PaperlayerView exact revision on arXiv

Source-linked AI summary

Authority at Commit Time: Reject-and-Rerun Semantics for Governed Agentic Systems

Jesus Salas

arXiv:2609.31490v1cs.DC

TL;DR

Agents can compute from snapshots whose governing inputs change before proposed work reaches the world, so completion alone does not confer authority. The paper uses commit-time admission by a logically authoritative service, and its local composition passed frozen gates while delegated admission exposed added clock, lease, and quorum obligations.

  • Problem

    Agent proposals may reach the world after their governing policy, facts, task state, models, tools, or verifiers have changed, making current admissibility the central question.

    Source: §1 · p. 1

  • Method

    A logically authoritative service checks declared dependencies and component manifests against current state, applies the current verifier, and either reserves an idempotent effect for dispatch or rejects stale work for resynchronization and rerun.

    Source: §1 · p. 2, §9 · p. 12

  • Results

    The local composition detected all eight deliberately journaled direct-credential effects with no false detections in the fully mediated control, while delegated admission exposed additional clock, lease, observation, and quorum obligations.

    Source: §9 · pp. 12–13

  • Takeaways & Limitations

    Commit-time reject-and-rerun semantics keep agents non-authoritative while a logically unified service alone admits effects and issues receipts.

    Source: §9 · p. 12

    The evidence does not establish production reliability, WAN behavior, external-journal completeness, dependency completeness, or verifier correctness.

    Source: §7.1 · pp. 10–11

Abstract

from arXiv · show

Enterprise agents can compute for seconds or hours from a snapshot of policy, facts, task state, models, tools, and verifiers that may change before their work reaches the world. Completion alone therefore cannot confer institutional authority. We treat agents as proposal producers and a logically authoritative service as the sole authority for governed effects. At admission, the service compares a proposal's declared dependencies and component manifest with current state, applies the current verifier, and either reserves an idempotent effect for outbox dispatch or rejects affected stale work for resynchronization and rerun. Unaffected work may continue; lost responses resolve through canonical verdicts and receipts. The protocol composes optimistic concurrency control, semantic verification, and transactional outbox dispatch. Its distinctive read set includes normative authority and the model components that produced the proposal. We evaluate the design through an implemented governed-work lifecycle, a local authority, outbox, and reconciliation composition, and a multi-process fallback that delegates effect authority when complete mediation is unavailable. The local composition preserved selective fallback, unaffected work, retry and restart recovery, and package reconstruction. Complete mediation produced 18 authority commands and 18 external effects. Direct-credential arms produced eight additional effects, all detected with independent journal reconciliation and none falsely detected in the mediated control. The results support commit-time reject-and-rerun semantics and expose the clock, lease, ordering, and quorum obligations introduced by delegated admission. They do not establish prevention or reversal of bypass effects, external-journal completeness, production throughput, wide-area availability, semantic completeness, or verifier correctness.

1 Introduction

Agents may spend seconds or hours proposing work from snapshots whose governing inputs can change before the proposal reaches the world. The paper makes agents proposal producers and reserves authority over effects for a logically authoritative service that checks current state.

1 Introduction

  • The institutional question is whether a proposal is admissible now, because policies, facts, tasks, verifiers, models, tools, or prior effects can change during agent computation.A proposal may still look reasonable or match what a current worker would produce.Source: §1 · p. 1
  • The service compares declared dependencies with current state, applies the current verifier, and either records an admitted effect for idempotent dispatch or rejects affected stale work for rerun.Unaffected work may continue.Source: §1 · p. 1
  • The protocol extends optimistic concurrency control with a read set that includes authority versions and model-component manifests, plus semantic verification and potentially irreversible external effects.The paper identifies complete mediation as a precondition.Source: §1 · pp. 1–2
  • If disconnected workers can authorize effects from cached state, the design needs leases, cutover clocks, fences, and split-epoch rules; proposal-only workers pause institutional progress instead.Service availability then concerns recovery objectives rather than competing sources of truth.Source: §1 · p. 2
  • The paper frames its contributions as an institutional OCC formulation, a reject-and-rerun protocol, partition and lost-acknowledgment semantics, and a reconciled evidence account across three implementations.The evidence account combines a governed-work ladder, a local authority/outbox/reconciliation composition, and a delegated-gateway study.Source: §1 · p. 2

2 Problem and Invariant

A proposal is not an effect: only current authority can admit it after checking governing dependencies and verification. The paper adapts OCC to institutional work, where stale work is rejected and rerun and progress is separated from safety.

2.1 Proposals are not effects

  • A proposal records its task, base snapshot, declared dependencies, component manifest, evidence, and requested action; an old global snapshot is acceptable if all governing heads remain current.A matching coarse epoch alone is insufficient when a governing head or required component hash differs.Source: §2.1 · p. 2

2.2 Why post hoc cleanup is insufficient

  • Post hoc cleanup cannot undo an already-dispatched message, payment, deployment, or entitlement change, so every governed effect must pass through an authority-controlled adapter.The same boundary can cover disclosures across trust boundaries, though the paper does not claim general information-flow control.Source: §2.2 · p. 3

2.3 OCC inheritance and the governance delta

  • The protocol composes OCC, semantic concurrency control, and transactional outbox practice rather than proposing three new transaction mechanisms.Its distinctive read set binds normative authority and the model, adapter, prompt, tool, and verifier versions; version agreement alone does not replace current verification.Source: §2.3 · p. 3

2.4 The reject-and-rerun rule

  • When a changed dependency affects a task, the worker invalidates the stale attempt, installs current required state, restarts from an authoritative checkpoint, and submits a new attempt.Stable task and effect identities may be retained; checkpoints and shorter speculative stages reduce wasted computation without weakening admission.Source: §2.4 · p. 3

2.5 Safety and liveness are separate

  • Service unavailability pauses governed submission and effect execution, while quorum, availability, and replication determine how long progress pauses rather than changing the safety rule.Acknowledged authoritative commits require an effective recovery point of zero.Source: §2.5 · p. 4

3 Authoritative Commit Protocol

The protocol binds each proposal to relevant state and component versions, then validates and records admission through an ordered authoritative transaction. Rejections, retries, and reconnection are resolved through canonical verdicts and receipts.

3.1 State objects

  • A snapshot manifest binds relevant authority, fact, task, receipt, and supervisor-verdict state to model, adapter, prompt, tool, and verifier hashes.The proposal envelope identifies its dependency subset, task and attempt identities, effect identity, requested action, and evidence hashes.Source: §3.1 · p. 4

3.2 Admission transaction

  • Admission authenticates the submitter, resolves declared dependencies, checks required components, rejects affected stale work, runs the current verifier, and records either refusal obligations or an accepted verdict and outbox command.On success, the effect identity is reserved atomically; dispatch is followed by a completion receipt or reconciliation obligation.Source: §3.2 · p. 4
  • The admission transaction is the authority linearization point; later amendments do not retroactively stale an admitted decision, and cancellation is a new governed decision if permitted.After intent is recorded, the remaining interval to landing is dispatcher latency rather than model-runtime duration.Source: §3.2 · p. 4

3.3 Lost acknowledgments and idempotency

  • A lost response is resolved by retransmitting the same effect identity, allowing the authority to return the canonical verdict or receipt instead of dispatching twice.The protocol promises at-most-one committed effect per identity, but external idempotency must be supplied by the adapter or explicitly reconciled.Source: §3.3 · p. 5

3.4 Partition and resynchronization

  • On reconnection, nodes send their last accepted snapshot hash and receipt sequence; unchanged governing subsets may proceed, while affected work is invalidated and rerun under current components.A global manifest change forces a handshake, but dependency comparison determines which tasks restart.Source: §3.4 · p. 5

3.5 Unified authority with scoped ledgers

  • Authority may be partitioned by governed scope, provided each scope has one ordered history and cross-scope proposals are checked against every governing head.Cached discovery records may expire by TTL; authorization records may not.Source: §3.5 · p. 5

4 Implementation and Evaluation Method

The paper evaluates three distinct evidence layers: an implemented governed-work lifecycle, a local networked authority/outbox/reconciliation composition, and a delegated fallback. Their bounded results address different questions and do not pool into a single verdict.

4.1 Layer A: implemented governed-work lifecycle

  • The Matrix prototype implements append-only event logging, versioned facts, dependency-directed invalidation, reconvergence, outcome verification, and replay, with worker models proposing while deterministic code owns declared contracts and lifecycle state.The self-authored synthetic onboarding workflows use three Phi-4 seeds and demonstrate mechanisms rather than estimate rates.Source: §4.1 · p. 5
  • The L4 and L5 workflows test selective invalidation and preservation, bounded rework, admission before task issuance, verified branch receipts, and closure only under current composite readiness.The L5 route-specific contract contains 20 lifecycle assertions per seed.Source: §4.1 · p. 6

4.2 Layer B: local networked composition and reconciliation

  • The local networked study uses separate authority, relay, external-effect, and reconciliation services to test component admission, pinned verification, outbox dispatch, and journal comparison.It replays previously recorded admitted Qwen3-14B proposals, so it is an integration workload rather than a new model-capability evaluation.Source: §4.2 · p. 6
  • Frozen local cases test revocation and fallback, unaffected work, verifier refusal, lost acknowledgments, retries, relay restart, bypass detection, and package reconstruction.Reconciliation may detect a bypass only if the external journal is complete, and cannot prevent, reverse, or compensate an effect already produced.Source: §4.2 · p. 6

4.3 Layer C: fallback under incomplete central mediation

  • The delegated fallback study uses three gateway processes and a three-member etcd control plane to test a versioned release, clocks, temporal fencing, leases, effect identities, and verified fallback.Stress tests examine clock-bound violations and loss of a control-plane majority, with separate verdicts for healthy and stressed behavior.Source: §4.3 · p. 6

4.4 Evidence boundary

  • The evidence is bounded: the lifecycle ladder is not a production networked commit service, and the local composition does not establish production identity, WAN behavior, cross-ledger atomicity, or journal completeness.The delegated study evaluates fallback when effect authority exists outside complete central mediation.Source: §4.4 · p. 7

5 Results

The implemented lifecycle admitted current work, invalidated affected evidence, reran dependent tasks, and required current receipts for closure. Local reconciliation detected direct-credential bypasses, while delegated admission passed healthy tests but exposed stress failures and remained bounded by controlled-composition and production-readiness limitations.

5.1 Central lifecycle mechanisms

  • After the tax authority changed, only the dependent tax task reran; the legal task and receipt remained current.The incomplete initial proposal was rejected on all three seeds, while its corrected version was admitted.Source: §5.1 · p. 7
  • All 60 L5 route-specific assertions passed, with tax rerun under v2 while legal and security receipts remained current and activation followed composite readiness.A regression that removed a preservation assertion held the run despite a green final business state.Source: §5.1 · p. 7

5.2 Local composition and independent reconciliation

  • All eight bypass effects were exposed by independent-journal reconciliation, with 60.607–130.249 ms detection latency; the mediated control had no false detections.The authority ledger remained reconstructable while omitting the direct effects.Source: §5.2 · p. 8
  • All eight affected tasks rejected the revoked specialist and committed once through fallback, while all eight unaffected tasks retained their admitted specialist and committed once.Lost acknowledgments retried without duplicate journal entries, and a replacement relay drained a pending command after restart.Source: §5.2 · p. 8

5.4 The requested property and the remaining gap

  • The results are controlled composition evidence, not production validation: proposals were recorded model outputs, services ran on one host, and the external journal was complete by construction.Detection neither prevented nor reversed a bypass; production identities, signed manifests, journal coverage, WAN failover, throughput, and cross-scope commit remain unmeasured or unimplemented.Source: §5.2 · p. 8, §5.4 · p. 9

5.3 The measured cost of delegated admission

  • Across 16 scenario-arm runs, delegated admission recorded 103 receipts and 60 commits with zero listed safety violations, but majority loss missed its liveness deadline at 545.133 ms versus 500 ms.The healthy split epoch was 174.251 ms under the frozen 385 ms maximum.Source: §5.3 · p. 8
  • The delegated-gateway study’s stress evidence included a time-only commit at oracle 774.363 ms, 25.637 ms before T = 800 ms, and a 340.597 ms split epoch.The separately instrumented confirmation measured actual effect time; majority loss preserved safety but failed liveness.Source: §5.3 · p. 8

6 Discussion

The discussion favors a single logical authority for each governed scope, with delegated admission reserved for effects that cannot be completely mediated. It treats availability, stale-work reuse, model changes, and lost responses as explicit protocol concerns, while connecting the design to the paper’s broader research arc.

6.1 The architecture is intentionally asymmetric

  • Agents may be numerous or disconnected, but each governed scope needs one logical ordering; replication may preserve availability without creating independent admission truths.If authority is unreachable, business progress pauses rather than allowing stale cached authority to commit.Source: §6.1 · p. 9

6.2 Complete mediation is the decision boundary

  • Centralize commit when every effect can pass through an authority-owned adapter; otherwise delegate only the minimum scope and carry its fencing and availability obligations.An independently controlled, complete external journal can detect a declared class of bypass omissions after effects, but cannot substitute for mediation when prevention matters.Source: §6.2 · p. 9

6.3 RTO and RPO

  • The acceptable outage is a business-dependent recovery-time objective, while acknowledged releases and receipts have an effectively zero recovery-point objective.Work may queue or route to a healthy replica, but stale local state cannot be declared authoritative to meet latency targets.Source: §6.3 · pp. 9–10

6.4 Reuse is an optimization, not a commit path

  • Affected stale proposals are rejected and rerun; preserving an unaffected intermediate artifact requires explicit admission under current authority.Reuse may reduce recomputation but is itself a governed operation, not a way to assert stale work current.Source: §6.4 · p. 10

6.5 Model updates are governing changes

  • A governing model, adapter, prompt, tool, or verifier change makes an old-manifest proposal rejectable when that component governs the task; unrelated scope changes need not trigger model reload.The worker installs the current manifest and reruns affected work.Source: §6.5 · p. 10

6.6 Receipts resolve lost responses

  • A retry with the same effect identity returns the ledger’s canonical acceptance answer, but exactly-once external behavior requires an idempotency key, transactional integration, or reconciliation.The local harness recovered from lost acknowledgments without duplicate journal entries, but this does not establish arbitrary external exactly-once behavior.Source: §6.6 · p. 10

6.7 Connection to the research arc

  • This paper places current authority at the boundary deciding whether a concurrent proposal becomes an effect, extending the paper’s arc from provenance through learning and artifact change to runtime commitment.The cited arc distinguishes governed execution, governance records as workflow supervision, and learned-artifact change controls.Source: §6.7 · p. 10

7 Limitations and Open Work

The prototypes establish bounded evidence for mediated admission and reconciliation, while leaving important deployment, contract, dependency, availability, and compensation limits unresolved.

7.1 Complete mediation and credential isolation

  • Direct credentials can bypass admission, and journal reconciliation detected the eight deliberate bypasses only after their effects occurred.Detection also depends on complete coverage of the declared external journal; unjournaled effects remain undetectable.Source: §7.1 · pp. 10–11
  • The Matrix ladder demonstrates implemented paths, not enterprise frequencies, human-review costs, or production reliability; the delegated study used local processes, not a WAN.The v2 composition ran on one host, and its 250 ms detection deadline was a harness gate rather than an SLO.Source: §7.1 · p. 11
  • Admission enforces only the declared contract, while omitted dependencies can leave stale proposals apparently current.Open-world deployment therefore requires independent authorship, human adjudication, verifier validation, and monitored appeals.Source: §7.1 · p. 11
  • Logical authority may become a bottleneck or outage domain; replication and scoped ledgers are proposed, not benchmarked.No throughput, tail-latency, regional-failover, or disaster-recovery claim is made.Source: §7.1 · p. 11
  • Some external effects cannot be made atomic with the ledger, and compensation is a new governed effect that current authority may prohibit.The next claim-bearing experiment should test authenticated identities, guaranteed journal coverage, WAN failover, throughput, and cross-scope cases.Source: §7.1 · p. 11

8 Related Work

The protocol adapts established concurrency, semantic verification, outbox, ordering, and workflow ideas to governed agent proposals, without claiming a new transaction algorithm.

Optimistic concurrency control

  • The protocol inherits optimistic concurrency control’s read, validation, write, and abort-retry structure, extending validation to authority, model components, semantic checks, and external effects.Its contribution is the governance-specific read set and commit boundary, not a new concurrency algorithm.Source: §8 · p. 11

Semantic concurrency control

  • Semantic admission is distinct from version validation, following the application-level scheduling insight of Garcia-Molina (1983).The proposal’s read set also records the authority and model-component provenance that produced it.Source: §8 · p. 11

Beyond distributed transactions and transactional outbox

  • The outbox carries an admitted effect intent from the authoritative ledger to an authority-controlled adapter; idempotent identity and reconciliation address the external system’s non-atomicity (Helland, 2007; Richardson, n.d.).The external write is not part of the ledger transaction.Source: §8 · p. 12

Authoritative ordering and authorization snapshots

  • Unlike authorization snapshots such as Zanzibar’s zookie, the proposal manifest binds task facts and component provenance and requires exact current-state validation plus semantic admission.The paper contributes no new consensus or transaction algorithm.Source: §8 · p. 12

Leases and coordination services

  • Under delegated admission, a gateway lease bounds a local right to admit, making leases more demanding than their role in keeping a centrally mediated authority available.The v1 gateway study measures this delegated role.Source: §8 · p. 12

Long-running transactions and compensation

  • Unlike saga compensation, a governed compensation is itself a proposal that current authority may refuse.The protocol treats compensation as a new admission, not an automatic inverse.Source: §8 · p. 12

Governed agent workflows

  • The prospective contribution extends prior governed-work and learned-artifact approaches: a concurrent proposal gains institutional standing only through current authoritative commit (Salas, 2026a, 2026b, 2026c).Those works address provenance, verifier-admitted records, and current-contract admission for learned artifacts.Source: §8 · p. 12

9 Conclusion

The paper places authority at effect admission: agents propose from snapshots, while current authority validates and commits. Prototype results support this boundary but do not establish production federated commit.

9 Conclusion

  • A logically unified service compares submitted checkpoints and dependencies with current state, applies the current verifier, and alone appends the admission verdict and outbox command.Affected stale work is rejected, synchronized, and rerun; confirmed dispatch produces a completion receipt.Source: §9 · p. 12
  • The protocol’s novelty is extending validation to current authority, facts, tasks, model components, and semantic verification before potentially irreversible external effects.The read-validate-write cycle itself is not new.Source: §9 · p. 12
  • 60 lifecycle assertions passed across three Phi-4 runs, and independent reconciliation detected all eight direct-credential effects with no false detections in the mediated control.The local composition also exercised component revocation, current verification, outbox dispatch, retry, restart, and reconciliation; delegated admission exposed clock, lease, observation, and quorum obligations, including stress failures.Source: §9 · pp. 12–13
  • Reconciliation detects only effects represented in the declared journal and cannot prevent or reverse bypass effects.The results do not establish a production federated commit service; further work must measure authenticated identities, guaranteed journal coverage, WAN failover, throughput, and scoped-ledger behavior.Source: §9 · p. 13

A Protocol Field Sketch

The appendices sketch the protocol’s minimum record fields, admission decision, and reconnect handling for unaffected, stale, and already-committed work.

A Protocol Field Sketch

  • Table 5 lists minimum snapshot, proposal, and receipt fields; production encodings may add signatures, tenancy, tracing, retention, encryption, and privacy controls.The field sketch identifies the minimum claim-bearing fields.Source: Table 5 · p. 14, A Protocol Field Sketch · p. 14

B Reference Decision Procedure

  • The authority resolves an existing verdict first, rejects affected stale dependencies or mismatched components, verifies current proposals, and atomically reserves an admitted effect with its outbox command.The procedure assumes affectedness comes from an admitted governance contract; conservative deployment may reject any manifest change until finer contracts are validated.Source: B Reference Decision Procedure · p. 14

C Reconnect Cases

  • Reconnect handling continues work when governing heads match, but installs current state and reruns after relevant authority, fact, model, or tool changes.A prior successful commit returns its canonical receipt without rerunning the effect; current verifier failure leads to rework, block, or escalation without commit.Source: C Reconnect Cases · pp. 14–15

D Claim-Control Ledger

Evidence verdicts remain separate across layers; the local composition passed its complete gate, while delegated evidence retains unresolved clock and liveness conditions.

D Claim-Control Ledger

  • No verdict is transferred across evidence layers, which use separately frozen protocols.L4 and L5 use the canonical Matrix ladder; the local composition uses frozen v2, and delegated evidence uses frozen v1 and v1.1.Source: D Claim-Control Ledger · p. 15
  • The local composition passed its complete gate as COMPOSED_RECONCILIATION_GO.Source: D Claim-Control Ledger · p. 15
  • The clock verdict remains PREDICTION_NOT_OBSERVED, later confirmation stays separate, and majority-loss liveness remains a failure.Source: D Claim-Control Ledger · p. 15
Loading 2609.31490v1…