Hi,
TOPAK is an architecture pattern for multi-agent systems that treats every agent as Byzantine and keeps the models out of the trusted computing base. The modules are small (a lease protocol, floor composition and routing, confinement, seating, observers, a coupling between a planner and an observer, break-glass, a workflow interpreter). About thirty are checked in TLC at small constants, with mutations that must fail, and 24 have TLAPS proof modules for their invariants. Liveness is checked by TLC and not proved. Seats.tla and Seats_proof.tla are a good two-minute first look.
All feedback is welcome.
Thanks,
Scott Cochran