Agents

Reactive, deliberative and the LLM

An agent that acts at once, stops when it is in danger, thinks before it continues — and uses a language model for ideas and knowledge without ever letting it decide.

There are three classic ways for a system to decide what to do, and each fails alone.

Way How it decides Strength Fails when
Reactive a stimulus triggers a response immediate; no model of the world needed the situation needs foresight, or two reflexes conflict
Deliberative (BDI) beliefs and desires license intentions, held by a commitment explainable; knows when to stop it must react faster than it can think
Language model predicts a plausible continuation, alone or step by step open-ended content and broad knowledge nothing checks it — a fluent answer can be wrong

Robotics learned the first lesson in the 1980s: Rodney Brooks’s subsumption architecture (1986) showed that layered reflexes, with no world model at all, produce robust behaviour — and the hybrid architectures that followed (TouringMachines, InteRRaP) put a deliberative layer above a reactive one so the system could both react and plan. Hilbert gives each layer a precise meaning and adds the third: a language model that proposes, while proofs and experts dispose.

Three layers of an agent Senses feed beliefs. Reactive plans run and can be interrupted. When a belief releases an intention the agent stops and deliberates. Deliberation may ask a language model to propose, and experts judge the proposal before anything is believed or adopted. Senses the world, people Deliberate · .ha theory licenses · commitment settles values order (Deliberation.hb) Beliefs B(self) φ — with provenance React · .hk plans run · interrupt △ · stop · abort proved: no deadlock, live Language model proposes content or knowledge simple or chain of thought Experts · .hs judge · gaps · corrections

Layer 1 — react without thinking

Plans are running processes. They receive, send and update beliefs without asking the deliberative layer anything, which is what makes them fast. The operator that expresses a reflex is the interrupt, \(P \mathbin{\triangle} Q\): \(P\) runs until \(Q\) performs its first event, and then \(Q\) takes over and \(P\) is abandoned.

plan Produce(parts: chan Int, made: Int) : Operator
{
  body ≔ n ← parts ; forget made(made) ; believe made(made + n) ; Produce(parts, made + n)
  on abort ≔ believe halted(1)
}

plan Guarded(parts: chan Int, alarm: chan Int) : Operator ≔ Produce(parts, 0) △ (level ← alarm ; believe danger(level))

Run on the plan runtime, sending two parts and then an alarm of level 7:

beliefs:  -made(0)  +made(2)  +danger(7)      plan status: Done

Production stopped the moment the alarm arrived, and the agent now believes danger(7). A reflex changes beliefs; it does not decide what the agent does next. That is layer 2’s job.

Layer 2 — stop, and think

A belief can make the agent’s current intention untenable. In the agent language this is an impossible rule, and the commitment strategy does the rest:

commit single_minded
impossible Produced when B(self) alarm("raised") because "the line is in danger, so production stops"
when B(self) alarm("raised") attend Emergency
intend Stop for Safe when B(self) alarm("raised")

Let \(a\) be the belief alarm("raised"). The impossible rule gives \(B_{\mathrm{self}}\, a \Rightarrow B_{\mathrm{self}} \neg\Diamond\,\mathrm{Produced}\), and the single-minded law holds an intention only while \(\neg B_{\mathrm{self}} \neg\Diamond\,\mathrm{Produced}\). So

\[B_{\mathrm{self}}\, a \;\Rightarrow\; \neg X\, I_{\mathrm{self}}\,\mathrm{Produced}:\]

at the next step the intention is gone. The runtime turns that into commands: the plan serving it is aborted (its on abort records where it stopped), attention shifts to Emergency, and the agent deliberates — its theory now licenses Stop, which it adopts. Run with the supervisor, single-minded, after two parts were made:

beliefs:   -made(0)  +made(1)  -made(1)  +made(2)  +danger(9)  +halted(1)  +safe(1)
released:  Produced (Unreachable)
journal:   start Work for Produced -> Running (adopted)
journal:   abort Work for Produced -> Running (Unreachable)
journal:   start Stop for Safe -> Running (adopted)

This is the difference between a system that continues because it was told to and one that stops because it no longer believes the goal can safely be reached. The plans are proved not to deadlock and to reach their goals; the commitment law guarantees the agent lets go when its beliefs say it must; and every command is journaled with its reason. See BDI agents for the theory.

The same machinery supports a gentler interruption: a higher intention suspends a running plan (stop, keeping its continuation), and when that subgoal is done the plan is resumed where it stopped.

Layer 3 — the language model

A language model is extraordinarily good at producing content — a requirement, a use case, a hypothesis — and at recalling broad knowledge. It is not a judge of its own output. In Hilbert the model is an instrument of the agent’s plans: a plan calls it, and what comes back is a proposal that the agent’s experts evaluate. The model never accepts, rejects or decides.

Simple: one question, one judgement

The plan asks once; the experts judge the answer once; the agent believes the verdict.

\[\text{prompt} \xrightarrow{\;\text{model}\;} \text{answer} \xrightarrow{\;\text{experts}\;} v \in \{\text{sound}, \text{gaps}\}\]

If the verdict is sound the content is adopted; otherwise it is refused, with the experts’ reasons. Use this when a wrong answer is cheap to discard.

Chain of thought, verified by agents

For work that must meet a standard, the agent reasons in steps and each step is checked. MLambda.Turing.Business is built this way: a person gives only a project’s name and description, and a Requirement agent discovers its backlog — Context → Module → Epic → Feature → Use case → Story — the way TOGAF and SEI say requirements should be discovered.

Propose ─▶ evaluate ─▶ verdict ──sound──▶ Accept ─▶ Decompose ─▶ evaluate children ─▶ ImproveChildren ─┐
             ▲            │                                                    ▲                          │
             │          gaps                                                   └─── up to 3 attempts ─────┘
             │            ▼
             └── Improve ◀── corrections (missing · gap · discarded · malformed, each with its reason)
                 (3 attempts in all; then Reject, citing the book for every open gap)

Each link in that chain is something the agent believes and a rule that licenses the next step. Let \(r \in \{0, 1, 2, 3\}\) be the number of attempts so far and \(v\) the experts’ verdict. The agent’s intentions, from Requirement.ha:

commit single_minded

intend Propose for Settled when B(self) verdict("none") ∧ B(self) flag("pending") ∧ B(self) rounds(r) ∧ r < 1
intend Improve for Settled when B(self) verdict("gaps") ∧ B(self) flag("correcting") ∧ B(self) flag("pending") ∧ B(self) rounds(r) ∧ r < 3
intend Accept  for Settled when B(self) verdict("sound") ∧ B(self) flag("pending")
intend Reject  for Settled when B(self) verdict("gaps") ∧ B(self) flag("pending") ∧ B(self) rounds(r) ∧ r ≥ 3

when B(self) verdict("gaps") ∧ B(self) rounds(r) ∧ r < 3 attend Improving
achieved Settled when B(self) outcome(h)

and a plan is the protocol for one step — ask the model, record the exchange, adopt what survives judgement — which the host carries out:

plan ProposeSteps(act: chan Word, done: chan Word) : Requirement ≔ "ask" → act ; r ← done ; match r { when "unavailable" ↦ SKIP  other ↦ "record" → act ; s ← done ; "adopt" → act ; t ← done }

The verifying agents are Shin theories. Togaf.hs and Sei.hs state what each kind of item owes (a module serves a capability, a feature names a quality scenario…), and Response.hs states how a model’s answer is read. Its rules are the checks a careful reviewer applies to each step — for example, when the agent asked the model to improve only certain slots, anything else it changed is discarded:

law r8_rule = ∀ i a s n f v, response(i, a, "wellformed") ∧ improving(i, a) ∧ proposed(i, a, s, n, f, v) ∧ ¬ asked(i, a, s) ⇒ discarded(i, a, s, n, f, v, "R8")

The experts derive gaps and corrections; the corrections — each with its reason in the book’s words — become the next prompt. That is chain of thought with a referee at every link: the model thinks aloud, the theories say which thoughts hold, and the agent’s commitment says when to stop trying. After three attempts an item is rejected with its reasons, not accepted on the model’s say-so. Every request and response is kept as a file, so a run can be replayed exactly, and a model outage is a word the plan matches ("unavailable"), not a crash.

Asking the model for knowledge

Sometimes the agent’s theory simply does not know — no rule concludes, and a query comes back unknown. Then a plan may ask the model for the missing knowledge. What comes back is admitted under strict terms:

The model may On these terms If it oversteps
sense — assert a belief the belief carries its provenance (from the model) and a trust weight; a machine belief is never an axiom nothing to overstep: the belief is weighted, and experts and other evidence can contradict it
propose — offer an intention or option it is only a candidate \(I_i p\), admissible if the agent desires \(p\) and believes \(p\) possible the proposal is recorded with the law it failed, and is never run
act — be the body of a plan a plan is a workflow; some workflows call a model as for any plan

So knowledge from the model can inform deliberation — raise a belief, suggest an option — but it passes through the same licence as everything else. A model that is confidently wrong can make the agent consider a bad option; it cannot make the agent adopt an unlicensed one, and it cannot turn a guess into a law. Thinker, MLambda’s reasoning layer, applies the same rule to research: knowledge gathered from models and documents keeps its source, and machine-induced knowledge never becomes an axiom.

Putting it together

One cycle of an agent that uses all three layers:

  1. Sense. Observations and people’s input become beliefs, with provenance.
  2. React. Running plans respond immediately; interrupts take over when their trigger arrives; plans believe and forget as they go.
  3. Reconsider? Bold, cautious, or on evidence of change. If not, keep going.
  4. Deliberate. The theory derives what is achieved, what is impossible, and what is licensed; the commitment law aborts or suspends what can no longer be held.
  5. Choose. Values order the licensed options; an unlicensed option has probability 0.
  6. Act. Adopted intentions start plans. A plan may ask the model — once, or step by step — and the experts judge every answer before it is believed or adopted.
  7. Learn. Rewards credit the plans that worked; the journal records every command and why.

The result is a system that is fast where it can be, careful where it must be, open-ended where a model helps — and that stops and thinks when its own beliefs tell it to.

Status. The agent language (.ha), proved plans (.hk), the commitment strategies and the plan supervisor are part of Hilbert, and every trace on this page was produced by running them. MLambda.Turing.Business — the requirements agent, its TOGAF and SEI experts, its step plans and model interface — is in active development. The reconsideration policy is chosen by the host; a .ha keyword for it is not yet available. Plans that the host drives over channels, as Business’s step plans are, run without the build-time proofs; plans an agent starts directly are proved.