Airlock stops multi-agent faults at the data path, not the whole workflow, keeping 68 to 96 points more healthy work

Airlock changes multi-agent fault handling from stopping one agent or the whole workflow to isolating along the data path: after an alert, tainted executions and not-yet-issued external actions are frozen or revoked individually while unaffected concurrent work keeps running. Earlier multi-agent controls either cancelled only the faulty source, missing downstream consumers that had already read its output, or interrupted the entire workflow or rolled back to a checkpoint, discarding healthy work as well. Across 1,832 testbed runs, 161 physical smart-home runs and 24,266 simulation records, Airlock blocked all post-alert faulty actuations on its main testbed and smart-home grids with zero post-convergence leaks; native A2A and LangGraph controls contained at most 33.3% of faults or retained at most 16% of work without redo.

The mechanism has two layers: a lower runtime narrows each subtask's permissions monotonically from parent to child agent, and an upper controller keeps an append-only provenance graph recording which output was read by which agent. Permission boundaries govern who may do what, while the provenance graph tracks where bad data has already flowed; recording them separately is what allows both restricting actions and tracing contamination. Each site daemon writes dispatches, reads, writes and effect commits into a per-site ordered journal that streams to a central coordinator; on an alert the controller traces forward to find tainted executions and pending actions, and backward when needed to narrow candidate root causes.

The default full-quarantine tier needs no solver and simply pauses tainted branches; the optimized-cut tier casts boundary selection as a deadline-aware minimum cut and enforces it with fence-then-prune while the system keeps running. Full quarantine suffices when faults do not spread, but under dense spread it halts healthy work along with the tainted branches. Across 10 paired runs at rogue rate 1.0, the optimized cut retained 100.0% of at-risk work in every run while full quarantine retained 54.0%, a paired gain of 46 percentage points.

The demonstrated setting is a three-site, two-host testbed plus physical smart-home devices actuated through Home Assistant; Airlock intercepts only external actions mediated by the site daemons and gateway, and does not roll back an agent's internal memory.

The single-process SQLite coordinator saturates journal ingestion at 63 logical sites, with ingest lag of 52.4 to 90.8 seconds; un-ingested alerts are then marked indeterminate, and effects committed before their journals arrive cannot be intercepted. Once shared memory has absorbed a corrupted schedule, restoring uncontaminated text replies requires pairing Airlock with separate memory or checkpoint rollback.