CBCL: Safe Self-Extending Agent Communication

Abstract: Agent communication languages (ACLs) enable heterogeneous agents to share knowledge and coordinate across diverse domains. This diversity demands extensibility, but expressive extension mechanisms can push the input language beyond the complexity classes where full validation is tractable. We present CBCL (Common Business Communication Language), an agent communication language that constrains all messages, including runtime language extensions, to the deterministic context-free language (DCFL) class. CBCL allows agents to define, transmit, and adopt domain-specific "dialect" extensions as first-class messages; three safety invariants (R1--R3), machine-checked in Lean 4 and enforced in a Rust reference implementation, prevent unbounded expansion, applying declared resource limits, and preserving core vocabulary. We formalize the language and its safety properties in Lean 4, implement a reference parser and dialect engine in Rust with property-based and differential tests, and extract a verified parser binary. Our results demonstrate that homoiconic protocol design, where extension definitions share the same representation as ordinary messages, can be made provably safe. As autonomous agents increasingly extend their own communication capabilities, formally bounding what they can express to each other is a precondition for oversight.

• The paper introduces CBCL, a protocol that enables agents to safely extend communication through runtime dialect installations while preserving deterministic parsing.
• It employs a deterministic context-free language design enforced by Lean 4 verification and a Rust-based implementation to ensure acyclic, bounded, and immutable core behaviors.
• Empirical results and formal proofs demonstrate that CBCL effectively prevents parser differential attacks and achieves efficient dialect propagation in multiagent systems.

Safe Self-Extending Communication for Autonomous Agents: An Analysis of CBCL

Overview and Motivation

CBCL (Common Business Communication Language) is introduced as an agent communication protocol balancing extensibility and security, addressing the persistent LangSec (language-theoretic security) challenge in multiagent systems. The protocol enables agents to define, transmit, and adopt new domain-specific extensions ("dialects") at runtime yet remains strictly within the deterministic context-free language (DCFL) class, thereby ensuring tractable parsing and preventing parser differential attacks and unintended Turing-equivalent attack surfaces. The protocol combines homoiconic message structure, Lean 4 mechanized verification, and Rust-based reference implementation.

Language Design and Security Invariants

CBCL messages are S-expressions with a minimal core vocabulary (eight performatives). The protocol supports runtime extensibility: agents exchange dialect definitions as first-class protocol messages. Critically, CBCL enforces three safety invariants:

R1 (No Recursion): Pattern-template substitution definitions in dialects must be acyclic—no direct or mutual recursion, iteration, or reflection is permitted, precluding unbounded template expansion.

R2 (Resource Bounds): All dialects statically declare hard limits on nesting depth (≤64), expansion size (≤8192 characters), and verification time (≤1000 ms), enforced at both installation and use.

R3 (Core Preservation): The core performatives cannot be redefined by any dialect, preserving protocol invariants.

These constraints are mechanized in Lean 4 and strictly enforced in the Rust reference implementation, eliminating ad hoc validator gaps.

The self-extension mechanism is homoiconic: dialect definitions are themselves S-expressions and use the same language as protocol data messages. This eliminates meta-language mismatches and attack surfaces. Template expansion supports only literal templates, parameter substitution, bounded conditionals, and flat sequences—eschewing computational completeness and thereby guaranteeing expansion terminability.

Formal Verification and Theoretical Properties

A formal Lean 4 specification (5.4 KLOC, 176 theorems, zero “sorrys”) establishes CBCL’s rigorous security claims:

• Parser Correctness: The recursive-descent parser is proven sound and complete with respect to the message grammar (DCFL), and an extracted verified parser binary is provided.
• Acyclicity: Soundness and completeness of self-reference and mutual recursion checks are proven, with cycle detection in the performative dependency graph.
• Resource Enforcement: Depth and size bounds are modeled using fuel-based evaluation and termination is guaranteed.
• Core Preservation: Dialects cannot clash with the protocol base.
• Pipeline Totality: The parse→validate→verify pipeline is total—every input yields either a valid message or a well-typed error, ruling out undefined parser states.

A central result is DCFL closure under dialect installation: unique dialect names render protocol extensions prefix-partitioned, allowing a DPDA to dispatch deterministically to subgrammars, and the language recognized remains DCFL after any finite sequence of dialect installations, with all properties formalized in Lean.

Implementation and Empirical Results

The reference Rust implementation (∼11 KLOC across five crates) exhibits strong correspondence to the Lean formalization. It forbids unsafe code and supports C FFI and WASM bindings. Differential testing ensures empirical equivalence between Lean-extracted and Rust parsers. The dialect verification engine (R1–R3 plus optional signature verification) guarantees that only safe dialects are installed, with strict runtime enforcement for resource limits.

Dialect propagation employs an epidemic protocol, converging in $O(\log n)$ rounds, measured empirically for networks up to 500 agents. All messages, including dialect definitions, are serialized in RFC 9804 canonical S-expression form to enable deterministic signing and tamper-evident provenance.

Performance: The pipeline processes simple messages in ∼400 ns; dialect verification completes in 1 μs; even full dialect cycle detection (R1) completes in <2 μs. Security tests confirm that all failure cases result in deterministic, well-typed errors. Five large dialects (37 performatives) have been verified for extensibility and resource safety.

Practical and Theoretical Implications

CBCL demonstrates that practical runtime protocol extensibility and formal message safety are compatible. This contrasts with prior ACLs, where extensibility was untyped and off-protocol, or with natural language/LLM-based protocols, where parser complexity is unbounded and undecidable. The DCFL restriction is explicitly justified: it provides sufficient expressiveness for structured data, but prevents ambiguous or Turing-complete behaviors, thus aligning with LangSec principles.

CBCL addresses a known root cause for agent communication attacks such as weird machine construction and prompt injection, as evidenced by the lack of such attacks at the parser layer within the protocol’s threat model. Its explicit, verifiable extension mechanism prevents message/metadata confusion and precludes grammar evolution from introducing parser differentials, observable in contrasting attacks documented against LLM communication protocols.

The protocol’s semantic model is intentionally syntactic—semantic divergence is observable (via :examples and behavior conformance) but not enforced at the protocol level. The paper proposes avenues for extending syntactic safety toward protocol semantics (Merkle-DAG causal constraints, visibly pushdown language enforcement), all while remaining within the DCFL class.

Limitations and Trade-offs

The DCFL ceiling implies that some patterns—recursive or context-sensitive transformations, cross-field validation, dynamic aggregation—cannot be expressed in dialect templates and must reside in application logic. Trust, naming, and dialect churn management are extrinsic to CBCL; the protocol ensures only syntax and resource safety, not dialect quality or governance.

There is an explicit trade-off: expressivity is intentionally limited to enable decidable, tractable verification and robust, protocol-level safety, sacrificing patterns only expressible with Turing or context-sensitive power.

Conclusion

CBCL operationalizes LangSec theory to realize a self-extensible, formally safe, and tractably verifiable agent communication protocol. By tightly constraining extensibility within the DCFL boundary and providing mechanized, end-to-end safety proofs alongside a performant reference implementation, the work provides a template for secure protocol design in adversarial multiagent environments. The formal separation of language extension from Turing-completeness demonstrates the feasibility of robust oversight in open agent ecosystems, highlighting that the choice of input language class is foundational to protocol security and oversight. Future theoretical work may extend syntactic safety toward richer semantic and protocol correctness, preserving the deterministic and verifiable substrate.