Skip to content

PatchOptic for Shared-State LLM Workflows with Projected Views and Verified Structured Updates

🕒 Published (v1): 2026-07-06 16:13 UTC · Source: Arxiv · link

Why this paper was selected

Projected views + verified structured updates for shared-state LLM workflows — core scaffolding primitive

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

PatchOptic is a step-interface abstraction for multi-agent workflows over shared structured state, combining optic-inspired projected reads with runtime-verified JSON Patch writes. Each workflow step declares an authority triple \((O_s, W_s, P_s)\) — projected view, write region, patch-source region — so agents see only the state they need and proposed mutations are checked against the full state before commit. A footprint algebra derived from the same declarations supports static certificates for delegation, sub-workflow composition, and same-phase step reordering.

Problem

In multi-step LLM workflows over shared structured state, the read side is routinely managed via progressive disclosure (RAG, AST queries, agent skills), but the write side lacks a corresponding contract. An agent proposing an update from a local view cannot be held accountable to global validity — it may write outside its scope, pull values from unauthorized state paths, or violate phase ordering or schema. Schema validators and constrained decoding address only local structure, not provenance or cross-step authorization.

Method

PatchOptic wraps each workflow step in a declared interface: the authority triple \(I_s = (O_s, W_s, P_s)\) where \(O_s\) is the projection (read view), \(W_s\) is the authorized write region, and \(P_s\) is the patch-source region (state paths a patch operation may read, e.g., copy/move sources). At runtime, the actor receives only the projected view \(O_s(x)\); it returns a JSON Patch proposal \(p\); a four-gate verifier (scope, schema, phase, invariants) checks \(p\) against the full state \(x\) before any mutation commits. Rejection leaves state unchanged and records diagnostics in an audit trace.

The same declaration yields a static footprint \((R_A, W_A, P_A) \subseteq L^3\) (leaf-path sets over JSON Pointer space with prefix containment \(\preceq\)). A footprint algebra defines: - Restriction (delegation): \((R_A', W_A', P_A') \subseteq (R_A, W_A, P_A)\) - Union (peer composition): \((R_A \cup R_B, W_A \cup W_B, P_A \cup P_B)\) - Commutation certificate for same-phase reordering: \(W_A \perp_\preceq W_B,\; R_A \perp_\preceq W_B,\; R_B \perp_\preceq W_A\)

For sequential sub-workflows \(P = (A_1; \ldots; A_k)\), the reusable interface \(\sigma(P)\) internalizes handoffs — read/patch-source paths satisfied by earlier writes within \(P\) are dropped from the external boundary. Data-dependent footprints (traversals, prisms) fall back to a differential check running both orderings on fixed artifacts.

Key Contributions

  • Runtime step interface: projected reads coupled with verified JSON Patch writes; a single declared authority triple governs both prompt construction and pre-commit verification with structured audit traces.
  • Footprint algebra: restriction for delegation/local-actor replacement, union for peer composition, commutation condition for \(O(N^2)\) static same-phase reordering certificates (replacing \(N!\) schedule enumeration).
  • Sub-workflow composition rule \(\sigma(P)\): external boundary drops internally satisfied read/patch-source dependencies; cached interface supports refactor reuse without reopening internal actor graph.
  • PatchBench: 46-case benchmark across six domains with a protocol separating live actor runs from no-model compromised-artifact containment tests.

Results

  • Projected-read settings raise accepted-output semantic pass from \(\approx 0.61\) to \(0.78\)–\(0.80\) under GPT-5-mini (vs. full-state input baseline).
  • Runtime verification reduces leak runs to \(0.1\) per round (vs. higher rates without projection).
  • Patch-read enforcement rejects all hidden-source patch artifacts in the containment test (no-model compromised-artifact setting).
  • Token cost is reduced alongside leakage reduction under projected-read settings.

Limitations

  • Semantic output errors (actor returns a contract-valid but factually wrong value) are explicitly out of scope and not addressed.
  • Policy-authorized disclosures and misuse of policy-visible context are not prevented — the system enforces the declared policy, not the correctness of the policy itself.
  • Data-dependent footprints (prisms, traversals with state-dependent realized paths) cannot receive static commutation certificates; the fallback differential check is tied to a specific document and does not generalize.
  • The static commutation certificate relies on deterministic actor model and fixed-footprint phase assumptions; live stochastic runs are evaluated empirically rather than certified.
  • Patch-source scope is prototype-only (copy, move, test of JSON Patch); generalization to other patch representations is left to future work.
  • Only 46 benchmark cases across six domains; coverage of the broader multi-agent workflow space is limited.

Relevance to Harnesses / Meta-Harnesses

PatchOptic is directly a harness-layer mechanism: it defines the step contract that a meta-harness enforces over every agent invocation in a shared-state workflow, separating what the actor sees from what it may write. The footprint algebra — restriction for delegation, union for composition, commutation certificates for reordering — is precisely the infrastructure a meta-harness needs to safely compose, substitute, and schedule sub-workflows without re-running all agents. The separation of declared interface from actor implementation (local replacement, delegate narrowing) matches how production harnesses abstract over model choices and prompt variants. PatchBench's evaluation protocol, which separates live model runs from artifact-injection tests, offers a reusable pattern for harness-level security and correctness evaluation independent of any specific LLM.