2026· International Journal Of Engineering And Computer Science· Vol 15, pp. 28741-28752· 1 citation
TL;DR
The K11tech Microservice QA System is presented, a LangGraph-orchestrated agentic pipeline that extends CI/CD quality assurance to distributed microservice ecosystems and achieves 100% precision, recall, and F1 throughout.
Abstract
Single-repository quality gates are blind to API contract violations across microservice boundaries: a pull request that changes a REST endpoint can pass all local CI checks while silently breaking downstream consumer services in other repositories. This paper presents the K11tech Microservice QA System, a LangGraph-orchestrated agentic pipeline that extends CI/CD quality assurance to distributed microservice ecosystems. The system maintains a cross-repository dependency graph, extracts versioned API contracts from pull requests (OpenAPI 3.x, gRPC Protocol Buffers, GraphQL, and AsyncAPI 2.x), identifies all downstream consumers of changed endpoints, and dispatches parallel ContractComplianceAgents to validate compatibility before merge. A cross-repository HITL gate triggers on impact score thresholds, filing GitHub issues in both provider and consumer repositories when breaking changes are detected. Evaluation across four phases (90 scenarios) achieves 100% precision, recall, and F1 throughout, including external validation on 59 OSS pull requests across four repositories with zero false positives and transitive consumer discovery at depth-2. Multi-model ablation identifies Claude Haiku 4.5 as the optimal backend: 31% faster than Sonnet 4.6 (8.9 s vs. 12.9 s) while maintaining perfect accuracy on ambiguous consumer-impact scenarios. The system is publicly available under the Apache 2.0 licence.
The results show that specification size alone does not predict implementation quality and that cross-agent transfer can produce substantial agent-dependent degradation, and suggest that specifications in heterogeneous SDD workflows should not automatically be treated as agent-neutral artifacts.
Oleg Grynets, O. Ilchuk, Dariia Zatulna et al.· 0 citations
The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.
Bohao Liao, Jing-Chao Wang, Qipeng Song et al.· 0 citations
AI-enabled service-oriented systems change through code, data, prompts, service contracts, retrieval indices, and deployment workflows, which makes regression impact difficult to localize with code-centric evidence only. Existing regression test selection methods provide strong code-, configuration-, and service-level signals, but they provide limited guidance on how to reconcile structural, document, semantic, retrieval, and risk evidence when these signals disagree. This paper presents a multi-agent orchestration framework for change impact analysis and budget-aware regression test selection, where specialized agents score various evidence, a coordinator applies a fixed CI/CD budget, and a graph-backed variant records arbitration traces. We evaluate the framework on three case-study systems: an anonymized industrial wellness retrieval-augmented generation (RAG) platform with 300 tests, a microservice application with 150 tests, and a CI/CD pipeline with 60 tests. Each system has six snapshots, producing five evaluated change transitions, with two replicates per transition and the same budget rule across systems. The results are mixed and informative: the base multi-agent configuration is competitive with monolithic fusion, the graph-backed configuration recovers the strongest CI/CD score, and single-signal baselines remain strongest when one impact mechanism dominates. These findings position the multi-agent test selection approach as an observable, configurable decision framework for cross-domain impact analysis rather than a universally superior predictor.
Nariman Mani, Amr S. Abdelfattah, Shakthi Weerasinghe et al.· International Conference on...· 0 citations
AppEval is presented, a benchmark and native-toolchain evaluation framework for mobile application repair across HarmonyOS/ArkTS, iOS/Swift, and Android/Kotlin, and shows that mobile repair performance depends strongly on the evaluated agent while demonstrating why runtime-aware acceptance is necessary for meaningful comparison.
Natural language interfaces enable flexible interaction with LLM‑based AIOps platforms but introduce reliability risks when user input lacks a verified mapping to a supported intent, parameter schema, or policy envelope. Unconstrained prompts can trigger hallucinated procedures, incorrect tool invocation, parameter‑level violations such as missing service identifiers or malformed time windows, and silent partial execution that evades post‑mortem detection. Guided discovery exposes system capabilities via BM25‑plus‑embedding hybrid retrieval over a versioned intent catalog, matching exact operational tokens alongside paraphrastic variation. Soft enforcement applies a two‑stage slot filling pipeline — deterministic parsers for structured identifiers combined with LLM‑based entity extraction — validated against JSON‑Schema definitions, converting validation failures into actionable repair prompts rather than hard rejections. Dynamic recommendation maintains lightweight dialog state across incident lifecycle stages and employs a rules‑plus‑learned ranker to re‑rank intents, pre‑populate parameters, and suppress sequencing or policy violations contextually. The reference architecture integrates these mechanisms with margin‑based confidence gating that enforces stricter thresholds for destructive operations, server‑side RBAC and environment policy gates evaluated before tool invocation, and an allowlisted execution registry that rejects hallucinated tool calls. Structured telemetry emitted at each pipeline stage — retrieval scores, extraction accuracy, validation error distributions, policy denial rates, and correction loop metrics — enables governance, drift monitoring, and continuous catalog improvement. This model demonstrates that a meaningful proportion of perceived LLM shortcomings in production AIOps can be mitigated through UX‑level constraints that align operator requests with the system's executable capability set. In production systems such as incident monitoring copilots, conversational agents invoke runbooks, diagnostic queries, or remediation workflows through downstream tool interfaces. Prompt‑level ambiguity may therefore propagate into incorrect execution plans, such as mis‑scoped tenant queries, environment‑mismatched remediation, or sequencing violations in mitigation workflows. The reliability of an operational agent is thus determined not solely by model reasoning but by the safety of the interface layer mediating prompt‑to‑execution translation.
N. Gupta· International journal of com...· 0 citations
AI coding agents such as Claude Code, Cursor, GitHub Copilot, and OpenAI Codex are configured through artifacts developers write and share: instruction files, skills, hooks, MCP server declarations, subagents. This harness is a dependency layer installed from marketplaces and public repositories, running with the developer's privileges, with no lockfile, no install-time check, and no vocabulary for what a component may do. We study it over 3,171 public GitHub repositories: 2,660 setups that assemble two or more component types and 511 published skill collections. We measure only rules decidable from bytes whose consequence is a security exposure, a configuration that cannot work, or a departure from the Agent Skills specification, and validate every finding before it counts: an independent implementation re-derives it from the repository at its pinned commit, a language-model adjudicator with a released prompt rules on every disagreement, and a second independent model session re-checks every counted pair. Three security classes survive: 9.8% of setups install an MCP server with no version pinned, 3.1% pre-approve arbitrary execution behind a scoped-looking grant such as Bash(python:*), and 3.8% carry a skill that pre-approves the shell for whoever installs it. In total 16.0% of setups carry a security defect and 16.7% a confirmed defect of any kind, against a raw scanner rate of 25.5% on the same rules; the third class ships inside 3.7% of collections, where a marketplace scan can see it. Rules that compare two files detect differences that are usually intended and are reported as observations. No credential-exfiltration path was confirmed. The instrument, corpus manifest, prompt, and every verdict are released.
Benjamin Kapner, Carmel Soceanu, A. Petrunin et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
