Ontology grounding beats document RAG by 22.5 points on real business questions

95.0% strict accuracy on real business questions with ontology grounding, against 72.5% for document RAG over the same 27 enterprise tables. That is the headline number from UniDataAgent, the China Unicom system that separates semantic acquisition from online execution. An Ontology Acquisition and Validation stage builds versioned enterprise ontologies from metadata and business knowledge through expert-authored business skills, constrained generation, question verification, and selected expert review; a Question-to-Report Execution stage then retrieves a semantic contract per question, coordinates skills and data tools, validates results, and emits evidence-linked reports. Ontology construction took hours instead of the roughly one week the manual process needed, and the 22.5-point gap over RAG was widest on structured and compositional questions, which is exactly where “the business means X by this metric” has to survive into the query. The paper is a deployment report rather than a controlled study, so treat the numbers as one enterprise’s evidence, but the architecture matches the charter question almost verbatim: acquire meaning offline, version it, execute against it.

A second enterprise-data paper attacks the same problem from the learned side. Learned Enterprise Data Comprehension argues that markdown memory and skill files, the current default for letting a data agent remember schema structure, obscure a division of labor: agents reason semantically well, learned systems predict recurring structure well. Its latent equivalence learning separates persistent task-relevant identities from their dataset-relative realizations, with Gaussian prototypes shaped by supporting and opposing evidence and a learned query-prototype system that routes each recurring evidential need into the same identity structure. On the Data Agent Benchmark, 54 queries across 12 heterogeneous datasets, it reports 94.67% dataset-macro stratified Pass@1 over five trials and 258 of 270 raw attempts succeeding, against 55.51% for the benchmark’s Claude Opus 4.6 reference agent, first of 40 leaderboard entries at submission. Read the two papers together and the shared claim is that cross-schema structure should be materialized once and reused, not rediscovered per query; they disagree only on whether a human-reviewed ontology or a trained prototype system should hold it.

On the coding side, Who Finishes the Job? follows 6,774 merged agent PRs from Codex, Copilot, Devin, Cursor, and Claude Code in repositories with at least 500 stars, against 5,044 contemporaneous human PRs from the same repos. Merged agent PRs attract verified follow-up fixes at 1.62 times the odds of human merges over the same period. The fix attribution is the interesting part: 69.6% of verified fixes on agent merges come from the same agent, and 76.4% of the fix PRs are agent-authored through every commit. The verification is careful, with human annotators plus an LLM judge at Cohen’s kappa 0.78 against a human-human 0.77 and 90% direct-fix precision. So the agents mostly clean up after themselves, but “merged” is a weaker completion signal for agent work than for human work, and any productivity accounting that stops at the merge event is overcounting.

SWE-Serve puts a number on a different completion gap. Its 53 repository-grounded tasks come from recent production changes to SGLang across six inference-engineering families, each run on CPU or a single H100 with hidden functional and regression tests, plus end-to-end serving tests and calibrated performance gates where they apply. Across 11 models and 31 model-effort configurations the best reaches 75% mean pass@1. On the 19 tasks with end-to-end coverage, serving tests reject roughly a third of the patches that pass everything else: 45.9% under the full verifier versus 69.4% with E2E excluded. The benchmark also ships no-op and oracle controls and adversarial verifier review, which is the kind of hygiene evals in this space still too often skip. If your agent’s acceptance test is “the unit tests pass,” this paper quantifies how much production correctness that leaves on the table for one serving stack.

Trains but Doesn’t Learn is a delivery benchmark rather than a task benchmark. It seats an agent as a forward-deployed engineer for post-training as a service: a customer hands over data and a goal, and the agent drives ten stages under a budget, a human-approval gate, and reproducibility requirements, with an oracle scoring each stage from platform-recorded facts. The failure it is built around is the run where loss falls, every signal stays green, and the delivered model is no better than the base. An operator-run acceptance gate catches every such run before payment, and a detector calibrated on known-corrupted runs flags severe corruption mid-run. Four frontier agents ran end to end on metered L40S, A100, and H200 GPUs across 8B to 70B bases, with a human FDE arm under the same oracle for comparison. The abstract withholds the per-agent scores, but the framing, trust to deliver rather than ability to move a metric, is the one production agent teams actually need.

Ajar adds a third axis to agent-defense evaluation. Existing benchmarks such as AgentDojo grade a defense on attack success rate and benign utility, so a defense can score well on both while leaving a transfer, a deletion, or a broad read open that no task ever needed. Ajar attaches to the existing benchmark, reuses its tasks, tool schemas, reference solutions, and goal states, and for each benign task constructs candidate tool calls the task does not require; any the defense allows is privilege left open. Run against Progent, CaMeL, AC4A, Permission Assistant, and Claude Code’s Auto mode, the five defenses leave widely different amounts open. Two leak almost the same amount yet differ widely in how many benign tasks they finish, and one buys part of its tightness by refusing calls its tasks were entitled to make. None of that is derivable from the two metrics everyone currently reports. Code is at github.com/reSHARMA/Ajar.

For retrieval, Semantics Delivery Network is a position paper arguing that chunk-granularity semantic retrieval should be a first-class network abstraction. Search returns URL lists ranked for generic relevance and CDNs cache URL-addressed objects, while agents consume short passages selected for task utility, retrieve statefully across turns, and duplicate each other’s acquisition and processing work. SemDN proposes an origin-authorized hierarchical edge substrate that indexes, searches, and caches at chunk level on behalf of participating sites with tenant-specific retrieval policies. The hard problem it names is that semantic retrieval has no explicit cache-miss signal, so the substrate has to estimate when its corpus is incomplete or stale and trigger scoped discovery. Preliminary probes show a large gap between page content processed and chunks consumed, substantial task-local reuse, and higher answer quality per context token from chunk delivery. Whether any origin will authorize a third party to serve its content to agents is the deployment question the paper leaves open.

What to watch: whether UniDataAgent’s ontology contracts and the latent-equivalence prototypes get evaluated on a common enterprise benchmark, since right now each reports against a different baseline; and whether the open-privilege axis from Ajar shows up in the next round of agent-defense papers, because a defense that is tight only by refusing legitimate calls is a defense nobody deploys.

Feed note: the code-intel mirror reported a stale sync timestamp; items were pulled from the local primary ingest, which is current through 2026-09-24.