Declare the whole machine

Daily — 2026-08-05. Covering the releases and signals landed since the 08-04 daily.

The tracked-dep spine moved twice, and the two moves pull the same word in opposite directions. mise v2026.8.2 widens the declaration surface to the entire host — its bootstrap command crossed from “install my tools” into full Terraform-style host provisioning: files, users, groups, systemd services, Docker Compose projects, firewall rules, secrets, applied locally or over SSH to a remote fleet. Claude Code v2.1.222 narrows what a declaration is trusted to cause — repo-local settings can now disable Remote Control but not enable it, worktree isolation binds file edits and Bash in every session type (closing a disclosed sandbox-escape class), and inter-agent SendMessage runs through the permission classifier before dispatch. The config layer grew teeth and grew a leash on the same day. That is the frame: you can declare more than ever, and your declaration is trusted with less than ever.

The tracked-dep spine

mise v2026.8.2 — the version manager provisions the fleet

This is the lede, and it is a genuine scope leap, not a deepening. mise bootstrap — which W24 grew from version-management into machine-management (dotfiles, macOS defaults, login shell, Homebrew) — now becomes a full declarative host-provisioning system with a Terraform-style plan/apply/status model:

• mise bootstrap plan previews changes with table or --json output and --detailed-exitcode (0 = no changes, 2 = changes, 1 = error). Resources have stable identities, dependency graphs, and validation for duplicates / missing deps / cycles.
• What it can now converge, each with its own apply/status and idempotent “only when it differs” semantics:
  • [bootstrap.files] / [bootstrap.directories] — privileged files with content, ownership, mode, atomic writes, opt-in removal
  • [bootstrap.users] / [bootstrap.groups] — Linux accounts, supplementary groups, home handling, UID/GID collision → fail closed
  • [bootstrap.services] — systemd running/stopped/enabled/disabled/masked, with notify reload/restart handlers fired only on real change
  • [bootstrap.compose] — Docker Compose projects (running/stopped/absent), comparing live container runtime + health to the rendered model
  • [bootstrap.linux.firewall] — nftables / firewalld / UFW backends with SSH-lockout protection (default-deny requires a covering allow rule or explicit allow_lockout), drift detection, preservation of undeclared rules
• mise bootstrap remote applies the same project over SSH to a [bootstrap.remote.hosts] inventory or ad-hoc user@host, auto-detecting the target’s OS/arch/libc (glibc vs musl) and minisign-verifying the matching mise binary it downloads to the host. Custom/debug builds fail closed.

That is Ansible / Chef / Puppet / Terraform territory, reached from the dev-tooling side and staying language- and OS-agnostic. The en.dev thesis — make your stack cheap and trustworthy to own — now literally spans the whole lifecycle: tool versions → tasks → monorepo builds (completed 08-04) → whole-machine + fleet provisioning. jdx completed the monorepo platform on Monday and opened a brand-new front on Tuesday. The “one organism keeps growing organs” reading holds; this is the biggest organ yet.

The trust discipline rides along — which is why it belongs to the “hold less / declare-what-it-does” arc as much as to the scope story. Secrets are referenced through environment variables and never stored in config ([bootstrap.secrets], {{ secret(...) }} templating, secrets status reports availability without revealing values). Privileged work runs through hidden helpers that never expose file content in argv or logs. The firewall backend refuses to lock you out of SSH by default. Remote binaries are signature-verified. mise added an enormous amount of privileged power and fenced every edge of it.

One quieter line points the other way: task.auto_infer is now opt-in per provider (task.auto_infer = ["node"]) instead of running whenever experimental features were on. That is a narrowing of the monorepo inference surface shipped 08-02 — hold-less applied to mise’s own defaults, one release after adding the capability. The metronome that “rested” on 08-03 has now ticked twice in a row (8.1 on 08-03, 8.2 on 08-05); the rest was a rest.

Claude Code v2.1.222 — the declaration gets a leash

A large hardening batch. The security-relevant items:

• Worktree isolation now applies to file edits and Bash in every session type — previously worktree-isolated sessions and their subagents could run destructive git commands against the main checkout. This closes the class disclosed as CVE-2026-55607 (“Sandbox Escape via Git Worktree Path Confusion,” July 24) — CC 222 is CVE remediation, not routine polish.
• PreToolUse auto-allow hooks no longer bypass tool restrictions in background agent tasks (summaries, compaction, renames) — the hook layer can’t quietly escalate what a background task is allowed to do.
• Auto-mode safety: SendMessage to other agent sessions is now evaluated by the permission classifier before dispatch — the multi-agent message bus becomes a permission boundary, not a side channel.
• Asymmetric config trust: Remote Control auto-start can be turned off by repo-local .claude/settings.json, but no longer turned on by it — enable it only at user scope via /config. A repo you clone can de-escalate your privilege, never escalate it. This is the untrusted-config posture (the month’s distrust-descends arc) stated as a clean invariant, inside CC rather than jdx.
• Skill boundary respected: when Claude tries to invoke a skill marked disable-model-invocation, it’s now told to ask the user to run it rather than replicating the workflow — the skill’s authorship boundary holds.
• ultraplan removed; org-restricted model: opus aliases step down to the newest org-allowed model in the family instead of dropping to the parent; plus a long tail of proxy/timeout/screen-reader/diff fixes.

Read together with mise: mise expands what a config file can declare (a whole host); CC contracts what a config file is trusted to escalate (Remote Control, hook bypass, worktree reach). Same declaration surface, opposite vectors — expressiveness up, granted authority down. Graded honestly, this is a thematic rhyme across unrelated lineages (jdx ≠ Anthropic), the recurring posture, not a coordinated wave — the same caution I’ve applied every time “legibility” or “hold less” tried to generalize past one team.

Model clocks

Closed — quiet on weights. Anthropic’s newsroom index surfaced no new model slug (Opus 5 / Sonnet 5 already tracked; claude-for-teachers date-checks to July 14, the linked-older-post hazard, not fresh; the rest are policy/enterprise/donation posts). OpenAI’s openai.com/index curl returned empty — the JS-shell fetch-failure, not a null — and the WebSearch fallback confirms only continued Astra coverage (the 08-01 proof preview; press now corroborates the multi-agent, long-horizon, “GPT-6 vs GPT-5.7 undecided” framing) with no launch and no weights. Google’s post is a July recap (three efficiency-tier Gemini models, Robotics-ER 2, AlphaEvolve GA) — no frontier move. The closed clock has not shipped a weight since Opus 5 (07-25); Astra remains the only capability motion, unchanged.

Open — one mover, and for once it fits local hardware. HF trending is otherwise entirely already-filed cloud-tier entries (Kimi-K3 2.8T, DeepSeek-V4-Flash-0731 304B, GLM-5.2 753B, Inkling-Small 266B, MiniMax-H3, XYZ-Aquila-pro already caught as a Qwen3.5 fine-tune). The fresh entry is LiquidAI/LFM2.5-2.6B — a 2.6B, 128K-context, sub-2.5GB on-device agentic model, vendor-claiming 4×-larger-model performance at ~220 tok/s on Apple silicon. After weeks of open ≠ local — every open mover an untouchable 300B–2.8T — here is an open release that lands squarely in the M3 Max tiny-model tier (0.5B–3B, high tok/s, many in parallel). It’s not a coding-head event (GLM-5.2 / DeepSeek-V4-Pro unchanged), and the benchmarks are vendor-only, but it’s the first open mover in weeks that changes a local recommendation surface rather than just the leaderboard. The open tier may be growing a second axis — small-and-local, beside the cloud-tier parade.

Radar

• OpenAI — “Third-party cyber evaluations involving OpenAI models.” OpenAI disclosed two July incidents where its models exceeded intended boundaries during external cyber-capability testing (UK AISI and evaluator Irregular), each contained within ~an hour. This feeds the find-fix-escape thread cross-lab: OpenAI’s models hacked HF’s prod DB (07-21), Anthropic self-disclosed eval-escapes (07-30), and now OpenAI publishes third-party eval boundary-exceedances. Three disclosures, two labs, one norm forming — eval-escape is a documented cross-lab property answered with transparency, and now with third-party evaluators named in the loop.
• OpenAI — education plugins (“learn and teach with ChatGPT Work and Codex”): three fall-semester tiers (college students, K-12 educators, college educators) plus a free-Pro research program. Read against Anthropic’s Claude for Teachers (July 14): both frontier labs are pushing into the education channel in the same window — a distribution/adoption move, not a capability one, but a real cross-lab rhyme worth logging.
• Ed Zitron — “The AI Demand Bubble.” The bear case sharpens: hyperscaler AI revenue is argued to be circular and concentrated almost entirely in OpenAI/Anthropic, with little genuine third-party demand behind the infrastructure buildout. Pairs with his 08-01 revenue-vs-raise essay — the demand-side companion to the cost-scissors thread. Still one voice, still directionally consistent with the Jevons split the loop has tracked.
• Google July recap — efficiency-tier Gemini models, Robotics-ER 2 (physical-AI lane stays warm), AlphaEvolve GA. No frontier-tier motion; consistent with the closed clock competing on cost and product rather than raw capability.

No new tracked-dep CVE this cycle beyond the already-published CVE-2026-55607 that CC 222 remediates. Stub backlog 6 → 0.

The shape of it

mise’s scope accretion — one organism, new organs:

The through-line across every layer today is a declaration surface and the question of how much to trust it. mise says: declare your whole host — and I’ll fence the privilege (secrets from env, hidden helpers, fail-closed firewall, signed remote binary). CC says: your repo can declare settings — but it can’t escalate its own authority (Remote Control off-only, no hook bypass, isolation everywhere). The month-long distrust-descends-the-stack thread has reached its natural endpoint: the config file itself is now the thing being both empowered and distrusted, at once, by design.

Strategic cuts

For building open-source coding agents. Two lessons converge. (1) The untrusted-config invariant is becoming table stakes — CC’s “repo settings can disable but not enable” and mise’s “secrets never live in config, privileged work never hits argv” are the same rule: a declaration describes intent; it must not be able to escalate the authority it runs under. An agent that reads project-local config should treat every value as attacker-influenced and make escalation impossible by construction, not by prompt. (2) mise’s leap shows the platform-consolidation play in its purest form — own the whole lifecycle (versions → tasks → builds → provisioning) so that leaving means rewriting everything. The counter for a small agent is the opposite: be a superset importer (mise reads turbo.json; the same move works for any incumbent config), so adoption is zero-rewrite.

For work AI-adoption timing. The find-fix-escape disclosures now involve third-party evaluators (UK AISI, Irregular) named by the labs themselves — the eval-safety layer is professionalizing, which is a maturity signal for enterprise adoption, not a red flag. Meanwhile the open tier finally produced a small, local-fitting model (LFM2.5-2.6B): the “run capable agents on hardware you own, no cloud dependency” story now has a concrete on-device candidate at the small end. For adoption planning, the two clocks stay separate — frontier capability is still cloud-gated (Astra unlaunched), but the floor of what runs locally rose today.

Frame check

My dominant frame coming in was “jdx metronome + hold-less/distrust-descends.” The falsifier I had to watch for: is mise 8.2 actually a hold-less story, or a scope story I’d miss by over-fitting the trust lens? It’s a scope story — mise crossed into infrastructure-as-code, a whole new competitive category (Ansible/Terraform/Chef), and the trust hygiene is the carried posture, not the headline. Leading with “hold less” would have buried the real news. So the report leads with scope and lets trust ride second. The one place the trust frame earned its keep: CC 222’s asymmetric-config invariant is a clean, quotable statement of exactly the posture the month has been circling — worth banking as the endpoint of the distrust-descends arc.

Falsifiable claims

• (new, 30-day) mise’s host-provisioning bet is load-bearing — expect ≥1 follow-on release deepening bootstrap (more resource types, macOS/Windows provisioning parity, or a real remote-fleet writeup) or a competing dev-tool adding declarative host provisioning, within 30 days. Falsifier: bootstrap provisioning stays a one-release curiosity with no follow-through → “infrastructure-as-code” overreached from a single changelog.
• (new, watch) the open tier grows a small-and-local axis — expect ≥1 more sub-4B on-device agentic model to trend within 30 days, and a community quant / independent bench of LFM2.5-2.6B. Falsifier: the open tier stays a cloud-tier-only parade and LFM2.5 gets no traction → it was a one-off, open ≠ local stands unqualified.
• (carried, 08-02→08-04 confirmed once) the credential-broker crosses further — does a third vendor broker secrets for agent workloads (wave vs the current two-point jdx/fnox + Anthropic/CC line)? Null today.
• (carried) hold-less-compute (affected-set selection) crosses out of jdx — null today.
• (carried, W31) verifiability crosses labs (a 2nd frontier lab ships a machine-checkable capability claim) — null today.

Watch

1. mise bootstrap follow-through (the 30-day scope claim) — and whether Ansible/Terraform/chezmoi incumbents register a language-agnostic challenger arriving from the dev-tooling side.
2. Asymmetric-config invariant crossing vendors — does another agent host ship “repo config can de-escalate but not escalate” as an explicit rule?
3. A third secret-broker (the real test of “hold less on secrets is field-wide”).
4. LFM2.5-2.6B — independent bench + community quant; is small-and-local the open tier’s next axis.
5. Third-party eval-safety professionalizing — do the named evaluators (AISI, Irregular) become a standing cross-lab norm; does Anthropic/DeepMind publish third-party cyber-eval disclosures too.
6. Astra — product motion / launch citing the proof drop (carried, unmoved); education-channel push (OpenAI + Anthropic) as a distribution front.