Module IX — Agent Control Plane & Governance

Phase 7 · CONTROL PLANE & GOVERNANCE — Module IX
Status: Authored & Empirically Verified.
Lecture Components: 6 FHD 1080p master videos + Lab L9.
Canonical Core Axiom:

THE DATA PLANE EXECUTES; THE CONTROL PLANE GOVERNS:
NEVER TRUST GENERATED TEXT OVER TEST ORACLES, AND NEVER DISPATCH WORKLOADS WITHOUT PREEMPTIVE TWO-PHASE BUDGET RESERVATIONS.


1. Separation of Concerns: Control Plane vs Data Plane

In production-grade distributed autonomous systems, an architectural boundary separates supervisory governance from high-frequency execution:

• The Control Plane (Deterministic Supervisor): Operates in the sub-millisecond regime ($<100\ \mu\text{s}$ latency overhead). Implemented in a compiled, type-safe language (such as pure Go), it owns context admission firewalls, two-phase budget reservations, epistemic state reconciliation, rate limiting, and cryptographic audit sealing. It possesses zero model probabilistic fuzziness.
• The Data Plane (Probabilistic Execution): Operates in the multi-second or minute regime ($4\text{ s} - 45\text{ s}$ per turn). Composed of frontier LLMs, AST diff synthesis, subprocess tooling, and sandboxed worktrees, it processes ephemeral prompts and generates mutations.

┌────────────────────────────────────────────────────────────────────────┐
│                        HEFESTO CONTROL PLANE (GO)                      │
│   Admission Gateways · 2PC Quota Governor · Epistemic Reconciler       │
└───────────────────────────────────┬────────────────────────────────────┘
                                    │ GovernedTaskRequest (Scoped & Reserved)
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                        DATA PLANE (AGENT WORKERS)                      │
│      Frontier LLMs · AST Parsers · Compilers · Ephemeral Worktrees     │
└───────────────────────────────────┬────────────────────────────────────┘
                                    │ TaskOutcome (ExitCode & Claims)
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                  RECONCILIATION & CRYPTOGRAPHIC SEAL                   │
│      Oracle Truth Verification · Atomic Rollback · HMAC-SHA256 Seal    │
└────────────────────────────────────────────────────────────────────────┘

The fundamental architectural invariant states: The Data Plane never governs the Control Plane. A model freeze, hallucination loop, or out-of-memory crash in an agent worker cannot corrupt, stall, or poison the control plane's state or security perimeters.

2. Memory & Context Window Governance

A model's context window is a finite, scarce, and vulnerable shared resource. Unrestricted injection of historical conversation turns or raw vector embeddings degrades generation quality due to the "Lost in the Middle" phenomenon, where attention focuses primarily on the prefix and suffix while mid-context information suffers up to a $60\%$ drop in recall.

Furthermore, naive ingestion exposes agent runtimes to Context Poisoning and indirect prompt injection attacks. To ensure context integrity, HEFESTO implements a 4-Stage Admission Firewall evaluated in $<50\ \mu\text{s}$ before any candidate memory chunk enters an LLM prompt:

MEMORY CANDIDATE ──► [ 1. Scope Gate ] ──► [ 2. Freshness Gate ] ──► [ 3. Authority Gate ] ──► [ 4. Contradiction Gate ] ──► ADMITTED CONTEXT
                             │                        │                         │                          │
                         REJECT                   REJECT                    REJECT                     REJECT
                     (Cross-Tenant)            (TTL Stale)           (Unverified Claim)         (Invariant Conflict)

1. Scope Evaluator: Strictly compares TenantID and RepoID. Rejects cross-tenant data leaks unconditionally ($0$ information bleed). 2. Freshness Evaluator: Computes $\Delta t = \text{clock} - \text{FreshnessTS}$. Drops candidates whose age exceeds assigned TTL, preventing outdated refactoring patterns from inducing compile regressions. 3. Authority Evaluator: Enforces minimum epistemic provenance weight. Unverified model hypotheses are blocked from masquerading as verified ground truth. 4. Contradiction Evaluator: Evaluates candidate assertions against active invariants (e.g. active system versions, port configurations). Conflicting chunks are masked to empty strings (""), neutralising indirect prompt attacks.

3. Epistemic Precedence & State Reconciliation

When multiple agents collaborate across a shared codebase, concurrency conflicts and model hallucinations inevitably arise. A common pathology is Hallucinated Task Success, where an LLM asserts in natural language: "All tests pass cleanly", while the physical compiler oracle returns exit code $1$ (e.g. fatal syntax panic).

HEFESTO enforces the Epistemic Precedence Hierarchy, establishing an absolute truth hierarchy across five tiers:

Under this hierarchy: Tier 2 (Test Oracle) strictly overrides Tier 5 (Model Hypothesis).

// Precedence Check: Tier 2 (Oracle) strictly overrides Tier 5 (Model Claim)
if !outcome.OracleTestPassed || outcome.CompilerExitCode != 0 {
    _ = rollback(outcome.TaskID, checkpointID)
    return &ReconcileVerdict{
        Approved:         false,
        ConflictDetected: modelAssertsSuccess,
        RollbackExecuted: true,
        Reason:           "EPISTEMIC CONTRADICTION: model claimed success, but oracle failed",
    }, nil
}

When an epistemic contradiction is flagged, the control plane executes an atomic rollback to the pre-task git checkpoint, preventing contaminated code from reaching authoritative branches, and emits a structured remediation directive with compiler diagnostics.

4. Dynamic Routing & Fleet Workload Scheduling

Static round-robin dispatch across heterogeneous agent clusters creates acute economic waste and systemic bottlenecks. HEFESTO's control plane uses Multi-Factor Algorithmic Scoring evaluating candidates across four orthogonal axes:

$$\text{Score} = w_1 \cdot \text{CapMatch} + w_2 \cdot \frac{1}{\text{Cost}} + w_3 \cdot \frac{1}{1 + \text{QueueDepth}} + w_4 \cdot \text{CacheWarmth}$$

• Capability Bitmasks: Hard $O(1)$ binary check ensuring worker supports required toolsets (AST, Terminal, Git, MCP).
• Complexity-Cost Optimization: Simple mechanical formatting routes to ultra-fast models (Haiku/Flash), while architectural synthesis routes to frontier reasoning engines (Opus/o3), slashing fleet operational costs by up to $65\%$.
• Bounded Priority Queues & Backpressure: Tasks are segregated by priority ($P_0$ hotfix down to $P_3$ docs). High-burst traffic triggers graceful load shedding with HTTP 429 status rather than allowing memory queues to cause out-of-memory process crashes.
• Distributed Deadlock Mitigation: Inter-agent communication is modeled as a Wait-For-Graph (WFG). Tarjan's strongly connected components algorithm continuously scans for circular dependency cycles ($A \to B \to C \to A$), surgically canceling the lowest-priority victim to break the cycle deterministically.

5. Quotas, Token Budgets & Two-Phase Commit

Autonomous agent systems operating without strict budget firewalls are acutely vulnerable to Economic Denial of Service (EDoS), where unhandled repair loops, recursive searches, or prompt thrashing incur thousands of dollars in unintended cloud API billing.

HEFESTO implements a Two-Phase Commit (2PC) Quota Governor:

1. Phase 1 (Reserve): Before dispatching a prompt to an upstream provider, the supervisor atomically locks estimated tokens and dollars against the task's budget reservoir. If the reservation exceeds available capacity, the request is rejected immediately with ErrBudgetExhausted. 2. Phase 2 (Commit): Upon return from the data plane, actual token usage and dollar expenditure are settled, and any reserved surplus is released back to the task pool. 3. Rollback: In the event of network failure or worker crash, the reservation is canceled in full, preventing budget leaks.

The governor maintains a 3-State Lifecycle:

• ACTIVE ($< 70\%$ budget consumed): Full nominal operation with frontier models.
• DEGRADED ($70\% - 99.9\%$ consumed): Enforces aggressive context pruning, suppresses background tasks, and downgrades execution to lightweight models.
• EXHAUSTED ($\ge 100\%$ consumed): Instantly trips circuit breaker, freezes filesystem mutations, and preserves last known good checkpoint.

6. Cryptographic Identity & Audit Receipts

Enterprise deployment requires strict non-repudiation and zero cross-tenant contamination. The HEFESTO control plane provides:

• Ephemeral SPIFFE Identities: Each worker receives a scoped, short-lived X.509 SVID formatted as spiffe://vtalgo.net/tenant/{tenant_id}/agent/{role}/{task_id}, attested via OS process binary hashes and valid for $\le 15$ minutes.
• Three-Tier Perimeter Isolation: Context memory sharding, ephemeral ramdisk worktrees with path-traversal fencing, and OS-level cgroup process quotas.
• Tamper-Evident HMAC-SHA256 Receipts: Every completed task produces an immutable ExecutionReceipt:

type ExecutionReceipt struct {
    ReceiptID        string
    TaskID           string
    TenantID         string
    CheckpointID     string
    AdmittedMemories int
    RejectedMemories int
    TokensConsumed   int64
    DollarsConsumed  float64
    VerdictApproved  bool
    SealSignature    string // HMAC-SHA256(ReceiptID|TaskID|TenantID|Tokens|Dollars|Verdict|IssuedAt)
    IssuedAt         time.Time
}

Signed with platform master keys and verifiable via constant-time hmac.Equal, these receipts provide undeniable proof of execution for SOC 2 Type II, HIPAA, and corporate financial audit compliance.