logs/

Build note on routing personal memory between RAG and model-weight edits, then proving attribution with retrieval disabled.

takeaway: memory systems need provenance, not just recall.

Three papers show verifiable-reward training is bounded by the verifier, not the RL loop: random rewards move Qwen math models, one example nearly matches 1.2k, and noisy verifiers silently bias GRPO; my VerifierForge control arm confirms the gain is not placebo.

takeaway: audit the verifier, correct its noise, and run a random-reward control arm before trusting any RLVR benchmark gain

A first-person reading of GRPO and its descendants as a family tree, where each descendant patches one specific pathology: clip collapse, length bias, entropy, and trajectory-level credit. Written from having implemented the algorithm and run it against a programmatic verifier.

takeaway: every GRPO variant names one pathology it fixes, so read them as a change log, not a zoo.

A field map of knowledge editing from ROME to UnKE, and a deep dive into my paper on the hard version: sequential edits whose facts survive rephrasing.

takeaway: routing a rephrased query to the right edit is only half the problem; the stored value has to be able to say the fact in a new shape.

Reading notes on verifier design for RLVR: rule-based brittleness, model-based hacking, process-reward credit assignment, and OpenAI's RFT wind-down, landing on programmatic tiered verifiers with falsification arms.

takeaway: the verifier is the product, and a falsification arm is the only honest check on reward quality

Reading notes on the token/parametric/latent memory taxonomy, the ROME-to-HoReN editing line, and the routing rule for when durable knowledge belongs in weights instead of retrieved context.

takeaway: write to weights when the knowledge is durable and must survive retrieval being off.

Reading notes on s1 budget forcing, LIMO's 817-example elicitation, and the ICLR 2026 multi-turn study showing when more thinking fails.

takeaway: more thinking only pays off when the model can still correct its own path.

Agent loops are sequences of short, structured, latency-bound steps sharing one growing prefix — a different serving problem than chat. Close reads of DistServe, Mooncake, and EAGLE, plus prefix caching and KV compression work, ending with the two-tier local-plus-frontier serving design of PiPlan.ai.

takeaway: optimize the run, not the request — keep the shared prefix warm across turns, split the phases, and make admission and routing decisions explicit

Reading notes on the 2026 on-policy distillation wave: the field survey, black-box adversarial distillation, and the calibration crisis, framed as the gate for small-model routing.

takeaway: capability without calibration is worse than no distillation, so routing must gate on it

A close read of the ICML 2026 Outstanding Paper "The Flexibility Trap" and the dLM reasoning debate it settles: arbitrary-order generation hurts math and coding reasoning, while parallel decoding and infilling remain the real wins.

takeaway: keep reasoning chains autoregressive and use diffusion for parallel decoding, infilling, and controllable generation.

A close read of DeepSeek-V3 (MLA, DeepSeekMoE), DeepSeek's Native Sparse Attention, and Qwen3.6's Gated DeltaNet hybrid: attention is no longer monolithic and the FFN is a router.

takeaway: the 2026 model block is a per-layer mix of compressed, sparse, and recurrent attention over an expert-routed FFN, so pick the mix by workload cost.

Reading notes on the Muon line of work: Keller Jordan's writeup, Moonshot's Moonlight scaling paper, and Kimi K2's MuonClip, plus where I'd adopt it and where I'd hold back.

takeaway: the optimizer is a training-recipe decision again, and compute-matched comparison plus two diagnostics (update condition number, max attention logit) decide where Muon wins.

Build note on a function + agent road-trip planner where agents verify the world but never mutate the route.

takeaway: keep agents as sensors; keep route decisions in deterministic code.

Design notes on sandboxing agent mutation: emulated execution, stateful evaluation sandboxes, and verify-then-mutate postures, read through ToolEmu, ToolSandbox, and Voyager, then grounded in the simulation sandbox at PiPlan.ai and the compute-then-commit invariant gate in SafeRoutes.

takeaway: sandbox the mutation before it lands, and when you cannot simulate the world, make the commit itself reversible

Proposal-first mutation gating, read through MAST, InferAct, and Agent-as-a-Judge, argued against the seed paper on harness design and post-training, and grounded in PiPlan.ai's draft-to-diff-to-human-commit flow and SafeRoutes' data-plane correctness.

takeaway: the review gate decides which trajectories exist at all, so it is a data quality feature, not just a safety feature

A desk-analysis close reading of Grok Build, SpaceXAI's open-source coding-agent harness — kernel-level sandboxing, the layered tool permission gate, and session JSONL state — with adopt/reject verdicts grounded in my own harness work.

takeaway: gate on the event log, not on tool names, and type your trajectory so it can be scored and replayed

A close read of BFCL V4, tau-bench, and ToolSandbox as oracles for the four hidden decisions in function calling: selection, fill, invocation judgment, and chaining.

takeaway: evaluate each function-calling decision separately, with deterministic oracles first and LLM judges only for what escapes them

A close read of MAST, the first empirically grounded taxonomy of multi-agent failures, plus why outcome-level checks are the wrong granularity and what runtime supervision has to catch. Ends with the Loop Supervision build and the silent sample-drop incident it caught for real.

takeaway: Multi-agent failures are structural, so supervision must check world state at process granularity and classify incidents, not just log stalls.

Reading the 2025-2026 memory wave: the forms-functions-dynamics survey, MemoryAgentBench's four competencies, Mem0's pipeline, and RL-trained memory management, mapped to Engram and a Hopfield reranker design.

takeaway: memory is an action space with a shared vocabulary now, and the open problem is evaluating selective forgetting

Close read of Focus (Active Context Compression), AgentFold, and IterResearch on autonomous context management: what to keep, fold, and drop in long agent runs, and where compaction silently loses state.

takeaway: give the model fold and prune operations, protect the invariants, and audit every compaction.

Field map and close reads of Search-R1, ReTool, and iStar, framed by the Landscape survey (TMLR 2026) and the SFT-memorizes/RL-generalizes result, ending in a design for an agentic RL harness.

takeaway: prompting exposes capability but RL changes the policy, so adopt agentic RL where a reward is definable, rollouts are affordable, and the gap is strategic rather than knowledge-based.

Reading notes on MCP as a standardized trust boundary: what the spec actually says about security, and the verified attack literature on tool-result injection (InjecAgent, MCPTox, MCP safety audits).

takeaway: standardization moves the trust boundary to the tool layer, so treat every tool description and result as untrusted input.

Reading notes on application-layer dry-run vs system-level isolation for agents, from ToolSandbox and ToolEmu to Firecracker microVMs, landing on which layer defends which failure mode.

takeaway: pick the sandbox layer by failure mode — dry-run for bad plans, microVM isolation for hostile code.

Survey note on memory poisoning and memory control-flow attacks: write-time injection, sleeper payloads, and memory-driven tool hijack, with the verified 2026 studies behind each.

takeaway: memory content is structurally indistinguishable from legitimate context at read time, so defenses belong at write time and at the tool boundary

Reading notes on GLM-5.2, structured-action-credit CLI agents, and SKILL0, mapped onto the state/skills/recovery stack, plus where PiPlan.ai's planner-executor work is headed.

takeaway: long-horizon capability is a stack, and the run-time artifact should shrink as state and skills get more durable.

Survey note on checking agent outputs against knowledge graphs, from GraphRAG upstream to graph-as-judge verification downstream, grounded in GraphJudge, Jerry's HackwithBay 3.0 project.

takeaway: the graph, not the LLM, should decide the verdict, and the topology of absence is evidence

Deep-dive on the neurosymbolic division of labor in planning — LLMs handle the ill-posed parts (parsing, modeling, preferences), classical solvers handle the well-posed combinatorial core. Close-reads LLM+P, ToT/LATS, and the constraint-modeling line (DCP-Bench-Open, CP-Agent), then lands on a propose/review loop tied to PiPlan.ai's graph-native planning and an in-progress learned-scheduling-vs-CP-SAT benchmark.

takeaway: put the solver at the center of planning agents, and let the LLM own everything upstream and downstream of the solve.