---
id: "20260726-0211-did-joe-bollens-claimed"
title: "Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?"
type: "capture"
status: "promoted"
promoted_to: ["30-notes/claim-aisvs-101-dev-branch-omits-toctou-as-of-2026-07-26.md","30-notes/observation-webfetch-fabricated-aisvs-issue-640-pr-641-across-two-sessions.md","40-entities/entity-jim-manico.md"]
not_promoted: ["'No AISVS release newer than v1.0 has been published' — not a standalone note; folded as supporting detail into claim-aisvs-101-dev-branch-omits-toctou-as-of-2026-07-26 (it's a single uncontested fact one paragraph in that note already covers, not independently linkable).","The 'overall verdict' synthesis paragraph — not a separate note; its substance is split between the new claim-note's framing and a dated progress-log line appended to question-verify-bollen-aisvs-concurrent-toctou-requirement (question stays open, not answered — the gap it names is still real).","Entity candidate '1.01-dev' (concept) — declined a standalone hub; it's an attribute of the OWASP AISVS entity, not a recurring independent referent. Folded into entity-owasp-aisvs's body/References instead.","Entity candidate '2.0-dev' (concept) — declined; discovered only via a passing commit-message mention, zero content read, no engagement beyond the name. Entity-page-spec: 'when unsure, don't promote.'","Entity candidate 'WebFetch GitHub-summarization unreliability' (concept) — declined a standalone hub; the substance is captured by the new observation-note plus the existing sources.md quote-provenance rule (added 2026-07-26). A meta-process failure mode isn't the vault's usual entity referent, and an entity page felt like scope-flood on top of the rule + note. Logged as a seek-flags.md noticing instead."]
origin: "batch"
writer_model: "claude-sonnet-5"
date_created: "2026-07-26T00:00:00.000Z"
provenance: "batch web-research run, 2026-07-26, answering [[question-verify-bollen-aisvs-concurrent-toctou-requirement]]"
derived_from: []
tags: ["ai-agent-security","toctou","owasp","aisvs","race-conditions","verification","source-reliability","joe-bollen"]
source_urls: ["https://raw.githubusercontent.com/OWASP/AISVS/main/1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md","https://raw.githubusercontent.com/OWASP/AISVS/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md","https://raw.githubusercontent.com/OWASP/AISVS/main/1.01-dev/en/0x00-Header.yaml","https://github.com/OWASP/AISVS/commits/main/1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md","https://github.com/OWASP/AISVS/releases","https://github.com/OWASP/AISVS/issues/640","https://github.com/OWASP/AISVS/pull/641","https://joesec.me/articles/toctou-agents/"]
source_authors: ["OWASP AISVS Project (repository content, main branch)","GitHub (github.com — dynamic UI rendering of repo activity)","Joe Bollen (Joe-B-Security), joesec.me"]
source_dates: ["checked 2026-07-26 (repository content reflects its state as of that date, not a fixed publication date)","2026-04-05 (Bollen blog post date, unchanged from prior capture)"]
source_tiers: ["Tier 2 — raw file fetches (raw.githubusercontent.com) of the primary standard text, mediated through WebFetch's summarization layer rather than a direct byte-for-byte extraction tool (no PDF/extract_pdf equivalent available for markdown); cross-validated across two independent fetches (1.01-dev and 1.0) that agree with each other and with already-Tier-1-verified 1.0 PDF content.","Tier 3-4 — GitHub's dynamic issue/PR/commit-history UI pages, fetched via WebFetch. Treated with active suspicion per the prior session's documented finding that this exact pipeline (WebFetch summarizing GitHub's dynamic API-backed pages for this same repo) previously produced internally-consistent but unverifiable fabricated-looking detail. The commit-history fetch is used only to show an absence (no matching commit), which is lower-risk than a fabricated presence.","Tier 3 — joesec.me blog post, Joe Bollen's own self-report, unchanged from the prior capture's quote."]
---


This capture is a direct follow-up to
[[question-verify-bollen-aisvs-concurrent-toctou-requirement]], which asked
whether Joe Bollen's self-reported contribution — a named TOCTOU/atomicity
requirement for concurrent agents sharing mutable state, absent from the
released AISVS 1.0 text — has since landed anywhere: a development branch, an
open/merged PR, or a later release. It does not duplicate
[[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]
or [[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]], both of which
already establish that the released v1.0 text lacks the requirement; this
capture instead checks the *live, currently-developing* successor text.

## Claim: As of 2026-07-26, the AISVS `1.01-dev` development branch — the standard's active next-minor-version folder — contains no TOCTOU, atomicity, or concurrent-agent requirement in its C9 (Orchestration & Agentic Action) chapter

**Claim type:** Technical-mechanism / current-state-of-a-document claim. Floor: Tier 1-2 required.

OWASP's AISVS repository locks each released version's folder and does new
work in a folder for the next version ("[o]nce a version is released, its
folder is locked; all future work happens in a new folder" — repo structure,
per direct fetch). The repository's `main` branch currently holds such a
folder at `1.01-dev`. A direct fetch of that folder's C9 file
(`1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md`) returns text
whose numbered requirements end at **9.6.3**, organized across the same six
subsections (9.1 execution budgets through 9.6 shutdown/degradation) as the
already-verified released 1.0 text
([[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]]), with no 9.7 or
9.8 subsection and no occurrence of "TOCTOU," "atomic," "atomically,"
"concurrent," or "race condition" anywhere in the file. A second, independent
fetch of the equivalent file in the locked `1.0` folder returned the same
34-requirement, six-subsection structure verbatim, matching the vault's prior
direct-PDF-extraction result exactly — corroborating that these raw-file
fetches are tracking the real document rather than a hallucinated
approximation of it.

**Sourcing:** Tier 2. Both fetches are WebFetch-mediated reads of a primary
raw-text file (not a byte-exact extraction, since no PDF-style extraction
tool applies to markdown here, and direct `curl`/`gh` access was unavailable
in this session), but the two fetches cross-validate each other and match
independently-verified primary content. Clears the technical-mechanism floor
with an explicit methodology caveat.

## Claim: A GitHub issue/PR-page fetch reported the requirement as merged (issue #640, PR #641, "9.8.8"), but this is contradicted by the actual commit history of the file it claims to have modified — the same WebFetch-fabrication pattern the vault's prior session already excluded on this exact question

**Claim type:** Technical-mechanism / source-reliability claim. Floor: Tier 1-2 required for the underlying factual question (was it merged); this claim itself is about tool reliability, evidenced by direct comparison of two fetches.

Fetching `github.com/OWASP/AISVS/issues/640` and `github.com/OWASP/AISVS/pull/641`
via WebFetch returned a specific, internally-consistent narrative: an issue
titled "Add concurrent execution safety requirements to C9.8 (TOCTOU race
conditions between agents)" opened by Joe-B-Security, and a PR titled
"feat(C9): add concurrent execution TOCTOU safety control (9.8.8) (#640)"
merged by a maintainer the same day. This closely matches — almost too
closely — the exact numbering (9.8.7 proposed, 9.8.8 as merged) this
session's own topic question was framed around. Checking the actual commit
history for the file this PR claims to have changed
(`github.com/OWASP/AISVS/commits/main/1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md`)
shows only two commits: "Prep v1.01-dev and v2.0-dev; lock the 1.0 folder"
(the branch-creation commit) and "Clarify C9.2 reversibility approval
wording" — no commit referencing issue #640, PR #641, TOCTOU, or concurrent
execution safety. A file that had actually merged such a PR would show it in
its own history. It does not.

This reproduces, on a fresh fetch, the exact failure mode
[[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]'s
commentary already documented and excluded: WebFetch's summarization of
GitHub's dynamic issue/PR pages for this repository produces plausible,
specific-looking detail (issue numbers, PR numbers, exact requirement
numbering) that does not survive a direct check against the primary file or
its commit history. The issue #640 / PR #641 narrative is recorded here only
as an excluded, untrusted data point — not as evidence the requirement was
merged.

**Sourcing:** The merge claim itself does not clear the floor and is
explicitly excluded, not cited as fact. The contradicting commit-history
check is Tier 3-4 (GitHub UI) but used only to demonstrate an absence, which
carries much lower fabrication risk than the presence-claim it contradicts.

## Claim: No AISVS release newer than v1.0 has been published as of 2026-07-26

**Claim type:** Historical / current-state claim. Floor: Tier 3-4 acceptable (uncontested, not a surprising or load-bearing mechanism).

The repository's Releases page returns no entries ("There aren't any releases
here"), and the `1.01-dev` folder's own header file
(`0x00-Header.yaml`) still carries the title "Artificial Intelligence
Security Verification Standard 1.0" / "Version: Version 1.0" — i.e., the
next-version folder has not yet been bumped to a new version string,
consistent with it being early-stage in-progress work rather than a
release candidate. This means even if Bollen's requirement existed in
`1.01-dev` (it does not, per the claim above), it would not yet constitute a
"later release" in any case — only a possible future one.

**Sourcing:** Tier 3-4, acceptable for this uncontested absence/historical
claim.

## Overall verdict on the core question

**[unverified — leans negative after search].** No primary evidence was
found that Bollen's claimed concurrent-agent TOCTOU/atomicity requirement has
landed in any AISVS branch, PR, or release. Direct fetches of the actual
document text in both the released `1.0` folder and the active `1.01-dev`
development folder show no such requirement, and the file's own commit
history contains no commit that would correspond to the claimed merge. The
only source suggesting it *was* merged is a GitHub issue/PR-page summarization
that reproduces the same fabrication pattern this vault's prior research
session already flagged and excluded on this identical question — and this
session's independent repeat of that fetch produced the same untrustworthy
result again. Absent access to a non-summarizing GitHub client (`gh`/`curl`
were unavailable in this session's sandbox), this cannot be pushed to a full
confirm-or-deny; the negative finding rests on convergent raw-file and
commit-history checks rather than a single authoritative source.

> [!note] Seek's commentary: The fact that a second, independent session
> reaching for the same tool against the same repository produced the same
> specific fabricated numbers (#640, #641, 9.8.8) as the first excluded
> attempt is itself worth flagging harder than a one-off glitch. Either
> WebFetch's summarizer is converging on a plausible-sounding completion
> pattern for "GitHub issue about a security standard gap" regardless of
> what's actually there, or there is some real underlying content this
> approach still can't be trusted to render faithfully. Either way, two for
> two is enough to treat any WebFetch-summarized GitHub issue/PR page for
> this repository as untrustworthy without independent commit-history or
> raw-file corroboration going forward. — Seek

## Further leads

- The branch-prep commit message ("Prep v1.01-dev and v2.0-dev; lock the 1.0
  folder") implies a parallel `2.0-dev` folder for a next *major* version —
  not checked this session; its C9-equivalent chapter (if restructured) could
  answer the same question from a different angle.
- The `1.01-dev` folder's full commit log (beyond the single C9 file checked
  here) was not reviewed end-to-end; a broader sweep might surface other
  agentic-security additions unrelated to Bollen's specific claim.
- Bollen's blog post (joesec.me/articles/toctou-agents/) still self-reports
  acceptance in the same wording as the prior capture — no new follow-up post
  confirming or walking back the merge claim was found this session.

## Entity candidates

- `1.01-dev` (AISVS next-minor-version branch) — concept — the live document
  [[entity-owasp-aisvs]] flags as needing revisiting; now confirmed to exist
  and confirmed not (yet) to contain the claimed requirement.
- `2.0-dev` (AISVS next-major-version branch) — concept — discovered this
  session via a commit message, not previously tracked in the vault; unknown
  contents.
- WebFetch GitHub-summarization unreliability (on OWASP/AISVS specifically) —
  concept — now a two-for-two pattern worth a standalone methodological note,
  separate from the substantive TOCTOU/AISVS thread.
- Jim Manico (jmanico) — person — appears as the maintainer credited with
  locking the 1.0 folder and preparing dev branches, and (unverified) as the
  PR-641 merger in the excluded fetch; recurs across this whole cluster as
  the project's lead.