Chronograph

Graph View

2026-07-02

11 min read

Martin Rosén-Lidholm
Martin Rosén-Lidholm

Daily D4 Digest — 2026-07-02

TL;DR

  • A burst of research is converging on treating AI-generated code as untrusted proposals that must pass deterministic admission gates before commit — the “terraform plan for agents” pattern is crystallizing across multiple independent papers
  • Loop engineering is being formalized as a distinct discipline layer above prompt engineering, with a taxonomy, verification ladder, and corpus of 50 real-world loop specs
  • Permission laundering in agent tool chains gets a concrete fix via ChainCaps, a transparent MCP proxy that enforces monotonic capability attenuation with near-zero benign task impact
  • Agent skill ecosystems are developing supply-chain security problems analogous to npm/PyPI — over 1.43M skills analyzed reveal governance-poor metadata and hidden transitive dependencies harboring known malicious packages
  • A 12-week case study producing 420 KLOC with a single engineer + AI agents yields a grounded theory of governance conversion: failures discovered during agentic velocity become the controls themselves

Call to Action

  • Evaluate ATM or Mnemosyne patterns for your multi-agent code pipelines — both provide open-source reference implementations for pre-write admission and transaction safety: ATM, Mnemosyne
  • Audit your MCP tool chains for permission laundering — deploy or prototype a capability-attenuation proxy like ChainCaps before agents compose sensitive data flows in production
  • Adopt AGENTS.md as your repo-level agent specification standard — the harness engineering study shows it’s becoming the interoperable norm across Claude Code, Copilot, Cursor, Gemini, and Codex

D1 — Agentic Engineering

Loop Engineering Gets Its Formal Treatment. A new paper defines the loop specification — trigger, goal, verification step, stopping rule, and memory — as the reusable artifact that replaces step-by-step prompting for coding agents like Claude Code and Codex. The taxonomy introduces a five-level “verification ladder” from human-in-the-loop to fully autonomous verification. Analysis of 50 real-world loops shows practice has matured most where it matters: 70% verify autonomously and 74% name terminal states, but automated triggering and durable memory remain underdeveloped. This is directly relevant to how engineering orgs should structure their agent harnesses — the paper argues loop and prompt engineering are complementary, not substitutes.

Harness Engineering Empirical Baseline. An updated study of 2,853 GitHub repositories maps how developers actually configure agentic coding tools across Claude Code, Copilot, Cursor, Gemini, and Codex. Eight configuration mechanisms are identified, from static context files to executable skills and subagents. The standout finding: AGENTS.md is emerging as an interoperable standard — it’s often the only configuration artifact in a repo. Advanced mechanisms like Skills and Subagents see minimal adoption so far, with Skills relying on static instructions rather than executable scripts. Claude Code users employ the broadest mechanism range. This is your empirical evidence for where to invest in tooling standardization. (Cross-cuts D3 — these are the conventions agents-as-consumers will rely on.)

Governance Conversion Theory from Real Agentic Development. “Cheap Code, Costly Judgment” documents a 12-week effort where a single expert engineer used frontier AI coding agents to produce 420 KLOC of production code plus 1.16 MLOC of tests, lints, and agent tooling for a document accessibility system. The key theoretical contribution: governance conversion — a process model explaining how high-velocity agentic implementation surfaces recurring structural failure classes, and how engineering judgment converts those failures into durable governance mechanisms. Unlike top-down governance models that derive controls from known obligations, this model shows controls are discovered from failures that only become visible during agentic work. This is the most grounded empirical account I’ve seen of what “human on the loop” actually looks like in practice.

ATM: Concurrency Control for Multi-Agent Code Synthesis. The AI-Atomic-Framework (ATM) addresses a specific and critical gap: when multiple AI agents simultaneously generate code mutations to a shared repository, how do you decide which writes can proceed in parallel, which need serialization, and which must fail-closed? ATM introduces a Content Identifier (CID) broker as a shared-mutation admission subsystem, with governed writes applied by a “neutral steward” rather than proposing agents. Evaluation includes a 12-scenario design matrix and a three-week external-adopter study. The pattern — untrusted proposals mediated by deterministic admission — directly mirrors Mnemosyne’s ATP approach but specializes it for code artifacts. (Cross-cuts D3 — this is infrastructure for agent-to-agent collaboration.)

Mnemosyne: Transaction Semantics for Agent Workflows. Agentic Transaction Processing (ATP) formalizes a principle that should be tattooed on every agentic engineering team’s wall: anything may propose, but only the runtime admits and commits. Mnemosyne implements this with an append-only transition log, effective-state projection, dependency-safe compensation, and four provable safety properties. The overhead is under 6% for projection-and-validation, and bounded local repair edits an order of magnitude fewer operations than global recompute. The key insight is that committed-state correctness becomes independent of the competence, honesty, or learning of the proposing layer — exactly the property you need when your “proposing layer” is a stochastic LLM. Open source available. (Cross-cuts D4 — the 6% overhead number matters for production deployment.)

Self-Evolving Agents with Statistical Safety Gates. SEA tackles the hardest variant: agents that modify their own behavior. The architecture confines self-modification to a steering adapter around a frozen base model, with every modification admitted only through an anytime-valid statistical gate that emits an auditable certificate against a fixed error budget. Five verifier-in-the-loop mechanisms supply grader-free signal. On SWE-bench Verified, the contribution is modest but real (+4 to +5 on strong base models), with event logs confirming mechanisms fire and prevent regressions. The broader point: bounded self-improvement is achievable when you separate the modification surface from the verification surface.

D2 — AI in the Product

Agentic Rule Generation Creates Self-Expanding Symbolic Systems. A multi-agent LLM pipeline for chemistry demonstrates a pattern with broad product implications: agents that don’t just classify but write the classification rules themselves, verified against a corpus. The system expanded a reaction taxonomy from 68 to 14,073 classes across 665,901 patent reactions, achieving 97.7% classification accuracy on unseen reactions. The product archetype here — “living databases” that grow their own ontologies via verified generative loops — is applicable far beyond chemistry. Any domain with long-tail classification needs (legal, medical coding, compliance) could adopt this pattern.

Verification Architecture for Trustworthy AI Answers. Theoria offers a middle path between formal proof assistants (high certainty, low coverage) and scalar LLM judges (high coverage, no auditability). Solutions are rewritten as typed state transitions with explicit justifications — citations, computations, or problem-given facts. The “completeness of change” invariant means hidden premises surface as unlicensed mutations. On adversarial poisoned proofs, structured judges catch 94.7% vs. 83.2% for holistic judging, with the gap concentrating exactly where the theory predicts (hidden premises: 90.6% vs. 62.5%). Relevant for any product that needs to explain why an AI answer should be trusted.

D3 — Build for Agents

Permission Laundering: The Composition Safety Gap in Agent Tool Chains. ChainCaps identifies and solves a critical problem for MCP-based architectures: an agent can pass every per-tool permission check and still produce an unsafe end-to-end effect (e.g., read confidential doc → summarize → send to external endpoint). The fix is monotonic capability attenuation — every value carries a sink-specific capability budget that can only shrink through composition. Implemented as a transparent MCP proxy requiring zero changes to agents or tool servers, it reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. The critical practical finding: manifest quality is the deployment bottleneck — expert manifests achieve 100% attack blocking, naive ones only 27.3%. This is the kind of infrastructure that needs to exist before enterprises trust agent-to-agent data flows.

Agent Skill Supply Chains Have an npm Problem. Analysis of 1.43 million agent skills reveals that the agent skill ecosystem is developing the same supply-chain vulnerabilities that plagued package managers. Skills are “activation-ready but governance-poor” — metadata exists for invocation but not for dependency tracking, versioning, or provenance. Recursive skill reuse creates hidden dependency graphs, and known malicious skills were found persisting in supply chains. The authors recommend typed dependency manifests, first-class dependency-cluster management, and lockfile-like records — essentially SBOMs for agent capabilities. If you’re building or consuming MCP tool servers, this is your early warning.

STPA Adapted for AI Systems. PHASE translates System Theoretic Process Analysis — a recognized system safety framework — for AI development and operation. The key finding is that STPA’s control-theoretic perspective applies but requires targeted adaptations for AI-specific traits: model opacity, capability uncertainty, and output complexity. The framework enables detection of system-level hazards from component interactions, explicit acknowledgment of social factors, and traceable accountability chains. Relevant for any organization building agent-to-agent systems that need to reason about emergent safety properties.

D4 — Performance & Cost at Scale

Mnemosyne’s Overhead Numbers Set a Practical Benchmark. The ATP runtime reports under 6% overhead for projection-and-validation, and bounded local repair that edits an order of magnitude fewer operations than global recompute. These numbers matter because they demonstrate that treating agent outputs as untrusted proposals and running deterministic admission doesn’t require prohibitive compute. For teams considering whether to add a governance layer to their agent pipelines, the cost/safety tradeoff is now empirically bounded. The question shifts from “can we afford admission control?” to “can we afford not to have it?”

Software Civil Engineering Lens

Today’s batch is remarkably coherent and represents the strongest single-day signal for the SCE thesis I’ve tracked. Multiple independent research groups are converging on the same fundamental principle: agent-generated actions are proposals, not truth, and deterministic admission gates are the engineering discipline that makes them safe. This is the Specify → Plan → Verify → Apply → Observe lifecycle instantiated in code.

The Decider pattern is going mainstream. Mnemosyne’s ATP and ATM’s CID broker are both implementations of what SCE calls the Decider pattern — a deterministic function that accepts or rejects proposed state transitions against a declared constraint set. The critical property both papers prove is that committed-state correctness becomes independent of the proposing layer’s competence. This is exactly the “bounded autonomy” concept: agents operate freely within spec constraints, and correctness is a property of the boundary, not the agent.

Governance conversion fills the “codes and norms” pillar. The “Cheap Code, Costly Judgment” case study provides empirical evidence for how the SCE equivalent of building codes emerges. Rather than being designed top-down, governance mechanisms are discovered from failures during agentic work and then hardened into durable constraints. This is how professional disciplines actually developed historically — the ASCE didn’t start with a complete codebook, it built one from bridge failures.

Loop specifications are blueprints. The loop engineering paper’s taxonomy — trigger, goal, verification, stopping rule, memory — maps directly to Event Modeling’s specification language. A loop spec is a blueprint for bounded agent behavior. The five-level verification ladder (from human-in-the-loop to fully autonomous) tracks the 10% → 10× transition the SCE thesis predicts. Today, 70% of real-world loops already verify in the autonomous zone.

The supply-chain security gap is the “material datasheets” pillar. The agent skill supply chain analysis reveals that we have activation-ready but governance-poor components — the equivalent of using construction materials without knowing their load-bearing properties. The recommended typed dependency manifests and lockfiles are literally material datasheets for agent capabilities.

Net assessment: Four of the six SCE pillars showed meaningful movement today. Formal spec (loop specifications, ATP constraint sets), codes/norms (governance conversion), simulation (Mnemosyne’s bounded-repair guarantees, SchedCheck’s schedule-robustness analysis), and material datasheets (skill supply chain SBOMs). Licensure and education remain untouched. The professionalization thesis is not just holding — it’s accelerating, driven by the practical necessity of making agent-generated code safe at scale.

Sources