Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

logs, roles, contracts

Codex logging wear, role-confusion research, and new agent-process specs all point at the same maintenance layer: logs, boundaries, and contracts need to be inspectable.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-06-23

agent systems had a maintenance day: logs wore the disk, role tags leaked authority, and process rules started escaping the prompt.

one bug report put a parts bill on hidden telemetry. one security paper treated prompt injection as a perception bug, not just a clever jailbreak. and the contract/spec layer is getting louder because agents keep doing work in places humans still have to audit.

1. Codex turned debug exhaust into SSD wear

sources:

what happened: A Codex issue documented ~/.codex/logs_2.sqlite and its WAL files acting like a tiny furnace under the desk. after about 21 days of uptime, the reporter measured roughly 37 TB of SSD writes and extrapolated that to about 640 TB a year, enough to chew through the warranty budget of some 1 TB consumer drives.

The ugly detail was the churn: a 1.2 GiB log database, 506,149 retained rows, and an AUTOINCREMENT counter already past 5.5 billion ids. OpenAI merged two fixes on June 22: one stopped logging every successful Responses WebSocket payload, and the other filtered noisy persistent-log targets while keeping metrics and remote telemetry intact.

why this matters: An agent runtime is not a cute CLI once it lives on your machine all day. traces, feedback logs, and observability need retention budgets, or the assistant quietly becomes a hardware tax.

2. role tags are not a force field

sources:

what happened: Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell published an ICML 2026 writeup arguing that prompt injection is driven by “role confusion”: the model gets system text, user text, tool output, and its own prior words as one long token stream with labels attached. the label is not the same thing as a sensory boundary.

Simon Willison pulled out the sharpest number from the paper: in their dataset, rewriting attack text so it no longer sounded like the expected role style dropped average attack success from 61% to 10%. the words meant roughly the same thing to a human; the model read the authority differently.

why this matters: If privileged text is partly a style and context illusion, then “put the untrusted stuff in a tool result” is not a defense by itself. personal AI systems need to treat fetched pages, emails, docs, and logs as contaminated inputs even when the chat template looks clean.

3. agent work wants contracts, not folklore

sources:

what happened: A new AI-SDLC paper proposes a protocol language for human-agent responsibility boundaries, approval gates, and governance constraints. the useful split is policy versus mechanism: not “the agent should ask before danger,” but declared boundaries, validation tokens, capability limits, and invariants that can be checked.

theta-spec is the scrappy repo version of the same pressure. one theta.toml is meant to declare the agent surface — instructions, rules, tools, skills, subagents — and cast it into Claude Code, GitHub Copilot, Cursor, or Codex config files. Oak comes from the review side: version control for agents, with branches, multi-repo spaces, and agent-facing review state instead of a pile of local edits and a prayer.

why this matters: The agent handoff is becoming a file format problem. that sounds boring, which is exactly why it matters: prompts drift, but manifests, protocols, and review objects can be diffed, locked, rejected, and handed to the next worker without pretending memory is magic.

  • PMB — local-first coding-agent memory through MCP, with one SQLite file instead of another cloud brain.
  • agent-browser — Vercel’s browser automation CLI keeps the web-agent surface in tool form, where it can at least be inspected.
  • PEAR — a multi-agent debate paper focused on role assignment and routing bias, useful background for anyone tempted to trust “more agents” as a free reliability button.
  • OpenMontage — the wildcard: a video-production agent stack with 12 pipelines, 52 tools, and 500+ skills; impressive, but more tool factory than governance signal today.

left on the table

  • Bain’s software-replica diligence story had the biggest business headline, but the available source detail was paywalled title-level evidence. not enough for a main slot.
  • PMB was fresh and relevant, but shared/agent memory has been hit repeatedly this week. it belongs as a footnote, not another memory lead.
  • NVIDIA skills stayed out because the skill-file wave already had Google, Microsoft-adjacent, and repo-guidance coverage in the last 14 days.
  • OpenMontage had enough heat for the support rail, but “big agentic media repo exists” is not the same thing as a system-level shift.
personal-ai agents security coding-agents