arXiv:2606.01722v1 [cs.LG] 1 Jun 2026
Post-Deterministic Distributed Systems: A New Foundation for Trustworthy Autonomous Infrastructure Jun He
Deying Yu
Abstract For decades, distributed systems have typically assumed that correct participants execute protocol-specified behavior with stable, externally defined, and deterministic semantics. Classical theory has extensively parameterized network timing, communication topologies, and failure domains, but this participant model has remained comparatively fixed. The integration of autonomous reasoning engines, stochastic modeldriven agents, and policy-driven actors into cloud control planes, incident response systems, and financial infrastructure challenges the universality of this assumption. These agents often produce divergent reasoning paths, distinct operational traces, and heterogeneous internal representations while achieving semantically equivalent and correct outcomes. In this paper, we introduce Post-Deterministic Distributed Systems (PDDS) as a research and engineering model for coordinating heterogeneous environments where deterministic code, stochastic models, and autonomous agents coexist. We show that classical distributed computing models form a zero-ambiguity special case of this participant-general model. We do not argue that deterministic systems disappear; rather, deterministic execution can no longer serve as the universal participant assumption for autonomous infrastructure. Finally, we outline five architectural pillars of post-deterministic infrastructure: Protocol-Driven Development, Verifiable Agentic Infrastructure, Autonomous State Control Planes, Semantic Quorum Assurance, and Epistemic State Replication. Epistemic State Replication extends persistence and consistency models from data visibility to knowledge visibility, enabling agentic memory, Verifiable Semantic Rollback, and coherence across reasoning participants. We also define a taxonomy of failure classes that arise in this setting.
1
context, synthesize execution plans, and remediate system anomalies [24,28]. Unlike traditional deterministic software, these agentic participants do not execute a static sequence of hardcoded instructions. They evaluate local context, consult external knowledge sources, generate reasoning steps, and propose actions dynamically.
Introduction
Distributed systems theory has traditionally parameterized networks, timing, communication, and failures, while largely fixing the participant model around protocol-specified deterministic behavior. Under the State Machine Replication (SMR) model [15, 26], correctness is defined by transition equivalence: given an identical sequence of inputs, replicas transition through identical state sequences and produce identical outputs. This model has served as a foundation for many resilient infrastructure systems, powering databases, distributed consensus protocols, and consensus-driven control planes.
Two correct agentic participants observing the same telemetry may execute distinct intermediate tasks—such as querying different endpoints or summarizing different logs—yet arrive at semantically equivalent remediation actions. Classical distributed systems theory, which relies on deterministic transition equivalence, does not directly provide a mechanism to verify or coordinate such behavior. Under traditional consensus mechanisms, a correct but non-identical reasoning path may appear as divergence from the replicatedstate-machine model, even when the resulting action is semantically admissible.
The integration of autonomous reasoning engines, stochastic models, and policy-driven agents into operational system loops challenges this premise. Modern software delivery pipelines, incident response systems, and cloud control planes increasingly rely on autonomous agents to interpret objectives, retrieve 1
This gap motivates Post-Deterministic Distributed Systems (PDDS) as a research and engineering model. PDDS removes the universality of the deterministicparticipant assumption and treats classical distributed systems as the zero-ambiguity special case of a participant-general model. Under this model, the target of agreement shifts from deterministic transition equivalence to semantic coherence under intent, policy, and execution context. This paper makes five contributions:
driven by autonomous reasoning loops. Rather than executing a fixed transition function f , an autonomous agent interprets an input intent i using a stochastic reasoning engine (e.g., a large language model) and local context C. Because the model’s outputs are probabilistic and context-dependent, the resulting execution trace and proposed system mutations may vary. For instance, in an automated database recovery scenario: • Agent A might identify a disk space anomaly, analyze log sizes, and propose deleting a specific temp directory. • Agent B might observe the same anomaly, run a cleanup script, and propose clearing a cache directory.
1. It identifies the deterministic-participant assumption as an implicit boundary of classical distributed systems theory. 2. It introduces Post-Deterministic Distributed Systems as a participant-general model in which deterministic services, stochastic models, reasoning agents, policy engines, and human actors coexist. 3. It defines semantic coherence and admissible behavior sets as foundations for correctness beyond deterministic transition equivalence. 4. It outlines five architectural pillars of postdeterministic infrastructure and a preliminary taxonomy of failure classes for trustworthy autonomous systems. 5. It introduces Epistemic State Replication (ESR) as the persistence layer for reasoning participants, motivating preliminary consistency notions such as Semantic Linearizability and Eventual Coherence.
2
Both actions may be safe and useful under the current system state, but their state transitions are nonidentical. Classical replication models would generally treat this variance as outside the replicated statemachine model. Treating these reasoning actors as traditional participants leaves system architects with two unsatisfactory options: reduce the agent to a rigid, deterministic script, or bypass distributed safety mechanisms. PDDS addresses this challenge by redefining the participant model itself.
3
A Participant-General Model
To formalize post-deterministic systems, we define a participant-general model where participants may be deterministic, stochastic, agentic, policy-driven, or human-mediated. Let: • S be the set of possible system states; • I be the set of declared intents or input requests; • C be the set of observed contexts and telemetry; • P be the set of active system policies and invariants; • E be the participant’s epistemic state: the set of retained observations, retrieved evidence, summaries, assumptions, local memories, prior reasoning traces, and belief lineage that influence action selection; • U be the action space containing possible system mutations; • R be the space of reasoning traces, explanations, or evidence paths.
The Deterministic-Participant Assumption
Classical distributed computing theory commonly models a participant as a deterministic state machine. In this view, a correct node faithfully transitions according to a predefined transition function f (s, i) = s′ , where s is the current state and i is the input command. The semantics of f are assumed to be fixed, stable, and universal across all correct replicas. This assumption is implicit in the proof of correctness for Paxos [16], Viewstamped Replication [21], and Practical Byzantine Fault Tolerance (PBFT) [4]. In these classic systems, correctness is verified through state and output equivalence under a shared command order. If two correct replicas execute the same log of ordered commands, they reach equivalent We define the admissible behavior function Adm states. This transition equivalence is formal, verifiable, and directly measurable. It allows the system to mask as: Adm : S × I × C × P × E → 2U ×R individual replica failures by checking for identity in the output stream. where Adm(s, i, C, P, E) returns the set of semanThis boundary is exposed when participants are tically correct and safe action-reasoning pairs under 2
state s, intent i, context C, active policies P , and epistemic state E. Correctness for a participant is defined as: (a, r) ∈ Adm(s, i, C, P, E)
4
Semantic Coherence and Certification
The shift to semantic coherence changes the target of agreement. In classical systems, consensus protocols like Raft [22] or Paxos [16] establish a total ordering of The participant proposes an action a and a reasoning commands so correct replicas execute the same transitions. The consensus layer is agnostic to command trace or evidence path r within the admissible set. Within this model, we can distinguish two regimes: semantics; it ensures that all correct replicas execute them in the same order. 3.1 The Classical Special Case In post-deterministic systems, the target of agreeClassical deterministic distributed systems represent a ment is the semantic validity of the state mutation. We zero-ambiguity special case where: define semantic coherence as the alignment of intent, evidence, policy, and execution across heterogeneous |Adm(s, i, C, P, E)| = 1 participants. To evaluate this property, the system checks: For any given state, intent, and context, there exists exactly one admissible action and reasoning trace. • Intent Alignment: Does the proposed action Classical deterministic systems are recovered when the a directly address the declared intent i without admissible behavior set collapses to a singleton and introducing unrelated side effects? the epistemic state E is either empty, externally fixed, • Evidence Provenance: Is the reasoning trace or fully encoded in deterministic program state. The r grounded in verifiable, authentic telemetry and reasoning trace r is trivial (often omitted entirely), and system state C? the behavior function collapses to a single, protocol• Policy Compliance: Does the proposed action defined transition. a satisfy all active safety and security invariants in P ? 3.2 The Post-Deterministic Case In the post-deterministic case, systems operate in the This process is semantic certification. Unlike clasregime where: sical consensus, which can often be reduced to quorum checks over identical values or ordered logs, semantic certification requires validating the structured proof In this regime, multiple syntactically different action- of admissibility (a, r). A semantic quorum is reached reasoning pairs (a, r) are semantically admissible. A when a threshold of independent verifiers certify that participant might choose any (a, r) ∈ Adm(s, i, C, P, E) (a, r) ∈ Adm(s, i, C, P, E). This allows the system to based on its internal model parameters, available accept non-identical but correct actions from diverse prompt templates, or local heuristic weights. The reasoning agents, using model diversity to improve coordination protocol should not require identical ac- resilience. |Adm(s, i, C, P, E)| > 1
tion traces; it should certify that the selected actionreasoning pair is a valid member of the admissible set. Table 1 summarizes the main differences between these two models across architectural dimensions. PDDS separates correctness into three levels: transition correctness, semantic admissibility, and epistemic coherence. The five architectural pillars operationalize these levels in infrastructure: PDD constrains admissible actions, VAI binds authority to intent, ASCP preserves intent across long horizons, SQA certifies semantic admissibility before execution, and ESR maintains epistemic coherence across future actions. This model is intentionally abstract: it exposes the participantlevel assumptions that PDDS needs to formalize rather than defining operational semantics for every class of reasoning agent.
5
Architectural Pillars of Post-Deterministic Infrastructure
The participant-general model above identifies a theoretical gap: correctness must account for semantic admissibility and epistemic coherence, not only deterministic transition equivalence. To operationalize this model, we outline five architectural pillars of post-deterministic infrastructure. These pillars govern mixed-participant systems containing deterministic services, stochastic models, reasoning agents, policy engines, and human-mediated actors. 5.1
Safety Perimeter: Protocol-Driven Development (PDD) Protocol-Driven Development (PDD) shifts the safety boundary from compile-time code verification to runtime policy enforcement [11]. For environments where 3
Table 1: Classical Distributed Systems vs. Post-Deterministic Distributed Systems Dimension
Classical Distributed Systems
Post-Deterministic Distributed Systems
Participant model
Deterministic protocol process
Correctness unit
State/output equivalence
Deterministic, stochastic, agentic, policy-driven, or human-mediated participant Admissible behavior under intent, context, evidence, and policy Semantic coherence and certified admissibility Semantic Linearizability, semantic coherence, and certified admissibility Knowledge visibility, belief lineage, Verifiable Semantic Rollback, and Eventual Coherence Semantic drift, intent loss, correlated reasoning failure, evidence fabrication, unsafe delegation, epistemic divergence, context amnesia Intent-to-execution evidence chain and semantic certification Admissibility checks, protocol boundaries, semantic quorum certification
Agreement target Value, log, or replicated state Consistency tar- Linearizability / serializability / transition get equivalence Persistence model Data replication and state visibility Failure model
Crash, omission, partition, Byzantine behavior
Trust basis
Credential plus protocol execution
Safety mechanism
Consensus, replication, fault tolerance
autonomous loops dynamically generate and execute code, static analysis and pre-deployment reviews are insufficient. PDD defines a machine-enforceable protocol boundary around the execution environment. The protocol acts as an edit automaton [1], intercepting proposed state mutations and validating them against active invariants to prevent synthesized logic from violating system-level constraints. 5.2
ments, aggregates proposed changes, and evaluates them against execution policies. By persisting intent, the ASCP limits drift and coordinates multi-agent mutations. 5.4
Certification Core: Semantic Quorum Assurance (SQA)
Semantic Quorum Assurance (SQA) certifies nondeterministic operations [10]. SQA dispatches critical execution requests to multiple heterogeneous participants, which independently derive action-reasoning pairs (aj , rj ). SQA aggregates these proposals, filters out invalid actions, and evaluates their semantic equivalence. If a quorum of independent verifiers confirms that the proposals converge on a semantically equivalent outcome, SQA issues a signed execution certificate, reducing dependence on a single agent.
Identity Boundary: Verifiable Agentic Infrastructure (VAI)
Traditional identity management evaluates permissions via credentials (e.g., API keys). In post-deterministic environments, credentials are insufficient; an authorized agent may execute a flawed plan due to context misinterpretation. Verifiable Agentic Infrastructure (VAI) replaces static credentials with dynamic, intentbased authorization [13]. Under VAI, an agent presents an intent-to-execution evidence chain containing the delegating authority, the observed context C, and the derived reasoning path r. The system validates this chain before authorizing the proposed mutation, so authority remains bounded by intent.
5.5
Persistence Layer: Epistemic State Replication (ESR)
Classical databases are designed around deterministic execution, explicit data visibility, and strict consistency models. In post-deterministic systems, reasoning participants maintain internal context states: retrieved 5.3 Orchestration Plane: Autonomous State Con- documents, compressed summaries, tool observations, trol Planes (ASCP) latent plans, local memories, and evidence histories. Autonomous State Control Planes (ASCP) govern long- Two participants can possess different epistemic states horizon workflows [12]. Because reasoning agents oper- while producing semantically equivalent actions. ate over long horizons with partial observability, they Epistemic State Replication (ESR) serves as the are susceptible to intent drift. ASCPs address this by persistence and memory pillar of the architecture. decoupling the reasoning phase from execution. The ESR replicates, summarizes, invalidates, and rolls ASCP isolates reasoning agents in sandboxed environ- back knowledge, evidence, and belief lineage across 4
participants. Rather than forcing identical memory 6.2 Correlated Reasoning Failure states—which could reduce reasoning diversity—ESR • Definition: Multiple independent agents share maintains enough knowledge visibility and semantic the same false inference or logical error. coherence for safe execution. • Why classical models fail to capture it: TraUnder ESR, the replicated object is the epistemic ditional consensus assumes independent failures; state: observations, retrieved evidence, summaries, ashowever, shared training data, prompt structures, sumptions, policies, and conclusions. This motivates or model biases in stochastic engines violate this preliminary consistency notions: Semantic Linearizassumption. ability, Eventual Coherence, and Verifiable Seman• Infrastructure Example: During a network tic Rollback. Semantic Linearizability requires that anomaly, three independent monitoring agents reasoning-dependent actions be explainable by a valid running the same model family misinterpret a ordering of intent, evidence, policy, and epistemic uptransient timeout as a hardware failure and trigdates. Eventual Coherence specifies that participants ger an unnecessary failover. converge toward semantically compatible knowledge states when exposed to shared evidence and policies. 6.3 Intent Loss • Definition: The degradation or complete loss Verifiable Semantic Rollback demands that reversing of the user-specified goal over long horizons. an autonomous loop prunes the relevant belief lineage without causing context loss. A full formal treatment • Why classical models fail to capture it: of ESR remains open. Each intermediate step is authorized and syntactically valid, but the cumulative sequence diESR complements Semantic Quorum Assurance. verges from the original goal. While SQA certifies whether a proposed action is admissible before execution, ESR governs the persistence • Infrastructure Example: An agent tasked and propagation of the knowledge states that inform with ”optimizing resource utilization” executes future actions. Together, they form the certification micro-migrations that eventually shut down secand memory foundations required for long-horizon auondary database replicas, satisfying the efficiency tonomous infrastructure. goal but violating the availability requirement.
6
Failure Classes in Post-Deterministic Sys- 6.4 Evidence Fabrication tems • Definition: A participant invents or alters
telemetry or logs to justify its actions. • Why classical models fail to capture it: The node communicates normally using standard protocols, but its evidence path r is detached from reality. • Infrastructure Example: An incident response agent, attempting to justify a service restart, falsely reports observing a memory leak in its reasoning trace because it misinterpreted a memory cache pool.
Traditional fault models commonly reason about crashstop, omission, network partition, and arbitrary Byzantine behaviors [4, 5, 9]. These models do not fully capture the failure modes of participants that are nonfaulty in the classical sense (i.e., they are online, authorized, and actively processing requests) but fail semantically. We propose an initial taxonomy of eight failure classes associated with post-deterministic systems.
6.1 Semantic Drift • Definition: The gradual decay of operational 6.5 Unsafe Delegation alignment and shared understanding between de• Definition: The transfer of execution authority coupled participants. from one participant to another without preserving intent, policy, or evidence constraints. • Why classical models fail to capture it: Nodes remain online and execute locally correct • Why classical models fail to capture it: steps, but their semantic interpretation of poliThe transaction is cryptographically secure and cies or states slowly diverges over time. matches access control policies, but fails to verify the delegatee’s semantic alignment. • Infrastructure Example: Two autonomous replica controllers gradually drift in their crite• Infrastructure Example: A deployment agent ria for ”optimal database health,” leading one delegates a rollback operation to a sub-agent node to start pruning connections while the other but fails to propagate the policy constraint that attempts to scale out, causing thrashing. forbids rolling back during peak traffic hours. 5
6.6 Policy-Violating Autonomy • Definition: A participant satisfies local constraints while violating high-level system policies or invariants. • Why classical models fail to capture it: The action complies with low-level API access boundaries, but the composition of actions violates system safety. • Infrastructure Example: An agent optimizes cloud spend by spinning down unused testing VMs, but deletes a VM containing a critical, undocumented cold-standby coordinator.
7.1
Classical Consensus and Replication
Classical replication relies on State Machine Replication (SMR) [26]. Protocols like Paxos [16], Viewstamped Replication [21], and Raft [22] assume deterministic execution paths. Practical Byzantine Fault Tolerance (PBFT) [4] extends this to arbitrary failures but still requires state or output equivalence to identify and isolate faulty nodes. PDDS relaxes the deterministic-participant assumption for reasoningbased agents while retaining explicit safety checks. 7.2
Randomized and Probabilistic Distributed Algorithms
Prior work has studied nondeterminism in scheduling, failures, network timing, adversarial behavior, and protocol choices [2, 9, 23]. These algorithms assume nodes execute deterministic logic, using randomness to break symmetry or manage scheduling. PDDS focuses on participant-level semantic nondeterminism: identical inputs, context, and policy can yield different admissible traces and actions depending on the participant’s epistemic state.
6.7 Epistemic Divergence • Definition: Participants maintain incompatible knowledge states, retrieved contexts, or belief lineages, causing actions to diverge despite shared intent. • Why it differs from classical inconsistency: Unlike database inconsistency, epistemic divergence does not appear as a mismatch in application data; it exists inside summaries, retrieved evidence, or latent planning states. • Infrastructure Example: Two remediation agents receive the same incident but retrieve different historical deployment records. One concludes that rollback is safe; the other concludes that rollback would violate a migration dependency.
7.3
Byzantine, Rational, and Hybrid Fault Models
Byzantine quorum systems [19] and rational fault models like BAR [7] analyze protocol deviations due to malice or self-interest. A semantically divergent participant in a post-deterministic system is not necessarily Byzantine or rational; it may be online, authorized, and correct while producing a different reasoning trace due to its probabilistic model.
6.8 Context Amnesia • Definition: A rollback, compaction, summarization, or memory reset removes context needed to preserve safe long-horizon behavior. • Why it differs from classical inconsistency: Classical database recovery is deterministic and preserves exact state bounds. Context amnesia in reasoning participants causes them to lose historical context (e.g., past failures), resulting in cyclical reasoning loops or repetitive execution faults. • Infrastructure Example: An agent loop rolls back a failed remediation plan but discards the evidence that caused the rollback, allowing the same plan to be regenerated later.
7.4
Multi-Agent Systems and LLM Agents
Recent LLM-agent work has produced frameworks for tool use [25], multi-agent debate [8, 18], and structured reasoning loops like ReAct [28]. These systems are largely designed for isolated, single-node, or application-level tasks. PDDS motivates distributed systems infrastructure for integrating these agents into critical control planes with explicit safety and coordination mechanisms. 7.5
Formal Methods, Runtime Assurance, and Policy Enforcement
PDDS draws from formal verification and runtime assurance, including proof-carrying code [20], enforceable security policies [27], and edit automata [1]. It extends these approaches to environments where deterministic 7 Related Work code, policy engines, and stochastic reasoning agents Post-Deterministic Distributed Systems draws from coexist, defining safety boundaries evaluated at runseveral established research areas in computer science. time [17]. 6
on prompt injection containment, authorization boundaries, and semantic access control. 9. Epistemic consistency and memory: Postdeterministic systems require consistency models for agentic memory and derived knowledge. Open questions include how to define Semantic Linearizability, propagate derived evidence across agents, summarize memory without losing safetycritical context, invalidate stale beliefs, and perform Verifiable Semantic Rollback. Benchmarks are also needed to evaluate epistemic divergence, evidence propagation, and long-horizon memory safety.
7.6
Epistemic State Replication and Memory Models Epistemic State Replication relates to database consistency [3], distributed shared memory, data provenance [6], linearizability [14], and agent memory. While classical storage systems define visibility and ordering guarantees for data transactions, ESR determines what knowledge, evidence, summaries, and belief lineage must be visible, invalidated, or propagated across participants to keep actions safe. Existing work on provenance and agent memory provides building blocks, but PDDS motivates consistency models connecting epistemic state to safety.
8
Research Agenda
9
Conclusion
Post-Deterministic Distributed Systems presents sev- Integrating autonomous, model-driven actors changes eral open research directions: distributed systems. By treating classical distributed 1. Formal semantics for admissible behavior: computing as a zero-ambiguity special case of a Develop mathematical languages and models to participant-general model, PDDS provides a technical define the admissible set Adm(s, i, C, P, E) and framework for coordinating heterogeneous participants, formally verify that a proposed (a, r) pair satis- including deterministic services, stochastic agents, policy engines, and human-mediated actors. Its archifies active policies and invariants. 2. Semantic quorum protocols: New certifica- tectural pillars—Protocol-Driven Development, Verifition protocols are needed to aggregate and certify able Agentic Infrastructure, Autonomous State Connon-identical inputs, evaluating semantic equiva- trol Planes, Semantic Quorum Assurance, and Epistemic State Replication—operationalize this framework lence rather than simple value identity. 3. Evidence-chain design: Specify the structure for infrastructure whose behavior remains auditable, and properties of intent-to-execution evidence bounded by policy, and semantically certifiable. The chains so they are cryptographically secure, com- deterministic era gave us reliable distributed computation; the post-deterministic era must give us trustworpact, and auditable. thy autonomous infrastructure. 4. Correlation-resistant agent diversity: Investigate how to design multi-agent systems that use References diverse model architectures, training data, and [1] Lujo Bauer, Jay Ligatti, and David Walker. Edit automata: More practical, stronger security policies for software. ACM prompts to reduce the risk of correlated reasoning Transactions on Information and System Security (TISSEC), failures. 8(1):105–144, 2005. 5. Intent preservation over long horizons: De- [2] Michael Ben-Or. Another advantage of free choice: Comvelop protocols to detect and mitigate intent drift pletely asynchronous agreement protocols. In Proceedings of the 2nd ACM Symposium on Principles of Distributed in long-running asynchronous workflows so exeComputing (PODC), pages 40–49, 1983. cution remains aligned with user goals. [3] Philip A. Bernstein, Vassos Hadzilacos, and Nathan Good6. Benchmarks for post-deterministic failures: man. Concurrency control and recovery in database systems. Create testbeds and fault-injection frameworks to Addison-Wesley, 1987. evaluate the resilience of autonomous infrastruc- [4] Miguel Castro and Barbara Liskov. Practical byzantine fault tolerance. In Proceedings of the 3rd Symposium on Opture against semantic drift, evidence fabrication, erating Systems Design and Implementation (OSDI), pages and correlated reasoning failures. 173–186, 1999. 7. Operational integration with cloud control [5] Tushar Deepak Chandra and Sam Toueg. Unreliable failure planes: Design reference architectures and APIs detectors for reliable distributed systems. Journal of the ACM (JACM), 43(2):225–267, 1996. to integrate PDDS controllers with cloud APIs, [6] James Cheney, Laura Chiticariu, and Wang-Chiew Tan. Kubernetes operators, and IAM boundaries. Provenance in databases: Why, how, and where. Founda8. Security and governance for autonomous tions and Trends in Databases, 1(4):379–474, 2009. infrastructure: Study the security implica- [7] Allen Clement, Jeff Napper, Harry Martin, Lorenzo Alvisi, tions of autonomous execution loops, focusing and Mike Dahlin. Bar fault tolerance for cooperative services. 7
In Proceedings of the 22nd ACM Symposium on Operating Systems Principles (SOSP), pages 1–14, 2009. [8] Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. Improving factuality and reasoning in language models through multiagent debate. arXiv preprint arXiv:2305.14325, 2023. [9] Michael J. Fischer, Nancy A. Lynch, and Michael S. Paterson. Impossibility of distributed consensus with one faulty process. Journal of the ACM (JACM), 32(2):374–382, 1985. [10] Jun He and Deying Yu. Openkedge: Governing agentic mutation with execution-bound safety and evidence chains. arXiv preprint arXiv:2604.08601, 2026. [11] Jun He and Deying Yu. Protocol-driven development: Governing generated software through invariants and evidence. arXiv preprint arXiv:2605.12981, 2026. [12] Jun He and Deying Yu. Sovereign agentic loops: Decoupling ai reasoning from execution in real-world systems. arXiv preprint arXiv:2604.22136, 2026. [13] Jun He and Deying Yu. Verifiable agentic infrastructure: Proof-derived authorization for sovereign ai systems. arXiv preprint arXiv:2605.15228, 2026. [14] Maurice P. Herlihy and Jeannette M. Wing. Linearizability: A correctness condition for concurrent objects. ACM Transactions on Programming Languages and Systems (TOPLAS), 12(3):463–492, 1990. [15] Leslie Lamport. Time, clocks, and the ordering of events in a distributed system. Communications of the ACM, 21(7):558–565, 1978. [16] Leslie Lamport. The part-time parliament. ACM Transactions on Computer Systems (TOCS), 16(2):133–169, 1998. [17] Martin Leucker and Christian Schallhart. A brief tutorial on runtime verification. The Journal of Logic and Algebraic Programming, 78(5):293–303, 2009. [18] Tian Liang, Zhiheng Xi, Sara Xu, Yiwen Wang, Taipeng Li, Wensen Zhou, Yifan Lu, Xiaoxian Wu, Dong Shen, Lu Chen, et al. Encouraging divergent thinking in LLMs
via multi-agent debate. arXiv preprint arXiv:2305.19118, 2023. [19] Dahlia Malkhi and Michael Reiter. Byzantine quorum systems. Distributed Computing, 11(4):203–213, 1998. [20] George C. Necula. Proof-carrying code. In Proceedings of the 24th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL), pages 106–119, 1997. [21] Brian M. Oki and Barbara H. Liskov. Viewstamped replication: A new primary copy method to support highlyavailable distributed systems. In Proceedings of the 7th ACM Symposium on Principles of Distributed Computing (PODC), pages 8–17, 1988. [22] Diego Ongaro and John Ousterhout. In search of an understandable consensus algorithm. In 2014 USENIX Annual Technical Conference (USENIX ATC), pages 305–319, 2014. [23] Michael O. Rabin. Randomized byzantine generals. In Proceedings of the 24th Annual Symposium on Foundations of Computer Science (FOCS), pages 403–409, 1983. [24] Toran Richards. Auto-gpt: An experimental open-source attempt to make gpt-4 fully autonomous. https://github. com/Significant-Gravitas/Auto-GPT, 2023. [25] Timo Schick, Jane Dwivedi-Yu, Roberto Dessı̀, Roberta Raileanu, Maria Lomeli, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. arXiv preprint arXiv:2302.04761, 2023. [26] Fred B. Schneider. Implementing fault-tolerant services using the state machine replication approach: A tutorial. ACM Computing Surveys (CSUR), 22(4):299–319, 1990. [27] Fred B. Schneider. Enforceable security policies. ACM Transactions on Information and System Security (TISSEC), 3(1):30–50, 2000. [28] Shunyu Yao, Jeffrey Zhao, Deying Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629, 2022.
8