A model-checked quorum rule absorbed an LLM oracle's jitter across 1,680 chaos rounds

A vote counts only when its distance from 0.5 exceeds the measured noise floor ^[15]. Three floors came out of 1,490 captured calls to jev-1.13.0, each one stored verbatim with a SHA-256: 0.042 for identical requests, 0.059 when the questions are reordered, 0.073 across a paraphrase cohort ^{[6] [7]}. Under the cohort floor, a probability has to land below 0.427 or above 0.573 before it can count toward quorum ^[1]. The 0.01 spread between those five identical calls disappears inside even the tightest floor ^[2]. The author reports that none of the three numbers came from the docs ^[11].

Consensus protocols assume something a language model breaks. Paxos and Raft assume a correct process's proposed value is stable, and with a noisy oracle that assumption is false ^[12]. Byzantine fault models do not cover it either: "the agent is not lying, the oracle is noisy," the author wrote ^[13]. So the spec treats vote instability as normal behavior and makes reproducibility the invariant, requiring a quorum of stable votes behind any non-abstain decision ^[14].

The quorum bound came out of a sweep across 24 configurations of (agents, byzantine, quorum), printing predicted against actual per cell, and the author says his first guess at the rule was wrong before the sweep produced 2Q > N and Q > 2f ^[17]. The enforcement is the part I would copy. `QuorumPolicy::new` is the only constructor in the Rust, so a configuration TLC proved unsafe cannot be instantiated ^[18]. Forty-eight tests sit on the kernel, including replays of TLC counterexample traces, and one of them, `calibration_choice_changes_the_outcome`, feeds identical probabilities through both floors: they decide under the identity floor and escalate under the cohort floor ^[19].

The chaos run produced the case that makes the behavior legible. Documented penicillin anaphylaxis in the record, a new order for amoxicillin, two of the five agents rate-limited, and the third answering 0.54 ^[26]. That answer is 0.04 from the midpoint, inside the 0.042 identity floor and well inside the 0.073 cohort floor ^[3]. Quorum was not met, so the kernel escalated a question the author says a first-year student answers ^{[26] [27]}.

The requirement is asymmetric. The author wrote that the pharmacy system is allowed to abstain, and is not allowed to be confident and wrong ^[29]. Zero wrong verdicts across 1,080 golden rounds bounds the true error rate below 0.28% at 95% confidence, which is the rule of three: 3 divided by 1,080 ^{[23] [5]}. That bound covers the golden tier. The other 600 rounds are the nuanced and ambiguous cases, where escalation is the defensible answer and there is no confident verdict to be wrong about ^{[4] [20]}. The author wrote that this does not prove the rate is zero, and that he is not going to round it up to safe ^[24].

Three conditions have to hold before any of this transfers. Jev returns a scalar: ask whether oxycodone is a controlled substance and the answer is 0.98, not a paragraph ^[5]. Prose has no margin from 0.5, so the stable-vote test has nothing to evaluate. The floors are properties of one model version measured on one engineer's traffic ^[6]. And the calibration figures, accuracy 0.979 with a Brier score of 0.0187, come from 240 items the same author constructed, as did the 14 pharmacy scenarios in the harness ^{[8] [20]}.

Two of the three bugs the author found were his own, and the third he describes as a limit the model cannot cross ^[28]. Latency was flat in question count, 96.7 ms for one question and 98.0 ms for 38, which is 1.3 ms for 37 extra questions, about 0.035 ms each ^{[9] [6]}. The billing meter was linear to within one token across a 2,500x range ^[10].