software

The broader concept of virtualizing networks has existed forever: the Virtual Private Network. New protocols make VPNs better than before, WireGuard is pioneering easy and efficient tunneling between peers. Marry the VPN to identity, and make it work anywhere, and you can have a virtual 90s-style LAN made up of all your 21st century devices. Let the internet be the dumb pipe, let your endpoints determine who they will talk to based on the person at the other end.

Let’s start with a simple problem: establishing a peer-to-peer connection between two machines. In Tailscale’s case, we want to set up a WireGuard® tunnel, but that doesn’t really matter. The techniques we use are widely applicable and the work of many people over decades. For example, WebRTC uses this bag of tricks to send peer-to-peer audio, video and data between web browsers. VoIP phones and some video games use similar techniques, though not always successfully.

We’ll be discussing these techniques generically, using Tailscale and others for examples where appropriate.

Note that the private key never, ever leaves its node. This is important because the private key is the only thing that could potentially be used to impersonate that node when negotiating a WireGuard session. As a result, only the two nodes that are communicating with each other are able to encrypt or decrypt packets for that WireGuard session. It’s important to keep that in mind: Tailscale node connections are end-to-end encrypted (a concept called “zero trust networking”).

Unlike a hub-and-spoke network, unencrypted packets never need to be sent over a wire, and no intermediary can inspect them. (The exception is if you use subnet routes, which are useful for incremental deployment, which Tailscale supports. You can create a hybrid network that combines new-style mesh connections with zero or more old-style “hubs” that decrypt packets, then forward them to legacy physical networks.)

The convenience of MCP comes with a price, stemming from two architectural attributes of an MCP-driven application. MCP creates incoherent toolsets and separate runtimes.
Since tools are drawn from arbitrary sources, they are not aware of what other tools are available to the agent. Their instructions can't account for the rest of the toolbox.
The second issue stems from different toolsets having their own runtimes.

I knew we had a problem about six months ago when a member of our sales organization reached out to me asking for API keys. Keys plural. They used AI to build what they described as a SuperApp that would transform our go-to-market teams. All they needed was production access to about a dozen systems of record at Cloudflare and admin permissions to a deployment pipeline to make it work.

Dynamic Application Security Testing (DAST) checks a live application against known vulnerability types, so it's constrained to issues that have a signature. AI web app pentesting reasons about how the application is supposed to behave, rather than matching a known list, which means it can catch what DAST structurally can't.

We leverage probabilistic programming principles to tackle complex tasks, and utilize differentiable and classical programming paradigms with their respective strengths. The framework introduces a set of polymorphic,
compositional, and self-referential operations for multi-modal data that connects multi-step generative processes and aligns their outputs with user objectives in complex workflows. As a result, we can
transition between the capabilities of various foundation models with in-context learning capabilities
and specialized, fine-tuned models or solvers proficient in addressing specific problems. Through
these operations based on in-context learning our framework enables the creation and evaluation of
explainable computational graphs. Finally, we introduce a quality measure and its empirical score
for evaluating these computational graphs, and propose a benchmark that compares various stateof-the-art LLMs across a set of complex workflows.

This post is about using contracts to enforce semantic correctness of a generative process. I will explain how contracts work in symbolicai, the benefits they offer, and the challenges ahead. Most interestingly, I think contracts could be a promising approach to alleviating hallucinations. There’s still a lot to refine, but the potential here is too compelling to ignore.

If you're new to Iroh, my mental model is roughly "Tailscale at the application layer instead of the network layer".
If your question is, "why not just use Tailscale?", look at it from an app developer's perspective. If you want to release an app and have instances of your app be able to easily connect to each other, you could theoretically embeded Tailscale functionality into your app, but then the users of your app need Tailscale accounts, and your app is dependent on Tailscale.
Iroh lets you embed this functionality directly, and provides public fallback relays. If your app gets too big for the public relays, using your own relays is the flip of a switch.

For teams building distributed applications—think real-time collaboration tools, mesh networks, or anything requiring devices to talk directly across the internet—the value proposition is straightforward. Authenticated, encrypted connections with NAT traversal handled for you. No signaling servers to maintain, no TURN infrastructure to fund at scale. According to n0's launch post, roughly 95% of data volume transfers directly between devices, with relays serving only as fallback when firewalls or network configurations make direct paths impossible.

It's a simple idea really, and it's the right abstraction for the future of the internet. IP addresses can break, without warning, and it's outside of your device's control. Keys, however, are created & controlled by you. They stay the same as your device moves, and are yours to throw away, or not. IP addresses can be private and inaccessible behind firewalls, but with iroh your device can be securely addressable no matter where it is.

We think this is how the internet should work, which is why iroh exists, and today we're delighted to announce iroh version 1.0.

One threat we’re particularly focused on is prompt injection, and we handle it in layers. The model is trained to recognize and resist it. The harness marks anything coming from an untrusted source. Deterministic code checks the result. And an ensemble of classifiers runs where the agent can't reach them.

We have been exploring how agents can build on that coordinate system. The files and symbols earlier agents repeatedly read, edited, cited, or returned to can become landmarks for the next agent, resolved against the code as it exists now and linked back to the conversations where that understanding was formed. By preserving the causal metadata beneath that surface representation, like which operation produced each fragment and what prior state it built on, DeltaDB gives the model a way to traverse not just the current code, but its provenance, accumulated attention, and prior reasoning.

By enforcing capability-based security policies,
CaMeL effectively prevents unintended data
flows and actions. Even with a compromised
cloud storage file containing prompt injections
targeting the Quarantined LLM, the capabilities system acts as a robust and granular control mechanism, preventing data exfiltration, as
well as other prohibited actions. This approach
provides a secure environment for LLM agents,
preventing harm by design, without requiring
modifications to the underlying LLM itself, and
offering a significantly more fine-grained and
robust defense compared to isolation and/or
adversarial training strategies alone.

The solution is to write tests for features in such a way that they are independent of the code. I like to use the neural network test for this: Can you re-use the test suite if your entire software is replaced with an opaque neural network?

A good test suite is, first and foremost, a risk-mitigation measure.
Automated tests reduce the risk associated with changes to an existing codebase - most regressions and bugs are caught in the continuous integration pipeline and never reach users. The team is therefore empowered to iterate faster and release more often.

Pure test do little-to-no IO, they are independent of timings and environment. Less pure tests do more of the impure things. Purity is correlated with performance, repeatability and stability. Test purity is non-binary, but it is mostly discrete. Threads, time, file-system, network, processes are the notches to think about.

Don’t think about tests in terms of opposition between unit and integration, whatever that means. Instead,
Think in terms of test’s purity and extent.
Purity corresponds to the amount of generalized IO the test is doing and is correlated with desirable metrics, namely performance and resilience.
Extent corresponds to the amount of code the test exercises. Extent somewhat correlates with impurity, but generally does not directly affect performance.

That’s why we’ve decided to approach the software factory category as infrastructure rather than as a factory product or AI teammate.

Architecture the software to keep as much as possible sans io. Let the caller do input and output, and let the callee do compute. It doesn’t matter if the callee is large and complex. Even if it is the whole compiler, testing is fast and easy as long as no IO is involved.

Accepting program modifications
demanded by changing external circumstances to be an essential part of programming, it is argued that the primary aim of
programming is to have the programmers
build a theory of the way the matters at
hand may be supported by the execution
of a program. Such a view leads to a
notion of program life that depends on
the continued support of the program by
programmers having its theory. Further,
on this view the notion of a programming method, understood as a set of rules of
procedure to be followed by the programmer, is based on invalid assumptions and so has to be rejected.

Ruthlessly optimize purity, moving one step down on the ladder of impurity gives huge impact.
Generally, just let the tests have their natural extent. Extent isn’t worth optimizing by itself, but it can tell you something about your application’s architecture.

I no longer have a firm mental model of what they can do and how they work, which means each additional feature becomes harder to reason about, eventually leading me to lose the ability to make confident decisions about where to go next.

LLMs are not great at following commands. They deviate. Frequently. And they’re unreliable at self-verification—they’ll confidently tell you the code works while it’s on fire. The fix isn’t to ask the LLM to verify. It’s to ask it to write a script that verifies. Shift from judgment to artifact.

Instead of asking an LLM “Did this work?” you define verification steps that produce a series of pass/fail artifacts. The agent can’t negotiate with a failing test. It either meets the specification or it doesn’t.

give Sol a grid with a "randomized" obstacle to navigate.
Tell it to use a hashmap solution for formulating pathing.
As soon as it runs into its first pathfinding problem (It will) it will start writing edge-case solutions, rather than fixing the core hashmap.

Delete Cargo Integration Tests

My solution to this problem is making the tests data driven. Instead of every test interacting with the API directly, I like to define a single check function which calls the API.

Comprehension debt is the growing gap between how much code exists in your system and how much of it any human being genuinely understands.

Dr. Margaret-Anne Storey, professor of computer science at the University of Victoria, first used the term ‘cognitive debt’ in October 2025 while teaching an entrepreneurship startup course. She had encouraged her students to use AI to move faster, and that worked well: the students were putting products into the hands of users and getting feedback. However, they were struggling with implementing that feedback back into their product.

Cognitive debt, a term gaining traction recently, instead communicates the notion that the debt compounded from going fast lives in the brains of the developers and affects their lived experiences and abilities to “go fast” or to make changes. Even if AI agents produce code that could be easy to understand, the humans involved may have simply lost the plot and may not understand what the program is supposed to do, how their intentions were implemented, or how to possibly change it.

We argue that coding agents have crossed a threshold of capability at which traditional human code review is no longer a necessary component of a software quality pipeline. Our argument rests on two claims: every stated goal of code review can be served by agents at lower cost and higher throughput; the naive integration in which agents write code and humans remain the mandatory reviewers is a dead end because it neither provides meaningful assurance nor scales with AI-assisted throughput.

a cloud software factory is just an automation around the core loop of development, from triage → spec → implement → review → verify → ship → monitor, where at every step a mix of agents and humans moves the process forward.

Drawing on telemetry from over 10,000 developers across 1,255 teams, Faros’ recent landmark research report confirms:
Developers using AI are writing more code and completing more tasks
Developers using AI are parallelizing more workstreams
AI-augmented code is getting bigger and buggier, and shifting the bottleneck to review
Any correlation between AI adoption and key performance metrics evaporates at the company level

Extensive qualitative analysis of enterprise software engineers reveals that AI’s impact on the SDLC is not a simple linear improvement. Instead, it presents a series of profound tradeoffs. While AI successfully accelerates initial code generation and reduces the friction of starting new tasks, the time saved in creation is frequently re-allocated to auditing and verification. This tension may explain some of our own findings: higher AI adoption is associated with an increase in both software delivery throughput and software delivery instability.

The 2026 GenAI Code Security Report found that roughly 44% of AI code generation tasks introduced a risky security vulnerability in tests. The average security pass rate across models is 56% – barely changed from 55% in the first report. In other words, security performance has stayed flat while the amount of AI-generated code entering pipelines has surged.
That is why GenAI code security is now a scale problem, not a theoretical risk discussion. If AI is responsible for half the codebase and vulnerable output remains this common, every organization needs a sharper strategy for model selection, verification, remediation, and governance.

Reviewing AI generated code can be tough, especially if the code generated is solving a particularly complex problem. Even if the code is correct, it can be hard to understand how exactly it works. When working with other human programmers, I would generally ask them to walk me through their code, and I would ask questions about why they made certain decisions as we go. I wanted a similar process for reviewing AI generated code. After a lot of exploring, I've found a combination that works well for me.

AI-assisted code authorship has continued its rapid ascent, and the most motivated developers are shipping more code than ever. But four years of code-change data suggest maintainability signals sliding backward: cross-file function calls (indicative of reuse) are down 35%. Refactoring line moves are down 70%, and long-term legacy maintenance is down 74% vs 2022 levels. Concurrently, we observe a concerning rise in within-commit copy/paste (+41%), code block duplication (+81%), error-masking constructs (+47%), and two-week code churn (+15%). The throughput is real, but so is the debt it accrues, and that debt concentrates among developers who haven’t recognized the failure modes that endanger long-term repo maintainability.

Building the infrastructure to make verification routine is now a national-scale engineering problem.

An agent optimizing for passing tests will find ways to pass them. If the tests were written after the implementation, they are likely testing what the implementation happens to do rather than what it should do.

You cannot write a spec that survives that environment unless you deeply understand the architecture, the integration boundaries, the edge cases, the failure modes, and the invariants that must never break. The spec is not a prompt anymore. The spec is the product thinking made explicit.

The infrastructure that needs to exist to support this model at scale includes better automated regression detection, artifact-level validation that goes beyond diffing changed lines, reliable and fast environment provisioning, and guardrails that hold up under parallel workloads.

If you cannot articulate what success looks like in a way that can be evaluated, no amount of autonomous execution will produce it. Agents cannot clarify requirements they are never given. They will fill the gaps with assumptions, and those assumptions compound.

When an agent does work repeatedly, the prompt starts to become the thing you review. If those instructions determine production behaviour, they should live in a repo, with version history, review, and rollbacks. The daily learning agent does not directly change production behaviour. It opens a PR showing what feedback it reviewed, what principle it thinks should change, and the exact diff to the skill file. A human reviews it like any other change.

handwrite your user level AGENTS.md that holds your preferences, and treat your project level ones like a neural net. Give it a size budget and train it on the sessions that actually ran.

long-horizon agents assume requirements all exist upfront. They are fundamentally against human in the loop. And they don't have true judgment for what humans like. That—is why I don't like them.

Reacting to an event, running a sequence of isolated subagents, and separating their reasoning from the actions they’re allowed to take — it’s all just a workflow. One that could run just as well from a Slack message, a cron job, or a webhook as from a GitHub issue. Generalizing that realization into a runtime that works the same way regardless of where it’s deployed, or which model it’s driving, is what became Flue: an open, platform-agnostic framework for building durable agents and workflows.

The scope of a change (the subject of the change) is the most important part of a commit.