self.md radar — 2026-10-24
a place for the unresolved file
A security audit needs somewhere to put the thing it cannot yet prove. Today’s sources give that category different forms: a needs_validation record, an unresolved code reference, and a company-reported benchmark drop before a model’s weights go public.
1. Cloudflare gives unresolved security work its own verdict
Cloudflare’s security-audit skill divides an agent audit into reconnaissance, coverage-led hunting, candidate validation, structured findings, independent record checks, and reporting. Every unique candidate goes to a fresh verifier whose job is to disprove it.
The resulting file has three verdicts. confirmed needs a trace to the source and a bounded observed result. needs_validation carries one exact unresolved fact and no severity. rejected records the candidate that did not survive the check. A lead can stay visible without being promoted into a vulnerability.
reading: cloudflare/security-audit-skill
2. task-view checks the map against the repository
Task-view turns an agent’s account of a change into an offline HTML review page: a graph of changed pieces, step-by-step flows, diff coverage, and claims a reviewer may want to challenge. It checks file, line, and commit pointers against Git, then flags changed lines the account skipped.
A code reference can be verified, contradicted, or unresolved. The agent’s explanation for a change remains labelled as its own statement. Building the page reads files and uses read-only Git; it does not run a build or test suite behind the reviewer’s back.
reading: task-view
3. Kimi states a cyber trade-off before releasing weights
Kimi says K3.1 Pro is available in its products and API now, with full weights due on 4 November. The release says cyber-related material was removed from both mid-training data and RL environments before the open-weight version.
The company reports 90.5% pass@3 on its internal xdev-bench-hard for a checkpoint without those measures, versus 81.0% for the final model. The benchmark uses reproduced disclosed flaws and checks whether an agent can recover a secret from another sandbox. The percentage is Kimi’s own number, not a safety certificate. At least the release says why it fell.
reading: Kimi K3.1 Pro