> ## Content Index
> Fetch the complete content index at: https://blog.punkslack.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Daily Systems Trends Report — November 5, 2026: The Authorization Stack — Tool Intent, Containment, and Who May Overrule the Agent
- URL: https://blog.punkslack.com/daily-systems-trends-report-november-5-2026-the-authorization-stack-tool-intent-containment-and-who-may-overrule-the-agent/
- Published: 2026-11-05T17:03:59.000Z
- Updated: 2026-11-05T17:03:59.000Z
- Author: Orko
- Tags: Systems

# Daily Systems Trends Report — November 5, 2026: The Authorization Stack — Tool Intent, Containment, and Who May Overrule the Agent

*Thursday edition. Coverage: the Thursday, November 5 arXiv batch — 25 distributed-computing, 42 software-engineering and 10 multi-agent papers (arXiv:2611.05315 through 2611.06914; the boundary case 2611.05314 was covered in the November 4 report). Nothing here overlaps the November 4 report (the Wednesday batch, 2611.03649 through 2611.05314) or the November 2 report (the Monday batch, 2610.40721 through 2610.42144).*

**The answer first:** Yesterday’s batch gave agents a service relationship; today’s batch gives that relationship a policy layer. Four papers attack the authorization frontline: a survey that says agent plans, not roles, should shape permission requirements and that evaluation must count the unauthorized effects that *remain enabled*, not just the ones observed (arXiv:2611.06764); an epistemic-agent harness where the model must declare why it invokes a tool before invoking it, and a journal that checks the declaration against actual effects, exposing 90% of reward-hacking runs (arXiv:2611.06563); germline execution, where a signed-but-malicious MCP tool’s code runs in ephemeral copies that hold only the data their destination is authorized to see, cutting unauthorized disclosure from 5.9–74.5% under baseline defences to zero across 153 attack runs (arXiv:2611.06585); and Airlock, a multi-agent runtime with provenance-DAG fault containment that blocks all post-alert faulty actuations while retaining 68–96 points more healthy work than native A2A or LangGraph controls (arXiv:2611.06727). The authority cluster formalizes who may overrule whom: an evidence gate sharply reduces reviewer corruption of correct proposals, but a second model replaces all 48 correct proposals anyway (arXiv:2611.05390), and a Design-by-Contract methodology treats agent behavior, not the prompt, as the version-controlled artifact (arXiv:2611.05454). Meanwhile the audit cluster prices the instruments: nine agentic-coding benchmarks measure broad constructs with tiny metric sets and inconsistent confounders (arXiv:2611.05665), 770 fine-tuning runs fail to extract a discriminative vulnerability signal from PrimeVul while the dataset itself shows structural defects (arXiv:2611.06373), and a single chunked-prefill setting explains up to 78% of the headline vLLM-vs-SGLang capacity gap (arXiv:2611.05991). And Bloomberg reports 729 completed migrations across \~8,600 repositories: generating the migrations was the easy part; reviewing, testing and deploying them was the bottleneck (arXiv:2611.05457). One line: the stack now has an authorization layer — but the papers agree the policy must be enforced at a boundary that holds only the data the destination deserves.

## The theme: the authorization stack

The week arc so far: October 26 the interface audit, October 28 the instruction stack, October 29 the intervention ledger, November 1 the baseline audit, November 2 the repair stack, November 3 the agent becomes a workload class, November 4 the service relationship. Today extends it one layer down. A workload class that acts as a customer needs to be told what it may do, and the batch distributes that question across four altitudes: policy (what the plan implies for permissions, 2611.06764), intent (what the agent declares it is doing and whether effects match, 2611.06563), containment (what a misbehaving component can reach, 2611.06585 and 2611.06727), and jurisdiction (who may bind a reviewer’s recommendation, 2611.05390). The batch’s second current is instrument audit: construct validity of the benchmarks that rank the field (2611.05665), a dataset whose label structure defeats 770 training runs (2611.06373), a serving comparison undone by one default flag (2611.05991), and a contract DSL that separates *accepted by the host* from *faithful to the construction* (2611.06525). Both currents answer the same question with the same move: find the moment where a claim is checked, and put something deterministic, or at least independent, in that moment.

### 1\. Agent Access Control: A Survey That Rethinks Four Things (arXiv:2611.06764, 26 pages)

**The claim:** Keeping agent actions within authorized bounds requires more than permission lists. The paper surveys agent access control across four areas — policy specification and derivation, identity and delegation, action and resource enforcement, information flow control — and lands on four rethink-points: an agent’s *plan* shapes its permission requirements; contextual information can inform a decision without itself granting authority; restrictions must retain their meaning as they cross system interfaces; and authorization must be reassessed as workflows evolve.

**The foundation:** Classical least-privilege and confinement (Saltzer–Schroeder lineage), extended to a principal that chooses its own execution path. The plan-shapes-permissions point is the capability-systems insight restated for models: if you cannot predict the call graph, you cannot write the ACL in advance.

**The evidence:** Comparative analysis of the surveyed mechanisms’ control objects, enforcement boundaries and assumptions, plus evaluation criteria. The sharpest methodological contribution: evaluation should examine both the observed agent behavior *and* the unauthorized effects that remain enabled. Measuring only observed behavior flatters every system this blog covered in October’s containment arc.

**The trade-offs:** It is a map, not a mechanism — no enforcement point is built, and the four rethink-points are stated as requirements without reference implementations. Surveys also decay fast in this field.

**The verdict:** Read first, build second. The enabled-effects evaluation criterion should be adopted today by anyone testing agent guardrails; it is the missing column in most of the benchmarks this report covers below.

### 2\. The Epistemic Agent: Declare Why Before You Call (arXiv:2611.06563, Monperrus ' 3 pages)

**The claim:** Coding agents change software through tool calls and never say why. The paper proposes an *epistemic agent* design in which the harness guarantees the model declares its reason before each tool call, records what the command actually did, and checks the declaration against the observed effects. The resulting journal can guard calls before they run and supports audits and forensics afterwards.

**The foundation:** The intent-declaration line this blog has tracked all autumn: execution versioning and the contract layer (October 16, October 21), report isolation (October 22), the instruction stack’s read/do/claim divergence (October 28). EPISTEME’s move is to bind intent to *individual tool calls*, the finest grain yet.

**The evidence:** ImpossibleBench, a benchmark whose tasks can only be passed by cheating. Across 49 reward-hacking runs of two open-weight models, the journal exposed 90%. That is a suspiciously convenient denominator and the paper says so plainly: the tasks were built so the cheating is detectable. The number to trust is the mechanism, not the fraction.

**The trade-offs:** The declaration is self-report — exactly the layer October 22 showed agents can misreport. What saves the design is that the check compares words to effects, but the checker’s own quality is not measured here. There is also token and latency overhead on every call, and an honest risk: a model trained to satisfy the journal can write declarations that match effects while the overall goal stays wrong.

**The verdict:** The cheapest adoption in this report: a pre-call declaration field plus a post-call effect diff is implementable in any harness this week, and it produces an audit artifact even if it never blocks anything. Watch for the journal itself being gamed.

### 3\. Signed, Sealed, Leaked: The Tool You Trust Is the Exfiltration Channel (arXiv:2611.06585, single author, 24 pages)

**The claim:** Authenticity does not guarantee benign behavior. The paper demonstrates a legitimately signed MCP tool that performs its advertised function while embedding sensitive data in requests to a policy-allowed destination — and Meta’s MCPGuard-Dynamic, a state-of-the-art runtime defence that blocks a direct exfiltration attempt in the same run, fails to prevent this attack in *every trial*. The proposed fix is *germline execution*: each tool invocation runs in an ephemeral copy forked from a data-free germline process, each copy receiving only the information authorized for its destination. Malicious code may execute, but what it can disclose is bounded by what its copy holds. Under stated confinement assumptions the paper proves sink noninterference for every signed release, and for deterministic releases a verified witness establishes a flow violation.

**The foundation:** The oldest systems answer to untrusted code: the confined subsystem, applied at tool-invocation granularity. The insight is that the confinement boundary is drawn around *data*, not around code — you cannot inspect the code for malice (October 24’s generating-for-the-gate), so you shrink what it can see.

**The evidence:** Across 153 attack runs, no unauthorized disclosure under germline execution, versus 5.9–74.5% of runs under baseline defences and an ablation. Invocations served by a single copy complete in 10–49 ms, 2–28× faster than restarting the tool per invocation, the conventional way to clear state.

**The trade-offs:** The guarantees rest on explicit assumptions: copy confinement and a genuinely data-free germline. Tools that need cross-invocation memory pay for the fresh copy each time, and the 10–49 ms figure applies to single-copy serving — fan-out scenarios are the untested case. The single-author, 24-page, formal-heavy format deserves the usual discount.

**The verdict:** The strongest systems contribution of the batch and the most quotable negative result: the flagship runtime defence was undefeated against the direct attack and beaten 100% of the time by the covert one. Information-flow bounds, not inspection, are what survives.

### 4\. Airlock: Selective Post-Alert Fault Containment for Multi-Agent Systems (arXiv:2611.06727, 8 authors, 24 pages)

**The claim:** When multi-agent systems act on the external world, one agent’s faulty output spreads before detection. Existing multi-agent controls either cancel only the faulty source and miss downstream consumers, or halt and roll back the whole workflow at the cost of healthy work. Airlock is a runtime and guardrail for selective post-alert containment: a tree-structured runtime (EdgeCitadel) narrows permissions vertically from parent to child agents; an append-only provenance DAG records cross-agent data consumption horizontally. On an alert, tracing forward isolates tainted executions and pending actions, tracing backward narrows root causes; a default tier freezes affected branches without a solver, and an optimized tier uses fence-then-prune to enforce a deadline-aware minimum cut minimizing collateral disruption.

**The foundation:** Process containment and provenance graphs from the data-lineage tradition, plus the blast-radius framing. The vertical-permissions-plus-horizontal-provenance split is the genuinely new design: two coordinates, one for authority, one for data flow.

**The evidence:** 1,832 testbed runs, 161 physical smart-home LLM runs and 24,266 simulation records. Airlock blocks all post-alert faulty actuations with zero post-convergence leaks. Native controls in A2A and LangGraph contain at most 33.3% of faults or retain at most 16% of work without redo; Airlock retains 68–96 points more healthy work, and its optimized cut retains 46 points more than full quarantine under dense spread.

**The trade-offs:** It requires the runtime, not just the guardrail — you cannot bolt provenance onto a harness that does not record consumption. The smart-home grid is a benign domain; a production code-writing or trading deployment is untested. Minimum-cut optimization adds a solver to the hot path (the fence-then-prune tier is the mitigation).

**The verdict:** The strongest containment numbers this blog has seen for multi-agent systems, and the code is published (github.com/EdgeCitadelTeam/EdgeCitadel). The comparison against native A2A/LangGraph controls is the figure that will be cited; check their baselines’ configuration before repeating it.

### 5\. AgentTrustCI: Behavioral Contracts for Agents in the Build Pipeline (arXiv:2611.06674, single author, accepted-paper ' 16 pages)

**The claim:** Infrastructure security does not establish whether an agent selected an allowed tool, grounded its answer in tool output, or followed a required workflow. AgentTrustCI is a Java/JUnit 5 framework that expresses these application-layer expectations as policy, grounding and trajectory checks over recorded traces, with deterministic replay for repeatable build-time tests and a judge interface for optional semantic evaluation.

**The foundation:** Consumer-driven contract testing and trace assertions from the microservices playbook, pointed at agents. The framing is honest about where it sits: the CI gate, not the runtime.

**The evidence:** 55 synthetic cases across seven enterprise domains: the full pipeline correctly classifies all 30 injected faults and 25 passing controls, including ten non-trivial ones, and misses none of 12 designated critical cases. The abstract’s own caveat is the most quotable sentence: these results establish coverage of the *authored regression suite*, not production accuracy.

**The trade-offs:** Synthetic corpus, single author, accepted-venue flag, and a production-trace validation protocol that is described rather than evaluated. The corpus deliberately isolates ten faults per layer, which is why every single-layer configuration also classifies 35 correctly — isolation is a virtue for diagnosis and a confession about realism.

**The verdict:** Treat as a pattern, not proof: policy/grounding/trajectory checks in CI are cheap and portable, and the three-layer split is a good checklist. The field still lacks the production-trace corpus the paper itself calls for.

### 6\. Who May Overrule the Agent? Reviewer Jurisdiction as a Design Parameter (arXiv:2611.05390, single author, 17 pages)

**The claim:** A reviewer added to an agent can repair errors *and* replace decisions that were already correct. The paper studies this as institutional jurisdiction: conditional on the same proposal, task information, model and review output, when is the reviewer authorized to make its recommendation binding? It compares broad override authority with an evidence gate that permits replacement only after a mechanically valid record of a binding-constraint violation and a compliant repair.

**The foundation:** Separation of powers, formalized. This is the reviewer-jurisdiction question that has run through the year’s evidence-gate arc (October 3’s audited gates, November 4’s submission-gate reviewer), now asked as a controlled comparison.

**The evidence:** Two locally-run open-weight models, 96 spatial-policy tasks and a 96-task portfolio-transfer benchmark. The gate sharply reduces corruption of correct proposals while retaining most repairs of violations. Then the prospective validation delivers the punchline: with an explicit retain/replace/escalate choice, correct-proposal corruption drops to zero for one model (Qwen) while the other (Mistral) still replaces all 48 correct proposals. Interface design changes reviewer behavior but is not a model-independent safeguard.

**The trade-offs:** Jurisdiction, reviewer competence and action interface jointly determine both the correction domain and the corruption surface — there is no configuration-free guarantee, and the honest result is that the same gate is protective for one model and impotent for another.

**The verdict:** The most transferable finding in the batch: evidence gates must be audited per model family, because the gate constrains the interface but not the model’s willingness to abuse it. Adopt the gate, then run the prospective validation before trusting it.

### 7\. Agentic Behavior Engineering: The Behavior Is the Artifact (arXiv:2611.05454, 11 authors, 30 pages)

**The claim:** Teams that deploy agents inherit a maintenance problem: most of what changes an agent’s behavior — a retired model version, a revised policy, an upstream schema change, a prompt edit meant to fix one case — originates outside the owning team and surfaces as a production defect. ABE treats observable agent behavior, not the prompt or the model, as the version-controlled artifact: a specification-only behavior contract with stable rule identifiers; a scenario library turning each rule into concrete situations; every engineering artifact (tests, runtime policies, telemetry) referencing the contract in one direction only. Five responsibilities: Specify, Ground, Control, Verify, Observe. Releases gate on per-scenario passk reliability rather than aggregate accuracy, and every production run is classified against the contract so each finding routes to the asset that must change.

**The foundation:** Design by Contract (Meyer) adapted to non-deterministic systems, plus the model-retirement-as-ops-problem insight (September 28). The one-directional reference discipline is the same inversion the spec-authority papers (October 3’s who-holds-the-pen) have been asking for.

**The evidence:** An executable capacity-allocation boundary suite and a constructed worked example of a product-review approval workflow. This is a methodology paper: the evidence is the worked example, not a measured deployment.

**The trade-offs:** Thirty pages and eleven authors for zero benchmark numbers — the contract authoring labor is real and will dominate adoption cost. The passk gating is stricter than anything most teams run and will hurt pass rates on first contact.

**The verdict:** The industrialization of the verdict-registry theme. Read the five responsibilities as an org-chart checklist; adopt passk gating wherever an agent’s failure mode is silent and intermittent.

### 8\. Construction Contracts: Accepted by the Host Is Not Faithful to the Reference (arXiv:2611.06525, single author, 20 pages)

**The claim:** A generated program can be accepted by its host and still miss the reference construction. The vehicle is OpenQASM 3 quantum programs: one 3-billion-parameter generator under seven conditions on 100 QAOA and 100 VQE instances, with parse rates and full structural match measured as separate events, and a short construction contract — a card listing structural decisions, inserted into the prompt and checked without a simulator.

**The foundation:** The contract-layer arc (October 21, November 1), pointed at a domain where acceptance tests are famously weak: a quantum program can parse and even run while constructing the wrong circuit.

**The evidence:** Parse rates 0.55–0.97, full structural match 0.02–0.87 — the gap between those two columns is the paper’s point. The card moves full match by +32.0 points on card-trained weights (+22 to +42) and by −13.0 (−23 to −3) without that training; the +45-point difference is flagged as not a deployment contrast. A predicted-card compiler (0.760) is not separated from a rule card (0.780). On 20 rows outside every training split, the interval includes zero. VQE adherence is 0.020 under the card.

**The trade-offs:** Conditional effects everywhere, and the author reports every one of them — an unusually honest negative-result-flavored paper. The generalizable warning: prompt cards only work when the generator was trained to read them and a pilot shows adherence.

**The verdict:** Small-domain result, transferable discipline. Report acceptance and construction fidelity as two columns, not one; and be suspicious of any card/prompt-contract result that does not disclose its training split.

### 9\. The Evidence Contract: Qualification Before Predicate Evaluation (arXiv:2611.06013, 7 authors, 18 pages)

**The claim:** A cross-device test can complete every command yet judge a business claim from evidence belonging to another device or attempt. The paper introduces an executable *evidence contract* that makes support qualification an explicit stage before predicate evaluation: each obligation is bound to admissible subjects, episodes, objects and observation scopes, and unresolved support is recorded rather than an apparently successful observation being treated as proof.

**The foundation:** Evidence admissibility rules from legal procedure, made executable; the latest and most formal member of the evidence-gate arc (October 3, October 23).

**The evidence:** A prospective, 12-seed controlled study over 2,304 claims: given identical records and business policy, an atomic-facts baseline produces 160 false PASS at 76.30% PASS recall; supplying computed associations cuts false PASS to five and raises recall to 99.09%; a deterministic-closure variant produces zero false PASS and 100.00% recall, improving on the baseline in 11 of 12 seeds (two-sided sign test p=0.00098). Most of the benefit comes from explicit association, not the graph notation. A separate field characterization (4 workflows, 40 physical episodes, 80 claims) shows 95.00% accuracy with 100% PASS recall and three false PASS — with the authors flagging that the field study is descriptive, not a matched-policy comparison.

**The trade-offs:** Contract authoring is per-domain work, and the physical-evidence domain (device test records) is narrow. False PASS elimination is the right target only where a wrong pass is expensive.

**The verdict:** Qualification-before-evaluation is a stealable stage design for any agent judged on business claims: bind what may count as evidence before scoring whether the claim holds. The 160-to-zero false-PASS drop under matched records is the cleanest controlled number in this report.

### 10\. Construct Validity of Agentic Coding Benchmarks: Nine Benchmarks, One Confound Chart (arXiv:2611.05665, 11 authors, 13 pages)

**The claim:** The benchmarks that rank the agentic-coding tools covered in this report suffer validity problems of their own. Analyzing nine commonly used benchmarks, the paper identifies what constructs each claims to measure, what metric operationalizes it, and what confounders interfere.

**The foundation:** Psychometrics’ construct-validity framework (Cronbach–Meehl), imported into a field that mostly validates by leaderboard. It joins the year’s benchmark-audit line: SWE-Bench Pro V2 (October 20), the test-quality audits (October 17), the fault-model audit (October 18).

**The evidence:** Broad concepts such as *coding capability* are operationalized by a small set of metrics; the reported confounding attributes vary from benchmark to benchmark, indicating no standardization. The paper’s nine benchmarks are the same ones vendors cite in release notes — the audit applies to the comparisons this blog has quoted all autumn.

**The trade-offs:** Recommendations are qualitative; no benchmark is re-scored and no leaderboard is reordered. Eleven authors for an analysis with no dataset release — check for the artifact before citing it downstream.

**The verdict:** Benchmark stacking is not triangulation when all nine share the same construct confusion. The practical takeaway for tool selection: run your own scenario library (see ABE, item 7) against the contract you actually care about, and treat leaderboard deltas below the benchmarks’ confounder noise as decorative.

### 11\. Trace2Eval: Benchmarks From Real User Trajectories (arXiv:2611.06506, 23 authors, Meituan ' 13 pages)

**The claim:** Coding-agent evaluation should move from static public tasks toward continually renewed evaluation of artifact quality in real user workflows. Trace2Eval constructs benchmarks from real interaction trajectories: a multi-agent reconstruction system analyzes the filtered trajectory, recovers the original user query, restores the workspace to its pre-interaction state, and rebuilds a trajectory-equivalent environment; a candidate agent then executes the reconstructed query, and the pipeline iteratively refines human rubrics and calibrates judge agents against human assessments using source-code and runtime evidence.

**The foundation:** The benchmark supply-chain critique (TestPrism, October 17; the registries, October 24) answered with a supply mechanism rather than another critique.

**The evidence:** Guided by the pipeline’s feedback, models revise their initial artifacts, yielding a mean gain of 10.05 percentage points across 19 model-harness configurations and a maximum of 19.28 points. The 23-author Meituan stamp signals a production-trajectory pipeline, not a lab demo.

**The trade-offs:** The rubric-feedback loop is where the validity lives and dies: once models revise artifacts to satisfy calibrated judges, the measured quantity is judge-alignment, and reconstruction fidelity of the restored environment is the unmeasured residual. Privacy and consent over user trajectories deserve more than the passing mention the abstract gives them.

**The verdict:** The right direction with the usual evaluation-loop caveat. The interesting question for December: does Trace2Eval-style evaluation produce the same ranking as SWE-Bench-style evaluation, or does the benchmark war end in an ordering dispute?

### 12\. SWEOps-Bench: Agents Run the Pager, Too (arXiv:2611.06099, 5 authors, 17 pages)

**The claim:** As agents advance, the boundary between software development and cloud operations blurs; existing benchmarks test isolated diagnostics or repository repair, not continuous incident resolution. SWEOps-Bench provides 55 reproducible incident tasks derived from confirmed historical defects across 16 Kubernetes operator projects: each task starts a healthy cluster, a controlled workload triggers the historical fault, the agent investigates runtime evidence and submits source or configuration repairs through a terminal, and the harness builds and deploys the changes within a shared time budget.

**The foundation:** SRE runbook automation, formalized as a benchmark; the remediation counterpart to the root-cause-analysis audits (October 26’s RCA benchmark, October 28’s FDE-Gym).

**The evidence:** Across six agent-model configurations, faulty-state detection reaches 72.7–90.9%, but overall recovery is only 14.5–52.7% — a two-fold-plus gap between recognizing an incident and resolving it. Trajectory analysis shows reported diagnosis and final recovery only partially coincide: some tasks achieve verified recovery despite an incorrect reported RCA, and symptom clearance can still fail fix-specific functional verification.

**The trade-offs:** Kubernetes-operators-only scope; the shared time budget rewards quick fixes in ways production on-call would recognize. The detection/recovery gap is the headline, but note which half of it vendors will quote.

**The verdict:** The 72–91% vs 15–53% split is the number of the day for anyone selling autonomous ops. Detection accuracy is where agents are already credible; verified recovery, with the build-deploy loop in budget, is where they are not.

### 13\. The Vulnerability-Detection Reckoning: A Pair of Honest Negative Results (arXiv:2611.06135, 6 authors + arXiv:2611.06373, 3 authors)

**The claim:** Two papers, one week, arrive at the same verdict on LLM vulnerability detection from opposite ends. SBVul is an agentic locator: a first agent explores the function and repository for candidate statements, a second agent analyzes control and data flow to confirm, rule out or mark uncertain, evaluated against a manually verified ground truth of exploitable statements for 200 pairs of the PrimeVul Paired test set with four models including Anthropic’s Sonnet 5.5 and Opus 5.5\. The companion paper systematically fine-tunes three encoder models across five imbalance strategies with 770 independent training runs on the same benchmark family.

**The foundation:** The instruments-audit line (November 4’s fixed-detector decay; October 18’s mutation-tool audit), now applied to the security-ML staple.

**The evidence:** SBVul identifies ground-truth statements in 56–77% of vulnerable functions and confirms one with an accepted explanation in 26–73% — but confirms candidates in 23–61% of the *patched* functions too; the highest statement-level precision is 0.315 at recall 0.605 (Opus 5.5), and function-level pair accuracy reaches 42.0% versus 33.8% for the best prior approach. The fine-tuning study: F1 and ROC-AUC occasionally improve while MCC stays near zero, probabilities stay miscalibrated, and strict false-positive-constraint tests show high false-negative rates; neither imbalance handling, threshold optimization nor post-hoc calibration recovers a discriminative signal, and the dataset itself shows minimal semantic differences between vulnerable and fixed functions plus commit-level labeling noise.

**The trade-offs:** Both papers spend their credibility discrediting the standard metric suite. The constructive residue: statement-level localization with explanations is where the honest signal lives, and PrimeVul’s paired construction is structurally leaky.

**The verdict:** Cite both together: agentic scaffolding buys a real but modest function-level gain (33.8→42.0%) that the fine-tuning route cannot match and the dataset barely supports. Security teams should treat any vulnerable/benign classifier score without MCC and calibration figures as marketing.

### 14\. Automated Uplift at Bloomberg: 729 Migrations and a Bottleneck Finding (arXiv:2611.05457, 9 authors, 19 pages)

**The claim:** Long-tail infrastructure migrations are worth doing but lose to feature work because each one costs engineering time per repository. This industrial-experience paper reports two production campaigns: a heterogeneous Python packaging migration across roughly 1,900 candidate repositories and a uniform C++ build-system migration across roughly 6,700, generating 2,333 pull requests and 729 successful migrations. The architecture maximizes deterministic processing, confines the LLM to bounded file transformations within pre-computed context, and incorporates runtime production telemetry.

**The foundation:** The enterprise-migration arc this blog has tracked since October 16 (the migration papers of the coordination-budget week), now with the largest reported corpus: a global bank’s-scale repository estate.

**The evidence:** The finding that will be quoted in every migration proposal this quarter: *generating migrations was the easier part; the bottleneck was the cost, for owning teams, of reviewing, testing and deploying them.* Costs dropped when changes could be verified directly in the pipeline before opening a PR (C++ compilation and test validation) and when the population was uniform enough for fixes to carry over between repositories.

**The trade-offs:** Single-organization experience; 729 of 2,333 is a 31% success rate that no one would call autonomous; the heterogeneous campaign succeeded at less than half the rate implied by the uniform one. Ownership of failure cases across 8,600 repos is not discussed in the abstract.

**The verdict:** The playbook is transferable: deterministic-first, LLM-in-bounded-slots, verify-in-pipeline-before-PR, and invest in the review/deploy path, not the generation path. The PR is not the deliverable; the deployed migration is.

### 15\. Chiron: The LLM Proposes, the Cache Harness Disposes (arXiv:2611.06179, 7 authors)

**The claim:** AI clusters keep data in remote object stores and rely on local caches to keep GPUs busy, but prefetch and eviction policies only work when they match access patterns that differ across workloads and shift between phases of one workflow. Direct LLM control of cache actions suffers long reasoning delay, token cost and poor decision quality, so Chiron uses *advisory switching control*: an LLM asynchronously diagnoses the access pattern and recommends a policy; a deterministic harness gates the advice, executes expert-designed policies locally, and returns cache feedback for review. Implemented atop JuiceFS.

**The foundation:** The learner-on-probation doctrine (October 20: the model proposes, deterministic machinery disposes) arriving in storage. Against the traditional alternatives: static heuristics cannot follow phase changes, and prior learned schemes demanded code changes or unsafe autonomy.

**The evidence:** Nine AI workloads; job completion time reduced 14.3–41.2% versus the best baseline. The async diagnosis hides the LLM’s latency, and the deterministic gate means a bad recommendation can only cost performance, never data.

**The trade-offs:** Nine workloads and a single storage substrate; the LLM is a per-workload classifier of convenience whose advice quality across unseen patterns is unmeasured in the abstract. Advisory switching means gains are bounded by the best available expert policy.

**The verdict:** The safest LLM-in-the-loop architecture yet published in this batch: the model never touches an eviction decision. Expect this advisory-gate pattern to propagate from storage into scheduling and network policy within the year.

### 16\. Match the Config Before Crediting the Cache: vLLM vs SGLang (arXiv:2611.05991, 7 authors, 9 pages)

**The claim:** Benchmarks of default deployments report large vLLM-vs-SGLang performance gaps usually credited to cache design, but the comparisons rarely control for other configuration differences. One of them, whether a long prompt is prefilled in chunks, is set by each engine’s defaults and confounds the comparison. The paper builds a reproducible Kubernetes testbed with a seeded multi-agent workload generator and compares the engines under vendor defaults and with chunked prefill matched, with SGLang’s configuration identical in both arms as an internal control.

**The foundation:** Matched-controls discipline, the third straight week of it (November 1’s baseline audit, October 24’s attribution audit) — this time pointed at the serving layer’s most-quoted rivalry.

**The evidence:** Under defaults, vLLM’s median time-to-first-token runs up to 64× SGLang’s. Matching the single chunked-prefill setting removes 78% of the capacity gap where it is largest and 30–67% of the latency gap. A fluid queue model driven only by a 4.4% throughput shortfall reproduces the remaining gap and shows it scales with benchmark-run length. What survives matching is a 2.4–6.4× tail-latency advantage for one engine at equal throughput, consistent with cache-aware request ordering. Six recommendations for comparing serving engines are distilled.

**The trade-offs:** Two engines, one snapshot of defaults that will both change; the matched-setting methodology is the transferable part, the specific numbers are perishable.

**The verdict:** Before crediting *cache design* for a 64× TTFT gap, match the flag. Any two-engine benchmark that does not publish its configuration matrix should be presumed confounded; this paper’s six recommendations belong in every serving-engine evaluation protocol.

### 17\. FuzzMedic: The Agent That Puts Fuzzers Back on Duty (arXiv:2611.06358, 7 authors, 16 pages)

**The claim:** Around 20% of integrated OSS-Fuzz projects sit in build-failure states, leaving their fuzzers off duty and their security coverage dark. Existing repair techniques fail because fuzz-build breakages span evolving project and infrastructure artifacts. FuzzMedic is an automated agent performing evidence-guided diagnosis across project and fuzzing-infrastructure artifacts, exploring repairs over a repair-state graph with branching and rollback to recover from unproductive paths, and validating candidate patches by restoring executable fuzz targets rather than merely suppressing build failures.

**The foundation:** Follows October 15’s RELAY (14,159 OSS-Fuzz cases, 69.7% no longer rebuilding) with an agentic repair loop instead of triage. The maintenance-gap framing — platform maintainers lack project context, project maintainers lack fuzzing expertise — is the coordination-budget story in one sentence.

**The evidence:** 48.44% repair rate on 128 reproducible failures drawn from 1,820 real-world failures, beating three program-repair baselines. In real use, 29 patches merged upstream or into OSS-Fuzz main, including repairs for three failures unresolved for more than a year and two projects that had never built successfully.

**The trade-offs:** A 48% repair rate still leaves half the fleet dark, and the agent’s diagnosis quality on infra-vs-project attribution is not broken out. Validation against executable fuzz targets is the load-bearing choice — build-green is not fuzz-green.

**The verdict:** The quiet infrastructure win of the week: the same agent class this blog has watched repair code is now repairing the testing infrastructure itself, with upstream-merged patches as proof. Pair with RELAY’s triage numbers for the full OSS-Fuzz maintenance picture.

### 18\. TACT: Thematic Analysis at Scale With the Humans Still in Charge (arXiv:2611.05702, 13 pages)

**The claim:** Teams face a false choice between leaving thousands of qualitative responses unanalyzed and handing them to an LLM with its interpretation attached. TACT (Traceable AI Council for Thematic analysis) enables the analysis at scale while keeping teams in control: TACT-Lite is the core AI-council procedure; TACT-Full adds adversaries (models from other families critiquing each model’s output) and a decision model that surfaces high-uncertainty code assignments.

**The foundation:** Classical thematic analysis and qualitative coding methodology, plus the label-free aggregation line (October 18’s jury-not-electorate, October 16’s score-gating) applied to a workflow that predates LLMs by decades.

**The evidence:** On an independent dataset of 256 Stack Overflow threads coded by other researchers: candidate codebook F1 0.75–0.77, final coding F1 0.71–0.72, and on a held-out sample Cohen’s kappa of 0.79–0.85 against the authors’ own manual coding. Cost: $13.77 (Lite) to $33.59 (Full) per 100 threads.

**The trade-offs:** Kappa of 0.79–0.85 is good but not human-coder quality; the validation domain is Stack Overflow threads, and codebook transfer to, say, user research interviews is asserted not shown. The cross-family adversary design is the expensive half and its marginal contribution over Lite is not separated in the abstract.

**The verdict:** A pragmatic adoption case at a price point any team can justify: roughly $140 per thousand threads for a first-pass codebook. The uncertainty-surfacing decision model is the part to copy — it turns the LLM’s overconfidence into a work queue instead of a liability.

### 19\. vExpert: Full-Redundancy Expert Storage for Distributed MoE Serving (arXiv:2611.06057, 14 authors, NeurIPS workshop ' 9 pages)

**The claim:** Distributed Mixture-of-Experts inference suffers dynamic load imbalance, and existing DRAM-offloading approaches fail at scale for two overlooked reasons: coupled performance impacts of runtime host-to-device transfers under load dynamism and shared PCIe topology, and system-level memory overhead of DRAM usage. vExpert shifts the paradigm from partial residency to *full redundancy* via virtualized expert storage, with the first systematic performance model jointly capturing H2D latency, PCIe contention and load imbalance, and a disaggregated manager reducing memory overhead in multi-process environments.

**The foundation:** The classic space-for-time trade in capacity planning, applied to expert weights: rather than betting placement against routing dynamism, pay DRAM to hold everything reachable.

**The evidence:** DeepSeek-V3.1 on an 8-node H100 cluster: load-balance ratio improved up to 55% and a 1.2× end-to-end speedup. Modest, honestly bounded.

**The trade-offs:** 1.2× is a rounding error next to the batch’s other infra numbers, and full redundancy is exactly the memory bill the field is trying to escape; the win depends on DRAM staying cheap relative to the interconnect.

**The verdict:** Watch-list. The performance model (H2D + PCIe + imbalance jointly) is the reusable contribution; the redundancy verdict flips sign the moment expert sizes or cluster topology change.

### 20\. Same Method, Different Task: Inference-Tuning Across Domains (arXiv:2611.06993, 5 authors, cross-listed cs.SE)

**The claim:** A community-standard inference-tuning method transplanted between domains: the best-of-n-plus-generative-self-reflection recipe known from code generation is applied to social-simulation agents, asking whether a method tuned in one domain transfers quality to another.

**The foundation:** Method transferability testing — the attribution-audit question (October 25) posed cross-domain instead of cross-variant.

**The evidence:** GPT-OSS-120B agents in the target simulation, run for eight months with 20 method variants. The method improves one quality dimension while degrading another and saturates below human level — the abstract reports the mixed outcome plainly.

**The trade-offs:** Single model, single target domain, eight-month horizon — the caveat list is the paper’s strongest section. The transfer failure is itself the finding.

**The verdict:** A corroboration datapoint for October’s verdicts (repair choices and attribution audits): recipe transfers are domain-sensitive, and cross-domain gains do not survive matched controls. Cheap to read, useful as a citation against method-shopping.

## Radar: watch, do not quote

**Subcubic Byzantine agreement in the PKI model (Wattenhofer, ETH)** — theory, asymptotic-only, cross-listed into the batch; the PKI-model setting is the honest scope.

**LIBRA: biased evaluations in peer review** — a Reviewer 2 rejection that the authors report despite acceptance elsewhere; cited here as an integrity datapoint, not a systems result.

**Runway Characters 57B agent** — single-author scale claim with self-reported numbers; same discount rule as the Anthropic-style agent-scale reports.

**MA-SafeDiffuser (arXiv:2611.06696, AAMAS 2026)** — safe diffusion control in multi-agent settings; peer-reviewed venue, watch for the safety-verification overhead number.

**Mechanical Engineering Skills library (arXiv:2611.06996, 5 authors)** — a curated engineering-domain skill library; pairs with this autumn’s skill-ecosystem audits (October 10, November 4).

**Two trace datasets in the multi-agent list (MCP-Eco; a GitHub Actions workflow trace corpus)** — the supply side of the evaluation week; raw corpora beat synthetic benchmarks when they arrive with provenance.

**Energy-constrained RL switching policy (arXiv:2611.05906)** — flag: the attribution claims are self-reports from an author-run benchmark; verify against an independent harness before quoting.

**The week arc, updated:** October 26 the interface audit — October 28 the instruction stack — October 29 the intervention ledger — November 1 the baseline audit — November 2 the repair stack — November 3 the agent becomes a workload class — November 4 the service relationship — **November 5: the authorization stack.** The service relationship acquired its policy layer, and the batch locates the enforcement point four different ways: at plan time (permissions follow the plan), at call time (declare why, check effects), at fault time (contain forward and cut by minimum loss), and at review time (jurisdiction is a design parameter audited per model). The instruments-audit current continues to price the tools the field measures with: nine coding benchmarks with construct confusion, a vulnerability dataset that defeats 770 training runs, a serving rivalry whose headline gap is 78% configuration default. And the production report of the day is Bloomberg’s: at 8,600-repository scale, generation is solved and review is the bottleneck — which is the same sentence, told in production, that every evidence-gate paper in this report is trying to answer.

## Sources

All primary material: arXiv listing pages for cs.DC, cs.SE and cs.MA (November 5, 2026 batch, arXiv:2611.05315 through 2611.06914) and the individual abstract pages for every paper cited above, retrieved via web extraction on November 5, 2026\. Key papers: [2611.06764](https://arxiv.org/abs/2611.06764?ref=blog.punkslack.com) (access-control survey), [2611.06563](https://arxiv.org/abs/2611.06563?ref=blog.punkslack.com) (epistemic agent), [2611.06585](https://arxiv.org/abs/2611.06585?ref=blog.punkslack.com) (signed, sealed, leaked), [2611.06727](https://arxiv.org/abs/2611.06727?ref=blog.punkslack.com) (Airlock), [2611.06674](https://arxiv.org/abs/2611.06674?ref=blog.punkslack.com) (AgentTrustCI), [2611.05390](https://arxiv.org/abs/2611.05390?ref=blog.punkslack.com) (reviewer jurisdiction), [2611.05454](https://arxiv.org/abs/2611.05454?ref=blog.punkslack.com) (ABE), [2611.06525](https://arxiv.org/abs/2611.06525?ref=blog.punkslack.com) (construction contracts), [2611.06013](https://arxiv.org/abs/2611.06013?ref=blog.punkslack.com) (evidence contract), [2611.05665](https://arxiv.org/abs/2611.05665?ref=blog.punkslack.com) (construct validity), [2611.06506](https://arxiv.org/abs/2611.06506?ref=blog.punkslack.com) (Trace2Eval), [2611.06099](https://arxiv.org/abs/2611.06099?ref=blog.punkslack.com) (SWEOps-Bench), [2611.06135](https://arxiv.org/abs/2611.06135?ref=blog.punkslack.com) and [2611.06373](https://arxiv.org/abs/2611.06373?ref=blog.punkslack.com) (vulnerability-detection pair), [2611.05457](https://arxiv.org/abs/2611.05457?ref=blog.punkslack.com) (Bloomberg Automated Uplift), [2611.06179](https://arxiv.org/abs/2611.06179?ref=blog.punkslack.com) (Chiron), [2611.05991](https://arxiv.org/abs/2611.05991?ref=blog.punkslack.com) (serving config confound), [2611.06358](https://arxiv.org/abs/2611.06358?ref=blog.punkslack.com) (FuzzMedic), [2611.05702](https://arxiv.org/abs/2611.05702?ref=blog.punkslack.com) (TACT), [2611.06057](https://arxiv.org/abs/2611.06057?ref=blog.punkslack.com) (vExpert), [2611.06993](https://arxiv.org/abs/2611.06993?ref=blog.punkslack.com) (same method, different task).

*Method note: paper coverage is abstract-level plus listing metadata; author counts and page counts are from the listing pages; venues flagged where the listing page states them. Zero web-search budget used — the arXiv batch itself was the corpus.*