From the Research Universities edition of September 21, 2026
CrossAudit: git-native cross-vendor audit loop so an AI scientist does not grade its own homework
University of Cambridge / University of Wisconsin–Madison (Dong & Chen) · AI scientist supervision / research integrity tooling · International academic authors; protocol transferable with vendor/API and confidentiality limits
- Publisher
- arXiv
- Original publication
- August 5, 2026 (arXiv; August 2026)
- Source retrieved
- 2026-09-22
What happened
CrossAudit specifies eight invariants for supervising agentic science: vendor-heterogeneous auditors, git ledger completeness (parsed tier), citation-valid reports, determinism-first checks, bounded revision, graded interruption, receipt binding, and fail-closed admission. Authors describe a reference implementation, a live computational-chemistry deployment, and an exploratory seeded-defect trial (30 increments, 43 defects) showing discordant configuration-level readings of the same rulebook; they explicitly state the protocol does not certify scientific truth.
Why it matters
Why now: Older than last run but newly relevant after 2026-09-20 capacity-vs-fidelity and this edition's WetRobo/SynAgent/Diamond agentic demos—supplies an independent supervision pattern campuses can adopt when AI scientists scale on university HPC and SDLs.
Evidence and measured results
Eight invariants; dual-repo separation; seeded trial 30/43; live chemistry deployment narrative; explicit non-claim of truth certification.
Limitations and uncertainty
Aug preprint with why-now; self-declared vendor identity; raw exchanges not ledgered; trial exploratory/blinding voided; observational deployment.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-22; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agentic research pipelines often use same-vendor critics and non-replayable logs, leaving institutions unable to inspect supervision.
- Stakeholders
- VPR/research integrity
- Research computing
- DevOps
- Faculty running AI scientists
- Discovery questions
- Which two vendors can be paired?
- Who authors the Constitution?
- What actions require receipt-gated admission?
- What data may leave to a second API?
- Value hypothesis
- Cross-vendor, git-ledgered audits with determinism-first checks can make supervision inspectable and reduce same-source self-preference exposure—without claiming scientific truth certification.
- Potential engagement
- Pilot dual-repo audit loop on one agentic pipeline with a small Constitution and admission gate on claim publication.
- Unsupported claims
- Certifies scientific truth
- Eliminates all correlated model error
- Guaranteed low escalation volume
Pre-sales engineering
Role takeaway
- Fit
- Git-native cross-vendor audit protocol with DCL precedence, citation-valid reports, receipts, and fail-closed admission.
- Architecture and integration
- Science repo increments trigger audit-repo CI; auditor writes report+receipt; science side verifies receipt before protected actions.
- Prerequisites
- Two model vendors
- CI + branch protection
- Human Constitution
- Deterministic check scripts
- Constraints
- Self-declared vendor identity
- Parsed ledger without raw exchanges (rev1)
- Exploratory trial limits
- Confidentiality of increments to second vendor
- Security
- Fence untrusted increment text; never let models waive DCL hard fails; escalate empty/citation-free audits.
- Proof of value
- Receipt verification tests
- Ledger replay of PASS/BLOCK cycles
- Documented cross-vendor disagreement on identical inputs
Delivery
Role takeaway
- Work
- Scaffold two repos, author Constitution v0, wire DCL+auditor, gate one protected action on receipts.
- Dependencies
- Research integrity principal
- CI/DevOps
- Generator team
- Legal/data-governance for second-vendor API
- Ownership
- Principal owns rules; platform owns admission; generator owns increments.
- Skills and adoption
- Train staff to write decidable rules and triage escalations asynchronously.
- Governance checkpoints
- Constitution change review
- Admission binding check
- Escalation SLA
- Acceptance criteria
- Receipt-gated protected action
- Sample ledger published or retained
- Written non-goals on truth certification
- Risks
- False-block storms
- Goodharting rules
- Data leakage via auditor API
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Split science and audit repositories; run DCL before LLM audit; gate protected actions on receipts.
Governance
Who approves, reviews and stays accountable for outcomes?
Human principal owns Constitution; escalations interrupt humans; same-vendor self-critique is insufficient as sole control.
Security and privacy
What data, permissions and controls need testing?
Fence increment content against prompt injection; second-vendor API confidentiality must be contracted; DCL hard fails non-waivable.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Redeploys scarce human attention to Constitutions and escalations rather than every increment; requires rule-authoring skills.
Procurement
What should contracts, pricing and exit terms secure?
Require dual-vendor audit options and receipt-gated claim publication in AI-scientist procurements—not internal reflection modules alone.
Operating model
Which teams own the service once it runs?
Management-by-exception model only works if auditor calibration keeps escalations << increments.
Publication history
- 2026-09-21Research Universities · Issue 164 resources
Stable resource ID: crossaudit-cross-vendor-agentic-science-20260805