{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.10629", "title": "The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate", "summary": "The method replaces unconstrained self-modification of an agent (or no adaptation at all) with a dual-loop engine that confines all adaptation to the runtime harness—prompts, tool-call logic, primitive composition—while keeping model weights fixed, and admits changes only through a hash-chained, test-backed audit gate. The cost is substantial governance machinery: a proposer, replay against relabelled history, an admission record per change, and the requirement that any supervisory re-interpretation be encoded as an explicit relabelling rule, since the gate rejects everything evaluated on pre-shift labels. It can fail on structural shifts, where the gate's fixed tolerance blocked the correct primitive replacement in half the seeds at high severity, and all results come from a simulated agent with a seeded-search proposer rather than real language models.", "rationale": "The core design principle—mutable harness, frozen weights, gated audit trail—is directly relevant to regulated production deployments on constrained infrastructure, but the evidence is simulation-only with no LLM evaluation, so the specific gate mechanism warrants tracking rather than adoption.", "technique": "Compliance-gated self-evolution of LLM agent harnesses", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-07", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.10629", "independent_implementations": 0, "total_implementations": 1, "stars": 1, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "The method replaces unconstrained self-modification of an agent (or no adaptation at all) with a dual-loop engine that confines all adaptation to the runtime harness—prompts, tool-call logic, primitive composition—while keeping model weights fixed, and admits changes only through a hash-chained, test-backed audit gate. The cost is substantial governance machinery: a proposer, replay against relabelled history, an admission record per change, and the requirement that any supervisory re-interpretation be encoded as an explicit relabelling rule, since the gate rejects everything evaluated on pre-shift labels. It can fail on structural shifts, where the gate's fixed tolerance blocked the correct primitive replacement in half the seeds at high severity, and all results come from a simulated agent with a seeded-search proposer rather than real language models.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.10629", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "In simulation, the admission gate accepted 144 of 7,449 candidate changes with no regression on held-out history and restored false-positive rates to oracle level in low- and mid-severity cells, while an ungated baseline admitted 309 harmful changes and left missed flags above 10% in 49 of 90 runs.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.10629", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }