How to formally verify an agent governance framework with TLA+

Why verify agent governance at all? Multi-agent systems are hard to reason about. A circuit breaker that "should" kick in, a state machine that "should" never skip a state — these are the kind of thin...