AA013 22 August 2026 The DECK

Watermarked Riddles

On the table

  • A2A moves under the AAIF — Google handed Agent2Agent to the Agentic AI Foundation, so the protocol for agents discovering each other and delegating work now sits in the same Linux Foundation house as MCP, goose and AGENTS.md — 150-odd organisations behind it, IBM’s ACP already merged in, and version 1.0 carrying signed agent cards for cryptographic identity. The tidy story is one vendor-neutral stack: MCP for tools, A2A for agents talking to agents. The less tidy one is Seekr’s “AI game of telephone” — each agent treating the last one’s output as trusted fact rather than a claim to check. Is anyone here actually running agent-to-agent messaging, or is a harness spawning its own subagents still the whole of it? — Techstrong AI — aaif.io
  • VibeVoice — Microsoft’s open-source voice stack, and a case study in what happens when a lab ships something too good — the original TTS model did 90 minutes of expressive multi-speaker conversation from a 1.5B base, then Microsoft pulled the code a fortnight later after finding “instances where the tool was used in ways inconsistent with the stated intent”. A community fork had already backed it up. The official repo came back as ASR — 60-minute audio in one pass with speakers and timestamps, 50+ languages, now an ICLR 2026 oral and a BitNet build that runs on three CPU threads. MIT licence on the way out the door, so the takedown bought exactly nothing. When the weights are already mirrored, is pulling the repo governance or theatre? — github.com/microsoft/VibeVoice — community fork
  • Voxtype — the other end of the same thread — push-to-talk dictation that runs entirely on your machine, MIT, Linux and Apple Silicon, no cloud and no telemetry. Seven engines to pick from including Moonshine from AA11, 1600+ languages with CJK properly handled, Wayland-first typing so it lands in a terminal or an editor rather than just a browser box. Which makes it a plausible front end for talking to a harness instead of typing at it. Given how much of our day is now prose aimed at a model — is dictation the input we’ve been ignoring, or does thinking-by-typing do work that talking doesn’t? — voxtype.io
  • Anthropic watermarks Claude’s output — every model launched on or after 2 August carries an invisible mark: SynthID-style statistical watermarking in generated text, C2PA provenance metadata on generated files, across the API, Claude, Claude Code, Cowork and Tag — and rolled out worldwide rather than only where the EU AI Act’s Article 50 demands it. Detection tooling is promised, but a hit means “Claude touched this”, not “Claude wrote this” — proofread or translate your own paragraph and it comes back marked. Anthropic concedes a re-save or a screenshot strips the file metadata; the paying-customer reaction has been loud and mostly negative. Two for the table: does the code your harness writes carry a mark you can’t see, and would you want it to? — anthropic.com — how it works — support — how Claude marks content
  • Conspiracy corner — are the comments the watermark? — no evidence, entirely a theory of the table, but the mechanism is at least the right shape. Statistical text watermarking works by nudging token choice inside a keyed pattern, and it needs entropy to hide in — a line of code that could only have been written one way carries no signal. Comments and prose do. Hence the theory: the comment spam nobody asked for is carrier payload, the quality hit is the cost of paying it, and the riddling, over-hedged prose we complained about at AA12 is the same tax on the chat side. Testable, roughly — comment density on a fixed task, watermarked model versus an older one. Does anyone want to actually run it before Saturday, or shall we just enjoy the theory? — SynthID — AA12’s Opus 5 thread
  • Output styles — the official answer to the same complaint, and worth a look before we blame the watermark. Styles rewrite the system prompt itself rather than appending to it like CLAUDE.md does, and there’s now a Concise built-in — lead with the result, skip the preamble and the narration, same engineering underneath — which reads as Anthropic shipping a fix for exactly the prose everyone’s been moaning about, alongside Proactive, Explanatory and Learning. Custom ones are a markdown file in .claude/output-styles/, and note the sharp edge: they drop Claude Code’s built-in engineering instructions unless you set keep-coding-instructions: true. /output-style is gone — it’s /config now, and it needs a /clear to take. So: is a system-prompt toggle the honest fix for a model that won’t shut up, or are we configuring around behaviour that shouldn’t be there? — docs — output styles

Demo — Claude in Chrome

Live, on the projector — the extension that puts Claude in a side panel next to the page and then lets it drive: clicking, typing, filling forms, working across tabs, all inside the browser session you’re already logged into. Out of the 1,000-user Max waitlist it launched on, now in beta on every paid plan — and the same machinery Cowork reaches for when a job needs the web.

Worth watching for on the day:

  • Per-site permissions — you approve each site before Claude can act there, and consequential actions ask again. Does that friction survive contact with real use, or does everyone click through it?
  • Prompt injection — the standing objection, and researchers have kept landing real injection chains against it all year. A page it reads is a page that can talk to it
  • Logged-in surface — it reads the live DOM, not a cached crawl, so everything behind your auth is in scope. That’s the whole value and the whole problem
  • The extension bet — OpenAI retired the standalone Atlas browser on 9 August and moved the agentic bits into a Chrome extension. Two labs, same conclusion: don’t ask people to change browsers

— claude.com — Claude in Chrome — Zenity Labs — threat analysis

Deep dive — DeepSeek Harness

dsh landed on 13 August, MIT, developer preview, and took roughly 95,000 GitHub stars in two days. We flagged the Bloomberg piece about DeepSeek’s “Harness Team” at AA12 the day before it shipped — this is the thing itself.

The claim — Agent = Model + Harness. Models are already swappable behind standard interfaces; the harness — loop, context, tools, permissions, state, UI — isn’t. So make every one of those a plugin, with no privileged core to patch. You extend by mounting alongside, never by forking.

The kernel — built on Cordis, a general-purpose plugin meta-framework rather than something invented for this. Its pitch is “spatiotemporal composability”, which is two concrete problems — temporal, unwinding a plugin’s side effects cleanly when it unloads, and spatial, letting dependents react correctly when a dependency reloads. That’s what makes hot-swapping the agent loop sane rather than a restart.

The extension points — everything hangs off a context object:

  • Add a model provider — register an adapter on ctx.llm
  • Add a model-facing capability — register on ctx.tools
  • Confine spawned processes — a ctx.sandbox backend
  • Intercept any request or tool call — listen to the agent or tools event waterfalls

Plugin categories run models — tools — skills — sessions — sandboxes — storage — loops — scheduling — UI. Even session-title generation is a registerable provider, which reads as either purist or unhinged depending on taste.

What falls out of it

  • Config, not code — swapping the loop or the storage layer is a config edit, not a patch
  • One event stream — an append-only session log records everything the model saw: system prompts, reasoning, tool calls and results, subagent scheduling, context injections. resume, fork, search and replay are all just reads over that log, rather than four separate features
  • Presets are just plugin sets — standard is the full coding agent; minimal is bash and str_replace_editor only, for clean benchmark numbers; code generates a TypeScript SDK and lets the model write a program against it, collapsing multi-round tool sequences into one call; creator is for building your own
  • Sandboxing — Landlock on Linux, Seatbelt on macOS, ACLs on Windows, over about 300 lines of C11
  • Scale — a TypeScript monorepo, ~57 package groups and ~500K lines, still 0.1.0-rc.5 with the README shouting about compatibility-breaking changes

The sharpest review going around argues it isn’t DeepSeek’s Claude Code at all — it’s a bet on owning the agent-runtime layer, and it’s not the tool for anyone who just wants to write code today. Claude Code’s plugins bolt onto a fixed core — skills, hooks, subagents, MCP. dsh says the core is plugins. Is that where we all end up in two years, or a config-file religion that makes the simple case worse? — deepseek.com/harness — github.com/deepseek-ai/deepseek-harness — The New Stack — in-depth review

Cordis — “Linux for AI agents”?

The kernel dsh is built on isn’t DeepSeek’s. Cordis is an independent MIT project by Shigma — Yifan Shi — and it’s been the plugin loader under Koishi, a cross-platform chatbot framework, since 2019. It was never designed for agents. The problem it was built for was a plugin ecosystem rotting as thousands of community plugins got installed, updated and removed, and its defining idea followed from that: unloading a plugin must completely undo everything it did. Every registration hands back a disposer, via ctx.effect() or a helper, and dependents re-wire themselves when a dependency reloads. Do that properly and reconfiguring a running system stops being a restart.

DeepSeek vendored it, then published an 80-page preprint with Peking University formalising it — A Programming Paradigm for Spatiotemporal Composability — and the framing that’s stuck since is agent microkernel: provable contracts for the planner, the memory, the tool caller, so any part of the loop swaps out without breaking the rest. Fireship put it more bluntly — “Linux for AI agents” — which is the pitch in five words, and also the bit to argue with, since microkernels have a long history of being architecturally right and losing anyway.

The detail worth sitting with — the agent-runtime layer every lab is now racing to own turned out to be a seven-year-old chatbot plugin loader with 6.7k stars and a README warning the API is unstable, holding up a project that took 95k stars in two days. Is “the OS for agents” a real layer someone’s going to own, or the analogy we reach for whenever we can’t name what we’re building? — Fireship — DeepSeek is back — github.com/cordiverse/cordis — Cordis primer — tutorial

What we talked about

Qwen3-ASR-1.7B

The third speech thing on the table this morning — Alibaba’s small transcription model off Qwen3-Omni, Apache 2.0, 52 languages and dialects with 22 of them Chinese, offline and streaming from one set of weights, and it handles singing and speech over background music rather than falling over. 1.63 WER on LibriSpeech clean puts it level with or past GPT-4o and Gemini 2.5 on the English and Chinese sets, and a separate 0.6B forced aligner bolts on word-level timestamps. Sits right next to VibeVoice’s ASR pivot and Voxtype’s engine list — if 1.7B under Apache 2.0 gets you this close on transcription, what’s left that justifies sending audio to an API? — huggingface.co/Qwen/Qwen3-ASR-1.7B

Graph databases

Where the room went after transcription — if an agent needs memory that survives the session, is a graph the right shape for it? Entities and relationships written as you go, episodic nodes timestamped against users and topics, semantic facts accumulating into something you can actually traverse, and MERGE keeping it from duplicating itself. Neo4j has an agent-memory library and an MCP server for exactly this, and there are community ones doing knowledge-graph memory over the same stack. It’s the same instinct as Graphify from AA11 and beads’ dependency graph from AA12 — structure the context instead of re-grepping for it. Counter-argument worth hearing: reach for a graph only when deep traversal is genuinely the product, otherwise it’s Postgres with extra operations. Which is it for the agents you’re running? — Neo4j — context graphs for agents — mcp-neo4j-agent-memory

Graph and vector hybrid databases

The follow-on question — if you want both the relationships and the semantic search, is that one engine or two? Two is the common shape: a graph for traversal next to a vector store for similarity, which is what Kùzu’s own hybrid-RAG workshop demonstrates by pairing it with LanceDB. One engine is the tidier pitch — FalkorDB does graph plus vector aimed squarely at GraphRAG, Neo4j has vector indexes, and Postgres people just bolt Apache AGE onto pgvector and keep one database. The cautionary tale in the room: Kùzu, the embedded favourite for prototypes, got archived after Apple picked up the team, and GitLab’s knowledge-graph project has been shopping for a replacement ever since. So — one engine that does both, or two you can swap when one of them disappears? — falkordb.com — Kùzu — hybrid RAG workshop

RAG

Where the database thread landed — the argument that you might not need any of it. Claude Code has never shipped a vector store; it greps, globs and reads files, while Cursor indexes the codebase, and both work fine. An Amazon Science paper at AAAI 2026 clocked agentic keyword search at 94.5% of RAG’s faithfulness with no vector store at all, and the case for it is mostly operational — an index is a second system to build, sync, permission and leak. The honest position the table arrived at: “RAG is dead” is clickbait and “always RAG” is cargo cult, what actually died is chunk-and-pray, and lexical search is superb on code and blind to a diagram. So where’s your line — grep until it hurts, or is there a corpus in your work that genuinely earns the embeddings? — Is RAG dead? Long context, grep, and the end of the mandatory vector DB — LightOn — retrieval in the age of agents

What “RAG done properly” actually looks like, since the previous thread left it at chunk-and-pray being the thing that died. Keyword search nails exact rare tokens — an identifier, a SKU, an error code — and embeddings nail paraphrase, and neither wins across all query types. You can’t just average the two, because BM25 scores are unbounded and cosine similarity lives in −1 to 1, so the standard move is reciprocal rank fusion — fuse on rank, not score, with a smoothing constant around 60 — then hand the top ~150 to a cross-encoder reranker and keep 20. Roughly a 7% NDCG lift over either method alone, which is real but not magic. The question that fell out of it, given where the grep argument ended up: for a codebase, is the BM25 half of this just rg with a scoring function bolted on? — Hybrid search — BM25, vector and reranking reference — Together AI — contextual RAG, Anthropic’s recipe

pgvector

The boring answer that kept winning the argument — vector similarity as a Postgres extension rather than a second database. Exact and approximate nearest neighbour, L2, inner product and cosine, HNSW and IVFFlat indexes, and the vectors sit in a normal table, which means joins against your actual data, real transactions, and the backup and point-in-time recovery you already run. That’s the whole pitch: no sync job, no second thing to permission, no separate outage. It also quietly answers the hybrid-search thread, since Postgres brings its own full-text search — both halves of the fusion in one query. Anyone here outgrown it, or is “just use Postgres” still the correct default until something proves otherwise? — github.com/pgvector/pgvector

InfluxDB

The fourth shape of the morning, after graph, vector and relational — time series. InfluxDB 3 is a full rewrite in Rust on the Apache stack: Arrow in memory, DataFusion for queries, Parquet on object storage, SQL and InfluxQL over the top, with Core under MIT/Apache 2. Which matters here because agent telemetry is time series — token spend, tool-call latency, session events — and it’s the same shape as dsh’s append-only session log from the deep dive, just with a query engine attached. Practical note for anyone pinning images: on 15 September the Docker latest tag flips to InfluxDB 3. Is watching a fleet of agents a monitoring problem we already have the tools for, or does it want something purpose-built? — influxdata.com — github.com/influxdata/influxdb

ClickHouse

The other answer to the telemetry question — columnar OLAP, Apache 2.0, built for firing analytical queries at absurd volumes of append-only rows. The detail that made it land in this conversation rather than a data-engineering one: ClickHouse bought Langfuse in January, so the open-source LLM-observability tool most people reach for is now owned by the database underneath it. Langfuse’s own framing is that tracing and evaluating agents “is fundamentally a data problem” — trace trees, graph views of how an agent moved through its turns and tool calls, cost and latency per call. Which reframes what we were arguing about: is agent observability a new discipline, or is it just OLAP with a nicer front end? — clickhouse.com — ClickHouse acquires Langfuse

Fortran

Sixty-odd years of working numerical code that nobody wants to touch, which makes it the honest test of agentic migration. The best example going is a five-phase pipeline that translated a 19,000-line Fortran land-surface model into JAX — static dependency analysis to order the modules, compile-and-repair loops running unattended, and, the part that matters, a Fortran reference oracle enforcing numerical parity module by module before anything integrates. Result was a differentiable model and a 24× speedup. The counterpoint landed this month: a transpiler paper arguing that probabilistic translation undermines reproducibility precisely where you need it, and a compiler pass doesn’t. Note what made the agentic version work — not a better model, but an oracle to check against. Do you have one of those for the migration you’re putting off? — Systematic LLM translation of legacy scientific code — A Fortran general-purpose transpiler

Monitor

Desk hardware as an agent problem — how much screen do you actually need to run a fleet? The room’s habit is a pane per agent, which means the constraint stops being the model and starts being pixels: ultrawide versus two panels versus one vertical for logs, and how many tiles you can hold before you lose track of which one is blocked on you. Straight back to the AA09 thread about typing a prompt into the wrong session and watching the wrong app get translated. The real question underneath it — at what point does watching agents stop being a thing you do with your eyes and start needing a dashboard?

Selenium

Straight out of the Claude in Chrome demo — the twenty-year-old way to drive a browser, and whether agents make it obsolete or more necessary. WebDriver BiDi has quietly closed most of the old gap, adding a WebSocket so the browser can push console logs, network events and DOM mutations instead of being polled, on a W3C standard rather than a Chrome-only protocol. Playwright still has the official MCP server and the better ergonomics for greenfield agent work; Selenium has a community one and tens of thousands of enterprise pipelines that aren’t going anywhere. Jason Huggins, who started Selenium, is now building Vibium — plain-English tests on BiDi — which tells you where he thinks this goes. The caution worth repeating: a Selenium script fails on a broken locator, an agent fails because it picked the wrong action, so you’re testing the harness as well as the app. Deterministic script or agent — which one do you actually want guarding your deploy? — selenium.dev — github.com/SeleniumHQ/selenium

grill-me

Matt Pocock’s skill for the failure mode everyone recognises — you describe a feature, the model happily fills in the gaps you left, and the code you get back answers a question you never asked. grill-me inverts it: before any code, it interviews you one question at a time and walks down each branch of the design tree, resolving the upstream decisions before the downstream ones, with a recommended answer attached to every question so you’re editing a draft instead of filling in a form. It reads the codebase first so it doesn’t ask what it could look up. Same instinct as the Opus 5 complaints from AA12 — the fix is prose, not a model. Install with npx -y skills add mattpocock/skills --skill grill-me --agent claude-code. Is being interrogated for ten minutes cheaper than the rewrite it saves you? — github.com/mattpocock/skills

Buzz

Block’s answer to the question the A2A item left open this morning — where do humans and agents actually talk to each other? A Slack-shaped workspace built on Nostr, with channels, threads, DMs, voice and repos, where agents are members rather than bots: each has a cryptographic identity and its own permissions, reviews code, and runs approved automations next to people. Harness-agnostic, so Claude Code, Codex and Block’s own goose can share a room. Apache 2.0 and self-hostable, with a free hosted version. The identity detail is the same instinct as A2A’s signed agent cards — if an agent participates, it has to be attributable. Would you give one a seat in your team chat, and what would it have to prove first? — block.xyz — introducing Buzz — github.com/block/buzz

Grok Bot

The teammate framing again, this time from SpaceXAI — always-on agents with a persistent cloud computer each, browser, filesystem and terminal, signed into your existing tools with your own credentials, working multi-step jobs end to end and only coming back when something needs approval. The pitch is explicitly for software with no clean API or MCP server: it drives the app the way a person would. Now bundled into Cursor plans, which is what the SpaceX acquisition looks like in practice. The detail the room enjoyed: the launch page says each Bot gets its own computer, while the documentation published the same day says they share one and that separate Bots are not a security boundary. So — an agent with your credentials and a browser, sharing a machine with your other agents. Where’s the blast radius? — x.ai/bot

News since last assembly

Floor: 2026-08-15 (AA12). Generated 2026-08-22.

New Claude Code commands & features

  • “Concise” output style (v2.1.237, 2026-08-20) — built-in style that leads with the result and skips preamble and narration, while doing the engineering as thoroughly as Default; error reports, security warnings and destructive-action confirmations stay complete — release
  • ANTHROPIC_DEFAULT_MODEL (v2.1.236, 2026-08-19) — set the default model for new sessions from the environment — release
  • notify_when_idle on SendMessage (v2.1.236, 2026-08-19) — ask another session to tell you when it goes idle; opt-in, one-shot, macOS and Linux — release
  • Auto-continue at usage limit (v2.1.234, 2026-08-17) — sessions pick themselves back up when a claude.ai limit resets, configurable in /config — release
  • /goal check-ins (v2.1.234, 2026-08-17) — long-running background work reports in every 30 minutes; CLAUDE_CODE_GOAL_CHECKIN_MINUTES=0 opts out — release
  • keybindingFlavor: "readline" (v2.1.238, 2026-08-20) — Bash-style word deletion, so Ctrl+W kills back to the previous whitespace — release
  • spellcheck setting (v2.1.235, 2026-08-18) — underlines misspelled words in the prompt via aspell, hunspell or ispell — release
  • /claude-api upgrade (v2.1.239, 2026-08-21) — migrates Python projects from anthropic 0.x to 1.x — release

Claude Code — other notes

  • [2026-08-17] GitLab merge requests get a footer and statusline badge — !N with draft, pending and green states, via an authenticated glab — release
  • [2026-08-19] macOS sandbox wildcard read-denies now win inside allowed read regions, so **/.env actually holds — release
  • [2026-08-20] Cross-session messaging lands on Windows; plugins synced from claude.ai appear as name@synced — release

Codex

  • [2026-08-20] 0.149.0 — an interactive codex agents dashboard, codex queue to message a running session, /cd /pwd /cwd, wider codex doctor network diagnostics, and SDK reasoning effort up to max and ultra — release
  • [2026-08-21] 0.150.0 alphas landing daily — six in two days — releases

Adjacent tools

  • [2026-08-17] Cursor Origin — Cursor now hosts your code: repos, pull requests, browsing and GitHub sync, on paid plans. Read past the “GitHub alternative” framing — pushes still go to GitHub, which stays the source of truth — cursor.com/changelog
  • [2026-08-19] Cursor cloud agents go always-on — subscribe to an event source, wake on a PR or a Slack thread, and hold a goal until it’s met, plus custom modes and subagents on their own machines — cursor.com/changelog

Simon says

  • [2026-08-16] “Qwen 3.8 27B is excellent, but it defaults to wildly overthinking things” — archive
  • [2026-08-19] “Conceptual integrity and counting lines of code” — archive
  • [2026-08-20] ChatGPT search is now using the site: operator at scale, per Promptwatch — archive

Notable posts

  • [2026-08-18] Google moved A2A under the Agentic AI Foundation — the agent-to-agent protocol now sits in the same Linux Foundation house as MCP, goose and AGENTS.md — Techstrong AI
  • [2026-08-20] The Concise announcement crossed 500K views in hours — and Boris Cherny called it “a band aid”, which is the more interesting half of the story — daily.dev

Topics worth a 5-min slot

  1. Concise output style — Anthropic shipped a fix for exactly the over-narration everyone’s been complaining about, and one of its own called it a band aid. Toggle, or symptom?
  2. Cursor Origin plus always-on agents — Cursor now hosts the repo and runs agents that wake on events. Does the harness swallow the forge?
  3. Sessions that manage themselves — notify_when_idle, auto-continue at usage limit, /goal check-ins. Fleet management is arriving one small flag at a time.