Weekly Review — Oct 19–25, 2026

Payments on Monday, then three posts in a row about checking: who checks the checker, what a loop keeps once a check passes, and what happens to the rules an agent writes for itself. Tuesday’s physics episode was meant as the break in the middle. It turned out to be about evidence too.

This Week on the Blog

When the Agent Pays per Inference Call

In June I built a research agent that paid fixed prices for articles from a $1 session on a test network. AWS has now published a production case study in which Incarna’s agents pay BlockRun for model inference, one call at a time, on Base with USDC, through Amazon Bedrock AgentCore payments. For a metered call the final charge isn’t known until generation finishes, so the work moves to the x402 upto scheme, where the agent signs a ceiling and the seller settles the actual amount, and to sizing the session for a day of calls instead of one task. The spending cap carries over unchanged and still sits in the infrastructure, outside the model’s control, as long as the role the agent runs under can’t create or reconfigure payment sessions. One question the docs didn’t answer for me is whether the session gets back the unused part of a ceiling. Until I know, I’d size it as if every call costs the full ceiling.

Why Does the Shower Curtain Attack You?

The bathroom air pushes the curtain in, because the pressure inside the running shower is slightly lower. That much the leading explanations agree on. Why the pressure drops is still open: the popular Bernoulli story, a warm-air-rises idea that fails because cold showers do it too, and a sideways vortex that David Schmidt found in a 2001 computer simulation, which earned him an Ig Nobel Prize. The push works out to roughly 6 newtons on a back-of-envelope estimate, which is why weights in the hem fix it. This is the sixth Lunch Break Physics, and the first one without a clean answer.

Who Referees the AI?

In July a purported disproof of the Collatz conjecture got through Lean’s official kernel and through Nanoda, an independent second checker. It was wrong, and it exploited a different bug in each of them. Lean’s creator Leonardo de Moura says he strongly believes AI built the exploit. Once output gets too big for anyone to read, acceptance rests on the checker, its specification and the code around it, and a capable generator rewarded for passing the checker can find their weak spots. The Lean community’s answer carries over to agent gates: keep the trusted part small, check it with independent implementations that share no code, publish how the check works, and remember that a pass only certifies what you specified.

Your Agent Needs to Remember What Passed

In a toy model with ten independent pieces at 1% odds each, a perfect check and kept pieces that never break, you need about 10^20 tries if you guess them all at once and about 1,000 if you keep every piece a check confirms. The model raises the odds that a change is useful, and a verifier plus a memory of accepted changes turns those odds into progress. The post walks through a toy combination-lock simulation and the Digital Red Queen paper, where LLM-evolved Core War warriors work as a set but are brittle one by one. It also lists where the arithmetic breaks: pieces that only pay off together, misleading partial scores, and verifiers that can be gamed. Build the verifier before you reach for a bigger model.

Your Agent’s Notes Are the Closest Thing It Has to Training Data

A new paper on agent plasticity measures how frontier-model agents improve when their weights stay frozen and everything they learn goes into tools, skills and notes. The agent with the best final score wasn’t the one that improved most per dollar. The weak improvers often didn’t use the notes they had written, and agents that did use their notes still failed when a note was wrong or too narrow. I recognise both from my own setup, where one rule has been flagged more than ten times by the analyzer that reviews my sessions. The lesson I took: measure the learning loop itself, and enforce the rules that matter with code.

The Thread This Week

Each of the four agent posts asks the same thing: what decides, beyond the generator’s own answer? The spending cap is enforced by the payment service, provided the agent can’t reconfigure its session. The Lean kernel decides what counts as a proof. The verifier decides which change the loop keeps. And a rule in the agent’s notes only works if something reads it at the right moment, ideally code that runs whether or not the agent remembers. The shower curtain is the honest counterpart. Everyone agrees on what you can observe, and the cause is still argued about. The questions are the same in both cases: what has actually been checked, and by whom?

Further Reading

Things worth your time that did not get their own post, all public:

• Evaluating Agents on Highly Subjective Tasks (Cameron R. Wolfe): The written companion to his AI Engineer talk. When a task can’t be checked deterministically, he lays out a three-part roadmap that combines human evaluation, offline evaluation and production monitoring, plus statistical methods to tell a real improvement from noise. A good next step after Who Referees the AI? for tasks that lack a deterministic acceptance check.
• What Is Loop Engineering? (IBM Technology): Martin Keen in about eleven minutes. The loop itself is trivial, and the engineering is what you build around it: a goal with a stop condition, a persistent record of what was tried, and a separate checker subagent. His four pitfalls include “intent debt”, illustrated by an agent that makes a test pass by relaxing the validation on a discount code.
• The Problem with Jev: Can You Trust AI Decisions? (IBM Technology): Jeff Crume on decision models that return a label and a probability. His point is that confidence isn’t evidence: corrupt the inputs and the model still reports 97%. The remedy is to split one big decision into smaller, observable ones and treat the model as an untrusted component. “Verify, then trust.”
• Beyond Synthetic Testing: Capturing and Replaying Real Database Workloads at Airbnb: Airbnb captures production MySQL traffic at its ProxySQL layer and replays it offline for three goals: load testing with real traffic, checking query compatibility across upgrades and migrations, and reproducing performance problems.
• How Image Watermarking Works (Computerphile): Mike Pound shows why metadata and least-significant-bit tricks don’t survive real edits, and how a learned watermark (Adobe’s open-source TrustMark) is trained to survive compression, crops and colour shifts. He also covers the attack where a valid watermark gets copied onto another image. So a watermark carries a claim about where an image came from, and proving that claim needs something more, such as a signed manifest (C2PA) that binds the image to a trusted signer.
• Why AI Compute Comes in Rectangles (Latent Space): Modal’s Erik Bernhardsson on GPU capacity sold as three-year blocks starting months out, while real demand is bursty. Sandboxes for code that LLMs write went from a product the team once discussed shutting down to about a third of Modal’s revenue. He also argues that code review often stands in for accountability that CI/CD should carry, which is worth arguing with.
• The Revised Rules of Engineering Management (The Pragmatic Engineer): Will Larson on why 2010s managers were told never to make a technical decision again, and why that advice is gone. With agents, leaders are back in the details. The marker for staff engineers stays the same: trade-offs under ambiguity, which agents often don’t even recognise because they’re not in the context window.

Until Next Sunday

If there’s one habit to take from this week, it’s to ask what your green check rests on before you let it stand in for a person reading the work. That applies to a payment cap, an eval suite, a judge prompt and the notes your agent keeps about itself. Which check in your pipeline would you least like a clever generator to study? Tell me in the comments on LinkedIn.

This is the Weekly Review, and it also goes out as Sunday’s newsletter.