The DOI matches its DataCite record; 2 of the 2 references it cites were found in a registry or an index.
A Deterministic Control Plane for LLM Coding Agents
Open accessAbstract
LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to these gaps. Rel(AI)Build treats agent definitions as a managed supply chain (SHA-256 content addressing, HMAC-stamped lockfiles, hash-chained audit logs); enforces tiered permissions and attack-derived blocklists before LLM invocation; gates feature work through a phase state machine with requirement-to-file-to-test traceability; compiles a single canonical definition to seven IDE targets; and detects prompt drift via Jaccard similarity. Conformance tests on injected violations confirm each mechanism enforces its stated invariant; developer outcomes remain future work. Governance of this layer must be deterministic and tool-agnostic -- not delegated to further LLM orchestration.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Madatha also uses the phrase deterministic control plane for LLM coding agents, but studies a different layer: agent configuration supply chains, permission boundaries, phase state machines, and prompt/configuration drift.
“Madatha [8] also uses the phrase deterministic control plane for LLM coding agents, but studies a different layer: agent configuration supply chains, permission boundaries, phase state machines, and prompt/configuration drift.”
From Claim Plane: Enforceable Change Intents and Dynamic Scope for Parallel Coding Agents (2026) · cites this paper as [8]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Fantastically Ordered Prompts and Where to Find Them: Overcoming Few-Shot Prompt Order Sensitivity
Lu, Y., Bartolo, M., Moore, A., Riedel, S., & Stenetorp, P. (2021) · arXiv · doi:10.48550/arxiv.2104.08786 · Cited by 615 · cited 1×
“Separately, literature demonstrates that LLMs are highly sensitive to spurious formatting variations [Sclar et al., 2023, Mishra et al., 2022, Lu et al., 2022], where cosmetic formatting differences change BPE token sequences and push inputs off-distribution.”
Sclar, M., Choi, Y., Tsvetkov, Y., & Suhr, A. (2023) · arXiv · doi:10.48550/arxiv.2310.11324 · Cited by 52
Flagged first, then by citations
Research works printed but not linked: 30
- References Saleema Amershi et al. Software engineering for machine learning: A case study. In IEEE/ACM Intl. Conf. on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 2019.
- Anonymous. The debugging decay index: Rethinking debugging strategies for code llms. arXiv preprint arXiv:2506.18403, 2025. doi: 10.48550/arXiv.2506. 18403. · DOI
- Anthony M. Barrett, Jessica Newman, Brandie Nonnecke, Nada Madkour, Dan Hendrycks, Evan R. Murphy, Krystal Jackson, and Deepika Raman. Ai risk- management standards profile for general-purpose ai (gpai) and foundation models, version 1.2. Technical report, UC Berkeley Center for Long-Term Cybersecurity (CLTC), 2026. arXiv:2506.23949; https://cltc.berkeley.edu/ wp-content/uploads/2026/04/Berkeley-GPAI-Profile-v1-2.pdf. · arXiv
- Robert G. Cooper. Stage-gate systems: A new tool for managing new products. Business Horizons, 33(3):44-54, 1990.
- Jack B. Dennis and Earl C. Van Horn. Programming semantics for multipro- grammed computations. Communications of the ACM, 9(3):143-155, 1966.
- In Gim, Guojun Chen, Seung-seob Lee, Nikhil Sarda, Anurag Khandelwal, and Lin Zhong. Prompt cache: Modular attention reuse for low-latency inference. In Proceedings of Machine Learning and Systems (MLSys); arXiv:2311.04934, 2024. doi: 10.48550/arXiv.2311.04934. · DOI · Paper page
- Stuart Haber and W. Scott Stornetta. How to time-stamp a digital document. Journal of Cryptology, 3(2):99-111, 1991.
- C. A. R. Hoare. Communicating sequential processes. Communications of the ACM, 21(8):666-677, 1978.
- Jez Humble and David Farley. Continuous Delivery: Reliable Software Releases Through Build, Test, and Deployment Automation. Addison-Wesley, 2010.
- Eirini Kalliamvakou et al. The promises and perils of mining github. In Working Conference on Mining Software Repositories (MSR), 2014.
- Piergiorgio Ladisa et al. Taxonomy of attacks on open-source software supply chains. In IEEE Symposium on Security and Privacy (S&P), 2023.
- Xiao Liu et al. Agentbench: Evaluating llms as agents. In International Con- ference on Learning Representations (ICLR), 2024.
- Yuhao Liu, Yiyang Zhao, Yiyang Lyu, Tianyi Zhang, Haoyu Wang, and David Lo. "your ai, my shell": Demystifying prompt injection attacks on agentic ai coding editors. arXiv preprint arXiv:2509.22040, 2025. · arXiv
- Padmaraj Madatha. Github agent-configuration prevalence study: Dataset and reproduction scripts. Zenodo (DOI to be assigned) and arXiv ancillary files [Author artifact, not peer-reviewed], 2026a.
- Padmaraj Madatha. Cursor vs cursor+rel(ai)build illustrative build walk- through. arXiv ancillary files [Author artifact, not peer-reviewed], 2026c.
- Mark S. Miller. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, 2006.
- Swaroop Mishra et al. Reframing instructional prompts to gptk's language. In Findings of the Association for Computational Linguistics (ACL Findings), 2022.
- Kief Morris. Infrastructure as Code: Managing Servers in the Cloud. O'Reilly Media, 2016.
- Tadao Murata. Petri nets: Properties, analysis and applications. Proceedings of the IEEE, 77(4):541-580, 1989.
- Zachary Newman, John Speed Meyers, and Santiago Torres-Arias. Sigstore: Software signing for everybody. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2353-2367, 2022. doi: 10.1145/ 3548606.3560596. · DOI
- Marc Ohm et al. Backstabber's knife collection: A review of open source soft- ware supply chain attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2020.
- Akond Rahman et al. Security smells in ansible and chef scripts: A replica- tion study. ACM Transactions on Software Engineering and Methodology (TOSEM), 30(1):1-31, 2021.
- Traian Rebedea et al. Nemo guardrails: A toolkit for controllable and safe llm applications with programmable rails. arXiv preprint arXiv:2310.10561, 2023. · arXiv
- Jerome H. Saltzer and Michael D. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 63(9):1278-1308, 1975.
- The White House. Executive order 14028: Improving the nation's cybersecurity. Federal Register Vol. 86, No. 93, 2021.
- Wil M. P. van der Aalst. Workflow verification: Finding control-flow errors using petri-net-based techniques. In Business Process Management, LNCS 1806, pages 161-183. 2000.
- Xingyao Wang et al. Openhands: An open platform for ai software developers as generalist agents (formerly opendevin). arXiv preprint arXiv:2407.16741, 2024. doi: 10.48550/arXiv.2407.16741. · DOI · Paper page
- Qingyun Wu et al. Autogen: Enabling next-gen llm applications via multi-agent conversation. arXiv preprint arXiv:2308.08155, 2023. · arXiv
- John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. Swe-agent: Agent-computer interfaces enable automated software engineering. In Advances in Neural Information Processing Systems (NeurIPS), volume 37, 2024.
- Nusrat Zahan et al. What are weak links in the npm supply chain? In IEEE/ACM Intl. Conf. on Software Engineering: Software Engineering in Society (ICSE-SEIS), 2022.
Cited by
Sorted by citations
Claim Plane: Enforceable Change Intents and Dynamic Scope for Parallel Coding Agents
Nikolaev, M. (2026) · arXiv · Cited by 1
Metadata
- Authors
- Madatha, P.
- Corresponding author
- Madatha, Padmaraj
- ORCID
- Madatha, Padmaraj
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2606.26924
- OpenAlex
- W7166096992
- Cited by
- 1
- References
- 2
- Citations by year
- 2026: 1
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Keywords
- LLM coding agents, content-addressed storage, permission management, Jaccard similarity, supply chain security, AI agent governance
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
