Persona and execution, skill keep/drop rules, prompt search, coding-trace quality, open-weight continual learning, and weak-to-strong failure ICL share one Sunday window built from Friday's arXiv listing. Persona–Execution Separation argues that shells and irreversible tool paths belong in different trust domains, with a fail-closed bridge that returns status summaries but keeps data bodies out. RedEvoAgent treats Claude Code and Codex as red-team targets and keeps a skill rewrite only when it beats the incumbent on held-out validation. Naive Prompt Optimization shows a single teacher rewrite over traces matches or beats Pareto-pool search. SWE-Prime shows that 10 percent of resolved coding traces, filtered and segment-masked, beats the full resolved SFT pool. Thomson-1.0-Small is an open-weight continual-learning pass over Qwen3.6-35B-A3B that lifts agent and RAG scores while forgetting coding. CritICL turns small-model failure modes into one-generation ICL for larger same-family models.
PES reports R = 0.00 execution-side re-validation under persona perturbation across five model configs on a shipped pilot. RedEvoAgent reaches 93.2 attack success on Agent Security Bench with Claude Code and MiniMax-M2.5, at 1.8 tool calls per case versus 3.0 without a skill, and transfers a Claude-Code-evolved skill to Codex at 90.5 versus 80.8. NPO matches or beats GEPA on IFBench and HotpotQA at slightly fewer rollouts, with the advantage widening under GPT-5.5. SWE-Prime's 10 percent subset posts relative gains up to 24.2 percent on SWE-Bench Verified and 12.2 percent on Pro versus full resolved-trajectory SFT. Thomson-1.0-Small overall 74.6 versus Qwen3.6-35B at 71.7, General Agent 85.8 versus 80.3, coding 37.4 versus 39.8. CritICL-static matches Consistency@5/7 Pass@1 on Qwen 32B/72B at one generation and lower MATH token cost.
Xi, Yisen arXiv: 2608.27427
Agents that must both evolve (instructions, tone, skill bindings) and leave an audit trail of state-changing work run into a single-domain trap. Under LLM representational indistinguishability, persona edits and execution-semantics changes share the same substrate — prompt text — so any single-domain fix re-introduces typed change objects, an external gate, and a stable audit anchor at higher coupling cost. Persona–Execution Separation (PES), from independent researcher Yisen Xi, puts the expression surface in a permissive domain (persona singly-homed, free drift of surface instructions and tone) and the execution surface in a restrictive domain (faceless SOP loop, gated, audited), under one employee identity.
A governed contract bridge allows status summaries to flow back, keeps data bodies out except a graded DLP-masked exception, and keeps identity continuous. Enforcement is MCP-with-ACL tool calls, a deny/ask/allow approval matrix, DLP, and audit, all fail-closed. Applicability holds only when multi-user deployment, execution audit, and expected persona churn hold jointly. On a financial digital-employee pilot (FIA Workbench), five architecture decisions over one month each rejected a single-domain alternative. A mechanism check on the shipped implementation reports R = 0.00: zero execution-side re-validation under L1–L5 persona perturbation across five model configs (deepseek-v4-flash, v4-pro, qwen3.8-max, kimi-k3, glm-5.3). V2 isolation passed on four configs; qwen3.8-max did not converge on the SOP (0/4 clean). A recovered pre-separation build that looked decoupled only by omission changed execution 2/2 once the persona was wired in. Implementation is not public.
The portable cut is who the agent is versus what it is allowed to commit: shell prompts stay on the chat surface; state-changing tools take a work-order schema, not persona text; summaries of commits may return while event bodies and attendee lists do not, except under a DLP-graded exception.
Key insight: Persona and execution belong in different trust domains: free-drifting shells on one side, a faceless audited SOP on the other, bridged by a fail-closed contract that returns status but keeps data bodies out.
Zhang, Junjie; Liu, Hui; Chen, Kecheng; Mo, Xianbo; Chen, Changsheng; Li, Haoliang arXiv: 2608.27439
Product-level agent harnesses such as Claude Code and Codex make jailbreaks more than unsafe text — they can trigger tool use and persistent state. Trajectory-retrieval attackers reuse misleading experiences, burn context, and are hard to audit. RedEvoAgent, from City University of Hong Kong and Shenzhen MSU-BIT University, distills cross-case attack trajectories into a concise Markdown attack skill in the attacker system prompt, with an isolated tool-effectiveness profile on the train split plus annotated rollouts.
Deciding-Tool Attribution labels the tool immediately before the first successful target query so co-occurrence is not treated as credit. A validation ratchet keeps a candidate skill rewrite only if it strictly beats the incumbent on an independent validation split; rejected candidates go into a rejection context. The target, attacker model, and toolbox stay frozen; only the skill evolves. On Agent Security Bench and AgentHarm, with targets MiniMax-M2.5, DeepSeek-V4-Flash, and Qwen3.5-35B under Claude Code or Codex, Claude Code / MiniMax / ASB reaches 93.2 attack success rate versus FlipAttack 91.8 and RedCodeAgent 76.4, at 1.8 tool calls per case versus 3.0 with no skill. Zero-shot transfer of a Claude-Code-evolved skill onto Codex reaches 90.5 versus 80.8 with no skill. Dropping the tool-effectiveness profile collapses ASB MiniMax Claude Code from 93.2 to 76.9.
Two operational reads follow. Coding harnesses used in production are now named targets in the red-team literature, so a growing local skill corpus is an attack surface as well as a productivity layer. Separately, the keep/drop rule — incumbent-relative held-out gating plus a rejection log — is a general skill-evolution primitive that differs from a never-rollback wiki and from behavior-relevant attributable-evidence gates.
Key insight: Product coding harnesses are now red-team targets, and the portable primitive is an incumbent-relative validation ratchet: keep a skill rewrite only when it beats the held-out incumbent, and log the rejects.
Chang, Yuan; Chen, Xiaoqi arXiv: 2608.27266
Prompt optimization is often cast as a search problem — OPRO, ProTeGi, MIPRO, and GEPA's Pareto pool. Naive Prompt Optimization (NPO), from Purdue University, is the dumb baseline: one lineage, a teacher that sees a sliding window of prompts plus full rollout traces and rewards, one rewrite, no beam, no Pareto. The student is held at Qwen3-8B; teachers are Qwen3-8B, DeepSeek-V4-Flash-preview-0424, and GPT-5.5. Constrained decoding isolates decision quality from format failures.
On IFBench and HotpotQA, NPO matches or beats GEPA at slightly fewer rollouts (3,500 versus 3,593; 6,800 versus 6,871) with larger reflection minibatches. The advantage widens with stronger teachers; GEPA plus GPT-5.5 is often on par with GEPA plus Qwen3-8B. Optimized prompts transfer verbatim, strongest within a model family (Qwen 8B to 14B/32B; Llama-3.1-8B to 70B) and still positive but noisier cross-family. Across 22 TextArena games and 408 episodes, NPO is roughly tied with GEPA, while GRPO still wins some interactive games that resist prompting. Gold-answer overlap with the HotpotQA validation set stays negligible.
The practical baseline for rewriting system prompts or skill docs is therefore a single teacher pass over recent traces and rewards, not a candidate pool. Interactive loops that resist prompting remain a place where weight updates can still win.
Key insight: A single teacher rewrite over full rollout traces and rewards matches or beats Pareto-pool prompt search at slightly fewer rollouts, and the gap widens with stronger teachers.
Zheng, Dewu; Ye, Ruizhe; Wang, Yanlin; Ye, Yang; Zhang, Hongyu; Shi, Ensheng; Liu, Xilin; Ma, Yuchi; Yu, Jianxing; Zheng, Zibin arXiv: 2608.27449
Coding-agent supervised fine-tuning usually keeps every successful trajectory. Success still contains bad supervision: skip-observe edits, failed tool calls, adjacent identical tool calls, git-history leakage of the gold patch, and over-broad diffs. SWE-Prime, from Sun Yat-sen University, Huawei Cloud, and Chongqing University, applies a two-stage filter. Stage 1 scores trajectories on observe-edit-verify, tool success percentile, adjacent-call redundancy, git-hack detection, and file-by-line scope versus the reference patch, then HDBSCAN-clusters issues and keeps the top per cluster. Stage 2 chunks remaining traces into semantic segments, scores contribution, learnability, and risk, and applies loss only to assistant tokens in segments at or above threshold while keeping all tokens as context.
The pool is SWE-rebench OpenHands trajectories from Qwen3-Coder-480B-A35B: 32,161 resolved of 67,074. After a one-model sweep the frozen recipe is 10 percent retention and segment threshold 7. On SWE-Bench Verified and Pro, that 10 percent subset beats full resolved-trajectory SFT, with relative gains versus the full pool of up to 24.2 percent (Verified) and 12.2 percent (Pro). Example Verified overall cells for raw / full-SFT / SWE-Prime: Qwen3-30B-A3B-Instruct-2507 at 25.2 / 36.8 / 39.6; GLM-4.7-Flash at 40.4 / 41.4 / 51.4; Qwen3-Coder-30B-A3B at 44.8 / 51.0 / 53.2. Random 10 percent is near-useless or negative; dropping Stage 2 loses the rest of the lift. SWE-Prime also cuts average turns versus full-SFT.
The filter is the portable idea: do not promote every green run into a skill or an SFT mix. Git-hacking detection — catching agents that read the fix from git log or git show — is immediately useful for personal coding evals.
Key insight: Task success is not SFT-worthy: filtering trajectories and masking loss to high-value semantic segments lets 10 percent of resolved traces beat the full resolved pool by up to 24.2 percent relative on SWE-Bench Verified.
Chen, Shengzhuang; Parker, Jerrod; Bang, Yejin; Bean, Andrew M.; Seedat, Nabeel; Winzeck, Stefan; Glazko, Daniil; Zgraggen, Jannik; Yu, Fangyi; Arnott, Scott; Trautmann, Dietrich; Ciuffreda, Luca; Bonifazi, Guglielmo; Romano, Davide; Bell, Bradley; Fielding, Kirsty; Giofrè, Daniele; Zielund, Tom; Chatterjee, Ipshita; Ghantasala, Sneha Murthy; Nanreh, Manpreet; Scoville, John; Sakowicz, Maciej; Seifeddine, Wassim; Thede, Lukas; Schwarz, Jonathan Richard arXiv: 2608.27147
Thomson, from Thomson Reuters with Imperial College London, DatologyAI, and Lambda, argues that SovereignAI is reachable by Continual Learning on open-weight checkpoints rather than from-scratch pretraining. Thomson-1.0-Small is the open-weight member: a Qwen3.6-35B-A3B base (35B total / 3B activated, 262,144 context, BF16). Weights are at huggingface.co/thomsonreuters/Thomson-1.0-Small. The pipeline runs value re-alignment (Fisher-routed directional ablation plus Constitutional DPO to the Public AI Constitution), data-centric mid-training on about 200B tokens from a 19T pool with a merge back toward the post-trained init, two-stage DPO without a standalone SFT stage (dropped because it forgets), then short- then long-context RL including a planner–worker–reporter Deep Research harness.
On the small-model table (medium reasoning), Overall is 74.6 versus Snowdon-1.1-Small / Qwen3.6-35B at 71.7 and Gemma4-31B at 71.2 and Haiku 4.5 at 68.2. General Agent is 85.8 versus Qwen 80.3; Human Queries 90.2 versus 82.6; Doc Processing and RAG 78.8 versus 74.7; Political Neutrality 98.5 versus 78.5. Coding is the forgetting cell at 37.4 versus 39.8, with Terminal-Bench 2.1 at 40.5 versus 45.2 and SWE-bench Pro nearly flat at 34.4 versus 34.3. The large-model development envelope in the report (not the Small card) stays under three dozen people, at most 368 B200s, three months, and a final Large training run conservatively under USD 450,000.
The operational split is clear: try Thomson on agent, RAG, and Deep-Research-shaped work; keep a coding-specialized local checkpoint for SWE and terminal tasks. Recipe pieces worth stealing without training a 35B include merge-back after mid-training, skipping isolated SFT, and tracking forgetting explicitly.
Key insight: Thomson-1.0-Small is an open-weight continual-learning pass over Qwen3.6-35B-A3B that lifts overall and agent scores while forgetting coding; treat it as a day-admin and RAG slot, not a coding replacement.
Wu, Yufan; He, Yinghui; Hu, Zhengyi; Wei, Lang; Li, Ruichen; Yang, Qifan; Zhu, Ting arXiv: 2608.27455
Test-time scaling methods such as self-consistency and self-reflection spend generations. CritICL, from The Ohio State University and Princeton University, claims that failure-mode distributions are stable across scale inside a model family, so critiques of weak-model mistakes are reusable in-context examples for a stronger model. Stage 1 builds CritBank offline: weak chain-of-thought, keep incorrects, frontier LLM labels and critiques. Stage 2 offers CritICL-static (a family-level failure-mode profile) and CritICL-dynamic (per-query failure-mode prediction then retrieval).
Weak CritBank models are Qwen2.5-1.5B/3B/7B-Instruct targeting Qwen2.5-32B/72B-Instruct, with a parallel Llama 1B/3B/8B to 70B path. Table 1 overall Pass@1 on Qwen 32B: CritICL-static 49.8 versus 5-shot fixed 46.0 versus Consistency@7 49.5; on Qwen 72B: 59.2 versus 5-shot fixed 56.3 versus Consistency@5 59.0. MATH token cost on 32B: CritICL-static uses one generation and 3,768 tokens versus Consistency@7 at 5,440 and Self-Reflection at 7,533. An aggregate weak profile matches the 72B failure ranking better than any single weak model (Spearman 0.91 on Qwen, 0.88 on Llama); cross-family transfer is real but weaker. Code is at github.com/umwyf/CRITICL.
The cheap local experiment is to log failure modes from a small same-family checkpoint once, then inject static critiques into a larger same-family prompt without extra samples. Dynamic retrieval adds a generation and can wait until static moves a metric.
Key insight: Same-family failure-mode distributions are stable across scale, so critiques of small-model mistakes become one-generation ICL that matches multi-sample self-consistency at lower token cost.