Governed multi-sub-agent orchestration: plan, route, execute, verify, merge, audit, recover — with per-sub-agent isolation

1. Contribution

Claimed. A single high-level request is decomposed into a DAG of governed sub-agent tasks. Each task runs as a full governed ReAct loop with its own identity (sub-agent id / task id / parent run id / tenant id), an isolated memory namespace, an allowed-tool restriction, and its own audit chain. A bounded-concurrency wave scheduler plans and dispatches tasks (parallel where independent), enforces a per-task timeout, retries only idempotent tasks, and merges results through a deterministic reducer that carries per-subtask audit references. On any sub-agent failure the orchestrator returns a structured partial result (all-OK flag plus failed-task ids), never a silent success. Every tool call still passes through a tool governor and a commit gate; an injected side-effect inside a sub-agent is denied and no sub-agent leaks into another. Verified at the contract level by model-free tests (each with a negative control) and by a real-model capstone on a quantized 30B-A3B-class model.

NOT claimed. This is multi-sub-agent orchestration, not multi-LLM autonomy: the planner is a deterministic clause splitter (v1), not an LLM. Parallelism is proven at the contract level (mock tests with overlap evidence); real-model concurrency is concurrent submission with serialized decode — no parallel-decode speedup and no throughput number is claimed. Scale (many agents), real business connectors, and production hardening are out of scope and not demonstrated.

2. Methods

The contract-level tests are model-free and falsify-first: a RED state was captured first (the four core types did not exist, so the test target failed to compile, demonstrating the capability was absent), then GREEN.

3. Results

• Contract-level tests: 6/6 GREEN, model-free, each with a negative control: split into three or more sub-agent tasks; parallel-overlap (independent tasks run in parallel; the negative control with max concurrency of 1 serializes); tool calls remain governed (a demo email side-effect denied, no bypass); sub-agent isolation (negative control: an explicit dependency does pass data); partial failure yields a structured result; reducer merges results with audit references. The full agent test suite passes with no regression.
• Real-model capstone: 7/7 (a one-command real-model capstone against a quantized 30B-A3B-class model): one composite request decomposed into four governed sub-agents — a read-only calculator (ran), a memory write (ran), a demo email side-effect (attempted by the real model, DENIED by the governor, no bypass), and a fan-in summarize that depends on the prior three (ran a recall). Distinct audit references per sub-agent; the reducer's final answer carries every task id plus audit reference.
• Concurrency mitigation (capstone). Running the daemon in a request-granular serialized-decode mode ran max concurrency of 3 at 9/9 with the daemon surviving and a maximum observed concurrency of 3. This is concurrent submission with serialized decode — no parallel-decode speedup. All numbers are from a single recorded run; no variance or repetition is stated in the source.

4. Ablations / negative controls

• Parallel-overlap negative control: max concurrency of 1 serializes the independent-task test — confirms the overlap observed at higher concurrency is real, not incidental.
• Isolation negative control: an explicit dependency does pass data between sub-agents — confirms the isolation is enforced by the absence of a declared edge, not by an inability to communicate.
• Governance: the demo email side-effect is denied both in the model-free test (no bypass) and when attempted by the real model in the capstone — confirms the governor holds across the sub-agent dispatch seam.

5. Threats to validity / limitations

• Planner is deterministic (model-free) v1, not an LLM planner. It splits requests on commas / "then" / ";". Nuanced decomposition is future work; an LLM planner would drop in via the same planner protocol. The sub-agents themselves use the real model.
• Real-model concurrency is SAFE-but-SERIALIZED. The engine's default batched-decode path is not safe under the agent concurrency pattern: its decode paths assume a single in-flight decode and share per-stream state, so concurrent decode is unsafe in the current build. The shipped mitigation serializes decode at request granularity. There is no parallel real-model decode and the batched-throughput advantage is off in this mode. True parallel decode would require per-stream state isolation in the engine or data-parallel scale-out.
• Bounded concurrency is a capability, not a benchmark. Max concurrency bounds in-flight sub-agents; "many agents" is not load- or scale-tested. No throughput numbers are claimed.
• Single recorded run. Capstone and concurrency numbers are from one run each; no variance, repetition, or independent reproduction is stated in the source. Evidence level is experimental.
• No real enterprise connector. The email side-effect is a denied demo tool (off by default). Real connectors are out of scope and not yet implemented.
• Per-sub-agent memory is per-run ephemeral (isolated by task id; not promoted to durable tenant memory). Cross-run sub-agent memory is future work.
• Inherits the daemon's non-production posture (no transport security / high availability; rate-limit default-off).
• Hardware, build flags, oracle, and precision details beyond the quantized capstone model are not recorded in source.

6. Reproducibility

• Repro command: a one-command real-model capstone script (against a quantized 30B-A3B-class model served by a real daemon).
• Contract tests: a model-free contract-test suite (6/6, runnable without a model).
• Daemon configuration for the concurrency mitigation: start the daemon in the request-granular serialized-decode mode.
• Companion docs: internal design notes on the orchestration runtime, the concurrent-decode investigation, and a capability-delta reality check.
• Env / hardware: single box; specific hardware, OS, and build flags are not recorded in source.