The headline this run is The Bitter Lesson of Tool Calling: programmatic tool calling — tools as typed Python stubs the model invokes via code — matches or beats native JSON tool calling on 11 of 14 models on BFCL v4, with a +10.6% gain for the GPT-5.6 family, and holds up under parallel fan-out and context rot. It’s a strong argument for dropping JSON tool schemas in agent harnesses. Around it, a dense agent-tooling batch: error-lifecycle tracing for long-horizon trajectories, seed-reproducible orchestration failure-injection, and hardware keystores for agent signing keys. Plus hard data on human-in-the-loop approval misses, a first field report on B300 fine-tuning, and two industry stories that change cost math.

Agent frameworks & tooling

  • The Bitter Lesson of Tool Calling — programmatic tool calling (tools as typed Python stubs the model invokes via code) matches or beats native JSON tool calling on 11 of 14 models on BFCL v4, +10.6% for the GPT-5.6 family, and holds up under parallel fan-out and context rot — evidence for dropping JSON tool schemas in agent harnesses (arXiv · cs.CL).
  • TRAJDEBUG: Tracing Error Lifecycle in Long-Horizon Agent Trajectories — traces each error’s resolution status and terminal impact to find the earliest step actually responsible for a failure, with TrajErrBench (486 annotated failed trajectories from Tau2Bench and SWE-Bench Pro); a real answer to “which step broke the agent” (arXiv · cs.AI).
  • OrchestraBench: Multi-Agent Orchestration Failure Modes — seed-reproducible failure-injection harness: keyword/flag routers score 0% on adversarial routing cases vs 100% for intent-reasoning routers, and blind retry just reproduces latent faults — evidence that detection and attribution, not retries, contain cascades (arXiv · cs.AI).
  • Hardware Keystores for AI Agent Signing: Zero-Trust MCP — moves agent signing keys (Git commits, API auth) into HSM/TPM keystores behind a PKCS#11 MCP layer; prompt-injection attack success drops from 19.3% to 0% across 12 AgentDojo-style scenarios, code released (arXiv · cs.CR).
  • Humans missed 1 in 3 threats approving AI agent commands across 40k plays — 409k approve/deny decisions from a human-in-the-loop game: exfiltration-style commands are missed ~3× more often than obviously destructive ones, payloads hidden behind npm run slip through 52.5% of the time, and over-blocking of benign commands feeds permission fatigue — real numbers for anyone shipping approval-gated agents (HN · scalex.dev).

Models & research

  • Operating Multi-Node Full Fine-Tuning on NVIDIA B300: A Field Report — first published field account of full fine-tuning on B300s (Qwen3-32B, 16×B300, FSDP/ZeRO-3): a wattage-based triage table that catches NCCL hangs, honest negative results on NFS vs page-cache, and a 2.7-second invariant gate that turns multi-hour silent failures into instant rejections (arXiv · cs.DC).
  • Output-Aware Rotation (OptR) for INT2 KV-Cache Quantization — rotation method that minimizes post-W_O attention error instead of proxy statistics, improving QuaRot and OSCAR across 3 models × 5 reasoning/coding benchmarks while preserving the paged KV-cache format — KV memory is the long-context bottleneck on single-GPU self-hosts (arXiv · cs.LG).
  • Herdr is joining Y Combinator. The runtime stays open — the Apache-2.0 agent runtime/TUI (25k stars, 340k downloads, 500+ plugins) becomes a YC F26 company while the runtime stays free and open; herdr --remote user@host puts persistent agents on your own VPS — a self-host agent tool worth watching (HN · herdr.dev).

Industry

Compiled from the morning digest — X, HN, Reddit, Techmeme, Bluesky, arXiv. Hype cut, links kept.

All gathered items — what was cut and why (8)