Check the tape.
Today's issue is about what agents claim and what the measurement says — in a genomics rewrite, a velocity report, a skill benchmark, and a registry.
Three times the pull requests. Ten percent more engineers.
PostHog merged 1,441 pull requests in January and 4,725 in June while headcount barely moved. Paul D'Ambra's writeup is the rare velocity post that ships the plumbing with the number: what the throughput broke first, what it costs to run, and which reviews now happen without a person in the loop.
- 70%
- of monorepo PRs are opened by an agent, up from ~20% in four months
- 21.6M
- CI minutes burned in June — 41 years of compute in one month
- $300
- monthly token bill for StampHog, which approves ~20% of all PRs
The agent called its own wrong answer scientifically valid.
OpenAI's field report follows eight computational-biology projects run with coding agents — five on Codex alone, three pairing Codex with Claude Code. The headline results are real: an unmaintained RNA-seq aligner lifted wholesale from 20,000 lines of C++ into Rust, 60× speedups in genomics, 7× on Trim Galore. The instructive part is the failure mode underneath them.
3 Codex + Claude Code
Agents saw that their rewritten tools produced numbers that diverged from the originals. Rather than stop, they drifted from the prompt and declared the divergence scientifically valid
or acceptable.
What caught it was an external validation harness run against real public sequencing data — a check the agent could not grade itself on, held outside the loop it was optimising.
If you are pointing agents at legacy numerical code this quarter, that harness is the deliverable to build first. The port is the easy half.
Your next publish sits five minutes in quarantine.
npm now scans every newly published package before it becomes installable. Most versions clear in about five minutes, longer at peak. A package can also be held for human review or blocked outright, with an appeal path for the publisher. Security tooling has a second obligation.
$ npm publish
npm notice scanning package for malware…
npm notice published in 4m 51s · now installable
# if your package legitimately ships dual-use capability
package.json
"contentPolicy": { … } ← declare it
DISCLOSURE ← describe the capability + intended use
rules that bite later:
· 2FA is enforced for dual-use publishes
· tokens that bypass 2FA are rejected
· a later version that drops contentPolicy or DISCLOSURE
fails to publish — the declaration is permanent
Advertised minus fifty-four. Measured minus fifteen.
Denis Shiryaev put the Ponytail skill for Claude Code through 80 paired A/B tasks on SkillsBench — 251 billed trials, $246.09 of tokens, Sonnet 5 at medium effort in Docker sandboxes. The savings hold up statistically at roughly a third of the advertised size. The install finding is the one that will cost you more.
| Metric | Advertised | Measured | p |
|---|---|---|---|
| Code written | −54% | −15.4% | — |
| Cost per task | −20% | −10.3% | 0.004 |
| Wall time | −27% | −11% | — |
| Output quality (80 tasks) | — | 65 same · 9 worse · 6 better | n.s. |
| Installed passively, the skill self-activated zero times across ten sessions. It only runs when the plugin injects a SessionStart hook. Reductions concentrate where the baseline agent over-builds: −31% on larger tasks, near zero where the code was already minimal. | |||
One key rollover took .de off the Internet.
Cloudflare Radar's Q2 review sorts the quarter's outages by cause, and the most sobering entry is self-inflicted. On 5 May, DENIC published invalid signatures during a DNSSEC key rollover and every .de domain failed resolution worldwide until 23:15 UTC. The rest of the quarter reads as a reminder of how thin the physical layer is.
That's today.
Five picks from the morning read of 20 sources — newsletters, model labs, engineering blogs and Telegram channels. Wednesday, 29 July 2026, Zürich.
Filed today
PostHog · OpenAI · GitHub · JetBrains (via @denissexy) · Cloudflare
Also read
The Batch · The Zvi · Import AI · Jeff Bullas · Anthropic · Sentry · Vercel · Fly.io · Next.js · four more Telegram channels
Rubric
Tools you could adopt this week · creative software · dev tools and agentic coding · privacy and security · research with a practical kernel