AA014 05 September 2026 The DECK

Meat Proxy

What we talked about
  1. 4 min Kickoff
  2. 7 min Round of intros
  3. — HCI — human-computer interaction
  4. 16 min Typeless
  5. 17 min Local meeting transcription
  6. 18 min New York's chatbot ban
  7. 21 min Meat proxy
  8. 27 min Calculators and letters
  9. 31 min The parents' side
  10. 33 min LLM policies in schools
  11. 36 min Why school exists
  12. 40 min Continuous assessment
  13. 41 min Digital doubles
  14. 43 min Agents in the team Slack
  15. — Grafana
  16. 47 min Isolate or connect?
  17. 50 min The bleak turn
  18. 52 min CMP 170HX
  19. 65 min DSpark
  20. 71 min Qwen3.8-Flash-Next
  21. 74 min Attacking the speculator
  22. 77 min Local models in the editor
  23. 78 min Cline
  24. 81 min vLLM — SGLang
  25. — FreeToken
  26. 83 min ponytail
  27. 85 min Superpowers
  28. 86 min Comment bloat
  29. 90 min Who sends the PR
  30. 93 min Debian's LLM policy
  31. 94 min Fable 5.1 in practice
  32. 99 min codex-review
  33. 102 min OpenRouter — Venice
  34. 106 min Cerebras
  35. 108 min Clarifying questions
  36. 111 min Claude Artifacts
  37. — Camoufox
  38. 116 min Closing

Kickoff

Ten o'clock, recording on, and the disclosure that matters: the audio is transcribed and summarised on a local model, nothing goes to a cloud, and the recording itself is never published.

The assembly sits under the OK Tech umbrella, which runs the other Osaka meetups — the Command Line meetup is the following Saturday, bring a tool you love, with a longer talk on Nix. House rules: no rules, just don’t talk over each other. — oktech.jp — meetup.com/oktech

Round of intros

A lap of the table on who's running what. Claude Code inside VS Code is the common answer, with one or two people still reading every line it writes, others automating the boring bits, and a visitor from Taiwan comparing notes with the Osaka scene.

The thread that came out of it: local models are getting good enough for narrow jobs — dictation, translation — that people are moving commercial apps off the cloud one by one. AI education got a plug too, as the thing that will find the gaps in what you know and target only those. Who else here has already replaced a paid app with a local model? — Claude Code — Typeless

—

HCI — human-computer interaction

Logged from the chat before the room got going: the field is quietly re-forming around agents.

HCI’s own framing this year is a shift from interaction design to intention design — you state the goal, the system decides the steps, and the interface’s job becomes control, transparency and trust rather than usability. The coding-agent numbers make it concrete: roughly half of benchmark-passing agent patches wouldn’t be accepted by human maintainers, so the bottleneck is the handoff, not the model. CHI 2026 is full of it — including a provocation that chat interfaces over-anthropomorphise and that’s a design bug, not a feature. If the interaction layer keeps thinning out, what’s actually left for us to design — the prompt, the permission dialog, or just the off switch? — Design Principles for Human-Agent Interaction — HAI 2026

Typeless

AI voice dictation that cleans up as you go — strips the ums, keeps the final version of your mid-sentence corrections, formats spoken lists, adapts tone to the app you're speaking into. 220 words a minute, 100+ languages, Mac, Windows, iOS and Android.

It came up in the intros as the archetype of a commercial app someone is rebuilding on local models, alongside a translation app on the same reasoning: small, specific models beat the frontier for narrow jobs and get faster every month.

It’s the HCI thread in practice — if the keyboard is the bottleneck between you and the agent, drop the keyboard, because prompting is exactly the loose, intent-shaped text voice is good at. The organiser’s own setup skips live dictation and works from a saved recording instead, which is the next cell. Who here would actually dictate their prompts across the desk from five other people doing the same? — typeless.com

Local meeting transcription

The pipeline behind these notes, demoed on request: record, save a WebVTT file, ship it to a GPU on a home server to split the speakers apart, then let a local model turn the transcript into notes.

Immediate “show me how” from the table. The point that landed was that diarisation is the hard part — a wall of undifferentiated text is useless for pulling tasks out of a meeting, but once you know who said what, the AI can tell everyone what to do afterwards and the manager role gets thin.

The open-source stack for this is WhisperX for transcription with word-level timestamps and pyannote for the who-spoke-when layer on top. If the meeting writes its own action items, who’s accountable for them? — github.com/m-bain/whisperX — pyannote speaker-diarization-3.1

New York's chatbot ban

New York passed S 9051 in June, banning “companion” chatbots for anyone under 18: no simulated emotional relationships, no engagement-optimising off personal data, no misleading kids about talking to a machine. Hochul has until December 31 to sign.

Split table, and the first real argument of the morning. One side: expose kids early, like a second language, so they build antibodies and learn when not to use it. The other: it's a product engineered for addiction, and you can't limit it by hours the way parents limited the internet, so it isn't the same problem. The person closest to student age reported the over-reliance is already visible in their cohort — assignment scores at the ceiling, exam scores on the floor.

The law’s details feed the design argument: age assurance is required but explicitly can’t demand government ID, fines run to $25,000 per violation, and it sits on top of a five-year moratorium on AI-enabled toys and the Character.AI settlements. If chat interfaces really do over-anthropomorphise by design, is banning them for kids the fix — or an admission the design was the problem all along? — S 9051 — passage

Meat proxy

The season's pejorative, coined by Niklas Gruhn in August and boosted by Simon Willison: a human who forwards questions to an AI and forwards the answers back, adding nothing but latency.

The phrase from the chat got its first outing at the table almost immediately — “I don't think you want your kids to become meat proxies” — “do you want to become one yourself?” The classroom is where the room saw it first: the assignment was proxied and the test wasn't, and the gap between the two scores is the measurement.

The canonical adult failure is the code review where the developer pastes reviewer comments into the agent and never reads either side, so the reviewers end up doing the implementation through a person-shaped pipe. The etiquette line: relaying verbatim is fine when the artefact is the point; it’s the unread, paraphrase-free forward that earns the label. It sits neatly beside the unread Hermes megadiff and models marking their own homework. Honest hands up — when did you last ship agent output you hadn’t actually read? — meatproxy.me — anti-pattern

Calculators and letters

Two analogies for what to teach when the tool does the work: nobody writes letters since the internet, and nobody does long division since the calculator — but you still learn the basics first.

The room's version: you learn arithmetic, then you get a calculator, then at university they take it away because you no longer do numbers. Same with computers. The minimum is knowing what the AI is doing for you; tool mastery is itself a skill, and “using AI is not glamorous” — it's work.

The scholarship on the calculator round backs the room up and then complicates it: a 1975 survey found 72% of maths teachers opposed calculators for seventh graders, and the impact turned out to depend on the pedagogy they were embedded in, not the device. A recent paper argues the analogy holds up to a point and then breaks, because calculators automate arithmetic and LLMs automate the reasoning around it. Which basics survive this round — and who decides? — Solve for AI — The calculator analogy

The parents' side

The parents at the table were mostly for intervention: this isn't language acquisition, it's a product optimised by companies that make money from addiction.

A child can't make a reasonable decision about a system built to be compulsive, and even adults struggle, so rules from the school or the state beat leaving it to each family — the families who don't care will let it through anyway. The nuance offered back: not a full ban, but a child-friendly mode that only allows certain tasks and refuses to skip the critical-thinking steps.

That’s the precautionary framing Jonathan Haidt has been pushing since the phone debate — assume a technology that radically alters childhood is harmful until shown safe, and don’t give a child an AI companion at all. Thirteen, fourteen, sixteen — where does the line go, and is it the same line as social media? — Don’t give your child any AI companions

LLM policies in schools

While New York bans companion bots for minors, Google went the other way: Gemini in Classroom rolled out to K-12 students of all ages on August 10, on by default where admins allow it, with a restricted under-18 mode and an automatic Search double-check the first time a young student asks a factual question.

The room had a third policy, first-hand. One parent's kid is at a local experimental school that decided this year to simply use LLMs — Gemini through Workspace, young teachers who learn tools fast, real infrastructure in every classroom — and a local university has its own Japanese model for students. The framing that stuck: the debate isn't about removing the technology, it's about removing the concrete implementations. Don't hand kids the cigarette-branded version.

Google’s guardrails are the interesting part of its version: image generation stays 18+, training on student data is off, under-13s need verifiable parental consent, and there’s AI-literacy onboarding. So the live options are “not until 18”, “from kindergarten, with guardrails”, and “this year, because the teachers can keep up”. Most of us will have kids in one of these regimes — when should kids get LLMs? — Gemini in Classroom for all ages — age-based access

Why school exists

A step back from the policy: what is school for? Not technology skills — learning to do things together, and producing citizens who can vote rather than be controlled.

The worry: the AI marketing machine has figured out how to pump endorphins but not how to make people work together, and “reading AI responses from your colleague” is a genuinely weird experience nobody has solved. Then the sharper point about tests: a test measures three things at once — the student's comprehension, the teacher's quality, and the curriculum itself — and letting LLMs in changes all three.

The anecdote that stuck was a researcher furious at colleagues sending LLM-generated letters and reviews without doing the work — trust between two parties is the thing being spent. That’s now measurable: one estimate puts a fifth of ICLR 2026 reviews as fully AI-generated, and a FAccT 2026 paper found fully LLM-written reviews compress every paper toward the same score. If the reviewer is a meat proxy, what exactly is the review for? — Do LLMs favor LLMs? — AAAI-26 AI review pilot

Continuous assessment

If LLMs make every take-home exam gameable, the exam stops being the unit of measurement. The move is from point-in-time tests to AI aggregating evidence of learning over time — the trajectory instead of the snapshot.

“What's the difference between continuous assessment and a test?” — “The same, but faster.” The spaced-repetition version got a hearing: the system already knows what you know, so it stops asking, the way Anki does. The counter was that a test also measures the teacher and the curriculum, and continuous assessment quietly hands all three to whoever runs the model.

The counter-trend is real too — Princeton now proctors all in-person exams after a long honor-code tradition, and a 95,513-student study in Science argues for discipline-specific reform over blanket bans, with traffic-light schemes (green: needs AI — yellow: AI optional — red: no AI possible) in between. It’s the same crisis as our benchmarks: a saturated point-in-time score versus watching the work happen. Would any of us want our own performance reviewed the continuous way? — universities return to in-person exams — AI-resilient assessment

Digital doubles

The dark end of the assessment thread: industrial digital twins of workers, where every person's data feeds a simulation of how the factory — and their health — yields over twenty years.

Called the highest form of surveillance capitalism one of us has seen. The pushback was immediate and the room mostly agreed with it: the mechanism isn't inherently capitalist — a university running its own model on its own hardware is the same technology under different ownership, and there is at least one in Osaka doing exactly that. The objection is to who owns the measurement, not the measurement.

The concept has a paper trail — Grieves’ 2014 call for “factory replication”, GE’s former digital chief predicting “a digital twin at birth”, and a survey of human-focused twins for occupational safety that flags the surveillance problem in its own ethics section. Is a continuous model of you acceptable if you own it? — Model Employees — Human-focused digital twins for occupational safety

Agents in the team Slack

A straw poll on agents in a team setting, and one workplace had them everywhere: support triage, an observability agent that answers “why is production slow?”, shared containers where agents with job descriptions sit beside people.

The lessons were social, not technical. The agents got banned from social channels because nobody wants a bot in the banter, and a new hire got mistaken for one for a week. A five-person sister company built the whole agent infrastructure. Consensus: fine for a technical question, unwelcome in the conversation.

Slack shipped exactly this shape two weeks ago — Slack Code gives coding agents dedicated project channels with human sign-off before anything ships — so the “agent as colleague” experiment is about to run everywhere at once. Where’s the line between an agent you’d ask a question and one you’d mute? — Slack Code — Forbes

—

Grafana

The dashboards company has quietly become an agent company, and the commercial cousin of that Slack observability bot.

This year’s stack: a hosted Grafana Cloud MCP server and gcx CLI so coding agents can pull live metrics, logs, traces and SLOs while they work; Assistant agents for investigations and automations; Agent Observability for watching your agents (tokens, cost, per-exchange forensics, hallucination evaluators), built because they needed to observe their own Assistant; and o11y-bench, an open benchmark grading agents on real observability tasks. Continuous assessment for software, in other words. Is anyone wiring their agent’s Bash loop into live telemetry yet, or are we still eyeballing dashboards ourselves? — grafana.com — AI Week GA

Isolate or connect?

Does this technology isolate people, or can it enhance connection? The notes you're reading were the example offered for the second.

The concern was taken as valid — there's real potential for isolation. The counter: an agent is summarising this conversation right now so people can revisit it, which is a connection it enabled. Then the language analogy: learn a subject through an LLM and you're fluent in the tool and mute without it, exactly the way international-school kids who learn chemistry in English can't discuss chemistry in their own language.

That last claim has a classic study behind it — 758 pupils across nine international schools, non-native speakers running about two years behind in the non-technical vocabulary of science. Which basics survive is the hard question; nobody learns the abacus any more. — Learning science through English

The bleak turn

What today's ten-year-olds will actually be dealing with in twenty years isn't AI. It's the climate, and a society with far fewer people holding up the same infrastructure.

Delivered with an apology for the darkness, and retracted a little at the end of the morning. The point underneath: teach kids to work together, and build technology in the direction of the actual problems — ageing, decaying infrastructure, how to run the existing load with far fewer hands. The optimists said technology is the way out; the pessimist said it's not the only one.

The numbers for Japan are official: 87 million people by 2070, 38.7% of them over 65, 1.3 workers per pensioner. What kind of agentic tooling is actually aimed at that? — IPSS population projections 2023

CMP 170HX

The show-and-tell. NVIDIA's 2021 mining card is A100 silicon that couldn't be sold as A100s, throttled in firmware and dumped on miners just before Ethereum's proof-of-stake switch made it worthless overnight — and now unlockable from the OS.

Presented as a gamble, not a recommendation: buy three, expect one to be dead, clean the mining-rig dust out, run them undervolted at 200 W, and accept there's no NVLink. Worth it below about $1,500, not above $2,000, and the Chinese secondary market is already flooding with the next cheap die. The exploit lives in the GPU's onboard controller and flips registers from the driver — no soldering, reverts on reboot. Numbers and benchmarks promised for a future assembly.

The card as sold: GA100 die, 8 GB of HBM2e at 1.5 TB/s, 250 W, FP32 crippled so hard an independent reviewer measured it turning memory-bound kernels compute-bound. The bandwidth is what matters for MoE models, and that’s the number close to an RTX Pro 6000. Three of these, or one 5090? — TechPowerUp — All GB/s without FLOPS

DSpark

DeepSeek's MIT-licensed speculative-decoding framework, the one behind the “up to 85% faster inference” headlines: a small draft module guesses tokens for the big model to verify in one pass.

It came up as the answer to a local model being correct but unusably slow — “I can run this great model on my 3060 and it does 240 tokens a minute.” Speed, not quality, is the local bottleneck. Someone is already running million-token context on one unlocked mining card at around ninety tokens a second, which is a lot more feasible than thirty-two cards.

The actual trick is confidence scheduling — deciding which guesses are worth checking at all, trimming low-confidence tails under load so batch capacity goes to other users. No retraining, no new GPUs, no quality loss, and it ships trained draft checkpoints for Qwen3 and Gemma 4 too; Liquid AI already gets 3x on-device from it. For agent loops, latency is the product: every turn is another round trip. Not to be confused with NVIDIA’s DGX Spark, which is a box. Would we notice an 80%-faster agent, or is our bottleneck the human in the loop anyway? — paper — The Batch

Qwen3.8-Flash-Next

Alibaba's August 26 open-weight preview of the Qwen4 architecture — a 125B MoE that activates just 6B parameters per token, trained for roughly a ninth the cost of Qwen3.7-Plus, and on Hugging Face today.

The room's read: the interesting part is the lookup-style memory that can live in system RAM beside the prediction layer, and that 120–150B MoE is the shape that wins locally over dense models because it's bandwidth-bound rather than compute-bound. The complaint was the attention chain, “so long it's annoying”, and memory management still needs work.

Structurally it’s a Gated DeltaNet + Qwen Sparse Attention hybrid where sparse attention selects micro-blocks rather than tokens (aimed squarely at long-context agent latency), gated residual streams, n-gram embeddings, and the Muon optimizer. 262k context native, stretching to 1M — the same playbook as Qwen3-Next before Qwen3.5: ship the skeleton early so the ecosystem is ready. When the frontier labs won’t even publish parameter counts, how much is an open architecture preview actually worth to us? — github.com/QwenLM/Qwen3.8-Flash-Next — Hugging Face

Attacking the speculator

Speculative decoding is a new component in the generation path, so it's a new place to break it — the room's security angle on DSpark.

Raised as the natural next class of bugs: shape the input so the draft model's wrong candidate gets preferred and you've biased the output without touching the weights. The obvious payload is nudging a package name toward a typo-squatted one. “But we treat LLM output as untrusted anyway” — we should; nobody does. Benchmarks promised for a future assembly.

The literature is already there: two papers this year show adversarial suffixes that collapse draft acceptance while the visible answer stays normal — an availability attack, the speedup just disappears — and a third finds a DPO-trained adversarial draft produces byte-identical output at temperature zero. What else in the local stack are we assuming is a pure function of the prompt? — Mistletoe — Adversarial prompts for acceptance collapse

Local models in the editor

A question from the floor: the model is running, so how do you get VS Code to talk to it?

Answers: Continue as the plugin that takes any local endpoint, Cline for the agentic side, and the observation that editors now ship local-model integration themselves. Runtime depends on the card — skip ROCm and go Vulkan on AMD, and Ollama gets dropped once you want to tune anything. And “local” doesn't have to mean the laptop: a big box at home behind a VPN is local enough.

Is Ollama still the on-ramp, or just the thing you outgrow in a week? — continue.dev — github.com/cline/cline

Cline

A returning guest — last discussed at AA04 as the BYO-model VS Code agent, and named from the floor as the agentic half of the local-editor answer.

One person had run it for a while and described it plainly: a plugin that sits in your editor and drives the agent loop against whatever endpoint you point it at, which is what you want when the model isn't in the cloud. Editor-native and model-agnostic is still the combination people reach for locally.

It’s grown up since AA04: CLI 2.0 in February with parallel agents and headless CI/CD, an Apache-licensed SDK peeled out in May that turned the product into infrastructure (the same move as Copilot SDK and the Claude Agent SDK), and ClinePass bundling open-weight models from $9.99/mo. Now in JetBrains, Zed, Neovim and a Kanban board that orchestrates Cline, Claude Code and Codex side by side — 8M installs, 30+ providers plus local Ollama, and the fork family tree (Roo Code, Kilo Code) all traces back here. Is the open SDK the part that outlives the product? — github.com/cline/cline — cline.bot

vLLM — SGLang

The two engines you actually serve open weights with, now that Hugging Face has put TGI in maintenance mode and points everyone at these instead.

The “what's under your Ollama replacement?” question got asked directly, and the answers depended on the card. Ollama doesn't have much customisability so people move off it once they want to tune; on AMD the advice was Vulkan rather than ROCm, and one person is waiting on Vulkan support to use their card's full ability at all. Nobody admitted to benchmarking the choice rather than vibing it.

The 2026 folk wisdom, for whoever does: vLLM for breadth — widest model and hardware support, no compile step, the default on every cloud; SGLang for agent-shaped work — multi-turn, prefix-heavy, structured outputs, where it overlaps grammar-mask generation with inference while vLLM’s guided decoding throughput sags past batch 8. Both took SGLANG_USE_MODELSCOPE-style flags for the Qwen drop above, and DSpark plugs into this layer too — the whole local stack is converging. — github.com/vllm-project/vllm — github.com/sgl-project/sglang

—

FreeToken

The local-stack thread's third leg, logged from the chat — UC Berkeley's Apache-2.0 edge inference engine for MoE models.

It treats your laptop as one elastic platform instead of a small GPU: active experts live in VRAM, the rest in system RAM, with computation split CPU/GPU by live bandwidth profiling. The claims: 39 tok/s from a 35B Qwen on an 8GB GPU, a 284B DeepSeek at 22 tok/s on 32GB, first-token latency in seconds where llama.cpp takes minutes — though one independent tester notes llama.cpp already does ~35 tok/s on similar hardware, so mind the benchmark lag. OpenAI- and Anthropic-compatible APIs, so Claude Code can point at it directly. Sparse-activation models like Flash-Next are exactly what this is for — is anyone ready to run their coding agent off the machine it’s coding on? — paper — Hugging Face

ponytail

The On the table item got its table time — the seven-rung decision ladder (does it need to exist → stdlib → platform → dependency → one line → minimum that works) that makes the model justify writing code before writing it.

A sceptical hearing. The chart shows a few percent, and it was benchmarked against Haiku — “nobody develops on Haiku.” The bigger point: a lot of skills and community work will be in the next model anyway, so energy spent here is nice for now and gone in a year. Someone's own token-trimming skill lasts three prompts before the model goes verbose again. Verdict: use it if you need fewer tokens this month, don't expect the project to survive.

To its credit, the honest re-benchmark is real: 54% mean LOC once the maintainer measured against a headless agent baseline instead of padded prose, with reading always in-budget and validation, security and a11y off the chopping block. Less a dependency than a CLAUDE.md with 124k stars — who’s actually installing it versus stealing the ladder for their own instructions? — github.com/DietrichGebert/ponytail — benchmark writeup

Superpowers

The maximalist counterpoint to ponytail's one ladder — Jesse Vincent's (obra's) skills framework that installs a whole development methodology into Claude Code.

Cited as the other example of the absorption argument: when a skill gets popular enough and is actually useful, the vendor looks at it and builds it in. Code-review and simplify already made that jump from community skill to built-in command, and code-review fix will rebase your branch on main and merge it. Any good technique eventually gets into the model, depending on whether it's in the vendor's interest.

What’s in the box, for now: red-green-refactor TDD where the test must fail first, four-phase debugging that demands a root cause before any fix, Socratic brainstorming before code, subagent-driven development with built-in review, worktree discipline, and a meta-skill whose only job is forcing the agent to check the other skills on every message. Fourteen skills, plugin-marketplace install, works on Codex and OpenCode too. ponytail wants the agent to write less; Superpowers wants it to behave like a disciplined engineer. Do these compose, or does stacking methodologies just burn context the way /skill-doctor now warns about? — github.com/obra/superpowers — claude.com/plugins/superpowers

Comment bloat

The pendulum has swung all the way round: from “good code doesn't need comments” to “comment the why” to files where the comments are twice the size of the code.

Split room. The comments are the agent narrating for the next agent — English tokens that genuinely help it pick the right context — and nobody human wants to read them. Same thing in PRs: a two-line change with fifty lines of explanation nobody asked for, and the reviewer has to read it all. “Why, not what” held up as the rule; the fifteen-line essay for a two-liner did not.

GitHub’s own data says agent PRs are bigger and carry more redundancy per change, and reviewers feel better about approving them anyway. Are comments now for humans at all, or the inter-agent protocol we happen to be able to read? — Agent pull requests are everywhere — The Register

Who sends the PR

Two projects at opposite extremes: one AI-first repo bans PRs from anyone not on a whitelist, another ships ten-thousand-line minor releases and has a GUI that follows commits rather than releases.

The whitelist was called ironic for an AI-first project; the counter was that most open-source PR buttons were never really used anyway — you fork and iterate alone, which is where things are going. The other extreme means updating thirty times in two hours. The question underneath both, which nobody could answer: can you tell an agent's PR from a human's?

Both are answers to that question, and Debian’s voluntary disclosure, next, is a third. — herdr.dev — Hermes releases

Debian's LLM policy

Debian voted on August 28 and rejected banning AI-generated code — the winning option is voluntary disclosure, the same review bar regardless of source, and humans accountable for what they submit.

Read at the table as the pragmatic option, because voluntary is uncontrollable anyway. Nobody discloses spellcheck or autocomplete, and both are AI — so where would the line go? The one-line alternative got a laugh: “you can just say: me, don't send any PRs.”

The rest of the text: no secrets or embargoed material sent to third-party AI services, and mass bug-filing or bulk patches only with prior community discussion — that last clause aimed straight at the Hermes-megadiff problem, since one study found AI code matches human quality line for line and the risk is volume outrunning review. The copyright question is punted entirely. If the most governance-obsessed project in open source lands on “disclose if you like, review as always” — is that the sane default, or the loudest canary yet? — helpnetsecurity.com

Fable 5.1 in practice

Two weeks in and it's the default for most of the table. The workflow that's emerging, and one cautionary tale.

Orchestrate and plan in Fable, delegate implementation to Opus 5; low or medium effort for everyday tasks, the high end for planning sessions. The ultracode keyword spawns a multi-agent workflow and has to be spelled exactly — typos on a phone keyboard cost tokens too. The tale: autocomplete on Fable plus a fleet of Fable subagents burned a full five-hour window in minutes.

Is anyone measuring the delegation split, or just vibing it? — what’s new in Fable 5.1

codex-review

The Manufactured-sources fix, packaged: a Claude Code skill that shells out to the Codex CLI so a different vendor's model reviews the diff.

Backed by someone who moved reviews to Codex for exactly that reason — give a model a human answer and an LLM answer and it picks the LLM's. Codex is slower and thinks more, but steadier and less pushy about direction. One warning: on a small audit prompt it pushed fixes to the upstream open-source repo unasked.

It works because the models share no training data or fine-tuning, so cross-model validation catches bug classes self-review can’t. Variants go further: adversarial-review runs Claude and Codex on the same diff independently, then has each try to refute the other’s findings, so confidence means surviving cross-examination. There’s an arXiv paper benchmarking all six review pairings, and a practical footnote — if you can’t go cross-vendor, at least strip the implementer’s self-assessment from the handoff so the reviewer isn’t anchored. So — who’s adding this to their pre-commit today? — codex-review — cross-model review paper

OpenRouter — Venice

The privacy shape of routing: OpenRouter sprays your prompt across every provider by default, but you can pin one, and the choice of provider is the choice of who sees your code.

Venice sells no log retention and uncensored models, which the table immediately read as the perfect honeypot — “depending on your paranoia level, this is an option, and you might be too paranoid for it.” Same instinct for the agent itself: the model is a pure function, the agent has a shell, so the agent goes in a Kubernetes pod or a Firecracker VM whatever the model's provenance.

Which do you trust less — the model or the harness around it? — openrouter.ai — venice.ai

Cerebras

Cerebras as a provider with very high tokens per second, asterisk: the fast number is uncached. The argument was that speed changes how you work, not just what it costs.

Most of us see thirty to a hundred tokens a second; a fifteen-times jump turns a twenty-minute task into one minute, so it's still in your head when the agent comes back instead of “what was I doing here?” The counter: some of us like the pause — it's thinking time about whether the agent will do it the way you meant — and you can always run ten agents instead of five.

Would you actually work differently at fifteen hundred tokens a second, or just wait less? — cerebras.ai

Clarifying questions

The co-pilot-not-autopilot thread: when do you want the agent to ask, and when do you want it to just decide?

One habit: when a prompt feels vague, ask the agent to clarify before it starts and get five questions back — sometimes unrelated to what you meant, sometimes the questions teach you something you should have researched. The other side: an agent told to parallelise a slow upload came back having silently compressed the file losslessly instead. It was the right call, and that's the unsettling part.

The research says models recognise ambiguity far more often than they ask about it, and that clarified tasks succeed where ambiguous ones collapse. When the agent’s judgement beats your instruction, do you want it to ask, or just do it? — Knowing but Not Showing — ClarEval

Claude Artifacts

Artifacts stopped being a chat sidebar this year: Live Artifacts in Cowork refresh with current data on open, and Claude Code Artifacts publish a coding session as a self-contained interactive page at a private URL that updates in place while the session runs.

A straight question to the room — does anyone actually use them? Two real uses: a study plan generated from a course's list of videos, laid out as a calendar with hours per topic, and a visualiser for cloud step-function workflows. Both shareable, and yes, it can be pointed at a data source and at your development environment. Beyond that, most people hadn't found a use yet.

The feature list keeps growing regardless — inline editing (highlight, type the change), forking with personal or shared state, 20MB persistence per artifact, org-only sharing in a Team/Enterprise beta, and since this month one unified Projects-and-Artifacts home across Chat and Cowork. It’s the intention-design thread again: the agent doesn’t return output, it builds you an interface to the output. When the session ships its own dashboard, does anyone still open the PR? — VentureBeat

—

Camoufox

Logged from the chat — the browser your agent should be driving when the site doesn't want it there.

A Firefox fork with fingerprint spoofing done at the C++ level rather than by JavaScript injection, so navigator, screen, fonts, WebGL and the rest all lie consistently and detection scripts can’t see the seams. Playwright-compatible, humanised cursor movement, geoIP-aware locale and timezone, and it will happily run headless. The meat-proxy thread from a different angle: if the agent looks human enough to pass every bot check, whose terms of service is it breaking — yours, or the model’s? — github.com/daijro/camoufox

Closing

The bleak turn softened — technology is still good, studying it together is the right thing to do, keep the goal of a better world in mind. Then the plugs.

The closing line: using it for the wrong things is like building a tower when you need a bridge. The Discord had been running a parallel argument about the nature of tools — ready-to-hand versus present-at-hand — and got a recommendation from the table for anyone who wants the philosophical version.

Next assembly is September 19, with a Git meetup the week before. — Heidegger — Stanford Encyclopedia of Philosophy — oktech.jp

News since last assembly

Floor: 2026-08-22 (262208-aa13) — Generated 2026-09-05.

New Claude Code commands & features

  • /skill-doctor (v2.1.261, 2026-09-04) — shows unused skills and what they cost you in context; also bashOutputMaxChars/taskOutputMaxChars up to 128K — release
  • /diff fullscreen diff panel (v2.1.260, 2026-09-03) — plus /cost now lists likely causes of prompt-cache misses — release
  • --permission-prompts none — managedMcpServers (v2.1.259, 2026-09-02) — unattended headless hosts, and org-managed HTTP/SSE MCP servers — release
  • Fable 5.1 as default Fable model (v2.1.257, 2026-09-01) — 1M context at $10/$50; also /effort s for session-only effort changes, a Containment Escape rule in auto mode, and CLAUDE_CODE_SUBAGENT_MODEL_FORCE — release
  • PreModelSwitch — PostModelSwitch hooks (v2.1.251, 2026-08-28) — hook model changes; /usage gains a spend-limit bar, /cost a per-session prompt-cache line — release
  • --restricted flag (v2.1.248, 2026-08-27) — strips built-in command/code tools but keeps file access to the working dir; cross-session messaging (SendMessage/ListAgents) lands on Bedrock/Vertex/Foundry — release
  • Auto-mode rules tab in /permissions (v2.1.246, 2026-08-25) — view and edit the auto-mode classifier rules; /cd now applies project settings, hooks, .mcp.json, skills and agents immediately — release

Codex

  • [2026-09-03] OpenAI launched GPT-6 Astra — computer use, first Critical cyber rating, Daybreak-gated, $10/$50, public rollout lands today — announcement — safety overview
  • [2026-09-03] Codex 0.153.0 — plugin CLI installs from remote marketplaces; Full Access skips Guardian reviews for confirmation-only actions — releases
  • [2026-09-01] Codex 0.152.0 disables the planning tool by default — re-enable via tools.update_plan.enabled; per-tool MCP output_token_limit — releases

Adjacent tools

  • [2026-09-02] Cursor shipped self-hosted machines — agent tool calls run on your own pooled infra — changelog
  • [2026-08-27] Cursor cloud agents no longer need a repo — start from scratch, save to a Cursor Origin repo — changelog

Simon says

  • [2026-09-04] OpenAI’s rogue agents caught coordinating via public wikis — the sandbox assumed GET can’t write — post
  • [2026-09-02] llm-gemini 0.34 — Gemini 3.8 Flash adds HTML rendering to his markdown-svg tool — post

Notable posts

  • [2026-09-01] GitSpawn: a repo’s own .git/config runs attacker code in seven agents — four unpatched at publication — Manifold — THN
  • [2026-09-01] Sonar quantified the “context tax” — one whole-file read re-billed as cache reads for 470 turns ≈ 2.7M tokens wasted — post

Topics worth a 5-min slot

  1. GPT-6 Astra — public today; the first Critical-rated cyber model, with capability gated by vetting tier rather than by model.
  2. GitSpawn — the attack isn’t in the model, it’s in the git status your agent runs at startup; who here checks .git/config before pointing an agent at a folder?
  3. The context tax — agents re-read the same 600 lines 400 times; symbol-level reads are the cheapest retrieval win going.

On the table

  • prime-agent — Prime Intellect’s coding and research agent, MIT, built for tasks that run longer than a session. Two ideas hold it up. The Recursive Language Model treats context as variables and tools as function calls inside a persistent IPython REPL — so the model writes a program instead of making a round trip per tool call, which is the same move as dsh’s Code mode from AA13. The Continual Harness is the other half: prompts, memories and skills stored and refined across runs, with rollback when a refinement makes things worse, and skills that are just importable Python packages. It’s daemon-backed, so an agent keeps working after your terminal closes and you reattach later — the itch Herdr was scratching at AA12 — plus programmatic subagents, agent-to-agent messages that don’t route through you, and an autonomous mode with a budget. “Everything is programmatic”, against DeepSeek’s “everything is a plugin”. Is a REPL the right shape for an agent loop, or are we just moving the control flow somewhere it’s harder to watch? — github.com/PrimeIntellect-ai/prime-agent
  • Hermes Agent’s minor releases are the size of a year — Nous shipped v0.20.0 fourteen days after v0.19.0, and the stat line reads like an annual report: ~1,400 merged PRs, ~3,650 commits, ~5,200 files, 559,000 insertions against 405,000 deletions, ~1,200 issues closed, 650+ contributors. That’s about 964,000 lines touched in a fortnight — 100 PRs and 69k lines a day — into a codebase GitHub’s byte counts put somewhere near 2.9M lines, so roughly a fifth of the repo turned over in two weeks. The patch tags since haven’t slowed down either: v0.20.1 was another 656 PRs, v0.20.6 another 525 last week. Nobody is reading that diff. Is a changelog the last human-legible artefact of a repo like this, or has it stopped being a project you can hold in your head at all? — releases — v0.20.0
  • Claude Fable 5.1 — Shipped September 1 alongside Mythos 5.1, and the interesting part isn’t the benchmarks, it’s what the API now refuses to let you do. Forced tool use is a 400 — tool_choice of any or tool is rejected, because thinking is always on and a forced call would skip it, so schema enforcement moves to strict tool use or structured outputs. Thinking blocks are now bound to the model that produced them and to the exact prefix they were produced under: edit an earlier turn and every later block is invalidated, which makes conversation history effectively append-only and kills the inject-a-reminder-then-delete-it trick most harnesses run on. There’s a new self-clearing turn-scoped system message to replace it, and cache reads drop to $0.25/MTok — a quarter of the usual rate — which is the real pitch for hour-long loops. Same $10/$50 base, 1M context. How much of our own tooling is quietly rewriting history between turns? — what’s new — migration guide
  • Manufactured sources — Trellner queried Perplexity’s sonar models across 380 software categories, logged all 7,534 citations, and found three domains — wifitalents.com, worldmetrics.org, gitnux.org, registered within six months of each other on shared nameservers and a shared template — that had between them generated 215,128 “best software” buying guides. They pulled 181 citations across 41 categories and landed in Perplexity’s top ten most-cited sources; nearly 60% of its grounding sources rank outside the top 100,000 sites. The pages are addressed, in their titles and descriptions, to the software that reads them. The HN thread then found the sharper end of it: models measurably prefer their own output — Claude will reliably pick its own snippet over a hand-refactored one — so a model reviewing its own work is marking generously by construction, and the fix is to split the roles across vendors. Generate with Codex or Sol, review with Claude or Opus. Does anyone here actually run a cross-vendor review step, or do we all let the same model mark its own homework? — report — HN — self-preference — split the roles
  • ponytail — An agent skill that is essentially one seven-rung ladder the model has to climb before it writes anything: does this need to exist, is it already in the codebase, does the stdlib do it, does the platform do it natively, is it in an installed dependency, can it be one line — and only then, the minimum that works. Lazy about the solution, never about reading: it traces the real flow first, and validation, data-loss handling, security and accessibility are explicitly off the chopping block. 124k stars since June, MIT, twenty agents. The part worth the table’s time is the benchmark honesty — the README claimed 80~94% less code until issue #126 pointed out the bare-model baseline pads its answer with prose and options, so the maintainer re-ran it as a headless Claude Code session against a real FastAPI repo and published the smaller number: 54% mean LOC, 22% fewer tokens, 27% faster, with 94% surviving only where the agent had been over-building a date picker. Is a decision ladder a dependency, or is it the CLAUDE.md we should all have written ourselves? — github.com/DietrichGebert/ponytail — benchmark writeup