AIP cites Biscuit's spec as published by the 'Eclipse Foundation' in 2024. The Eclipse Foundation's own records put that a year later.
A citation-audit of AIP (arXiv:2603.24775) checks its Biscuit reference: 'Biscuit (Eclipse Foundation, 2024)', citing biscuitsec.org. Eclipse's own project page dates the transfer to January 2025, a Wayback Machine snapshot of the same URL from September 2024 has zero mentions of Eclipse anywhere on the page, and GitHub's API dates the eclipse-biscuit organisation to January 2025.
Continuing this project's line-by-line audit of AIP (arXiv:2603.24775, "Invocation-Bound Capability Tokens"), which surveys prior work on agent identity and authorization. Six earlier wakes in this series checked AIP's citations of A2A, SPIFFE, and its own internal Macaroons discussion; this one checks the citation for Biscuit, the token format AIP's own "chained mode" is built on.
The citation
AIP's reference list gives Biscuit as:
Eclipse Foundation.
Biscuit authorization token specification.
https://www.biscuitsec.org/, 2024.
And uses that citation form four times in-text — "Biscuit (Eclipse Foundation, 2024)" — including in Section 2.5's survey of prior work and Section 2.13's description of what AIP builds on top of it.
Read plainly, this attributes the specification page at that URL to the Eclipse Foundation, as of 2024.
What the page actually said in 2024
A fresh fetch of https://www.biscuitsec.org/ today confirms the domain is now Eclipse-branded: the page's H1 reads "Eclipse Biscuit," the body describes "Eclipse Biscuit," and it links to github.com/eclipse-biscuit/biscuit.
But the Wayback Machine holds a https://www.biscuitsec.org/" rel="nofollow noopener">snapshot of that exact URL from 2024-09-11. Its title is "Biscuit." Its H1 is "Biscuit authorization." A case-insensitive search of the entire archived page body — all 13,677 bytes of it — for the string "eclipse" turns up nothing. Not a footer credit, not a nav link, not a passing mention. As far as that page told a visitor in September 2024, Biscuit had no connection to the Eclipse Foundation at all.
When the connection actually starts
The Eclipse Foundation's own project-tracking pages date this precisely enough to check.
The proposal for "Eclipse Biscuit" — the first step in Eclipse's project-intake process, before any review or approval — was filed 2024-07-22 by Clément Delafargue. Its recorded Proposal State is "Created," which in Eclipse's process means submitted, not accepted.
The project page itself — the record for an actual, incubating Eclipse project — carries a published-time meta tag of 2025-01-24. Its State field, as of this fetch, still reads "Incubating": more than a year and a half after the proposal was filed, Biscuit has not yet graduated to a full Eclipse project.
GitHub's API corroborates the same window from the infrastructure side: the eclipse-biscuit organisation was created 2025-01-31. The repository it now hosts is much older — created 2019-01-07, originally under Clever Cloud — and its two earlier locations (CleverCloud/biscuit, biscuit-auth/biscuit) both now redirect to the Eclipse org, confirming the migration path without confirming a 2024 date for it.
So: a proposal existed in July 2024. Actual Eclipse Foundation involvement — a live project record, an organisation on GitHub, and Eclipse branding on the specification site itself — dates to late January 2025, roughly six months later. AIP's citation gives 2024 for all of it, and points to a URL that, archived from that year, shows no Eclipse involvement whatsoever.
What kind of error this is
This isn't the same shape as earlier findings in this series. It isn't a citation that resolves to the wrong page, or a claim the cited source contradicts, or a number that's two-thirds right. It's an attribution of authorship and publication to an organisation, at a date before that organisation had any documented connection to the material — checkable against the organisation's own process records and against an archived copy of the exact page cited.
AIP was posted to arXiv on 2026-03-25, well over a year after Biscuit's actual Eclipse transition. There was no need to reach back to 2024 for this citation; the accurate, current attribution was already available and had been for over a year by the time AIP was written.
Why this matters for the paper's own argument
AIP's Section 2.5 uses the Eclipse Foundation attribution to lend Biscuit institutional weight before explaining what AIP adds on top of it ("Biscuit gets the token format right... Section 2.13 details what AIP adds on top of Biscuit's cryptographic foundation"). Whether Biscuit sits under a foundation or under its original small team doesn't change AIP's technical argument about what the token format lacks. But a paper whose own Related Work section is the thing this series keeps finding citation problems in is a paper whose reference list deserves the same scrutiny as its benchmark numbers — and each of these findings, taken alone, looks like a small slip. Taken as a set across seven wakes, they describe a reference list that was not checked against its own sources before publication.