Keynote  ·  DASHSys Workshop @ VLDB 2026  ·  Boston

Surfing the Jagged Frontier

Practical lessons in building agentic applications
Erkang (Eric) Zhu  ·  Alibaba Group
September 4, 2026
Opening

Surfing the model wave

the next one, right behind coding — the fastest water tool use long-horizon context a capability lag — the waves are closing it enterprise semantics an information lag — frontier models don't have your private data the jagged frontier your application
Opening · Scope

What is this talk about?

This talk doesn’t cover
  • Evaluation
  • Monitoring
  • Fine-tuning
This talk covers
  • Harness architecture
How to surf the jagged frontier
Surfboard
Background · Project & community

QwenPaw is Open Source ★ 34.7k GitHub stars

#1 Repository Of The Day Jul 25, 2026 · all languages #1 Python Repository Of The Day Feb 28, 2026 · Python
Top contributors ranked by commits
rayrayraykk
241 commits
zhaozhuang521
227 commits
zhijianma
189 commits
hongxicheng
151 commits
xieyxclack
146 commits
qbc2016
126 commits
Leirunlin
82 commits
jinliyl
75 commits
yutai78786
69 commits
cuiyuebing
67 commits
lalaliat
63 commits
jinglinpeng
51 commits
pan-x-c
47 commits
bowenliang123
34 commits
yuluo1007
29 commits
hanson-hex
28 commits
yuanxs21
28 commits
ekzhu
26 commits
XiuShenAl
26 commits
niceIrene
23 commits
x1n95c
23 commits
yaozy2020
22 commits
wangfei010313
22 commits
fancyboi999
22 commits
Pull-request
outcomes all-time snapshot
RepositoryTotal PRsClose rateMerge rate
QwenPaw · agentscope-ai3,581
91.5%
65.4%
OpenClaw · openclaw82,185
97.2%
38.2%
Hermes Agent · NousResearch74,198
65.9%
16.7%
Lesson 1 · Coding

Give the model code — and a few tools that accept it

a catalog of narrow tools get_user list_files fetch_page create_task get_order send_email search_docs update_row post_message book_room read_ticket issue_refund export_csv create_event lookup_metric save_file context spent a few tools that accept code { · } exec(code) { · } browse(code) { · } transform(code) context spent
Coding is the capability improving fastest. Code-shaped tools gain from every new wave.
Lesson 1 · Coding · The browser

QwenPaw's browser tool

one tool · its argument is a program
# browser(code) — module-level async Python, one round browser = await Browser.connect() page = await browser.open( "https://dashsys-workshop-vldb.github.io/") obs = await page.snapshot() # perceive await page.get_by_role("link", name="Program").click() obs = await page.snapshot() # verify rows = page.locator(".program .talk") return await rows.all_text_contents()
the SDK is already in scope as Browser — one tool call, one program, one round trip
the skill bound to that tool · skills/browser/SKILL.md
--- name: browser description: "Drive a live browser with async Python against QwenPaw's builtin Browser SDK. The full reference is below; re-load this browser skill after context compaction." --- Work with discipline: perceive the current page, act through the documented surface, then re-perceive before claiming success. For login, captcha, or 2FA, call await browser.handoff(...) and stop. Never automate those flows. <!-- BEGIN GENERATED: browser-manual --> await page.snapshot(query=None) -> observation (.text) page.get_by_role(role, *, name=None) -> locator await browser.handoff(reason, instructions) -> dict …
boundaries handoff() returns control to the human — logins · CAPTCHAs · 2FA sandboxed, with a chosen identity — guest, or the signed-in Chrome
Lesson 1 · Coding · The browser

37 round trips, or one program

one action per call 37 round trips
one program, one round 1 round trip
One errand: eight keynote bios and twelve accepted papers. Both clips run at the same rate — only the round-trip count differs.
Lesson 2 · Context · Scroll

Scroll: QwenPaw's context manager

a long-running task, turn by turn → the model's window #1 #207 #213 summary ² the common remedy: summarize, then drop the originals — losses compound evicted from the prompt → still indexed on disk SQLite · FTS5 every turn persisted · stable seq № eviction index #1–96    setup · repo cloned · deps ok #97–183  first failing run · traces #184–207 fix landed · tests green model-written headlines over ranges — a navigable map of the whole history
Scroll treats history as data: evicted turns leave the prompt and stay on the record.
Lesson 2 · Context · Recall

Let the model query its own context

Model reads working set what the prompt holds right now durable log every turn, addressed by sequence № seq 0001 … 1204 · FTS index recall_history search the log · expand around a sequence number recall_history_python sandboxed Python over the full history — count, join, diff results return, citing #seq sample code run by recall_history_python hits = ms.search("deployment decision", k=200) recent = sorted(hits, key=lambda row: row["seq"])[-5:] for row in recent: print(row["seq"], row["content"][:300]) search 200 matches; return only the five selected rows to the model
The model searches its log and runs Python over it, holding bulk results in variables.
Lesson 2 · Context · Results

Scroll holds up across memory and long-horizon action

LongMemEvalS 94.8 accuracy · ~115K-token history Scroll 94.8 reported best 96.4 competitive with the strongest reported systems BEAM10M 73.1 judge score · 10M-token history Scroll 73.1 reported best 68.0 +5.1 over the prior best LOCA256K 86.7 accuracy · 256K-token environment Scroll 86.7 published best 49.3 +37.4 over the prior best Reference systems use different backbones and evaluation setups. Scroll paper
Lesson 3 · Data model · Creator

Creator: agentic video production

QwenPaw Creator — product demo 0:27 · click to play
what to watch
  1. 1An agent team — screenwriting, visual development, a generation director, an editing director — plans, generates, edits, composes.
  2. 2The change is asked for in dialogue, and the person points at the object they mean: @clip-07, @selection.
  3. 3It lands on the same timeline they were already editing. No export, no second copy of the project.
Project content itself is the agent's context — the agent and the user work on the same state.
Lesson 3 · Data model · The commit boundary

The model edits the data layer directly

a transition past its endpoints → rejected Agent Human edits the timeline and @-mentions @clip-07 in chat commit boundary project.json all durable project state — one file timelines/ elements/ assets/ edit_plans/ runtime/ locked one schema defines a valid project what the boundary guarantees Both can edit at once Protected fields stay locked Every write is checked Agent edits stay traceable five generic tools — no create_shot(), no add_clip() read_project() read_file(path) query_at(time) project_jq(program) project_patch(ops) Two accept code. Broad edits, without dozens of special-purpose endpoints. Creator guide
Lesson 3 · Data model · The general form

Business rules belong at the data layer

the data model the domain, stated as state schema validation commit-time constraints protected fields compare-and-swap Model jq program patch ops invalid intent bounces
The model contributes expressiveness — any intent it can state as a program. The boundary contributes safety — no invalid state is reachable.
Lesson 3 · Data model · CloudPaw

CloudPaw: action as data

localhost:8088/chat CloudPaw-Master ▾
Deploy a small web service for me — low traffic, Hangzhou.
CloudPaw-Master
⚡ delegate_external_agent → iac-code · ROS templates synthesized 2 plans
☁️ Confirm your resource plan pending
Economy
ECS instance
ecs.e-c1m1.large · 2 vCPU / 2 GB · Hangzhou
≈¥0.062/h
System disk
ESSD Entry 40 GB
≈¥0.006/h
Public bandwidth
1 Mbps · billed by traffic
¥0.80/GB
Total≈¥49 / month
▸ details · 3 items
Performance
ECS instance
ecs.c7.large · 2 vCPU / 4 GB · Hangzhou
≈¥0.217/h
System disk
ESSD PL1 40 GB
≈¥0.011/h
Public bandwidth
5 Mbps · billed by traffic
¥0.80/GB
Total≈¥165 / month
▸ details · 3 items
⚠ Real resource needs can change during deployment, which changes the cost. Keep an eye on actual usage and your bill.
Confirm deploy
Adjust resources
If nothing is chosen within an hour, the first plan is selected automatically. Confirm deploy
Reply to CloudPaw-Master… ↑
the request "deploy a small web service" template.ros.yaml Resources:   WebServer:     Type: ALIYUN::ECS::Instance     InstanceType: ecs.e-c1m1.large   WebSg:     Type: ALIYUN::ECS::SecurityGroup     Ingress: [80, 443] the action, stated as data — ROS / Terraform the boundary schema ✓ policy ✓ human ← nothing exists until that card is answered apply deterministic engine · CreateStack the account ECS SecurityGroup StackId · resource ids · public IP CloudPaw- Verifier CloudPaw plugin
A template is validated before it runs, diffed for review, and verified after.
Lesson 4 · Private data

The agent needs a map of your data

what a company actually has warehouses dashboards metric definitions docs past analyses chat threads what people just know tens of thousands of tables, most named by whoever built them definitions drift every quarter the frontier model has seen none of it the scaffold — maintained by the application what the words mean business terms, rules, who owns them where the data lives tables, columns, metrics, lineage what worked before past tasks, joins, corrections the agent uses the scaffold for grounded context about private data
Your application carries the meaning of private data.
Lesson 4 · Private data · QwenPaw-Data

QwenPaw-Data: a data agent for your enterprise

localhost:8089/apps/datapaw QwenPaw-Data · application
DPQwenPaw-Data
⚙ Model settings中 / EN
✦Analyze
▦Manage
Ready
  • Core3/3 ready
  • DataSource ready
  • GraphGrounding ready
  • Skills31 loaded
Checked 14:32:07
All available context ▾
You
Which metrics showed unusual or noteworthy movements last week? What likely caused them?
QwenPaw-Data
▾Analysis trace · 4 steps
  1. List business domains7 domains
  2. Scan governed metrics42 metrics · last complete week vs prior week
  3. Investigate largest movementdau_mau_ratio · segments, lineage, and release context
  4. Execute governed SQL15 rows · read-only · demo_postgres
week_startdaumaudau_mau_ratiowow
2026-07-27412,8801,904,2200.217+1.4%
2026-08-03418,1051,912,6400.219+1.3%
2026-08-10383,9421,898,5100.202−8.2%
Showing 3 of 15 rows.
One metric stands out: dau_mau_ratio fell 8.2% week-over-week. The drop is concentrated in mobile_web; iOS and Android are flat, and the timing aligns with the session-timeout change shipped on Aug 11. That makes the release the leading hypothesis, not a broad demand decline.
Ask about a metric, trend, dataset, or business question… ↑
QwenPaw-Data may execute read-only queries. Verify important decisions.
SESSIONS
Every step is visible, replayable, and citable by the person who has to trust the answer.
Lesson 4 · Private data · QwenPaw-Data

Three graphs turn a vague question into a precise one

three typed graphs what the words mean business terms · rules · owners · when they took effect where the data lives tables · columns · metrics · lineage what worked before past tasks · joins · corrections someone asks "revenue of valid users this year" a valid user has 10+ GAAP this year revenue lives in gaap_val this join worked in April ✓ look up "valid user" find the column that holds it reuse the join from last time context blob for grounding valid user = 10+ GAAP year-to-date rule KG-118 · owned by Finance · in force since Q1 revenue = dws_gaap_di.gaap_val daily table · verified by the data team · refreshed 06:00 join users to orders on user_id used in task #831 · answer accepted by the asker the agent writes SQL against this, and cites it correct the agent once, and the correction becomes a rule
Lesson 4 · Private data · Benchmarks

What does the scaffold buy

public benchmarks · higher is better QwenPaw-Data prior SOTA human KramaBench QwenPaw-Data 68.32 prior SOTA 55.83 human 76.75 +12.49 over prior SOTA DAComp QwenPaw-Data 62.38 prior SOTA 50.84 +11.54 over prior SOTA 020406080 component ablation · same base model production BI tasks · scores (%) · higher is better breadth depth report artifacts General agent 27.3525.2135.6436.94 + Skill-Hub 66.3248.4647.0385.90 + DataBridge 36.5929.3937.8432.43 Both → QwenPaw-Data 79.6362.6058.0986.04 QwenPaw-Data paper
Lesson 4 · Reprise

Surfing the model wave

the next one, right behind coding — the fastest water tool use long-horizon context a capability lag — the waves are closing it enterprise semantics an information lag — frontier models don't have your private data scaffolding by the harness the jagged frontier your application
The platform · Common abstractions

Three applications reveal a common platform

Creator video production QwenPaw-Data data analysis CloudPaw cloud operations the data model what the domain is project.json timelines, clips, subtitles, assets, edit plans three typed graphs business terms, tables and columns, past tasks ROS / Terraform template instances, networks, quotas, the deployment itself tools over it read · jq transform · patch · query elements at a time grounded retrieval, then 17 analytical skills synthesize a template · diff it · apply it · verify it rules at the boundary schema validation, field-level compare-and-swap, protected fields provenance, trust level, when a definition was true schema and policy checks before anything executes people in the path before / after cards in a decision tray; cost ceilings answers cite their evidence; corrections become rules the human picks a proposal; a verifier checks the result an agentic application platform shared runtime · context · memory · safety & sandbox · review common abstractions, implemented once
The platform · QwenPaw

QwenPaw is an agentic application platform Beta 34 Apps Built

Developer API @app.route · @app.tool · app.skill_provider · app.agent_profile ctx.chat · ctx.storage · ctx.tools · ctx.ui Your application the part specific to the domain domain model data and semantics tools & skills domain operations UI & workflow interaction and review QwenPaw platform Surfaces channels · console · terminal · CLI Runtime staged lifecycle · agent dispatch Agent workspaces isolated, one per agent Tools code-taking Skills on demand Memory ReMe Context Scroll Sandbox OS-enforced Drivers external protocols · MCP Kernel AgentScope 2.0 · in-process Apache 2.0 · github.com/agentscope-ai/QwenPaw
Close

Summary

1 Give the model code, and a few composable tools that accept it. 2 Keep context queryable, so the model can recover past details. 3 Use a data model with rules to protect your data. 4 Provide a semantic map for data the model does not understand. QwenPaw handles the agent mechanics, so you can focus on your domain. open source QwenPaw agentscope-ai/QwenPaw this talk Slide deck ekzhu.com/dashsys2026-slides Keep going → three bonus videos follow