Another 13% shave, and more stability

No grand autopsy this week. Mostly it was small bugs and wrong assumptions — the kind that make one step fail or one workflow stall at 3 a.m. and leave a run sitting there until somebody notices. Each one is a one-line fix that turns a stall into a routed failure, and 413 commits later the runs are noticeably more boring, which is the goal.

The shortlog for the week, for the record:

git shortlog -sn --since=2026-08-13
   259  vx-maintainer
   152  tix-repair-bot
     2  Daniel Poelzleithner

Two of those are mine. The rest were landed by the workflows, gated by the gates in their own tree. Over the three months of the last post, I was still the top committer.

This is what one of those commits looks like while it is being made — an implement run for a feature spec, fanned out into a worker per work package, several of them running at once, the manager paused until they report back:

The compressor hook, polished

The LLM gateway runs a content pipeline over every request before it leaves the daemon: redact, compress, redact again. The compression stage is headroom, which now ships as its own self-contained tix flake — the gateway stopped carrying a built-in headroom service, and the sidecar, its weights, the retrieval skill and the round-trip test come from one flake you register as a source. The hooks got a proper polishing this week: honest survival when the compressor is down, restarting or mid-update (requests pass through instead of failing), and the stats every agent step was silently paying for became visible.

Here is what the sidecar reports after a week of real workflow traffic:

❯ tix services client headroom/headroom/default stats
headroom compressor — mode: cache
  requests     31963 total · 7477 compressed · 2523 passthrough
  tokens       1,627,897,746 → 1,413,152,531 · saved 214,745,215 (13.19%)
  compression  avg 11.3% · best 100.0% (87,459 → 34 tokens)
  latency      avg 86.86 ms · min 0.3 ms · max 2594.16 ms
  mcp          0 compressions · 0 retrievals
  strategies:
    text: 12628 uses · 168,580 tokens saved
    smart_crusher: 11294 uses · 8,704,788 tokens saved
    passthrough: 5504 uses · 0 tokens saved
    code_aware: 2795 uses · 20,351 tokens saved
    log: 1008 uses · 130,089 tokens saved
    diff: 998 uses · 21,166 tokens saved
    search: 270 uses · 61,192 tokens saved
    html: 220 uses · 439 tokens saved
    tabular: 164 uses · 1,748 tokens saved
    config: 45 uses · 1,494 tokens saved

1.6 billion tokens in, 1.4 billion out: 13.19% shaved, at an average latency of 87 ms per request. The best single case took an 87,459-token blob down to 34 tokens — some tool output that was all noise and one line of signal. That is the middleware doing what an agent would otherwise be asked to do by hand, and it does it before the prompt ever reaches a provider or a budget.

The important word in that number is another. Headroom runs after rtk, which rewrites the shell commands agents run inside the sandbox so that cargo nextest, find, grep and friends return what the agent needs instead of everything the tool prints. Its own ledger, global scope, since we started counting:

❯ rtk gain
RTK Token Savings (Global Scope)
════════════════════════════════════════════════════════════

Total commands:    92837
Input tokens:      1128.4M
Output tokens:     138.0M
Tokens saved:      991.0M (87.8%)
Total exec time:   83457m47s (avg 53.9s)
Efficiency meter: █████████████████████░░░ 87.8%

By Command
─────────────────────────────────────────────────────────────────────────
  #  Command                   Count   Saved    Avg%     Time  Impact
─────────────────────────────────────────────────────────────────────────
 1.  rtk read                   2528  326.8M   22.4%      0ms  ██████████
 2.  rtk find                    713  221.0M   54.8%     3.1s  ███████░░░
 3.  rtk test cargo nextes...    303  187.8M   99.5%   45m21s  ██████░░░░
 4.  rtk test cargo nextes...    224   32.6M   98.3%  139m51s  █░░░░░░░░░
 5.  rtk test cargo nextes...    153   18.6M   99.1%     4m2s  █░░░░░░░░░
 6.  rtk grep                   6689   14.3M   13.7%      6ms  ░░░░░░░░░░
 7.  rtk test cargo nextes...     15   12.8M  100.0%    10m4s  ░░░░░░░░░░
 8.  rtk ls -la /nix/store/       11   12.7M   43.9%     1.4s  ░░░░░░░░░░
 9.  rtk:toml ps aux              77   10.2M   99.2%     1.4s  ░░░░░░░░░░
10.  rtk test cargo nextes...     67    9.6M   99.5%   6m25s   ░░░░░░░░░░
─────────────────────────────────────────────────────────────────────────

Nearly a billion tokens that never existed, 87.8% of what the tools wanted to say. A cargo nextest run is 99.5% noise to an agent: it needs the failures, not the 1,400 lines of PASS. Headroom’s 13% is taken from what survives rtk — the two layers don’t compete, they stack. And none of the recipes had to change to get either of them.

The difftastic mystery

For weeks, some agents would read a diff and then behave as if they had seen a different repository. They would report files that weren’t changed, miss hunks that were, and — my favourite — produce a confident review of a diff that amounted to a stat summary. Retries fixed nothing. Model swaps fixed nothing. It only happened on some machines.

The cause: rtk re-parsed whatever git diff printed. If you have difftastic configured as your global external diff driver — as I do, as a lot of people do — git diff prints difftastic’s side-by-side output, which has no +++ or @@ markers. rtk parsed that into a garbled stat-like summary and handed it to the agent as the diff. Every agent reading diffs through rtk on a machine with difftastic was working from fiction, and the same recipe on a machine without it was fine. If you have difftastic installed globally, rtk will drive your agents into an existential crisis.

The fix is upstream as rtk PR #3607: parsed diff invocations are pinned to unified diff (--no-ext-diff and friends), and anything rtk doesn’t recognise falls back to raw passthrough rather than a guess. Our harness bumps rtk to 0.45.0 with that patch vendored until it merges, and ships jq beside the rewrite hook, which had been silently no-opping wherever jq was missing. The lesson is the one from the last post again: the agents weren’t wrong, the inputs were lying.

Providers and models

The gateway grew up a bit from being tested against more endpoint providers with more models behind them. Endpoints are now ranked by operator priority and that priority persists; real Anthropic wire shapes, versioned base URLs and blocked candidates are survived instead of rejected; consecutive assistant messages are merged for upstreams that refuse them; model ids with colon variant suffixes resolve; and claude.ai OAuth credentials are accepted on the Anthropic routes with a verbatim passthrough. claude-code workers now default to the tix gateway, and a new tix claude hosts an interactive claude-code session through it — same credentials, same budget, same compression as a workflow step.

More providers means more opinions on the review panel, which is the point. Here a landing sits at its approval gate with two reviewers from two providers disagreeing — claude-code#opus says approve-with-nits, opencode#gpt-5.6-sol says blocking — and the gate shows me the distilled findings, the fix commits beyond the reviewed head, and the diff before I answer. The models argue; the gate decides; I get to read the argument:

Highlights

• Durable run records got real. The runner journals every run event as CBOR into a per-run journal (tix-log), and the daemon serves logs, event streams and projections from it instead of copying events into the shared database. Interrupted workflows are reconciled at boot, resumed at their execution frontier, and auto-resumed when it is safe to. A run’s outcome.json can be regenerated from the ledger after a crash.
• Release supply chain (spec 067) went from design to code. Workflows declare release folders, digest them at step completion, and a reproducibility sweep is enforced: non-reproducible content fails the release. Releases publish to Walrus, with Seal primitives and a Move approval path, and tix can verify an artifact’s digest — distinguishing unverifiable from missing from tampered.
• Multi-run monitoring. Several runs stream into one merged view, with quorum and recovery semantics that were hardened over a string of follow-up fixes the repair bot landed on its own.
• Run-scoped leases and detached children. A workflow can lease resources for the lifetime of a run, and a subgraph step can spawn an independent child run that outlives it.
• Admission under load. The scheduler’s load governor holds admissions when the host is saturated, heals idle holds without thrashing, and a held admission is claimed as soon as a step fails and frees capacity.
• Models on disk. A split GGUF is treated as one model, pulling a multi-GGUF repo asks which quantization you want, and downloads draw a progress bar.
• Harness config is rendered at build time. tix-harness-render emits each harness’s dialect from the skill index; opencode and hermes joined the rendered-fragment pipeline, and rtk integration closed the cline and hermes gaps.
• Worker honesty. A turn settles on its end marker, not on the prompt reply; retry frames render truthfully; auto-answered permission requests stop showing as “waiting for input”; all 39 bare tool descriptors got real input schemas; stale workers get pinged from the keep-alive loop.
• Less data loss at the edges. The secrets store never loses the master key on a keyring miss; a torn journal tail is truncated before repair appends; oversized log chunks are never dropped; event-log writers flush before they are dropped; tix-sui derives independent AES-SIV key halves via HKDF and redacts recovery phrases from diagnostics.
• Profiling toolkit. heaptrack, jemalloc heap profiling, dhat and coz are packaged and wired in, for the next time something leaks.

What moved on the roadmap

• Durable run records — from “runs survive a daemon restart” to journal-backed reads, boot reconciliation, frontier resume and auto-resume. Close.
• Reproducible release folders — was horizon, now building: spec 067 landed declared folders, digests, the enforced reproducibility sweep, and Walrus publication.
• Output signing — the verify path exists: digests per artifact, a verify RPC and CLI, and a persisted release record that the sweep checks against. Per-run leaf keys are the next step.
• Run budget enforcement — steps now default to a 15-minute budget and surface gateway retries in their log, so a stalled step fails loudly rather than spending quietly.
• Step memoization and container warm pool — no movement this week; the review cache from the last post is still the only memoization in production.

Next week is more of the same, on purpose. The stalls that are left are rarer and stranger, which means each one takes longer to find and is worth more when it’s gone.