{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-llm-proposed-consensus-fail-only-when-the-proposal-space-is-adversarially-dense",
  "title": "Why does an instance of LLM-proposed consensus fail only when the proposal space is adversarially dense",
  "date_of_record": "2026 November 11",
  "scope": "Applies to multi-agent systems where LLM agents propose discrete actions that are then committed by a Byzantine fault-tolerant (BFT) consensus protocol, and where the safety argument assumes quorum intersection over *distinct* proposals. Does not apply to single-proposer systems, to systems where proposals are pre-validated by a deterministic gate before reaching consensus, or to crash-fault-tolerant (non-Byzantine) protocols where equivocation is impossible.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-llm-proposed-consensus-fail-only-when-the-proposal-space-is-adversarially-dense.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-llm-proposed-consensus-fail-only-when-the-proposal-space-is-adversarially-dense.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-llm-proposed-consensus-fail-only-when-the-proposal-space-is-adversarially-dense.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1489,
    "python_slice_tokens": 195,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure is not \"the LLM proposed something bad.\" That is the normal case, and BFT consensus is supposed to absorb it: with `3f+1` replicas tolerating `f` Byzantine faults, up to `f` agents may propose arbitrary, malicious, or hallucinated actions and the committed value still satisfies the protocol's safety property. The boundary that actually breaks is ...",
    "what_was_observed": "In a five-replica deployment (`f=1`, tolerating one Byzantine agent), agents proposed actions as structured JSON derived from free-form LLM output. During a routine period, all five replicas were honest. The protocol required a 2f+1 = 4 replica quorum to commit a proposal whose hash matched across replicas. - The median time-to-quorum for a *fixed* action (\"restart service X\") was 3.1 s. - The median time-to-quorum f...",
    "condition_of_validity": "The safety collapse requires all of the following to hold simultaneously: 1. **Unbounded proposal encoding.** The action space is not canonicalized to a finite set before consensus. If proposals are hashed over a canonical form, the density drops and the invariant holds. 2. **Quorum-by-identity.** The protocol's commit rule compares proposals by cryptographi...",
    "decision_boundary": "The operational rule: **treat proposal-space density as a safety parameter, not a performance parameter.** - If the measured fraction of rounds that hit the timeout fallback exceeds a threshold (in our deployment, 5%), the system must be considered to have exited the BFT safety regime, regardless of the configured `f`. The configured fault tolerance is nomin...",
    "operational_effect": "After canonicalizing the action space (a fixed schema with enumerated operation types and normalized targets) and removing the simple-majority fallback, the same five-replica cluster with the same injected Byzantine replica produced: - Median time-to-quorum: 2.4 s, with 0.3% of rounds timing out. - Zero equivocation splits across 50,000 injected-fault rounds..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "128e80307c6540dae0203973de0868b3ac0e0cc357c7ab0183037e5ece7b38ae",
    "verified_classes": [
      "ProposalDensitySafetyError"
    ],
    "verified_functions": [
      "admit_proposal",
      "check_round_safety"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ProposalDensitySafetyError"
    ],
    "sample_fail_closed_invariants": [
      "missing canonical target",
      "commit path used sub-quorum majority; intersection property violated"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}