The Sunday stream on August 30 consisted almost entirely of papers, but together they formed a compelling map of a mature agent. A skill gains a lifecycle. Memory splits into several representations and must open the evidence before answering. A video workflow keeps tasks and artifacts in a shared workspace. A judge is treated as a measuring instrument, and a model provider as a party whose honesty may sometimes need to be verified.
The day's central concern is not intelligence, but trust across a long system: from the way it found a procedure to the model that actually made the tool call, and whether a single bit in the host control plane corrupted the result.
Agent architecture
A skill becomes a software asset with its own lifecycle
A position paper proposes treating agentic skills as portable procedural knowledge rather than a folder of prompt files. The authors identify nine stages: discovery, authoring, storage, retrieval, composition, execution and repair, adaptation, evaluation, and security governance. Registries, marketplaces, and runtime verification appear alongside them.
This is a taxonomy, not a benchmark or an adopted standard. The paper does not show that existing platforms are interoperable or that exactly nine stages are optimal.
But the vocabulary is useful. If a skill can shape an agent's actions, it needs provenance, a version, tests, dependencies, permissions, and a revocation path — everything we have long required of code. A marketplace without these stages distributes unverifiable behavior, not “knowledge.” The skill begins to live as a supply-chain artifact.
Source: systems lifecycle for agentic skills.
Memory wins through multiple representations of one history, not sheer volume
Agent Zero Memory combines an episodic timeline, an entity-event graph, and citation-locked documentary memory. Retrieval includes an intent gate, source selection, and three parallel search loops; an answer may rely only on evidence pointers the system actually opened.
The authors report 95.60% on LongMemEval and 93.60% on LoCoMo, 0.73 and 1.10 points above the strongest comparisons. Across eight backbone models, accuracy varied by 3.4 points while cost differed by roughly 30x; near-best quality was reportedly achievable at up to 20x lower cost.
All figures are self-reported. The splits, baseline parity, latency, and implementation of the citation lock need verification. The central idea does not depend on the record: the timeline answers “when,” the graph answers “what is connected,” and the documentary layer answers “where is the evidence.” One endless summary performs all three jobs poorly.
Source: Agent Zero Memory.
Video agents coordinate through a workspace, not by retelling their work to one another
FRAMEWORKERS turns video production into a dynamic Task Stack. A Director changes task order and selects a sub-agent; an Assistant connects the task to assets in a shared Workspace, invokes the worker, and stores the result. New workers connect through descriptors, and routing is further trained with SFT and GRPO.
The authors claim gains in routing, recovery from failures, generalization to unseen sub-agents, and final video quality. The abstract page provides no numerical baseline, judges, or pipeline cost, so those comparisons remain the authors' claims.
The reliable signal is the shared workspace. When every agent hands the next one a textual retelling, the asset version, its link to the task, and the intermediate result all become lossy. With state stored separately, messages coordinate the work without becoming the sole carrier of reality.
Source: FRAMEWORKERS.
Training
The world model and policy share an input but write different outputs
The authors trained a next-state world model and reward-maximizing policy in sequence, then analyzed the resulting parameter changes. Their results suggest that world-model updates are low-rank, share an input-feature subspace with policy updates, but write information into nearly orthogonal output directions. Sequential training was more robust to projection interventions and produced more varied exploration of states and actions.
The paper has been accepted to EMNLP 2026, but its abstract does not disclose model sizes, absolute metrics, or confidence intervals. This is a research direction, not a ready-made recipe.
The intuition is still valuable: understanding environmental dynamics and choosing a rewarding action can rely on the same signals without collapsing their target representations together. An agent benefits from learning to predict a consequence before its policy learns to exploit the reward.
Source: world-model and policy updates.
Evaluation
An LLM judge changes its severity when the model version changes
A pre-registered audit measured severity, halo, reliability, cross-version shifts, and differential functioning for twelve LLM judges on 2,377 essays in two languages. The spread in severity reached 219 points on ENEM's 1,000-point scale; on ASAP it covered 15–33% of the scale, while trained humans differed by about 1%. Correlation with human raters ranged from 0.47 to 0.56, and all five version changes produced a significant shift, as large as 133 points.
Two pre-registered hypotheses returned null results. Self-consistency improved repeatability but did not produce human-level accuracy. This is one educational setting, not every LLM-as-judge task.
The practical conclusion is direct: a score without the judge version is not a stable metric. A model upgrade can create an apparent product improvement or decline while the product itself stays unchanged. A judge must be calibrated and versioned as a measuring instrument, not treated as an invisible arbiter.
Source: pre-registered audit of LLM judges.
Provenance and security
Model substitution at an API can be detected through the distribution of tool calls
AgentProv builds a fingerprint from the distribution of structured actions and applies an MMD permutation test. This sidesteps cases in which an API hides text during tool invocation while a provider-injected prompt disrupts a text-channel audit.
Across 630 checkpoint pairs, the authors detected every selected substitution; the false-positive rate under injected prompts was 7%, versus 67% and 53% for two baselines. The paper has been accepted to EMNLP, but its authors created the benchmark, and 100% on known substitutions does not protect against an adaptive provider. Quantization and wrappers can also change action distributions without malicious substitution.
The important shift is that provenance is tested on the channel that matters to an agent. If a model chooses tools differently, textual similarity offers little comfort: the behavior of the system has changed.
Source: AgentProv.
One bit in the CPU control plane can corrupt GPU inference
JITterFlip targets not model weights but CPU-resident branch code that selects compiled artifacts and launches GPU kernels. In laboratory workloads, the authors produced gibberish with perplexity amplification from 15.45x to 2.48 million x, and sponge attacks with slowdowns from 2.03x to 181.90x. In an end-to-end Rowhammer demonstration, one bit flip produced up to 7.23 million x perplexity amplification or 124.97x latency while preserving the exact answer.
Exploitation depends on the physical environment, memory layout, and specific tenant; the work does not demonstrate a widespread cloud attack. But it corrects the threat model: protecting weights and GPU kernels is not enough. A tiny host-side branch can send an enormous compute system down the wrong path. The CPU control plane is part of the trusted computing base for inference too.
Source: JITterFlip.
The issue's main technological shift
On August 30, trust spread across the entire agent lifecycle.
A skill needs provenance and governance. Memory must expose its evidence. A workspace preserves state between workers. A judge changes severity and therefore needs a version. An API model leaves a behavioral fingerprint, while a CPU branch determines the integrity of the GPU result.
No final answer can prove that this whole chain was sound. A production system must be able to name every layer's version and reconstruct the path from procedure and memory to action and measurement.
What to discuss with the technical team
- Do skills have provenance, versions, tests, permissions, and a revocation procedure?
- Does memory separate the timeline, relationships, and citable evidence?
- Do agents keep shared state in a workspace, or do they pass reality along only through textual summaries?
- Is the judge versioned together with the results it evaluated?
- Which CPU components belong to the trusted computing base of our GPU inference stack?