Daily Report

Eunomia Daily Report examines concrete systems questions, compares primary evidence, identifies mechanisms that current research or production practice still cannot explain well, and develops ideas that could become useful research systems or deployable engineering mechanisms.

Current reports

Can GPU Utilization Tell You Whether Another Workload Will Fit?

GPU utilization describes recent activity, not whether a particular incoming workload can safely co-reside. This report separates hard resource fit from interference risk and develops an allocatability certificate, bounded two-stage admission, and a counterexample benchmark for spare-capacity claims.

Can GPU Instrumentation Change a Kernel Without Changing Its Meaning?

Dynamic GPU instrumentation can inspect already compiled device code, but the probe itself can alter registers, occupancy, control flow, and measurement coverage. This report develops a probe-effect manifest, resource-budgeted instrumentation with explicit coverage, and a counterexample benchmark for observer-induced failures.

Can a GPU Runtime Place Memory Well With Only Page Faults?

GPU memory oversubscription turns every migration and eviction into a policy decision. This report compares fault, sampled-access, object/phase, and scheduling evidence, then develops evidence-carrying placement records, placement intent with observable compliance, and a counterexample benchmark that measures decision regret under a fixed observability budget.

Can eBPF Keep Policy Identity Across an L7 Proxy Handoff?

An L7 proxy terminates one policy-bound connection and emits or reuses another, so socket identity can stop representing the principal that caused an upstream request. This report develops generation-scoped handoff capabilities, policy-safe multiplexing, and a benchmark for authorization-lineage violations across fast and slow paths.

Can eBPF Preserve Complete Mediation Across Host and Offload Paths?

Host software, SmartNIC fast paths, and DPU offload can all execute network policy while traffic changes paths during misses, updates, and faults. This report develops an explicit path-coverage contract, generation-continuous fallback, and a benchmark that measures policy escapes rather than offload throughput alone.

How Long Can a Revoked Authorization Stay Alive in an eBPF Datapath?

Fast eBPF datapaths can reuse authorization through conntrack, auth maps, socket-local storage, and other persistent state after the policy that created it changes. This report develops scoped revocation epochs, cross-layer completion barriers, and a benchmark that measures the last stale allow rather than policy-update throughput alone.

Can eBPF Verify a Stateful Security Policy, Not Just Safe Bytecode?

Stateful eBPF security relies on persistent map transitions across packets, syscalls, CPUs, and userspace updates even when every program is verifier-safe. This report develops a small temporal policy contract, verifier-cooperative transition guards, and an adversarial benchmark for policy-state correctness.

Who Owns a Packet Buffer in a Zero-Copy eBPF Datapath?

AF_XDP, io_uring ZC Rx, and DPDK already use different native lifetime protocols. This report develops a generation-scoped buffer capability, policy-linked handoff witnesses, and a cross-path fault benchmark for zero-copy eBPF datapaths.

How Should eBPF Compose Multi-Tenant Network Policies?

Multi-tenant clusters can combine additive Kubernetes NetworkPolicy, tiered ClusterNetworkPolicy, and Cilium L3-L7 policy in one eBPF datapath. This report develops an authority-aware composition IR, generation-stable verdict witnesses, and a counterexample benchmark for explaining which policy owner and rule determined an effective verdict.

Can eBPF Compress Telemetry Without Losing the Diagnosis?

Always-on eBPF telemetry can become too expensive to export continuously, while counters and histograms can erase the context needed for later diagnosis. This report develops diagnostic contracts, state-transition exemplars, coverage-carrying summaries, and an equal-budget benchmark that scores diagnosis retention instead of compression ratio alone.

Can eBPF Understand Application-Defined Resources?

Internal pools, queues, caches, and credits can determine performance while remaining invisible as OS resources. This report develops a versioned resource-semantics manifest compiled into eBPF attachments, runtime confidence loss for stale contracts, and a mutation benchmark that tests semantic correctness across software upgrades.

Was the GPU Kernel Slow, or Did It Just Start Late?

A late CUDA kernel start can come from host scheduling, runtime work, command-buffer queueing, dependencies, or device availability even when kernel execution itself is unchanged. This report develops an explicit launch-state ledger, cross-domain launch lineage, and a ground-truth benchmark for deciding which delay cause the trace actually proves.

Can a GPU Profiler Prove What Caused a Slow Kernel?

Asynchronous CUDA traces can show host calls, streams, graph nodes, and GPU kernels without proving which earlier action caused a delay. This report develops generation-scoped host-device causal identity, a dependency-aware critical-path graph with explicit unknown edges, and a ground-truth benchmark that makes timestamp-only explanations fail visibly.

When Does Profiler Sampling Become Biased?

Sampling percentages can be systematically wrong when a sampler phase-locks with periodic work, skids past the event that caused a sample, or repeatedly misses short-lived code. This report develops an explicit sampling-schedule contract with aliasing diagnostics, replicated profile epochs with rank uncertainty, and uncertainty-triggered selective instrumentation under a fixed overhead budget.

Can eBPF Attribute Memory to the Pages That Actually Matter?

Allocation stacks, RSS, page hotness, reclaim, migration, and hardware memory samples describe different parts of memory cost. This report develops a lifetime-aware provenance chain from application allocations to virtual-region generations and page activity, access-weighted attribution with explicit confidence, and a ground-truth benchmark for deciding when page-level lineage is worth its overhead.

Where Should eBPF Run in a Heterogeneous System?

Kernel, userspace, SmartNIC, and GPU-side runtimes can all be valid homes for eBPF logic, but they do not expose the same events, state, memory, authority, or verifier environment. This report develops a placement-aware target manifest, generation-scoped state ownership, and a ground-truth benchmark for choosing execution location without silently changing policy semantics.

How Far Can eBPF Programmability Move Into io_uring?

Current Linux has both per-opcode io_uring BPF request filtering and an eBPF struct_ops execution path. This report separates the cBPF admission gate from the eBPF ring-loop control surface, then asks how restrictions, LSM authority, policy generations, provenance, and resource accounting should compose as io_uring absorbs FUSE, zero-copy networking, ublk, and other registered I/O resources.

What Must an eBPF Profiler Track Beyond Threads?

Async work can leave one thread through io_uring, workqueues, runtime tasks, and application-defined resources, so CPU and off-CPU stacks can lose logical attribution even when the samples themselves are accurate. This report develops a typed causal-edge model, a budget that treats topology edges differently from context samples, and a ground-truth benchmark for cross-thread attribution.

Can a Stateful eBPF Application Upgrade Atomically?

One BPF link can replace one program cleanly, but real stateful applications also span maps, pinned objects, multiple hooks, and userspace controllers. This report separates simple state reuse from semantic state migration and develops generation-gated activation, BTF-aware migration, and crash-consistent recovery as testable upgrade mechanisms.

eBPF Hook Composition: Sharing One Hook Safely

Linux, libxdp, and TCX already let multiple eBPF programs share execution points, but ordering alone does not define how mutations, shared state, competing outcomes, and updates compose. This report compares existing multi-program semantics and research on isolation and bytecode dependencies, then proposes typed composition manifests, explicit outcome algebras, and versioned hook generations.

What Is Missing Before Userspace eBPF Becomes a Real Runtime?

A BPF VM can execute the instruction set without defining how programs attach, which capabilities they receive, who owns state, or how extensions are revoked and accounted for. This report compares Linux eBPF, uBPF, bpftime, and eBPF for Windows, then proposes a machine-readable runtime contract, capability-aware attach handles, and per-extension resource accounting.

When Several AI Agents Work at Once, Who Makes Sure the Final Result Is Right?

Worktrees, sandboxes, and parallel tool calls can isolate workers while still producing a wrong combined outcome. This report uses code changes, shared budgets, approvals, and irreversible actions to explain why parallel agents need one validation and commit step before their effects become real. It also identifies missing benchmarks and effect contracts, then proposes an agent transaction layer, a semantic-conflict benchmark, and adaptive concurrency control.

What Should an AI Agent Trace Keep? Observability Under a Fixed Evidence Budget

AI agent traces can generate hundreds of system events around each model call while still omitting decisive state, authority, or provenance. This report develops an evidence-portfolio architecture and then identifies open problems in evidence utility, portable schemas, unbiased adaptive capture, and equal-budget evaluation.