EpochGuard

Inspiration

Multi-agent systems introduce a failure mode that is easy to miss: every agent can be locally correct, while the team is globally wrong.

Imagine three agents preparing a campaign launch:

• an Inventory Agent verifies that enough inventory is available;
• a Budget Agent verifies that enough budget remains;
• a Policy Agent verifies that the campaign is permitted.

Each agent may truthfully return ALLOW based on the evidence it observed. But if those observations were taken from different versions of a changing world, the three facts may never have been true at the same time.

A coordinator that simply sees three ALLOW decisions could therefore authorize an action based on an impossible world.

That led us to the central idea behind EpochGuard:

A multi-agent decision should not be allowed to cause an external effect merely because every agent individually approves it. The platform should also be able to prove that the evidence supporting those decisions belongs to one jointly valid world.

EpochGuard turns that requirement into middleware between Agent execution and protected side effects.

What it does

EpochGuard implements proof-carrying multi-agent decisions.

Three dedicated Role Agents independently inspect Inventory, Budget, and Policy evidence through real Agent Runs. Their outputs are treated as untrusted proposals rather than authoritative truth.

Each accepted Decision is bound to its provenance, including its:

• Agent and Role;
• Assignment, Attempt, and Run;
• observation Receipt;
• source revision and evidence hash;
• validity interval;
• frozen Role profile and prompt contract.

Before a protected effect can be released, EpochGuard reconstructs the authoritative evidence behind all participating Decisions and checks whether their validity intervals share a common cut.

For intervals (I_i = [from_i, until_i)), EpochGuard computes:

$$ L = \max_i(from_i), \qquad U = \min_i(until_i) $$

A jointly valid observed-world cut exists only when:

$$ L < U $$

EpochGuard additionally requires the current world head to remain covered before issuing a Permit. The Effect Gate revalidates the evidence again when the protected effect is actually committed.

If no common cut exists, the effect is blocked even when all three Agents returned ALLOW.

EpochGuard then produces a conflict witness and identifies which evidence owners no longer cover the current world. Instead of rerunning the entire team, it preserves still-valid Decisions and re-observes only the required Agent.

The Impossible World demo

Our main failure scenario deliberately creates three individually valid ALLOW Decisions whose evidence never coexisted.

The three real Role Agents initially report:

• Inventory: ALLOW
• Budget: ALLOW
• Policy: ALLOW

However, their authoritative evidence intervals produce:

L = 21
U = 20

NO VALID OBSERVED-WORLD CUT

Built With

• codex
• multi-agent
• seed2.0
• typescript