A post from Boris Cherny on TLA+ drew the usual online reaction: 1 million views, thousands of bookmarks, and everyone asking what TLA+ actually means. Cherny employed Opus 5.5 to model portions of the Claude Agent SDK using both TLA+ and Lean, and the attention followed. The real question is whether anyone can actually explain it.
What TLA+ Does
The name TLA+ breaks down as Temporal Logic of Actions, a way of describing what a system can do and what must always or eventually hold true about it. Cherny’s post builds on earlier examples, adding weight to the argument that TLA+ pays off in agentic coding, among them a Datadog post on harness-first agents.
The Playground Example
A blog post presents an interactive setting where three machines, labeled a, b and c, must settle on a single leader among themselves. Only one leader can be active at any given moment, so no two machines hold the role simultaneously. Users work through states manually, advancing step by step through a possible run, while a model checker stands ready to verify that the property holds true throughout.
States and Actions
A TLA+ model comprises two components. The first is a transition system featuring states — snapshots of the world, such as who holds the candidate role, who has cast votes for whom, who leads — and actions that alter them, including “a starts an election” or “b votes for a.” The second component consists of temporal properties that describe how runs unfold over time. “There are never two leaders” and “A leader is eventually elected” serve as examples.
Safety and Liveness
Safety means nothing bad ever happens. The playground’s model checker explores every possible state, finding all 38 states for three computers, and confirms the property. Level 2 changes one rule so a computer can vote twice, producing a six-step execution ending with two leaders — a counterexample showing the model can fail.
A liveness guarantee promises that something good eventually comes to pass. A system that simply does nothing for all time is perfectly safe, which is why the playground’s level 3 illustrates the point: a single typo can prevent anything from happening, yet the safety check still clears it. The fairness assumptions behind these guarantees actually exclude executions where an action remains possible but is never actually carried out.
What TLA+ Is Not
More and more companies are adopting TLA+, and you can find it at work across a wide range of organizations, from AWS and MongoDB to Datadog, with Kafka being another notable example among many others. However, the tool carries three significant restrictions.
- It checks a model of the software, not the software itself.
- Its main model checker only explores finite instances.
- It imposes no order on transitions and no probability distribution.
The Proof Gap
It is not a matter of whether an agent can write TLA+ that raises interest. The real question concerns what becomes possible when agents can move between specifications, proofs, and real programs. At Reasonable, part of the effort involves training models so that agents can carry out this movement consistently, reliably, and quickly.
The Verus Connection
Verus keeps its specification, proof, and Rust code all in the same language. Reasonable created a system that takes 16,000+ TLA+ specifications paired with properties and turns them into 3,000+ proofs that have been checked by a machine.
Why It Matters
The notation known as TLA+ offers a way to express precisely what a system is permitted to do and what must always or eventually hold true of it. Verification involves determining whether every conceivable sequence of actions is allowable. The standard TLA+ model checker, TLC, responds by listing all the states that can be reached in a limited instance. A proof, by contrast, establishes the stronger claim that the property applies without exception.
The Bottom Line
Cherny’s tweet drew attention to TLA+, and the playground made it easy to use. What matters most, though, is what sits between a specification and a working program. That is where the agents do their work.
Key Facts Box
– Views on Cherny’s TLA+ account: 1 million
– Bookmarks: thousands
– Machines in playground example: three (labeled a, b and c)
– Model checker finds: 38 states
– Level 2 execution: six steps, ending with two leaders
– Reasonable pipeline: 16,000+ TLA+ spec/property pairs processed
– Machine-checked Verus proofs generated: 3,000+
The TLA+ language has existed for some time now, though the internet has only recently taken notice of it. What remains to be seen is where things go from here.
Source material: “The internet discovers TLA+. Now what?,” reasonable.io.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.