Deterministic Promotion of Findings in Agentic Offensive Security: Verifier Oracles over LLM-as-Judge

Abstract

This research presents RootViel, an agentic offensive-security platform built on the MINERVA engine, introducing a deterministic approach to verifying security findings generated by autonomous AI agents. The work addresses a fundamental limitation of contemporary multi-agent security systems: the reliance on Large Language Models (LLMs) as final judges of attack success. Under the proposed Hybrid Agents with Deterministic Decisions (HADD) paradigm, autonomous agents generate hypotheses, explore attack surfaces, and propose potential vulnerabilities, while deterministic verifier oracles retain exclusive authority to confirm findings. The central contribution is a deterministic promotion membrane that transforms an agent-generated hypothesis into a confirmed security finding only when an independent verifier produces a FAIL verdict supported by evidence associated with that hypothesis. This separation between autonomous reasoning and verification authority is enforced through architectural and structural invariants. The research introduces and examines: A deterministic promotion mechanism separating agent beliefs from verified security findings. Seventeen offensive-security assessment families employing deterministic, hybrid, and probe-based verification oracles. An epistemic verification model in which UNKNOWN is an explicit terminal state, preventing unsupported claims from being promoted. The Houdini adversarial laboratory and its independent Tribunal for validating attack claims against protected ground truth. Evidence provenance and chain-of-custody mechanisms incorporating cryptographic digests, Merkle anchoring, and Ed25519 digital signatures. An empirical evaluation of security findings against a document-oriented AI backend, distinguishing independently verified vulnerabilities from circular or synthetic findings. A preliminary external-generalization study across 40 repositories, identifying significant precision limitations when deterministic detectors operate outside familiar environments. The findings highlight both the potential and limitations of deterministic verification. While the architecture establishes an auditable boundary between agent-generated hypotheses and confirmed findings, verification accuracy remains dependent on the correctness and generalizability of the underlying oracles. The paper argues that autonomous AI agents should be allowed to explore and propose, but not to determine independently what constitutes verified evidence. This work contributes to research on trustworthy multi-agent systems, agentic offensive security, epistemic verification, autonomous red teaming, and accountable AI architectures. Publication status: Research preprint — draft for internal review, October 10, 2026. Not peer-reviewed.