Stafford

← 2026-09-07 · all briefs · 2026-09-09 →

Stafford Brief — 2026-09-08

Tuesday. Today's scan landed (Conference Board, board AI expertise) and is not restated here. Two Stafford chases, both of leads the scan itself named and did not run — and the first of them overturns the reading that named it. One KB file, one challenge corrected, one new challenge opened against a published paper of Brandon's, one asset re-priced, one scan contradiction settled. No Stafford brief was filed for 09-07, so that scan day is folded in where it bears.

📖 TODAY'S READ

A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption — Denisov-Blanch, Agarwal, Azaletskiy, He, Schaeffer, Miranda, Vasilescu & Koyejo (arXiv 2608.25241, 2026-08-26; ASE '26, Munich, October)

The 09-07 scan opened a candidate slot for this group and set its promotion test: chase this paper, because "if it measures a committed, version-controlled configuration artifact against a quality outcome, it is the verification thread's criterion (1) approached from a direction nothing in this base has tried: the standard as a file in a repository rather than as prose." Called "the cheapest available advance on the oldest open criterion here." The 09-08 scan did not run it. I ran it.

The paper is real, peer-reviewed, and better than the test it was chased for. It also does not pass that test.

The instrument first, per hard rule 9. 441 private GitHub repositories at 27 commercial organizations, under research agreements that prohibit identification. RAMP — a four-level cumulative maturity scale scored from artifacts teams had already committed to version control, from behavioral rules and coding standards up to multi-agent orchestration. Independent human annotation reproduces the repository labels on 97% of a held-out sample. An existing agent-adoption panel (Agarwal et al., MSR '26 — 401 agent-first repos matched to 606 controls) is re-estimated within each maturity stratum, against SonarQube metrics, log-transformed. Window: git events January 2025 – February 2026, maturity snapshot November 2025.

The result splits cleanly and the split is the finding. Agents accelerate development regardless of maturity — 28–38% more commits at every level. Quality does not. Among agent-first repositories, those without committed configuration show "roughly twice the increase in cognitive complexity (+53% versus +27%) and 1.7x the increase in static-analysis warnings."

Why it fails the verification criterion, and this is the correction the scan needs. Committed AI configuration is instruction to the machine. It is not verification of the machine's output. A rules file tells the agent what good code looks like before it writes; a verification standard says how much of what it wrote a human checks afterwards. The scan's phrase — the standard as a file in a repository — slides between the two, and they are different organizational objects with different owners. Criterion (1) on the verification thread remains unmet: fourteen instruments, six functions, the FRC still its only member and still a regulator.

What it does instead is worth more than what it was chased for. It is the first instrument in this base on the private, firm-owned population. The 09-04 correction to NBER WP 35275 established that its public-repository measure identifies only 24.2% of async-agent users — "the other 75.8% work exclusively private, i.e. exactly the firm-owned population." That has been this base's standing complaint about the entire software-engineering evidence class. This is 441 private repositories at 27 commercial organizations, measured directly.

🔭 THINKER TO WATCH

Nobody new — and the entry is the refusal.

The 09-07 scan opened a candidate slot for the Stanford AI Lab / CMU software-measurement group (Denisov-Blanch, Koyejo, with Vasilescu and He) and made this paper its promotion test. The test fires and the promotion should not.

Today's paper shares four authors with the 09-07 read — Denisov-Blanch, He, Vasilescu, Koyejo, plus Agarwal and Azaletskiy on both. Same programme, adjacent data, one house. This base spent 09-06 establishing that four Gallup entries across one panel family are one instrument with several constructs, not repeated confirmation, and imposed the same rule on Babina/Ewens-Giroud for a shared right-hand side on 08-24. A candidate promoted on a second paper from the same group is that error with a different logo.

The honest disposition: the slot stays at one signal, and its promotion bar should be rewritten rather than met — promote on a third-party replication or extension of RAMP, not on the group's next paper. Note that the same discipline the scan applied to itself on Salesforce ("promote only on a second release that discloses its frame the same way and reports something not congenial to a Salesforce product") is the one that was not applied here, because the promotion test was written before the author list was known.

What is genuinely notable about the group is a fact about the field, not about them: the two most organizationally interesting software instruments of the last month were produced by the same eight people, and the reason is access. Private repositories at 27 commercial organizations require research agreements. The bottleneck on enterprise AI evidence is not method; it is who has signed the NDAs — which is also why this base keeps ending up with one house per construct.

🏢 CASE IN THE WILD

No named organization cleared from Stafford's own work today, and I am not going to manufacture one. The 27 organizations behind today's read are contractually unidentifiable. What is available is a behaviour observed across all of them, and it is the most quietly damning number in the paper.

73.8% of committed AI configuration artifacts are committed once and never modified. The authors' word for the adoption pattern is "cumulative, forward-only, and set-and-forget."

Hold that against the finding it sits next to. These artifacts are associated with half the cognitive-complexity growth after agent adoption. They cost, in the paper's own title, a few pages of markdown. They are the cheapest organizational intervention with a measured quality association anywhere in this base — cheaper than training, cheaper than a role, cheaper than a governance committee — and three-quarters of them were written once and never touched again while the models, the agents and the codebases underneath them changed for fourteen months.

The mechanism is not Technology Illusion; it is one layer stranger than that. The framework's standard case is an organization producing a governance artifact instead of a capability. Here the artifact is the capability, it appears to work, and the organization still treats it as a filing rather than as a live control. Whatever stops organizations from maintaining these things is not doubt about whether they work, and it is not cost.

Open implication: if a durable organizational control can be established for a few pages of text and then left to rot without anyone noticing, the framework's account of why organizations underinvest in design — too expensive, too slow, no short-term signal, per Paper 3 — does not cover this case. Something else is operating.

⚙️ FOUR FORCES CONCLUSION

Capability, and today supplies the missing half of the 09-07 scan's conclusion rather than a new one.

The 09-07 scan read the 2× mandate firm as "Purpose worked. Capability was never specified" — one Force left unnamed, and the entire cost of the transformation landing on it. That was one firm, n=1, and the counterfactual was hypothetical. Today's paper is the same research group running the comparison: 441 repositories, stratified by whether the capability artifact exists.

Where it exists, the quality cost is roughly halved (+27% versus +53% cognitive complexity) while the output gain is identical (28–38% more commits either way). That is as close as this base has come to observing a Force specified and unspecified in the same population, on the same technology, with the output held constant.

Four disciplines, and the first two are severe.

  1. These are not independent instruments. Same authors, same programme. The 09-07 case and today's stratification are one research effort with two studies and must be cited as such. The apparent "n=1 result confirmed at scale" reading is unavailable.
  2. The authors decline the causal claim explicitly: "Because maturity is observational, we treat these associations as hypothesis-generating." They name five confounders — engineering maturity, code hygiene, AI usage intensity, domain complexity, model capability — and concede that some repositories may have committed artifacts only after adoption. A repository that writes coding standards is plausibly a repository that would have written better code anyway, and nothing here separates those.
  3. The warnings result must not travel at the strength of the complexity result. The authors record that "warnings show elevated pre-treatment coefficients and are more weakly identified than complexity." Cite the +53%/+27% and leave the 1.7× as supporting texture.
  4. Capability here is infrastructure the organization wrote down, not talent. That is the framework's own definition, and it is the version that is cheap to test — which is the whole argument of today's asset note.

💭 OPEN QUESTION

If the cheapest effective organizational control in this base is a few pages of text, and three-quarters of them are never revised — what exactly is the barrier to organizational design?

This is not a rhetorical complaint about short-termism. The framework has a stated answer, and it is Paper 3's: organizational design "is structural, slow, produces no short-term signal that anyone tracks and requires political confrontation with peers. It gets crowded out." Every clause of that fails on this case. Committing a coding-standards file is not slow, not structural, requires no political confrontation, and — per today's paper — is associated with halving the quality cost of agent adoption within fourteen months. It should be the easiest thing an organization ever does. 73.8% of them did it once and walked away.

So one of three things is true and this base cannot currently tell which. Either (a) the artifacts do not actually need maintenance — set-and-forget is correct behaviour and the framework's maintenance instinct is wrong; or (b) they are decaying and nobody is measuring it, in which case the +27% is a fourteen-month number that will not hold; or (c) the barrier to organizational design is not cost, slowness or politics at all, but the absence of anyone whose job it is to notice that a control has gone stale — which is Paper 3's stewardship argument arriving at a scale far below the one it was written for.

(c) is the interesting one and it is testable from this paper's own data: RAMP records artifact modification dates. Whether repositories that revised their configuration diverge from those that committed once is a question the authors did not ask and their dataset can answer. That is one email, and it is the second time in a fortnight that this base has found a decisive variable already constructed and never estimated — the first being Cohen et al.'s Self/External evaluation split.

🥊 CHALLENGE

Today's scan find bears on a published paper of Brandon's, and it is a challenge, not a confirmation. Logged in full to knowledge/thesis-challenges.md.

Paper 3 makes the board the terminal escalation point of its anti-drift architecture — "independent reporting on transformation health to the board separate from the sponsor's status updates", and "Severe drift... triggers escalation to the board with the possibility of program restructuring." The tiering is defended on the ground that "every level of severity needs a defined response that the political weather of the moment cannot soften."

The trigger is mechanical. The response is not. "The possibility of program restructuring" is a judgment, and Paper 3 nowhere states what the receiving body must be able to do for that escalation to be worth making. Today's Conference Board data is the first measurement of that receiving capacity: director AI expertise at 2.7%, against 83% of the same index calling AI a material risk — and, on the same channel over the same years, cybersecurity expertise 15%→27% and technology 20%→51%. The mechanism for putting a competence on a board works, and was used twice recently. Not for this.

The objection is narrower than it first looks and I am reporting it that way. Two of the three defenses are strong. Predefined triggers with predefined responses are designed to be robust to an unqualified board — that is arguably the mechanism's point, and it survives everything above except the one clause where the response is left open. And disclosed expertise is a floor on disclosure, not an estimate of competence; the Conference Board says so itself.

Recommendation: absorb it. One clause in Paper 3's severe tier naming what the board must be equipped to evaluate, alongside what triggers the escalation. It costs a sentence, it removes referee exposure, and it converts an implicit assumption into a stated design requirement — which is the register the rest of Paper 3 already operates in.

The larger point, and it is the one to keep. Before today, 2 of 501 knowledge-base files touched the board or proxy layer, and neither measured board composition. Brandon's published corpus treats the board as a recipient of information — reporting lines, escalation tiers, "the board's visibility into the difference is limited in the early years." Board composition — whether the body receiving the escalation can act on it — is absent from six papers. That gap is worth more to him than the challenge is.

🧱 ASSET SUGGESTION

Asset 3b's price was set by an assumption that has now failed in two unrelated domains, and the failure is the asset.

3b — the prospective readiness study that would answer the unfalsifiability challenge — has been blocked since 08-30 on ~30 sites plus a partner with access to live deployments. That price assumes the ex-ante organizational variable has to be collected. Asset #4 broke that once: for the incentive layer the variable is already filed in proxy statements. RAMP breaks it again in a domain with nothing in common — a four-level organizational maturity scale scored entirely from artifacts teams had already committed to git, across 441 repositories, with nobody recruited to be measured. And the scan's own 09-08 Open Question proposes a third instance without naming it as one: pairing boards' self-rated AI fluency against their filed expertise disclosures.

The principle: readiness measurement is an access problem only where the organization has not already been made to write the answer down. Wherever regulation, engineering practice or disclosure convention has forced the ex-ante condition into a durable artifact — a proxy statement, a repository, a skills matrix, a risk factor — the study is desk work and no permission. That reframes 3b from "needs a partner and thirty sites" to "needs the right artifact," and hunting artifacts is cheaper than hunting partners.

Three bounds, and the third would sink the essay if unaddressed. None of the three instances is prospective — RAMP is observational, proxy coding retrospective, the board study cross-sectional — so this lowers the cost of building an instrument, not of demonstrating prediction, which is the half the challenge turns on. RAMP's altitude is a repository, and 27 organizations is not a sampling frame. And most seriously: the domains where the ex-ante variable is already written down are disproportionately the domains where the outcome is already measured too — carbon had Trucost, git has SonarQube. That may make this principle a restatement of the measurability confound rather than an escape from it. Full spec and bounds in knowledge/asset-suggestions.md (#3, update 09-08).

Argument-priced, not time-priced. It sits behind the Accenture window piece and the agent-intrusion piece; its value today is that it re-prices 3b.

🎓 SPARRING NOTE

(First note this week; the cap permits it. Two remain outstanding and unanswered from 08-31 and 09-01 — this one is deliberately answerable in fifteen minutes rather than being a fourth exercise stacked on them.)

Growth edge #2 — build the readiness instrument sketch. Somebody just published one, in a different field, and released it as reusable.

RAMP is what edge #2 asks Brandon to draft: named constructs, four cumulative levels, an explicit scoring procedure, human validation at 97%, and an outcome criterion attached. It took its authors a maturity scale and a static-analysis tool.

The prompt, and the constraint is the whole exercise: write the Five Breakpoints equivalent of RAMP's Level 1 — but score it only from artifacts the organization has already produced for some other reason. No survey, no interview, no access request. For each of the five breakpoints, name one document a company has already written, for its own purposes, that would let you score it: the proxy statement, the org chart, the OKR file, the incident postmortem, the job posting, the board skills matrix.

Where it should get uncomfortable, and that is the point. Some breakpoints will have an obvious artifact and some will have none. The ones with none are the ones the framework cannot currently measure without asking permission — and that list, written down, is simultaneously the answer to "why is the readiness instrument expensive" and the specification for the cheapest version that could exist. It also directly re-prices asset 3b, which is the one thing standing between the unfalsifiability challenge and a response.

🔍 SOURCES & THREADS

Stafford ran two chases and no discovery sweep (correct — the scan owns discovery). Both targets were named by the scan itself and left unrun, which is turning out to be the highest-yield input available: a deferral list is a queue of things a pipeline has already judged worth doing and structurally cannot get to.

Chase (a) — the ASE 2026 paper. Resolved, ingested, and the reading that motivated it rejected. Details above. Venue confirmed from the paper itself: "Proceedings of the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE '26), October 12–16, 2026, Munich, Germany," DOI 10.1145/3832783.3837546 — so the 09-07 note calling it ASE 2026 from the author's site was right. KB file: knowledge-base/denisov-blanch-ramp-committed-ai-configuration-2026-08.md. STAGE-CANDIDATE payload in Routing.

Chase (b) — Chemla & Tena, and the two scan days contradict each other. The 09-07 scan skipped SSRN 5997775 as "a general-equilibrium asset-pricing model, no organizational construct." The 09-08 scan called the same paper "on-thesis and unreadable... exactly the Category 6 territory this base is thinnest in" and instructed a chase via RePEc or a mirror. Settled: 09-08 is right on substance and 09-07's disposition is right anyway. The model's objects are incentive contracts, termination threats and wage compression — organizational constructs, so "no organizational construct" is simply wrong. But there is no mirror. RePEc carries no listing; SSRN 403s; and Chemla's own Imperial College profile — the 09-04 lesson's winning route, author's page before publisher — lists it under a different title, "AI adoption, incentives, and market outcomes," marked "in progress," with no download. Not ingested. Not booked. Everything known about its findings comes from a search-engine summary, which this base's own rules say is not a source; and the 09-05 standing instruction is that the next formal model must be read parameter-by-parameter before being counted as support. This one cannot be read at all. Recommended disposition for the scan's next Category 6 slot: stop chasing until SSRN or a mirror serves it, and record it as pending rather than as a skip — the 09-07 reason for skipping was wrong even though the skip was right, and that distinction is worth keeping in the log.

Threads. None due today; the nearest is EU AI Act enforcement on 09-15. No thread advanced by Stafford, and one thread's criterion was tested and explicitly not met — the verification thread (criterion 1), against today's read. That non-advance is the substantive result: the scan expected this paper to advance it and it does not, for the prescription-versus-verification reason above. Fourteen instruments, six functions, one member.

Patterns: none crossed a threshold, and one was considered and rejected. Today's read is a second observation from the same research programme as 09-07's, so treating the two as a pattern member pair would double-count one house — the discipline this base imposed on Gallup on 09-06 and on Babina/Ewens-Giroud on 08-24. Recurrence counts unchanged.

Candidates: none added; one promotion recommended against (Stanford/CMU group — see THINKER TO WATCH). The 09-08 scan's new candidate, The Conference Board, is correctly at one signal with a narrow bar.

Judgment-layer files updated: thesis-challenges.md (unfalsifiability challenge corrected; new challenge opened against Paper 3), asset-suggestions.md (#3 re-priced), query-log.md (today's chases).

Routing

STAGE-CANDIDATE — for the next research-evidence scan run

python3 build/add-research-json.py --json '{
  "title": "A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption",
  "publisher": "arXiv (forthcoming, ASE 2026)",
  "url": "https://arxiv.org/abs/2608.25241",
  "published_date": "2026-08-26",
  "credibility": "high",
  "instrument": "441 private GitHub repositories at 27 commercial organizations under research agreements; RAMP four-level cumulative maturity scale coded from version-controlled configuration artifacts, human-validated at 97% on a held-out sample; Study 2 re-estimates the Agarwal et al. (MSR 2026) agent-adoption panel (401 agent-first repos matched to 606 controls) within maturity strata against log-transformed SonarQube metrics; window January 2025 - February 2026, maturity snapshot November 2025; OBSERVATIONAL - authors decline causal identification and name five confounders plus possible reverse causality.",
  "breakpoints": [
    {"name": "technology_illusion", "rationale": "Coding agents deliver 28-38% more commits at every maturity level while agent-first repositories without committed AI configuration absorb roughly twice the cognitive-complexity growth (+53% versus +27%), so the technology performs identically on prepared and unprepared organizational conditions and only the hidden cost differs."},
    {"name": "momentum_mirage", "rationale": "Commit volume - the metric most likely to be watched - rises identically in both strata, so the visible progress measure reports the same movement in the stratum paying double the complexity cost."}
  ],
  "forces": [
    {"name": "Capability", "rationale": "The measured moderator is infrastructure the organization committed to version control - behavioral rules and coding standards - and its presence is associated with halving the post-adoption cognitive-complexity increase (+27% versus +53%)."}
  ],
  "key_findings": [
    "Agents accelerate development regardless of maturity: 28-38% more commits at every RAMP level",
    "Agent-first repositories without committed AI configuration show +53% cognitive complexity versus +27% for those with it",
    "1.7x the increase in static-analysis warnings without committed configuration - authors note warnings are more weakly identified than complexity",
    "73.8% of committed AI configuration artifacts are committed once and never modified (set-and-forget)",
    "RAMP repository-level labels reproduced by independent human annotation on 97% of a held-out sample"
  ],
  "sample_size": 441
}'

Ingest note for whoever runs it: the entry is not independent of knowledge-base/he-denisov-blanch-2x-mandate-review-capacity-2026-07.md (staged 09-07) — same research group, overlapping author list. Flag them as one programme, as Gallup entries are flagged.

PROPOSED-UPDATE — knowledge/story-threads.md, thread "Does anyone design for verification cost, or is it absorbed invisibly?"

  • 2026-09-08 (Stafford chase, thread not due): the lead the 09-07 log named as "the cheapest available advance on the oldest open criterion here" was chased, and criterion (1) is not met. Denisov-Blanch et al., A Few Pages of Markdown (arXiv 2608.25241; ASE '26, DOI 10.1145/3832783.3837546) does measure a committed, version-controlled configuration artifact against a quality outcome — 441 private repositories at 27 commercial organizations, +53% versus +27% cognitive complexity by whether the artifact exists. But committed AI configuration is instruction to the model, not verification of its output. A rules file constrains what the agent writes; a verification standard governs how much of what it wrote a human checks. The 09-07 formulation — "the standard as a file in a repository rather than as prose" — slides between two different organizational objects with different owners. Criterion (1) remains unmet at fourteen instruments across six functions, the FRC still its only member and still a regulator. Recorded because a criterion that is nearly met is the one most likely to be scored as met later. Next check unchanged at 2026-10-11. File: stafford-research/knowledge-base/denisov-blanch-ramp-committed-ai-configuration-2026-08.md

PROPOSED-UPDATE — knowledge/source-candidates.md, Stanford AI Lab / Denisov-Blanch–Koyejo group

Promotion bar rewritten 2026-09-08 (Stafford), signal count held at 1. The promotion test set on 09-07 — chase the ASE 2026 paper — was run and the paper is excellent, but it shares four authors with the find that opened the slot (Denisov-Blanch, He, Vasilescu, Koyejo; Agarwal and Azaletskiy on both). Promoting on it would count one house twice, which is the error this base corrected for Gallup on 09-06 and for Babina/Ewens-Giroud on 08-24. Revised bar: promote on a third-party replication, extension or critique of RAMP, or on a paper from this group whose finding is uncongenial to its own research programme — not on the group's next output.

PROPOSED-UPDATE — knowledge/query-log.md (scan's copy), Category 6 disposition

Chemla & Tena, SSRN 5997775 — reclassify from "skipped" to "pending, unreadable." The 09-07 skip reason ("a general-equilibrium asset-pricing model, no organizational construct") is incorrect: the model's objects are incentive contracts, termination threats and wage compression. The 09-08 instruction to chase it via RePEc or a mirror was run on 09-08 by Stafford and failed — no RePEc listing, SSRN 403, and the author's own Imperial College profile lists it under a different title ("AI adoption, incentives, and market outcomes") as "in progress" with no download. Do not spend another Category 6 slot on it until a readable copy exists, and do not book its findings from search summaries.

By audience