A Deterministic Control Plane for LLM Coding Agents

• URL: http://arxiv.org/abs/2606.26924v1
• Date: Thu, 25 Jun 2026 12:02:18 GMT
• Title: A Deterministic Control Plane for LLM Coding Agents
• Abstract summary: A prevalence study of 10,008 GitHub repositories finds that agent configurations propagate as undeclared shared components.<n>We propose a deterministic control plane above the harness that maps one-to-one to these gaps.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to these gaps. Rel(AI)Build treats agent definitions as a managed supply chain (SHA-256 content addressing, HMAC-stamped lockfiles, hash-chained audit logs); enforces tiered permissions and attack-derived blocklists before LLM invocation; gates feature work through a phase state machine with requirement-to-file-to-test traceability; compiles a single canonical definition to seven IDE targets; and detects prompt drift via Jaccard similarity. Conformance tests on injected violations confirm each mechanism enforces its stated invariant; developer outcomes remain future work. Governance of this layer must be deterministic and tool-agnostic -- not delegated to further LLM orchestration.

Related papers

• Scanning the Harness: An Empirical Study of Supply-Chain Defects in AI Coding-Agent Configurations [0.0]
  AI coding agents such as Claude Code, Cursor, GitHub Copilot, and OpenAI Codex are configured through artifacts developers write and share.<n>This harness is a dependency layer installed from marketplaces and public repositories, running with the developer's privileges.<n>We study it over 3,171 public GitHub repositories: 2,660 setups that assemble two or more component types and 511 published skill collections.
  arXiv  Detail & Related papers  (2026-09-07T11:27:24Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agents [61.184954205350984]
  ClawArena-Team is a benchmark of 41 multi-turn, multimodal, multi-agent scenarios spanning 258 evaluation rounds and 72 staged updates.<n>All scoring is execution-based with no LLM judge: an overall score -- the Subagent-Management Score (SMS) -- multiplies task correctness by a least-privilege and modality-routing factor.
  arXiv  Detail & Related papers  (2026-06-30T06:06:08Z)
• Detecting AI Coding Agents in Open Source: A Validated Multi-Method Census of 180 Million Repositories [2.36052383261568]
  Generative AI coding agents are entering the open-source supply chain.<n>We introduce a multi-layered detection framework that integrates configuration-file scanning, commit-message analysis, author-identity matching, and bot-signature lookup.<n>No single method captures more than a fraction of activity.
  arXiv  Detail & Related papers  (2026-06-23T11:05:42Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• PRISM: : Planning and Reasoning with Intent in Simulated Embodied Environments [59.07829883257003]
  Built on five multi-room apartments, PRISM structures 300 human-verified tasks into three capability tiers.<n>PRISM exposes an agent-agnostic executable action API that allows arbitrary agents to be evaluated end-to-end.
  arXiv  Detail & Related papers  (2026-05-12T04:59:47Z)
• Constraint-Guided Multi-Agent Decompilation for Executable Binary Recovery [47.704311990064554]
  Decompilation is essential for security analysis, malware reverse engineering, and legacy software maintenance.<n>We present a multi-agent framework that transforms decompiled code into re-executable source through Multi-level Constraint-Guided Decompilation (MCGD)<n>Our framework achieves 84-97% re-executability, improving baseline decompiler output by 28-89 percentage points.
  arXiv  Detail & Related papers  (2026-04-27T01:28:11Z)
• Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives [0.0]
  Governed MCP is a tool governance gateway built on a logit-based safety primitive.<n>The gateway interposes on every MCP tool call in a 6-layer pipeline.<n>I implement Governed MCP in a bare-metal x86_64 OS in approximately 86,000 lines of Rust.
  arXiv  Detail & Related papers  (2026-04-18T06:40:20Z)
• From Inference Routing to Agent Orchestration: Declarative Policy Compilation with Cross-Layer Verification [10.651054435747385]
  The Semantic Router DSL is a non-Turing-complete policy language deployed in production for per-request inference.<n>This paper extends the same language from stateless, per-request routing to multi-step agent routing.
  arXiv  Detail & Related papers  (2026-03-28T15:04:31Z)
• Agent Control Protocol: Admission Control for Agent Actions [0.4929694290403903]
  Agent Control Protocol (ACP) is a formal specification for admission control governance of autonomous agents in B2B institutional environments.<n>ACP defines cryptographic identity, capability-based authorization, deterministic risk evaluation, chained delegation, and cryptographically-chained auditing.<n>ACP operates on top of RBAC and Zero Trust, addressing what neither model solves.
  arXiv  Detail & Related papers  (2026-03-19T12:28:28Z)
• Test-Driven AI Agent Definition (TDAD): Compiling Tool-Using Agents from Behavioral Specifications [0.0]
  Test-Driven AI Agent Definition (TDAD) is a methodology that treats agent prompts as compiled artifacts.<n>We evaluate TDAD on SpecSuite-Core, a benchmark of four deeply-specified agents spanning policy compliance, grounded analytics, runbook adherence, and deterministic enforcement.
  arXiv  Detail & Related papers  (2026-03-09T18:04:54Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• Behavior Knowledge Merge in Reinforced Agentic Models [48.89546963456286]
  Reinforcement learning is central to post-training, particularly for agentic models that require specialized reasoning behaviors.<n>Existing merging methods are designed for supervised fine-tuning (SFT), and they are suboptimal to preserve task-specific capabilities on RL-trained agentic models.<n>We propose Reinforced Agent Merging (RAM), a distribution-aware merging framework explicitly designed for RL-trained agentic models.
  arXiv  Detail & Related papers  (2026-01-20T03:56:53Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.