provenance for the machines, receipts for the humans

A glowing tree of connected nodes rising from dark machinery, with duplicated branches and light threads tracing code blocks back to their origins.

Week ending January 30, 2026; archive coverage: January 30.

Every week there's a shiny demo, and every week the actual story is buried one layer down in the plumbing. This week the plumbing barely tried to hide. Nobody launched a god-model. Instead we got Merkle trees, a provenance spec, a long essay arguing verification eats the world, a paper quietly torching static interpretability, and a forensic accounting of what a token really costs.

The through-line is simple and a little unglamorous: agents only become durable infrastructure when the boring layers underneath them are trustworthy. You need to know what your codebase contains, what your agents actually did to it, whether their work can be verified, whether your probes mean what you think, and whether any of it pencils out. That's five different flavors of "show your work," and this week delivered all five.

the index your teammate already built

Cursor's writeup on securely indexing large codebases is the kind of engineering post I actually enjoy, because it makes measurable claims instead of showing a video. The core observation is almost embarrassingly practical: clones of the same repo across an org average 92% similarity, so why rebuild the index from scratch every time someone opens their laptop?

The mechanism is a Merkle tree plus a similarity hash. New user joins, computes a simhash, the server finds a near-identical existing index, and you query against it immediately while the real sync happens in the background. The catch they took seriously is leakage: you can only compute a node's hash if you have the file, so the server drops any result the client can't cryptographically prove it holds. Time-to-first-query on the biggest repos falls from four hours to twenty-one seconds. That's not a party trick, that's someone's Monday morning.

receipts for what the agent did

Cognition's post on Agent Trace attacks the other half of the problem: once an agent writes code, what actually happened? Git tracks line diffs because in 2005 bandwidth was scarce. Now context is the scarce thing, and we're throwing it away on every commit. Agent Trace is a vendor-neutral spec to attribute each change to the specific conversation and line ranges that produced it, storing a URL pointer instead of dumping the whole transcript into your repo.

The honest framing isn't "know which AI to blame." It's that a traced codebase can hand an agent exactly the context that a line of code depends on, right when it's needed. Whether that materializes into the cache-hit and accuracy gains they're projecting is still a bet. But typed contracts around agent contributions are exactly what makes automation legible, and legibility is what lets you sleep.

verification is the bottleneck, not IQ

The RL environments essay makes the argument I keep making at people: the limiting factor isn't model smarts, it's whether you can reliably verify the work. The EDA-for-silicon analogy is a stretch and the author admits it, but the point holds. Reward signals drift, benchmarks saturate, agents learn to hack the grader, so environments have to be living systems, not static datasets.

The market read is spicier: frontier labs are the anchor buyers, coding is the first real market because it has compilers and tests, and the winners will be research shops, not throughput vendors. Treat the specific valuation talk as speculation. Treat "evals that survive contact with reality are the moat" as gospel.

the probe you trusted moved

The wildcard is a paper showing that linear representations can change dramatically over a conversation. Information encoded as factual at turn one can read as non-factual by turn twenty, even on directions that disentangle factuality from surface patterns, across model families. It happens from replaying someone else's script, not just on-policy.

So if you're leaning on a static probe or a fixed steering vector to police truthfulness mid-conversation, the ground is moving under you. Self-grading and single-snapshot interpretability just got more fragile. Skepticism vindicated, unfortunately.

what the tokens actually cost

Finally, Exponential View and Epoch AI's look inside OpenAI's unit economics does the forensic thing: triangulating leaks, disclosures, and Altman quotes to bracket GPT-5's real per-token cost rather than gawk at the valuation. Jevons says cheaper tokens explode demand, but that doesn't answer whether serving them makes money. Worth reading before you scope any inference budget on optimism.

what I'd do Monday

Audit your codebase indexing story: how long is time-to-first-query, and is it leaking cross-user? Start capturing agent provenance now, even a crude prompt-to-line-range map, because you'll want those receipts. Stop trusting any single-snapshot probe as a truthfulness gate. And put a real dollar figure on your inference path before someone in finance does it for you.

vocabulary inflation

Simhash: a single similarity value summarizing a codebase's file hashes, used to find a near-identical existing index to bootstrap from. Replication training: running the same long-form workflow thousands of times across varied environments so learning compounds from repetition rather than novelty. Environment factories: systems that continuously assemble, orchestrate, and refresh RL environments instead of hand-building brittle one-offs.