Observation Contracts Across Domains

• Observation contracts are explicit agreements that define what is observed, how observations are used, and the associated guarantees, spanning domains such as Earth observation, systems theory, economics, and software monitoring.
• They utilize measurable observables—like input–output trajectories, contract-level coverage, and runtime traces—to enforce compliance via frameworks such as OSAG and assume–guarantee contracts.
• This framework formalizes implicit operational practices into explicit, actionable contracts that guide empirical validation and design decisions in diverse technical systems.

Observation contracts are explicit specifications over what is observed, how those observations may be used, and which guarantees or obligations attach to them. The term is used in several distinct technical senses in current research rather than naming a single universal formalism. In Earth observation, it denotes mathematically defined service agreements over regions, classes, and other mission-critical strata during training; in behavioural systems theory, it denotes assume–guarantee constraints on observable input and output trajectories; in economics, it denotes contracts that incentivize costly and unobservable information acquisition using observable outcomes; in runtime verification, it denotes executable monitors over calls, traces, and message-handling behavior; and in tool-using LLM agents, it denotes intermediate artifacts such as presigned URLs, tokens, and OAuth state parameters whose later use is constrained by time and byte-level integrity (Du, 4 Dec 2025, Shali et al., 2021, Clark et al., 2021, Fredlund et al., 2018, Wang et al., 17 May 2026, Hähnle et al., 2023).

1. Cross-domain structure

Across these literatures, observation contracts are defined over observables rather than latent internal choices. The observable object may be a training-sample stratum, an input–output trajectory, a realized decision and state, a runtime trace, or a tool-returned artifact. What changes from field to field is the semantics of compliance: coverage alignment in Earth observation, behavioural inclusion in linear systems, incentive compatibility in information acquisition, rejection soundness in monitoring, or validity-plus-integrity preservation in agentic tool use.

Literature	Contract object	Observable quantity
Earth observation	Service contract $c$ with target share $w_c$	Contract-level coverage $\hat q_T(c)$
Linear dynamical systems	$C=(\mathcal{A},\mathcal{G})$	Input $u$, output $y$ trajectories
Information acquisition	Transfer $b(d,\theta)$	Verifiable decision $d$, state $\theta$
Runtime verification	Monitor or executable contract	Calls, results, messages, traces
LLM agents	$C=(o,t_{\text{issue}},\tau,\pi)$	Artifact bytes and time of use

A recurrent distinction is between implicit and explicit policy. The Earth observation work states that usual training implicitly lets the sampling policy determine who is served, whereas OSAG makes that policy explicit (Du, 4 Dec 2025). The dynamical-systems work makes environment assumptions and system guarantees explicit at the level of observable behaviours (Shali et al., 2021). The LLM-agent work similarly isolates obligations that many benchmarks leave implicit: preserving temporal validity and byte-level integrity of intermediate tool outputs (Wang et al., 17 May 2026). This suggests that observation contracts often arise when an implicit operational convention is recast as a first-class formal object.

2. Service agreements over observations in Earth observation

In Earth observation, observation contracts are explicit, mathematically defined service agreements about who an EO model should serve during training and how much attention each group should receive. The training set is partitioned into $w_c$0 contracts,

$w_c$1

where each contract $w_c$2 is a semantically meaningful unit such as $w_c$3 for AVIRIS or a semantic grouping of land-cover classes for EuroSAT. Each contract has a subset $w_c$4, cardinality $w_c$5, and a target service share $w_c$6 with $w_c$7. The paper instantiates this framework as the Observed Service Agreement Graph (OSAG), a lightweight governance layer that monitors contract-level exposure, drives empirical coverage toward target shares by contract-normalized sampling weights, and exposes explicit coverage–accuracy trade-offs through a sampling mixture coefficient $w_c$8 and a contract-regularization weight $w_c$9 (Du, 4 Dec 2025).

The central observable is empirical coverage,

$\hat q_T(c)$0

with coverage error

$\hat q_T(c)$1

The reported governance metric is priority coverage error,

$\hat q_T(c)$2

where $\hat q_T(c)$3 and priority levels are in $\hat q_T(c)$4, with rare groups defined as the bottom $\hat q_T(c)$5 in empirical frequency and assigned priority $\hat q_T(c)$6. Service risk is defined by

$\hat q_T(c)$7

Two theoretical links are emphasized. Under i.i.d. contract sampling with $\hat q_T(c)$8, empirical coverage concentrates to $\hat q_T(c)$9 almost surely, with a Hoeffding bound and a union-bound control on $C=(\mathcal{A},\mathcal{G})$0. Under bounded loss $C=(\mathcal{A},\mathcal{G})$1, service-risk deviation satisfies

$C=(\mathcal{A},\mathcal{G})$2

and in particular

$C=(\mathcal{A},\mathcal{G})$3

Operationally, OSAG samples contracts according to $C=(\mathcal{A},\mathcal{G})$4, then samples uniformly within $C=(\mathcal{A},\mathcal{G})$5, so each sample $C=(\mathcal{A},\mathcal{G})$6 in contract $C=(\mathcal{A},\mathcal{G})$7 receives weight $C=(\mathcal{A},\mathcal{G})$8. The mixture parameter $C=(\mathcal{A},\mathcal{G})$9 interpolates between OSAG and a baseline sampler, while $u$0 biases the optimization objective through

$u$1

Reported configurations are OSAG $u$2, OSAG-mix $u$3, and $u$4-fairloss $u$5.

The experiments make the governance interpretation concrete. On AVIRIS, Rand yields $u$6, $u$7, and $u$8, whereas OSAG-mix yields $u$9, $y$0, and $y$1. On EuroSAT, Rand yields $y$2, $y$3, and $y$4, whereas OSAG-mix yields $y$5, $y$6, and $y$7. A EuroSAT coarse-versus-fine ablation further reports that fine contracts achieve comparable governance gain with a smaller empirical accuracy drop. The paper attributes this to contract design via a contract adjacency graph $y$8, a $y$9-Lipschitz assumption on $b(d,\theta)$0, and the dependence of governance cost on $b(d,\theta)$1.

3. Assume–guarantee observation contracts in linear dynamical systems

For linear dynamical systems, observation contracts are behavioural assume–guarantee contracts over observable inputs and outputs. A system under design is an input–output system

$b(d,\theta)$2

with behaviour

$b(d,\theta)$3

A contract is a pair

$b(d,\theta)$4

where the assumption system constrains admissible input behaviours,

$b(d,\theta)$5

and the guarantee system constrains output behaviours,

$b(d,\theta)$6

The paper explicitly frames these as observation contracts because an external observer sees only $b(d,\theta)$7 and $b(d,\theta)$8, not internal state $b(d,\theta)$9 or latent variables $d$0 (Shali et al., 2021).

The semantic notion of implementation is universal over compatible environments. An environment $d$1 is compatible when $d$2. The system $d$3 implements $d$4 iff for all such environments,

$d$5

A key elimination theorem reduces this universal quantification to a single check: $d$6 Because behaviours are kernels of polynomial matrices, inclusion is algebraic: $d$7

The framework also defines refinement and conjunction. Refinement is characterized by

$d$8

Thus a refining contract weakens assumptions and strengthens guarantees. Conjunction is

$d$9

where the assumption behaviour is the sum

$\theta$0

and the guarantee behaviour is the intersection

$\theta$1

The quarter-car example shows the intended reading. When the observed input $\theta$2 satisfies the suspension assumptions, the component output $\theta$3 must satisfy the guarantee $\theta$4, meaning no vertical vibration. The example also illustrates refinement: adding the stronger environmental assumption $\theta$5 yields a weaker contract than the one that works for arbitrary road profile.

4. Information acquisition and learning from observed outcomes

In economic theory, observation contracts arise when an agent’s information acquisition is hidden while only decisions and states are contractible. In "Contracts for acquiring information", the principal and agent sign a contract

$\theta$6

with limited liability $\theta$7, while the agent chooses an experiment $\theta$8 from a feasible set $\theta$9. The experiment is costly and unobservable, and the agent’s expected utility is

$C=(o,t_{\text{issue}},\tau,\pi)$0

whereas the principal’s expected utility is

$C=(o,t_{\text{issue}},\tau,\pi)$1

The central result is a decomposition of any Pareto optimal contract into a fraction of output, a state-dependent transfer, and an optimal distortion: $C=(o,t_{\text{issue}},\tau,\pi)$2 The paper states that the fraction of output paid is increasing in the set of experiments available to the agent, that the state-dependent transfer indexes contract payments to account for differences in output between states, and that the distortion exploits complementarities in the cost of information acquisition. It further states that the distortion is a decision-dependent transfer if and only if the agent’s cost of experimentation is mutual information (Clark et al., 2021).

This line of work treats observation contracts as incentive schemes over observable consequences of unobservable sensing or experimentation. The agent is paid based on realized decision and state rather than on the experiment itself. A plausible implication is that observability here is neither full transparency nor pure outcome-only contracting in the narrow sense; it is a structured interface in which decisions and states are verifiable, but the information-generation process remains latent.

A related learning-based line considers repeated outcome observation. The principal sequentially offers contracts to identical agents and observes the resulting outcomes while remaining oblivious to the agent’s chosen level of effort. In the provided description, the principal has zero information about the agent’s utility, effort levels, or outcome distributions, and learns an $C=(o,t_{\text{issue}},\tau,\pi)$3-optimal contract over a class of monotone-smooth contracts using machinery from multi-armed bandit theory; the result is stated as robust even when considering risk-averse agents, and two special cases are identified: two outcomes, and many outcomes with a risk-neutral agent (Cohen et al., 2018). Here the contract itself is learned from observation, rather than being derived from a known structural model.

5. Runtime verification, behavioural monitoring, and monitorability

In programming-language and web-service settings, observation contracts are executable runtime monitors. The Erlang system EDBC defines contracts as plain Erlang expressions attached to functions or behaviours and checked during runtime. The general contracts include preconditions, postconditions, decreasing-argument contracts, execution-time contracts, purity contracts, and type contracts; the concurrent contracts include invariants over behaviour state and cpre/3 admission conditions for gen_server_cpre. The paper characterizes these constructs as runtime observers over function calls and, for concurrency, over message-handling behaviour and internal state transitions. Violations raise runtime errors with diagnostic information, and the contracts can later be disabled while remaining as documentation (Fredlund et al., 2018).

The monitorability literature on web-service contracts makes the same observational restriction explicit in a more formal way. Server contracts are finitary LTS terms built from prefixing, external choice, and internal choice; a monitor observes only visible server actions, not internal $C=(o,t_{\text{issue}},\tau,\pi)$4-steps. Rejection soundness requires

$C=(o,t_{\text{issue}},\tau,\pi)$5

while rejection completeness requires

$C=(o,t_{\text{issue}},\tau,\pi)$6

The paper shows that the full language is not rejection-monitorable in the strong sense of soundness plus completeness, but it gives a sound synthesis $C=(o,t_{\text{issue}},\tau,\pi)$7 from server contracts to monitors (Vella et al., 2016).

A common misconception is that runtime observation can decide full contract conformance whenever a trace can be checked. The monitorability result rejects that view. For the web-service setting, absence of rejection on one run does not entail that the implementation is a genuine supercontract, because missing behaviours and unexercised branches are not always finitely witnessable. Conversely, EDBC shows that practical observation contracts often mix passive monitoring with active enforcement, since a failed contract may abort the execution rather than merely label it.

6. Context-aware trace contracts and explicit observations in asynchronous programs

Context-aware trace contracts generalize state-based Hoare contracts and procedure-local trace contracts by incorporating both call context and explicit state observations. In the Async setting, traces are finite sequences of states and events, where events include calls, invocations, returns, scheduling actions, and file operations such as open(f), close(f), read(f), and write(f). A contract for procedure $C=(o,t_{\text{issue}},\tau,\pi)$8 has a pre-trace, an internal trace, and a post-trace, together with state predicates at the boundaries. The paper’s defining novelty is the observation quantifier

$C=(o,t_{\text{issue}},\tau,\pi)$9

which records the current value of program variable $w_c$00 into a logical variable $w_c$01 and continues with $w_c$02. Its semantics is

$w_c$03

This makes it possible to compare values at distinct points in a trace, not merely at procedure entry and exit (Hähnle et al., 2023).

The resulting contracts are context-aware in a strong sense. They can constrain what happened before a procedure starts, what happens during its execution, and what must happen after it terminates or after its asynchronous children finish. Procedure adherence is defined by trace membership relative to these formulas, and modular verification proceeds by proving weak adherence locally and then appealing to a global adherence theorem for the whole program. To control the combinatorial explosion of asynchronous call sequences, the paper transfers Liskov’s principle of behavioural subtyping to contracts via a partial order on pre-traces, internal behaviour, and post-traces.

The file-handling case study illustrates the purpose of observation-based specification. Using $w_c$04, one can state that a procedure writes the same file that was previously opened, that closeF closes that file and does not reopen it, or that do opens and ultimately closes the file associated with the current program variable file. This is not expressible in ordinary endpoint-only pre/post contracts because the relevant identity relation spans multiple intermediate states and asynchronous scheduling points.

7. Observation contracts in tool-using LLM agents

In tool-augmented LLM agents, observation contracts are artifacts returned by external systems whose later use is constrained by validity windows and integrity predicates. The formal object is

$w_c$05

where $w_c$06 is the artifact, $w_c$07 the virtual issue time, $w_c$08 the TTL, and $w_c$09 an integrity predicate. The validity window is

$w_c$10

and satisfaction of a use $w_c$11 is

$w_c$12

iff $w_c$13 and $w_c$14. For a workflow with multiple contracts, trace compliance is

$w_c$15

The two orthogonal failure modes are validity failure and integrity failure (Wang et al., 17 May 2026).

ContractBench operationalizes this definition as a deterministic benchmark of 33 tasks, with a virtual clock for timing and SHA-256 hashes for byte integrity. It evaluates 38 models and reports four empirical findings. First, no evaluated model clears $w_c$16, with Claude-Opus-4.6 leading at $w_c$17. Second, Qwen 3.5 shows a sharp within-family cliff from $w_c$18B at $w_c$19 to $w_c$20B at $w_c$21, smoothing to $w_c$22 at $w_c$23B-A17B; the paper interprets what emerges across the cliff as mid-trajectory restraint rather than tool-call competence. Third, the GPT-5 family is non-monotonic: GPT-5 reaches $w_c$24, GPT-5.1 drops to $w_c$25, and GPT-5.2 recovers to $w_c$26, with regression concentrated on integrity-type failures such as WRONG_VALUE and MUTATED_TOKEN. Fourth, the benchmark’s failure taxonomy functions as an actionable in-context reward signal, yielding $w_c$27 percentage points on 42 paired GPT-5.1 failures.

This usage shifts observation contracts from formal methods or mechanism design into agent systems and API reliability. It also sharpens a contemporary misconception: general tool-use ability does not guarantee contract compliance. The benchmark reports that preserving temporal validity and byte-level integrity is an emergent, regression-prone capability, and recommends explicit architectural support such as handle-based artifact storage, backoff middleware, and machine-readable TTLs.