Mach2: Scientific Discovery Platform with Deterministic Execution Constraints

RESEARCH SERIES

•

November 2026

Mach2: Scientific Discovery Platform with Deterministic Execution Constraints arXiv:2611.14777v1 [cs.SE] 10 Nov 2026

Model-authored orchestration, portable engineering agents, and result reconciliation across execution boundaries

Vansh Sharma1,2,* , Venkat Raman1,2 1 Center for Prediction, Reasoning & Intelligence for Multiphysics Exploration (C-PRIME) 2 Department of Aerospace Engineering, University of Michigan

ABSTRACT

Language-model agents can formulate workflows and invoke specialized tools, yet compliance with natural-language operating rules is not guaranteed by prompting alone. Mach2 addresses this limitation by coupling Eigen orchestration to deterministic, lint-like checks of tool requests, source changes, acceptance tests, and artifact contracts. Domain requirements are represented as executable predicates: mandatory failures prevent advancement of the checked operation, while diagnostic findings are retained for correction or review. User-specified test-driven development (TDD), CodeGrapher’s abstract-syntax-tree analysis, and history-guided evolutionary search provide complementary verification and optimization mechanisms. Mach2 also generates task-specific agent packages for execution through independently selected endpoints. The originating harness validates returned artifacts against declared interfaces and evidence requirements without assuming continuous supervision of the remote run. Model-internal-knowledge (MIK) dependencies are recorded separately from source-grounded and test-supported findings. This paper formalizes the rule-gated execution model and the agent-package lifecycle, and proposes measurable criteria for evaluating rule compliance, engineering validity, and cross-endpoint task continuity.

Keywords Agentic Harness; Multi-agent Orchestration; Domain-specific Harness; Secure Agentic Platform; Detached Execution; Verification Corresponding author

Vansh Sharma (vanshs@umich.edu)

1 Introduction Language-model agents extend generative models with tools, persistent state, and delegated workflows. Written instructions can define intended behavior, but they do not ensure that each generated tool call, code modification, or final artifact satisfies the specified constraints. Agent and their underlying models tend to defy written instructions. Evaluations of verifiable instruction following and tool-using agents document deviations from stated requirements, including failures induced by “untrusted" tool output [1, 2]. For computational engineering, a rule violation may invalidate a result even when an implementation appears to complete successfully. The objective of this report is to introduce a user-aligned agentic development framework that integrates explicit governance mechanisms, enforceable execution constraints, and verifiable workflows to support reliable and accountable autonomous operation. Mach2 is a scientific discovery platform (SDP) built on an OpenCode-derived runtime. It combines Eigen’s (a custom built agent) model-authored orchestration with user-specified tests, structural code analysis, and executable engineering tools. In contrast to the original MachOne system developed in Sharma’s doctoral research [3], Mach2 prioritizes the deep integration of scientific tools and the management of long-running workflows, with scoped task context and provenance checks designed to mitigate context contamination and maintain traceability of scientific outputs. OpenCode supports configurable agents, plugins, and server © 2026 All rights reserved by the Author and C-PRIME.

1

C-PRIME

MACH2 Intelligence System

interfaces [4–6]; DeepSeek Harness also supports model-authored workflows and subagent coordination [7]. The distinguishing architectural emphasis here is the coupling of these capabilities to runtime-checkable constraints and to agent packages that preserve task contracts across execution endpoints. The resulting lifecycle has three verifiable boundaries: compliance checks around local actions, acceptance checks on candidate engineering artifacts, and contract validation when external execution returns. Mach2 also incorporates test-driven scientific-code construction following Chain of Unit-Physics [8] and history-guided optimization based on AUTO [9].

2 Mach2 Orchestration and Engineering Runtime 2.1 Eigen coordination and user-defined acceptance Eigen agent decomposes user objectives into bounded tasks, generates execution workflows, commissions specialist agents, and integrates results. In the user-facing test-driven development (TDD) interaction, expected behavior and acceptance tests are specified before implementation. A baseline execution records unmet requirements; subsequent revisions are accepted only after the applicable tests are re-executed. For scientific code, tests can express conservation, dimensional consistency, and physical limiting behavior, consistent with Chain of Unit-Physics [8]. CodeGrapher indexes source-code entities and relationships obtained through language-aware abstract syntax trees (ASTs). The patent application by Sharma and Raman describes syntax-tree traversal, graph-backed source retrieval, and verification of generated assertions against source locations [10]. CADGrapher integrates supported geometry operations through FreeCAD. These services supply structured evidence and executable actions to Eigen rather than relying exclusively on model-generated descriptions. 2.2 Workspace-scoped execution Mach2 is distributed in a Linux ARM64 Docker runtime. Its launcher mounts the selected host project as the working directory and preserves project outputs there; application state persists in a separate volume. Host filesystem exposure is determined by the configured mounts. Internal temporary storage can remain available, so the launch-workspace model concerns accessible host files and durable artifacts rather than an unconditional prohibition on temporary paths. Table 1. Mach2 execution components and associated checks. Component

Execution responsibility

Eigen

Dependency-aware task planning, branch-local agent proposals, and integration

User interaction (TDD)

Testable requirements, baseline failure, and acceptance evidence

Deterministic rule checks

Pre-merge and post-merge acceptance gates, with diagnostics

CodeGrapher / CADGrapher

AST-grounded code queries and executable CAD operations

Agent-package generator

Creates specialized agents, endpoint interfaces, and contracts

Result reconciliation

Checks returned outputs and resumes the originating task

3 Deterministic Enforcement of Written Rules 3.1 From instructions to executable predicates Natural-language requirements are operational specifications, not enforcement mechanisms. In Mach2, eligible rules are translated into checkable predicates resembling static-analysis or lint rules. Their subjects include permitted tools and filesystem paths, allowable source changes, required test evidence, output schemas, and provenance records. This separates a model’s choice of an action from the harness’s decision to permit or accept it. Let 𝑥 denote the available task state, proposed operation, and associated artifacts, and let 𝜌 𝑗 (𝑥) be the result of rule 𝑗: Û 𝜌 𝑗 (𝑥) ∈ {pass, fail, review}, 𝐺 (𝑥) = [𝜌 𝑗 (𝑥) = pass],

(1)

𝑗∈H

2

C-PRIME

MACH2 Intelligence System

where H contains mandatory rules. A gated action or artifact can advance only when 𝐺 (𝑥) is true. Nonmandatory findings generate diagnostics, while an unresolvable mandatory check requires correction or an explicitly authorized change to the specification. Evaluation results are retained with rule identifiers and the corresponding task or artifact revisions. 3.2 Rule checkpoints and scope of assurance Checks are applied at the appropriate lifecycle boundary: before an instrumented tool action (permissions and target paths), after a code modification (AST invariants and TDD outcomes), during package construction (interface and resource constraints), and upon result import (required fields, task identity, and available scientific evidence). An agent’s textual declaration of success cannot substitute for a passing rule evaluation. Determinism applies to the implemented predicates on observed inputs; it does not establish that a natural-language requirement was translated perfectly, that the test suite is complete, or that an unobserved external endpoint complied with local restrictions. 3.3 Orchestrated execution and state acceptance

Figure 1. Rule-gated multi-agent execution. Eigen decomposes the task into dependent subtasks, receives branch-local proposals and evidence, and integrates admissible changes into a candidate state. Only a passing post-merge validation updates the accepted project state; failed checks trigger replanning.

The orchestrator treats the accepted project state 𝑠 𝑘 as a fixed baseline for an execution cycle. From a task specification 𝑇, Eigen constructs a directed acyclic task graph D 𝑘 = (T𝑘 , 𝐸 𝑘 ), where 𝐸 𝑘 denotes precedence constraints, and assigns the 𝑁 currently runnable subtasks 𝜏𝑖 ∈ T𝑘 to workers 𝐴𝑖 (see Fig. 1). Each worker operates on a logically isolated branch 𝑏 𝑖 derived from 𝑠 𝑘 and returns a proposed modification Δ𝑖 with supporting evidence 𝑒 𝑖 : O (𝑇, 𝑠 𝑘 ) { D 𝑘 ,

(Δ𝑖 , 𝑒 𝑖 ) = 𝐴𝑖 (𝜏𝑖 , 𝑏 𝑖 ),

𝑏 𝑖 = 𝐵𝑖 (𝑠 𝑘 ).

(2)

Proposals are screened by the applicable mandatory predicates in Eq. (1). For 𝑥𝑖 = (𝑠 𝑘 , 𝜏𝑖 , Δ𝑖 , 𝑒 𝑖 ), the integration set I𝑘 contains only proposals passing the applicable mandatory rules, satisfying their dependencies, and remaining free of unresolved change conflicts. Integration produces a candidate state 𝑠★𝑘+1 , not an immediate update to the accepted project:  I𝑘 ⊆ 𝑖 : 𝐺 (𝑥𝑖 ) = 1 ,
𝑠★𝑘+1 = 𝑀 𝑠 𝑘 , {Δ𝑖 : 𝑖 ∈ I𝑘 } , ( 𝑠★ , 𝑉post (𝑠★𝑘+1 ; 𝑇) = pass, 𝑠 𝑘+1 = 𝑘+1 𝑠𝑘 , otherwise.

(3)

3

C-PRIME

MACH2 Intelligence System

Here 𝑀 is the conflict-aware integration operation and 𝑉post comprises integration tests and project-level acceptance rules. A failed or review-required check leaves the accepted state unchanged and returns its diagnostic evidence to Eigen for corrective work or replanning. Branches may be realized as version-control branches or equivalent isolated workspaces; the state-transition model does not require a particular version-control implementation.

4 Domain-Specific Agent Package Generation 4.1 Rule-bearing harness construction A domain specification comprises objectives, permissible tools, evidence, policies, verifiers, interfaces, and resource limits: 𝐷 = (O, T , K, P, V, I, B),

𝐻 𝐷 = C(𝐷; 𝑅, 𝑀) = ( 𝐴, Π, Γ, Σ, I).

(4)

Here P contains the rule predicates and their severity, V the test and domain acceptance conditions, 𝐴 the agent roles, Π the execution policy, Γ the bound tools and sources, and Σ the persistent task record. The compiler C creates an executable agent configuration for compatible runtime 𝑅 and model service 𝑀. Compilation means constructing and binding a workflow and its checks, not compiling model weights. 4.2 Portable agents and interface contracts For independent execution, the generated artifact is 𝑃 𝐷 = (𝐻 𝐷 , 𝐸 𝐷 , 𝑄 𝐷 ), where 𝐸 𝐷 defines the endpoint requirements and 𝑄 𝐷 the returned data and evidence schema. Mach2 can create specialized agent files for tasks that cannot remain under Eigen’s supervision; the user supplies a compatible endpoint and initiates execution. Required identifiers, artifact formats, and applicable acceptance rules accompany the package. Credentials and model weights need not be embedded in it. Local rules can govern export and subsequent acceptance; guarantees about the intervening remote run depend on controls present at that endpoint.

5 Test-Driven and Evolutionary Execution For supervised development, Eigen records the current state 𝑠 𝑘 , action 𝑎 𝑘 , and observation 𝑜 𝑘 at each iteration: (e 𝑠 𝑘+1 , 𝑜 𝑘 ) = 𝐹𝐻𝐷 (𝑠 𝑘 , 𝑎 𝑘 ),

𝑣 𝑘 = 𝑉𝐷 (e 𝑠 𝑘+1 , 𝑜 𝑘 ).

(5)

The tentative state e 𝑠 𝑘+1 is evaluated before commitment. The verifier 𝑉𝐷 includes user-defined TDD tests and applicable domain checks; the transition to an accepted state follows Eq. (3). Bounded retries can respond to failing tests, while the mandatory rule gate in Eq. (1) independently governs permitted actions and acceptance. Persistent agent iteration has precedents in the Ralph workflow [11, 12]; here the completion condition is external test evidence rather than the model’s own completion statement. For design exploration, the AUTO methodology employs evaluated candidate history to select exploration, recombination, or refinement [9]. Rule and test checks establish admissibility; objective measurements rank candidates that satisfy those constraints. This separates feasibility enforcement from evolutionary search and allows failed candidates to inform subsequent trials without being accepted as valid engineering outputs.

6 External Agent Execution and Reconciliation Mach2 can dispatch a generated agent package through a user-linked endpoint when the required service is outside the active workspace or observation boundary. Just-in-time (JIT) binding resolves compatible execution services at invocation time. Figure 2 summarizes the independent execution path and the return-validation boundary. User specification tests / rules

Eigen orchestration rule-gated tool actions

Agent package policy / result contract

User-linked endpoint runtime / model service

Project workspace accepted outputs

Mach2 validation gate rules / tests / MIK

Returned result bundle artifacts / evidence

Independent execution no live Mach2 monitor

Figure 2. Mach2 agent lifecycle with rule checkpoints. Local execution and package construction use instrumented checks; an independently executed package is validated on return before its results are accepted into the project. 4

C-PRIME

MACH2 Intelligence System

A return bundle records the originating task, package and input versions, endpoint-reported status, output artifacts, and test evidence. At import, Mach2 checks schema conformity, required outputs, task identity, and available domain verification. Failures block acceptance or trigger review. The imported record distinguishes assertions made by the remote executor from results supported by independently executed checks. For example, a remotely computed geometry or simulation result may be syntactically valid yet still fail dimensional, conservation, or convergence requirements.

7 Comparison with Existing Agent Harnesses OpenCode provides an extensible agent runtime and interfaces; DeepSeek Harness provides model-authored workflow composition. Eigen supplies these orchestration capabilities together with engineering tools and a rule-gated task lifecycle. Mach2 can also create agent packages for independent endpoint execution and subsequent result validation. Table 2 compares configured mechanisms, rather than asserting that other extensible systems cannot implement analogous checks. Table 2. Selected execution and policy abstractions across agent harnesses. Dimension

OpenCode

DeepSeek Harness

Mach2

Orchestration

Configurable agent and tool execution

Model-authored subagent workflows

Eigen-authored engineering workflows

Engineering tools

MCP and tool extensibility

Plugin and service architecture

CodeGrapher and CADGrapher

Agent generation

User-defined agents and extensions

Agent profiles and workflow bundles

Eigen creates specialized agents and exportable packages

Rule governance

Configurable tool permissions

Workspace and sandbox policies

Domain checks with gated acceptance

External execution

Application server / SDK

Headless and SDK execution

User-linked agent-package execution

Result integration

Application APIs and integrations

Session and service interfaces

Task-linked rule and evidence checks

Workspace

Configurable filesystem policies

Workspace and sandbox controls

Launch-selected container project mount

An illustrative task combines a source-code modification, CAD generation, and a calculation at an external solver. CodeGrapher provides AST-grounded change context; user-defined tests and tool restrictions govern local revisions. The exported agent specifies solver inputs and acceptance criteria, while post-return rules check data structure and available physical consistency before the output is incorporated into subsequent work.

8 Assurance, Knowledge Provenance, and Evaluation 8.1 Model-internal knowledge and evidence classification Mach2 identifies unsupported model assertions through explicit provenance checks. Claims without a recorded source, AST-backed relation, user specification, or executed verification are flagged as potentially dependent on model-internal knowledge (MIK). This is an evidence flag, not direct observation of the model’s internal reasoning or a determination that the assertion is false. Such claims can be routed to source retrieval, structured code inspection, TDD, or human assessment. The claim, provenance status, and subsequent verification outcome remain attached to the task record and imported artifacts, consistent with traceable-source validation methods [10, 13]. 8.2 Limits of protocol Deterministic checks enforce only the constraints encoded by their predicates and only where calls or artifacts pass through the corresponding validation points. Tests may miss physical errors, an AST cannot prove runtime correctness, and package-level requirements do not establish compliance at an inaccessible endpoint. Evaluation should therefore include deliberate rule violations, untrusted tool outputs, missing provenance, malformed return packages, and adversarially chosen code changes. Existing software benchmarks such as SWE-bench [14] require extension to test numerical and CAD-specific properties

5

C-PRIME

MACH2 Intelligence System

9 Conclusion Mach2 combines model-authored orchestration with deterministic checks at defined action, branch-integration, and artifactacceptance boundaries. Proposed agent changes remain isolated until mandatory checks and integration tests permit commitment to the accepted project state. User-specified TDD, AST-grounded inspection, and history-guided optimization support these engineering decisions, while generated agent packages extend execution to compatible external endpoints. Returned results are reconciled against task contracts and provenance requirements. The assurance offered by this architecture is measurable compliance with specified checks, an important step towards establishing engineering correctness of such AI systems. Mach2 establishes an extensible foundation for subsequent generations of scientific agentic systems, emphasizing privacypreserving computation, model governance, and low-latency execution. Future iterations of the Mach series, including Mach3, will extend this architecture through runtime classifiers for identifying potentially invalid or policy-inconsistent tool invocations, coupled with deterministic enforcement mechanisms. Further developments will address adaptive orchestration of complex scientific workflows, building upon scientific reasoning frameworks, such as Ref. [3], as well as multimodal tool integration and connectivity with persistent user conversational workspaces. These capabilities will enable controlled context transfer across agents, sessions, and execution environments while maintaining execution traceability, knowledge provenance, and consistent governance policies.

Acknowledgements This work was supported by the Center for Prediction, Reasoning, and Intelligence for Multiphysics Exploration (C-PRIME), a PSAAP-IV project funded by the U.S. Department of Energy under grant DE-NA0004264 (program manager: Dr. David Etim).

References [1] Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. Instruction-Following Evaluation for Large Language Models, 2023. URL https://arxiv.org/abs/2311.07911. [2] Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. In Advances in Neural Information Processing Systems, volume 37, 2024. URL https://arxiv.org/abs/2406.13352. [3] Vansh Sharma. A Novel Neural Pressure Paradigm for Conceptual Abstraction in Artificial Machine Intelligence. PhD thesis, University of Michigan, 2026. URL https://www.me.engin.umich.edu/news-events/event/ thesis-defense-vansh-sharma/. [4] OpenCode. Agents. Official documentation, 2026. URL https://opencode.ai/docs/agents/. [5] OpenCode. Plugins. Official documentation, 2026. URL https://opencode.ai/docs/plugins/. [6] OpenCode. Server. Official documentation, 2026. URL https://opencode.ai/docs/server/. [7] DeepSeek AI. Workflow. Subsystem reference, 2026. deepseek-harness/en/reference/subsystems/workflow.

URL https://deepseek-harness.github.io/

[8] Vansh Sharma and Venkat Raman. Chain of Unit-Physics: A Primitive-Centric Approach to Scientific Code Synthesis, 2025. URL https://arxiv.org/abs/2512.01010. arXiv:2512.01010. [9] Anthony Carreon, Vansh Sharma, and Venkat Raman. Automated Design Optimization via Strategic Search with Large Language Models, 2025. URL https://arxiv.org/abs/2511.22651. arXiv:2511.22651. [10] Vansh Sharma and Venkat Raman. False Information Mitigating in Knowledge Processing Frameworks. U.S. Patent Application Publication US 2026/0178595 A1, June 2026. URL https://patents.justia.com/patent/20260178595. Published June 25, 2026; code-specific graph analysis in Figs. 8A–8C. [11] Geoffrey Huntley. Ralph Wiggum as a “software engineer”, jul 2025. URL https://ghuntley.com/ralph/. 14 July 2025. 6

C-PRIME

MACH2 Intelligence System

[12] Anthropic. Ralph Loop Plugin. Official plugin documentation, 2026. URL https://github.com/anthropics/ claude-plugins-official/blob/main/plugins/ralph-loop/README.md. [13] Vansh Sharma and Venkat Raman. A Reliable Knowledge Processing Framework for Combustion Science using Foundation Models. Energy and AI, 16:100365, 2024. doi: 10.1016/j.egyai.2024.100365. URL https://doi.org/10.1016/j. egyai.2024.100365. [14] Carlos E. Jimenez et al. SWE-bench: Can Language Models Resolve Real-World GitHub Issues?, 2023. URL https: //arxiv.org/abs/2310.06770. [15] Model Context Protocol. Tools. Protocol specification, jun 2025. URL https://modelcontextprotocol.io/ specification/2025-06-18/server/tools. [16] Shunyu Yao et al. ReAct: Synergizing Reasoning and Acting in Language Models, 2022. URL https://arxiv.org/ abs/2210.03629. [17] DeepSeek AI. DeepSeek Harness Architecture. Official documentation, 2026. URL https://deepseek-harness. github.io/deepseek-harness/en/reference/. [18] DeepSeek AI. Process Sandbox. Subsystem reference, 2026. URL https://deepseek-harness.github.io/ deepseek-harness/en/reference/subsystems/sandbox. [19] DeepSeek AI. Tool Schema Catalog: Ralph. Tool reference, 2026. URL https://deepseek-harness.github.io/ deepseek-harness/en/reference/tool-catalog.

7

Related documents

• Mach2: Scientific Discovery Platform with Deterministic Execution Constraints#1648807
• Avatar: Toward Autonomous End-to-End Orchestration of Scientific Workflows using LLMs#997381
• Model-Adaptive Tool Necessity Reveals the Knowing-Doing Gap in LLM Tool Use#1446700
• Kepler: Auditable World Models for ARC-AGI-3#1155769
• EvoX: Rethinking the Agent Harness as a Runtime Policy#1653070