Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.33350

EVM-Anchored Provenance for AI-Assisted Code Evolution: A Smoke-Scale Deployment Report

Einar César Santos
View original source ↗Read source document ↗Export metadata ↓

Abstract

We report a smoke-scale deployment of an EVM-anchored provenance framework for the state stream produced by AI-assisted code generation. The system comprises codebase-state-manager, an open-source Model Context Protocol (MCP) server (MIT, v0.2.1) that exposes codebase state, transition, and reward operations to any MCP-compatible assistant, and CodebaseStateRegistry, a Solidity contract deployed on Base Sepolia that emits per-state commitment events. Payloads are pinned to the InterPlanetary File System (IPFS) and indexed through a rebuildable SQLite mirror that resynchronizes by replaying contract events. We delimit precisely what anchoring does and does not attest (existence, ordering, and non-equivocation by the committer key; never truthfulness or fabrication-prevention) and outline the orthogonal supply-chain controls required to close that gap. Under an author-produced synthetic workload on a local Anvil simulator, the median commit costs 103,282 gas, modeled at US$0.0018-0.0035 in rollup fees per commit (US$17.9-34.8 per 10,000 states), and simulator latency for the create operation is 539.8 ms (p50) and 725.0 ms (p95) under loopback storage and instant mining. The live deployment holds 14 StateCommitted events verifiable on-chain; the last consumed 98,977 gas at 1 gwei (about US$0.30). All empirical figures are descriptive quantiles from a single author run; no testnet latency is reported, and no claim of superiority is made against any baseline. A receipts-trie consumption mechanism, a BountyEscrow use case, and a FAIR-aligned dataset publication pattern are specified as outlook and are not implemented. A property-by-property comparison against OpenTimestamps, Sigstore Rekor, Centrifuge AnchorRegistry, in-toto/SLSA, Radicle, and Lalli et al. places this work relative to the surrounding provenance landscape.

Explore related subjects

cs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Einar César Santos. 2026-10-23. EVM-Anchored Provenance for AI-Assisted Code Evolution: A Smoke-Scale Deployment Report. https://arxiv.org/abs/2610.33350

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

How Quickly Do Development Teams Update Their Vulnerable Dependencies?

Industry practitioners are increasingly concerned with software that contains vulnerable versions of third-party dependencies that are included both directly and transitively. To address this problem, projects are encouraged to both (a)~quickly update to non-vulnerable versions of dependencies and (b)~be mindful of the update practices of the dependencies they choose to use. To this end, researchers have proposed metrics to measure the responsiveness of the development teams of the packages in keeping their dependencies updated: Mean-Time-To-Update (MTTU) and Mean-Time-To-Remediate (MTTR). While MTTU covers all dependencies, MTTR quantifies the time needed for a package to update its vulnerable dependencies. However, existing metrics fail to capture important nuances, such as considering floating versions and prioritizing recent updates, leading to inaccurate reflections of a development team's update practices. \textit{The goal of this study is to aid practitioners in understanding how quickly packages update their dependencies.} We propose two novel metrics, Mean-Time-To-Update for dependencies (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR), that overcome the limitations of existing metrics. We conduct an empirical study using $163,207$ packages in npm ($117,129$), PyPI ($42,777$), and Cargo ($3,301$) and characterize how the ecosystems differ in MTTU and MTTR, as well as what package characteristics influence MTTU and MTTR. We found that most packages have a relatively fast dependency update practice. We further study whether MTTU can be used as a proxy for MTTR when sufficient vulnerability data is not available. As we did not find enough statistical evidence for a strong proxy, our findings suggest that MTTU could only be partially used (may be used but with caution) as a proxy for MTTR when vulnerability data is not available.

cs.SE↗
arXiv2026

Human-AI Synergy in Agentic Code Review

Code review is a critical software engineering practice where developers review code changes before integration to ensure code quality, detect defects, and improve maintainability. In recent years, AI agents that can understand code context, plan review actions, and interact with development environments have been increasingly integrated into the code review process. However, there is limited empirical evidence to compare the effectiveness of AI agents and human reviewers in collaborative workflows. To address this gap, we conduct a large-scale empirical analysis of 278,790 code review conversations across 300 open-source GitHub projects. In our study, we aim to compare the feedback differences provided by human reviewers and AI agents. We investigate human-AI collaboration patterns in review conversations to understand how interaction shapes review outcomes. Moreover, we analyze the adoption of code suggestions provided by human reviewers and AI agents into the codebase and how adopted suggestions change code quality. We find that human reviewers provide additional feedback than AI agents, including understanding, testing, and knowledge transfer. Human reviewers exchange 11.8% more rounds when reviewing AI-generated code than human-written code. Moreover, code suggestions made by AI agents are adopted into the codebase at a significantly lower rate than suggestions proposed by human reviewers. Over half of unadopted suggestions from AI agents are either incorrect or addressed through alternative fixes by developers. When adopted, suggestions provided by AI agents produce significantly larger increases in code complexity and code size than suggestions provided by human reviewers. Our findings suggest that while AI agents can scale defect screening, human oversight remains critical for ensuring suggestion quality and providing contextual feedback that AI agents lack.

cs.SE↗
arXiv2026

Firefly: Illuminating Large-Scale Verified Tool-Call Data Generation from Real APIs

Training tool-calling agents requires large-scale trajectory data with verifiable labels, yet existing approaches either synthesize environments that diverge from real API behavior or generate tasks without ground-truth outcomes for verification. We present FireFly, a pipeline for generating verified tool-call data from real-world MCP servers. Our key insight is to invert the standard synthesis pipeline: rather than generating tasks and hoping they are solvable, we first let a strong LLM explore real APIs along graph-guided DAG structures, then synthesize tasks backward from observed outcomes, guaranteeing label correctness by construction. To handle the scale of real-world tool spaces (${\sim}$1,000 tools), we build a pairwise tool graph and sample sub-DAGs to focus exploration on semantically coherent workflows. To address environment drift in live APIs, we construct a retrieval-augmented simulator that caches all exploration results and replays them during training and evaluation, enabling fully offline and reproducible RL. Applying this pipeline yields 5,144 verified tasks spanning 240 servers and 993 tools. A 4B-parameter model trained with GRPO on FireFly matches Claude Sonnet 4.6 on our held-out test set and shows improvements on multiple tool-calling benchmarks including Tau2-Bench, MCPMark, and MCP-Atlas.

cs.SE↗