{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:DXPRU3JKZGIMV4NBLULPL3S4BL","short_pith_number":"pith:DXPRU3JK","canonical_record":{"source":{"id":"2605.19668","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-19T11:00:34Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"eabbacd2d44945832e6a77b53b1cb05928e6aab1e8c0426745611dc529070287","abstract_canon_sha256":"d291396de7e1fa3d487eeef4751fbe76065af573dec6fc48639a7d042ba3928f"},"schema_version":"1.0"},"canonical_sha256":"1ddf1a6d2ac990caf1a15d16f5ee5c0aeeb43f752708174d6b48ed92983208d0","source":{"kind":"arxiv","id":"2605.19668","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.19668","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"arxiv_version","alias_value":"2605.19668v1","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.19668","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_12","alias_value":"DXPRU3JKZGIM","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_16","alias_value":"DXPRU3JKZGIMV4NB","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_8","alias_value":"DXPRU3JK","created_at":"2026-05-20T01:05:57Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:DXPRU3JKZGIMV4NBLULPL3S4BL","target":"record","payload":{"canonical_record":{"source":{"id":"2605.19668","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-19T11:00:34Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"eabbacd2d44945832e6a77b53b1cb05928e6aab1e8c0426745611dc529070287","abstract_canon_sha256":"d291396de7e1fa3d487eeef4751fbe76065af573dec6fc48639a7d042ba3928f"},"schema_version":"1.0"},"canonical_sha256":"1ddf1a6d2ac990caf1a15d16f5ee5c0aeeb43f752708174d6b48ed92983208d0","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T01:05:57.009732Z","signature_b64":"XdTfWiNKpTxkxhgarZEVINQzpYxp/vWdTn9iayJeN9vCOPnVLzccdZq4+leBU+1Z6kXqPI1RVubTnpM6JBY9Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"1ddf1a6d2ac990caf1a15d16f5ee5c0aeeb43f752708174d6b48ed92983208d0","last_reissued_at":"2026-05-20T01:05:57.008999Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T01:05:57.008999Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.19668","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T01:05:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"o/fVJuAccvpf42JiPepJD1zv43QBrjXD59sKypxVgh33LNBeD6FAdujP+iUQi03wAyWZJSD/Y1sTZySiVOOIDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-21T08:15:13.265961Z"},"content_sha256":"cf0cffa65405b391235382ac5d67d818e0a2f66d5d2b09ce69fdf09e977e2cb9","schema_version":"1.0","event_id":"sha256:cf0cffa65405b391235382ac5d67d818e0a2f66d5d2b09ce69fdf09e977e2cb9"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:DXPRU3JKZGIMV4NBLULPL3S4BL","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"SCARA: A Semantics-Constrained Autonomous Remediation Agent for Opaque Industrial Software Vulnerabilities","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Bowei Ning, Guogang Wang, Jinyang Liu, Kan He, Lian Lian, Xuejun Zong, Yifei Sun","submitted_at":"2026-05-19T11:00:34Z","abstract_excerpt":"Critical-infrastructure operators are increasingly expected to assess and remediate vulnerabilities in deployed industrial software. However, much of this software exists as opaque industrial software (OIS), including stripped firmware, proprietary protocol handlers, and compiled control logic without source code, symbols, build environments, or hardware interfaces. While binary analysis can identify vulnerability candidates, existing automated repair systems largely rely on source code, compilable artifacts, sanitizer feedback, or instrumentable builds, leaving a gap between binary-level disc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.19668","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.19668/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T01:05:57Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"A26JwlFWv8e7XEDuFMUaskwLKzIK1K6AISas6zngVvryto/wWkHCsVje98Dih2OYiIgnsplO6kQt700kz0vEAw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-21T08:15:13.266629Z"},"content_sha256":"51721ce670c16a350e96718a21948c3653ba59a942b1970d60b1607681094a61","schema_version":"1.0","event_id":"sha256:51721ce670c16a350e96718a21948c3653ba59a942b1970d60b1607681094a61"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:DXPRU3JKZGIMV4NBLULPL3S4BL","target":"integrity","payload":{"note":"DOI in the printed bibliography is fragmented by whitespace or line breaks. A longer candidate (10.18429/JACoW-ICALEPCS2015-WEPGF092.URLhttps://jacow.org/ICALEPCS2015/papers/WEPGF092.pdf) was visible in the surrounding text but could not be confirmed against doi.org as printed.","snippet":"Dániel Darvas, Enrique Blanco Viñuela, and Borja Fernández Adiego. PLCverif: A tool to verify PLC programs based on model checking techniques. InProceedings of the 15th International Conference on Accelerator and Large Experimental Physics ","arxiv_id":"2605.19668","detector":"doi_compliance","evidence":{"ref_index":37,"verdict_class":"incontrovertible","resolved_title":null,"printed_excerpt":"Dániel Darvas, Enrique Blanco Viñuela, and Borja Fernández Adiego. PLCverif: A tool to verify PLC programs based on model checking techniques. InProceedings of the 15th International Conference on Accelerator and Large Experimental Physics ","reconstructed_doi":"10.18429/JACoW-ICALEPCS2015-WEPGF092.URLhttps://jacow.org/ICALEPCS2015/papers/WEPGF092.pdf"},"severity":"advisory","ref_index":37,"audited_at":"2026-05-20T04:58:54.333746Z","event_type":"pith.integrity.v1","detected_doi":"10.18429/JACoW-ICALEPCS2015-WEPGF092.URLhttps://jacow.org/ICALEPCS2015/papers/WEPGF092.pdf","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"b7375a4ec198aa40a12e0cfdb3c0f31c813abc0818860faebdf42f9b1eb1799f","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"1.0.0","detected_arxiv_id":null,"integrity_event_id":4801,"payload_sha256":"d97cddc4e7122c43899ba9ea55aa5acb1d5248cc487fbbb3694ca22e5745e2ca","signature_b64":"A2fb1pHCW1BpEpBvHzdiykyQNh4HnmNU8E94av5RlwB8w5oX7msQJLuo0/rkF6yQbqNyFomAJiJ8RQSzSRzyDA==","signing_key_id":"pith-v1-2026-05"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T05:02:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"EHkbOi7EQdyTzzj7rEKitKfZLNCHfiANLijAScZok0/UZfJLyVikyjHrIQC5TlMMOiAC62ArFYf3qrcGZJpqBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-21T08:15:13.267809Z"},"content_sha256":"79566ac07f7c854d066c74912db6901b0d34c889e1ad556efa2c39ef901b3b4e","schema_version":"1.0","event_id":"sha256:79566ac07f7c854d066c74912db6901b0d34c889e1ad556efa2c39ef901b3b4e"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/bundle.json","state_url":"https://pith.science/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-21T08:15:13Z","links":{"resolver":"https://pith.science/pith/DXPRU3JKZGIMV4NBLULPL3S4BL","bundle":"https://pith.science/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/bundle.json","state":"https://pith.science/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/state.json","well_known_bundle":"https://pith.science/.well-known/pith/DXPRU3JKZGIMV4NBLULPL3S4BL/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:DXPRU3JKZGIMV4NBLULPL3S4BL","merge_version":"pith-open-graph-merge-v1","event_count":3,"valid_event_count":3,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"d291396de7e1fa3d487eeef4751fbe76065af573dec6fc48639a7d042ba3928f","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-19T11:00:34Z","title_canon_sha256":"eabbacd2d44945832e6a77b53b1cb05928e6aab1e8c0426745611dc529070287"},"schema_version":"1.0","source":{"id":"2605.19668","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.19668","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"arxiv_version","alias_value":"2605.19668v1","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.19668","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_12","alias_value":"DXPRU3JKZGIM","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_16","alias_value":"DXPRU3JKZGIMV4NB","created_at":"2026-05-20T01:05:57Z"},{"alias_kind":"pith_short_8","alias_value":"DXPRU3JK","created_at":"2026-05-20T01:05:57Z"}],"graph_snapshots":[{"event_id":"sha256:51721ce670c16a350e96718a21948c3653ba59a942b1970d60b1607681094a61","target":"graph","created_at":"2026-05-20T01:05:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2605.19668/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Critical-infrastructure operators are increasingly expected to assess and remediate vulnerabilities in deployed industrial software. However, much of this software exists as opaque industrial software (OIS), including stripped firmware, proprietary protocol handlers, and compiled control logic without source code, symbols, build environments, or hardware interfaces. While binary analysis can identify vulnerability candidates, existing automated repair systems largely rely on source code, compilable artifacts, sanitizer feedback, or instrumentable builds, leaving a gap between binary-level disc","authors_text":"Bowei Ning, Guogang Wang, Jinyang Liu, Kan He, Lian Lian, Xuejun Zong, Yifei Sun","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-19T11:00:34Z","title":"SCARA: A Semantics-Constrained Autonomous Remediation Agent for Opaque Industrial Software Vulnerabilities"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.19668","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:cf0cffa65405b391235382ac5d67d818e0a2f66d5d2b09ce69fdf09e977e2cb9","target":"record","created_at":"2026-05-20T01:05:57Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"d291396de7e1fa3d487eeef4751fbe76065af573dec6fc48639a7d042ba3928f","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by-nc-nd/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-19T11:00:34Z","title_canon_sha256":"eabbacd2d44945832e6a77b53b1cb05928e6aab1e8c0426745611dc529070287"},"schema_version":"1.0","source":{"id":"2605.19668","kind":"arxiv","version":1}},"canonical_sha256":"1ddf1a6d2ac990caf1a15d16f5ee5c0aeeb43f752708174d6b48ed92983208d0","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"1ddf1a6d2ac990caf1a15d16f5ee5c0aeeb43f752708174d6b48ed92983208d0","first_computed_at":"2026-05-20T01:05:57.008999Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-20T01:05:57.008999Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"XdTfWiNKpTxkxhgarZEVINQzpYxp/vWdTn9iayJeN9vCOPnVLzccdZq4+leBU+1Z6kXqPI1RVubTnpM6JBY9Dg==","signature_status":"signed_v1","signed_at":"2026-05-20T01:05:57.009732Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.19668","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:cf0cffa65405b391235382ac5d67d818e0a2f66d5d2b09ce69fdf09e977e2cb9","sha256:51721ce670c16a350e96718a21948c3653ba59a942b1970d60b1607681094a61","sha256:79566ac07f7c854d066c74912db6901b0d34c889e1ad556efa2c39ef901b3b4e"],"state_sha256":"640b86511b29b7db6d333a67a82021c8d7dc916db24ec81afdcdbd489b9de1e6"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"f9J5r1gS3LRQU/xu/QfaUpzgVi90jRlww1/f6Ee0poISQm635g0eJU4ry7mr2qrS4FNSwMuL6R++gPpw46qEDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-21T08:15:13.270266Z","bundle_sha256":"a37ff85d56bdc5b3b5c3582230eeeb243c668204991ebd640d078228cd6e32f2"}}