# The Engineering Reality of Multi-Agent Collaboration: Triggers, Topologies, and Deterministic Merging - Date: 2026-03-03 - Author: ByF - URL: https://blog.baifan.site/en/multi-agent-collaboration-engineering/ - Description: Deconstructing multi-agent systems from classical distributed systems theory: non-deterministic state machines, split-brain hazards, CAS merges, and fault domain isolation. --- Packing multiple probabilistically sampled large language model instances into a single codebase or production pipeline is, fundamentally, constructing a distributed system over an unreliable network using stochastic state machines. The axiomatic foundations of classical distributed computing—deterministic state transitions, reproducible failure modes, Byzantine fault tolerance, and atomic commits—collapse almost entirely when applied to modern generative models. Tech social media abounds with utopian product demos: one agent searches documentation, another implements business logic, a third writes unit tests, and a fourth conducts code review, while an orchestrator agent glides over the process like an infallible engineering manager. Yet anyone who has pushed such topologies into a 500,000-line monolithic repository or a high-concurrency production environment knows the reality: the system rapidly degenerates into distributed chaos. Unsynchronized modifications cause silent overwrites and split-brain states; non-deterministic rollouts cause cognitive divergence; token consumption explodes in a positive-feedback avalanche; and parent and child processes lock each other in cognitive livelocks. Multi-agent collaboration is not an exercise in clever prompt engineering; it is an unforgiving distributed runtime challenge. Who holds the write lease? How are the failure domains of subagents isolated? How do we bound context decay and SNR degradation? And when two workers concurrently mutate caller and callee semantics, what deterministic Compare-And-Swap (CAS) oracle reconciles their changes? Setting aside marketing hype, this analysis examines multi-agent architecture through the lens of classical distributed systems theory (the Actor model, State Machine Replication, CAS, and Crash-Only Software) alongside five production architectures: OpenAI Codex, Claude Code, OpenClaw, Hermes, and Qoder. --- ## 1. The Collapse of Foundational Axioms: Non-Deterministic State Machines and the Quorum Illusion To diagnose the chronic fragility of multi-agent workflows, one must return to the foundational prerequisites of distributed consensus. ### The Breakdown of the Deterministic State Machine (DSM) Since Leslie Lamport formulated Paxos and Diego Ongaro alongside John Ousterhout introduced Raft (2014), State Machine Replication (SMR) has rested on an immutable mathematical premise: **the Deterministic State Machine**. For any node in a replica set, given an identical initial state $S_0$ and an identical sequence of input log entries $L = \langle e_1, e_2, \dots, e_n \rangle$, the state transition function must be strictly deterministic and invariant: $$ \text{apply}(S_t, e_{t+1}) \to S_{t+1} \quad \text{uniquely and deterministically} $$ Auto-regressive language models, by contrast, are high-dimensional probabilistic samplers: $$ P(w_{t+1} \mid w_1, w_2, \dots, w_t; \theta, T) $$ Even when inference temperature $T$ is clamped to 0, underlying GPU hardware non-determinism—specifically floating-point non-associativity ($(a + b) + c \neq a + (b + c)$) across parallel warp reductions, dynamic CUDA thread scheduling jitter, and mixed-precision quantization kernels—induces non-trivial deviations in token generation trajectories over long rollouts. The architectural consequence is stark: **multi-agent systems possess zero deterministic replicas.** When an orchestrator fans out a task to three supposedly homogeneous worker instances, the system does not create three fault-tolerant redundant replicas; it branches into three divergent stochastic Markov chains. Classical quorum voting cannot validate correctness here. Quorum arbitration assumes independent, uncorrelated hardware failure distributions ($p^k$). LLMs instantiated from shared base weights exhibit highly correlated **common-mode failures**: when confronted with tricky prompt ambiguities or subtle API edge cases, parallel instances hallucinate along identical cognitive fault lines. Blind majority voting merely executes collective delusions with higher statistical confidence. ### Context Decay and the Token Avalanche In conventional distributed RPC frameworks, message payloads are decoupled from the execution engine: transport overhead scales linearly ($O(M)$). In multi-agent systems, however, payload *is* state, and state *is* attention context. As demonstrated by Nelson F. Liu et al. (2023) in *Lost in the Middle: How Language Models Use Long Contexts*, transformer retrieval and rule adherence degrade along a pronounced U-shaped curve as prompt lengths expand. When an orchestrator dumps sprawling repository ASTs, call stacks, and architectural contracts into a subagent's prompt, the signal-to-noise ratio (SNR) plummets. Compounding this is the quadratic nature of attention cache memory and cumulative token consumption. Consider an orchestrator fanning out to $K$ concurrent workers. Each worker runs a tool-execution loop, consuming $T_{\text{in}}$ tokens and generating $T_{\text{out}}$ trace tokens. When these $K$ parallel branches fan in for synthesis, the orchestrator's ingestion footprint surges: $$ T_{\text{reduce}} \approx T_{\text{base}} + \sum_{i=1}^{K} (T_{\text{in}}^{(i)} + T_{\text{out}}^{(i)}) $$ Without aggressive, lossy semantic summarization, the orchestrator's context window saturates within two iterations, forcing destructive context compaction (see [Claude Code Context Compression Analysis]({{< ref "2026-06-17-claude-code-context-compression.en.md" >}})). As context saturates, reasoning fidelity degrades, which prompts the orchestrator to trigger additional corrective sub-queries. The runtime rapidly enters a **token consumption avalanche**: budgets evaporate while the root objective remains unresolved. ### The Straggler Problem and Cognitive Deadlocks In their seminal 2004 MapReduce paper, Jeffrey Dean and Sanjay Ghemawat highlighted the operational bottleneck of **stragglers**: in any barrier-synchronized parallel computation, latency is bounded not by mean worker throughput, but by tail latency ($P_{99}$). In LLM multi-agent systems, generation variance magnifies straggler penalties by an order of magnitude. A subagent assigned to "security audit" may encounter a convoluted regex, stalling in a 180-second loop of ReDoS analysis and repeated AST tool invocations, while sibling workers assigned to interface design and unit testing sit idle at the synchronization barrier. Even more pernicious are implicit topological deadlocks: - Worker A patches authentication routines while awaiting external configuration schema definitions; - Worker B refactors configuration structures, assuming its interface must match the auth worker's new token struct; - In the absence of an explicitly defined Directed Acyclic Graph (DAG) with validated topological sort order, the agents enter a cognitive livelock, politely trading tentative status updates until their step budget is exhausted. --- ## 2. Triggering Boundaries: Call Stack Bloat and Ingress Perimeter The first perimeter of any multi-agent architecture is triggering: under what rigorous conditions is a single-threaded execution thread permitted to fork into concurrent branches? This boundary dictates the system's fault domain. ```text +----------------------------------+ | Input Ingress Event | +-----------------+----------------+ | [ Authentication Gate ] | +------------------v------------------+ | Entry Gateway Router (OpenClaw) | +------------------+------------------+ | (Resolved Identity & Policy) +------------------v------------------+ | Master Agent Loop (Claude) | +--------+--------------------+-------+ | | [Explicit Command / Contract] [Semantic Match] | | +--------------v---+ +---v--------------+ | Codex Dispatch | | Ephemeral Worker | | (Scoped Worker) | | (Read-Only Tools)| +--------------+---+ +---+--------------+ | | +--------v--------------------v-------+ | Durable Execution Queue / Postgres | | Checkpointer (Hermes / LangGraph) | +-------------------------------------+ ``` ### Explicit Triggering: Concurrency as a Privileged Operation OpenAI Codex adopts the most conservative stance in production. By default, Codex refuses to fork subagents merely because a user's prompt sounds conceptually broad ("Refactor this module and improve performance"). It treats concurrency like `rm -rf`—a high-privilege, potentially hazardous primitive requiring explicit human authorization: ```text Use parallel subagents. Spawn one agent per review category. Delegate this work in parallel and synthesize the results. ``` The underlying architectural rationale is the prevention of **unbounded call stack bloat**. Left to their own devices, language models given autonomous delegation privileges will routinely fan out to avoid making difficult analytical decisions—spawning five subagents to run redundant web searches and dumping unvetted summaries back into parent memory. Codex nails the delegation trigger to the user, ensuring system behavior remains fully deterministic and predictable. ### Semantic Dispatch and Description Flutter Anthropic's Claude Code implements semantic triggering for standard subagents (see [Claude Code Multi-Agent System Architecture]({{< ref "2026-06-24-claude-code-multi-agent.en.md" >}})). Each registered subagent declares an isolated system prompt, tool manifest, and trigger description. The main loop matches user intent against this registry at each turn. The vulnerability here lies in **semantic overlap and route fluttering**: Consider two registered subagents: - `security-auditor`: "Use proactively to review authentication, encryption, and vulnerability concerns." - `code-reviewer`: "Use proactively to review code logic, design patterns, and potential defects." When handling a pull request modifying JWT expiration routines, the router operates in an ambiguous vector subspace. It may summon `security-auditor` on turn 1, flip to `code-reviewer` on turn 2, or oscillate between the two, duplicating effort and fragmenting context. **Production descriptions must be codified as rigid preconditions rather than aspirational wish lists:** ```yaml name: auth-crypto-reviewer description: > MANDATORY trigger condition: Invoke ONLY when files under src/auth/ or src/crypto/ have modifications in the git diff. Do NOT invoke for general styling, performance, or UI component changes. tools: [Read, Grep, Glob] permissions: read-only ``` ### Ingress Isolation: Gateways and the Principle of Least Privilege OpenClaw approaches triggering from a completely different perspective: **perimeter ingress routing**. Operating as an enterprise gateway bridging WhatsApp, Telegram, Discord, and Slack into an agent runtime, OpenClaw recognizes that diverse communication channels represent distinct trust domains. Requests from an enterprise Slack `#devops` channel and public webhooks must never inhabit the same execution context. Adhering to Saltzer and Schroeder's (1975) Principle of Least Privilege, OpenClaw enforces authorization at ingress: 1. Match incoming events against channel IDs, account boundaries, and guild roles; 2. Bind the execution to a designated workspace (`AGENTS.md`, `SOUL.md`) and isolated `agentDir` credentials; 3. Physically filter the tool surface—an agent serving customer-facing webhooks is never injected with terminal access or infrastructure deployment tools. In OpenClaw's design, multi-agent architecture is first and foremost a **mechanism for fault domain and privilege isolation**, and only secondarily an engine for cooperative problem-solving. --- ## 3. Topologies and Concurrency: From Fan-Out to Mesh Split-Brain Topology dictates the pathways of communication and state mutation. The engineering cost of maintaining consistency varies exponentially across structures: | Topology | Communication Complexity | Consistency Guarantee | Write Collision Risk | Production Exemplar | | :--- | :--- | :--- | :--- | :--- | | **Single Agent** | $O(1)$ | Strong (Single-threaded transaction) | Zero collision | Localized bug fixing, linear debugging | | **Star Fan-Out/In** | $O(K)$ | Weak (Reconciled at central sink) | High (Reducer bottleneck) | Codex Subagents, Qoder Experts | | **Pipeline (DAG)** | $O(N)$ | Sequential (Output feeds input) | Low (Serialized ownership) | Audit $\to$ Patch $\to$ Verify pipelines | | **Hierarchical Tree** | $O(B^D)$ | Tiered (Vulnerable to root loss) | Moderate (Strict namespace isolation)| Deep architecture migrations | | **Mesh Team** | $O(N^2)$ | Extremely weak (Split-brain prone) | Critical (Requires locks / CRDT) | Multi-hypothesis incident triage | ### Star Fan-Out/Fan-In: The Central Bottleneck Star topologies dominate the subagent landscape. The orchestrator dispatches $K$ leaf workers, which execute independently and return summaries for central reduction. The fatal defect of the star model is **cognitive overload at the sink**. The orchestrator must act as both dispatcher and universal reducer. When three subagents return hundreds of lines of complex refactoring analysis, the orchestrator's context is overwhelmed with heterogenous prose. Because workers cannot communicate laterally, Worker A cannot warn Worker B that its interface assumptions have been invalidated. Every semantic contradiction is deferred to the final merge, forcing the orchestrator to gamble on reconciliation. ### Mesh Topologies and Actor Model Pitfalls Claude Code Agent Teams introduces peer-to-peer mesh collaboration: a leader coordinates with multiple teammates who share a common task board and can message each other directly. This model strongly echoes Carl Hewitt's (1973) Actor model and Joe Armstrong's Erlang/OTP process architecture. However, Erlang's industrial resilience depends on three foundational primitives: 1. **Strictly private process heaps** with zero shared memory; 2. **Bounded mailboxes** equipped with explicit backpressure; 3. **Supervision trees** with deterministic failure semantics (`one_for_one`, `one_for_all`, `rest_for_one`). Current LLM agent teams lack both bounded mailboxes and deterministic supervisors. When four agents engage in open-ended peer-to-peer discourse regarding a production outage, message complexity scales quadratically: $$ M = \frac{N(N - 1)}{2} \times \text{Turns} $$ Context windows burn rapidly, while sycophancy bias and attention drift take over. Agent A proposes an unverified hypothesis; Agent B elaborates upon it; the peer group rapidly converges around a collective hallucination, completely subverting the objective of diverse, independent verification. ### Filesystem Split-Brain and Write Contention When multi-agent systems are restricted to read-only exploration, topological failures waste only compute. But when workers are granted filesystem write privileges, distributed anomalies hit bare metal. Consider Worker 1 updating authentication logic in `src/auth/token.ts` while Worker 2 concurrently instruments the codebase with distributed tracing spans: 1. Worker 1 reads `token.ts` and prepares an updated authentication routine; 2. Worker 2 reads the original `token.ts` and inserts a trace header; 3. Worker 2 writes its copy to disk a split second later, executing a Last-Write-Wins (LWW) clobber. 4. **Worker 1's authentication patches are silently erased without generating a single compiler syntax error.** ```text [Shared Repository Working Tree] (NO Concurrency Control) | +-------------+-------------+ | | Worker 1 reads Worker 2 reads src/auth/token.ts src/auth/token.ts | | Modifies Auth Logic Injects TraceID Logging | | Writes token.ts (t=1) | | Writes token.ts (t=2) -> SILENT OVERWRITE! v v [Changes Lost!] [Corrupted State Committed] ``` In distributed systems, this is resolved via Distributed Lock Managers (DLM) or Two-Phase Locking (2PL). In generative AI runtimes, we cannot assume probabilistic models will honor POSIX `flock` conventions. **The only production-grade defense is physical workspace isolation via Git Worktrees.** As implemented in Claude Code's batch layer, the runtime isolates concurrent mutators: ```bash git worktree add -b feat/worker-auth .worktrees/worker-auth HEAD git worktree add -b feat/worker-trace .worktrees/worker-trace HEAD ``` Each writable worker operates within its own physical filesystem checkout. Workers remain oblivious to concurrent modifications on disk; all write contention is deferred to an atomic Git 3-way merge at commit time. **We replace wishful assumptions about agent discipline with optimistic concurrency control (OCC) enforced by the filesystem.** --- ## 4. State Reconciliation: Who Writes the Final Commit Log? Multi-agent demonstrations look immaculate because they conveniently conclude at the "advisory" stage. Real software engineering begins when divergent states must be merged, compiled, and passed through integration suites. ```text [Worker Worktree 1] [Worker Worktree 2] | | +------------+------------+ | [ Git 3-Way Merge ] | +---------------+---------------+ | (Clean Merge) | (Conflict / Invariant Broken) v v [ Deterministic Verification ] [ Automatic Rollback / Abort ] - tsc / ast-grep / lint | - unit tests / integration tests v | [ Log Failure Snapshot ] +--------+--------+ [ Erlang-style Restart ] | (Pass) | (Fail) v v [ Atomic Commit ] [ Reject Patch ] ``` ### Semantic Drift Breaches Textual 3-Way Merge Standard version control systems rely on line-based diff algorithms (`diff3`): ```text <<<<<<< HEAD export async function authenticate(token: string, timeoutMs: number): Promise { ======= export async function authenticate(token: string, options: AuthOptions): Promise { >>>>>>> feat/worker-auth ``` If two workers edit disjoint functions in the same file—or touch entirely separate files—Git reports a clean merge. Yet software correctness depends on **semantic invariants**, not line offsets: - Worker A updates `UserService.getUserById(id: string)` to `getUser(id: UserId)`; - Worker B, working on an API controller in another directory, introduces new calls to `getUserById(id)`; - The Git 3-way merge succeeds without a single text conflict. Shipped to production, this yields immediate runtime panics (`NoSuchMethodError`). **The reconciliation of multi-agent state cannot rely on an LLM writing a polite summary; it requires an algorithmic, deterministic Verification Oracle:** 1. **AST Semantic Validation**: Running static type checkers (`tsc --noEmit`, `cargo check`) and symbol analyzers across the unified codebase; 2. **Runtime Verification**: Automatically triggering regression suites targeting affected modules; 3. **Atomic Abort**: Rolling back immediately upon verification failure, discarding the worktree diff completely to prevent dirty state contamination. ### Durable Checkpointing: LangGraph's State Machine In the Python landscape, LangGraph provides a robust template for state persistence. Its `Checkpointer` interface (such as `PostgresSaver`) decouples multi-agent state progression into an append-only event-sourced log: ```python # LangGraph Checkpointer State Snapshot Tuple CheckpointTuple( config={"configurable": {"thread_id": "tx_20260929", "checkpoint_ns": "subagent_auth"}}, checkpoint={ "v": 1, "ts": "2026-09-29T00:40:00Z", "channel_values": {"files_modified": ["src/auth.ts"], "tests_passing": False}, "channel_versions": {"files_modified": 3, "tests_passing": 3}, "versions_seen": {"worker_1": 2} }, metadata={"source": "loop", "step": 4, "writes": {"worker_1": {"status": "retry"}}}, parent_config={"configurable": {"checkpoint_id": "019e59ca-7536-753a-bf78"}} ) ``` By versioning state into PostgreSQL, the runtime unlocks two vital architectural primitives: 1. **Time Travel and Clean Rollback**: When a subagent's remediation breaks integration suites, the engine does not pollute context trying to undo the mess; it resets the state pointer to `checkpoint_id`, restoring a pristine state to retry with alternative heuristics; 2. **Asynchronous Human-in-the-Loop Interruption**: Long-running transactions can pause, flush their state to disk, free compute resources, and await human approval before resuming. ### Crash-Only Software and Fail-Stop Semantics George Candea and Armando Fox (2001) argued in *Crash-Only Software* that resilient distributed systems should possess only two state transitions: starting and crashing. Rather than relying on fragile graceful shutdown routines, components must be designed to withstand sudden failure and recover instantly from checkpoints. Multi-agent process hierarchies must enforce these rules: - **Cascading Interruption**: When a parent task disconnects or receives a `SIGINT`, the runtime must issue immediate termination signals across its process group or container cgroups. Hermes codifies this explicitly: when a parent turn aborts, all active child workers are instantly killed to prevent background token hemorrhaging; - **Fail-Stop Isolation**: A subagent crash must never crash the orchestrator. The parent registers the worker failure as an error event, falling back to a deterministic fallback or rescheduling the task. --- ## 5. Deconstructing Five Production Architectures Abstract theory proves its value only in production execution. The table below contrasts five major agent runtimes: ```text +-----------------------------------------------------------------------------------+ | Five Real-World Architectures | +-----------------------------------------------------------------------------------+ | Codex | Explicit Fan-out | Star (Isolated) | Ephemeral | Strict Sandbox| | Claude Code| Description / Team| Star / Mesh / Tree| Session / WT | Git Worktree | | OpenClaw | Gateway Ingress | Multi-tenant Gate | Persistent | Per-Agent Dir | | Hermes | RPC / Kanban Board| RPC / Durable DAG | SQLite / WAL | Capped Workers| | Qoder | Upfront Plan Gate | Star (Specialized)| Transactional| Tiered Sandbox| +-----------------------------------------------------------------------------------+ ``` ### OpenAI Codex: Determinism via Sandbox Containment Codex reflects the restraint of battle-tested infrastructure engineering. It foregoes speculative autonomous collaboration in favor of strict sandbox isolation: - **Zero Recursive Delegation**: Subagents cannot spawn child agents; delegation depth is capped at 1; - **Strict Role Separation**: The `explorer` role is strictly read-only, emitting structured file paths and call graphs; the `worker` role possesses restricted write access, governed by explicit file ownership paths in the prompt; - **Patch Reconciliation**: All mutations are synthesized into a consolidated Git patch by the orchestrator, anchoring AI concurrency firmly within version control transactions. ### Claude Code: The Three-Tier Escalation Model Claude Code cleanly stratifies collaboration into three distinct runtime layers: 1. **Tier 1 (Ephemeral Subagents)**: Context isolation for single sessions. Verbose test outputs and codebase greps are relegated to throwaway child contexts, returning only distilled summaries; 2. **Tier 2 (Agent Teams)**: Parallel multi-hypothesis investigation. Teammates explore distinct debugging vectors concurrently, sharing progress via a synchronized task list; 3. **Tier 3 (Worktrees & Batch)**: Monolithic repository refactoring. The system drops conversational peer collaboration entirely, physically partitioning concurrent workers across isolated `git worktrees` and validating all mutations with test suites. ### OpenClaw: The Multi-Tenant Messaging Gateway OpenClaw is less a coding agent and more an operating system for intelligent message routing: - **Ingress Multiplexing**: Normalizes heterogenous incoming message streams, routing events to designated agent runtimes via deterministic policy tables; - **Security Sandboxing**: Isolates workspace directories, persona rules, and API credentials per agent, preventing cross-tenant context leaks; - **ACP Harness Layer**: Treats external specialized coding runtimes (Codex, Claude Code CLI) as downstream tools, preserving its identity as an unopinionated message gateway. ### Hermes: Ephemeral RPC vs. Durable State Machines Hermes resolves the chronic confusion between transient tasks and long-lived workflows: - **Ephemeral RPC (`delegate_task`)**: The parent blocks while a child runs in an isolated terminal session, returning a structured summary within seconds or minutes; - **Durable State Machine (Kanban)**: Long-horizon workflows persist to SQLite with WAL mode. Tasks transition through formal states (`TODO -> IN_PROGRESS -> BLOCKED -> COMPLETED`). Workflows can span days, survive host reboots, and wait for asynchronous human feedback. ### Qoder: Upfront Contract Planning and Tiered Sandboxes Qoder strikes a practical compromise between automation and human oversight: - **Upfront Planning Gate**: In Experts mode, the Team Lead must synthesize a structured execution plan and await explicit user confirmation before mobilizing specialists. The concurrency contract is signed by a human before a single line of code is touched; - **Tiered Sandbox Isolation**: Benign commands execute directly; destructive filesystem mutations are quarantined in containers; privilege escalations halt and demand human authorization. --- ## 6. Architectural Decision Checklist: A Pragmatic Guide Before deploying a multi-agent topology to production, evaluate your system against these distributed systems criteria: ```text [ New Task Arrives ] | +-------------v-------------+ | Can a single agent loop | | handle it deterministically? +-------------+-------------+ | [Yes] | [No] +----------------+----------------+ | | (Run Single Agent) +-------------v-------------+ Keep context lean; | Is context pollution or | Short feedback loop. | long-tail search the issue? +-------------+-------------+ | [Yes] | [No] +----------------+----------------+ | | (Star Fan-Out) +-------------v-------------+ Spawn Read-Only | Do tasks have strict sequential Explorer Workers | data dependencies? +-------------+-------------+ | [Yes] | [No] +----------------+----------------+ | | (Serial Pipeline) +-------------v-------------+ Pass context downstream; | Will workers write to disk Topological order execution| simultaneously? +-------------+-------------+ | [Yes] | [No] +----------------+----------------+ | | (Git Worktree OCC) (Actor Mesh Team) Physical isolation; Read-only hypothesis Compiler verification. testing; bounded turns. ``` ### The Five Commandments of Production Agent Architectures 1. **The Single-Agent Default**: If a problem fits within a single context window and has tight step dependencies, run it in a single agent loop. Multi-agent coordination entropy routinely outstrips its parallelism gains; 2. **Read/Write Segregation**: Fan-out workers must be read-only by default. When write access is required, allocate isolated physical workspaces (Git worktrees or ephemeral containers); never permit uncoordinated writes to a shared directory; 3. **The Deterministic Verification Oracle**: Every fan-in reduction must pass through compilers, linters, and regression suites. Any patch failing automated verification must trigger an immediate atomic abort and rollback; 4. **State Persistence Decoupling**: Workflows spanning more than a single interaction turn must be persisted as state machines in durable storage (PostgreSQL/SQLite). Never rely on long-running memory processes; 5. **Circuit Breaking and Cascading Termination**: Strictly bound concurrency width ($\le 4$) and recursion depth ($\le 2$). The cancellation of a parent task must broadcast immediate physical kill signals to all active subagents. ### The Formal Delegation Contract Specification In production runtimes, orchestrators must never delegate work via vague conversational prompts. All delegations should be governed by a structured, machine-verifiable contract: ```yaml Contract: Version: "1.0-RFC" TaskID: "task_auth_audit_0929" Timestamp: "2026-09-29T00:40:00Z" Identity: Role: "Read-Only Security Explorer" Profile: "security-auditor-v2" Scope: TargetPaths: - "src/auth/**" - "src/middleware/session.ts" ForbiddenPaths: - "src/database/**" - "config/secrets/**" Capabilities: FileRead: true FileWrite: false NetworkAccess: false TerminalCommandLevel: "read-only-inspect" SubagentSpawnAllowed: false Invariants: - "Do NOT alter any existing business interfaces." - "Do NOT attempt to format or refactor unrelated files." VerificationOracle: Format: "JSON" Schema: type: "object" required: ["findings", "risk_level", "suggested_patch_boundaries"] TimeoutSeconds: 120 OnFailure: "Fail-Stop and emit snapshot" ``` --- Multi-agent systems are not a magic bullet; they are distributed systems subjected to the chaotic realities of probabilistic inference. Abandon the hype of unconstrained collective intelligence. Return to first principles—constrain failure domains, lock down writes, bound context entropy, and anchor every merge in deterministic compiler verification. Only then can intelligent agents operate reliably in real-world production environments.