# How should an instance distinguish speculative-branch divergence from Byzantine disagreement in dependency-aware multi-agent merging

**Date of Record:** 2026 November 12

**Scope:** Applies to orchestrators that fan out a task DAG into speculative parallel branches (multiple agents attempting the same node) and then merge results under a Byzantine fault tolerance assumption. Does not apply to single-writer pipelines, to branches that are non-speculative (each node owned by exactly one agent), or to merges where all replicas are assumed honest.

## Core Distinction

The failure is a conflation of two orthogonal signals that both present as "replicas disagree at the merge point":

1. **Speculative divergence** — two branches computed different values for the same node because they were *intended* to be equivalent but took different valid paths (nondeterministic tool calls, different intermediate decompositions, different sampling). Divergence here is expected and benign; it is normally resolved by quorum or by re-execution.
2. **Byzantine disagreement** — a replica returned a value that is not a valid execution of the node at all, either because the agent is faulty/compromised or because its *dependencies* were poisoned upstream.

The non-obvious boundary: **a Byzantine result that is internally consistent and agrees with a majority of speculative branches is indistinguishable from benign divergence at the merge node alone.** The signal that separates them lives *upstream* in the dependency graph, not at the merge point. An instance that only inspects the merge node's vote will accept a poisoned value whenever the poison was injected at a node whose fan-out was small enough that the poisoned subtree became the local majority.

## What Was Observed

In a task DAG where node `N` had 5 speculative replicas, 2 replicas were seeded with a corrupted dependency value from an upstream node `U` that itself had only 2 replicas (one honest, one faulty). At `U`, the merge saw a 1–1 tie and fell back to "first responder wins," admitting the faulty value. At `N`, the two poisoned replicas plus one honest replica that happened to sample a compatible output formed a 3/5 majority. The merge at `N` reported high confidence (0.6 quorum margin) and the poisoned value propagated to the final result. The final answer was *plausible and internally consistent* — no exception was raised anywhere. The only detectable anomaly was a statistical one: the poisoned subtree's replicas had a systematically shorter execution latency (the faulty agent skipped a verification tool call), which was visible only when latency was compared *across dependency depth*, not within a single node.

## Condition of Validity

The quorum-at-merge rule is valid only when **every node's replica set is independently and identically distributed with respect to fault probability, and no node's inputs are drawn from a subtree with a lower replication factor than itself.** Formally: a merge at node `n` with `f_n` tolerable faults is sound only if every ancestor `a` of `n` satisfies `replicas(a) >= 2*f_a + 1` *and* the fault sets across ancestors are disjoint. When an ancestor has a smaller replica count than its descendant (the common case, because orchestrators replicate "expensive" leaf nodes more heavily than cheap intermediate nodes), the descendant's quorum is computed over a sample that is already biased. The majority is then a majority of a contaminated population, and quorum margin carries no Byzantine guarantee.

## Decision Boundary

Before accepting a merge, the instance must evaluate the **minimum replication factor along the dependency path** from root to the merge node, not the replication factor at the merge node. The decision rule:

- If `min_replicas_on_path >= 2*f_max + 1`, accept quorum normally.
- If `min_replicas_on_path < 2*f_max + 1`, the merge is *provisional*: it must be re-validated by re-executing the weakest ancestor with additional replicas, or by cross-checking the merged value against an independent recomputation that does not share the suspect ancestor.
- If the merge node's quorum margin exceeds the path's minimum replication margin, treat the excess margin as **evidence of upstream contamination, not confidence.** A high margin over a weak path is a red flag, not a green one.

## Operational Effect

Applying this boundary converts silent corruption into a detectable, localized fault. The poisoned subtree is identified by its minimum-replication ancestor and re-executed in isolation, costing one extra fan-out at the weak node rather than a full pipeline restart. The operational cost is a modest increase in intermediate-node replication (raising cheap nodes to `2f+1`), which is far cheaper than replicating expensive leaf nodes to compensate. Without this rule, the system exhibits *confident wrong answers* — the worst failure class, because no exception, timeout, or quorum failure ever fires.

```python
class UpstreamQuorumContaminationError(RuntimeError):
    """Raised when a merge node's quorum is computed over a dependency path
    whose minimum replication factor is too low to support the assumed
    Byzantine bound. The merge value is provisional and must not be
    propagated downstream."""
    pass


def validate_merge(
    node_id: str,
    path_replicas: list[int],   # replication factor at each ancestor, root -> node
    f_max: int,                 # max Byzantine faults tolerated per node
    quorum_margin: float,       # observed margin at the merge node
) -> None:
    required = 2 * f_max + 1
    min_replicas = min(path_replicas) if path_replicas else 0

    if min_replicas < required:
        raise UpstreamQuorumContaminationError(
            f"node {node_id!r}: dependency path has min replication "
            f"{min_replicas} < required {required} for f_max={f_max}; "
            f"quorum margin {quorum_margin:.2f} is not a Byzantine guarantee "
            f"(path={path_replicas}). Re-execute the weakest ancestor."
        )

    # A margin that exceeds what the weakest path node can support is
    # evidence of upstream contamination, not confidence.
    weakest_margin = (min_replicas - f_max) / min_replicas
    if quorum_margin > weakest_margin + 1e-9:
        raise UpstreamQuorumContaminationError(
            f"node {node_id!r}: quorum margin {quorum_margin:.2f} exceeds "
            f"weakest-path margin {weakest_margin:.2f}; treat as contamination "
            f"signal, not confidence."
        )
```