正在打开每日关注
正在打开每日关注
Datadog 团队以状态机、OData、Cedar、Wasm 等成熟原语组合出 Temper,让 Agent 生成的软件先验证再运行。
Strongly agree. Agents amplify whatever primitives they build on, good or bad. Our systems research team at @datadog is building Temper: a higher level of abstraction for software that agents build and operate, made from boring, well-understood primitives. (1) OData for self-describing APIs with typed entities and relationships (2) I/O automata for behavior (3) Actor model for execution (4) Cedar for policy (5) Wasm for safe code sandboxing (6) rust as the language None of these are new, and that’s the point. Composing them lets you describe/specify an application succinctly as entities, state machines, and policies, instead of as the glue code between them. That description is small and precise enough to formally verify (SMT solvers, model checkers, theorem provers), and the runtime is tested under deterministic simulation. An agent can propose any change. A state change only lands if it passes the spec and the policy. https://t.co/cXWpzEMuPL
“Programming language syntax or languages themselves doesn’t matter anymore because the agents just do it.” This drives me nuts because it’s just not true. You need to have solidly designed primitives for agents to work with, otherwise it becomes sloppy soup.
是什么:Temper 是 Datadog 系统研究团队开源的"为 Agent 造的机床"——一个经形式化验证、策略驱动的运行时,让 Agent 以规约而非胶水代码描述并运行软件。Rust 实现,v0.1.0 预发布,MIT/Apache 双协议,Katagami 已在其上生产运行。
架构与核心设计:应用被拆为四部分——行为(I/O Automata 状态机)、数据契约(OData CSDL 类型化 API)、授权(Cedar 默认拒绝策略)、应用逻辑(带资源预算的 Wasm 沙箱模块)。内核跨部署保持静态,规约与策略热重载。每次部署前过四层验证:Z3 符号检查、Stateright 全量模型检查、故障注入的确定性模拟、proptest 属性测试,小规约亚秒完成。Agent 任意变更只有通过规约与策略才落地;越权调用记入待审队列,temper decide 支持人按窄/中/广范围批准并热加载新规则。
值得借鉴:同一份 TOML 规约既是验证目标又是运行执行工件,从结构上防止证明与实现漂移;默认拒绝 + 人在环治理兼顾 Agent 自主性与安全;对 HTTP/MCP 开放,兼容 Claude Code、LangChain 等主流客户端;确定性种子让失败可复现。
边界与风险:API 未冻结;生产案例极少;规约表达力受限,复杂业务逻辑仍要写模块内代码;验证速度依赖小状态空间,契约外的集成风险仍需靠故障注入模拟兜底。回应了 Vicki Boykis 的观点:Agent 时代不是不需要好原语,而是更需要。