Chronograph

Graph View

2026-04-25

10 min read

Martin Rosén-Lidholm
Martin Rosén-Lidholm

Daily D4 Digest — 2026-04-25

TL;DR

  • Two independent papers formalize automated harness optimization for agents — signaling that the “wrapper around the LLM” is becoming a first-class ML optimization target, not a craft artifact.
  • Tool Attention proposes a middleware that cuts MCP’s per-turn token overhead by 95%, reframing protocol-level efficiency as the real bottleneck for scalable agentic systems.
  • A function hijacking attack achieves 70-100% success rates against MCP tool selection across 5 models, underscoring that agent-to-tool interfaces need security engineering, not just prompt hardening.
  • Three papers converge on the same SCE thesis from different angles: GROUNDING.md for epistemic constraints, meta-predicates for auditable decision logic, and Bertrand Meyer’s call to move AI-generated code from probable to provable.
  • The Semi-Executable Stack offers a six-ring reference model that explicitly names the expanding engineering surface — natural language specs, orchestration, controls — as first-class objects requiring SE discipline.

Call to Action

D1 — Agentic Engineering

Automated Harness Optimization Is the New Hyperparameter Tuning. Two papers published within a day of each other independently frame “harness engineering” — the prompts, tools, memory policies, and orchestration glue that wrap a foundation model — as a machine learning optimization problem rather than a craft skill. The Last Harness You’ll Ever Build introduces a two-level meta-learning framework: a Harness Evolution Loop optimizes a worker agent’s harness for a single task via adversarial evaluation, while a Meta-Evolution Loop learns an evolution protocol that generalizes across task classes — “automating the design of the automation itself.” HARBOR takes a more rigorous optimization approach, formalizing the problem as constrained noisy Bayesian optimization over mixed-variable configuration spaces, with a reference solver using SAAS surrogates and TuRBO trust regions. Both papers argue that manual harness stacking collapses once the flag space exceeds a handful of bits. The strategic implication is clear: teams still hand-tuning agent scaffolding are doing the equivalent of manual hyperparameter search in 2016. Cross-cutting: D4 — both approaches directly reduce the human cost of adapting agents to new domains.

Confining LLM Non-Determinism to a Bounded Layer. The scientific workflow architecture proposes a three-layer decomposition — semantic (LLM intent extraction), deterministic (validated DAG generation), and knowledge (expert-authored “Skills” documents) — that explicitly confines LLM stochasticity to intent parsing. Identical intents always yield identical workflows. On the 1000 Genomes benchmark, Skills raise full-match accuracy from 44% to 83%, reduce data transfer by 92%, and add under 15 seconds of LLM overhead at sub-$0.001 per query. This is a practical template for any team that needs reproducible pipelines orchestrated by non-deterministic agents. Cross-cutting: D4, SCE.

GROUNDING.md — Community-Governed Epistemic Constraints for Agentic Coding. Palmblad et al. propose a new artifact class: a field-scoped, community-governed document encoding Hard Constraints (non-negotiable validity invariants) and Convention Parameters (community-agreed defaults) that override all other contexts during agentic code generation. Using mass spectrometry proteomics as an example, GROUNDING.md ensures that a non-domain-expert using an AI coding agent produces scientifically valid code by default. The key insight: “it is easier to have agentic AIs adhere to guidelines than humans.” This is the spec-driven development thesis made concrete and domain-portable. Cross-cutting: SCE.

The Semi-Executable Stack as a Diagnostic Model. Feldt et al. argue that agentic AI doesn’t diminish software engineering — it expands its scope to “semi-executable artifacts”: combinations of natural language, tools, workflows, and organizational routines whose execution depends on probabilistic interpretation. Their six-ring reference model (executable artifacts → instructional artifacts → orchestrated execution → controls → operating logic → societal fit) provides a diagnostic for locating bottlenecks in agentic system design. The “preserve-versus-purify” heuristic for legacy SE processes is immediately useful for any CTO deciding what to keep vs. redesign.

D2 — AI in the Product

Meta-Predicates for Auditable Clinical AI. Bouzinier et al. introduce meta-predicates — predicates about predicates — that assert epistemological constraints on clinical decision rules expressed in a DSL. Unlike post-hoc explainability (LIME, SHAP), meta-predicates constrain what evidence may be used before deployment. Validated on 5.6M genomic variants, the approach catches epistemological errors whether rules are human-written or AI-generated. For any team building AI decision support products in regulated domains (healthcare, finance, legal), this is a concrete pattern for pre-deployment validation that satisfies EU AI Act and FDA requirements. Cross-cutting: SCE.

D3 — Build for Agents

Tool Attention Eliminates the MCP Tax. The Tool Attention paper quantifies a problem many practitioners have felt: MCP’s eager schema injection burns 10k–60k tokens per turn in multi-server deployments, inflating KV cache and degrading reasoning as context utilization approaches ~70% fracture points. Their middleware — combining intent-schema overlap scoring, state-aware gating, and lazy two-phase schema loading — reduces per-turn tool tokens from 47.3k to 2.4k (95% reduction) and raises effective context utilization from 24% to 91% on a 120-tool, six-server benchmark. End-to-end task success, latency, and cost figures are projected (not measured on live agents), which is an important caveat. Still, the thesis is compelling: protocol-level efficiency, not raw context length, is the binding constraint on scalable agentic systems. Cross-cutting: D4.

MCP Security Gap

Function Hijacking Attacks achieve 70-100% ASR on MCP tool selection. Belkhiter et al. introduce Function Hijacking Attacks (FHA) that manipulate agentic models’ tool selection to force invocation of an attacker-chosen function. Unlike semantic-preference attacks, FHA is largely context-agnostic and transfers across function sets. Universal adversarial functions can hijack tool selection across multiple queries. Tested on 5 models including reasoning variants against the BFCL dataset. This is a structural vulnerability in any system where untrusted tool registries participate in agent workflows — which is precisely the MCP design pattern. Teams exposing agents to third-party MCP servers need guardrails now.

AGNT2: Purpose-Built L2 for Agent Economies. Ruan & Zhang argue that existing blockchain L2s optimize for human-initiated financial transactions, while autonomous agents need high-frequency, semantically rich service invocations among mutually untrusting principals. AGNT2 proposes a three-tier stack with P2P state channels (<100ms, 1K-5K TPS per pair), a dependency-aware rollup layer (300K-500K TPS target), and EVM L1 settlement. The honest caveat: no end-to-end implementation exists yet, and practical deployment is constrained to ~10K-100K TPS by DA throughput. Worth tracking as infrastructure for B2A commerce, but not actionable today. Cross-cutting: D4.

D4 — Performance & Cost at Scale

SparKV: Hybrid Cloud-Edge KV Cache Loading. Liu et al. present an adaptive framework for on-device LLM inference that splits KV cache construction between cloud streaming and local computation on a per-chunk basis, overlapping both execution paths. Runtime schedule refinement handles wireless connectivity fluctuations. Results across diverse devices: 1.3x–5.1x TTFT reduction with negligible quality impact, and 1.5x–3.3x per-request energy savings. For teams deploying agentic capabilities on edge devices or mobile, this is a practical architecture for making prefill affordable without sacrificing responsiveness.

Tool Attention’s Cost Implications. As noted in D3, Tool Attention reframes the MCP scaling problem as fundamentally a token economics issue. At 0.45/turn reduction in a 120-tool deployment. At 10K agent turns/day, that’s 1.6M/year** in token costs eliminated. Even accounting for the embedding model overhead of the ISO scorer, the ROI case is straightforward.

Software Civil Engineering Lens

Today’s batch is unusually rich for the SCE thesis — possibly the strongest single-day signal we’ve seen.

The specification layer is solidifying into distinct artifact types. Three papers independently propose formal, machine-readable specification artifacts that sit above code but constrain agent behavior: GROUNDING.md encodes domain-specific Hard Constraints and Convention Parameters; meta-predicates assert epistemological validity of decision rules before deployment; and the AGENTS.md structural quality study reveals that 37% of practitioner-authored governance prompts fail structural completeness. Together, these map directly to the SCE “formal specification” and “codes/norms” pillars. The GROUNDING.md concept in particular — community-governed, field-scoped, overriding user prompts — is essentially a building code for domain software.

From probable to provable. Bertrand Meyer’s updated paper makes the SCE case in characteristically crisp terms: prompt engineering is requirements engineering (one of the hardest SE disciplines), hallucination is the correctness problem, and the solution is combining AI creativity with formal specification and verification. This is the SCE thesis stated by one of software engineering’s most influential voices.

The Semi-Executable Stack provides the missing taxonomy. Feldt et al.’s six-ring model gives the SCE movement a diagnostic tool. If software is professionalizing the way civil engineering did, we need clear categories for what’s being engineered. The expansion from “executable code” to “semi-executable artifacts” — natural language specs, orchestration logic, controls, operating logic, societal fit — is precisely the expanded scope that SCE must address. Their “preserve-versus-purify” heuristic for legacy processes is the practical bridge between current practice and the professionalized future.

Automated harness optimization as “material testing.” The HARBOR and Meta-Evolution papers implicitly validate the SCE “material datasheets” pillar. By treating harness configurations as a searchable space with measurable performance characteristics, they’re creating the equivalent of standardized material testing for agent architectures. When harness optimization becomes automated and reproducible, you get closer to being able to certify that an agent system meets performance specifications — a prerequisite for any licensure or code-compliance regime.

The confined non-determinism pattern recurs. The scientific workflow paper and GROUNDING.md both implement the same core SCE principle: confine AI non-determinism to a bounded layer, then constrain it with deterministic specifications. This is the Specify → Plan → Verify → Apply → Observe lifecycle in practice. The pattern is clearly converging across research groups who may not even be reading each other’s work, which is a strong signal that it reflects genuine engineering necessity rather than academic fashion.

Sources