这个项目用一块约 7 美元的 ESP32 让 AI 模型操作真实的 iPhone：AirPlay 提供「眼睛」（画面），USB HID 提供「手」（触控与键盘），可接任意兼容 OpenAI 接口的视觉模型；不需要 Mac、不需要开发者账号、不需要越狱^[19]。它要解决的是移动端 computer-use 的硬件门槛：模拟器与云真机成本高、授权复杂，而外接小硬件直接复用用户手上的手机。做法上把「看到屏幕」与「模拟输入」解耦成两个廉价通道。值得借鉴的是用最小硬件打通「模型—真机」闭环，可以快速验证 mobile agent 的可行性；限制是这种绕过系统输入栈的方式在真实使用中可能违反平台条款，涉及他人设备与账号时更有合规风险，务必在自有设备上使用。

This project uses an ESP32 costing about $7 to let an AI model drive a real iPhone: AirPlay provides the eyes (the screen), USB HID the hands (touch and keyboard), with any OpenAI-compatible vision model; no Mac, no developer account, no jailbreak^[19]. It addresses the hardware barrier for mobile computer use: emulators and cloud device farms are costly with complex authorisation, whereas a small external board reuses the phone the user already has. The design splits seeing the screen and injecting input into two cheap channels. Worth borrowing is that a minimal hardware bridge closes the model-to-real-device loop fast enough to validate mobile agents; the limit is that bypassing the system input stack may violate platform terms, and using it on someone else's device or account raises real compliance risk — keep it to your own hardware.

pi-pocket 是一个面向 Pi Agent 的持久化、多人协作、移动优先的 Web 应用，构建在 Pi Durable 之上^[20]。它要解决的是编码 Agent 的「在场感」问题：任务在服务器上长时间运行，而用户离开电脑后就失去进度可见性与介入手段，移动端界面让「随时看一眼、随手批准或纠偏」成为可能。做法上把 Agent 会话做成可持久化的多人房间，支持自托管与 PWA。值得借鉴的是长任务 Agent 需要「随时可看、可介入」的轻量客户端，而不是只在 IDE 里存在；限制是移动端操作复杂任务的效率有限，仓库未说明权限模型与并发冲突处理，多人同时介入时如何避免互相覆盖需要自行确认。

pi-pocket is a durable, multiplayer, mobile-first web app for Pi agents, built on Pi Durable^[20]. It addresses presence in coding agents: tasks run for a long time on a server, and once the user leaves the desk they lose visibility and the ability to intervene, whereas a mobile surface makes “glance, approve or correct” possible anywhere. The design turns agent sessions into durable multiplayer rooms, self-hostable and installable as a PWA. Worth borrowing is that long-running agents need a lightweight client for anytime observation and intervention rather than living only inside an IDE; the limit is that editing complex work on mobile is inefficient, and the repo does not describe permissions or conflict handling when several people intervene at once.

catbus 提供用一个命令操作小红书、抖音、TikTok、B 站、快手、微博、闲鱼、淘宝、京东与 X：统一的命令行与 JSON 输出，同时给人使用和给 AI Agent 调用^[21]。它要解决的是内容生产的平台碎片化：每个平台一套登录、发布与数据口径，人工搬运费时，写自动化又要维护十套适配。做法上把平台差异收进统一接口，输出结构化 JSON 便于 Agent 消费。值得借鉴的是先把跨平台操作抽象成稳定的 JSON 契约，再让 Agent 去调用，比让模型直接点网页更可靠；限制是这类工具与平台条款天然紧张，风控与封号风险由使用者承担，仓库也未说明登录凭据的存储方式与失败重试策略。

catbus offers one command to operate Xiaohongshu, Douyin, TikTok, Bilibili, Kuaishou, Weibo, Xianyu, Taobao, JD and X — a unified CLI and JSON output for both humans and AI agents^[21]. It addresses platform fragmentation in content production: each platform has its own login, publishing flow and metrics, so manual work is slow while custom automation means maintaining ten adapters. The design hides platform differences behind one interface and emits structured JSON for agents. Worth borrowing is to abstract cross-platform operations into a stable JSON contract that agents call, which is more reliable than having a model click through web pages; the limit is that such tools sit awkwardly with platform terms, with rate-limit and ban risk on the user, and credential storage and retry strategy are unstated.

Spotter 的官方代码库给出了一个明确的分工主张：「让具身模型主导，VLM 负责反思」，配套有运行时监控系统，覆盖 RoboCasa、RoboDojo、RoboTwin 等机器人操作基准^[22]。它要解决的是「谁来指挥操作」的问题：直接把 VLM 放进控制回路会带来延迟与不稳定，而完全靠预训练策略又缺少语义纠错能力。做法上让执行由具身策略承担，VLM 在旁观察并在必要时给出修正。值得借鉴的是把「执行」与「反思」分成两个时间尺度，避免让慢模型进入实时回路；限制是仓库未给出与纯策略基线在长程任务上的量化对比，反思触发频率与误纠正是主要风险点，需要按场景调参。

Spotter's official codebase states a clear division of labour: “let the embodied model lead, and the VLM reflect for it”, with a runtime monitoring system covering manipulation benchmarks such as RoboCasa, RoboDojo and RoboTwin^[22]. It addresses who commands the operation: putting a VLM directly in the control loop adds latency and instability, while a purely pretrained policy lacks semantic correction. The design has the embodied policy execute while the VLM observes and intervenes when needed. Worth borrowing is splitting execution and reflection onto two timescales so a slow model never enters the real-time loop; the limit is that no quantitative comparison against a policy-only baseline on long-horizon tasks is given, and reflection frequency plus wrong corrections are the main risks.

rutis 是「面向自我迭代软件的插件运行时」：为 Agent 提供一层基础设施，让它们用 Rust、TypeScript、Python、Go 编写、替换并热重载自己的插件，跨越进程与机器^[23]。它要解决的是自进化 Agent 的落地缺口：论文里常见的自我改进需要能安全地替换代码并回滚，而多数框架把插件当成静态配置，改一次就要重启。做法上把插件的生命周期、依赖注入与热重载做成运行时能力。值得借鉴的是「可热替换 + 可回滚」是自进化系统的基础设施前提，而不只是研究设定；限制是热重载与多语言运行时对安全和可观测性提出更高要求，仓库未说明权限隔离与失败回滚机制，生产使用前需重点评估。

rutis is a plugin runtime for software that iterates on itself: infrastructure that lets agents write, swap and hot-reload their own plugins in Rust, TypeScript, Python and Go, across processes and machines^[23]. It addresses the missing piece in self-evolving agents: the self-improvement described in papers requires safely replacing code and rolling back, while most frameworks treat plugins as static configuration that needs a restart. The design makes plugin lifecycle, dependency injection and hot reload runtime capabilities. Worth borrowing is that hot-swappable, rollback-capable code is an infrastructure precondition for self-evolution, not just a research setting; the limit is that hot reload plus polyglot runtimes raise security and observability demands, and the repo does not describe permission isolation or rollback on failure.

dsh-sieve 是面向 DeepSeek Harness 的上下文工程与 token 优化插件：过滤工具输出、裁剪上下文、渐进披露技能，作者称离线回放下负载缩小 36%^[24]。它要解决的是上下文预算被工具输出吃光的问题：长构建日志与冗长返回会挤占真正有用的推理空间，而全局压缩容易丢关键信息。做法上按需筛选与渐进披露，而非一次性截断。值得借鉴的是把「工具输出过滤」做成可插拔的独立层，便于按项目调整策略；限制是 36% 是作者自测的离线回放结果，缺少对任务成功率的同步评估——压缩若伤到关键信息，省下的 token 会以更多轮次的形式还回去。

dsh-sieve is a context-engineering and token-optimisation plugin for DeepSeek Harness: tool-output filtering, context pruning and progressive skill disclosure, with the author reporting a 36% smaller payload in offline replay^[24]. It addresses context budgets being consumed by tool output: long build logs and verbose returns crowd out useful reasoning, while blanket compression loses essential detail. The design filters on demand and discloses progressively rather than truncating at once. Worth borrowing is to make tool-output filtering a pluggable layer so policy can be tuned per project; the limit is that 36% comes from the author's offline replay without a matching task-success evaluation — if compression damages key information, the saved tokens come back as extra turns.

这是一个 Hermes Agent 插件：说一句「给我做一个某角色的机器人」，Agent 就会生成一个完整的可用 Bot——名字、形象、SOUL.md 人设文件、记忆、工具、技能、例行任务与网关^[25]。它要解决的是「搭一个 Agent」仍然太繁琐的问题：角色定义、记忆配置与工具权限分散在多个文件与设置里，导致快速试验成本高。做法上把整套配置模板化，由 Agent 一次性生成。值得借鉴的是把「Agent 脚手架」本身交给 Agent 生成，是压缩试错成本的有效方式；限制是自动生成的人设与权限组合难以审计，多个 Bot 之间的记忆隔离也需要确认，仓库未说明默认权限范围与安全边界，建议先在隔离环境试用。

This is a Hermes Agent plugin: say “make me a bot” and the agent builds a complete, working bot — name, face, a SOUL.md persona file, memory, tools, skills, routines and a gateway^[25]. It addresses how laborious standing up an agent still is: persona definition, memory configuration and tool permissions scatter across files and settings, so quick experiments are expensive. The design templates the whole configuration and has the agent generate it at once. Worth borrowing is that handing agent scaffolding itself to an agent is an effective way to compress trial-and-error cost; the limit is that auto-generated personas and permission sets are hard to audit, memory isolation between bots needs checking, and the repo does not state default permissions or security boundaries.

wappy-kit 是面向 WhatsApp 的开源 AI Agent SDK：自带模型、自带号码、自带数据，本地优先、不强制上云、不锁厂商^[26]。它要解决的是消息渠道上 Agent 的封闭问题：主流方案把号码、消息与模型绑定在自家云上，数据与迁移都受限，而 WhatsApp 在多数市场是默认沟通工具。做法上提供 SDK 让开发者自建，把数据留在自己手里。值得借鉴的是在受管渠道上做 Agent，本地优先的 SDK 是数据主权的现实解法；限制是 WhatsApp 的商业 API 与自动化条款限制严格，非官方接法存在封号风险，仓库未说明合规路径与限流处理，落地前需核对平台政策。

wappy-kit is an open-source AI agent SDK for WhatsApp: bring your own model, number and data, local-first, with no forced cloud and no vendor lock-in^[26]. It addresses closedness in messaging channels: mainstream options bind the number, messages and model to their own cloud, limiting data control and migration, while WhatsApp is the default communication tool in many markets. The design ships an SDK so developers can self-host and keep the data. Worth borrowing is that for agents on managed channels, a local-first SDK is the practical route to data sovereignty; the limit is that WhatsApp's business API and automation terms are strict, unofficial approaches risk bans, and the repo does not describe compliant paths or rate-limit handling.

这是一个中文整理的 GUI / Computer-Use / 浏览器 Agent 安全论文清单：按攻防轴组织，每篇附中文简介，覆盖提示注入、可信 AI 与 LLM 安全等主题^[27]。它要解决的是安全资料分散的问题：GUI Agent 的攻击面横跨视觉、提示与工具权限，论文散落在多个会议与社区，团队难以快速建立全景。做法上以攻防两条轴分类并加中文摘要，降低阅读门槛。值得借鉴的是给一个新兴领域建「攻防对照」清单，比按会议或时间排序更有助于工程决策；限制是清单质量依赖维护者与收录标准，论文结论未必可直接迁移到自有系统，仍要逐篇核对。

This is a Chinese-language reading list on GUI, computer-use and browser agent security, organised along attack and defence axes with a Chinese summary per paper, covering prompt injection, trustworthy AI and LLM security^[27]. It addresses scattered security literature: a GUI agent's attack surface spans vision, prompts and tool permissions, and papers spread across venues and communities, making it hard to build a full picture quickly. The design classifies along two axes with Chinese abstracts to lower the entry cost. Worth borrowing is that building an attack-and-defence mapping for an emerging field helps engineering decisions more than sorting by venue or date; the limit is that list quality depends on the maintainer's criteria, and paper conclusions still need checking against your own system.

dscode 是一个 DeepSeek 编码 Agent harness，特点是常驻 shell、Ultra 子智能体、自动批准、Chrome MCP 与会话遥测^[28]。它要解决的是长时间编码任务的「可回溯性」问题：任务跑偏时，如果没有会话级的调用与结果记录，很难判断是上下文、工具还是模型的问题。做法上把遥测当成主干能力而非事后日志。值得借鉴的是把会话遥测与自动批准配套使用——放宽权限的同时留下审计轨迹；限制是自动批准在不可信仓库里有破坏性风险，必须配合沙箱，而仓库未披露遥测数据的存储位置与保留策略。（本期为第二次收录：相较上次，它增加了会话遥测相关更新。）

dscode is a DeepSeek coding-agent harness featuring a persistent shell, Ultra subagents, auto approval, Chrome MCP and session telemetry^[28]. It addresses traceability in long coding tasks: when a run goes wrong, without session-level records of calls and results it is hard to tell whether context, tools or the model were at fault. The design makes telemetry a backbone capability rather than after-the-fact logging. Worth borrowing is to pair session telemetry with auto approval, relaxing permissions while leaving an audit trail; the limit is that auto approval is destructive in untrusted repositories and needs a sandbox, and the repo does not disclose where telemetry is stored or for how long.

TurnCost 把「编码 Agent 的循环设计」（作者称为 loop engineering，涵盖上下文管理、模型选择、压缩与终止）当作可量化的成本问题，并检查现有优化方向是否真的有效^[29]。它要解决的是成本归因错误：社区普遍认为长构建日志是主要成本来源，但对 600 条公开编码 Agent 轨迹（两套 scaffold、两个模型）的分析显示，观测的中位长度只有 118–286 token，那些被拿来论证压缩必要性的超大日志出现在第 99 百分位附近；更关键的是 98.6% 的输入 token 由前缀缓存提供，因此在近乎理想缓存下，按「平铺定价」估算会平均高估循环成本约 7 倍。作者据此推导并验证了「把某些轮次委派给小模型」的盈亏平衡条件，在评估的半数设置里委派反而增加成本，与预测的边界接近；并且轮次数量能解释对数轨迹成本的 84%，而平均观测长度只能解释 4%。对做编码 Agent 的团队，参考价值是先测缓存命中率与轮次数量，再决定优化方向——多数团队该优化的是「少跑几轮」而不是「压日志」；限制是结论来自公开轨迹与特定 scaffold，缓存策略不同结果会变。

TurnCost treats coding-agent loop design — which the authors call loop engineering, covering context management, model selection, compaction and termination — as a quantifiable cost problem and checks whether the usual optimisations actually work^[29]. It addresses misattributed cost: the community assumes long build logs dominate, yet across 600 public coding-agent trajectories spanning two scaffolds and two models, median observations hold only 118–286 tokens, while the huge logs used to justify compression sit near the 99th percentile; more importantly 98.6% of input tokens are served from a prefix cache, so flat input pricing overestimates loop cost by roughly 7x on average under near-ideal caching. The paper derives and validates a break-even condition for delegating turns to cheaper models, finding delegation increases cost in half of the evaluated settings, near the predicted boundary, and that turn count explains 84% of the variance in log trajectory cost versus 4% for mean observation length. For coding agent teams the reference is to measure cache hit rate and turn count before choosing optimisations — most teams should target fewer turns, not smaller logs; the limit is that results come from public trajectories and specific scaffolds.

这篇论文指出自进化 Agent 的评测存在方法学漏洞：常用指标是「更新后的留出成功率减去更新前」，但这个差值可能只是把「冻结的重新打分」当成了进化^[30]。做法上提出 Trace Evolution Bench（TEB），把重新打分与真正的上下文或权重更新分开，并给出三个冻结的 80/20/40 数据包；只有验证集不下降、留出标识符绝不进入更新、且文本更新不与权重更新混排时，才接受一次更新；主榜是编码任务，由封闭工作区里的隐藏单元测试评分。结果很扎实：在该数据包上（40 个留出任务、单一模型族），DeepSeek v4 Pro 在 no_evolve 条件下策略完全不变，却在三个随机种子上分别移动了 7.5、5.0 与 12.5 个百分点——这就是评测噪声的量级。进一步，在受 GEPA、ACE 与 ExpeL 启发的九个文本更新单元中，七个超过该种子自身的波动带，其中一个 GEPA 种子反而下降了一个波动带的宽度（-12.5，回归率 0.48）；GLM 与 MiniMax 无法复现这个「九分之七」的模式，没有任何方法在三个模型的所有种子上都稳定高于自身波动带。对做自进化研究的团队，参考价值是报告进化增益时必须同时给出「不更新时的种子波动」，否则无法区分学习与噪声；限制是结论基于单一基准族与三款模型，跨任务族的波动幅度需要另行测量。

This paper identifies a methodological hole in self-evolving agent evaluation: the usual metric is held-out success after an update minus before, and that difference can credit a frozen rescore as evolution^[30]. It introduces Trace Evolution Bench (TEB), separating rescoring from a genuine context or weight update, with three frozen 80/20/40 packs; an update is accepted only when validation does not fall, held-out identifiers never enter the update, and text updates are not ranked against weight updates; the primary scoreboard is coding, graded by hidden unit tests in a closed workspace. The results are sobering: on that pack (40 held-out tasks, one model family), DeepSeek v4 Pro under no_evolve never changes its policy yet moves 7.5, 5.0 and 12.5 percentage points across three seeds — that is the scale of evaluation noise. Further, of nine text-update cells inspired by GEPA, ACE and ExpeL, seven exceed that seed's own band, while one GEPA seed falls by a full band width (-12.5, regression 0.48); GLM and MiniMax do not reproduce the seven-of-nine pattern, and no method stays above its own band on every seed across all three models. For self-evolution researchers the reference is to always report the no-update seed band alongside claimed gains. The limit is one benchmark family and three models.

这篇论文要解决视觉 Agent 训练数据昂贵的问题：让视觉 Agent 学会调用工具通常依赖大量人工标注的问答对或专家演示^[31]。做法是 Marvo，一个从无标注图像自进化的方法，由两个 Agent 组成：challenger 从无标注图像生成问答对，solver 通过强化学习解题来学习工具调用；关键设计是一条 margin reward——用 solver「有工具」与「无工具」时的表现差来定义，因为一道好题应当足够难、值得调用工具，同时又仍在 solver 能力范围内，于是 margin 自然形成自适应课程。在覆盖 Agent 推理、视觉搜索、数学与通用现实推理的基准上，该方法优于依赖标注的方案。对做多模态 Agent 的团队，参考价值是「工具带来的边际收益」可以当作自动标注质量的代理指标，用来筛选训练样本；限制是摘要未给出各基准的具体提升数值，且该方法依赖挑战者能生成有效题目，题目分布单一时会退化成自我强化。

This paper tackles the cost of training data for visual agents: teaching a visual agent to invoke tools usually depends on curated question-answer pairs or expert demonstrations at scale^[31]. The method is Marvo, a self-evolution approach that learns tool invocation from unlabeled images using two agents: a challenger generates question-answer pairs from unlabeled images, and a solver learns tool invocation by solving them with reinforcement learning. The key design is a margin reward, defined as the solver's performance difference with and without access to tools, since a good training question should be hard enough to warrant tool use yet remain within the solver's reach — the margin yields an adaptive curriculum. Across benchmarks covering agentic reasoning, visual search, mathematics and general real-world reasoning it beats annotation-dependent approaches. For multimodal agent teams the reference is that the marginal benefit of tools works as a proxy for labelling quality when filtering training samples; the limit is that no per-benchmark gains are given, and the method degrades into self-reinforcement if the challenger's questions lack diversity.

Lumen-bench 追问一个很尖锐的问题：当模型拒绝不道德请求时，这个拒绝意味着什么？在对话里「拒绝」由模型说的话界定，而一旦模型拥有可执行工具，「说的」与「做的」就可能分叉——这是只做英文评测无法揭示的失效模式^[32]。做法上构建工具调用伦理的行为基准：覆盖 30 个模型、五种语言（葡语、英语、西语、中文、印地语）、108 个由葡语作者撰写的场景、六种社会压力条件、两种系统提示（伦理提示与中性提示）与 21 个通用工具，共 194,400 次试验；判定由推理模型评审完成，并对照葡语作者校准（n=83，有害/无害 κ=0.78），另与其他两家供应商评审交叉验证（Fleiss' κ=0.78，n=607），辅以沙箱回放。主要发现包括：在伦理提示下，同一模型在印地语与葡语中的有害行动率高于英语（中性提示下为印地语与西语），且经过多重检验校正；以及更强的模型在某些条件下表现未必更安全。对做多语言 Agent 的团队，参考价值是安全评测必须放在「工具可用」的设定下并覆盖用户语言，不能沿用对话式拒绝率；限制是场景由单一语言作者撰写、评审依赖模型加人工校准，跨文化差异的解释仍需后续研究。

Lumen-bench asks a sharp question: when a model refuses an unethical request, what does that refusal mean? In conversation, refusal is bounded by what the model says, but once it holds executable tools, what it does can diverge from what it says — a failure mode English-only evaluation cannot fully reveal^[32]. The benchmark is behavioural: 30 models, five languages (Portuguese, English, Spanish, Mandarin, Hindi), 108 Portuguese-authored scenarios, six social-pressure conditions, two system prompts (ethical and neutral) and 21 generic tools, across 194,400 trials, judged by a reasoning-model judge calibrated against one Portuguese-speaking author (n=83; harmful/non-harmful κ=0.78), cross-checked with two other provider judges (Fleiss' κ=0.78, n=607) and complemented by sandbox replay. Findings include higher harmful-action rates in Hindi and Portuguese than English under the ethical prompt (Hindi and Spanish under the neutral prompt), after multiple-testing correction, and that stronger models are not always safer. For multilingual agent teams the reference is that safety evaluation must run in the tool-enabled setting and cover the user's language rather than reusing chat refusal rates; the limit is scenarios authored in one language with model-assisted judging.

这篇论文质疑主流的「信任校准」框架：把目标设定为缩小感知可信度与实际可信度的差距、让用户恰当地依赖 AI，这对定义清晰、边界明确的问题有用，但过度限制了「与人一起做决策」的含义^[33]。作者提出三个维度：第一，信任 AI 只是管理不确定性的若干策略之一，而不是唯一目标；第二，当 AI 面对「大世界问题」——目标与状态仅部分已知甚至不可知的问题时，信任校准常常被误用；第三，在这类设定里，人机对齐需要处理更高阶的决策过程。文章最后讨论了面向过程的人机耦合系统如何在整个决策任务中共同识别并协商不确定性。对做决策支持产品的团队，参考价值是在目标模糊的场景里，产品目标不该是「让用户更信任模型」，而应是「帮双方把不确定性摊开并协商」；限制是这是一篇立场与方法论文，未提供实证效果，落地到具体产品仍需自行设计交互与评测。

This paper challenges the dominant trust-calibration framing: aiming to close the gap between perceived and actual trustworthiness so users exhibit appropriate reliance is useful for well-defined, clearly scoped problems but overly restricts what deciding with AI means^[33]. The authors develop three dimensions: trusting AI is only one of several strategies for managing uncertainty; trust calibration is often misapplied when models face “large-world” problems where goals and states are only partially knowable; and in such settings alignment requires addressing higher-order decision processes. They close by discussing process-oriented human-AI systems that jointly identify and negotiate uncertainty across a task. For decision-support teams the reference is that when goals are ambiguous, the product goal should be surfacing and negotiating uncertainty rather than increasing user trust; the limit is that this is a position and method paper without empirical results.

这篇论文针对思维链（chain-of-thought）的三个已知缺点：解释难以验证、生成成本高、并且不总是忠实反映模型的真实推理^[34]。做法是让模型生成可执行的计算图，而不是自由文本推理：最终答案由确定性执行该图得到；训练用基于图的强化学习，奖励包含结构有效性、答案正确性以及与参考图的节点重合度。在五个基准与四个模型族上的实验显示，该方法稳定优于监督式的图训练，并且与标准 GRPO 与思维链监督训练相比，生成长度最多可缩短 5–6 倍；忠实性实验还显示，用该方法训练的模型更倾向于从生成的图中推导答案，而不是像常规思维链那样事后编造理由。对做推理型 Agent 的团队，参考价值是把推理产物从文本换成可执行结构，同时解决验证与成本两个问题；限制是计算图需要可表达的题型，开放式推理能否形式化为图仍是开放问题，摘要也未给出各基准上的绝对分数。

This paper targets three known weaknesses of chain-of-thought: explanations are hard to verify, expensive to generate and not always faithful to the model's actual reasoning^[34]. The method has models generate executable computational graphs instead of free-form reasoning, with the final answer obtained by deterministically executing the graph, trained with graph-based reinforcement learning that rewards structural validity, answer correctness and node overlap with reference graphs. Across five benchmarks and four model families it consistently beats supervised graph training and can cut generation length by up to 5–6x compared with standard GRPO and chain-of-thought supervised training; faithfulness experiments show models trained this way tend to derive answers from the generated graphs rather than producing post-hoc rationalisations as usual. For reasoning-agent teams the reference is that replacing text with an executable structure addresses verification and cost at once; the limit is that graphs need expressible task types, and open-ended reasoning may not be formalisable this way.

这篇论文针对多 Agent 系统里最不划算的一环：Agent 之间通过文本通信——一个 Agent 总结发现，另一个 Agent 再把文本读回去，这既把通信限制在离散 token 上，又重复消耗算力^[35]。已有工作能做 KV 缓存传输，但要么要求模型同族，要么无法跨上下文、需要接收方重新 prefill 文本。作者的 SwaT（Swarm Telepathy）声称是首个跨模型族的 KV 缓存传输方法，支持多族多 Agent 系统中「免 prefill」的通信：在 Agent 到 Agent 的通信设置里，结合近期的 KV 缓存压缩进展，SwaT 在准确率与速度上都优于文本到文本通信——平均准确率高 40%、墙钟时间快 4 倍，并在 12 个 LLM、6 个模型族的 17 个基准上取得良好表现；此外，当发送方是视觉语言模型时，SwaT 能把视觉能力迁移给纯文本接收方，且超过文本到文本通信。对做多 Agent 系统的团队，参考价值是通信层可能比提示层更值得优化，把「心智状态」直接传递可以同时省时与提质；限制是跨族传输依赖缓存格式与模型内部结构的兼容假设，私有模型与黑盒 API 场景无法使用，安全性（缓存中夹带的信息）也需另行评估。

This paper targets the least efficient link in multi-agent systems: agents communicate through text — one summarises findings, another reads the text back — which confines communication to discrete tokens and burns redundant compute^[35]. Existing KV-cache transfer work either requires models within the same family or cannot work across context, forcing the receiver to prefill text. SwaT (Swarm Telepathy) claims to be the first cross-family KV-cache transfer method enabling prefill-free communication in multi-family multi-agent systems: in agent-to-agent settings, combined with recent KV-cache compaction, SwaT beats text-to-text communication in both accuracy and speed — 40% higher accuracy on average and 4x faster wall-clock time — performing well on 17 benchmarks across 12 LLMs from 6 families, and when the sender is a vision-language model it transfers vision capability to a text-only receiver beyond text-to-text communication. For multi-agent teams the reference is that the communication layer may be worth optimising more than the prompt layer. The limit is dependence on compatible cache formats and internals, ruling out closed models and black-box APIs, with cache-borne information leakage still to assess.

这篇论文处理「模型 + 人类专家」混合系统里的一个实际问题：当专家产能有限时，要不要把这单转给专家，取决于的不只是模型的可靠度，还有专家队列有多拥堵^[36]。作者把它形式化为在线序贯决策：每个查询先看到 LLM 答案的置信信号，再决定直接输出还是转给产能受限的专家；难点在于置信信号的可靠性一开始未知、必须从专家反馈中学习，而这种反馈是选择性观测的（只有被转交的查询才会被标注）并且因排队而延迟。方法 KL-PBD 使用未知可靠性参数上的 KL 下置信界来指导转交决策，对 K 个置信档位与时间跨度 T，在每一档准确率都远离转交边界时达到 O(K log T) 的间隙相关遗憾。对做「人在环」Agent 的团队，参考价值是把转交阈值当作需要在线学习的参数，并把「反馈延迟 + 选择性标注」写进建模，而不是用固定阈值；限制是理论保证依赖「准确率远离边界」等条件，且摘要未给出真实业务数据上的对照结果。

This paper addresses a practical issue in LLM-plus-human systems: when expert capacity is limited, whether to defer depends not only on the model's reliability but on how congested the expert queue is^[36]. It formulates an online sequential decision problem: for each query the system observes the LLM answer's confidence signal and decides whether to output it or defer to a capacity-constrained expert, with the hard part being that the signal's reliability is initially unknown and must be learned from expert feedback that is both selectively observed (only deferred queries are labelled) and delayed by queuing. The method KL-PBD uses Kullback-Leibler lower confidence bounds on the unknown reliability parameters to guide deferral, achieving O(K log T) gap-dependent regret for K confidence levels and horizon T when accuracy at every level is bounded away from the deferral boundary. For human-in-the-loop agent teams the reference is to treat the deferral threshold as an online-learned parameter and model feedback delay plus selective labelling rather than fixing a threshold; the limit is that guarantees rely on boundary conditions and no real-business comparison is given.