The Engineer

The Data Point That Changes Priorities

Mason Drxy ran controlled ablations on coding agent orchestration this week. Holding the model constant at gpt-5.2-codex, changes to prompts and middleware alone moved Terminal-Bench 2.0 from 52.8% to 66.5%. That is a 13.7-point swing with the model fixed. The same technique pulled 20% on tau2-bench for gpt-5.3-codex. These are production coding benchmarks, not demos.

A 4-point gap between two frontier models, reported without harness control, is noise. The experiment cannot tell you they aren't equivalent.

Where the Points Come From

Swap the system prompt and the token distribution over the first decision shifts. Reformat tool schemas in middleware and the model's prior over JSON shapes shifts with it. Retry logic hides or exposes parse failures. Truncation policy decides whether the 8K-token trace survives to the next step. None of this is on the model card. All of it is in the harness.

Anthony Maio named the lock-in surface. It is not the harness shell, which LangGraph and deepagents-cli have already commoditized. It is the context pipeline: how repo state gets fetched, ranked, and compressed into the window. That is what compounds with a codebase.

The Cost Dimension Makes This Urgent

Uber reported Claude Code running at $500–$2,000 per engineer per month, burning the full-year AI coding budget in four months. A single Copilot session consumed roughly $221 of inference, over sixty million tokens across 15 messages, against a $40/month subscription. Claude Code enterprise pricing doubled this week.

Three responses landed the same week. Caveman strips about 75% of Claude Code output tokens. Deepclaude proxies to DeepSeek V4 Pro at roughly 17x lower cost. Mistral Medium 3.5 adds self-hosting at 128B dense on 4 GPUs. Which of these actually works is a function of the harness, not the model.

Sources Disagree on What to Build

The principle converges. The implementation does not. One camp (Browser Harness, 592 lines) hands the LLM raw protocol access and lets it write tools at runtime. The other camp (Hermes Agent, SQLite Kanban) builds boring persistent infrastructure. Pick based on trust surface: LLM-generated tools are untested code running in your production environment.

The Architectural Pattern

Pin the harness before A/B testing models. Log the exact system prompt, tool schema serialization, retry policy, and truncation rule on every eval run. Version the context pipeline as production code, not prompt engineering. If 400 tokens of instructions sit buried in 200K of context, the model is not reasoning. It is searching for its own task.

The Mechanism That's Being Exploited

package-lock.json pins the resolved tree at install time. package.json still ships semver ranges. When a transitive dep is compromised and a new patch version is published, anyone running npm install on a fresh checkout — CI, a new contributor, a rebuilt container — resolves the attacker's version before the lockfile is regenerated. The lockfile guarantees reproducibility of an install that already happened. It says nothing about the next install.

The attacker does not need to touch your lockfile. They need to touch a lockfile you haven't generated yet.

What Happened This Week

TeamPCP pushed malicious versions of SAP's npm packages (572K weekly downloads), the Intercom SDK, and the Lightning deep learning framework. The Axios campaign hit 57M+ weekly downloads across 84K dependents and the s1ngularity attack replicated worldwide within minutes of publication. A parallel campaign landed on Ruby gems, Go modules, and Packagist simultaneously. Four ecosystems, one actor.

PromptMink malware was traced to a library added by an Anthropic Claude Opus commit in February. Spoofed attribution or genuine AI-suggested malware, it doesn't matter which. Both paths say the same thing: AI-assisted dependency work needs a human review gate.

The Fix That Ships Today

A 7-day cooldown means a freshly published malicious version is invisible to your installs for a week. That's long enough for the community to flag it. The Axios compromise was caught in 3–4 hours. The malicious versions had already replicated worldwide in minutes. A 12-hour cooldown would have blocked it outright.

The Tradeoff

Legitimate fast-moving dependencies lag by the cooldown window. For packages you control, pin the exact version or override per-dependency. For transitive dependencies from a registry you don't own, the cooldown is the point.

Pair it with npm ci everywhere that isn't a developer explicitly updating — CI, Dockerfiles, rebuilt images. Add fallback Ubuntu/Debian mirrors to CI/CD. The Canonical DDoS this week (3.5 Tbps, 20+ hours) broke every build that pinned a single upstream.

The Mechanism

Datadog published the finding this week: INSERT ... ON CONFLICT DO UPDATE takes a row lock and writes to WAL even when the proposed update changes nothing. The speculative insertion path grabs the lock, emits a WAL record, then discovers the row is unchanged. The "do nothing" branch is not free. It is a full write path that happens to produce an identical row.

One logical upsert. Two physical writes. Sometimes three, if a unique index triggers a second pass.

At Datadog's scale this doubled disk writes and quadrupled WAL syncs. The amplification stays invisible until you graph bytes_written against rows_affected and notice the ratio sits around 2x on upsert-heavy tables. This is documented behavior of the speculative insertion path. The docs say so. Nobody reads that section.

Where This Hurts

• Replication lag spikes on read replicas
• Backup sizes growing faster than data volume
• Archive storage costs climbing with no apparent table growth
• IOPS budget consumed by no-op writes in event processing, CDC, and idempotent API handlers

The Audit

Pull WAL generation per table from pg_stat_statements. Divide by affected rows. Flag anything north of ~2KB per row on narrow tables. Check pg_stat_user_tables.n_tup_ins versus n_tup_upd on each target table. If most upserts resolve to updates, the amplification is worse than the headline number suggests.

Fix Options by Workload

Stripe's Related Pattern Worth Stealing

Stripe published their zero-downtime migration architecture this week: 2,000+ MongoDB shards at 5M QPS with 99.9995% reliability. The reconciliation loop is the part worth copying: row hash comparison instead of row counts, CDC from a pinned LSN, version-gated cutovers. The lesson for any Postgres shard rebalance is simple. Run reconciliation for a week before flipping anything. If the diff count does not trend to zero, the bug is in the dual-write path, not in CDC.

The Trendline

METR's autonomous task horizon measures how long a system runs unattended at 50% reliability. The curve is clean exponential. GPT-3.5 managed 30 seconds in 2022. GPT-4 hit 4 minutes in 2023. o1 reached 40 minutes in 2024. GPT 5.2 hit 6 hours in 2025. Opus 4.6 is around 12 hours in 2026. Ajeya Cotra projects 100 hours by year-end. That is roughly 10x per year with no plateau in the data.

Most agent orchestration shipped in 2026 was designed for the 4-to-40-minute regime. The 12-hour regime is a different system.

What Breaks at Duration

The supervisor dies first. It was written assuming it holds a handle to the work. At 12 hours the process gets restarted, the upstream rotates an API key, a dependency rate-limits, something OOMs. Work has to be checkpointed to durable storage, keyed by a task ID the agent owns, and resumed by whichever worker picks it up.

Observability breaks second. Logs that read fine for one request are unreadable across 12 hours. Traces need segmenting by phase, not by call. If the only signal is "still running," the operator has nothing to decide with.

Context management breaks third. Retry logic assumes transient failures and cheap state rebuilds. Checkpoint intervals assume losing the gap is tolerable. The context window budget was set when the agent ran for four minutes. None of those assumptions survive twelve hours.

Sources Disagree on Current Reliability

METR reports 12-hour autonomous capability at the frontier. ClawMark, the multi-day benchmark, reports low task success rates on sustained autonomous work. SWE-Bench at 93.9% measures implementation capability in isolation. The gap between completing a coding task and sustaining a multi-day project is still wide. Design for bounded autonomy with human checkpoints at natural phase boundaries.

The Architecture

This is workflow-engine territory. Temporal or Step Functions, not HTTP middleware. Durable checkpoints the agent can resume from without replaying tool calls. Idempotency on every side-effecting action. A state store the agent reads from, rather than a transcript it scrolls through. Explicit trust gates on irreversible actions. Separate budgets for compute spend and wall-clock. If the current system treats the transcript as the state, that is the thing to rewrite first.