Making agents prove things before they believe or do them.
GDF is an independent research program on reliable autonomous agents — evidence-graded memory, runtime verification, and policy enforcement at the boundary where an agent acts on a machine. Every quantitative claim ships with the scripts and data that produced it.
GDF.AI :: AGENT SYSTEMS & VERIFICATIONOne question, more than one place it bites
Autonomous agents fail in what they conclude, in what they execute, and in how much of either anyone can still check. The tracks below are where the work sits today; they are not a closed list.
Belief
What is an agent allowed to believe?
An agent's memory is usually a pile of its own assertions. Grade facts on a confirmation ladder instead, bind each one to the state it was observed under, cap it by what the agent's vantage can see, and carry a doubt score forward — then make doubt able to interrupt a completion claim rather than merely decorate it.
- ┌distributed workflow evidence
- │monotonic proof state
- │state-bound memory
- │learned doubt
- └completion enforcement
Action
What is an agent allowed to do?
Coding agents execute system operations with the user's privileges. Intercept at the kernel boundary, resolve the unambiguous cases deterministically on the synchronous path, and reserve the language model for the semantic residue — placement in the pipeline turns out to matter more than model cleverness.
- ┌agent intention
- │runtime action
- │policy evidence
- └enforcement
Oversight
opening upWhat can still be supervised at scale?
Evidence and enforcement both assume someone is reading the result. Run enough agents in parallel and that assumption is the thing that breaks first — so the open question is how supervision capacity scales against a fleet, and what has to become automatic before it stops scaling at all.
- ┌agent fleet
- │oversight capacity
- └what gives first
Evidence-graded memory, v2
in progressThe first study is a pilot: one small model, five runs per cell, constructed scenarios. v2 scales it into something a third party can run — more models and agent harnesses, more scenarios and state-change classes, blinded grading, and memory baselines beyond plain notes.
Kernel enforcement, end to end
nextThe published study measures the userspace verdict pipeline with the drivers unloaded. The next version runs the drivers, measures the full syscall-to-verdict-to-block path, and puts a prompt-injected agent against it.
The oversight tax
unpublishedA simulation of how review capacity scales against a growing fleet of agents, and where the limits actually bind.
Papers, reports, and negative results
Every quantitative claim ships with the scripts and data that produced it. Papers are deposited on Zenodo with a DOI; released code is on GitHub.
Evidence-Graded Memory with a Doubt Signal: Applying Monotonic Proof-State Advancement Inside Autonomous Agents
Changed repository, stale notes. Notes memory: 0/5 correct. Doubt shown to the model: 0/5. Doubt allowed to interrupt the completion claim: 5/5. Representation was not enough; enforcement was.
Moves the monotonic proof-state model inside the agent loop as a memory written only by observation: facts graded on a confirmation ladder, bound to the code state they were observed under, capped by what the agent's vantage can see, each carrying a cheap uneasiness score learned from outcomes. Building the reference implementation surfaced a premature-dispatch gap in the original theoretical design — under out-of-order delivery, threshold dispatch could evaluate before all required evidence arrived, reducing a perfect judge to 91% across 500,000 simulated instances; frontier gating restored 100%. The efficiency thesis largely did not survive measurement. The correctness thesis did. One small agent model, five runs per cell, constructed scenarios: a pilot, and labeled as one.
Toward LLM-Assisted Policy Enforcement at the Kernel Boundary
p99 verdict latency, deterministic patterns moved onto the synchronous path: 3,617 ms → 1.00 ms. Placement in the pipeline mattered more than model cleverness.
Runtime security controls for AI coding agents that execute system operations with user privileges. A hybrid architecture pairs kernel-level syscall interception with Claude Haiku 4.5 policy decisions over AWS Bedrock: pure-LLM verdicts time out on 56% of events at a 4s budget, while moving the same deterministic patterns onto the synchronous publisher path collapses the tail. Evaluation across 1,247 events and 1,000 threat scenarios. Scope note, stated in the paper and repeated here: the measurements cover the userspace verdict pipeline with the kernel drivers unloaded on the test host. End-to-end enforcement through the driver — and an adversarial pass against a prompt-injected agent — is the next version of this work.
Monotonic Proof-State Advancement for Distributed Workflow Verification
The substrate the agent-memory work is built on. A method for verifying distributed workflows when no single observer can witness every step: a monotonic confirmation-level hierarchy that prevents proof-state regression, threshold-triggered evaluator dispatch that suppresses premature policy evaluation, and boundary-capped proof resolution that distinguishes architecturally unobservable evidence from true policy failure. Illustrated with a payment-settlement case study.
No Free Signal: A Negative Result for Substrate-Evolution Around Fixed LLMs in an Embodied Multi-Agent Population
Can evolutionary pressure on the communication substrate — rather than on model weights — make a frozen LLM more adaptive inside a 25-creature multi-agent system? A seven-arm design with 140 controlled runs, including mute baselines, scrambled models, and cadence-matched noise emitters, finds the full treatment does not outperform any control on fitness. Published as the null result it is. A behavioral analysis still detects emission-source effects on receiver responses, with methodological contributions around cadence-matched noise controls.
The Real Limits of Distributed LLM Training: An Architectural Postmortem
A federated, peer-to-peer LLM training network — its architecture, mechanisms, and the quantitative reasons centralized training still wins for frontier models. Reproducible scripts for bandwidth, straggler, convergence, cost, and poisoning analysis included.
Sterling Morrison
AI systems researcher. GDF is his independent research program.
Sterling Morrison works on reliable autonomous agents: how an agent can be made to ground what it believes in observed evidence, and how that grounding can be enforced at the moment the agent acts — in memory, in the completion claim, and at the system-call boundary.
The work runs as a single line rather than a set of unrelated papers. A verification abstraction for distributed workflows became a memory substrate inside the agent loop; a reference implementation of that substrate found a premature-dispatch gap in the original design and fixed it; the corrected substrate then changed agent behavior on a benchmark where notes memory failed outright. Negative results are published on the same footing as positive ones.
Books
The Generative Development Framework series (2025) — methodology for engineering leaders adopting AI, and for full-stack engineers shipping with it.
Common questions
GDF is an independent research program on reliable autonomous agents. The current work covers evidence-grounded agent memory, runtime verification of what an agent claims to have done, and policy enforcement at the boundary where an agent executes system operations. Results are published as preprints and technical reports with the code and data behind them.
Sterling Morrison, an AI systems researcher. GDF is his independent program, not a company product line and not a consultancy.
Making autonomous agents prove things before they are allowed to believe or do them. A verification abstraction for distributed workflows (monotonic proof-state) became a memory substrate inside the agent loop (evidence-graded memory with a doubt signal); alongside it, the same instinct applied to the runtime boundary became policy enforcement over intercepted syscalls. Belief and action, one question.
That is the point. Every quantitative claim ships with the exact scripts used to generate it and a README with the commands to re-run them. Papers are deposited on Zenodo with a DOI; code is on GitHub under github.com/gdf-ai. If you find a number that will not reproduce, that is a bug and email about it is welcome.
Yes, on the same footing as positive ones. No Free Signal is a seven-arm, 140-run study whose central hypothesis did not survive its own controls, published as such. The efficiency thesis in the evidence-graded memory paper largely did not survive measurement either, and the paper says so.
It is a pilot and labeled as one: one small agent model, five runs per cell, constructed scenarios. The effect it demonstrates — that showing an agent a doubt signal changes nothing while letting that signal interrupt the completion claim changes everything — is worth generalizing, and the current research cycle is scaling it across models, agent harnesses, state-change classes, and memory baselines.
Each paper is deposited on Zenodo with a DOI. Cite the title, author, year, and DOI. The listing on this site links to the canonical Zenodo record for each.
The Generative Development Framework books (2025) and their documentation are earlier work and remain available, but they are not what GDF is now. The program today is agent systems and verification research.
Correspondence welcome.
If you work on agent reliability, memory, or runtime containment — or you want to reproduce a number and it will not reproduce — that is the mail worth sending.
Email hello@gdf.ai