Trust,
and verify.

In mainstream agent frameworks a step ends when the agent's own output says it has finished. This paper states what a harness must instead guarantee — that it finishes, does not drift, and does not overspend — and proves each one: termination in closed form under a global repair budget, no DONE without a gate verdict in an append-only hash-chained ledger, and a spend ceiling enforced inside an attempt rather than between attempts. It then builds the instrument that measures whether a harness delivers it, characterising two ways a sound-looking check passes anything: vacuity and self-attestation. Engine, catalogue and corpus are Apache-2.0.

Multi-agent reliability analysis routinely assumes component failures are conditionally independent, and almost never tests it. This paper tests it and finds strong positive dependence, which inflates joint failure rates well beyond what independence-based bounds predict. It replaces the assumption with a certificate that assumes no dependence structure at all — a linear program over the joint distribution, bounded by a Bonferroni–Clopper–Pearson box — and proves that fitting a dependence model instead degrades coverage as sample size grows.

The revised preprint studies governed local-first memory and distinguishes implementation from verified effectiveness. Component evidence is protocol-scoped; current package behavior requires separate checks.

Every agent framework reinvents orchestration, and none of them interoperate. Qualixar OS defines a universal substrate: execution semantics for 12 multi-agent topologies, Forge for designing agent teams, three-layer model routing with a Bayesian POMDP, and a consensus-based judge pipeline.

A memory system that never forgets degrades: old facts crowd out current ones and retrieval quality falls. V3.3 borrows the brain's answer — decay curves, consolidation, and quantized cognitive states — and retrieves across six independent channels fused by reranking, without a single LLM call in the hot path.

Retrieval quality is usually bought with LLM calls. V3 buys it with geometry instead: memories live on a statistical manifold where relevance is a distance, so ranking is computed rather than generated. The result is a benchmark score competitive with cloud systems, produced entirely on-device.

You cannot diff an agent's output against a golden file, because the output legitimately differs every run. AgentAssay tests the distribution instead of the sample: stochastic verdicts over repeated runs, with a sampling strategy that reaches a decision in a fraction of the tokens a naive repeat-and-compare would burn.

An agent skill is arbitrary code that runs with the agent's own authority, installed from a registry with no review gate. This paper gives the threat model a formal treatment, then builds static analysis, provenance verification and SBOM generation across 22 agent frameworks so a skill can be judged before it executes.

Prompts express intent; they do not enforce it. This paper adapts design-by-contract to autonomous agents: preconditions, invariants, governance policies and recovery mechanisms stated formally, then checked at runtime, so a violation is caught at the step that caused it rather than three tool calls downstream.

When several agents write to one memory store, a single compromised agent can poison what every other agent later recalls. This paper models writer trust as a Bayesian posterior updated by downstream outcomes, so a source that keeps producing facts which fail verification loses influence over retrieval — without any of the data leaving the machine.