Clock Invariance in Decentralized Agent Presence: Eliminating Ephemeral Liveness Spoofs and Test-Fixture Rot

#Abstract

In decentralized multi-agent computing environments where autonomous agents run across heterogeneous cloud providers, local developer seats, and containerized runtimes, determining agent liveness and presence is a foundational distributed state problem. Conventional presence architectures rely on heartbeats evaluated against unmocked system wall-clocks (Date.now()). This design creates two severe failure modes: (1) Future-Dated Liveness Spoofing, where a rogue or misconfigured node writes a timestamp in the future to maintain perpetual “live” status, and (2) Test-Fixture Clock Rot, where test suites pass or fail depending on the time of day CI executes.

In this paper, we formalize the Spatiotemporal Invariance Theorem for multi-agent presence derivation and present its reference implementation within the Mupot substrate. We demonstrate how unconstrained time difference equations ($\Delta t = t_{\text{now}} - t_{\text{heartbeat}}$) create unbounded negative age vulnerabilities, analyze real-world production incident data from Flight-008 (PR #1077 and Issue #1079), and establish the mathematical necessity of Clock Injection Protocols ($\text{nowMs}$ parameterization).

We show that enforcing parameter-threaded clock injection across all state derivation functions guarantees complete temporal invariance, eliminates clock-skew vulnerabilities, and ensures that distributed multi-agent telemetry remains deterministic and reproducible across arbitrary execution seats.

---

#1. Introduction: The Fragility of Uninjected Time in Agent Fleets

Autonomous multi-agent architectures operate as distributed state machines. Agents register heartbeats, claim task leases, evaluate presence states, and execute peer-to-peer handoffs across disparate physical networks (e.g., Google Cloud VMs, Hetzner bare-metal servers, and local terminal harnesses).

graph TD
    subgraph Non-Invariant Time Evaluation (The Vulnerability)
        A1[Heterogeneous Node 1: Hetzner] -->|Heartbeat t1| DB[(Presence Table)]
        A2[Heterogeneous Node 2: GCP] -->|Heartbeat t2| DB
        A3[Unsynced / Rogue Node 3] -->|Future Heartbeat t_future| DB
        
        DB --> E1[Presence Derivation Function]
        SYS[System Wall Clock Date.now] --> E1
        E1 -->|Evaluates age = Date.now - t_heartbeat| RES1[Inconsistent Presence State / Eternal Liveness Spoof]
    end

    subgraph Spatiotemporally Invariant Architecture (Mupot)
        B1[Heterogeneous Node 1] -->|Heartbeat t1| MDB[(D1 Presence Table)]
        B2[Heterogeneous Node 2] -->|Heartbeat t2| MDB
        
        MDB --> E2[Pure Derivation Function]
        INJ[Injected Parameter: nowMs] --> E2
        E2 -->|Evaluates clamped bounded age| RES2[Deterministic, Time-Invariant Presence Matrix]
    end

In typical web and cloud architectures, developers evaluate temporal elapsed time using system primitives: $\Delta t = \text{Date.now}() - t_{\text{heartbeat}}$

While deceptively simple, this pattern introduces fatal vulnerabilities when applied to autonomous agent swarms:

1. The Negative-Age Loophole (Future Skew): If a node’s clock is skewed forward, $\Delta t < 0$. If the liveness predicate only checks $\Delta t \le \text{TTL}$, a future-dated heartbeat remains “live” indefinitely.
2. Clock-Rot in CI/CD: A test fixture written with a static timestamp passes when executed in the morning, but fails in the afternoon when real time crosses the TTL threshold.
3. Flaky Consensus: Different observer agents reading the same database row compute conflicting presence states based on microsecond differences in their local clocks.

To resolve this, Mupot establishes Spatiotemporal Clock Invariance as a core substrate law.

---

#2. Mathematical Formulation of Presence Derivation

Let $\mathcal{A}$ be the set of registered agent identities in a multi-agent network. Each agent $a \in \mathcal{A}$ periodically emits a heartbeat tuple: $H_a = \langle a, \tau_a, \kappa_a \rangle$ Where $\tau_a \in \mathbb{R}^+$ is the recorded timestamp in epoch milliseconds, and $\kappa_a$ is the node capabilities metadata.

#2.1 The Naive Presence Predicate

Let $\mathcal{T}_{\text{TTL}} \in \mathbb{R}^+$ be the maximum allowable heartbeat silence window (e.g., 180 seconds). In naive systems, the presence function $\mathcal{P}_{\text{naive}}: \mathcal{A} \to \{\text{LIVE}, \text{STALE}, \text{OFFLINE}\}$ is defined as:

\text{LIVE} & \text{if } (t_{\text{sys}} - \tau_a) \le \mathcal{T}_{\text{TTL}} \\ \text{STALE} & \text{if } \mathcal{T}_{\text{TTL}} < (t_{\text{sys}} - \tau_a) \le 2\mathcal{T}_{\text{TTL}} \\ \text{OFFLINE} & \text{otherwise} \end{cases}$$ ### 2.2 The Negative Age Vulnerability (Theorem 1) **Theorem 1 (Unbounded Future Skew):** Under $\mathcal{P}_{\text{naive}}$, any heartbeat where $\tau_a > t_{\text{sys}}$ satisfies the condition $(t_{\text{sys}} - \tau_a) \le \mathcal{T}_{\text{TTL}}$ for all $t_{\text{sys}} < \tau_a + \mathcal{T}_{\text{TTL}}$. *Proof:* Let $\tau_a = t_{\text{sys}} + \delta$, where $\delta > 0$ represents future clock skew. $$t_{\text{sys}} - \tau_a = t_{\text{sys}} - (t_{\text{sys}} + \delta) = -\delta$$ Since $\delta > 0$, $-\delta < 0 \le \mathcal{T}_{\text{TTL}}$. Therefore, $\mathcal{P}_{\text{naive}}(a, t_{\text{sys}}) = \text{LIVE}$. $\blacksquare$ **Consequence:** A rogue runner or misconfigured agent can emit a single heartbeat with $\tau_a = \text{Date.now}() + 10^9\text{ ms}$, permanently spoofing active presence in the fleet for decades without running any compute. --- ## 3. The Invariant Presence Architecture in Mupot To eliminate Theorem 1 and guarantee absolute testability, Mupot enforces a two-part architectural constraint: ### 3.1 Bounded Clock-Skew Clamping Mupot defines an explicit maximum clock-skew tolerance $\mathcal{T}_{\text{skew}}$ (e.g., 60 seconds). The presence predicate is bounded symmetrically: $$\text{Age}(a, t_{\text{ref}}) = \frac{t_{\text{ref}} - \tau_a}{1000}$$ $$\mathcal{P}_{\text{clamped}}(a, t_{\text{ref}}) = \begin{cases} \text{SKEW\_ANOMALY} & \text{if } \text{Age}(a, t_{\text{ref}}) < -\mathcal{T}_{\text{skew}} \\ \text{LIVE} & \text{if } -\mathcal{T}_{\text{skew}} \le \text{Age}(a, t_{\text{ref}}) \le \mathcal{T}_{\text{TTL}} \\ \text{STALE} & \text{if } \mathcal{T}_{\text{TTL}} < \text{Age}(a, t_{\text{ref}}) \le 2\mathcal{T}_{\text{TTL}} \\ \text{OFFLINE} & \text{otherwise} \end{cases}$$ ### 3.2 Formal Clock Injection ($\text{nowMs}$ Parameterization) No core state derivation function in Mupot is allowed to access system wall-clocks directly. Time is treated as an explicit, pure input: ```typescript // src/dashboard/observatory.ts export interface PresenceQueryOptions { ttlSec?: number; maxClockSkewSec?: number; nowMs?: number; // Injected reference time } export function derivePresenceState( lastHeartbeatMs: number, options: PresenceQueryOptions = {} ): "live" | "stale" | "offline" | "skew_anomaly" { const nowMs = options.nowMs ?? Date.now(); const ttlSec = options.ttlSec ?? 180; const maxClockSkewSec = options.maxClockSkewSec ?? 60; const ageSec = (nowMs - lastHeartbeatMs) / 1000; if (ageSec < -maxClockSkewSec) return "skew_anomaly"; if (ageSec <= ttlSec) return "live"; if (ageSec <= ttlSec * 2) return "stale"; return "offline"; } ``` By making `nowMs` an explicit parameter with a `Date.now()` default for production calls, tests can simulate any arbitrary point in spacetime with microsecond precision. --- ## 4. Empirical Case Studies from Live Council Deployments ### 4.1 Case Study: The 05:28 vs 12:44 UTC Time Bomb (Flight-008, PR #1077) During Flight-008, a pull request was submitted consolidating dashboard KPIs across Home, Health, and Fleet surfaces into a unified helper `computeOperatorCounts()`. #### The Empirical Incident: 1. **Initial CI Run (05:28 UTC):** 14/14 CI checks passed green. The pull request was marked ready for merge. 2. **Adversarial Gate Run (12:44 UTC):** Companion gatekeeper **River** executed `tests/operator-counts-cross-surface.test.ts`. The test failed with: $$\text{Expected liveRuntimeCount} = 2, \quad \text{Received} = 0$$ #### The Forensic Root Cause: The test fixture had hard-coded an agent presence timestamp of `11:58:00 UTC`: - At `05:28 UTC`, `11:58 UTC` was 6.5 hours in the future ($\text{Age} = -23400\text{s}$). Under un-clamped logic, $-23400 \le 180\text{s}$ evaluated to `true`, marking the seat as "live". - At `12:44 UTC`, real wall-clock time had advanced past `11:58 UTC` ($\text{Age} = +2760\text{s} > 180\text{s}$), immediately classifying the seat as "offline". #### The Substrate Fix (Commit `fb03d8c6`): 1. Parameter `nowMs?: number` was threaded through `loadObservatory()` down to `loadAgentRuntimeStates(db, potId, nowMs)`. 2. The cross-surface fixture was updated to explicitly pin `nowMs = 11:58:30 UTC` ($\text{Age} = +30\text{s}$), making the test mathematically invariant to the time of execution. 3. 51/51 unit tests passed across all execution seats regardless of local timezone. --- ### 4.2 Case Study: Bounded Skew vs Liveness Spoofing (Issue #1079) Following the resolution of PR #1077, council audit revealed issue **mupot#1079**: a rogue agent could intentionally emit heartbeats with $t_{\text{future}} = \text{Date.now}() + 1\text{ year}$, evading all maintenance heartbeat warnings and health checks. #### Implementation Proof: By introducing `maxClockSkewSec = 60`, any heartbeat emitted further than 60 seconds into the future is immediately flagged as a `SKEW_ANOMALY` and stripped from dispatch routing. --- ## 5. Architectural Axioms for Distributed Temporal State From our empirical operations, we codify four foundational axioms for temporal state management in autonomous AI swarms: 1. **Axiom of Pure Temporal Derivation:** State derivation functions must be pure projections of database state and a reference timestamp: $$f: \mathcal{D} \times \mathbb{R}^+ \to \mathcal{S}_{\text{derived}}$$ 2. **Axiom of Symmetric Bounding:** Every duration check $(t_{\text{ref}} - t_{\text{event}}) \le \Delta$ must possess an explicit lower bound $-\epsilon \le (t_{\text{ref}} - t_{\text{event}})$ to prevent future-dated bypasses. 3. **Axiom of Fixture Time-Invariance:** A test fixture that contains a hard-coded timestamp without pinning its reference evaluation clock is an architectural defect. 4. **Axiom of Observer Symmetry:** Two independent observer agents inspecting the same database snapshot at reference time $T_0$ must compute identical presence matrices. --- ## 6. Conclusion & Substrate Availability Temporal non-determinism is one of the most insidious sources of silent failure in distributed autonomous systems. By eliminating direct calls to unmocked system clocks, implementing symmetric clock-skew clamping, and formalizing parameter-threaded clock injection, Mupot guarantees that agent presence derivation is deterministic, verifiable, and immune to time-decay rot. The time-invariant observatory engine, presence schemas, and test suites are open-source and maintained under the **Mumega Open Science Initiative**: - **Repository:** `https://github.com/Mumega-com/mupot` - **Module Path:** `src/dashboard/observatory.ts` - **Paper DOI:** `10.5281/zenodo.mumega.200.403` --- ## References 1. Lamport, L. (1978). *Time, Clocks, and the Ordering of Events in a Distributed System*. Communications of the ACM, 21(7), 558–565. 2. Mills, D. L. (1991). *Internet Time Synchronization: The Network Time Protocol*. IEEE Transactions on Communications, 39(10), 1482–1493. 3. Mumega Synthetic Council. (2026). *Paper 200.401: Falsificationist Substrates for Multi-Agent Systems: Beyond Tautological Task Execution*. Mumega Paper Series. 4. Mumega Synthetic Council. (2026). *Paper 200.402: Kill-Witness Verification: Adversarial Falsification of Code in Autonomous AI Swarms*. Mumega Paper Series. 5. Mumega Synthetic Council. (2026). *ADR-008: Mupot Operating Model & Epistemic Invariants*. Mumega Architecture Repository.