New Middleware Keeps AI Security Reviews Honest With Evidence-Gated Handoffs

Software security review is undergoing a quiet revolution. Large language model agents now sweep through codebases, flag suspected vulnerabilities, run verification tools, and pass their findings along to other models or human analysts. But as these long-running workflows grow more complex, involving multiple models, tools, and reviewers working in sequence, a deceptively simple problem has emerged: when one participant hands the work to another, how does the recipient know what actually happened before? A new open-source middleware called BGVD-State, described in the journal SoftwareX by Yi Lv and Cheng Wang, tackles exactly this problem by making every security review replayable, auditable, and strictly evidence-gated.

The core insight behind BGVD-State is that the integrity of review state matters as much as the discovery of new candidate issues. In a typical AI-assisted review, one model may observe a suspicious pattern, another may attach evidence from a scanner, and a third may render a verdict. If the recipient of a handoff only receives a transcript or a summary, they cannot reliably tell which candidate owns which piece of evidence, whether that evidence is still current, which investigation routes have already failed, or which verification decision controls whether the finding can be reported. Stale, incomplete, or contradictory evidence can slip through, or worse, a candidate’s lifecycle can be silently corrupted across handoffs.

BGVD-State, whose historical name stands for Blackboard-Guided Vulnerability Discovery, draws on an idea that predates modern AI by decades: the blackboard architecture, in which independent knowledge sources collaborate by reading and writing to a shared problem-solving state. The Hearsay-II speech understanding system of 1980 popularized the approach, and recent LLM research has revisited blackboards for multi-agent collaboration. What the new software adds is an explicit evidence chain and a reporting gate. Crucially, BGVD-State is not itself a language model. It is deterministic middleware that sits between event producers, such as agents, tool wrappers, parsers, and human analysts, and state consumers, such as stronger models, reviewers, and reporting pipelines.

The architecture works through typed event records. Every tool call, observation, evidence update, invalidation, or review decision is appended to an event store with a unique identifier, preserving submission order. From these ordered records, the EvidenceLifecycle component derives candidate status, evidence binding, verifier currency, and failed paths. A FinalizationGate then decides whether a candidate may enter a report, returning an allow or reject decision with machine-readable reasons. The whole system enforces five invariants: evidence stays bound to its candidate until explicitly invalidated; a candidate requires current material evidence and a current positive verifier result before reporting; the newest verifier result always governs; rejected routes are carried into later handoff packages so successors do not repeat failed paths; and finalization excludes invalidated or superseded evidence.

Because these rules are enforced by deterministic code rather than by prompts, model forgetting, reinterpretation, or prompt-rule violations cannot alter execution after context compression or a provider change. This is a deliberate design choice with significant implications. When the software version, policy configuration, and event sequence are identical, every client obtains the same lifecycle state and gate decision. Replay validates each event’s structure before appending it, and an event rejected by validation leaves the state unchanged. The middleware does not, however, verify the substantive truth of client-supplied observations; that responsibility remains with the producers and verifiers.

The authors demonstrate the system on a third-party review of fixed public revisions of real open-source projects, including TypeScript, Django, and an elliptic-curve cryptography library. A workflow of 22 event records reconstructed six suspected-risk candidates. Five candidates were rejected along paths whose exclusion reasons are fully recorded within those events. The remaining candidate had a locally reproduced technical observation and an initial positive technical review, but a subsequent security-impact review concluded that the available evidence and tests did not establish a privilege or trust-boundary impact sufficient for reporting. That negative decision was appended as a 23rd event, and after replay, BGVD-State generated a handoff package containing the current states, evidence, and review results for all six candidates, with the complete decision trail preserved for audit.

Reproducibility is treated as a first-class concern. Version 1.2.0, released under the MIT license, runs on Python 3.10 through 3.12 with no runtime dependencies, and no-install reviewer kits are available for Windows x64 and macOS on both Apple Silicon and Intel. The regression suite of 130 tests covers legacy-input normalization, rejected-event state snapshots, and artifact-completeness checks, none of which require an API key or a model call. In a historical performance profile cycling through six fixed synthetic candidates across scales from 100 to 100,000 events, each scale produced a single stable state hash and handoff hash across five repetitions, with median replay time rising from under a millisecond to about 1.34 seconds at the largest scale.

The paper is notably candid about where the approach helps and where it does not. In historical memory-representation studies, a schema-guided state format outperformed matched free-form memory on selected high-pressure continuation fixtures, with a valid-output sensitivity analysis showing six wins, no losses, and 23 ties. But under reduced pressure, with information-equivalent prose, and in a cross-family source-audit setting, the advantage disappeared or reversed, and the authors explicitly present the source-audit result as a tested negative boundary. A token-cost comparison using GLM 5.2 and DeepSeek v4-pro found that a route in which local weaker models handle routine state curation consumed roughly 24,000 strong-model finalizer tokens with no strong-model update tokens, versus nearly 147,000 total strong-model tokens for strong-model curation, with both routes reaching correct final decisions in all 30 runs.

The practical vision is one of composable infrastructure. Orchestration frameworks such as LangGraph can keep workflow checkpoints, and multi-agent systems like AutoGen can coordinate agents and memory, while BGVD-State retains sole authority over security-review state and the reporting gate, presenting the same event, handoff, and gate interfaces to whichever client is attached. Teams can swap models, prompts, retrievers, or tool wrappers without changing the rules that determine which evidence remains current and whether a finding may be reported. A weaker local model can maintain routine state while stronger models or human reviewers receive the current package only when needed.

The authors are careful about the limits of their claims. The applied case used local copies of public repository revisions without interacting with live services, and no candidate is presented as a maintainer-confirmed vulnerability. The middleware implements one deterministic policy family, external clients remain responsible for authenticating event sources, and deployment-level gains in discovery rate, review time, or total cost are not established by the reported checks. Future work points toward multi-writer transactions, cryptographic event integrity, and signed handoff exchange for distributed deployment. Even so, BGVD-State offers something the fast-moving world of AI security agents has lacked: a provider-independent, replayable contract for carrying evidence and state across handoffs, ensuring that when an AI says a vulnerability is worth reporting, the entire chain of evidence behind that claim can be traced, replayed, and trusted.

Subject of Research: Replayable middleware for evidence-gated state handoffs in third-party software security review using AI agents

Article Title: BGVD-State: Replayable middleware for evidence-gated handoffs in third-party software security review

Article References: Lv, Y., & Wang, C. (2026). BGVD-State: Replayable middleware for evidence-gated handoffs in third-party software security review. SoftwareX, 36, Article 103109. https://doi.org/10.1016/j.softx.2026.103109

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103109

Keywords: BGVD-State, software security, LLM agents, vulnerability discovery, blackboard architecture, middleware, reproducibility, evidence chain, handoff, open source, cybersecurity, multi-agent systems