What recovery mechanisms do vault defense notes actually specify?

The SoK's contract names five parts: path target, observation, intervention, trust boundary and recovery (see Can multi-agent defenses close attack paths completely?). Used as a checklist against the vault's defense notes, it asks what each defense specifies and what it leaves open.

A first pass on 2026-09-23 searched six notes for "recover", "rollback", "remediat" and "undo": the FLOWGUARD planning-boundary note, the ChannelGuard hops note, the SafeFlow flow-framing note, the SafeFlow taints note, the ChainGuard chain-level note, and the SafeFlow commit-point note. Five had no hits. The sixth, Where should workflow validation gates be placed for safety?, mentions recovery only through its tie to What makes an AI system truly safe in practice?, where irreversibility is what defeats the recoverable condition. So on this check, recovery is the least specified part.

Two caveats limit what the check shows. The notes are built from excerpts, mostly abstracts and introductions, so the absence may say what the excerpt covered and not what the papers contain. And a keyword check finds a word, not the idea, so a defense that quarantines or resets state would be missed if it used other words.

The second caveat has a case in the vault. How can operators stop coordinated agent intrusions now? ties response to surviving state, and its proposed evaluation tests "recurrence after channel closure and state quarantine". None of those are words the check searched for, and none of that doctrine's notes were among the six. It is a doctrine and a proposed test with no measured result, so it does not fill the recovery part; what it changes is the reading of "five of six", which counts one keyword set over six notes and not the vault's whole stock of recovery ideas. Rollback is also specified elsewhere in the vault, as a safety primitive for self-evolving agents in How can agent self-evolution be made safe and auditable?, where the failure is a bad committed change and not a multi-agent attack path, so it sits outside the set the audit covered.

The other four parts were not checked. A fuller audit would go part by part: does each note say which path is targeted, what is observed, how the intervention acts, and where trust is drawn? The trust-boundary part may prove the easiest to fill, since several notes place a check at a boundary, but that is untested, and one measured case argues for caution. How does the authorization layer stay outside the poisoned path? asks where the authorization layer sits relative to what the tested attacks could reach, which the excerpt leaves unstated. On the plain reading of the slot name, a check placed at a boundary is not yet a specified boundary.

What would settle it: read the source papers behind those defenses for recovery provisions, and run the contract against each. That would say whether the gap is in the field or only in the vault's excerpts.