Three gates for production agents: boundary, stopping, and consensus

An agent does not become reliable because it received one more round, another model agreed, or the first address it queried was allowed. Three findings published in the same cutoff show the same problem from different angles: controls must follow actual execution, have an objective stopping condition, and preserve evidence independent of generation.

This Evidence Brief turns one advisory and two preprints into a defensive contract. It does not publish offensive steps, generalize benchmarks to all software development, or claim that these controls are deployed, tested, or operating in Trustyu Forge. The text was editorially approved on 10/09/2026; effective publication was regularized on 15/09/2026.

The evidence package

1. Boundary: every hop must be reevaluated

The official advisory GHSA-5x7x-4c3c-qf5w describes an SSRF in Open WebUI. The affected range is 0.9.5 to 0.11.0; the fix is in 0.11.1. The precondition matters: AIOHTTP_CLIENT_ALLOW_REDIRECTS=true, while the default is false. According to the advisory, validation covered the initial URL but not the effective destination after redirects. The project reports reproduction in version 0.11.0 and blocking in 0.11.1.

Updating fixes the described case, but there is an operational caveat: when traffic exits through a forward proxy, the private-destination restriction must also be enforced at the proxy itself. The case does not prove active exploitation or the prevalence of SSRF in AI products. It demonstrates one property: policy must be enforced at every effective destination, not only at the initial intent.

2. Stopping: continuing to fix can create regressions

The preprint If It's Not Buggy, Don't Fix It, version 1 dated 09/09/2026, studied blind iterative repair across 20 problems, with 40 C++ submissions per problem, two models, and up to 100 turns. In the evaluated settings, the models claimed to find issues in correct code and often damaged correct code at a rate equal to or higher than they fixed defective code. The study also observed cycles in which changes were added and removed.

The result does not support saying that “AI makes code worse” in general. The study uses single-file competitive tasks, two models, ambiguous objectives, and no history in the loop. It supports a more precise conclusion: without an objective verifier and an external stopping condition, additional iteration is not evidence of improvement.

3. Consensus: diversity can prioritize, not validate

The preprint Ensembling LLMs for AI-Augmented Cybersecurity Software Requirements Generation, also version 1 dated 09/09/2026, evaluated 24 runs, 12 configurations, four model families, and ten ISO/IEC 27002:2022 controls. The reference standard contained 72 requirements considered valid by experts. Combining all outputs recovered all 72 but added 111 hallucinations. Fusion improved the ranking of suggestions; it did not turn agreement into truth.

The study has its corpus and code archived on Zenodo, which improves auditability. Even so, this is an English-language case about one system, one standard, and expert judgment. It does not measure whether the generated requirements prevent incidents or replace risk analysis.

The technical contract

intenção
   │
   ▼
fronteira por efeito ──► execução limitada ──► verificador externo
   │                            │                     │
   └── política em cada salto   └── orçamento        └── parar, reverter ou promover
                                                        │
                                                        ▼
                                                evidência + decisão humana

A durable harness must keep policy, session history, and execution isolation as explicit boundaries. Adapters or model choice cannot become the security boundary. This is a design inference supported by the current canon, not a claim about Forge operation. [HARNESS31-C2]

Gate A — the boundary follows the effect

• validate destination, identity, and authority again at every redirect, resolution, and proxy hop;
• enforce policy in the component that actually opens the connection or produces the effect;
• keep egress minimal and enforce equivalent restrictions at the proxy;
• record the URL by class and decision without retaining secrets, sensitive addresses, or full content;
• fail closed when the effective destination cannot be determined.

Gate B — stopping is external to the same loop

• preserve an immutable baseline, tests, and requirements before the first change;
• define budgets for turns, time, cost, and diff size;
• stop when the objective verifier does not improve or when a regression appears;
• detect cycles using a state digest and revert to the last proven point;
• escalate ambiguity to human judgment instead of rewarding activity.

Gate C — consensus organizes the queue

• keep outputs independent before fusion;
• separate candidate retrieval, ranking, and validation;
• use a reference standard or an evaluator independent of the generator;
• preserve disagreement, provenance, and confidence for each requirement;
• treat consensus as a review priority, never as automatic authorization.

Minimum receipt

{
  "input_ref": "immutable-ref",
  "policy_digest": "sha256:...",
  "effective_boundary": "bounded",
  "iteration_budget": {"max_turns": 12, "used": 7},
  "verifier_result": "pass|fail|inconclusive",
  "cycle_detected": false,
  "candidate_sources": ["model-a", "model-b"],
  "human_decision": "promote|revise|reject",
  "effect_receipt": "immutable-ref"
}

The values are illustrative. The receipt must be issued outside the agent's authority and preserve only what is necessary to reconstruct version, policy, boundary, verification, and decision.

Negative tests

1. An allowed initial destination does not automatically authorize the destination after a redirect.
2. A proxy must not expand the destinations blocked by client policy.
3. Initially correct code must not be promoted if iteration reduces tests or invariants.
4. Repeated states stop the loop and produce evidence of a cycle.
5. Agreement between two models does not remove the need for a source, test, or accountable approval.
6. The combined candidate set must not hide false positives or change the denominator.
7. inconclusive is not converted into pass when the budget expires.
8. Verifier failure does not authorize the generator to self-certify its own output.

Release Gate

• Is the effective destination verified at every hop and at the proxy?
• Does the effect require compatible identity and capability?
• Are the initial state and the last proven state recoverable?
• Is there an explicit limit on turns, cost, time, and mutation?
• Is the verifier independent of the loop proposing the change?
• Do cycles and regressions stop and revert execution?
• Does fusion preserve false positives, disagreement, and provenance?
• Is the human decision bound to the exact approved artifact?
• Does the Evidence Packet distinguish blocking, failure, and inconclusive results?

Passing the gate demonstrates only the exercised scope. It does not prove complete security, absence of vulnerabilities, universal quality, or continuous operation.

Limitations and conflicts of interest

• The Open WebUI advisory is an official project source describing the condition, reproduction, and fix; it is not an independent measurement of real-world exploitation.
• Both studies are recent preprints with no peer review recorded on arXiv.
• The bug-fixing study has authors affiliated with UnlikelyAI; part of the work was conducted during an internship at the company. This does not invalidate the method, but it should accompany the reading.
• The requirements study uses one case, one standard, and one specialist team; its figures do not represent market prevalence.
• Trustyu and Tech Human operate commercially in AI architecture, governance, and engineering.

Direct sources

1. Open WebUI — GHSA-5x7x-4c3c-qf5w.
2. Open WebUI — release v0.11.1.
3. Wang-Lin, Isopoussu, and Mahon — arXiv:2609.10123v1.
4. Full experimental text for arXiv:2609.10123v1.
5. Perez-Acuna, Martín, and Yelmo — arXiv:2609.10316v1.
6. Requirements study artifacts — Zenodo.

Editorial and responsibility note

Facts, figures, and versions are bound to the cited sources. The contract, gates, and recommendations are the author's professional analysis, not universal facts or claims that controls are already operating. This content is informational and does not replace technical, legal, or security assessment. Research, structure, and writing were AI-assisted; Fernando Parreiras confirmed factual and authorial review and publication approval on 10/09/2026. There was no additional independent human review.