Quotes

The broader concept of virtualizing networks has existed forever: the Virtual Private Network. New protocols make VPNs better than before, WireGuard is pioneering easy and efficient tunneling between peers. Marry the VPN to identity, and make it work anywhere, and you can have a virtual 90s-style LAN made up of all your 21st century devices. Let the internet be the dumb pipe, let your endpoints determine who they will talk to based on the person at the other end.

Let’s start with a simple problem: establishing a peer-to-peer connection between two machines. In Tailscale’s case, we want to set up a WireGuard® tunnel, but that doesn’t really matter. The techniques we use are widely applicable and the work of many people over decades. For example, WebRTC uses this bag of tricks to send peer-to-peer audio, video and data between web browsers. VoIP phones and some video games use similar techniques, though not always successfully.

We’ll be discussing these techniques generically, using Tailscale and others for examples where appropriate.

Note that the private key never, ever leaves its node. This is important because the private key is the only thing that could potentially be used to impersonate that node when negotiating a WireGuard session. As a result, only the two nodes that are communicating with each other are able to encrypt or decrypt packets for that WireGuard session. It’s important to keep that in mind: Tailscale node connections are end-to-end encrypted (a concept called “zero trust networking”).

Unlike a hub-and-spoke network, unencrypted packets never need to be sent over a wire, and no intermediary can inspect them. (The exception is if you use subnet routes, which are useful for incremental deployment, which Tailscale supports. You can create a hybrid network that combines new-style mesh connections with zero or more old-style “hubs” that decrypt packets, then forward them to legacy physical networks.)

The convenience of MCP comes with a price, stemming from two architectural attributes of an MCP-driven application. MCP creates incoherent toolsets and separate runtimes.
Since tools are drawn from arbitrary sources, they are not aware of what other tools are available to the agent. Their instructions can't account for the rest of the toolbox.
The second issue stems from different toolsets having their own runtimes.

Every Ditto user already has a knowledge graph. As you talk, Ditto extracts subjects (typed topics, people, projects, preferences) and links each one to the memories it touches. (That’s the dreaming pipeline at work.) We’d already seen that matching a query to subjects, rather than only to raw memories, was a powerful signal. v4 leans on it directly.

Storing memories is easy. Finding the right one from a vague question is the hard research problem. When you ask Ditto something indirect, like “what did I decide about that thing a while back?”, there’s no keyword to match on, just a fuzzy query against a haystack of everything you’ve ever told it.

I knew we had a problem about six months ago when a member of our sales organization reached out to me asking for API keys. Keys plural. They used AI to build what they described as a SuperApp that would transform our go-to-market teams. All they needed was production access to about a dozen systems of record at Cloudflare and admin permissions to a deployment pipeline to make it work.

"Have Faith in all the things you believe in, and everything will be fine."

Dynamic Application Security Testing (DAST) checks a live application against known vulnerability types, so it's constrained to issues that have a signature. AI web app pentesting reasons about how the application is supposed to behave, rather than matching a known list, which means it can catch what DAST structurally can't.

These results show that a model’s capabilities are compatible, generalizable and can carry over to other harnesses. Providers do report to optimize some models for their own coding environments: OpenAI, for example, describes GPT-5-Codex as optimized for agentic software engineering in Codex.12 Yet we observe that a shared provider does not guarantee the best pairing. The practical question remains which harness delivers the best balance of cost and task success for a given model and workload.

A graph in the context of AI work is simpler than it sounds: it's a map of which jobs need to happen and what each one depends on.

Modern retrieval agents expose many configuration choices—LLM, retriever, number of documents, number of hops, and synthesis strategy—each shaping both
answer quality and serving cost. Today, these pipelines are typically hand-tuned
once per workload, leaving substantial per-query optimization untapped. We formulate Query2Conf : given a natural-language query and either an accuracy or
a budget target, select from a predefined pipeline catalog the configuration that
minimizes cost (or maximizes accuracy) at inference time. We propose BRANE
which uses an LLM to convert each query into workload-specific characteristics,
then trains a lightweight per-configuration predictor that estimates whether the
pipeline will answer the query correctly. At inference time, BRANE selects the
configuration that maximizes predicted correctness penalized by cost, exposing a
tunable cost–quality tradeoff without retraining. Across MuSiQue, BrowseCompPlus, and FinanceBench, BRANE consistently pushes the cost–quality Pareto
frontier, matches the best fixed configuration’s accuracy at up to 89% lower cost,
and outperforms LLM-routing, rule-based, and fine-tuned Qwen3-4B baselines.
These results show that per-query configuration of the full retrieval pipeline is a
practical alternative to static workload-level tuning.

We leverage probabilistic programming principles to tackle complex tasks, and utilize differentiable and classical programming paradigms with their respective strengths. The framework introduces a set of polymorphic,
compositional, and self-referential operations for multi-modal data that connects multi-step generative processes and aligns their outputs with user objectives in complex workflows. As a result, we can
transition between the capabilities of various foundation models with in-context learning capabilities
and specialized, fine-tuned models or solvers proficient in addressing specific problems. Through
these operations based on in-context learning our framework enables the creation and evaluation of
explainable computational graphs. Finally, we introduce a quality measure and its empirical score
for evaluating these computational graphs, and propose a benchmark that compares various stateof-the-art LLMs across a set of complex workflows.

taken together, it appears that for most domains LLMs will continue to look like a cracked intern: quick and effective in the hands of an adult but not given run of the place. most firms will not be able to adopt fully autonomous AI, not for problems of skill issue or lagging technology diffusion but rather for structural reasons seemingly endemic to current architectures.

Think of Jev as a frontier-intelligence function call: unstructured state in, typed probabilistic decisions out.

This post is about using contracts to enforce semantic correctness of a generative process. I will explain how contracts work in symbolicai, the benefits they offer, and the challenges ahead. Most interestingly, I think contracts could be a promising approach to alleviating hallucinations. There’s still a lot to refine, but the potential here is too compelling to ignore.

If you're new to Iroh, my mental model is roughly "Tailscale at the application layer instead of the network layer".
If your question is, "why not just use Tailscale?", look at it from an app developer's perspective. If you want to release an app and have instances of your app be able to easily connect to each other, you could theoretically embeded Tailscale functionality into your app, but then the users of your app need Tailscale accounts, and your app is dependent on Tailscale.
Iroh lets you embed this functionality directly, and provides public fallback relays. If your app gets too big for the public relays, using your own relays is the flip of a switch.

For teams building distributed applications—think real-time collaboration tools, mesh networks, or anything requiring devices to talk directly across the internet—the value proposition is straightforward. Authenticated, encrypted connections with NAT traversal handled for you. No signaling servers to maintain, no TURN infrastructure to fund at scale. According to n0's launch post, roughly 95% of data volume transfers directly between devices, with relays serving only as fallback when firewalls or network configurations make direct paths impossible.

It's a simple idea really, and it's the right abstraction for the future of the internet. IP addresses can break, without warning, and it's outside of your device's control. Keys, however, are created & controlled by you. They stay the same as your device moves, and are yours to throw away, or not. IP addresses can be private and inaccessible behind firewalls, but with iroh your device can be securely addressable no matter where it is.

We think this is how the internet should work, which is why iroh exists, and today we're delighted to announce iroh version 1.0.

This question is related to the general phenomenon of the spikiness of AI capabilities, meaning that it is already superhuman in some areas, but still lacks something needed to replace human intellectual labor on a massive scale. I have the impression that the most significant thing which is missing is a sort of ability to exercise judgements.

But here is the thing: if you showed a video generation model enough footage of people using spreadsheets, it would produce the exact same result. You type =A5+1, and a 2 appears. Not because anything was computed. Because the model knows what happens next. It has seen this scene ten thousand times. The 2 is not the output of arithmetic. It is the output of pattern recognition so thorough that it becomes indistinguishable from arithmetic. I mean, nothing really crazy if you think about it. It’s the same principle that allows ChatGPT to write you a perfectly functional Python script despite having never, in any meaningful sense, learned to program. It just knows what code looks like when it’s going well.

For humans, cleverness and intelligence are correlated; for machines they are largely decoupled, and today's tools are best viewed as stochastic generators of sometimes-clever, often-useful outputs — which yields the characteristic "useful yet unsatisfying" feeling of a magic trick once explained. He resists a one-dimensional picture entirely: the space of cognitive tasks is extremely high-dimensional, so no "sub-human to super-human" scale captures it, and the frontier that still eludes machines is data-scarce reasoning — extrapolating from five or six facts and a vague analogy, exactly where human mathematicians excel.

Large language models can develop novel social biases previously unseen in training data by simply going through an iterative decision making process and learning from spurious outcomes, which they do at a rate even more frequent than humans.

One threat we’re particularly focused on is prompt injection, and we handle it in layers. The model is trained to recognize and resist it. The harness marks anything coming from an untrusted source. Deterministic code checks the result. And an ensemble of classifiers runs where the agent can't reach them.

Both interruptions and auto-approvals increase with experience. This apparent contradiction reflects a shift in users’ oversight strategy. New users are more likely to approve each action before it’s taken, and therefore rarely need to interrupt Claude mid-execution. Experienced users are more likely to let Claude work autonomously, stepping in when something goes wrong or needs redirection. The higher interrupt rate may also reflect active monitoring by users who have more honed instincts for when their intervention is needed. We expect the per-turn interrupt rate to eventually plateau as users settle into a stable oversight style, and indeed the curve may already be flattening among the most experienced users (though widening confidence intervals at higher session counts make this difficult to confirm).

We have been exploring how agents can build on that coordinate system. The files and symbols earlier agents repeatedly read, edited, cited, or returned to can become landmarks for the next agent, resolved against the code as it exists now and linked back to the conversations where that understanding was formed. By preserving the causal metadata beneath that surface representation, like which operation produced each fragment and what prior state it built on, DeltaDB gives the model a way to traverse not just the current code, but its provenance, accumulated attention, and prior reasoning.

By enforcing capability-based security policies,
CaMeL effectively prevents unintended data
flows and actions. Even with a compromised
cloud storage file containing prompt injections
targeting the Quarantined LLM, the capabilities system acts as a robust and granular control mechanism, preventing data exfiltration, as
well as other prohibited actions. This approach
provides a secure environment for LLM agents,
preventing harm by design, without requiring
modifications to the underlying LLM itself, and
offering a significantly more fine-grained and
robust defense compared to isolation and/or
adversarial training strategies alone.

Standards will catch up. I’ve been out of the web standards space for a couple years now, so this is pure speculation on my part. But I imagine that a lot of the efforts to improve the ergonomics of building websites – better CSS shorthands, terser JavaScript syntax, etc. – will become perceived as less important relative to things that actually move the needle on performance, capabilities, etc. At the end of the day, it’s just not very different for an agent to write 3 lines of CSS instead of 1, and anyway using the newer syntax might actually be harder because you have to coach the agent about things that aren’t in its training weights.

I trained a small transformer from scratch in 1.5hrs on a 5090
Beats many LLMs, and scores the same as TRM/HRM

Despite appearances, perhaps the internal representations of neural networks implicitly realize symbolic structure. In support of this hypothesis, we show that the vector representations of a variety of neural networks can be closely approximated with symbolic structures: we can replace the network's entire representation-generating process with a closed-form equation instantiating a symbolic structure, and the network's behavior remains largely unchanged.

Respondents found the task less meaningful when they thought that the slogans were AI-generated (Figure 1). Compared to the human-label group, the AI-label group saw a drop in task meaning of about 0.07 standard deviations. Respondents in the AI-label condition were also less willing to contribute a slogan of their own by 3.4 percentage points. Because 26% of participants provided a slogan—and some were remarkably creative—the estimated effect is substantial: a 13% decrease relative to the baseline.

The solution is to write tests for features in such a way that they are independent of the code. I like to use the neural network test for this: Can you re-use the test suite if your entire software is replaced with an opaque neural network?

A good test suite is, first and foremost, a risk-mitigation measure.
Automated tests reduce the risk associated with changes to an existing codebase - most regressions and bugs are caught in the continuous integration pipeline and never reach users. The team is therefore empowered to iterate faster and release more often.

Pure test do little-to-no IO, they are independent of timings and environment. Less pure tests do more of the impure things. Purity is correlated with performance, repeatability and stability. Test purity is non-binary, but it is mostly discrete. Threads, time, file-system, network, processes are the notches to think about.

Don’t think about tests in terms of opposition between unit and integration, whatever that means. Instead,
Think in terms of test’s purity and extent.
Purity corresponds to the amount of generalized IO the test is doing and is correlated with desirable metrics, namely performance and resilience.
Extent corresponds to the amount of code the test exercises. Extent somewhat correlates with impurity, but generally does not directly affect performance.

That’s why we’ve decided to approach the software factory category as infrastructure rather than as a factory product or AI teammate.

Architecture the software to keep as much as possible sans io. Let the caller do input and output, and let the callee do compute. It doesn’t matter if the callee is large and complex. Even if it is the whole compiler, testing is fast and easy as long as no IO is involved.

Accepting program modifications
demanded by changing external circumstances to be an essential part of programming, it is argued that the primary aim of
programming is to have the programmers
build a theory of the way the matters at
hand may be supported by the execution
of a program. Such a view leads to a
notion of program life that depends on
the continued support of the program by
programmers having its theory. Further,
on this view the notion of a programming method, understood as a set of rules of
procedure to be followed by the programmer, is based on invalid assumptions and so has to be rejected.

Ruthlessly optimize purity, moving one step down on the ladder of impurity gives huge impact.
Generally, just let the tests have their natural extent. Extent isn’t worth optimizing by itself, but it can tell you something about your application’s architecture.

I used to load the full Oh My Zsh framework. Then I profiled my shell and found I was pulling in 150+ files to use maybe 10 features. The chef overcooks 👨‍🍳
So I stripped things back. Now I cherry-pick the OMZ plugins I need via Zinit, and fill the gaps with tools that do one thing well. The terminal is Ghostty with a six-line config, the shell is Zsh, and everything below is what makes it feel like home.

a turn by turn context awareness enables a context engineering mindset. mastering llms is all about mastering malloc().

I no longer have a firm mental model of what they can do and how they work, which means each additional feature becomes harder to reason about, eventually leading me to lose the ability to make confident decisions about where to go next.

LLMs are not great at following commands. They deviate. Frequently. And they’re unreliable at self-verification—they’ll confidently tell you the code works while it’s on fire. The fix isn’t to ask the LLM to verify. It’s to ask it to write a script that verifies. Shift from judgment to artifact.

The important ironies of the classic approach to automation lie in the expectations of the system designers, and in the nature of the tasks left for the human operators to carry out.

And so generating code is not necessarily the part that you need to worry about the most. Given enough context, agents can write the implementation and run the tests and inspect failure and revise code for us. We need to get to a place where we feel like there is enough of human taste encoded in the environment that we can trust what is being built, so that our human attention can be focused on the places where it’s needed most.

Global workspace theory,4 or GWT, describes the human brain as a collection of specialized modules sharing data through a central, limited capacity bottleneck. Most machine learning architectures already satisfy the first three indicators5 of this theory. However, they consistently fail to implement GWT-4, the requirement for temporal persistence. To address this, we use the framework of computational self-availability, or CSA. This describes a system where internal processing is available as an input to the system itself.

Instead of asking an LLM “Did this work?” you define verification steps that produce a series of pass/fail artifacts. The agent can’t negotiate with a failing test. It either meets the specification or it doesn’t.

give Sol a grid with a "randomized" obstacle to navigate.
Tell it to use a hashmap solution for formulating pathing.
As soon as it runs into its first pathfinding problem (It will) it will start writing edge-case solutions, rather than fixing the core hashmap.

Delete Cargo Integration Tests

My solution to this problem is making the tests data driven. Instead of every test interacting with the API directly, I like to define a single check function which calls the API.

Comprehension debt is the growing gap between how much code exists in your system and how much of it any human being genuinely understands.

Dr. Margaret-Anne Storey, professor of computer science at the University of Victoria, first used the term ‘cognitive debt’ in October 2025 while teaching an entrepreneurship startup course. She had encouraged her students to use AI to move faster, and that worked well: the students were putting products into the hands of users and getting feedback. However, they were struggling with implementing that feedback back into their product.

Cognitive debt, a term gaining traction recently, instead communicates the notion that the debt compounded from going fast lives in the brains of the developers and affects their lived experiences and abilities to “go fast” or to make changes. Even if AI agents produce code that could be easy to understand, the humans involved may have simply lost the plot and may not understand what the program is supposed to do, how their intentions were implemented, or how to possibly change it.

We argue that coding agents have crossed a threshold of capability at which traditional human code review is no longer a necessary component of a software quality pipeline. Our argument rests on two claims: every stated goal of code review can be served by agents at lower cost and higher throughput; the naive integration in which agents write code and humans remain the mandatory reviewers is a dead end because it neither provides meaningful assurance nor scales with AI-assisted throughput.

a cloud software factory is just an automation around the core loop of development, from triage → spec → implement → review → verify → ship → monitor, where at every step a mix of agents and humans moves the process forward.

We conduct randomized experiments to study how developers gained mastery of a new asynchronous programming library with and without the assistance of AI. We find that AI use impairs conceptual understanding, code reading, and debugging abilities, without delivering significant efficiency gains on average. Participants who fully delegated coding tasks showed some productivity improvements, but at the cost of learning the library. We identify six distinct AI interaction patterns, three of which involve cognitive engagement and preserve learning outcomes even when participants receive AI assistance. Our findings suggest that AI-enhanced productivity is not a shortcut to competence and AI assistance should be carefully adopted into workflows to preserve skill formation -- particularly in safety-critical domains.

Drawing on telemetry from over 10,000 developers across 1,255 teams, Faros’ recent landmark research report confirms:
Developers using AI are writing more code and completing more tasks
Developers using AI are parallelizing more workstreams
AI-augmented code is getting bigger and buggier, and shifting the bottleneck to review
Any correlation between AI adoption and key performance metrics evaporates at the company level

Extensive qualitative analysis of enterprise software engineers reveals that AI’s impact on the SDLC is not a simple linear improvement. Instead, it presents a series of profound tradeoffs. While AI successfully accelerates initial code generation and reduces the friction of starting new tasks, the time saved in creation is frequently re-allocated to auditing and verification. This tension may explain some of our own findings: higher AI adoption is associated with an increase in both software delivery throughput and software delivery instability.

The 2026 GenAI Code Security Report found that roughly 44% of AI code generation tasks introduced a risky security vulnerability in tests. The average security pass rate across models is 56% – barely changed from 55% in the first report. In other words, security performance has stayed flat while the amount of AI-generated code entering pipelines has surged.
That is why GenAI code security is now a scale problem, not a theoretical risk discussion. If AI is responsible for half the codebase and vulnerable output remains this common, every organization needs a sharper strategy for model selection, verification, remediation, and governance.

Reviewing AI generated code can be tough, especially if the code generated is solving a particularly complex problem. Even if the code is correct, it can be hard to understand how exactly it works. When working with other human programmers, I would generally ask them to walk me through their code, and I would ask questions about why they made certain decisions as we go. I wanted a similar process for reviewing AI generated code. After a lot of exploring, I've found a combination that works well for me.

AI-assisted code authorship has continued its rapid ascent, and the most motivated developers are shipping more code than ever. But four years of code-change data suggest maintainability signals sliding backward: cross-file function calls (indicative of reuse) are down 35%. Refactoring line moves are down 70%, and long-term legacy maintenance is down 74% vs 2022 levels. Concurrently, we observe a concerning rise in within-commit copy/paste (+41%), code block duplication (+81%), error-masking constructs (+47%), and two-week code churn (+15%). The throughput is real, but so is the debt it accrues, and that debt concentrates among developers who haven’t recognized the failure modes that endanger long-term repo maintainability.

The core insight is this: AI agents don’t save you time by finishing your work. They expose how much work was always possible but never attempted. Five constraints now govern how much of that backlog any organization can actually capture: judgment, planning, coordination, evaluation, and absorption. Understanding those five constraints tells you exactly which new roles are being created and why.

Building the infrastructure to make verification routine is now a national-scale engineering problem.

the Unix / Linux Environment is a natural candidate, and could be turned into an Agentic harness with a few modifications.

An agent optimizing for passing tests will find ways to pass them. If the tests were written after the implementation, they are likely testing what the implementation happens to do rather than what it should do.

You cannot write a spec that survives that environment unless you deeply understand the architecture, the integration boundaries, the edge cases, the failure modes, and the invariants that must never break. The spec is not a prompt anymore. The spec is the product thinking made explicit.

Agents doing judgement-heavy work need a way to learn from the people whose judgement they are trying to approximate. 1. Principles beat rules, because rules overfit and principles transfer. 2. Agents need to learn how to learn, or feedback turns into brittle exceptions. 3. The feedback loop has to live where the team already works, or people stop participating.

The infrastructure that needs to exist to support this model at scale includes better automated regression detection, artifact-level validation that goes beyond diffing changed lines, reliable and fast environment provisioning, and guardrails that hold up under parallel workloads.

Feedback is not learning unless the agent can generalize

Agents run tools in a loop to achieve a goal

If you cannot articulate what success looks like in a way that can be evaluated, no amount of autonomous execution will produce it. Agents cannot clarify requirements they are never given. They will fill the gaps with assumptions, and those assumptions compound.

It's less about crafting individual assets and more about building systems with enough flexibility to serve a range of needs and enough structure to stay coherent at scale. Brand guidelines become agent-legible rules. A component library becomes the guardrails within which agents make decisions. An internal asset system that automatically tags images for color, text, and usage context means an agent can query for the right image rather than grabbing whatever's most recent.

When an agent does work repeatedly, the prompt starts to become the thing you review. If those instructions determine production behaviour, they should live in a repo, with version history, review, and rollbacks. The daily learning agent does not directly change production behaviour. It opens a PR showing what feedback it reviewed, what principle it thinks should change, and the exact diff to the skill file. A human reviews it like any other change.

handwrite your user level AGENTS.md that holds your preferences, and treat your project level ones like a neural net. Give it a size budget and train it on the sessions that actually ran.

Every SaaS business will become a harness around a model, whether or not they’ve realized it yet.

If you put all these things together:- RLHF = training the model to be likable by humans- RLVR = training the model to be accepted by machines- RLVR is more scalable- "Alignment tax" says "likable by humans" makes the model do worse on verifiable tasks

long-horizon agents assume requirements all exist upfront. They are fundamentally against human in the loop. And they don't have true judgment for what humans like. That—is why I don't like them.

Harrison’s 4 elements of an agent remain – the system prompt, planning tool, file system, and subgents – describing the core loop. This is the core loop the developer controls with the keyboard. The harness manages everything beyond this, the world the developer sits within.

Reacting to an event, running a sequence of isolated subagents, and separating their reasoning from the actions they’re allowed to take — it’s all just a workflow. One that could run just as well from a Slack message, a cron job, or a webhook as from a GitHub issue. Generalizing that realization into a runtime that works the same way regardless of where it’s deployed, or which model it’s driving, is what became Flue: an open, platform-agnostic framework for building durable agents and workflows.

If this continues, there’s a world where 3rd party harnesses become less valuable when used with frontier lab models because the 1st party harness behavior is already baked in. And there’s no longer a fine tuning escape hatch to generalize this behavior away.

The conclusion I draw is that empathy in these systems is not an inherent state but a manufactured quantity.

The scope of a change (the subject of the change) is the most important part of a commit.

with CmdAtom, a lot of "leader key" mappings will just be unnecessary, bc you can compose macros on the fly.

I get pushback that falling inference prices will eventually bring us back to sending everything through the largest models. But I’m not so sure: those same gains will benefit the K3s and Qwens, and as we continue to develop better harnesses it will be easier to provide weaker (but still great) models with sufficient context to perform well.

It’s going to be funny if the network effects the AI labs have been searching for end up looking just like the network effects of the SaaS era. Coding harnesses, managing the environments around the agent, look a whole lot like the SaaS platforms of old.