Can individual components pass safety checks if the system still fails?

Three papers in the vault, three mechanisms, one shape. In SafeFlow every subtask is "locally plausible" and the composed workflow exfiltrates (Can task decomposition hide harmful intent across agents?). In ChannelGuard each model may be aligned, yet safety is a property of the wiring between them (Do internal agent hops in pipelines need security monitoring?). In the Honest Quorum every validator authenticates, signs and answers on time, and the quorum still certifies a transition that breaks an application invariant (Can a quorum of honest validators certify an invalid transition?).

The shared structure is that the check available at the component level tests a different property from the one that matters for the system: the plausibility of a step, the alignment of a model, or the protocol compliance of a signature, against a harm-free flow, safe wiring, or semantic validity. A local pass then says almost nothing about the whole. It also explains why improving the local check (a better guard model, more validators, a higher quorum threshold) leaves the gap in place. Why do safety failures remain invisible to our evaluation methods? gives the general diagnosis: the habits assume failures are local, output-level and legible.

The unification should not go too far. The mechanisms differ (fragmented intent, unmonitored channels, and the correlated faults in Can a quorum of validators really provide independent judgment?), and so do the remedies: taints with commit-point validation, gates on every hop, semantic verification. A fix for one does not transfer. The evidence differs as well. Each excerpt argues the point, and none reports a controlled comparison of component-level assurance against system-level outcome. This is a shape shared by arguments, not yet a measured regularity.

Post angle: "every step was fine." Three agents retrieve, rewrite and transmit; every reviewer signed correctly; every model was aligned; the audit trail passes. The reader's likely reply is that this is just emergent behavior and composed software has always had it. That is partly right. What is specific to LLM systems is that the local checks are semantic judgments that can be fooled, not mechanical guarantees, so the gap cannot be closed by tightening them.