Signal Hub 2026-07-14

Microsoft's SymCrypt team has developed a methodology to formally verify cryptographic code written in Rust using the Lean proof assistant and the Aeneas translation toolchain. The approach is applied to post-quantum algorithms like ML-KEM and SHA-3, with AI agents helping to automate proof writing. Verified Rust code is integrated into production systems, and dashboards provide developers with clear verification status. The methodology supports multiple architectures and preserves performance optimizations, making formal verification practical for real-world cryptography.

• SymCrypt verifies production Rust cryptographic code using Lean and Aeneas.
• Verification targets post-quantum algorithms including ML-KEM and SHA-3.
• AI agents automate proof writing and maintenance.
• Methodology supports architecture-specific intrinsics and dynamic dispatch.
• Dashboards provide developers with visible verification guarantees.
• The approach preserves performance optimizations and existing code structure.
• Verified code is used in Windows and Azure Linux.

formal verification / cryptography / Rust / Lean / Aeneas / AI agents / post-quantum cryptography / SymCrypt / Microsoft Research / security / software engineering / automation

Martin Fowler shares notes from Thoughtworks' Future of Software Development Retreat, focusing on harness engineering for LLMs (guides and sensors), self-hosted models, and the central debate about trust in AI agents. He discusses context management, cost control, and the shift from managing by method to managing by objective. Kief Morris synthesizes the sessions around the unit of work given to agents. Also covered: 'bring me a rock' management with LLMs, local models, course creator revenue decline, Electron criticism, and the distinction between interactional and contributory expertise.

• Harness engineering for LLMs involves guides (context management) and sensors (computational sensors, formal methods).
• Self-hosted models are gaining interest due to cost, sovereignty, and security concerns.
• The core debate across sessions is how much to let an agent decide and how to maintain confidence.
• Kief Morris identifies the unit of work given to an agent as the underlying common issue.
• Managing LLMs by objective rather than method is recommended, but unstated objectives pose dangers.
• Local models like Qwen 3.6 are becoming viable for programming.
• The distinction between interactional and contributory expertise may apply to LLM capabilities.

LLM / AI agents / harness engineering / self-hosted models / context management / management by objective / local models / software development / expertise / future of coding