arxiv: 2604.25596 · v1 · submitted 2026-04-28 · 💻 cs.DC · cs.HC· cs.MA· cs.SI

Recognition: unknown

Volitional Multiagent Atomic Transactions: Describing People and their Machines

Andy Lewis-Pye , Ehud Shapiro

Authors on Pith no claims yet

Pith reviewed 2026-05-07 15:08 UTC · model grok-4.3

classification 💻 cs.DC cs.HCcs.MAcs.SI

keywords volitional transactionsmultiagent atomic transactionsgrassroots platformsdistributed systemssocial networksdigital assetssafety and liveness

0 comments

The pith

Volitional multiagent atomic transactions let formal models capture both machines and the people who operate them.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper introduces volitional multiagent atomic transactions as a way to specify distributed systems that consist of people and their personal machines. Traditional models leave people out or treat them as external noise, but this approach adds a volitional state to each agent so that machine actions become possible only when the relevant people are willing. Transactions such as mutual befriending or asset swaps are thereby guarded by the volitions of the participants, while unilateral actions like payments or unfriending require only one side's consent. The framework supplies the mathematical tools to state and prove safety and liveness for such systems and is used to specify two grassroots platforms. A simpler definition of grassroots systems is also given, under which the example platforms remain grassroots.

Core claim

Volitional multiagent atomic transactions, executed atomically by machines yet enabled only when the guarding persons' volitions permit, form a mathematical foundation for describing systems of people operating their machines; each agent's state pairs a volitional component with a machine component, and examples include social-network operations and coin-bond exchanges whose specifications yield provably correct implementations.

What carries the argument

Volitional multiagent atomic transactions, in which a transaction fires only when its machine precondition holds and the volitional states of the guarding agents all permit it.

Load-bearing premise

Human volitions can be treated as stable, discrete states that reliably guard machine preconditions without introducing unmodeled inconsistencies.

What would settle it

A deployed system in which a person's actual willingness changes during a transaction in a way that the discrete volitional state cannot predict, producing behavior that violates the safety or liveness claims.

read the original abstract

Formal models for concurrent and distributed systems describe machines; the people who operate them are either ignored or treated as external environment. Yet key distributed systems -- notably grassroots platforms -- include people operating their personal machines (smartphones), and their faithful description must include the states of both people and machines and how they jointly effect system behaviour. Here, we propose volitional multiagent atomic transactions -- executed atomically by machines and guarded by their people's volitions -- as a novel mathematical foundation for specifying systems consisting of people operating machines. Each agent's state consists of a volitional state and machine state; a transaction is enabled when the machine precondition holds and the guarding persons are willing. For example, befriending two people is guarded by both; unfriending, by either; voluntary swap of coins and bonds is guarded by both parties, while a payment is guarded by the payer. We develop the mathematical machinery to express safety and liveness of platforms specified in this framework, and provide example specifications of two grassroots platforms: social networks, and coins and bonds. These specifications are then used by AI to derive working implementations. % We employ here a novel and simpler definition of `grassroots' that better captures the informal notion -- multiple instances can form and operate independently, yet may coalesce -- and show that the platforms specified here, as well as those hitherto proven grassroots under the original definition, are grassroots under the new definition.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper adds volitional guards to atomic transactions to model people-plus-machines systems and offers a simpler grassroots definition, but the volition dynamics are left open.

read the letter

The main thing to know is that the authors want to treat both human volitions and machine states as part of the formal model for distributed systems, rather than leaving people as an external environment. They define transactions as enabled only when the machine precondition holds and the relevant people are willing, then apply this to grassroots platforms with examples for social networks and coins-and-bonds systems. They also give a new, simpler definition of grassroots that allows independent formation and later merging, and claim it covers earlier results as well as their own specs. They say AI can turn these specs into working code. This framing is new in how it combines the two layers explicitly. The examples are concrete and make the idea easy to follow: befriending needs both parties willing, a payment only needs the payer, and so on. The new grassroots definition looks cleaner than the prior one and still captures the informal intent. The safety and liveness machinery is sketched at a high level on top of these guards. The soft spot is exactly where the stress-test note points: volitional states are treated as stable guards, but there are no rules given for how they change, how conflicts between agents are resolved, or what happens if willingness shifts after a transaction is enabled but before commit. Without those, the atomicity and liveness properties are hard to verify in any real deployment. The abstract mentions AI-derived implementations, yet no code, derivations, or checks are visible here, so that part stays untested. This is aimed at people working on formal methods for multi-agent distributed systems, especially those building or specifying grassroots or decentralized platforms. A reader who already thinks about consent and human factors in specs will get the most from the examples and the revised grassroots notion. It deserves a serious referee because the core modeling choice is coherent and grounded in standard distributed-systems ideas, even though the volition transitions will need more detail.

Referee Report

2 major / 2 minor

Summary. The paper proposes volitional multiagent atomic transactions as a novel mathematical foundation for specifying distributed systems consisting of people operating machines. Each agent's state combines a volitional state with machine state; a transaction is enabled when the machine precondition holds and the guarding persons are willing (e.g., both for befriending or voluntary swaps, either for unfriending, payer only for payments). The work develops safety and liveness machinery for platforms specified in this framework, gives example specifications for social networks and coins-and-bonds platforms, shows that AI can derive working implementations from these specifications, and introduces a simpler definition of 'grassroots' systems (multiple independent instances that may coalesce) under which both the new examples and prior ones qualify.

Significance. If the formal model and its safety/liveness properties hold, the framework would enable more faithful specifications of grassroots platforms by directly incorporating human volitions as guards on machine actions, potentially improving verification of systems like decentralized social networks and financial platforms. The AI-assisted derivation of implementations from formal specs is a concrete strength that could accelerate development, and the revised grassroots definition provides a cleaner, more inclusive characterization that applies retroactively to existing platforms.

major comments (2)

In the model of agent state and transaction enabling (as described in the abstract and proposed framework): volitional states are treated as discrete, stable guards that enable transactions when willingness holds, yet no transition rules, conflict-resolution mechanisms across agents, or invariants are specified to handle cases where a volition changes after enabling but before commit. This is load-bearing for the central claim, as the safety and liveness machinery is built directly on these guards and cannot guarantee atomicity or the stated properties without explicit handling of volition dynamics.
In the development of safety and liveness machinery: the manuscript claims to provide the mathematical tools to express these properties for platforms specified in the framework, but the absence of explicit derivations, proof sketches, or invariants that account for volition updates leaves the soundness of the central claims unverified and dependent on unstated assumptions about volition stability.

minor comments (2)

The abstract mentions AI derivation of implementations but provides no details on the AI technique, input format, or any correctness verification of the generated code; this should be expanded for reproducibility.
A brief comparison of the new 'grassroots' definition to the original (including why it is simpler and how it captures the informal notion) would clarify the contribution in the relevant section.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for their careful reading and constructive comments on our manuscript. The points raised highlight opportunities to strengthen the presentation of the atomic model and the supporting proofs. We respond to each major comment below and indicate the revisions we will make.

read point-by-point responses

Referee: In the model of agent state and transaction enabling (as described in the abstract and proposed framework): volitional states are treated as discrete, stable guards that enable transactions when willingness holds, yet no transition rules, conflict-resolution mechanisms across agents, or invariants are specified to handle cases where a volition changes after enabling but before commit. This is load-bearing for the central claim, as the safety and liveness machinery is built directly on these guards and cannot guarantee atomicity or the stated properties without explicit handling of volition dynamics.

Authors: We appreciate the referee drawing attention to this aspect of the model. Transactions in our framework are defined as atomic: the machine precondition together with the relevant volitional guards are evaluated simultaneously, and the transaction either commits or aborts as a single indivisible step. Volition changes are modeled as separate, discrete state transitions that occur only between atomic transactions. Consequently, there is no temporal window between enabling and commit within which a volition can change. We will revise the manuscript to make the transition rules for volitional states explicit, state the relevant invariants that preserve atomicity, and clarify that conflict resolution across agents is resolved by the atomic semantics themselves. revision: partial
Referee: In the development of safety and liveness machinery: the manuscript claims to provide the mathematical tools to express these properties for platforms specified in the framework, but the absence of explicit derivations, proof sketches, or invariants that account for volition updates leaves the soundness of the central claims unverified and dependent on unstated assumptions about volition stability.

Authors: The safety and liveness machinery is presented via standard definitions adapted to the volitional multiagent setting, with atomicity ensuring that volition updates cannot interleave inside a transaction. The key theorems appear in the manuscript, but we acknowledge that the presentation would benefit from additional explicit derivations and proof sketches. In the revised version we will supply these sketches together with the invariants that account for discrete volition updates, thereby making the soundness arguments fully self-contained. revision: yes

Circularity Check

0 steps flagged

No significant circularity detected in the derivation

full rationale

The paper introduces a new modeling framework by defining volitional multiagent atomic transactions directly from agent states (volitional plus machine) and explicit enabling conditions (machine precondition and willingness). Safety and liveness properties are developed from these definitions, with concrete specifications for social networks and coins-and-bonds platforms provided as examples. The novel simpler definition of 'grassroots' is stated independently and applied to reclassify the given platforms plus prior ones, without any load-bearing step reducing by construction to fitted parameters, self-citations, or renamed inputs. The work extends standard distributed-systems foundations with external grounding in platform examples, making the overall derivation self-contained.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 1 invented entities

The framework rests on standard concurrent-systems axioms plus the new postulate that volitional states can be discretely modeled and reliably guard transactions. No free parameters or invented physical entities are introduced.

axioms (2)

standard math Standard mathematical foundations for concurrent and distributed systems describe machine behavior.
Invoked in the opening contrast between existing models and the proposed extension.
domain assumption Human volitions can be represented as discrete states that guard machine actions without external inconsistency.
Central to the definition of enabled transactions.

invented entities (1)

Volitional state no independent evidence
purpose: Represents a person's willingness to participate in a transaction.
New component added to each agent's state alongside machine state.

pith-pipeline@v0.9.0 · 5560 in / 1307 out tokens · 72848 ms · 2026-05-07T15:08:34.740886+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

19 extracted references · 12 canonical work pages · 1 internal anchor

[1]

IPFS - Content Addressed, Versioned, P2P File System

6 Juan Benet. Ipfs-content addressed, versioned, p2p file system.arXiv preprint arXiv:1407.3561,

work page Pith review arXiv
[2]

Reconfigurable atomic transaction commit

9 Manuel Bravo and Alexey Gotsman. Reconfigurable atomic transaction commit. InProceedings of the 2019 ACM Symposium on Principles of Distributed Computing, pages 399–408,

2019
[3]

Spidercast: a scalable interest-aware overlay for topic-based pub/sub communication

13 Gregory Chockler, Roie Melamed, Yoav Tock, and Roman Vitenberg. Spidercast: a scalable interest-aware overlay for topic-based pub/sub communication. InProceedings of the 2007 inaugural international conference on Distributed event-based systems, pages 14–25,

2007
[4]

Ceremony design and analysis

16Carl Ellison. Ceremony design and analysis. Technical Report 2007/399, IACR,

2007
[5]

Rodríguez-Aguilar, Carles Sierra, Pere Garcia, and Josep Lluís Arcos

17 Marc Esteva, Juan A. Rodríguez-Aguilar, Carles Sierra, Pere Garcia, and Josep Lluís Arcos. On the formal specification of electronic institutions. InAgent-Mediated Electronic Commerce (AMEC), volume 1991 ofLNCS, pages 126–147. Springer,

1991
[6]

Federated assemblies

18 Daniel Halpern, Ariel D Procaccia, Ehud Shapiro, and Nimrod Talmon. Federated assemblies. Proc AAAI 2025; arXiv preprint arXiv:2405.19129,

work page arXiv 2025
[7]

arXiv preprint arXiv:2505.19216 (2025)

21 Idit Keidar, Andrew Lewis-Pye, and Ehud Shapiro. Constitutional consensus.arXiv preprint arXiv:2505.19216,

work page arXiv
[8]

Grassroots flash: A payment system for grassroots cryptocurrencies.arXiv preprint arXiv:2309.13191,

25 Andrew Lewis-Pye, Oded Naor, and Ehud Shapiro. Grassroots flash: A payment system for grassroots cryptocurrencies.arXiv preprint arXiv:2309.13191,

work page arXiv
[9]

27 Nancy Lynch, Michael Merritt, William Weihl, and Alan Fekete

Submitted, arXiv XXXX.XXXXX. 27 Nancy Lynch, Michael Merritt, William Weihl, and Alan Fekete. A theory of atomic trans- actions. InICDT’88: 2nd International Conference on Database Theory Bruges, Belgium, August 31–September 2, 1988 Proceedings 2, pages 41–71. Springer,

1988
[10]

Opendht: a public dht service and its uses

35 Sean Rhea, Brighten Godfrey, Brad Karp, John Kubiatowicz, Sylvia Ratnasamy, Scott Shenker, Ion Stoica, and Harlan Yu. Opendht: a public dht service and its uses. InProceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, pages 73–84,

2005
[11]

Multiagent transition systems: Protocol-stack mathematics for distributed computing.arXiv preprint arXiv:2112.13650,

36 Ehud Shapiro. Multiagent transition systems: Protocol-stack mathematics for distributed computing.arXiv preprint arXiv:2112.13650,

work page arXiv
[12]

In: 37th International Symposium on Dis- tributed Computing (DISC 2023)

37 Ehud Shapiro. Grassroots distributed systems: Concept, examples, implementation and applications (brief announcement). In37th International Symposium on Distributed Computing (DISC 2023). (Extended version: arXiv:2301.04391), pages 47:1, 47:7, Italy,

work page arXiv 2023
[13]

39 Ehud Shapiro

doi:10.1145/3599696.3612898. 39 Ehud Shapiro. Grassroots currencies: Foundations for grassroots digital economies.arXiv preprint arXiv:2202.05619,

work page doi:10.1145/3599696.3612898
[14]

Glp: A grassroots, multiagent, concurrent, logic programming language.arXiv preprint arXiv:2510.15747,

40 Ehud Shapiro. Glp: A grassroots, multiagent, concurrent, logic programming language.arXiv preprint arXiv:2510.15747,

work page arXiv
[15]

Grassroots bonds: A grassroots foundation for market liquidity.arXiv preprint arXiv:2603.13671,

41 Ehud Shapiro. Grassroots bonds: A grassroots foundation for market liquidity.arXiv preprint arXiv:2603.13671,

work page arXiv
[16]

doi: 10.1145/3772290.3772309

arXiv preprint arXiv:2502.11299. doi: 10.1145/3772290.3772309. 43 Ehud Shapiro. Implementing grassroots logic programs with multiagent transition systems and ai.arXiv preprint arXiv:2602.06934,

work page doi:10.1145/3772290.3772309
[17]

Types for grassroots logic programs.arXiv preprint arXiv:2601.17957,

44Ehud Shapiro. Types for grassroots logic programs.arXiv preprint arXiv:2601.17957,

work page arXiv
[18]

Grassroots Federation: Fair Democratic Governance at Scale

45 Ehud Shapiro and Nimrod Talmon. Grassroots federation: Fair governance of large- scale, decentralized, sovereign digital communities.Proc. of AAMAS’26; arXiv preprint arXiv:2505.02208,

work page internal anchor Pith review arXiv
[19]

whose motion is only partially determined by the configuration

introducedchoice machines(c-machines), “whose motion is only partially determined by the configuration”—at designated states, the machine “cannot go on until some arbitrary choice has been made by an external operator.” The external operator is a person who freely chooses between alternatives; the sequence of choices determines which computation unfolds. ...

1939