VIII · Safety & ControlExperimental·

Quorum on Mutation

also known as Two-Tick Confirmation, Distributed Consensus (Single Agent)

Require multiple consecutive ticks (or runs) to agree before a mutation to durable state lands.

This pattern helps complete certain larger patterns —

  • used-byWorld-Model Separation★— Maintain an explicit, surprise-updated model of the environment (humans, repos, services, capabilities) in a separate file from the agent's self-model, so the two cannot be confused or co-mutated by reflection.

Context

A team runs a long-running agent that is allowed to propose changes to its own durable state — its persistent rules, its memory entries, its operating preferences. Over time the agent revises these to fit how the user actually behaves. Some of those proposed changes come from a single frustrated moment in a single conversation, and the agent has no built-in way to tell a passing reaction apart from a genuine long-term preference.

Problem

If a proposed mutation lands on a single tick's say-so, then a momentary misreading — a user vented once, the agent overinterpreted a single sentence, a transient confusion in context — becomes a permanent rule that degrades the agent for weeks. If the team simply disables self-mutation to avoid this, the agent stops learning from real signals and the operator has to hand-edit every rule change. Without a way to require multiple consecutive endorsements before a mutation lands, single-tick confusion gets baked into durable state.

Forces

  • More ticks = slower change; legitimate improvements are delayed.
  • Coordination across ticks needs a proposal / approval state machine.
  • User override should always be available for legitimate fast paths.

Example

A long-running personal agent reads a frustrated user message and proposes a new persistent rule: 'never offer suggestions before being asked.' Under single-tick mutation the rule would land immediately and degrade the agent for weeks. Instead the proposal goes to a holding area; the next tick re-reads the rule against fresh context and the user's later message ('actually keep proposing, I just hated that one') and declines to confirm. The mutation expires unwritten. Only rules that survive K consecutive endorsements join the durable charter.

Diagram

Solution

Therefore:

Mutation proposals are written to a holding area. A subsequent tick must confirm the proposal (still endorses it given fresh context). After K consecutive confirms, the mutation lands. Explicit user approval bypasses the wait.

What this pattern forbids. A mutation cannot land on a single tick's say-so; it requires K consecutive endorsements.

And the patterns that stand alongside it, or against it —

  • complementsConstitutional Charter★— Define rules the agent reads every turn but cannot modify, encoding inviolable boundaries.
  • complementsSelf-Modification Diff Gate·— Gate the agent's edits to its own code or rules through a separate critic persona that reviews the diff before it lands.
  • complementsRace Conditions on Shared Tool Resources✕— Anti-pattern: let concurrent agents perform read-modify-write on shared external resources without locking, producing silent data corruption.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance