Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

agent custody moved downstack

Reasoning traces picked up an order-bias audit; Frona put personal agents behind policy sandboxes; MDA made instruction files compiled and signed.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-05-11

Agents picked up three boring forms of custody today: the answer trace, the runtime boundary, and the instruction file.

A reasoning paper found that longer chains can drag multiple-choice answers toward position bias. Frona shipped a self-hosted agent platform where tools and sandboxes share one policy language. MDA put SKILL.md, AGENTS.md, MCP-SERVER.md, and CLAUDE.md behind a compiler with digests and signatures.

1. longer reasoning has an order tax

sources:

what happened: Xiao Wang’s paper tests position bias in reasoning models across 13 reasoning-mode configurations on MMLU, ARC-Challenge, and GPQA. In 12 of the 13, reasoning length had a positive partial correlation with Position Bias Score after controlling for accuracy, with correlations from 0.11 to 0.41. The truncation probe is the ugly part: R1-Qwen-7B continuations shifted toward position-preferred options from 16% to 32% as the restart point moved later in the trajectory. DeepSeek-R1 at 671B still showed the length effect in the longest quartile, even though aggregate PBS fell to 0.019.

why this matters: A longer trace is not automatically a cleaner answer. If a benchmark treats chain-of-thought as a bias scrubber, the measurement may be counting a new bias source without naming it.

2. Frona put policy below the personal agent

sources:

what happened: Frona tagged v2026.5.0 as its first public release on May 10. The release pitches a self-hosted personal AI agent platform built around one Rust engine, one policy language, and per-principal sandboxing. The README says every actor, including agents, MCP servers, deployed apps, and channels, gets its own policies; CLI tool calls and MCP servers run in sandboxed Linux processes with policy-driven syscall filtering. The same policy engine covers tool access, read/write paths, network destinations, and port binds, while the credential vault asks for approval instead of letting secrets sit in agent memory.

why this matters: Personal agents only become useful when they touch files, browsers, messaging channels, and credentials. Once they get that close to the machine, “trust the assistant” is not a control plane; the control plane is policy, isolation, and which principal gets to do the weird thing.

3. instruction files got a compiler

sources:

what happened: MDA v1.0.0-rc.3 shipped the reference CLI as @markdown-ai/cli on May 10. One .mda source compiles into SKILL.md, AGENTS.md, MCP-SERVER.md plus sidecar, and CLAUDE.md. The CLI handles authoring, validation, compilation, canonicalization, integrity checks, and conformance checks. The trust machinery is the real move: artifacts carry reproducible content digests, and signed artifacts carry Sigstore-anchored signatures.

why this matters: Agent instructions are no longer harmless repo notes. They grant authority. Four drifting copies and an unsigned blob are fine for vibes, not for runtimes that load the file and start touching systems.

  • Weblica — visual web-agent training got HTTP-level replay plus synthesized environments; Weblica-8B reports 39.2% pass@1 on Online-Mind2Web with 30 steps.
  • miii-cli — local coding assistant with no cloud, no Python, no API keys; it leans on Ollama or an OpenAI-compatible API, then adds git context, compaction, sessions, and planning mode.
  • Memori — memory from what agents do, not just what they say; the pitch is LLM-, datastore-, and framework-agnostic state.
  • James Shore on maintenance cost — the useful warning: codegen speed is fake leverage if maintenance cost compounds faster than review capacity.

left on the table

  • screenpipe app releases had real personal-agent integration work, but the same release stream has been resurfacing in the cache for several days.
  • the Qwen airplane-mode post had a good local-model claim, but Reddit commentary was not enough to rerun the local-model argument after this week’s support notes.
  • clawsec stayed out because the security-skill angle was too close to recent skills and agent-boundary coverage.
  • Hidden Coalitions in Multi-Agent AI was interesting, but today’s cleaner eval story was the position-bias paper.
  • Best Claude Code plugins — choose the Claude Code extensions worth installing, and the ones to skip
  • Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
  • Local LLM runtimes — pick local inference by custody, speed, privacy, cost, and failure mode
agents evaluation security personal-ai developer-tools signals