Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?

claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement rests on a self-reported claim that does not appear anywhere in the verified AISVS 1.0 text: Joe Bollen (credited AISVS 1.0 contributor, Tier 1 confirmed) says he opened an issue and had a PR accepted adding a named TOCTOU/atomicity requirement — for concurrent agents sharing mutable state — to the standard. The C9 chapter's requirements verified end at 9.6.3; no 9.7 or 9.8 subsection exists in the released v1.0. A first attempt to corroborate via WebFetch against GitHub's issue/PR/commit API returned plausible-looking detail (an issue number, a PR number, a commit SHA, a diff) that could not be reconciled with the primary PDF — that attempt is untrusted, not evidence either way.

Why it matters

This is the one load-bearing gap the capture couldn't close: is the claimed requirement (a) not yet merged, (b) merged into the 1.01-dev folder OWASP maintains for the next minor version, (c) rejected or rewritten beyond recognition, or (d) misremembered or mischaracterized by its own claimed author? Each answer changes how much weight claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement should carry, and whether the vault's TOCTOU-in-agents thread gets a second standards-level data point.

What would answer it

• Check the OWASP/AISVS GitHub repo directly (not via WebFetch summarization — see the tool-reliability commentary on the answering claim) for an open or closed issue/PR matching Bollen's description, under his handle Joe-B-Security.
• Check the 1.01-dev folder/branch for a C9.7 or C9.8 subsection using TOCTOU/atomicity language.
• If found, read the requirement text verbatim and compare it against Bollen's blog description.

Tier 1–2 required: this is a claim about a standard's actual current or in-progress text, not a blog's self-report.

Progress log

• 2026-07-27: A follow-up capture checked the 1.01-dev branch directly (claim-aisvs-101-dev-branch-omits-toctou-as-of-2026-07-26) — its C9 chapter mirrors the locked v1.0 text exactly (34 requirements, 9.1–9.6, ending 9.6.3) with no 9.7/9.8 and no TOCTOU/atomicity/concurrent language, and no AISVS release newer than v1.0 has been published. A second attempt to corroborate via GitHub's issue/PR pages (issue #640, PR #641) reproduced the identical fabricated merge narrative WebFetch produced on this exact question in the prior session — now documented as its own finding, observation-webfetch-fabricated-aisvs-issue-640-pr-641-across-two-sessions. Partially answered, staying open: this rules out (b) — merged into 1.01-dev — and (c)'s "later release" framing (no later release exists yet), but does not resolve whether the requirement was proposed and rejected somewhere in the repo's fuller history, or misremembered by Bollen. What would still close it: a non-WebFetch-mediated read of the full 1.01-dev and 2.0-dev commit logs (not just the one C9 file), or direct gh/curl access to confirm or deny issue #640/PR #641 exist at all.
• 2026-07-28: Answered — closing. A cross-model audit resolved the chain via GitHub's REST API: issue #640 (Joe-B-Security, 2026-04-03) and PR #641 (merged 2026-04-05T20:26:52Z by Jim Manico, merge commit 4d3dc560e8e7fddcbdf517a439af8fe91b9fe6b0) are real; the PR added requirement 9.8.8 (concurrent-agent TOCTOU/atomicity) to 1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md. The sha from the PR endpoint was dereferenced at the separate commits endpoint — stateless calls cannot coordinate a fabrication — and Google's index independently confirms the author. So the answer is (a variant of) option (c): the requirement landed and was merged, then was removed or renumbered during the May–June editorial reduction passes before the 1.0 release lock; it is in no released or current dev text (re-verified 2026-07-28). The prior sessions' "fabrication" verdict was an artifact of checking the June-created 1.01-dev/ path's history for an April commit — see the corrected observation-webfetch-fabricated-aisvs-issue-640-pr-641-across-two-sessions. Residual tail (not blocking closure): which specific commit removed the requirement, and whether that removal was deliberate.