---
title: 'In the News: October 17, 2026 (Evening)'
description: 'L3M, a Lean 4 agent harness, tiers tools by how far their effects can be undone, and tools that need no review reach about two thirds of shell pass rate.'
canonical_url: 'https://darkfactory.dev/news/2026-10-17-evening'
markdown_url: 'https://darkfactory.dev/news/2026-10-17-evening.md'
collection: news
date_published: '2026-10-17T19:30:00-04:00'
date_modified: '2026-10-17T19:30:00-04:00'
---

# In the News: October 17, 2026 (Evening)


One paper this edition: a harness that decides which agent actions need human review by asking whether they can be undone, with first-party numbers on what that costs in finished work.

## 1. L3M: tools that can be undone or bounded in advance recover about two thirds of what a shell does on Terminal-Bench

**[L3M: A Verifiable Harness and Runtime for Self-Extending and Self-Improving Agents](https://arxiv.org/abs/2610.19591)** · Carson Eisenach, Robert Joseph George, Vincent Quenneville-Belair, Kate Gwimm and Dean Foster · arXiv, October 14, 2026

L3M is a runtime written in Lean 4 that keeps all agent state in Git, so a run can be rewound, forked or merged. A tool's review tier follows from how far its effects can be undone. File writes are "tame" because the harness saves the old bytes first. Git pushes and web fetches are tame because a scoped token names the remotes and hosts they may reach. A shell call is neither undoable nor bounded, so it is "wild" and gets reviewed by default.

The authors tested this on 37 Terminal-Bench tasks with three attempts each, running Claude Opus 5 in every arm and Claude Sonnet 4.6 as the reviewer. With a shell and review off, L3M passed 41.7 percent at pass@3. With tame tools only and no shell, it passed 27.0 percent, 18 passes against 34. Claude Code with permission checks bypassed passed 59.5 percent. Review of shell calls added about 85 percent more model calls and 50 percent more tokens per attempt, and the roughly one-point change in pass rate was not statistically significant on 37 tasks. The authors say the harness is untuned and that it spends well over Claude Code's tokens per solved task.

**Why it matters:** If you are deciding which agent actions need an approval step, this gives a measured case for gating on reversibility instead of on every shell call, and a number for what that gate costs. The comparison is one benchmark subset, run by the harness's authors. We read the abstract, the reversibility section and the evaluation; the other sections and the formal appendices were not read, and we did not inspect the released code.