A new paper on arXiv formalizes something practitioners have long suspected but rarely proved: in a multi-agent pipeline, verification is only as strong as its weakest link — literally. The paper, "Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use," traces a structural flaw it calls the capability-context separation: inside a transformer, tool definitions and user instructions look like identical tokens, but at the orchestration layer they carry very different security weight, and most current frameworks don't distinguish them. From that gap, the author derives three requirements a governed agent ecosystem needs to enforce regardless of implementation: capability integrity, behavioral verifiability, and interaction auditability. The paper then proves two structural results. The first, the Chain Verifiability Theorem, states that one unverifiable interior agent breaks end-to-end verification for every downstream node in the chain — meaning a single unaudited hop in a multi-agent pipeline poisons the trust of everything after it, no matter how well-attested the other agents are. The second, the Bounded Divergence Theorem, gives a probabilistic safety bound for replay-based verification, expressed as epsilon less than or equal to 1 minus alpha to the power 1/n. The paper backs this with two working implementations: a basic version using Ed25519 and SHA-256 that verifies in 97 microseconds, and an enhanced version using BBS+ selective disclosure with Groth16 zero-knowledge proofs that takes 13.8 milliseconds but allows an agent to prove it followed policy without revealing the underlying data. Both satisfy nine formal security properties the paper defines. A separate reproducibility study across 9 models from 7 providers found 5.8x variance in how deterministic inference actually is — a finding that matters because replay-based auditing schemes assume a model will behave the same way twice given the same input, and that assumption turns out to be far shakier for some providers than others. Testing across pipelines of 5 to 20 agents, the system caught every attack scenario tested with zero false positives, at under 0.02% runtime overhead. The practical takeaway is uncomfortable for anyone building multi-agent systems piecemeal: bolting an attestation layer onto some agents in a chain while leaving others unverified doesn't get you partial credit. The theorem says it gets you nothing — the whole chain's provenance guarantee collapses at the first unverifiable node.