{"id":"7a13dd85-db92-472f-8805-c0bab28c9f5e","arxiv_id":"2608.12761","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"low","formal_verification":"none","parameter_count":4,"one_line_summary":"Correct execution and governed execution are separate properties: a workflow is governed only when decision authority, completion evidence, and change effects are explicit and independently checkable.","lead":"Matrix is a deterministic causal-state layer that records which authority and facts guided each AI agent decision, verifies completion evidence, and selectively invalidates stale work. It aims to make agentic workflows auditable and independently verifiable, which matters for enterprises subject to AI accountability rules.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The governed path's 'refusal of unsupported closure' is only as valid as the author-supplied definition of done; without an independent audit, the central empirical separation remains fixture-specific.","rationale":"The paper's central conceptual claim, that task correctness and governed execution are separate properties, is well supported and internally consistent. The separation is demonstrated by matched pairs where actions tie but provenance differs, and the paper explicitly bounds the mechanism claim as enforcing declared contracts rather than validating them. The remaining soft spot is the empirical interpretation of 'governed execution': the system's verdicts inherit the correctness of author-supplied definitions of done, authority metadata, and dependency edges. The reader's weakest assumption identifies exactly this issue, and Study 6's zero-specificity transfer failure shows it is not merely hypothetical. I therefore agree with the reader's conditional verdict. My concrete test would settle whether the most prominent closure result, Study 2, survives independent institutional scrutiny. If it does, the evidence is stronger; if not, the paper's own future-work gate remains necessary before the governed-vs-direct difference can be read as more than a mechanical demonstration.","tokens_in":15915,"tokens_out":5350,"duration_ms":64058,"concrete_test":"Run a pre-registered independent audit of Study 2's C4/C5 fixture: give the frozen DPA definition of done and the recorded receipts (both the rejected first attempt and the accepted retry) to two domain experts with no Matrix affiliation, blind to which receipt Matrix accepted, and ask whether each receipt satisfies the institutional requirement. If experts agree with Matrix's verdicts in all three seeds, the closure distinction is externally meaningful; if they classify the first attempt as acceptable or the retry as insufficient, the execution-provenance claim is fixture-specific and the conditional scope remains.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing empirical premise is that the governed path's refusal of unsupported closure in Study 2 (C4/C5) reflects the real institutional requirement, not just the author-supplied definition of done. Matrix can verify receipts against a declared DoD, but that DoD is authored by the same team that designed the system. If the DPA DoD in C4/C5 is not the actual institutional requirement, then the direct control's self-closure may be institutionally acceptable, or Matrix's rework demand may be wrong, and the headline separation becomes an artifact of the test harness. Study 6 already demonstrates this failure mode: a deterministically enforced completeness contract with perfect sensitivity blocked all seven reviewer-complete packets (specificity 0.00, Section 5.8). That negative result is disclosed, but it applies to the same class of author-supplied contracts that Study 2 treats as authoritative. The paper's definition of 'governed' does not require the DoD to be correct, so the conceptual claim survives; what is not established is that the measured 'refusal of unsupported closure' has institutional meaning.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that evaluating agentic workflows by business outcome alone is insufficient for institutional settings, and it defines 'governed execution' as the conjunction of decision provenance, execution provenance, and change provenance. It introduces Matrix, a deterministic causal-state layer that records versioned authority and facts, verifies completion receipts against definitions of done, and performs dependency-scoped invalidation after changes. The evaluation uses small, self-authored synthetic fixtures with repeated model seeds: Study 1 shows matched expected actions with diverging citation integrity; Study 2 shows self-closure versus receipt-verified closure; Study 3 shows tied currentness with different recovery scope; Study 4 shows a metadata-decidable refusal invariant; Study 5 composes the mechanisms; and Study 6 reports a controlling negative result in which a deterministically enforced completeness contract over-blocks on a role-separated transfer set. The paper's central claim is that task correctness and governed execution are different properties, and it explicitly disclaims that Matrix is a general accuracy enhancer or an external-validity guarantee.","tokens_in":16054,"tokens_out":6895,"duration_ms":71482,"significance":"If the framing holds, this is a useful conceptual contribution to the agent-auditability literature: it separates outcome correctness from the inspectability of decisions, completion evidence, and change propagation, and it does so with an implemented prototype and a matched-evaluation design. The paper is unusually transparent about limitations, including frozen claim-evidence maps, post-hoc specificity amendments, deterministic assertions rather than independent samples, and the failed contract-transfer result. The negative Study 6 result is a genuine strength: it distinguishes mechanism fidelity from contract validity and prevents overclaiming from the positive mechanism demonstrations. The contribution is modest but real, and the reproducibility-oriented reporting discipline is exemplary.","major_comments":[{"comment":"The Study 1 comparison is presented as evidence for the deterministic layer, but the governed condition differs from direct RAG not only by the presence of Matrix but also by an additional applicability adjudication call (21 vs 15 condition-specific calls for model-signaled governance), by prompt specialization in that adjudicator, and by a rewired action-revision pipeline. The paper discloses the call asymmetry and in Section 6.3 says the evidence cannot distinguish decomposition, prompt specialization, or persistent binding, but the abstract and conclusion still attribute the provenance preservation pattern to the governed path without this caveat. Please present Study 1 explicitly as a system-level comparison of direct RAG against governed adjudication-plus-binding, and place the causal attribution for the deterministic layer on Studies 2 and 3, where the controls are more tightly matched.","section":"Section 4.2, Table 3; Section 6.3"},{"comment":"The paper acknowledges that 'contract fidelity is partly by construction,' but several result sections—notably Section 5.3's description of 'refused unsupported closure' and Section 5.5's 'contract fidelity'—report the outcome without repeating this caveat. Because definitions of done, dependency edges, and completeness contracts are authored by the same team that designed Matrix, the positive enforcement results demonstrate that the code implements the declared rules, not that those rules capture an external institutional requirement. Study 6 shows exactly why this distinction matters. Please add an explicit sentence at the start of Sections 5.3 and 5.5 stating that all positive enforcement results are relative to author-supplied contracts, and that no claim of institutional validity is intended.","section":"Section 3.5; Appendix A"},{"comment":"The 'role-separated transfer challenge' is implemented as procedural information separation on a shared filesystem with fresh model-role reviewers, not as independent human authorship or review. The manuscript discloses this in Section 4.8, yet the abstract says packets 'produced outside its authoring context' and the conclusion says 'independently contextualized synthetic packets.' Please replace 'independently' with 'procedurally separated' in claim-bearing sentences, and state in Section 5.8 that the negative result establishes contract non-transfer under simulated role separation—stronger than no test, but weaker than independent human evaluation.","section":"Section 4.8, Section 5.8, Abstract"}],"minor_comments":[{"comment":"The frozen claim-evidence map and reproducibility artifact are good practices, but the manuscript does not include a stable archive identifier; please add the repository or DOI to the camera-ready version so the frozen run reports can be verified.","section":"Section 4.1"},{"comment":"The specificity value of 1.00 in Table 6 is from a post-hoc amendment on the same authored fixture, as the text explains; please add a footnote to the table itself clarifying that this is a degenerate-implementation check, not a population estimate.","section":"Section 5.5, Table 6"},{"comment":"The phrase 'reviewer-complete packets' should specify that the reviewers are fresh model contexts under procedural role separation, not human reviewers, to avoid overstatement in the main text.","section":"Section 5.8"},{"comment":"There are several missing spaces around the 'Matrix' macro in the abstract and body text (e.g., 'We presentMatrix'), which should be fixed in the final formatting pass.","section":"General"}],"recommendation":"minor_revision","confidential_remarks":"The paper is unusually honest and well-scoped for this area. The main risk is that readers over-interpret the positive mechanism results as external validity; the requested qualifiers should mitigate that. The transfer-failure result is the most valuable contribution and should be kept prominent. No concerns about citation or novelty disclosure; the related-work boundary is clearly drawn."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is the rare agent-governance paper that states its real claim in the title and then does not overrun it. It argues that governed execution is a distinct property from task correctness—decisions traceable to current authority, completion backed by independently checkable evidence, change effects scoped by dependency—and that a deterministic substrate can enforce that distinction around probabilistic models. I buy the distinction, and the matched same-outcome experiments support the direction.\n\nWhat is genuinely new is not any single mechanism. Append-only logs, runtime contracts, citation checks, and dependency replay all have prior art, and the paper says so explicitly in Section 8. The contribution is the integration: versioned authority and facts flowing into decision admission, task issuance, receipt-verified closure, supervisory verdicts, and dependency-scoped recovery in one lifecycle. The negative transfer result in Study 6 is the most valuable part: a deterministic contract with perfect sensitivity blocked all seven reviewer-complete packets, specificity 0.00. That cleanly separates mechanism fidelity from contract validity.\n\nThe paper earns credit for disclosure. It flags self-authored fixtures, seeds as stability checks, the post-hoc specificity amendment, direct RAG not being call-matched, no human-load measurement, and the fact that contract fidelity is partly by construction. Most of this is in Appendix A, not buried.\n\nSoft spots: external validity is not established, and the stress-test concern is real. The definitions of done and dependency edges are authored by the same team that designed Matrix, so Study 2's refusal of unsupported closure is only as meaningful as the DPA definition of done. The paper does not hide this—it even teaches the lesson in Study 6—but it means the headline separation has been demonstrated on fixture-specific rules, not on independently verified institutional requirements. The missing equal-call citation-verifying RAG baseline also leaves the RQ1 comparison weaker than it looks. And the artifact is promised but not yet retrievable, so I cannot re-run anything.\n\nWho is this for? Researchers working on auditable agents, runtime enforcement, or EU AI Act traceability. It will not settle deployment questions, but it gives the field a sharper vocabulary and a genuinely useful negative result. I would send it to a serious referee; the important questions about baseline strength, artifact availability, and independent task authorship can be pushed without rejecting the framing, which is sound.","headline":"A bounded but honest case that correct outcomes and governed execution are different properties; worth refereeing, though external validity is still fixture-specific.","tokens_in":16628,"tokens_out":2103,"would_cite":true,"duration_ms":22217,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Task correctness and governed execution are different properties, and a deterministic causal-state layer can enforce the governance side independently of model judgment.","keywords":["provenance","governed execution","agentic workflows","auditability","deterministic enforcement","completion verification","dependency scoping","contract transfer"],"falsifier":"Run the frozen completeness contract from the transfer experiment on a fresh, independently authored set of synthetic packets that was never exposed to the contract's authors; if specificity rises well above zero on reviewer-complete packets, the transfer failure was an artifact of the original packet set, whereas if it stays near zero, the claim that determinism does not confer contract validity holds.","tokens_in":15583,"feed_emoji":"🔍","tokens_out":5276,"duration_ms":47005,"temperature":0.7,"pith_summary":"This paper argues that evaluating agentic workflows by whether they reach the correct outcome is insufficient for institutional settings. A correct action may cite the wrong authority, claim completion without supporting evidence, or rely on work that a later change made stale. The author defines governed execution as work whose decisions, completion, and response to change carry explicit, independently checkable provenance, and presents Matrix, a deterministic layer that records authority and fact dependencies, verifies completion receipts against declared definitions of done, and selectively invalidates stale work. In controlled comparisons, governed and direct workflows reached the same outcomes, but only the governed path preserved governing evidence, refused unsupported closure, and limited recovery to dependent tasks. A transfer test failed: a deterministically enforced completeness contract over-blocked independently produced packets, showing that mechanism fidelity does not establish contract validity.","feed_headline":"Correct is not governed, a provenance layer shows","feed_subtitle":"A deterministic layer keeps decisions, completion evidence, and change effects independently checkable even when outcomes tie.","key_machinery":"The central object is Matrix, a deterministic causal-state layer built on an append-only event log with six first-class sets—versioned authority, accepted facts, admitted decisions, issued tasks, completion receipts, and supervisory verdicts—plus typed read/produce dependency edges. Models continue to interpret documents and propose plans; Matrix owns identity, transition validity, declared preconditions, receipt matching, bounded rework, and replay. Its lifecycle records applicable authority and facts, admits or rejects a proposed decision, issues tasks only after preconditions, attaches every attempt to a receipt, verifies receipts against definitions of done, emits supervisor verdicts, and on authority or fact change invalidates the dependent set and reissues only affected obligations. This machinery is what makes the three provenance forms measurable separately from outcome correctness.","core_discovery":"The paper's central claim is that task correctness and governed execution are different properties. A workflow is governed only when the authority behind its decisions, the evidence behind its completion, and the effects of later change are explicit and independently checkable. The empirical pattern is matched pairs: governed and direct workflows reach the same business outcome while differing on provenance—direct RAG cited non-governing records in six of fifteen runs that all chose the expected action; both recovery arms stayed current after an amendment but dependency-scoped recovery reissued three tasks versus eighteen; a generic self-review produced complete plans but the direct control self-closed on an unsupported completion claim. The paper also reports a controlling negative result: a completeness contract enforced with perfect sensitivity blocked every reviewer-complete packet in the transfer set, separating faithful mechanism from valid contract.","pith_inferences":["If correct-is-not-governed becomes an accepted evaluation standard, audit and compliance regimes that require traceability would naturally demand provenance layers of this kind, making governing evidence a first-class system output rather than a transcript byproduct.","The separation suggests a division of labor: models can remain fallible at semantic judgment while deterministic infrastructure owns identity, transitions, and evidence gates; a human or model verifier could supply the semantic judgments the contracts miss.","The transfer failure implies a testable engineering rule: completeness and applicability contracts should be authored by parties independent of packet production, and every invariant family should be evaluated on both incomplete and complete held-out cases to avoid over-blocking.","The dependency-based recovery mechanism could be extended to cost metrics: with accurate dependency declarations, the observed churn reduction (from eighteen to three reissued tasks) suggests potential savings in reexecution and review burden, but only where declarations are complete."],"forward_implications":["Evaluation of agentic workflows should report provenance properties (citation soundness, receipt-backed closure, dependency-scoped recovery) alongside outcome accuracy, because matched outcomes can still hide governance failures.","Deterministic receipt verification offers a practical answer to self-certified completion: an agent's own completion claim is never sufficient, and failed attempts remain in history.","Selective invalidation after policy change can preserve unaffected proof and reduce rework without leaving stale residue, compared with conservative full reruns.","Mechanism fidelity to a declared contract is not validity: a completeness contract can be perfectly enforced yet severely over-block inputs produced outside its authoring context.","The system's role is an institutional integrity layer—making work auditable and independently verifiable—not a general accuracy enhancer."],"supporting_citations":[{"why":"Supplies the retrieval-augmented generation baseline that the direct RAG condition derives from.","marker":"Lewis et al., 2020"},{"why":"Defines citation correctness and completeness evaluation, the standard Study 1's citation-soundness measure builds on.","marker":"Gao et al., 2023"},{"why":"Supports the claim that large language models cannot reliably self-correct, motivating independent completion verification in Study 2.","marker":"Huang et al., 2024"},{"why":"Documents self-verification limitations on reasoning and planning, reinforcing the need for an external completion verifier.","marker":"Stechly et al., 2025"},{"why":"Offers runtime constraint enforcement for LLM agents, a direct neighbor for Matrix's deterministic transition rules.","marker":"Wang et al., 2025"},{"why":"Demonstrates dependency-based selective replay in artifact DAGs, the direct precedent for Study 3's recovery scope.","marker":"Rosen and Rosen, 2026"},{"why":"Frames commit-time authorization and invalid witnesses, closely tracking the paper's distinction between visible and authorized success.","marker":"Santos-Grueiro, 2026"},{"why":"Provides evidence-contract scrutiny with mechanized checks, a neighbor for Matrix's receipt-verification function.","marker":"Xu et al., 2026"}],"fun_headline_variants":["Right answer isn't a governed answer","Correctness doesn't equal governance in agents","Provenance layer shows why correct isn't enough","Beyond correct outcomes: auditable agentic work","Why a correct agent can still be ungoverned"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The governance inputs—definitions of done, authority and applicability metadata, dependency declarations, and completeness contracts—are assumed to capture the real institutional requirement, because the deterministic layer can enforce a wrong contract with perfect fidelity.","fun_headline_variants_meta":{"raw":{"variants":["Right answer isn't a governed answer","Correctness doesn't equal governance in agents","Provenance layer shows why correct isn't enough","Beyond correct outcomes: auditable agentic work","Why a correct agent can still be ungoverned"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000308,"raw_usage":{"total_tokens":1721,"prompt_tokens":868,"completion_tokens":853,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":484,"completion_tokens_details":{"reasoning_tokens":782}},"tokens_in":484,"tokens_out":853,"duration_ms":7701,"temperature":1.0,"reasoning_tokens":782,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:52:42.757179+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the frozen completeness contract from the transfer experiment on a fresh, independently authored set of synthetic packets that was never exposed to the contract's authors; if specificity rises well above zero on reviewer-complete packets, the transfer failure was an artifact of the original packet set, whereas if it stays near zero, the claim that determinism does not confer contract validity holds.","supporting_citations":[{"cited_title":"Enabling large language models to generate text with citations","cited_arxiv_id":null,"evidence_quote":"Defines citation correctness and completeness evaluation, the standard Study 1's citation-soundness measure builds on."}],"review_version":1}