PaperlayerView exact revision on arXiv

Source-linked AI summary

Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows

Edward Y. Chang, Longling Geng, Emily J. Chang

arXiv:2607.00269v2cs.AI

TL;DR

Generated workflow proposals can be well-formed yet infeasible or harmful to existing commitments, motivating a transaction boundary that does not trust the proposer to validate its own work. ATP and Mnemosyne admit proposals deterministically under C and support bounded reactive repair; the artifact evaluates safety across targeted hazards, while live-pilot usefulness observations remain limited in scope.

  • Problem

    Generated workflow proposals can be syntactically valid yet infeasible or drop existing commitments, which conventional transaction processing assumes are not hallucinated or semantically invalid.

    Source: §1 · pp. 1–2

  • Method

    ATP treats generated actions and repairs as untrusted proposals admitted by a deterministic gate, and Mnemosyne implements the boundary with separate proposal, admission, commit, and projection planes.

    Source: §1 · p. 2, §4 · p. 10

  • Results

    The artifact tests targeted hazards across its falsification benchmarks, with the comparator considered meaningful when it commits a specified violation while ATP commits zero such violations and still admits valid operations.

    Source: §5.1 · pp. 11–12

  • Takeaways & Limitations

    Relative to C, committed-state correctness is independent of the proposing layer’s competence, honesty, or learning behavior.

    Source: §1 · p. 2, §7 · p. 18

    Live-pilot usefulness observations do not establish learning efficacy or planning quality, and the confirmatory cross-episode study is ongoing and out of scope.

    Source: §5.4 · p. 15

Abstract

from arXiv · show

LLMs increasingly generate workflow actions, repairs, and plans, but a generated action may be syntactically valid yet stale, infeasible, conflicting, or destructive of the evidence that triggered a repair. We introduce Agentic Transaction Processing (ATP), a transaction model that treats generated actions as untrusted proposals until they pass deterministic admission under a declared, executable constraint set C. The governing principle is two-sided: a proposal is not truth, and no proposal foresees every disruption. Anything may propose, but only the runtime admits and commits; when an unforeseen disruption strikes, it repairs reactively within bounds rather than trusting a fresh proposal. Relative to C, committed-state correctness becomes independent of the competence, honesty, or learning of the proposing layer. We realize ATP in Mnemosyne, a runtime with an append-only transition log, effective-state projection, dependency-safe compensation, and active commitment records, and prove four safety properties relative to C (authority separation, serial-equivalent generative admission, evidence-preserving repair, and obligation containment) plus a bounded-reactive-repair guarantee (LCRP). A reproducible artifact rejects the targeted violations across nine falsification tests while still admitting valid work, at under 6% overhead, and local repair edits an order of magnitude fewer operations than global recompute. In live-proposer pilots, 80 static plan-entry and mid-execution repair proposals from four heterogeneous LLMs pass the same admission boundary, scored by an external cross-episode harness with zero invalid commits; the gate admits 24 of 40 live repair proposals and rejects 16, four as explicit safety rejections of over-broad rollback. Mnemosyne is open source: https://github.com/eyuchang/Mnemosyne/tree/mnemosyne-atp-postgres-rerun

1 Introduction

Generated workflows can be syntactically valid yet stale, infeasible, or destructive, while conventional transaction processing assumes submitted work is meaningful. ATP treats generated actions as untrusted proposals, with deterministic admission and bounded reactive repair governing what becomes committed truth.

1 Introduction

  • Agentic workflows can produce well-formed proposals that are nevertheless physically infeasible or silently drop an existing commitment.In the Thanksgiving example, a delayed flight makes the old travel time unrealistic, and replanning drops Grandma’s pickup.Source: §1 · p. 2
  • The gate checks revised assignments against C and current effective state, rejecting infeasible travel and plans that drop a committed obligation.Feasible reassignments can commit; rejected proposals receive a recorded reason.Source: §1 · p. 2
  • When an unforeseen disruption invalidates committed work, LCRP repairs the affected region and routes its output back through the same admission gate.The example retimes the disrupted leg and its dependents while leaving the rest of the day untouched.Source: §1 · p. 2
  • ATP makes generated actions, repairs, and other outputs proposals that only a deterministic gate may admit under constraint set C.Committed-state correctness is thereby decoupled from the proposing layer’s competence or honesty, relative to C.Source: §1 · p. 2
  • The paper formalizes four safety properties and bounded reactive repair, implements them in Mnemosyne, and evaluates safety, usefulness, cost, and containment.The evaluation includes nine falsification tests, live-proposer pilots, and a disruption-containment study.Source: §1 · p. 3

2 Agentic Transaction Processing

ATP specifies how generated proposals earn transaction authority: executable invariants are checked at admission, and theorems connect those checks to guarantees over executions. Its gate-critical and structural properties extend transaction safeguards to generated workflows, with guarantees stated relative to C.

2 Agentic Transaction Processing

  • ATP distinguishes all-execution properties, per-event executable invariants, and theorems that connect invariant enforcement to those properties under C and gate closure.Figure 1 maps the invariants to the guarantees they support.Source: §2 · p. 3, Figure 1 · p. 4

2.1 The Agentic Transaction Model

  • A proposal is admitted deterministically against C and effective state, then appended to the committed-transition log and projected into StateView for future admissions.Rejected proposals leave a queryable rejection event.Source: §2.1 · p. 3

2.2 Properties Beyond ACID

  • ATP adds safeguards beyond ACID because generated workflows must be checked before acceptance, not merely protected after a trusted application submits a transaction.The admission procedure checks declared constraints and conflict scopes, preserves repair-triggering evidence, and records accepted transitions or queryable rejections.Source: §2.2 · pp. 4–5

2.2.1 Tier 1: The Gate-Critical Properties

  • Authority separation makes committed correctness relative to C independent of proposer behavior, while serial-equivalent admission orders or rejects incompatible concurrent proposals.These extend consistency and isolation to generated work.Source: §2.2.1 · p. 5
  • Evidence-preserving repair prevents a repair from silencing its own trigger unless admission verifies that the triggering condition is resolved under C.Obligation containment lets active commitment records wake and propose continuations but not directly mutate committed state.Source: §2.2.1 · p. 5
  • LCRP limits reactive repair to an affected region under an edit-radius bound and iteration cap, then routes the repair back through admission.This extends recovery to repairs constructed at run time without bypassing the gate.Source: §2.2.1 · p. 5

2.2.2 Tier 2: The Structural Properties

  • Structural properties require StateView to exclude compensated or superseded history, block compensation that would orphan effective dependents, and retain queryable decision evidence.The runtime enforces these properties by construction rather than proving them as separate theorems.Source: §2.2.2 · p. 6

2.3 Safety Invariants

  • The executable invariants include rejection of invalid or stale-world commits, conflicting proposals, evidence-destroying repairs, unauthorized wakeups, and orphaning compensation.All guarantees are relative to trusted C; hazards omitted from C are not claimed to be detected.Source: §2.3 · p. 6

3 Guarantees: Admission Safety and Reactive Repair

ATP’s guarantees make committed-state correctness independent of proposer competence, provided proposals pass admission under C and the gate-closure assumptions hold. For unforeseen disruptions, LCRP bounds local repair and sends its output back through admission rather than recomputing the whole plan.

3 Guarantees: Admission Safety and Reactive Repair

  • The guarantees are relative to C, and a faithful constraint set for richer deployments remains an application-engineering task; the formal claims also assume gate closure.The implementation includes boundary regression tests, but does not claim a machine-checked noninterference proof of its Python codebase.Source: §3 · p. 7, §3.1 · p. 8

3.1 Admission Safety

  • Under gate closure, committed-state correctness relative to C is independent of the intelligence layer’s competence, honesty, or learning behavior.The gate reads current effective state and appends only accepted proposals.Source: §3.1 · p. 7, §3 · p. 7
  • Admission serializes incompatible conflict scopes, prevents repairs from silencing their trigger unless C verifies resolution, and keeps active commitments behind the same admission boundary.If neither resolution nor continued evidence retention can be established, the repair is rejected or escalated.Source: §3.1 · pp. 7–8

3.2 Reactive Repair for the Unforeseen

  • For unforeseen failures without registered compensation, a fired active commitment hands the disrupted region to LCRP, leaving completed and unaffected work untouched.The running case is a highway closure that makes the committed airport leg infeasible.Source: §3.2 · p. 8
  • LCRP records the disruption, propagates effects along effective dependencies, then reassigns only affected transitions; its repair proposal re-enters ordinary admission.The runtime computes reversibility and vetoes edits crossing an irreversible boundary; iteration cap K and displacement budget δmax bound edits.Source: §3.2 · p. 8, Figure 3 · p. 10
  • LCRP bounds repair to K revalidation rounds and cumulative displacement δmax; no transition commits with a non-empty violation set, and exceeding either bound triggers rollback to a restore point.Rollback undoes post-restore-point effects through dependency-closed compensation and supports deterministic replay.Source: §3.2 · p. 9
  • These guarantees do not claim globally optimal repairs or semantically complete C; reactive repair is in scope, while preemptive guard synthesis is deferred.The illustrative Figure 2 contrasts dependency-closure edits with global re-timing.Source: §3.2 · pp. 9–10, Figure 2 · p. 9
  • A mid-repair disruption is accumulated with all unabsorbed observations, then recovery restarts from the latest committed restore point as sequential recovery.Each candidate is validated against that restore point, C, and the full pending observation set; F failures terminate within at most FK rounds before success or escalation.Source: §3.2 · p. 9

4 Mnemosyne Architecture and System Specification

Mnemosyne implements ATP through separate proposal, admission, commit, and projection planes, with runtime drivers outside the authority boundary. Its durable substrate records admitted transitions and obligations, while admission evaluates proposals against projected effective state.

4 Mnemosyne Architecture and System Specification

  • Mnemosyne separates proposal, admission, commit, and projection planes; runtime engines orchestrate work but do not own committed truth.Only admitted transitions extend durable stores.Source: §4 · p. 10
  • The committed-transition log is the append-only source of truth, while StateView projects effective records and supplies the state read during admission.The projection excludes compensated, superseded, or invalidated records while preserving dependency chains.Source: §4 · p. 10
  • The deterministic admission gate alone decides whether a proposal may become truth, checking validity, scope, dependencies, compensation safety, staleness, conflicts, and evidence preservation.Solver certificates and LLM rationales count as evidence, not authority; the gate admits, rejects with a reason, or escalates.Source: §4 · p. 10
  • Active commitment records store obligations whose wakeups construct repair proposals that must pass ordinary admission rather than receiving privileged commit authority.The proposal-and-obligation lifecycle rejoins the same admission path after wake and resume.Source: §4 · pp. 10–11
  • Inbox deduplication and an idempotency-keyed outbox separate external observations and effects from domain commits, while drivers remain non-authoritative.Table 2 describes each component’s authority boundary and the failure associated with bypassing it.Source: §4 · pp. 10–11, Table 2 · p. 11

5 Evaluation

The evaluation tests whether ATP enforces its boundary across targeted hazards, live proposers, usefulness, cost, and reactive repair; the tests are framed as system validation, not model-quality experiments. Across the reported safety tests, ATP rejects invalid work while admitting valid work.

5.2 RQ1: Does the Authority Boundary Hold Across Hazard Classes and End-to-End?

  • Across the six hazard classes, ATP commits zero targeted violations while admitting valid work; evidence-destroying repairs are also rejected while genuinely valid repairs pass.In EVIDENCEREPAIRBENCH, ATP rejects 20 evidence-destroying repairs and admits eight valid ones.Source: §5.2 · p. 12, Figure 4 · p. 12
  • On J1–J4, ATP admits six valid packages, rejects three invalid ones, and completes all cases without invalid commits or StateView mismatches.The direct-workflow baseline commits all nine packages and leaves three StateView mismatches.Source: §5.2 · p. 13, Table 3 · p. 13

5.3 RQ2: Does ATP Catch Hazards Workflow/Saga Guardrails Miss?

  • In the mechanism-level comparator, ATP admits all four valid cases and rejects all ten invalid cases, while workflow/saga guardrails miss the six ATP-specific hazards.The comparator rejects the four classical guardrail hazards but still commits the ATP-specific cases.Source: §5.3 · pp. 13–14, Table 4 · p. 13

5.4 RQ3: Does the Boundary Hold Under Live, Heterogeneous LLM Proposers?

  • Across one task family, the live-proposer pilots report zero invalid commits in 40 static proposals and 40 mid-execution repair events; the gate admits 24 repairs and rejects 16.The pilots are bounded and support no planning-quality or learning-efficacy claim; confirmatory evaluation is ongoing.Source: §5.4 · pp. 14–15

5.5 RQ4: Does Proposer Quality Affect Usefulness but Not Correctness?

  • ATP admits 23 valid attempts and rejects 37 invalid ones across 60 proposals, preserving valid utility while every proposer class has zero invalid commits.Solver-like proposals have the highest acceptance and admitted utility; no-intelligence and adversarial proposals are mostly rejected.Source: §5.5 · p. 15, Figure 5 · p. 15, Table 6 · p. 15

5.6 RQ5: What Does the Safety Boundary Cost?

  • Projection-plus-validation overhead falls from 5.98% to 4.96% of end-to-end runtime as workers increase from one to eight.This is a local artifact audit, not a production-scale load test; the reproducible snapshot includes PostgreSQL and SQLite paths.Source: §5.6 · pp. 15–16, §5.8 · p. 17

5.7 RQ6: Is Reactive Repair Contained, and Safe Under Recovery-During-Recovery?

  • Both repair policies restore feasibility on all six job-shop instances, while LCRP holds median makespan and edits 7.2 operations on average versus 59.8 for global recompute.LCRP’s cost-aware objective J is lower in both mean (58.0 vs. 161.8) and median (53.5 vs. 125.0); the harness implements the same bounded-repair protocol.Source: §5.7 · p. 16, Table 7 · p. 16
  • Recovery during recovery restarts from the latest restore point over accumulated disruptions, reducing recursive recovery to sequential recovery with a stated bound of FK rounds for F failures.A dedicated stress harness remains in progress; the artifact snapshot provides a nine-test reproducibility path with PostgreSQL or SQLite.Source: §5.7 · pp. 16–17, §5.8 · p. 17

6 Related Work

The section positions ATP as a transaction-layer boundary for generated actions, complementing systems that manage admitted work, recovery, or workflow execution. Its key distinctions are effective-state-aware admission, evidence preservation, and proposer-independent commit authority.

Transactions, recovery, and input validation

  • ACID governs how an admitted unit commits, while ATP decides whether an untrusted generated action should be admitted at all [Gray and Reuter 1993; Bernstein and Newcomer 2009; Weikum and Vossen 2001].ATP adds effective-state witnesses, evidence preservation, obligation containment, and serial-equivalent generative concurrency beyond per-command checks.Source: §6 · p. 17

Compensation and event sourcing

  • Mnemosyne combines saga compensation and event-sourced projections with dependency-closed compensation that must itself pass admission [Garcia-Molina and Salem 1987; Fowler 2005, 2011].StateView is the effective-state witness read by the gate, not merely a read-side projection.Source: §6 · p. 17

Active databases and provenance

  • Unlike event-condition-action rules, ACRs wake continuations that construct proposals but cannot mutate committed truth; ATP also makes provenance evidence part of admission [Paton and Díaz 1999; Buneman et al. 2001; Simmhan et al. 2005; Ludäscher et al. 2006; Freire et al. 2008].This supports obligation containment and evidence-preserving repair.Source: §6 · p. 17

Workflow engines and LLM agents

  • Workflow engines may schedule, retry, and wake, while agent reasoning traces, tool calls, and memory retrieval may serve as evidence; neither owns committed truth [Russell et al. 2005; Argo Project 2025; Temporal Technologies 2026; Cadence Workflow Authors 2026; LangChain 2024; Yao et al. 2023b,a; Shinn et al. 2023; Zhou et al. 2023; Wang et al. 2023a; Park et al. 2023; Wang et al. 2023b].Only admission changes committed truth.Source: §6 · pp. 17–18

Relationship to SagaLLM

  • SagaLLM disciplines multi-agent planning with saga mechanisms, whereas ATP gives generated actions no authority until deterministic admission; the approaches are complementary [Chang and Geng 2025].ATP’s additional contributions include effective-state projection and transaction-layer safety theorems; preventive guard synthesis and confirmed self-improving recovery remain future work.Source: §6 · p. 18

7 Conclusion

The conclusion presents ATP as a transaction model that separates proposing workflow actions from committing them. It reports safety and repair results while delimiting the guarantees and evaluation scope.

7 Conclusion

  • Across nine safety tests, ATP rejects targeted violations while admitting valid work; bounded local repair edits an order of magnitude fewer operations than global recompute, and live pilots report zero invalid commits.The pilots use four heterogeneous LLMs at plan entry and during mid-execution disruption, with external cross-episode scoring.Source: §7 · p. 18
  • ATP formalizes four safety properties and bounded reactive repair, with repair proposals re-entering the same admission gate.Mnemosyne implements the model with an append-only transition log, effective-state projection, dependency-safe compensation, and active commitment records.Source: §7 · p. 18
  • Committed-state correctness is relative to declared constraint set C and a gate-closure assumption; hazards outside C can pass undetected, and faithful constraint authoring requires engineering work.Gate closure is enforced by construction and regression tests, not by a machine-checked proof that no code path bypasses admission.Source: §7 · p. 18
  • The guardrail comparator is an artifact-level mechanism model rather than a deployed workflow engine, and the cost audit is a local infrastructure measurement rather than a production load test.Production deployment, confirmatory-scale and family-generalized live-LLM evaluation, a third-party workflow benchmark, and cross-episode learning efficacy remain future work.Source: §7 · p. 18

A Proofs of the Safety Theorems

The appendix proofs connect ATP’s admission rules to safety properties and bounded recovery claims. It also catalogs targeted workflow hazards and additional runtime invariants.

A Proofs of the Safety Theorems

  • Authority separation follows because only the gate can append a proposal after checking it under C and effective state; conflicting proposals are ordered per scope, yielding a serial-equivalent committed history.The proof does not assume that the proposing intelligence is accurate, rational, complete, honest, or improving.Source: A Proofs of the Safety Theorems · p. 22
  • An admitted repair cannot discharge its trigger solely by deleting or obscuring evidence: it must preserve queryable evidence or resolve the underlying failure condition.An ACR wakeup constructs a proposal but cannot commit a domain transition without ordinary admission.Source: A Proofs of the Safety Theorems · p. 22

Proofs of the Reactive-Repair Propositions (main text, Section 3)

  • LCRP caps repair at K rounds and enforces a displacement budget δmax; it commits only with an empty violation set, otherwise rolling back to the last validated state.Each round validates the affected region and propagates effects along effective dependencies.Source: Proofs of the Reactive-Repair… · p. 23
  • Rollback restores a previously admitted feasible state while retaining superseded branches for audit; interrupting an uncommitted repair leaves committed state unchanged, so recursive recovery reduces to sequential recovery.Rollback uses idempotency-keyed compensation under dependency closure; recursive recovery is bounded by at most F recoveries of K rounds each.Source: Proofs of the Reactive-Repair… · p. 23

Corollaries of the Authority-Separation Theorem (main text, Section 3.1)

  • The corollaries establish that solver certificates do not grant admission authority, StateView reflects effective committed chains, and dependency-closed compensation cannot orphan effective dependents.These results are conditional on the stated effective-state and compensation assumptions.Source: Corollaries of the… · p. 23

B Expanded Failure Model

  • The expanded failure model covers invalid transitions, compensation that would orphan dependents, conflicting proposals, stale-world assumptions, and repairs that destroy their triggering evidence.The appendix pairs these hazards with deterministic admission, dependency-closed compensation, scoped conflict rejection, stale-world rejection, and evidence-preserving admission.Source: B Expanded Failure Model · pp. 23–24

C Additional Safety Invariants

  • Additional invariants require effective-chain preservation and bounded-scope ACR proposals, with wider scope allowed only through explicit escalation.ACR creation must be admitted and include bounded dependency scope, discharge or expiry, a guard, a validator, and an idempotent creation key; matching rejected or compensated proposals remain queryable as historical evidence.Source: C Additional Safety Invariants · p. 24

D Benchmark Roster

The appendix lists the benchmark suite and supplies aggregate and proposer-level scoreboard context. It also describes concurrency boundaries and identifies distributed-operation settings left unevaluated.

D Benchmark Roster

  • The roster includes six safety benchmarks, end-to-end planning and recovery benchmarks, a proposer-quality study, and a workflow/saga guardrail comparison.The guardrail comparator lacks ATP-specific admission over stale-world assumptions, effective state, evidence preservation, obligation containment, dependency-closed compensation, and conflict scopes.Source: D Benchmark Roster · p. 24

E Aggregate Safety Scoreboard

  • Across nine benchmarks, permissive baselines commit each targeted violation, while ATP commits zero and still admits valid operations.The appendix identifies this as the aggregate safety scoreboard summarized in the main-paper evaluation.Source: E Aggregate Safety Scoreboard · p. 24, Table 9 · p. 25

F Per-Proposer-Class Detail

  • Invalid commits remain zero for every proposer class, while proposer quality changes acceptance rate, utility, and first-admission delay.The appendix provides per-proposer-class detail behind the main-text study.Source: Table 10 · p. 25, F Per-Proposer-Class Detail · p. 25

G Concurrency, Contention, and Distributed Execution

  • Admission serializes contenders within a conflict scope but allows disjoint scopes to proceed concurrently; MVCC lets StateView read effective state without blocking admission.Hot-scope contenders are ordered through row-level locking and a unique constraint, while rejected contenders retry against updated StateView.Source: G Concurrency, Contention, and… · p. 25
  • The evaluation uses a single durable store; multi-region or sharded operation and production-scale load testing remain future work.Cross-region admission and outbox idempotency would require partitioned conflict scopes or a shared consensus log.Source: G Concurrency, Contention, and… · pp. 25–26

H Per-Property Safety Results

Across six safety hazard classes, ATP rejects invalid transitions while admitting valid work. Bounded live-proposer pilots show the same gate handling static plans and mid-execution repairs, including safe rejections of over-broad proposals.

H Per-Property Safety Results

  • Across six safety hazard classes, ATP rejects invalid proposals, unsafe concurrent admissions, evidence-destroying repairs, unauthorized wakeups, invalid compensations, and invalid storage attempts while admitting valid work where tested.The baselines commit the corresponding violations; ATP yields serial-equivalent history and zero StateView mismatches in the reported tests.Source: H Per-Property Safety Results · p. 26, Table 11 · p. 26, Table 12 · p. 26

I Live-Proposer Pilots (RQ3): Detail and Representative Cases

  • The live-proposer pilots are bounded to one job-shop task family, four proposer packs, and manual collection, with no claim of learning efficacy or family generality.The packs were Claude, GPT, DeepSeek expert, and DeepSeek instant.Source: I Live-Proposer Pilots (RQ3): Detail… · p. 26

I.1 Static plan-entry pilot

  • 40 static plan-entry cases validated with zero schema failures and zero invalid commits; mean horizon reward was 0.90125 and grounded admission rate was 0.725.The external scorer read boundary traces while Mnemosyne admitted or rejected proposals.Source: §I.1 · pp. 26–27

I.2 Dynamic mid-execution pilot

  • Of 40 mid-execution repair responses, Mnemosyne admitted 24 and rejected 16, including four explicit safety rejections; the safety gate passed with repeated-failure rate 0.0.Mean horizon reward was 0.925, grounded admission rate was 0.6, and observed mean time-to-correction was 0.725 across 40 uncensored observations.Source: §I.2 · p. 27

I.3 Representative cases

  • Representative cases include a local repair admitted with committed operations and evidence preserved, and a two-step repair rejected because its radius exceeded the limit of one.A proposer also refused a global rollback that would violate committed evidence; this was recorded as a model-side, not guard-derived, rejection.Source: §I.3 · p. 27

J Coverage Audit: ATP and a Production Transaction-Processing Substrate

The coverage audit distinguishes ATP's proposal-authority checks from responsibilities handled by production transaction-processing systems and workflow guardrails. It finds ATP covers all nine hazards in the audit, while the other layers cover subsets or require application encoding.

J Coverage Audit: ATP and a Production Transaction-Processing Substrate

  • The audit identifies a layer boundary, not a weakness in production transaction processing: ATP governs proposal authority before admission, then relies on the production substrate for atomic commit, durability, uniqueness, and isolation.ATP adds StateView-based admission, retained-evidence checks, dependency-closed compensation, non-authoritative wakeups, and generative conflict scopes.Source: J Coverage Audit: ATP and a Production… · pp. 27–28
  • PRODUCTIONTPCOMPARATORBENCH is a deterministic coverage audit of which layer owns each check, not a throughput benchmark.It runs the same hazard set through a PostgreSQL-style substrate, workflow/saga guardrails, and ATP/Mnemosyne.Source: J Coverage Audit: ATP and a Production… · p. 28
  • In a deterministic nine-hazard coverage audit, ATP/Mnemosyne catches all nine; PostgreSQL-style transaction processing catches two natively and misses three ATP-specific hazards, while workflow/saga guardrails catch three classical hazards and miss three ATP-specific hazards.The remaining checks are marked application-encoded or partial for the production TP substrate, and partial or missed for workflow/saga guardrails.Source: J Coverage Audit: ATP and a Production… · p. 28, Table 17 · p. 29

K RQ5 Infrastructure-Cost Audit: Full Method and Results

The infrastructure-cost audit reports passing ATP paths at all tested worker counts, with measured projection-and-validation shares below 6% at four and eight workers. Separate local HTTP smoke-load runs preserve the admission boundary, while throughput remains diagnostic rather than production evidence.

K RQ5 Infrastructure-Cost Audit: Full Method and Results

  • The RQ5 workload executes 20 repository infrastructure paths across 30 repeats at worker counts 1, 4, and 8, rather than treating the semantic workflow/saga comparator as a throughput competitor.The paths cover admission, commit-boundary enforcement, effective-state projection, validation, compensation, active recovery, and Temporal activity-boundary validation.Source: K RQ5 Infrastructure-Cost Audit: Full… · p. 29, Table 18 · p. 29
  • At four workers, throughput was 709.10 infrastructure units per minute with projection plus validation at 5.63%; at eight workers, throughput was 804.43 units per minute with that share at 4.96%.All ATP infrastructure runs passed at one, four, and eight workers; the audit does not establish production-scale throughput or a product-level comparison against a deployed workflow engine.Source: Table 18 · p. 29, K RQ5 Infrastructure-Cost Audit: Full… · p. 29

L R8 Deployment Smoke-Load Variability

  • Across two local runs and every worker setting, the R8 service admitted exactly 120 valid proposals, rejected 80 invalid or bypass proposals, and produced zero invalid commits.Each setting submitted 200 HTTP proposal requests.Source: L R8 Deployment Smoke-Load Variability · p. 30, Table 19 · p. 30
  • R8 is deployment-boundary evidence, not a production load test: 16-worker throughput varied substantially, and testing with durable PostgreSQL, Kubernetes workers, networked services, and pool saturation remains future work.PostgreSQL is the reported-experiment substrate; SQLite remains a zero-setup portability fallback, and substrate choice does not affect ATP correctness semantics or reported numbers.Source: L R8 Deployment Smoke-Load Variability · p. 30, Figure 6 · p. 30

M Mnemosyne Architecture and Runtime Data Structures

Mnemosyne separates committed truth from proposals, projections, obligations, and external boundaries. Its admission, commit, replay, and recovery mechanisms preserve that separation while allowing bounded repair and compensation.

M Mnemosyne Architecture and Runtime Data Structures

  • Mnemosyne distinguishes immutable events, candidates, constraint evaluations, and committed transitions; only admitted committed transitions enter the append-only CTL, while rejected proposals remain queryable without becoming truth.CTL identity and ordering fields are fixed, while typed metadata and extension fields carry recovery, domain, and causal evidence.Source: M Mnemosyne Architecture and Runtime… · p. 31, Table 20 · p. 31
  • StateView reconstructs current operational truth by replaying effective CTL records and folding domain-attribute deltas, while monotonic log positions and distinct entity, binding, and workflow identities support replay and recovery.The materialized projection is a cache; the CTL remains the source of truth.Source: M Mnemosyne Architecture and Runtime… · pp. 31–32, N Admission, Commit, Logging, and Replay · p. 33
  • An ACR is a durable obligation whose wakeup can create a repair proposal but cannot mutate committed state; inbox deduplication and outbox intent staging likewise do not own truth.Provider execution remains outside committed truth until its result is observed and admitted as a subsequent transition.Source: M Mnemosyne Architecture and Runtime… · p. 32, Table 21 · p. 32

N Admission, Commit, Logging, and Replay

  • Admission evaluates proposals against current StateView and retained evidence under C, checking finite-state and policy rules, stale-world conditions, dependency closure, compensation safety, and whether repairs resolve or preserve their trigger evidence.ACR wakeups must supply a proposal package and cannot directly mutate the CTL or StateView.Source: N Admission, Commit, Logging, and Replay · pp. 32–33
  • The commit batch serializes incompatible scopes, locks affected entities in sorted order, rechecks versions and effective dependencies, appends CTL rows, updates all affected StateView projections, and stages outbox intents atomically.Replay checks state continuity and reconstructs current truth without deleting history; rejected proposals produce queryable rejections, not committed rows.Source: N Admission, Commit, Logging, and Replay · p. 33

O Disruption, Recovery, and Compensation

  • Recovery selects a move against governed invariants; compensation is a new admitted transition that unwinds saga groups in reverse dependency order, preserving effective chains and avoiding orphaned dependents.Supersession also changes effectiveness through a later transition rather than erasing history.Source: O Disruption, Recovery, and Compensation · p. 34
  • A repair may alter trigger evidence only if it resolves the failure under C or leaves that evidence effective and queryable; crash recovery similarly appends compensating transitions rather than deleting records.Obligation wakeups re-enter the ordinary admission gate and may act only within their recorded dependency scope unless a wider scope is admitted as an escalation.Source: O Disruption, Recovery, and Compensation · pp. 34–35

P Staged Implementation (R0–R8) and Reproducibility

The appendix documents Mnemosyne’s reproducibility path and shows how its constraint set and non-authoritative execution substrate support deterministic admission. Worked examples and an end-to-end trace distinguish observations, proposals, admitted log records, effective state, and staged external effects.

P Staged Implementation (R0–R8) and Reproducibility

  • The default reproducibility path runs nine executable safety experiments without PostgreSQL; projection plus validation adds under 6% of end-to-end runtime.The live PostgreSQL storage-substrate test is optional and environment-gated; the nine-experiment result requires no database setup.Source: P Staged Implementation (R0–R8) and… · p. 36

Q Structure and Scalability of the Constraint Set C

  • Adding an operation typically extends C by declaration, because most structural and declarative rules derive from application-maintained declarations rather than per-case validator code.Hand-written validators are reserved for domain semantics that cannot be derived or declared and are a small minority of the artifact’s constraint surface.Source: Q Structure and Scalability of the… · pp. 36–37

R Workflow-Engine and Storage-Substrate Selection

  • The substrate is non-authoritative: the admission gate and CTL own committed truth, while orchestration schedules work and can change without changing correctness semantics.The recommendation is a PostgreSQL-anchored two-tier substrate, with durable transaction bookkeeping in PostgreSQL and compute fan-out for concurrent proposal and probe execution.Source: R Workflow-Engine and… · p. 37

S.1 Valid Proposal

  • An accepted hotel-booking proposal has effective dependencies, current world assumptions, an unoccupied conflict scope, and a fresh idempotency key; its transition enters the CTL.StateView projects the booking as effective current truth after admission.Source: §S.1 · pp. 38–39

S.2 Invalid Proposal

  • A syntactically valid but stale proposal is rejected before commit, leaving domain truth and StateView unchanged and staging no external side effect.The rejection is durably recorded with a reason.Source: §S.2 · p. 39

S.3 Valid Output After a Valid Proposal

  • An accepted notification proposal records an outbox intent, while the provider call and its result remain outside committed truth until later observed and admitted.The proposal depends on an effective booking and uses a fresh outbox idempotency key.Source: §S.3 · p. 39

S.4 Invalid Output After a Valid Proposal

  • A changed provider idempotency key does not authorize a second charge against the same payment obligation; the duplicate intent is rejected or escalated for reconciliation.The worked examples report that only the first and third proposals commit; the second and fourth are rejected with durable reasons.Source: §S.4 · p. 40

T An End-to-End Transaction Trace

  • An observation supplies evidence, a repair package remains a candidate until admission, and only admitted CTL records define committed truth projected by StateView.Admission checks dependency closure, freshness, compensation safety, evidence preservation, conflict scope, and idempotency; compensation makes earlier records ineffective without erasing CTL history.Source: §T.1 · p. 40, §T.2 · p. 40, §T.3 · p. 41
Loading 2607.00269v2…