Chronograph

Graph View

2026-06-26

11 min read

Martin Rosén-Lidholm
Martin Rosén-Lidholm

Daily D4 Digest — 2026-06-26

TL;DR

  • OpenAI’s internal Codex usage exploded 27x in Engineering and 56x in Research since Nov 2025 — the “agentic workforce” inflection point is arriving inside frontier labs themselves
  • Three independent papers propose formal governance frameworks for AI agents: institutional attestation, policy autoformalization into Cedar, and a deterministic control plane for coding agent configs — a spec-driven safety stack is crystallizing
  • SharQ delivers 2.2–2.4× latency reduction on RTX 5090 via training-free FP4+sparsity decomposition; CAT-Q achieves ternary quantization with 100,000× fewer training tokens than BitNet — the inference cost floor keeps dropping
  • ShareLock demonstrates a >90% success rate for stealthy multi-tool poisoning attacks against MCP, exposing a critical gap in the agent interoperability security model
  • The “Spec Growth Engine” paper directly operationalizes spec-driven development for AI coding agents with drift gates and context scoping — the SCE thesis is now generating peer-reviewed frameworks

Call to Action

  • Audit your MCP tool descriptions for multi-tool poisoning vectors — ShareLock’s Shamir-based attack evades single-tool detectors at >90% success rate. Read the attack paper
  • Evaluate SharQ for inference cost reduction on your serving stack — training-free, model-agnostic FP4 with 1.2–1.4× throughput over FP8 on current hardware. Code available
  • Prototype a drift gate in your CI/CD pipeline — the Spec Growth Engine’s approach of making spec-code divergence a blocking merge condition is immediately actionable. Paper

D1 — Agentic Engineering

OpenAI’s internal Codex token explosion signals agentic engineering at scale. OpenAI reports that median internal Codex output tokens grew 56× in Research, 32× in Customer Support, 27× in Engineering, and 13× in Legal since November 2025. This isn’t incremental adoption — it’s a phase change. The 27× growth in Engineering specifically suggests that AI-assisted code generation has moved from “copilot for completions” to “agent writing substantial artifacts.” For CTOs building agentic practices, the takeaway is that even frontier AI labs are drinking their own champagne at accelerating rates. The differential across departments (56× Research vs 13× Legal) maps neatly to task formalizability — more structured domains adopt faster. (Cross-cuts D4: this growth implies exponential inference cost scaling internally.)

The Spec Growth Engine directly addresses agentic coding’s two structural failure modes. This paper identifies context explosion and silent spec-code drift as the core problems when AI coding agents operate at scale. The proposed solution — a machine-readable spec graph with contract/design separation, a “Spine” context assembler that scopes agent context to ownership paths, and a drift gate that blocks merges on spec-code divergence — synthesizes Parnas information hiding, C4, ADRs, and Walking Skeleton into a lean, machine-enforced framework. The hardest-first vertical-slice growth protocol is particularly notable: it forces agents to tackle the riskiest architectural decisions early when they’re cheapest to fix. This is the most concrete operationalization of spec-driven agentic development I’ve seen in the research literature.

A deterministic control plane for LLM coding agents reveals a governance vacuum. Rel(AI)Build presents striking empirical findings from 10,008 GitHub repositories: agent configuration files are propagating as undeclared shared components (10.1% are exact SHA-256 duplicates across independent repos), 58% have only a single commit, and less than 1% declare permission boundaries (vs 33% for GitHub Actions workflows). The proposed control plane treats agent definitions as a managed supply chain with content addressing, HMAC-stamped lockfiles, hash-chained audit logs, and tiered permissions enforced before LLM invocation. The phase state machine with requirement-to-file-to-test traceability is essentially a CI/CD pipeline purpose-built for agent governance. (Cross-cuts D3: directly relevant to anyone consuming or publishing agent tools.)

NOVA: verification-aware architecture evolution delivers 13× speedup in production. NOVA introduces an “architecture gradient” — an SGD-inspired, non-differentiable update signal — to guide agent-driven modifications to industrial recommender systems. The verification cascade (structure semantics → local executability → offline effectiveness → online impact) blocks invalid candidates early and records failure patterns as “forbidden directions.” Deployed in a real advertising system, it achieved 54.5% and 60.0% effective pass rates on complex tasks and reduced one literature-to-production cycle by 13× in human-attended time, with measurable GMV improvements in online A/B testing. This is a compelling example of the Specify → Plan → Verify → Apply → Observe lifecycle working in production. (Cross-cuts D2, D4.)

EGG framework achieves 2.13× PyTorch speedup via expert-guided kernel generation. EGG decomposes GPU kernel generation into algorithmic structure design and hardware-specific tuning, using a stage-aware multi-agent collaboration mechanism. By encoding expert optimization principles (parallel mapping, tensor tiling, memory optimization) as explicit guidance for the LLM agents, it outperforms both agent-based and RL-based approaches on KernelBench. The key insight is that domain expertise can be encoded as agent constraints rather than requiring the LLM to rediscover optimization principles from scratch. (Cross-cuts D4: directly reduces inference compute costs.)

D2 — AI in the Product

Institutional attestation reframes product-level AI governance. This paper proposes that agents should retain full autonomy over planning and reasoning but hold no execution authority over high-risk actions. Execution requires independently attested preconditions, cryptographically bound to declared intent, evaluated by deterministic policy, and recorded in tamper-evident logs. The examples — clinical prescribing and production software deployment — are exactly the domains where agentic products face the highest liability exposure. For product teams embedding agents, this pattern suggests a clean architectural separation: let the agent reason freely, but gate consequential actions through an attestation layer that’s independently auditable. This is “human on the loop” made concrete and cryptographically enforceable.

NOVA’s L1–L4 task-level control provides a template for risk-aware agent products. NOVA’s tiered automation model routes high-risk tasks to a Copilot mode requiring human oversight while allowing lower-risk modifications to proceed autonomously. The online A/B results (+1.25% to +2.02% GMV improvement, 37–67% bias reduction) demonstrate that verification-aware agent architectures can deliver measurable business value in production recommender systems. This is a model for how D2 products can graduate from “agent as assistant” to “agent as autonomous contributor” with appropriate guardrails.

D3 — Build for Agents

MCP Security Alert: ShareLock achieves >90% attack success rate with multi-tool poisoning

ShareLock exposes a fundamental security gap in MCP’s tool description model. This paper demonstrates that malicious instructions can be distributed as benign-looking Shamir secret shares across multiple MCP tool descriptions, achieving information-theoretic secrecy that defeats both manual inspection and automated single-tool detectors. A covert reconstruction trigger planted during server update aggregates the shares to execute the attack. The >90% average attack success rate across mainstream LLMs on two MCP clients is alarming. The implication for anyone building B2A interfaces or consuming MCP tools: single-tool description auditing is insufficient. You need cross-tool correlation analysis, and potentially cryptographic attestation of tool provenance — which connects directly to the attestation model proposed in today’s governance papers.

Autoformalization of agent instructions into Cedar policies bridges natural language and formal enforcement. This ICML 2026 workshop paper presents a pipeline that translates agent prompts, MCP tool descriptions, and natural-language policy documents into formally verified Cedar policies using an LLM-based generator-critic loop. On MedAgentBench, the autoformalized policies cover substantially more of the source specification than hand-coded symbolic enforcement. This is significant for D3 because it means policy enforcement for agent-to-agent interactions can scale with the breadth of real policy specifications rather than being bottlenecked by manual formalization. The choice of Cedar (Amazon’s authorization policy language) as the target is pragmatic — it’s deterministic, analyzable, and already has toolchain support.

D4 — Performance & Cost at Scale

SharQ: training-free FP4 inference with 2.2–2.4× latency reduction. SharQ introduces an online sparse-dense decomposition that bridges activation sparsity and FP4 quantization without calibration data, retraining, or model-specific tuning. On an RTX 5090, it delivers 2.2–2.4× latency reduction over FP16 and 1.2–1.4× throughput improvement over FP8 across Llama-3.1-8B, Qwen2.5-7B, Qwen3-30B-A3B, and Qwen3-VL-8B. The technique recovers 43–63% of the NVFP4-to-FP16 accuracy gap and generalizes across NVFP4, HiF4, and MXFP4 formats. For serving workloads where you’re already at FP8, the additional 1.2–1.4× throughput at FP4 precision is pure margin. The training-free, model-agnostic nature makes this deployable today.

CAT-Q achieves ternary quantization with 100,000× fewer training tokens than BitNet. CAT-Q is a post-training quantization scheme that compresses LLMs to ternary (1.58-bit) using only 512 calibration samples while outperforming BitNet v1 and v2 families trained with 100B tokens. It scales to models up to 235B parameters within 8–60 hours on 8 A100-80GB GPUs. The combination of learnable modulation and softened ternarization makes ternary models practical without the massive training investment previously required. For D4 cost modeling, ternary models offer dramatic memory and compute savings — if accuracy holds for your use case.

HuggingFace Jobs enables one-command vLLM server deployment. HF’s new Jobs feature reduces the operational overhead of standing up inference endpoints. While not technically novel, it commoditizes the deployment of optimized serving stacks, lowering the barrier to running cost-efficient inference infrastructure. For teams evaluating SharQ or CAT-Q, this kind of deployment simplification matters for iteration speed.

Software Civil Engineering Lens

Today is a landmark day for the SCE thesis. Three independent research groups — without citing each other — converged on the same fundamental insight: agentic AI systems require formal, deterministic, machine-enforceable governance layers that are architecturally separate from the AI’s reasoning.

The institutional attestation model draws explicitly from how human institutions govern powerful autonomous actors — not by monitoring reasoning, but by requiring independently attested evidence at the point of consequential action. This is the “codes and norms” pillar of SCE manifesting as a computational protocol. The cryptographic binding of preconditions to declared intent and tamper-evident logging is directly analogous to structural engineering’s inspection and certification regime.

The policy autoformalization pipeline attacks the “formal specification” pillar — translating natural-language policy into formally verified Cedar policies via LLM generator-critic loops. The 31.4% verification success rate for LLM-generated separation logic specs in the VeriFast study (with 94% of errors being domain-specific knowledge gaps) calibrates expectations: we’re not at automated formal verification yet, but the direction is clear and the bottleneck is identifiable.

The Spec Growth Engine is perhaps the most SCE-aligned work I’ve seen — it directly operationalizes spec-driven development with drift gates as blocking merge conditions, essentially creating the “building permit” equivalent for AI-generated code. The explicit framing of context explosion and spec-code drift as structural failure modes mirrors how civil engineering identifies failure modes in physical structures.

The deterministic control plane provides the empirical evidence for why this matters: agent configurations in the wild are propagating without governance (58% single-commit, <1% permission boundaries). This is the software equivalent of building without permits or inspections.

Meanwhile, NOVA’s verification cascade demonstrates that the Specify → Plan → Verify → Apply → Observe lifecycle works in production at industrial scale, delivering 13× faster cycles with measurable business outcomes. The L1–L4 task-level control is “bounded autonomy” made concrete.

The pattern emerging across all these papers: the professionalization of agentic software development is not being driven by regulation or standards bodies — it’s being driven by the practical necessity of making agents reliable enough to deploy. The SCE thesis predicted this would happen. It’s happening.

Sources