Modern software engineering has evolved sophisticated practices for managing complexity and uncertainty: CFEngine for infrastructure convergence, XP for iterative development, CI/CD for continuous validation, and Domain-Driven Design for semantic boundaries. These practices share a common thread—they provide deterministic frameworks for managing inherently unpredictable processes.

Large Language Models present a parallel challenge: substantial capability with stochastic behavior. While "Attention is All You Need" launched the transformer revolution, experience suggests that Attention is Not All You Need for Software Engineering—robust systems also require the scaffolding of verification, convergence, and bounded autonomy. Just as CFEngine treats infrastructure as eventually consistent rather than immediately correct, LLM outputs are treated in this framework as eventually valid through iterative refinement.

This work does not propose a revolutionary new algorithm, but rather a formalization of these emerging architectural patterns. The contribution is a theoretical grounding of these heuristics—providing the vocabulary, convergence guarantees, and formal reasoning framework required to transform ad-hoc "guardrails" into rigorous engineering disciplines.

Specifically, this work formalizes the separation of deterministic control flow from stochastic content generation. Through Atomic Action Pairs (inseparable generation-verification units) and a Dual-State Solution Space (workflow state versus environment state), the framework enables LLMs to operate within traditional software engineering bounds. Each verification failure provides feedback that refines subsequent generation attempts, achieving reliability through iteration rather than perfection.

Additionally, the architecture provides a potential approach to the Credit Assignment Problem inherent in LLM training. By enforcing immediate verification the framework naturally generates immediate reward signals attributed to specific generation attempts, rather than the sparse rewards typical of end-to-end generation. These verified traces can support both online reinforcement learning and offline supervised fine-tuning (e.g., via LoRA). Over time, this could theoretically reduce retry rates from the observed 2.1× toward 1.0× as models internalize domain-specific constraints.

Importantly, this architectural approach enables reliable systems using smaller, locally-deployed models (< 15B parameters) rather than requiring API access to frontier models. By substituting architectural rigor for parameter scale, organizations can maintain control over their software development pipeline while achieving high reliability.

The control dynamics of this framework draw from convergence patterns first encountered in configuration management, where CFEngine was leading the way in applied research [1, 2] and subsequently formalized as Promise Theory [3, 4]. In production systems, CFEngine demonstrated that reliability emerges not from commanding distributed components but from continuous convergence toward desired states—autonomous agents make promises rather than receive commands. This practical insight, later abstracted by Burgess into Promise Theory, provides the theoretical lens for managing stochastic systems: treat unreliable components as "promisers" and architect convergence operators to guide them toward validity.

Applied to LLMs, this convergence paradigm operates within the classical agent-environment boundary defined by Sutton & Barto [5], where the agent comprises only components modifiable by the control policy. Since the LLM’s weights cannot be modified during inference, it resides in the environment, with the agent function—per Russell & Norvig’s formalization [6]—mapping percepts (generation outputs) to actions (verification decisions).

Against this theoretical foundation, prior approaches to LLM control generally fall into two categories:

External Control Architectures (Symbolic & Hybrid):

Frameworks such as HTN planning [7] and LLM-Modulo [8] maintain deterministic control outside the model. While logically sound, they rely on explicit causal models (preconditions/effects) which are notoriously difficult to extract from the latent space of black-box LLMs.

Internal Control Architectures (LLM-Centric):

Conversely, techniques like Chain-of-Thought [9] and ReAct [10] locate the control loop inside the stochastic generation window. While flexible, these methods suffer from probabilistic control flow, where the agent’s decision-making process is subject to the same hallucination modes as its content generation.

This framework synthesizes these perspectives by utilizing external symbolic guards to enforce the internal convergence of generative promises.

Building on goal-based agent frameworks [11], this work introduces a mechanism to externalize reasoning. The definition of an action is extended to utilize guard functions—not merely as gates, but as active postcondition validators that project the LLM’s internal generation process onto a verifiable external state.

These sensing actions enable a dual-state architecture that provides:

• •

  Observable Workflow Reasoning: Unlike opaque internal monologues (e.g., Chain-of-Thought), reasoning is captured in explicit state transitions, converting probabilistic generation into deterministic logical steps.

• •

  Bounded Indeterminacy: The system guarantees termination and cost control through deterministic validation predicates and finite retry budgets.

• •

  Atomic Composition: Generation and verification are treated as a single transactional unit—an "Atomic Action Pair"—ensuring that invalid content never pollutes the workflow state.

Promise Theory (Burgess, 2015)

A model of voluntary cooperation where autonomous agents issue promises regarding intended behavior rather than guarantees. Interactions are defined by the consumer’s responsibility to verify promise fulfillment, replacing command-and-control assumptions.

Agent (Russell & Norvig, 1995)

A function $f:\mathcal{P}^{*}\to\mathcal{A}$ mapping a complete percept history to actions. A rational agent selects actions that maximize an expected performance measure given its percept sequence and built-in knowledge.

Control Boundary (Sutton & Barto, 1998)

The boundary defining the agent comprises only those components that can be arbitrarily modified by the control policy. Components outside this boundary constitute the environment.

Bounded Rationality (Simon, 1955)

Rational agents operating under computational constraints do not optimize for the global maximum; instead, they satisfice, selecting the first solution that meets the aspiration level (validity criteria) within the available search budget.

Weak Agency (Wooldridge & Jennings, 1995)

A software system exhibiting autonomy, reactivity, and pro-activeness, without implying consciousness or mental states.

Control Boundary (Generative Application)

This framework applies Sutton & Barto’s definition to the resource-dependent nature of Large Language Models (LLMs). The agent boundary is defined by modifiability relative to the time horizon:

• •

  Intra-Episode: The agent controls context composition ($C$) and state transitions ($S_{workflow}$).

• •

  Inter-Episode: With sufficient compute, the agent may control adapter parameters (e.g., LoRA) or distilled weights.

• •

  Base Model: The pre-trained weights remain in the environment, providing a stochastic generation oracle that functions as the fixed generative component.

Goal-Based Agent (Deterministic Controller)

A rational decision function $f:\mathcal{P}^{*}\to\mathcal{A}$ that treats stochastic generations as percepts rather than actions. The agent observes the opaque output of the LLM (environment) and executes deterministic state transitions (actions) based on verification results. This ensures that while the content is stochastic, the control flow remains strictly deterministic.

Neuro-Symbolic Agentic System

A software architecture integrating neural generation with symbolic verification. The LLM (as a component of the environment) issues generation promises; deterministic guard functions verify promise fulfillment within an atomic transaction, ensuring that invalid states are never committed to the persistent workflow history.

Dual-State Architecture

An implementation pattern that separates the system state space $\mathcal{S}$ into two distinct spaces:

• •

  $\mathcal{S}_{workflow}$ (Control State): A deterministic, finite state machine tracking goal progress and guard satisfaction.

• •

  $\mathcal{S}_{env}$ (Information State): An append-only versioned repository of generation history, artifacts, and guard feedback, enabling in-context learning without polluting the control flow.

To ensure auditability and enable effective backtracking, the environment is formalized not as a mutable store, but as an append-only versioned repository.

To preserve the finiteness of the planning space while enabling learning, a distinction is made between the Control State (Workflow) and the Information State (Context).

The execution of policy $\pi$ follows a refined control loop that handles context augmentation upon failure, as detailed in Algorithm 1.

Standard generative planning operates in $\mathcal{S}_{\text{env}}$, the space of all possible artifacts (e.g., all valid Unicode strings). Since $|\mathcal{S}_{\text{env}}|\approx\infty$, standard MDP planning algorithms with complexity $O(|S|^{2}|A|)$ are intractable.

Execution is projected into $\mathcal{S}_{\text{workflow}}$, defined by the boolean status of $N$ guards. While the theoretical size of this space is $2^{N}$, it is observed that industrial workflows typically follow a strict sequential or Directed Acyclic Graph (DAG) structure.

The Reachable Execution Tree $\mathcal{T}$ is defined as the subset of states reachable from $s_{init}$ under the transition function $T$. For a sequential workflow of length $K$, the reachable space is linear in $K$.

Remark on Generator Cost: While generator execution is treated as an atomic action in the planning layer, each transition in $\mathcal{S}_{\text{workflow}}$ corresponds to a potentially computationally intensive operation in $\mathcal{S}_{\text{env}}$ (e.g., LLM inference). However, this cost is constant per node visit and does not affect the asymptotic complexity of the search algorithm itself.

Given $N$ guards and a retry limit $R_{max}$, the planning problem reduces to finding an optimal policy in the finite AND-OR tree $\mathcal{T}$. The size of this tree is bounded by:

Finding the optimal policy involves a single traversal of this finite tree (e.g., via backward induction), with a computational cost of $O(|\mathcal{T}|)$. This represents a reduction from infinite/intractable ($s_{\text{env}}$) to linear/polynomial complexity ($S_{workflow}$) with respect to the workflow length, conditioned on the assumption that the workflow structure is sparse.

The primary contribution of this work is the formal Dual-State Framework and the concept of Atomic Action Pairs. To validate this architecture, a set of Diagnostic Probes was selected rather than broad industry benchmarks such as HumanEval or SWE-Bench.

This decision was driven by two factors. First, as an independent researcher with limited computational resources (time and GPU availability), the goal was to isolate the architectural mechanism efficiently rather than benchmark model parameters at scale. Second, and more critically, current benchmarks are not designed to evaluate agentic control flow in the context of formal verification.

For instance, while SWE-Bench provides realistic software engineering tasks, applying the framework would require a pre-existing library of Guard Actions (formal specifications or executable tests) mapped to each repository issue. Constructing such a “Guard Library” is a non-trivial engineering challenge and represents a distinct avenue for future research (potentially involving a meta-policy that selects guards dynamically).

Consequently, this experimental validation is illustrative. It is designed to answer a single mechanistic question: Does the introduction of deterministic guards enable a stochastic model to solve problems it could not solve zero-shot?

To this end, three tasks were selected (see Appendix C). It is hypothesized that while the models possess high prior knowledge (“High Priors”) for the concepts behind all three, they differ significantly in implementation difficulty:

• •

  LRU Cache: The model is expected to have High Priors for both the concept and the implementation. The pattern (Hash Map + Linked List) is standard in training data. The challenge is simply maintaining state without drift.

• •

  Template Engine: The model is expected to have High Priors in Concept (knowing what a template engine is), but Low Priors in Implementation. Since there is no single standard way to write a parser from scratch, the model must synthesize a novel solution rather than recalling a memorized one.

• •

  Password Validator: The model is expected to have High Priors in Concept but faces a Calculation Gap. While the rules are simple to state, satisfying them requires mathematical operations (e.g., Prime Number calculation) that are difficult for token-prediction models to implement correctly.

In choosing these tasks, specific Atomic Action Pairs are isolated to validate that deterministic guards can enforce reliability on a single stochastic generation node. Data was collected to test two primary hypotheses:

• •

  H1 (Reliability): The dual-state, guard-based planning framework significantly increases task success rates compared to a standard, single-attempt baseline.

• •

  H2 (Efficiency): The increase in reliability is achieved with modest additional generation attempts, and this efficiency varies predictably with model scale.

Limitations of this Approach: It is acknowledged that these tasks are bounded and synthetic. However, by restricting the problem space, confounding variables are eliminated — such as library knowledge or prompt ambiguity—allowing success to be attributed directly to the architectural intervention (the Guard mechanism).

A foundational premise of this work is that the Dual-State Framework is an architectural multiplier for capability, not a substitute for it. The framework requires a generator capable of instruction following—specifically, the ability to ingest a guard’s error trace and attempt a semantic correction.

To isolate this architectural effect, a model is deemed qualified if it consistently produces parsable output in a zero-shot prompt. Models that fail this basic threshold (e.g., raw FIM models, or those producing blank tokens) violate Assumption 1 ($\epsilon\approx 0$). Including them would conflate architectural failure with model incapacity.

Specifically, the qualification threshold requires the model to adhere to the requested output format (Markdown code blocks) under a generic system prompt. Models that produce valid code but fail to wrap it in standard formatting (e.g., Markdown backticks) are classified as unqualified, as they fail the fundamental agentic requirement of Interface Compliance.

• •

  Workflow: The workflow for all tasks enforces structural correctness via a sequential Guard Validation Chain:

  1. 1.

     Generation: The probabilistic output from the LLM.

  2. 2.

     Syntax Validation: Enforced by SyntaxGuard (validating Python AST parsing).

  3. 3.

     Functional Correctness: Enforced by TestGuard (validating functional correctness via unit tests).

  Each guard failure triggers the refinement loop ($s_{w}\to s_{w}$), preventing transition to the next logical state until the constraint is met.

• •

  Models & Runtime: 13 models from 6 families were evaluated (see Table 2). All models were executed locally using Ollama v0.12.3 to ensure a standardized, offline inference environment. The focus is deliberately on Small Language Models (SLMs) ($<$15B parameters) to test the hypothesis that architectural constraints can substitute for parameter scale. Demonstrating high reliability on these lightweight models validates the framework’s ability to act as a capability multiplier, enabling secure, local execution for SDLC tasks without reliance on massive, proprietary APIs.

• •

  Hardware Specification: Experiments were conducted on a workstation equipped with an AMD Threadripper PRO (32 cores), 125GB RAM, and an NVIDIA RTX A4000 GPU. This setup accommodated the varying VRAM requirements of models ranging from 1.3B to 15B parameters without quantization loss beyond the standard 4-bit (q4_k_m) schema.

• •

  Inference Parameters: To verify the architecture’s ability to manage high variance, all models were sampled with temperature $T=0.7$. This relatively high entropy setting ensures the generator is sufficiently "irrational," testing the framework’s ability to constrain a stochastic process.

• •

  Software Harness: The control loop was implemented in Python 3.12.11. To strictly isolate the "Control" from the "Generation," the harness enforces:

  • –

    Context Isolation: A hard reset of the inference context window between trials.

  • –

    Template Normalization: A unified system prompt is applied across all models, intentionally avoiding model-specific chat templates. This acts as a stress test for "Instruction Following Robustness"—models that rely on bespoke control tokens rather than natural language instructions fail the qualification step.

• •

  Guards ($G$): A single comprehensive guard was implemented, $G_{\text{functional}}$, which encapsulates:

  1. 1.

     Execution Safety: Controlled process execution with a 60s timeout to prevent infinite loops.

  2. 2.

     Functional Correctness: A suite of task-specific unit tests against the generated artifact.

  3. 3.

     Diagnostic Feedback: If failure occurs, the guard returns specific error traces to guide retries.

• •

  Configurations: Two execution modes are compared:

  • –

    Baseline (One-Shot): A single generation attempt ($k=1$), measuring the model’s raw zero-shot capability.

  • –

    Guarded (Agentic): The contingent planner with a retry limit of $R_{\text{max}}=3$. This mode utilizes the guard’s diagnostic feedback to iteratively refine the artifact upon failure.

50 independent trials were executed for each model across the three diagnostic probes. To quantify the architectural benefit of the Dual-State Framework, the Baseline Success (One-Shot, $k=1$) is reported, the Guarded Success ($R_{max}=3$), and the Reliability Gain ($\Delta$), which represents the absolute percentage point improvement attributable to the guard mechanism.

The expanded benchmark across 13 models (ranging from 1.3B to 15B parameters) reveals a nuanced capability landscape. Statistical significance was assessed using Fisher’s exact test, with effect sizes reported as Cohen’s h for proportions.

Template Engine (Structural Gap): This task exhibited the widest variance in guard effectiveness. Top performers achieved substantial gains: Yi-Coder (9B) improved from 56% to 98% ($\Delta=+42\text{pp}$, $p<0.001$, Cohen’s $h=1.17$), while StarCoder2 (15B) reached perfect reliability from a 60% baseline. The template task proved most discriminating for smaller models—DeepSeek-Coder (6.7B) achieved only 18% guarded success ($\Delta=+14\text{pp}$, $p=0.051$), suggesting that instruction-following fidelity limits how effectively feedback can be utilized. The sub-3B models showed negligible improvement ($\epsilon\approx 0$), establishing a clear capability threshold.

LRU Cache (Drift Prevention): The LRU task confirmed the framework’s efficiency for well-understood patterns. Eleven of thirteen models achieved $\geq$98% guarded success. Notable findings include:

• •

  DeepSeek-Coder (6.7B) showed the largest gain ($\Delta=+50\text{pp}$, $p<0.001$, Cohen’s $h=1.33$), demonstrating that guards effectively close the reliability gap for mid-capability models.

• •

  Phi4-Mini (3.8B) exhibited anomalous behavior: a negative gain (-2pp) with high retry costs (1.80 avg), suggesting possible overfitting to feedback or instruction-following degradation under error correction.

• •

  DeepSeek-Coder (1.3B) achieved 0% across both configurations, establishing the canonical “unqualified” ($\epsilon=0$) model baseline.

Password Validator (Reasoning Gap): This task exposed a reasoning capability threshold that correlates weakly with parameter count. Phi4 (14B) achieved 98% baseline, while StarCoder2 (15B) achieved 0%. The guards proved transformative for StarCoder2: from 0% baseline to 66% guarded ($\Delta=+66\text{pp}$, $p<0.001$, Cohen’s $h=1.90$)—the largest effect size observed. This suggests guards can bootstrap reasoning in models that understand the structure but fail on computation. Sub-3B models showed the capability threshold clearly: Qwen2.5-Coder (1.5B) reached 52% guarded from 14% baseline, while DeepSeek-Coder (1.3B) and Phi4-Mini (3.8B) remained at 0%.

Cost-Benefit Analysis: Across all valid trials, the framework demonstrates efficiency advantage over standard “Best-of-N” sampling. A comparable Pass@5 strategy incurs a fixed 5.0$\times$ compute cost. In contrast, the sequential refinement strategy achieves reliable convergence with an average cost of just 1.2–1.6$\times$ for qualified models. The cost-benefit ratio (gain per compute multiplier) was highest for mid-sized models: StarCoder2 (15B) on password achieved +35.9pp/x, while Qwen2.5-Coder (7B) on template achieved +20.3pp/x.

Key Insight—Task-Specific Qualification: A critical finding is that model qualification ($\epsilon>0$) is task-specific, not global (see Figure 2). Phi4-Mini (3.8B) is qualified for LRU (60% baseline) but unqualified for password (0%). This has practical implications: guard-based systems should assess model capability per-task rather than assuming uniform competence.

The preceding experiments validated single Atomic Action Pairs. To test multi-step workflows, a TDD pipeline was constructed where the output of one action pair becomes input to the next:

1. 1.

   g_test: Generate pytest test functions from specification (validated by SyntaxGuard)

2. 2.

   g_impl: Generate implementation that passes the generated tests (validated by DynamicTestGuard)

This creates a practical complication: the implementation must satisfy LLM-generated tests, not human-written ones. Specification errors in the first step propagate to the second.

Six tasks were selected across difficulty tiers: Stack and Queue (basic data structures), Calculator and LRUCache (state management), SimpleTemplate (string parsing), and PasswordValidator (exact error message matching). Three Qwen2.5-Coder variants (3B, 7B, 14B) were tested across 50 trials each with $R_{max}=3$.

The results confirm expected patterns: model scale correlates with success (70% for 14B vs. 36% for 3B), and task difficulty creates clear tiers. Easy tasks achieve 71–98% success; hard tasks drop to 0–14% for PasswordValidator.

The PasswordValidator results warrant attention. Even the 14B model achieves only 14% success—far below its single-task performance. Examining the failure artifacts reveals why: LLM-generated tests frequently contain incorrect edge case expectations (e.g., wrong error message ordering for multi-violation inputs). The implementation then fails not because it is wrong, but because it must satisfy a flawed specification.

This illustrates the risk identified in Remark 7: when LLM-generated artifacts become validators, specification errors compound through the workflow. The practical mitigation is straightforward—insert a HumanGuard checkpoint between test generation and implementation to catch specification errors before they propagate.

The framework supports this; the benchmark simply omitted it to measure the failure mode. Far from being an experimental flaw, this failure mode validates the central thesis of the framework: a stochastic generator cannot serve as its own ground-truth oracle. Without an external source of truth (a human, a formal spec, or a deterministic compiler), the agent creates a closed feedback loop of hallucination.

While Appendix F outlines a practical workflow for bootstrapping legacy systems[12], this process represents a distinct class of theoretical control problems: Specification Extraction via Oracle Inversion. Unlike standard generation where the specification is static and explicit ($C_{\text{init}}$), legacy environments possess a latent specification encoded purely in binary execution behavior.

Future research should investigate the convergence properties of agents operating in this “Oracle Inversion” regime. Specifically, can the Dual-State Architecture guarantee that an agent’s set of generated characterization guards ($G_{\text{char}}$) asymptotically approaches the true semantic boundaries of the legacy artifact? By modeling the “Bootstrapping Phase” as a System Identification task, we can theoretically bound the number of “sensing actions” (guard executions) required to achieve a target confidence level in the generated regression suite, effectively transforming “Legacy Refactoring” from an art into a measurable, convergent algorithmic process.

The standard execution model treats retries as computational waste. Converting this overhead into a training signal is proposed by closing the loop between three distinct entities: the Guard (the critic), the Coach (the guide), and the Generator (the actor). This creates a four-tier optimization hierarchy:

While this work formalizes the Guard as a fixed component of an Atomic Action Pair, future iterations can treat the Guard function $G$ as a distinct member of the agent’s available action space $\mathcal{A}$. In this view, the agent is not merely a generator of code, but a rational decision-maker that must select the optimal verification strategy for a given state.

From an SDLC perspective, guards can be modeled as a Library of Actions available within specific parent states. For example, in a CodeReview state, the agent might have access to a set of verification actions:

Each action carries a distinct computational cost and information gain. A simple syntax check is cheap but offers low safety assurance; a security scan is expensive but high-value.

Current code generation benchmarks (e.g., HumanEval, MBPP) primarily measure the static generative capability of models in a zero-shot regime. They do not capture the dynamic capabilities required for agentic workflows: error recovery, state maintenance across retries, and adherence to rigid environmental constraints.

The field requires a Control-Oriented Benchmark Suite—effectively a “GuardGym”—that evaluates agents not on their initial output, but on their ability to converge to a valid state under strict guard feedback. In this paradigm, the primary metrics shift from Pass@k to Refinement Efficiency (the mean number of retries required for convergence) and Trajectory Stability (the resistance to regression loops). Such a benchmark would isolate the architectural contribution of the control loop from the raw knowledge capacity of the model, providing a standardized method for evaluating neuro-symbolic bridges.

In collaborative environments, $\mathcal{S}_{\text{env}}$ is modified by multiple actors. The Dual-State framework provides synchronization without explicit message passing or complex consensus algorithms.

The workflow state $\mathcal{S}_{\text{workflow}}$ thus serves as a fully observable blackboard. For example, a downstream Implementation Agent does not need to query an upstream Specification Agent for status; it simply executes the relevant (verify-spec) sensing action on the shared artifact. If the Guard passes, the shared truth is established, and execution proceeds.

While this work uses JSON-based task specifications (Appendix B), the Dual-State architecture is compatible with richer formalisms. Future work may extend the specification language to support HTN-style hierarchical decomposition with explicit parallel fork-join semantics (e.g., :ordering (add || tdd || bdd)) and typed generative actions with retry bounds. Such extensions would enable formal verification of workflow properties (deadlock freedom, guaranteed termination) prior to execution.

A prevailing view in AI alignment seeks to make the generative model itself “categorically safe” through Reinforcement Learning from Human Feedback (RLHF) or constitutional training. However, this work proceeds from the premise that the stochastic nature of Large Language Models is not a defect to be eliminated, but a fundamental capability—a “superpower” that enables creativity and solution diversity. Attempts to constrain this stochasticity at the model weights level risk lobotomizing the very capability we seek to exploit.

Instead, this framework advocates for shifting the locus of safety from the component (the LLM) to the system (the Architecture). By accepting that the solution space of a generative model is inherently probabilistic and unsafe, we can focus on augmenting it with a deterministic control layer that enforces safety constraints. In this view, safety is not an intrinsic attribute of the intelligence, but an emergent property of the workflow in which that intelligence is embedded.

By formalizing the Environment State as a Versioned Repository ($\mathcal{R}$), the framework creates a record of rejected artifacts ($a_{fail}$) and the feedback ($\phi$) that guided correction. This supports post-hoc analysis of failure modes and convergence behavior.

The append-only structure also provides a degree of tamper-evidence: unauthorized insertions into the context would create discontinuities in the derivation graph that could be flagged by external auditors.