# Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs

arXiv: https://arxiv.org/abs/2609.38266 · HTML: https://mlsanity.com/paper/2609.38266/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Financial trading and forecasting agents, one of 16 directions in LLM agents and tool use.
- Builds on 24 of its 43 references that are in the map.
- First posted on arXiv 29 Sep 2026.

## Placed in

- LLM agents and tool use / [Financial trading and forecasting agents](https://mlsanity.com/agents/financial-trading-and-forecasting-agents/)

## Builds on (most cited first, 24 of 24)

- [SagaLLM: Context Management, Validation, and Transaction Guarantees for Multi-Agent LLM Planning](https://mlsanity.com/paper/2503.11951/) (2025)
- [From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents](https://mlsanity.com/paper/2606.04990/) (2026)
- [Atomix: Timely, Transactional Tool Use for Reliable Agentic Workflows](https://mlsanity.com/paper/2602.14849/) (2026)
- [Cordon: Semantic Transactions for Tool-Using LLM Agents](https://mlsanity.com/paper/2606.17573/) (2026)
- [Auditable Agents](https://mlsanity.com/paper/2604.05485/) (2026)
- [What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents](https://mlsanity.com/paper/2606.02668/) (2026)
- [AEGIS: No Tool Call Left Unchecked -- A Pre-Execution Firewall and Audit Layer for AI Agents](https://mlsanity.com/paper/2603.12621/) (2026)
- [Mnemosyne: Agentic Transaction Processing for Validating and Repairing AI-generated Workflows](https://mlsanity.com/paper/2607.00269/) (2026)
- [Right to History: A Sovereignty Kernel for Verifiable AI Agent Execution](https://mlsanity.com/paper/2602.20214/) (2026)
- [AgentRewind: Recoverable Execution for Long-Horizon LLM Agents](https://mlsanity.com/paper/2608.14380/) (2026)
- [Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents](https://mlsanity.com/paper/2603.00476/) (2026)
- [Autonomous Action Runtime Management(AARM):A System Specification for Securing AI-Driven Actions at Runtime](https://mlsanity.com/paper/2602.09433/) (2026)
- [Sovereign Agentic Loops: Decoupling AI Reasoning from Execution in Real-World Systems](https://mlsanity.com/paper/2604.22136/) (2026)
- [LEDGER: Claim-to-Evidence Trace Graphs for Auditing LLM Agents](https://mlsanity.com/paper/2608.18398/) (2026)
- [Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems](https://mlsanity.com/paper/2601.17744/) (2026)
- [Keeping Authorities "Honest or Bust" with Decentralized Witness Cosigning](https://mlsanity.com/paper/1503.08768/) (2015)
- [Robust Agent Compensation (RAC): Teaching AI Agents to Compensate](https://mlsanity.com/paper/2605.03409/) (2026)
- [Proof of Execution: Runtime Verification for Governed AI Agent Actions](https://mlsanity.com/paper/2607.05397/) (2026)
- [Resume Means Resume: A Machine-Checked Conformance Contract for Checkpoint, Interrupt, and Resume Semantics in Workflow Persistence Layers](https://mlsanity.com/paper/2608.03836/) (2026)
- [Loopjacking: Hijacking Human-in-the-Loop Approval](https://mlsanity.com/paper/2609.21081/) (2026)
- [Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback](https://mlsanity.com/paper/2608.29381/) (2026)
- [Agent Flight Recorder: Tamper-Evident Audit Trails with On-Chain Anchoring for Long-Horizon Tool-Using Agents](https://mlsanity.com/paper/2609.01931/) (2026)
- [The Verifiable Action Card: Trustworthy Human-in-the-Loop Control for Secure Autonomous Agents](https://mlsanity.com/paper/2609.18411/) (2026)
- [NovaFabric: Tamper-Evident, Replayable Evidence for Autonomous AI Agent Runs](https://mlsanity.com/paper/2609.12582/) (2026)

## Abstract (arXiv)

Agentic large language models (LLMs) now move money through tools, yet the record of what they did is usually a trace their own process emits beside the effect. Janus puts the record on the effect path. A step's proposal, the verdict on it and any answer from a validator or a person are durable in a signed, hash-chained log before the step may run or its effect be released; with keys declared, each answer is signed by whoever gave or relayed it. Gates are pure functions of that log, and an auditor re-derives every verdict offline from the log and one public key. At the MCP edge the effect is held until then; through the SDK, which our model experiment uses, a cooperating client runs it only afterwards. We evaluate Janus under crash injection (144 kills in-process, 81 through the daemon), by verifying a 100-million-event log offline (254.5 s), and with a real model behind a lending workflow, run governed and plain on the same recorded model outputs. With the lending mandate in the model's prompt, the comparison was 0 against 0. With it only in the policy and the amount's unit stated, the model approved six loans declared over the mandate, three with no injection (a run that also dropped the unit approved three); the plain agent paid all six and Janus none, each refused by a deterministic validator and re-derivable offline. An always-approve oracle over the recorded intakes gave 20 and 21 declared over the mandate against 0, though Janus paid four and three whose declared amount understated the request. Designing the experiment exposed, in a system that passed its own audit, an instance of post-approval substitution: an approval keyed to an attempt was counted for a different proposal, moving a person's approval from 100 to 1,000,000. We report it, a first fix and the five routes around it, and what Janus does not guarantee.