Agent Systems Brief: Durable Skills, Semantic Tools, and Workspace Discipline

The August 29 cycle makes the model-versus-system distinction unusually clear.

Tencent released weights for a 770B-parameter MoE with more than one million tokens of context. A finance-specialized sparse model appeared on a major gateway. Anthropic expanded subsidized access for scientists and won a court challenge over its military-use restrictions.

Yet the most actionable evidence came from five papers about everything surrounding the model: durable procedural memory, evaluator ceilings, semantic software interfaces, chart provenance, and noisy workspaces.

The shared engineering lesson is:

A larger context window expands what an agent can see. Reliability depends on how the system structures what the agent can know, do, verify, and ignore.

Vendor figures below are first-party claims. Research results are author-reported. The court item is grounded in AP and the court record rather than a paywalled secondary source.

1. Hy4 combines open weights, extreme scale, and artifact-oriented work

Tencent released Hy4 preview, a Mixture-of-Experts model with 770B total parameters, 49B active per token, and support for contexts beyond one million tokens. The company positions it for long-running coding, documents, spreadsheets, slides, games, and scientific research.

In a blind internal evaluation involving 163 experts and 203 technical tasks, Tencent reports an average score of 2.99/4, compared with 2.92 for GLM-5.3 and 2.94 for Kimi K3. Tencent also reports a 31.8% end-to-end throughput gain after the model participated in optimizing inference operators and systems. These are vendor measurements, not independent replication.

Builder implication: a million-token window is not a memory strategy. Teams should measure retrieval precision, distraction, cache cost, long-horizon completion, and whether artifacts remain internally consistent after hundreds of turns.

2. Ling 3.0 Flash Fin tests specialization with low active compute

Ling 3.0 Flash Fin is a 124B-total model that activates roughly 5.1B parameters per token. Its gateway listing advertises 256K context, up to 32K output, reasoning, function calling, and workflows including investment research, spreadsheet analysis, valuation, and multi-step banking work.

The small active footprint is attractive for high-volume financial agents. The domain label, however, is not a control boundary.

Builder implication: wrap financial tools with typed inputs, deterministic calculations, source timestamps, portfolio constraints, approval gates, and replayable audit records. Never let fluency substitute for accounting equality or risk policy.

3. Anthropic's science program couples access with capability tiers

Anthropic is offering 10,000 seats in Claude Team for scientists for one year, with standard seats free and premium seats priced at $15 per month. Eligible principal investigators can add lab members, while projects with heavier compute needs may apply for up to $50,000 in credits.

Anthropic continues to restrict biology and chemistry work to Opus-tier models and blocks specialized biology and drug-development queries in Fable because of dual-use risk.

Builder implication: capability routing is a safety primitive. Access policy can depend on user role, domain, model tier, tool grant, and task risk rather than treating every authenticated request as equivalent.

4. The Anthropic–Pentagon ruling makes use restrictions a governance issue

U.S. District Judge Rita F. Lin ruled against the Pentagon's “supply chain risk” designation of Anthropic. AP reports that the court found the action unlawful in a dispute tied to Anthropic's restrictions on lethal autonomous weapons and domestic mass surveillance. The government may appeal.

The immediate legal outcome matters, but the systems lesson is broader: model-use policy becomes meaningful only when it survives procurement pressure, contract negotiation, and enforcement.

Builder implication: high-risk restrictions should exist in contracts, policy engines, technical controls, monitoring, and escalation paths. A prompt-level refusal alone is not durable governance.

5. WikiSkill turns trajectories into persistent procedural knowledge

WikiSkill separates an agent workspace into raw execution traces, a persistent wiki, and executable skills. After each iteration, one component updates the wiki while another proposes skill changes. Skill updates are retained only when validation improves; the wiki can preserve broader lessons from both success and failure.

Across five benchmarks and five models, the authors report consistent gains over compared skill-evolution methods. Qwen-3.5-9B with WikiSkill reaches 47.4% average accuracy, above Qwen-3.6-27B without skills at 39.4%. On ALFWorld, the 9B model reaches 70.2% with a skill evolved by the 27B model, versus 63.4% with its own skill.

This cross-model transfer result is more important than the leaderboard. The best model for discovering a procedure need not be the cheapest model for executing it.

Builder pattern: maintain three distinct stores:

1. replayable raw evidence,
2. a concise knowledge layer with provenance and uncertainty,
3. versioned executable skills with tests, rollback, and acceptance metrics.

Do not promote a trajectory into a skill merely because it succeeded once.

6. AgentJudgeBench exposes structural ceilings in LLM evaluation

AgentJudgeBench contains 3,808 cases spanning six workflow-DAG patterns and three difficulty levels. It evaluates whether LLM judges can assess tool-calling workflows when ground truth is missing or partial.

The paper reports that alignment degrades more than 1.5 times faster as difficulty increases without ground truth. On hard cases, six judges from 20B models through frontier systems converge around 77–82%. Structured rubrics improve performance by as much as 6.5 percentage points; chain-of-thought and temperature changes contribute little.

The convergence is a warning: scaling the judge does not automatically solve structural ambiguity.

Builder pattern: use LLM judgment only for genuinely semantic dimensions. Verify graph structure, tool arguments, state transitions, arithmetic, schema conformance, permission scope, and artifact existence deterministically. Keep human review for high-impact ambiguity.

7. ASIL replaces visual imitation with semantic software control

ASIL exposes software through structured JSON observations and code-executable semantic actions rather than screenshots and click coordinates. The implementation spans 15 applications, 300 single-application tasks, and 80 multi-application tasks.

The authors report that closed models score above 80 with fewer than five actions per task. Under the same tasks and a 50-step budget, screenshot-and-click baselines reach strict success of only 6.6 and 26.6. Small-scale fine-tuning raises Qwen3.5-2B from 58.0 to 72.1 and Qwen3.5-9B from 66.6 to 80.4.

Builder pattern: prefer semantic interfaces in this order: domain API, typed tool or MCP contract, structured application state, then vision-based computer use as a fallback. Keep validators and postconditions attached to each action so “tool returned 200” is not confused with “task succeeded.”

8. DEEPCHART separates valid rendering from valid evidence

DEEPCHART contains 1,482 chart-generation tasks sourced from scientific papers, financial reports, and ecosystem reports. Text inputs average 220,600 tokens, while multimodal documents average 218 pages.

The benchmark separates source-data extraction, derived-data reasoning, and rendering. In the Ecosystem domain, generated programs have an average execution rate of 0.782 and visual score of 0.447, while source-data F1 is only 0.149 and derived-data F1 is 0.276.

A chart can therefore look acceptable and be built by runnable code while encoding the wrong data.

Builder pattern: make every chart reproducible from a data manifest containing source location, extraction rule, transformed table, units, filters, aggregation formula, and reconciliation checks. Evaluate evidence before pixels.

9. DuMateBench shows that workspace noise is a first-class variable

DuMateBench reconstructs 200 tasks from real user sessions across eight scenarios and 17 capability types. Its Docker environments deliberately include missing dependencies, unstable networks or tools, and distracting files such as backups, stale data, and near-duplicate names.

Across 20 configurations, the paper reports the highest mean score for DeepSeek-V4-Pro at 0.8106. Within Hermes, DeepSeek-V4-Pro reaches 0.8223. Under high workspace noise, Hermes loses 20.08 percentage points, Claude Code 18.53, and OpenClaw 9.49.

DuMate with Opus-4.8 reaches the highest individual score, 0.8548, but consumes an average 1.56 million tokens and more than 17 minutes per task. One benchmark should not dictate a default provider, but it clearly demonstrates a quality-cost-time trade-off.

Builder pattern: scope the workspace before model invocation. Provide an explicit root, ignore patterns, a file manifest, freshness metadata, duplicate detection, dependency checks, and a scratch directory. Make recovery behavior part of evaluation rather than treating infrastructure failures as noise to delete from results.

A production control stack suggested by the evidence

These developments support a seven-layer agent architecture:

1. Capability envelope: model, context, latency, and active compute.
2. Authority: typed tools with source-system permissions.
3. Workspace: bounded files, freshness, ignore rules, and dependency state.
4. Memory: raw traces, distilled knowledge, and validated skills kept separate.
5. Execution: semantic actions with preconditions and postconditions.
6. Verification: deterministic assertions plus bounded semantic judgment.
7. Evidence: provenance manifests for every consequential artifact.

Failures occur when these layers collapse into one another: a long transcript becomes “memory,” a click becomes “task completion,” a judge score becomes “ground truth,” or a pretty chart becomes “correct analysis.”

Builder checklist

• Benchmark occupied long context, not advertised context alone.
• Route specialized capabilities by role and task risk.
• Keep source-system permissions outside generated text.
• Distill traces into versioned skills only after validation.
• Prefer semantic tool interfaces over coordinate control.
• Define deterministic checks for DAGs, schemas, math, and artifacts.
• Record chart data lineage before rendering.
• Bound the workspace and detect stale or duplicate files.
• Measure cost and latency per verified outcome.

Takeaway

The next reliability gain may not come from swapping in the newest model. It may come from a cleaner workspace, a better tool contract, a skill that survived validation, or one deterministic assertion that catches what an LLM judge cannot see.

Long context expands the canvas. System design determines whether the agent paints the right picture.

Sources: Tencent Hy4; Vercel Ling 3.0 Flash Fin; Anthropic scientists program; AP on Anthropic v. Pentagon; arXiv 2608.27454, 2608.26623, 2608.26991, 2608.26757, and 2608.26546.