What happens when an unsupported, stale, unsafe or contaminated output is reused by downstream stages as trusted context, and how can explicit controls contain or recover from that propagation?
Why This Problem Matters
Agentic workflows can reuse intermediate outputs as downstream context. When unsupported, stale, contaminated or incorrectly verified outputs are accepted too early, the error can propagate beyond its source and become harder to detect or contain.
Approach
Version 1.0 freezes an eight-stage workflow, one authoritative workflow definition, one scenario registry and eight controlled scenarios. The execution engine produces structured canonical traces and explicit evidence/context states, then applies deterministic controls for evidence checking, safety decisions, context isolation and trusted-state recovery.
Architecture
The implementation separates workflow specification, scenario definitions, execution, controls, tracing, isolation, evaluation and Streamlit presentation. The interface consumes the canonical engine rather than maintaining an independent simulator.
Evaluation
The frozen scenarios cover nominal behavior, missing evidence, stale evidence, unsupported root-cause propagation, instruction contamination containment, false verification, over-permissioned action, and containment with trusted-state rollback and deterministic re-execution.
The committed evaluation reports the expected final state for all eight scenarios as PASS. Recorded propagation properties include fault source, fault reach, blast radius, propagation depth, containment point, control response and final state.
Results / Evidence
The evaluation demonstrates deterministic behavior of the bounded simulation under its predefined specifications. It shows that the implemented controls can produce explicit escalation, blocking, containment, human-approval and recovery states under the corresponding predefined scenarios.
My Contribution
The public repository identifies Yasir Siddiq as the project author. The portfolio therefore presents the design, implementation, evaluation and documentation as Yasir Siddiq’s project work within the limitations stated by the repository.
Limitations
Version 1.0 does not contain independently executing LLM agents, production infrastructure, real attack execution, trained safety classifiers, calibrated risk probabilities, production remediation or regulatory compliance assessment. Presentation indicators are not model confidence or empirical risk estimates.
Reproducibility
The repository documents Python 3.11 as the verified CI environment, includes pytest tests, a one-command frozen evaluation, committed versioned result artifacts and CI checks that compare regenerated evidence with the committed results.
Current Status
Version 1.0 is frozen as a bounded deterministic demonstrator. Future work may replace fixed simulated stages with independently executing bounded agents, but that is not functionality claimed by the current version.