Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

A Deterministic Control Plane for LLM Coding Agents

Source

arXiv

arxiv.org/abs/2606.26924v1

Read the source

Source

Plain-Language Brief

The research proposes a control plane for LLM coding agents, which currently have unmanaged configuration layers. The control plane aims to fill gaps identified in a study of 10,008 public GitHub repositories, such as the duplication and lack of revision and permission declarations in agent configurations. The proposed control plane, called Rel(AI)Build, enforces tiered permissions, uses HMAC-stamped lockfiles for security, has a phase state machine for feature work traceability, and detects prompt drift among other features.

What the Document Says

  • The research discusses the issue of unmanaged configuration layers in LLM coding agents.
  • A study was conducted on 10,008 public GitHub repositories, finding that agent configurations are often undeclared shared components.
  • The study found that configurations are rarely revised and seldom declare permission boundaries.
  • The proposed control plane, Rel(AI)Build, treats agent definitions as a managed supply chain and enforces permissions and attack-derived blocklists.
  • Rel(AI)Build uses a phase state machine for feature work traceability and detects prompt drift.
  • Conformance tests were conducted on injected violations to confirm each mechanism enforces its stated invariant.

Key Concepts Mentioned

  • LLM coding agents
  • configuration layers
  • GitHub repositories
  • agent configurations
  • undeclared shared components
  • deterministic control plane
  • Rel(AI)Build
  • SHA-256 content addressing
  • HMAC-stamped lockfiles
  • tiered permissions
  • attack-derived blocklists
  • phase state machine
  • prompt drift

Claims Made by the Document

  • Agent configurations propagate as undeclared shared components.
  • Configurations are rarely revised and seldom declare permission boundaries.
  • Rel(AI)Build enforces tiered permissions and attack-derived blocklists before LLM invocation.
  • Rel(AI)Build detects prompt drift via Jaccard similarity.

Evidence Used

  • The study conducted on 10,008 public GitHub repositories

Methods / Approach

  • A prevalence study of 10,008 public GitHub repositories
  • conformance tests on injected violations

Limitations Stated by the Authors

Developer outcomes remain future work.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The agent does not seem to have any limitations stated by the author, but as a general limitation, it may require integration with existing LLM harnesses.

Open Questions

  • What are the developer outcomes after implementing Rel(AI)Build?
  • How easily can Rel(AI)Build be integrated with various LLM harnesses?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The research focuses on the control plane, but it is not clear what the exact impact on developers and their outcomes will be.
  • Integration of Rel(AI)Build with different LLM harnesses may pose challenges that need to be addressed.

Raw Abstract / Excerpt

LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them -- rules files, agent definitions, IDE-specific markdown -- is largely unmanaged. A prevalence study of 10,008 public GitHub repositories (n=6,145 agent config files) finds that agent configurations propagate as undeclared shared components: 10.1% of tracked paths are SHA-256 exact duplicates across independent repositories (fork-adjusted, threshold-independent), with 75.5% of clone pairs crossing organisational boundaries. Two further patterns are indicative: configurations are rarely revised (58% single-commit; 0.4 vs 0.6 commits/month age-normalised against CI/CD workflows), and rarely declare permission boundaries (<1% of agent configs vs 33% of Actions workflows, n=31 true positives). We propose a deterministic control plane above the harness that maps one-to-one to these gaps. Rel(AI)Build treats agent definitions as a managed supply chain (SHA-256 content addressing, HMAC-stamped lockfiles, hash-chained audit logs); enforces tiered permissions and attack-derived blocklists before LLM invocation; gates feature work through a phase state machine with requirement-to-file-to-test traceability; compiles a single canonical definition to seven IDE targets; and detects prompt drift via Jaccard similarity. Conformance tests on injected violations confirm each mechanism enforces its stated invariant; developer outcomes remain future work. Governance of this layer must be deterministic and tool-agnostic -- not delegated to further LLM orchestration.