Sterling Morrison
Reliable autonomous agents: evidence, memory, runtime verification, and enforcement. GDF is his independent research program.
Sterling Morrison works on reliable autonomous agents: how an agent can be made to ground what it believes in observed evidence, and how that grounding can be enforced at the moment the agent acts — in memory, in the completion claim, and at the system-call boundary.
The work runs as a single line rather than a set of unrelated papers. A verification abstraction for distributed workflows became a memory substrate inside the agent loop; a reference implementation of that substrate found a premature-dispatch gap in the original design and fixed it; the corrected substrate then changed agent behavior on a benchmark where notes memory failed outright. Negative results are published on the same footing as positive ones.
Papers, reports, and negative results
Every quantitative claim ships with the scripts and data that produced it. Papers are deposited on Zenodo with a DOI; released code is on GitHub.
Evidence-Graded Memory with a Doubt Signal: Applying Monotonic Proof-State Advancement Inside Autonomous Agents
Changed repository, stale notes. Notes memory: 0/5 correct. Doubt shown to the model: 0/5. Doubt allowed to interrupt the completion claim: 5/5. Representation was not enough; enforcement was.
Moves the monotonic proof-state model inside the agent loop as a memory written only by observation: facts graded on a confirmation ladder, bound to the code state they were observed under, capped by what the agent's vantage can see, each carrying a cheap uneasiness score learned from outcomes. Building the reference implementation surfaced a premature-dispatch gap in the original theoretical design — under out-of-order delivery, threshold dispatch could evaluate before all required evidence arrived, reducing a perfect judge to 91% across 500,000 simulated instances; frontier gating restored 100%. The efficiency thesis largely did not survive measurement. The correctness thesis did. One small agent model, five runs per cell, constructed scenarios: a pilot, and labeled as one.
Toward LLM-Assisted Policy Enforcement at the Kernel Boundary
p99 verdict latency, deterministic patterns moved onto the synchronous path: 3,617 ms → 1.00 ms. Placement in the pipeline mattered more than model cleverness.
Runtime security controls for AI coding agents that execute system operations with user privileges. A hybrid architecture pairs kernel-level syscall interception with Claude Haiku 4.5 policy decisions over AWS Bedrock: pure-LLM verdicts time out on 56% of events at a 4s budget, while moving the same deterministic patterns onto the synchronous publisher path collapses the tail. Evaluation across 1,247 events and 1,000 threat scenarios. Scope note, stated in the paper and repeated here: the measurements cover the userspace verdict pipeline with the kernel drivers unloaded on the test host. End-to-end enforcement through the driver — and an adversarial pass against a prompt-injected agent — is the next version of this work.
Monotonic Proof-State Advancement for Distributed Workflow Verification
The substrate the agent-memory work is built on. A method for verifying distributed workflows when no single observer can witness every step: a monotonic confirmation-level hierarchy that prevents proof-state regression, threshold-triggered evaluator dispatch that suppresses premature policy evaluation, and boundary-capped proof resolution that distinguishes architecturally unobservable evidence from true policy failure. Illustrated with a payment-settlement case study.
No Free Signal: A Negative Result for Substrate-Evolution Around Fixed LLMs in an Embodied Multi-Agent Population
Can evolutionary pressure on the communication substrate — rather than on model weights — make a frozen LLM more adaptive inside a 25-creature multi-agent system? A seven-arm design with 140 controlled runs, including mute baselines, scrambled models, and cadence-matched noise emitters, finds the full treatment does not outperform any control on fitness. Published as the null result it is. A behavioral analysis still detects emission-source effects on receiver responses, with methodological contributions around cadence-matched noise controls.
The Real Limits of Distributed LLM Training: An Architectural Postmortem
A federated, peer-to-peer LLM training network — its architecture, mechanisms, and the quantitative reasons centralized training still wins for frontier models. Reproducible scripts for bandwidth, straggler, convergence, cost, and poisoning analysis included.