{"id":"230e19f4-a812-4e22-a654-00eaa9ff70cf","arxiv_id":"2607.05483","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"low","formal_verification":"none","parameter_count":3,"one_line_summary":"Projected reads plus verified structured patches and path footprints reduce leakage and illegal commits in shared-state LLM workflows on a 46-case benchmark.","lead":"PatchOptic couples projected state views with verified JSON Patch writes so LLM workflow steps can update shared structured state without seeing or writing outside declared authority. It matters because progressive disclosure is already common, but local rewrites still lack a clear contract for global validity, leakage, and composition.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Empirical gains rest on a hand-authored 46-case suite whose traps match the enforced contracts, plus GPT-5-mini as both actor and judge; no deeper design inconsistency found.","rationale":"The reader’s weakest_assumption already isolates the correct soft spot: trusted policy author plus dependence on the hand-authored suite, GPT-5-mini actor/judge, and fixed 0.80 threshold. No internal contradiction appears in the runtime path (projected view + four verifier gates), the footprint algebra (restriction/union/commutation under the stated determinism and fixed-footprint assumptions), or the reported tables; View Only / Verify Only / PatchOptic ablations cleanly separate mechanisms, and the 9/9 no-model rejection is decisive for patch-source scope. Residual transformed leakage and weak-actor quality drop are acknowledged. The concern therefore does not overturn the systems contribution or justify moving off CONDITIONAL; it simply confirms why the verdict is not ACCEPT. The proposed test would falsify suite-specific over-fit without requiring a theory rewrite.","tokens_in":19539,"tokens_out":575,"duration_ms":21686,"concrete_test":"Commission an independent team (no access to PatchOptic source or original L0–L5 tags) to author 15 new shared-state cases across ≥3 new domains; re-run the six-setting, ten-round protocol with GPT-5-mini actor and a different judge (Claude or human raters). If PatchOptic’s semantic-pass lift vs full-state baselines falls below +0.10 or relative leak-rate reduction is <50 %, the headline empirical claim weakens.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest claim’s numbers (semantic pass ~0.78–0.80 vs ~0.61, leak runs ~0.1/round, 9/9 hidden-source rejections) are produced by PatchBench cases deliberately constructed around L0–L5 levels and tags for hidden-value exfiltration, patch-source smuggling, phase/scope violations, etc. (Table 3, §4.1). Projection and verification are therefore scored against traps the design is built to catch. GPT-5-mini further serves as both strong actor and the quality/leakage judge (fixed content-score ≥0.80 threshold plus two-stage matcher+review). The paper states the policy-trust and suite limitations honestly (§2, §6), yet this remains the least secure condition for the quantitative claim: magnitudes may not transfer to independently authored workflows or human-evaluated outputs. Runtime gates and the no-model artifact test themselves are clean and well-ablated.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes PatchOptic, a step interface for multi-step LLM workflows over shared structured state. Each step declares an authority triple (projected-read view Os, write region Ws, patch-source region Ps) plus phase, schema, and invariant checks. At runtime the actor sees only Os(x) and proposes a JSON Patch that is verified against the full state before commit; the same declaration yields a path-level footprint algebra for restriction (delegation), union (composition), and same-phase commutation certificates. Evaluation uses PatchBench (46 hand-authored cases, six domains, levels L0–L5) under six ablations (Unconstrained, Schema Only, FSM+ACL, View Only, Verify Only, PatchOptic), two actors (GPT-5-mini and local Mistral 7B), ten rounds, plus a separate no-model test of nine compromised patches that name hidden sources. Reported findings: projected reads cut leak runs to ~0.1/round and reduce tokens while preserving accepted-output quality under the strong actor (semantic pass ~0.78–0.80 vs ~0.61 full-state); phase/scope verification eliminates unsafe accepts in the audited slice; Verify Only and PatchOptic reject 9/9 hidden-source artifacts via patch_read_scope_violation.","tokens_in":19813,"tokens_out":1661,"duration_ms":21507,"significance":"If the results hold under broader workflows, PatchOptic supplies a concrete, inspectable contract that closes a real gap between progressive-disclosure reads and global write validity in agentic systems—something schema validators and constrained decoding alone do not provide. Strengths that should be credited: (1) clean six-setting ablations that separate structured output, phase/path ACLs, projection, and full verification; (2) explicit separation of live actor runs from no-model compromised-artifact tests; (3) an honest failure model (Table 1) that does not overclaim semantic correctness or policy-authorized disclosure; (4) dual-actor evaluation showing how projection interacts with weak vs strong models; (5) released artifacts and fixed judge prompts that support reanalysis. The footprint algebra, while largely definitional, gives a usable static vocabulary for delegation and reordering that path-prefix ACLs and FSM policies typically lack. The work is a solid systems contribution for shared-state LLM workflows rather than a foundational theoretical result.","major_comments":[{"comment":"§4.1 and Table 3: PatchBench’s 46 cases are hand-authored around L0–L5 levels and tags (hidden-value exfiltration, patch-source smuggling, phase/scope traps) that match the contracts PatchOptic enforces. The quantitative claims in §5 (semantic pass ~0.78–0.80 vs ~0.61; leak runs ~0.1/round; 9/9 rejections) therefore measure performance on traps the design is built to catch. Ablations still isolate mechanisms, but the manuscript should state more clearly that absolute magnitudes are suite-specific and should either (a) add a small held-out or independently authored case set, or (b) reframe headline numbers as mechanism-isolation evidence rather than transferable effect sizes. This is load-bearing for the abstract’s numerical claims.","section":"§4.1, Table 3, §5"},{"comment":"Contribution (ii) and §3.2–3.5 vs §5–6: The footprint algebra (restriction, union, commutation certificate, composite external footprint σ(P), data-dependent FA(x)) is presented as a main contribution and appears in the abstract, yet §6 states it is “evaluated analytically rather than as a benchmark score.” No PatchBench case exercises delegation restriction, certified reordering, or composite reuse end-to-end. Either add a small static-check suite (e.g., N-actor same-phase reorder certificates and one composite packaging example with measured reuse), or demote the algebra in the abstract/contributions to a supporting static layer whose correctness is definitional under the stated assumptions (§3.4).","section":"§3.2–3.5, Contributions, §6"},{"comment":"§4.2 and §5.1: GPT-5-mini is both the strong actor and the semantic-quality / leakage-review judge (content score weights fixed; semantic pass requires score ≥0.80 and no reviewed leakage). Under this setup, View Only and PatchOptic preserve content score while cutting leakage—plausible, but judge–actor coupling can inflate accepted-output quality agreement. At minimum, report inter-judge agreement on a subsample with a second model or human raters for the content-score components, and sensitivity of semantic pass to the 0.80 threshold. Without that, the “preserving quality” half of the strong-actor claim is less secure than the leakage and reject-rate results.","section":"§4.2, §5.1, Table 5"}],"minor_comments":[{"comment":"Figure 1 and Table 2: The figure lists four gates (scope, schema, phase, invariants) while Table 2 expands six checks; the grouping note helps but a one-line mapping in the figure caption would reduce reader friction.","section":"Figure 1, Table 2"},{"comment":"§3.1: “When the projection is path-realizable, we write Rs…” — briefly state when a projection is not path-realizable and how the prototype handles that case, since later footprint definitions assume leaf paths in L.","section":"§3.1"},{"comment":"§5.2 / Table 6: “Verifier accepted” is defined as cross-setting disagreement and “does not imply semantic correctness,” but the column name still reads as a positive outcome. Rename to “Verifier disagreement” or similar to avoid misreading the audit.","section":"Table 6"},{"comment":"§3.4 commutation assumptions (deterministic actors, no retries/rollbacks, fixed footprints, verifier supports disjoint from the other actor’s writes) are strong relative to live stochastic agents. A short forward pointer in §3.4 to the empirical stochastic evaluation in §5 would clarify the static/dynamic split.","section":"§3.4"},{"comment":"Typos / polish: Abstract and §1 use “afootprint” without space; §7 “must still be satisfy” → “must still satisfy.” Date line “2026-06-30” and arXiv stamp are fine for preprint but should be normalized for journal production.","section":"Abstract, §1, §7"},{"comment":"Related work (§6) covers protection systems, structured generation, and prompt injection well; a brief explicit contrast with tool-permission / capability systems in agent frameworks (beyond the cited IFC and ACL lines) would help practitioners place PatchOptic.","section":"§6"}],"recommendation":"minor_revision","confidential_remarks":"Solid systems paper with unusually careful ablations and an honest failure model. The main risk for a top venue is overselling PatchBench magnitudes and the unevaluated footprint algebra; both are fixable with framing and modest extra experiments rather than redesign. Fit for a systems/ML or agent-safety venue is good; pure theory venues would find the optic connection thin (the paper correctly does not claim a full categorical optic). I would not reject on the hand-authored suite alone—that pattern is common in security benchmarks—but the authors should not lead with absolute percentages as if they were domain-general."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The useful punchline is simple: progressive disclosure already manages what an agent sees, but shared-state workflows still lack a contract for when a local rewrite is legal against the full state. PatchOptic’s actual novelty is binding projected read, write scope, and especially patch-source authority into one step declaration, then reusing that declaration for runtime gates and a footprint algebra (restriction, union, same-phase reordering, composite external footprint). They do not invent optics, JSON Patch, or RBAC; they make those pieces operational for LLM workflow commits.\n\nWhat works: the design in §3 is clear, the six-setting ablations separate projection from verification, and the no-model compromised-artifact test is the right check for patch-source smuggling—only Verify Only and PatchOptic reject all nine hidden-source patches. Table 1 is honest about what they do not claim (semantic correctness, policy mistakes, transformed leaks). Under GPT-5-mini, projected reads cut leak runs to ~0.1/round and raise semantic pass from ~0.61 to ~0.78–0.80 without hurting content score; tokens drop ~11–13%. The weak-actor audit also shows verification turning phase/scope errors into rejects rather than silent accepts.\n\nSoft spots, in proportion: PatchBench is 46 hand-authored cases built around the traps the contracts catch, and GPT-5-mini is both strong actor and quality/leakage judge. Magnitudes may not transfer to independently authored workflows or human evaluation. The footprint algebra is solid definitional machinery with a conservative static certificate, not a machine-checked optic or a large production deployment. Policy trust is load-bearing; they say so. None of that undoes the core engineering claim that the interface is coherent and the gates do what they say.\n\nThis is for people building multi-step agents over shared structured state who care about least-privilege commits. Worth a serious referee and worth engaging if you work on agent control layers. I would send it to peer review, not desk-reject it.","headline":"Clean systems paper that turns progressive disclosure into a real read/write/patch-source contract; gains are real but sit on a custom trap suite and LLM judge.","tokens_in":20423,"tokens_out":517,"would_cite":true,"duration_ms":10969,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"A declared step contract of projected reads and verified structured patches makes local LLM updates safe on shared workflow state.","keywords":["shared-state workflows","LLM agents","progressive disclosure","projected views","JSON Patch","access control","workflow verification","PatchOptic"],"falsifier":"On tasks with known hidden secrets and illegal patch sources, if projected-read plus full verification still leak protected values at rates comparable to full-state baselines, or if the verifier accepts patches that copy, move, or test paths outside the declared patch-source region, the central claim fails.","tokens_in":20382,"feed_emoji":"🔒","tokens_out":888,"duration_ms":17091,"temperature":0.7,"pith_summary":"Agentic workflows share structured state, but limited context forces each model call to see only a fragment—progressive disclosure. Existing tools manage that read side; they do not say when a rewrite proposed from the fragment is valid once applied to the full state. PatchOptic supplies the missing contract: each step declares a projected read view, an authorized write region, and a patch-source region. The actor sees only the projection; a verifier checks the structured patch against the whole state before commit. The same declaration yields path footprints for delegation, composition, and static same-phase reordering certificates. On PatchBench (46 cases across six domains), projected reads cut reported leakage and token cost while preserving accepted-output quality under a strong actor; runtime verification blocks declared contract violations; and patch-source checks reject compromised artifacts that name hidden sources.","feed_headline":"Projected views cut agent leaks without quality loss","feed_subtitle":"Verified structured patches block out-of-scope writes and hidden sources before commit.","key_machinery":"The optic-inspired authority triple (projected-read view, write region, patch-source region), realized as projected actor prompts plus a multi-gate verifier over structured patches (JSON Patch in the prototype), together with a footprint algebra of restriction, union, and a commutation condition for same-phase independence.","core_discovery":"The paper establishes that coupling projected reads with verified structured patches—under an optic-inspired authority triple of read view, write region, and patch-source region—gives a contract between local LLM rewrites and global validity in shared-state workflows. That contract reduces secret leakage and prompt cost at read time, blocks illegal commits before mutation, and yields footprints that support delegation, sub-workflow composition, and reordering certificates for independent same-phase steps.","pith_inferences":["The same projected-read and source-authority split could extend beyond JSON Patch to database updates, file edits, and tool side effects if every operation names its read sources.","Footprint commutation certificates open a path to schedule optimization of multi-agent workflows without full re-execution when writes and reads are disjoint.","Policy authorship becomes the critical surface; tooling that helps authors write least-privilege footprints may matter as much as the runtime.","Contract-valid but fabricated values remain open; combining these boundaries with stronger semantic checkers would close the remaining failure class the paper leaves to the actor."],"forward_implications":["Shared-state agent systems can hide fields from the model without relying on the model to self-censor.","Wrong-phase, out-of-scope, schema-invalid, and hidden-source patches can be rejected before they mutate global state.","Declared footprints support static certificates that independent same-phase steps may be reordered without changing final state.","Delegation and packaged sub-workflows can be checked by restriction and composite external footprints rather than reopening internal actors.","Compromised patch artifacts that name hidden sources can be rejected even with no live model in the loop."],"fun_headline_variants":["Projected views cut agent leaks and tokens, quality holds","Verified patches block illegal agent writes before commit","Optics contracts couple local rewrites to global state validity","Authority triples reduce leakage while guarding shared state","Path footprints enable safe agent delegation and reordering"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"The workflow policy author is trusted: if the declared read, write, or patch-source regions (or schemas and phase rules) are wrong or too broad, the runtime will enforce that incorrect contract.","fun_headline_variants_meta":{"raw":{"variants":["Projected views cut agent leaks and tokens, quality holds","Verified patches block illegal agent writes before commit","Optics contracts couple local rewrites to global state validity","Authority triples reduce leakage while guarding shared state","Path footprints enable safe agent delegation and reordering"]},"model":"grok-4.5","effort":"low","cost_usd":0.003704,"raw_usage":{"total_tokens":1208,"prompt_tokens":838,"num_sources_used":0,"completion_tokens":54,"cost_in_usd_ticks":37040000,"prompt_tokens_details":{"text_tokens":838,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":316,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":838,"tokens_out":54,"duration_ms":3281,"temperature":1.0,"reasoning_tokens":316,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T07:25:48.053677+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"On tasks with known hidden secrets and illegal patch sources, if projected-read plus full verification still leak protected values at rates comparable to full-state baselines, or if the verifier accepts patches that copy, move, or test paths outside the declared patch-source region, the central claim fails.","supporting_citations":[],"review_version":1}