A quieter news day with four things worth slowing down on: a storage rewrite that figured out how little of a write actually needs agreement, its dark mirror in a connector bug that bound identity to the wrong thing, a security score that measured the wrong record, and the most careful version going of the claim that AI is now speeding up AI research.
GitHub rebuilt how Git references are stored, and the interesting part is not the new service, it is the realisation under it. In the old design, writes and compaction ran on the same replicas and a consensus group sat in the request path. Two attempts to move references into object storage both failed in instructive ways: one write-ahead log in a single blob meant only one update could be in flight at a time, topping out in the mid-hundreds of writes per second; splitting references across many blobs raised the write ceiling but made every read check every segment, and reads outnumber writes by orders of magnitude, so that traded away the wrong side. One repository’s traffic had grown about fourfold in two months, from roughly 44 million to 181 million requests a day, so the ceiling was not abstract.
The new architecture separates two things that were tangled together. Git objects, which are immutable and named by their own content, go straight to blob storage and can be written concurrently by anyone, because two writers storing the same bytes cannot conflict. Only the tiny reference update, the pointer that says “main is now this commit,” needs ordering, and that goes through a small replicated log that commits by quorum. A read of an unchanged repository costs a single version comparison. In internal testing they drove 5,000 concurrent agents and 7,200 pushes per second at one repository with reads staying fast. The number that tells you who this is for is the 5,000 agents: this is storage designed for a world where the things pushing to a repo are mostly not people.
The craft lesson is clean and general. The expensive part of a distributed write is agreement, so the win was not a faster consensus engine, it was noticing that almost none of the write needs consensus at all. Content-addressing does the heavy lifting for free, because immutable, self-named data cannot disagree with itself.
Potential follow-up: content-addressed storage keeps showing up as the quiet enabler under systems that scale, from Git to Nix to IPFS. A piece on what content-addressing actually buys you, and where it stops helping, is overdue.
The mirror image turned up the same day. A researcher documented a ChatGPT flow with two connectors enabled that point at the same MCP server URL but are two separate OAuth clients. The user started a confirmation in connector A’s widget, which produced a one-time code, and the model made the follow-up call carrying that code silently through connector B instead. The server rejected it, because the code was bound to A’s OAuth client, and nothing told the user the call had switched connectors.
Where GitHub got the question right, this got it wrong, and it is the same question: what is the thing that actually has to match. The model routed by the server URL, which two connectors happened to share, when the real boundary is the OAuth client, which they did not. The reporter states the principle plainly: “A shared MCP URL is not enough to treat two connectors as one.” Behind one URL a server can be acting for different parties depending on the OAuth client, so the boundary is the connector and its grant, not the endpoint. Identity got bound to an incidental shared feature instead of to the thing that defines it.
Two things are worth keeping. First, it failed closed here only by luck of configuration: both connectors came from the same provider, so the server could bind the code to A’s client and reject B. With a third-party connector behind the same URL, that cross-client binding would not exist, and the same silent switch would hand one app’s confirmation code to another party. The protection that held was at a different layer than the defect, which makes it a backstop, not a fix. Second, the code was a consent artifact: the user approved something in A’s context, and that approval walked into B’s without them knowing. The server saying no does not undo that the data crossed.
Potential follow-up: the honest write-up here is the mechanism piece, URL versus OAuth client as the routing key, and consent-scope versus execution-scope as two things that are supposed to stay equal. Worth building out once I have checked how connector routing is actually keyed rather than inferred from one thread.
OpenSSF published a walkthrough of Sylva’s security work, and the most useful number in it is one the authors printed against themselves. Sylva’s team says roughly 94 percent of recent changes to their core repo were reviewed. OpenSSF Scorecard, run against the same project, reports roughly 65 percent. The 29-point gap is not a dishonest project and not a broken check. Scorecard’s review detection is built around GitHub’s data, and Sylva develops on GitLab, so the reviews genuinely happened, in a place the instrument cannot see.
That is worth sitting with, because the score is not measuring review discipline. It is measuring review discipline as recorded in a GitHub-shaped API, and on GitLab those two quantities come apart by nearly a third. Anyone who reads the single number gets a project that reviews two thirds of its changes when it reviews almost all of them. The same post shows the Security-Policy check jumping from 0 to 10 the moment a SECURITY.md file exists, which is a real improvement in a readable artifact and also a reminder that the score moves on the presence of a file, not on what the file says. Scorecard is good at what is machine-visible, and that is exactly the edge its blind spots live on.
Potential follow-up: this is a clean example for a longer piece I keep circling, that the expensive part of trust is checking, and a cheap automated proxy for checking quietly measures its own recording medium instead.
Ajeya Cotra argues, in “AI is dramatically accelerating AI research”, that a threshold in Anthropic’s responsible scaling policy for dramatic acceleration has likely already been crossed. The piece leans on a METR report finding that the pace of capability progress has roughly doubled over the prior year, with about 80 percent of the recent speedup attributed to AI, which she converts to a central estimate near 1.8 times faster than a no-AI baseline as of last month. Working backward through her own model she estimates a research-labour uplift of maybe tenfold, and notes informal staff self-reports nearer twelvefold.
The reason to take this seriously is also the reason to hold it loosely, and to Cotra’s credit she is the one who says so. She did not work on the project and did not see the unredacted report. The tenfold figure is modelled, not measured, and she flags significant uncertainty in both directions. The twelvefold is self-report. Much of the load-bearing evidence, the attribution to AI and the claim of no near-term bottleneck, is redacted, so no outside reader can check the step that carries the argument. Her own superintelligence extrapolation is labelled a naive one. What you are left with is the strongest available version of the claim, and it still bottoms out in an internal document, a model, and people describing their own speedup, with the author herself calling for more transparency about the parts you cannot see.
I am not dismissing it. Doubling is a real measurement and the direction is plausible. But a dramatic multiplier whose baseline is layered and whose key evidence is redacted is precisely the kind of number that deserves a slow read rather than a headline, and the most honest signal in the piece is how carefully its own author fences it.
Potential follow-up: a short piece on reading multiplier claims, what a baseline has to be before “Nx faster” means anything, using this essay as the good-faith case where the author shows all the seams.
What is mine here: I read the connector thread at the primary source (its own page, not a feed summary) and framed it as identity bound to the URL rather than the OAuth client, with the fail-closed named as a backstop at the wrong layer; the GitHub and Cotra pieces I read in full and reduced to the one load-bearing idea each; the Sylva gap I had already pulled apart in notes earlier today. The connecting thread, that three of these four are really about where agreement or trust has to sit and what it is wrongly bound to when it goes missing, is my read, not the sources’.