{"id":"bcb6e5dc-6382-407f-97fb-2ffb0ec55858","arxiv_id":"2607.18243","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":8,"one_line_summary":"CPSAINT/FRIESA-K couples failure-path structure to a multiplicative residual-risk score with a Markov-derived resistance term, demonstrated only on parameter-assigned synthetic scenarios.","lead":"The paper proposes CPSAINT, a fixed seven-layer failure-path grammar, and FRIESA-K, a residual-risk score whose control-effectiveness term is computed from an absorbing Markov chain. The framework is illustrated on a warehouse-robot and a banking-agent scenario, but all risk inputs are assigned 'bundle-default' values rather than measured or calibrated data.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Composition theorem is conditional on an unspecified path-to-generator mapping: Q_π(u) and baseline u0 are never constructed from π's layer sequence, so K is not shown to be derived from path dynamics.","rationale":"The reader's weakest assumption correctly identifies that the CTMC rates and numerator parameters are not reported or calibrated. My concern is adjacent but more formal: even if every rate were disclosed, the paper does not define how a path's layer/mode sequence selects or shapes Q_π(u). The theorem's premise 'well-defined K' is therefore an assumption, not a construction. This is load-bearing because the paper's distinctive contribution is presenting K as derived from controlled absorbing dynamics rather than expert-assigned; without the path-to-generator mapping, K is as assigned as the other factors. The paper is internally consistent and explicitly discloses several limitations (domain-specific calibration, independent numerator terms, short-horizon R_gov), which prevents a stronger verdict. The concern can be addressed by releasing the explicit mapping and reproducing the reported K values; hence the conditional verdict stands unchanged.","tokens_in":11181,"tokens_out":6018,"duration_ms":68685,"concrete_test":"Obtain the open-source repository (github.com/coderhard/friesa-k-DSN-crai2026) and verify that it contains an explicit function mapping path π, policy u, and parameter set θ to the generator Q_π(u), including the baseline policy u0. Then independently re-implement Eqs. (5)–(6) and recompute K for the warehouse path (S→D→C→T→A) and banking path (D→C→T→E) under the stated bundle defaults. If the function is absent or the reported K values (1.527, 1.339) are not reproduced within Monte Carlo error, the theorem's premise is unfulfilled and the case-study numbers must be relabeled as illustrative rather than derived.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section IV-C defines K(π,τ,u) via Eq. (6) as the ratio of catastrophe-absorption probabilities under a path-conditioned CTMC with generator Q_π(u), and Theorem 1 (Section IV-D) then treats 'a defender policy u induces a finite-state absorbing process with well-defined K' as a premise. But the paper never specifies the map from a path π=[(ℓ1,m1),...,(ℓn,mn)] to Q_π(u), nor the baseline policy u0. The state space S is fixed as ten generic states (Σ_op×Σ_obs); no construction shows which states or rates are selected by a given layer/mode sequence. The sentence 'The path determines the relevant hazard states, interfaces, and control touch points' and the pointer to an open-source implementation do not supply the formal mapping needed for the theorem. In Section V, K values (1.527, 1.339) are reported without the underlying q_ij(u) values or the path-to-generator algorithm, and sensitivity sweeps rely on 'bundle-default' parameters. Consequently, the central claim that K is derived from state dynamics rather than assigned is unsupported at the formal level: Eq. (6) is a definition of K once Q_π is given, but Q_π is not given. The Limitations section (Section VI) acknowledges domain-specific calibration and independence of numerator terms, but it does not flag this missing path-to-generator construction. The composition theorem remains a conditional statement whose key premise is uninstantiated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a compositional risk framework for agentic and cyber-physical systems. It introduces CPSAINT, a fixed seven-layer grammar (Physical, Sensors, Data, Compute, Actuators, Environment, Time) with a five-mode failure alphabet, and FRIESA-K, a residual-risk functional R = F·Ri·E·S·A / K. The resistance term K is meant to be derived from a path-conditioned, controlled absorbing CTMC, so that control effectiveness is a consequence of state dynamics rather than an ad hoc expert score. A composition theorem asserts that any valid CPSAINT path, together with a defender policy inducing a well-defined absorbing process, yields a well-defined FRIESA-K risk instance of unchanged functional form. The framework is demonstrated on two case studies: a warehouse robot and a financial-services agent, with sensitivity sweeps, Monte Carlo bands, and weak-control comparisons.","tokens_in":11561,"tokens_out":3725,"duration_ms":45916,"significance":"If the framework were fully realized, it would fill a genuine gap: structural safety/security analyses such as STPA do not produce residual-risk magnitudes, while quantitative risk models generally abstract away the internal failure path. The paper's conceptual separation of mechanism (CPSAINT) from magnitude (FRIESA-K), the dynamic grounding of K, and the additive governance-observability penalty are sensible design ideas. The authors are also transparent about some limitations, including domain-specific calibration and the absence of dependence modeling among numerator terms. However, as it stands, the central quantitative claim is not substantiated. The construction from a failure path π to the CTMC generator Q_π(u) is never given, the composition theorem is largely definitional, and all reported risk scores are produced from undisclosed 'bundle-default' parameters. The case studies therefore illustrate the algebra of Eq. (4) under chosen magnitudes rather than provide evidence that the framework produces transferable or empirically grounded risk estimates.","major_comments":[{"comment":"The definition of K rests on a path-conditioned CTMC with generator Q_π(u), but the manuscript never defines the mapping from a failure path π = [(ℓ1,m1),...,(ℓn,mn)] to Q_π(u), nor the baseline policy u0. The sentence 'The path determines the relevant hazard states, interfaces, and control touch points' and the pointer to an open-source implementation do not supply the required construction. Consequently, Eq. (6) is a conditional definition whose key premise is uninstantiated. The reported K values in Section V (1.527, 1.339) are therefore not shown to be derived from path dynamics; they are as assigned as the numerator terms the framework criticizes. Section VI, which lists limitations, does not flag this missing path-to-generator mapping.","section":"Section IV-C, Eq. (6)"},{"comment":"The proof of the composition theorem restates the premises as conclusions: it assumes that domain-specific instantiations of F, Ri, E, S, A exist and that a defender policy u induces a finite-state absorbing process with well-defined K, and then concludes that R is well-defined and that the functional form is preserved. This is a tautology unless the theorem constructs Q_π from π and u, or gives sufficient conditions on Φ, M, and the transition rates under which K exists, is finite, and is uniquely determined. As written, 'compositionality' is a definitional restatement rather than a theorem with content.","section":"Section IV-D, Theorem 1"},{"comment":"All numerical risk scores and sensitivity results are generated from 'bundle-default' parameter values that are not reported: F, Ri, E, S, A, the CTMC rates q_ij(u), β_c, β_r, and the generator matrix are never disclosed. The text itself acknowledges that the scores are 'not calibrated to monetary or physical loss units,' but the evaluation section still presents sensitivity rankings, weak-control comparisons, and Monte Carlo bands as empirical results. For example, the claims that the warehouse robot is 'response-dominant' and that weak response/weak detection produce the largest increases are consequences of the chosen parameter magnitudes, not measurements or fitted estimates. To make the framework testable, the authors must either report calibrated parameter values with provenance or clearly present the case studies as a parameterized illustration without evaluative conclusions.","section":"Section V-A, V-B, Table II"},{"comment":"The governance-observability demonstration is weakened by the chosen horizon. The paper states that at τ=0.75 s the R_gov term is 'numerically negligible' and that governance effects become material only at longer horizons (e.g., a 12-hour clinical scenario). Yet the banking-agent case study is used to demonstrate governance instrumentation. This is internally consistent but significantly narrows the demonstration: the case study shows the structural mechanism, not a quantitative governance effect. The 43,200-second clinical scenario, mentioned only in passing, should either be moved into the main evaluation or the claim that the framework 'demonstrates governance observability' should be explicitly reduced to a structural assertion.","section":"Section V-C, V-D"}],"minor_comments":[{"comment":"The notation is confusing: Eq. (5) defines a catastrophe-absorption probability but calls it π_F, which is easily mistaken for the failure path π. Use a distinct symbol such as p_cat or P_F.","section":"Section IV-C, Eq. (5)"},{"comment":"The elasticity parameters β_c = 2.1 and β_r = 1.8 appear in the text but are never defined in Table I or in the model. Please define them, or remove them if they are only simulation inputs.","section":"Section V-C"},{"comment":"The mapping from the formal layer set {P,S,D,C,A,E,T} to the two column stacks in Figure 1 is described only in prose. Add an explicit table or legend in the figure itself to make the correspondence precise.","section":"Figure 1"},{"comment":"Given that the path-to-generator mapping is absent, the Limitations section should list it as a primary limitation, not only mention calibration and numerator independence.","section":"Section VI"},{"comment":"The approximate factorization of K into per-control benefit factors is stated but never used in the case studies or sensitivity analysis. Either show how the approximation connects to the reported sweeps or remove it to avoid dangling machinery.","section":"Section IV-B, Eq. (7)"}],"recommendation":"major_revision","confidential_remarks":"The paper is better understood as a framework proposal than as a validated empirical method. The core formalism is not wrong, but the central claim—that K is derived from path dynamics—is currently unsupported because Q_π is never constructed. I believe this can be fixed within the manuscript's scope by supplying the generator construction and replacing undisclosed bundle-defaults with explicit, justified parameter values. If the venue expects quantitative validation, the case studies need substantial recalibration."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper is a well-organized proposal for a shared risk grammar for agentic AI, but the load-bearing claim—that K is derived from state dynamics rather than assigned—is not backed by a construction, and Theorem 1 is a definition in proof clothing.\n\nWhat's genuinely useful: the CPSAINT seven-layer decomposition is a sensible way to compare failure paths across domains, and the idea of grounding control effectiveness in an absorbing CTMC is reasonable. The paper is honest about limitations. It explicitly says the risk scores are not calibrated and that the governance penalty is structurally demonstrated rather than quantitatively material at the 0.75s horizon. That matters.\n\nThe stress-test note is right. Section IV-C says the path determines the relevant hazard states and control touch points, but the map from π to Q_π(u) is never specified. Without that, Eq. (6) is just a definition of K once you assume a generator. The claim that K is derived from dynamics is unsupported at the formal level. Theorem 1's proof restates the assumptions; it is a construction, not a theorem. The case studies use 'bundle-default' parameters with no calibration, so the risk numbers are illustrative. The sensitivity curves follow directly from Eq. (4) and show the functional form, not empirical behavior. These are real soft spots, but they are consistent with the stated scope as a framework proposal.\n\nOne thing I'd push back on: the reader's report says the governance penalty is 'structurally defined so that it remains negligible at the chosen horizon.' That is a fair observation, but the authors disclose it in Section V-C, so it is not a hidden flaw.\n\nThe paper is for people designing risk assessment methods for agentic and cyber-physical systems. It does not deliver an empirical estimator, but it does offer a vocabulary and a way to think about composable risk. I'd send it to peer review because the framework is new enough and the writing is clear, but I'd expect referees to demand that the path-to-generator mapping be specified or the K claim downgraded. I'd engage with it as a design proposal, but not cite it in the next year for empirical claims.","headline":"A clearly written framework proposal whose central theorem is a definition and whose K is not actually derived from path dynamics; worth engaging, not worth citing as an empirical result.","tokens_in":12069,"tokens_out":1854,"would_cite":false,"duration_ms":20399,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A seven-layer failure grammar turns any agent failure path into a quantifiable residual risk.","keywords":["agentic AI","residual risk","failure-path decomposition","control effectiveness","absorbing Markov chain","governance observability","compositional trust","cyber-physical systems"],"falsifier":"If an independent, deployed agentic system shows that a control policy produces a measured catastrophe-frequency reduction that disagrees with the K predicted from the paper's Markov construction, the dynamic-resistance derivation would be falsified; more directly, the framework is empty if the open-source rate parameters are not traceable to any empirical source.","tokens_in":11040,"feed_emoji":"🤖","tokens_out":4004,"duration_ms":40548,"temperature":0.7,"pith_summary":"This paper tries to close the gap between two partial views of agentic-AI risk: structural analyses that explain how failures propagate but yield no risk number, and quantitative estimators that give numbers but treat the system as a black box. It proposes a fixed seven-layer failure grammar (CPSAINT) together with a risk functional (FRIESA-K) in which residual risk equals (frequency × reachability × exploitability × severity × amplification) divided by a control-effectiveness term K. The paper's key move is to derive K not from expert scores but from a path-conditioned absorbing Markov model, so control effectiveness is the ratio of baseline to controlled catastrophe-absorption probability by a horizon. A composition theorem asserts that any valid failure path induces a well-defined risk instance with the same functional form across domains. Two case studies, a warehouse robot and a banking agent, show the same grammar and semantic machinery at work.","feed_headline":"One risk formula maps any agent failure path to a score","feed_subtitle":"A fixed seven-layer grammar plus Markov-derived controls gives transferable residual-risk numbers across robotics and finance.","key_machinery":"The central object is the pair (CPSAINT, FRIESA-K). CPSAINT is a fixed seven-layer integrity grammar over Physical state, Sensors, Data, Compute, Actuators, Environment, and Time, with a five-mode failure alphabet (corruption, delay, omission, replay, coupling abuse) and a propagation relation defining valid failure paths. FRIESA-K is a residual-risk functional that maps a path π, horizon τ, and control policy u to the score (F·Ri·E·S·A)/K. The load-bearing mechanism within it is the dynamic-resistance term K, defined as the ratio of baseline to controlled catastrophe-absorption probability in a path-conditioned, ten-state continuous-time Markov chain; this is what converts a structural desc","core_discovery":"The central claim is the composition theorem: for any valid failure path π in the CPSAINT grammar and any control policy u inducing a well-defined absorbing process, π induces a well-defined FRIESA-K risk instance R(π,τ,u) = (F·Ri·E·S·A)/K(π,τ,u), and the mapping preserves functional form across domains. The paper also introduces a dynamic-resistance construction in which K is the ratio of the catastrophe probability under a baseline policy to that under the policy u, computed on a finite-state continuous-time Markov chain. This makes control effectiveness a consequence of state dynamics rather than an assigned score. The paper further separates governance observability as an additive dwell-","pith_inferences":["The framework is best read as a template or calculus, not an empirical estimator: the paper reports no measured transition rates, so realized risk scores inherit whatever fidelity those rates carry.","A natural stress test is multi-agent composition, where overlapping controls on shared surfaces would violate the single-path factorization of K; the paper explicitly leaves this for future work.","The sub-second governance-penalty result suggests a concrete design rule: governance-heavy applications should be evaluated at their full assurance horizon, not at the operational control loop's horizon, or the governance term will look negligible."],"forward_implications":["Any agentic system expressible in the seven-layer grammar yields a comparable residual-risk number, enabling cross-domain benchmarking of interventions.","Control effectiveness becomes falsifiable: if a policy does not reduce catastrophe probability by horizon, K does not rise, and the risk score reflects that.","Operational risk and governance-assurance degradation are reported separately, so a system can be operationally safe yet governance-fragile, or vice versa.","Sensitivity analysis follows directly from the functional form: residual risk is linear in frequency F and inverse in control effectiveness K."],"fun_headline_variants":["One formula turns any agent failure into a risk score","Seven-layer grammar maps failure paths to quantified risk","Markov-based resistance gives transferable risk for agentic AI","Composable risk kernel: from warehouse robots to finance agents"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that each failure path can be assigned transition rates for the Markov model that genuinely reflect empirical propagation, detection, and recovery hazards; the paper provides no such measured rates, so the computed K and risk scores are the modeler's prior expressed as a formula unless those parameters are independently calibrated.","fun_headline_variants_meta":{"raw":{"variants":["One formula turns any agent failure into a risk score","Seven-layer grammar maps failure paths to quantified risk","Markov-based resistance gives transferable risk for agentic AI","Composable risk kernel: from warehouse robots to finance agents"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00017,"raw_usage":{"total_tokens":1119,"prompt_tokens":775,"completion_tokens":344,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":519,"completion_tokens_details":{"reasoning_tokens":291}},"tokens_in":519,"tokens_out":344,"duration_ms":4658,"temperature":1.0,"reasoning_tokens":291,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T15:16:15.071440+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"If an independent, deployed agentic system shows that a control policy produces a measured catastrophe-frequency reduction that disagrees with the K predicted from the paper's Markov construction, the dynamic-resistance derivation would be falsified; more directly, the framework is empty if the open-source rate parameters are not traceable to any empirical source.","supporting_citations":[],"review_version":1}