FlagThis

Abstract

LLM coding harnesses grant agents broad file and shell access, yet the configuration layer that steers them-rules files, agent definitions, IDEspecific markdown-is largely unmanaged. A prevalence study of 10,008 public GitHub repositories ( _n_ =6,145 agent config files) establishes one robust headline finding: agent configurations propagate as undeclared shared components -10.1% of tracked paths are exact duplicates across independent repositories (fork-adjusted; measured by SHA-256, thresholdindependent), and 75.5% of clone pairs cross organisational boundaries. Two further patterns are indicative rather than definitive: configurations are rarely revised (a 58% single-commit majority; the gap narrows but persists after age-normalisation-0.4 versus 0.6 commits/month against CI/CD workflows in the same repos), and they rarely declare permission boundaries (<1% of agent configs versus 33% of Actions workflows, on a fragile parser with _n_ =31 true positives). A fourth gap- unbounded execution without enforced traceability-is not observable from static config files; a fifth- expertise locked to harness dialects -is only partially visible in the corpus but is structurally evident from incompatible config formats across tools. We propose a deterministic control plane above the harness (not replacing it) that maps one-to-one to these gaps. Rel(AI)Build , our reference implementation, treats agent definitions as a managed supply chain (SHA-256 content addressing, HMAC-stamped lockfiles, hash-chained audit logs) to counter undeclared propagation; enforces tiered permissions and attack-derived blocklists before LLM invocation where configs declare none; gates feature work through a phase state machine with requirementfiletest traceability to bound execution; compiles a single canonical definition to seven IDE targets to port expertise across dialects; and detects prompt drift via Jaccard similarity. Conformance tests on injected violations confirm each mechanism enforces its stated invariant; developer outcomes remain future work. Determinism applies to install-time gates, blocklists, and phasestate transitions; trace linkage is cooperative and auditable post-hoc, not pre-execution enforced. Governance of this layer must be deterministic and tool-agnostic -not delegated to further LLM orchestration.