Preprints — Under Review on omnibachi

Who Authorizes Software Behavior? Governing the AI-Native SDLC

Mon, 14 Sep 2026 00:00:00 +0000

Independent Researcher — Camas, WA, USA

Contact: bachipeachy@gmail.com ORCID Profile: https://orcid.org/0009-0007-3810-6520

Submitted to: IEEE Computer — under review.

Abstract

As software projects become increasingly agent-mediated, implicit authorization fails: the lifecycle is gated repeatedly—merge, release, deployment—and those disjoint approvals are assumed to compose, a composition living in reviewers’ heads that requires producers to be few, known, and sharing tacit context. Agents break all three, and no single point determines what behavior a system is authorized to realize. Authorization must instead be an explicit, independently checkable property established during governed construction and carried in a sealed state that execution realizes but cannot amend. Three tests are reported: a reference implementation assembling seven governed domains under one governance surface; an independent realization built from a frozen specification, claiming only the surfaces it exercised; and mutation testing in which removing two required guards left demonstrations unaffected, while a discriminating mutation of declared routing failed as expected. These address realizability, specification sufficiency, and evidence adequacy, exposing a concrete limitation of conventional evidence.

Protocol-Governed Human-AI Software Engineering: Autonomy Without Authority

Tue, 08 Sep 2026 00:00:00 +0000

Author: Bhash Ganti (aka Bachi)

Preprint: https://doi.org/10.5281/zenodo.22650863 — this page is the frozen rendition of that deposit.

Submitted to: Springer Automated Software Engineering — under review.

Abstract

Autonomous agents can now perform substantial portions of the software-engineering lifecycle, yet conventional lifecycles rarely make explicit who authorizes the resulting software: repository write access and human review do not by themselves constitute an authorization decision.

Protocol-Governed Computing: A Software Development Lifecycle Architecture for Deterministic Declarative Execution and Governed Transformation

Mon, 14 Sep 2026 00:00:00 +0000

Author: Bhash Ganti (aka Bachi)

bachipeachy@gmail.com · ORCID 0009-0007-3810-6520

Preprint: https://doi.org/10.5281/zenodo.22758703 — this page is the frozen rendition of that deposit.

Submitted to: Elsevier Journal of Systems and Software — under review.

Abstract

Software systems are governed across three activities usually treated separately: changing what the system is, constructing an executable representation, and executing it. This separation lets authority migrate between them. Transformation may author behavior, construction may repair incomplete declarations, or a runtime may resolve omissions by inference. Behavior is then determined partly by declarations and partly by the mechanisms that realize them.

Protocol-Governed Computing: Architectural Inversion, Its Consequences, and a Scaling Claim

Mon, 14 Sep 2026 00:00:00 +0000

Author: Bhash Ganti (aka Bachi)

bachipeachy@gmail.com · ORCID 0009-0007-3810-6520

Preprint: https://doi.org/10.5281/zenodo.22736531 — this page is the frozen rendition of that deposit.

Submitted to: Wiley Software: Practice and Experience — under review.

Abstract

Conventional software architecture spreads behavioral authority across several sources. Declarations govern some behavior. Implementation, build tooling and runtime decide the rest. Protocol-Governed Computing reverses that arrangement. Governed declarations determine authorized behavior, business process rules included. Construction, implementation and execution realize that determination and add nothing to it.

Protocol-Governed Computing: Business Software That Runs on a Domain-Neutral Substrate

Tue, 15 Sep 2026 00:00:00 +0000

Author: Bhash Ganti (aka Bachi)

bachipeachy@gmail.com · ORCID 0009-0007-3810-6520

Preprint: https://doi.org/10.5281/zenodo.22779384 — this page is the frozen rendition of that deposit.

Submitted to: Oxford University Press, The Computer Journal · manuscript ID COMPJ-2026-09-1249 — under review.

Abstract

Operating systems admit a new process, virtual machines new bytecode, and database engines a new query without being rebuilt for it. This paper asks whether governed business domains can likewise arrive as artifacts that a shared substrate admits and executes without acquiring domain-specific behavior.