Not 'Tested.' Model-Checked. — Why MAREF Uses TLA+ Formal Verification

By MAREF Engineering

TLA+ formal verification formal methods agent governance Lyapunov

"Tested in production" is not a security strategy. Not when your agents can delete databases, sign contracts, and call APIs with real-world consequences.

Testing tells you one thing: the system didn't fail in the specific scenarios you tested. It doesn't tell you it won't fail in the one scenario you didn't think of. And with multi-agent systems, the state space is infinite — you can't test your way to safety.

That's why MAREF doesn't rely on testing alone. The governance state machine is model-checked using TLA+ against specs of its constitutional red-line invariants — the same model checking language used to verify Amazon Web Services, consensus protocols like Raft, and real-time systems where failure means loss of life.

What is TLA+?

TLA+ (Temporal Logic of Actions) is a formal specification language created by Leslie Lamport — winner of the 2013 Turing Award. It's designed to model and verify concurrent, distributed, and stateful systems.

The key insight: instead of testing individual scenarios, TLA+ exhaustively checks all possible states of a specification against invariants you define. If the model checker says no counterexample exists, the specification satisfies the invariant — not for the 100 cases you tested, but for every possible execution path.

Amazon used TLA+ to find subtle bugs in S3, DynamoDB, and EBS that would have caused multi-hour outages. If it's good enough for AWS infrastructure, it's good enough for agent governance.

What MAREF Verifies in TLA+

MAREF's governance state machine — a 10-state, 4-bit Gray Code FSM — is modeled in TLA+. The model checker verifies:

  • HALTAbsorbing invariant: □(s = HALT ⇒ ∀k > 0: s{t+k} = HALT) — once halted, always halted. No agent can un-halt itself.
  • Constitutional red-line invariants: the TLA+ specs encode red-line immutability, safety-gate integrity, audit-trail completeness, and constitution supremacy (INV-001…INV-005, plus cross-dimensional CD-INV-* constraints).
  • Safety state reachability: the HALT state is reachable from any operational state within finite steps — the circuit-breaker path always exists.
  • No deadlock: the system never gets stuck in a state where no valid transition exists.

The Practical Difference: Model Checking vs. Testing

Here's what formal verification buys you that testing doesn't:

Testing: "We checked 100 attack scenarios"

→ The 101st attack might work. The test suite only covers what you thought of.

TLA+ Verification: "No counterexample exists across all possible state transitions"

→ The invariant holds for every execution path, including ones you never considered.

Convergence monitoring: "The system's error metrics trend downward"

→ Not "we hope the evolution helps" — the metrics are instrumented and reproducible from the public benchmark suite.

What About the Five Eyes / CISA Guidance (May 2026)?

The May 2026 joint guidance from CISA and the Five Eyes specifically recommends formal methods for securing agentic AI systems. The reasoning: agents operate in high-dimensional state spaces where empirical testing is provably insufficient. MAREF's TLA+ verification directly satisfies this recommendation.

Limitations

To be clear: TLA+ verification is not a silver bullet. It verifies the specification — not the implementation. Bugs in the code that implements the TLA+ spec can still exist. That's why MAREF also uses 11,000+ unit and integration tests, runtime monitoring, and adversarial evolution.

But the spec is the foundation. If the foundation is model-checked, the scope for implementation bugs is dramatically reduced — and any that slip through are caught by the lower layers of defense.

📐 Sources: Lamport, L. (2002). Specifying Systems: The TLA+ Language and Tools. Addison-Wesley. Amazon Web Services — "Use of Formal Methods at Amazon" (2014). CISA/Five Eyes — "Securing Agentic AI Systems" joint guidance (May 2026). MAREF — src/formal/MAREF_ConstitutionalRedLines.tla (TLA+ specs of governance invariants). Deploy MAREF in 5 minutes.