Daily Systems Trends Report — November 4, 2026: The Service Relationship — Agents as Customers, Instruments as Suspects

Wednesday edition. Coverage: the Wednesday, November 4 arXiv batch — 35 distributed-computing, 30 software-engineering and 19 multi-agent papers (arXiv:2611.03649 through 2611.05314). Nothing here overlaps the November 3 report, which covered the Tuesday batch (2611.00006 through 2611.03631), or the November 2 report, which covered the Monday batch (2610.40721 through 2610.42144).

The theme: the service relationship

The week arc so far: October 26 the interface audit, October 28 the instruction stack, October 29 the intervention ledger, November 1 the baseline audit, November 2 the repair stack, November 3 the agent becomes a workload class. Today completes the sequence. A workload class that selects its own services, reports its own completion, and outlives the conversation needs what every other workload class eventually got: a service relationship. That means three things this batch treats separately and one theme binds: a completion contract that some independent party can verify (2611.04182), a durable board where obligations wait without a process holding them (2611.04100), and conformance gates on the protocol layer the services ride on (2611.03662). The second half of the batch audits the meters: if completion is to be grounded in observation, the observers — graders, cost columns, trajectory logs, mislabeled ground truth — must themselves be suspect. Two of today’s papers put numbers on exactly how much those instruments lie.

1. When the Consumer Is an Agent: Execution-Grounded Service-Level Agreements (arXiv:2611.04182, AGH ' Orzechowski, Slota, Kitowski)

The claim: LLM agents increasingly act as service consumers: they select operations and report whether a task is complete. In an asynchronous distributed service, an accepted call or an immediate state read does not establish that the required state became observable by its deadline. Completion should be treated as a service-level outcome governed by execution-grounded completion contracts: an independent control plane observes a deadline-bound service-state predicate, admits completion, and directs recovery while the agent performs the task.

The foundation: This is the oldest move in distributed systems — do not trust the participant’s report; observe the state — applied to the newest participant type. It descends directly from the evidence-before-effect line this blog has tracked since October 1 (signed logs before effects, commitment roots, receipts at commit time).

The evidence: A live multi-provider data service with heterogeneous models and an injected transfer delay. Before enforcement, both error directions occur: some tasks that missed the deadline were accepted and some that met it were rejected — the agent’s self-assessment is not even biased in one direction, it is noise. Under enforcement, accepted completions remained consistent with later observations, all included healthy tasks completed, and unresolved faulted tasks terminated as unverified.

The trade-offs: The method requires a state predicate that is actually observable by deadline. For placement and deletion tasks that is natural; for fuzzy deliverables (documents, reviews, designs) the predicate is the hard part and the paper does not solve it. And the control plane is a new privileged component that itself needs assurance.

The verdict: Ready for adoption wherever agent tasks have observable end-states. This is the flagship of the theme: the completion verdict moves out of the model and into a monitored predicate, exactly like a receipt-verified payment.

2. The Agent Board: Kanban for Machines (arXiv:2611.04100, Corvic ' Hunt, Nguyen, Gill)

The claim: Harnesses have converged on a single-threaded shape — one agent, one history, one machine, one sitting — which fails work that spans many agents, outlives any one model call, or waits on non-agent systems. The Agent Board is a durable, shared table of semi-semantic tasks: a few exact fields the system routes on plus a free-form body only language models read. Agents post, watch, and block on tasks, ending their turn and holding no process until a matching post wakes them. A system agent (the Board Keeper) acts as the interrupt handler: it carries events from non-agent parts of the harness onto the board, matches them to waiting tasks by reading their prose, and allocates new agents for tasks that name a kind of agent rather than an instance. Loadable coordination-policy kernels give statuses and roles meaning per work pattern, without the board enforcing them.

The foundation: The kanban board a human team puts on a wall, plus the OS scheduler analogy — the authors state where the analogy breaks. It names the persistent-agent products that need it once an agent must wait or hand off: Meta Muse, OpenAI dots, SpaceXAI Grok Bot.

The evidence: A trace from a live board and three simulated pilots. The wait cost of the board was flat in wait length while naive polling grew about 165-fold; but a plain external watcher was cheaper than the board. The Board Keeper matched prose waiters with no false wakes but missed 3.6 percent of real wakes.

The trade-offs: Prose matching is a model-judged gate — exactly the kind of check this week’s audit cluster distrusts, and the missed 3.6 percent is the measurable shadow of that. The honest external-watcher comparison concedes the board’s value must come from durability and semantics, not cost.

The verdict: The durable semi-semantic task row is a design pattern worth stealing regardless of the product; the performance case is modest and honestly bounded. Watch whether Board Keepers get the same message-admission gates as 2611.04321.

3. A Gated Spec-Driven Workflow: An Audit-Trail Study (arXiv:2611.05094, Abdo & Brom)

The claim: Spec-driven development with almost every control being an instruction carried out by the same model it constrains can work — if the controls are stage gates with fixed defect lists, file-scoped executors, and file-inventory checks. The study dissects one such Claude Code workflow.

The foundation: Continues the approval-laundering arc (October 1) and the assurance plane (October 22): controls executed by the constrained model are instructions, not gates. The question is where the residual weakness lands when the scaffolding is dense.

The evidence: Nine features in seven projects, all run by the authors, from a Fortran solver and Python programs to books and the paper itself. Five of nine finished with every planned task done; 288 of 581 planned tasks completed block by block. The executor kept to its declared files: exactly one undeclared change left in a deliverable folder, and the inventory check caught it. The weak point was the orchestrator, which runs and judges its own checks: it recorded undeclared changes in 11 of 247 block checks and stopped work in only four.

The trade-offs: Nine features, all author-run, no baseline arm — an audit-trail study, not a benchmark. But the failure localization is exactly what the field needs: the self-judging component is the leak, again.

The verdict: File-scoping plus inventory checks are cheap and demonstrably effective; gate authority should move out of the orchestrator that benefits from skipping them. The one-undeclared-change-caught datapoint is the most encouraging execution discipline result this week.

4. ATC: Role-Contract Enforcement for Black-Box Multi-Agent Systems (arXiv:2611.04321, Maliha, Pramanik, Jha)

The claim: Division of labor in multi-agent LLM systems is only meaningful if each agent stays within its authorized functions. Over many turns an agent can produce a locally reasonable message that exercises another role’s authority: a verifier that begins planning, a retriever that asserts unsupported conclusions, an executor that changes state no one approved. The paper formalizes this as role drift and enforces role contracts at the point where a message would enter the shared conversation: score the proposed output for out-of-role deviation, leakage into other roles’ functions, impermissible speech acts, and logical contract breaches, then constrain regeneration with a leakage-regularized target and re-check before admission.

The foundation: Message-level admission control — the same altitude as October 22’s report isolation and StateMirror’s pre-execution detection. Enforcement acts on the message rather than the generator, so it governs agents whose internal representations are unavailable.

The evidence: Across homogeneous and heterogeneous teams, ATC improves task performance and role consistency while lowering role-drift energy relative to strong baselines spanning prompting, memory, workflow control, and activation editing, with the largest gains under explicit role-confusion stress tests and in larger, more diverse teams. Note honestly: the abstract gives no point estimates; the numbers live in the paper.

The trade-offs: A learned scorer at the admission point is another model in the trust path; the leakage-regularized regeneration loop costs turns. The scorer itself needs auditing (see item 6).

The verdict: The right altitude for API-model teams; a watch-list adoption pending the full results tables. Same group as ATLAS (item 20), which enforces the same contracts one level lower, in the weights.

5. MCPGuard: Finding Conformance Gaps in MCP SDKs (arXiv:2611.03662, Tsinghua ' Sun, Liu, Dang, Zheng, Yang, Liu Yunhao)

The claim: Specification constraints omitted by MCP SDKs propagate to every downstream application built on them, and existing conformance tools only exercise running endpoints, never the SDK’s own enforcement. MCPGuard pairs a structural track (align JSON Schema constraints with normalized SDK models, produce constraint-specific evidence) with a behavioral track (extract normative prose rules, retrieve bounded function-level slices, audit with LLMs for candidate omissions), then an evidence-aware dynamic adjudicator inspects complete source context and builds PoCs to validate candidates.

The foundation: The interface audit from October 26 made the case that the model-machinery interface is the failure surface; this paper tests the protocol layer under it. Dual-track + dynamic adjudication is the two-independent-checkers pattern the week keeps converging on.

The evidence: On the official Python 1.26.0 and TypeScript 1.29.0 SDKs, MCPGuard confirms 13 and 19 findings respectively, none of which are exposed by two black-box baselines. Tests on open MCP servers show the gaps systematically propagate downstream.

The trade-offs: LLM-in-the-loop detection means candidate omissions need the adjudicator (another model) to confirm — the 10/22 correlated-failure question applies. And flag: this paper was submitted August 12 and only surfaced in this batch’s listing; treat as a preprint that has been sitting for three months.

The verdict: Concrete and actionable for anyone operating MCP infrastructure: the SDK you installed is not the spec. Worth a conformance sweep before adding the next server.

The instrument audit: the meters are suspects too

If completion is to be grounded in observation, the observers must be credible. Four papers in this batch audit the instruments of agent and software measurement — grader code, cost columns, trajectory logs, ground-truth labels, and decade-old SAST detectors — and find silent failures that produced plausible numbers. This is the October 24–26 audit line (generating for the gate, the attribution audit, the interface audit) turned on the measurement layer itself.

6. Silent Instrument Errors Reorder Agent Leaderboards (arXiv:2611.04399, Yangze Liu, Shandong — single author)

The claim: The infrastructure of agent evaluation — the code that grades, logs, replays, and versions an evaluation — is part of the measurement and fails silently. Scores and orderings can move with no visible sign.

The evidence: On a public leaderboard, a general-purpose agent trailed a scaffold built for an airline customer-service benchmark by 13 points on database-touching tasks — a reader would conclude generality costs accuracy. The gap came from the grader: the general agent often ended conversations in a way that never triggered grading, so only about half its episodes were scored and the rest were stored as failures. Grading the ungraded half under the benchmark’s own rule closed the pooled gap without rerunning any agent. Auditing HAL and tau2-bench from published artifacts alone found three more instrument errors: a cost column counting nested model calls twice, unevenly across rows; archived trajectories recording grader-written actions as agent actions; and a re-grade under a newer evaluator that is itself a new measurement — a correct and announced fix reordered a leaderboard, and a mode check that misreads four files collapsed their scores by 59 to 82 points while printing no error. The HAL maintainers confirmed all three within five weeks.

The trade-offs: Two leaderboards, public artifacts only, single author. But the maintainers’ confirmations within five weeks are the strongest external validation a single-author audit can get.

The verdict: Adopt today, verbatim: report the graded fraction, aggregate cost from root spans, tag the provenance of every recorded action, and pin evaluator versions with a published re-grade diff. This is a checklist to send to every benchmark you consume — and a mirror for any in-house eval harness.

7. Verifier Strength Does Not Buy Discovery Quality (arXiv:2611.04420, Chen, Zhang, Zhang — pre-registered, Zenodo-archived)

The claim: Automated-research pipelines pair an LLM proposer with a verifier on an implicit bet: discovery quality rises with verification strength. Under a pre-registered protocol, the bet fails — and pool composition, not gate strength, is the lever.

The foundation: Direct descendant of the score-gating theorem (October 1, RAC: score-gating equals gate-conjunction only when the threshold is at least as strict as the smallest weight) and October 18’s label-free aggregation results. The economics question the whole verifier-race is built on.

The evidence: Two real-data domains (job-shop scheduling and vehicular edge offloading on Beijing T-Drive trajectories), 100 matched LLM/random pairs per domain, three verifier tiers. The manipulation binds — a 429-case mutation battery shows scores rising across tiers — yet the paired LLM-over-random advantage does not scale with it (domain A: one-sided p=0.1115; domain D: p=0.9994, and it shrinks under the strict tier with margin contrast –0.040, p=0.0013). The two lower gates promote identical candidates in 100/100 and 99/100 pairs, so the strict order is untestable when they coincide. Constructively: mixing the two pools adds +1.52 holdout-value units in domain A (one-sided Wilcoxon, n=100, p=0.0002).

The trade-offs: Two domains, one LLM/random pairing scheme; the strict tier was largely untestable because lower gates already agreed. The post-hoc union-pool analysis is labeled as post-hoc — correctly.

The verdict: Design note for every proposer/verifier build: spend on proposal diversity before gate strength. The pre-registration discipline — criteria, ledgers, scripts archived — is becoming the field’s new minimum standard, and this paper executes it well.

8. Noisy Issues, Noisy Results: Mislabeling in IR-Based Bug Localization (arXiv:2611.05314, Asad, Yasir, He, He, Malek)

The claim: IRBL evaluations lean on issue labels that are frequently wrong in open-source projects, and the resulting performance numbers are inflated.

The evidence: Five benchmark datasets comprising over 55,000 issue reports: on average 34.82% of issues are mislabeled. Across six IRBL techniques spanning traditional, deep-learning, and LLM-based approaches, removing mislabeled issues significantly reduces measured performance, with Mean Reciprocal Rank decreasing by 4.68% to 21.74%. Mislabeling does not change the relative ranking of techniques, but it changes the magnitude of their differences.

The trade-offs: Ranking-stability is the honest headline: if you only claim ordering, the noise did not hurt you; if you claim gaps of X points, a third of your gap may be label noise. The study is benchmark-side; it does not propose label cleaning at scale.

The verdict: Classic measurement hygiene, executed at scale. Pairs with October 18’s fault-representation gap: before trusting any localization leaderboard, ask what fraction of its ground truth is wrong — here, a third.

9. Fixed Detectors, Moving Code: SAST Over a Decade (arXiv:2611.03742, Tang & Cai)

The claim: SAST tools are deployed on the assumption that detectors configured today will stay effective on future code. A ten-year audit shows the assumption needs re-deriving — and that apparent temporal decline can be alerting breadth and coverage change rather than detection loss.

The evidence: 20,000 vulnerable and fixed C/C++ cases from 1,116 projects (2016–2025), evaluated with three CodeQL releases, three Infer releases, and one Semgrep configuration, with project- and label-matched year pairs and within-project trajectories. Changed-file F1 ranges from 0.066 to 0.478 while count-based AUROC stays near chance (0.495–0.526). Newer CodeQL releases attain higher F1 alongside nearly parallel rises in recall and false-positive rate — not stronger separation of vulnerable from fixed cases. Among selected drops, only 6 of 39 CodeQL and 2 of 620 Infer findings overlap a changed repair line. And Semgrep reported success on every run while 78.96% of cases show parser or timeout diagnostics.

The trade-offs: The reporting itself is the deliverable: fix detector conditions, control for projects, inspect repair-level evidence, and report failed or degraded analyses — a recipe every security team’s annual tool re-qualification should steal. The tool coverage is three analyzers, C/C++ only.

The verdict: The most methodologically careful item in the audit cluster. Its negative framing (apparent decay may be measurement artifact) is exactly the discipline October 18’s mutation-audit called for.

10. Interpretable Early Termination of Web Agents (arXiv:2611.04142, Talavera & Eirinaki)

The claim: Web navigation agents fail often and fail late, with most tokens spent after the trajectory is unrecoverable. Closed sequential pattern mining (BIDE+) over K-step prefixes yields a small, human-reviewable failure-signature library organized into a four-category taxonomy with repair recommendations — termination decisions a human can audit.

The evidence: 1,544 MiniWoB++ traces from three open-weight models. Best F1 at K=3 on the Exclude-errors configuration across eight methods (0.717); 88% of test-set failures recovered within three steps; an early-termination policy saving 26.3% of tokens at 92% precision.

The trade-offs: MiniWoB++ only; and the honest methodological note is the paper’s real contribution: a multi-variant evaluation protocol that explicitly removes contamination artifacts (zero-step crashes and trivially separable single-step successes) so that reported accuracy reflects behavioral discrimination rather than trace-length distributions.

The verdict: Modest numbers, exemplary protocol. The decontamination checklist belongs in every agent-failure-detection evaluation — the same class of instrument hygiene as items 6 and 8.

The systems floor: kernels, loops, caches, and optics

The serving-side cluster keeps the agent-workload theme physical: kernel generation that accumulates knowledge across runs and now tops public leaderboards; looped-model serving graded by exactness; cell-level KV precision planning for looped transformers; high-throughput KV compression where pipeline execution — not compression ratio — is the bottleneck; and optical circuits configured once per deployment because decode communication structure is static.

11. ForgeKernel: Self-Evolving Kernels Catch and Surpass Experts and Agents (arXiv:2611.04998, 16 authors)

The claim: Existing kernel-agent systems lack cross-run knowledge accumulation and architectural evolution: each run starts from the same initial knowledge and later iterations optimize within an architecture fixed early. ForgeKernel accumulates and reuses knowledge across runs by analyzing a high-performance reference and distilling validated architectural decisions into reusable knowledge of hardware mechanisms (not source-code imitation), then seals a kernel that passes correctness and performance validation and uses it as the reference for the next run — so architectural decisions can be revisited.

The evidence: Across 27 operators and 29 input configurations on NVIDIA Hopper and Blackwell GPUs, ForgeKernel matches or beats its expert reference on 25 configurations with a geometric-mean performance gain of 10%. On Ascend 910C it outperforms the per-operator public best on all 8 level-4 operators of the CANN-Bench Season 1 final leaderboard with a geometric-mean gain of 25.1%. As of October 30, 2026, public submissions generated by ForgeKernel rank first on all three CANN-Bench 2.0 solution leaderboards (910C, 950DT, 950PR) and on the SOL-ExecBench FlashInfer-Bench track.

The trade-offs: Leaderboard-based claims — CANN-Bench public submissions are a narrow window on real workloads, and the expert reference is self-defined. The validation-before-sealing gate is the right control, but its strength is internal to the system.

The verdict: The strongest systems result in the batch: agent-generated kernels topping multiple public hardware leaderboards, with the cross-run knowledge ledger as the mechanism. Pair with October 26’s caution that leaderboard wins are not workload wins — but four first places is four first places.

12. What Sets the Serving Speed of Looped Language Models? (arXiv:2611.05150, Lu, Li, et al. — Runguo Li returns after October 21’s ternary CPU sync)

The claim: Looped models apply one block of layers many times per token, so a serving engine pays every per-layer overhead once per loop. The paper measures Ouro and Huginn-0125 serving and grades every optimization from bitwise-identical to accuracy-checked — an exactness ledger.

The evidence: At batch 1, fusing all loop submissions left Ouro throughput at 0.99x; the 5,689 small kernels per token are the real cost, and fusing them behind rounding fences raises throughput 1.11–1.59x while 1014/1014 requests remain identical. An approximate fusion was no faster and missed a one-point GSM8K rule on 87 questions, so it was not shipped. Huginn’s released defaults avoid dead KV slots and reuse prefix-cache pages for 1.77–3.16x; Ouro reaches 1.65–2.15x and agent sessions 1.91–3.21x. Under prefill-decode disaggregation, ExactLoop reaches up to 3.3x base throughput, and its transfer budget sized to hold one request’s KV in flight cuts the commit tail from about one second to 16 ms (base: 2.8 s).

The trade-offs: Looped models are a niche architecture; the transferable part is the discipline, not the numbers. Some optimizations pass the accuracy rule only on point estimates and are labeled as such.

The verdict: The exactness-graded ledger is the second instance of this pattern this fall (after October 21’s CPU-side loop study by the same author) and it is the right way to publish serving optimizations: state what is guaranteed identical, what is checked, and what was rejected for missing the check.

13. The serving floor, in brief: LoopKV, high-throughput KV compression, and static optics

LoopKV (arXiv:2611.04137): For looped transformers that keep a KV cache per loop, quantization sensitivity varies across (loop, layer) cells and the sum of individual cell damages approximates overall output damage. A one-time offline profile chooses 4-bit storage, 2-bit storage, or reuse of the final loop’s KV for each cell; during decoding each loop reads only the high 2 bits and fetches low bits where its own attention weights require full precision, executed as one fused kernel in vLLM. Serving Ouro-1.4B on one RTX PRO 6000: 35% less KV than uniform 4-bit quantization (KIVI-4) and 1.7–2.2x KIVI-4’s goodput under a latency SLO, with no benchmark average significantly below BF16. Sensible cell-level specialization — scoped to a niche but growing model class.

Beyond Compression Ratio (arXiv:2611.04382): KV compression in disaggregated serving pays only if the compression pipeline itself is fast enough for high-bandwidth interconnects. A fused tilelang kernel eliminates intermediate tensor materialization for up to 5.9x kernel speedup, and an open, extensible lossless-compression backend raises compression throughput from below 90 GB/s to over 500 GB/s, cutting job completion time by up to 2.04x. Classic boring-mechanism engineering: the ratio was never the metric.

Workload-Static Optical Circuit Switching (arXiv:2611.05104): For a fixed deployment and parallelization, the communication structure of decode is fixed — so configure optical circuits once per deployment, co-designed with topology-aware collective schedules. In a 576-accelerator scale-up domain serving 5T-parameter MoE models with up to 5M-token contexts, all-OCS fabrics improve interactivity by up to 65% and energy efficiency by up to 119% over 4:1 oversubscribed packet-switched fabrics. Caveat: evaluated via a graph-based workload emulator coupled to analytical and flit-level models grounded in hardware measurements — a co-design argument, not yet a live-fabric demo.

Developer layer: skills age, wording matters, code becomes disposable

14. How Agent Skills Evolve: 84,200 Skills on GitHub (arXiv:2611.04456, HKUST ' Huang, Cao, Han, Jiang, Cheung, Liu)

The claim: Agent skills are now a real software supply chain, and their evolution has never been studied at scale. The paper captures 84,200 skills and 750,898 commits, builds taxonomies of skill components, change patterns, and evolution motivations, and labels changes with an automated pipeline.

The evidence (five implications): (i) reliability receives less attention in skill composition and change, motivating execution-contract skill design with verification and recovery mechanisms; (ii) evolution concentrates in project-coupled skills, calling for just-in-time skill updating; (iii) change patterns are dominated by incremental enrichment and refinement; (iv) redundancy is a practical maintenance issue; (v) security-motivated changes show limited risk reduction, suggesting skill regression testing that objectively verifies functionality and security.

The foundation: Completes this blog’s skills trilogy: October 10’s supply-chain audits (copy networks, skill conflicts, pycache traps) showed how skills spread and misbehave; this paper shows how they age. The security-motivated-change finding lands directly on the October 10 PyCache Trap lesson: patches do not equal protection.

The verdict: The census the skills ecosystem needed. The “security-motivated changes show limited risk reduction” result is the headline: intent to secure is not security; only executable regression checks count.

15. Do Coding Agents Follow AGENTS.md? Wording Matters, Differently per Stack (arXiv:2611.04367, Nara ' Tsuchida et al., 4 pages, IEICE under review)

The evidence: One policy inserted in four styles into Agent Context Files across 86 benchmark tasks and four harness-model combinations: conditional phrasing was followed less often than Prescriptive and Explanatory, and which of those two won varied by combination.

The verdict: Small, but it lands exactly on the October 28 instruction-stack arc and October 23’s stale-instruction files finding: the instruction is an interface, and its wording is a tunable with stack-specific optima. Practical rule: do not copy someone else’s AGENTS.md phrasing — A/B test the wording on your own harness-model pair.

16. Disposable Implementations: What Is Software Engineering For? (arXiv:2611.04383, Treude — position essay)

The claim: If coding agents can regenerate implementations from requirements, tests, architectural constraints, and operational records that survive replacement, then changing a system may no longer require modifying its existing codebase. The paper names this regeneration and asks what software engineering should preserve when implementations become disposable.

The evidence: An exploratory review of practitioner literature. Published examples show agents can replace existing implementations, but do not establish that repeated regeneration is safe or economical. The identified risk is precise: existing code contains knowledge absent from preserved artifacts — safeguards introduced after failures, undocumented assumptions — and a regenerated implementation can pass the available tests and still lose behavior that matters in production.

The trade-offs: A position essay, not a study — flag it as such. But the question is the right one and converges with September 28’s model-retirement work and October 26’s Code of Theseus: the durable layer is artifacts and checks, not code.

The verdict: Keep the question, wait for the evidence. Its practical residue: inventory what your preserved artifacts would lose if the code were regenerated tomorrow — that inventory is your continuity gap.

Multi-agent dynamics: roles are feedback valves, drift has a geometry

17. Beyond Division of Labor: Roles Shape Feedback and Recovery (arXiv:2611.03931, Yang, Li, Thakur, Yan)

The claim: Roles in multi-agent LLM systems allocate decisions as well as work. In a Planner–Executor–Reviewer team, the Reviewer’s approval gates when the team submits and therefore how often it receives corrective feedback. Recovery after failure — not first-pass accuracy — is where role structure matters.

The evidence: Three open-weight models on Omni-MATH and two on SciBench, holding agents, topology, call budget, and evaluator constant. Removing roles largely eliminates functional specialization without lowering first-pass accuracy. After a failed first answer, a role-structured Reviewer often withholds approval, so its team submits less and receives fewer evaluator verdicts; the role-free team recovers more often across all five model–benchmark settings. The control analyses are exemplary: at equal numbers of verdicts the pooled recovery difference is small (+0.009, 95% interval [–0.014, +0.033]) — roles buy no better use of feedback, only less of it. An exploratory intervention on 400 Omni-MATH problems with gemma-4: keeping role prompts but forcing submission every cycle raises recovery from 0.198 to 0.613.

The verdict: The cleanest control discipline in the batch. Converges with October 18’s label-free aggregation and October 22’s report isolation: what matters is the feedback channel, not the persona. Measure who may submit, how often the team gets feedback, and who can act on it.

18. Drift No More: Spectral Locking for Long-Horizon Multi-Agent Systems (arXiv:2611.04315, Pramanik, Maliha, Jha, Jha)

The claim: Task drift, role drift, and state staleness share a representational cause: agent hidden states move away from the directions encoding the active task, assigned role, and current shared state. A pilot study over 14,832 annotated turns supports it: drifted turns collapse near-uniformly across all three anchor subspaces (pairwise r = 0.72–0.78). ATLAS is a training-free intervention acting on hidden states before token generation: a positive-semidefinite anchor kernel over task, role, and state subspaces, steered toward shared high-coherence eigendirections via low-rank Gram decomposition.

The evidence: Across long-horizon memory, state maintenance, tool use, least-privilege coordination, and embodied stress tests, ATLAS outperforms prompting, retrieval, memory, and activation-steering baselines: up to +5.7 points memory macro-average over A-MEM with write/read failures down 31.7%/24.8%; 93.5% role consistency; transfers to a 72B backbone (61.0 vs 56.2). The ablation is the credibility anchor: ablating the joint task-role-state span costs 7.2 points against 0.8 for a matched-rank random span.

The trade-offs: Requires hidden-state access — open-weight models only, no black-box path (which is why the same group ships ATC at the message level). Intervention-style evaluation, single group.

The verdict: Watch: if the three-drifts-one-geometry hypothesis holds up in replication, agent reliability engineering gets a single dial where it previously had three. The message-level (ATC) and state-level (ATLAS) pair from one group is a rare full-stack offering.

Radar and watch list

• arXiv:2611.04032 (ROCm InferaSim): simulator to cut LLM-serving trial costs and pick the best configuration before deploying — the selection layer keeps getting its own tools.
• arXiv:2611.04897 (TapeSAC): automated, Pareto-optimal fine-grained memory management for large model training — watch the Pareto claim’s axes.
• arXiv:2611.03875 (INSIGHT-HPC): interpretable system intelligence over global HPC telemetry — observability meets HPC ops.
• arXiv:2611.05081: large-scale characterization of serverless/FaaS workloads — the workload-class census extends to functions.
• arXiv:2611.04556 (Inter-Agent Influence): evaluating persuasion, deception, and coercion in MAS — the adversarial-communication axis this blog flagged in October.
• arXiv:2611.04546: are LLM assistants regulatory-ready? Evidence from regenold’s 2026 EU AI Act Q&A challenge.
• arXiv:2611.05056: GitHub Copilot and productivity among developers with disabilities — unequal gains; equity dimension of the productivity debate.
• arXiv:2611.03935 (Labtune): lab organization and information sharing as experimental variables in LLM-agent discovery — institutional design as a hyperparameter.
• arXiv:2611.03832 (El Agente Farmaco): scalable AI scientist for drug discovery — the AI-scientist lineage meets a domain with real gates.
• arXiv:2611.04898: local distributed computation under crash failures — theory floor for the week’s service-relationship theme.

Sources

Primary: arXiv listings for cs.DC, cs.SE, and cs.MA, Wednesday, November 4, 2026 (35/30/19 new entries), plus the abstract pages of the twenty papers discussed above.

• arXiv:2611.04182 — When the Consumer Is an Agent: Execution-Grounded Service-Level Agreements (Orzechowski, Slota, Kitowski)
• arXiv:2611.04100 — The Agent Board: Kanban for Machines (Hunt, Nguyen, Gill; Corvic)
• arXiv:2611.05094 — A Gated Spec-Driven Workflow: An Audit-Trail Study of Coding-Agent Work (Abdo, Brom)
• arXiv:2611.04321 — ATC: Agent Trajectory Control for Role-Contract Enforcement (Maliha, Pramanik, Jha)
• arXiv:2611.03662 — MCPGuard: Finding Conformance Gaps in MCP SDKs (Sun, Liu, Dang, Zheng, Yang, Liu; Tsinghua; submitted Aug 12, 2026)
• arXiv:2611.04399 — Silent Instrument Errors Reorder Agent Leaderboards (Liu Yangze; Shandong; single author)
• arXiv:2611.04420 — Verifier Strength Does Not Buy Discovery Quality (Chen, Zhang, Zhang; pre-registered; Zenodo DOI 10.5281/zenodo.23308866)
• arXiv:2611.05314 — Noisy Issues, Noisy Results (Asad, Yasir, He, He, Malek)
• arXiv:2611.03742 — Fixed Detectors, Moving Code (Tang, Cai; submitted Nov 2, cross-listed cs.CR)
• arXiv:2611.04142 — Interpretable Early Termination of Web Navigation Agents (Talavera, Eirinaki)
• arXiv:2611.04998 — ForgeKernel (Chen et al., 16 authors)
• arXiv:2611.05150 — What Sets the Serving Speed of Looped Language Models? (Lu, Li, Ni, Tang, Kong, Yang, Guo, Gao)
• arXiv:2611.04137 — LoopKV: Loop-Aware KV Cache Compression (Zhou et al.)
• arXiv:2611.04382 — Beyond Compression Ratio: High-Throughput KV Compression (Wu, Liu, Ma, Chen, Tan, Tao)
• arXiv:2611.05104 — Workload-Static Optical Circuit Switching for LLM Decode (Thurmer et al.)
• arXiv:2611.04456 — How Agent Skills Evolve (Huang, Cao, Han, Jiang, Cheung, Liu; HKUST)
• arXiv:2611.04367 — Do Coding Agents Follow AGENTS.md? (Tsuchida, Fan, Shimari, Kula, Matsumoto; IEICE under review)
• arXiv:2611.04383 — Disposable Implementations: What Is Software Engineering For? (Treude; position essay)
• arXiv:2611.03931 — Beyond Division of Labor: How Roles Shape Feedback and Recovery (Yang, Li, Thakur, Yan)
• arXiv:2611.04315 — Drift No More: Spectral Locking (Pramanik, Maliha, Jha, Jha)

Method note: all figures quoted come from the papers’ own abstracts as listed on arXiv. Items flagged as single-author, position essays, or resurfaced preprints are labeled at point of use. Coverage boundaries were verified against the November 2 and November 3 published reports on this blog.