Code Generation & Program Synthesis - Weekly Roundup

T1, a Mixture-of-Experts model of 122B total trained with reinforcement learning, operating a real shell in a cloud sandbox for up to 300+ tool-call turns per task, rewarded by executing each task's own verifier by executing each task's own verifier.

RCL (Retrieval-Confidence Layer), a lightweight module inserted between retrieval and generation that combines a call-graph-derived structural coverage score with a novelty score estimating a query's dependence on knowledge outside the model's prior, to detect insufficient retrieval before generation occurs.

Recursive Code World Models (RCWM) is introduced, a framework for reconstructing complex 3D worlds in code from a single reference image that provides a recursive construction principle for building complex executable worlds from visual evidence.

T1, a Mixture-of-Experts model of 122B total trained with reinforcement learning, operating a real shell in a cloud sandbox for up to 300+ tool-call turns per task, rewarded by executing each task's own verifier by executing each task's own verifier.

RCL (Retrieval-Confidence Layer), a lightweight module inserted between retrieval and generation that combines a call-graph-derived structural coverage score with a novelty score estimating a query's dependence on knowledge outside the model's prior, to detect insufficient retrieval before generation occurs.

Recursive Code World Models (RCWM) is introduced, a framework for reconstructing complex 3D worlds in code from a single reference image that provides a recursive construction principle for building complex executable worlds from visual evidence.

Solvable does not mean faithful: automated planners routinely validate and execute LLM-generated PDDL instances that completely corrupt the user's intended initial states and goal specifications.

This work studies the codification readiness of implementation-facing research-method specifications, defined by whether they provide sufficient methodological information for a competent implementer or coding agent to construct the intended method without unsupported assumptions.

Turning LLM-written JavaScript games directly into GPU-accelerated Gym environments bypasses manual RL simulation engineering while hitting over 1M decisions per second on a single node.

Treating delayed evaluation feedback as discrete jumps in an SDE-governed return space eliminates the severe credit assignment bottlenecks typical of token-level symbolic alpha search.

Standard binary evaluations mask critical retrieval failures in Text-to-SQL agents, where minor conversational abbreviations slash model accuracy by 17% and increasing join depth triggers undetected multi-table degradation.

Structuring multi-agent program search around quality-diversity archives and execution-profile niches nearly doubles effective alpha discovery yields without falling prey to redundant factor families or execution-cost collapse.

Standard code retrieval reliably lands agents in the right file but leaves them blind to the right function—a gap closed by turning flat snippet results into structured, navigable file scaffolds.

Strong graph coverage doesn't require prohibitive test runtimes: edge-pair coverage is viable on realistic systems once you strip out the 2x to 26x redundant test steps generated by standard methods.

Final code diffs conceal catastrophic agent reasoning: mapping dense execution logs into classified, chronological action streams reveals precisely where models derail or burn tokens during repository navigation.

Highly coupled, history-dependent physical art can now be inverted into editable procedural programs in four minutes flat, slashing backpropagation memory by 8.7× through an exact replay adjoint.

Turning published scientific figures back into executable Python remains a brittle frontier for top VLMs, with even frontier models routinely failing on multi-component layouts, precise axis semantics, and domain typography.

Standard Software Composition Analysis tools are functionally blind to the novel, shifting dependency topologies generated by coding LLMs.

Naive agent-generated test feedback degrades SWE-bench performance by reinforcing shared hallucinations, but decoupling test generation from repair through role-specific RL converts a 3.9-point loss into an 11.4-point gain on open-weights models.

Code generation models can now self-improve at test time without ground-truth unit tests by turning behavioral execution agreement on generated input probes into a stable, hack-resistant policy gradient signal.

LLMs don't just mimic human bugs—they fundamentally skew system failure distributions toward catastrophic crashes that standard deterministic fault-injection pipelines fail to surface.

Standard static analysis tools like CodeQL and Semgrep missed 100% of ground-truth autonomous vehicle software flaws that LLMs detected at a 76% rate, proving that LLMs excel at domain-specific cyber-physical logic bugs where rule-based methods entirely fail.

Automated test generation achieves near-zero bug detection on LLM-written code not because tests fail to execute the bugs, but because LLM-generated assertions consistently fail to notice when a fault occurs.

Tracing whether an LLM or a human wrote a buggy line of code is an operational dead end: responsibility cannot be derived from code provenance, requiring quality engineering to pivot entirely to service-outcome verification.

Autonomous coding agents can slash inference costs by 33% and actually *improve* task success on SWE-Bench, proving that dynamic, syntax-aware context pruning enhances long-horizon reasoning rather than compromising it.

Hardware dataset curation no longer requires manual code refactoring, thanks to an agentic pipeline that autonomously trawls academic repositories to carve out synthesizable HLS designs for LLM training.

Opaque industrial control binaries can now be traced back to their raw Structured Text source code with 95.89% top-1 accuracy across major PLC toolchains, breaking down a persistent barrier in industrial software auditing.

In-code comments only help LLMs when they smuggle in correct downstream solution content that the model could not otherwise elicit, debunking the idea that self-commentary acts as general chain-of-thought scaffolding.

Decoupling permissions from context windows drops prompt injection success from over 60% down to 4% in multi-agent coding workflows without sacrificing repair utility.

Imperative Python loops can now be deterministically converted into idiomatic, vectorized tensor operations in under a second, unlocking an average 75x speedup without relying on trial-and-error rewriting.

In this work, HLS-Eval is extended with an agentic evaluation flow built on the open-source mini-swe-agent framework, which establishes a foundation for agentic HLS design and motivates harder benchmarks and new agentic tooling as model capabilities progress.

SWE-Bench Pro Verified offers a more trustworthy benchmark for assessing software engineering agents, with safeguards that eliminate major leakage channels without disrupting normal agent functionality, and a task refinement that minimally corrects inconsistencies within flawed instances.

The topological geometry of an LLM's attention maps reveals whether code is hallucinated before a single line is executed, outperforming traditional pre-execution heuristics across models up to 34B parameters.

Over 15% of LLM-generated causal inference pipelines run without a single code error yet return completely bogus treatment effects, proving that code execution is a dangerously misleading proxy for statistical validity.

Because the EVM never validates emitted logs against actual execution state, off-chain bridges and wallets are systematically vulnerable to phantom transactions even when contract code passes traditional logic audits.

Over 16% of AI coding-agent configurations silently expose developer environments to supply-chain compromise, frequently disguising arbitrary shell execution behind faux-scoped permissions or consuming unpinned MCP servers.

Open source isn't banning AI code—83% of projects explicitly welcome it, but maintainers are actively rewriting governance rules to enforce human liability, mandatory PR disclosure, and countermeasures against autonomous "slop."

Silent numerical bugs like catastrophic cancellation can quietly corrupt training pipelines and custom kernels, but FPScan exposes them automatically by compiling magnitude-aware error propagation directly into first-order SMT queries.

Merely getting decompiled C to compile hides critical runtime failures, but gating LLM repairs sequentially on compiler diagnostics and official test suites achieves an 87.5% full behavioral recovery rate on GNU Coreutils.

High IoU scores often conceal broken CAD construction logic—a blind spot resolved here by translating natural language into checkable constraint trees that can verify and self-repair parametric CAD code.

Regression surrogates can cut evolutionary architecture search runtimes by up to 30% without sacrificing Pareto optimality across competing non-functional objectives.

Computational effects can now be statically checked and dynamically executed under a single architecture without hard-coding the underlying monad into the language interpreter.

Turning messy execution traces into structured episodic memory stops agents from repeating failed terminal commands, boosting autonomous environment setup to a 75% Pass@1 rate across nine programming languages.

Single-commit detectors systematically miss major architectural refactorings—like class splits and inheritance restructuring—because developers spread complex structural edits across multiple commits without documenting them.

Stakeholders can clearly articulate what they want in a modernized system, yet consistently fail to determine what their legacy architecture actually does.

Maintainers are fundamentally restructuring OSS governance rules to defend scarce human attention against asymmetric floods of low-effort, AI-generated pull requests.

Open-source teams routinely use architecture records to log what technologies they chose, yet systematically fail to document the decision drivers, quality trade-offs, and rejected alternatives required to understand why.

Over 20% of software vulnerabilities actually require multiple patches across repositories and branches to fully resolve, yet public databases miss them so consistently that one-fifth of supposedly "single-patch" CVEs are dangerously incomplete.

When LLMs treat code as disposable, regenerable output, mission-critical conservation invariants can be mathematically verified over compact specifications even as the underlying implementation complexity balloons.

Vector databases and dense retrievers are often overkill for software intelligence: prompt-driven tool selection over live repository APIs delivers accurate, real-time analytics with significantly less architectural complexity.

AI coding assistants executed zero verification commands across nearly 2,000 package installations, demonstrating that machine-readable trust signals provide zero supply-chain protection unless actively enforced by the agent harness.

While leading agents can determine whether an upstream dependency vulnerability is exploitable 80% of the time, their ability to correctly justify *why* collapses—revealing a crucial gap in autonomous security reasoning across repositories.

A single, architecture-independent mechanism behind the conditions where diff-based generation does win is identified: it is competitive on short, spatially localized edits, and its category-level wins concentrate in exactly the two task categories - refactoring and error-handling/edge-case fixes - with the lowest mean edit-step count in the authors' dataset.