TRACE: Evaluating a Control Set Across Agent Architectures

Edition One of this work proposed seven minimum viable controls at the MCP agent-to-tool boundary and evaluated them by ablation across five threat models, all against one architecture. This edition varies the architecture instead: three multi-agent topologies — deep delegation, shared-state coordination, peer handoff — are built, attacked and ablated, with a forward arc built against each gap found. The organising claim, that edge controls (attached to a boundary crossing) are architecture-dependent while endpoint controls (attached to a resource or a process) are not, survives every registered falsification condition — and the paper records why that is weak evidence: the claim is close to true by construction, and both endpoint survivals carry a named, untested confound. The contribution is what the method had to become: twelve procedural additions to TRACE, none designed in advance, each forced by a near-miss in which something the evaluator controlled could have manufactured a finding — a harness that never invoked a control, an instrument that vindicated itself, a fix graded by its own author. Findings the claim did not predict include an audit trail that is precise about the wrong topology, another that is complete yet silent about the transfer that mattered, and a control set with no concept of caller authority. The practical payoff is a procedure for ISO/IEC 42001's reassessment-at-change obligation: ask of each control where it attaches. Edition Three tests the frame on control sets this author did not design. Second in a three-edition series. Continues Edition One (doi:10.5281/zenodo.21426578), which supplies controls C1–C7, forward arcs FW1–FW5, and the T1–T5 results this edition treats as frozen. All predictions, build requirements and falsification conditions were pre-registered before the corresponding code existed; the commits that introduced them are the timestamps. Implementation: edition-2 , commit 8d53289.