session management

Current Asset Administration Shells (AAS) in manufacturing digital twins are predominantly static, lacking dynamic service integration and adaptive capabilities. To address this, this paper proposes an active AAS architecture that innovatively embeds containerized services within AAS submodels, enabling runtime, on-demand deployment and autonomous behavioral extension via an event-driven mechanism. The architecture integrates OPC UA for industrial communication, RAMI 4.0 for standardized modeling, and Docker for lightweight, portable service execution—ensuring both interoperability and executability. Evaluated on a three-axis milling machine case study, the proposed architecture transforms the AAS from a passive data container into an active service execution interface. This significantly improves system responsiveness and enables AI-driven intelligent evolution. The work provides a concrete pathway toward the “executable twin” paradigm in digital twin systems.

This work addresses the challenge of short embedded-system lifecycles and inflexible driver updates in industrial automation, hindering timely compliance with evolving regulations and market demands. To this end, we propose Wasm-IO—a novel framework that pioneers the adaptation of WebAssembly (Wasm) to safety-isolated peripheral I/O execution. Wasm-IO introduces a first-of-its-kind Wasm-based interrupt priority extension model enabling deterministic, time-isolated interrupt handling, coupled with platform-agnostic inlined driver support and synchronous I/O abstractions to enable standards-compliant driver hot-swapping. Leveraging lightweight containerization, interrupt virtualization, and real-time scheduling, it significantly reduces I/O latency and runtime overhead. Experimental evaluation demonstrates cross-platform portability, strong spatial and temporal isolation, and practical feasibility on real industrial hardware. Wasm-IO establishes a secure, flexible, and sustainably evolvable paradigm for driver execution in industrial embedded systems.

This work addresses the lack of closed-loop control in traditional software development lifecycles, which often fails to simultaneously ensure security, auditability, and highly reliable automation. The authors propose a deterministic autonomous control framework that models the lifecycle as a seven-stage automated pipeline, integrating Jira-based task orchestration, structured context, resource constraints, and human-review gating mechanisms to establish a secure closed loop. Key innovations include a state-contract-based collision locking mechanism, a degradation protocol for fallback operation, and a traceable control architecture. Implemented with 12,661 lines of Python code and 6,907 lines of versioned prompt specifications—including 101 exception handlers and 12 centralized locks—the system achieved a 100% success rate (95% CI [97.6%, 100%]) across 152 initial runs, producing over 795 artifacts. All 51 issues identified through adversarial review were fully resolved, with 60% of security tickets autonomously completed.

To address privacy leakage and privilege escalation risks arising from the lack of execution isolation for third-party plugins in large language model (LLM) application ecosystems, this paper proposes the first fine-grained natural language interaction isolation architecture tailored for LLM-based agent systems. Our approach integrates sandboxed execution environments, semantic-aware call interception, a least-privilege API gateway, and dynamic contextual isolation policies. It establishes verifiable trust boundaries across all natural language interactions—including inter-component, LLM-to-plugin, and plugin-to-plugin communication—for the first time. Experimental evaluation demonstrates that our solution effectively mitigates diverse data leakage and privilege escalation attacks without functional degradation. In 75% of query scenarios, the incurred security overhead remains below 30%, significantly enhancing both the security assurance and operational controllability of LLM systems.

Existing LLM tool-use evaluation benchmarks are limited to stateless API calls or offline trajectory analysis, failing to capture realistic multi-turn, state-dependent interactions. Method: We propose ToolSandbox—the first benchmark framework supporting stateful execution, multi-turn interaction, and online dialogue evaluation. It features (1) stateful tool execution with implicit state-dependency modeling; (2) a hybrid rule- and LLM-based user simulator enabling on-policy dynamic dialogue evaluation; and (3) a dynamic criterion mechanism assessing both intermediate and final milestones. Built upon finite-state machine modeling, RESTful sandbox encapsulation, and input normalization, it handles real-world challenges such as incomplete information. Results: Experiments reveal that current SOTA models achieve <40% accuracy on state-dependent tasks, exposing critical limitations in tool orchestration. ToolSandbox establishes a new paradigm and a rigorous, reproducible evaluation standard for LLM tool learning.

Current large language model (LLM) agent frameworks lack reliable state memory management, often leading to issues such as state loss, bypassed refreshes, and destructive overwrites. This work proposes ClawVM—a virtual memory abstraction embedded within the agent harness layer—that introduces, for the first time, a deterministic and auditable state management mechanism. Its core components include typed state pages, multi-resolution representations, minimal fidelity invariants, and lifecycle-boundary-aware write-back validation. Experimental results demonstrate that, under practical token budget constraints, ClawVM completely eliminates policy-controllable failures across synthetic workloads, twelve real-world conversational trajectories, and adversarial test scenarios, with per-turn policy overhead consistently below 50 microseconds.

This work addresses the limitations of existing human-in-the-loop (HITL) mechanisms in intelligent agent workflows, which are often tightly coupled with application logic, resulting in poor reusability, weak consistency, and limited scalability. To overcome these challenges, the paper proposes a decoupled HITL system architecture that abstracts human oversight into an independent component. By introducing explicit interfaces and a structured execution model, the approach cleanly separates human–machine interaction from business logic. Furthermore, it introduces a novel four-dimensional framework—comprising intervention conditions, role resolution, interaction semantics, and communication channels—to enable context-aware, controllable human intervention. This design achieves, for the first time, protocol-level reusability of HITL mechanisms, supporting consistent and scalable autonomy governance in multi-agent environments and laying a foundational infrastructure for system-level human–agent collaboration.

This work addresses the absence of a unified, verifiable runtime safety mechanism in existing MCP-style agents, where security decisions are fragmented across multiple components. To bridge this gap, the paper introduces HCP (Handle-Capability Protocol), a runtime framework that, while fully compatible with MCP workflows, formally defines eight execution-layer safety invariants for the first time. HCP enforces these invariants through a fine-grained access control model grounded in subjects, resources, capabilities, handles, and policies, explicitly ensuring critical properties such as subject binding, capability scoping, and data-flow authorization. Empirical evaluation demonstrates that HCP successfully blocks all attacks across ten benchmark scenarios while preserving auditable evidence, substantially outperforming baseline approaches. Microbenchmark results further indicate that policy operations incur an average latency of less than one millisecond.

This work addresses the reliability challenges faced by AI agents operating in real-world software environments, where ensuring consistent alignment of perception, decision-making, and execution with user intent remains critical. The paper proposes the first unified framework that integrates a three-layer architecture—perception, decision, and execution—with a four-phase lifecycle encompassing creation, deployment, operation, and maintenance. This framework systematically analyzes the root causes of agent failures and intervention interfaces, clarifying the relationships among capability construction, permission exposure, and failure manifestations. By synthesizing representative systems, benchmarks, and advances in security and privacy, the study identifies key open problems, including controllable grounding, sustained constraint adherence, and secure permission binding, thereby establishing a new paradigm and structured research pathway toward achieving controllable and continuously reliable agent behavior.

Current AI systems struggle to support effective human oversight while preserving autonomy. This work establishes “intervenability” as a foundational requirement for AI design and introduces a novel classification framework that encompasses both real-time control and case-specific decision interventions. Grounded in human-AI collaboration theory, cybernetics, and reflective organizational practice, the framework systematically defines intervenability and articulates a closed-loop pathway linking human intervention to AI adaptation. By bridging human judgment with machine learning dynamics, it enables smooth, continuous AI refinement and provides key design principles for next-generation human-centered AI systems that synergistically integrate human strengths with artificial intelligence.