Agents Under Audit: Tool-Call Validation, Hash-Chained Traces, and Fused CUDA Speed

Today's findings

1. #1 Open-Source Tool-Call Validation Layer for LLM Agentsrepo

   A small MIT-licensed TS/Python layer rejects malformed or out-of-domain tool arguments before they reach production systems.

   Tool-call validation

   Bad arguments never reach the production tool

   1

   Agent calls tool

   drafted arguments

   2

   Validator gate

   schema + business rules

   3

   Tool executes

   valid calls only

   fail → structured error

   A deterministic code gate (MIT-licensed TS/Python) — the agent can correct and retry.

   Why it matters: Agents often invent IDs, negative amounts, or impossible dates; schema and domain validation at the tool boundary catches these failures deterministically.

   How to apply: Wrap each tool handler with the validator, define argument schemas plus business rules, and return structured errors the agent can correct.

   agentstool-usevalidationopen-source

   Read more: I built a small validation layer that stops LLM agents from sending bad tool calls (TS + Python, MIT

2. #2 Tamper-Evident Agent Trace Recorderrepo

   Deposition hash-chains every LLM and tool call into a jsonl log so you can prove an agent trace was not edited after the fact.

   Deposition · Tamper-Evident Logs

   Every agent call sealed into a hash chain

   1

   Agent call

   LLM or tool event

   2

   Record

   appended to jsonl

   3

   Seal

   hash of entry + prior seal

   each seal embeds the previous hash

   4

   Verify

   recompute at review

   Edit any one entry and every later seal fails verification — tampering becomes provable.

   Why it matters: When an agent refunds the wrong order or calls a forbidden tool, ordinary logs are mutable; hash-chained traces give audit-grade evidence.

   How to apply: Wrap agent execution with the decorator, store the hash-chained jsonl alongside run metadata, and verify the chain during incident review.

   agentsobservabilityauditopen-source

   Read more: Built an open-source recorder that can prove an agent trace wasn’t edited after the fact. Looking for people to break it

3. #3 Fix RAG Failures at Chunk Boundaries, Not the Modeltip

   A contract Q&A failure came from a sentence split across two chunks, so neither retrieved chunk could answer the question alone.

   RAG debugging

   Fix the chunk boundary, not the model

   Fixed-size chunks

   • Sentence cut in two
   • Neither chunk answers alone
   • Blame lands on the model

   → The boundary was the bug

   Clause-aware chunks

   • Cuts at clause boundaries
   • Answer sits in one chunk
   • Parent context preserved

   Regression questions whose answers span multiple clauses catch this early

   Why it matters: Retrieval can return plausible chunks while still destroying the dependency between conditions and outcomes; chunking is often the real bug.

   How to apply: Use sentence- or clause-aware chunking, preserve parent context, and add regression questions where the answer spans multiple clauses.

   ragchunkingretrieval

   Read more: Your RAG can't answer. It's probably not the model's fault

4. #4 Modular SKILL.md Packages Reduce Agent Instruction Drifttechnique

   Breaking monolithic coding-agent prompts into task-specific SKILL.md packages helps agents handle edge cases instead of skipping them.

   Why it matters: Instruction drift is a common failure mode in Claude Code, Cursor, and local terminal agents; modular skills make constraints reusable and testable.

   How to apply: Split prompts by task, keep each SKILL.md focused with examples and failure checks, and start from the open-source 40-skill collection.

   agentspromptingskillsopen-source

   Read more: Why typical agent prompts fail at edge cases, and 40 structured skills I built to fix them · I Thought SKILLs Were a Waste of Tokens Until I Wrote My Own · I Thought SKILLs Were a Waste of Tokens Until I Wrote My Own

5. #5 llama.cpp CUDA PR Fuses FFN Gate/Up Matmuls and GLUrepo

   A llama.cpp PR interleaves gate/up rows and fuses FFN matmuls plus GLU in MMQ, targeting faster quantized CUDA inference.

   Why it matters: Local inference speed is often limited by memory traffic and kernel launches; fusing these operations can improve tokens/sec without changing models.

   How to apply: Test PR #29948 on your CUDA hardware with llama-bench, compare against your current build, and watch for quantization-specific regressions.

   llama.cppcudaperformancequantization

   Read more: CUDA: fuse FFN gate/up matmuls and GLU in MMQ with interleaved gate/up rows by anujj · Pull Request #29948 · ggml-org/llama.cpp

6. #6 Run a 125B Qwen Model on 16GB VRAM via NVMe Offloadingtechnique

   Lean-QwenFlash runs Qwen3.8-Flash-Next at about 20 tok/s on 16GB VRAM plus 8GB RAM by streaming experts directly from NVMe.

   Lean-QwenFlash

   A 125B MoE running on 16 GB VRAM

   HOT

   16 GB VRAM Hot experts — always resident

   WARM

   8 GB RAM Warm experts — on standby

   COLD

   NVMe SSD Cold experts — streamed on demand

   ~20 tok/s: only the routed hot experts stay in VRAM, the rest stream from a fast SSD.

   Why it matters: It shows a practical path to large MoE models on modest hardware when the full model cannot fit in memory.

   How to apply: Use the Lean-QwenFlash setup, keep hot experts in VRAM, stream cold experts from a fast SSD, and benchmark latency against your context needs.

   local-llmoffloadingqweninference

   Read more: Lean-QwenFlash: Qwen3.8-Flash-Next (125B) running at ~20 tok/s on 16gb vram and 8gb ram via direct nvme SSD offloading · Lean-QwenFlash: Qwen3.8-Flash-Next (125B) running at ~20 tok/s on 16gb vram and 8gb ram via direct nvme SSD offloading

7. #7 Speculative Decoding Helps Code More Than Prosetip

   Qwen3.8-27B with DFlash2 hit 154 tok/s on code but only about 2.5 accepted tokens per step on prose, exposing a workload-dependent speedup.

   Speculative decoding

   Code flies; prose doesn't follow

   vs

   Code

   Prose

   Throughput

   154 tok/s

   No equal speedup

   Draft acceptance

   Accepted frequently

   ~2.5 tokens / step

   Best setting

   DFlash2 drafts on

   Plain decoding

   Code wins the row Prose wins the row

   Qwen3.8-27B with DFlash2 — gains hinge on draft acceptance, so benchmark per workload.

   Why it matters: Speculative decoding gains depend on draft acceptance; teams should not assume the same speedup for chat, docs, or creative writing.

   How to apply: Benchmark acceptance rates by workload, enable DFlash2 for code and tool calls, and fall back to non-draft decoding for prose-heavy tasks.

   speculative-decodinglocal-llmqwenbenchmarking

   Read more: Qwen3.8-27B on free Kaggle 2x T4: 154 tok/s on code with DFlash2, but prose stuck at ~2.5 accepted tokens

8. #8 Metis Reverse MCP Gives Claude Structured Reverse-Engineering Toolstool

   Metis Reverse is an open-source MCP server that lets Claude Code and Desktop map binaries, Electron apps, and native libraries through structured RE tools.

   Tool release

   Metis Reverse gives Claude structured reverse-engineering tools via MCP

   Metis Reverse

   tool open-source

   MCP server for Claude Code & DesktopAvailable now

   runConnect the server via MCP, then point it at software you're authorized to analyze.

   Focused task-level tool calls replace pasting giant disassembly dumps into chat.

   Why it matters: Instead of pasting giant disassembly dumps into chat, agents can call focused tools for architecture mapping and feature analysis.

   How to apply: Connect the MCP server to Claude Code or Desktop, point it at software you are authorized to analyze, and use its task-level tools for module and data-flow mapping.

   mcpclaudereverse-engineeringopen-source

   Read more: Metis Reverse is an open-source reverse-engineering MCP for Claude Code / Claude Desktop (and other Agent). Free to try

9. #9 MemT 1.0 Puts Agent Memory Inside the Forward Passpaper

   MemT 1.0 is a memory-native MoE architecture that compresses history into a persistent internal state instead of re-supplying an external vector store every turn.

   MemT 1.0

   Where agent memory lives

   External store

   vs

   Internal state

   MemT's bet: memory lives in the model, not in the retrieval loop.

   Built on gated DeltaNet-2 and a mixture-of-storage design.

   Why it matters: Long-running agents suffer context drift and repeated retrieval costs; internal memory could reduce storage and token overhead.

   How to apply: Read the architecture breakdown on gated DeltaNet-2 and mixture-of-storage, then prototype the memory-state pattern for long refactoring or support agents.

   memoryagentsarchitecturepaper

   Read more: We trained a model that keeps memory inside its own forward pass · memt-1.0 architecture breakdown gated deltanet-2, mixture-of-storage, and 66x smaller storage footprint for agent memory [D]

10. #10 Block Claude Code from Hiding Errors with 2>/dev/nulltip

    A PreToolUse hook can reject commands that redirect stderr to /dev/null, forcing Claude Code to see real errors instead of guessing.

    Why it matters: Agents often summarize failures from incomplete output; hiding stderr turns a typo or permission error into a misleading conclusion.

    How to apply: Add a Claude Code PreToolUse hook that blocks 2>/dev/null, then let the agent rerun the command with stderr visible.

    claude-codeagentsdebugginghooks

    Read more: I blocked Claude Code from using 2>/dev/null

11. #11 Audit Subagent Context to Cut Claude Code Token Burntip

    Subagents can inherit the entire conversation history, so capping context and terminating stuck agents can cut usage dramatically.

    Claude Code subagents

    One simple change, hundreds of thousands of tokens

    Every subagent re-sends the entire conversation history — cap it, hard-stop stalls, audit /usage.

    Why it matters: Long Claude Code sessions get expensive when helper agents re-send hundreds of thousands of tokens for simple changes.

    How to apply: Check /usage for per-subagent token counts, limit inherited history, and add a hard stop when a subagent loops or stalls.

    claude-codetokenssubagentscost

    Read more: Usage cap advice for the non-technical

12. #12 Treat Abliterated Local Models as a Supply-Chain Risktip

    Project Discovery shows abliterated models can be backdoored, so untrusted local weights may execute malicious behavior.

    Why it matters: Local models are often downloaded from community hubs; removing safety layers can also remove guardrails that would resist injected behavior.

    How to apply: Prefer verified model provenance, scan weights and prompts, isolate untrusted models, and avoid running abliterated models with tool or filesystem access.

    securitylocal-llmmodel-safety

    Read more: Imp : News backdooring the local models