TARMAC

medical courier · unaccompanied minor · wheelchair · tight connections — medians of 10 seeds, docs/BENCH.md

One dispatcher. Two phones. The last seat to Denver.

A 12-year-old flying alone watches the DEPARTED board go red at 6 PM. Behind a door, one overloaded human decides whether she or the transplant cooler gets that seat.

Greedy re-accommodation optimizes revenue, not regulation: it seats the flexible high-fare passenger — and schedules a crew ferry that breaks the duty clock.

Make the conflict the architecture.

Five agents with opposed objectives — Rebooking, Crew-Legality, Gate/Ground, Hotel, Passenger-Advocate — negotiate revocable claims on a row-locked seat ledger, sealed-bid in contested rounds.

A Duty-Manager mediator resolves mechanically detected deadlocks with Ed25519-signed, regulation-cited rulings.

SEALED-BID COMMIT → REVEAL

Every contested round: commit SHA256(claim ‖ nonce) first, reveal second. A reveal that doesn't re-derive its digest is rejected (I4).

Rivals can't adapt bids — negotiation that's provably leak-free.

MECHANICAL DEADLOCK

Wait-for cycle or contested ≥2 rounds → mediation triggers. Reproducible, never vibes-based.

SIGNED RULINGS

Ed25519 + a cited regulation — verify what was decided, and on what basis, without trusting the DB.

CREDIBILITY CURRENCY

Contesting costs points; winning refunds + premium; losing burns. Argument is economically bounded.

DOMAIN-AGNOSTIC CORE

tarmac-society lib — meeting-room booking on the same protocol in 20 lines.

An unmeasured society is just a group chat.

Track 3 asks for a measurable efficiency gain over single-agent baselines. Measuring means running a 5-agent, ~60-turn society dozens of times. That's an economics problem — and Qwen Cloud is the economics.

The transport is swappable (FakeQwen ↔ LiveQwen); ledger physics, sealed bids, signing and logging are identical offline and live.

327

tests, all green in ~5s — ledger locks, commit/reveal, deadlock graphs, ruling flow, invariants I1–I5

99%

coverage — pytest --cov=tarmac_society

19

deterministic tests on the live DashScope wire path — --live adds tokens, not code

DELIVERED IN THE REPO

• ▸ Ablation bench committed (docs/BENCH.md, 3 conditions × 10 seeds)
• ▸ Zero-key judge path: verify_offline.py → exit 0, sockets disabled
• ▸ 7-layer CI: ruff · mypy · pytest · CodeQL · pip-audit · TruffleHog · wheel smoke
• ▸ Domain proof: examples/meeting_rooms.py — same core, 20 lines

HONEST LIMITS

A simulator — synthetic data, one curated storm + seeded generator. Offline default = deterministic policy agents; real Qwen agents behind --live. ECS deploy documented, not claimed.

Run one command. Judge the receipts.

Score Tarmac on Track 3's own sentence: a measured gain over a single-agent baseline — 3 vs 17, reproducible on your laptop.

Edy Cu · github.com/edycutjong/tarmac · tarmac.edycu.dev

tarmac.edycu.dev/pitch/

The mediator is load-bearing.
Now you can prove it.