APBSCPublication boundary & security closure 中文

APBSC 00 · Framework

Agentic publication boundary and security closure: the integrated framework

Splits AI-assisted delivery into five information states and argues that the step from persisted to published has no automatic closure today.

2026-09-21 · v0.1 · Internal research draft v0.1 · full text not yet public

AI may observe ≠ AI may persist ≠ AI may publish

The argument

Generating code, passing tests, passing a scanner, finishing review and pushing successfully are five different propositions. None of them is the proposition that the delivered thing respects its security and privacy boundary. The framework names the chain a piece of information travels through — observed, authorized, persisted, published, externally obtainable — and treats each arrow as a separate permission.

Two pieces of evidence anchor it. An anonymous case A, in which a delivery workflow with privacy rules and an automatic checker still carried recoverable private information inside the checker itself, while that checker reported PASS. And an exploratory public GitHub pilot on 2026-09-20 that found workstation paths, runtime layout, session and internal-network context inside agent instruction files. The paper treats both as evidence that the phenomenon exists, and as nothing more.

It fixes the vocabulary the rest of the series uses: the green-light fallacy, the publication boundary, the checker as part of the delivered content, representation change versus information removal, repeated review versus independent verification, and the three knowledge states O, H and E.

Key ideas

  • Delivery is judged by the state of the world it leaves behind, not by whether the program is correct.
  • A hash proves the bytes are the bytes you hashed. It says nothing about what those bytes reveal.
  • A private repository is not a secret vault, and a cleaned current tree does not clean history.
  • Security closure is not more checks; it is evidence that actually covers the intended postcondition.

Propositions it carries

  • OObserved

    AI collaboration files (CLAUDE.md, AGENTS.md, .cursor/rules and similar) can themselves become publication surfaces.

    00, 02
  • OObserved

    In at least one documented workflow, a checker reported PASS while recoverable excluded information sat inside the checker itself.

    00, 03 · case A
  • OObserved

    Public AI collaboration files can contain concrete workstation, runtime, session and internal-network context.

    02 · pilot 2026-09-20
  • HHypothesis

    AI-assisted repositories disclose more than matched non-AI repositories.

    00, 07
  • HHypothesis

    Shared organization context can amplify one disclosure pattern across many repositories.

    04
  • HHypothesis

    Multiple AI reviewers often share evidence roots, so the number of reviews overstates how independent the verification was.

    01
  • HHypothesis

    Conventional secret-scanning statistics undercount semantic privacy leakage.

    03
  • HHypothesis

    AI-assisted building grows the population of low-maturity targets faster than defensive automation shrinks it.

    05

What it does not claim

  • AI coding is unsafe.
  • Any prevalence figure, for any group.
  • A ranking of vendors or tools.