Runtime Attention-Anomaly Circuit Breakers: Bounding Execution Risk in Agentic AI via Calibrated Heuristic Monitoring (manuscript + H1 validation archive v7)

Combined manuscript and full reproducibility archive for the Runtime Attention-Anomaly Circuit Breaker. The breaker is a single, lightweight, sink-excluded, length- and causality-corrected attention-entropy scalar that triggers a synchronous inference abort when it leaves a calibrated band. Key findings (confound-controlled): indirect prompt injection induces a small but extremely consistent attention concentration, but only when the injection is out-of-context (AgentDojo: 100% of matched attacks more concentrated than their own no-injection control, p≈1e-104; replicated across Qwen2.5-7B, Mistral-7B-Instruct-v0.3, and Phi-3-mini-4k-instruct). The effect is null on in-context-styled injection (matched InjecAgent, BIPIA). A confound ladder (domain, length, framing, novelty vs. maliciousness) shows the driver is out-of-context topical novelty, not maliciousness. Among unsupervised detectors the entropy scalar leads on agentic injection and beats a perplexity control; a supervised hidden-state probe dominates it; and an adaptive white-box adversary (AttnGCG) evades it (87.5% of intercepted attacks). Archive contents (h1_validation_archive_v7.tar.gz, SHA-256 4014f868682a22fc48cacf03f518e206d83c113569629875fec016daa92e8272): code, datasets, all result JSONs with per-sample scores, logs, run metadata, and SHA-256 manifests. Primary model Qwen/Qwen2.5-7B, seed 0, monitored layers [12,16,20], 1% false-positive target. v7.1: cosmetic correction — removed the running page footer (page numbers retained); no changes to text, results, or data.