What consensus barrier signatures must be recorded when a multi-agent commit cannot be guaranteed?
**Date of Record:** 2026 October 26 **Scope:** Applies when a multi-agent system attempts a coordinated commit (a single state mutation that requires all participating agents to succeed atomically) and the consensus barrier cannot be guaranteed due to partial failures, network partitions, or timeout, and the system must persist the exact partial state for a successor to reconcile. Does not apply to strictly single-agent commits, or systems where the coordinator has unilateral final authority.
Core Distinction
The separation between **commit success** (the atomic mutation was applied to all participants) and **consensus barrier signature** (the cryptographic proof of which participants acknowledged the commit, which rejected, which never responded, and at what epoch). Failing to distinguish these creates the **Ghost Commit Hazard**: the system reports commit failure to the caller, but some participants actually applied the mutation. The successor, unaware of the partial commit, inherits an inconsistent state and cannot determine whether to roll forward (apply to the rest) or roll back (revert the partial).
What Was Observed
In distributed multi-agent commit protocols, failing to record consensus barrier signatures produces three primary failure modes:
- **Split-Brain Commit:** Three of five agents acknowledge the commit, two time out. The coordinator reports failure. But the three that succeeded now have different state than the two that didn't. The successor cannot reconcile because it doesn't know which agents hold which state.
- **Silent Rollback Failure:** The coordinator initiates rollback. Two agents roll back successfully, one fails to roll back (e.g., compensating transaction failed). The successor inherits a partially-rolled-back state with no proof of which side effects persisted.
- **Late Acknowledgment:** An agent acknowledges the commit after the coordinator already declared failure. The successor sees a "failed" commit but discovers the state actually contains the mutation on the late agent, causing a phantom state divergence.
Recorded Elements
- **`per_participant_ack_receipt`:** For each agent, the cryptographic proof of whether it acknowledged, rejected, timed out, or acknowledged late (with timestamp), forming the complete barrier state.
- **`commit_epoch_signature`:** The exact epoch at which the coordinator declared the commit decision, allowing late acknowledgments to be distinguished from legitimate participants.
- **`compensating_transaction_manifest`:** If rollback was initiated, the exact compensating actions attempted per participant, with their own ack/reject/timeout status.
- **`reconciliation_directive`:** The fail-closed instruction for the successor (e.g., `ROLL_FORWARD_ALL`, `ROLL_BACKWARD_ALL`, or `ESCALATE_TO_HUMAN`) based on the barrier state.
Condition of Validity
* **Applies when:** The commit requires atomicity across multiple agents, partial failure is possible, and the successor must reconcile the partial state. * **Does not apply when:** The commit is unilateral (single agent, no coordination), or the protocol guarantees that all participants either fully commit or fully roll back atomically (e.g., a database with 2PC and guaranteed reachability).
Decision Boundary
- **Did the commit fail to achieve full acknowledgment?** If no, standard commit success applies. If yes, proceed.
- **Is the `per_participant_ack_receipt` recorded for every participant?** If no, the barrier state is unknown. The successor cannot reconcile. The instance must halt and escalate.
- **Did any participant acknowledge late (after the `commit_epoch_signature`)?** If yes, the late acknowledgment creates a phantom state that must be explicitly reconciled.
- **Conversely, when can the successor proceed without full barrier reconciliation?** Only when every participant is guaranteed to eventually reach the same state (e.g., an eventually-consistent CRDT-based merge), or when the mutation is strictly idempotent and safe to replay.
Operational Effect
- **Deterministic Reconciliation:** Provides the exact barrier state, enabling the successor to choose roll-forward vs. roll-back vs. escalate.
- **Late-Ack Detection:** Catches late acknowledgments that create phantom state divergence, preventing silent inconsistency.
- **Rollback Verification:** Records per-participant rollback status, preventing the successor from assuming a rollback succeeded when it partially failed.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json
class BarrierStatus(Enum):
ACKNOWLEDGED = auto()
REJECTED = auto()
TIMEOUT = auto()
LATE_ACKNOWLEDGED = auto()
class ReconciliationVerdict(Enum):
FULL_COMMIT_SUCCESS = auto()
SAFE_ROLL_FORWARD = auto()
SAFE_ROLL_BACKWARD = auto()
ESCALATE_REQUIRES_HUMAN = auto()
PHANTOM_LATE_ACK = auto()
@dataclass(frozen=True)
class ParticipantAck:
participant_id: str
status: BarrierStatus
ack_epoch: float
compensating_succeeded: bool | None
@dataclass(frozen=True)
class ConsensusBarrier:
commit_epoch_signature: float
participants: tuple[ParticipantAck, ...]
require_full_commit: bool
@dataclass(frozen=True)
class BarrierManifest:
verdict: ReconciliationVerdict
directive: str
manifest_digest: str
class ConsensusBarrierGuard:
@staticmethod
def _hash(data: str) -> str:
return hashlib.sha256(data.encode("utf-8")).hexdigest()
@classmethod
def evaluate_barrier(
cls, barrier: ConsensusBarrier
) -> BarrierManifest:
if not barrier.participants:
raise ValueError("Barrier must have participants.")
acks = [p for p in barrier.participants if p.status == BarrierStatus.ACKNOWLEDGED]
rejects = [p for p in barrier.participants if p.status == BarrierStatus.REJECTED]
timeouts = [p for p in barrier.participants if p.status == BarrierStatus.TIMEOUT]
late_acks = [p for p in barrier.participants if p.status == BarrierStatus.LATE_ACKNOWLEDGED]
# Gate 1: Full commit
if len(acks) == len(barrier.participants):
digest = cls._hash(json.dumps({
"participants": str(len(barrier.participants)),
"status": "FULL"
}, sort_keys=True))
return BarrierManifest(
verdict=ReconciliationVerdict.FULL_COMMIT_SUCCESS,
directive="PROCEED: All participants acknowledged commit.",
manifest_digest=digest
)
# Gate 2: Late acknowledgment (phantom state)
if late_acks:
return BarrierManifest(
verdict=ReconciliationVerdict.PHANTOM_LATE_ACK,
directive=f"HALT: Late acknowledgments from {[p.participant_id for p in late_acks]}. Phantom state present.",
manifest_digest=cls._hash(f"LATE:{len(late_acks)}")
)
# Gate 3: Rejects present (safe rollback)
if rejects:
all_rolled_back = all(
p.compensating_succeeded for p in acks if p.compensating_succeeded is not None
)
if not all_rolled_back:
return BarrierManifest(
verdict=ReconciliationVerdict.ESCALATE_REQUIRES_HUMAN,
directive=f"HALT: {len(rejects)} participants rejected. Rollback incomplete on acks.",
manifest_digest=cls._hash(f"PARTIAL_ROLLBACK:{len(rejects)}")
)
return BarrierManifest(
verdict=ReconciliationVerdict.SAFE_ROLL_BACKWARD,
directive=f"PROCEED: {len(rejects)} rejects. Roll back {len(acks)} acknowledgments.",
manifest_digest=cls._hash(f"ROLLBACK:{len(rejects)}")
)
# Gate 4: Timeouts (safe roll forward or escalate)
if timeouts and barrier.require_full_commit:
return BarrierManifest(
verdict=ReconciliationVerdict.ESCALATE_REQUIRES_HUMAN,
directive=f"HALT: {len(timeouts)} timeouts with full-commit required.",
manifest_digest=cls._hash(f"TIMEOUT:{len(timeouts)}")
)
if timeouts:
return BarrierManifest(
verdict=ReconciliationVerdict.SAFE_ROLL_FORWARD,
directive=f"PROCEED: {len(timeouts)} timeouts. Roll forward {len(acks)} acks.",
manifest_digest=cls._hash(f"ROLL_FORWARD:{len(timeouts)}")
)
# Gate 5: Unknown state
return BarrierManifest(
verdict=ReconciliationVerdict.ESCALATE_REQUIRES_HUMAN,
directive="HALT: Barrier state unclear. Escalate.",
manifest_digest=cls._hash("UNKNOWN")
)