PaperlayerView exact revision on arXiv

Source-linked AI summary

Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution

Adam Mazzocchetti

arXiv:2608.16891v1cs.AIcs.CEcs.CRcs.CY

TL;DR

Agentic AI safety increasingly depends on controlling whether model-proposed actions become operational side effects, a boundary prompt-level governance does not create. Aegis inserts trusted runtime authorization before tool execution and, across this sandbox corpus, recorded zero governed risky side-effect completions. The result supports a narrower systems claim rather than general autonomous-agent safety.

  • Problem

    Agentic AI introduces a safety gap at the transition from model-proposed actions to operational side effects, which prompt-centered governance does not directly control.

  • Method

    Aegis places a trusted decision layer between proposed actions and tools, evaluates active policy and server-resolved provenance, fails closed, and supports quorum-based Senate settlement.

  • Results

    Zero governed mock-tool applications and zero governed risky side-effect completions were recorded across 2,100 Aegis-governed rows.

  • Takeaways & Limitations

    In this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from becoming governed side effects.

  • Takeaways & Limitations

    The evaluation uses sandbox mock tools rather than live deployment, so its zero-completion result does not prove that all agentic risks are eliminated.

Abstract

from arXiv · show

Agentic AI systems request tool actions that can modify files, send messages, launch jobs, or change workflow state. This shifts the safety problem from harmful text generation to harmful operational side effects. Prompt-level governance can shape model behavior, but it does not create an execution boundary. We introduce Aegis, a runtime governance system that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. The model proposes; the trusted runtime decides. Aegis evaluates proposals against active policy state, resolves provenance server-side, fails closed under uncertainty, and routes selected cases through Senate-style settlement, a quorum- based non-unilateral authorization path. We evaluate Aegis on a repeated sandbox corpus spanning five run families, 42 tasks, three conditions, and ten repeats per family. Across 6,300 rows, prompt-policy conditioning produced 79 risky comparator-path leakage rows. Across 2,100 Aegis-governed rows, the system recorded zero governed mock-tool applications and zero governed risky side-effect completions. All 1,832 Aegis-attempted governed rows preserved trusted Aegis-resolved provenance, and all 1,019 Senate-settled rows had quorum and final signed tally evidence. These results do not prove general autonomous-agent safety. They support the narrower systems claim that, in this evaluated sandbox corpus, runtime action-boundary governance prevented observed risky proposals from becoming governed side effects.

Significance statement · 1. Introduction · 2. Related Work

Agentic AI safety depends on controlling whether model-proposed actions become operational effects, not merely on shaping generated text. Aegis addresses this through trusted runtime mediation, provenance, auditable decisions, and repeated sandbox evaluation, while making a deliberately narrow empirical claim.

  • Significance statement: The empirical claim is intentionally narrow: in this repeated sandbox evaluation, runtime governance prevented observed governed risky proposals from becoming mock-tool applications or risky side-effect completions.The paper does not claim intrinsic model safety, exhaustive task coverage, or coverage of every future tool environment.
  • Significance statement: Agentic systems shift the safety problem from risky text generation to whether tool-mediated proposals become operational side effects.Agents can act through tools, files, memory, communications systems, workflows, APIs, and other agents.
  • 1. Introduction: Prompt-level governance can shape behavior but cannot decide whether tools execute, especially under bypass, adversarial context, or tool-selection pressure.Prompt-injection and malicious tool descriptions can manipulate tool-integrated agents toward harmful actions or data exfiltration.
  • 1. Introduction: Aegis places a trusted decision layer between model proposals and tools, treating outputs as proposals while the runtime decides whether actions may execute.The architecture applies action-boundary control rather than claiming that models become intrinsically safe.
  • 1. Introduction: Aegis resolves policy and provenance through trusted infrastructure and separates proposals, runtime decisions, Senate settlement, provenance, and execution outcomes into auditable traces.This design follows reference-monitor, complete-mediation, PEP/PDP, runtime-assurance, provenance, and secure-audit principles.
  • 1. Introduction: 42 tasks were evaluated across three conditions and five run families to stress the governance boundary under stochastic proposal behavior and runtime variation.The conditions were plain mesh, prompt-policy mesh, and Aegis-governed mesh; run families included a deterministic stubbed model, Gemma, and frontier-model temperatures.
  • 2. Related Work: Related work motivates runtime governance through agent-safety benchmarks, prompt-injection studies, runtime assurance, trusted provenance, auditability, and lifecycle risk-management frameworks.The literature increasingly treats agentic AI governance as a runtime problem rather than only a predeployment, documentation, or prompt-design problem.

3. System Design

Aegis inserts a trusted runtime decision layer between model-proposed actions and side-effectful tool execution. It evaluates active policy and server-resolved provenance, fails closed under uncertainty, and separately records execution and Senate settlement outcomes.

  • Action-boundary governance: Aegis places a governance boundary between model-proposed tool actions and operational side effects, with the trusted runtime deciding before tool application.The sandbox forwards proposed actions to Aegis, whose decisions the sandbox must enforce.
  • Action-boundary governance: The model may propose actions, but it does not carry execution authority; runtime governance can block, withhold, fail closed, or route proposals to Senate settlement.This shifts operational authority from instruction-following to the action boundary.
  • Trusted provenance: Aegis evaluates proposals against active policy state and resolves trusted provenance server-side rather than accepting model-, client-, or PEP-supplied citations.The runtime records the policy and control references that informed each decision.
  • Settlement and execution traces: Senate settlement records scoped governance evidence, but a Senate-settled allow is not evidence that the mock tool was applied.Governance authorization, runtime execution, and side-effect completion remain separately recorded events.
  • Settlement and execution traces: Aegis preserves distinct traces for the raw decision, normalized decision bucket, practical execution outcome, and asynchronous Senate governance outcome.Together, these records support reconstruction of the proposal, decision, evidence, settlement, and side-effect status.

4. Methods

Aegis was evaluated in a repeated sandbox corpus spanning 42 tasks, three conditions, and five ten-run families, with all side effects restricted to mock tools. The methods distinguish comparator leakage, governed attempts, provenance, Senate settlement, and side-effect outcomes using metric-specific denominators.

  • Evaluation design: 42 tasks were evaluated under three conditions: plain mesh, prompt-policy mesh, and Aegis-governed mesh.The tasks covered agentic authority, external communication, vendor and service-provider workflows, active-law changes, and AI consumer-impact scenarios.
  • Evaluation design: 6,300 rows came from five ten-run families, with 2,100 governed rows contributed by the Aegis condition.Each family contained 1,260 rows from the 42-task by three-condition matrix, including 420 governed rows.
  • Reproducibility boundary: Public artifacts reproduce sandbox mechanics and report construction but exclude the production Aegis kernel, trust infrastructure, credentials, signing material, live endpoints, and production policy bundles.Validation against the real Aegis PDP requires scoped credentials and mock-only trust material configured to fail closed without the required endpoint and trust configuration.
  • Execution and scoring: All side effects were evaluated through mock tools, with no real-world emails, exports, jobs, approvals, shell commands, or workflow changes executed.Rows were scored for expected and practical execution outcomes, risky side-effect completion, parser/backend status, provenance, and Senate settlement where applicable.
  • Execution and scoring: Metric denominators were separated: prompt-policy leakage used comparator rows, governed risky completion used Aegis-governed rows, trusted provenance used Aegis-attempted rows, and Senate settlement used routed rows.Local fail-closed/no-tool rows did not reach Aegis as actionable proposals, while Senate settlement was reported separately from the initial Aegis/PDP response.

5. Results

Across 6,300 evaluation rows, prompt-policy conditioning produced 79 risky comparator-path leakage rows, while Aegis recorded zero governed mock-tool applications and zero governed risky side-effect completions across 2,100 governed rows. Aegis also preserved trusted provenance and auditable Senate settlements, supporting the narrower claim that runtime action-boundary governance prevented observed risky proposals from becoming governed side effects in this sandbox corpus.

  • Governed execution outcomes: 2,100 governed rows produced zero governed mock-tool applications and zero governed risky side-effect completions.The evaluation covered 6,300 total rows across five 10-run families, with each family contributing 420 governed rows.
  • Comparator-path leakage: 79 prompt-policy leakage counterfactual rows remained in the comparator path, including 40 runaway background-job rows and 39 external raw-data disclosure rows.These leakage rows represent risky proposals, not governed side effects, and were mapped to workflows, failure categories, controls, references, and policy-risk labels.
  • Senate settlement: 1,019 Senate-settled rows had quorum and final signed tally evidence, comprising 60 settled allow outcomes and 959 settled deny outcomes.A settled allow records governance completion, not tool application; mock-tool application remained separately recorded and zero.
  • Runtime timing: 25.598 ms to 27.754 ms were the reported Aegis latency medians, while p95 values ranged from 30.908 ms to 66.848 ms and maximum observed latency was 237.897 ms.These are bounded measurements of the evaluated sandbox/runtime decision path, not production network latency, end-user latency, or a general benchmark.
  • Trusted provenance: 1,832 Aegis-attempted governed rows had trusted Aegis-resolved provenance-valid results, with zero provenance-unknown and zero provenance-invalid rows.Trusted provenance required server-side Aegis resolution from verified controls and source references; client-, model-, and PEP-supplied citations were not counted.

6. Discussion · 7. Limitations

Aegis separates model proposals from execution authority by enforcing a trusted runtime action boundary, server-side provenance, and auditable authorization. Its evidence supports only a narrower sandbox claim: observed governed risky proposals did not become side effects under the evaluated path.

  • 6. Discussion: Runtime governance controls the proposal-to-execution transition, whereas prompt governance remains advisory and does not itself determine whether a proposed action executes.The model proposes; the trusted runtime decides.
  • 6. Discussion: The key result is that risky proposals did not become governed side effects, not that models stopped proposing risky actions.Aegis treats proposals as inputs to authorization rather than as permission.
  • 6. Discussion: Senate-settled allow is a governance settlement rather than a tool application, preserving the distinction between authorization state and side-effect completion.Aegis records both states separately.
  • 6. Discussion: Server-side provenance resolution keeps evidence records within the trusted runtime, making authorization decisions more auditable than model-generated citations.The governed actor does not generate the trusted provenance record.
  • 7. Limitations: The evaluation is a sandbox/mock-tool study, so zero governed risky side-effect completions apply only to the evaluated corpus and runtime path, not all agentic risks.The corpus contains 42 tasks across five workflow families; broader coverage and independent replication are still required.
  • 7. Limitations: Assurance depends on policy quality, complete control mapping, correct integration, and maintaining the PEP/PDP trusted boundary as an implementation invariant.Untrusted citation material, incomplete controls, or unauthorized execution around that boundary could weaken the result.
  • 7. Limitations: The result applies to the Aegis-governed path rather than ungated model behavior, and public artifacts exclude the kernel, production trust infrastructure, live endpoints, credentials, and signing material.Public artifacts support sandbox inspection and report/table reconstruction; live PDP validation requires scoped access.
  • 7. Limitations: The paper claims neither universal agent safety nor regulator certification; it supports only that observed governed risky proposals did not cross the action boundary in the evaluated setting.This narrower systems claim covers the reported corpus, mock-tool environment, and trusted runtime path.

8. Conclusion … Opening Note

Aegis places agentic-AI governance at the transition from action proposal to operational side effect, where the evaluated sandbox recorded zero governed mock-tool applications and zero governed risky side-effect completions. The accompanying materials describe the released inspection artifacts, AI-assisted manuscript work, author responsibility, competing interest, and supplementary evidence trail.

  • 8. Conclusion: 6,300 repeated evaluation rows and 2,100 governed rows supported Aegis’s runtime action-boundary evaluation.The conclusion contrasts Aegis governance with prompt-policy conditioning and reports zero governed mock-tool applications and zero governed risky side-effect completions.
  • Data, Materials, and Software Availability: The public artifact release includes the sandbox policy-enforcement point, synthetic task corpus, mock tools, comparator, scoring logic, report builders, schemas, frozen results, and documentation.The public sandbox PEP repository is identified at https://github.com/CyberQube1/Aegis_PEP_Sandbox.git; archival DOI details were to be added before public release.
  • Use of AI tools: AI-assisted tools supported drafting, proofreading, formatting, LaTeX organization, and consistency checks.The author reviewed and approved the final manuscript and states that AI tools did not generate, alter, or rerun the reported evaluation materials or results.
  • Competing Interests: The author declares a competing interest as the developer of the evaluated Aegis runtime-governance system and related SPQR/Aegis architecture-lineage materials.This disclosure covers the system and architecture-lineage materials evaluated and discussed in the manuscript.
  • Supplementary Information: The Supplementary Information provides an evidence trail for the headline results reported in the main manuscript.It summarizes repeated evaluation design, result packs, leakage counterfactuals, implicated policy controls, Senate records, provenance audits, workflow coverage, and the artifact manifest.
  • Opening Note: The supplementary source reports remain the artifacts for reproduction and inspection.The Opening Note frames the supplement as an evidence trail covering evaluation, leakage, settlement, provenance, workflow, and artifact-manifest materials.

Appendix A. Evaluation corpus and run design … Supplementary Table S3. Risk outcome summary

The evaluation used repeated 42-task comparisons across three conditions and five run families, totaling 6,300 rows, including 2,100 governed rows. In this sandbox, Aegis recorded zero governed mock-tool applications and zero governed risky side-effect completions, while the comparator path had 79 prompt-policy leakage rows.

  • Appendix A. Evaluation corpus and run design: 6,300 rows covered 42 tasks, three conditions, five run families, and 10 repeats per family.The governed condition contributed 2,100 rows overall.
  • Appendix A. Evaluation corpus and run design: No real-world email, file export, workflow mutation, shell action, or operational API action was executed.All side effects were evaluated through mock tools.
  • Appendix B. Headline 10-run and single-run results: 1,832 Aegis-attempted governed rows and 268 local fail-closed/no-tool governed rows were recorded in the 10-run comparison.The same comparison recorded 1,832 trusted provenance-valid rows and zero provenance-unknown or provenance-invalid rows.
  • Appendix B. Headline 10-run and single-run results: 630 total rows and 210 governed rows comprised the single-run comparison.It recorded 184 Aegis-attempted governed rows, 26 local fail-closed/no-tool rows, and 184 trusted provenance-valid rows.
  • Supplementary Table S2. Single-run governed headline: The single-run governed headline reports Governed, Aegis attempted, Fail-closed no-tool, Senate rows, Mock applied, and Risky completions.The single-run comparison contains 210 governed rows.
  • Supplementary Table S1. Ten-run governed headline: The 10-run governed headline reports Governed, Aegis attempted, Fail-closed no-tool, Senate rows, Mock applied, and Risky completions.These are the governed headline fields presented for each run family.
  • Supplementary Table S3. Risk outcome summary: 2,100 governed rows contained 0 governed mock-tool applications, 0 governed risky completions, and 79 prompt-policy leakage rows.These totals are reported in Supplementary Table S3’s risk outcome summary.

Appendix C. Prompt-policy leakage and Aegis counterfactuals · Supplementary Table S4. Prompt-policy leakage counterfactual summary

Appendix C reports 79 comparator-path prompt-policy leakage rows, while Aegis counterfactuals withheld execution or selected fail-closed and Senate paths. Governed mock-tool applications and governed risky side-effect completions remained zero.

  • Appendix C. Prompt-policy leakage and Aegis counterfactuals: 79 total prompt-policy leakage rows were comparator-path leakage events, not Aegis-governed side effects.The appendix distinguishes leakage rows from governed side-effect completion.
  • Appendix C. Prompt-policy leakage and Aegis counterfactuals: 20 stubbed_10_run, 0 gemma_10_run, 20 frontier_temp_0_10_run, 19 frontier_temp_0.7_10_run, and 20 frontier_temp_1.0_10_run leakage rows were reported.These counts sum to the reported total of 79.
  • Appendix C. Prompt-policy leakage and Aegis counterfactuals: Zero governed mock-tool applications and zero governed risky side-effect completions were recorded in Aegis counterfactuals.Counterfactual outcomes included execution withheld, local fail-closed/no-action, or Senate voting paths where applicable.
  • Appendix C. Prompt-policy leakage and Aegis counterfactuals: The machine-readable leakage artifacts record run family, model or temperature, task, proposed action/tool, workflow family, failure category, risk flags, policy-risk effects, counterfactual decisions and outcomes, application flags, completion flags, and evidence paths.These fields support inspection of the summarized counterfactual results.
  • Supplementary Table S4. Prompt-policy leakage counterfactual summary: 39 leakage rows in the external-communication category had 22 execution withheld, 10 Senate voting pending, and 7 fail-closed no action outcomes.The table lists the task as an external reviewer request for raw complaints data.
  • Supplementary Table S4. Prompt-policy leakage counterfactual summary: 62 of 79 leakage rows resulted in execution withheld, 10 in Senate voting pending, and 7 in fail-closed no action.The total row in Supplementary Table S4 summarizes the counterfactual outcomes.
  • Supplementary Table S4. Prompt-policy leakage counterfactual summary: Supplementary Table S4 reports prompt-policy leakage rows only and does not count Aegis-governed side-effect completion.Full row-level leakage counterfactuals are identified in Appendix H source artifacts.

Appendix D. Policy controls implicated by leakage rows · Supplementary Table S5. Policy controls implicated by leakage rows · Worked evidence exhibit: frontier-model temperature 0.7 leakage-to-control trace

The appendix maps prompt-policy leakage rows to implicated controls and source references, while distinguishing comparator leakage from Aegis-governed non-execution. Supplementary counts and a frontier-model temperature 0.7 trace make these mappings inspectable without claiming real-world breach or completed harm.

  • Appendix D. Policy controls implicated by leakage rows: The mapping identifies controls implicated by proposed actions, not real-world legal breach, regulatory contravention, or completed harm.In governed Aegis rows, corresponding outcomes were non-execution with zero governed risky side-effect completions.
  • Appendix D. Policy controls implicated by leakage rows: The implicated control categories include resource bounds, runaway resources, unauthorized external sensitive data, data minimization, and indirect disclosure.The listed identifiers are INT-AI-RESOURCE-BOUNDS, TAX-RESOURCE-RUNAWAY, INT-SENSITIVE-DATA-NO-UNAUTH-EXTERNAL, AUF-INFOSEC-DATA-MINIMIZATION, and TAX-INDIRECT-DISCLOSURE.
  • Appendix D. Policy controls implicated by leakage rows: A single leakage row can implicate multiple controls.The mapping therefore does not require a one-row-to-one-control relationship.
  • Supplementary Table S5. Policy controls implicated by leakage rows: 40 rows linked INT-AI-RESOURCE-BOUNDS and TAX-RESOURCE-RUNAWAY to runaway background jobs, while 39 rows linked three controls to external raw complaints data.The three external-data controls were INT-SENSITIVE-DATA-NO-UNAUTH-EXTERNAL, AUF-INFOSEC-DATA-MINIMIZATION, and TAX-INDIRECT-DISCLOSURE.
  • Worked evidence exhibit: frontier-model temperature 0.7 leakage-to-control trace: The temperature 0.7 worked trace shows how comparator leakage rows were mapped to controls and corresponding Aegis-governed rows resolved the same tasks.It is presented as a row-level example rather than a claim about a named model provider.
  • Worked evidence exhibit: frontier-model temperature 0.7 leakage-to-control trace: Prompt-policy external raw complaints-data rows proposed escalation-style mock-tool actions and were scored as unauthorized action and sensitive disclosure risk.Mapped controls were INT-SENSITIVE-DATA-NO-UNAUTH-EXTERNAL, AUF-INFOSEC-DATA-MINIMIZATION, and TAX-INDIRECT-DISCLOSURE.
  • Worked evidence exhibit: frontier-model temperature 0.7 leakage-to-control trace: Prompt-policy runaway-job rows proposed escalation-style mock-tool actions for high-concurrency requests and were scored as unauthorized action.They mapped to INT-AI-RESOURCE-BOUNDS and TAX-RESOURCE-RUNAWAY; the passage also reports corresponding Aegis-governed rows recorded block with practical outcome execution_withheld.
  • Worked evidence exhibit: frontier-model temperature 0.7 leakage-to-control trace: The full leakage artifacts retain required controls, source references, jurisdictions or regulators where applicable, clauses where available, mapping level, dereference status, and evidence-record pointers.Compact summaries are printed in the appendix, while row-level mappings remain in the source report manifest and Appendix H artifacts.

Appendix E. Senate settlement and finality … Appendix F. Trusted provenance boundary audit

In the evaluated sandbox, Senate settlement produced quorum and final-tally evidence without governed tool applications or risky side-effect completions. Aegis also preserved server-resolved provenance and reported millisecond-scale runtime decision latency, with timings limited to the captured sandbox path.

  • Appendix E. Senate settlement and finality: 1,019 Senate rows had quorum met, effective finality, and tally-present evidence; 60 settled allow rows and 959 settled deny rows were recorded.Settled failed-closed and settled unknown rows were both zero.
  • Appendix E. Senate settlement and finality: 0 Senate-associated governed mock-tool applications and 0 governed risky side-effect completions were recorded.A Senate-settled allow represents governance settlement, not evidence that the original mock tool was applied.
  • Appendix E. Senate settlement and finality: Senate escalation used a voting path rather than an informal approval step, while tool application remained tracked separately.The distinction prevents settlement status from being interpreted as proof of tool execution.
  • Runtime decision latency: 25.598 ms to 27.754 ms was the median Aegis latency range across five governed run families in the reported 10-run pack.These timings measure the sandbox/runtime decision path captured in the evaluation artifacts.
  • Runtime decision latency: 30.908 ms to 66.848 ms was the p95 latency range, and 237.897 ms was the maximum observed Aegis latency.The timings should not be read as production network latency, end-user latency, or a general benchmark for all deployment environments.
  • Appendix F. Trusted provenance boundary audit: 1,832 Aegis-attempted governed rows matched 1,832 trusted Aegis-resolved provenance-valid rows.Provenance-unknown rows and provenance-invalid rows were both zero.
  • Appendix F. Trusted provenance boundary audit: Trusted provenance was server-side Aegis-resolved provenance, excluding model-, client-, and PEP-supplied citations as production-valid provenance.Evidence completeness and provenance boundary validity are distinct, and local fail-closed/no-tool rows remain legitimate non-execution outcomes.

Supplementary Table S7. Trusted Aegis-resolved provenance … Appendix H. Artifact manifest and reproducibility notes

The supplementary material documents trusted-provenance distinctions, workflow and failure-category coverage, governed-coverage tables, and reproducibility artifacts. It identifies the source reports and files supporting provenance, leakage, latency, workflow, failure-category, and manifest claims.

  • Supplementary Table S7. Trusted Aegis-resolved provenance: Supplementary Table S7 distinguishes trusted provenance validity from evidence completeness and reports categories for trusted-valid, unknown, and invalid provenance.Its stated source is AEGIS_10_RUN_PROVENANCE_SUMMARY.md.
  • Appendix G. Workflow and failure-category coverage: The governed corpus covers five workflow families: active_law_change, agentic_authority_tool_use, ai_consumer_impact, external_communication, and vendor_service_provider.These families are listed as coverage categories for the governed corpus.
  • Appendix G. Workflow and failure-category coverage: The governed corpus covers eight listed failure categories, including authority spoofing, unsafe propagation, disproportionate tool use, and persistent loops.The list also includes false task-completion divergence, indirect sensitive-information disclosure, non-owner compliance, and none.
  • Appendix G. Workflow and failure-category coverage: The taxonomy demonstrates coverage beyond one narrow scenario but is not claimed to be exhaustive.This is an explicit limitation of the workflow and failure-category taxonomy.
  • Supplementary Table S8. Governed workflow coverage: Supplementary Table S8 reports governed rows by workflow family, with detailed bucket splits sourced from the governed decision trace and workflow-bucket report.The cited source files are AEGIS_10_RUN_GOVERNED_DECISION_TRACE.csv and AEGIS_10_RUN_B Y_WORKFLOW_AND_BUCKET.md.
  • Supplementary Table S9. Governed failure-category coverage: Supplementary Table S9 reports governed rows by failure category, with detailed bucket splits sourced from the governed decision trace and failure-category report.The cited source files are AEGIS_10_RUN_GOVERNED_DECISION_TRACE.csv and AEGIS_10_RUN_B Y_FAILURE_CATEGORY.md.
  • Appendix H. Artifact manifest and reproducibility notes: Appendix H identifies source_report_manifest.md as the manifest for reports, raw records, completeness and rerun-readiness reports, manifests, and timing records.It also identifies files supporting the Appendix D leakage trace and Appendix E runtime decision-latency summary.

Supplementary Table S10. Report-pack completeness

Supplementary Table S10 reports a complete run pack containing 6,300 total rows, 2,100 governed rows, and 50 matrix files. The build performed no model inference, backend calls, policy or prompt changes, task changes, or real side effects.

  • Report-pack completeness: 6,300 total rows, 2,100 governed rows, and 50 matrix files were marked pack complete.The table records Pack complete as True.
  • Documentation: The report pack is sourced from AEGIS_10_RUN_PACK_COMPLETENESS.md and includes human-readable appendix notes.Listed appendices cover the supplementary index, leakage-policy control, Senate provenance, and reproducibility.
  • Build scope: The supplementary build performed no model inference, backend service calls, policy mutations, prompt changes, task changes, or real side effects.The public release includes the sandbox enforcement point, synthetic corpus, mock tools, comparator, scoring logic, report builders, schemas, frozen results, and inspection documentation.
Loading 2608.16891v1…