Kinetic Control of Unmodified Agents
Abstract
This is a framework for orchestrating unmodified Large Language Models. Three layers compose. The operator vocabulary (Antecedent–Behavior–Consequence) provides human readability. The telemetry layer borrows kinetic-theory form as a fitted mnemonic, not as a physics claim. The control engine provides per-step bounded guarantees via online supervisor synthesis under partial observation. The customer agent is treated as an autonomous policy whose environment, not its weights and not its prompt, is the controllable surface. Events on the alphabet are typed, signals are fitted with disclaimed analogies, and the supervisor admits per-step decisions rather than computing offline guarantees the substrate cannot support.
1. ABC as operator vocabulary
The Customer Agent (CA) is treated as an autonomous policy. The Shadow Agent (SA) controls the CA’s environment, never its weights and never its prompt directly. Operators reason about this surface using Antecedent–Behavior–Consequence; engineers implement it as typed events on a defined alphabet (§4).
Antecedent. SA strews task-relevant facts into the CA’s retrievable context before the CA queries them, so the CA discovers them as ambient memory and its reasoning autonomy is preserved.
Extinction over correction. When the CA goes off-track, SA returns clean negative signals, such as empty result sets, 404s, or terminating tool calls, rather than corrective prompts. Clean failure modes degrade reasoning less than in-band correction loops, which trigger RLHF-trained refusal and sycophancy patterns.
Reinforcement. When the CA aligns with the target, SA returns dense, well-structured data, lowering the marginal cost of staying on-policy.
ABC is the operator’s vocabulary; the mechanisms below are what the engine actually does.
2. Semantic kinetics as telemetry mnemonic
We borrow the kinetic-theory form λ = 1 / (n · σ) as a mnemonic for a fitted runtime signal, not as a physics claim. λ is the expected uninterrupted reasoning span (in tokens) before the CA’s next observable constraint violation. The 1/(n·σ) shape is the first-order functional we fit constants to, and we do not assert physical units.
n (exhaust density). Fraction of the last K tokens classified as non-task-aligned. Computed by Datalog non-derivability of asserted SPOCL pentads against the active task node, or by a small classifier trained on labeled traces. Range [0, 1].
σ (semantic cross-section). Effective entropy of the CA’s next-token distribution under the active query, normalized against a task-conditioned reference language model. High when intent is diffuse, low when narrowly bound.
λ. Calibrated empirically from traces. Predictive value comes from trace-replay AUC against labeled stalls, not from analogy to gas physics.
Derivatives are heuristic precursor signals, validated empirically per task-node-type:
dλ/dt. First-derivative drop indicates an impending stall or context collision.
d²λ/dt². Early-warning precursor for context collapse, used to time antecedent injection.
This layer produces a scalar plus its derivatives. It is a sensor, not a controller.
3. Bounded-context environment control
SA exerts control through three actuators, all operating on the CA’s environment.
Tool interception. SA proxies all CA tool calls and may degrade, enrich, delay, or null-return any response. This is the primary controllable channel.
Memory injection. SA writes structured facts (SPOCL pentads with Merkle-chained provenance) into the CA’s retrievable context just ahead of the CA’s projected query, exploiting the antecedent surface from §1.
Context pruning. SA bounds visible context to task-relevant facts to lower σ and raise λ.
The §2/§3 tension is apparent rather than real: bounded relevant context is desirable because σ falls, while accumulated historical exhaust is undesirable because n rises. These are distinct terms in the same equation, optimized in opposite directions.
4. Online supervisor synthesis under partial observation
We adapt Ramadge–Wonham supervisory control to the LLM setting. We do not claim to compute the supremal controllable sublanguage offline, since for an LLM’s behavior space this is intractable and the language is not regular. The adaptation has four components.
Event alphabet Σ. Typed observable agentic events: tool_call_issued, tool_result_returned, spocl_assertion_emitted, task_node_transition, completion_boundary. Σ_c (controllable) consists of events SA mediates, namely tool returns and memory state. Σ_uc (uncontrollable) consists of events the CA generates directly.
Specification. The task tree expressed as a Datalog program over SPOCL pentads. Legal traces maintain derivability of the goal predicate.
Supervisor. At each Σ_c decision point, SA admits the action minimizing expected cost-to-goal subject to a controllability invariant: no admitted action may drive the trace into a state from which the goal predicate becomes underivable. This places the engine in the family of constrained-MDP and probabilistic supervisory control, with documented approximation guarantees.
Cost function. Tree-Wasserstein distance between the empirical distribution over k sampled CA continuations and the task-conditioned target distribution, with the ground metric defined as path distance on the task tree.
The choice of tree-Wasserstein is over-determined. Cosine ignores hierarchy; Euclidean ignores semantics; general Wasserstein is intractable at runtime. Tree-Wasserstein respects the task tree’s nested structure, computes in linear time on the tree, and is a true metric, so the triangle inequality holds and cost composes cleanly across sub-tasks.
5. Trace-driven phase discovery
An offline auto-research loop runs over recorded CA traces, computing (λ, dλ/dt, tree-W cost) per step and clustering in the resulting 3-space. Persistent clusters become named phases: steady reasoning, stall, RLHF-collapse, escape. Per task-node-type, we fit phase-transition thresholds, so search nodes tolerate λ ≥ τ_search while summarize nodes tolerate λ ≤ τ_summ.
Phase labels feed back into the supervisor as cost-function priors.
Ground-truth labels for phase boundaries should come from synthetic-fault injection, namely deliberate poisoning of tool returns to induce known stall classes, rather than from unsupervised clustering alone.
6. The disclaimers are the substance
The framework’s load-bearing commitments are the disclaimers, not the formalism. Three matter most.
The kinetic-theory analogy is form, not content. λ is a fitted scalar with predictive value validated by trace-replay AUC, and the n · σ shape is a first-order functional rather than a physical claim. We use the kinetic vocabulary because it is operationally useful for naming what the runtime is sensing (exhaust density, mean free path, semantic cross-section), not because we claim that semantic execution is governed by gas-kinetic dynamics. An analogy that names its own non-literal status is more rigorous than one that pretends to be a derivation.
The supervisor is online, not offline. Classical Ramadge–Wonham supervisory control computes the supremal controllable sublanguage in advance and certifies that all admitted traces are safe. For an LLM’s behavior space this is intractable and the language is not regular, so we replace offline supremal computation with per-step admission of controllable actions subject to a controllability invariant evaluated at the decision point. The substitution is honest: we do not get the offline guarantee that classical supervisory control provides, but we get a per-step probabilistic guarantee in the documented family of constrained-MDP and probabilistic supervisory control approaches. We have adapted supervisory control to a regime its original formulation does not cover, with calibrated approximation guarantees rather than completeness theorems.
Tree-Wasserstein is uniquely justified in this setting. The cost function in any optimal-transport-style controller has to respect the structure of the task representation. Cosine throws away hierarchy, Euclidean throws away semantics, and general Wasserstein is too expensive at runtime. Tree-Wasserstein respects the task tree’s nesting, computes in linear time, and is a true metric, which means we can reason about composition of costs across sub-tasks rather than treating the cost surface as opaque. The choice is over-determined by the substrate; we did not pick it for elegance.
7. What this framework is and is not
This is a control framework for orchestrating unmodified LLMs as autonomous policies, with the controllable surface being the agent’s environment rather than its weights or prompts. The composition is operator vocabulary (ABC), telemetry (semantic kinetics), supervisor (online synthesis under partial observation), and calibration (trace-driven phase discovery), assembled so that each layer has a defined interface to the layers above and below.
It is not fine-tuning, prompt engineering, or RLHF. Those are weight- and prompt-modifying interventions, and the framework treats those surfaces as outside the controllable channel by construction. The framework does not refuse those techniques, which remain available where appropriate, but the orchestration layer described here is independent of them and can be applied to agents that have already been fine-tuned, agents that have been prompt-engineered, or agents that have been left in their stock state. The point of unmodified-agent control is that the framework works without requiring the orchestrator to own the agent’s training pipeline.
8. What we will measure
Several empirical surfaces will harden the framework as it deploys.
Predictive AUC of λ. How well the fitted λ signal anticipates stalls and constraint violations across task-node-types. The kinetic-theory form is justified only if it provides predictive lift over simpler alternatives such as token entropy alone or exhaust density alone. We measure this as the framework deploys.
Phase-boundary calibration via synthetic-fault injection. Phase labels come from deliberate poisoning of tool returns. The fault-injection harness is part of the calibration commitment, but the catalog of induced stall classes and their phase signatures is empirical work to come.
Supervisor admission cost at scale. Per-step admission requires evaluating the controllability invariant at each Σ_c decision point. The cost depends on task-tree depth, the size of the active SPOCL working set, and the number of candidate actions. Bounds are tractable in principle; the constants matter and require measurement on representative workloads.
Composition of multiple SAs over a single CA. The framework as described assumes one SA per CA. Multi-SA orchestration is a natural extension and the supervisor synthesis admits it in principle, though the mechanics of conflict resolution between SAs at shared decision points are open.
Cross-CA phase transfer. If λ phase boundaries are calibrated per task-node-type on one CA, how much transfers to other CAs of similar capability tier versus dissimilar ones? The empirical surface here matters for deployment economics, since it determines whether each new CA needs its own calibration cycle or whether tiered priors are sufficient.
9. Glossary
Alignment Tax. Reasoning degradation from in-band correction prompts, including anxiety loops, sycophancy, and context collapse.
Semantic Exhaust. Tokens, intermediate states, and discarded hypotheses generated by the CA but not part of the active task trajectory.
Tree-Wasserstein. Optimal-transport metric on probability measures over a tree, with ground metric equal to tree path distance. Closed-form, hierarchy-respecting, true metric.
Online Supervisor Synthesis. Per-step computation of the admissible controllable action set, replacing offline computation of the supremal controllable sublanguage.
Task-conditioned Reference LM. A small language model (or template-driven distribution) representing the expected next-token distribution under the active task node, used to normalize σ.
A note on method
Drafted in conversation with Claude Opus 4.7 (Anthropic) as structured interlocutor and prose editor. The framework, claims, formal commitments, and architectural decisions are mine. Claude converted internal specification material into research-note register, surfaced places where disclaimers needed to be foregrounded, and tightened the prose. Transcripts available on request.
Kendall Clark · k@pentad.ai
—Great Falls, Virginia
May 2026
Pentad Labs · pentad.ai