The Engineer

Why the number goes negative

A signed 32-bit integer stops at 2,147,483,647. A 149 GB scan is roughly 160 billion bytes. Write that into an INT32 column and it wraps to a small negative value, which is the -1.5 GB Espresso AI reported. Nothing errored. The unload wrote a file, the job went green, and the corruption is deterministic. It lands on exactly the rows with the largest values.

Trace the propagation before ranking the urgency. Sum bytes scanned per team and the heaviest queries subtract from the total, so chargeback under-bills the biggest consumer. Sort an optimization backlog descending by bytes scanned and the worst offenders sink to the bottom. Join exported telemetry against a job registry on any of the nine wrapped columns and rows silently fail to match. The remedy is two lines of SQL plus one policy: cast the affected columns before export, then add a schema assertion that fails the pipeline on negative bytes, negative durations, or negative row counts. Platform telemetry is data nobody on the team wrote and nobody tests. Validate it at the boundary like any third-party payload.

The pragma you tuned is code upstream never ran

Tailscale spent six months tracing repeated database corruption to a race between SQLite's WAL checkpointing and write transactions, a bug that sat latent for 16 years. It surfaced for them because they checkpoint aggressively and manually. That is the transferable part. The default path collected 16 years of accidental fuzzing from millions of deployments. A configuration hand-tuned for throughput gets whatever coverage the local suite gives it, which is usually none. Good engineering, wrong test population.

So the work is an inventory, not a patch: enumerate every embedded SQLite deployment, write a one-line justification for each non-default pragma, pin a post-fix version, and put PRAGMA integrity_check into a startup or health check so corruption arrives as an alert instead of a support ticket.

CDC gives you ordering, not idempotency

Change data capture buys retryable, ordered, observable downstream writes. It does not make a destination safe to receive the same event twice, and replay after recovery is precisely when it will. Classify every sink into one of three buckets:

1. Idempotent by upsert. The write is naturally convergent.
2. Idempotent by key. A durable dedupe key, such as source LSN plus primary key, persisted atomically with the side effect.
3. Explicitly at-least-once tolerant. Double-counting is documented as acceptable by an owner.

Anything unclassified is a duplicate-write bug waiting for the next replay, when nobody is reading the diff carefully. Metrics double, side effects fire twice, and the incident gets blamed on the replay rather than the sink.

The same discipline applies to numbers you did not produce

There is a tension inside the data reporting. The same material arguing that a valid benchmark must disclose workload shape, cache state, and scaling limits also carries a 3.4x DuckDB-versus-EMR-Serverless claim measured on 1,000 JSON files, with no cache or cold-start disclosure. At that size the ratio is mostly cold-start tax and single-threaded JSON parsing. The direction is probably right: single-node wins the sub-scale tier. The ratio does not transfer.

The security column of this briefing rhymes exactly. CSO First Look describes a defense that never starts rather than one that fails. Same reflex in both columns: assert the invariant on the path you rarely take.

Every correctness failure here came from running a trusted system slightly off its happy path, which is also where the untested code lives.

The registry key that decides whether the agent runs

Safe Mode boots a minimal service set. The list lives under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal (or \Network). Most third-party endpoint agents never registered there. So the chain is dull: set the BCD safeboot flag, optionally add the payload's own service under the SafeBoot key so it does start, force a reboot. On the far side, tamper protection, behavioral analytics, and agent self-defense are not defeated. They are runtime constructs, and there is no runtime.

Categorization drives the response. This is a control-plane attack, the same species as deleting a cloud audit trail before acting rather than evading its detection rules. The conditions under which the logic executes get removed. Snatch and several ransomware-as-a-service families did this years ago, per CSO First Look. Continued success says more about default endpoint posture than about Akira's sophistication.

The encryptor bug removes the worst option

The minimal environment broke Akira's own encryption routine. Some victims got corrupted rather than encrypted data. That is bad news. Paying for a decryptor was already a poor option; now it is not an option. Assume the next build fixes the encryptor, which puts the defender window at weeks, not quarters.

The honest test is a restore drill run on the assumption that the data is unrecoverable in place and no decryptor will ever exist. Take the largest stateful service, restore from immutable off-domain backups, measure actual RTO against the runbook number. The gap usually shows up in restore-and-verify, not in the copy.

The management plane is the force multiplier

The Hacker News reports a patched VMware vCenter flaw chained by a suspected China-nexus actor into Babuk-derived ransomware, exploited within days of the fix landing. Two engineering consequences follow. First, the hypervisor management plane is tier-0 infrastructure: dedicated management network, MFA on an identity independent of production SSO, immutable off-domain backups, timed restore drill. One control point encrypts the entire VM estate.

Second, the payload no longer identifies who is at the keyboard. A suspected state-nexus actor shipping commodity ransomware means motive cannot be inferred from encryption. Branch into exfiltration hunting on every encryption event, before the restore destroys the evidence.

Where the reporting is thin, say so. The vCenter and macOS Screen Sharing items arrive with no CVE identifiers and no affected version ranges, so scope exposure from vendor advisories and the national CSIRT feed rather than from summaries. The Akira mechanism is specific enough to build detections against.

Detections worth writing this sprint

1. Alert on writes to the BCD store and to the SafeBoot service keys. Legitimate changes are rare and operator-initiated, so the false-positive budget is small.
2. Correlate forced reboot plus agent heartbeat loss into one high-severity signal. Endpoint telemetry is gone across the boot, so identity, DHCP, and DNS re-registration events carry the detection.
3. Test one nuance in the local image: BCD modification can perturb measured-boot PCRs and trigger a BitLocker recovery prompt, which breaks unattended attacker automation. A genuine speed bump with real support load. Verify it before claiming it as a control.

Akira does not bypass your EDR. A boot flag decided the agent would never start, before any detection logic existed.

What Cordis actually guarantees, and under which assumptions

Harness runs on Cordis, a runtime with two invariants. Effects reversible: a component records how its changes get withdrawn. Dependencies reactive: dependents deactivate before a service they need is removed. Under reversibility, declared dependencies, and independent effects, the paper claims a mutated system reaches the same observable state as one built from scratch in that configuration. Saga pattern plus topologically ordered teardown, moved out of application code and into the runtime. Real tools violate all three assumptions.

Provenance persuades more than the theorem. Cordis came out of Koishi, a four-year-old chatbot framework with thousands of community plugins running on QQ, Telegram, and Discord; its creator now works at DeepSeek, per Turing Post. That is plugin lifecycle hardened by an untrusted third-party ecosystem, which is the code most in-house agent frameworks never had to write.

Creator mode: lacking a capability, the agent writes a temporary plugin, asks permission to load it, uses it, removes it. Codegen plus dynamic loading inside the process boundary. Unloading does not undo what the plugin did. Read the sandbox implementation locally, away from production credentials.

Classify effects before trusting any rollback story

Cordis buys rows one through four. Row five is a product decision no formalism touches, and row five is where agent incidents originate. Cheap port: three fields per tool registration, side-effect class, compensating action or an explicit irreversible flag, declared dependencies, plus enforced deactivation order on unload. Days of work, and half-applied multi-step trajectories become something a chaos test can exercise by yanking a dependency under load.

Two other findings point at the same layer

Import AI reports Inherent's Faraday, a 27B model post-trained on Qwen-3.6-27B that drives OpenAI Codex as a tool, reportedly beating vanilla Opus 4.8 and GPT-5.5 on 73% of in-distribution ML tasks and 60% of held-out science tasks. Self-reported: rubrics generated by Claude Opus 4.7, scoring by a Codex-based judge, so training signal and eval share a topology. Clone that stack and the policy learns to satisfy rubric text. DiG-bench, same reporting, is cleaner. Several frontier models cleared Tier 6 only when given a harness, so the leaderboard ranks model-plus-scaffold.

Lenny's Newsletter, third angle. Codex could not emit a valid CAD file; Codex driving CLO's interface could. Orchestrator plus deterministic executor, and the driven surface sets the operational properties. GUI driving has no idempotency, no transactional semantics, no error taxonomy, so a failed step and a slow step look identical from outside.

DeepSeek's own behavior is the disagreement worth noticing. This material says orchestration is where value accrues; DeepSeek published the orchestration layer and raised the price of inference. Both hold if the durable asset is the contracts rather than harness code: effect classification, pinned scaffold versions, a judge validated against human grading.

The harness is free. The reversibility contract for in-house tools is not downloadable, and neither is the eval that proves it holds.