Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows

Bardia Mohammadi; Nearchos Potamitis; Lars Klein; Akhil Arora; Laurent Bindschaedler

cs.LGFeb 16, 2026

Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows

Authors: Bardia Mohammadi, Nearchos Potamitis, Lars Klein, Akhil Arora, Laurent Bindschaedler

Organizations: Max Planck Institute for Software Systems · Aarhus University · EPFL

Abstract

LLM agents execute multi-step workflows that mutate external state through tools. Common orchestrators treat tool return as the settlement trigger, so faults, speculation, and concurrent agents can leave partial effects, losing-branch residue, stale writes, or irreversible sends. Correct settlement needs two facts that retries, checkpoint replay, locks, and compensation each conflate: which effects must settle together, and when earlier conflicting work is exhausted. Atomix makes this split explicit with progress-aware transactions. The runtime records reads and effects during execution, seals a transaction when its footprint is complete, and commits only after per-resource frontiers show that no earlier conflicting work can still arrive. Commit is final settlement: Atomix releases bufferable effects, accepts reversible external effects as final, and lets irreversible effects leave the gate. Abort suppresses unreleased effects and compensates externalized reversible effects where possible. On representative agent workloads, this composition improves clean recovery under injected faults, isolates contending and speculative work, and prevents correctly classified irreversible actions from leaking; microbenchmarks show microsecond-scale wrapper overhead relative to tool latency.

Figures & tables

Figure 1: Atomix lifecycle across agent, runtime, and tool layers. The agent receives synchronous tool returns plus one settlement outcome; the runtime records scopes and effects, seals the transaction footprint, gates settlement on per-resource frontiers, and interposes through tool shims.

Panel of Figure 2 — Figure 2: Clean task success on $\tau$ -bench retail (GPT-4.1, max_steps=30) across fault rates. Bars show 95% Clopper-Pearson CIs; faulted cells use $N{=}30$ and the $fp{=}0$ calibration uses $N{=}10$ .

	Synthetic plan-delay (4 ag, $N{=}100$ )			Real LLM (GPT-4o-mini)		Disjoint wait (ms)
Mode	Inv./run	Wait (ms)	Blocked	Inv./run, 4ag	Inv./run, 8ag	4 ag	8 ag
Tx-Full	0.00 †	1 0.0	0%	0.0 †	0.0	0.0	0.0
Workflow-Lock	0.00 †	112.3	75%	0.0 †	0.0	44.9	104.7
Per-Call-Lock	4.91	1 0.0	0%	3.0	7.0	0.0	0.0
OCC-Revalidate-and-Retry	0.00 ‡	1 0.0	0%	0.0 ‡	0.0 ‡	0.0	0.0
No-Tx	4.97	1 0.0	0%	3.0	7.0	0.0	0.0

Table 1: Multi-agent

\tau

-bench contention results. Inv./run is the workload invariant diagnostic; an independent operation log checks conflict-serializability. Wait columns report average blocking time.

Mode	Leaks	Attempts	Leak rate	95% CI
Tx-Full	0	500	0%	[0, 0.74]
Saga-Compensation	400	500	80%	[76, 83]
Checkpoint-Replay	200	500	40%	[36, 44]
TCC-Confirm	0	500	0%	[0, 0.74]
Mutex+WAL+Rollback ∗	0	500	0%	[0, 0.74]
No-Tx	500	500	100%	[99.3, 100]

Table 2: Irreversible-effect leakage against a real append-only sink. Each row sums 5 abort sources with

N{=}100

trials each, for 500 invalid-send trials per baseline. The final column gives the Clopper-Pearson interval for leak rate.

Mode	$fp{=}0.10$	$fp{=}0.30$	$fp{=}0.10$	$fp{=}0.10$	(ms)
	Mixed faults		F2-only	F4-only	Wait
Tx-Full	84	65	100	85	1 0.1
OCC	82	62	100	75	1 0.0
Mutex-Workflow	81	62	100	77	95.9
TCC-Confirm	79	63	100	81	1 0.1
Mutex+WAL+Rollback	70	24	80	78	1 0.4

Table 3: Run-clean rate on combined-stress (

N{=}300

mixed,

N{=}100

F2/F4-only, 4 agents, 2 contended orders). Run-clean requires zero invariant violations, stale commits, confirmation leaks, and duplicates. Wait is from mixed

fp{=}0.10

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Workload / adapter	Representative scope(s)	Idempotency key pattern	Compensation / gating
Filesystem writes	absolute path, /repo/src/app.py	path:trace: epoch:branch	restore previous contents; delete files created by aborted writes
WebArena actions	page scope, webarena:site:page optional element suffix	webarena:action: trace:epoch:branch	no generic per-action compensation; settlement controlled by transaction scopes
OSWorld GUI actions	UI app scope, osworld:ui:app: text_input or mouse:region	action:args: trace:epoch:branch	action-specific compensation when available; read-only actions carry no scope
$\tau$ -bench tools	real runner: tau2:tool harness: retail:order:id	real runner: trace:epoch:tool harness: order-scoped key	structured tool calls are replayable; multi-agent harness checks order invariants

Appendix

Table 4: Adapter specification examples. Scope granularity and compensation are adapter-defined.

	WebArena		OSWorld
Mode	$fp{=}0.10$	$fp{=}0.30$	$fp{=}0.10$	$fp{=}0.30$
Tx-Full	73.0 $\pm$ 5.5	57.2 $\pm$ 6.7	63.0 $\pm$ 7.5	37.0 $\pm$ 8.8
Checkpoint-Replay	68.0 $\pm$ 4.8	53.2 $\pm$ 4.3	62.0 $\pm$ 6.2	37.1 $\pm$ 5.1
TCC-Confirm	25.0 $\pm$ 4.2	18.0 $\pm$ 3.5	10.0 $\pm$ 3.0	6.0 $\pm$ 2.8
Saga-Compensation	18.0 $\pm$ 3.2	10.0 $\pm$ 2.8	7.0 $\pm$ 2.8	4.0 $\pm$ 2.2
Mutex+WAL+Rollback	65.0 $\pm$ 5.1	48.0 $\pm$ 5.5	55.0 $\pm$ 6.8	32.0 $\pm$ 6.5

Appendix

Table 5: Clean task success on WebArena and OSWorld at

fp\in\{0.10,0.30\}

. Values are percentages with 95% Clopper-Pearson CI half-widths. WebArena uses GPT-5 ( reasoning_effort=medium , max_steps=30); OSWorld uses Claude Sonnet 4.

Mode	$\tau$ -bench ( $fp{=}0$ , $N{=}10$ )	$\tau$ -bench ( $fp{=}0.10$ , $N{=}30$ )	$\tau$ -bench ( $fp{=}0.30$ , $N{=}30$ )
Tx-Full	60 [26, 88]	73 [54, 87]	57 [37, 75]
Checkpoint-Replay	60 [26, 88]	63 [44, 80]	53 [34, 72]
TCC-Confirm	60 [26, 88]	40 [23, 59]	3 [0, 17]
Saga-Compensation	60 [26, 88]	37 [20, 56]	7 [1, 22]
Mutex+WAL+Rollback	60 [26, 88]	33 [17, 53]	3 [0, 17]
No-Frontier	60 [26, 88]	30 [15, 49]	3 [0, 17]

Appendix

Table 6: Clean task success on

\tau

-bench retail (GPT-4.1, max_steps=30). Values are percentages with 95% Clopper-Pearson intervals.

Mode	Bursty (entry $=$ 0.04, len $=$ 3)	Bernoulli ( $fp{=}0.10$ )
Tx-Full	20/30 = 67%	22/30 = 73%
Checkpoint-Replay	17/30 = 57%	19/30 = 63%
TCC-Confirm	18/30 = 60%	12/30 = 40%
No-Tx	18/30 = 60%	8/30 = 27%
Mutex+WAL+Rollback	15/30 = 50%	10/30 = 33%
No-Frontier	14/30 = 47%	9/30 = 30%

Appendix

Table 7: Bursty-fault sensitivity on

\tau

-bench retail at marginal

fp{\approx}0.12

N{=}30

. The Bernoulli column repeats

fp{=}0.10

from Table 6 for direct comparison.

Mode	F2-only ( $fp{=}0.10$ )	F4-only ( $fp{=}0.10$ )	$\Delta$ (F2 $-$ F4)
Tx-Full	63 [44, 80]	67 [47, 83]	$-3$ pp
Checkpoint-Replay	57 [37, 75]	57 [37, 75]	$0$ pp
Saga-Compensation	43 [25, 63]	70 [51, 85]	$-27$ pp
OCC-Revalidate-and-Retry	40 [23, 59]	53 [34, 72]	$-13$ pp
Mutex+WAL+Rollback	33 [17, 53]	57 [37, 75]	$-23$ pp
No-Frontier	37 [20, 56]	67 [47, 83]	$-30$ pp

Appendix

Table 8: Fault-class isolation on

\tau

-bench retail at

fp{=}0.10

N{=}30

per cell, with 95% Clopper-Pearson CIs. F2-only forces post-effect/pre-return faults; F4-only injects silent duplicate delivery with no exceptions.

	$fp{=}0.02$					$fp{=}0.10$					$fp{=}0.30$
Mode	F1	F2	F3	F4	F5	F1	F2	F3	F4	F5	F1	F2	F3	F4	F5
Tx-Full	100	100	100	100	100	100	100	100	100	100	96	98	96	100	96
Tx-NoFrontier+Retry	100	100	100	88	100	100	100	100	64	100	94	98	96	16	96
Saga-Compensation	100	100	100	92	100	100	100	100	60	100	96	98	94	17	96
Checkpoint-Replay	100	100	100	88	100	100	100	100	56	100	98	97	98	16	96
OCC-Revalidate-and-Retry	100	100	100	90	100	100	100	100	66	100	96	97	98	18	94

Appendix

Table 9: Clean-success sweep by fault class on the synthetic substrate. Cells use

fp\in\{0.02,0.10,0.30\}

; F3 is compensation failure and F4 is duplicate delivery.

Mode	$n{=}2$	$n{=}4$	$n{=}8$	$n{=}16$	$n{=}32$	$n{=}64$
Tx-Full	0.0	0.0	0.0	0.0	0.0	0.0
Tx-GlobalFrontier (single global lock)	14.8	44.9	104.7	563.9	1,163.2	2,368.6

Appendix

Table 10: Average wait (ms) per task on the disjoint multi-agent benchmark. Cells use

N{=}100

for

n\in\{2,4,8\}

and

N{=}30

for

n\in\{16,32,64\}

. Tx-GlobalFrontier replaces per-resource coordination with one global lock.

Composition ablation	Inv./run	Wait (ms)	Extra writes (per run)	What it removes
Tx-Full (control)	0.00	1 0.0	0.0	none
Tx-NoScopeOnRead	4.83	1 0.0	6.5	scope registration on first read
Tx-NoAbortOnStale	4.87	1 0.0	6.5	abort-on-stale retry
Tx-GlobalFrontier	0.00	113.0	0.0	per-resource granularity (single global lock)

Appendix

Table 11: Composition ablations on multi-agent

\tau

-bench, 4 agents forced-overlap,

N{=}100

. Inv./run : invariant violations; Wait : average lock wait; Extra writes : writes beyond 10 per run.

Mode	Buffer	Filesystem	DB rows	Mailbox
Tx-Full	0	0	0	0
Tx-GlobalFrontier	0	0	0	0
Mutex+WAL+Rollback	0	0	0	0
TCC-Confirm	0	0	0	1000
Saga-Compensation	0	0	0	1000
OCC-Revalidate-and-Retry	0	0	0	1000

Appendix

Table 12: Speculation contamination across four effect classes, averaged over

K\in\{2,4,8,16\}

(

N{=}200

trials per K). Cells report persistent loser-branch effects per 1,000 attempted transactions; the mailbox column is the irreversible class.

Mode	$o{=}0$ disjoint	$o{=}0.25$	$o{=}0.5$	$o{=}0.75$	$o{=}1$ overlap
Tx-Full	5.09	4.43	3.22	2.28	1.66
Tx-GlobalFrontier	1.00	1.00	1.00	1.00	1.00
Workflow-Lock	1.00	1.00	1.00	1.00	1.00
No-Tx	1000	873	751	627	503

Appendix

Table 13: Resource-granularity throughput sweep, in transactions per step.

o

is the fraction of overlapping scopes; No-Tx is an unsafe upper bound, not a correctness-preserving baseline.

Mechanism	tx_manager LOC	Per-tool wiring	Leaks/500	Composes with
	(one-time)	(per integrated tool)		R/I/S
Tx-Full	500 (runtime)	17 (scope+effect builder)	0	R/I/S
TCC-Confirm	115	$\sim$ 50 (try/confirm/cancel triple)	0	I only
Mutex+WAL+Rollback	168	$\sim$ 30 (explicit gating predicate)	0	I + S
OCC-Revalidate-and-Retry	135	$\sim$ 15 (read-version site)	500 ∗	S only
Saga-Compensation	0 92	$\sim$ 30 (compensation handler)	400	R only (irreversibles leak)

Appendix

Table 14: RQ3 integration cost versus leak prevention. tx_manager LOC is one-time harness integration; Per-tool wiring is per integrated tool. Composes with marks recovery (R), irreversible gating (I), and stale-plan isolation (S).

Mode	Tool fail	Losing spec.	Stale read	Pre-commit veto	Timeout
Tx-Full	0	0	0	0	0
Saga-Compensation	1000	1000	1000	0	1000
Checkpoint-Replay	1000	0	0	0	1000
TCC-Confirm	0	0	0	0	0
Mutex+WAL+Rollback ∗	0	0	0	0	0
No-Tx	1000	1000	1000	1000	1000

Appendix

Table 15: Irreversible-effect leaks by abort source. Cells report classified-before-externalization leaks per 1,000 attempts.

Mode	$cf_{p}$	Trials	GT clean	Classified clean	Mismatch
Tx-Full	0.0	600	600	600	0
Tx-Full	0.1	600	589	589	0
Tx-Full	0.3	600	557	557	0
Saga-Compensation	0.3	600	559	559	0
Retry-only	0.3	600	534	534	0
Tx-Full-NoResidueClassification	0.3	600	564	600	36

Appendix

Table 16: Compensation-failure classification. GT clean is oracle residue status; Mismatch counts classification errors.

Branches ( $K$ )	Setup ( $\mu$ s)	Commit ( $\mu$ s)	Total / p99 ( $\mu$ s)
2	13	85	98 / 295
4	23	142	165 / 273
8	44	321	365 / 1339
16	86	939	1025 / 23198

Appendix

Table 17: Speculation commit latency (

n=200

runs per

K

). At

K=16

, total frontier-gating overhead is about 1 ms.

Frontier-advancement mode	Out-of-order commits	Invariant violations	Tx-Full waits
Correct (advances after each commit finalizes)	0/200	0/200	0
Stalled (no advancement)	0/200	0/200	200/200 (100% block)
Premature (advance before earlier-epoch finalizes)	200/200	200/200	0

Appendix

Table 18: Frontier-contract negative control on one resource. Premature advancement causes out-of-order commits; stalled advancement blocks progress.

Kill point	Trials	Lost effects
(i) before pending-log write	50	50
(ii) after pending-log, before effect	50	50
(iii) after effect, before committed-mark	50	0
(iv) after committed-mark, before retry	50	0

Appendix

Table 19: Crash-window enumeration for the SQLite-backed adapter. Duplicate effects remain zero; lost effects occur only before the effect runs.

Scope strategy	Should-conflict cases	Missed conflicts	False conflicts
	(across all substrates)	(false neg.)	(false pos.)
Tx-Full canonical	28	0	0
Tx-NaiveStringScopes	28	12	0
Coarse-Global	28	0	28
Fine-NoOverlapAware	28	12	0

Appendix

Table 20: Aliasing and canonicalization stress across four substrates. Missed conflicts are false negatives; false conflicts are false positives.

Configuration	Inv./200	Leaked irrev./200	Failure mode
Tx-Full (control)	0	0	none
E10-OB Over-broad scope	0	0	failure-closed
E10-TN Too-narrow scope	66	0	failure-open
E10-WC Wrong effect class	0	17	failure-open
E10-NC Missing compensation	0	35	failure-open with alert

Appendix

Table 21: Annotation-error sensitivity. Cells report invariant violations and leaked irreversibles per 200 trials.

	Atomix’s axes							Orthogonal
System	Per-resource	Effect-class	Spec. isolation	Irrev. gating	Stale-plan iso.	Shim deploy.	Single-proc. dedup.	IFC	Sem. valid.
Atomix (this paper)	✓	✓	✓	✓	✓	✓	✓	✗	✗
SAFEFLOW Li et al. [2025a]	✗	✗	✗	✓ a	✓	✗	✓	✓	✗
SagaLLM Chang and Geng [2025]	✗	✗	✗	✗	✓	✗	✗	✗	✓
ALAS Geng and Chang [2025]	✗	✗	✗	✗	✓	✗	✗	✗	✓
Temporal Saga Temporal Technologies Inc. [2026] , Garcia-Molina and Salem [1987]	✗	✗	✗	✗ b	✗	✓	✓	✗	✗

Appendix

Table 22: Capability comparison across load-bearing axes. Superscripts mark partial support or the limitation discussed in text.

Mechanism	Sealed footprint	Per-resource progress	Scope-on-read + abort-on-stale	Effect-class settlement
Sagas Garcia-Molina and Salem [1987]	✗	✗	✗	✗
TCC Pardon and Pautasso [2014]	partial a	✗	✗	partial b
OCC Weikum [1991]	✗	✗	✓	✗
Two-phase locking Mohan et al. [1992]	✗	✗	✗	✗
Watermarks (Naiad/Flink) Murray et al. [2013] , Apache Flink [2026]	✗	✓ c	✗	✗
Workflow-Lock	✗	✗	✗	✗

Appendix

Table 23: Four-ingredient composition matrix. Atomix exposes all four ingredients to unmodified tool adapters as a single runtime contract.

Tool Use

Tool use studies how AI agents select, invoke, and combine external tools to solve tasks beyond their internal knowledge.

See all 91 papers

TomasuLLM: Out-of-Order Speculative Execution for LLM Agents
Sep 22, 2026Jiangnan Yu, Ceyu Xu, Mengming Li +6LLM Agent Workflow Optimization Software Engineering Agents
HKUST Hong Kong, Hong Kong · Nanjing University Nanjing, China · King Abdullah University of Science and Technology Thuwal, Saudi Arabia +1
When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary
Sep 14, 2026Artem Trofimov, Boris NovikovAgent Failure Analysis Agentic Workflows
AVIV Group · Independent Researcher
MemTX: Transactional Belief Commit for Stateful Agent Memory
Jul 27, 2026Xiaoyang Li, Yiqi Wang, Haohui Lu +5Belief Revision LLM Agent Safety
University of Southern Queensland · 2Griffith University · 3The University of Sydney +2

Sep 22, 2026J/K move · Enter open · S save

TomasuLLM: Out-of-Order Speculative Execution for LLM Agents

Jiangnan Yu, Ceyu Xu, Mengming Li, Shiyu Huang+5

HKUST Hong Kong, Hong Kong · Nanjing University Nanjing, China · King Abdullah University of Science and Technology Thuwal, Saudi Arabia+1

LLM Agent Workflow Optimization Software Engineering Agents Runtime Enforcement for AI Agents LLM Agent Harnesses

Open paper AskPDF arXiv

Long-running tools can dominate coding-agent latency: compilers, test suites, and repository commands take seconds to minutes while the agent idles. This observation stall presents the same tension that drove out-of-order processors -- asequential interface hides work that can be predicted and started early, but a speculative result may become visible only after it and every earlier step have been validated. We present TomasuLLM, a runtime that executes agent tool calls out of trajectory order while preserving task-execution correctness. It drafts future actions, runs them in isolated copy-on-write sandboxes, traces their dependencies and effects, and commits results in trajectory order only after validation against committed state. Across three benchmarks spanning sub-second to minutes-long tool calls, TomasuLLM improves the reported benchmark means and scales with tool latency: 1.31x on 100 SWE-bench Verified tasks, 1.35x on 28 Terminal-Bench 2.0 tasks, and 1.27x matched progress on 18 SWE-Marathon sessions. Across 4,010 audited commit-validation records, it produces zero false accepts.

Abstract

Tool Use

Explore similar work

TomasuLLM: Out-of-Order Speculative Execution for LLM Agents

When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent-Tool Boundary

MemTX: Transactional Belief Commit for Stateful Agent Memory