{"id":"464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2","title":"arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","argument":"The authors of “Signed but Not Safe” study a specific risk in multi-agent AI systems: when one agent passes work to another, requirements can be summarized away, altered or ignored. Their handoff records each requirement as a verbatim quote plus a checkable predicate, then uses HMAC-SHA256 to sign the record and deterministic code to verify the merged decision. In synthetic, exactly scorable tasks with Qwen3-8B, the authors report that signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, without a net loss of conformant commits compared with structured handoffs. But the signature only protects the manifest after it is created. An adversarial line before signing increased violations, and the signature authenticated the corrupted manifest. The authors identify requirement extraction—not just transmission—as the trust boundary: a secure handoff cannot repair a requirement that was already captured incorrectly. They also report that a deterministic verifier caught more violating decisions than an LLM checker, with fewer false alarms in their study. These results describe the paper’s tested tasks and models; they do not establish performance in other settings.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results come from synthetic, exactly scorable tasks and specified models; the abstract does not establish how they generalize to other settings. The abstract describes requirement extraction as the trust boundary but does not report a method that prevents extraction errors.","speaker":{"name":"Chen, Xiaobo, Zhu, Genliang, Wang, Ziyuan, Wang, Chu","roleAtSource":"Article author"},"source":{"title":"Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07483","publishedAt":"2026-11-05","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors say multi-agent handoffs can lose, alter or ignore requirements as work is split across agents and results are merged.","excerpt":"each handoff can summarize away, alter or ignore a requirement","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"The authors tested signed requirement-manifest handoffs against free-text and structured JSON handoffs using synthetic, exactly scorable tasks and Qwen3-8B.","excerpt":"With Qwen3-8B (1,440 trajectories, five threats)","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"In the study, signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, with no net loss of conformant commits relative to structured handoffs.","excerpt":"signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"The authors report that signing protected a manifest from in-transit tampering, but a pre-signing injection could corrupt it and the signature would then authenticate that corruption.","excerpt":"Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"In the reported study, deterministic verification caught more violating decisions than an LLM checker and produced fewer false alarms.","excerpt":"the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07483","checkedAt":"2026-11-09T03:26:06.728Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported extraction errors and verification results change in handoffs beyond the study’s synthetic, exactly scorable tasks?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","summary":"The authors of “Signed but Not Safe” study a specific risk in multi-agent AI systems: when one agent passes work to another, requirements can be summarized away, altered or ignored. Their handoff records each requirement as a verbatim quote plus a checkable predicate, then uses HMAC-SHA256 to sign the record and deterministic code to verify the merged decision. In synthetic, exactly scorable tasks with Qwen3-8B, the authors report that signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, without a net loss of conformant commits compared with structured handoffs. But the signature only protects the manifest after it is created. An adversarial line before signing increased violations, and the signature authenticated the corrupted manifest. The authors identify requirement extraction—not just transmission—as the trust boundary: a secure handoff cannot repair a requirement that was already captured incorrectly. They also report that a deterministic verifier caught more violating decisions than an LLM checker, with fewer false alarms in their study. These results describe the paper’s tested tasks and models; they do not establish performance in other settings.","question":"How would the reported extraction errors and verification results change in handoffs beyond the study’s synthetic, exactly scorable tasks?","claims":[{"text":"The authors say multi-agent handoffs can lose, alter or ignore requirements as work is split across agents and results are merged.","excerpt":"each handoff can summarize away, alter or ignore a requirement","support":"source-stated"},{"text":"The authors tested signed requirement-manifest handoffs against free-text and structured JSON handoffs using synthetic, exactly scorable tasks and Qwen3-8B.","excerpt":"With Qwen3-8B (1,440 trajectories, five threats)","support":"source-stated"},{"text":"In the study, signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, with no net loss of conformant commits relative to structured handoffs.","excerpt":"signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs.","support":"source-stated"},{"text":"The authors report that signing protected a manifest from in-transit tampering, but a pre-signing injection could corrupt it and the signature would then authenticate that corruption.","excerpt":"Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.","support":"source-stated"},{"text":"In the reported study, deterministic verification caught more violating decisions than an LLM checker and produced fewer false alarms.","excerpt":"the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms.","support":"source-stated"}],"limitations":["The reported results come from synthetic, exactly scorable tasks and specified models; the abstract does not establish how they generalize to other settings.","The abstract describes requirement extraction as the trust boundary but does not report a method that prevents extraction errors."],"mediaId":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","correctionReason":null,"id":"464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2","publicationId":"1bc017ca-833a-4659-8b60-9275114c2a86","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07483","sourceTitle":"Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-05","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:10:22.599Z","createdAt":"2026-11-09T02:23:29.868Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","kind":"article","url":"https://arxiv.org/abs/2611.07483","sourceUrl":"https://arxiv.org/abs/2611.07483","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T02:22:42.963Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07483","checkedAt":"2026-11-09T03:26:06.728Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","confidence":0.88,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e0f301d398dbf40bf6a0477b0d2dca2ab6d89ea0909a89f6fbc1388939a2488b","decidedAt":"2026-11-09T02:22:43.739Z"},"provenance":{"textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observationId":"a5b36eb4e7269e0cbcaf5a0817faf30949c4c3678f46aed8713d4b304b6e5e60","retrievedAt":"2026-11-09T02:22:42.849Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"f5c90475-6515-4c1e-8c18-9c606238e6dd"},"reviewer":{"model":"gpt-6-luna","runId":"bae1b3f0-dd1b-47fc-8eba-27ecffd74b45"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T02:23:29.868Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Chen, Xiaobo","url":null,"kind":"unknown"},{"name":"Zhu, Genliang","url":null,"kind":"unknown"},{"name":"Wang, Ziyuan","url":null,"kind":"unknown"},{"name":"Wang, Chu","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Chen, Xiaobo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chen, Xiaobo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Zhu, Genliang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhu, Genliang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Wang, Ziyuan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Ziyuan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Wang, Chu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Chu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07483","snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-signed-but-not-safe-requirement-integrity-in-multi-464857bb","formats":{"html":"/readings/arxiv-cs-ai-signed-but-not-safe-requirement-integrity-in-multi-464857bb","markdown":"/readings/arxiv-cs-ai-signed-but-not-safe-requirement-integrity-in-multi-464857bb.md","json":"/readings/arxiv-cs-ai-signed-but-not-safe-requirement-integrity-in-multi-464857bb.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2","revision":"1bc017ca-833a-4659-8b60-9275114c2a86","revisionKind":"publication-id","title":"arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","url":"https://escapemeridian.com/readings/arxiv-cs-ai-signed-but-not-safe-requirement-integrity-in-multi-464857bb"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.07483","revision":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","revisionKind":"sha256-source-text","title":"Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","url":"https://arxiv.org/abs/2611.07483"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2","title":"arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","argument":"The authors of “Signed but Not Safe” study a specific risk in multi-agent AI systems: when one agent passes work to another, requirements can be summarized away, altered or ignored. Their handoff records each requirement as a verbatim quote plus a checkable predicate, then uses HMAC-SHA256 to sign the record and deterministic code to verify the merged decision. In synthetic, exactly scorable tasks with Qwen3-8B, the authors report that signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, without a net loss of conformant commits compared with structured handoffs. But the signature only protects the manifest after it is created. An adversarial line before signing increased violations, and the signature authenticated the corrupted manifest. The authors identify requirement extraction—not just transmission—as the trust boundary: a secure handoff cannot repair a requirement that was already captured incorrectly. They also report that a deterministic verifier caught more violating decisions than an LLM checker, with fewer false alarms in their study. These results describe the paper’s tested tasks and models; they do not establish performance in other settings.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results come from synthetic, exactly scorable tasks and specified models; the abstract does not establish how they generalize to other settings. The abstract describes requirement extraction as the trust boundary but does not report a method that prevents extraction errors.","speaker":{"name":"Chen, Xiaobo, Zhu, Genliang, Wang, Ziyuan, Wang, Chu","roleAtSource":"Article author"},"source":{"title":"Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.07483","publishedAt":"2026-11-05","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors say multi-agent handoffs can lose, alter or ignore requirements as work is split across agents and results are merged.","excerpt":"each handoff can summarize away, alter or ignore a requirement","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"The authors tested signed requirement-manifest handoffs against free-text and structured JSON handoffs using synthetic, exactly scorable tasks and Qwen3-8B.","excerpt":"With Qwen3-8B (1,440 trajectories, five threats)","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"In the study, signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, with no net loss of conformant commits relative to structured handoffs.","excerpt":"signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"The authors report that signing protected a manifest from in-transit tampering, but a pre-signing injection could corrupt it and the signature would then authenticate that corruption.","excerpt":"Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"},{"text":"In the reported study, deterministic verification caught more violating decisions than an LLM checker and produced fewer false alarms.","excerpt":"the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms.","url":"https://arxiv.org/abs/2611.07483","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07483","checkedAt":"2026-11-09T03:26:06.728Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the reported extraction errors and verification results change in handoffs beyond the study’s synthetic, exactly scorable tasks?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","summary":"The authors of “Signed but Not Safe” study a specific risk in multi-agent AI systems: when one agent passes work to another, requirements can be summarized away, altered or ignored. Their handoff records each requirement as a verbatim quote plus a checkable predicate, then uses HMAC-SHA256 to sign the record and deterministic code to verify the merged decision. In synthetic, exactly scorable tasks with Qwen3-8B, the authors report that signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, without a net loss of conformant commits compared with structured handoffs. But the signature only protects the manifest after it is created. An adversarial line before signing increased violations, and the signature authenticated the corrupted manifest. The authors identify requirement extraction—not just transmission—as the trust boundary: a secure handoff cannot repair a requirement that was already captured incorrectly. They also report that a deterministic verifier caught more violating decisions than an LLM checker, with fewer false alarms in their study. These results describe the paper’s tested tasks and models; they do not establish performance in other settings.","question":"How would the reported extraction errors and verification results change in handoffs beyond the study’s synthetic, exactly scorable tasks?","claims":[{"text":"The authors say multi-agent handoffs can lose, alter or ignore requirements as work is split across agents and results are merged.","excerpt":"each handoff can summarize away, alter or ignore a requirement","support":"source-stated"},{"text":"The authors tested signed requirement-manifest handoffs against free-text and structured JSON handoffs using synthetic, exactly scorable tasks and Qwen3-8B.","excerpt":"With Qwen3-8B (1,440 trajectories, five threats)","support":"source-stated"},{"text":"In the study, signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, with no net loss of conformant commits relative to structured handoffs.","excerpt":"signed manifests cut unsafe commits under attack from 69.4% to 9.0% (60.4 pp, 95% CI [51.4, 69.4]) with no net loss of conformant commits relative to structured handoffs.","support":"source-stated"},{"text":"The authors report that signing protected a manifest from in-transit tampering, but a pre-signing injection could corrupt it and the signature would then authenticate that corruption.","excerpt":"Signing protects requirements in transit, not at extraction; the extraction step is the trust boundary.","support":"source-stated"},{"text":"In the reported study, deterministic verification caught more violating decisions than an LLM checker and produced fewer false alarms.","excerpt":"the deterministic verifier caught 78.7% of violating decisions versus 59.0% for an LLM checker, with 7% versus 50% false alarms.","support":"source-stated"}],"limitations":["The reported results come from synthetic, exactly scorable tasks and specified models; the abstract does not establish how they generalize to other settings.","The abstract describes requirement extraction as the trust boundary but does not report a method that prevents extraction errors."],"mediaId":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","correctionReason":null,"id":"464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2","publicationId":"1bc017ca-833a-4659-8b60-9275114c2a86","version":1,"sourceUrl":"https://arxiv.org/abs/2611.07483","sourceTitle":"Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-05","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:10:22.599Z","createdAt":"2026-11-09T02:23:29.868Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","kind":"article","url":"https://arxiv.org/abs/2611.07483","sourceUrl":"https://arxiv.org/abs/2611.07483","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T02:22:42.963Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.07483","checkedAt":"2026-11-09T03:26:06.728Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"91589b57cba121e70780491e5503e8296be4c3579504ab152beaeea9dffc2889","confidence":0.88,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e0f301d398dbf40bf6a0477b0d2dca2ab6d89ea0909a89f6fbc1388939a2488b","decidedAt":"2026-11-09T02:22:43.739Z"},"provenance":{"textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observationId":"a5b36eb4e7269e0cbcaf5a0817faf30949c4c3678f46aed8713d4b304b6e5e60","retrievedAt":"2026-11-09T02:22:42.849Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"f5c90475-6515-4c1e-8c18-9c606238e6dd"},"reviewer":{"model":"gpt-6-luna","runId":"bae1b3f0-dd1b-47fc-8eba-27ecffd74b45"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T02:23:29.868Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Chen, Xiaobo","url":null,"kind":"unknown"},{"name":"Zhu, Genliang","url":null,"kind":"unknown"},{"name":"Wang, Ziyuan","url":null,"kind":"unknown"},{"name":"Wang, Chu","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Chen, Xiaobo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Chen, Xiaobo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Zhu, Genliang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhu, Genliang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Wang, Ziyuan","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Ziyuan","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}},{"actor":{"name":"Wang, Chu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Chu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.07483","locator":"head/meta[name=author|citation_author]"},"assertionId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T03:26:06.728Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","sourceUrl":"https://arxiv.org/abs/2611.07483","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.07483","snapshotId":"a1c40cfc41fd410b06749b14023fc3a1a8c8f6593248203ca235a7efaee6ad93","contentSha256":"551d8c8f89336829448bf5bb1548130a4a528e8f927647207ac37248a7f9fcae","textHash":"abbf5828a949d15c8eead11e71b001a493b03daf81e737b7d52adcfd6e293d2e","observedAt":"2026-11-09T03:26:06.728Z","basis":"publisher-page-metadata","sourceLinks":44,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/464857bb32886132f30393ac5438b7fb7fe29134efe12a71baa751fe5f34dfc2/source"}}}],"audits":[{"publicationId":"1bc017ca-833a-4659-8b60-9275114c2a86","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading attributes the findings to the authors of the arXiv paper and keeps them as reported results, not established facts. Labelling the source arXiv cs.AI matches the publisher field; the paper is primarily cs.CR but cross-listed in cs.AI.","excerpt":"Authors:Xiaobo Chen, Genliang Zhu, Ziyuan Wang, Chu Wang"},{"dimension":"summary","status":"uncertain","explanation":"The reading tracks the abstract and keeps its sharp turn that signing protects transit, not extraction. But the headline metric, unsafe versus conformant commits, is never put in plain language, so a general reader may not know a commit is the merger's final accepted decision. Manifest and HMAC-SHA256 are also unexplained; tooltips may cover them, but the central result should be readable directly. Smallest repair: one clause saying a commit is the merged decision the system accepts, and that unsafe means it violates a requirement.","excerpt":"signed manifests cut unsafe commits under attack from 69.4% to 9.0%"},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-05 matches the v1 submission date on arXiv. The later feed date of 2026-11-06 was correctly not used.","excerpt":"[Submitted on 5 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Every claim is backed by verbatim abstract text: the handoff risk, the Qwen3-8B comparison, the drop from 69.4% to 9.0%, and the deterministic-versus-LLM checker results. The line that a secure handoff cannot repair a badly captured requirement is a fair restatement of the authors' residual-risk finding. The limitations and the question stay within the evidence and avoid generalizing beyond the tested tasks.","excerpt":"An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page. That is the most direct way for a reader to reach the actual source.","excerpt":null}],"createdAt":"2026-11-09T02:23:29.868Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}