Data sovereignty
Control over data location, movement, residency, and permitted disclosure.
PDDS consumes these constraints as policy and evidence inputs; it does not replace privacy, localization, or data-governance programs.
Distributed systems researchAI agents & agentic infrastructure
Post-Deterministic Distributed Systems
Distributed systems for AI agents.
Post-Deterministic Distributed Systems (PDDS) studies distributed systems in which cognitive components produce non-deterministic decisions, yet execution must still satisfy explicit guarantees for evidence, authority, provenance, timing, fault isolation, and state mutation.
PDDS frames agentic infrastructure not as generic “AI safety,” but as a distributed-systems research program for non-deterministic, cognitively mediated, evidence-dependent, and dynamically stateful participants capable of high-consequence mutation.
The Recurring Systems Question
How do we build distributed systems when reasoning, evidence, intent, and execution can all change independently before a consequential action commits?
Reasoning may be non-deterministic; mutation must be governed.
Sovereign Execution Boundary
Institution-Controlled Reference Architecture
Architecture Intent·Assurance & Execution Control
Admission Gate:CAC Protocol
Evidence State:Satisfied / Unknown / Violated
A locally operated gateway can evaluate proposals against organization-defined policy and evidence obligations before issuing a scoped admission certificate.
Institutional identity, delegation, and revocation
Local policy authority and evidence validation
Cognitive Admission Control (CAC)
Dependency and freshness validation
Consensus or additional approval where required
Bounded execution certificates and replay protection
Trusted execution broker and effect evidence
Local
Authority Boundary
Typed
Evidence Receipts
Guarded
Dispatch Path
Policy
Operator Defined
At a glance
What is PDDS?
Post-Deterministic Distributed Systems is a research paradigm for systems where AI agents and other participants can produce variable proposals. It asks how those proposals can become authorized, evidence-backed actions in shared infrastructure.
- Acronym
- PDDS
- Full term
- Post-Deterministic Distributed Systems
- Applies to
- AI agents, autonomous services, and agentic infrastructure
- Core question
- When may a proposed action change protected state?
From agent to action
How PDDS applies to agentic infrastructure
An agent may choose a different plan each time it runs. The infrastructure around it still needs a dependable way to decide what may change, who is accountable, and what evidence survives the action. This is the PDDS research problem in operational form.
- 01
Agent proposes
An AI agent or autonomous service submits an intended action with its target, context, and supporting evidence.
Reasoning boundary - 02
Control plane decides
Institutional policy checks identity, delegation, evidence, risk, and current state before admitting a bounded action.
Cognitive admission - 03
Trusted service executes
A confined execution path rechecks conditions, applies an authorized effect, and records what actually happened.
Governed commit
Reference flow. The actual controls depend on the action's risk, target system, and institutional policy.
Sovereign Execution & Governance Architecture
Reference Architecture • Scoped Research Results • Policy-Mapping Support
Research scope
A broader model for distributed systems with adaptive participants.
Traditional distributed systems address agreement, timing, and failures in services with defined transition rules. AI agents add another problem: they interpret goals, synthesize plans, and may choose different actions from the same starting point.
Post-Deterministic Distributed Systems (PDDS) extends the model to include non-deterministic participants such as AI agents, autonomous services, adaptive workflows, and human-in-the-loop components. PDDS treats deterministic services as the zero-ambiguity limit case inside a broader governable participant model.
A multidimensional sovereignty model
Sovereign AI is more than sovereign compute.
Domestic GPUs, local foundation models, national data centers, and data residency all matter. Operational sovereignty additionally requires control over identity, policy, consequential execution, and the evidence those actions produce. These dimensions coexist; PDDS contributes coordination and assurance mechanisms, not a substitute for privacy, localization, cybersecurity, or applicable law.
Model sovereignty
Control over model selection, hosting, access, replacement, and portability.
PDDS supports domestic, external, and mixed model strategies by separating reasoning from execution authority.
Identity sovereignty
Institutional ownership of agent identities, delegation, memory governance, and revocation.
PCI, VAI, and related work define governed lineage and authority boundaries across model or vendor changes.
Policy sovereignty
Locally governed rules determining permissible autonomous behavior.
CAC and the OpenKedge protocol treat institutional policy as trusted control-plane input, not model-generated preference.
Execution sovereignty
Institutional control over consequential state changes.
SAL, CAC, TCT, and trusted brokers place bounded admission and commit checks between proposals and protected assets.
Evidence sovereignty
Control over operational records, provenance, auditability, and evidence retention.
ATP and execution receipts provide mechanisms for operator-controlled evidence, subject to declared observation boundaries.
Reference architecture
The Sovereign Execution Boundary
The boundary separates intelligence generation from institutional authority. It can support fully domestic, hybrid, or isolated deployments; it does not presume live foreign-model traffic or require an air gap.
Zone A
Intelligence and reasoning
Domestic or permitted external models generate proposals, plans, analyses, and explanations.
- Architectural requirement
- Outputs are untrusted for execution and reasoning environments hold no direct credentials for protected state mutation.
- Implementation-dependent
- Model hosting, routing, disclosure controls, and isolation strategy follow institutional policy.
Zone B
Sovereign assurance and execution control
The institution binds identity and delegation, evaluates local policy and evidence, and mediates execution.
- Architectural requirement
- Consequential actions use authorized paths with revocation, replay protection, bounded certificates, revalidation, and effect evidence appropriate to their risk class.
- Implementation-dependent
- CAC, consensus, dependency checks, TCT, human approval, and hardware-backed controls are selected as required; not every workflow needs every mechanism.
Zone C
Protected assets
Institutional databases, cloud resources, financial services, industrial systems, and critical control planes apply authorized mutations.
- Architectural requirement
- Target credentials and consequential mutation paths remain confined to trusted execution components.
- Implementation-dependent
- Transactional, conditional, compensating, or hardware-mediated execution depends on the target system.
Five pillars
Five Pillars of PDDS
The pillar names follow the terminology defined in the PDDS paper and manifesto.
Safety Perimeter
Protocol-Driven Development
Defines machine-enforceable protocols that admit generated software and autonomous outputs only when they satisfy semantic and operational invariants.
Identity Boundary
Verifiable Agentic Infrastructure
Replaces static credentials with intent-based authorization, ephemeral delegation, and evidence-backed execution identity.
Orchestration Plane
Autonomous State Control Planes
Separates high-variance reasoning from direct state mutation while preserving intent across asynchronous execution.
Certification Core
Semantic Quorum Assurance
Evaluates meaning, intent, policy, and evidence across participants instead of relying only on bitwise agreement.
Persistence Layer
Epistemic State Replication
Replicates knowledge states and belief lineage while preserving cognitive diversity and enabling semantic rollback.
Six-layer conceptual architecture
The PDDS Research Stack
Six layers connecting probabilistic intelligence to governed, verifiable, and sovereign execution.
PDDS connects foundations, identity, evidence, admission, consensus, and institutional sovereignty. The 24 unique PDDS artifacts include 20 research-paper records; each appears in one primary tier. Publication status and evidence maturity are shown on individual cards. This conceptual stack is separate from the execution lifecycle.
PDDS Research Spine ProgressionFaults → Admission → Scheduling → Lifecycle → Causality → Placement → Impossibility
Foundations → GovernanceResearch foundations → Institutional deployment
Tier 04 Deep-Dive4 Artifacts
Cognitive Admission & Sovereign Execution
Condition consequential execution on risk, evidence, bounded authority, and commit-time validity.
Central research question
When is an authorized agent actually ready and permitted to execute a consequential action?
Sovereign AI relevance
Places local policy, bounded certificates, trusted brokers, dispatch guards, and commit checks at the execution boundary.
Key protocols and concepts
Cognitive Admission ControlSovereign Execution BrokerTaming Cognitive TransactionsTernary Decider
Governing Invariant
“Authorization ≠ Epistemic Readiness. Consumed reasoning tokens cannot substitute for empirical evidence.”
Technical context and evidence boundary
Conditions execution authority on affirmative epistemic readiness. Evaluates non-fungible assurance obligations via ternary semantics, triggering closed-loop remediation and minting guard-bound admission certificates.
Controlled prototype result: CAC uses Admit / Remediate / Deny evaluation and dispatch guards. The implementation ran 2,730 local trials in total; across 390 CAC trials, 120 effects completed and no modeled harmful effect was observed. This is not a production failure rate.
Papers and Technical Artifacts in this Layer
Paper 5PreprintarXiv:2606.11632
Jun 10, 2026Sovereign Assurance Boundary
Certificate-Bound Admission for Agentic Infrastructure
Defines typed execution contracts, assurance certificates, revocation epochs, and broker-enforced admission.
Paper 8PreprintarXiv:2606.20520
Jun 18, 2026Sovereign Execution Broker
Enforcing Certificate-Bound Authority in Agentic Control Planes
Defines certificate verification, live-state drift checks, scoped identity, bypass prevention, and replay-safe execution.
Paper 12CompletedarXiv:2609.16313
Sep 14, 2026Cognitive Admission Control
Risk-Conditioned Assurance for Consequential Actions in Agentic Distributed Systems
“What evidence and assurance must exist before a high-consequence action may execute?”
Maps modeled action risk to explicit assurance obligations and enforces a deterministic admission boundary.
Takeaway:Risk determines required assurance before mutation.
PROTOTYPE VALIDATEDEvidence, scope & assumptions+
Evidence: 2,730 controlled local trials in total. Across 390 CAC trials, 120 effects completed and no modeled harmful effect was observed; 9,000 additional measurements exercised the local dispatch path.
Scope: Controlled TypeScript prototype behavior and local cost, not a production failure rate or general physical-safety result.
Assumptions:
- Policy obligations are adequate.
- Evidence is sound and fresh.
- The environment model covers relevant transitions.
- Complete mediation and dispatch-time condition preservation hold.
Paper 13CompletedarXiv:2609.20261
Jul 28, 2026When AI Agents Commit
Cognitive Serializability Across Data, Evidence, Policy, and Authority
“When can a non-deterministic cognitive decision safely mutate durable system state?”
Defines commit-time coordination across data, evidence, policy, authority, and executable state.
Takeaway:Reasoning may be non-deterministic; mutation must be governed.
PROTOTYPE VALIDATEDEvidence, scope & assumptions+
Evidence: A PostgreSQL prototype rejected all injected anomalies in 28 controlled falsification histories. Mean added commit latency was 3.22 ms across 10,000 executed transactions.
Scope: Controlled conformance histories and microbenchmark; not a production reliability or universal anomaly-prevention rate.
Assumptions:
- Trusted mediation captures every value exposed to reasoning.
- The sealed dependency plan is complete and current.
- Guards, exact post-seal grants, external validity, and durability assumptions hold.
- TCT-C is effect-compatible admission and does not serialize the original derivation.
Cross-tier relationships
Why the layers must work together
01
Identity without evidence can preserve unsupported beliefs.
02
Evidence without admission cannot prevent inappropriate actions.
03
Admission without trusted execution mediation can be bypassed.
04
Consensus without accounting for shared epistemic dependencies can amplify shared errors.
05
Execution without authoritative effect evidence cannot establish accountability.
06
Sovereign deployment requires these controls to remain under authorized institutional governance.
PDDS Evidence Layer · ATP SpecificationarXiv:2608.16178
Agent Telemetry Protocol (ATP)
ATP replaces prose-first telemetry with cryptographically verifiable state deltas. On the paper's AIOpsLab and OpenTelemetry Astronomy Shop workloads, it reduced context tokens by 88.8% and raw wire footprint by 96.4% versus OpenTelemetry JSON. Those are benchmark results, not universal operating rates.
BENCHMARK RESULTEvidence, scope & assumptions+
Evidence: On AIOpsLab and OpenTelemetry Astronomy Shop workloads, ATP reduced raw wire footprint 96.4% versus OpenTelemetry JSON and context tokens 88.8%. The primary evaluation observed 0 successful passive prompt injections in 50 adversarial trials per ATP configuration, independently replayed on a second model.
Scope: Named microservice benchmarks and passive prompt-injection test set; not a universal injection defense.
Assumptions:
- Typed state-delta paths cover the monitored signals.
- Untrusted strings remain quarantined.
- Producer hosts and unmonitored code paths are outside the stated boundary.
96.4%
Wire Footprint Reduction
512.4 B → 18.4 B per record versus OpenTelemetry JSON in the weighted workload.
88.8%
Context Token Savings
34k → 3.8k tokens per incident diagnosis session.
75% Faster
Time to Root Cause
Claude-3.5-Sonnet mean TT-RCA: 184s → 46s across the controlled incident benchmark.
0 / 50
Successful Passive Injections
Per ATP configuration in the primary-model test set; independently replayed on a second model.
PDDS Consensus Layer · EBFT SpecificationarXiv:2607.16109
The Honest Quorum Problem & Epistemic BFT
Classical BFT bounds Byzantine behavior but does not characterize shared semantic error among protocol-compliant validators. EBFT adds confidence-indexed budgets for coherent invalid endorsement and unusable support. Its quorum conditions, including q > f + eδ, are conditional on calibrated fault budgets and certificate-validity checks.
FORMAL RESULTEvidence, scope & assumptions+
Evidence: Defines confidence-indexed semantic-safety and liveness budgets in addition to the Byzantine fault bound.
Scope: Conditional quorum bounds, not elimination of correlated errors.
Assumptions:
- The workload-specific e_delta and u_epsilon budgets are calibrated conservatively.
- Certificate validity checks and conventional Byzantine assumptions hold.
Q > f + eδ
Epistemic Quorum Lower Bound
Conditional safety threshold using Byzantine and coherent-invalid-endorsement budgets.
3 Fault Classes
Taxonomy of Agent Failures
Physical/crash, semantic divergence, and correlated hallucination.
eδ
Semantic Safety Budget
Bounds coherent invalid endorsement outside the Byzantine set at confidence 1−δ.
EFD
Shared-Dependency Model
Provider or model diversity is not proof of source independence.
PDDS Transaction Layer · TCT SpecificationarXiv:2609.20261
When AI Agents Commit: Cognitive Serializability (TCT)
Classical ACID isolation orders database effects but does not by itself capture every evidence, policy, and authority dependency used during deliberation. Under complete trusted dependency capture and the paper's guard and durability assumptions, TCT-S provides strict Cognitive Serializability. The weaker TCT-C recertifies an effect against a jointly protected current dependency vector and policy; it does not serialize the original derivation.
PROTOTYPE VALIDATEDEvidence, scope & assumptions+
Evidence: A PostgreSQL prototype rejected all injected anomalies in 28 controlled falsification histories. Mean added commit latency was 3.22 ms across 10,000 executed transactions.
Scope: Controlled conformance histories and microbenchmark; not a production reliability or universal anomaly-prevention rate.
Assumptions:
- Trusted mediation captures every value exposed to reasoning.
- The sealed dependency plan is complete and current.
- Guards, exact post-seal grants, external validity, and durability assumptions hold.
- TCT-C is effect-compatible admission and does not serialize the original derivation.
28 / 28
Controlled Histories
All injected anomalies were rejected in the PostgreSQL prototype evaluation.
3.22 ms
Mean Commit Overhead
Added mean commit latency across 10,000 prototype transactions (p99 8.41 ms).
1,842 tx/s
Peak Throughput
Peak measured prototype throughput at 32 concurrent threads.
TCT-C
Weaker Compatible Profile
Recertifies the concrete effect under current protected dependencies; not derivation faithfulness.
Reference deployment options
One boundary model, multiple deployment patterns.
The appropriate pattern depends on applicable policy, threat models, disclosure constraints, operational requirements, and regulator or customer obligations. Execution sovereignty does not prescribe offshore reasoning.
Pattern A — Fully domestic
Domestic model hosting, policy authority, execution, and evidence retention operate inside approved institutional or national environments.
Reasoning, control, protected assets, and records remain within the domestic deployment boundary.
Pattern B — Hybrid sovereign
Permitted external or domestic reasoning is combined with local identity, policy, execution authority, and evidence custody.
Only approved, appropriately minimized information crosses the model boundary; models receive no direct mutation credentials.
Pattern C — Isolated or air-gapped
Local models or approved offline workflows provide intelligence without a live dependency on external model services.
Policy, execution governance, protected assets, and evidence remain local; synchronization procedures are implementation-specific.
Architectural invariants
Requirements that keep intelligence separate from authority.
Architectural requirementSAL and OpenKedge
Reasoning does not confer execution authority.
Formal resultCAC
An authenticated agent is not automatically ready to act.
Conditional formal resultCAC
An admission certificate is bound to a specific action and its validity conditions.
Formal modelEBFT and EFD
Collective agreement does not establish semantic correctness.
Architectural requirementOpenKedge, TCT, and ATP
Execution evidence must describe actual effects, not merely intended actions.
Architectural requirementPCI and epistemic boundedness
An agent's remembered belief is not automatically an authoritative fact.
Architectural requirementVAI and PCI
Authority must remain revocable across model and vendor changes.
Illustrative national-cloud operation
Changing a production network security policy
This example describes a reference control flow, not a claim that OpenKedge operates a production national cloud. Exact checks and execution mechanisms depend on the institution and target platform.
- 01
Propose
A network-operations agent proposes narrowing an ingress rule on a production national-cloud segment after detecting unexpected exposure.
- 02
Bind identity and delegation
The institution resolves the agent identity, operator-approved task, target segment, permitted change class, and delegation expiry.
- 03
Evaluate policy and evidence
Policy requires a current topology snapshot, ownership record, affected-service inventory, active-session check, rollback plan, and change-window authorization.
- 04
Remediate or deny
Missing, stale, or conflicting evidence returns a scoped request for fresh observations or human review; an explicit policy violation is denied.
- 05
Admit bounded action
If obligations are satisfied, the gateway issues a short-lived certificate bound to the exact rule diff, target, evidence set, and dispatch guards.
- 06
Revalidate and execute
The broker checks revocation, policy epoch, target version, and live dependencies before using its own confined credential to apply only the certified change.
- 07
Record effect and reconcile
The system retains the proposal, authority chain, evidence manifest, decision, actual target response, resulting state, and reconciliation receipt under institutional retention policy.
What OpenKedge is
Research paradigm, protocols, reference architecture, and code—clearly separated.
PDDS
The systems research paradigm for coordinating deterministic and probabilistic participants.
OpenKedge
The research initiative and implementation framework developing the PDDS program.
Research protocols
Individually proposed and evaluated mechanisms such as SAL, CAC, TCT, ATP, PCI, EBFT, and EFD.
Reference architecture
An integrated deployment model showing how selected mechanisms can compose under an institution's trust boundary.
Software implementations
Available code and prototypes, each labeled by its actual evaluation maturity rather than as a generally available integrated platform.
Models may be global. Execution authority must remain sovereign.
Citation
Cite the PDDS paper
The canonical research artifact is the arXiv paper, with the OpenKedge paper page serving as the HTML reading and sharing surface.
FAQ
PDDS FAQ
What is Post-Deterministic Distributed Systems?
Post-Deterministic Distributed Systems (PDDS) is a research paradigm for coordinating AI agents, stochastic models, deterministic services, and people. It treats variable model outputs as proposals and requires explicit policy, evidence, authority, and state-transition controls before consequential execution.
Read the PDDS researchHow does PDDS relate to AI agents and agentic infrastructure?
AI agents can plan and call tools, but their outputs can vary with context and evidence. PDDS studies how those agents coordinate with services and people; agentic infrastructure applies its proposed controls at the boundary between an agent's proposal and a protected system's state change.
See the agent-to-action flowWhat is sovereign execution?
Sovereign execution is an institution's ability to retain control over which consequential actions autonomous systems may perform, under which identity, policy, evidence, and validity conditions, through execution paths the institution authorizes.
Explore the reference architectureHow does execution sovereignty differ from data sovereignty?
Data sovereignty governs where data resides, moves, and may be disclosed. Execution sovereignty governs who or what may change protected state. Both are necessary and neither substitutes for model custody, privacy, localization, security, or applicable law.
Compare sovereignty dimensionsCan sovereign AI use global foundation models?
Potentially, when institutional policy permits it. A hybrid pattern can use approved external reasoning while retaining local identity, policy, execution authority, and evidence custody. Fully domestic and isolated patterns remain equally valid options.
Review deployment patternsWhat is the sovereign execution boundary?
It is the institution-controlled trust boundary between untrusted action proposals and protected assets. It contains the identity, policy, evidence, admission, revocation, dispatch, and recording controls required by the chosen risk class.
Inspect the boundaryHow does PDDS differ from classical distributed systems?
Classical distributed systems primarily reason about deterministic transition semantics under network, timing, crash, and Byzantine faults. PDDS adds explicit treatment of probabilistic participants, semantic validity, evidence provenance, bounded authority, and governed execution.
Read the foundationsWhy is RBAC alone insufficient for safe autonomous execution?
RBAC can establish that a principal has permission, but permission alone does not establish that current operational evidence supports a particular action. Readiness may depend on freshness, dependencies, risk, target state, and recovery conditions.
Read about cognitive admissionWhat is the difference between authorization and cognitive admission?
Authorization asks whether a principal may attempt an action. Cognitive Admission Control asks whether the specific action is sufficiently supported by policy-required evidence and remains within its bounded validity conditions.
Explore CACHow does PDDS address correlated multi-agent failures?
EBFT introduces confidence-indexed semantic-safety and liveness budgets, while Epistemic Fault Domains model shared evidence and infrastructure ancestry. Their results are conditional on calibrated budgets, represented dependencies, and runtime validity checks.
Explore EBFT and EFDHow do PCI, CAC, ATP, and EBFT fit together?
PCI governs persistent identity and belief lineage; ATP supplies typed operational evidence; CAC evaluates action readiness; and EBFT addresses semantic quorum risk when collective approval is required. A workflow uses only the mechanisms justified by its risk and assurance policy.
Explore the six tiersIs OpenKedge a research framework or a production platform?
OpenKedge is a research initiative and implementation framework. The portfolio includes formal results, reference architectures, prototypes, benchmarks, and open-source implementations with different maturity levels; this page does not claim a generally available integrated production platform or a verified national-cloud deployment.
Review implementation statusSovereign execution control
Govern the proposal before it becomes an action.
Explore the research, inspect the open implementations, or discuss how the reference architecture maps to your institution's trust boundary.