Source-linked AI summary
Logos: An Agent Harness on a Cross-Process Bus
Hanzhang Jia, Liheng Zeng, Hao Cheng, Yi Gao, Bo Ma
TL;DR
The paper addresses whether reversible agent composition must remain inside one process. It derives four lemmas from the calculus and language-model statelessness, then builds Logos with process-level plugins and transcript-backed recovery. Eighty sessions resume without repeated effects across four kill boundaries, and same-fault comparison localizes failure to one node instead of all co-resident sessions.
Problem
The calculus formally supports reversible plugin composition in a single-process implementation, leaving the process boundary and its shared failure domain unresolved.
Method
The paper derives four lemmas and constructs Logos, a ROS-like cross-process harness whose plugins are processes and whose shared state is an append-only transcript.
Results
80 sessions resume and complete without repeated effects after kills at four tool-call boundaries, while same-fault comparison shows failure ending at one peer node rather than interrupting every co-resident session.
Takeaways & Limitations
The results support carrying the calculus’s reversibility guarantee across processes under the stated conditions, with process failures localized to affected nodes.
Takeaways & Limitations
The deployment assumes trusted networks and reviewed tools admitted through registration, while the transcript remains plaintext and snapshotting or compaction is left as engineering work.
Abstract
from arXiv · showhide
Modern agent systems assemble capabilities at runtime, and this dynamic composition has recently received a complete formal treat ment in the spatiotemporal-composability calculus, in which a capability is a component carrying a tracked inverse, and agents are assembled as plugins. This plugin form is carried by a single process sharing one context, a carrier that places all components in one physical failure domain, a fault suspends every component at once, and process death interrupts every session the process hosts. This paper shows that neither the modeling nor the calculus binds an agent to one process, the statelessness of the language model keeps all cross-step state outside the model, and the soundness invariant is defined on the state space alone. These observations condense into four lemmas whose premises are the hypotheses of the calculus and the statelessness of language-model inference. On these lemmas this paper constructs Logos, a ROS-like cross process agent harness in which a plugin is a process and the only shared state is an append-only transcript. Eighty sessions resume with no repeated effect after kills placed at the four boundaries of the tool-call cycle, and a same-fault comparison with a single process reference configuration shows one fault interrupting every co-resident session while under the peer-process construction one fault ends at one node.
1 Introduction
The paper argues that single-process plugin composition creates a shared failure domain and presents Logos, a cross-process harness that preserves reversible composition through an append-only transcript. Evaluation reports reliable routing and recovery across process failures, while moving composition itself beyond the host process.
- Motivation: Single-process hosting makes crashes, blocked event loops, plugin withdrawal, and process death affect co-resident components and sessions together.The shared process also forces whole-stack recovery when one component fails.
- Contribution: Four lemmas argue that stateless inference, carrier substitution, independent recovery, and external dependency resolution permit spatiotemporal composability across processes.The lemmas use the calculus’s existing assumptions plus language-model statelessness.
- System: Logos makes each plugin a process, keeps routing in the router, and stores shared session state in an append-only transcript for cold-switch recovery.A replacement process rebuilds the session from the transcript after process death.
- Evaluation: 3,500 calls from up to 200 concurrent callers complete with no loss, duplication, or misattribution, while 100 simultaneous registration claims yield one winner and 99 denials.The stress audit directly exercises message integrity and single-registration behavior.
- Evaluation: 80 sessions resume and complete after kills at four tool-call boundaries without repeating previously executed effects.The tested boundaries include tool execution, persistence, and announcement transitions.
- Novelty: Unlike MCP and Temporal, which move tools or execution out of the host while retaining composition there, Logos moves composition and assembly onto peer processes.The distinction is the paper’s stated architectural novelty.
2 Related Work
Related systems distribute tools or execution across processes, but typically retain capability composition and assembly in a host process. Logos instead assigns each capability its own operating-system process and places composition on the bus.
- In-process frameworks: AutoGen and LangGraph organize capabilities as in-process objects through conversation programming or state graphs.Their capability objects remain inside the importing host.
- Distributed architectures: MCP moves tool servers out of the process while composition and session state remain in the host.Calls cross processes, but assembly stays host-resident.
- Distributed architectures: Temporal moves execution out of the process while assembly remains in the workflow definition and recovery uses history replay.The comparison separates execution placement from composition placement.
- Logos: Logos inherits ROS-style peer processes and name-based routing while extending the calculus’s single-process reversibility treatment to a multi-process carrier.The paper positions this as a construction with sufficient conditions and measurements.
3 Preliminaries
The preliminaries define reversible components, tracking and recovery, independence, observational equivalence, registries, and the soundness invariant used by the later cross-process argument.
- Components: A component maps a state to a new state and an inverse map that returns the original state at the chosen input.The inverse is constrained at the state where the component was applied.
- Assembly and removal: Tracking applies effects and accumulates inverses, while recovery applies the composite inverse and reverses assemblies in reverse order.The invariant remains unchanged along witnessed tracking steps.
- Independence: Independent effects commute across transformations and do not disturb one another’s inverses, supporting the calculus’s global theorems.The calculus assumes pairwise independence, with disjoint-key coeffects commuting unconditionally.
- Soundness: The soundness invariant states that recovering after tracking returns the same result as recovering before tracking.Recovery evaluates the invariant, whose meaning is preserved along the formal track.
- Equivalence: Observational equivalence identifies states indistinguishable to context observers, and a macrostate is an equivalence class under the projection Π.Recovery equality is therefore physical only up to observational equivalence.
- Registry: A registry organizes named fibers into a rooted tree with disjoint provider sets and at most one installed provider per demand key.The calculus proves that rule steps preserve this well-formed registry structure.
4 Sufficient Conditions
The paper argues that the calculus’s reversibility guarantee can survive arbitrary process placement because model inference is stateless and the soundness invariant constrains state, not carriers. Four lemmas establish externalized orchestration, persistent-carrier recovery, localized recovery, and external resolution, yielding sufficient conditions for faithful distributed implementations.
- From One Process to an Assignment: The calculus’s shared context and records are hosted in one process, but its soundness invariant imposes no constraint on component placement.The paper identifies co-residence as an implementation restriction rather than a requirement of the state-space invariant.
- From One Process to an Assignment: A faithful assignment permits arbitrary component and record placement when implemented traces agree pointwise with abstract traces under Π.The assignment framework compares abstract assembly/removal traces with the steps processes actually perform.
- Two Modeling Facts: A stateless pure model pass makes cross-step state external, allowing input synthesis and output parsing to occur at any process.Lemma 4.1 treats the model as a dispatchable node and places runtime state in a shared sector S.
- Four Lemmas: A persistent carrier is faithful when its readout preserves inverse data, so recovery rebuilt from the carrier is observationally equivalent to in-place recovery.The append-only transcript is identified as the general persistent carrier for inverse data.
- Four Lemmas: Component independence permits recovery to remain local, while any interleaving of local inverse sequences reaches the same endpoint.The result relies on recovery being invariant under permutation of the applied inverses.
- The Theorem: Theorem 4.5 requires reversible effects to record anchors in a persistent transcript and each key to have one writer enforced at registration.Under these conditions, the lemmas support an implemented trace agreeing pointwise with the abstract trace.
5 The Logos Construction
Logos moves composition and assembly from a host process onto a bus of peer processes, with routing state in the router and session state in an append-only transcript owned by no process. Harnesses rebuild sessions from the transcript after failure, while registration, forwarding, broadcast, and durable settlement support distributed operation.
- The Logos Construction: Logos replaces the host process with a bus, makes each plugin a process, and keeps the routing table, transcript, and event stream outside processes.The construction moves composition and assembly out of the host while preserving a defined message path.
- The Bus: The router registers nodes, forwards calls to capability providers, and broadcasts events while holding only its routing table.It schedules nothing and reads no payload.
- The Bus: The wire layer separates lossy streams from paired control messages and uses bounded per-connection queues with distinct overflow behavior.Control messages are not dropped; a full control queue disconnects the peer, whereas lossy-stream overflow drops the oldest entry and records a notice.
- The Bus: Registration enforces one row per capability name, refuses conflicting claims, and broadcasts online or offline changes to all nodes.A broadcast-maintained registry is observationally equivalent to an in-memory registry.
- The Transcript: The append-only transcript records each session step, supports projected model messages, and preserves full tool results in the underlying file.Replay checks ordering, monotone identifiers, one result per tool use, and projection equality.
- Harness Loop with Recovery: The harness loop imports the transcript, rebuilds its projection, synthesizes input, calls the model, routes tools, appends results, and settles outputs.Durable settlement precedes visible announcement on the bus.
- Assembly, Removal, and Recovery: After process death, a replacement process cold-switches by rebuilding the session from the transcript without rollback, fork, or repeated recorded steps.Recovery remains local to the failed process, while outward effects remain outside the recovery boundary.
- Deployment Assumptions: Deployments assume trusted networks and reviewed tools, while plaintext transcripts and snapshot or compaction policies remain explicit design or engineering boundaries.Snapshot and compaction archive prefixes without changing replay semantics.
6 Experiments
Experiments evaluate Logos under concurrency, process failures, recovery boundaries, and matched single-process faults. The peer-process design preserves session progress while narrowing failures to affected nodes, with measured overhead at the bus and recovery layers.
- Scale Separation: 0.215 ms median bus hops cost 43 times a local call but remain 1/823 of median first-token latency.The 99th percentile is 0.377 ms and the maximum is 3.045 ms; full inference has a median of 1896.8 ms.
- Concurrency: 3,500 calls from 200 concurrent callers complete with no loss, duplication, or misattribution.Concurrent loads of 50, 100, and 200 callers also complete three rounds with zero losses.
- Fault Recovery: A tool-process kill returns caller errors in 0.321 ms, remounts the provider in 100.5 ms, and leaves other nodes unaffected.Transcript replay satisfies invariants I1 through I4.
- End-to-End Resumption: 80 sessions resume across four tool-call kill points with no repeated effect.The four points are during execution, after return before persistence, after persistence before announcement, and after announcement.
- Session Isolation: Two harnesses serialize calls through 4.00 s while recovering independently from separate transcript shards without coordination.Each answer returns to its own caller and no false timeout occurs.
- Single-Process Comparison: At 20 dependents, single-process restoration takes 1003.0 ms and freezes an unrelated session for 987.2 ms, while peer processes report zero freezing.Peer recovery pays one 126.3 ms process start at the twenty-dependent point.
- Single-Process Comparison: 10 of 10 matched trials interrupt all five co-resident sessions in the single-process configuration, whereas peer processes replace one node in 10 of 10 trials.The independent peer sessions continue without gaps while the single-process pipeline restarts from step one.
7 Conclusion
The paper establishes sufficient conditions for the calculus’s reversibility guarantee to survive process boundaries and implements those conditions in Logos. Measurements show recovery without repeated effects and a narrower peer-process failure domain under matched faults.
- Conclusion: Sufficient conditions extend the spatiotemporal-composability calculus’s reversibility guarantee across the process boundary.The four lemmas use the calculus’s hypotheses and language-model statelessness.
- Conclusion: 12 sessions resume through six kills and 80 sessions survive four tool-call kill points with no repeated effect.Router loss permits node reconnection and routing resumption.
- Conclusion: Matched-fault comparison interrupts every co-resident session in one process but ends at one node in the peer-process construction.The transcript replays the full session, while future work targets formal guarantees for ordering, channel failures, and multi-machine deployment.
A.1 Setup
The setup fixes component and record assignments across N processes and imposes persistent anchoring and single-writer conditions. It then relates abstract state-space traces to the steps actually executed by processes.
- A.1 Setup: The setup assigns components and records to N processes and requires reversible effects to write anchors to a persistent transcript.Each key must admit exactly one writer, enforced during registration.
- A.1 Setup: Abstract traces sequence assembly and removal steps in the state space, while implemented traces record the steps processes actually perform.The theorem constructs an implemented trace corresponding to every abstract trace.
A.2 Proof of Lemma 1
The proof of Lemma 1 rests on language-model statelessness and external input synthesis and output parsing. Therefore cross-step state resides in an external sector readable from any process.
- A.2 Proof of Lemma 1: A forward language-model pass is a stateless pure map, so cross-step state cannot reside inside the model.The proof treats the model as a function whose stateful context is supplied externally.
- A.2 Proof of Lemma 1: Because synthesis and parsing are external operations, the shared sector is the remaining residence for cross-step state.The sector can be read from anywhere, allowing input x = ω(S) to be synthesized at any process.
A.3 Proof of Lemma 2
Lemma 2 identifies a persistent carrier as necessary for recovery and derives the append-only transcript as the general carrier form. Cold switching then reconstructs the accumulator in a new process without changing the soundness invariant.
- Carrier equivalence: Recovery through the persistent carrier is observationally equivalent to in-place recovery under Π.The calculus’s composition and equivalence properties establish this recovery correspondence.
- Necessity of a record: A persistent record is necessary because reversible state must survive process death; process memory cannot satisfy this carrier condition.The persistent carrier is presented as the physical lower bound for reversibility in fault-tolerant deployments.
- Append-only derivation: The inverse data form a monoid, whose most general persistent carrier is the free monoid of generators: an append-only transcript.Plaintext storage and a single-source transcript are design choices rather than mathematical consequences.
- Cold switching: Cold switching imports the transcript, rebuilds the external accumulator, and composes it with the failed process’s retained state.The original process can depart while the soundness invariant remains unchanged, making the process a disposable auxiliary carrier.
A.4 Proof of Lemma 3
Lemma 3 localizes recovery by allowing each process to replay its own last-in-first-out inverse sequence independently. The construction relies on permutation-invariant recovery, confined local state, and engineering constraints for registration and notification consistency.
- A.4 Proof of Lemma 3: Any interleaving of per-process last-in-first-out sequences permutes all inverses, preserving the recovery endpoint.This permutation invariance supports local storage and eliminates the need for coordination during recovery.
- A.7 The Three Engineering Constraints: The three engineering constraints remain empirically supported rather than formally modeled, including asynchronous loss, partition, and reconnection semantics.Their formalization is identified as future work.
- A.4 Proof of Lemma 3: Local recovery needs no shared state because each component’s inverse data remain in its own process and recovery is independent of interleaving.The process-local claim depends on confinement and disjoint supply assumptions.
- A.4 Proof of Lemma 3: The routing table replaces in-memory resolution for removed components, with registration broadcasts preserving observer agreement on supply-change order.Registration conflict refusal and ordered notifications implement the corresponding resolution conditions.
- A.4 Proof of Lemma 3: The proof’s induction establishes pointwise agreement between implemented and abstract traces under Π.The argument assumes a bus time scale separated from model time and a topology stationary at the model step scale.