From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Most promoted claims in this baseline come from OpenDART records and selected official IR materials, while market and news inputs are handled as runtime signals.

“Most promoted claims in this baseline come from OpenDART records and selected official IR materials, while market and news inputs are handled as runtime signals.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The fixed validation set contains 30 investor-facing scenarios: for each of the five corporate groups, five company questions and one cross-company comparison (six scenarios per group).

“The fixed validation set contains 30 investor-facing scenarios: for each of the five corporate groups, five company questions and one cross-company comparison (six scenarios per group).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The current slice covers five Korean corporate groups, each contributing five listed companies.

“The current slice covers five Korean corporate groups, each contributing five listed companies.”

May combine two claims.

The checks the harness enforces held under model substitution: across three hosted models, they passed on all 270 composition-boundary runs; failures were confined to the model-composed side and were caught and recorded.

“The checks the harness enforces held under model substitution: across three hosted models, they passed on all 270 compositionboundary runs; failures were confined to the model-composed side and were caught and recorded.”

May combine two claims.

The code-owned guarantees are load-bearing, not reproducible by prompting alone: holding the model fixed and varying only the enforcement layer, prompt instructions alone let recommendation-language and internal-trace-leakage violations reach the reader, which the harness blocks entirely.

“The code-owned guarantees are load-bearing, not reproducible by prompting alone: holding the model fixed and varying only the enforcement layer, prompt instructions alone let recommendation-language and internal-trace-leakage violations reach the reader, which the harness blocks entirely.”

Probably not a substantial claim: may not pass S3 (load-bearing).

From these 113 claims, a compact reporting layer of 25 priority claims-five per corporate group-is selected for paper reporting and product inspection, recorded in the review-approved runtime-promotion manifest.

“From these 113 claims, a compact reporting layer of 25 priority claims-five per corporate group-is selected for paper reporting and product inspection, recorded in the review-approved runtime-promotion manifest at raw/manifests/review-approved-runtime-promotion.json [62].”

• cites [62]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

A bolt-on external guardrail prevents such violations too but over-refuses, dropping utility to 88/120 where the harness preserves full utility (120/120); in this ablation, only code-owned enforcement preserves both safety and utility.

“A bolt-on external guardrail prevents such violations too but over-refuses, dropping utility to 88/120 where the harness preserves full utility (120/120); in this ablation, only code-owned enforcement preserves both safety and utility.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

DART and IR materials provide most promoted financial and corporate claims in the paper baseline, while KRX and news-search inputs provide runtime market and news signals that are linked, checked, and traced separately.

“DART and IR materials provide most promoted financial and corporate claims in the paper baseline, while KRX and news-search inputs provide runtime market and news signals that are linked, checked, and traced separately.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The five corporate groups exercise transfer across different source structures: affiliate-level IR pages, regulatory filings, holding-company materials, market-data interfaces, and news-search interfaces.

“The five corporate groups exercise transfer across different source structures: affiliate-level IR pages, regulatory filings, holding-company materials, market-data interfaces, and news-search interfaces.”

May combine two claims.

The five-corporate-group manifests contain 113 source-backed runtime claims in total, distributed across groups as shown in Table 4 (Samsung 36, SK 27, Hyundai Motor 15, LG 15, Hanwha 20).

“The five-corporate-group manifests contain 113 source-backed runtime claims in total, distributed across groups as shown in Table 4 (Samsung 36, SK 27, Hyundai Motor 15, LG 15, Hanwha 20).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The source ledger extends beyond the 25-company reference slice.

“The source ledger extends beyond the 25-company reference slice.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The method is instantiated on a bounded public-data slice of five Korean corporate groups, 25 listed companies, and 113 source-backed runtime claims.

“We instantiate the method on a bounded public-data slice of five Korean corporate groups, 25 listed companies, and 113 source-backed runtime claims.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The extracted DART row is promoted into a source-backed claim: 2024 consolidated revenue KRW 300.9 trillion and operating income KRW 32.7 trillion.

“The extracted DART row is promoted into a source-backed claim: 2024 consolidated revenue KRW 300.9 trillion and operating income KRW 32.7 trillion.”

May combine two claims.

Across all 270 live-LLM composition-boundary runs, the first-pass contract passed 234/270, recovery 36, final pass 198/270, final failure 72/270.

“Total | 270 | 234/270 | 36 | 198/270 | 72/270”

May combine two claims.

For Claude Sonnet 4, the first-pass live contract passed 74/90, recovery 16, final pass 62/90, final failure 28/90.

“Claude Sonnet 4 | 90 | 74/90 | 16 | 62/90 | 28/90”

May combine two claims.

The implementation passed 5/5 live-API corporate-group connectivity tests and 15/15 live answer-hygiene tests, with review packets for all 15 runtime samples.

“it passed 5/5 live-API corporate-group connectivity tests and 15/15 live answer-hygiene tests, with review packets for all 15 runtime samples”

May combine two claims.

In the enforcement-layer ablation, the harness condition had 0 violations, 0 false refusals, 0 adversarial blocks, and 120/120 utility pass.

“harness | 0 / 0 | 0 | 0 | 120/120”

Probably not a substantial claim: may not pass S3 (load-bearing).

The LG group has 15 source-backed runtime claims.

“LG | 15 | electronics, chemicals, battery/ESS, components, telecom AI data center | industry coverage with telecom”

May combine two claims.

In the enforcement-layer ablation, the prompt-only condition had 15/15 violations, 0 false refusals, 0 adversarial blocks, and 120/120 utility pass.

“prompt-only | 15 / 15 | 0 | 0 | 120/120”

Probably not a substantial claim: may not pass S3 (load-bearing).

The 25-claim reporting layer selects five priority claims per group from the 113-claim layer.

“the 25-claim reporting layer selects five priority claims per group from these.”

May combine two claims.

Every visible answer (30/30) contained the required answer signals and avoided prohibited patterns.

“Every visible answer (30/30) contained the required answer signals and avoided prohibited patterns.”

• AssumptionRests on an assumption: The deterministic contract checks correctly implement the intended contracts and are complete enough that passing them means no safety or leakage violation reached the reader.

Probably not a substantial claim: may not pass S3 (load-bearing).

The SK group has 27 source-backed runtime claims.

“| SK | 27 | system (ESS), telecom AI, net asset value | portfolio-allocation |”

Probably not a substantial claim: may not pass S3 (load-bearing).

The full source-backed runtime claim layer contains 113 claims across five corporate groups.

“The per-group counts sum to the full 113-claim layer; the 25-claim reporting layer selects five priority claims per group from these.”

May combine two claims.

For Gemini 2.5 Flash, the first-pass live contract passed 71/90, recovery 19, final pass 59/90, final failure 31/90.

“Gemini 2.5 Flash | 90 | 71/90 | 19 | 59/90 | 31/90”

May combine two claims.

Output hygiene held at 60/60: internal-trace leakage was blocked and reader-facing source links were preserved across the 30 scenarios.

“Output hygiene held at 60/60: internal-trace leakage was blocked and reader-facing source links were preserved across the 30 scenarios.”

• AssumptionRests on an assumption: The deterministic contract checks correctly implement the intended contracts and are complete enough that passing them means no safety or leakage violation reached the reader.

May combine two claims.

In the enforcement-layer ablation, the external-guardrail condition had 0/0 violations, 4 false refusals, 28 adversarial blocks, and 88/120 utility pass.

“external-guardrail | 0 / 0 | 4 | 28 | 88/120”

May combine two claims.

In the fixed validation-scenario contract results, all 30 scenarios passed every required check, with 109/109 expected source-backed claim references, 30/30 trace, 30/30 answer, 60/60 hygiene, and 0 failed.

“Total | 30/30 | 109/109 | 30/30 | 30/30 | 60/60 | 0”

May combine two claims.

Pairwise McNemar tests show violations admitted: harness vs. prompt-only 30/0, p < 0.001; prompt-only vs. external-guardrail 0/30, p < 0.001; harness vs. external-guardrail 0/0, p = 1.

“Violations admitted: harness vs. prompt-only 30/0, 𝑝 < 0.001; prompt-only vs. external-guardrail 0/30, 𝑝 < 0.001; harness vs. external-guardrail 0/0, 𝑝 = 1.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Hyundai Motor group has 15 source-backed runtime claims.

“Hyundai Motor | 15 | Financial baselines/trends; OEM/Kia performance; parts, logistics, and defense/rail operating signals | Mobility-centered affiliate routing”

Probably not a substantial claim: may not pass S3 (load-bearing).

Recovery adds the one provider-call failure, yielding 36 recovery runs.

“and therefore adds the one provider-call failure, yielding 36 recovery runs”

May combine two claims.

In the fixed-scenario latency test, the baseline run had average latency 1648.23ms, median 1475ms, p90 1876ms, and 16/30 runs within the 1500ms budget.

“Average latency | 1648.23ms | 69.40ms”

• Also stated in: § A6 Live-LLM Composition-Boundary Protocol · plain

  “Runs within 1500ms budget | 16/30 | 30/30”

May combine two claims.

Recommendation-style phrasing was blocked across 270 runs, with 0 failures.

“Recommendation-language absence 270 0 -Recommendation-style phrasing was blocked.”

May combine two claims.

Every shortfall fell on the composition side and was caught and recorded by the composition-boundary evaluation checks.

“Every shortfall fell on the composition side and was caught and recorded by the composition-boundary evaluation checks.”

May combine two claims.

Pairwise McNemar tests show false refusals: harness vs. external-guardrail and prompt-only vs. external-guardrail 4/0, p = 0.13; harness vs. prompt-only 0/0, p = 1.

“False refusals: harness vs. external-guardrail and prompt-only vs. external-guardrail 4/0, 𝑝 = 0.13; harness vs. prompt-only 0/0, 𝑝 = 1.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Recovery is counted over all 270 runs.

“Recovery is counted over all 270 runs”

May combine two claims.

A bolt-on external guardrail blocked the same violations but only by over-refusing and sacrificing utility.

“A bolt-on external guardrail blocked the same violations but only by over-refusing and sacrificing utility”

• AssumptionRests on an assumption: The fixed validation scenarios and live-API tests validly measure the source-grounding, entity-routing, trace, output-hygiene, and recommendation-language contracts.

May combine two claims.

In the fixed-scenario latency test, the optimized run had average latency 69.40ms, median 77ms, p90 95ms, and 30/30 runs within the 1500ms budget.

“Average latency | 1648.23ms | 69.40ms”

• Also stated in: § A6 Live-LLM Composition-Boundary Protocol · plain

  “Median latency | 1475ms | 77ms”

• Also stated in: § A6 Live-LLM Composition-Boundary Protocol · plain

  “Runs within 1500ms budget | 16/30 | 30/30”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Hanwha group has 20 source-backed runtime claims.

“Hanwha | 20 | Group financials; construction pipeline; value-up/capital allocation/governance; aerospace, renewables, systems, and shipbuilding drivers | Cross-affiliate boundary across defense, energy, shipbuilding”

May combine two claims.

For GPT-4.1 mini, the first-pass live contract passed 89/90, recovery 1, final pass 77/90, final failure 13/90.

“GPT-4.1 mini | 90 | 89/90 | 1 | 77/90 | 13/90”

May combine two claims.

On a bounded public-data slice, the harness preserved its contracts across the fixed scenarios and flagged deliberately broken ones under fault injection, kept its code-owned checks intact when the composition model was substituted, and, under an enforcement-layer ablation, showed that the code-owned validation gate is load-bearing where prompt instructions alone are not.

“On a bounded public-data slice, the harness preserved its contracts across the fixed scenarios and flagged deliberately broken ones under fault injection, kept its code-owned checks intact when the composition model was substituted, and, under an enforcement-layer ablation, showed that the code-owned validation gate is load-bearing where prompt instructions alone are not.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The Samsung group has 36 source-backed runtime claims.

“Samsung | 36 | Financial baselines/trends; memory, battery, bio, components, and finance-company boundary claims | Broad affiliate-mix routing”

Probably not a substantial claim: may not pass S3 (load-bearing).

Output-contract validation is counted over the 269 runs that returned a live response.

“Output-contract validation is counted over the 269 runs that returned a live response”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The reference slice has uneven source and claim depth: one group is the deepest reference case, with four group extensions, although the same six-scenario design applies to each.

“The reference slice has uneven source and claim depth: one group is the deepest reference case, with four group extensions, although the same six-scenario design applies to each.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Runtime-interface tests verify the live filing, market, and news interfaces and record connectivity as a runtime state.

“Runtime-interface tests verify the live filing, market, and news interfaces and record connectivity as a runtime state.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The claim can support margin, trend, or portfolio questions.

“The claim can support margin, trend, or portfolio questions.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

Prompting and vibe coding are valuable for early exploration and explain why prototype systems can be built quickly.

“Prompting and vibe coding are valuable for early exploration and explain why prototype systems can be built quickly.”

Probably not a substantial claim: may not pass S3 (load-bearing).

MLOps research treats operationalization as a concern that spans the full system lifecycle.

“Machine learning operations (MLOps) research likewise treats operationalization as a concern that spans the full system lifecycle [5].”

• cites [5]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The named-direction works above are largely surveys, conceptual definitions, or harness automation, while the call-, pipeline-, and runtime-level tools assert their guarantees by construction.

“The second concerns evidence: the named-direction works above are largely surveys, conceptual definitions, or harness automation, while the call-, pipeline-, and runtime-level tools assert their guarantees by construction.”

Classified as probably not a substantial claim.

Leakage checks block internal claim identifiers, raw trace records, API diagnostics, fixture labels, and internal-only status text from the reader-facing answer.

“Leakage checks block internal claim identifiers, raw trace records, API diagnostics, fixture labels, and internal-only status text from the reader-facing answer.”

Probably not a substantial claim: may not pass S2 (checkable).

Because these responsibilities are implicit and entangled, audit, replay, and transfer require them to be relocated from prompts into explicit artifacts.

“However, because these responsibilities are implicit and entangled, audit, replay, and transfer require them to be relocated from prompts into explicit artifacts.”

Classified as probably not a substantial claim. May combine two claims.

These per-scenario fields are evaluated under shared trace, prohibited-pattern, and latency-budget contracts, and a scenario passes only when all required evidence and trace fields resolve and no configured blocker fires.

“These per-scenario fields are evaluated under shared trace, prohibited-pattern, and latency-budget contracts, and a scenario passes only when all required evidence and trace fields resolve and no configured blocker fires.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Fixed scenarios must preserve entity scope, required answer signals, and recommendation-language constraints.

“Fixed scenarios must preserve entity scope, required answer signals, and recommendation-language constraints.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The scenario questions are product-facing briefing prompts, not investment advice or recommendations.

“The scenario questions are product-facing briefing prompts, not investment advice or recommendations.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

Prompt-dominant development is useful for exploration and is related to vibe coding.

“Prompt-dominant development is useful for exploration and is related to vibe coding, a conversational LLM-assisted software-development workflow popularized by Karpathy [1,2].”

• cites [1]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [2]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Such prompts carry behavior well enough to demonstrate it, but not to guarantee it.

“Such prompts carry behavior well enough to demonstrate it, but not to guarantee it.”

May combine two claims.

The proposed system adopts the maintained-knowledge idea while reassigning authority: because such compilation is lossy, source manifests and source-backed claims remain the runtime source of truth, and the LLM Wiki is compiled as a concise context layer for humans and models.

“The proposed system adopts the maintainedknowledge idea while reassigning authority: because such compilation is lossy, source manifests and source-backed claims remain the runtime source of truth, and the LLM Wiki is compiled as a concise context layer for humans and models.”

Classified as probably not a substantial claim. May combine two claims.

Promotion is the admission boundary of the architecture: it turns unbounded source documents into atomic, provenance-bound, entity-scoped units, so that a code-owned layer-not the model or retrieval-decides which statements may be asserted as fact, each of which stays traceable to its source.

“Promotion is therefore the admission boundary of the architecture: it turns unbounded source documents into atomic, provenance-bound, entity-scoped units, so that a code-owned layer-not the model or retrieval-decides which statements may be asserted as fact, each of which stays traceable to its source.”

Classified as probably not a substantial claim. May combine two claims.

The controlled 25-company slice supports routing and transferability tests while keeping source eligibility auditable.

“The controlled 25-company slice supports routing and transferability tests while keeping source eligibility auditable.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

In compliance-sensitive enterprise settings a single contract violation-an unauthorized recommendation or a leaked internal field-outweighs average answer quality; these system-contract checks verify those per-answer obligations.

“In compliance-sensitive enterprise settings a single contract violation-an unauthorized recommendation or a leaked internal field-outweighs average answer quality; these system-contract checks verify those per-answer obligations.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The ranking provides a reproducible sampling rule at the corporate-group level, independent of investment-quality assessment.

“The ranking provides a reproducible sampling rule at the corporate-group level, independent of investment-quality assessment.”

Classified as probably not a substantial claim.

The LLM Wiki pattern proposes a maintained markdown knowledge layer between raw sources and query-time answers.

“The LLM Wiki pattern [52] proposes a maintained markdown knowledge layer between raw sources and query-time answers.”

• cites [52]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

The trace contract records how a visible answer was assembled while keeping internal details out of the reader-facing answer.

“The trace contract that supports these gates, summarized in Table 1, is a method artifact that records how a visible answer was assembled while keeping internal details out of the reader-facing answer.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Runtime answers depend on promoted claims, source manifests, and validation gates, not on the ledger itself.

“Runtime answers depend on promoted claims, source manifests, and validation gates, not on the ledger itself.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The corporate-group boundary follows the 2026 ranking by fair-value assets in its official designation results: Samsung, SK, Hyundai Motor, LG, and Hanwha form the top-five corporate-group set after Hanwha entered fifth place.

“The corporate-group boundary follows the 2026 ranking by fair-value assets in its official designation results: Samsung, SK, Hyundai Motor, LG, and Hanwha form the top-five corporate-group set after Hanwha entered fifth place [63].”

• cites [63]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Follow-up questions are treated as part of the output contract: the reference implementation generates them with a deterministic topic-conditioned builder, and validation checks that enough customer-facing follow-ups are present and free of generic or internal-review wording.

“Follow-up questions are treated as part of the output contract: the reference implementation generates them with a deterministic topic-conditioned builder, and validation checks that enough customer-facing follow-ups are present and free of generic or internal-review wording.”

Classified as probably not a substantial claim.

The reconstructed architecture adds a control layer for source authority, entity scope, trace retention, and reader-facing constraints.

“Prompt, model, and output evaluation tools measure important application behavior; the reconstructed architecture adds a control layer for source authority, entity scope, trace retention, and reader-facing constraints.”

Classified as probably not a substantial claim. May combine two claims.

Frameworks for auditing AI systems distinguish governance-, model-, and application-level audits; the contract checks in this paper sit at the application level, auditing whether a deployed answer honors its source, routing, and output obligations.

“Frameworks for auditing AI systems similarly distinguish governance-, model-, and application-level audits [56]; the contract checks in this paper sit at the application level, auditing whether a deployed answer honors its source, routing, and output obligations.”

• cites [56]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

The control layer owns several governance responsibilities independent of the LLM: source eligibility, entity routing for corporate-scope binding, claim eligibility for runtime admission, answer planning, follow-up filtering, trace generation, and validation.

“The control layer owns several governance responsibilities independent of the LLM: source eligibility, entity routing for corporate-scope binding, claim eligibility for runtime admission, answer planning, follow-up filtering, trace generation, and validation.”

Probably not a substantial claim: may not pass S4 (based).

The harness-engineering method reconstructs a prompt-dominant LLM prototype into a traceable LLM-agent architecture.

“The harness-engineering method reconstructs a prompt-dominant LLM prototype into a traceable LLM-agent architecture.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

RAG evaluation frameworks measure properties such as faithfulness, answer relevance, and context relevance, while broader benchmark work supports multi-scenario evaluation.

“RAG evaluation frameworks measure properties such as faithfulness, answer relevance, and context relevance [57,58], while broader benchmark work supports multi-scenario evaluation [59].”

• cites [57]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [58]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [59]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Manifest registration acts as a source gate, preventing the knowledge base from becoming an unbounded document folder.

“Manifest registration acts as a source gate, preventing the knowledge base from becoming an unbounded document folder.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Reader-facing answers must exclude internal traces while preserving source links and answer structure.

“Reader-facing answers must exclude internal traces while preserving source links and answer structure.”

Probably not a substantial claim: may not pass S3 (load-bearing).

A public-data slice enters the paper baseline only after it passes source, claim, routing, answer, trace, and latency checks.

“A public-data slice enters the paper baseline only after it passes source, claim, routing, answer, trace, and latency checks.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Source-inventory counts function as audit artifacts.

“Sourceinventory counts function as audit artifacts.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

The validation design described in this paper is suited to a pre-commercial research prototype before customer logs are available.

“The validation design described in this paper is suited to a pre-commercial research prototype before customer logs are available.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

This reporting layer keeps coverage tied to selected evidence, while the full 113-claim layer and the wider source ledger remain available for future transfer measurement.

“This reporting layer keeps coverage tied to selected evidence, while the full 113-claim layer and the wider source ledger remain available for future transfer measurement.”

Classified as probably not a substantial claim. May combine two claims.

The audit trace aggregates routing, source states, claims, and validation results, making each produced answer auditable.

“The runtime returns two outputs, a reader-facing answer and an audit trace; the trace, which aggregates routing, source states, claims, and validation results, is what makes each produced answer auditable.”

Probably not a substantial claim: may not pass S1 (asserted).

What remains unmeasured, at the product level, is whether an enterprise contract layer is enforced rather than merely instructed.

“What remains unmeasured, at the product level, is whether an enterprise contract layer is enforced rather than merely instructed.”

Classified as probably not a substantial claim. May combine two claims.

Manifest registration keeps source use auditable before synthesis, claims are the runtime unit of factual knowledge, and the companyId field on a claim supports affiliate-level routing so that a question about one affiliate is not answered with unrelated corporate-group evidence.

“Manifest registration keeps source use auditable before synthesis, claims are the runtime unit of factual knowledge, and the companyId field on a claim supports affiliate-level routing so that a question about one affiliate is not answered with unrelated corporate-group evidence.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Surveys of agent evaluation organize these efforts along capability, reliability, and safety dimensions, of which the contract checks in this paper instantiate the reliability and safety dimensions at the product level.

“Surveys of agent evaluation further organize these efforts along capability, reliability, and safety dimensions [60], of which the contract checks in this paper instantiate the reliability and safety dimensions at the product level.”

• cites [60]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based). May combine two claims.

Live interfaces and orchestration should connect to external sources while preserving the answer contract.

“Live interfaces and orchestration should connect to external sources while preserving the answer contract.”

Classified as probably not a substantial claim.

Fixed validation-scenario tests verify expected claim coverage, entity routing, trace integrity, internal-trace leakage prevention, follow-up quality, and output structure.

“These checks are exercised by fixed validation-scenario tests, which verify expected claim coverage, entity routing, trace integrity, internal-trace leakage prevention, follow-up quality, and output structure.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

The language model remains responsible for language composition, while source eligibility, entity resolution, claim selection, answer planning, answer-structure rules, follow-up filtering, trace generation, and validation are represented as explicit artifacts.

“The language model remains responsible for language composition, while source eligibility, entity resolution, claim selection, answer planning, answer-structure rules, follow-up filtering, trace generation, and validation are represented as explicit artifacts.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Language checks enforce the insight-first answer structure and block recommendation-style phrasing such as buy, sell, or target-price instructions.

“Language checks enforce the insight-first answer structure and block recommendation-style phrasing such as buy, sell, or target-price instructions.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Productization introduces requirements that prompts alone do not enforce: each visible claim should be traceable to bounded sources, routed to the correct entity, constrained in what it may assert, regenerated under the same assumptions, and audited through explicit, versioned artifacts.

“Productization introduces requirements that prompts alone do not enforce: each visible claim should be traceable to bounded sources, routed to the correct entity, constrained in what it may assert, regenerated under the same assumptions, and audited through explicit, versioned artifacts.”

• cites [3]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [5]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Link checks require cited sources and follow-ups to resolve to source-link packages, public locators, or documented fallback states.

“Link checks require cited sources and follow-ups to resolve to source-link packages, public locators, or documented fallback states.”

Classified as probably not a substantial claim. May combine two claims.

Because such compilation is lossy, the wiki is used only as context: source manifests and source-backed claims, not the compiled pages, remain authoritative, and the generated pages themselves declare that they are not a source-backed claim set.

“Because such compilation is lossy, however, the wiki is used only as context: source manifests and source-backed claims, not the compiled pages, remain authoritative, and the generated pages themselves declare that they are not a source-backed claim set.”

Classified as probably not a substantial claim.

The maintained knowledge layer gives humans and LLMs a concise, readable overview of what is known about each entity, rather than re-synthesizing the same raw documents for every question.

“It serves a practical role: rather than re-synthesizing the same raw documents for every question, it gives humans and LLMs a concise, readable overview of what is known about each entity.”

Classified as probably not a substantial claim.

Software-engineering research on AI-based systems emphasizes that production AI depends on data management, testing, lifecycle controls, monitoring, and assurance artifacts beyond model performance.

“Software-engineering research on AI-based systems emphasizes that production AI depends on data management, testing, lifecycle controls, monitoring, and assurance artifacts beyond model performance [4,55].”

• cites [4]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [55]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

Practitioner tools support prompt, model, and application regression checks.

“Practitioner tools also support prompt, model, and application regression checks [61].”

• cites [61]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Where RAG and benchmark frameworks measure answer quality, this design checks a different property: whether every answer honors its contracts for source grounding, entity routing, trace completeness, output hygiene, runtime interface, and latency.

“Where RAG and benchmark frameworks measure answer quality, this design checks a different property: whether every answer honors its contracts for source grounding, entity routing, trace completeness, output hygiene, runtime interface, and latency.”

Classified as probably not a substantial claim. May combine two claims.

The baseline fixes the system contract and separates validation of the control layer from model sampling effects.

“This baseline fixes the system contract and separates validation of the control layer from model sampling effects.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Following the LLM Wiki pattern, the system maintains markdown knowledge pages that sit between raw sources and query-time answers.

“Following the LLM Wiki pattern, the system maintains markdown knowledge pages that sit between raw sources and query-time answers [52].”

• cites [52]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

These per-group counts differ because they reflect how many statements passed the promotion gates for each group's validation scenarios and answer templates; Samsung is the largest because its claim set additionally spans finance and other listed affiliates to exercise broad affiliate-mix routing and finance-company boundaries, so the full claim layer covers more companies than the 25-company sele

“These per-group counts differ because they reflect how many statements passed the promotion gates for each group's validation scenarios and answer templates; Samsung is the largest because its claim set additionally spans finance and other listed affiliates to exercise broad affiliate-mix routing and finance-company boundaries, so the full claim layer covers more companies than the 25-company sele”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Market and news inputs are registered the same way but typically attach as traceable runtime signals rather than as promoted claims.

“Market and news inputs are registered the same way but typically attach as traceable runtime signals rather than as promoted claims.”

May combine two claims.

In the live-LLM composition-boundary check, the trace contract passed for 270 runs and failed for 0 runs, with audit-envelope fields preserved.

“Trace contract 270 0 -Audit-envelope fields were preserved.”

May combine two claims.

In the live-LLM composition-boundary check, follow-up quality passed for 270 runs and failed for 0 runs, with follow-up prompts remaining customer-facing.

“Follow-up quality 270 0 -Follow-up prompts remained customer-facing.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In the live-LLM composition-boundary check, the credential check passed for 270 runs and failed for 0 runs, indicating all reported runs had a usable credential path.

“Credential check 270 0 -All reported runs had a usable credential path.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Raw issuer materials are not redistributed; the repository provides public URLs and redistributable metadata in their place.

“Raw issuer materials are not redistributed; the repository provides public URLs and redistributable metadata in their place.”

Classified as probably not a substantial claim.

The enforcement-layer ablation held the model fixed and varied only how the rules are enforced.

“The enforcement-layer ablation answers RQ3 by holding the model fixed and varying only how the rules are enforced.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The versioned JSON artifacts retain the Korean prompts, expected source-backed claim identifiers, routing expectations, and required answer signals per scenario, together with the shared answer-policy and trace contracts.

“The versioned JSON artifacts retain the Korean prompts, expected source-backed claim identifiers, routing expectations, and required answer signals per scenario, together with the shared answer-policy and trace contracts.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The appendix documents the 30 fixed validation scenarios underlying Table 6, covering five Korean corporate groups with six scenarios per group: five company briefings and one cross-company comparison.

“This appendix documents the 30 fixed validation scenarios underlying Table 6.The set covers five Korean corporate groups, with six scenarios per group: five company briefings and one cross-company comparison.”

Classified as probably not a substantial claim.

The fault-injection check starts from one valid baseline scenario and produces seven mutated copies, each modifying exactly one contract property.

“The fault-injection check starts from one valid baseline scenario and produces seven mutated copies, each modifying exactly one contract property.”

May combine two claims.

In the live-LLM composition-boundary check, the source-link package passed for 270 runs and failed for 0 runs, with source links remaining attached to the answer package.

“Source-link package 270 0 -Source links remained attached to the answer package.”

May combine two claims.

In the live-LLM composition-boundary check, visible answer structure passed for 250 runs and failed for 20 runs, with some visible answers lacking required answer signals.

“Visible answer structure 250 20 -Some visible answers lacked required answer signals.”

Classified as probably not a substantial claim.

Internal trace artifacts are kept out of both answer-support surfaces (source links and follow-up questions).

“Internal trace artifacts are kept out of both surfaces.”

Classified as probably not a substantial claim. May combine two claims.

The contribution is an engineering one: the paper evaluates preservation of code-checkable contracts, not the correctness of the promoted claims or the investment quality of the briefings.

“The contribution is an engineering one: the paper evaluates preservation of code-checkable contracts, not the correctness of the promoted claims or the investment quality of the briefings.”

Classified as probably not a substantial claim.

The three conditions in the enforcement-layer ablation differ only in which enforcement layer controls the reader-facing answer.

“so the three conditions differ only in which enforcement layer controls the reader-facing answer”

May combine two claims.

In the live-LLM composition-boundary check, JSON parse passed for 267 runs and failed for 2 runs, with two live responses failing JSON-object parsing.

“JSON parse 267 2 -Two live responses failed JSON-object parsing.”

Classified as probably not a substantial claim. May combine two claims.

By themselves, these results do not isolate whether the code-owned enforcement layer is load-bearing: a sufficiently well-instructed model might satisfy the rules from prompt text alone, or a generic output filter might enforce them without the harness gate.

“By themselves, however, these results do not isolate whether the code-owned enforcement layer is load-bearing: a sufficiently well-instructed model might satisfy the rules from prompt text alone, or a generic output filter might enforce them without the harness gate.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims. The quote only partly states this claim.

The runtime trace contract records stage-by-stage values, evidence artifacts, and user visibility for entity routing, source collection, claim selection, answer planning, and output validation.

“Runtime trace contract: stage-by-stage recorded values, evidence artifacts, and user visibility.”

Classified as probably not a substantial claim. May combine two claims.

Fixed validation scenarios test whether the system preserves its source-grounding, routing, trace, and answer-structure contracts; their role is to fix a reproducible baseline for contract preservation rather than to measure answer quality.

“Fixed validation scenarios test whether the system preserves its source-grounding, routing, trace, and answer-structure contracts; their role is to fix a reproducible baseline for contract preservation rather than to measure answer quality.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The final answer-support row in the validation scenario table is a support-surface example, not a seventh scenario, and each corporate group uses exactly six scenarios.

“The final answer-support row is a support-surface example, not a seventh scenario; each group still uses exactly six scenarios.”

Classified as probably not a substantial claim. May combine two claims.

Applied to a new enterprise target, the pattern requires registering public or client-approved sources, promoting source-backed claims, checking routing rules, and running scenario contracts, all of which the paper baseline makes inspectable before private documents, production credentials, or operational logs are introduced.

“Applied to a new enterprise target, the pattern requires registering public or client-approved sources, promoting source-backed claims, checking routing rules, and running scenario contracts, all of which the paper baseline makes inspectable before private documents, production credentials, or operational logs are introduced.”

May combine two claims.

In this ablation, the composition model is held fixed to isolate the enforcement layer; the separate composition-boundary check in Section 5.4 varies the hosted model and shows that the code-owned checks held across the three tested model identifiers.

“In this ablation, the composition model is held fixed to isolate the enforcement layer; the separate composition-boundary check in Section 5.4 varies the hosted model and shows that the code-owned checks held across the three tested model identifiers.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Each corporate group contributes five listed companies selected for stable source identifiers, representativeness, sector diversity for cross-group comparability, source availability, and claim-promotion feasibility.

“Each corporate group contributes five listed companies selected for stable source identifiers, representativeness, sector diversity for cross-group comparability, source availability, and claim-promotion feasibility.”

May combine two claims.

The preceding checks show that the harness preserves its contracts across fixed scenarios and under fault injection, and that its code-owned checks held under model substitution.

“The preceding checks show that the harness preserves its contracts across fixed scenarios and under fault injection, and that its code-owned checks held under model substitution.”

Classified as probably not a substantial claim. May combine two claims.

System readiness stays separate from usefulness for investment analysis: this paper evaluates preservation of the source-grounding, entity-routing, trace, output-hygiene, and recommendation-language contracts, while expert review and deployment evidence are left to later domain-value evaluation.

“System readiness nonetheless stays separate from usefulness for investment analysis: this paper evaluates preservation of the source-grounding, entity-routing, trace, output-hygiene, and recommendation-language contracts, while expert review and deployment evidence are left to later domain-value evaluation.”

Classified as probably not a substantial claim.

The external-guardrail condition is representative of the pass/redact/refuse behavior of bolt-on moderation guardrails such as Llama Guard and the broader guardrail layer.

“representative of the pass/redact/refuse behavior of bolt-on moderation guardrails such as Llama Guard and the broader guardrail layer [9,45].”

• cites [9]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [45]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The paper presented a harness-engineering reconstruction of a prompt-dominant enterprise LLM prototype as an auditable LLM-agent architecture: deterministic behavior moves out of an expanding prompt and into versioned contracts-manifests, source-backed claims, answer contracts, and validation traces-while a replaceable model composes the reader-facing language.

“This paper presented a harness-engineering reconstruction of a prompt-dominant enterprise LLM prototype as an auditable LLM-agent architecture: deterministic behavior moves out of an expanding prompt and into versioned contracts—manifests, source-backed claims, answer contracts, and validation traces—while a replaceable model composes the reader-facing language.”

Classified as probably not a substantial claim. May combine two claims.

Only the harness branch is the production path; prompt-only and external-guardrail are ablation-only baselines selected by the enforcement-condition parameter.

“Only the harness branch is the production path; prompt-only and external-guardrail are ablation-only baselines selected by the enforcement-condition parameter.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The visible answer is part of the checked artifact.

“The visible answer is part of the checked artifact.”

May combine two claims.

In the latency comparison, both conditions used the deterministic composer and differed only in whether process-level caching and prewarming of live source retrieval was enabled.

“both conditions use the deterministic composer and differ only in whether process-level caching and prewarming of the live source retrieval is enabled”

May combine two claims.

In the live-LLM composition-boundary check, output-contract validation passed for 234 runs and failed for 35 runs, with structured live answers passing before fallback in 234 runs.

“Output-contract validation 234 35 -Structured live answers passed before fallback in 234 runs.”

May combine two claims.

Read together with RQ2, the two results triangulate where the guarantees reside: RQ2 varies the model with the harness fixed and finds the code-owned checks intact, while RQ3 fixes the model and varies the enforcement layer and finds the contract lost without the code-owned gate.

“Read together with RQ2, the two results triangulate where the guarantees reside: RQ2 varies the model with the harness fixed and finds the code-owned checks intact, while RQ3 fixes the model and varies the enforcement layer and finds the contract lost without the code-owned gate.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The reference implementation, source manifests, evidence records, claim records, validation scenarios, scripts, and evaluation artifacts are available in the project repository [62] and archived on Zenodo (DOI: 10.5281/zenodo.21269426), pinned at release tag public-baseline-v0.5.16.4 (commit e8e60fb8ea6e34d4caa53f00187e760b67bd973a), from which the reported numbers are reproduced.

“The reference implementation, source manifests, evidence records, claim records, validation scenarios, scripts, and evaluation artifacts are available in the project repository [62] and archived on Zenodo (DOI: 10.5281/zenodo.21269426),pinned at release tag public-baseline-v0.5.16.4 (commit e8e60fb8ea6e34d4caa53f00187e760b67bd973a), from which the reported numbers are reproduced.”

• cites [62]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The separation of model-composed parts from code-owned checks serves two audiences at once: enterprise readers get a useful answer, while operators and auditors get a separate trace that explains how it was assembled.

“This separation is also what serves two audiences at once: enterprise readers get a useful answer, while operators and auditors get a separate trace that explains how it was assembled.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The live-LLM boundary check is retained as a composition-boundary sensitivity record, not as a general model benchmark.

“The live-LLM boundary check is retained as a composition-boundary sensitivity record, not as a general model benchmark.”

Classified as probably not a substantial claim. May combine two claims.

These results are systems-engineering evidence, not evidence of investment-answer quality.

“These results are systems-engineering evidence, not evidence of investment-answer quality.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Generation ran at a low but nonzero temperature of 0.2, so repeated runs of the same scenario can differ; the three repeats capture that run-to-run variation.

“Generation ran at a low but nonzero temperature of 0.2, so repeated runs of the same scenario can differ; the three repeats capture that run-to-run variation.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The Wilson intervals summarize binomial sampling uncertainty around each model's observed pass rate over its 90 runs and are not estimates of investment-answer quality or future provider behavior.

“The Wilson intervals summarize the binomial sampling uncertainty around each model's observed pass rate over its 90 runs; they are not estimates of investment-answer quality or of future provider behavior.”

• cites [67]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim. May combine two claims.

DART filings, issuer IR materials, KRX market rows, and news-search results are registered as source manifests and evidence records; a promotion gate admits eligible statements into the runtime-eligible layer (source-backed claims, wiki context, and runtime answer context), while non-eligible inputs are held back.

“DART filings, issuer IR materials, KRX market rows, and news-search results are registered as source manifests and evidence records; a promotion gate admits eligible statements into the runtime-eligible layer (source-backed claims, wiki context, and runtime answer context), while non-eligible inputs are held back.”

May combine two claims.

In the live-LLM composition-boundary check, source-claim references passed for 252 runs and failed for 18 runs, with expected source-backed claims remaining a required contract.

“Source-claim references 252 18 -Expected source-backed claims remained a required contract.”

May combine two claims.

Relocating enterprise behavior from prompts to inspectable contracts is what makes the system auditable rather than merely plausible-in short, prompts are not guardrails.

“Relocating enterprise behavior from prompts to inspectable contracts is what makes the system auditable rather than merely plausible—in short, prompts are not guardrails.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

The harness earns its cost when product behavior must move from plausible interaction to governed operation, so that approved source boundaries, claim eligibility, answer contracts, and traces become explicit organizational capabilities rather than informal conventions.

“The harness earns its cost when product behavior must move from plausible interaction to governed operation, so that approved source boundaries, claim eligibility, answer contracts, and traces become explicit organizational capabilities rather than informal conventions.”

• AssumptionThe authors state this as an assumption: The adoption ladder is a planning heuristic, not derived from the experiments.

Probably not a substantial claim: may not pass S3 (load-bearing).

The enforcement-layer ablation adds ten adversarial scenarios beyond the thirty fixed validation scenarios: two per corporate group, following a uniform two-template design.

“The enforcement-layer ablation (Section 5.5) adds ten adversarial scenarios beyond the thirty fixed validation scenarios: two per corporate group, following a uniform two-template design (Table A5).”

May combine two claims.

The significant between-model difference is a property of the attached model, not the harness: it lies entirely in the model-composed checks, while the code-owned checks held 270/270 for every model.

“The significant between-model difference is thus a property of the attached model, not the harness: it lies entirely in the model-composed checks, while the code-owned checks held 270/270 for every model.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The latency figure is an operational signal, not a quality result.

“the latency figure is an operational signal, not a quality result”

Probably not a substantial claim: may not pass S3 (load-bearing).

The figures are recomputed from the committed artifact by a script pinned to the cited repository version, so they cannot drift from the underlying data.

“The figures are recomputed from the committed artifact by a script pinned to the cited repository version, so they cannot drift from the underlying data.”

• cites [62]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

The paper proposes a five-level descriptive planning heuristic for enterprise LLM-agent adoption, from prompt-centered task support to traceable enterprise harness.

“Descriptive planning heuristic for enterprise LLM-agent adoption.The levels are a proposed ladder for locating an adoption stage and motivating the harness layer; organizational scoring remains a separate assessment.”

May combine two claims.

The pattern reported here offers a reusable path for enterprise LLM productization: it turns an exploratory enterprise LLM prototype into an application whose source, control, and validation artifacts can be inspected, versioned, tested, and extended.

“The pattern reported here offers a reusable path for enterprise LLM productization: it turns an exploratory enterprise LLM prototype into an application whose source, control, and validation artifacts can be inspected, versioned, tested, and extended.”

Classified as probably not a substantial claim.

The left branch (no LLM provider) is the deterministic replay baseline, not a fourth condition.

“The left branch (no LLM provider) is the deterministic replay baseline, not a fourth condition: Table8varies the enforcement layer only on the provider-configured live branch.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In the live-LLM composition-boundary check, recovery was used in 36 runs and not needed in 234 runs, with invalid or unavailable live output triggering fallback.

“Recovery --36 used; 234 not needed Invalid or unavailable live output triggered fallback.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the live-LLM composition-boundary check, recommendation-language absence passed for 270 runs and failed for 0 runs.

“Recommendation-language absence 270 0”

May combine two claims.

Across the three research questions, the contracts hold on the fixed scenarios (RQ1), their code-owned checks remain stable under model substitution (RQ2), and their reader-facing guarantees are lost when the code-owned gate is removed (RQ3).

“the contracts hold on the fixed scenarios (RQ1), their code-owned checks remain stable under model substitution (RQ2), and their reader-facing guarantees are lost when the code-owned gate is removed (RQ3)”

Classified as probably not a substantial claim. May combine two claims.

Raw model output is not stored by default; the trace instead records the requested model identifier, output-contract status, recovery path, final harness-contract result, and a hash, character count, and short preview of the response, so failures can be audited without exposing raw text.

“Raw model output is not stored by default; the trace instead records the requested model identifier, output-contract status, recovery path, final harness-contract result, and a hash, character count, and short preview of the response, so failures can be audited without exposing raw text.”

Probably not a substantial claim: may not pass S3 (load-bearing).

These checks validate reference resolution and contract preservation, not the upstream correctness of which claims were promoted.

“These checks validate reference resolution and contract preservation, not the upstream correctness of which claims were promoted, which is treated as a limitation (Section 7).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Live-LLM provider composition latency is out of scope for the latency check.

“live-LLM provider composition latency is out of scope”

Probably not a substantial claim: may not pass S3 (load-bearing).

The aggregate 7/7 detection result reported in Section 5.3 corresponds row-by-row to the fault-injection mutation protocol table.

“the aggregate 7/7 detection result reported in Section 5.3 corresponds row-by-row to this table”

May combine two claims.

The harness is not a replacement for prompt engineering: prompts still guide language behavior, while the code-owned layer owns evidence boundaries, entity scope, output structure, leakage prevention, and inspection.

“This does not make the harness a replacement for prompt engineering: prompts still guide language behavior, while the code-owned layer owns evidence boundaries, entity scope, output structure, leakage prevention, and inspection.”

Classified as probably not a substantial claim.

The traceable LLM-agent harness architecture separates a source layer, runtime assembly, a code-owned control layer (product rules and validation gates), and two outputs (a reader-facing answer and an audit trace).

“The architecture separates source layer, runtime assembly, a code-owned control layer (product rules and validation gates), and two outputs (a reader-facing answer and an audit trace).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

In the live-LLM composition-boundary check, the live LLM call passed for 269 runs and failed for 1 run, with one hosted call failing before parse.

“Live LLM call 269 1 -One hosted call failed before parse.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

The same adoption ladder can also classify AI tasks grounded in physical operations-store, factory, logistics, or equipment signals-when those signals are registered as governed sources rather than treated as unbounded context.

“The same ladder can also classify AI tasks grounded in physical operations—store, factory, logistics, or equipment signals—when those signals are registered as governed sources rather than treated as unbounded context.”

• AssumptionThe authors state this as an assumption: The adoption ladder is a planning heuristic, not derived from the experiments.

Probably not a substantial claim: may not pass S3 (load-bearing).

Each adversarial scenario is a Korean user prompt engineered to elicit one specific contract violation.

“Each is a Korean user prompt engineered to elicit one specific contract violation”

May combine two claims.

The code-owned guarantees are decoupled from the substituted model-enterprise reliability depends on separating model phrasing from source authority, trace generation, recovery handling, and output-contract validation, so that swapping the composition model does not move the reader-facing contract.

“The interpretation is that the code-owned guarantees are decoupled from the substituted model—enterprise reliability depends on separating model phrasing from source authority, trace generation, recovery handling, and output-contract validation, so that swapping the composition model does not move the reader-facing contract.”

May combine two claims.

In the live-LLM composition-boundary check, development-leak absence passed for 270 runs and failed for 0 runs, with internal trace artifacts not leaking into visible answers.

“Development-leak absence 270 0 -Internal trace artifacts did not leak into visible answers.”