Volitional Multiagent Atomic Transactions

• The paper introduces a framework where explicit human consent and machine preconditions jointly govern all-or-nothing state updates across multiple agents.
• It leverages mathematical models and guarded transaction systems to achieve coordinated updates and fairness conditions in decentralized and federated platforms.
• Key runtime implementations like Atomix and ATM empirically validate enhanced task success and correctness under fault injection and contention.

Searching arXiv for papers on Volitional Multiagent Atomic Transactions and closely related transactional agent runtimes. Volitional multiagent atomic transactions denote atomic state changes chosen, guarded, or otherwise authorized by multiple autonomous parties. In recent arXiv work, the term spans at least three closely related formulations: a mathematical model in which each agent consists of a person and a machine, and transactions are enabled only when machine preconditions hold and the relevant people are willing; a transactions-based foundation for specifying grassroots platforms and other global platforms; and operational runtimes that lift agent tool use or shared code mutation into all-or-nothing, progress-aware units of coordination (Lewis-Pye et al., 28 Apr 2026, Shapiro, 16 Feb 2025, Mohammadi et al., 16 Feb 2026). Across these formulations, the common thread is that atomicity is not merely a storage property: it is tied to consent, inter-agent coordination, and controlled visibility of effects.

1. Formal foundations

A basic precursor is the transactions-based distributed transition system. Given a finite nonempty set of agents $P \subseteq \Pi$, local states $S$ with initial state $s_0$, and a set of transactions $R$, the induced transition system is

$TS = (S^P,\{s_0\}^P, R{\uparrow}P),$

where the closure operator $t{\uparrow}P$ embeds a transaction over participants $Q \subseteq P$ into the larger agent set by keeping nonparticipants stationary (Shapiro, 16 Feb 2025). In that formulation, a transaction is already atomic: either all active participants update according to the transition, or the transition does not occur. This yielded crisp specifications of befriending and defriending, coin swaps, and democratic federation operations, and supported the theorem that a protocol over an interactive set of transactions is grassroots (Shapiro, 16 Feb 2025).

The later VMAT formulation adds people explicitly. Each agent state is a pair of volitional and machine components, with agent state space

$A := 2^{T/\sim} \times S.$

Here $T$ is a set of machine transactions, $\sim$ is a transaction equivalence relation, an agent state is $S$0 with $S$1 and $S$2, and a guarded transaction over a machine transaction $S$3 is written $S$4 for guards $S$5 (Lewis-Pye et al., 28 Apr 2026). The crucial move is that willingness is persistent state rather than external nondeterminism. A volitional machine transaction induced by $S$6 can fire only if the designated guards currently will the equivalence class $S$7, and when it fires, the will is discharged globally by removing $S$8 from every agent’s volitional state (Lewis-Pye et al., 28 Apr 2026).

This foundation distinguishes two transition forms. A change-volition transaction lets a person alter only the volitional component of their own state. A volitional machine transaction updates the machine states of the participating agents atomically while leaving nonparticipants stationary in machine state (Lewis-Pye et al., 28 Apr 2026). This separation is central: human choice is modeled directly, but atomicity remains a machine-level property.

The framework is also used to classify global platforms. In the transactions-based multiagent protocol formalism, an essential set of agents is a minimal set whose removal leaves only unary transitions. Minimal essential-set cardinality partitions global platforms into four classes: centralised, with $S$9; decentralised, with finite $s_0$0; federated, with $s_0$1 and $s_0$2; and grassroots, with $s_0$3 (Shapiro, 5 Nov 2025). This embeds grassroots protocols into a broader architecture-level taxonomy while keeping atomic transactions as the underlying semantic unit.

2. Guards, enablement, and correctness conditions

In the VMAT model, a guarded transaction $s_0$4 with $s_0$5 over participants $s_0$6 is enabled in configuration $s_0$7 exactly when two conditions hold: the machine precondition $s_0$8 for all $s_0$9, and the volitional guard $R$0 for all $R$1 (Lewis-Pye et al., 28 Apr 2026). This makes consent a first-class enabling condition.

The model supports several guard patterns without changing the primitive semantics. “All-of” uses one guarded transaction with $R$2. “Any-of” is represented by enumerating guarded variants with singleton guard sets. “$R$3-of-$R$4” can be expressed by enumerating all guard subsets of size $R$5 (Lewis-Pye et al., 28 Apr 2026). As a result, VMATs can model both mutual-consent actions and unilateral actions. The literature is explicit that befriending two people is guarded by both, unfriending by either, voluntary swap of coins and bonds by both parties, and payment by the payer (Lewis-Pye et al., 28 Apr 2026).

Correctness is not reduced to reachability alone. A run is correct if no equivalence class $R$6 remains enabled forever in some suffix without some representative of $R$7 being taken in that suffix (Lewis-Pye et al., 28 Apr 2026). This is a fairness-like liveness condition for enabled transaction classes, while pure change-volition steps carry no liveness obligation. Earlier grassroots specifications omitted liveness at the abstract atomic-transactions layer “to simplify the exposition,” but the later VMAT formulation turns enablement and fairness into explicit semantic machinery (Shapiro, 16 Feb 2025, Lewis-Pye et al., 28 Apr 2026).

A complementary transactional line sharpens what “aborted work should not take effect” means. In transactional memory, non-interference requires that aborted or incomplete transactions should not force any other transaction to abort. That strongest form of non-interference is not implementable with opacity, but it is implementable for local correctness properties such as local opacity and conflict local opacity (Kuznetsov et al., 2012). This suggests that VMAT systems which allow speculation, retries, or incomplete branches benefit from criteria closer to local correctness than to globally coupled opacity.

3. Runtime realizations in agentic systems

The most direct systems realization is Atomix, which addresses the problem that “LLM agents increasingly act on external systems, yet tool effects are immediate” (Mohammadi et al., 16 Feb 2026). The paper frames immediate tool externalization as unsafe under failures and retries, speculation, and contention on shared resources. Its remedy is to marry volitional planning with transactional control: calls chosen by agents become atomic transactions that either become jointly visible at a safe point or are undone (Mohammadi et al., 16 Feb 2026).

Atomix formalizes a transaction as

$R$8

with logical epoch $R$9, touched resource scopes $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$0, and issued effects $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$1. For each resource $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$2, it maintains a monotone frontier $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$3, and the progress-aware commit gate is

$TS = (S^P,\{s_0\}^P, R{\uparrow}P),$4

Bufferable effects are delayed until commit; externalized effects are issued immediately but must carry an idempotency key and, when feasible, a compensation $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$5 such that $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$6 in the corresponding commutative monoid of effects (Mohammadi et al., 16 Feb 2026). The runtime architecture consists of a transaction manager, a progress tracker, and tool adapters, and its isolation contract is explicit: opacity for buffered state, per-resource commit-order serializability of the committed external history, and best-effort rollback for externalized effects (Mohammadi et al., 16 Feb 2026).

A second realization is ATM, the AI-Atomic-Framework for multi-agent code co-synthesis within a single governance domain. ATM binds task intent, repository scope, write admission, validation, and evidence obligations into a single governance chain through the Task Contract

$TS = (S^P,\{s_0\}^P, R{\uparrow}P),$7

and a normalized WriteIntent that declares target files, read and write atoms, shared surfaces, Candidate CIDs, and bounded regions (Huang, 29 Jun 2026). Its mutation-admission plane is centered on a CID broker and a neutral steward. The broker decides whether a write intent is parallel-safe, needs-physical-split, SERIAL, blocked, or fail-closed/refine by applying seven hard gates: CID identity, shared surfaces, read/write hazards, file-range or virtual-atom overlap, ConflictKey plus canMerge, CAS base-hash, and a fallback file lock (Huang, 29 Jun 2026).

ATM’s formalization of multiagent atomicity is deliberately narrower than Atomix’s tool-effect model. It defines a conflict relation $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$8 over intents using unit identity, shared-surface overlap, declared read/write hazards, and bounded-region overlap; a deterministic composition operator $TS = (S^P,\{s_0\}^P, R{\uparrow}P),$9 for bounded-disjoint same-file edits; a broker-defined serialization order $t{\uparrow}P$0; and a fail-closed policy $t{\uparrow}P$1 (Huang, 29 Jun 2026). Governed shared writes are not applied directly by proposing agents. They are applied by a neutral steward after CAS base-hash validation and then passed through validators (Huang, 29 Jun 2026).

These runtime systems are explicit about what they are not. Atomix states that its multi-resource commit “resembles a barriered atomic commit rather than classical 2PC,” that it “does not revalidate reads” like optimistic concurrency control, and that its abort path uses compensation “saga style” (Mohammadi et al., 16 Feb 2026). ATM states that it “does not implement distributed 2PC,” is limited to a single governance domain, and treats systems like Atomix as complementary settlement layers at broader tool-effect boundaries (Huang, 29 Jun 2026).

4. Canonical platform specifications, recovery, and platform structure

The canonical examples remain social networks, cryptocurrencies, and federations. In the grassroots social-network specification, local state is a friendship set, and befriending is a binary atomic transaction

$t{\uparrow}P$2

while defriending removes the edge symmetrically (Shapiro, 16 Feb 2025). In the person-and-machine VMAT version, Befriend$t{\uparrow}P$3 is guarded by both parties and Unfriend$t{\uparrow}P$4 is guarded by either, with the safety invariant of mutuality:

$t{\uparrow}P$5

for every reachable configuration (Lewis-Pye et al., 28 Apr 2026).

For grassroots coins and bonds, local state contains multisets of bonds and a local current date. Mint is guarded by the sovereign, voluntary swap by both parties, pay by the payer, and redeem by the coin holder. The central invariant is conservation: for each issuer $t{\uparrow}P$6, the multiset of $t{\uparrow}P$7-bonds present across all agents equals exactly the multiset minted by $t{\uparrow}P$8 up to the current configuration (Lewis-Pye et al., 28 Apr 2026). The earlier transactions-based foundation presented the corresponding coin-swap model without explicit volitional state, again using binary atomic transactions to express mutual exchange cleanly (Shapiro, 16 Feb 2025).

For democratic federations, the state is a labeled directed acyclic graph of communities. Transactions include Federate, Join, and Leave, with participants determined by community membership and the order constraint $t{\uparrow}P$9 used to preserve acyclicity (Shapiro, 16 Feb 2025). These examples show that VMATs are not restricted to bilateral exchange: they naturally express higher-arity community actions.

Recovery from major faults extends the same guarded-transaction logic. In secure grassroots social graphs, each person designates identity custodians and state custodians. Identity loss is handled by a Replace transaction guarded by a willing supermajority of identity custodians; machine loss without key loss is handled via state custodians and is simpler (Eitan et al., 2 Jul 2026). The threshold condition is written

$Q \subseteq P$0

with $Q \subseteq P$1 fixed in the immutable identity record (Eitan et al., 2 Jul 2026). The same paper extends the pattern to grassroots coins and bonds, where a currency’s single-writer log is recovered exactly and the recovered sovereign resumes “without double-spending” (Eitan et al., 2 Jul 2026).

These platform specifications also connect to architecture-level classification. In the global-platform framework, centralised, decentralised, federated, and grassroots social networks can all be specified with multiagent atomic transactions, and the distinction comes from the cardinality of the minimal essential set rather than from abandoning the transactions-based model (Shapiro, 5 Nov 2025).

5. Cross-chain and federated coordination protocols

A substantial branch of the literature realizes multiagent atomicity across blockchains and across mutually distrustful domains. GPACT, the General Purpose Atomic Crosschain Transaction protocol, provides synchronous, atomic inter-contract function calls spanning multiple blockchains without modifying existing Ethereum-based chains (Robinson et al., 2020). Its flow is organized around Start, Segment, Root, and Signalling transactions, with provisional updates held in lockable storage and only materialized after a commit decision. The atomicity condition is stated as

$Q \subseteq P$2

for the set of operations in the crosschain call execution tree (Robinson et al., 2020). The closely related Atomic Crosschain Transactions white paper uses threshold BLS signatures, a Coordination Contract, dynamic code analysis, signed nested transactions, and lockability to achieve the same all-or-nothing property across private Ethereum blockchains (Robinson et al., 2020).

Application-level authentication refines this further. A callee contract can validate Originating Blockchain Id, From Blockchain Id, and From Account, formalized as a permit predicate over the identity triple

$Q \subseteq P$3

with access controlled by membership in an allowed set $Q \subseteq P$4 (Robinson, 2019). This makes cross-chain atomicity explicitly depend on which chain and which caller are authorized to participate.

AC3WN replaces timelock-centric atomic swap logic with an open witness network. Each contract has redeem and refund events, and the witness smart contract authorizes exactly one of the two global outcomes. The atomicity condition is written

$Q \subseteq P$5

together with the safety constraint

$Q \subseteq P$6

(Zakhary et al., 2019). This protocol targets asynchronous environments with crash failures and network delays, specifically to avoid the failure mode in which an honest participant misses a timelock and loses assets (Zakhary et al., 2019).

A different line studies incentive-compatible atomic swaps. 4-Swap is presented as “the first cross-chain atomic swap protocol that is both grief-free and bribery-safe, while completing asset exchange in just four transactions” (Singh et al., 6 Aug 2025). It uses griefing premiums, bribery premiums, an early-refund window, and slashing conditions; its game-theoretic analysis proves that the honest strategy profile is a subgame-perfect Nash equilibrium, and the Slashing Lemma states that whenever slashing is available to the miner, slashing strictly dominates not slashing (Singh et al., 6 Aug 2025).

Federated settings introduce a different tension: serializable scheduling can itself leak information. “Safe Serializable Secure Scheduling” proves that no protocol can guarantee both security and liveness in all federated settings, then introduces staged commit, which divides transactions into stages ordered by conflict labels and uses per-stage 2PC with precommit barriers (Sheff et al., 2016). This is relevant to VMATs because it shows that atomic multiagent coordination across distrustful domains is constrained not only by consistency but also by information flow.

6. Empirical evidence, comparisons, and limitations

The strongest current empirical evidence comes from Atomix. Under fault recovery on real workloads with 30% per-call fault injection, Tx-Full achieved $Q \subseteq P$7 task success on WebArena versus $Q \subseteq P$8 for No-Frontier and $Q \subseteq P$9 for No-Tx; $A := 2^{T/\sim} \times S.$0 on OSWorld versus $A := 2^{T/\sim} \times S.$1 and $A := 2^{T/\sim} \times S.$2; and $A := 2^{T/\sim} \times S.$3 on $A := 2^{T/\sim} \times S.$4-bench versus $A := 2^{T/\sim} \times S.$5 and $A := 2^{T/\sim} \times S.$6, recovering 110 of 186 retried faults (Mohammadi et al., 16 Feb 2026). For speculation isolation, Tx-Full produced 0% transient contamination in a bufferable store versus 100% for baselines, 0 leaked files versus 40 leaked across 20 tasks for baselines, and halved conflicts in speculative WebArena mock tasks from 296–305 to 148 (Mohammadi et al., 16 Feb 2026). For contention correctness, shared counters, read-modify-write, and mixed read/write workloads reached 100% correct final states with Tx-Full and 0% for baselines, while runtime overhead was approximately $A := 2^{T/\sim} \times S.$7 per step, less than 0.01% of wall-clock tool latency (Mohammadi et al., 16 Feb 2026).

ATM’s evaluation emphasizes admission correctness rather than end-task success. In ATM-AdmissionBench v0.2, route-label $A := 2^{T/\sim} \times S.$8, with 42/42 matched expectations and 0 unresolved rows. In the 252-row policy view, intent preservation was 97.62%, with 2 false-safe rows and 4 over-serialization rows. Ablations showed that removing virtual atoms added 8 false-safe rows and lost 9 successes; removing ConflictKey added 4 false-safe rows and lost 5 successes; and removing CID, shared-surface, or CAS each removed 3–5 successes (Huang, 29 Jun 2026). OperationalBench reported official-run P95 admission decision latency of approximately 0.024 ms, steward P95 of approximately 0.30 s, and total scenario P95 of approximately 0.31 s (Huang, 29 Jun 2026).

OptiMA provides evidence from a centralized execution framework for very complex multi-agent systems. It enforces atomic multi-agent transactions with RC2PL on non-shareable plugins and uses scheduling to optimize throughput. In a factory-floor benchmark with more than a hundred agents, transaction scheduling produced average throughput improvements such as 12.34% with a maximum of 16.79% for $A := 2^{T/\sim} \times S.$9, speed $T$0, Very Low conflict, and 10.01% average improvement for $T$1, speed $T$2, Low conflict (Çalıkyılmaz et al., 5 Nov 2025). The result is narrower than Atomix or ATM, because it assumes centralized execution, but it shows that transaction-based coordination can remain effective at VCMAS scale (Çalıkyılmaz et al., 5 Nov 2025).

Several limitations recur across the literature. Atomix notes non-compensable side effects, long-running actions that can starve later epochs, eventual-consistency hazards, in-memory deduplication that is not crash-durable, and the need for a linearizable frontier store plus durable replicated effect log in distributed deployments (Mohammadi et al., 16 Feb 2026). ATM explicitly does not claim broad comparative superiority or cross-clone governance, assumes a single governance domain, leaves liveness and starvation under high contention unproven, and acknowledges incomplete admission-time active-intent forwarding in B-12-style late catches (Huang, 29 Jun 2026). The Send kernel states that opacity against the operator requires operator-faithful trust, and otherwise only five of six guarantees survive under an unconstrained operator (Goes, 17 May 2026). Secure scheduling in federated settings proves an impossibility result: no protocol can provide both security and liveness for all transaction sets, so staged commit applies only under monotonicity and relaxed monotonicity conditions (Sheff et al., 2016).

Comparisons to classical mechanisms are correspondingly precise. Atomix is not classical 2PC, not OCC read revalidation, and not merely a saga; ATM is not distributed 2PC and intervenes at pre-write admission; AC3WN rejects timelock-based safety in asynchronous settings; and the transactional-memory non-interference result shows that globally coupled opacity is not always the right abstraction when aborted or incomplete work must not constrain others (Mohammadi et al., 16 Feb 2026, Huang, 29 Jun 2026, Zakhary et al., 2019, Kuznetsov et al., 2012). A plausible implication is that VMAT research is converging on a broad systems principle: atomicity in multiagent settings is inseparable from who is authorized to act, when effects become visible, and how losing, aborted, or delayed branches are prevented from distorting committed history.