Chronograph

Graph View

2026-05-21

11 min read

Martin Rosén-Lidholm
Martin Rosén-Lidholm

Daily D4 Digest — 2026-05-21

TL;DR

  • A new paper formalizes the stochastic-deterministic boundary (SDB) as the load-bearing primitive of production agent runtimes, with a catalog of six composable architecture patterns and a novel “replay divergence” failure mode — the closest thing to an architectural pattern language for agentic systems we’ve seen (arXiv:2605.20173)
  • Evidence-Carrying Agents (ECA) reframe hallucination as an authorization exploit, achieving 0% unsafe-action rate by requiring deterministic verifier certificates before any privileged tool call — a direct instantiation of the Decider pattern for agent safety (arXiv:2605.19192)
  • Three D4-critical infrastructure papers drop: KVBuffer cuts linear attention decoding latency up to 45% (arXiv:2605.19049), GEM reduces MoE straggler latency up to 16.5% via GPU-variability-aware expert placement (arXiv:2605.19945), and multi-model LLM scheduling empirics reveal that preemption cost is dominated by model reload, not KV-cache transfer (arXiv:2605.19593)
  • ResearchArena benchmarks 117 auto-generated papers from Claude Code, Codex, and Kimi Code — none reach top-venue acceptance; fabrication rates vary 15× across agents, underscoring that verification, not generation, remains the bottleneck (arXiv:2605.19156)

Call to Action

  • Adopt the SDB contract pattern from arXiv:2605.20173 as a design review checklist for any production agent runtime — the proposer/verifier/commit/reject decomposition maps directly to the Decider pattern and catches replay divergence before it hits production
  • Audit your multi-model serving stack against the offloading sensitivity findings in arXiv:2605.19593 — if you’re running heterogeneous models on shared GPUs, smaller models degrade non-linearly and your scheduler likely doesn’t account for it
  • Evaluate KVBuffer (arXiv:2605.19049) if you’re deploying linear-attention models (e.g., Qwen3-Next) — the 5× improvement in max concurrent requests for speculative decoding is material for cost planning

D1 — Agentic Engineering

Runtime Architecture Patterns for Production LLM Agents. This is the paper of the day for anyone building agent systems. Srinivasan introduces the stochastic-deterministic boundary (SDB) — a four-part contract (proposer, verifier, commit step, reject signal) that governs how LLM output becomes system action. The paper catalogs six runtime patterns (hierarchical delegation, scatter-gather+saga, event-driven sequencing, shared state machine, supervisor+gate, human-in-the-loop), each traced to distributed-systems lineage with explicit analysis of what changes when the worker is stochastic. Most actionable: the identification of replay divergence as a failure mode unique to agentic systems — when LLM-based consumers of a deterministic event log produce different downstream outputs under model-version or prompt changes. This directly threatens reproducibility in any event-sourced agent architecture. The five-step methodology for pattern selection and the diagnostic procedure mapping production failures to pattern weaknesses are immediately applicable. (Cross-cuts D1, D3, SCE)

ResearchArena: How Far Are We From True Auto-Research? A rigorous benchmark of 117 agent-generated papers across Claude Code (Opus 4.6), Codex (GPT-5.4), and Kimi Code (K2.5) running the full research loop — ideation, experimentation, writing, self-refinement. The headline: under manuscript-only review, Claude Code matches ICLR 2025 submission averages; under artifact-aware review where agents inspect the workspace, scores drop sharply. None of the 117 papers meet top-venue acceptance. The most striking finding is the 15× spread in fabrication rates: Codex shows 5%/8% paper-vs-artifact mismatch / fabricated references versus Kimi Code’s 77%/72%. This confirms that for agentic engineering workflows, verification infrastructure matters more than generation capability. The three failure modes — fabricated results, underpowered experiments, plan/execution mismatch — map precisely to the gap between “propose” and “verify” in any agent orchestration loop.

Agent Security as a Systems Problem. A position paper from cybersecurity researchers arguing that the AI model must be treated as an untrusted component, with security invariants enforced at the system level rather than through model robustness alone. They analyze eleven real-world attacks on agents and map them to systems security principles (least privilege, complete mediation, fail-safe defaults) that could have prevented them. The key insight for agentic engineering: model robustness is a necessary but insufficient condition; you need system-level enforcement of security invariants. This aligns with both the SDB paper’s verifier pattern and the ECA paper’s certificate-gated actions. (Cross-cuts D1, D3, SCE)

AI-Assisted Theorem Proving Exposes the Local-vs-Global Gap. A Lean 4 formalization case study using the Aristotle API on IMO 2009 Problem 6 produces four verified helper lemmas but leaves the main theorem unresolved with a sorry. The precise finding: local proof search succeeds while global combinatorial bookkeeping remains out of reach. This is a clean micro-example of the same failure mode ResearchArena identifies at macro scale — agents can execute components but struggle with global coherence and compositional reasoning.

D2 — AI in the Product

Self-Falsifying Digital Twins for Safety-Critical Industrial Processes. The CCSS-IX system for wastewater treatment is technically a domain-specific application, but its architecture pattern — interpretable locally-linear “expert” models mixed by a context-aware gating network, with a conformal risk control layer that can abstain, reopen, or return a falsifying temporal witness — is a transferable pattern for any AI-in-the-product scenario where you need certified safety guarantees. The self-falsifying decision rule (finite-sample coverage guarantees, 93 of 187 false-safe approvals prevented) demonstrates what “human on the loop” looks like in practice: the system doesn’t just recommend; it provides evidence for why a recommendation should not be trusted when evidence is insufficient. (Cross-cuts D2, SCE)

Evidence-Carrying Multimodal Agents. The ECA framework reframes hallucination in agentic contexts as an authorization failure: when a false visual claim triggers a privileged action (click, email, transfer), the hallucination becomes an exploit. ECA decomposes each tool call into action-critical predicates, obtains typed certificates from constrained DOM/OCR/AX verifiers, and uses a deterministic gate. Results: 0% unsafe-action rate on a 200-task pipeline (Wilson 95% upper bound 2.67%), gate bypass reduced from 15% to 1.3% after four hardening steps. For any product embedding agents with tool-calling capabilities, the principle is concrete: model language may propose actions, but external evidence must authorize them. (Cross-cuts D1, D2, SCE)

D3 — Build for Agents

Trustworthy Agent Networks: Trust Must Be Baked In, Not Bolted On. This vision paper argues that as agents move from isolated operation to collaborative A2A ecosystems, trustworthiness cannot be retrofitted onto protocols designed for individual agents. The four design pillars address adversarial composition, semantic misalignment, and cascading operational failures — systemic vulnerabilities unique to multi-agent networks. For anyone building on Google’s A2A protocol or similar interoperability layers, the implication is clear: trust negotiation, capability attestation, and failure isolation need to be first-class protocol concerns, not application-layer afterthoughts.

Agentic Affordance Profiles for Knowledge Graph Discovery. The AAP framework revisits Semantic Web Services (OWL-S, WSMO) for the KG setting, proposing a semantic layer above VoID and DCAT that lets agents determine not just what a KG contains but what the agent can prove from it, what closure assumptions govern empty results, and whether the agent’s task vocabulary is grounded in the schema. This is MCP/A2A-adjacent: as agents need to discover and compose data sources, metadata standards must evolve from describing content to describing affordances. The five-point research agenda identifies concrete gaps in formal, computational, and engineering work needed for agent-scale affordance matching.

D4 — Performance & Cost at Scale

KVBuffer: IO-Aware Serving for Linear Attention. KVBuffer addresses a specific but increasingly important bottleneck: serving linear attention models (constant decoding cost w.r.t. context length) is currently inefficient because the linear attention state is much larger than per-token KV pairs, creating memory-access overhead on every decode step. By buffering recent keys and values and enabling chunkwise computation, KVBuffer reduces decoding latency by up to 45.17% and increases max concurrent requests by 5× for speculative decoding (verified on Qwen3-Next in SGLang). As linear attention models become the default for long-context workloads, this is a critical infrastructure optimization.

GEM: GPU-Variability-Aware Expert Mapping for MoE. GEM tackles a real but often invisible problem: in MoE serving, the lock-step synchronization barrier means the slowest GPU determines batch latency. Prior work balanced token loads but ignored GPU variability. GEM profiles GPU variability per model/task and distinguishes between “consistent” experts (always active) and “temporal” experts (co-activated in bursts), placing co-activated experts on different GPUs and away from slower hardware. Result: 7.9% average, 16.5% peak end-to-end latency improvement. This matters as MoE deployments scale — the marginal cost of ignoring hardware heterogeneity grows with cluster size.

Multi-Model LLM Scheduling Under GPU Constraints. The empirical study of layer offloading and preemption across heterogeneous hardware reveals two non-obvious findings: (1) offloading causes strongly non-linear, model-dependent degradation in decode throughput, with smaller models more sensitive to reduced GPU residency; (2) preemption overhead is dominated by model state reload, not KV-cache transfer, and varies significantly across models and hardware. If you’re running multiple specialized models on shared infrastructure (increasingly common in agentic architectures where routing dispatches to different models), your scheduler needs model-specific offloading sensitivity curves.

Document AI Pipeline Profiling. The microservice architecture paper provides concrete production profiling data from processing thousands of multi-page documents per hour. Two counterintuitive findings: OCR, not LLM parsing, dominates end-to-end latency; and the system saturates at a concurrency determined by shared GPU-inference capacity, not worker count. The architectural pattern — separating GPU-bound inference from CPU-bound orchestration with async processing for IO-bound operations and independent horizontal scaling — is a template for any multi-model pipeline. (Cross-cuts D1, D4)

Software Civil Engineering Lens

Today’s batch is unusually rich for the SCE thesis. Three papers independently converge on the same structural argument: the stochastic components of agentic systems must be bounded by deterministic contracts.

The SDB paper is the most explicit — it literally names the boundary between stochastic (LLM) and deterministic (software) as a four-part contract and builds a pattern catalog around it. The proposer/verifier/commit/reject decomposition is isomorphic to the Decider pattern: the LLM proposes a state transition, a verifier checks it against domain invariants, and the system either commits or rejects. The identification of “replay divergence” as a failure mode is particularly SCE-relevant — it’s the agentic equivalent of discovering that your building materials have non-deterministic load-bearing properties under different environmental conditions. You need material datasheets (model behavior profiles) and simulation (the “terraform plan” step) to manage this.

The ECA paper operationalizes the same principle for safety: free-form model text is treated as inadmissible evidence, and only typed certificates from constrained verifiers can authorize privileged actions. This is bounded autonomy made concrete — the agent has freedom to reason and propose, but the system enforces invariants at the boundary. The 0% unsafe-action rate is the kind of quantitative guarantee that SCE’s “simulation” pillar demands.

The Agent Security paper provides the systems security framing: treat the model as untrusted, enforce invariants at the system level. This maps directly to SCE’s “codes and norms” pillar — you don’t trust individual construction workers to always make safe decisions; you enforce building codes structurally.

The ResearchArena results and the Lean 4 case study provide the negative evidence: without verification infrastructure (the “Verify” step in Specify → Plan → Verify → Apply → Observe), agents produce outputs that look competent but fail under scrutiny. The 15× spread in fabrication rates across agents is a material datasheet problem — you cannot treat “an LLM agent” as a generic component; you need per-model, per-task reliability profiles.

Finally, the self-falsifying digital twin demonstrates the lifecycle end-to-end in a safety-critical domain: specify the operating constraints, plan via simulation, verify with conformal risk control, apply only when certified, observe via falsifying witnesses. It’s the SCE lifecycle instantiated in wastewater management, of all places.

Net assessment: Today moves the SCE needle meaningfully. The SDB paper’s pattern catalog and the ECA paper’s certificate-gated architecture are both concrete, implementable contributions to the “formal spec” and “simulation” pillars. The field is converging on the insight that professionalization of agentic systems requires structural guarantees, not just better models.

Sources