Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Metis, a multi-provider runtime that transforms provider streams into typed events, enhancing the safety and efficiency of tool-using software agents. By implementing a four-class mediation system, Metis significantly reduces the median elapsed time for operations from 25.958 ms to 14.146 ms, demonstrating improved performance across all tested pairs. The evaluation also reveals critical insights into permission decisions and interference management, although it does not establish broader claims about model competence or semantic safety.
Metis achieves a remarkable 45% reduction in operation time for tool-using agents while ensuring explicit permission and interference management.
Software agents connect probabilistic model output to operations that change repositories, processes, networks, and graphical applications. We present Metis, a multi-provider runtime that converts provider streams into typed events before admitted calls reach external effects. Its execution path makes permission decisions, interference classes, terminal results, and lifecycle transitions explicit and inspectable. We evaluate these mechanisms on frozen source artifacts. Across 30 matched real-I/O pairs, four-class mediation reduced median elapsed time from 25.958 ms under forced serialization to 14.146 ms. The mean paired difference was -12.295 ms (95% bootstrap interval [-12.968, -11.694]), with mediation faster in all pairs. A ten-case fault matrix exposed duplicate-identifier and rollback limits. In a child-boundary ablation, the full gate-plus-registry condition blocked the declared unauthorized effect and hid all five escape tools. Removing both protections reversed both observations. A decision-only permission oracle matched all ten declared cases across five invocation routes. Five model conditions also completed a fixed Read-marker protocol in 3/3 trials each. These results support bounded claims about dispatch, permission routing, child authority, and provider-valid trace closure. They do not establish model competence, semantic safety, rollback, or superiority over another runtime.