Archive·tdd.cat
PDF·7 Stories

The Daily Diff

An Engineering Newspaper · Curated by Arpit Bhayani

  /\_/\
 (=^.^=)
 (")_(")
				
  /\_/\
 (=^.^=)
 (")_(")
				

Section
Signal

No stories match the selected filters in today's edition.

Building custom tooling with AI agents deepens security audits

Most teams treat coding agents as glorified line-level reviewers, but that completely misses their real leverage. The highest leverage use case for AI agents in security is building custom compilers, formal models, and analysis tools for targets that have zero developer tooling.

Trail of Bits demonstrated this approach while auditing the Miden virtual machine, a zero-knowledge execution environment with its own low-level assembly language. Rather than asking an LLM to find vulnerabilities directly in unfamiliar bytecode, the team spent six months using agents to synthesize a custom Language Server Protocol server, a decompiler, a static analysis engine, and a formal Lean specification of the executor from scratch.

This agent-constructed toolchain uncovered a severe vulnerability where an unvalidated prover input allowed forging Falcon signatures to steal funds. Furthermore, the Lean specification produced 95 machine-checked correctness proofs for the core library.

Do not ask agents to spot bugs in code they cannot execute; make them build the compilers and verifiers that do the hard work for you.

Personal AI memory should preserve exact timestamps without summarization

Most agent memory systems rely heavily on vector similarity search or recursive LLM summarization. These architectures sound elegant on paper, but they frequently discard the single most critical asset in continuous interactions: the exact chronological record of what was said and when.

Summaries inevitably compress nuance, while vector retrieval often pulls semantically adjacent turns out of order. This strips away conversation trajectory. Lossless-memory takes the contrarian stance that raw conversation logs must remain completely untouched. It builds what it calls a temporal backbone, indexing every utterance along an immutable time axis so that chronological constraints narrow candidate windows before keyword ranking occurs.

By combining explicit time-window filters with a lightweight topic tracker, agents avoid hallucinated contexts without burning tokens on lossy intermediate summaries. For teams building production conversational agents, preserving raw structured logs turns out to be far more reliable than trusting an LLM to remember its own past.

Verifying incoming Git pack files on an enterprise server is shockingly CPU-bound. When validating untrusted repositories, a server cannot simply rely on hardware-accelerated SHA-1 instructions because SHA-1 is vulnerable to chosen-prefix collisions. Instead, Git servers run specialized collision detection routines that inspect the internal hash state on every single block.

This mitigation comes with a brutal performance penalty. In a real-world benchmark inflating 7.7 gigabytes of Git objects, pack verification spent over 84 percent of its runtime inside the collision detection crate, stalling throughput at roughly 900 megabytes per second. Plain hardware SHA-1 runs at over 3 gigabytes per second on the same chip.

To close this gap, the author redesigned collision-detecting SHA-1 using an automated solver to schedule state checks directly across SIMD lanes. The resulting implementation reaches 68 to 81 percent of native SHA-1 throughput, compared to just 29 percent for the legacy crate.

This architectural rewrite cuts Git pack verification time in half without compromising object integrity.

Running multiple coding agents concurrently across a codebase breaks traditional version control. Standard Git workflows only detect collisions at merge time through textual line diffs, which completely fails when agents alter interdependent architectural abstractions in separate branches.

Foremerge addresses this by introducing a local-first coordination protocol built directly above Git worktrees. Instead of waiting for merge conflicts, agents broadcast provisional changesets, semantic claims, and dependency graphs into an SQLite-backed metadata store. An integrated MCP server allows tools like Cursor and Claude Code to register intent before touching disk.

When one agent attempts to refactor an interface while another agent builds a feature assuming the old signature, the system flags the conflict deterministically before code generation finishes. Shifting conflict detection from line-level diffs to semantic intent is essential as multi-agent engineering workflows scale into production.

Data weighting during language model pretraining does not scale the way most practitioners assume. A common heuristic is to optimize data mixing ratios on small models and extrapolate those hyperparameter weights directly to multi-billion parameter runs. Recent empirical research from Jane Street reveals that this relationship is fundamentally non-monotonic.

As models scale from small to medium sizes, they transition from learning broad baseline patterns to absorbing weighted subsets aggressively. However, once models reach larger parameter scales, their representational capacity expands to absorb all available training patterns regardless of sequence weights. The data weighting curve flattens out again.

This finding carries direct architectural consequences for teams budgeting compute on pretraining pipelines. Tuning mix weights on a small proxy model can lead you to over-index on weighting strategies that lose their effectiveness at scale.

Your small proxy model is optimizing for a regime your large model will simply outgrow.

Tokenization is often treated as a solved, negligible step in modern machine learning systems, but high-throughput inference engines and large data pipelines tell a different story. In production inference stacks, tokenization latency and memory allocation patterns regularly turn into unexpected bottlenecks, especially when scaling across multiple CPU cores.

The release candidate benchmarks for Hugging Face Tokenizers v1 show substantial architectural improvements over earlier versions. Single-encode decoding throughput jumps between 5.4 and 8.8 times compared to version 0.23 across multiple model families. Under native multi-threading, the engine achieves 76 percent of linear scaling across eight CPU workers by minimizing thread contention and memory churn on the live heap.

Optimizing text processing throughput before data ever hits the GPU is essential for building scalable inference infrastructure.

Decentralized worker polling scripts quickly collapse under high multi-tenant concurrency.

Blacksmith originally scheduled continuous integration jobs by having host node agents poll a shared Redis instance, running serial Lua scripts to verify rootfs versions, tenant limits, and hardware capacities. While executing atomic Lua scripts in Redis avoids state races between hosts, this model degrades when scaling past millions of jobs per day because polling traffic saturates memory databases and prevents globally optimal placement.

Scaling past ten million daily jobs required moving to a centralized scheduler. By evaluating cluster capacity holistically rather than one node at a time, the new architecture guarantees tenant fairness, eliminates hot spots, and maximizes hypervisor core density. Crucially, the engineering team relied on discrete event simulators to model race conditions and queue starvation before deploying to production clusters.

Distributed systems at scale eventually outgrow cooperative worker polling in favor of centralized orchestrators.