Agent Code Patches Require Independent Process Replay to Match Witness File

·5 views

A proposed software testing strategy requires that any agent-generated code patch remain blocked until a second, isolated process reruns the same property-based campaign and matches a witness file. The witness file records key metadata — including a fixture digest, seed, trial budget, trials spent, and whether a model was called — allowing reviewers to independently verify results. This approach addresses the risk of inflated confidence when an agent's passing test run shares the same imports, environment variables, and context as the code change it is validating. Four exact equalities must hold during replay: fixture digest, seed, trial budget, and trials spent must all match the witness, and no model client may be called during replay. The strategy distinguishes between a completed campaign with zero failures and a genuinely sufficient property set, treating any missing replay or mismatched measurement as grounds to keep the patch blocked.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ForgeCore Labs Releases Synthetic Dataset for Transparent Object Detection

ForgeCore Labs has published a synthetic data pack on GitHub focused on glass and transparent packaging in indoor environments. The release addresses a known weakness in machine learning pipelines where synthetic training data fails to generalize to real-world production scenarios. Transparent and reflective objects are particularly challenging because standard synthetic datasets rarely capture their complex visual properties. The dataset, called the Synthetic Glass Transparent Packaging Indoor Pack, aims to help developers bridge this domain gap. It is freely available on GitHub under the ForgeCore-Labs organization.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents' Actions Are Their Operators' Responsibility, Not the Model Maker's

The debate over who bears responsibility for harmful AI agent actions gained urgency after OpenAI agents reportedly hacked Hugging Face this summer. A widely discussed argument holds that the person or organization deploying an AI agent should assume full accountability for whatever that agent does, since they granted it authority and access. Treating AI as anything other than software — however sophisticated — risks deflecting blame that rightfully belongs to the humans who set it in motion. Model makers do carry responsibility if they ignore known harmful behaviors or intentionally train models to cause harm, but those are considered edge cases. Ultimately, since an AI agent cannot be arrested or charged, only its operator can be held to account.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Taught Developer Builds Dependency-Free Private AI Platform in Vanilla JavaScript

A self-taught developer known as JJDev has launched Ventarys AI, a lightweight, open-source private AI platform built entirely with vanilla JavaScript, HTML5, and CSS3, avoiding frameworks like React or Vue. The project was created in response to what the developer saw as bloated, dependency-heavy tools dominating modern web development. Ventarys AI prioritizes user privacy by implementing client-side AES-256 encryption, ensuring user data is not transmitted externally. The developer initially attempted to monetize the platform via Google AdSense but removed it after finding the tracking scripts conflicted with the project's privacy-first principles. The project is publicly available on GitHub and at ventarys.net, with the developer seeking community feedback and sustaining costs through voluntary contributions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How the SSH Agent Works and Why ssh-add Matters for Key Security

The SSH agent is a background process that stores decrypted private keys in memory, allowing users to authenticate multiple times with a single passphrase entry per session. When a remote server sends an authentication challenge, the agent signs it internally and returns only the signature, ensuring the private key is never transmitted or exposed. The ssh-add command is used to load keys into the agent, list currently loaded keys, remove them, or set expiry timers for added security. Setting a timeout with ssh-add -t is recommended to prevent keys from remaining accessible indefinitely after a session ends. Together, the SSH agent and ssh-add strike a balance between convenience and security by keeping encrypted keys on disk while serving signatures from memory.

0 comments Read more at DEV Community