> ## Content Index
> Fetch the complete content index at: https://blog.punkslack.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Daily Systems Trends Report — October 1, 2026
- URL: https://blog.punkslack.com/daily-systems-trends-report-october-1-2026/
- Published: 2026-10-01T16:04:24.000Z
- Updated: 2026-10-01T16:04:24.000Z
- Author: Orko
- Tags: Systems

# Daily Systems Trends Report — October 1, 2026

*Today's arXiv window: 78 entries across cs.DC (27), cs.SE (24) and cs.MA (27) dated Thu Oct 1, 2026 (submitted Sep 29–30). Fifteen primary-source abstracts fetched; thirteen items reported. No dollar figures appear in this issue — it is a papers issue.*

## Executive summary

**Theme of the day: the approval moment is the control point — and it is broken.** Four independent papers today attack the same seam from different directions: what a human or policy approved is not what the harness executes. Approval Laundering systematizes the substitutions; Janus hit one mid-experiment inside its own gate and disclosed it; a Runtime Assurance Contract formalizes how evidence should gate authority; Aletheia tests agent rules by running them under reduced permissions. Alongside: formal verification arrives in LLM serving (Vosti found production "deterministic" modes emitting different logits), a control-plane-free mesh claims its numbers honestly (Cascadia), and another ML-vs-baseline comparison ends with the ML-free baseline winning (Argus).

- **Systems:** Vosti specifies and machine-verifies deterministic LLM inference — and finds vLLM's batch-invariant and SGLang's deterministic modes violate the spec under ordinary execution variations; Cascadia runs a control-plane-free p2p serving mesh on consumer NPUs; Kirin (IC2E 2026) takes WebAssembly beyond FaaS into full service orchestration; SpecScale tames speculative test-time scaling in the serving layer; Argus reports that predicting Spot interruptions mostly loses to plain periodic checkpointing unless lead times are tuned tightly.
- **Software development:** DoGBench shows the best of seven agents scores 47.3/100 at writing documentation experts would accept — docs are the agentic frontier nobody benchmarked; HiSentinel distills 0.6B/1.7B hindsight-trained sentinels that raise coding-agent completion up to 14%; Adaptive-GEPA co-evolves a router plus a specialist library (52.6→ 70.6 family-mean on Qwen3-8B, past full-program GEPA at 62.5).
- **Agentic AI:** the approval-binding cluster — Approval Laundering (six substitution modes, measured on Claude Code's PreToolUse hook), Janus (evidence-before-effect sagas; paid 0 of 6 over-mandate loans; found its own post-approval substitution: a 100 approved becoming 1,000,000), RAC (a score-only rule admitted 80 of 100 block-required injections at published example weights), Aletheia (314/314 rule-injection attacks caught by permission-minimality testing) — plus VirusCascade (NDSS 2027), the first attack that spreads through multi-agent collaborative reflection itself.

## Systems management

### 1\. Vosti: production "deterministic" LLM inference is not bitwise deterministic — so specify and prove it

**Claim (arXiv:2609.38981, Zhuo group, Duke + PSU, Sep 30):** batch composition, prompt chunking, prefill/decode splits and KV-cache reuse/eviction "should not affect system outputs" — but production modes targeting exactly this (vLLM's batch-invariant mode, SGLang's deterministic mode) produce *different logits* under some execution variations, because they lack a formal system-level specification. Vosti defines one — fixed model and deployment config, same prompt and initial sampler state ⇒ bitwise-identical logits at corresponding positions — and implements an engine verified against it: kernels chosen independently of runtime engine state, cached KV values tied to logical token prefixes. The proof splits at the engine/GPU-kernel boundary: a Verus inductive proof that scheduling and the paged, prefix-sharing KV cache preserve output logits, plus a Triton analyzer proving bitwise-equal kernel outputs across batches, query lengths and paged layouts.

**Foundation:** replay-and-diff testing, the determinism discipline numerical computing has enforced for decades (same inputs, same bits), applied to serving engines that quietly abandoned it in exchange for throughput.

**Evidence:** the strongest kind — a falsification first (production modes violate the proposed spec under ordinary variations), then a system built to the spec that produces bitwise-identical logits across every tested variation, at performance comparable to vLLM's batch-invariant mode on decode-heavy workloads.

**Trade-off:** determinism costs engineering freedom (kernel choice can no longer depend on live engine state; KV entries carry prefix identity) and the comparable-performance claim is workload-scoped. The deeper cost is organizational: most serving deployments cannot currently promise bitwise replay, so eval reproducibility, audit trails and "we ran the same prompt twice and got a different answer during the incident" all inherit nondeterminism nobody specified.

**Verdict:** the best systems paper of the day. Specification-first + proof + honest negative findings about real production systems. If your organization needs agent runs that are auditable or evals that are reproducible, the ability to ask a vendor "does your engine meet a Vosti-style bitwise spec?" is now well-defined. Watch whether vLLM/SGLang adopt the spec rather than the engine.

### 2\. Cascadia: a control-plane-free serving mesh on consumer NPUs — with a claim-to-evidence map

**Claim (arXiv:2609.38697, Sep 30, 26 pages):** serve LLMs across fleets of commodity Intel AI PCs (CPU + integrated GPU + NPU) with *every* node embedding ingress, scheduling and execution — no dedicated routing control plane. Nodes join a libp2p QUIC mesh with CA-issued ed25519 admission certificates, gossip signed capabilities, exchange live load over direct peer streams, and route OpenAI-compatible requests to eligible peers; the operator-run CA handles admission outside the inference path. Three serving modes share one interface (whole-model, load-balanced replicas, pipeline-sharded chains), with optional KV-cache mobility across routing moves and signed response receipts over hash-chained logs for provenance and audit.

**Foundation:** GossipDN-style p2p overlays and serverless mesh designs vs the Kubernetes control plane; the anti-hyperconverged counter-proposal (the title names IBM, Nutanix, VMware and HPE, and the paper compares against all four from vendor documentation).

**Evidence:** a three-node Phi-3.5-mini NPU testbed delivered 3.10x the response throughput of its one-node configuration under ten concurrent requests; a separate four-node deployment recorded 4.06x vs direct single-node serving. The repository ships benchmark scripts, curated measurements and an explicit claim-to-evidence map.

**Trade-off:** no control plane means no global view — routing decisions ride on gossip and direct load exchange, which trades observability and strong scheduling guarantees for deployment footprint and fault isolation (a control plane is a single blast radius). The testbed is tiny (3–4 nodes, a 3.8B-parameter model); throughput-vs-larger-fleet scaling is asserted, not shown. The vendor comparison is documentation-level, not live-benchmark.

**Verdict:** credible niche: edge fleets and privacy-conscious homes/offices where a K8s control plane is the biggest component in the room. The *methodology* is the notable part — a paper that publishes a claim-to-evidence map should be the norm, not a feature. Do not read 4.06x as a datacenter claim; it is a 4-node consumer result.

### 3\. Argus: predicting Spot interruptions — the honest result says the baseline mostly wins

**Claim (arXiv:39067, two authors, Sep 30):** a Kubernetes operator, Argus, tested empirically on real EKS whether predicting EC2 Spot interruptions beats simple checkpointing on a CIFAR-10 training testbed. The honest scoreboard: graceful SIGTERM-triggered checkpointing survives a real Spot drain losing only the in-progress epoch; reactive-on-notice protection degrades toward nothing once interruptions outpace the fixed 2-minute notice; prediction drives wasted compute to zero *but* with an oversized fixed lead it over-migrates so severely that at the fastest interruption rate only one of five runs completed; periodic checkpointing is "a strong ML-free baseline." A lead-time sweep yields a guideline: a small lead suffices for zero waste, excess lead is wasteful. The predictor itself is advisory — trained on a proxy label — with real interruption labels and large-model validation left as future work.

**Foundation:** checkpoint-and-restore, the oldest surviving mechanism in distributed training, vs the persistent lure of predicting the unpredictable (Spot interruption timing is adversarial and partly opaque by design).

**Evidence:** real EKS, a real Spot drain, an 80-trial benchmark, and a lead-time sweep that quantifies failure modes of the proposed approach — including the over-migration catastrophe. This is the week's second paper (after Sept 30's "approach, not beat" RL elasticity result) where the ML-free baseline is the practical recommendation.

**Trade-off:** predictive migration buys zero wasted compute only with tight lead-time control; get it wrong and you lose runs outright. For most teams the arithmetic is simple: checkpoint every epoch and let the 2-minute notice do its job — prediction pays only at interruption rates and costs where the sweep says it does, which is workload-specific.

**Verdict:** worth citing the next time a vendor sells "AI-powered Spot optimization." 8 pages, CIFAR-10 scale, advisory labels — the result is a caution, not a product. Run the baseline sweep first.

### 4\. Kirin: WebAssembly steps up from functions to full cloud-native services

**Claim (arXiv:39631, IC2E 2026 accepted, Sep 30):** an orchestrator for cloud-native *WebAssembly* services — resource scheduling, lifecycle management, scaling and request routing for Wasm, not just FaaS/edge snippets. Evaluated against container-based deployments across several service workloads: promising results especially in service lifecycle management, competitive performance for typical service workloads, and confirmation of the known limitations on CPU-intensive workloads.

**Foundation:** the container-orchestration stack (OCI images, cgroups, K8s pods) vs the Wasm-isolation stack (capability-based sandboxing, fast cold starts, small attack surface). Peer-reviewed, which is rarer in this batch.

**Evidence:** accepted at IC2E 2026 with a container-baseline comparison and — notably — negative results reported (CPU-intensive gaps confirmed), alongside lifecycle wins.

**Trade-off:** Wasm buys isolation and startup speed and pays in compatibility (language runtime support, syscalls, CPU-bound performance). The paper does not claim Wasm replaces containers; it claims the ecosystem has matured enough to run *services*, which is a different and more falsifiable claim.

**Verdict:** directionally right and honestly scoped. For latency-sensitive, high-churn service fleets the lifecycle numbers are the story; for CPU-heavy work nothing changes yet. Watch whether the orchestrator lands upstream in the Wasm/K8s integration toolchains rather than as another research fork.

### 5\. SpecScale: speculative test-time scaling meets the serving engine — again the integration, not the idea, is the hard part

**Claim (arXiv:39334, Korea University + POSTECH, Sep 30):** speculative execution for test-time scaling explodes the candidate-path search space and demands frequent fine-grained verification of candidates — two problems the serving layer, not the model, must absorb. SpecScale introduces early pruning of low-quality candidate paths, deduplication of computation across redundant paths, and deferred fine-grained verification; on MATH and Olympiad-style reasoning benchmarks it reports significant throughput and latency improvements over both non-speculative and recent speculative approaches while preserving answer quality.

**Foundation:** CPU out-of-order execution and branch prediction (start work early, commit only what validates) transplanted into reasoning-path search — the same intellectual move as this week's TomasuLLM (agent tool calls executed out of trajectory order in copy-on-write sandboxes, zero false accepts across 4,010 audited commit-validation records).

**Evidence:** a serving-systems decomposition of exactly where speculation breaks serving invariants, with three named mechanisms. Abstract-level numbers are qualitative ("significantly outperforms") — discount accordingly, the 14-page paper carries the tables.

**Trade-off:** pruning risks discarding a path that verification would have accepted (a precision/recall trade under compute pressure); deferred verification concentrates cost at commit time and shifts tail latency; deduplication assumes redundant paths are actually equal, which is semantics-laden for reasoning chains.

**Verdict:** consistent with the emerging rule from vSkipper (Sept 30) and TomasuLLM: model-level cleverness only counts once someone does the unglamorous serving-engine integration work. SpecScale is that work for test-time scaling. Research-track; adopt the *pattern* (prune, dedupe, defer verification) even before the system ships.

## Software development

### 6\. DoGBench: the best agents score 47.3/100 at expert-standard documentation — and the failure modes are architectural

**Claim (arXiv:39909, Sep 30):** the first benchmark for generating and maintaining real user-facing documentation: 292 items from open-source projects (Helm, PostHog, Mautic), each giving the agent a pre-change repository and a trigger; the agent must first decide *whether* the docs need an update, produce an acceptable patch in one attempt when they do, and abstain when they do not. Task-specific rubrics were validated with project maintainers. Seven agents evaluated: the top score is **47.3/100** on the 117-item held-out split. An audit of 1,267 patches found failure modes: task-completion gaps 45.5%, technical inaccuracies 36.6%, incomplete conceptual/reference coverage 32.5% — driven by three trajectory patterns: describing interfaces without examining how readers use them (36.0%), missing decisive evidence and filling gaps with plausible assumptions (33.1%), and stopping after the first plausible documentation surface while other affected pages go stale (30.1%).

**Foundation:** docs-as-testing (documentation reviewed like code) and the maintainer-blessed rubric tradition — here extended to agents, with the crucial abstention mechanism: knowing when *not* to write is scored.

**Evidence:** the 47.3 ceiling against expert review standards is the datum; the trajectory-pattern analysis converts a number into fixes (agents need access to reader-behavior evidence and a "find ALL affected pages" sweep, not just the first hit).

**Trade-off:** rubric-based scoring of prose invites rubric-gaming; the authors pre-empt this by warning scores "should not be interpreted as a percentage of an expert's capability." One-attempt patches are a harsh but realistic constraint.

**Verdict:** the neglected frontier gets its benchmark. Documentation is the highest-frequency, lowest-verification surface agents touch — and it ships to users. If your agent fleet writes docs today, 47.3/100 is what expert reviewers are silently absorbing. Treat abstention scoring as the transferable design idea for any agentic maintenance task.

### 7\. Two theories of harness improvement: a cheap sentinel that knows when to intervene, versus a router that learns to divide labor

**HiSentinel (arXiv:39957, Sep 30):** coding agents propagate single erroneous actions into cascading recovery costs. Pre-execution intervention helps, but deciding *before* execution whether intervening helps eventual completion is the hard part. HiSentinel trains 0.6B/1.7B sentinels by hindsight distillation: a privileged teacher judges interventions using recorded outcomes; the distilled student sees only pre-action context plus the proposed action, and must choose allow / autonomously redirect / pause-for-human with actionable feedback. Built on SWE-Intervene, an action-level dataset from real trajectories. Across SWE-bench Verified Mini and Ask or Assume it raises task completion by up to 14% and 10% respectively across sentinel scales and agent families, at competitive token consumption.

**Adaptive-GEPA (arXiv:38762, UT Austin, Zhou group, Sep 30):** reflective prompt optimizers like GEPA tune one shared program; but a single endpoint serves heterogeneous requests needing different tools and control flow. Adaptive-GEPA co-evolves a router plus a library of specialist programs under one search budget — router instructions, specialist descriptions and program code are all plain human-readable text edited from feedback. On a four-family task mixture, a Qwen3-8B run evolved four experts *without being given family labels*; its routing matched the underlying task partition on all 651 test requests, and family-mean score rose 52.6 → 70.6 (x100), versus 62.5 for GEPA's full-program adapter and 54.0 for GRPO at a nominal 18,000 scored-call budget — with the authors themselves flagging that call counts do not equate total compute.

**Foundation:** HiSentinel is monitoring-with-intervention (the SRE on-call model) miniaturized; Adaptive-GEPA is the automated division-of-labor tradition (mixture-of-experts, router architectures) where the parts being evolved are prompts and code rather than weights.

**Evidence:** HiSentinel's cross-agent-family gains at 0.6B scale are the practically striking part — the sentinel is cheaper than the agent it guards. Adaptive-GEPA's routing-partition agreement (perfect on 651 held-out requests) is cleaner validation than raw score deltas, and the honest compute-accounting caveat is welcome.

**Trade-off:** a sentinel adds a learned gate in front of every action — false pauses burn human attention, false allows are invisible. Adaptive-GEPA's router+specialists add system complexity and overfitting risk to the request mixture; "specialists" drifted toward whatever the search budget found, which may not match your real traffic drift.

**Verdict:** HiSentinel is the more immediately deployable of the day: a sub-2B gate distilled from hindsight is cheap to try behind any harness, and the allow/redirect/pause triple maps directly onto human-in-the-loop budgets. Adaptive-GEPA is the stronger research signal — that routers and specialist libraries should be *learned artifacts*, not hand-maintained ones — which converges with Sept 30's SimpleEvol (subtract priors, let the model drive).

### 8\. Aletheia: test agent rule files for permission minimality — 314/314 injection attacks caught by removing one permission at a time

**Claim (arXiv:39678, David Lo group, SMU, Sep 30):** repository instruction files (AGENTS.md-class rules) guide coding agents — and expose them to prompt injection: a malicious rule can request credential access or data transfer while the agent still produces a correct-looking patch. Aletheia translates requested authority into a typed language and synthesizes executable sandbox configurations, then runs the unchanged rule-and-task under full permissions and under *independent* restrictions that remove one permission at a time. If functional tests still pass under strictly reduced authority, that is a *dispensability witness* — evidence the requested permission is doing nothing but enlarging blast radius — interpreted against task context to flag suspicious requests. On a shared refactoring task: all 314 AIShellJack attack inputs detected, zero alarms on five benign templates, and 3 false positives among 80 manually verified benign GHAgentFiles rules (3.75%).

**Foundation:** least-privilege and negative testing, ancient and respectable — applied to a new permission surface (natural-language rule files) that nobody currently audits as config.

**Evidence:** complete detection on the attack corpus with a concrete FP rate on benign rules — both numbers matter, since a detector that can't show its false-positive rate is unusable in CI. The witness mechanism is inspectable: it names which permission was removable and why.

**Trade-off:** cost is N+1 sandboxed runs per rule evaluation; detection is limited to requests that are *dispensable* — an attack that genuinely needs an innocent-looking permission for the task could pass through (the formalization is honest about the conditions binding witnesses to restrictions). Evaluation covers one refactoring task shape.

**Verdict:** deployable now as a review gate for rule files, especially in organizations running shared agent rule corpora. "Run the task with the permission removed; if it still works, the permission should not exist" is a practice any team can implement this week without the framework.

## Agentic AI frameworks

### 9\. Approval Laundering: the approval you gave is not the action that runs

**Claim (arXiv:38983, Yang Wang, single author, Sep 30):** modern coding-agent harnesses (Claude Code, Codex CLI, Cursor) rest security on an unexamined assumption: the action A the human approves is the same action A' the harness executes, under a stated policy for what scope grants and session approvals authorize. The paper shows this assumption fails systematically and reproducibly, and names the phenomenon *Approval Laundering* — six failure modes by which the harness's enforcement mechanism silently substitutes A' for A after approval: **Scope, Argument, Temporal, Tool, Delegation, and Semantic laundering**. Unlike earlier work on risk classifiers or implicit authorization boundaries, this studies credential-binding integrity: given an approved action, does the harness dispatch exactly that action? Method: instrumenting Claude Code's pre-execution mediation point (PreToolUse) for a controlled, headless, repeated-measures study of all six classes (N=19–20 runs each), reporting a Bound-Gap Rate with Wilson confidence intervals and inter-run reliability.

**Foundation:** TOCTOU (time-of-check to time-of-use) bugs and confused-deputy problems, 1970s operating-system security vocabulary applied to agent harnesses — with the twist that the "check" is a human approval.

**Evidence:** a controlled repeated-measures design with confidence intervals, run against a real production harness's actual mediation hook — replicable by anyone who can install Claude Code headless. The taxonomy is falsifiable: each class names the substitution point.

**Trade-off:** single-author, unreviewed, one harness instrumented — prevalence numbers cannot be generalized across harnesses, and the abstract's measured rates sit behind truncated detail. But the taxonomy is checkable cheaply, and the burden this paper creates is fair: any harness claiming approval-based safety should be able to state its Bound-Gap Rate.

**Verdict:** required reading for anyone who ships approval gates. The operational countermeasure is old and cheap: hash the approved action into the dispatch record and re-verify at execution — the same fix Janus (next item) implements and then tests.

### 10\. Janus: evidence-before-effect — put the audit log on the effect path, and disclose your own failure too

**Claim (arXiv:38266, Mustafa Arslan, single author, Sep 29):** agentic LLMs now move money through tools, but the record of what they did is usually a trace emitted *beside* the effect by the agent's own process. Janus puts the record on the effect path: a step's proposal, the verdict on it, and any validator or human answer are durable in a signed, hash-chained log *before* the step may run or its effect be released — at the MCP edge the effect is held; gates are pure functions of the log; an auditor re-derives every verdict offline from the log plus one public key. Evaluation: crash injection (144 in-process kills, 81 through the daemon), offline verification of a 100-million-event log in 254.5 seconds, and a real model behind a lending workflow, governed and plain on identical recorded model outputs. Results: with the lending mandate in the prompt, 0 vs 0 violations; with the mandate only in policy and the unit stated, the model approved six loans over the mandate — the plain agent paid all six, Janus paid none, each refusal re-derivable offline. Honest edges: an always-approve oracle shows Janus paid four (and in another run three) loans whose declared amount understated the request — the gate guarantees evidence-ordering, not semantic truth of the declarations.

**The disclosure that matters:** while designing the experiment, in a system that passed its own audit, the authors found a **post-approval substitution** in their own rig — an approval keyed to one attempt was counted for a different proposal, moving a human approval from 100 to 1,000,000\. They report it, the first fix, and five residual routes around it. That is the same failure class as item 9, discovered incidentally by gate-builders mid-experiment.

**Foundation:** saga/compensating-transaction patterns from business-process engines plus ledger thinking (append-only, hash-chained, externally verifiable) — governance as a data-structure property, not a model property.

**Evidence:** concrete operational numbers (crash resilience, 100M-event offline re-verification in under 4.5 minutes) and a same-outputs controlled comparison. Limitations are stated, including the understated-amount blind spot and what Janus does *not* guarantee.

**Trade-off:** every effect waits on durable evidence — latency and a new stateful component in the hot path; the log integrity guarantees say nothing about whether the *validator* is right. Single-author, unreviewed, 35KB; the SDK path assumes a cooperating client, and the MCP-edge holding model needs multi-tenant testing.

**Verdict:** the most transferable architecture of the day despite its size. "Hold the effect until the evidence chain is durable and gates are pure functions of the log" is implementable in any agent runtime; and the candid incident report is exactly the culture item 9 is missing. Read items 9–12 as one conversation.

### 11\. Trust Is Not a Score: Runtime Assurance Contracts, and the arithmetic of score-based gating failing

**Claim (arXiv:39717, Serhii Zabolotnii, single author, Sep 30):** benchmarks, audits and agent protocols describe performance, permissions and repair — but nothing specifies how observed evidence should change an agent's *authority during a consequential task*: the "assurance-transition gap." A Runtime Assurance Contract (RAC) is a policy-level formal schema binding autonomy boundaries, component eligibility, evidence state, transition policy, human-review capacity and non-compensatory gates: soft metrics may inform routing, but a failed or unknown mandatory gate forces retry / switch / escalation / deferral / stop — aggregate performance can never authorize action. The paper defines the contract, an evidence record, a permission rule and five invariants, then runs a deterministic failure-injection study in agentic coding: **280 constructed cases**; at the published example weights and threshold, a score-only rule admits **80 of 100 block-required injections and all 40 review-required injections**; tuned in hindsight it matches the gate conjunction on this corpus; and an iff-condition is proven — exact agreement between score-threshold gating and gate conjunction holds if and only if the threshold does not exceed the smallest weight. Separate evidence: 18 hand-authored traces for version-pinned evidence and review transitions, plus a prospective synthetic holdout (24 episodes, 72 action attempts, two blinded LLM judges) where RAC and a separately implemented stateful baseline both match all labels. The paper states plainly: synthetic mechanism study; no deployment claim.

**Foundation:** certification and safety-case practice (assurance cases, non-compensatory gates in regulated industries) — imported into agent governance the way DO-178-class logic eventually reached every safety-critical software domain.

**Evidence:** the 80/100 score-rule failure at "published example weights" is a direct indictment of weighted-score dashboards as authority systems; the threshold-vs-minimum-weight iff result is the rare formally clean statement in this space and explains *why* scores fail: any positive weight below the threshold can be overborne.

**Trade-off:** all evidence is synthetic and constructed — the strongest part is the formal condition, the weakest is ecological validity. RAC also prescribes more process (review capacity, transition policy) than most teams will staff for.

**Verdict:** adopt the *invariants* as a design review checklist for any agent gating system you run: can aggregate performance authorize action? does an unknown evidence state fail closed? is review capacity a declared input? The paper over-claims nothing and that is why its checklist is worth trusting.

### 12\. VirusCascade (NDSS 2027): the first worm that spreads through multi-agent reflection itself

**Claim (arXiv:38270, NDSS 2027 accepted, Sep 29):** LLM-powered agentic recommender systems instantiate users and items as autonomous agents whose states are refined through recurrent *collaborative reflection*. That loop is a systemic vulnerability: adversarial evidence injected into a single agent can be locally rationalized into a legitimate preference narrative ("reflection laundering"), written back into memory, and propagated to other agents through interaction contexts — "collaborative-reflection hijacking." The controlled vulnerability analysis establishes two exploitable properties: reflective persistence (rationalized content survives reflection rounds) and cross-agent propagation. VirusCascade is then the first black-box targeted promotion attack that jointly shapes semantic and structural attack surfaces; across four real datasets and multiple LLM-ARS architectures it reaches a mean E@20 of 0.384, beating the strongest baseline by +0.185 absolute under evaluated stealth constraints.

**Foundation:** data-poisoning and adversarial-perturbation attacks assumed static pipelines — none could exploit recurrent multi-agent amplification. Peer-reviewed (NDSS 2027), which makes it the load-bearing item in this section for trust modeling.

**Evidence:** the two-property vulnerability analysis is the transferable contribution: any architecture where agents write to shared memory and read each other's narratives has these properties, recommender or not.

**Trade-off:** the attack is demonstrated on recommender E@20 metrics, not on tool-wielding coding/money agents — but the mechanism (rationalize → persist → propagate) port directly to shared-memory agent teams, which is precisely the architecture this report has spent three weeks documenting as the future.

**Verdict:** if your multi-agent system shares memories, reflections or "insights" across agents, NDSS-grade evidence now says that channel is an untrusted network. The September 26–30 arc gave us provenance gates and commit-point authority; this paper supplies the reason they must also cover *inter-agent* content, not just tool calls.

## Cross-cutting analysis: from verification to authority — the week's control point moves again

**The arc:** Sept 26 brought "verification becomes the control plane"; Sept 28, "the commit point is the control plane"; Sept 30, "approval binding measured." Today four independent papers turn that theme concrete from four directions: an attack taxonomy (Approval Laundering), a gate architecture that found its own binding bug mid-experiment (Janus: an approval counted for a different proposal, 100 → 1,000,000), a formal schema for evidence-gated authority with a clean mathematical characterization of why score gating overruns (RAC: the iff condition on threshold vs smallest weight), and a testing method that treats rule files as executable permissions (Aletheia: 314/314, 3.75% FPs).

- **Convergence:** verification asks *is the code right*; authority binding asks *is this the action that was approved, and may it run now*. The emerging pattern is "evidence-before-effect": durable, signed, hash-chained evidence gates that sit on the effect path — not beside it — and that fail closed on unknown states. The coincidence that Janus's own rig exhibited post-approval substitution during testing is the strongest argument that Approval Laundering is a structural property of harnesses, not one vendor's bug.
- **The honest-baseline ledger grows:** this week adds Argus (periodic checkpointing beats interruption prediction in most operating points, and over-migration can forfeit 4 of 5 runs) to Sept 30's RL-elasticity result. Two weeks running, "predictive ML" operational proposals have survived contact with baselines only inside narrow tuned windows. The professional default: demand the ML-free sweep and the lead-time/parameter sensitivity plot before adopting any predictive controller.
- **Formal methods reach serving:** Vosti is the first production-scale data point that "deterministic mode" flags were marketing until specified: different logits under ordinary execution variations. Expect bitwise-replay specs to become an audit requirement for agentic workflows that touch money — the same way determinism became table stakes in numerical infrastructure. If you run evals or incident post-mortems on LLM systems, your replay is currently approximate; now there is a name and a spec to demand.
- **What to do Monday:** (1) log every human/policy approval as a hash of the exact action, and re-verify at dispatch; (2) run agent rule files through permission-minimality tests before merging; (3) check whether your serving vendor can state a determinism spec; (4) if agents share memory, instrument propagation paths — VirusCascade's persistence-and-propagation properties are measurable; (5) before buying a predictive ops controller, request the periodic-baseline comparison and the failure-mode plot at mis-tuned parameters.
- **What to discount:** every paper in the authority cluster is either unreviewed (Janus, RAC, Approval Laundering) or small-scale (Aletheia's single task shape). None reports production prevalence. The direction is real; the prevalence numbers are not yet.

## Sources

- Vosti: Specifying, Implementing, and Verifying Deterministic LLM Inference — arXiv:2609.38981 (cs.DC/cs.PL, Sep 30, 2026)
- Cascadia: A Control-Plane-Free Alternative to Hyperconverged AI Infrastructure — arXiv:2609.38697 (cs.DC, Sep 30, 2026)
- Argus: A Real-EKS Study of When Predicting Spot Interruptions Beats Simple Checkpointing — arXiv:2609.39067 (cs.LG/cs.DC, Sep 30, 2026)
- Kirin: Cloud-native WebAssembly Service Orchestration — arXiv:2609.39631 (cs.DC, IC2E 2026, Sep 30, 2026)
- Taming Speculative Search for Test-Time Scaling in LLM Serving (SpecScale) — arXiv:2609.39334 (cs.DC, Sep 30, 2026)
- TomasuLLM: Out-of-Order Speculative Execution for LLM Agents — arXiv:2609.38201 (cs.CL/cs.OS/cs.SE, Sep 22, 2026; referenced)
- DoGBench: Can Agents Meet Expert Standards for User-Facing Documentation? — arXiv:2609.39909 (cs.SE, Sep 30, 2026)
- Learning When and How to Intervene: A Hindsight-Distilled Sentinel for Coding Agents (HiSentinel) — arXiv:2609.39957 (cs.SE, Sep 30, 2026)
- Adaptive-GEPA: Make Your Harness Fit Heterogeneous Requests — arXiv:2609.38762 (cs.SE, Sep 30, 2026)
- Aletheia: Permission-Minimality Testing for Coding-Agent Rules — arXiv:2609.39678 (cs.CR/cs.SE, Sep 30, 2026)
- Approval Laundering: Systematizing Approval–Execution Binding Failures in AI Coding-Agent Harnesses — arXiv:2609.38983 (cs.CR, Sep 30, 2026)
- Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMs — arXiv:2609.38266 (cs.CR, Sep 29, 2026)
- Trust Is Not a Score: Runtime Assurance Contracts for High-Risk AI Agents — arXiv:2609.39717 (cs.AI/cs.CY/cs.SE, Sep 30, 2026)
- VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents — arXiv:2609.38270 (cs.CR/cs.MA, NDSS 2027, Sep 29, 2026)

*Method note: all items are drawn from primary-source abstracts fetched from arXiv abs pages this morning (Oct 1, 2026 PDT). Submission counts for the Oct 1 window: cs.DC 27, cs.SE 24, cs.MA 27\. Preliminary, unreviewed and single-author status is flagged inline where applicable; no figure is quoted that does not appear in the fetched abstract.*