Preprints

Most papers here are deposited under their own DOI; the IEEE and SoSyM papers are not. Most are under review at a named journal; the table says where each stands. The page you read is the Author’s Original Version — the version completed before submission — and is the citable preprint until the Version of Record appears.

Paper	Publisher	Status	Asks about
Who Authorizes Software Behavior?	IEEE Computer	under review	the problem
Autonomy Without Authority	Springer Automated Software Engineering	under review	the agent
A Software Development Lifecycle Architecture	—	not accepted (JSS, then SCP); being reworked	the standard
Architectural Inversion	Wiley Software: Practice and Experience	under review	the consequences
Business Software on a Domain-Neutral Substrate	Oxford University Press The Computer Journal	under review	the substrate
Behavioral Authority in Sealed Models	Springer Software and Systems Modeling	under review	the semantics

They rest on one architecture and one reference realization, and each asks a question that appears in no other paper as a question. Where one paper’s result is needed by another it enters as a cited premise or as positioning, never as a restated contribution.

Who Authorizes Software Behavior? Governing the AI-Native SDLC

© 2026 Bhash Ganti Independent Researcher — Camas, WA, USA Contact: bachipeachy@gmail.com ORCID Profile: https://orcid.org/0009-0007-3810-6520 Submitted to: IEEE Computer — under review. Abstract As software projects become increasingly agent-mediated, implicit authorization fails: the lifecycle is gated repeatedly—merge, release, deployment—and those disjoint approvals are assumed to compose, a composition living in reviewers’ heads that requires producers to be few, known, and sharing tacit context. Agents break all three, and no single point determines what behavior a system is authorized to realize. Authorization must instead be an explicit, independently checkable property established during governed construction and carried in a sealed state that execution realizes but cannot amend. Three tests are reported: a reference implementation assembling seven governed domains under one governance surface; an independent realization built from a frozen specification, claiming only the surfaces it exercised; and mutation testing in which removing two required guards left demonstrations unaffected, while a discriminating mutation of declared routing failed as expected. These address realizability, specification sufficiency, and evidence adequacy, exposing a concrete limitation of conventional evidence. ...

Protocol-Governed Human-AI Software Engineering: Autonomy Without Authority

Author: Bhash Ganti (aka Bachi) (c) 2026 Bhash Ganti. All rights reserved. Released under the Apache-2.0 License. Preprint: https://doi.org/10.5281/zenodo.22650863 — this page is the frozen rendition of that deposit. Submitted to: Springer Automated Software Engineering — under review. Abstract Autonomous agents can now perform substantial portions of the software-engineering lifecycle, yet conventional lifecycles rarely make explicit who authorizes the resulting software: repository write access and human review do not by themselves constitute an authorization decision. ...

Protocol-Governed Computing: A Software Development Lifecycle Architecture for Deterministic Declarative Execution and Governed Transformation

Author: Bhash Ganti (aka Bachi) (c) 2026 Bhash Ganti. All rights reserved. Released under the Apache-2.0 License. bachipeachy@gmail.com · ORCID 0009-0007-3810-6520 Preprint: https://doi.org/10.5281/zenodo.22758703 — this page is the frozen rendition of that deposit. Submission history: Elsevier Journal of Systems and Software, then Elsevier Science of Computer Programming — not accepted at either. The paper is being reworked. Abstract Software systems are governed across three activities usually treated separately: changing what the system is, constructing an executable representation, and executing it. This separation lets authority migrate between them. Transformation may author behavior, construction may repair incomplete declarations, or a runtime may resolve omissions by inference. Behavior is then determined partly by declarations and partly by the mechanisms that realize them. ...

Protocol-Governed Computing: Architectural Inversion, Its Consequences, and a Scaling Claim

Author: Bhash Ganti (aka Bachi) (c) 2026 Bhash Ganti. All rights reserved. Released under the Apache-2.0 License. bachipeachy@gmail.com · ORCID 0009-0007-3810-6520 Preprint: https://doi.org/10.5281/zenodo.22736531 — this page is the frozen rendition of that deposit. Submitted to: Wiley Software: Practice and Experience — under review. Abstract Conventional software architecture spreads behavioral authority across several sources. Declarations govern some behavior. Implementation, build tooling and runtime decide the rest. Protocol-Governed Computing reverses that arrangement. Governed declarations determine authorized behavior, business process rules included. Construction, implementation and execution realize that determination and add nothing to it. ...

Protocol-Governed Computing: Business Software That Runs on a Domain-Neutral Substrate

Author: Bhash Ganti (aka Bachi) (c) 2026 Bhash Ganti. All rights reserved. Released under the Apache-2.0 License. bachipeachy@gmail.com · ORCID 0009-0007-3810-6520 Preprint: https://doi.org/10.5281/zenodo.22779384 — this page is the frozen rendition of that deposit. Submitted to: Oxford University Press, The Computer Journal · manuscript ID COMPJ-2026-09-1249 — under review. Abstract Operating systems admit a new process, virtual machines new bytecode, and database engines a new query without being rebuilt for it. This paper asks whether governed business domains can likewise arrive as artifacts that a shared substrate admits and executes without acquiring domain-specific behavior. ...

Behavioral Authority in Sealed Models: Execution Semantics and Governed Evolution

Author: Bhash Ganti (aka Bachi) (c) 2026 Bhash Ganti. All rights reserved. Released under the Apache-2.0 License. bachipeachy@gmail.com · ORCID 0009-0007-3810-6520 Submitted to: Springer, Software and Systems Modeling — under review. No preprint DOI; this page is the Author’s Original Version as submitted. Abstract Model-driven systems execute models, but the model does not always determine every behavior. A generator, build step or runtime may supply a default, route or recovery path that the model never declared. This paper asks whether a sealed model can be the authority for all domain-visible decisions, leaving construction and execution only to realize what the model specifies. We define six classes of domain-visible decision and introduce the sealed behavioral model as their authoritative source. We give a step-level execution semantics: the runtime reads routes and effects from the sealed model and refuses when the model is silent. We state three properties for a conforming realization—determination closure, non-addition and recoverability—and derive checkable obligations for construction, the runtime and the trace. As supporting context, we describe a discipline for changing models by deriving each successor from a named, frozen predecessor. ...