Imagine you're shipping a fragile package across three courier companies. Each time it changes hands, someone repacks it — and every repack is an opportunity to lose a piece, swap an item, or just misread the label. You could seal the box with tamper-evident tape after the first pack, so at least downstream couriers can't alter the contents. But if the first packer put the wrong item in the box, the tape faithfully seals the error inside. That's the core mechanism here: cryptographic signing protects multi-agent LLM handoffs in transit, but it cannot protect against mistakes made before the signature is applied. The committed claim: in multi-agent LLM systems where an orchestrator splits a user request across subagents, HMAC-SHA256 signed requirement manifests plus deterministic code verification reduce unsafe commits from 69.4% to 9.0% under adversarial attack — a 60.4 percentage-point drop — with no loss of conformant commits relative to unsigned structured handoffs. This is not a theoretical proposal. Across 1,440 trajectories on Qwen3-8B facing five distinct threat types, signing is what specifically defeats in-transit tampering: unsigned manifests committed violations in 79% of mutated runs, signed ones in 0%. The deterministic verifier caught 78.7% of violations with only 7% false alarms, versus an LLM-based checker at 59.0% detection with 50% false alarms. The architecture is refreshingly un-exotic. The orchestrator extracts each requirement as a verbatim quote plus a checkable predicate, then deterministic code (not an LLM) signs the manifest with HMAC-SHA256. At the merge step, deterministic code again verifies each predicate against the signed manifest. This is classical software engineering — message authentication codes and predicate checking — applied as a wrapper around LLM agent pipelines. The LLM does the creative work of extraction and fulfillment; the crypto and verification are handled by conventional code that doesn't hallucinate. The integrity story is unusually strong for an AI systems paper. The study was preregistered. The task bank uses synthetic, exactly-scorable tasks — meaning ground truth is deterministic, not judged by another LLM. An oracle manifest condition confirmed that when extraction is perfect, all remaining unsafe commits vanish, cleanly isolating the trust boundary. The authors then ran a preregistered pre-signing injection attack to stress-test that boundary: a single adversarial line injected before extraction raised signed-manifest violations from 14.6% to 37.5% on Qwen3-8B, from 11.1% to 63.9% on gpt-oss-20b, and from 8.3% to 75.0% on GPT-5.6-luna. The signature faithfully authenticated the corrupted manifest. This is honest reporting — the authors built a weapon against their own method and published the results. The ladder comparison is well-constructed but narrow. Free-text handoffs are the weakest baseline (69.4% unsafe under attack), structured JSON is the middle ground, and signed manifests are the treatment. What's missing is comparison against other proposed multi-agent safety mechanisms — tool-use constraints, sandboxing, constitutional AI approaches to agent coordination. The paper compares handoff protocols against each other, not against the broader field of multi-agent safety. Within its scope, the numbers are decisive; the question is whether scope is sufficient. The milestone is concrete and clearly stated by the paper's own results: extraction fidelity is the bottleneck. The oracle manifest removed all remaining unsafe commits, proving the pipeline is sound once extraction is correct. The next number to watch is extraction error rate under adversarial conditions — currently the mechanism through which a single injected line can raise violations to 75% even with signing. Closing this gap likely requires either formal verification of extracted predicates against the original user request, or redundant extraction with majority-vote reconciliation. The obvious successor experiment the authors didn't run: testing on real enterprise tasks with ambiguous, multi-constraint requirements where ground truth is fuzzy. The synthetic task bank guarantees scorability but sidesteps the hardest problem in production — requirements that are vague, contradictory, or context-dependent. The honest read is (a): this is a controlled study establishing the mechanism, and messy real-world tasks would require a different evaluation framework they haven't built yet. The paper earns its scope by being explicit about it.
