket induction for causal discovery and feature selection part i: Algorithms and empirical evaluation,” Journal of Machine Learning Research, vol. 11, 2010. [14] T. Gao and Q. Ji, “Efficient markov blanket discovery and its application,” IEEE transactions on Cybernetics, vol. 47, no. 5, pp. 1169– 1179, 2016. [15] J. Pearl, Causality: Models, Reasoning, and Inference. Cambridge University Press, 2nd ed., 2009. [16] K. Friston, “The free-energy principle: A unified brain theory?,” Nature Reviews Neuroscience, vol. 11, no. 2, pp. 127–138, 2010.