Cordon: Semantic Transactions for Tool-Using LLM Agents

• URL: http://arxiv.org/abs/2606.17573v1
• Date: Tue, 16 Jun 2026 06:21:14 GMT
• Title: Cordon: Semantic Transactions for Tool-Using LLM Agents
• Abstract summary: This paper introduces Cordon, a transactional runtime system for staging and validating agent effects before commit.<n>It reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.
• Score: 11.567293065381918
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Tool-using LLM agents are shifting the unit of computation from explicit human-issued commands to model-driven tasks with stateful consequences. Yet today's agent runtimes still expose tools as isolated RPCs. This interface gives runtimes a convenient integration point, but it lacks a task-scoped execution boundary for commit, rollback, recovery, and audit across multi-step agent workflows. We argue that this mismatch calls for a runtime containment boundary rather than another per-call guardrail. This paper introduces Cordon, a transactional runtime system for staging and validating irreversible agent effects before commit. A semantic transaction is a task-level execution boundary that binds tool intents and runtime-tracked result lineage to reversible local state, staged external effects, delegated authority, and audit metadata. Cordon implements this abstraction with a transaction manager that tracks derived result objects, executes reversible mutations in shadow state, stages outward-facing actions in an effect outbox, and records recovery metadata. The runtime then validates the composed execution flow before it commits state or releases external effects. Our evaluation across adversarial and benign workflows shows that Cordon exposes cross-step violations missed by existing defenses. It also reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.

Related papers

• When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary [0.0]
  Under retries, speculative execution, and partial failures, the resulting external state may be inconsistent with the workflow's intended resolution.<n>Advanced transaction models address related failures, but assume that lower-level operations expose the semantics they depend on.<n>We contribute an effect-history model that separates events in the external world from the runtime's observations of them, and a catalog of eight recurring external-effect anomalies.
  arXiv  Detail & Related papers  (2026-09-14T11:31:06Z)
• TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents [7.080139152914316]
  We present TraceGrant, a security framework that governs the task-effect lifecycle of networked LLM agents.<n>Before execution, TraceGrant establishes a task-effect boundary from the trusted user request.<n>During execution, admitted evidence can instantiate only authority already established by the Contract.<n>After execution, task completion is verified against actual tool results.
  arXiv  Detail & Related papers  (2026-08-21T14:05:42Z)
• ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step [74.83535434786145]
  We introduce ScrambleToolBench, an interactive terminal benchmark designed to isolate behavioral reasoning.<n>The benchmark requires agents to uncover hidden tool behaviors entirely through trial-and-error interaction.<n>Our evaluation of state-of-the-art language models reveals that successful initial discovery does not translate into robust adaptation.
  arXiv  Detail & Related papers  (2026-08-03T15:07:46Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents [0.0]
  PORTICO is a reference monitor for capabilities exposed to the planner.<n>It compiles an explicit task contract into initial capabilities, grant rules, trusted closure predicates, and global deny rules.
  arXiv  Detail & Related papers  (2026-06-21T13:52:37Z)
• Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps [10.07589034106101]
  jailbreak defenses must reason about cross-step composition rather than isolated text.<n>We operationalize a deployment failure mode for tool-using LLM agents, the emphprovenance gap<n>We instrument the failure mode with trace-level diagnostics and outline a verifiable mitigation direction.
  arXiv  Detail & Related papers  (2026-06-08T06:29:42Z)
• A Physical Agentic Loop for Language-Guided Grasping with Execution-State Monitoring [5.437966695589128]
  We reformulate language-guided grasping as a bounded embodied agent operating over grounded execution states.<n>We introduce a physical agentic loop that wraps an unmodified learned manipulation primitive.<n>We validate the resulting loop on a mobile manipulator with an eye-in-hand D405 camera.
  arXiv  Detail & Related papers  (2026-04-08T08:01:35Z)
• A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance [0.22940141855172028]
  This paper presents an assurance framework for Agentic AI systems using Large Language Models (LLMs)<n>Executions are instrumented as Message-Action Traces (MAT) with explicit step and trace contracts.<n>The framework includes stress testing, formulated as a budgeted counterexample search over bounded perturbations.
  arXiv  Detail & Related papers  (2026-03-18T10:23:48Z)
• AgentProcessBench: Diagnosing Step-Level Process Quality in Tool-Using Agents [50.481033105867205]
  We introduce AgentProcessBench, the first benchmark dedicated to evaluating step-level effectiveness in realistic, tool-augmented trajectories.<n>The benchmark comprises 1,000 diverse trajectories and 8,509 human-labeled step annotations with 89.1% inter-annotator agreement.<n>It features a ternary labeling scheme to capture exploration and an error propagation rule to reduce labeling ambiguity.
  arXiv  Detail & Related papers  (2026-03-15T16:13:58Z)
• Agents Learn Their Runtime: Interpreter Persistence as Training-Time Semantics [4.774525456207306]
  Tool-augmented LLMs are increasingly deployed as agents that interleave natural-language reasoning with executable Python actions.<n>We ask whether interpreter persistence is merely a runtime scaffold, or a property of the training data that shapes how agents learn to use the interpreter.<n>We introduce Opaque Knapsack, a procedurally generated family of partially observable optimization tasks designed to prevent one-shot solutions.
  arXiv  Detail & Related papers  (2026-03-01T18:08:02Z)
• Robust and Efficient Tool Orchestration via Layered Execution Structures with Reflective Correction [55.13278005189741]
  We model tool orchestration as learning a layered execution structure that captures high-level tool dependencies.<n>We introduce a schema-aware reflective correction mechanism that detects and repairs errors locally.<n>This design confines errors to individual tool calls and avoids re-planning entire execution trajectories.
  arXiv  Detail & Related papers  (2026-02-21T22:20:01Z)
• Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows [3.1978093202244704]
  Atomix is a runtime that provides progress-aware transactional semantics for agent tool calls.<n>Atomix tags each call with a epoch, tracks per-resource frontiers, and commits only when progress predicates indicate safety.
  arXiv  Detail & Related papers  (2026-02-16T15:46:19Z)
• The Bitter Lesson of Diffusion Language Models for Agentic Workflows: A Comprehensive Reality Check [54.08619694620588]
  We present a comprehensive evaluation of dLLMs across two distinct agentic paradigms: Embodied Agents and Tool-Calling Agents.<n>Our results on Agentboard and BFCL reveal a "bitter lesson": current dLLMs fail to serve as reliable agentic backbones.
  arXiv  Detail & Related papers  (2026-01-19T11:45:39Z)
• Runaway is Ashamed, But Helpful: On the Early-Exit Behavior of Large Language Model-based Agents in Embodied Environments [54.67512489842682]
  Large language models (LLMs) have demonstrated strong planning and decision-making capabilities in complex embodied environments.<n>We take a first step toward exploring the early-exit behavior for LLM-based agents.
  arXiv  Detail & Related papers  (2025-05-23T08:23:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.