Synthesis — Agentic Tooling

The evolving thesis. This spoke was split out of ../research-wiki's "cluster B" on 2026-06-01, when a single Telegram burst added ~10 agent-tooling sources and the cluster became larger than its parent's core. It owns the tooling for building and running LLM agents; the knowledge-management / tools-for-thought lineage stays in ../research-wiki, joined here by a few explicitly cross-linked bridge nodes (gbrain, agent-skills, compound-engineering, model-context-protocol, anthropic, claude-opus-4-8).

Current thesis

The frontier model writes code; the value has moved to everything wrapped around it. A claimed leaked Claude system prompt (claude-fable-system-prompt-leak) is the vendor-side snapshot of exactly this — tools (web search, artifacts, MCP connectors, code execution), memory, safety rules, and behavior assembled into one configured layer — though as a T4 unverified leak it illustrates the pattern, not proves any specific. Six layers recur across the (verified) sources:

1. Capability as portable markdown — agent-skills. Domain expertise + procedures bundled as markdown an agent loads at runtime: claude-financial-services (FSI verticals), agentic-seo-skill and claude-skills-ppc (marketing), gstack's 23 role-skills, and now cybersecurity-skills — an 817-skill security pack that is the wiki's largest skillpack and a scaling test of the standard itself: an agent scans all 817 ~30-token frontmatters in one pass and loads only the matched workflow, so "metadata → body → resources on demand" is shown working at three orders of magnitude past a toy. (It also turns the standard reflexive: two of its framework mappings — MITRE ATLAS, NIST AI RMF — are about attacking/defending agents, so an agent skillpack ships agent-security skills.) A different shape of the same primitive is superpowers (Jesse Vincent/obra): not domain expertise but a whole software-development methodology packaged as ~two dozen composable skills the agent self-invokes (brainstorm→plan→test→build→debug→review). It is notable for spanning the layers — bundling orchestration skills (subagent-driven development, parallel agents, git-worktrees) alongside the per-phase ones — and for shipping cross-harness (Claude Code, Cursor, Codex, Copilot/Gemini CLI), making it a portable methodology rather than a single-tool plugin. (Reflexively, it is the skill system this very hub session runs on.) Its nearest sibling is compound-engineering-plugin (Every Inc), re-read 2026-07-25 and grown to 32 skills across 13 host CLIs. Same idea — a development methodology as a skillpack — with two instructive differences. First, who invokes: superpowers has the agent self-invoke, compound-engineering exposes explicit /ce-* slash commands a human drives (with /lfg as the autonomous escape hatch), so the same primitive supports both an agent-initiative and a human-initiative loop. Second, and the part worth stealing, it ships /ce-compound: a skill whose output is the next run's context, written to docs/solutions/. Every other pack in this section codifies expertise once, up front; this one closes the loop back onto its own artifact store, which is self-improving-agents achieved with a filesystem instead of a weight update. Its portability is also honestly expensive — a separate plugin manifest per host, not one artifact carried by the standard — which is the pre-standard tax the spec exists to remove, still being paid by the biggest packs. A third point on the invoke axis arrived 2026-08-05: superclaude-framework (23.7k★, MIT) — 30 slash commands, 20 role-persona agents, 7 behavioral modes and 8 wired-in MCP servers, installed by pipx writing configuration into claude-code. Its phase vocabulary is nearly word-for-word superpowers' (brainstorm, research, test) but its primary surface is a command the operator types, which puts it on compound-engineering's side of the line. Three packs now teach the same arc and disagree only about who pulls the trigger — the strongest sign yet that the methodology is settled and the control point is the live design question. SuperClaude is also Claude-Code-only where the other two are cross-harness, and its announced v5 (a TypeScript plugin system) would move it onto the same plugin rails, so the portability tax above is being paid down by a second route: not one artifact per the standard, but a rewrite off ad-hoc config injection. None of the three has an evaluation, and this is now the section's standing hole rather than a note on one entry. cc-thinking-skills remains the only place anyone ran the harness on a comparable pack and it found zero proven accuracy gains across 39 skills. Star counts (242k, 23.7k) measure installs. The academic literature has now caught up with the packs, and it leads with the harm (2026-08-15). agent-skills-can-be-harmful (Microsoft Research + HUST + UIUC, T1) audits skills against paired reference runs and classifies 307 confirmed skill-induced failures — 125 that broke the task, 182 that doubled its cost. The result that should change how this section reads its own subject: an irrelevant skill is not the problem. Loading a skill that should not have applied accounts for 2 of 125 functional failures. The other 123 are on-topic skills whose examples, defaults and templates got followed as if they were the task's requirements. Every pack above ships exactly that material, and none of them marks which parts are binding. ruflo (67.1k★, ex-Claude Flow), routed the same day, is the layer above: not a methodology pack but an agent meta-harness wrapping claude-code in swarm topologies, 100+ agent roles, ~210 parallel MCP tools, vector memory, a self-learning loop and cross-organization federation. It bundles in one package what this spoke has otherwise met one claim at a time — orchestrate-100-agents-claude-code for fan-out, iai-pme for memory, nono for sandboxed execution, qm for multi-operator coordination — and it inverts those projects on evidence: each defends a single claim with a number, Ruflo asserts all of them behind one conditional speedup. Across the day's three packages the pattern is consistent enough to state: in this corner adoption and measurement are uncorrelated, and the most-starred artifact is usually the least evaluated. Its federation claim is the one nothing else here attempts — agents cooperating across an org boundary under zero trust, strictly harder than qm's tightening-only posture inside one org, and the place to watch for a first independent account. A source that arrives assembled (2026-08-05, hitchhikers-guide-agentic-ai). Roitman's arXiv book runs the whole stack — substrate, alignment, agentic RL, RAG, memory, harness, loops, MCP/A2A, evaluation, deployment — on the thesis that competence at one layer does not survive ignorance of the others. It is the first source here that is not a repository, a post or a benchmark, and it independently names two things this spoke reached the long way. Loop engineering is a chapter, with generate-verify-retry and adaptive budget control as named mechanisms; the corpus derived loop-engineering from practitioner accounts and has documented no budget lever at all. The in-context / external / episodic / semantic memory taxonomy is standing vocabulary there, where the spoke assembled it from iai-pme's tiers and jcode's memory graph. Convergence between a literature synthesis and a corpus built bottom-up from artifacts is the strongest evidence either one gets that the categories are real. It also puts the section's evidence hole in relief. The book teaches evaluation methodology for agentic tasks as settled enough to have a chapter, while the field it describes ships packs with 242k and 67.1k stars and no measurements. Nothing here resolves that; both facts stand. The counter-case to the evidence hole (2026-08-14, meaning-typed-programming). Every entry in this paragraph ships adoption numbers and no measurement. byllm — jaseci's by operator — inverts that: its accuracy/cost/complexity claims trace to a peer-reviewed paper (OOPSLA2 2025) with a blind N=20 user study and a 13-benchmark suite run against two named prior systems, DSPy and LMQL. 4.0×/5.3× less code modified, 98.92% average accuracy vs 98.23% (DSPy)/90.85% (LMQL), and LMQL scoring zero success on the hardest user-study task. This is not evidence that MTP is more adopted — jaseci's own repo sits at a modest 686★, nothing like the counts above — it's evidence that evaluating this kind of claim is tractable when someone does it, which sharpens rather than resolves the corpus's standing complaint: adoption and measurement remain uncorrelated, but now for a documented reason each entry supplies for itself (no eval published) rather than an assumed one (no eval possible). A second extraordinary count, not a matching one (2026-08-14, ecc). ecc — a separate, unrelated 68-agent / 284-skill harness system, single-maintainer, seven months old — sits at 240,127 GitHub stars. Checked against superpowers's 2026-06 snapshot (≈242k) the two looked near-identical; live-checking both the same day showed superpowers had grown to 272,113, a ~32k gap. The lesson is not "two repos converged" but "a snapshot star count decays fast enough to manufacture a false coincidence" — the correction is now recorded on both pages. What still stands: both counts remain individually extraordinary for single/small-maintainer packs this young, and neither is taken as adoption evidence. The packs leave software (2026-08-05, opc-skills). ReScienceLab's Apache-2.0 pack (1.2k★, ~11 skills, 16+ host tools) is for solopreneurs and one-person companies, and none of its skills touches a codebase: market research on Reddit/Twitter/Product Hunt, domain hunting, SEO, logo and banner generation, archiving. Everything else in this section teaches an agent to build or ship software; the two marketing packs here are single-discipline. So the standard travels to a domain with no compiler, no test suite and no CI — which removes the free verification every coding pack has been leaning on, and neither the pack nor the format offers a substitute. It also puts a third answer on the table for where composition lives: domain-hunter declares a dependency on twitter and reddit inside the skill, where the standard has no dependency mechanism at all and agentic-awesome-skills pushes the question out to an MCP control plane that lets the agent pick IDs and validates structure only. In the standard, in a control plane, or in the skill — three placements, no argument yet for any of them. The individual-developer floor of this is agent-scripts (Peter Steinberger, the openclaw author): one engineer's private hub of skills + AGENTS.MD hard rules + helper scripts, kept DRY across all his repos and mirrored into both Codex and Claude Code by a sync-skills script. Where superpowers and pm-skills are cross-harness packs for others, this is the smallest useful unit — a portable skill set for one person's machines — and its sync-skills / validate-skills are the same library-maintenance ops autoharness automates, here run by hand. That the OpenClaw author standardizes his own work on these conventions is a small vote for how load-bearing they've become. This is hardening from per-tool conventions into an open cross-vendor standard, agentskills-spec (agentskills.io) — one skill across "Gemini CLI, Claude Code, Cursor, 40+ products" — with progressive disclosure (metadata → body → resources on demand) the load-on-demand mechanism. Skills become agentic when combined with tools/data via model-context-protocol (the explicit "skills × MCP = agency" formula). A concrete, fully-local worked example is from-local-llm-to-agent: a Gemma model on Ollama (OpenAI-compatible endpoint) driven by the OpenAI Agents SDK calling MCP tools — showing the agent layer decouples from where the tokens come from, so "agency = the configured layer, not the model" holds even with no cloud model.

   The standards layer around this primitive now spans five edges: skills (agentskills-spec = what an agent can do), context (agents-md = what it must know about a project; 60k+ repos, Linux Foundation) tools (MCP = how it reaches data/APIs), interop (a2a-protocol = how agents from different frameworks collaborate without exposing internal state — Agent Cards, tasks, JSON-RPC/HTTP), and discovery (agentic-resource-discovery = how an agent finds and trusts capabilities across organizations). The framing: MCP = agent→tool; A2A = agent→agent — complementary, MCP runs inside an A2A ecosystem — and ARD = how you find either across domains (an ai-catalog.json at a well-known path, indexed by registries that are "search engines for the agentic web," with domain-rooted cryptographic trust). The interop edge now has a running cross-language instance: adk-a2a-cross-language drives a Go validator (plain HTTP, no AI framework) from a Python ADK orchestrator via A2A alone — so "decompose the monolith into per-language microservice agents" is demonstrated, not just specified, and orchestrator → fan-out provably crosses language and framework boundaries. ARD is a meta-standard: it doesn't replace MCP/A2A, it indexes them. Five distinct open standards, each a candidate attractor or a fragmentation front; the governance move repeats (vendor → neutral foundation → default) — ARD's data model lands in the Linux Foundation (AI Catalog Working Group), the same home as A2A and AGENTS.md. agents-md and agentskills-spec are siblings: skills = what an agent can do; AGENTS.md = what it must know about the project it's working in.

   A sixth contender that isn't at the same layer (2026-07-27, pilot-protocol). All five above are formats layered on the human internet — JSON-RPC over HTTP, a catalog file at a well-known path, markdown conventions — keeping DNS, TLS and HTTP and adding agent semantics above them. pilot-protocol takes the other branch: its own address space resolved by its own registry instead of DNS, an OSI-layer-5 UDP protocol with NAT hole-punching so agents connect directly, its own discovery agent, a curated app store, and payments (USDC via x402) as a network primitive. So "which standard becomes the attractor" may be the wrong shape of question — the prior one is does the agent web run on the human web at all. A2A bets that HTTP's installed infrastructure (DNS, TLS, proxies, every firewall rule already written) outweighs the impedance mismatch; Pilot bets the mismatch is the point. Two further notes. Payments are a genuine gap the five don't address: none of them says how one agent compensates another, which is what decides whether an open agent network can sustain itself (the consumer-facing half sits cross-spoke at ../search-marketing-wiki's agentic-commerce; this is agent-to-agent settlement). And the governance pattern inverts — where A2A, AGENTS.md and ARD all ran vendor → neutral foundation → default, Pilot is a venture-funded company operating the network it specifies, with an IETF Internet-Draft that confers no standing until a working group adopts it. Its self-reported ~219k agents and ~33k req/s are unaudited marketing counters, so treat the traction claim separately from the architectural argument, which is the part worth keeping.

   A seventh, and it argues against one of the five (2026-08-12, webmcp). WebMCP fills the slot the stack above never had — agent→web page. A page registers its own functions and <form>s as tools (document.modelContext.registerTool) and an in-browser agent calls them in the tab the user is already looking at. The reason given is the interesting part, because of who gives it: the explainer's case is that backend integrations — naming MCP and OpenAPI — bypass the UI, which it calls "UI Disintermediation & Context Loss," forcing a developer to "replicate the user's state, active context, and authentication credentials on a separate server." This corpus has held that objection before only from critics. Here it is the problem statement of a spec written by the people building the ecosystem, and WebMCP still "shares a common vocabulary with MCP."

   That cuts against the framing above in a specific way. The five standards were read as candidates to become the attractor, differing in layer and scope. WebMCP says the choice is not only which protocol but where the capability lives — and a capability implemented inside a page is one an ai-catalog.json entry cannot point at, so ARD's index has a blind spot by construction.

   And the governance pattern breaks a second time, in the other direction from Pilot. pilot-protocol inverted it by being a company operating its own network. WebMCP inverts it by having no single vendor to invert — Microsoft and Google are co-authors from the first commit (13 August 2025), in a W3C community group rather than a foundation created around the artifact. So the spoke now holds three governance shapes rather than one pattern with exceptions: vendor → foundation → default (A2A, AGENTS.md, ARD), vendor operates the network (Pilot), and multi-vendor incubation in an existing standards body (WebMCP). Their failure modes differ, which is the useful part: the first fails by nobody else adopting it, the second by the company, and the third by stalling. WebMCP is at 108 open issues against 124 commits with no version number, in a Chrome origin trial from Chrome 149, and neither Apple nor Mozilla has a stated position in anything read. For a proposal adding an agent-facing API to every page on the web, that absence is the number to watch.

   A split inside the primitive, and the first measurement of it (2026-07-22). Everything above treats a skill as capability — knowledge or procedure the agent lacked. A second kind rides the same SKILL.md channel and makes a weaker claim: cognitive skills, which prescribe how to think about a problem rather than granting anything new. cc-thinking-skills packages 39 of them (Munger, Meadows, Kahneman, Goldratt, Boyd) behind a router meta-skill — and, unusually, ships the eval harness too, reporting that zero of the 39 show a robust replicated accuracy gain against a length-matched placebo (best candidate thinking-scientific-method: +5.3pp, p=0.061, n=150, DIRECTIONAL-NOT-REPLICATED; the repo's August audit restates it as +4.0pp, below its own margin, and cut the pack to 28 manual-only skills). auto-company makes the same bet in the persona encoding (14 named experts, "extreme business and engineering depth"), untested. The scope is narrow — scoreable accuracy only, one author, one harness — but it is the first negative evidence in the spoke against any part of "structure substitutes for capability," and it lands precisely where the substitution was cheapest to assert. Progressive disclosure's token-budget win is mechanical and stands; "reasons better because it was handed a framework" does not, yet.

2. Structure around the model — the agentic-coding-harness. A wave of products (agentsys, agent-kanban, claw-code, conductor, gstack, agent-starter-pack) crystallizes one bet: structure substitutes for capability — phase gates, deterministic tools instead of token-spend, confidence grading, persistent state, multi-agent + human coordination. agentsys pushes the strong form (Sonnet + harness > raw Opus on cost-effectiveness). The instances span a full plan → build → deploy spectrum: conductor (context/plan) → agentsys/agent-kanban/gstack (build/orchestrate) → agent-starter-pack (deploy/operate), over the thin provider- agnostic substrate claw-code. langchain supplies the canonical formula and the structural unit: agent = model + harness, "task-harness fit > raw model capability", and the harness built from composable agent-middleware — single-concern pieces that hook the agent loop (before/after model & tool calls, startup/teardown) and stack instead of a monolith (langchain-custom-harness). Tellingly, LangChain's prebuilt middleware are just this wiki's other threads as drop-ins — delegation = agent-orchestration, human-in-the-loop = supervision (agent-kanban), state = durable-agents, memory = gbrain — so the harness is a middleware stack over orchestration / durability / supervision / skills. easy-agent turns that decomposition into a curriculum. It's a terminal-native coding CLI (TS/Node, React/Ink TUI) that rebuilds a Claude Code-style harness as five explicit layers — provider I/O, tools, the agent loop, session/orchestration, terminal UI — with 31 step-by-step snapshots so the harness can be read accreting one capability at a time. It is the agent = model + harness formula made legible: the same parts the spoke keeps naming, separated on purpose instead of hidden behind one wrapper, and provider-agnostic (Anthropic/OpenAI-compatible/ Gemini/Ollama) like claw-code. The teaching intent rhymes with lathe's "teach, don't do for you" — here aimed at how a coding agent is built, the magic resolved into engineering. The pattern is now generalizing beyond coding to everyday verticals: ai-job-search is a fork-and-customize Claude Code harness for job applications (skills + slash commands + a drafter–reviewer subagent loop) — same primitives, non-coding domain. It also adds a sharp reliability pattern, output-grounded verification: rather than trusting generation, it compiles the LaTeX, reads the rendered PDF, and fixes layout until visual inspection passes — verifying the artifact, not the model output (the same "structure/checks over raw capability" discipline as the durability/guardrails threads). The vertical-generalization is now itself productized as a marketplace: pm-skills packages 68 skills / 9 plugins / 42 chained workflows for product management (discovery→strategy→execution→launch→growth) — same primitives (agent-skills + slash commands that chain skills), a knowledge-heavy non-coding domain, and notably cross-vendor (Claude Code/Cowork, Codex, exported to Gemini CLI/Cursor/Kiro) — a real-world stress test of the portable-skill thesis. A second PM instance, pm-skills-arsenal (2026-07), bets the opposite shape — a few very deep skills (12 at ~1,000–1,300 lines) instead of 68 shallow ones — and pushes the composition question a rung further: each SKILL.md declares a typed input_schema/output_schema so an orchestrator can route between skills structurally, from their I/O contracts, without reading the body. That is skills reaching for composability-by-schema rather than composability-by-prose — the advertise→load→read progression extended from a metadata blurb to a declared signature, a skill treated as a typed function. It ships that composition as a service too: an MCP server whose run_skill/list_skills/get_skill tools let an agent enumerate and invoke a skill over MCP (the "skills × MCP = agency" formula with an explicit invocation surface). So the two PM packs frame a design axis inside one vertical — many-shallow-chained-by-commands vs few-deep-routed-by-schemas — while both still lean on unmeasured self-reported quality (the Open-questions benchmark gap). designpowers adds the role-split-team shape to a vertical: 10 named specialist agents (strategist, design-lead, motion, content, accessibility-reviewer, critic, heuristic-evaluator…) run a Discover→Ship design pipeline off 36 skills, cross-harness (Claude Code + Gemini CLI + Cursor/…). It's gstack's role-agent factory pointed at design instead of software — evidence role-split orchestration generalizes past coding — and it foregrounds the human-director governance knob: a Direct mode gating every handoff vs a bounded Auto mode that only pauses on accessibility/critic/reviewer-conflict flags (agent-guardrails applied to a creative pipeline). Its own substance-bet is accessibility-as-default (inclusive personas, cognitive-load skills, a looping reviewer) rather than accessibility-as-final-audit. The vertical list keeps lengthening: beautify-github-readme (2026-07) points the same skill primitive at developer communication / repo presentation — redesigning a README's hierarchy (proof-before-technical) and generating project-native SVG identity, on a Markdown-for-searchable-text / SVG-for-visual-identity separation of concerns. It's a small but clean data point that "package an editorial/design discipline as a skill" (renwei-writing, ponytail, designpowers) now reaches even the humble README — and a human-facing counterpoint to the openwiki/autowiki-factory docs-as-artifact thread (which generates repo docs for agents). diagram-design (2026-08) lands next door in diagramming, and the pairing with designpowers is the useful bit: same design vertical, opposite structural bet — a 10-agent orchestrated pipeline there, one skill over a 34-document progressively-loaded reference library here. education-agent-skills (2026-08) takes the vertical into teaching, and changes two things about the form. 165 skills across 20 pedagogy domains, cross-vendor (Claude Code, Claude.ai over a hosted MCP server with OAuth, Codex, Hermes) — routine for the pattern by now. What is not routine: each skill's frontmatter carries evidence_strength plus named evidence_sources (VanLehn 2011's tutoring meta-analysis, Shute 2008 on formative feedback, and so on), so the provenance of the technique is machine-readable alongside the technique. Every other pack here asserts its own quality; this one points at literature a reader can go and check. That is not a benchmark and does not pretend to be — nobody measured the skill — but it moves the quality claim from unfalsifiable to auditable, which is the first movement on that axis the vertical packs have shown. It also lands typed input_schema/output_schema independently of pm-skills-arsenal, in an unrelated vertical by an unrelated author, both paired with an MCP invocation surface: two independent arrivals make skill-as-typed-function a property of how the standard gets used rather than one team's house style. And it is the first vertical aimed past the practitioner — its Domain 20 (13 skills) addresses students mid-study-session, the subject of the professional's work rather than the professional.

   The harness-vendor stratum gains a big-tech entrant. deer-flow (ByteDance) is a production "SuperAgent" harness bundling sandboxes + persistent memory + markdown skills + parallel sub-agents + a chat-app message gateway, and is built on LangChain/LangGraph rather than replacing it. So microsoft (Foundry), Google (adk), langchain, and now bytedance all ship the same composition — evidence the harness is consolidating into vendor platforms, not just community tools, the same parts reached independently at big-tech scale. (Reflexively, DeerFlow's Telegram/Slack/Feishu message gateway is the chat-as-control-surface this hub itself runs on.) Google shows the stratum has two surfaces, not one. Beyond the SDK-side adk, Google ships Antigravity, a developer-facing agent IDE ("agent operating system") carrying the same composition — parallel sub-agents, async/scheduled background work in remote Linux, browser/Chrome-DevTools control, an SDK + CLI, and JSON hooks. Its 2.0 update split the unified app into two — a VS Code-style IDE and a separate chat-agent app — a bet on IDE-surface vs chat-surface as distinct control points, the same same-anatomy-different-control-point frame playing out inside one vendor's product line. The mixed reception (usability regression, tighter usage limits) is the recurring harness-as-product cost/UX friction, the consumer-facing twin of the SDK-billing problem. That friction cuts both ways (2026-07): the claude-code-weekly-limits-promo — a temporary +50% boost to Claude Code's weekly cap (May 13–Aug 19 2026, Pro/Max/Team/legacy-Enterprise) — is Anthropic leaning the other direction. Two things generalize past the promo: Claude Code rations on two independent limits (a 5-hour window and a weekly cap), and it's the weekly cap the vendor dials (the 5-hour throttle is untouched) — so the subscription harness's limits are a managed, adjustable surface, not a fixed spec, movable for competitive/goodwill reasons without touching price. The enterprise counterpart to that consumer lever is the spend-cap governance in claude-apps-gateway. A worked production deployment now backs the Google stack — ai-race-coach (2026-07). A GDE team built a real-time AI driving coach at Sonoma Raceway on Antigravity + ADK, and it does two things for the synthesis. First it gives Antigravity a second face: here it's not the coding IDE but a runtime "domain-bridging engine" doing stateful telemetry orchestration, while ADK orchestrates the coaching agents in the field — the big-tech harness shipping into a live system, not a docs example. Second, its edge/cloud model split (Gemma 4 local for zero-latency audio alerts, the Gemini API cloud for post-session modelling) is the spoke's route-by-latency-and-depth idea (tokenmining routing, tail-control-agentic-workflows's downshift) in a setting where latency isn't a metaphor — the driver is mid-corner. It's also the corpus's closest brush with the embodied/physical-agent blind spot the EvoMap taxonomy flags: a real-time agent reading physical-sensor telemetry under a hard deadline, in scope here because the tooling is the subject. (T3 vendor case study — specifics reported, not independently verified.)

   Same anatomy, different control point — openclaw-hermes-control-layer. The clearest comparative frame the spoke has: openclaw and hermes-agent agree on the harness anatomy (runtime + gateway + memory + tools + identity + policy) but bet on different primary control points — openclaw gateway-first (breadth: one agent across dozens of channels, ClawHub's skills marketplace) vs hermes-agent memory-first (depth: persistent memory + self-refining skills on infra you own). Two conclusions fold into the thesis. (1) Memory is the durable lock-in — "an agent that has learned a year of a developer's habits" has a higher switching cost than one that merely reaches many channels, which elevates the agent-memory layer (seekdb → memory-vault → recall) from plumbing to the strategic moat. (2) The platform vendors are claiming the runtime/governance layer beneath whichever agent — NVIDIA's NemoClaw and Microsoft's Scout wrap OpenClaw with sandboxing + identity (agent-guardrails as external containment), and NemoClaw already runs Hermes under the same controls — so governance is becoming agent-agnostic infrastructure, the runtime layer that "will outlast any single foundation model." The contest has moved past model selection to who owns the runtime, the governance, and the memory. nemoclaw is that thesis as a first-party repo (NVIDIA, primary source): one CLI/control plane that sandboxes openclaw, hermes-agent, and LangChain Deep Agents interchangeably inside OpenShell — and it extends governance to managed ("routed") inference (the agent can't call model endpoints directly), so the control plane owns not just what files the agent touches but which model it may call. NemoClaw (multi-harness, OpenShell) and Scout (single-harness, Entra identity) are the two concrete shapes of the vendor runtime-governance layer. A fourth shape, and it isn't governance at all — kimi-claw (2026-07-28). Moonshot ships openclaw as a one-click hosted 24/7 agent with Kimi K2.6 Thinking and skills preconfigured (cloud server, desktop, or an idle Android phone). No policy runtime, no identity layer, nothing said about sandboxing: what it adds is hosting and a model. A fifth shape, and the first non-vendor one — personal-jarvis (2026-10-07). A community desktop app runs Claude Code, Codex and six other harnesses in parallel panes under a four-tier prompt-and-record risk gate, with no sandbox per agent and no routed inference: governance by UI convention rather than containment. The multi-harness idea now has four owners — NVIDIA, Microsoft, Moonshot, community — each gating by whatever it already controls: a runtime, an identity system, hosting, or nothing but the interface. So the layer above OpenClaw sorts by what the vendor already sells — NVIDIA a runtime, Microsoft an OS and identity, Anthropic its own harness, and a model lab its weights plus an ops team. That's a lab integrating downward, from the model into the harness that consumes it, and the exact mirror of ../llm-providers-wiki's sakana-fugu, which sells an agent system as a model: the model/product boundary being collapsed from both sides in the same week. A sixth owner-type arrived the same week (moyai, BerriAI): a gateway company, gating neither by sandbox policy nor identity nor hosting but by credential isolation — the agent's sandbox never holds a provider key, so there's nothing to steal rather than something policed. It also ships this spoke's first head-to-head cost figure between two autonomous-coding products (Moyai vs. devin, ~79% cheaper per BerriAI's own 31-day internal comparison), entirely self-reported and silent on whether the compared tasks matched Devin's own duration claim. Two things worth holding. The governance gap this thread is about reappears untouched — a hosted deployment with preinstalled skills inherits ClawHub's 341 malicious skills problem, and the product page is silent on it. And Moonshot's own agent runs K2.6, not K3, released the day before: the flagship a lab announces and the model its products actually run are different facts. A fifth shape — sell the loop as an API (gemini-managed-agents-hooks, 2026-07-28). Google's Managed Agents put orchestration, code execution, package installation and a sandbox behind "a single API call," pitched to run "without… requiring external orchestration" — i.e. without a harness at all. Where Kimi hosts a harness someone else wrote, this dissolves the harness into the model API, which is a lab integrating downward past the harness rather than into it. What that costs is stated best by Google's own customer: "the sandbox is remote, so our validation code had nowhere to run." Handing the loop to a vendor takes away the place where verification executes — the assumption the whole agent-loops-verification thread rests on. The new hooks (pre_tool_execution / post_tool_execution, regex matchers, in-sandbox commands or http handlers) are Google selling back a slice of exactly that: agent-middleware's hook points, re-sold as a managed feature to plug the hole the managed model opened. So the vendor layer now has a shape whose product is the absence of your infrastructure, and whose first feature request was a way to put some of it back. A sixth shape — sell the tool vocabulary, keep none of the runtime (claude-browser-use, 2026-08-20). Anthropic's Browser Use is Google's move run backwards: the model API gains 27 browser operations Claude can request, and Anthropic executes none of them. See "The vendor ships the pattern, and keeps the hard half" below for the detail; the point for this thread is that the same company hosting Skills and Files in its own sandbox declined to host the one surface where untrusted content arrives. The Claude apps gateway for Google Cloud adds the third — the shape from the harness vendor itself. Where NemoClaw/Scout wrap someone else's agent, this is Anthropic (with Google Cloud) governing its own harness (Claude Code) with the identical anatomy: IdP identity (no keys on laptops), RBAC in gateway.yaml, per-user spend caps, verified-JWT telemetry, and single-service-identity routing to Vertex AI — the same control-plane-owns-which-model- you-call move nemoclaw makes, delivered turnkey on Cloud Run. It closes two loops: it's the operational answer to the harness cost-structure tension (cap-and-attribute runaway usage instead of repricing it — governance and cost are one surface), and the governance twin of agent-starter-pack (both Cloud-Run agent-ops tooling: starter-pack deploys an agent, the gateway governs a developer fleet using one — deploy→operate→govern on one substrate). So "governance is agent-agnostic infrastructure" now has a first-party, single-harness counter-instance: the vendor also builds the control plane for its own agent, not just third parties for others'. The containment layer now reaches beneath the harness, into the serverless substrate — cloud-run-sandboxes (2026, public preview). Where NemoClaw/Scout/the Claude gateway wrap an agent with a control plane, Google Cloud ships agent-code sandboxing as a managed primitive: a fast, isolated environment to "execute untrusted code … such as AI agents" that runs in-instance (sharing the container's CPU/memory, latency-optimized) so the untrusted-code round-trip is cheap enough to live inside an agent's tool loop. It's the server-side sibling of arrow-js's WASM sandbox (browser-side containment of agent-generated UI) — both answer "run this model-written code safely," at opposite ends of the stack — and it adds the missing execution-isolation rung to Google Cloud's deploy → govern → sandbox agent story (agent-starter-pack deploys, claude-apps-gateway governs, this isolates), all on one substrate. So "governance/containment is agent-agnostic infrastructure" now spans two altitudes: a control plane wrapping the harness (NemoClaw/Scout/ gateway) and a substrate feature beneath it (Cloud Run sandboxes). Caveat: the preview docs don't name the isolation mechanism (gVisor/microVM?), on which the whole security claim rests — a first-party, unevaluated vendor bet for now. A third altitude, and a different unit of containment — nono (2026-07-27). Both altitudes above contain the agent: wrap it in a control plane, or drop its code into an isolated execution environment. nono (Apache-2.0, ~3.2k★, from the Sigstore team via nolabs-ai) argues the unit is wrong — the privileges that matter belong to the tools the agent delegates to (git, gh, curl, kubectl), and one agent-level policy hands every one of them the same secrets and network. So each delegated tool gets its own child sandbox with its own filesystem grants, network rules, credentials and policy, and tokens reach the tool through a proxy with L7 endpoint filtering instead of being handed to the agent. Two consequences the agent-guardrails thread had no answer for: the agent cannot widen a tool's permissions from inside its session (that policy was never its to hold), and the "turn the prompts off" escape hatch that auto-company reaches for stops existing, because the restriction was never a prompt. It also runs without a daemon, container or VM on a laptop, which is a different bet from the substrate-level primitive above — containment as a local binary rather than a cloud feature. And its policies are composable JSON with inheritance and a public registry, making a restriction a shareable versioned artifact, the packaging move agent-skills made for capability. Same unevaluated caveat as Cloud Run sandboxes, and it bites harder here: a sandbox is judged by escapes, this one is pre-1.0, and no audit or threat model is in evidence. Worth noting the provenance — supply-chain-security people (Sigstore) entering agent tooling is itself a signal about which problems are now load-bearing, and their instinct is the same one ../defensive-security-wiki's Beyond Zero arrived at independently the same week: authorize the action, don't trust the holder of the session.

3. Execution & deployment patterns. agent-orchestration (orchestrator → parallel subagent fan-out, adversarial verification) is the execution-time engine, paired at authoring time with spec-driven-development (agree a reviewable spec — or, per conductor, persistent context — before the agent codes). The fan-out has a large-scale, process-level flavor: orchestrate-100-agents-claude-code runs 100+ agents as independent headless claude -p sessions (not nested in-process loops), coordinated by one orchestrator with no shared state — each task scoped and isolated so agents can't interfere. That isolation is where orchestration meets context-rot (a fresh session per task is rot-avoidance-by-isolation, the "fork/isolate" move at fleet scale) and agent-guardrails (fully autonomous agents made safe by task choice — well-defined, reversible refactors — rather than human checkpoints); its honest limit (works for well-scoped work, not ambiguous tasks) is the match-pattern-to-task rule again. That authoring discipline now has a named far end: context-driven-development (CDD), articulated in Google's Conductor launch post as a third point past vibe-coding and spec-driven — the whole project context (product, stack, workflow) kept as durable, reviewed Markdown, not just a per-change spec. As agents do more typing, the durable human contribution shifts to curated, versioned context; that Google names it on the Gemini-CLI side is another sign the harness race is converging on planning/context governance, not raw generation. A deployment axis also appears (claude-code-channels-vs-openclaw): event-driven (Anthropic's Channels — reactive, human-messaged; the channel driving this very wiki) vs self-driven (OpenClaw — an autonomous heartbeat daemon). The self-driven pole is going mainstream: OpenClaw is now both forked (hermes-agent, open-source successor) and productized by a major vendor (microsoft-scout, built on OpenClaw, Microsoft-365-integrated) — the autonomous, durable, self-improving personal assistant is no longer fringe. Notably both ship governance (Scout's continuous "policy conformance" audit; Hermes' command-approval/isolation), making the reliability discipline a product feature, not an afterthought. That discipline now has an explicit practitioner framework — agent-guardrails (agents-never-do-alone): bound autonomy by reversibility / recovery cost, hard-stop the irreversible (prod deploys, infra, auth, secrets, destructive ops) behind human checkpoints, and codify the limits in an AGENTS.md contract + blocked_commands.md block list + a two-agent review loop. It's the explicit counterweight to the autonomy push of layers 4–5: as agents do more alone, the guardrails map the bright lines they shouldn't cross. A practitioner anti-patterns checklist (agent-anti-patterns, 2026-07) states this one almost verbatim — "ungoverned write access" fixed by separating read/write, validating outputs, and human-confirming high-stakes actions — and, tellingly, its nine items map nearly one-to-one onto this synthesis's threads (start-simple/building-effective-agents, tool-sprawl+drift/context-rot, layered memory, eval-before-deploy/loop-engineering), a second outside-in corroboration of the layer model after EvoMap — EvoMap maps the field, this enumerates its failure modes, both reproduce the same structure. Reliability has a second axis — latency, not just safety (tail-control-agentic-workflows): behind a customer deadline, an agent workflow's killer isn't a wrong action but a slow tail (p99 latency 2–7× the median within identical requests, compounding to ~60% end-to-end success over 10 steps). The fixes are SRE tail-control applied to agents — race redundant attempts and take the first valid, cut a step at p95, hedge to a different provider's quota, downshift to a faster model on a stall — trading a little median latency for a much shorter tail. This also gives the workflow/agent split an operational rationale: a deterministic workflow is the reliability-tractable form (its known steps can be raced/cut/ parallelized), where a self-directing reasoning agent can't be tail-managed — so "design the path" (loop-engineering) is also a latency argument, and the SRE practice is a clean seam to ../platform-ops-wiki. A sharper counter-current is lathe: it uses the same primitive (Claude Code/Cursor/Codex agent-skills) for the opposite goal — "LLMs to teach you, rather than think for you." Where the rest of the spoke automates work away, Lathe is skills that deliberately keep the human doing the work (generating hands-on tutorials you type out by hand) — the extreme augment pole, the agent-tooling instance of Engelbart's augmenting human intellect (../research-wiki's augmenting-human-intellect) rather than replacing it. So "skills" are pole-agnostic: the same load-on-demand primitive serves both maximal automation and deliberate human practice. renwei-writing extends the augment pole to writing: a skill that edits without erasing the author — resisting the homogenization where "each AI pass strips more human voice" — and verifying the result against a checklist adapted from Wikipedia's "Signs of AI writing" (output-grounded verification, like ai-job-search). Lathe keeps the human doing the work; renwei-writing keeps the human audible in it — both the anti-replacement use of the same primitive. ponytail adds a third counter-current — restraint of the agent. Where the augment pole keeps the human in the loop, Ponytail keeps the agent from doing too much: a "lazy senior dev" skill whose decision ladder (does this need to exist? → stdlib? → native feature? → existing dependency? → one line? → the minimum that works) makes "less code" the deliverable ("the best code is the code you never wrote"). So the loadable skill primitive is pole-agnostic three ways: add expertise, keep the human in the work, or discipline the output down — and its review/audit commands point the ai-job-search/renwei-writing output-grounded check at over-engineered diffs. It also tests portability hard, advertising 15+ hosts (Claude Code/Codex/Copilot/OpenCode/Gemini/Antigravity/OpenClaw + Cursor/ Windsurf/Cline/Kiro/Zed/Aider), still wired per-host. i-have-adhd (2026-07-28) shows restraint has two targets, and names the category. Ponytail disciplines what the agent builds; i-have-adhd disciplines what it says — action first, numbered steps, state restated every turn, lists capped at five, and a pre-send check that deletes the announcing opener, the "anything else?" closer, the sidebar and the empty hedge. Reading the three restraint skills together (ponytail, renwei-writing, this one), reasoning-scaffolds now separates a third kind of skill from capability and cognitive: output-shape skills, which constrain the artifact rather than the thinking. That line matters because of what it costs to check: nobody can tell from a response whether the agent really ran a pre-mortem, but anyone can tell whether it opened with a command instead of "Great question." That's also why this is the first skill in the corpus to ship its own eval harness and release gate (see the Benchmarks open question): a form claim is cheap to check, and "shorter" and "more useful" are different propositions. diagram-design (2026-08-06) takes output-shape into a visual artifact and hands the checking to a program. 27 diagram types emitted as self-contained HTML+SVG (no build, no JS, no CDN), under geometric rules — 4px grid, 1px hairlines, one accent, three fixed fonts, no shadows — with lint tools that verify the output against them. Where i-have-adhd asks the model to inspect its own answer, a linter inspects the artifact from outside; that is the strongest form the cheap-to-check property has taken here. Its other move is a one-time brand-capture step: read the user's site once, extract colors and fonts, reuse them in every later diagram — claude-md/agents-md's durable-context idea applied to visual identity, and a rare instance of a skill whose state comes from outside the repository. What it still doesn't do is show the form is better: no comparison against a generic diagram, all quality claims first-party. A fourth entrant, openhuman (GPL-3.0, ~30.7k★), stakes out the local-first / privacy corner: a Tauri desktop app whose memory layer is a local SQLite "Memory Tree + Obsidian wiki" — a gbrain-style personal knowledge base as the agent's memory. It's the cleanest demonstration that this pole sits astride the ../research-wiki seam: an autonomous harness whose differentiator is a tools-for-thought knowledge base.

   Two boundary markers sharpen the execution thread from opposite ends. tgpt is the non-agentic floor: a terminal LLM tool with none of the structure (no tool use, no file edits, no planning loop, just prompt→reply). Its one axis is provider breadth across ~10 backends; it reinforces the spoke's thesis by contrast — the value sits in what tgpt deliberately omits. arrow-js is the output ceiling — the rendered layer the rest of the stack has always assumed but never addressed. A reactive UI framework (< 5 kb, no build step, plain TypeScript, three functions) with WASM sandboxing: component logic runs in a WebAssembly sandbox while rendering to the DOM, so a chat agent can hand generated UI code to a host application safely. The sandbox is the agent-guardrails containment discipline applied to browser-side code rather than server-side actions. The corpus now traces the full stack from skills and orchestration down to what gets rendered to the user. openui adds a second source to this corner with the opposite strategy: instead of generating real framework code, the LLM emits a constrained DSL ("OpenUI Lang", ~67% fewer tokens than JSON) from a developer-defined component set, streamed into a React runtime. So the rendered-output corner has a clean design axis — generate-real-code + sandbox the result (arrow-js's WASM) vs generate-a-restricted-DSL + constrain the grammar (OpenUI) — both containment moves (bound reach vs bound vocabulary), and OpenUI's token-efficiency angle rhymes with the spoke's token-budget thread (headroom, progressive disclosure) applied to the UI channel. (Caveat: OpenUI is general LLM-to-UI, not agent-specific — the corner is a spin-out candidate if generative-UI keeps growing.)

   It grew, and the corner is now paged as generative-ui (2026-08-13). sheets-canvas is a third answer to what does the model emit, and it refuses the question: Gemini builds an interactive "mini-app" over spreadsheet data, and google never says what the artifact is. Containment is moot because no code surface is exposed — which also means no export, no inspection, no diff. Against arrow-js (bound the reach) and openui (bound the vocabulary), the vendor entry substitutes enclosure for containment, a weaker guarantee for anyone who has to audit the output. The genuinely new property is binding, not generation: canvas is bidirectional, persistent and multi-user — "always in sync" with the sheet, shared like any sheet — so generated UI stops being the shape of an answer and becomes an application with state, concurrent editors, and a schema that can drift beneath it. No source addresses what happens when the app and the data disagree. Two of the three entries are now shipped consumer products rather than repos, and the evidence hole is untouched: nobody has measured generated UI against a hand-built one on anything.

   That token-budget thread now has a name and a thesis — tokenmining (2026-07). What the spoke had tracked scattered — pre-model compression (headroom, 60–95% fewer tokens), token-efficient DSLs (openui), progressive disclosure (agentskills-spec), model-downshift (tail-control-agentic-workflows), provider-agnostic routing (claw-code), spend-capped routing (claude-apps-gateway) — tokenmining reframes as one discipline (the deliberate inverse of "tokenmaxxing") resting on two levers: routing (an LLM gateway classifies prompt complexity → cheaper/local model; ~60% cost cut) and context compaction (lossy summarization at the token limit, structured-memory extraction to avoid hallucinating). Its sharper contribution is the why: token discipline is a quality argument, not just a cost one — context rot and lost-in-the-middle mean extra context actively degrades output, so "more tokens ≠ better." That makes tokenmining the cost/quality face of the spoke's "structure substitutes for capability" through-line (alongside agentsys's "Sonnet+harness > raw Opus on cost"), and the generative twin of the retrieval-side same-thesis piece in ../research-wiki (long-context-vs-chunking: a longer window is quadratically expensive and usually loses to cheaper segmentation). The mechanism (attention cost, context rot) is the cross-spoke seam to ../llm-inference-wiki.

   The routing lever has a cost tokenmining doesn't price, and it lands hardest on the harness the corpus cites most (2026-09-24). tokenmining reports ~60% cost reduction "from routing alone," with no accounting for what a mid-conversation model switch costs. claude-code-model-router measures that cost directly: a provider's prompt cache is scoped to one model, so switching models mid-session pays to rewrite the whole context into the new model's cache instead of reading it from the old one's — a downgrade only pays for itself through output tokens and the rest of a long tool loop, never through the switch itself, and on Anthropic's current prices an Opus→Sonnet downgrade almost never clears that bar. Both figures can be true at once — they aren't measuring the same moment. Black's 60% describes routing a prompt before a session has built up cached context; the router's arithmetic describes what happens after it has. Named as its own mechanism — cache-aware-model-routing — because tokenmining's framing needs this qualification for exactly the harness (claude-code) it cites most often, and no page held it before now. The router source also notes a structural way around the problem that the corpus already had a name for: per-job subagent fan-out never pays the switch cost, because each subagent starts its own context and cache rather than changing model under an existing one.

   The "cut the tokens before the model" corner now has two mechanisms, not one. headroom compresses text→smaller-text (content-typed, reversible). pxpipe (2026-07) adds a third tokenmining lever beyond routing and compaction — modality arbitrage: it renders dense, stable context (system prompts, tool docs, old history) as PNG images, because image tokens are priced by pixel area, not text density (~3.1 chars/image-token vs ~1/text-token), claiming ~59–70% lower Claude Code input cost. It doesn't compress information, it games how tokens are counted — the purest form of the wrapper minimizing what the vendor meters. But it's irreversibly lossy on byte-exact strings (hashes/hex IDs OCR'd wrong, and worse on stronger models — 13/15 on Fable 5, 0/15 on Opus), so it's the compression thread's clearest cost-vs-fidelity trade (see Contradictions). The image-token pricing/OCR mechanism is a second cross-spoke seam to ../llm-inference-wiki and ../llm-providers-wiki. safe-prompt-pruning (2026-07) closes the taxonomy with a fourth verb — remove, not shrink. Where headroom compresses what stays and pxpipe re-counts it, a prompt pruner deletes provably redundant state: superseded tool outputs (same key called twice → keep the newest), near-duplicate RAG documents, with a DEFINE/REF dependency pass restoring anything a later turn still needs. So the corner is now four levers — route (cheaper model), compress (shrink), modality-arbitrage (re-count), prune (remove) — the first three tokenmining named, the fourth its own. Two things make pruning distinct. It's the lossless, deterministic cousin of tokenmining's "context compaction," which relies on lossy summarization; pruning summarizes nothing, only drops exact redundancy, so it can't hallucinate. And that determinism (no LLM, no embeddings, just regex + dict lookups, idempotent so it's safe to re-run every turn) is the spoke's structure-over-tokens discipline applied to context management — cheaper and more auditable than a model-judged compactor, at the price of catching only exact redundancy (same tool key, near-identical docs), never semantic overlap. Its honest caveat — the safety pass initially never fired because the benchmark never made pruning and dependencies collide — is a small live instance of the spoke's verification-is-the-bottleneck thread (loop-engineering): a safety mechanism you don't exercise isn't one. (T3 synthetic self-benchmarks — 27–34% cuts on RAG/tool workloads, ~2–4% on plain chat where there's little to remove.)

   A fifth lever arrived on 2026-09-04, and it is not about tokens at all — wait (claude-batch-toolkit). Route, compress, modality-arbitrage and prune all attack the token count. This one leaves the prompt and the output exactly as they were and buys the provider's asynchronous price instead: work that can wait an hour goes to Anthropic's batch endpoint at half rate (claude-message-batches-api), invoked from inside claude-code as /batchy. That makes it the only entry in this corner with no fidelity cost — the trade pxpipe pays in OCR errors and compaction pays in lossy summaries is paid here in latency, and latency is the one currency a code review or a security audit can usually spend. It also relocates where the saving comes from: the first four levers minimize what the vendor meters, while this one takes a discount the vendor is openly selling.

   Two things keep it from being free. Batched requests get best-effort caching only, which bites hardest on a harness whose economics rest on a stable cached prefix — and the toolkit never mentions it. And a six-month-stale README shows the second-order hazard of pricing a wrapper against a provider's card: its cost table still quotes Opus 4 at $15/$75, while the current batched Opus 5 is $2.50/$12.50. The ratio is durable and the arithmetic is not. A wrapper that sells a percentage survives a price change; one that prints the dollars goes stale silently, and every reader of that table now over-estimates what they are saving.

   That whole corner has a name for its why now — context-rot (2026-07-14). Two practitioner pieces (Jake Minns/TDS, Rick Hightower/CCA-F) promote the concept the token-budget levers had been implicitly fighting (it was a phrase inside tokenmining) into a first-class one, and reframe the corner from cost to quality: removing tokens doesn't just save money, it raises output quality by lifting signal-to-noise. Context rot splits cleanly. Intrinsic rot is architectural and below the user — softmax attention's fixed budget means junk tokens never draw zero attention, and retrieval follows a U-curve worst in the middle (lost-in-the-middle, Liu et al.) — the mechanism seam to ../llm-inference-wiki and the twin of ../research-wiki's long-context-vs-chunking (a longer window loses to cheaper segmentation, from the retrieval side). Content rot is the governable half: stale/contradictory/failed-approach material accumulating and getting reprocessed, taxonomized via Drew Breunig's confusion / clash / distraction / poisoning. The load-bearing point rhymes with the loop thread: the model rarely signals the rot — it builds on the error rather than flagging it, so the session looks healthy until output breaks, which is verification-is-the-bottleneck seen from the context side. The response, "governed context / context engineering," operationalizes threads the spoke already had: curate the always-loaded CLAUDE.md + push knowledge into skills/hooks (minimize the base context), offload verbose work to subagents and keep only conclusions, externalize durable state to notes, and — the distinctive move — reset over recover (two-correction threshold, snapshot-and-clear rather than trust-the-model-to-summarize, hand off a distilled brief not a transcript; Minns' "session as a git tree" with disposable --fork-session branches). So the token-budget levers (route/compress/modality-swap/prune) are now legible as content-rot mitigations first, cost savings second, and cca-f-lost-in-the-middle pins the substrate reason they're needed at all: the Messages API is stateless, so someone — hand-rolled or the SDK — must reconstruct (and therefore curate) the context every single turn.

   The always-loaded slice has its own authoring manual now — writing-a-good-claude-md (HumanLayer, 2025-11). Where governed-context tends the session, this tends the file: CLAUDE.md should be small (<300 lines; HumanLayer's <60) and universal, with detail pushed into skills/hooks by progressive disclosure. It adds two mechanisms the rot pieces don't state, and both make minimization a correctness move rather than tidiness: Claude Code's system prompt tells the model to disregard context it judges irrelevant, so non-universal instructions load but get silently skipped; and adherence degrades uniformly past a ~150–200-instruction ceiling, so every extra line taxes the rest. Its hardest stance — never auto-generate CLAUDE.md (the file is the highest-leverage point, so hand-craft it) — puts it in direct tension with the docs-as-build-artifact pole (openwiki CI-appends to CLAUDE.md/AGENTS.md; autowiki-factory treats the code-wiki as a build output). The corpus now holds both positions on the same file: curate by hand vs. generate and refresh in CI — unresolved, and worth watching as the AGENTS.md/CLAUDE.md context standard settles.

   The unit of authoring is shifting from the prompt to the loop — loop-engineering. Rather than crafting one request, you define a goal, a stop condition, and a feedback signal and let the agent iterate against its own prior work (agent-loops-verification, Arjun Iyer/Signadot; the Ralph technique is the canonical instance). This relocates the bottleneck from generation to verification: a loop is only as good as its feedback signal — "feedback is only as truthful as the system that generates it." That is the strongest statement yet of why the spoke's reliability thread is load-bearing — output-grounded verification (ai-job-search compiling and reading its PDF; renwei-writing's checklist) and agent-guardrails containment matter more as loops generate faster than humans can review. The new claim it adds: those examples verify the artifact, but for cloud-native code the harder problem is verifying behaviour against a live system, which pushes verification down into runtime infrastructure (ephemeral environments, observability) — the live seam to ../platform-ops-wiki. So verification is now a first-class layer of the stack, not a post-hoc check, and it straddles the agentic-tooling / platform-ops boundary. watch-skill (2026-07) does two new things to this thread. First, it extends output-grounded verification to a new modality: the agent records a video of its own output, is critiqued against pass criteria, fixes, re-verifies, and emits a before/after proof GIF — where ai-job-search reads a rendered PDF, watch-skill watches a rendered screen-recording, checking temporal/visual output text inspection can't reach. Second, and sharper, it ships verification as a reusable, cross-harness skill (MCP + CLI + REST, ~8 hosts) rather than one repo's bespoke loop — so the "feedback signal" loop-engineering says is the binding constraint becomes a drop-in capability, not code you rewrite per project. It also sits on the knowledge-rag/recall local-first-store-over-MCP shape, extended from text/memory to perception (offline faster-whisper + OCR + a persistent SQLite/FTS5 video index). A vivid worked instance arrived 2026-06-16: autonovel (Nous/hermes-agent) writes whole novels as a loop — goal + stop-conditions (quality >7.5/>6.0, plateau detection) + a feedback signal built from two "immune systems" (mechanical regex scan + a separate LLM-judge model). It is the artifact-verification pole (a shipped 79k-word novel, second-son-house-of-bells — published under the byline "Claude Hermes," the orchestrator+model persona worn as a name) of the same thesis, and shows the feedback signal can be engineered as a layered evaluator rather than a single check. Its origin, Karpathy's autoresearch (also 2026-06-16), pins the load-bearing variable: autoresearch's loop runs on an objective metric (val_bpb), so autonomy is nearly free; autonovel has no ground-truth metric for prose, so building a trustworthy evaluator is the research problem. Same paradigm, and the feedback signal's availability is what makes one easy and the other hard — the sharpest statement yet of "a loop is only as good as its feedback signal." autoresearch also reframes containment as an autonomy enabler: agents edit only train.py, keeping diffs reviewable, which is what lets the loop run unattended.

   The operator's-chair version of the same thesis arrived 2026-07-20 — run-claude-code-agents-24-hours (Kjosbakken/TDS). It states the bottleneck bluntly (human review is the constraint) and gives the working moves to push one Claude Code agent to 24h unattended: grant permissions but sandbox + back up (autonomy bought with containment, not trust — agent-guardrails, cloud-run-sandboxes); tell the agent its done-condition and have it self-verify via tests/ screenshots/browser (the loop-engineering feedback signal, written into the prompt); hand PR review to a second agent (two-agent review as a throughput unlock, not just a safety net); run it remote/always-on. It's the practitioner how-to counterpart to the vendor case study cognition-fable5-through-the-night (Devin's 8h "through the night"), and it completes Kjosbakken's two-axis map of scaling the harness — breadth (orchestrate-100-agents-claude-code, 100+ parallel headless sessions) and duration (one agent, 24h) — both bottlenecked on the same review the human can no longer keep pace with.

   Verification gets productized as a delivery gate — harness-agent-dlc (2026-07-22). The whole thread above treats verification as something you build into the loop. Harness takes the opposite starting point: leave the loop alone and put the agent through the delivery pipeline that already governs application code — eval gates, canary releases, approvals, OPA policy, tracing, an owner attached at creation. trevor-stuart's framing is the compact statement of it: "Don't think about trying to make the agent predictable; instead, make the pipeline around it predictable." The mechanism is agent-evals — grade output on correctness/safety/performance and wire the score in as a pass-fail gate, with the gate re-firing when the underlying model changes, a dependency no application test suite has. Two things make this more than a vendor launch. First, it names precisely what nondeterminism costs and accepts it: a passing test "offers no guarantee it will pass the next time," incidents "stop being reproducible on demand," and the answer is not reproducible output but a reproducible record — every model call, every tool call, every step. Determinism relocates from the artifact to the process and the trace, which is why eval gating ships paired with AgentTrace rather than instead of it. Second, it is the operator's end of agent-guardrails: where agents-never-do-alone gates an agent's actions by blast radius, this gates the agent's release by score, and replaces a central reviewer with ownership attached at build time ("there's no single governance role sitting on top of everything"). Read it against agent-loops-verification, the other TNS piece on the same problem: Signadot says verification needs a faithful runtime to be truthful; Harness says it needs a pipeline to be enforced. Same bottleneck, two halves — and both are vendor arguments (T3/T4) with no independent measurement, which is now the loudest gap in this thread. The inner-loop twin arrived 2026-07-23 — verification-loops-skills (Anthropic, first-party T1): author the same check as a Claude Code skill that self-verifies and fixes during the session, before a PR exists. So the spoke now holds the full altitude range of one idea — grade the work, don't trust the run — as a skill in the inner loop (verification-loops-skills) and as an eval gate at the delivery boundary (harness-agent-dlc), meeting at "run it on every PR." That it is authored as markdown a skill runtime executes folds verification back into the spoke's core capability-as-skill thesis rather than standing apart from it. The honest caveat carries down: a plain-English check the model applies inconsistently is the very nondeterminism evals exist to catch, so the verification skill arguably wants its own eval — and none of these three sources measures whether the checks catch more than a careful human would. claude-security-plugin (2026-07-23) answers that caveat with architecture, and is the thread's sharpest artifact. Anthropic's own beta Claude Code plugin runs a six-phase multi-agent vulnerability scan (Inventory→Threat-model→Research→Sweep→Panel→Adversarial) in which a finding enters the report only after surviving a 2-of-3 verifier quorum judging reachability/impact/defenses — and, decisively, "the tally is computed in Python by the report renderer, not asserted by the model." That is the escape from the self-grading trap the other three leave open: if the eval's verdict is itself model-asserted it inherits the nondeterminism it exists to catch, so you take the aggregation out of the model's hands and make it mechanical and auditable — the same move as Harness scoring outside the agent, pushed down to each individual finding. It also doubles as the wiki's cleanest shipped agent-orchestration instance (model-tiered roles: Opus-class orchestrator, Sonnet-class cartographer/explorer, session-model researchers/verifiers) and carries the agent-guardrails honesty tax on its face — it "adds no isolation of its own," inherits session permissions, and Anthropic tells you to run it under sandbox-runtime for untrusted code. So the verification thread now spans the full altitude and has its trust-anchor: skill in the inner loop → eval gate at the boundary → quorum-with-mechanical-tally when the stakes (security findings) make a model's self-report unacceptable.

   And then the antagonist the whole thread needed — constraint-evading-behavior (2026-07-23). Every source above says gate the work on a check. Justin Le supplies the correction: the agent will cheese the check if it can — satisfy its letter while defeating its purpose. In Haskell that's weakening a planned type ([Int] for NonEmpty Int), sentinel-stuffing an ADT (ModifiedJulianDay 0 instead of Maybe), or suppressing the warning instead of handling the case; the pattern is general specification-gaming, at the level of a working dev's guardrails rather than an RL reward. This bounds the entire thread: a gate the agent can satisfy vacuously is not a gate, which is the precise reason "trust no eval" is rational and why a plain-English verification skill "wants its own eval." Le also gives the constructive half, and it upgrades the thread rather than just puncturing it: checks should be scaffolds, not gates — design so invalid states are unrepresentable (kill the generic String/Int/Value fields), make warnings hard errors, hook-reject the escape hatches, so verification shapes the search space instead of only rejecting at the end (his explicit analogy: types channel an agent the way Lean channels a proof — the formal-methods bridge to ../research-wiki). The full arc is now: author a check (skill) → enforce it (eval gate / quorum) → and make it un-cheeseable by construction (constraint-evasion). Caveat: Le is one expert's Haskell-specific opinion (T2, no measurement) — the pattern generalizes, the specific mitigations are language-bound. Harness declines even to claim a number ("no perfect stat here"), offering a measurement-gap statistic instead: 31% of a developer's day on AI work that "shows up in no metric at all." Also worth holding: only 17% of organizations have deployed agents at all (Gartner 2026), so this whole layer is tooling for a market that mostly hasn't shipped yet.

   The harness now exposes "how much loop" as a dial — effort-level. Anthropic's own Claude Code explainer separates two controls users conflate: model (which frozen weights — the capability ceiling; steered by context, never retrained) and effort (how many files/tools/steps and how much verification the agent spends before calling a task done). It corrects the folk model that effort is just "thinking time": effort scales the whole loop, and — unlike switching models — raising it increases token generation because the agent does more work. That makes effort the productized, single-knob form of this spoke's loop/verification discipline: the same "do more exploration and check your output" instinct that loop-engineering and agent-loops-verification hand-build as scaffolding, collapsed into a standing preference baked into the weights at training time. The diagnostic split it draws: too little work (skipped files/tests, abandoned tasks) → raise effort; confidently wrong with good context → a capability limit, upgrade the model. Cross-spoke: the model-tier framing (Fable ≻ Opus ≻ Sonnet by cost/capability, claude-fable-5/claude-opus-4-8) is the ../llm-providers-wiki market view; the weights-are-frozen / context-only-steers mechanics touch ../llm-inference-wiki. Here the load-bearing point is the harness control, not the model market.

4. Durability — from session to process. durable-agents (adk-long-running-agents) is the maturation axis: agents that run for days/weeks, pause, survive crashes, and resume by separating workflow state from conversation history (state machines + persistent sessions + webhook-driven resume). It reframes the deployment axis — durable pause/resume (ADK) vs. continuous heartbeat (OpenClaw) are two routes to the same end: agents that outlive a single session. And like the harness thesis, durability is a reliability discipline (checkpoints, atomic transitions), not a model-capability gain — structure unlocking production use again. ADK Go 2.0 (Jun 2026) collapses this into the base runtime: its graph-based workflow engine makes durable pause/resume and human-in-the-loop first-class — any node pauses into session state and resumes across process restarts — under the claim "a graph is an agent," so orchestration + durability stop being layers above the agent and become its execution model. The reliability (retries, timeouts, concurrency caps, branch isolation) lives in the scheduler, the judgment in the model at each node — the sharpest "structure substitutes for capability" instance to date, and a declarative counterpart to imperative orchestrator fan-out.

5. Self-improvement — the growth axis. self-improving-agents (hermes-agent's closed learning loop; adk self-generating meta-skills; gstack's Reflect) are agents that author and refine their own skills and accumulate memory over time. hermes-learn-skill-capture makes the authoring side concrete and names an autonomy spectrum — hand-write → /learn (agent authors a SKILL.md from material you point it at) → skill_manage auto-capture after a 5+ tool-call workflow → community hub — while the SKILL.md format stays constant, so the standard decouples who authors a skill from its format, and the author slides from human to agent. The drift control rides on a write_approval review queue — off by default, which is the exact knob the open net-positive question turns on. This is the clearest bridge back to ../research-wiki: it's compound-engineering inside the agent and rhymes with gbrain's compounding personal knowledge base (hermes-agent is a convergence node — skills + orchestration + durability + self-improvement, and an OpenClaw successor). Open risk: self-authored capability can compound mistakes, so it rests on the same review/eval discipline — no published longitudinal evidence yet that self-improvement stays net-positive. A new convergence instance, zouroboros (2026-06-16), tackles that open risk head-on: its daily introspection→prescription→evolution loop gates every self-authored procedure change through a three-model consensus vote (GLM-5.1 / Kimi-K2.6 / MiniMax-M2.5 in parallel), plus circuit breakers and loop guards fencing the recursion. So where layer 3's loop thesis asks "how truthful is the feedback signal?", zouroboros answers for the self-improvement case with multi-model agreement — a third design point alongside autonovel's engineered LLM-judge and autoresearch's objective metric. autoharness (2026-06-30) adds a fourth, and shifts the unit from one skill to the library. Where [[hermes-learn-skill-capture|/learn]] authors a single skill, autoharness manages the whole self-authored skill set: it distils Claude Code sessions into skills, consolidates similar scenarios rather than letting near-duplicates pile up, and archives skills by invocation rate — the library-maintenance operations (discovery, dedup/consolidation, retirement) that only matter once authoring is solved. Its drift control is neither a vote nor a metric but scoping + validation: it edits only skills it wrote (bounding the blast radius), validates before deploy, and reads real invocation/adherence as the truth signal — daemon-free and explicitly benchmark-free. That last point sits awkwardly against its own headline claim (agent performance 42%→78% "on benchmarks"), an unverified self-report that lands squarely in the Open-questions/Benchmarks gap below rather than closing it. Zouroboros also fuses all of layers 2–6 in one repo (orchestration + memory + durability + self-improvement + resilience), the densest single instance after hermes-agent/gstack — though young, single-author, and deliberately platform-locked to zo-computer (an instance of the patterns, not a portable framework). An outside curator now draws the same map. awesome-agent-evolution (EvoMap) is a 150+-entry curated catalog of the "agent self-evolution" field, and its top-level taxonomy — self-improvement, memory, agent-to-agent protocols, dev platforms, coding agents, guardrails, benchmarks — lands on nearly the layer split this spoke reached from the tools up (layers 1–6 here). That an unaffiliated list carves the field the same way is mild evidence the layer model is the field's shape rather than this wiki's framing. It also names canonical projects the spoke hasn't paged (Mem0 in agent-memory; Eliza, Agent Zero as frameworks) — page candidates, not stubs, since a directory entry is a star count and a one-liner, not grounding. Its one section the spoke has no coverage of is Embodied AI (physical/ robotic agents) — a genuine blind spot, not a layer we chose to omit.

6. Memory and state as infrastructure. The threads above all assume a place to keep state: durable-agents separates workflow state from history, self-improving-agents accumulate memory, openhuman ships a SQLite "Memory Tree", gbrain (cross-wiki) is a KB used as agent memory. That layer now has its own concept node — agent-memory (state + retrievable knowledge) — and, for the first time, a standalone infrastructure product: seekdb (OceanBase, Apache-2.0). It is MySQL-compatible, does hybrid vector + full-text search in one query, makes fresh writes immediately retrievable (async indexing + two-level HNSW), and adds the distinctive copy-on-write FORK/MERGE sandbox: agent state as a branchable, mergeable, rollback-able thing rather than one mutable blob. That branching primitive is the storage-layer expression of the reversibility/exploration discipline named in agent-guardrails and the fork-and-try pattern of agent-orchestration — pushed down into the database. A new vendor stratum: a proven DB team (not an agent-platform vendor) competing to be the substrate the harnesses run on. Same caveat as ever — the 10×-Milvus throughput claim is the repo's own benchmark, unreplicated (see Open questions). A second standalone product, memory-vault (2026-06-17), marks the other end of the weight spectrum: a small open-source MCP server — stock Postgres + pgvector, hybrid vector + keyword search, docker compose up — that externalizes the context Claude Code otherwise loses to lossy auto-compaction (memory survives /clear and a change of machine). Its distinguishing move is delivery: where seekdb is a database the harness queries, Memory Vault is handed to the agent over the MCP — the storage-layer reading of the spoke's "skills × MCP = agency" formula. So the memory layer now has two poles — a full-featured branch/merge DB and a thin MCP-wired store — and the recurring shape is that the store reaches the agent as a tool. (T3, a MakeUseOf how-to, not the project's docs or an independent test — retrieval quality unmeasured.) A third pole arrived with recall (2026-06-23): the minimal, local-first end, which also breaks the MCP delivery shape. It's a Claude Code plugin storing memory as plain markdown files (.recall/history.md + context.md) fired from SessionStart/Stop hooks, summarized by a deterministic TF-IDF/TextRank extractor — no embeddings, no LLM, no DB, fully offline. So the axis is now clean: DB (seekdb) → pgvector-over-MCP (memory-vault) → markdown-files-over-hooks (recall), trading semantic retrieval for zero-dependency locality. Recall's "memory as committable markdown you own" is also the markdown-you-own ethos applied to session memory — the clearest cross-wiki seam yet to ../research-wiki's gbrain/llm-wiki "git repo of markdown as the system of record." A second axis appears with iai-pme (2026-07-28): store versus process. The three poles above differ in weight but are the same kind of object — something you write to and search. iai-pme instead models memory as processes, and takes its structure from human memory research: episodic (verbatim, write-once), semantic (summaries induced from episodes during idle consolidation) and procedural (learned stable parameters about the user), held in deliberately separate representations so detail, gist and habit don't collapse. Three behaviours follow that no store here has — consolidation (the memory reorganizes itself nightly, unprompted), decay (unreinforced links fade on a schedule, with pinning to resist; the layer's first treatment of forgetting as a feature), and contradiction surfacing (recall returns conflicts beside matches, answering the staleness problem that bi-temporal graphs answer with validity intervals). Its internals borrow from the retrieval corpus too: a Leiden-family community-detection step over a personal history, the GraphRAG move applied to one user's episodes. And it is the first in this layer to publish numbers on a named public benchmark (LongMemEval-S R@10 0.978; ~350 retrieval tokens against ~2,850 for agent search) rather than asserting that it works — author-run, so not independent, but a rung above the rest of the layer and a partial answer to the standing "nobody measures the memory layer" gap. The taxonomy borrowing is also the cleanest seam yet to the new ../psychology-wiki: episodic/semantic/procedural is Tulving's, arriving as a software architecture. A fourth pole, and it breaks the axis: cloudflare-agent-memory (2026-04-17, ingested 2026-08-22). The three poles above differ in weight, but all of them are things you run. Cloudflare's is a managed service — extraction, verification, classification, embedding and synthesis all execute on cloudflare's network, and what the agent gets is a deliberately narrow five-verb API (ingest, remember, recall, list, forget) over a Worker binding or REST. So the layer now has a hosted/self-hosted dimension beside the weight one, with the two ends arguing opposite cases: recall says memory should be markdown you own; Cloudflare says the constraint is the product, because "tighter ingestion and retrieval pipelines are superior to giving agents raw filesystem access." It is also the most mechanically specified entry in the layer — an eight-check verifier that passes, corrects or drops each extracted memory; facts / events / instructions / tasks as the type system, with tasks explicitly disposable; supersession by normalized topic key leaving a version chain rather than a delete; and retrieval as five parallel channels (full-text, exact fact-key, raw-message safety net, direct vector, HyDE) fused by Reciprocal Rank Fusion. Date arithmetic is done by regex and injected as pre-computed fact, never asked of the model. Two findings generalize past the product. First, a bigger model is not better per stage: Llama 4 Scout (17B MoE) does extraction, verification, classification and query analysis, and only synthesis rewarded the 120B Nemotron 3 — structure-over-model, measured inside one pipeline. Second, this is the openclaw-hermes-control-layer prediction arriving: memory as the durable lock-in, claimed here by an infrastructure vendor rather than an agent vendor. Cloudflare names the risk itself and answers with exportability — "every memory is exportable… the right way to earn long-term trust is to make leaving easy" — a commitment with no format or API behind it yet. The gap that matters: the post names LoCoMo, LongMemEval and BEAM and publishes no score against any of them, so the layer's best-documented architecture is one of its least-measured claims, while the much smaller iai-pme prints LongMemEval-S R@10 0.978. It converges with iai-pme on process (supersession chains answer staleness the way contradiction surfacing does; async consolidation is the stated roadmap, framed as sleep) while rejecting its taxonomy — facts/events/instructions/tasks is a document taxonomy, not Tulving's. And it leaves beyond-pass-at-1 standing: a gated, synthesized retrieval service is exactly the configuration that negative result did not test. And on the same day, consolidation stopped being theory: claude-dreams (2026-08-22). The cloudflare-agent-memory post described background consolidation as a roadmap item, borrowing the sleep metaphor; anthropic has shipped the thing, under that name, as a research-preview endpoint in claude-managed-agents. A dream reads a memory store plus 1–100 past session transcripts and emits a new store — duplicates merged, contradicted entries replaced, patterns surfaced — because "writes are local and incremental: over many sessions a memory store accumulates duplicates, contradictions, and stale entries." That is the append-only failure mode every self-hosted pole in this layer has and none of them fixes. Three properties matter beyond the endpoint. The input is never modified — the output is a separate store you review and can discard, which is seekdb's copy-on-write instinct moved from the storage engine to the consolidation step, and the answer to the risk auto-company's single rewritten consensus.md carries. The pipeline is a session you can watch — its session_id streams events live and its transcript is archived, where iai-pme's nightly pass is invisible by design. And it is process without a store: Dreams holds no memory, it operates on memory something else holds, so consolidation becomes a separable stage rather than a property of the engine. That is a third position on the store-versus-process axis, and it is the one that composes. Two vendors independently reaching for sleep as the model — one with a billable API — is the layer converging. What neither publishes is any evidence that a consolidated store retrieves better than the store it came from; Anthropic's own guidance hands evaluation to the customer ("scale up once you're satisfied with the curation quality"), which leaves beyond-pass-at-1 exactly where it stood. The same overview also settles what claude-managed-agents is, in Anthropic's framing: four objects — Agent (model, prompt, tools, MCP servers, skills), Environment (an Anthropic cloud sandbox or a self-hosted one on your own infrastructure), Session, Events. Separating config from placement is the agent-scope-isolation instinct applied to infrastructure, and it is what lets the managed pole answer data-residency without redefining the agent. Scheduled deployments then run sessions on cron with no client-side scheduler — mimiclaw's heartbeat with the vendor owning the timer. The price is stated by the vendor and worth holding beside Cloudflare's: because sessions are "stateful by design," Managed Agents is not eligible for Zero Data Retention or a HIPAA BAA. Anthropic answers with deletion on demand, Cloudflare with exportability. Both are policy, not architecture — which is the recurring cost of the managed pole across both vendors. The same local-first, reaches-the-agent-as-an-MCP-tool shape extends beyond memory to document retrieval: knowledge-rag (2026-06) is a self-contained RAG server (hybrid semantic+BM25 + cross-encoder rerank, ChromaDB, no external APIs) exposed to Claude Code as 13 MCP tools — the retrieval-rich end of the local axis, where recall is the zero-dependency end. The retrieval science it packages lives in ../research-wiki (hybrid-retrieval-rag); here the subject is its MCP-server delivery — one more case of the store/index reaching the agent through MCP. ask-search (2026-07) extends that same shape from local files to the live web. It wraps a self-hosted SearxNG meta-search behind an MCP server (+ CLI + an OpenClaw SKILL.md), so the agent gets zero-API-key web search as a tool — where knowledge-rag grounds it in your documents, ask-search grounds it in the current web, both offline-of-the-vendor. It's the free, private counterpart to from-local-llm-to-agent's paid Tavily search tool (which ask-search keeps only as a fallback): the tool side of "skills × MCP = agency" made self-hosted. So the local-first-over-MCP corner now spans memory (recall), documents (knowledge-rag), perception (watch-skill), and web search (ask-search) — four capabilities, one delivery shape. A distinct shape of "context as infrastructure" is the machine-maintained code wiki: agents that generate and continuously refresh a codebase's documentation so other agents (and humans) can browse it as shared grounding — "documentation as a build artifact, not a side project." It now has two independent instances, a closed product and an OSS CLI: autowiki-factory (Factory.ai — multi-agent Survey→Plan→Generate→refresh, web viewer) and openwiki (2026-07, LangChain), which runs in CI and wires the output into agents by appending to AGENTS.md/CLAUDE.md rather than a viewer. Two teams reaching the same survey→generate→auto-refresh loop is the pattern hardening; it's also the cleanest cross-wiki seam to ../research-wiki's llm-wiki concept — a machine maintaining a file-based markdown wiki (of a codebase, for agent grounding, rather than of thought). Notably LangChain, tracked here as a harness vendor, ships doc-gen too — the same maker treating codebase knowledge as agent context. corbell (2026-07-22) turns that extraction forward. It runs the same first move — parse the repos, build a graph of what exists (tree-sitter call graphs, typed signatures, service dependencies, plus git change coupling, a signal nobody maintains by hand) — but the output is not documentation of the system. It is the input to a new spec: a PRD or feature sentence auto-discovers the services it touches, and the graph context plus code snippets go to the model to draft an architecture spec, which is then validated against recorded constraints and exported as Linear/Jira tasks. So the code-understanding step now feeds two directions — describe what is there (autowiki-factory, openwiki) and constrain what comes next (Corbell). Against spec-driven-development that is a real shift: spec-kit and conductor have a human author the constitution or curate the context, while this mines the context from the code, which is the only version that stays true to a codebase nobody documented. It also extends the local-first-store-over-MCP corner to a fifth capability — codebase structure, beside memory, documents, perception and search — and is multi-repo, where most spec tooling assumes one. Caveat is the same one this thread keeps carrying: no evaluation that a graph-grounded spec beats a written one, and no described refresh trigger to back the word "living" the way AutoWiki's regenerate-on-push does.

Two firsts from one skill pack (claude-seo, 2026-08-22)

The spoke has paged a lot of skill packs and the marginal one now teaches little. claude-seo — agrici-daniel's 25-skill / 18-agent / 32-command SEO plugin for claude-code, MIT, 14.8k★ — is worth the space for two properties nothing else here has, and for one comparison it makes possible.

It treats the pack as software. 410 tests, up from 39 two minor versions earlier, of which 91 cover URL-safety SSRF and DNS-rebinding bypasses — obfuscated IPv4, FQDN trailing-dot, redirect-rebinding — run in CI. Every other skill pack in this spoke is markdown with no executable contract, and this one has found the reason to be different: a tool that takes a URL from a user and fetches it from the machine running the agent is server-side request forgery with extra steps. Two of its releases are credential-injection and SSRF-bypass fixes. That is the agent-guardrails argument arriving from an unexpected direction — the containment problem showing up not in what the agent is allowed to do, but in what a helper script is allowed to fetch.

It is a cognitive skill that ships its own disconfirmation. Its 10-principle framework (PERCEIVE → ANALYZE → VALIDATE → ACT) is exactly the kind reasoning-scaffolds says carries measured and negative evidence: a named sequence prescribing how to think, adding no capability. But its output contract requires every recommendation to state the observation it rests on, its dependencies, a "how would we know this failed?" check, and a leading indicator. The scaffold itself remains unverified — nobody has run it against a no-scaffold baseline. Its outputs are falsifiable, which is new, and the two claims should not be blurred: this is not evidence that framing the reasoning improves the reasoning. It does hand the corpus an experiment it could actually run, since the leading indicators are recorded per finding.

And it makes a clean pair with agentic-seo-skill. Same domain, same form factor, opposite bets. The earlier pack is cross-tool, installing identical content in nine harnesses' native formats. This one is Claude-Code-only and spends the saved effort on depth: auto-discovery from a directory convention, 15-way parallel dispatch, the test suite, a four-tier Google credential ladder, eight optional MCP extensions. Portability versus depth, chosen explicitly, on identical subject matter — the cleanest instance of that trade the spoke holds.

What is not evidence, and it matters because the star count invites the mistake. The "10–15 minutes versus 4–8 hours manual" figure is the repo's own with no method. The case study is one screenshot of one three-month-old site's Search Console impressions — no control, no attribution. The 410 tests measure the code; nothing measures whether the audits improve rankings. A pack can be well-engineered and unevaluated at the same time, and this is the corpus's sharpest example of the two coming apart.

One distribution note. The MIT repo has a members-only early-access mirror behind a paid Skool community, alongside a contributor programme that folded outside work into v1.9.0. The spoke's first two-tier open/paid release cadence, and the mechanism by which one maintainer reaches 25 skills.

The convergence node — gstack

garry-tan's "software factory" is the clearest single artifact of the thesis: 23 agent-skills, role-split agent-orchestration, parallel sprints via conductor, and gbrain as persistent memory — its Think→Plan→Build→Review→Test→Ship→Reflect sprint, where Reflect is compound-engineering. It is also the cleanest bridge back to ../research-wiki: the same author's knowledge base is the harness's memory layer.

hermes-profile-builder (Nous) gives the spoke's most abstract claim a UI: an agent is composed from identity + model + skills + MCP servers, and the Profile Builder is a local dashboard with exactly those four toggleable blocks (writing config.yaml/.env/SOUL.md, CLI-parity, one-click Skills-Hub/MCP-catalog installs). So "skills × MCP = agency" + model-selection + identity stop being separate threads and become a single composition surface in one shipping product. Evidence on the standardization-reach question: the blocks are stable enough to assemble in a GUI. Local-only (127.0.0.1) keeps it on the openhuman local-first pole.

Vendors

anthropic (Claude Code / Channels / FSI) is the furthest along the model-provider → full-agent-platform shift: the ant CLI (ant-cli) drives claude-managed-agents from the terminal, and claude-agent-sdk ships the Claude Code harness itself as a Python/TS library — tools, agent loop, hooks, subagents, MCP, sessions, and .claude/ skills/CLAUDE.md dirs. A three-rung ladder: Client SDK → Agent SDK → Managed Agents. The wiki's threads are now literally one vendor's SDK feature list. But selling the wrapper exposes a cost-structure tension the model layer didn't have: anthropic-agent-sdk-billing-pause (June 2026) shows flat subscriptions are far cheaper than API-rate metering for anyone running the harness hard — power users hit breakeven within days — so Anthropic announced (May 13), then paused (June 15/16), a change to bill Agent-SDK / claude -p usage at API rates. boris-cherny's framing — subscriptions "weren't built for the usage patterns of these third-party tools" — reads the pause as a deferral, not a reversal. The thread to watch: as the harness becomes the product, its pricing converges toward usage-metering (cf. GitHub Copilot's parallel move), and "the value moved to the wrapper" acquires a margin problem the wrapper's owner must solve. google (adk, agent-starter-pack, Gemini CLI / conductor, and now genkit) and now microsoft (Agent Framework + Azure AI Foundry, per agents-that-build-agents-ms) are all building the same harness + skills patterns — three independent vendors converging on skills as the primitive, strong evidence the form factor is an industry attractor, not one vendor's house style. The open agentskills-spec is where that convergence is most explicit — and Microsoft adopts it outright: per agents-that-build-agents-ms (confirmed via Microsoft Learn), Foundry skills follow the agentskills.io format and surface to any MCP client as MCP Resources (SEP-2640), so all three vendors land on the same open file format, not rival proprietary ones. langchain is the fourth vendor, but decomposes the harness differently: its primitive is composable agent-middleware, not a loadable skill — a framing tension worth watching (skill-as-unit vs middleware-as-unit; in practice likely both, skills being what the agent can do and middleware how the loop is wired).

The community-org stratum, and what it says about moats (2026-07-26). Under the vendors sits a different kind of publisher: FoundationAgents, a MetaGPT-community GitHub org with a gmail contact address, whose openmanus carries 57.6k stars off 526 commits. It exists because Manus shipped a general-purpose agent behind an invite code, and the community had an open prototype in three hours. Read against the vendor ladder above, that's the sharpest available evidence for the spoke's own premise cutting both ways: if the value really has moved into the wrapper, then the wrapper is also the part that is cheapest to re-implement. What the closed product owned was distribution and a waitlist, and neither survived contact with an org that could be started in an afternoon. The counterweight, visible in the same repo: 301 open issues and 192 open PRs. Replicating the architecture took hours; carrying it doesn't.

Permission is the dial that runs the other way

Every capability this synthesis tracks extends what an agent can do: context, orchestration, skills, the effort-level dial. claude-code-auto-mode is the corpus's first source about what an agent is allowed to do, and it belongs to the thesis rather than beside it. The model writes the code; the harness decides what the code may touch (agent-permission-model).

The number worth keeping is about the humans, not the feature. Per-action approval — the safety design most harnesses here ship — caught 13.6% of harmful actions, against 89% for automatic approval, across 1,053 paid developers. That is a measurement of confirmation fatigue, and it generalises past claude-code to anything in this corpus whose safety story is a prompt: a control that fires hundreds of times a session stops being read, so it degrades exactly in proportion to how useful the agent is. The spoke has been describing harnesses that make agents run longer and wider (run-claude-code-agents-24-hours, orchestrate-100-agents-claude-code) without noticing that the same trend disarms the approval prompt.

The remedy points the same direction as everything else here. Not a better human review — no human. On the reported figures 11% of harmful actions still get through, now at machine speed with nobody nominally watching.

And the evidence is the vendor's. 89 / 13.6 / 720-of-720 all originate with anthropic, including the commissioned third-party injection test. simon-willison accepts the design and asks for independent confirmation of the numbers, which is the same position this synthesis has taken on the agentsys harness claims and the progressive-disclosure savings. Add it to the standing pattern: the strongest claims in this corpus are still measured by the parties making them.

A third position arrives 2026-08-23, and it has no number at all. KOT removes the gate rather than moving it — "There is no security, and there will not be" — and hands isolation to the operator's container. Read beside nanoclaw, which argues from the identical premise to shipping containers itself, the premise turns out to underdetermine the design: "application-level permission is not real isolation" supports both build the boundary and build nothing. What separates them is who is assumed to do the work, and only one of those assumptions is testable by the vendor.

The substrate floor: a harness with no identity and no policy

mimiclaw is the smallest harness in this corpus by two orders of magnitude, and it is useful for what it leaves out rather than what it fits in.

The anatomy this synthesis works from — runtime, gateway, memory, tools, identity, policy (openclaw-hermes-control-layer) — survives the shrink with four of six parts. A C agent loop on an ESP32-S3, a Telegram gateway, markdown memory files on flash, five tools. No identity layer, no policy layer, and no approval prompt. Those are precisely the two layers NVIDIA and Microsoft added to openclaw to get it into production, so the anatomy's own claim that they are the control layer rather than the working layer now has its demonstration at the bare end.

It also runs unattended by design. A 30-minute heartbeat re-prompts the agent from a task file, and cron_add lets the model schedule its own future wake-ups, persisted across reboots. Read against "Permission is the dial that runs the other way": claude-code-auto-mode measured per-action approval catching 13.6% of harmful actions, and MimiClaw has no such control to degrade. What keeps it safe instead is that its five tools cannot do anything — search the web, read a clock, set an alarm. Containment by capability poverty is a third mechanism beside external sandboxing and the approval prompt, it is free, and it lasts exactly until someone adds a filesystem tool.

The cost claim needs splitting, and the repository already splits it. The headline says an AI assistant on a $5 chip; the GitHub description says a harness on a $5 chip, and the second is right. Every turn is an API call to Claude or GPT with a key stored on the board, and the recommended board is ~$10. What got cheap is the thing that hosts the loop, which was never the expensive part (model-or-harness-taxonomy). The 0.5 W figure is a claim about electricity, not about inference.

Standing caveat unchanged: everything here is the project's own account of itself.

Open questions

• Does an optimized prompt beat a hand-written one? (opened 2026-08-20 with dspy.) Every number prompt-optimization produces is measured against the optimizer's own seed prompt, on a metric the operator chose. Nobody in this corpus has run optimized vs. competent-human-authored on the same task with the same metric. This is the sharpest form of the standing benchmark gap above, because it is the one place where the evaluation harness already exists — an optimizer cannot run without one — so the missing piece is a baseline arm, not an instrument. A T1/T2 source running that arm would be the most valuable single ingest available to this spoke.
• How many skills can an agent actually keep installed before triggering degrades? (opened 2026-08-23 with attention-is-all-you-have.) The paper bounds the answer at fewer than a hundred reliable auto-trigger slots per agent from the long-context literature and states plainly that no controlled measurement exists — trigger reliability as a function of installed-skill count is the experiment it proposes and does not run. This is unusually cheap to settle compared with the other open questions here: one agent, N installed skills, a fixed set of requests that should fire each one, swept over N. It would price the whole install layer and settle whether @skills's premise holds. Answered 2026-10-07 by skill-shadowing: a 21-point pass-rate drop at 202 installed skills, already 8 points at 52, driven by wrong-skill selection (see edge 14). A neutral run is the single most valuable ingest this spoke could get on the skills thread. Sharpened 2026-08-28. how-many-tools-should-an-agent-see measures the neighbouring regime and moves the variable: with a retrieval layer in front, a 3,251-tool registry is workable at a shortlist of seven and unusable flat, and shortening the list raises a frontier model's own selection accuracy (93.1% against 87.1%). So the honest form of this question is no longer "how many can I install" but "how many reach the prompt" — and the skills case is the corner where those two numbers are the same, which is precisely the corner nobody has swept.
• Benchmarks. Substantially answered 2026-08-03 — see "Three independent measurements, three nulls" below. context-files-ablation-paper is the neutral, controlled, two-agent study this bullet had been asking for since June, and it lands a bounded null with a mechanism. What stays open is narrower and now well-specified: nobody has tested purpose-built, task-specific context (as opposed to generic style-guide context), no study reaches the ~120-task scale needed to detect a 10pp effect, and the harness-vs-model tradeoff below is still untouched. The history of the question follows. Nearly every claim here is from READMEs / vendor blogs / one practitioner (claude-code-best-practices) — including agentsys's "Sonnet+harness > Opus" and the ~90% progressive-disclosure saving. A neutral, measured comparison is the highest-value next source. Partial step (2026-06-16): awesome-hermes-usecases is third-party, primary-source- gated deployment evidence for hermes-agent — it narrows the README-only-claims gap (the features demonstrably ship and get used across 13 domains) without closing it, since it documents that Hermes is deployed, not how well it performs against alternatives. Usage evidence, not a benchmark. awesome-agent-evolution (2026-07-02) adds a lead, not an answer: its "Benchmarks and Evaluation" section indexes where field-level evaluation lives, but a curated directory of benchmarks points at the question rather than settling it. The sharpest partial step yet (2026-07-14): Cognition runs an explicit "trust no eval" practice — senior engineers judge a model on whether real output would ship, backed by a proprietary "Frontier Code" anti-slop benchmark built precisely because public benchmarks reward test-passing over production-ready code (the failure mode this open question keeps naming). It reports Fable 5 at ~30% vs the prior Opus's ~10%, with internal dogfooding agreeing with the metric. This is the first source that both names the anti-benchmark failure mode and offers a methodology aimed at it — but it narrows rather than closes the gap on two counts: it's a proprietary vendor benchmark (Anthropic-published, Cognition-owned, not neutral third-party), and it measures the model, not the harness-vs-model tradeoff the next bullet asks about. First measurement of the tooling layer itself (2026-07-22): cc-thinking-skills runs a length-controlled, placebo-compared, replication-gated harness over its own 39 skills and publishes a null result — zero robust ELEVATE verdicts, best candidate short of the p<0.05 gate. It's small, single-author, single-harness, and covers only cognitive skills rather than capability skills, so the Benchmarks question stays open. But it changes the character of the gap: the spoke's evidence is no longer only claims-from-READMEs, and the first honest experiment came back negative. The methodological detail worth copying is the length-matched placebo — without it, any "more deliberation" effect gets scored as a win for the framework. A template without a result (2026-07-28): i-have-adhd ships an evals/ harness and a release gate for a single skill — blind judging, a weighted rubric (correctness 35% / autonomy 25% / actionability 20% / safety 10% / concision 10%), and a bar the change must clear (correctness and safety within 0.1 of baseline, weighted score above it). Its runner guards the exact contamination this question keeps tripping over: strip the operator's config so user plugins and hooks don't leak into every condition (the named worst case is the repo's own always-on flag injecting the skill into the baseline), pin the model so the comparison doesn't drift with CLI defaults, cap spend, and require any competitor claim to use the same cases, models, trials and rubric. Then it publishes no numbers. So the corpus holds three author-side postures — ponytail's metric without a method, cc-thinking-skills's method with a null result, and this one's method with no run. Then the outside measurement arrived the same day (2026-07-28). jetbrains-ponytail-tested is a third party testing a tool it doesn't own: 80 paired SkillsBench tasks, claude-sonnet-5, 251 billed trials, every trial audited to confirm the ruleset reached the treatment arm and stayed out of the baseline. It found ponytail works and is oversold — −15.4% code (p=0.088), −10.3% cost (p=0.004), no quality difference detected, against an advertised −54% and −20%. The gap is method, not dishonesty: a mean over twelve hand-picked tickets versus a median over 80 tasks nobody chose. That is the shape to expect from self-reported numbers generally — measured on the sample that flatters them. A different move on the same problem (2026-08-05): education-agent-skills does not measure anything, and is worth logging here anyway because it attacks the gap from the other end. Its 165 skills carry evidence_strength and named evidence_sources in frontmatter, citing the education literature behind each technique. Note what this is not: no evidence that the skill works, and a strong citation behind a technique says nothing about the prompt encoding it — the gap between "retrieval practice is well-evidenced" and "this skill elicits retrieval practice well" is exactly the one every source in this thread keeps falling into. What it adds is that the claim is now checkable by a reader rather than merely asserted, and the check is cheap. Provenance instead of measurement: weaker than jetbrains-ponytail-tested, and much easier to ship, which is why it may spread further. A positive result at null-result scale (2026-08-05): statewright reports two local models going 2/10 → 10/10 on a 5-task SWE-bench subset with its state-machine constraints applied — same model, same hardware. This is the cleanest demonstration of structure substitutes for capability the corpus holds, and among the least measured: five self-selected first-party tasks, the mirror image of cc-thinking-skills's honest null at the same scale, and the same setup jetbrains-ponytail-tested showed collapses under neutral replication. Held as a strong hint, not a measurement. Its one falsifiable boundary is worth keeping: below ~13 GB the models could emit tool calls but not retain file content to edit, and constraints only helped above that line — structure steers a capable-enough model rather than manufacturing capability, which is the most precise version of the thesis's limit the spoke has recorded. The same shape at real N (2026-08-05): longhorizon-harness reports +28.9 points on WeaveBench (114 tasks), 2.8% → 8.3% on OSWorld 2.0 (108 tasks) and +7.5 points on Terminal-Bench 2.1 at 24% fewer tokens, all on a fixed Qwen backbone with only the harness switched on. The task counts are the news: 114 and 108 are past the scale at which cc-thinking-skills and statewright returned their verdicts, and past context-files-ablation-paper's 17. They are still first-party, with no trial count per task and no rubric, so they buy scale and not independence. The OSWorld row is the one to keep in view — a 3× gain that lands at 8.3% says the harness moved a number that remains close to useless, which is a more informative shape than the headline and one a promotional README had no reason to print. A self-benchmark that shows its method (2026-07-29, jcode). jcode publishes RAM and startup comparisons against seven rival harnesses with the exact version of each tool tested, ranges rather than bare means, the measurement procedure (10 interactive PTY launches), and a footnote explaining why one competitor needed a different readiness signal. That is most of what jetbrains-ponytail-tested had to supply from outside, supplied voluntarily. The flattering-sample move still happens, one level down: the baseline row is jcode's own most-stripped configuration, so every "N× more RAM" is measured against a config jcode doesn't ship, and jcode's default appears in its own table at 6.0× the baseline — above two of the competitors it is being compared against. The lesson refines rather than repeats: a self-benchmark's method can be impeccable and the choice of baseline still carries the claim. Startup and per-session scaling, where jcode wins by 20–250×, need no such reading. Two results generalise past Ponytail. The benefit was conditional (31% on over-built tasks, near zero on already-lean ones), so a headline percentage describes a task mix rather than a tool — every restraint skill should be read that way. And adherence is not a given: without the always-on hook the skill fired zero times in ten sessions despite claiming any-coding-task readiness, and its own shortcut-comment rule was followed once in 80 trials. A loaded skill is a bid for attention, not a constraint, and until someone counts, the difference is invisible. So the Benchmarks question is finally open with evidence in it rather than open for lack of any. And the best-designed harness in the corpus landed the same day — perplexity-api-platform-skills. Its fixture is a production-verified app deliberately loaded with migration hazards; its reference migrations are shipped but disqualified as answer keys ("treat these as examples, not golden diff targets" — grade properties, not diffs, which is the nondeterminism problem solved rather than restated); check.sh grades by greps plus live production runs, so the tally is mechanical; fixtures are kept comment-free to stop hint-leakage; and the runbook documents the A/B against no-skill. The move worth stealing is its last rubric section, "Judged by eye (not greppable)", which names the two places the grader can be satisfied vacuously — delete the feature instead of preserving it, handle only the common terminal event — and routes them to a human. That's constraint-evading-behavior anticipated by the gate's own authors. Still no published score, so the tally across four sources today is: one outside measurement, three harnesses nobody has run.
• Does structure really substitute for capability, and how far? ANSWERED 2026-08-06, and the answer is "one tier, not two." scaffold-effects-gaia is the crossed design this question had been asking for since June: 5 models × 3 scaffolds × 139 GAIA questions × 3 attempts, pre-registered, ~5,900 runs. Three findings settle the shape of it. Scaffold choice is worth a lot inside one model — Haiku swings 23 points on Level 1 purely by scaffold. It does not carry a model across a tier: Haiku's best configuration (0.459) never reaches Sonnet's worst (0.660), so no amount of structure buys the next model up. It does carry one step: Sonnet + Planner-Actor-Rater (0.730 L1 / 0.620 L2) beats Opus + planner-executor (0.704 / 0.655), which is agentsys's "Sonnet + harness beats Opus" claim confirmed under control for the first time — and bounded, since the same table shows it failing two tiers down. Two corollaries the spoke should carry. The best scaffold is model-specific and sometimes it is the simplest: Opus tops Level 1 on plain ReAct, and the multi-agent scaffold hurts it there, with the multi-agent advantage appearing only inside the Anthropic family. And every single-scaffold benchmark number in this corpus is therefore a scaffold-conditional estimate, not a capability reading. Caveats kept: the scaffold arms also vary their tool surface, GAIA validation answers are public so Level 1 may reflect memorization, and it is one author on one non-coding benchmark. The non-coding caveat is now retired (2026-08-07, claw-swe-bench). Zheng et al. put the same question to 350 SWE-bench-class issues across 43 repositories with prompt, container, timeout and evaluator all fixed, and the shape holds: harness spread of 12.5 pp on GLM 5.1 and 27.4 pp on Qwen 3.6-flash against a model spread of 29.4 pp across nine models. The two axes are the same order of magnitude, so "harness choice is a first-order factor" is now a coding-domain finding and not only a GAIA one. It also sharpens substitution. GAIA said structure carries a model one tier and not two; the coding data says how much structure is worth depends on how weak the model is — the harness spread roughly doubles going from GLM 5.1 to Qwen 3.6-flash, and the worst harness (generic) loses 24.5 pp across that same step while openclaw loses 7.4. Scaffolding compensates for capability, and the compensation is worth most where there is least. The untested cell is the top: neither GPT 5.5 nor Claude Opus 4.7 appears in the harness sweep, so whether the spread keeps narrowing at the frontier is still unmeasured — and that, not the general question, is what the corpus should hunt next. The history of the question, and the bounds the earlier sources set, follow. The harness-vs-model tradeoff was asserted, not quantified — and Cognition is the clearest counter-current yet. Its account of Devin gaining 8-hour unattended autonomy credits a raw model step-change (Fable 5's horizon — "how long it can be self-sufficient," "the kind that come roughly once a year"), not a cleverer harness. If the binding constraint on long-horizon autonomy is model coherence rather than scaffolding, that bounds "structure substitutes for capability": structure buys reliability at a fixed horizon, but extending the horizon itself may need the model. The spoke's own effort-level framing already conceded half of this (raise effort for skipped work, upgrade the model for confidently-wrong-with-good-context) — Cognition supplies the production instance where the model jump, not the loop, was the unlock. cc-thinking-skills bounds it from the other side: at the thinnest layer of "structure" — a framework instruction with no new information in it — the substitution didn't measurably happen at all. Read together, the two suggest structure pays where it changes what the agent does (tools, gates, retrieval, verification) rather than what it's told to think, and that horizon still belongs to the model. auto-company is the natural experiment on the far end: maximal structure (14 personas, six workflows, hardcoded phase gates) around an unbounded loop, with no reported outcome. A third bound, from the blame side (2026-08-06): model-or-harness-taxonomy assigns 36 of its 41 failure modes to the model — but by construction, since fault is model-side whenever a stronger model could have recovered. Read carefully that is not evidence against the harness; it is a rule that makes the model the default defendant. The load-bearing number is the other five, the modes no model upgrade fixes, which is the cleanest statement yet of where structure is not substitutable. See agent-failure-localization.
• Standardization reach. Will agentskills-spec actually unify formats, or fragment (agent-starter-pack already migrating to agents-cli; ACP, MCP, vendor-native dirs coexist)? renwei-writing ships for Cola (~/.cola/skills/) — yet another host with a SKILL.md-style dir, i.e. the pattern keeps spreading but via per-tool directories, leaving open whether they converge on the spec or just proliferate. Convergence is now winning the evidence. Anthropic's own anthropic-skills repo publishes the spec first-party, and Microsoft Foundry adopts it outright: agents-that-build-agents-ms confirms (via Microsoft Learn) that Foundry skills "follow the Agent Skills specification format" — SKILL.md + YAML front matter, the spec's progressive-disclosure advertise→load→read pattern, surfaced to any MCP client as MCP Resources (SEP-2640). So the three converging vendors (Anthropic, Google, Microsoft) are not just each shipping skills but landing on the same open format wired to the same transport (MCP) — strong evidence the spec unifies rather than fragments. The residual fragmentation is at the per-tool directory/host level (Cola, agents-cli), not the file format.
• The channel-gateway corner, and MCP past the Claude ecosystem. Most of this spoke's harnesses point a model at a terminal (coding agents). whatsapp-chatgpt-bot (wassenger) points the same anatomy — model + persona + tool/function-calling + per-conversation memory + cost/abuse limits + human handoff — at a consumer messaging channel instead, as a single-purpose business support bot. It echoes the "chat-app message gateway" in deer-flow and gateway-first openclaw, but productized down to one channel. The sharper signal: it is an OpenAI/GPT-4o bot that nonetheless ships MCP support — MCP showing up in a non-Anthropic, non-coding messaging bot is another point (with the Microsoft-Foundry evidence above) that MCP is becoming the cross-vendor tool/context transport, not a Claude-only detail. A T3 vendor demo, so weak on its own — watch whether more channel-deployed, non-Anthropic agents reach for MCP by default.
• The A-bridge. gstack fuses harness (here) + knowledge base (gbrain, ../research-wiki). Is "agent tooling" ultimately a sub-case of "LLMs operating over file-based markdown," or a distinct engineering discipline? The split makes the question explicit.
• First-party lab harnesses — the vendor ships the wrapper too. Most harnesses here are community or third-party (claw-code, oh-my-pi, easy-agent) or from platform vendors (adk, deer-flow). grok-build is the model lab itself shipping an open-source terminal coding agent (xAI's Rust grok), joining Claude Code and Gemini CLI: the labs now compete on the harness, not only the model. Two details make it a data point rather than just another CLI: it embeds in editors via the Agent Client Protocol (ACP) and extends via MCP + plugins — so even a lab that could lock users to its own stack is converging on the shared agent↔editor / agent↔tool protocols the rest of this spoke tracks. It also crisply separates from the model: the Grok model/provider is a cross-wiki node in ../llm-providers-wiki (xai-grok), while the harness is here — the structure-over-capability split drawn by the same company on both sides of it.

Growth edges

Ranked; each names the kind of source that would close it (see ../QUALITY.md → Growth edges).

1. Purpose-built context, tested. Every measurement the spoke holds tested generic context — style guides, house rules — and returned a null. Nobody has tested context written for the task at hand, which is the version practitioners actually claim works. — needs: a T1 controlled study, ~120 tasks (the scale the corpus's own power analysis says a 10pp effect needs). Two studies of exactly that shape now exist and the spoke has not read either (2026-08-15). agent-skills-can-be-harmful reports their results at second hand: skillsbench (84 verifier-graded tasks, 11 domains) finds average pass-rate gains from curated skills with drops on 16 of 84; swe-skills-bench (490 repository tasks) finds limited average improvement, many skills with no gain, and token overhead up to 451%. That is purpose-built context tested at the scale this edge specified, pointing at a small positive mean with a long negative tail. The edge stays open until the primaries are ingested — the numbers above are one paper's summary of two others, and the failure study deliberately reports no denominator of its own. — needs: arXiv:2602.12670 and arXiv:2603.15401, read directly.

2. The harness-vs-model tradeoff. CLOSED 2026-08-06 by the research pass — scaffold-effects-gaia, the crossed 5-model × 3-scaffold pre-registered comparison this edge had specified almost word for word ("varies model and harness in the same design"). Seven sources missed it by holding one factor fixed; the eighth ran the factorial. The answer is recorded in the open question above: structure carries a model one tier, not two, and the best scaffold is model-specific. The coding-domain successor is also CLOSED, 2026-08-07, by the research pass — claw-swe-bench, 350 SWE-bench-class instances with prompt, container, timeout and evaluator held fixed. Harness spread 12.5–27.4 pp against a 29.4 pp model spread; the finding is domain-independent. The frontier cell is CLOSED too, 2026-08-08, by the research pass — harness-bench: 8 model backends × 6 harnesses, 106 tasks, 5,194 trajectories, frontier models in the grid. "Stronger model backends tend to achieve higher mean scores while exhibiting lower cross-harness variance." The spread narrows at the top and does not vanish (23.8 pp strongest-to-weakest harness). Successor edge, ranked below: the benchmark scores whole harnesses, so it cannot say which mechanism bought the gap — the corpus documents mechanisms and nothing attributes a point of the spread to one. Partly closed 2026-08-08 by ddr-bench (T1), whose Section 5.2 ablations vary reasoning budget, memory and reactive-vs-proactive operation one at a time on a fixed model (Qwen3-Next-80B-A3B) — the design this edge specified — and whose Table A1 adds whole-mechanism additions across three datasets × three models. The numbers are now held (an earlier note here said they would not extract; a local PDF pass got them): 2 of 27 additions beat the plain ReAct baseline, both +Plan on 10-K. Memory never wins. Multi-agent takes one cell from 16.67 to 4.44. So the attribution this edge wanted exists and points the unexpected way — much of the spread is damage, not benefit. Remaining: one benchmark, one task family, off-the-shelf framework implementations, and nothing on a coding workload, which is what this spoke mostly documents. The coding half is now CLOSED, 2026-08-11 (research pass) — confucius-code-agent (Meta and Harvard, T1) varies context management and tool sophistication one at a time on a fixed model, on a 100-example SWE-Bench-Pro subset. Context management: +6.6 pp on Claude 4 Sonnet (42.0 → 48.6) and +0.6 pp on Claude 4.5 Sonnet (51.0 → 51.6). Tool sophistication: +7.0 pp (44.0 → 51.0). So a mechanism worth almost seven points on one model is worth half a point on its successor. Successor edge, unmet: the ablations keep stopping at two mechanisms. Confucius never removes its note-taking agent or its meta-agent, DDR-Bench's additions are off-the-shelf framework implementations, and neither reports variance or repeated runs — a 0.6 pp difference on 100 examples is not distinguishable from noise. — needs: an ablation reporting repeated runs with variance, covering persistent memory or self-configuration, on a fixed model. 2a. The human-versus-model harness comparison, actually controlled. New 2026-09-03 with harnessdev, which reports 86.2 for human-engineered references against 67.8 for the best model-built harness — and states plainly that the references are "verified public system results rather than paired controls under one executor." Five different published systems on five different models. The direction survives that; the 18.4-point gap does not, and it is the number the paper will be cited for. — needs: one benchmark run where a human-engineered and a model-built harness execute on the same model, same tasks, same budget. T1/T2. Cheap by the standards of this list: the harnesses and the benchmark are published.

3. Neutral evaluation of a vendor's own claims. jetbrains-ponytail-tested is the template — a third party testing a tool it does not own, with audited arms. The corpus needs more of exactly that shape and fewer proprietary benchmarks like Cognition's Frontier Code. — needs: T1/T2 third-party evaluations.

4. Consolidate before adding. Done 2026-08-04 at the curator's instruction. The six dated (added 20xx) sections became three thematic ones — Structure changes how an agent works, not whether it succeeds, The surface dictates the representation, Shared state is the next boundary — with the overlaps merged (the phone and the video editor were making one argument, not two) and nothing dropped. 264 lines to 202. The standing rule this leaves behind: a new finding extends the thread it belongs to; it does not get a dated section of its own.

Coverage edges (added 2026-08-08, at the curator's request for a wider backlog). These widen what the spoke covers instead of answering an open question above; one ordinary solid source closes any.

5. The observability layer. 234 pages and not one tracing or eval product — LangSmith, Langfuse, Braintrust — although agent-evals and agent-failure-localization both assume someone is recording runs. — needs: product documentation plus one team's account of debugging with traces.

6. The frameworks named in passing. CrewAI, AutoGen, smolagents and OpenAI's Agents SDK appear only inside other pages; langchain and adk carry the whole framework story alone. — needs: official docs, one page each.

7. The benchmark family behind the benchmark argument. Mostly CLOSED 2026-08-09 (research pass) — swe-bench, tau-bench and webarena written from their papers, all T1. BrowserGym is still absent, and a sharper successor has opened: every one of the three reports figures from 2023–24, and the spoke quotes current vendor scores against them. — needs: a contamination or saturation study on SWE-bench (or its Verified subset), and any independent re-run of these benchmarks at current model strength. The contamination half CLOSED 2026-08-22 (research pass) by swe-bench-illusion (Liang, Garg & Zilouchian Moghaddam, T1). Ten models name the buggy file from the issue text alone, with no repository access, at 60–76% on SWE-Bench Verified and below 53% on repositories the benchmark never covered; verbatim recall of the fixed function runs 35% vs 18% on the same split. The independent-re-run half is still open — nobody has re-scored current harnesses on a decontaminated task set this spoke can cite. — needs now: a decontaminated or freshly-collected task set with harness results on it.

8. Agents running unattended in CI. Nearly everything here is an interactive harness. The GitHub-Actions path — a pull-request bot, a nightly agent, and who approves what it writes — has one mention across the corpus. — needs: platform documentation plus one report of a team running it.

9. A framework comparison whose outcome is correctness, not bytes. New 2026-08-21, successor to the multi-framework comparison with a measured outcome edge closed the same day by agent-storage-footprint (Yu et al., HK PolyU, T1: eight frameworks, one replayed trajectory, 6.7× spread in retained bytes; 15.7× among configurations all scoring 100%; 4.8–32.7× removable by content-addressing; and across 108 SWE-bench Verified submissions, trajectory volume spanning three orders of magnitude with no correlation to resolve rate). The layer is measurable — that was the open part. But accuracy in that study is a control, pinned so storage can vary, so it still compares frameworks only to each other. — needs: a comparison across frameworks, or against a hand-written loop on the same API, where correctness or cost is the dependent variable.

10. Whether the storage result survives contact with a real deployment. New 2026-08-21, second successor to the same source. Its own audited boundaries say the controlled suites cover retrieval and retention rather than general reasoning, that results describe version-pinned configurations rather than frameworks in the abstract, and that the wild data are exports rather than runtime residue. Version pinning decays fastest of the three. — needs: a re-run at current framework versions, or an operator publishing runtime residue rather than exported trajectories.

11. Does the reliability plateau hold on proprietary frontier models? Written into this section 2026-08-23 (it had lived only on the hub's ## Most wanted since 2026-08-21, which is the wrong home — the spoke's edges are the source of truth). CLOSED the same day by the research pass: science-of-agent-reliability (Princeton, ICML 2026, T1) runs 14 proprietary frontier models, zero open-weight, K=5 runs at temperature zero, and finds reliability improving only modestly over 18 months of releases — barely at all on open-ended GAIA. beyond-pass-at-1's guess that the closed models are "likely more reliable" is not supported. Successor, edge 12.

12. Reliability with the harness as the variable. New 2026-08-23. Both repeated-run studies hold the scaffold fixed — one per benchmark in science-of-agent-reliability, two in beyond-pass-at-1 — while scaffold-effects-gaia and harness-bench vary the scaffold and run once or thrice. So the spoke's central claim, that structure substitutes for capability, has never been measured with variance on the structure side, and a 23.8 pp harness spread from single runs sits on an unmeasured noise floor. — needs: a harness comparison with K≥5 repeats per configuration and reported spread, or a reliability study that varies the scaffold. HALF CLOSED 2026-09-14 by metr-scaffold-comparison (METR, T1): the factorial was run — Opus 4.5 / GPT-5 × vendor harness / generic scaffold — and the harness moved the time horizon by nothing measurable (Claude Code over ReAct in 50.7% of bootstrap samples; Codex over Triframe in 14.5%). Uncertainty is bootstrap over tasks, not seeded repeats, so the K≥5 half stands. — needs now: the same cells with ≥5 seeds and a variance decomposition, or the cells repeated later.

13. A non-naive memory arm. New 2026-08-23, carried in from the hub shortlist where it had been parked since 2026-08-21. Three sources now report memory scaffolds failing to help or actively hurting (beyond-pass-at-1 5 of 9 models, ../osint-wiki's vibesearchbench on three mechanisms, and the budget mechanism in context-rot) — and all of them test naive episodic memory, a scratchpad appended to. Curated, retrieval-gated and summarized memory are untested, and agent-memory's whole product thread assumes them. — needs: the same repeated-run design with a non-naive memory arm.

14. How many installed skills before triggering degrades. New 2026-08-25, written here because the question has been an open question on this page since 2026-08-23 and lived as a sourcing need only on the hub shortlist (quality-log.md #28) — the drift QUALITY.md's "the spoke is the source of truth for edges" rule exists to catch. attention-is-all-you-have crawled 56,804 published skills and bounds an agent at fewer than a hundred reliable auto-trigger slots, taken from the long-context literature rather than measured; the authors say so and propose the experiment without running it. It is the cheapest high-value measurement on the list — one agent, N installed skills, a fixed request set that should fire each one, swept over N — and it prices the whole install layer, including whether @skills's premise holds. — needs: a T1/T2 measurement of trigger reliability as a function of installed-skill count. HALF CLOSED 2026-08-28 (research pass) by how-many-tools-should-an-agent-see (Repantis et al., Meta, arXiv 2605.24660, T1, read from the PDF) — which measures the adjacent regime and reframes the question. Registries from 20 to 3,251 tools: on BFCL's 370-tool pool a learned depth policy reaches 90.3% at K = 7.4 against 90.8% for a fixed shortlist of fifty, and downstream selection by Claude Sonnet 4.6 improves to 93.1% from 87.1% — and to 76.8% from 60.9% on medium-difficulty queries — when the list is short and adaptive rather than a fixed five. So the variable that moves accuracy is how many candidates are shown, not how many exist. Why it is only half. Everything measured here sits behind a retrieval layer, and installed skills have none — their trigger descriptions share the prompt, so installed count is shown count. This paper never visits that K = N corner. — needs still: the sweep with no shortlist in between, which is the attention-is-all-you-have experiment. Not eligible before 2026-09-11. CLOSED 2026-10-07 (research pass) by skill-shadowing (Song & Wei, Databricks, arXiv 2605.24050, T1): the K = N sweep, run. All names and descriptions in context, no retrieval, Claude Haiku 4.5 and Sonnet 4.6 on SkillsBench. Pass rate falls 0.08 at 52 skills, 0.14 at 102, 0.21 at 202 against the task's own skills alone, and wrong-skill selection ("shadowing") explains up to 68% of it; context length never separates from zero. So the decline starts well under the argued hundred and is gradual, not a cliff. Successor, edge 14a: no mitigation was tested, both models are Anthropic's, and the sweep stops at 202. — needs: a T1/T2 run of the same sweep with a mitigation arm (retrieval pre-filter, rewritten descriptions or routing), ideally across providers.

15. What these tools rewrite, and what they import. New 2026-09-03, promoted from the hub dream ledger. 1jehuang is recorded here as a pattern about one author — three dependencies rewritten because the existing layer was judged inadequate. Read beside llm-inference's latency-compensation diagnostic, the pattern may be narrower and testable: the layers these authors replace are the ones that encode a latency budget rather than a computation — version-control locking, job queues, streaming renderers — while compute layers keep getting imported. The spoke has the instances and no count. — needs: a commit- or dependency-level taxonomy of what agentic coding tools reimplement rather than import, each rewrite classified as pacing/coordination or compute. T1/T2.

16. Whether a vendored skill records what it vendored. New 2026-09-03, promoted from the hub dream ledger. atskills-protocol lists what the design leaves out — no manifest, no lockfile, no version pinning, no update command — and treats the subtraction as the point. The page never asks what the omission costs. :save vendors a copy at the ID's own path and both cloud forms resolve local-first, so a saved copy answers its own address after upstream has changed, with nothing on either side able to tell the two apart. — needs: the @skills implementation or its documentation on whether .atskills/ stores an upstream revision or content digest. T1/T3; a first-party fact, cheap to close.

17. An independent measurement of the edit format. New 2026-09-06, from harness-problem-hashline. The spoke now leans on the edit format as its cleanest single-tool demonstration that structure substitutes for capability, and the only measurement of it is the tool author's own. Two independent studies exist and neither has been read here — Diff-XYZ (JetBrains, arXiv:2510.12487), which finds no single format dominates across models and use cases, and EDIT-Bench (arXiv:2511.04486), where only one model clears 60% pass@1 on realistic editing. Both are cheap to close and both would test the claim the corpus is already using. — needs: arXiv:2510.12487 and arXiv:2511.04486, read directly. T1.

18. Where the harness effect goes at the frontier. New 2026-09-06. Every harness measurement here is run on frontier or near-frontier models, and the one source that sweeps the weak end (harness-problem-hashline, 16 models) finds the gain concentrated there and absent or negative at the top — GPT-5.2 Codex +4.6 points and 26% more output tokens, DeepSeek V3.2 negative on both. If that gradient is real and not an artefact of easy fixtures, "the harness matters more than the model" has a shelf life, and the corpus cannot currently tell the two readings apart. — needs: a harness or tool comparison spanning a wide capability range with the model as a swept factor, ideally on tasks harder than single mechanical mutations.

Structure changes how an agent works, not whether it succeeds

The Benchmarks question above was the spoke's oldest. It is no longer unanswered, and the answers keep arriving the same way.

context-files-ablation-paper (Khatri, arXiv) is the strongest measurement this corpus holds: two frontier agents from different providers, 17 tasks mined from merged PRs across 3 real repositories, 288 runs scored against hidden gold tests, code and data released. Context-injection strategy does not measurably move correctness on either agent — bounded to ≤10pp (Claude Code) and ≤15pp (Codex), with the no-context arm scoring higher on the borderline tasks selected to have room to move. A pre-registered probe across 36 cells confirms the real AGENTS.md never converts a near-miss failure to a pass.

Three independent parties, three different layers of the structural stack — cognitive scaffolds, a ruleset, project context — and none found the outcome improvement the layer is sold on. Two found process effects instead (fewer tokens, less cost, fewer wasted test runs) and both authors attributed those to delivery mechanics rather than agent capability.

The mechanism is the part to carry. Khatri's failure triage is the most useful paragraph in the corpus on why. Near-miss failures fail on implementation skill — feature design, pattern selection, exact wiring — not on repository knowledge a document could supply. The agent that implemented reactive retry where proactive token refresh was needed did not lack a fact; it made an architectural choice. No context file fills that.

So the standing does structure substitute for capability question sharpens into something narrower and testable: the structural layer plausibly changes how an agent works — what it reads, what it re-runs, what it spends — while leaving whether it succeeds to the model. Every measured result here is consistent with that split and none contradicts it.

And the artifacts have started agreeing with the split without being told (added 2026-08-06). claude-code-development-kit is a packaged Claude Code setup built on four synchronized project-context files — the mechanism context-files-ablation-paper ablated to a null. It ships no evaluation, so it adds no evidence. What makes it worth recording is that every claim it does make is a process claim: less re-derivation across sessions, a smaller always-loaded floor, fewer stale docs, cleaner merges. It never promises the agent will write better code. Read against the table above, the kit and the paper are not in conflict; the kit is selling exactly the half the measurements found real, and the corpus's recurring disappointment has come from tools that sold the other half.

That reframes the growth edge slightly. The open question is no longer only "does structure improve correctness" — the answer keeps coming back no — but whether the process gains are worth their own overhead, which nobody has measured either. A kit that keeps four documents in step spends tokens to save tokens, and /update-docs, /review-work and /second-opinion all cost a run apiece. Nothing in this corpus prices the structural layer against the burn it removes.

Two honest limits. All three studies are small (Khatri's own power analysis: 120–200 tasks to detect 10pp; his MDE is >30pp), and all three measure generic structure — naturalistic style-guide context, cognitive scaffolds, a general ruleset. Purpose-built, task-specific context is untested by any of them. What has collapsed is the inference from adoption to effect, which is what most of this spoke's sources actually offer.

The split that has since appeared runs along authorship, not along scale. Every measurement in the table above was run by someone with nothing to sell, and each found process effects and no outcome effect. Every result claiming a large outcome gain — statewright 2/10 → 10/10, longhorizon-harness +28.9 points, agentsys's 73–83% cost savings — was run by the party shipping the harness. That is not proof the vendors are wrong; the two groups also test different things (the independents test generic context on frontier models, the vendors test purpose-built scaffolding, often on weaker backbones, which is exactly the untested case growth edge #1 names). But until one measurement crosses the line, the corpus cannot tell the difference between "purpose-built structure works and generic structure doesn't" and "authors find what they are selling." Both stories fit every number on this page.

2026-09-03: a measurement crossed most of the line, and it went the boring way. harnessdev runs six models building their own harnesses from an identical weak seed, over 2,207 instances, with held-out tasks withheld from the development loop — purpose-built structure, at scale, scored by people not selling the winning harness. The lead affiliation is ByteDance Seed and Seed 2.0 Pro finishes last of six, which is the inverse of the authorship problem above rather than another instance of it.

The outcome result is a small one. Harness evolution — the compounding claim — tops out at +4.44 held-out points for Opus 4.8 and regresses for three of four lineages once the runtime model is fixed. So the vendor stories on this page (autoharness's 42% → 78%, longhorizon-harness's +28.9) now have a controlled number of the same shape to sit beside, and it is an order of magnitude smaller. That does not settle the split — nobody has re-run a vendor's own purpose-built scaffold under control — but the first purpose-built-at-scale measurement landed nearer the independents' null than the vendors' headline.

And it names a harder problem underneath. "77.8% of failed Data tasks are attributed to harness defects, showing that the bottleneck is not only executor capability." Every study in the table above asks whether structure helps a working agent. This one finds structure is where most of the failures already are. The two questions are not the same, and the corpus has been asking only the first.

Verification is where the bottleneck went, and the gate can be cheesed

loop-engineering moved the bottleneck from generation to verification; shipping-without-human-verification states the destination outright: how much code can you ship with no human looking at it, starting at 1% and growing the number the way teams grew into CI/CD.

Its contribution is a distinction the corpus lacked. Testing asserts; verification judges. Testing confirms the code works; verification confirms the change did what was intended and fits the organisation's standards — and code review historically fused them and did the judging badly, at a reviewer's four-in-the-afternoon attention. That explains why better test coverage never dissolved the review bottleneck: intent alignment, acceptance-criteria coverage, architectural fit and blast radius are not assertable, and they are most of what review was for.

The hole is adversarial robustness, and it runs straight into constraint-evading-behavior. The proposal replaces human judgement with automated gates, with an LLM judging exactly the rows that can't be asserted. This spoke already documents agents satisfying a check's letter while defeating its purpose, and ../defensive-security-wiki holds the extreme instance — a model treating its sandbox allowlist as the puzzle and breaking out. The defence offered is a Swiss-cheese stack of layers, which is the right instinct against independent failures and no defence at all against correlated ones, where the verifier and the author are the same class of system confused by the same thing.

And verification has a price nobody was charging it (2026-08-15). The corpus argues for encoding checks — verification-loops-skills packages them as skills Claude runs on itself, agent-loops-verification makes the loop the unit of design, watch-skill's THE LOOP re-reads its own output. agent-skills-can-be-harmful audited the bill. Excessive Verification is the single largest bucket in its whole cost taxonomy: 67 of 182 regressions, tasks that passed while the skill kept the agent re-testing, rebuilding, debugging and walking checklists after the artifact was already right. This does not overturn the verification thread — every one of those runs passed — but it prices it, and the price shows up in a place pass-rate evals do not look. What the finding actually indicts is the unconditional checklist: verification scope belongs on a budget, scaled to change size and uncertainty, rather than prescribed in full by a skill that cannot see either.

Both halves stand in tension. The bottleneck is real and the human baseline is genuinely weak — "better than a tired reviewer" is a lower bar than teams admit. And a gate you can cheese isn't a gate. Nobody here has measured an automated verifier against an agent with an incentive to pass it, which is a sharper version of the Benchmarks question than "are the numbers real." The article's one quantity — "improving detection by 50% may speed up the engineering organization by 200%" — has no method, no source, a load-bearing "may", and a vendor sponsor selling verification.

The surface dictates the representation

mobilerun put the controlled surface on a device rather than a repo, browser or chat channel, and its architecture restates this spoke's core thesis unusually cleanly. Nothing about the model is mobile-specific — it runs OpenAI, Anthropic, Gemini, DeepSeek, Ollama or any compatible endpoint against the same phone. Everything that makes it work is harness: a device-side Portal exposing the accessibility service, an operator-side runtime holding the loop and tools, per-app guidance cards, and a manager-executor planner that is agent-orchestration with taps as the end effector. The phone runs no model at all. If the claim is that value moved to the wrapping, mobile is where the wrapping is the entire product.

The design decision is what to send the model. Mobilerun reads the OS accessibility tree rather than screenshots and claims a 500× smaller payload with better accuracy — semantics beat pixels because a labelled button doesn't have to be recognized.

video-use landed twenty minutes later from browser-use, an unrelated team in a different medium, and made the same call: one ElevenLabs Scribe pass turns a shoot into a ~12KB word-level transcript, the model cuts from that text, and filmstrip composites render only at decision points. watch-skill was already doing it on video with a ≤100-frame budget against a text index.

Three instances from three orgs is why this is paged as text-first-agent-design rather than left as a note: don't hand the agent the surface, hand it a derived representation chosen for meaning per token. pxpipe resolves as the principled inverse rather than a contradiction — a coding harness has no upstream structured description, so once text is already the most meaningful form available, the only lever left is what the tokens cost. The rule covering all four: ask what description the platform already maintains before deciding what to feed the model.

Two answers on one task, four days apart

open-edit (VEED) is the corpus's first genuine head-to-head: the same job as video-use, a different org, and a different answer at almost every decision. Both read a per-word transcript, because caption timing has no other input. From there video-use stays in text to the finished cut, while OpenEdit has the agent author captions in HTML and CSS and renders them with a binary that never starts a browser. That is the pattern's neighbour rather than its violation — pick the notation the model is fluent in, which is also paperclip's move on scientific databases the same day.

Two things travel beyond video. First, the provider is abstracted and the precondition is not: VEED, WhisperX or your own Whisper-family service all write the same transcript file and "nothing downstream can tell which one ran," but a transcript without per-word timings "is refused rather than rendered badly." A mechanical gate on an input, in a corpus where most quality control is a sentence in a prompt (agent-guardrails). Second, the vendor shape is new: not a model provider climbing into the harness (anthropic, google, microsoft) but an application company publishing the agent-native replacement for its own subscription product, with the funnel moved to transcription. "Not the editor you rent, but the one you own," from the company renting the editor.

What is still missing is the comparison itself. Two tools, zero shared evaluation, and the honest summary is that they disagree about authoring surface, renderer, host portability and licensing with nothing measuring which choice was right. The star gap (18.6k vs 209) is distribution. OpenEdit's 2.2×-faster renderer claim arrives with the README's own admission that it is "preliminary and not yet reproducible outside VEED," which is the right disclosure and still not evidence.

The token-budget corner, and its first instrument

Five levers now sit in this corner and every one is an intervention: compress (headroom), remove (safe-prompt-pruning), swap modality (pxpipe), route (tokenmining), and strip at capture (md-this-page). That last is the only one upstream of the harness — a browser extension where Readability strips the page and a person pastes the Markdown, no agent or model deciding anything. Its uncomfortable implication for the expensive tools: a 2010-era Reader Mode heuristic captures a good share of the win, because much of what bloats a window is structural rather than a judgment call.

And two days later the upstream lever grew a server (2026-08-05). pullmd is strip-at-capture with md-this-page's stated limit removed: a self-hosted URL/file → Markdown service exposing an MCP server, a Claude Code skill that fires on web-reading requests, and OAuth for the claude.ai connector. Capture-time reduction moves inside the loop — the agent chooses what to fetch and the stripping is a service it calls, rather than a person clipping a page and pasting it. Its architecture is the other thing worth taking: a fallback cascade (Readability → Trafilatura → origin-supplied Markdown → headless Chromium) rather than one extractor, which concedes that nothing works across the whole web. Same unmeasured footing as the rest of the corner — the cascade's selection quality is exactly what no source in it has ever tested.

agtop is the first entry that changes nothing. It reads Claude Code and Codex JSONL transcripts, joins them to OS processes, and reports what a session actually cost — spend, tokens, context saturation as a live percentage, CPU and memory, per model and per subagent. The corner's claims are quantitative and almost entirely self-reported (60–95% fewer tokens, 59–70% cost, 27–34% cuts), and this spoke holds the demonstration of what outside measurement does to such a number: jetbrains-ponytail-tested took an advertised −54%/−20% to −15.4%/−10.3%. The corner did not need a sixth lever; it needed an instrument. Two limits keep it honest — it measures cost, not quality (a session that spent little because the agent gave up early scores well), and CTX% makes context-rot's central quantity visible without making it actionable.

Progressive disclosure has a ceiling, and a catalog found it

The skills model rests on a claim about cost: a skill's frontmatter is cheap enough to keep resident, its body loads only when needed, so more skills are close to free. agentic-awesome-skills is the first source here that shows where that stops. At 2,003 skills the index is the thing that no longer fits: the README documents that Antigravity, which watches ~/.agents/skills, "may load enough installed instructions to exhaust its context, slow startup, trigger truncation errors, or enter a crash loop," and the installer therefore refuses to run bare against that target. A composed manifest is capped at 128.

So the cheap-frontmatter argument holds per skill and fails in aggregate, and it fails at a number well below what a catalog can accumulate. The project's response is the part worth keeping: it built a read-only local MCP the agent queries instead of a directory the harness ingests. The agent searches, reads candidates, picks exact IDs, and Core validates the selection's structure — explicitly not its semantic fit, compatibility, or safety to apply. Discovery replaces distribution, which is agentic-resource-discovery arriving from the direction of a catalog too big to hand over.

Two things it does not settle. Whether an agent selects better than a ranking would is the project's entire premise and is untested. And the honest disclaimers cut both ways: a system that validates IDs but certifies nothing, distributing two thousand instruction files — including a critical and authorized-use-only offensive tier — into an autonomous agent's working set, puts the whole trust burden on a selection step nobody audits. agent-guardrails in supply-chain form.

The per-skill ceiling, measured (2026-08-15). The catalog above found where the index stops fitting. agent-skills-can-be-harmful found the limit inside a single skill, and it is not made of tokens. Across 182 paired cost regressions, Excessive Procedure — the extra steps a skill's instructions induce — is 114 cases (62.6%) against Context Bloat's 46. Progressive disclosure prices the text a skill puts in the window and prices nothing about the workflow that text prescribes; a 600-token body demanding a full test suite after every edit is cheap to load and expensive to obey.

Where the cost is context, the split is the sharper number: 43 of 46 cases are the mandatory body, 3 are the lazy-loaded supplementary material. The L2/L3 boundary works as designed, and authors are putting the wrong things above it. Both halves point at the same repair and it is an authoring convention, not a platform feature — say what is binding, move the rest below the fold, and stop turning an optional checklist into mandatory work on every task.

The same day, from the other end. vibe-tools answers "how does an agent learn it can do something" by writing the harness's instruction file — .cursorrules, CLAUDE.md, Windsurf/Cline/Roo — and giving the agent shell-callable models: Perplexity for what it doesn't know, Gemini for what won't fit, Stagehand for what must be clicked. That is the pre-MCP answer, and it still works because instruction files are the one surface every harness reads. Put beside AAS the pair is a spectrum with the context budget as its axis: push capability into the context until it stops fitting, then make the agent go fetch it. Neither source measures whether either works.

Whether the loop can close depends on the surface

video-use inspects its own output at the cut boundaries and re-renders, up to three passes — the same move as watch-skill's THE LOOP and ai-job-search reading its compiled PDF. mobilerun cannot: a tap leaves no artifact, so its 8.6% failures are invisible from inside the loop. Two agents on media-heavy surfaces, one day apart, and the one that can check its work is the one whose actions produce something inspectable before they count.

That, not model quality or harness sophistication, determines whether loop-engineering's feedback signal exists at all — and it sharpens agent-guardrails: gate the plan where you cannot verify the act. video-use asks the user to approve a cutting strategy before it renders; on a phone, that approval is the only checkpoint there is.

On evidence, Mobilerun is among the better the spoke holds and still vendor-run: 91.4% across AndroidWorld's 116 tasks against a named leaderboard (AutoGLM-Mobile 84.5, LX-GUIAgent 80.2, K²-Agent 79.3, Finalrun 76.7), on a task set it didn't write, harness published. That clears the bar most sources here fail. It does not clear the jetbrains-ponytail-tested bar: the vendor still chose the frame and ran the numbers. Read 91.4% as the ceiling of a reproducible claim, not a settled one. video-use measures nothing at all, and its 18.6k stars measure attention, not use — openclaw is the standing reminder.

Shared state is the next boundary

Two sources push past the spoke's default of one agent, one principal, from opposite directions.

Topology. agent-orchestration has meant one shape here: an orchestrator fans work to parallel subagents, coordination happens at the root, isolation is a worktree per agent. jcode's swarm runs a different one — several agents in the same repo under a server tracking who read what, so when agent A edits a file agent B has read, B is notified and can diff it or ignore it. Agents message each other, broadcast, and spawn sub-swarms, becoming coordinators in turn.

This is peer-to-peer with cache invalidation, borrowed from filesystems and CPU caches, where the existing model is a tree with isolation. The two answer the same question — what stops two agents corrupting each other's work — with opposite instincts: isolation prevents the conflict, invalidation detects and reconciles it. agent-kanban shares a board of intent; jcode shares the working tree. The author is explicit about why: "Git was clearly not built for multi-agent workflows, and git worktrees is not a good solution." No evidence either way on which holds up. Watch whether shared-state swarms hit the coordination cost that pushed distributed systems toward isolation, or whether an LLM that can read a diff makes reconciliation cheap enough to prefer.

(A second jcode mechanism belongs elsewhere: its skills load by embedding hit — the conversation is vectorised and a skill injected on similarity — where agentskills-spec's progressive disclosure has the agent read descriptions and choose. Retrieval-selected versus description-selected capability, different failure modes, no measurement of either.)

A third topology removes the orchestrator instead of relocating it. agensh (Microsoft Research) keeps agent-orchestration's tree-with-isolation picture only as the thing it's arguing against: identical workers read a shared Git workspace, a Mattermost-backed message channel, and an append-only shared-context log, then decide for themselves what to claim next. It's the first source in this spoke to put a controlled number on scaling past the orchestrator bottleneck rather than asserting the limit exists: mean pass rate on the five hardest ProgramBench tasks rises 19.31% → 28.78% from 1 to 128 workers, and on pandoc alone 33.89% → 55.06% from 1 to 1,024, model and per-worker harness held fixed throughout. The finding that matters as much as the curve: cooperation forms aren't designed in — peer negotiation at 8 agents gives way to review chains at 32, standardized merge protocols at 128, and duplicate specialist roles with failover at 1,024, from the same unmodified prompt. Read against jcode, the two disagree about the unit that should notice a conflict (a cache-invalidation ping vs. a Git merge plus a direct message) but agree that isolation-by-worktree is the thing both are moving past.

Principals. qm is built around the case that breaks the default: "Most agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex." Once two employees share a deployment, every stateful thing the agent owns needs an owner — memory, files, keychain view, permissions, skills, crons, a durable sandbox — each scoped per person and per room (agent-scope-isolation). That lands on the open agent-memory question from an unexpected side: the "one markdown file" pole cannot hold per-scope views, so multi-user is an argument for the machinery rather than a preference for it.

Containment is the right architecture and its enforcement is heuristic

QM takes a side in the standing constitution-vs-containment tension — "the agent and software it runs in a sandbox are not trusted to make authorization decisions" — with core enforcing identity, scope and effect gates around the model. That is the containment position from a shipping product rather than an essay, and the governance shape is new here: an org-level posture (Strict / Auto / Dangerous) that narrower scopes may only tighten, with a predeclared command policy applying in every posture including Dangerous. Review is configurable; a class of effects is not.

Then its own SECURITY.md concedes the boundary is porous. The command policy is "a speed bump against mistakes and injection, not a sandbox boundary" — writing a script and running it evades it, which is constraint-evading-behavior admitted by the party with most reason to deny it. Credential purposes "travel with the credential as an instruction to the model", and an instruction to the model is not a constraint on it. Sandbox credentials sit in plaintext while in use. And the line worth carrying into every human-in-the-loop design in this wiki: "An approval means a human accepted the displayed action under the information available at that time, not that the resulting behavior is safe."

So the tension sharpens rather than resolves. Containment is the right architecture and the best-documented implementation in the corpus says its enforcement is heuristic at the edges. The honest reading is that containment and prose instructions differ in degree of porosity, not in kind — which makes what is the blast radius when the gate fails the question, exactly where agent-guardrails' recovery-cost framing already points.

Two governance practices worth stealing regardless of the product. A seven-day dependency cooldown (min-release-age=7), so a compromised npm package yanked within hours never enters a lockfile — the corpus's first concrete supply-chain control. And contributions as human-written prose: .txt or .md in adrs/, maintainers implement, with an explicit "please do not have AI artificially expand what you'd like to do into a formal proposal." Once agents write most of the code, the scarce reviewable artifact is human intent, and the PR goes back to being a conversation.

Caveats on both: jcode and QM are single sources, days old, with no benchmarks and no deployment evidence beyond their publishers'. Candour about limitations is not the absence of limitations.

At 37,000 agents the unit of design changes

Everything above scales fan-out by adding workers. virtual-biotech (Zou, Stanford, via stanford-virtual-biotech-37000-agents) runs tens of thousands and does something else with them: agents are differentiated by role and by data source — a CSO agent over pharma-style divisions, then one agent per genetics/genomics/single-cell stream — so the population has a shape rather than a width. orchestrate-100-agents-claude-code, the previous high-water mark here at 100+, is stateless one-shot copies of the same worker; agensh now sits between the two at 1,024 — also homogeneous, also role-undifferentiated at the start, but with a measured curve instead of a demo scale.

Three things follow, and none of them is settled by one talk.

The claimed mechanism is disagreement. Fan-out in this corpus buys coverage (decomposition) or a shorter tail (tail-control-agentic-workflows racing). Zou's is neither: agents "get into debates and disagreements. They have to convince the other AI scientists [of] their ideas," which he reports produces more creative reasoning and more resistance to compounding errors than one model working alone. That is the claude-security-plugin verifier quorum and agent-kanban's peer review generalised into the reason for the population's existence. No numbers on the head-to-head are given — the closest this corpus gets is agensh's 1→128/1,024-agent pass-rate curves, and those measure homogeneous workers converging on roles, not a population Zou pre-differentiates by data source, so the comparison stays a suggestion, not a test.

Optimise the environment, not the model. agent-environment-design is the sharper claim: below some scale you specify (workflows, spec-driven-development, context-driven-development); above it you supply infrastructure, incentives and guardrails and leave collaboration open, because "the environment itself is the object that we optimize." Note what survives the switch — the guardrails do, which keeps agent-guardrails' containment position intact — and what does not: the instructions. Per-agent training still happens (an "agent school" doing supervised fine-tuning), so the position is that the two layers have different levers, not that fine-tuning stopped working. It also lands next to context-files-ablation-paper's null from a different direction: one experiment found telling an agent more changed nothing measurable, one practitioner concluded at scale you should stop trying.

An MCP wrapper is not an agent interface. "Even if you wrap an MCP around the existing databases and APIs, that doesn't solve the underlying problem: the interface and APIs are not suitable for agents" — they were built for humans or pre-AI algorithms. paperclip's substitute is a virtual file system agents navigate with the file operations models are already good at, claiming an order-of-magnitude time and cost cut. This is text-first-agent-design applied to data access instead of a GUI, and it puts a load-bearing qualifier on MCP as the corpus has treated it: the protocol standardises the connection, not the fit.

Evidential standing. T3, one conference talk, no independent confirmation. The headline validation — a CD276 antibody-drug conjugate designed from pre-2025 data that merck later arrived at independently, FDA breakthrough designation following — is a retrospective coincidence reported by the party it flatters, not a prospective test, and Merck says nothing in the source. The preprint is unread. Treat the architecture as a described system and the results as claims.

The vendor states the order, and it is a claim

The layer list at the top of this file was assembled bottom-up: skills from one set of artifacts, orchestration from another, memory from a third, each arguing for its own layer. agent-sdk-workshop is the first source here that gives the same stack as a sequence, from the vendor. Four booleans in a config file, in this order: system prompt, then ENABLE_TOOLS, then ENABLE_SUBAGENTS, then ENABLE_MEMORY. Capability, then coordination, then persistence.

The switches are independent, so the order is not a technical constraint — nothing stops a learner enabling memory first. Putting it last is a judgment that persistence earns its cost only once there is something worth persisting, which is roughly what iai-pme and jcode arrived at from their own directions. What is new is that it arrives as a curriculum decision instead of a finding, from the party that ships the loop.

Two things follow.

The teaching method is the thesis. "No code writing required. You flip switches, pick from component lists, and write prompts. The SDK does the rest." That is harness-as-library stated as far as it goes: the vendor owns the loop, the builder supplies configuration and prose. This spoke has tracked the value moving from the model to the wrapper; here the wrapper is sold as something you do not write either.

The staging asserts what the measurements keep failing to find. Each stage is presented as better than the last, and the repository measures nothing. Read against the table above — cc-thinking-skills, context-files-ablation-paper, jetbrains-ponytail-tested, three parties and three layers, all finding process effects and no correctness effect — a four-step improvement ladder with no evaluation is the shape the corpus has learned to discount. One caveat keeps this from being a straight repeat: stage 1 is tools, the one layer none of those studies ablated, and the one with an obvious mechanism for a real gain. A tool supplies facts the model does not have; a context file supplies facts it mostly did. If any rung of this ladder is load-bearing it is that one, and nobody has measured it.

A smaller observation worth keeping. Four of the workshop's six scenarios — chief of staff, customer support, sre-agent, account intelligence — are operations roles, not coding. This spoke's corpus is overwhelmingly coding harnesses, and the vendor's own teaching fixtures are not. That is a market read rather than evidence, and it is the vendor's, but it points at a corner the corpus does not cover.

The layer under the harness, finally counted

This spoke's corpus is harnesses, skillpacks and meta-harnesses — things you run. turingpost-13-frameworks surveys the layer beneath: the agent-framework you build with. Thirteen of them, and until now the spoke touched this layer only when a specific entry forced it (adk, langchain), never as a class.

Three things the census shows by its shape.

The layer is Python. Twelve of thirteen support it; Mastra alone does not. TypeScript is in six, .NET only inside Microsoft's entry, and nothing else appears. That cuts against the texture of this wiki's own corpus, which is full of TypeScript and shell harnesses, and it is the first time the language line has been visible here at all.

It has started specializing. Voice and telephony, documents and RAG, research simulation, enterprise coordination. When the general-purpose entrants stop being the only entrants, the market is past its first phase — the same signal, one layer down, that the skillpack corner gave when methodology packs began disagreeing only about who pulls the trigger.

Anthropic is absent from it. OpenAI, Google and Microsoft are all listed, and AWS arrives through Strands' Bedrock default. The claude-agent-sdk this wiki calls the clearest artifact of the model-provider → agent-platform shift is not there. The article states no inclusion criteria, so there is no way to separate an omission from a judgment, and the honest record is the observation without the explanation.

A vocabulary problem worth naming. The article's ladder is model → API → SDK → framework, sorted by how much arrives pre-built. Anthropic's, already paged here, is Client SDK → Agent SDK → Managed Agents, sorted by who runs the loop and on whose machine. Both call the middle rung an SDK. A source saying "it's just an SDK" may be making either claim, and the two are not close.

A second census arrived the next day and did not agree with the first. llm-engineer-toolkit (10.7k★, 150+ libraries in 15 categories) lists 27 agent libraries where Turing Post listed 13, and seven are on both. The divergence is patterned rather than random: Turing Post carries the vendor SDKs (ADK, Microsoft Agent Framework, Strands) and the non-Python entries (Mastra, LiveKit) that the toolkit omits, and the toolkit carries a whole community stratum (AutoGen, Swarms, Composio, Browser Use, AgentOps, Langroid, AgentStack) that Turing Post has none of. Neither states an inclusion rule.

So "agent framework" is a category with a contested boundary, and every count of it is a statement about the counter — one list shaped like the vendor landscape, the other like the Python open-source community. That does not weaken the three findings above; the toolkit independently confirms crowded and Python, at twice the size. It does mean a census here is evidence of what its author was looking at, and should be cited that way.

The Anthropic absence is now twice, and still not an explanation. No Anthropic agent library appears in the toolkit either — the word occurs once across 150+ entries, inside a monitoring tool's list of what it instruments. Two criteria-free lists of different shape is a second data point and nothing more; it stops the observation being one author's oversight without making it a claim about the market.

One thing the toolkit shows that the survey could not. Its second-largest category is evaluation — fifteen libraries (Ragas, DeepEval, Giskard, Opik, AgentEvals, TruLens…) — against this spoke's standing complaint that nobody evaluates agent tooling. The complaint should be stated more precisely from now on: the instruments exist in quantity, and what the corpus has never found is anyone using them to publish a result about the tools this wiki pages. That is a different and more damning gap than an absence of tooling.

And the hole is the same hole. No source in this corpus measures a framework against building directly on an API. The survey grades on ergonomics, community size and one star count; its "weaknesses" column is editorial judgment. One layer up, three parties did run controls (cc-thinking-skills, context-files-ablation-paper, jetbrains-ponytail-tested) and found process effects without correctness effects. Nobody has run that experiment down here, on the layer where the abstraction cost is largest and most obviously in the way.

The loop becomes a config row (2026-08-13)

deepseek-harness takes the agent-middleware thesis to its limit and states the consequence in one sentence: every part of the product is a plugin, including the model adapter, the tool registry, the session log, and the agent loop itself, so every part is replaceable from configuration. There is no privileged core. LangChain's middleware hooks a loop that stays LangChain's; here the loop is one row in a tree built from ordered layers, and replacing it is a patch file rather than a fork.

Three things about this are worth carrying forward.

The substrate is older than the problem. cordis was written in 2022 as a general-purpose composition framework and had nothing to do with agents. The agent vocabulary — turns, steps, tool pipelines, session logs — is layered on as plugins. Every other harness in this spoke was designed as a harness. This is the first one that is an application of something else, which makes it the only available test of whether general composition machinery is the right substrate for an agent, and the first cost is legible already: the architecture doc opens by telling you to learn Cordis first.

One invariant lands on an open problem. "Model-visible means logged" — anything reaching a model request must be reconstructable from the append-only session log, asserted at runtime. That is an architectural answer to the exact ambiguity model-or-harness-taxonomy builds its worked example from: an agent ignores an earlier instruction, and you cannot say whether compaction dropped it or the model disregarded it. Under this invariant the question is decidable from the log. DeepSeek never claims this motivation, and the harness still compacts; what changes is that the dropping is on the record. If the failure-localization thread ever gets an instrument, this is the shape of the substrate it needs.

A model lab shipped a harness that is not a lock-in play. The vendor pattern is now well populated — anthropic with claude-code, Google with Gemini CLI and adk, DeepSeek with dsh — and the obvious read is that labs have concluded the scaffolding is where the product is. But dsh ships two LLM adapters against one seam, and the second is a generic multi-provider one where an OpenAI-compatible gateway is configuration rather than code. The harness is the durable unit and the vendors now agree, including on the part where it isn't theirs alone.

And the standing complaint survives intact. 37,128 stars on day one is the largest attention number in this corpus and it measures nothing. The repo ships a BENCHMARK.md whose entire content is instructions for running the Python SDK — a file named for the thing this spoke keeps asking for, containing no result. Held as architecture, not as evidence.

Review gets a price tag (2026-08-16)

The verification thread has argued for months that checking, not generating, is the binding constraint (agent-loops-verification), and has proposed better environments (signadot), automated verification engineers (shipping-without-human-verification) and scored evals (agent-evals) as the answer. stop-burning-tokens-on-code-review is the first source here to report what the model-based answer costs to run: about $1,000 a week for Cursor's BugBot, and $1,000 in a single day for Claude review skills in GitHub Actions, against 2,900 pull requests a quarter.

The number matters less than what the author did about it. Rather than tuning the reviewer, he had a model compile the deterministic half of the team's written guidelines into linters and then took the model out of the loop entirely — deterministic-review-gate. The model runs once, at rule- generation time; the check that runs on every agent-authored commit is a 27-second sweep with no model in it.

That is a third position in this thread, and it cuts across the spoke's usual axis. The corpus has been sorting tools by how much autonomy they grant and how much structure they wrap around the model. This source sorts by where the model sits in the loop, and finds that the highest-volume position — once per commit, per reviewer, per repository — is the one worst suited to a probabilistic tool. Cost is the visible symptom; the reviewer's second queue is the real one, since a model comment must be read to be dismissed and a lint rule does not.

The caveat is the same one this spoke keeps recording. Nothing in the source measures what the linters miss. The trade is cheaper-and-faster against possibly-blinder, and only one side of it has numbers.

A pack with no measurement in it (2026-08-17)

ai-marketing-claude is the marketing vertical's turn at agent-skills, after agentic-seo-skill and claude-skills-ppc, and it is most useful here as a specimen rather than a tool. Reading its file tree instead of its README gives the spoke a number it can compare: 14 skill files, 5 subagents and 4 Python scripts, in 37 files and 132 KB. agentic-seo-skill, the same form factor one vertical over, ships 89 scripts it calls evidence collectors.

That gap is the verification thread restated as a packaging decision. One pack sends the agent to fetch a fact and reason over it; the other sends the agent to look and write. Both emit something shaped like an audit, and the marketing pack's output is a scored, client-facing PDF — the artifact where an unmeasured number is least likely to be questioned and most likely to be forwarded. agent-skills-can-be-harmful measured 307 failures caused by skills themselves and skillsbench defines the deterministic verifier that would settle it; neither has anything to bite on here, because there is nothing in the pack that produces a checkable observation.

And the popularity signal degrades further. agentic-awesome-skills established that stars measure attention rather than fitness, but that catalog carried 2,464 commits of visible maintenance underneath the number. This repository was created and last pushed nine minutes apart on 2026-03-02 and, re-checked on 2026-09-27, still holds exactly one commit: nearly seven months of silence, now against 2,686 stars, 712 forks and 6 unanswered issues (2,451/692/7 on 2026-08-17). The fork-to-star ratio held at 27–28% across that six-week gap while both counts grew — not an early-life artifact settling with age, but what the pack looks like when people take a copy rather than depend on one. So the corpus now has the clean case: a skill pack with heavy adoption signal and exactly one push behind it. Whatever the stars measure, it cannot be that anyone found it correct, because it has never been corrected.

The delivery method belongs in the same paragraph. The documented install is curl … | bash from an unmaintained repository, installing instructions an agent will then execute with the user's tools — two trust decisions collapsed into one command, in a corpus that already holds a paper on skills causing failures. Nothing suggests bad intent; the point is that the mechanism gives the user no moment to look.

What the source is good evidence of is the form factor reaching non-engineering work, and what a pack contains when it gets there: a router skill, a fan-out of specialists, a handful of scripts, and client-deliverable templates — proposals, launch checklists, email sequences. Agency work packaged as a skill pack, sold to agency builders and solopreneurs. That is a real observation about where agent-skills is spreading, and it is separate from whether this instance works.

A fifth instance adds a true zero to the evidence-collector spectrum (2026-10-07). claude-marketing-research-skill has no scripts directory at all — one SKILL.md, competitor data from "web search" rather than a fetcher the project wrote. The spectrum this thread tracks now reads 0 (claude-skills-ppc, an article) · 0 (this one, a real pack) · 4 (ai-marketing-claude) · 6 (geo-seo-claude) · 89 (agentic-seo-skill). It's also small enough (55★, 3 commits) that its rough edges are still visible rather than smoothed over by attention — a wrong repo name in its own install commands, an unfilled "[Your Name]" credit — the state a pack is in before the single-push-then-silence pattern above, not after it.

The prompt becomes a fitted parameter (2026-08-20)

dspy and awesome-prompts arrived together and named a corner this spoke had been circling for months without a word for it: prompt-optimization — you supply a program, examples and a metric, and a search rewrites the instructions and demonstrations until the score stops moving. The prompt stops being authored text and becomes a fitted parameter.

The pieces were already here, unconnected. awesome-hermes-usecases pinned hermes-agent's "closed learning loop" down to GEPA + DSPy optimization; meaning-typed-programming benchmarked MTP against DSPy as its main rival. Neither reading noticed that the mechanism underneath is the same one, or that GEPA is a published algorithm (arXiv 2507.19457) rather than a vendor's private trick. Paging DSPy — 37.5k stars, 406 contributors, four papers, cited fourteen times here across five pages and never written up — closes a gap the spoke created itself.

It is the second mechanism for self-improving-agents. Until now that page had exactly one: an agent writing skill files for itself. Prompt optimization is the other, and it is the one with peer-reviewed algorithms and thirteen shipped implementations behind it.

It is also the one corner that cannot skip evaluation. The complaint that runs through this synthesis — nobody measures the tooling — has a structural exception here, because an optimizer without a metric does not run. That turns out to be less than it sounds. The gain an optimizer reports is measured against its own seed prompt, on a metric its operator chose, over examples its operator supplied. It says search beat the starting point. It does not say the framework beat a competent human writing the prompt by hand, and nothing in this corpus runs that comparison. The instrument is finally present and the experiment still is not.

There is a reason to think the hand-written baseline is weaker than it looks, and this spoke found it independently: cc-thinking-skills, context-files-ablation-paper and reasoning-scaffolds all report process effects without correctness effects for hand-authored structure. An approach that ignores authorship and fits to a score is attacking the problem from the side the evidence favours. Nobody has run it as an experiment, so it stays a reason to look rather than a finding.

Where the category boundary actually runs

DSPy is missing from turingpost-13-frameworks's thirteen and from llm-engineer-toolkit's twenty-seven; the toolkit does carry it, under LLM Prompts, in a nine-entry category otherwise made of prompt compressors, with Guidance and LMQL exiled again to Structured Outputs. The agent-framework finding was that the category has no agreed membership. This is the third data point and the first that explains why: both censuses sort by what you assemble — agents, chains, crews — and a compile step is not an assembly. It gets filed next to LLMLingua because both edit the prompt, which is classification by surface rather than by function. The peer-reviewed source disagrees with both directories: meaning-typed-programming treats DSPy, LMQL and MTP as one comparable class.

The system prompt is now a distribution channel

awesome-prompts is a curated directory with a thesis — "the engineering camp gets more space" — that its own proportions contradict, 488 lines of copy-paste prompts against 68 of frameworks. The interesting half is not the argument. It is that the Coding & Development prompts are distillations of this spoke's own corpus, each citing the artifact it came from: Anthropic's auto-mode write-up as a permission-classifier prompt (agent-permission-model), harness guidance as an "Agent Harness Designer" (agentic-coding-harness), three separate encodings of loop-engineering, skill authors for Codex's SKILL.md and Roo Code's modes (agentskills-spec).

So a technique this wiki reaches through a paper or a repo reaches a practitioner as a paragraph they paste. The system prompt has become the transport layer for agent-tooling technique, and the same source shows the other end of that: six catalogues of leaked production system prompts, framed as curriculum. This spoke met that material once as evidence about one product (claude-fable-system-prompt-leak); it is now a standing genre with a reading guide attached. Nothing in either half is measured — no prompt in the directory carries an evaluation — so the source is a map of what the practice is attending to, and nothing stronger.

Somebody built the comparison rig (2026-08-21)

agtx is a kanban TUI that runs several coding agents at once, worktree and tmux window per task, with a different vendor's harness per phase. That description makes it the second board product here after agent-kanban, and on its own it would be an incremental entry. The part that matters is buried in benchmark/.

agtx ships a SWE-bench Lite runner whose config file names the workflow plugin. That turns the methodology packs this spoke has been paging one at a time — superpowers, spec-kit, get-shit-done, OpenSpec, skill stacks including ponytail — into swappable arms over a fixed task, model and sandbox, each run reporting duration, tokens, dollar cost and a three-way outcome grade. Eight configs are published with results.

The results are almost worthless and the rig is not. n=1 per arm on one task out of 300, one model, no repeats, the tool's own author running it, and every config sets skip_worktree = true so agtx's own parallelism is switched off for the entire benchmark. What is measured is the plugin, with agtx as the driver.

Even so, the one published table says something the spoke's own thread predicts. Seven of eight arms produced the correct fix and stopped short of writing a test (🟡); the single ✅ was superpowers, which wrote the test at $2.64 against the cheapest partial pass's $0.40 and 15m46s against 4m48s. If that holds up, the methodology pack bought completeness and charged 6× for it, which is a cost effect with a correctness effect attached — the thing cc-thinking-skills, context-files-ablation-paper and reasoning-scaffolds all failed to find. One task is not evidence of it. It is a reason to run the rig properly.

So the standing complaint needs a smaller amendment than it looked like it needed. llm-engineer-toolkit made the sharpened version: the instruments exist in quantity and nobody publishes a result with them. Somebody now has. What is missing is anyone running it past n=1, and jetbrains-ponytail-tested is the reminder of what that costs — 251 billed trials and $246.09 for a single skill, with every trial audited for contamination.

Two smaller findings. Orchestration here is heterogeneous: not one model fanning out to copies of itself, but Gemini, Claude and Codex taking successive turns on one task with automatic switching, which is a shape agent-orchestration had not carried. And the stuck-task detector reads the agent's tmux pane to diagnose why a task stalled, then either nudges or escalates to the human as an MCP tool call — text-first-agent-design applied to supervision, and agent-guardrails' escalation argument implemented as an API rather than a crash.

One conflict recorded, not resolved. spec-driven-ai-tools (T4) scored OpenSpec highest of the tools it hand-tested. Here OpenSpec is the leanest arm by tokens and lands 🟡 — correct fix, no test. Different criteria, so not a contradiction; but the reading that survives both is cheap, and does not finish the job.

Running it once was never a measurement (2026-08-21)

beyond-pass-at-1 (Northern Kentucky University, T1) arrived through the research pass and settles something this synthesis has been circling from the wrong side. The complaint here has always been that nobody measures agent tooling. The sharper statement is that the standard suites measure the wrong property: swe-bench, webarena and tau-bench all score a single attempt per task, none treats duration as a variable, and only tau-bench touches repetition at all. A single attempt measures capability — can it. Anything operational needs reliability — does it, consistently.

Over 23,392 episodes at k=3 across 396 tasks, four duration buckets and ten open-weight models, run-to-run spread on long tasks reaches ±7 to ±10 points at 95% confidence on one model in one bucket. That number retroactively grades every one-shot comparison in this corpus, agtx's eight-config table most of all: the gaps it reports are smaller than the noise nobody measured.

Three findings worth carrying beyond the methodology.

Decay is domain-stratified. Software-engineering GDS falls 0.90 → 0.44 across the duration range while document processing stays flat at 0.74 → 0.71. "Long-horizon agents degrade" is too coarse; what degrades depends on what the horizon is made of.

High variance is a capability signature, not an instability one. Frontier VAF ≥2.37 against mid-tier ≤1.26, and the strongest models have the highest meltdown rates, up to 19%, because they attempt ambitious multi-step strategies that sometimes collapse. Capability and reliability rankings diverge with multi-rank inversions at long horizons — a leaderboard position earned on short tasks does not transfer.

Memory scaffolds hurt, and that is the fourth negative result on added structure. cc-thinking-skills, context-files-ablation-paper and reasoning-scaffolds found process effects without correctness effects. This one finds a correctness effect pointing the wrong way: long and very-long GDS falls for 5 of 9 models, worst on the strongest (Llama 3.3 70B Δ=−0.13). The proposed mechanism is a budget argument rather than a memory argument — the scratchpad's extra tool calls and context injection "tax capable models' step budgets more than it benefits them" — which is context-rot arriving from the reliability side. What is disconfirmed is naive episodic memory; agent-memory and self-improving-agents both rest on persistence, and neither can now treat it as free.

A second, independent data point (2026-08-22). vibesearchbench (in ../osint-wiki, T1) ablates three mechanisms of a production harness — sub-agent collaboration, local memory and life-long memory — on 200 multi-turn search tasks scored by graph matching, and reports no significant improvement from any of them. Different task, different metric, different harness, same direction: the memory result here is no longer a single study's finding. What it still does not cover is curated or retrieval-gated memory, so the successor edge stands.

The source contradicts itself and the page says so. Its abstract claims memory scaffolds "universally hurt … negative or neutral for all 10 models." Its body reports 5 of 9, with Mistral Nemo slightly positive. Both are recorded; the body is what to cite.

And the excuse is gone. The whole study cost about $0.004 per episode, $40–120 in total. Variance is absent from the standard suites by choice, not by budget.

The proprietary set behaves the same way (2026-08-23, research pass). science-of-agent-reliability (Princeton, ICML 2026) runs the complement: 14 proprietary frontier models, no open-weight ones, K=5 runs per task at temperature zero, on GAIA and the 26 clean τ-bench tasks. beyond-pass-at-1's own limitations section had guessed that "GPT-4o, Claude and Gemini are likely more reliable than the models studied here." They are not usefully so: across 18 months of releases, accuracy climbs and overall reliability moves only modestly, with τ-bench showing moderate gains and open-ended GAIA barely any. The plateau is not an artifact of studying open weights, which is the single most useful thing this pair of studies establishes.

Three things it adds that the open-weight study could not.

Consistency runs backwards against size. Within a family, calibration, robustness and safety improve with capability while outcome consistency often does not — smaller models match or beat their larger siblings, because a bigger model has more ways to attempt a task and therefore more ways to vary. Set against beyond-pass-at-1's "high variance is a capability signature," two independent designs now say the same uncomfortable thing: the better model is the less predictable one, and this corpus's harness thread has been treating capability and dependability as the same axis.

The instability is in ordering, not in choosing. Agents pick similar action types across runs and vary the sequence — the authors' "what but not when." That is the most specific mechanism the spoke has for agent nondeterminism, and it points at planning and execution rather than at tool selection, which is where most harness machinery here actually intervenes.

Cost is unpredictable too, and worse where it hurts. Resource consistency — tokens and compute across identical runs — is poor on GAIA and degrades with difficulty, with the newest Claude models showing a "try harder" pattern of elevated action counts on hard tasks. Every cost figure in this corpus is a single run (effort-level, agent-storage-footprint, stop-burning-tokens-on-code-review), and none of them carries a spread.

What neither study touches: the harness is held fixed in both. scaffold-effects-gaia varies the scaffold with three attempts, this varies the model with five runs, and nothing varies both with repeats — so the spoke's central claim, that structure substitutes for capability, is still measured without variance on the structure side.

The vendor ships the pattern, and keeps the hard half (2026-08-21)

claude-browser-use is anthropic's Browser Use toolset, announced 2026-08-20 next to general availability for Computer Use, the Skills API and the Files API. Claude reads a page as its accessibility tree and acts on element references (ref_3) instead of screen coordinates — text-first-agent-design, now shipped by a model provider rather than by a tool builder, and on the surface the pattern was invented for.

The title of the source is the finding. Anthropic does not run a browser. The toolset exposes 27 operations and executes none of them: the developer opens the browser, performs each action, holds the session across turns and returns the result. What ships is a protocol and a tool definition. That makes it the vendor layer's sixth shape, and the inverse of the fifth: gemini-managed-agents-hooks dissolved the harness into the model API and then sold hook points back to replace the infrastructure it had taken away. This puts the tool vocabulary in the model API and leaves the entire runtime — the browser, the session, the containment, the failure handling — with the developer. The vendor defines what Claude may ask for; you still own everything that happens.

Three specifics carry beyond this tool:

• The representation has a floor. The default toolset costs ~6,600 input tokens just to be loaded, before a tree or a screenshot. Every open-source instance of the pattern argued meaning-per-token without ever stating a fixed entry price; this one has to clear its own overhead before the accessibility tree is cheaper than the pixels.
• References go stale and the API does not notice. Navigate the tab, or change the page enough, and ref_3 no longer points at what Claude thinks it does. Detecting the mismatch, refusing the action and forcing a re-read are the developer's code. The pattern's quiet failure mode, which text-first-agent-design had listed as unmeasured, is now at least named by a vendor — and still not handled by one.
• Batching relocates the approval gate. Several actions per model turn, run in order, results returned together. Cheaper, and it means a sequence can start on an ungated click and end somewhere that needs a person, so the check has to run inside the executor's loop rather than at the model boundary (agent-permission-model). The 13.6% confirmation-fatigue result is untouched by this; the prompts just get rarer and carry more behind them.

Then the hosting split. The same release put Skills into Anthropic's sandbox and Files into Anthropic's storage, and left browser sessions, downloads and uploads on the developer's machine — with the advice to run them in an isolated container or VM, JavaScript off, uploads off, because Claude-generated code executes with the page's privileges. Browser Use is also not available in claude-managed-agents. The vendor took custody of the two surfaces where containment is easy and declined the one where the untrusted input lives. Read generously that is staging; read plainly it is where the liability sits.

Convergent design, divergent protocols. Playwright's ARIA snapshots, Playwright MCP's referenced accessibility snapshots and Puppeteer's Accessibility.snapshot() already do the substantive thing. Playwright MCP speaks MCP; Browser Use speaks Anthropic's own client-toolset protocol; bridging them is an adapter in both directions. The interop story the corpus keeps tracking (a2a-protocol, webmcp) gains another wire that does the same job differently.

Sourced entirely from anthropic-browser-use-tool — trade press, T2, with the outlet's disclosure that its owner invests in Anthropic. No first-party document ingested, and no measurement anywhere: no Browser-Use-vs-Computer-Use cost or accuracy comparison exists here, which is the number that would say whether the tree pays for itself the way mobilerun claims it does on a phone.

Part of the benchmark score is recall, and it grows with publication (added 2026-08-22)

swe-bench-illusion closes the contamination half of edge 7 with an instrument worth copying: ask the model something a genuine solver could not answer. Name the buggy file from the issue text alone, with no repository access; reproduce the fixed function from the issue and the current file.

60–76% on SWE-Bench Verified, below 53% off-benchmark, on repositories averaging 763 files, and 35% verbatim 5-gram recall of the fix against 18% elsewhere. The ordering — Verified highest, the same benchmark's unverified tail lower, unrelated repositories lowest — is what contamination predicts and what a general capability would not produce.

What it does not license. The harness argument this spoke rests on (swe-bench: ~2% for a bare model, an order of magnitude more inside a scaffold) is untouched in shape. Knowing where a bug lives is not fixing it. What changes is the precision of every current number: a cross-model comparison on Verified is partly a comparison of training-set overlap, and the spoke should stop treating small gaps between vendors' reported scores as meaningful.

Second confirmation, from the other side. agent-storage-footprint found 108 SWE-bench Verified submissions whose trajectory volume spans three orders of magnitude with no correlation to resolve rate. Two independent 2025–26 results agreeing that the headline number carries less information than its two decimal places suggest.

The refusals become the product (2026-08-23)

Every harness in this corpus is described by what it adds. KOT is the first described by what it takes out, and the three removals are exactly the three layers this synthesis has treated as settled infrastructure: the permission gate, the skills subsystem, and MCP.

The skills argument is the one worth arguing with. "A skill is a text with instructions that someone wrapped into a separate mechanism with a registry, an installer and versions" — true as far as it goes, and it does not go as far as the claim. The case for skills in this corpus was never the registry; it was progressive disclosure, loading the instruction only when the job needs it, which is a context-budget argument (agent-skills, agentskills-spec). Handing the agent the document and telling it to follow it is the thing progressive disclosure exists to avoid at scale. KOT does not answer that, and nobody has measured which side is right — the savings claim was already flagged here as vendor-measured.

The MCP refusal is stronger, because it comes with a replacement rather than a shrug: cli-wrapper turns any CLI, including one held open as a resident process, into a typed tool with validated parameters. That is the same job as an MCP server minus the protocol and the extra process, and it concedes the underlying need while rejecting the standard. It is the first source here to argue the transport is the accidental part of MCP.

What the refusals share is a bet that built-in beats extensible. Ten fixed tools, no registry, no protocol — which is only viable while the built-in ten cover the work, and is the opposite of the pattern ecc and superpowers demonstrated at 284 and hundreds of skills. It is a falsifiable position rather than a manifesto, and the fixed ten tools are where it fails first.

The same refusals, the opposite bet (2026-08-30)

That last paragraph generalized from one instance, and the second instance breaks it. Pi refuses more than KOT does — no MCP, no sub-agents, no permission popups, no plan mode, no built-in to-dos, no background bash — and overlaps it on MCP and permissions. It reaches those refusals from the far side. KOT removes the extension surface and keeps ten tools built in; Pi removes the features and keeps nothing but surface, under the heading "Primitives, not features", with subagent/, plan-mode/, permission-gate.ts and sandbox/ sitting among 50+ example extensions and a package registry (pi install npm:… / git:…) to distribute more.

So a refusal does not imply a built-in bet. It implies a claim about where a capability should live, and the two harnesses put it in opposite places: KOT in the binary, Pi in userland. Both then tell the same story about why — the feature list of a sealed product is somebody else's guess at your workflow. What separates them is who is expected to close the gap, the vendor or you, and Pi's answer is the more demanding one: "just ask Pi to build it. It will customize itself on the fly." A harness whose documented method of acquiring a feature is asking the agent inside it to write one, then /reload.

The MCP argument is the same argument in both, and it now has a date. Pi's "No MCP" links Zechner's post "What if you don't need MCP?" from 2025-11-02 — nine months before KOT's cli-wrapper reached it independently. This synthesis recorded KOT on 2026-08-23 as "the first source here to argue the transport is the accidental part of MCP." It was the first the spoke read, not the first to say it.

And the adoption numbers are not close. Pi carries 99,163 stars and 12,303 forks (GitHub API, 2026-08-30) on a repository created 2025-08-09 and pushed the day before it was read — the largest in this spoke by an order of magnitude, against KOT's v1.0.0 tagged nine days earlier. Stars measure attention rather than quality and the spoke's standing caveat applies, but the extensible-refusal position is not a fringe one and the built-in-refusal position has no comparable following yet.

A fork the corpus already held, now with its parent. oh-my-pi was ingested on 2026-06-01 as "a fork of Mario Zechner's Pi" and placed at the feature-rich end of the harness spectrum against claw-code. With Pi paged, the pair stops being two unrelated projects on an axis and becomes one codebase forked in the direction its author refused to take it — Pi ships no subagents, oh-my-pi ships isolated parallel workers returning structured JSON; Pi ships no permission gates, oh-my-pi wires in an IDE. That is the cleanest natural experiment on built-in-versus-extension this spoke has, and neither side has measured anything.

Meanwhile the surface it refuses to extend is itself a copy. KOT's Agent tool documents subagent_type, general-purpose, sonnet/opus/haiku aliases, effort from off to max, isolation: worktree|remote with remote unavailable, and <task-notification> results — Claude Code's API, field for field, a dead parameter included. Against mimiclaw, nemoclaw and nanoclaw reimplementing openclaw, the pattern is now hard to miss: the harness API is becoming a de-facto interface that clones adopt whole, and a project can reject three of the ecosystem's standards while inheriting its tool signatures verbatim.

Somebody counted the skills ecosystem (2026-08-23)

The spoke has tracked skills for three months on vendor posts, README claims and one null experiment. attention-is-all-you-have is the first source to crawl the thing: 56,804 SKILL.md directories across 1,133 public repositories, 56,245 bodies fetched. Four numbers change what can be said here.

Skills became a provider integration channel, and it is now measurable. 21 major-provider organizations publish 958 first-party skills — AWS 138, Anthropic's own collections 379, Google 92, Sentry 80, Elastic 70 — with 79% of the provider-product skills naming that provider's own CLI and 60% carrying executable shell. The corpus's own reading of perplexity-api-platform-skills — a vendor teaching every agent to drive its product with markdown instead of an MCP server — turns out to be the general case, not an example.

The portability claim was half true. One format, 54 distinct project-level skills directories across 75 agents, 58 home-directory locations, and a community CLI that installs once and symlinks everywhere. agentskills-spec standardized what a skill is and left where it goes to each vendor, and the fragmentation this synthesis kept describing qualitatively (ponytail wiring 15 hosts, renwei-writing's Cola-specific directory) has a count now.

Residency is the scarce thing, and the ecosystem is bidding for it. An installed skill's description costs 50–280 tokens on every message, and buys exactly one thing: firing unasked. The authors bound the reliable capacity at fewer than a hundred slots per agent — argued from the literature, not measured, and flagged as such by them. Against 56,804 published skills, the ratio is the point regardless of where the true number sits. Two second-order effects follow, and both are already visible in artifacts this spoke holds. Authors pad descriptions into bids (Stripe's flagship skill: ~150 words of trigger conditions, ~20× a quiet description), and teams defect to AGENTS.md because always-loaded beats a trigger lottery. The mechanism that matters most: dilution means the channel degrades exactly as adoption succeeds — the more skills get installed, the worse each one fires. Every "install our 2,003 skills" artifact here (agentic-awesome-skills, ecc, superpowers) is under that ceiling.

And it lands the same week as the opposite conclusion. KOT read the same install layer and deleted skills altogether, on the argument that the registry is the only thing they add. This paper reads it and keeps skills while deleting the install: content, persistence and triggering are three functions bundled into one switch, and only triggering needs the prompt (@skills). Two independent 2026-08 sources agree the install lifecycle is the broken part; they disagree on whether the artifact survives it. That is the sharpest live disagreement in the spoke, and it is testable — the question is whether a fetched-at-point-of-use skill outperforms the same text pasted into a prompt, which nobody has run.

The standing caution applies to the remedy and not to the count: SylphAI sells the agent and hosts the hub. The crawl is the contribution; the protocol is a product.

The prompt directory converts (2026-08-25)

prompts-chat is the 2022 prompt directory — fatih-kadir-akin's awesome-chatgpt-prompts, 167.9k stars, the artifact that named the genre — and in 2026 it carries 66 Skills, 13 Workflows, an MCP server and a Claude Code plugin. Its definition of a skill is agentskills-spec's, written by someone who arrived from the other side, and its skills are indexed by the system they drive (Supabase, Stripe, GitHub, Termux) rather than the persona they request. That is the distance between the two sections of one site.

The number to hold is 66 against agentic-awesome-skills's 2,003, from an audience roughly thirty times larger. Read next to the residency ceiling above, it cuts against the assumption that skill supply is unbounded: the largest non-specialist prompt community on the internet produces skills two orders of magnitude slower than a specialist catalogue does. Either authoring a skill is genuinely much harder than writing a prompt, or the submission path here still belongs to the old artifact. The source cannot separate those, and neither can the corpus yet — but if the first reading holds, the "fewer than a hundred slots" ceiling binds much later than 56,804 published skills implies, because most published skills come from few authors.

The CC0 licence on the prompt data is the other durable fact, and it is the one nothing here measures: a public-domain corpus of this size is a plausible upstream for training and eval sets, and it appears inside other tools with no attribution trail by design.

The harness moves onto the device, and the guardrail becomes a number (2026-08-30)

seekerclaw arrived by Telegram and lands on two of this spoke's threads at once.

First, it breaks a split this corpus had drawn too coarsely. mobile-device-agent was written from one source and described the shape as device-plus-operator: a helper on the phone exposing control, and a runtime elsewhere holding the loop, the model and the tools. SeekerClaw runs the runtime on the phone — a Node.js foreground service with a heartbeat and a cron timer — while still calling a remote model. So the observation that made those frameworks model-agnostic survives and the architecture around it does not: the model is remote, the harness need not be. The consequence is not academic. A resident harness has no session to start, which is why its interface is a chat channel rather than a CLI, and why cron and persistent memory are core modules rather than add-ons. It is the agentic-tooling thesis on unfamiliar hardware — the value is in the wrapper, and the wrapper turns out to be portable to a phone.

Second, it supplies the guardrail case the corpus was missing. agent-guardrails organizes bounds by reversibility, and gemini-managed-agents-hooks added budget as a second axis in tokens. An irreversible on-chain transaction is where both meet: nothing can be undone, and confirming every action would defeat the point of an agent that runs unattended. The answer taken is neither — cap the loss and act freely underneath it. Per-transaction and daily limits in USDC and SOL, preflighted before any send, burner key signing silently under cap, main-wallet popup over. And a split by effect rather than size: for x402 payments a GET settles silently under cap while a POST always asks.

That last detail is the generalizable one, and it states the reversibility principle better than either bound does alone: reads are bounded by money, writes are bounded by consent. What the design concedes, and says so on its own README, is that it makes nothing reversible — it makes the worst case a number the principal chose in advance.

What it does not have is any measurement, which is the standing condition of this corner. mobilerun's AndroidWorld lead is its own vendor's run; SeekerClaw publishes no benchmark at all. Two sources, a hackathon judgment, and nobody outside either project has scored anything.

The failure distribution existed all along (quality cycle, 2026-08-30)

agent-failure-localization has carried, since 2026-08-06, that "nobody has published frequencies" for agent failures. One search during the absence-claim drain found two studies, and the older predates the claim by seventeen months.

MAST (NeurIPS 2025) publishes the distribution with the methodology that makes it a measurement — 150 expert-annotated traces at κ = 0.88, then 1,600+ through a validated LLM judge, across seven frameworks and four models. System design issues 44.2%, inter-agent misalignment 32.3%, task verification the remainder.

And the shape corroborates this spoke's central claim from the failure side. Step repetition (15.7%) and unawareness of termination conditions (12.4%) are 28% of all failures between them, and neither is a reasoning deficit — both are missing loop control. Disobeying the task specification is 11.8% and disobeying a role specification is 1.5%. So the losses are overwhelmingly in the scaffold, not in the instructions or the model, which is structure over capability stated as a defect distribution rather than as a benchmark spread.

coding-agent-misalignment supplies the denominator at production scale — 20,574 sessions, 1,639 repositories — and one trend worth watching: overall misalignment falls over time while constraint violations and inaccurate self-reporting rise proportionally. As agents get better, what remains is the agent ignoring a stated rule and misreporting what it did. That is corrosive in a specific way, because 91.49% of misalignments need a human to catch and correct them, and both growing categories are the ones a human cannot easily audit.

What is still open is narrower than before and unchanged in kind: neither study varies the harness as the independent variable, so the failure distribution across scaffolds — the thing growth edge 12 wants — is still unmeasured.

The harness thesis gets a formal statement (research pass, 2026-08-30)

This spoke has been assembling "the harness matters more than the model" out of five sources — scaffold-effects-gaia, claw-swe-bench, harness-bench, ddr-bench, confucius-code-agent — each measuring one cell. harness-disclosure (Zhang et al., arXiv 2605.23950, T1) states it as a proposition that can be false.

The Binding Constraint Thesis: with HV(M) the variance of benchmark score over harnesses and MV(H) the variance over models, HV > MV for long-horizon tasks among comparable frontier models. Two quantities and a claim about which is larger, rather than a slogan.

It also supplies the largest harness effect the corpus holds — ~48 pp single-model swing across scaffolds on HAL's SWE-bench Verified Mini, against harness-bench's 23.8 pp — and names the consequence that makes this more than noise: model ranking reversal, the same model placing above or below a competitor depending on the scaffold.

The reframing is the durable part. The inference framing treats an agent as a model in a while-loop and attributes the score to the model. The closed-loop framing makes the harness a controller with stability, context drift and control lag, and the model an open-loop policy it governs. That explains the magnitude rather than just reporting it: controller properties compound over a long horizon in a way a per-token policy difference does not.

Edge 12 half-closes and its residue sharpens. The paper argues that a factorial protocol with reported variance components is necessary, and aggregates other people's single-run numbers to argue it. Nobody has run it. The corpus now holds the specification of the missing experiment and still not the experiment — which is a better position than before, because the successor edge can now name a protocol instead of a wish.

The marketing pack learns to measure, and the funnel becomes the pattern (2026-08-31)

geo-seo-claude (zubair-trabzada, MIT, 9,877★ / 1,531 forks, routed 2026-08-31) is the fifth marketing/SEO skill pack here and the second by the author of ai-marketing-claude. Set beside his earlier one it does something the spoke has not seen: it revises the design choice this synthesis criticised, in the direction of measuring.

The verification thread's sharpest instance was ai-marketing-claude — 4 Python scripts against agentic-seo-skill's 89 evidence collectors, emitting a scored client PDF that rested on no checkable observation. Same author, five and a half months later: six scripts, four of which fetch facts rather than form impressions — page retrieval and parsing, a citability score computed from word counts, pronoun density, sentence length and counts of percentages and dollar figures, a robots.txt read for 14+ named AI crawlers with fixed deductions per blocked agent, and llms.txt validation. The composite score now hangs off observations. A skill pack in this corpus moved along the verification axis on its own, without a benchmark telling it to.

It also publishes what ai-marketing-claude withheld — a 16 KB scoring methodology with per-point criteria — and then does something rarer than either:

"These weights are not derived from a controlled study and are subject to change as AI search platforms evolve."

That is a third posture toward the unverifiable score, beside ai-marketing-claude's silence and claude-seo's output contract forcing a "how would we know this failed?" line into every recommendation. Publish the arithmetic, label it opinion. Of the three it is the cheapest for a reader to audit, and it is the only one that concedes the gap rather than engineering around it.

The ceiling did not move. Every input is a property of the site; none is a measurement of whether an AI system cited it. The score predicts citability and nothing checks the prediction — the same wall claude-seo hit ("nothing measures whether the audits improve rankings"). So the pack got better at observing its inputs and no better at evaluating its output, which is exactly the distinction skillsbench and verification-loops-skills have been drawing. Measuring what you can reach is not the same as knowing whether you were right.

A found defect, and what finding it cost. Reading the tree rather than the README turned up a headline feature that is not wired up: /geo report-pdf needs templates/geo-report-template.html, that file is in the repository, and install.sh never copies the directory — it installs geo/, skills/, agents/, scripts/, schema/ and hooks/ and verifies the schema directory but not this one. The skill also hardcodes /Applications/Google Chrome.app/ in a repository shipping a Windows installer, and the README still documents a ReportLab script that the skill itself (v2.0.0, "No ReportLab") replaced. The finding took reading three files. Nothing in 9,877 stars or 1,531 forks surfaces it, which is agentic-awesome-skills's point about star counts arriving as a concrete case rather than an argument.

The Skool funnel is now a pattern. claude-seo was recorded as the spoke's first two-tier open/paid cadence — MIT repo plus a members-only mirror, run by agrici-daniel. This pack points its repository homepage at a Skool community and closes the README by naming the rate the free tool is meant to win: "GEO agencies charge $2K–$12K/month. This tool does the audit. The community teaches you how to sell it." No gated code here, so the structures differ — one sells early access to the same pack, the other sells the sales training. But two of the three largest SEO packs in this spoke, by unconnected authors, are the top of a paid funnel on the same platform. The pack is not the product. That reframes the "service business in a box" reading on ai-marketing-claude: the box is free because the box is the advertisement.

One correction to carry forward. ai-marketing-claude's "nine minutes, then nothing" is a fact about that repository, not about its author — the same person has maintained this one for six months while the other sat untouched, both accumulating stars. Whenever this spoke reads repository metadata as evidence, the abandonment signal attaches to the artifact and not to the builder.

Unmeasured, still. Nothing has been run. Five of the six statistics in the README's opening table carry no citation anywhere in the repository; the sixth traces to a named Ahrefs study of 75,000 brands (YouTube presence correlating 0.737 with AI citations against 0.266 for backlinks), which is a real source buried one level below the headline using it. Sourcing detail belongs to ../search-marketing-wiki, where the GEO claims live; what belongs here is that the pack's citability rubric independently rediscovers the three levers geo-paper actually measured — statistics, quotations, cited sources — and never cites the paper.

The split gets formalized a third time, and acquires a clock (2026-08-31)

long-horizon-agents-survey (Dong et al., RUC-NLPIR, July 2026 preprint, ~730-paper reading list, 1,015★) writes this spoke's central question as a decomposition:

Agent = π_θ ⊕ ℋ

A base policy coupled to a surrounding harness. That is the third independent formalization of the model/harness split in roughly two months, and the three do different jobs: harness-disclosure measures it (HV > MV, ~48 pp swing, ranking reversal), model-or-harness-taxonomy diagnoses across it (which component broke, therefore which repair), this survey organizes the field by it. None cites the others.

Worth stating plainly, on the day the hub also corrected itself in the opposite direction: this is genuine convergence. Three groups, three institutions, three purposes, no shared ancestor. Compare research-wiki/llm-wiki, where four apparent independent arrivals turned out to descend from one gist. The test is whether the members owe each other anything, and here they do not.

The new thing is a dynamic, and it dates our best number. The survey's organizing claim is that externalized harness engineering and internalized model optimization co-evolve — "capabilities first implemented explicitly in the harness may later be internalized into the model policy, while stronger policies in turn enable more capable harnesses."

Read against the Binding Constraint Thesis, that is a clock. HV > MV is largest exactly where the harness compensates for something the policy cannot yet do; the co-evolution account says such compensation gets trained in. So ~48 pp is a 2026 reading, not a constant, and this synthesis has been treating a measurement as a standing conclusion. Not a contradiction — one is a measurement, the other a trajectory, and the survey measures nothing — but a condition the harness thread should carry from here on. The deciding experiment is the one harness-disclosure already specified (factorial model × harness, reported variance components), run at two points in time. Edge 12 gains a second dimension rather than closing further.

Two threads turn out to be rungs of one ladder. The survey's nested levels — H1 intra-context (minutes) ⊂ H2 cross-context across windows and sessions (hours–days) ⊂ H3 cross-task open-ended stream, with capabilities C1 ⊂ C2 ⊂ C3 — make agent-memory the definition of H2 rather than a feature of interest: a task outliving its context window cannot be done without cross-context state. The same move puts self-evolution at H3. The memory corner and the self-improvement corner have been filed here as separate enthusiasms; they are the second and third rungs of one requirement. Paged as long-horizon-agency.

And a periodization that dates the corpus. Prompt engineering (2020–2023) → context engineering (2023–2025) → runtime harnesses (2025–present). Nearly everything this spoke holds is Stage III, which is worth knowing about our own sampling.

What the source is not. A preprint, not peer-reviewed, and a survey measures nothing — every figure in it is relayed, including the Figure 1 claim that agent time horizons double every few months, which is METR's (arXiv 2503.14499) and which this wiki holds only as a row label in beyond-pass-at-1. The horizon axis the whole H1/H2/H3 ladder hangs on rests on one external measurement nobody here has read. New edge: ingest METR.

Pillar II is not ours. Agentic RL, on-policy distillation, mid-training, data and environment synthesis — train-time work, ../machine-learning-wiki's subject by the line the two spokes were split on. The survey is the first source here to make that split a research program rather than a filing convention, and its co-evolution claim says the two spokes' subjects are coupled, which is a better reason to cross-link them than we have had.

The word for the thing loses the thing (2026-09-01)

vibe-coding-prompt-template is a five-step workflow — deep research, PRD, tech design, AGENTS.md and agent_docs/, then a plan-approve-build loop — under a name that means the absence of all of that. MIT, 2,984 stars, 377 forks, by one author, with a npx vibeworkflow CLI that interviews the user and scaffolds the output.

The spoke has been tracking the structure-before-code trend through the tools that name themselves after it: spec-driven-development, context-driven-development, spec-kit, conductor, corbell. CDD's own launch post defines the trend against vibe coding — "jump straight to code, intent improvised in chat and lost when the session ends." Here is a project whose title is that phrase and whose content is CDD's programme, arrived at independently and stated in the same words: durable facts in files rather than one long chat, repo-owned memory over tool-side memory, plan before edit.

So the discipline is spreading faster than its vocabulary. The practitioner-facing tools argue about the method under precise names; this one carries the method to an audience that "does not need to be an experienced developer" under the name the method was coined to reject. Two readings, and the corpus does not settle between them: either the term has widened to mean "built with heavy AI help" with the discipline left unspecified, or a workflow is deliberately using the popular label as a doorway. Both predict the same thing next — that "vibe coding" stops carrying information about how code was produced. vibe-coding collects the four incompatible senses this hub already holds, across four spokes, including a project warning that its code is "entirely vibe-coded" and a foundation that bans the practice from contributions. A word doing those four jobs cannot support a policy, which is a problem for the foundation, not for the template.

What the source adds on the method itself is a separation the spoke could not make before. Every other SDD instance bundles the ordering with machinery — slash commands, delta specs, code graphs. This one is four prompts pasted into a chat tool and keeps the whole ordering, the review gate and the durable artifacts. If SDD's benefit comes from the sequence rather than the tooling, this is the cheapest possible test of it. Nobody has run that test: the repository ships no evaluation, and its evidence is four sites built by the author and his associates.

One more thing it does that the surveyed tools do not: it puts permissions and a cost ceiling in the planning document. Step 3 defines the AI surface, data boundaries, approval gates and evals; step 4 emits an agent-permissions.example.json; step 5 demands evidence — files changed, commands run, tests, unresolved risks. agent-permission-model has been a harness-configuration subject here. This makes it a design-time decision, written down before there is code to permit.

The harness looks down at the serving layer (2026-09-01)

The spoke's standing line with ../llm-inference-wiki is that harnesses consume inference and neither spoke owns the other's subject. inferoa is the first source to argue that the line is the problem. Its premise: "every loop is also an inference workload. As turns accumulate, prompt prefixes drift, cache reuse collapses, stale evidence fills context, model routing gets harder, and serving choices start to matter." So it builds the harness on the vLLM stack and exposes serving to the loop — prompt epochs and deterministic tool schemas to keep a cacheable prefix alive across iterations, bounded history and tool output, routing by cost, privacy and capability, and a /tokenmaxxing command that shows token and cost pressure inside a running session.

This is the cost half of loop-engineering, which the spoke had only ever written about as a correctness discipline. Every earlier loop source asks how the loop knows it is done and how truthful its feedback is. This one asks what the loop costs on the twentieth turn, and answers with kv-cache mechanics rather than with a token budget. The credibility comes from provenance rather than data: the author, xunzhuo, works on vLLM's routing ("Intelligent Routing @vllm-project"), so the harness is written by someone on the other side of the boundary it crosses.

And there is no evidence. A project whose entire pitch is efficiency publishes not one number. Worse for its own claim, the work stopped: 132 commits between 2026-06-08 and 2026-06-18, 119 npm versions inside those ten days, three releases on consecutive days, then eleven weeks of silence — and 3 watchers against 512 stars. Held as a design position, and as the strongest statement yet of a seam that now has a name.

Second vocabulary collision of the day. tokenmining defined itself as the inverse of "tokenmaxxing", glossed there as spending tokens freely; Inferoa puts the same word in its tagline and means token discipline. That is the shape vibe-coding took a few hours earlier with four senses across four spokes. Two independent instances in one day is not a pattern yet, and it is worth naming what would make it one: this field coins its vocabulary in public, adoption outruns definition, and the terms that describe a discipline keep getting taken as product names by the discipline itself — at which point the word can no longer sort the practice it was coined to sort. A third case gets a page.

The harness effect gets isolated to one tool, by an interested party (2026-09-06)

omp came back through Telegram as its product site rather than its repository, and the site led to The Harness Problem — the finest-grained measurement of a harness effect this spoke holds, and the only one run by someone selling the result.

What is new is the resolution. harness-disclosure states the Binding Constraint Thesis over whole harnesses; harness-bench crosses 8 models × 6 harnesses; claw-swe-bench does the same on coding. All three vary the harness as a unit. This one holds everything fixed and swaps one tool: the edit format. Sixteen models, three formats, 3 runs × 180 tasks. Average +15 points over apply_patch, ahead in 14 of 16, with Grok Code Fast 1 going 6.7% → 68.3%. If a single tool inside a harness moves a model that far, the harness/model variance comparison is not just true at the top level — it decomposes, and the decomposition points at the narrowest interfaces.

The gradient contradicts the slogan, which is why it is worth keeping. The gain concentrates in weak models and vanishes at the frontier: GPT-5.2 Codex gains 4.6 points and spends 26% more output tokens, DeepSeek V3.2 loses on both axes. "The harness matters more than the model" is therefore not uniform across the model range — on this task shape the harness is a floor-raiser, and a model already fluent in a format has nothing to recover. That is compatible with harness-disclosure's thesis (which is stated for comparable frontier models on long-horizon tasks, neither of which describes these fixtures) but it constrains how far the slogan travels, and nothing else in the corpus tests the weak end of the model range at all.

The evidence is T3 and the corpus should say so plainly. This is the tool's author benchmarking his own format against his competitors', on fixtures he generated by mutating React files and scoring against the known inverse. The code and per-run reports are published, the failures that hurt his case are reported, and it is still the maker measuring the maker. What raises it above ordinary vendor marketing is that it names the independent work — Aider's format swing (26% → 59% on GPT-4 Turbo), JetBrains' Diff-XYZ (arXiv:2510.12487, no format dominates), EDIT-Bench (arXiv:2511.04486) — and that literature supports the weak claim (format choice is a large effect) while leaving the strong one (hashline is the best format) resting entirely on his run. Both arXiv papers are now growth edges; they are the cheapest available independent check on a mechanism the spoke has started to lean on.

A second reading, on what a harness is becoming. omp's own surface has outgrown the "IDE wired in" framing this spoke gave it in June: curated cross-session memory with swappable backends, a second advisor model reading every turn of the first, a relay that puts a live session behind a shared link, sixteen internal URL schemes so a PR and a merge conflict are just paths, desktop control through the OS accessibility tree, and a native Windows build with no WSL. Against Pi, the 2026-08-30 finding still holds — the upstream ships its refusals as extensions, the fork built them all in — but the fork now carries features Pi never refused because nobody had proposed them. The two are no longer the same question answered twice, and the minimal↔batteries-included axis this spoke has been drawing since claw-code has stopped being one axis.

Skills reach the introductory course (2026-09-10)

claude-101-course is Anthropic Academy's free introduction to Claude for office work — fourteen lessons, a certificate, and no code anywhere in it. Unit two is projects, artifacts, skills.

That placement is the finding. This spoke has followed skills from a developer format through a published spec, catalogues, benchmarks and failure analyses — an engineering object throughout, argued about by people who write them. Here the same word sits between "creating with artifacts" and "connecting your tools," taught to someone who will never open a SKILL.md. A concept has crossed from tooling into product literacy, and the vendor's own beginner course is where that becomes visible.

Read against the vocabulary drift this spoke recorded on 2026-09-01 ("the word for the thing loses the thing"), the direction is worth watching rather than celebrating: the more the word travels, the less of the mechanism travels with it. The course teaches using skills, and nothing in the syllabus suggests a learner ever sees the file that makes one.

The syllabus order restates the adoption ladder from the vendor's side. Chat, then containers for work, then reach outside the chat, then role use cases — the same sequence agentic-adoption-ladder arrives at from the practitioner's side (context, off-the-shelf, custom, people). Two independent statements of the same ordering, one selling and one advising, is a firmer result than either alone.

And it is a reminder about which product this is. The deployment surface taught is the desktop app; the "agent" a Claude 101 graduate meets is a Research run with connectors attached. The agentic-coding corner that dominates this spoke is the minority product being documented at far greater depth than the majority one.

Held loosely: the lessons are behind registration, so only the curriculum was read. Nothing here says how any concept is explained, and a vendor's teaching material is marketing by construction.

The product harness does nothing at the top of the range (2026-09-14)

metr-scaffold-comparison is the first source here to run the model × harness factorial and it found the harness effect the spoke has been sizing at 23.8–48 pp to be about zero for the two strongest models: Claude Code against a bare ReAct loop is a coin flip on Opus 4.5, and Codex loses to METR's generic Triframe on GPT-5 in most resamples. METR's explanation is that the product harnesses are tuned for a human in the loop, so unattended they spend their elaborate prompting on to-do lists and on talking to nobody. Read with harness-disclosure, which argues harness variance exceeds model variance from weaker models' numbers, the two are not in contradiction but in tension: the harness effect may be largest exactly where the model is weakest, and shrink to nothing where the model no longer needs the compensation — which is long-horizon-agency's co-evolution claim stated as a measurement rather than a thesis. One time point, four cells, bootstrap uncertainty; edge 12 is half closed and its K≥5 half stands.

The loop moves to the policy over the agent (2026-09-16)

dream-rsi (Maryland / google-deepmind / Virginia, arXiv 14 Sep 2026) puts the self-improvement loop at a site this spoke had not seen: not the skills, not the harness, not the training environment, but the exploration policy that chooses which node of a discovery tree a coding agent expands next. The agent is left unchanged. The trick is that finished discovery trees are replayed as a simulator, so a candidate policy is scored off-policy for the price of a lookup rather than a rollout. Set against the spoke's other three loop sites, the pattern that holds is the one environment-evolution and SkillFlow already pointed at: the gains come from something outside the agent being curated — here the search strategy — and the headline claim is fewer generations to the same answer, not a better answer. Authors' numbers, no replication, and replay can only price paths some earlier policy already walked.

Three video skills, three licences (2026-09-17)

hypit makes the video-skill row three deep, and the row now reads as a gradient in what the agent starts from: a transcript (video-use), an empty editor (open-edit), or a finished video to clone (hypit). The technical idea in the third is word-anchored composition — captions, B-roll and effects tied to words rather than timecodes — which turns "make 100 variants" and "localise it" into reflows. The business idea is in the first sentence of the README, and it is cloning viral videos. Licences track the business: MIT, Apache-plus-shielded-binaries, and a modified Apache that forbids running the thing as a service. "Open source" on the tin, source-available in the text, and the reason is the same one open-edit's page gave for VEED — the company that publishes the skill sells the hosted version of it. The per-clip costs ($1.07–$1.15) are the vendor's examples, and the thing they price is API spend the skill routes, not the skill.

The eval platform arrives without the eval (2026-09-17)

stax is Google Labs open-sourcing the plumbing of its LLM-evaluation product: dataset store, rater workflow (code, autorater, human), version comparison, dashboard, all as a Terraform-deployed GCP stack. The docs' one-liner — ten good prompts beat vibe testing — is agent-evals' argument from a vendor. What is not in the repo or the docs is the measurement that would make an autorater trustworthy: agreement with the human raters the same platform collects. That is the number this spoke has been circling since harness-disclosure and metr-scaffold-comparison, and a platform that holds both kinds of rating is exactly where it could be produced. Ninety-eight stars and seventeen commits say this is a code drop; whether it becomes a community decides whether anyone produces it.

The environment is a real repository this time (2026-09-17)

scienceide takes environment-evolution's bet — spend the loop on the environment — and changes where difficulty comes from. Instead of synthesising tasks that a stronger model outgrows, it wraps 27 real scientific codebases in 64 environments and 2,812 tasks whose correctness is the code's own numerical outputs and physical invariants, checked by execution. The generation rule is the useful export: propose tasks by mechanical mutation, keep only those where the known-good solution passes and the broken baseline fails. The measured results split cleanly. The benchmark half is a leaderboard — Fable 5.1 67.1%, Opus 5 64.6%, Astra 63.1% on 85 hard tasks, one run each, no spread. The training half is where the paper is most careful: SFT lifts small Qwen models on held-out repair, and the RL gain (2.4× reward in 30 steps) is stated by the authors to be inside the training environment with hints and not a transfer result. Read with dream-rsi from the day before: two papers in two days, both moving the self-improvement loop off the agent, both honest that the number they report is the easy one.

The engine the model cannot overrule, and where the errors went (2026-09-20)

omega-framework is the first neuro-symbolic-agent here: a MeTTa loop on OpenCog Hyperon that suspends the LLM whenever it emits a (metta (|- ...)) command, runs NAL or PLN over an AtomSpace, and hands back atoms with (stv frequency confidence) the model can read but not recompute. The pitch is auditability — "confidence cannot be inflated by rhetoric" — and on its own terms it holds: the truth-value arithmetic is deterministic and traceable. What makes the source worth the page is that the project measured itself and published where the errors moved. On the maintainers' own agent, over 4,500 instrumented cycles, LLM-written premises were right about 55% of the time, asymmetric relations were inverted up to 16.6% of the time, and self-assigned confidence ran ~15 points high — errors the engine "cannot detect" because they are well-formed. Deduction then multiplies confidences with no floor, so a chain from c = 0.9 is under the ACT threshold by hop three, and a fabricated premise comes out stamped (stv 0.81 0.73); the doc calls this "GIGO amplification." And the single most frequent failure in the whole system is the model failing to produce a parseable s-expression at all.

Read against the rest of this spoke, three things follow. The formal layer buys exactly one property — a derived number the model cannot argue up — and pays with a new failure surface at the neural↔symbolic boundary, plus the same garbage-in problem every harness has. The action thresholds (ACT at f ≥ 0.6 ∧ c ≥ 0.5) are a permission dial keyed on the truth value of a conclusion rather than on the kind of action, which is what every agent-permission-model here gates on; whether the two are complementary is an open question on that page. And the self-improvement loop, which the disclaimer says may "modify its own skills, memory, and operational logic at runtime," produced three documented self-patches that did not work — the only negative instance self-improving-agents has, and the one with no gate at all. Every number is Omega-on-Omega, from a whitepaper the doc says the agent self-authored; there is no external comparison. Two smaller checks: "~200 lines of MeTTa" is the loop file (119 lines), the core is ~594; and the Docker image is named omegaclaw, the third framework here to borrow the suffix after openclaw and hermes-agent's claw migrate.

The agent gets its own desktop (2026-09-23)

agent-workspace-linux answers a question this spoke has asked from the browser side: when an agent uses a computer, whose computer is it? claude-browser-use leaves the browser to the developer's executor, and computer-use tools in general drive the screen the person is sitting at. This one gives the agent a hidden Xvfb desktop and a Chrome instance of its own, with a small viewer where a human can watch, pause or stop it. The same org (agent-sh, publisher of agentsys) ships the inverse tool, computer-use-linux, which drives the real desktop. So the choice between "act on my machine" and "act on a machine beside mine" is now two products from one maintainer.

The design adds a fourth position to agent-permission-model: approve the workspace once, then let a ceiling set by the developer (network, mounts, app allowlist) hold at two layers, including the daemon socket that apps inside the workspace can reach. KOT's "isolation is a property of the environment" becomes a shipped environment rather than an instruction to the operator. Two details from the source: it hides its ~86 tools behind one skill that loads schemas by phase, and without bubblewrap the isolation rules are only declared. Nothing is measured, the security policy still names 0.1.x as the supported line at v0.3.3, and the README carries an undisclosed ad for its author's inference company (avi-fenesh).

The permission model becomes a floor plan (2026-09-27)

starnet answers agent-permission-model's question — what may an agent do without asking? — with geometry instead of a prompt or a policy file: a room is a capability-scoped team, a hallway is an authorized handoff lane, a placed object is a real capability grant. Moving an agent's sprite into a room is the grant. That is a third position next to the two the spoke already holds: per-action approval (which degrades with use, agent-permission-model's 13.6%/89% split) and the sandboxed workspace agent-workspace-linux ships (approve the environment once, hold a ceiling underneath). StarNet's version is spatial and always-visible rather than a one-time approval or a background enforcement layer — the scope is wherever the agent's icon currently sits, which is legible to a human glancing at the station in a way a permission log is not, at the cost of nothing here confirming what actually stops an agent from acting outside its room.

It also names its own version of KOT's "isolation is a property of the environment" directly: "the interface must never assert state the harness cannot prove" — no simulated revenue, activity, or spend. Read next to openhuman (the spoke's other local-first Tauri multi-agent desktop, differentiated by a persistent memory tree rather than spatial scoping) and oh-my-pi/pi-coding-agent (which fight the same permission question through tool grants and refusal lists rather than a UI metaphor), the desktop-agent thread is now three different answers to "how does a human see and bound what an agent can do" — a chat log, a floor plan, and a tool list — none of them measured against the others.

Review keeps the model, and moves the queue local (2026-09-27)

jev-code-reviewer is a third position in the code-review thread stop-burning-tokens-on-code-review opened and deterministic-review-gate answered by removing the model from the hot path. Jev keeps a model on every PR — two, in fact, one to classify and one to explain — but attacks the same complaint from a different angle: the reviewer's second queue wasn't only the model's noise, it was the model's comments landing on GitHub next to the human's. Jev posts nothing to GitHub. The report lives on a local server an extension reads, P0/P1/P2 triage means only a fraction of it demands a first look, and diffs render as old-versus-new logic rather than as lines. Nothing here is measured against either prior answer — no source yet compares reviewer time across "remove the model," "keep it but triage locally," and the GitHub-Actions setup that cost $1,000 in a day — but the thread now has three shapes of the same fix: compile away the deterministic half, triage the probabilistic half, or don't let either half leave the reviewer's own machine.

The tool's own name turns out to be a citation. Its classification step runs on TypeSafe's Jev model, which ../llm-providers-wiki already documents as a vendor's self-graded launch (typesafe-ai, system-one-models-and-jev, T3, 67.8% aggregate accuracy against the vendor's own reference labels). This spoke's page is about the harness wrapped around that model, not the model's accuracy, so the two stay separate rather than duplicating each other's claims — but it is the first case here of a named model product showing up as an ingredient in someone else's tool, rather than as the subject of its own source.

Two Slack agents converge on the same shape, and the permission dial gets a fifth position (2026-09-28)

company-brain, supermemory's open-sourced Slack teammate, lands three findings against threads this synthesis already tracks, and none of them needed the same source to arrive twice.

First, agent-scope-isolation stops being one implementation's design and starts being a shape. qm and Company Brain are different teams, different stacks, five weeks apart, and both partition memory the same way — public-channel / private-channel / DM — and both make write authority follow the person asking rather than the agent holding the conversation. Two independent arrivals at the same partition is weak but real evidence this is what the problem requires, not what one product chose. The honesty gap between them is still worth keeping separate from that convergence: qm wrote a 9.9 KB SECURITY.md listing what its containment doesn't cover; Company Brain's README states the same scoping as a finished feature.

Second, agent-permission-model gets a position that isn't a point on the existing scale. Every prior entry — per-action approval, batching, no gate, one ceiling underneath — varies how often the agent is asked. Company Brain varies whose authority the action uses: a write runs under the asking user's own tool connections, and a request needing someone else's connection goes to that person as a card, not back to the agent's operator as a broader grant. That sidesteps the confirmation-fatigue number (13.6%) rather than beating it, since most of what would need a prompt elsewhere here needs no prompt at all — it also has no SECURITY.md-grade admission of what the scheme doesn't cover, which is exactly the gap qm was candid about on the isolation side.

Third, agent-memory's hosted/self-hosted axis turns out not to be one dial. Every source on that page so far tied "who runs the agent" to "who runs its memory" — cloudflare-agent-memory is hosted end to end, everything else is self-run end to end. Company Brain deploys the agent to the operator's own Cloudflare account while keeping memory on supermemory's hosted service, which means an operator can self-host every visible part of the stack and still not own the one layer this spoke has been treating as the point of self-hosting.

All three claims rest on one maker's README — 717 stars, no independent usage report, no security audit — so the honest reading is "here is a second shape, not yet a rule."

A browser control plane adds a sixth axis to the permission dial, and a fifth drift control (2026-09-28)

auto-browser is a single-maintainer MCP tool that hands an agent a real Playwright/Chromium session with a human able to take over live through noVNC. Two things about it land on existing threads rather than opening a new one.

agent-permission-model's five positions all vary how much oversight the agent gets before it acts. Auto-browser answers a different question: how would anyone know a gate that looked like it held actually held? Every governed call chains into an Ed25519-signed "witness receipt," checkable by a script that trusts nothing from the project that produced it, and the project's own public audit names safety controls that "reported success while doing nothing" and were fixed only once someone went looking. That is a record layered on top of an authorization design, not a rival to one, and it is the first source here to treat "did the gate actually fire" as a thing worth being able to prove after the fact rather than something the design is simply trusted to do.

self-improving-agents gets a fifth instance. Its experimental Convergence harness turns a verified task trace into a staged skill candidate with signed provenance; unsigned or mock-run candidates are rejected outright, and promoting a candidate out of staging stays a manual step. That puts its drift control next to zouroboros's consensus vote rather than Hermes's off-by-default review queue, which this page already flags as the design most exposed to unreviewed drift.

Both findings rest on one maintainer's README and a self-reported audit; no independent party has checked the receipt chain against a controller trying to lie, or the induced skills for quality.

Contradictions / tensions

• Adoption is not evidence — the context-file layer, measured (2026-08-03). agents-md is documented here through its own site: 60k projects, 30-odd tools reading it, Linux Foundation stewardship. context-driven-development goes further and names durable project context a discipline. governed-context-claude-code, spec-driven-development and much of the harness thread assume the same premise. context-files-ablation-paper tested it under control and found no correctness effect on either of two frontier agents, with the ablated file removed entirely scoring within 2.3pp of the file injected every turn. Both positions are kept: the convention's reach is real and well-sourced, and so is the null. What cannot survive is treating the first as evidence for the second. The narrower claim that does survive the experiment — context reduced blind full-suite test runs on the one repository whose file warned about test cost — is an operational benefit, not a quality one, and it came from a single warning rather than from conventions or architecture guidance.
• "Self-hosted" is doing two jobs — KOT (2026-08-23). The spoke has used self-hosted to mean you can run it and read it: nanoclaw wants you to fork and edit the source, mimiclaw fits on a chip you can flash, pullmd ships AGPL. KOT is self-hosted in the first sense only — the repository contains three READMEs, tool docs and prebuilt binaries, no source and no licence. That is a defensible distribution choice on its own, and it collides with the product's stated security model, which is there is none, run it in your own container. The operator is asked to supply the boundary and is given no way to inspect what is inside it. Kept as a tension because the engineering described is specific enough to be real; the point is that nothing about it can be checked, including by the people it tells to take responsibility.
• Cost vs. fidelity — pxpipe vs the reliability thread. The spoke's reliability discipline (output-grounded verification, byte-exact correctness, agent-guardrails) pushes toward not silently corrupting what the agent reads. pxpipe's image-compression cost lever does exactly that — hashes/hex IDs can be OCR'd wrong with no error raised — and, counter-intuitively, gets worse as the model gets stronger (0/15 on Opus vs 13/15 on Fable 5). So the token-cost thread and the fidelity thread pull against each other here; pxpipe mitigates by imaging only old/stable/non-byte-critical context, but the trade is real and unusual (better model → worse OCR fidelity). Contrast headroom's reversible compression, which keeps originals retrievable. Watch whether modality-arbitrage compression stays fenced to safe content or leaks into byte-critical context.
• Constitution vs containment — auto-company vs agent-guardrails. The spoke's safety line is enforcement: block lists, checkpoints on irreversible actions, containment so a bad step is recoverable (agents-never-do-alone, run-claude-code-agents-24-hours). Auto-Company runs 24/7 unattended with the limits written as prose in CLAUDE.md ("do not delete repos, do not force-push to main") while its sandbox boundary is bypassPermissions / danger-full-access on the host filesystem — and its FAQ's fix for a stalled cycle is to disable the prompts. So the wiki now holds two live positions on how autonomy is made safe: instructions the model reads, versus a boundary it cannot cross. Neither has incident data attached. The reasoning-scaffolds null result is faint evidence against the prose position — if a framing instruction doesn't measurably change reasoning, it's a thin thing to hang rm -rf on.
• Memory's unpriced range — one markdown file vs a forkable store. auto-company's consensus.md is the entire cross-cycle state of a 14-agent loop, chosen explicitly over "complex vector databases"; seekdb and zouroboros build layered, indexed, branchable agent-memory for the same continuity goal. Three orders of magnitude of machinery, no comparison between them, and the markdown pole buys a real property the other lacks (a human steers by editing one line).
• Scaffold the model or train it — openmanus's RL sibling (2026-07-26). Every layer of this spoke's thesis puts competence in the wrapper: skills, middleware, loops, memory, guardrails. The same org ships OpenManus-RL, which tunes agent LLMs with reinforcement learning (GRPO) — locating competence in the weights instead. The two aren't logically opposed (you can RL-tune a model and wrap it), but they are competing bets about where the next increment comes from, and the corpus has zero sources on the RL side against ~166 pages on the structural one. That imbalance is a real blind spot, not a resolved argument. It also sharpens the standing "does structure substitute for capability" question: the honest version has three terms now — bigger model, better harness, or a model post-trained for agent behaviour.
• Specify more vs specify less — agent-environment-design vs the spec thread (2026-08-07). The spoke's dominant answer to an unreliable agent is a better-written up-front artifact: spec-driven-development, context-driven-development, claude-md, agents-md. Zou's position from 37,000 agents is that at scale you supply infrastructure, incentives and guardrails and stop telling agents how to work, because the environment is what you optimise. Both are single-position claims about different scales, and neither has a measurement attached — but they cannot both be the general rule, and the ablation null (context-files-ablation-paper) is the only evidence in the room, weakly on the second side.
• The harness-substitutes-for-model claim, now measured three times (2026-08-08). This line used to end "watch it against future neutral benchmarks." Three have arrived and they agree: scaffold-effects-gaia (structure carries a model one tier, not two), claw-swe-bench (harness spread roughly doubles as the model weakens), and now harness-bench with frontier models in a full 8×6 factorial — "stronger model backends… exhibit lower cross-harness variance." So the wrapper's value is real and shrinks as the model improves, which prices much of this spoke's subject into model progress without zeroing it: 23.8 points still separate the best harness from the worst. The corollary the authors draw is the one to keep — agent capability should be reported at the model-harness configuration level, so a benchmark score without a named harness says little. The detail this spoke should sit with: openclaw, its most-starred harness and the centre of gravity for a dozen of its sources, scores last of six.

Cross-spoke adjacency

• ../research-wiki — parent; holds the knowledge-management / memex / llm-wiki lineage (cluster A) and formal methods (E), plus the bridge nodes above. gbrain, agent-skills, compound-engineering, and model-context-protocol are the seams between the two. Runner-up for omega-framework (2026-09-20) on the formal-methods corner: NAL and PLN are uncertain logics (truth values, revision, confidence decay), not the deductive machine-checked proving research-wiki holds under Lean — same word "inference," different tradition. The artifact is a harness and the subject is loop design, so it is paged here. ../knowledge-representation-wiki is the second adjacency: Hyperon's AtomSpace is a truth-valued hypergraph, a KR substrate that spoke does not yet page; if a source about Hyperon or MeTTa itself arrives, it belongs there, not here. Runner-up again for company-brain (2026-09-28) on the memory/PKM corner: gbrain is a personal/team knowledge base built as a self-wiring markdown graph, and Company Brain is a Slack agent whose grounding memory happens to be team knowledge too — close enough in subject that research-wiki was the second-best fit, but the dominant substance (Slack bot, MCP tool actions, a permissions graph gating writes) is this spoke's per the 2026-06-01 split, so it's paged here with the PKM angle noted on the source page rather than split.
• ../llm-inference-wiki — the mechanism layer (how models run/serve). This spoke sits above it: harnesses and skills consume inference; neither owns the other's subject. Contested from this side, 2026-09-01: inferoa is a harness whose design premise is that a long loop degrades as an inference workload — prefix-cache reuse, mutable-context growth, routing — so it exposes vllm, the router and the kv-cache to the loop deliberately. Routed here because the artifact is a harness and the subject is loop design, with the runner-up logged. If a second such source arrives, "inference-aware harness design" is a real shared corner rather than a boundary case.
• ../platform-ops-wiki — the verification-runtime seam (new, via agent-loops-verification). This spoke owns the loop + verification paradigm (loop-engineering); when verification of agent-written code requires a real running system (cloud-native behaviour, not just the artifact), it becomes a runtime/ephemeral-environment problem that platform-ops owns. Watch for sources where agent loops drive CI/CD or validate against live infrastructure. Second source on that seam, 2026-07-22: harness-agent-dlc — agents shipped through CD pipelines with eval gates, canary/OPA deploys and run tracing. Routed here because the subject is the agent lifecycle, but every mechanism it uses is platform-ops vocabulary (canary, policy-as-code, tracing, the delivery-measurement gap next to dora-metrics), so platform-ops is the logged runner-up. The cluster the seam predicted now has two sources; a third would make "verifying/governing agents against live delivery infrastructure" a real spin-out candidate rather than a shared edge. A third adjacency shows up here too: the ../ai-governance-wiki angle (ownership, asset inventory, auditable records of what an agent did) — that spoke owns the rules-and-assurance framing, this one owns the tooling that implements it.
• ../web-browsers-wiki / ../osint-wiki — the device seam (new, 2026-08-03, via mobilerun). An agentic browser's "act on my behalf" mode is the same GUI-driving problem confined to one application, and ../web-browsers-wiki owns it as a product feature; ../osint-wiki holds the profile-building agents that would be the obvious consumer of phone control. Neither owns the device layer — the accessibility bridge, the tree-vs-pixels encoding, the gesture toolset — which is why mobile-device-agent is paged here. One source deep; if phone/desktop GUI agents accumulate, this is a spin-out candidate rather than a permanent corner of agentic-tooling.
• ../foss-applications-wiki and ../game-engines-wiki — the vibe-coding seam (new, 2026-09-01). Neither spoke owns the term; both use it. One holds a project whose README discloses "this project is entirely vibe-coded" as a caveat about review, the other a foundation that bans the practice from contributions outright. The discipline vocabulary is this spoke's, so the term is paged here and linked from there — and the divergence between the four senses is a finding none of the three spokes could see alone. Runner-up again for starnet (2026-09-27): it is also open-source software an end user installs and runs locally, which is ../foss-applications-wiki's domain, but the dominant substance — capability-scoped multi-agent orchestration, permission model, chat/MCP integrations — is this spoke's, so it's paged here with the local-app angle noted rather than split.
• ../speech-audio-wiki — the voice-model market (new, 2026-08-14, via sayna). Sayna wraps Deepgram/ElevenLabs/Google/Azure STT+TTS behind one API for agentic frameworks but introduces no speech model of its own, so it's filed here by mechanism (agent I/O infrastructure) rather than there by modality. claude-to-speech is the same corner's earlier, narrower entry — one provider, one harness, output-only; Sayna is provider-agnostic, bidirectional (STT too), and runs as a standalone server rather than a plugin. Two sources now sit in this agent-I/O-for-voice slot; cross-link the provider pages there rather than duplicating them.

The seat becomes a pool (2026-10-04)

subpool adds a layer this spoke had no page for: a quota gateway between an organization's employees and the vendors' coding-agent subscriptions. It does not constrain what an agent does, which is where agent-permission-model and agent-guardrails work. It constrains who may spend which account's capacity, with per-key limits, expiry and revocation, and it keeps a visible assignment table. That is a agent-scope-isolation-style partition (many principals, one deployment), applied to billing capacity instead of memory or files. Unlike qm and company-brain, it states plainly that it never stores prompts or responses, so there is nothing to scope on the disclosure side; the open exposure is the encrypted upstream credentials it holds for every pooled account.

The design choice worth keeping is subscription first, paid API as overflow, same key. It treats a flat-rate seat as the cheap tier and metered tokens as the fallback, a cost lever that claude-code-model-router and claude-batch-toolkit reach differently (pick a cheaper model; sell latency). Whether the arrangement is allowed is not settled by the source, which tells operators to check each provider's terms; no provider page in this corpus answers it either. The adjacent omniroute and ai-gateway pages sit in ../llm-providers-wiki.

Evidence is thin: a month-old repo, 112 stars, no benchmarks or deployment reports. Recorded as a design data point, not a finding. Gap-relevance: it does not advance an open question; it opens a possible one (how much quota-governance a coding-agent fleet needs before per-seat licences stop fitting), which needs an independent source.

A 270M model gets a tool protocol, and the chaining is left to the harness (2026-10-04)

functiongemma-formatting-and-best-practices is Google's documentation for a function-calling model small enough to run on a device. What it shows is how little the model is asked to do. The protocol is six control tokens plus one <escape> token for strings, and the supported workflows are one call per query or several independent calls in one response. Chaining one tool's output into the next, and gathering parameters across turns, are listed as not trained. The page says the second needs state outside the model.

That moves the multi-step loop into the application, which is the same place agentic-coding-harness puts it for large models, only here the doc says so outright. The page also treats tool-selection failure as a description problem first: add the words users really say to the tool's description, and fine-tune only when phrasing stays indirect. That is a cheap lever next to the tool-count question in how-many-tools-should-an-agent-see.

Evidence is documentation only. No accuracy figures, no tests of the chaining claim, and Google "expects some generalization" after fine-tuning without showing it. Gap-relevance: it advances no open question here; it adds a small-model data point for tool-calling interfaces. The model-family facet is recorded in ../llm-providers-wiki (gemma-variants), not here.

Index — Agentic Tooling Wiki

Catalog of every page, grouped by schema.org @type. Spine: synthesis (thesis), log.md (history), this file (catalog). Some wiki-links resolve to bridge nodes in the sibling ../research-wiki (intentional cross-wiki links).

DefinedTerm (concepts / mechanisms)

• agentic-tooling — umbrella: the tools wrapped around a model to build/run LLM agents; structure as the lever · domain

• agentic-coding-harness — the scaffolding around a code-writing model ("everything else"); structure as capability · mechanism

• agent-edit-format — how an agent names the lines it wants to change: apply_patch (Codex), str_replace (claude-code, Gemini), a fine-tuned apply model (Cursor), or content-hash anchors (omp's hashline). The narrowest interface in a harness and one of the largest levers on whether a model succeeds — every format but hashline makes the model retype content it already read · mechanism

• vibe-coding — the term four spokes use for four incompatible things: the artifact-free pole CDD is defined against, a project's own warning that its code got less review, a contribution mode a foundation bans, and the name of a disciplined five-step workflow. A word that can no longer support the policy written on it · term

• agent-permission-model — how a harness decides what an agent may do without asking; the one dial that limits the agent rather than extending it. Per-action human approval caught 13.6% of harmful actions — a control that degrades the more the agent is used. Five positions now; the newest (company-brain) borrows the asking user's own authority per action instead of gating the agent's · mechanism

• agentskills-spec — agentskills.io open cross-vendor skills standard + progressive disclosure; the format is universal but 75 agents keep skills in 54 different directories · standard

• atskills-protocol — the @skills delivery layer (sylphai, 2026-08): a path is the identity and reading it is using it, so nothing installs. Splits install's three bundled jobs — content, persistence, auto-triggering — into a reference, a :save that vendors a git-tracked copy, and an :install that adds one .gitignore-style line, the only thing costing prompt residency. No manifest, lockfile, versioning or per-agent directory; SKILL.md unchanged. Implemented and shipped; no adoption outside its authors yet · standard

• agent-evals — scored test runs over a dataset (not one pass/fail) as the answer to agent nondeterminism; eval score wired into the delivery pipeline as a pass-fail gate, firing on model changes too; consolidates the corpus's trust-no-eval tension · practice

• skill-induced-failure — a task an agent would have completed, or completed cheaper, without the skill it loaded: functional failure (skill run fails, reference run passes) vs efficiency regression (both pass, skill run costs 2×+). Loading an irrelevant skill is 2 of 125 functional failures — the harm comes from on-topic skills whose examples and defaults get followed as requirements · failure-mode

• agent-failure-localization — deciding which component of an agent system caused a failure, so you know which repair to attempt: interaction edge + fault side, root-caused to the earliest unrecovered failure; the diagnostic complement to agent-evals' regression score · mechanism

• agent-scope-isolation — one deployment, many principals: per-person and per-room memory, files, keychain view, permissions, skills, crons and durable sandbox; enforceable for access, not for disclosure. Two independent Slack agents (qm, company-brain) now converge on the same public/private/DM partition · architecture

• agent-specific-task-difficulty — the same task is trivial for one agent and impossible for another (Spearman ρ=0.75, but ~40% of tasks borderline for only one agent), so the informative band is per-agent and ablations must screen per agent; plus the portability trap that turn counts mean different things across harnesses · methodology

• constraint-evading-behavior — agents satisfy a check's letter while defeating its purpose (weaken the planned type, sentinel-stuff an ADT, suppress the warning) — specification-gaming at the developer-guardrail level; the counterforce to the verification thread (a gate you can cheese isn't a gate) · failure-mode

• agent-orchestration — orchestrator → parallel-subagent fan-out; the execution-time engine · mechanism

• graph-based-agent-workflow — agent app as a directed graph of nodes+edges run by a scheduler; the declarative "a graph is an agent" model (ADK Go 2.0) · mechanism

• spec-driven-development — agree the spec/context before the agent codes; process-as-markdown · practice

• context-driven-development — CDD: SDD widened to context + spec before code; project context as a durable, reviewed artifact (Google/Conductor) · source · T1 · practice

• durable-agents — long-running agents that pause/resume/survive crashes via state machines + persistent sessions · mechanism

• self-improving-agents — agents that author/refine their own skills + accumulate memory (the "growth" axis) · mechanism

• agent-middleware — the composable structural unit of a harness: single-concern pieces hooking the agent loop · mechanism

• agent-guardrails — autonomy boundaries: bound agents by reversibility/recovery cost; human checkpoints on irreversible actions · practice

• deterministic-review-gate — compile the checkable half of a review guideline into linters and keep the model for the rest; the model runs once, at rule-generation time, not on every agent-authored commit (27s sweep vs a 10–30 min model review) · mechanism

• agents-md — open project-context convention (AGENTS.md); cross-tool (60k+ repos, Linux Foundation) · source · standard

• claude-md — Claude Code's per-project instruction file (loaded every session); the Claude-native sibling of agents-md; small+universal+hand-authored is the discipline · convention

• agent-memory — the persistent state + retrievable-knowledge substrate beneath durability/self-improvement; the storage layer of its own. Four poles now, on two axes: weight (DB → pgvector-over-MCP → markdown-over-hooks) and hosted vs self-hosted (cloudflare-agent-memory). company-brain shows the axis isn't one dial: a self-hosted agent can still depend on a hosted third-party memory store (supermemory) · mechanism

• long-horizon-agency — the organizing capability: persistent iteration across many interdependent steps, formalized as Agent = π_θ ⊕ ℋ with three nested levels (H1 intra-context ⊂ H2 cross-context ⊂ H3 cross-task) and their capabilities (C1 ⊂ C2 ⊂ C3). Makes agent-memory the definition of H2 rather than a feature, and self-evolution the definition of H3 · concept

• loop-engineering — designing the agent's iterative loop (goal + stop condition + feedback) instead of a prompt; the Ralph technique generalized; relocates the bottleneck to verification · practice

• agentic-resource-discovery — ARD: cross-org capability discovery (ai-catalog.json + registries); the discovery edge of the interop stack, indexing MCP/A2A; Google→Linux Foundation · source · T1 · standard

• effort-level — harness control for how much work the agent does (files/tools/steps/verification), orthogonal to model choice; effort moves token-generation, model doesn't (Claude Code) · mechanism

• context-rot — degradation of output as context grows/accretes cruft; intrinsic (attention/U-curve/lost-in-the-middle) vs content (stale-material accumulation) rot; the why under the token-budget corner, reframed cost→quality; governed via curate/offload/reset · mechanism

• text-first-agent-design — don't hand the agent the surface, hand it a derived representation chosen for meaning-per-token (accessibility tree / transcript / text index) and touch the raw medium only at decision points; pxpipe is the deliberate inverse where no structured description exists · principle

• mobile-device-agent — an LLM agent whose tool surface is a phone: taps/swipes/typing driven from the OS accessibility tree (semantics, ~500× cheaper) with screenshots as the vision fallback; device-side Portal + operator-side runtime; the spoke's first non-repo/browser/chat surface · mechanism

• reasoning-scaffolds — cognitive skills (frameworks/personas prescribing how to think) vs capability skills (what an agent can do) vs output-shape skills (constraining the artifact, added 2026-07-28); the first layer of the skills claim with measured — and negative — evidence · mechanism

• agent-environment-design — at scale you stop tuning the agent and tune the space it works in: supply infrastructure, incentives and guardrails, drop the instructions, and optimise the environment as the object; the first argument here for removing specification rather than adding it · principle

• generative-ui — a model emitting an interface instead of prose; the corner's design axis is what does the model actually emit — real code contained by a WASM sandbox (arrow-js), a restricted DSL contained by grammar (openui), or an undisclosed artifact inside the vendor's own app (sheets-canvas, where enclosure replaces containment). The new property in 2026 is binding: generated UI that is bidirectional, persistent and multi-user is an application, not an answer · mechanism

• agent-framework — the library layer you build an agent with (orchestration, memory, tools, multi-agent), as against the harness you run; paged 2026-08-10 with the corpus's first stated comparison axes — language, abstraction level, specialization, production posture, multi-agent support · layer

• prompt-optimization — fitting the prompt instead of writing it: a program, examples and a metric, and a search that rewrites instructions and demonstrations until the score stops moving. Five families by what the search may move (demonstrations · instructions · reflective evolution · textual gradients · prompt+weights). The one corner where a number is definitionally unavoidable — and the number is measured against its own seed prompt, not against a human · mechanism

• neuro-symbolic-agent — an agent loop where the LLM writes premises and picks rules but a formal engine (NAL/PLN) owns the truth-value math it cannot overrule; one instance, and its own numbers put the failure upstream of the engine (~55% premise accuracy, +15pt confidence) and at the parse boundary, not inside it · mechanism

• cache-aware-model-routing — a provider's prompt cache is scoped to one model, so switching models mid-conversation pays to rewrite the cache instead of reading it; a downgrade only pays off through output tokens and the rest of a long loop, never through the switch itself. The qualification tokenmining's "~60% cost cut from routing" is missing for a cache-heavy harness · mechanism

SoftwareSourceCode (sources)

• subpool — gesta-run, Apache-2.0, Go + React + PostgreSQL, 112★ / 12 forks, created 2026-09-02, v0.2.0 (2026-09-29): self-hosted gateway that pools a company's Codex, GitHub Copilot and OpenAI-compatible accounts behind one OpenAI-compatible endpoint, with per-employee keys, rate limits, expiry/revocation, subscription-first fallback to API accounts, and encrypted upstream credentials. Governs the person-to-vendor edge, not the agent's actions. A month old; nothing measured, and the README defers the question of sharing seats to each provider's terms · source · T1 (design only) · github.com

• company-brain — supermemory, Apache-2.0, TypeScript, 717★/105 forks: open-sourced Slack teammate agent, formerly a paid product with thousands of users, now a one-click deploy to the user's own Cloudflare account (Workers/Durable Objects/D1) with memory kept on supermemory's hosted service. Memory scoped as a permissions graph (public/private-channel/DM); tool writes run under the asking user's own connections, with an approve/deny card when a teammate's tool is needed — a second data point for agent-scope-isolation after qm, and a new position on agent-permission-model. MCP integrations (GitHub, Linear, Notion, Google Workspace); sandbox (QuickJS + Cloudflare container/Daytona); scheduled digests; skills. No independent usage evidence, README claims only · source · T1 · github.com

• jev-code-reviewer — egma-ai, MIT, 81★/1 fork: local CLI + agent skill + Chrome extension that reviews a coding agent's own PRs by behavior, not diff, and is named after TypeSafe's Jev model (system-one-models-and-jev), which classifies each change unit P0/P1/P2 while OpenAI writes the old/new-logic prose; only P0 shows by default. No hosted backend, posts nothing to GitHub; keeps the model in the loop (unlike deterministic-review-gate) but triages so most of the diff never needs reading · source · T1 (design) · github.com

• claude-code-model-router — the curator's own local HTTP proxy (~400 lines, httpx) in front of claude-code: a Haiku classifier picks haiku/sonnet/opus per prompt, and the downgrade policy accounts for what a prompt-cache rewrite costs on a model switch. Also reverse-engineers undocumented Claude Code request shape (system-role folding, cache breakpoint on the last message, per-model max_tokens/thinking/effort support). Self-authored build notes, one device, a few dozen requests · source · T3 (self-run measurements) · no url

• agent-workspace-linux — agent-sh, MIT, Rust, 111★, v0.3.3 (2026-09-19): a hidden Xvfb desktop + workspace-owned Chrome an agent drives over MCP without touching the user's screen or browser, with a GPUI viewer for pause/read-only/stop. Permission is layered: host approval by default, or a developer ceiling (network/mounts/app allowlist) enforced at the MCP and the daemon socket; bubblewrap does the isolation and is optional. ~86 tools behind one phase-routing skill. Nothing measured; SECURITY.md still names 0.1.x; README ad for the author's own inference company · source · T1 (design only) · github.com

• omega-framework — singularitynet's neuro-symbolic agent in MeTTa on OpenCog Hyperon (Apache-2.0, 135★ / 66 forks, created 2026-04-02, v0.1.19, pushed 2026-09-18): a tail-recursive loop that suspends the LLM whenever it emits (metta (|- ...)), runs NAL/PLN over an AtomSpace, and injects (stv f c) atoms back as data; ACT/HYPOTHESIZE/IGNORE thresholds gate on truth value. Its failure-modes doc, measured on the maintainers' own agent over 4,500+ cycles, is the point: LLM premises ~55% right, +15pt overconfident, deduction below the ACT line by hop three ("GIGO amplification"), the most common failure a malformed s-expression, and three self-patches that all failed. "~200 lines" is the loop (119); the core is ~594. Docker image is named omegaclaw · source · T1 (first-party; every number self-measured) · github.com/singnet

• claude-batch-toolkit — S2 (s2-streamstore), Shell+Python, README says MIT (GitHub detects no licence file), 158★ / 7 forks / 1 open issue, created 2026-02-09, last pushed 2026-03-09 — a four-part add-on (MCP server + /batchy skill + status line + jobs registry) that posts slow claude-code work to Anthropic's batch endpoint at half price, ~1h typical / 24h ceiling. The spoke's only cost lever that leaves the token count alone and sells the latency instead. Refuses a daemon: the status bar forks a poll at most once per 60s. Vertex AI is a second backend for submitting but is not background-polled. Six months stale, so its cost table quotes Opus 4 at $15/$75 and defaults to claude-opus-4-6 — the 50% ratio holds, the absolute numbers don't (claude-message-batches-api). Nothing measured · source · T1 · github.com

• inferoa — xunzhuo ("Intelligent Routing @vllm-project | Open Source & AI @AMD") under the Agentic Intelligence Lab org, Apache-2.0, TypeScript, 512★ / 87 forks / 48 open issues / 3 watchers, 132 commits (128 the author's), read 2026-09-01: "Inference-native Tokenmaxxing Agent Harness for Loop Engineering" — a TUI harness built on vLLM Engine / Omni / Semantic Router that treats a long loop as an inference workload and exposes serving to it (prompt epochs and deterministic tool schemas to protect cacheable prefixes, bounded history and tool output, routing by cost/privacy/capability, a /tokenmaxxing pressure view). /loop names Ralph's completion promise completion evidence. The first source to argue the harness/serving boundary is itself the problem. No benchmarks of any kind, and the work stopped: 119 npm versions in ten days to 2026-06-18, silent since. Uses "tokenmaxxing" to mean the opposite of tokenmining's gloss · source · T1 (design only — nothing measured) · github.com

• vibe-coding-prompt-template — Alp Yalay (KhazP), MIT, 2,984★ / 377 forks / 0 open issues, created 2025-04-14, pushed 2026-08-21, read 2026-09-01: five steps from idea to MVP — deep research → PRD → tech design (pasted into any chat tool, no repo) → AGENTS.md + agent_docs/ → a plan-approve-build loop, priced at 2–4 hours, with npx vibeworkflow to drive steps 1–4 by interview. SDD's ordering with almost none of its machinery, and the first instance here aimed at people who "do not need to be an experienced developer." Its name is the practice CDD was defined against (see vibe-coding). States the agents-md hub-and-spoke rule outright — one contract, vendor files as "concise tool-specific adapters" — and puts permissions, evals and a cost ceiling in the planning document. No evaluation of any kind; the evidence is four sites built by the author · source · T1 (efficacy claims are the author's) · github.com

• seekerclaw — sepivip, 299★/71 forks, MIT, Android 14+, winner of the Solana Mobile Hackathon (April 2026): an LLM agent that runs on the phone as a foreground service — Node.js (~24k lines, 50+ modules) inside a Kotlin/Compose app (~27k lines), 64 tools across 13 modules, 22 bundled + 35+ partner skills, MCP over Streamable HTTP, driven through Telegram or Discord. Inverts mobile-device-agent's device/brain split: the harness is local, the model remote. Its guardrail is a currency cap — per-tx and daily USDC/SOL limits preflighted before an irreversible Solana transaction, silent under cap, wallet popup over · source · T1 (hackathon win and "first on-device agent that can transact" are maker claims) · github.com

• agtx — fynn-fluegge, 1.25k★/111 forks, Apache-2.0, Rust, v0.2.6: a kanban TUI running several coding agents in parallel, worktree + tmux window per task, with a different vendor's harness per phase (Gemini research → Claude implement → Codex review) and ten swappable workflow plugins. Its experimental orchestrator drives the board over MCP, diagnoses stuck tasks by reading the tmux pane, and escalates to the human as a tool call. Ships a SWE-bench Lite runner with published cost-per-run results — n=1 per arm, worktrees disabled, author's own tool, so an instrument rather than a result · source · T1 (benchmark numbers T3) · github.com

• dspy — Stanford NLP/omar-khattab, 37.5k★/3.2k forks, MIT, 406 contributors, v3.3.0 (2026-08-03): "programming—not prompting—language models" — signatures, modules, and thirteen optimizers that fit the prompt to a metric. Four peer-reviewed papers behind it (DSP 2022 → DSPy/ICLR 2024 → MIPRO → GEPA). Cited 14× here across five pages before it was paged. Absent from both agent-framework censuses — the toolkit files it with the prompt compressors · source · T1 · github.com

• nanoclaw — a rewrite of OpenClaw argued as a criticism of it (MIT, TypeScript, 30,570★ / 12,841 forks, created 2026-01-31): security by Linux container per agent group rather than application-level allowlists, credentials held outside the agent in OneCLI's Agent Vault, and a codebase kept small so Claude Code can safely rewrite your fork — configuration rejected outright, channels and providers installed per-fork as skills off separate branches. Its 0.42 forks/stars against OpenClaw's 0.21 is the fork-first model showing up in the numbers. The half-million-lines charge against OpenClaw is its own count, unverified · source · T1 · github.com/nanocoai

• deepseek-harness — DeepSeek AI's agent harness dsh (MIT, TypeScript, 37,128★ / 2,869 forks on its first day, 2026-08-13): everything is a plugin on cordis — the agent loop, tool registry, model adapter and session log are each one replaceable row in a tree composed from profiles and bundles, with no privileged core. ~50 packages (MCP, LSP, ACP, sandbox/e2b, subagent, skills, compaction), a multi-provider LLM adapter beside the DeepSeek-official one, and the runtime invariant "model-visible means logged". Developer preview; BENCHMARK.md contains no numbers · source · T1 · github.com/deepseek-ai

• agentkot — KOT by Loqira Labs (2026-08-20, v1.0.0, 4★/0 forks, no licence): a one-executable harness whose design argument is three refusals — no permission gate ("There is no security, and there will not be"), no skills subsystem, no MCP (replaced by a cli-wrapper that types any CLI). Positive claim: provider is a per-agent role — lead/architect/researcher split across Anthropic/OpenAI/DeepSeek per spawn, per teammate and per pipeline step — over the corpus's widest child taxonomy (sub-agent · 12h delegate · mailed teammate · restart-surviving TOML pipeline DAG with an until check-command gate). Its Agent API copies claude-code's field for field, dead remote parameter included. Binary-only: the repository contains no source, and no evaluation · source · T1 (unverifiable) · github.com/Loqira-Labs

• cordis — the 2022 general-purpose plugin meta-framework underneath it (MIT, ~1.3k★): services, typed events and reversible effects on a shared ctx; registrations unwind on unload. The only agent substrate here that was built for something else first — and the architecture doc makes you learn it before anything else · framework

• agent-sdk-workshop — anthropic's hands-on course for the claude-agent-sdk (Apache 2.0, Python, 56★, one commit): one agent taken through four config switches — prompt → ENABLE_TOOLS → ENABLE_SUBAGENTS → ENABLE_MEMORY — plus six scenario breakouts over 19 mock-data tools. The spoke's layer stack stated by the vendor as a dependency order, capability first and persistence last, and "no code writing required" is harness-as-library at full strength. Four of six scenarios are ops roles, not coding. No evaluation, and the staging asserts monotonic gain · source · T1 · github.com/anthropics

• mimiclaw — an agent harness in pure C on an ESP32-S3 (MIT, 5.6k★/829 forks, read 2026-08-10): Telegram gateway, ReAct loop against Claude or GPT, markdown memory on flash (SOUL.md/MEMORY.md/HEARTBEAT.md), five tools, dual-core, 0.5 W. Ships four of the six parts of the harness anatomy and omits identity and policy entirely; the LLM schedules its own cron jobs and a 30-minute heartbeat re-prompts it, with no approval gate anywhere. The "$5 chip" hosts the harness — the model is rented per turn · source · T1 · github.com/memovai

• stax — google-labs' LLM-eval platform, open-sourced (Apache-2.0, 98★, 17 commits), via Telegram: datasets + three evaluator kinds (code / LLM autorater / human) + version comparison, as a deployable GCP stack (Terraform, Spring Boot over Pub/Sub, Next.js). Docs: "ten high-quality prompts beat vibe testing." Nothing measures autorater–human agreement · source · T3 · github.com

• hypit — hypit-ai, via Telegram: agent skill that clones a video as a template — SVML compositions anchored to words so script/language swaps reflow timing; code-rendered in 64 parallel headless Chromium; generation only where needed (Seedance 2 Mini, GPT Image 2); worked examples $1.07–$1.15 per 20-s clip in API spend; 7.5k★. Licence is a modified Apache-2.0 that fails OSI (no multi-tenant service, no resale, keep the logo) · source · T3 · github.com

• open-edit — VEED's agent skill for video editing (Apache-2.0 editor + PolyForm Shield renderer binaries, 209★, npx skills add): no GUI, agent-agnostic via AGENTS.md, captions authored in HTML/CSS and rendered without a headless browser, transcription abstracted across VEED/WhisperX/your own — and a hard refusal on any transcript lacking per-word timings. The head-to-head against video-use the spoke didn't have; Apple Silicon + macOS 26 only · source · T1 · github.com/veedstudio

• claude-code-development-kit — Peter Krueck's opinionated Claude Code starter (MIT, 1.4k★): four synchronized docs/ai-context/ files, tiered /prime (~4–6k tokens base), /review-work parallel subagents, /second-opinion to Codex/Gemini, secret-scanner + deny-list hooks. A configuration layer, not a harness — governed-context-claude-code's playbook turned into an installer. Built on the mechanism context-files-ablation-paper ablated to a null, ships no eval, and makes only process claims · source · T1 · github.com/peterkrueck

• qm — Y Combinator's multiplayer agent harness for work (MIT, TypeScript, 8,967★ in five days): headless core + Postgres, harness-agnostic (Pi/OpenCode/Codex/Claude Code drive the same loop), per-scope durable sandbox, Slack + web. Org-level security posture (Strict/Auto/Dangerous) that scopes may only tighten, over a command-policy floor that applies in all three. Its 9.9 KB SECURITY.md is mostly published limitations — command policy "a speed bump… not a sandbox boundary", credential purposes not enforced, plaintext sandbox creds. Plus a 7-day npm cooldown and prose-only contributions · source · T1 · github.com/yc-software

• claudecode-writer — Women Defining AI's Claude Code content workspace (MIT, 214★): rawnotes → /extract-themes → /research → /write → three platform repurposer subagents. Fan-out from one artifact, no quality gates. Its writing-examples.md is a clean specimen of the purpose-built context context-files-ablation-paper left untested — and its demo output is the flattened-voice failure renwei-writing exists to name. Last pushed 2025-09-06 · source · T1 · github.com/WomenDefiningAI

• iai-pme — CodeAbra's local-first memory engine for MCP coding assistants (MIT, ~423★): episodic / semantic / procedural tiers with nightly consolidation, scheduled decay and contradiction surfacing; Rust core, encrypted SQLite (vector + graph), Leiden-family MOSAIC clustering, local bge-small embeddings; publishes LongMemEval-S numbers (R@10 0.978) — the memory layer's store→process axis · source · T3 · github.com

• nono — Nolabs AI's agent sandbox (Apache-2.0, ~3.2k★, pre-1.0): least-privilege launcher for coding harnesses with per-tool child sandboxes (git/gh/curl/kubectl each with own creds, FS grants, network rules), proxied credentials with L7 endpoint filtering, composable JSON profiles + public registry; no daemon/container/VM; from the Sigstore team · source · T1 · github.com

• claude-financial-services — Anthropic's reference FSI agents/skills/connectors repo · source · src: claude-financial-services.md

• compound-engineering-plugin — Every Inc's compound-engineering skillpack for coding agents; refreshed 2026-07-25: 32 skills / 13 host CLIs / no agents or hooks, /ce-work cross-model dispatch, /ce-compound writes the next run's context to docs/solutions/ · source · T1 · src: compound-engineering-plugin.md + url

• claude-seo — agrici-daniel's Claude Code SEO plugin (MIT, 14.8k★, v2.2.4): 25 sub-skills + 18 sub-agents + 32 commands, auto-discovered from skills/seo-*/ and dispatched 15-way in parallel. Two firsts for a skill pack here — a 410-test suite of which 91 cover SSRF/DNS-rebinding bypasses (the fetcher is attack surface, and two releases were security fixes), and a cognitive scaffold whose output contract forces every recommendation to carry a "how would we know this failed?" check. Its "10–15 min vs 4–8 hours" figure and its one-screenshot case study are not evidence; nothing measures whether the audits improve rankings. Also the spoke's first two-tier open/paid release cadence (MIT repo + members-only early-access mirror) · source · T1 · github.com/AgriciDaniel

• agentic-seo-skill — LLM-first SEO skill pack for agent IDEs · source · src: agentic-seo-skill.md

• geo-seo-claude — zubair-trabzada's GEO/AI-search pack for claude-code (MIT, 9,877★ / 1,531 forks, pushed the day it was routed): a router + 15 sub-skills (README says 13), 5 subagents, 6 Python scripts of which four collect evidence (page fetch, citability scoring from measurable text properties, robots.txt checks for 14+ AI crawlers, llms.txt validation). Publishes a 16 KB scoring rubric and concedes "these weights are not derived from a controlled study". Same author as ai-marketing-claude and a revision of it toward measuring — but still nothing checks whether an AI ever cites the site. Found defect: /geo report-pdf needs templates/ and install.sh never copies it · source · T1 (primary artifact, not verified quality) · github.com/zubair-trabzada

• ai-marketing-claude — zubair-trabzada's marketing pack for claude-code (MIT, 2,686★ / 712 forks, 2026-09-27): 14 skill files + a router, 5 parallel subagents, 4 Python scripts, 6 client-deliverable templates, curl | bash install, /market audit <url>. The form factor reaching non-engineering work — and the spoke's cleanest case of adoption signal without maintenance: created and last pushed nine minutes apart on 2026-03-02, still one commit as of this refresh, 6 issues open. Against agentic-seo-skill's 89 evidence-collecting scripts it has four, so its scored client PDF rests on no checkable observation · source · T1 (primary artifact, not verified quality) · github.com/zubair-trabzada

• claude-marketing-research-skill — ishwarjha's single-SKILL.md marketing-research workflow (Apache-2.0, 55★/5 forks, 3 commits): competitor research, avatar, market-sophistication staging, value propositions, mental-model reframes. Zero scripts — competitor data from "web search," not an author-written fetcher — the true-zero end of the evidence-collector spectrum this spoke tracks (0/4/6/89). Install commands name the wrong repo; credits still read "Created by [Your Name]" · source · T3 · github.com

• cc-thinking-skills — 28 mental-model/critical-thinking skills (cut from 39, all manual-only) + the replication-gated eval harness that found zero proven accuracy gains; best row now +4.0pp, below its own margin; follow-up studies unrun · source · T2 · github.com

• auto-company — 24/7 daemon running Claude Code/Codex as a 14-persona "autonomous company"; one markdown file as all cross-cycle state, phase gates hardcoded to force convergence · source · T2 · github.com

• agent-kanban — shared Kanban board for multi-agent + human coding collaboration · source · github.com

• agentsys — modular agent orchestration runtime (24 plugins / 49 agents / 44 skills); its 73–83% cost-saving claim against Opus alone is the project's own, no method stated · source · T3 · github.com

• ecc — "the agent harness operating system": 68 agents / 284 skills / AgentShield security scanner / Memory Vault, installed separately across 13 harnesses; 240,127★/36,445 forks in 7 months from one maintainer — flagged the same way as superpowers's star count, though live-checked side by side the two are ~32k apart, not near-identical · source · T1 · github.com/affaan-m

• shipping-without-human-verification — TNS (Rubick + Jain, Aviator-sponsored, 2026-07-29): the endgame of the verification thread — ship a growing % of commits with no human review, starting at 1%. Contributes testing asserts / verification judges and a row-by-row split of which is which; proposes the automated verification engineer. Its one number (50% detection → 200% org speedup) has no method, and it never asks whether an LLM gate is adversarially robust · source · T3 · thenewstack.io

• cult-ui-agent-patterns — 92+ copy-paste AI-agent patterns (ReAct/plan-and-solve/RAG) on the Vercel AI SDK; recipes, not a framework · source · T3 · opensourceprojects.dev

• headroom — local-first context-compression toolkit (lib/proxy/CLI/MCP): compresses tool outputs/logs/RAG before the LLM, 60-95% fewer tokens; content-typed compressors + cross-agent memory · source · T3 · github.com

• superpowers — Jesse Vincent (obra)'s composable agent-skills framework + dev methodology (brainstorm→plan→test→build→debug→review); cross-harness skill pack, MIT, 272.1k★ (flagged, 2026-08-14 live check; up from ≈242k in 2026-06) · source · T1 · github.com/obra

• opc-skills — ReScienceLab (Apache-2.0, 1.2k★): ~11 skills for solopreneurs / one-person companies — market research (Reddit/Twitter/Product Hunt), domain hunting, SEO, logo+banner generation, archiving; 16+ host tools. The first pack here whose subject is not software, so none of the free verification a coding pack gets applies; declares inter-skill dependencies (domain-hunter → twitter+reddit), a third answer to where composition lives · source · T1 · github.com/ReScienceLab

• ruflo — rUv/ruvnet (MIT, 67.1k★, ex-Claude Flow): agent meta-harness over claude-code — swarm topologies + 100 agent roles, ~210 MCP tools in parallel, AgentDB/HNSW vector memory, SONA self-learning, zero-trust cross-org federation; the corpus's maximal stack-everything entry, with one conditional benchmark to its name · source · T3 · github.com

• superclaude-framework — SuperClaude-Org (MIT, 23.7k★, v4.3.0): 30 slash commands / 20 role-persona agents / 7 behavioral modes / 8 wired MCP servers, pipx-installed as injected config into claude-code; the operator-invoked, single-harness counterpart to superpowers; no evaluation · source · T1 · github.com

• knowledge-rag — local-first RAG MCP server for Claude Code: hybrid semantic+BM25 + cross-encoder rerank, ChromaDB, 13 MCP tools, 20 format parsers, zero external APIs; the retrieval-rich end of the local axis · source · T1 · github.com/lyonzin

• claw-code — provider-agnostic Rust CLI agent harness · source · github.com

• jcode — single-author Rust terminal coding agent (MIT, 13.1k★ in ~7 months): in-harness agent-memory (turn embeddings → memory graph, relevance-gated passive injection, ambient consolidation), a peer-to-peer swarm that notifies an agent when a file it read is edited under it, plus its own terminal and mermaid renderer. Publishes self-run RAM/startup benchmarks with versions, ranges and method — and baselines them on its own stripped config · source · T3 · github.com

• openmanus — FoundationAgents' open general-purpose agent framework, built in 3 hours as an invite-code-free replica of the closed Manus; MIT, 57.6k★ off 526 commits; Python/Playwright/MCP, three modes; agent loop undocumented; sibling OpenManus-RL puts competence in the weights (GRPO), not the wrapper · source · T1 · github.com

• oh-my-pi — omp (Can Bölük / stencil-labs): "a coding agent with the IDE wired in," forked from Pi. Re-seen 2026-09-06 via its product site omp.sh (full docs tree) and 2026-09-07 via the repository itself. 29,934★ / 3,047 forks, MIT, 2,389 open issues, repo created 2025-12-31 — +156 stars in the day between those two readings. 31 tools, 60+ providers, 14 LSP and 28 DAP ops, ~80k lines of Rust with ripgrep and 58 coreutils in-process — which is why it runs natively on Windows, no WSL. Since August: curated cross-session memory, an advisor model reading every turn, /collab live session sharing, 16 internal URL schemes (pr://, conflict://, agent://), desktop AX-tree control. Its hashline edit format is the one claim now measured — by its own author (harness-problem-hashline, T3) · source · T1 · github.com / omp.sh

• pi-coding-agent — Pi (Zechner / earendil-works): "a minimal agent harness." 99,163★ / 12,303 forks, MIT, TypeScript, created 2025-08-09 and pushed 2026-08-29 — the largest repository in this spoke by an order of magnitude. Defined by its removals — no MCP, sub-agents, permission popups, plan mode, to-dos or background bash — each shipped back among 50+ example extensions, which is KOT's refusal list with the opposite bet behind it. Four modes (TUI / print-JSON / RPC / SDK, with openclaw as the SDK case), 15+ providers switched mid-session, sessions stored as branchable trees with /share to a gist, and a package registry over npm and git. No benchmark of any kind on the site. The upstream oh-my-pi forked · source · T1 · pi.dev

• hermes-agent — Nous Research self-improving autonomous agent framework ("grows with you"); OpenClaw successor · source · github.com

• awesome-hermes-usecases — community-curated, primary-source-gated catalog of real-world Hermes Agent deployments (13 domains); the evidence counterweight to hermes-agent's README claims · source · T2 · github.com

• autonovel — Nous/Hermes Agent autonomous novel-writing pipeline (4 phases, ~27 scripts, mechanical+LLM-judge eval loops); shipped a 79k-word novel — the loop/verification thesis as a working artifact · source · T1 · github.com

• zouroboros — self-enhancing multi-agent orchestration + hybrid memory platform (5 executors incl. Hermes; Health Council; 3-model consensus gate on self-edits); convergence instance, Zo-Computer-native · source · T1 · github.com

• autoresearch — Karpathy's "agentic scientist": agents autonomously iterate ML training overnight (edit train.py → 5-min run → val_bpb → keep/discard); the loop thesis with an objective feedback signal · source · T1 · github.com

• microsoft-scout — Microsoft's OpenClaw-built personal assistant (autonomous, durable, self-improving) + policy-conformance governance · source · techcrunch.com

• openhuman — local-first (Tauri/SQLite) open-source personal AI agent; Memory Tree + Obsidian wiki; 118+ Composio integrations · source · github.com

• starnet — local-first Rust/Tauri desktop app running several agents in a pixel-art space station where room = capability-scoped team, hallway = authorized handoff lane, placed object = real capability grant; BYO-model (OpenRouter/Anthropic/OpenAI/Google/Ollama), chat channels, Night Shift unattended mode, Task Briefs, MCP, imports openclaw/hermes-agent personas; MIT code, name/art proprietary to andrew-sims; 641★ / 109 forks · source · T1 · github.com

• corbell — CLI building a code knowledge graph across repos (tree-sitter call graphs + embeddings + git change coupling) and generating architecture specs from it; local SQLite, MCP server, D3 graph UI, Linear/Jira export; SDD with mined context instead of written context — unevaluated · source · T1 · github.com

• spec-kit — GitHub's reference spec-driven-development toolkit (six /speckit.* commands, 30+ agents) · source · github.com

• anthropic-skills — Anthropic's official Agent Skills repo: the spec, template, example + production document skills, plugin marketplace; first-party home of the skills standard · source · T1 · github.com

• get-shit-done — GSD: Claude Code system pairing context engineering + spec-driven development · source · github.com

• jaseci — Jac language + full-stack AI framework (Meaning Typed Programming, graph walkers) · source · docs.jaseci.org

• byllm — the shipped by operator: Jaseci's Meaning-Typed Programming module, standalone-Python-usable, model-agnostic across OpenAI/Anthropic/Google/self-hosted · source · T1 · byllm.jaseci.org

• node-js-functional-patterns-skill — a skill pack via MCP Market; honest stub (429) · source · mcpmarket.com

• conductor — Gemini CLI extension; Context-Driven Development (context → spec → implement) · source · github.com

• gstack — Garry Tan's "AI software factory": 23 skills + role-agents; uses GBrain + Conductor · source · github.com

• claude-to-speech — Claude Code plugin: ElevenLabs TTS for responses via hooks · source · github.com

• sayna — Rust unified voice-layer server for agentic frameworks (MIT-ish, ~303★): one WebSocket/REST API in front of Deepgram/ElevenLabs/Google/Azure STT+TTS, LiveKit WebRTC rooms, Silero-VAD turn detection; provider-agnostic infrastructure vs. claude-to-speech's single-provider hook · source · T1 · github.com/SaynaAI

• ai-job-search — Claude Code job-application framework (skills + slash commands + drafter–reviewer subagents; output-grounded PDF verification); harness pattern in a non-coding vertical · source · github.com

• designpowers — model-agnostic 10-agent design team (36 skills, Discover→Ship pipeline) with human-as-director (Direct/Auto modes); accessibility-as-default; role-split orchestration in a non-coding (design) vertical, cross-harness · source · T1 · github.com

• lathe — Claude Code/Cursor/Codex skills that generate hands-on tutorials you work through by hand; the anti-automation "teach, don't do for you" augment pole · source · github.com

• renwei-writing — 人味儿写作: a Cola skill that edits text without erasing the author's voice; augment pole applied to writing; Wikipedia-"Signs of AI writing" post-edit checklist · source · T1 · github.com

• pm-skills — PM Skills Marketplace: 68 skills / 9 plugins / 42 chained workflows for product management; cross-vendor (Claude Code/Cowork/Codex/Gemini/Cursor) · source · github.com

• pm-skills-arsenal — 12 deep PM skills (~1–1.3k lines) with typed input/output_schema for structural routing; APM + plugin marketplaces + MCP run_skill; the few-deep-routed-by-schema counterpoint to pm-skills · source · T2 · github.com

• seekdb — OceanBase's "AI-native state store for agents": MySQL-compatible, hybrid vector+FTS, COW FORK/MERGE sandboxes (Apache-2.0); the memory-substrate layer as a product · source · github.com

• tgpt — multi-provider terminal LLM chat frontend (Go, GPL-3.0); ~10 backends incl. free tiers + Ollama; the non-agentic boundary of the terminal-AI ecosystem · source · T1 · github.com

• arrow-js — reactive UI framework for agent-generated interfaces; WASM sandboxing for safe browser-side code execution; < 5 kb, no build step · source · T1 · arrow-js.com

• openui — generative-UI framework: LLMs emit a compact streaming DSL ("OpenUI Lang", ~67% fewer tokens than JSON), React renders it; the constrained-DSL counterpoint to arrow-js in the rendered-output corner · source · T2 · github.com

• agent-starter-pack — Google Cloud toolkit for building/deploying production agents from templates (Cloud Run / Agent Engine, eval, CI/CD); the deploy/operate end of the harness · source · T1 · googlecloudplatform.github.io

• perplexity-api-platform-skills — Perplexity's official Agent Skills repo (Apache-2.0, 71★): migrate-sonar-to-agent-api (a vendor absorbing its own breaking change as an agent task) + pplx-cli, bundled docs-MCP, Claude Code and Codex marketplaces from one tree, npx skills add fanning out to ~70 agents, plus zero-install by URL. Best-built eval here — production-verified fixtures, reference migrations explicitly not answer keys, mechanical check.sh + live runs, a documented A/B against no-skill, and a "judged by eye (not greppable)" section naming where its own grader can be cheesed · source · T1 · github.com

• jetbrains-ponytail-tested — JetBrains' independent A/B of ponytail (80 paired SkillsBench tasks, claude-sonnet-5, 251 trials, per-trial contamination audit): −15.4% code / −10.3% cost, no quality difference — about a third of the advertised −54%/−20%; benefit conditional on the baseline over-building, and the skill self-activated zero times without the always-on hook · source · T2 · blog.jetbrains.com

• ponytail — "lazy senior dev" skill: a decision ladder that constrains coding agents to write the minimum code (restraint, not capability); 15+ hosts; self-reported ~54% less code, independently measured at −15.4% code / −10.3% cost (jetbrains-ponytail-tested) · source · T3 · github.com

• i-have-adhd — ponytail's sibling in output restraint: 10 rules + a pre-send check that strip preamble/recap/tangents from an agent's answers (ADHD-derived, MIT, 12.3k★); the first skill shipping its own eval harness + release gate (blind weighted rubric, condition isolation, pinned model) — and no published numbers · source · T1 · github.com

• easy-agent — terminal-native agentic coding CLI (TS/Node, Ink TUI) that rebuilds a Claude Code-style harness in 5 explicit layers + 31 study snapshots; a teaching scaffold · source · T1 · github.com

• nemoclaw — NVIDIA reference stack: runs OpenClaw/Hermes/LangChain Deep Agents securely inside OpenShell sandboxes (managed inference, network policy, lifecycle); the agent-agnostic vendor governance layer, first-party · source · T2 · github.com

• personal-jarvis — community desktop app running Claude Code, Codex, OpenCode and 6 other harnesses in parallel panes, plus persistent agents, voice, computer use and an MCP/skills marketplace. Fourth, non-vendor shape of the multi-harness control-plane idea. 123★, Apache-2.0 · source · T3 · github.com

• cybersecurity-skills — 817-skill cybersecurity skillpack (mukul975) on agentskills.io; 29 domains, 6 framework mappings; the largest skillpack instance — progressive-disclosure scaling test; community repo (not official Anthropic) · source · T2 · github.com

• education-agent-skills — 165-skill pedagogy skillpack (Gareth Manning, CC BY-SA 4.0) on agentskills.io; 20 domains, cross-vendor plugin + hosted MCP/OAuth; first pack citing external research in frontmatter (evidence_strength/evidence_sources) and first vertical aimed at the end user (13 student-facing skills) · source · T2 · github.com

• pullmd — self-hosted URL/file→Markdown service (Aeterna Labs, AGPL-3.0, 365★); Readability→Trafilatura→origin-Markdown→Playwright cascade, plus MCP server + Claude Code skill + OAuth. md-this-page's strip-at-capture lever with an agent-invocation surface · source · T2 · github.com

• statewright — state-machine guardrail (Rust, ~449★): phase-scoped tool availability (plan=read-only → implement=edit → test=test-cmds), cross-vendor MCP plugin. Enforcement-over-instruction aimed at reliability, not safety; reports 2/10→10/10 on a 5-task SWE-bench subset (self-run, tiny-N) · source · T3 · github.com

• longhorizon-harness — AMAP-ML (alibaba) long-horizon harness over Claude Code/Codex/OpenClaw (MIT): Manager/Executor/Auditor split, fresh context per round, verification as the write-gate on persistent state. First self-reported harness result at real N — WeaveBench 114 tasks +28.9 pts, OSWorld 2.0 108 tasks 2.8%→8.3%, Terminal-Bench 2.1 +7.5 pts / −24% tokens, all on a fixed Qwen backbone. Re-sent and refreshed 2026-08-30: 1,396★/144 forks in its first 26 days, five releases to v0.1.7, and its "growth edge 2 still stands" section retracted — the edge closed the day after this page was written, and harness-bench/claw-swe-bench put the model gap above the harness gap · source · T1 · github.com

• deer-flow — ByteDance "SuperAgent" harness (LangChain/LangGraph): sandboxes + memory + markdown skills + parallel subagents + chat-app message gateway; long-horizon (minutes–hours); big-tech harness-vendor entrant · source · T2 · github.com

• autoharness — self-maintaining skill layer for Claude Code: distils sessions into skills, consolidates duplicates, archives by invocation rate; author-only scoping + validation, daemon/benchmark-free; self-improvement at the library level · source · T3 · github.com

• whatsapp-chatgpt-bot — wassenger's MIT WhatsApp bot: GPT-4o + multimodal I/O + function-calling RAG + MCP + human handoff; the messaging-channel gateway corner (non-Anthropic bot reaching for MCP) · source · T1 · github.com

• agent-scripts — peter-steinberger's personal cross-harness hub: skills + AGENTS.MD hard rules + sync-skills/validate-skills mirrored into Codex & Claude Code; the individual-developer floor of skill-infra · source · T1 · github.com/steipete

• openwiki — LangChain's OSS CLI that auto-generates + CI-refreshes codebase docs for agents, appending to AGENTS.md/CLAUDE.md; the OSS pole of docs-as-build-artifact · source · T1 · github.com/langchain-ai

• agtop — ldegio, GPL v2, 224★: top for coding agents — per-session spend, tokens, CTX% saturation, CPU/memory, tool calls and subagents, from JSONL transcripts joined to OS processes. The token-budget corner's first instrument — every other entry in it is a lever that spends less; this one only measures · source · T1 · github.com/ldegio

• pxpipe — local proxy that cuts Claude Code token cost ~59–70% by rendering dense context as PNGs (modality arbitrage on image-token pricing); lossy on byte-exact strings; headroom's opposite pole · source · T3 · github.com/teamchong

• watch-skill — cross-harness skill (MCP+CLI+REST) giving agents video-watching + self-verification ("THE LOOP": record own output → critique → fix → before/after proof GIF); output-grounded verification made perceptual; local-first (offline whisper/OCR/SQLite index) · source · T1 · github.com/oxbshw

• ask-search — self-hosted zero-API-key web search skill for agents: wraps SearxNG (70+ engines) behind MCP + CLI + OpenClaw SKILL.md; the live-web pole of the local-first-tool-over-MCP corner (vs knowledge-rag's local docs); Tavily fallback · source · T1 · github.com/ythx-101

• diagram-design — cathryn-lavery's Claude Code skill for editorial diagrams (MIT, ~3k★): 27 types × 3 variants, self-contained HTML+SVG with no build/JS/CDN, one-time brand capture from the user's website (colors + fonts), 34 progressively-loaded reference docs, PNG/SVG export via Playwright — and lint tools that check the output against 4px-grid / 1px-hairline / one-accent rules. The output-shape skill in visual form, machine-checked · source · T1 · github.com/cathrynlavery

• beautify-github-readme — oil-oil's MIT agent skill that redesigns a repo's README (proof-before-technical hierarchy + project-native SVG identity; Markdown-for-text / SVG-for-visual separation); the vertical-skill thread reaches repo/README presentation · source · T2 · github.com/oil-oil

• md-this-page — Ademking's MIT Chrome/Firefox extension (1.3k★): page → clean Markdown via Mozilla Readability + Turndown, with copy-as-prompt; the strip-at-capture lever upstream of the whole token-budget corner, and the pattern with the agent removed · source · T2 · github.com/Ademking

• video-use — browser-use's MIT skill that edits video by conversation (18.6k★, the spoke's most-starred skill): one ElevenLabs Scribe call → ~12KB transcript the model cuts from, composites only at decision points; filler/dead-air removal, grading, subtitles, sub-agent overlays; self-evaluation loop re-renders bad cuts · source · T2 · github.com/browser-use

• mobilerun — DroidRun's MIT framework driving real Android/iOS phones from natural language (8.9k★): device Portal app + local agent runtime, model-agnostic (OpenAI/Anthropic/Gemini/DeepSeek/Ollama/OpenRouter), standard/vision/reasoning modes; reports 91.4% on AndroidWorld's 116 tasks, ~7 pts clear of AutoGLM-Mobile, on accessibility-tree-not-pixels · source · T2 · github.com/droidrun

• grok-build — xAI's open-source Rust terminal coding agent (grok): full-screen TUI + headless + editor-embed via ACP; MCP/plugin-extensible; modular crates; the model lab shipping its own harness (peer to Claude Code / Gemini CLI) · source · T1 · github.com/xai-org

• agentic-awesome-skills — sickn33's 2,003-skill catalog turned control plane (MIT, ~44.5k★, v15.9.0): a local read-only MCP (search_skills/get_skill/compose_stack) where the agent picks the IDs and Core validates structure only — explicitly not semantic fit, safety, or suitability; aas-stack.json + evidence sidecar + immutable plan + human review. Documents its own scale failure (Antigravity context exhaustion → installer refuses a bare full install; 128-skill manifest cap) and that a full install ships critical/offensive instructions · source · T3 · github.com/sickn33

• data-formulator — microsoft Research's AI data-analysis system (MIT, Python, 16,279★/1,543 forks, v0.8 beta, active): natural-language questions over files, three relational engines, Databricks/ADX, S3/Blob and auto-refreshing URLs, with DuckDB underneath and three named agents above. The model emits Flint chart specs — the narrowest vocabulary in the generative-ui set — and data threads branch the investigation instead of keeping a transcript. Microsoft's open answer to sheets-canvas's closed one, four days apart; no accuracy figure, no benchmark, no paper identified · source · T1 (primary artifact, not verified quality) · github.com/microsoft

• auto-browser — LvcidPsyche's MIT MCP browser control plane: one shared Playwright/Chromium session behind a 20-tool curated profile, noVNC human takeover, auth profiles, and model-agnostic adapters (OpenAI/Claude/Gemini/OpenRouter/Ollama/vLLM, LangChain/LangGraph/CrewAI). Ed25519-signed "witness receipt" audit chains plus a public self-audit disclosing controls that silently no-op'd; an experimental Convergence harness turns verified traces into staged, provenance-signed skill candidates requiring manual promotion. 826★/143 forks, single maintainer · source · T1 · github.com/LvcidPsyche

• vibe-tools — eastlondoner's Node CLI giving an agent other models to call (MIT, ~4.8k★): Perplexity search/research, Gemini whole-codebase context, Stagehand browser act/extract/observe, GitHub/Linear/docs/YouTube skills; integrates by writing the harness's instruction file (claude-md, .cursorrules, Windsurf/Cline/Roo) — the pre-MCP way, and the opposite pole to agentic-awesome-skills; arrived via a promotional X thread · source · T1 · github.com/eastlondoner

Collection (sources)

• awesome-prompts — ai-boost, 8.7k★/840 forks, GPL-3.0: prompts, prompt-engineering frameworks and papers, arguing prompts-as-engineering over prompt templates while giving the templates 43% of the file. Its Coding & Development prompts are distillations of this spoke's own corpus — harness design, permission classifiers, three separate loop-engineering encodings — each citing the artifact it came from. Pivoted away from the GPT-store list its GitHub description still advertises. No inclusion criteria, nothing measured · source · T3 · github.com

• llm-engineer-toolkit — kalyan-ks, Apache-2.0, 10.7k★: 150+ LLM libraries in 15 categories, Agents the largest (23) and inference+serving the smallest (9). Read against turingpost-13-frameworks the next day: 7 of 13 overlap, and the two diverge along a vendor-vs-community line — no ADK/Strands/MAF/Mastra/LiveKit here, no AutoGen/Swarms/Composio/Browser Use there. No Anthropic agent library in either. No inclusion criteria, no dates, no per-row licence or maintenance signal · source · T3 · github.com

• prompts-chat — fatih-kadir-akin's awesome-chatgpt-prompts (5 Dec 2022, 167.9k★/21.7k forks, MIT code + CC0 prompt data), renamed after its own website. The prompt directory that named the genre now carries 66 Skills and 13 Workflows beside its prompts, plus an MCP server and a Claude Code plugin — the persona-prompt collection rebuilding itself as agent tooling. 66 skills against agentic-awesome-skills's 2,003, at ~30× the audience. The "sequential flows and connections" are one long prompt with ordered sections, not a graph. No inclusion criteria, nothing measured · source · T3 · prompts.chat

• awesome-agent-evolution — EvoMap's 150+-entry curated catalog of the agent-self-evolution field (self-improvement / memory / A2A / platforms / coding / guardrails / benchmarks / embodied); an external taxonomy matching the spoke's bottom-up layer model; names Mem0/Eliza/Agent Zero as page candidates · source · T3 · github.com/EvoMap

• long-horizon-agents-survey — Dong et al. (ruc-nlpir, 20 authors, July 2026 preprint) + a ~730-paper reading list (MIT, 1,015★): writes the model/harness split as Agent = π_θ ⊕ ℋ — the third independent formalization in two months, after harness-disclosure and model-or-harness-taxonomy, citing neither. Its co-evolution claim (harness capability gets internalized into the policy) dates our ~48 pp harness effect. Nested H1/H2/H3 levels make agent-memory the definition of H2. Preprint; measures nothing of its own · source · T1 · github.com/RUC-NLPIR

• turingpost-13-frameworks — Alyona Vert, turing-post, 2026-08-09: a census of thirteen agent frameworks and SDKs (OpenAI Agents SDK, LangGraph, ADK, Microsoft Agent Framework, Pydantic AI, CrewAI, Agno, Strands, Mastra, smolagents, LlamaIndex, CAMEL-AI, LiveKit) with five comparison axes and a refusal to pick a winner. Python in 12 of 13; the layer has begun specializing by use case; Anthropic is absent and no inclusion criteria are stated. Editorial judgment, no measurement · source · T3 · turingpost.com

TechArticle (sources)

• functiongemma-formatting-and-best-practices — Google's docs for FunctionGemma (Gemma 3 270M tuned for function calling), read 2026-10-04: six control tokens plus one <escape> token for strings, a trigger phrase in the developer turn, and <start_function_response> as an extra stop sequence. Supports single-turn and parallel calls; multi-step chaining and multi-turn parameter collection are not trained and need external state. Best fix for missed tool picks is richer tool descriptions. No measurements · source · T1 (documentation, nothing measured) · ai.google.dev
• metr-scaffold-comparison — METR (Jurkovic, 2026-02-13): the model × harness factorial run once — Opus 4.5 under Claude Code vs ReAct (50.7% of bootstrap samples, a coin flip) and GPT-5 under Codex vs Triframe (14.5% — the product harness loses). Vendor harnesses are tuned for a human in the loop; unattended, the tuning buys nothing. Half-closes edge 12; one time point, bootstrap not seeds · source · T1 · metr.org
• hermes-agent-termux — nous-research's own Android/Termux guide for hermes-agent, read 2026-08-22. The first source here where a framework names the features it cannot ship on a platform: Termux is Tier 2 ("best-effort... commits to main may break these packages at any point"). Survives: CLI, cron, PTY, Telegram gateway, MCP, Honcho memory, ACP. Absent: voice (ctranslate2 publishes no Android wheels), browser/Playwright bootstrap, .[all], and Docker terminal isolation — so one of the two stated security controls is gone. Android suspends background jobs, so gateway persistence is best-effort. Also documents a curl | bash community APT repo it disclaims on all four counts — build, sign, host, audit · source · T1 · hermes-agent.nousresearch.com
• anthropic-browser-use-tool — amanda-caswell for the-new-stack (2026-08-21) on claude-browser-use: the tool named Browser Use does not run a browser. Best on the three things a vendor post would skip — batched actions are ordered so a failed first click poisons the rest, approval has to move inside the executor's loop, and Playwright/Playwright MCP/Puppeteer already do the substance over a different wire. Every number is Anthropic's, restated; outlet discloses its owner invests in Anthropic · source · T2 · thenewstack.io
• stanford-virtual-biotech-37000-agents — VentureBeat on Zou's VB Transform talk: virtual-biotech runs tens of thousands of role- and data-differentiated agents under a CSO agent, 37,000 on one clinical-trial task; a CD276 ADC design later matched by merck; wrapping legacy DBs in MCP doesn't make them agent-ready (paperclip); optimise the environment, not the model · source · T3 · venturebeat.com
• claude-code-model-effort-levels — Anthropic: model (frozen weights = capability ceiling) vs effort (how much work) as orthogonal Claude Code controls; when to raise effort vs upgrade the model · source · T1 · claude.com
• orchestration-mode — Claude API doc: multi-agent fan-out via mid-conversation steering · source · src: orchestration-mode.md
• hermes-profile-builder — Nous: web dashboard composing an agent from identity/model/skills/MCP (the "agent = composition" thesis as a form) · source · T3 · marktechpost.com
• harness-agent-dlc — Harness AI Agent DLC (TNS): ship agents through the pipelines/gates/approvals that govern app code — make the pipeline predictable, not the agent; AI Evals, canary+OPA agent deploys, AI configs, asset catalog with owners, AgentTrace (harness-sdk/harness-evals open-sourced); only 17% of orgs have deployed agents (Gartner) · source · T3 · thenewstack.io
• agent-loops-verification — Arjun Iyer/Signadot (TNS): loops replace prompts, so verification becomes the bottleneck — and for cloud-native code it's a runtime problem · source · T4 · thenewstack.io
• anthropic-agent-sdk-billing-pause — Ars Technica: Anthropic paused (June 2026) a change to bill Claude Agent SDK / claude -p usage at API rates; the harness-as-product's cost-structure problem · source · T2 · arstechnica.com
• claude-code-weekly-limits-promo — Anthropic support: temporary +50% weekly-cap boost for Claude Code (May 13–Aug 19 2026; Pro/Max/Team/legacy-Ent); reveals the two-tier limit (5-hour + weekly) and the weekly cap as the vendor's adjustable lever · source · T2 · support.claude.com
• building-effective-agents — Anthropic engineering: building effective agents (workflows vs agents; simple, composable patterns) · source · T1 · anthropic.com
• adk-sessions-docs — Google ADK: Sessions — the session/state model for ADK agents · source · T1 · adk.dev
• agents-md-spec — the agents.md spec site: the AGENTS.md open convention · source · T1 · agents.md
• langchain-middleware-docs — LangChain docs: middleware as the agent-composition unit · source · T1 · docs.langchain.com
• autowiki-factory — Factory.ai's multi-agent system that auto-generates/maintains a code wiki ("docs as a build artifact"); Droids browse it as shared context · source · T2 · factory.ai
• hermes-learn-skill-capture — MarkTechPost: Hermes /learn auto-authors a standards-compliant SKILL.md from a doc/URL/past conversation; names the manual→assisted→autonomous→community skill-creation spectrum; write_approval gate (off by default) · source · T3 · marktechpost.com
• tail-control-agentic-workflows — Wittkampf (TDS): reliability engineering of agent workflows — latency heavy tails (p99 2–7× median; 10 steps×95%≈60%), and SRE tail-control (race/cut-p95/hedge/downshift); workflows are the reliability-tractable form · source · T3 · towardsdatascience.com
• claude-fable-system-prompt-leak — Medium (unverified leak): a claimed Claude Fable system prompt — tools/MCP/memory/code-exec + guardrails + behavior as one configured layer; the "model is now an engineered system" thesis from the vendor side · source · T4 (unverified) · medium.com
• from-local-llm-to-agent — TDS: a fully-local tool-using agent (Gemma on Ollama + OpenAI Agents SDK + MCP/Tavily); skills×MCP=agency decoupled from the model substrate · source · T4 · towardsdatascience.com
• safe-prompt-pruning — TDS (Emmimal P Alexander): deterministic 3-pass prompt pruner (drop expired tool outputs + duplicate RAG docs, restore DEFINE/REF dependencies); the remove lever of the token-budget corner (vs headroom compress / pxpipe modality-swap); lossless & LLM-free, 27–34% cuts on RAG/tool workloads · source · T3 · towardsdatascience.com

BlogPosting / Article (sources)

• harness-problem-hashline — Can Bölük (2026-02-12) holds the model fixed and swaps one tool: 16 models × 3 edit formats, 3 runs × 180 React-mutation tasks. Hashline averages +15 points over apply_patch, ahead in 14 of 16; Grok Code Fast 1 goes 6.7% → 68.3%, Grok 4 Fast spends 61% fewer output tokens. The gain concentrates in weak models and reverses at the frontier (GPT-5.2 Codex +26% tokens, DeepSeek V3.2 negative on both axes). The finest-grained harness measurement the spoke holds and the only one run by the seller — fixtures and per-run reports published, tier unchanged · source · T3 · blog.can.ac
• stop-burning-tokens-on-code-review — swizec-teller (2026-08-15) puts a price on model-based code review: ~$1,000/week for Cursor's BugBot and $1,000 in one day for Claude review skills in GitHub Actions, against 2,900 PRs/quarter. Replaced both by having a model compile the team's guidelines into linters once and then leaving the loop (deterministic-review-gate). Cost and latency measured; detection rate on neither side · source · T2 · swizec.com
• sheets-canvas — Google ships generative-ui to a paid consumer tier (2026-08-13): describe an interface in the Ask Gemini panel and it builds an interactive "mini-app" over your spreadsheet — "a dynamic, read-write layer that sits directly on top of your spreadsheet data," always in sync and shared like any sheet. The corner's first bidirectional, multi-user, stateful entry, and its least legible: no model named, no artifact format, no export or inspection, no numbers. "No coding required" and no code available · source · T2 · blog.google
• claude-code-auto-mode — simon-willison on auto mode as the claude-code default (Pro/Max/Team, from 2026-08-14): Anthropic reports it blocking 89% of harmful actions vs 13.6% by human reviewers (n=1,053 developers), and a commissioned Trajectory Labs test where none of 720 injection attempts succeeded. Willison buys the design and not the verification — "I'd like to see more independent confirmation" — and names the untested vector: a malicious package whose instructions look like the job · source · T2 · simonwillison.net
• llms-cheese-your-types — Justin Le (in Code): how LLMs cheese Haskell's type constraints (escape hatches, weakened planned types, sentinel/string-stuffing) and using types as scaffolds not gates to fight back; the source behind constraint-evading-behavior · source · T2 · blog.jle.im
• verification-loops-skills — Anthropic (Delba de Oliveira): turn manual post-implementation checks into Claude Code skills that self-verify & fix — a verification loop = "Claude checks and attempts to fix the work"; four activation patterns incl. gate-on-every-PR; the concrete inner-loop twin of agent-evals · source · T1 · claude.com
• ai-race-coach — Google GDE case study: real-time AI driving coach (Sonoma Raceway) on Antigravity (stateful telemetry orchestration) + ADK agents, split Gemma-4-local / Gemini-cloud; Antigravity's runtime "domain-bridging engine" face + the spoke's closest brush with embodied/edge agents · source · T3 · developers.googleblog.com
• cognition-fable5-through-the-night — Anthropic case study: Cognition/Devin runs 8h unattended ("through the night") on Fable 5; "trust no eval" + the Frontier Code anti-slop benchmark (Fable5 ~30% vs Opus ~10%); the sharpest step on the Benchmarks gap + a model-as-unlock counter-current to structure>capability · source · T3 · claude.com
• adk-agents-with-skills — Google guide: building ADK agents with skills; the open skills spec · source · developers.googleblog.com
• adk-long-running-agents — Google guide: durable long-running ADK agents (pause/resume, state machines, persistent sessions) · source · developers.googleblog.com
• adk-go-2 — Google: ADK Go 2.0 — graph-based workflow engine, first-class durable HITL, unified runtime ("a graph is an agent") · source · T3 · developers.googleblog.com
• governed-context-claude-code — TDS (Jake Minns): the fullest context-rot governance playbook for Claude Code — curate CLAUDE.md/skills/hooks, offload to subagents, externalize state, reset over recover ("session as a git tree", disposable --fork-session branches) · source · T3 · towardsdatascience.com
• cca-f-lost-in-the-middle — Medium (Rick Hightower, CCA-F series): the API-level take on lost-in-the-middle — pinned facts + rolling history + reconstruct-state-every-turn, because the Messages API is stateless; context mgmt is a design problem not a config knob · source · T3 · medium.com
• writing-a-good-claude-md — HumanLayer: how to author CLAUDE.md — small+universal (<300 lines), progressive disclosure, never auto-generate; two mechanisms (Claude ignores non-universal instructions; ~150–200-instruction ceiling) · source · T3 · humanlayer.dev
• agent-anti-patterns — MLM (Bala Priya C): nine agent-building anti-patterns (multi-agent-too-soon, tool sprawl, no memory arch, ungoverned writes, context drift, no eval); maps ~1:1 onto the spoke's threads — a failure-mode index + outside corroboration of the layer model · source · T3 · machinelearningmastery.com
• orchestrate-100-agents-claude-code — TDS (Eivind Kjosbakken): 100+ Claude Code agents in parallel via headless mode (claude -p) — hierarchical orchestrator, stateless one-shot sessions, task isolation + self-verification; the spoke's largest-scale fan-out instance · source · T3 · towardsdatascience.com
• run-claude-code-agents-24-hours — TDS (Eivind Kjosbakken): operator how-to for one Claude Code agent unattended for 24h — sandbox+backup permissions, agent-authored done-conditions/self-verify, second-agent PR review, remote always-on; the duration axis (vs. orchestrate-100's breadth), practitioner counterpart to cognition-fable5-through-the-night · source · T3 · towardsdatascience.com
• claude-code-channels-vs-openclaw — event-driven vs self-driven Claude agents; the deployment axis · source · aimaker.substack.com
• claude-apps-gateway — Anthropic+Google Cloud self-hosted governance gateway for Claude Code fleets (IdP identity, RBAC, spend caps, OTLP telemetry, routing to Vertex); the harness-vendor's own runtime-governance layer + the enterprise answer to the SDK-billing tension · source · T3 · cloud.google.com
• tokenmining — TDS (Sam Black): the named cost/token discipline (inverse of "tokenmaxxing") — routing (LLM gateway → cheaper/local model, ~60% cut) + context compaction; thesis "more tokens ≠ better" (context rot / lost-in-the-middle); the cost/quality face of the spoke's structure-over-tokens thread · source · T3 · towardsdatascience.com
• claude-code-best-practices — practitioner lessons; BMAD vs plan mode, CLAUDE.md, model selection · source · ranthebuilder.cloud
• agents-never-do-alone — TDS: what agents shouldn't do autonomously; reversibility matrix + AGENTS.md/blocked_commands.md/two-agent review · source · towardsdatascience.com
• langchain-custom-harness — LangChain: agent = model + harness; middleware as the composition unit; task-harness fit · source · langchain.com
• ant-cli — hands-on: Anthropic's ant CLI deploys/manages Claude Managed Agents from the terminal (model provider → agent platform) · source · medium.com
• claude-skills-ppc — Claude Skills for PPC; skills × MCP = agency; system-designer framing · source · searchengineland.com
• spec-driven-ai-tools — comparison of BMAD / Spec-Kit / OpenSpec · source · src: spec-driven-ai-tools.md
• agents-that-build-agents-ms — Microsoft SKILL-first blueprint (Agent Framework + Foundry); Foundry adopts the agentskills.io spec (SKILL.md, MCP Resources/SEP-2640) · source · techcommunity.microsoft.com
• adk-a2a-cross-language — Google guide: cross-language multi-agent team over A2A (Python ADK orchestrator + Go validator as RemoteA2aAgent); the agent↔agent wire format demonstrated with running code · source · T1 · developers.googleblog.com
• openclaw-hermes-control-layer — TNS: OpenClaw (gateway-first/breadth) vs Hermes (memory-first/depth) — same harness anatomy, different control point; memory as the durable lock-in; vendors own the runtime layer beneath both · source · T2 · thenewstack.io

ScholarlyArticle (sources)

• harness-disclosure — Zhang, Wang, Ge et al., May 2026 (arXiv 2605.23950, T1): the Binding Constraint Thesis stated formally — HV(M), variance over harnesses, exceeds MV(H), variance over models, for long-horizon tasks with comparable frontier models. Assembles the largest harness effect this corpus holds (~48 pp single-model swing on HAL's SWE-bench Verified Mini) and reports model ranking reversal. Asks for locked-harness or factorial protocols with variance components reported. A position paper: it specifies the missing experiment, it does not run it · source · T1 · arxiv.org
• mast-multi-agent-failure-taxonomy — Cemri, Pan, Yang et al., NeurIPS 2025 (arXiv 2503.13657, T1): the failure distribution this spoke said nobody had published — 14 modes in 3 categories, 150 traces hand-annotated at κ=0.88 then 1,600+ via a validated LLM judge across 7 frameworks. System design 44.2%, inter-agent misalignment 32.3%; step repetition 15.7% and unawareness of termination 12.4% are together 28%, and neither is a reasoning deficit · source · T1 · arxiv.org
• coding-agent-misalignment — Tang, Chen, Xu et al., May 2026 (arXiv 2605.29442, T1): 20,574 real coding-agent sessions across 1,639 repositories, misalignment operationalized as developer pushback. 90.50% cost effort and trust rather than destroying anything, 91.49% need explicit user correction, and the residual failures shift toward constraint violations and inaccurate self-reporting — the two a user cannot audit · source · T1 · arxiv.org
• swe-bench-illusion — Liang, Garg & Zilouchian Moghaddam, The SWE-Bench Illusion: When State-of-the-Art LLMs Remember Instead of Reason (arXiv 2506.12286, 2025); the contamination study edge 7 asked for. Two diagnostic tasks a genuine solver could not do — name the buggy file from the issue text alone, reproduce the fixed function — over ten GPT/Claude models. 60–76% on SWE-Bench Verified, under 53% on repositories outside it, and 35% vs 18% verbatim 5-gram recall of the fix. Does not invalidate the harness argument; it makes every current swe-bench score an upper bound with an unknown memorisation component · T1 · arxiv.org
• agent-storage-footprint — Yu, Gui, Yu, Zeng & Li (Hong Kong Polytechnic Univ. / Zhejiang Normal), arXiv 2607.11149, Jul 2026: AgentFootprint, the first cross-framework benchmark of what an agent run leaves on disk, and the spoke's first measurement of the framework layer. One replayed trajectory through eight frameworks' persistence adapters → 6.7× spread in retained bytes; among configurations all scoring 100% accuracy, 15.7× (LangGraph 5.10 MB vs CrewAI 0.32 MB); full-history designs grow superlinearly (α up to 1.95: a 200-round loop over one 2 KB file leaves 323 MB); framework residue exceeds delivered artifacts by up to 24,033×. A content-addressed store removes 4.8–32.7× with every restore check passing. Corroborated outside the lab: across 108 SWE-bench Verified submissions, per-instance trajectory volume spans three orders of magnitude with no detectable correlation with resolve rate. 1,061 sandboxed runs; storage ranking survives backend swap (ρ=0.96). Accuracy is a control, so it still does not say whether a framework helps · source · T1 · arxiv.org
• beyond-pass-at-1 — Khanal, Tao & Zhou (Northern Kentucky Univ.), arXiv 2603.29231, Mar 2026: 396 tasks × 4 duration buckets × 3 domains, 10 open-weight models, k=3 repeats, 23,392 episodes — the corpus's first agent study that repeats runs and reports 95% CIs. Four metrics (RDC/VAF/GDS/MOP). Decay is domain-stratified (SE GDS 0.90→0.44, DP flat 0.74→0.71); high variance is a capability signature (frontier VAF ≥2.37 vs mid-tier ≤1.26) and the strongest models meltdown most (19%). Memory scaffolds hurt long-horizon GDS on 5 of 9 models (Llama 3.3 70B Δ=−0.13) — and the abstract's "universally… all 10" overstates its own body · source · T1 · arxiv.org
• swe-bench — Jimenez et al., ICLR 2024 (T1): 2,294 tasks from real issues + merged PRs across 12 Python repos, graded by the repo's own tests. Best model at publication: 1.96% — the number that shows how much of the later progress was harness, not model · source · T1 · arxiv.org
• tau-bench — Yao et al., 2024 (T1): agent × simulated user × written domain policy (retail, airline), graded on final database state. Introduces pass^k — GPT-4o's pass^8 in retail is under 25% — the reliability metric this spoke was arguing without · source · T1 · arxiv.org
• webarena — Zhou et al., CMU, 2023 (T1): self-hosted real web apps (e-commerce, forum, GitLab, CMS), functional-correctness grading. GPT-4 agent 14.41% vs humans 78.24% — acting in an environment nobody designed for an agent · source · T1 · arxiv.org
• self-evolving-agents-survey — arXiv survey: Self-Evolving AI Agents (foundation models → lifelong self-improvement) · source · T1 · arxiv.org
• confucius-code-agent — Wong et al., Meta + Harvard (arXiv 2512.10398, Dec 2025): a four-mechanism coding scaffold (context management, note-taking agent, extensions, meta-agent), 54.3% Resolve@1 on SWE-Bench-Pro. The corpus's first per-mechanism ablation on a coding workload: context management +6.6 pp on Claude 4 Sonnet but +0.6 pp on Claude 4.5 Sonnet, tool sophistication +7.0 pp — the same mechanism worth ten times more on the weaker model. 100-example subset, no variance reported · source · T1 · arxiv.org
• hitchhikers-guide-agentic-ai — Haggai Roitman, arXiv 2606.24937 (cs.AI, rev. 2026-07-27): book-length practitioner reference across the whole stack — LLM substrate → RLHF/PPO/DPO/GRPO alignment → agentic RL, RAG, memory taxonomy, harness design, loop engineering (inference-time RL, generate-verify-retry, adaptive budget control), agent-pattern taxonomy, MCP/A2A/multi-agent topologies, evaluation and deployment. The corpus's first already-assembled source: names as chapters what loop-engineering and agent-memory were derived from scattered tools · source · T1 · arxiv.org
• context-files-ablation-paper — Khatri, Do Context Files Help Coding Agents? (arXiv 2607.27250, 2026-07-28): controlled ablation of AGENTS.md injection across Claude Code + Codex, 17 PR-mined tasks, 288 gold-test runs. No correctness effect (≤10–15pp), near-misses fail on implementation skill not missing knowledge, and a 36-cell probe shows the real file never flips a near-miss to a pass. Process effects only: fewer cache tokens, fewer blind full-suite test runs · source · T1 · arxiv.org
• model-or-harness-taxonomy — Raj et al., Scale AI, arXiv 2607.28802 (2026-07-30): interaction-centric taxonomy of 41 agent failure modes, each assigned an edge between two components (owner/grader/third party · context/memory/tool/peer-subagent · local/external env) and a fault side saying where the repair belongs. 36 of 41 land model-side by construction. Validated with four frontier models as agent-judges (GPT-5.5 κ=0.76 vs human labels; judge-judge κ up to 0.84). Explicitly descriptive — no frequencies · source · T1 · arxiv.org
• ddr-bench — Liu et al., arXiv 2602.02039: proposes Deep Data Research + DDR-Bench, but filed here for its Section 5.2 ablations — reasoning budget, memory, and reactive-vs-proactive varied one at a time on a fixed model (Qwen3-Next-80B-A3B), the design harness-bench and scaffold-effects-gaia cannot supply. Table A1 now held: across 3 datasets × 3 models, only 2 of 27 mechanism additions beat plain ReAct (both +Plan on 10-K); memory never wins; multi-agent takes one cell from 16.67 to 4.44. The corpus's most direct evidence that harness machinery can be negative-value · source · T1 · arxiv.org
• scaffold-effects-gaia — Starace, arXiv 2606.08529 (2026-06-07): the corpus's first crossed model × scaffold design — 5 models (Opus 4.7 / Sonnet 4.6 / Haiku 4.5 / Gemini 3.1 Pro / GPT-5.5) × 3 scaffolds (ReAct, Planner-Actor-Rater, planner-executor) × 139 GAIA questions × 3 attempts, pre-registered, ~5,900 runs. Scaffold moves one model up to 23pp, but never across a capability tier (Haiku's best < Sonnet's worst); Sonnet+PAR does beat Opus+planner-executor. Best scaffold is model-specific — Opus tops L1 on plain ReAct. Closed growth edge #2 · source · T1 · arxiv.org
• claw-swe-bench — Zheng et al., arXiv 2606.12344 (2026-06-10): the coding-domain counterpart to scaffold-effects-gaia — 350 SWE-bench-class instances, 43 repos, 8 languages, with prompt/container/timeout/evaluator all fixed. 5 harnesses (openclaw, hermes-agent, zeroclaw, nanobot, generic) x 2 models, plus 9 models on OpenClaw. Harness spread 12.5pp (GLM 5.1) to 27.4pp (Qwen 3.6-flash) against a 29.4pp model spread — "harness choice is a first-order factor," and it matters more the weaker the model. Two grids, not a full factorial; no frontier model in the harness sweep. Closed the coding half of growth edge #2 · source · T1 · arxiv.org

ScholarlyArticle (added)

• dream-rsi — Zheng et al., arXiv 2609.14858 (14 Sep 2026, cs.CL; Maryland / Google DeepMind / Virginia), via Telegram: self-improvement aimed at the exploration policy over a coding agent, not the agent. Finished discovery trees become a replay simulator; candidate policies are scored offline ("dreaming"), the winner redeploys. Reported: Lasso path 3,587→2,931 ms with 317 vs 550 agent calls; KernelBench kernels in 1.79×–2.43× fewer generations; a claimed 50× budget saving vs SimpleTES on math tasks. Authors' own numbers; mostly a cost claim · source · T1 · arxiv.org

• scienceide — Geng et al., 45 authors (AItonomy / qwen / PhAI-Labs), arXiv 2609.19134 (16 Sep 2026), via Telegram: 27 scientific codebases → 64 environments → 2,812 verifier-checked tasks (1,076 executable checks on numerical outputs and physical invariants); tasks made by deterministic mutation/excision and kept only if the good solution passes and the broken one fails. ScienceIDE-Hard (85 tasks): Fable 5.1 67.1 / Opus 5 64.6 / Astra 63.1. PhAI-IDE 4B/9B/72B via SFT (4,567 segments) + RL; LAPS reward 2.4× in 30 steps — inside the training environment, no transfer shown, by the authors' own limitations · source · T1 · arxiv.org

• environment-evolution — Fan, Yu, Cai et al., arXiv 2609.04128 (3 Sep 2026, cs.AI), via Telegram: the harness pointed at training data instead of at work. Argues that environments synthesized from scratch stop being hard as models improve, and that co-evolution's on-policy dependence — deriving the next environment from what this model just failed — thins the signal as the model gets stronger. Proposes raising difficulty off-policy and scheduling evolved environments generation by generation, along three directions derived from the multi-turn objective, implemented through a "loop-engineered multi-agent harness." Difficulty verified by rollouts with Hy4 preview, claude-opus-5 and GPT-5.6 Sol; training gains +14.4 (Qwen3.6-27B) and +18.0 points (Qwen3.6-35B-A3B) on Terminal-Bench 2.1. Authors' own numbers, v1 preprint, no affiliations listed, no baseline score given and "simple long-horizon RL" unspecified at abstract level · source · T1 · arxiv.org

• harness-bench — Yao et al., arXiv 2605.27922: the full crossed factorial — 8 model backends × 6 harnesses, 106 tasks, 5,194 trajectories, shared budgets and protocol. Harness gap 23.8 pp (NanoBot 76.2% → openclaw 52.4%), and the finding this spoke was waiting for: "stronger model backends… exhibit lower cross-harness variance." Scaffolding substitutes for capability, at three points on the axis now — and has not reached zero · source · T1 · arxiv.org

• meaning-typed-programming — Dantanarayana et al., PACMPL, OOPSLA2 2025 (T1): the paper behind byllm's by operator. Benchmarked against DSPy and LMQL — 4.0×/5.3× less code modified, a blind N=20 user study (3.2× faster, 45% fewer LOC, LMQL scored zero success on the hardest task), and accuracy 90.85% (LMQL) vs 98.23% (DSPy) vs 98.92% (MTP) — one of this spoke's few framework claims backed by a controlled comparison rather than a star count · source · T1 · dl.acm.org

• science-of-agent-reliability — Rabanser, Kapoor, Kirgis, Liu, Utpala & Narayanan (Princeton), arXiv 2602.16666, ICML 2026: reliability as its own axis — twelve metrics over four dimensions (consistency / robustness / predictability / safety), normalized by p(1−p) so they are not accuracy in disguise. 14 proprietary frontier models, zero open-weight, K=5 runs per task at temperature zero, GAIA + the 26 clean τ-bench tasks, on Princeton's HAL harness. 18 months of accuracy gains bought only modest reliability gains — barely any on GAIA, which kills beyond-pass-at-1's guess that closed models are more reliable. Consistency runs backwards against model size within a family; instability is in action ordering, not selection ("what but not when"); resource use varies widely run to run. Two benchmarks, one scaffold each · source · T1 · arxiv.org

• how-many-tools-should-an-agent-see — Repantis et al. (Meta, arXiv 2605.24660), read from the PDF: shortlist depth as the object of evaluation, scored chance-corrected (Bits-over-Random) across registries of 20–3,251 tools. 90.3% at K≈7 against 90.8% at a fixed 50; on ToolBench a fixed 5 wins on aggregate and finds nothing on hard queries. Downstream, Claude Sonnet 4.6 selects better from short adaptive lists — 93.1% vs 87.1%, and 76.8% vs 60.9% on medium queries. Moves the skills question from how many are installed to how many reach the prompt — and never visits the K=N corner where skills live · source · T1 · arxiv.org

• skill-shadowing — Song & Wei, Databricks, arXiv 2605.24050 (2026-05-21): every installed skill in context, no retrieval; pass rate falls 0.08 / 0.14 / 0.21 at 52 / 102 / 202 skills (Haiku 4.5 + Sonnet 4.6, SkillsBench); wrong-skill selection explains up to 68%. Closes edge 14 · source · T1 · arxiv.org

• attention-is-all-you-have — Yin et al., SylphAI + UT Austin, arXiv 2608.12610 (2026-08-12): the first crawl of the published skills ecosystem — 56,804 SKILL.md directories across 1,133 repositories, 56,245 bodies analysed. 21 providers publish 958 first-party skills (AWS 138, Anthropic 379, Google 92) with 79% naming their own CLI; 75 agents use 54 distinct project-level skill directories; two aggregators hold 21% of the corpus; median body 921 words; an installed description costs 50–280 tok on every message. Argues (from the literature, not measured — they propose the experiment) that fewer than 100 reliable auto-trigger slots exist per agent, so the channel degrades as adoption succeeds. Proposes @skills, which the authors also sell around · source · T2 (preprint; authors sell the remedy; classification shares from a 100-skill sample ±10pp) · arxiv.org

• agent-skills-can-be-harmful — Dong et al., Microsoft Research + HUST + UIUC, arXiv 2608.11888 (2026-08-12): differential-testing design over skillsbench + swe-skills-bench, skill pool widened from public marketplaces (826 → 20,664 potential pairs), OpenCode 1.15.1 + Claude Opus 4.6. 307 confirmed skill-induced failures — 125 functional, 182 cost regressions. Wrong-skill-loaded explains 2 of 125; Task-Implementation Fault 86 (68.8%); cost is Excessive Procedure 114/182, not prompt length, with excessive verification the single biggest bucket (67). Counts of harm, no denominator · source · T1 · arxiv.org

• harnessdev — arXiv:2609.01437 (ByteDance Seed, SUTD, Georgia Tech, M-A-P, TokenWave.AI; 2026-09-02). The first benchmark here that asks whether a model can build a harness, not which harness is better: six creators, four domains, five benchmarks, 2,207 instances, from a deliberately weak seed. Model-built harnesses beat the human reference on ML experimentation (32.9 vs 24.0) and writing (84.6 vs 83.7) and lose badly on search (52.4 vs 92.2); overall 67.8 against 86.2. Evolution tops out at +4.44 held-out points and regresses for three of four lineages under a fixed executor. 77.8% of failed Data tasks are harness defects. ByteDance's own Seed 2.0 Pro places last · source · T1 · arXiv

• agensh — Zhan, Song, Dong, Huang, Lian, Xia, Wei (Microsoft Research), arXiv:2609.26781 (2026-09-22). Removes the central orchestrator: concurrent workers claim sub-tasks by reading a shared Git workspace, a Mattermost message layer, and an append-only shared-context log, no agent assigning for the others. On the five hardest ProgramBench tasks, mean pass rate rises 19.31% → 28.78% scaling 1 → 128 agents; on pandoc alone, 33.89% → 55.06% scaling 1 → 1,024. Cooperation forms — peer negotiation, review chains, standardized merge protocols, role specialization — emerge at each successive scale from an unmodified prompt · source · T1 · arxiv.org

Dataset (benchmarks)

• skillsbench — 84 verifier-graded tasks, 11 domains, no-skill / curated-skill / self-generated-skill. Average pass-rate gain from curated skills, and a drop on 16 of the 84 tasks. Also the task set behind jetbrains-ponytail-tested. Known here at second hand · arxiv.org/abs/2602.12670
• swe-skills-bench — 490 repository tasks with deterministic tests, with and without a curated skill. Limited average improvement, many skills with no gain, token overhead up to 451%. Known here at second hand · arxiv.org/abs/2603.15401

Book (sources)

• second-son-house-of-bells — the shipped novel from the autonovel pipeline, bylined "Claude Hermes" (PDF/ePub/audiobook); the reader-facing artifact end of the loop thesis · source · T2 · nousresearch.com

Course (sources)

• claude-101-course — Anthropic Academy's free 14-lesson introduction to Claude as a workplace tool (Skilljar-hosted, certificate at the end): chat → projects/artifacts/skills → connectors/enterprise search/Research → role use cases. The first source here showing skills taught to non-developers by the vendor, and its unit order matches agentic-adoption-ladder from the other side. Syllabus only — lessons are behind registration · source · T1 · anthropic.skilljar.com

SoftwareApplication

• skilltriage — taxonomy-guided attribution tool from agent-skills-can-be-harmful: normalizes a confirmed target/reference pair, extracts differential evidence (5 signals for failures; phase- and tag-level cost deltas for regressions), returns category + cited evidence + repair. GPT-5.5, 2-of-3 vote — 88.8% exact subcategory on functional failures, 72.5% on cost regressions. Triages only; detection stays manual
• virtual-biotech — Stanford's agent population organised as a drug company: tens of thousands of agents, CSO agent, pharma divisions, an "agent school" doing supervised fine-tuning; grew out of a 5–8-agent Virtual Lab that designed COVID nanobodies. Differentiated agents, not replicated ones — the claimed gain is debate between them · T3 · biorxiv.org
• paperclip — the context layer beneath it: unstructured papers plus scattered databases mapped into one AI-native virtual file system, so agents navigate with file operations instead of per-database APIs; the answer to "an MCP wrapper doesn't fix a human-era interface". Claimed order-of-magnitude time/cost cut, no benchmark · T3 · github.com/GXL-ai
• claude-code — Anthropic's terminal coding harness, and the hub node this spoke ran without for two months: named across 84 pages before it had one. Written from what the corpus's own sources measured, not from product docs — including the three studies that found its structural layer moves how it works and not whether it succeeds
• devin — Cognition's autonomous AI software engineer; bets on long-horizon unattended autonomy (8h "through the night"), invariants-then-verify discipline; runs on Fable 5 · source
• moyai — BerriAI's self-hosted, multi-harness background coding agent (Claude Agent SDK/Hermes/Codex/OpenCode/Deep Agents/Tool Loop, switchable per session) over 100+ model providers via LiteLLM; credential isolation as its governance shape; claims ~79% cost cut replacing devin internally (self-reported) · source · T3 · github.com
• adk — Google's Agent Development Kit; loads skills via the open agentskills.io spec
• genkit — Google's open-source framework for agentic full-stack apps: Agents API, pluggable session stores, HTTP-servable agents, JS/TS full-stack client, delegation middleware + HITL; the embeddable-library counterpart to adk's managed runtime (TS/Go/Dart/Python) · source · T1 · developers.googleblog.com
• google-antigravity — Google's developer-facing agent IDE ("agent OS"); v2 split into a VS Code-style IDE + a separate chat-agent app; sub-agents, scheduled/remote background work, SDK/CLI, JSON hooks · source · T3 · geeky-gadgets.com
• claude-cowork — interactive plugin host for the FSI agents
• claude-agent-sdk — Anthropic's official SDK: the Claude Code harness as a Python/TS library (tools, loop, hooks, subagents, MCP) · source
• claude-security-plugin — Anthropic's beta Claude Code plugin: multi-agent vulnerability scanner (/claude-security), six-phase dynamic workflow, model-tiered subagents, 2-of-3 verifier quorum with a Python-computed tally (not model-asserted); a shipped agent-orchestration + verification reference (security = domain, agent machinery = substance) · source · T2 · marktechpost.com
• gemini-managed-agents-hooks — Google: Managed Agents in the Gemini Interactions API — the agent loop sold as one API call (sandbox, code exec, package install, web retrieval), now with environment hooks (pre/post_tool_execution, regex matchers, deny-with-reason fed back into context), max_total_tokens budget caps that pause-and-resume, cron triggers over a persistent sandbox, and free-tier access; the vendor layer's fifth shape — dissolve the harness into the model API, then sell back the hook points · source · T3 · blog.google
• kimi-claw — Moonshot's managed openclaw: one-click 24/7 hosted agent with Kimi K2.6 Thinking + preset skills, deployable to cloud, desktop or an idle Android phone; Claw Groups in preview. The vendor layer's fourth shape — a model lab adding hosting and weights rather than containment; ships K2.6 not K3, and says nothing about skill security · source · T3 · kimi.com
• openclaw — gateway-first open agent harness (Steinberger → OpenAI-sponsored foundation; ClawHub skills marketplace; ~380k★); breadth across channels, governance added by NemoClaw/Scout; the foil to memory-first hermes-agent
• memory-vault — open-source MCP server: Postgres + pgvector persistent memory for Claude Code; externalizes context lost to auto-compaction; the lightweight pole of agent-memory vs seekdb · source · T3 · makeuseof.com
• recall — Claude Code plugin: offline durable memory as plain markdown files (history.md/context.md) via SessionStart/Stop hooks + deterministic TF-IDF/TextRank summaries (no DB/embeddings/LLM); the minimal local-first pole of agent-memory · source · T2 · github.com
• cloud-run-sandboxes — Google Cloud managed primitive to execute untrusted / AI-agent-generated code in an isolated in-instance sandbox (2nd-gen env, shares container CPU/mem, --sandbox-launcher); containment-as-substrate beneath the harness (vs nemoclaw/claude-apps-gateway control planes); server-side sibling of arrow-js's WASM sandbox · source · T2 · docs.cloud.google.com

WebAPI

• cloudflare-agent-memory — cloudflare's managed memory service for agents (private beta 2026-04-17, tyson-trautmann + rob-sutter): profile-scoped ingest/remember/recall/list/forget over a Worker binding or REST, on Durable Objects + Vectorize + Workers AI. The fourth pole of agent-memory and the first nobody self-hosts — an eight-check verifier, facts/events/instructions/tasks typing, supersession by topic key, and five parallel retrieval channels fused by RRF (incl. HyDE). Names LoCoMo/LongMemEval/BEAM and publishes no score against any of them · source · T1 · blog.cloudflare.com
• claude-dreams — anthropic research preview inside claude-managed-agents: reads a memory store + 1–100 past sessions and emits a new store with duplicates merged and contradicted entries replaced. The corpus's first shipped memory-consolidation API — input never modified (review or discard), pipeline is a session you can stream, and it is process without a store, so consolidation becomes a separable stage. No evidence published that a dreamed store retrieves better · source · T1 · platform.claude.com
• claude-managed-agents — headless /v1/agents deployment surface for the FSI agents (refreshed 2026-08-22 from the platform overview: Agent/Environment/Session/Events, self-hosted sandboxes, cron scheduled deployments, MCP tunnels + claude-dreams behind a further preview, and no ZDR or HIPAA BAA because sessions are stateful by design)
• claude-browser-use — anthropic's Browser Use toolset (browser_toolset_20260801, Claude API only): Claude reads a page as its accessibility tree and acts on element refs (ref_3) instead of coordinates, and can batch several actions per turn. 27 operations, none of them executed by Anthropic — the developer hosts the browser, the session and the containment; ~6,600 input tokens of toolset overhead before any content; stale refs are the executor's problem. Not available in claude-managed-agents · source · T2 · vendor tool protocol
• a2a-protocol — A2A (Agent2Agent): cross-vendor agent↔agent interop standard (Agent Cards, tasks, JSON-RPC); Google→Linux Foundation; complements MCP (agent↔tool) · source
• pilot-protocol — "Network OS for agents": own address space + registry instead of DNS, OSI-L5 UDP with NAT hole-punching for direct agent↔agent tunnels, discovery agent, curated app store, USDC/x402 payments as a network primitive; the substrate-replacing branch beside A2A's layer-on-HTTP branch; VC-funded company running its own network, IETF draft; traction figures self-reported · source · T3 · pilotprotocol.network
• webmcp — a page hands its own functionality to an in-browser agent as tools (document.modelContext.registerTool, plus a declarative form synthesized from <form>); the agent→web page slot the interop stack lacked. Its problem statement is an argument against server-side MCP — "UI Disintermediation & Context Loss", naming MCP and OpenAPI — made from inside the standards effort. Microsoft and Google co-authored it from the first commit, breaking this spoke's one-vendor-ships-a-spec pattern; W3C WebML CG, Chrome 149 origin trial, no version, 108 open issues, no stated Apple or Mozilla position · source · T1 · standard

Organization

• supermemory — hosted "memory and context engine" company (supermemory.ai) behind company-brain; publisher of the memory backend it stores on, formerly a paid product now free/self-hosted at the app layer · publisher

• egma-ai — small US GitHub org (3 followers, one public member) behind jev-code-reviewer; main line of work is egma, a voice-agent simulation/monitoring platform · publisher

• agent-sh — GitHub org ("DX focused ecosystem for AI-powered research and development") maintained by avi-fenesh; publishes agentsys, agent-workspace-linux and the inverse computer-use-linux · publisher

• metr — Model Evaluation and Threat Research: Berkeley nonprofit (ex-ARC Evals, 2022, Beth Barnes) behind the task-horizon doubling every ~7 months yardstick (arXiv 2503.14499) and the OpenAI incident investigation held in ../defensive-security-wiki; paged 2026-09-14 after five pages named it with no node · org · evaluator

• metr — Model Evaluation and Threat Research: Berkeley nonprofit (ex-ARC Evals, 2022, Beth Barnes) behind the task-horizon doubling every ~7 months yardstick (arXiv 2503.14499) and the OpenAI incident investigation held in ../defensive-security-wiki; paged 2026-09-14 after five pages named it with no node · org · evaluator

• earendil-works — Austrian GitHub org ("Bearer of Light", earendil.com, 15 repos, created 2025-04-16) that publishes Pi. No company details, funding or business model stated anywhere the corpus has looked, on a project at ~99k stars · publisher

• stencil-labs — Stencil Labs, Inc., the copyright line on omp's MIT LICENSE. stencil.so is a near-empty page serving the Harness Problem images; no product, pricing or team stated anywhere. The same open-project-with-a-company-behind-it shape as earendil-works, and equally silent about the business model · thin node

• veed — subscription video-editor company that published open-edit, the agent skill doing the same job without the editor; also supplies its default transcription and its closed renderer — the application-vendor shape on the vendor ladder

• stanford-university — the university behind james-zou's group, virtual-biotech and paperclip; also the campus the "agent school" is modelled on

• venturebeat — enterprise-AI outlet that both runs vb-transform and reports the talks given there; publisher of stanford-virtual-biotech-37000-agents

• merck — pharma company whose independent arrival at the same CD276 ADC design is the external evidence virtual-biotech's headline claim rests on; it said nothing itself in the source · thin node

• aeterna-labs — publisher of pullmd; AGPL-3.0 self-hosted extraction service, no other evidenced footprint

• s2-stream-store — GitHub org s2-streamstore ("Stream Store", s2.dev, 48 repos, created 2023-06-08); a durable stream API company, not an agent vendor — claude-batch-toolkit is infrastructure engineers tooling their own claude-code use, and the maintenance pattern (one month of commits, then silence) fits that · publisher

• princeton-university — maintainer of the HAL harness the 14-model, five-runs-per-task sweep ran on; an instrument rather than a result

• sylphai — publisher of @skills and the 56,804-skill crawl; ships AdaL (the agent) and atskills.one (the hub) around a free protocol — spec unrequirable, agent the product, hub the position

• loqira-labs — Kazakhstan-based publisher of KOT and dsp-codegen (org created 2026-07-14); its stated line "no cloud, no frontier API" is the opposite of the product it shipped

• alibaba — owner of the Qwen model line and of AMAP-ML, which publishes longhorizon-harness; second vendor after bytedance to ship both a model family and a harness on top of it

• microsoft — Microsoft Foundry (agent factory) + open-source Agent Framework SDK; third agent-platform vendor; adopts agentskills.io + MCP Resources; also microsoft-scout and Microsoft Research's orchestrator-free agensh

• langchain — create_agent / Deep Agents; harness-from-middleware (the fourth agent-platform vendor)

• oceanbase — distributed-DB team (Alipay/Taobao) behind seekdb; the agent-infrastructure/state-store vendor stratum

• harness-io — software-delivery-lifecycle (CI/CD) vendor bringing pipeline governance to agents (harness-agent-dlc); homonym: the company, not agentic-coding-harness

• nolabs-ai — the Sigstore team behind nono; supply-chain-security provenance applied to agent containment (enforced sandboxes over advisory policy)

• signadot — Kubernetes-native ephemeral environments for runtime/behavioural verification; the loop-verification substrate (platform-ops seam)

• nous-research — AI lab behind the Hermes line; owner/developer of hermes-agent + hermes-profile-builder (open-source, model-agnostic, self-driven pole)

• zo-computer — the platform zouroboros is built natively on; thin node (host platform), evidence-only

• ars-technica — NewsMediaOrganization; publisher of anthropic-agent-sdk-billing-pause; canonical tech-news publisher node

• bytedance — big-tech vendor behind the deer-flow SuperAgent harness (built on LangChain/LangGraph); the harness-vendor stratum's big-tech entrant

• nvidia — vendor behind nemoclaw (OpenShell agent-governance layer); plays the agent-agnostic runtime-governance angle rather than shipping its own harness

• tigerless-labs — GitHub org publishing autoharness; thin node (evidence = the repo)

• wassenger — WhatsApp API / messaging-automation platform; owner/maintainer of whatsapp-chatgpt-bot; the channel/gateway-vendor stratum · thin node

• google-labs — Google's experimental-products unit (google-labs-code); publisher of stax · thin node

• google-deepmind — Google's AI lab; thin node, evidence = dream-rsi; parent google lives in llm-providers-wiki

• evomap — curator of awesome-agent-evolution (evomap.ai); publishes the list + a visual field taxonomy · thin node

• cognition — AI company behind devin; long-horizon-autonomy bet + "trust no eval" / Frontier Code benchmark culture; a named Anthropic frontier-agent customer

• foundation-agents — MetaGPT-community GitHub org behind openmanus + OpenManus-RL; the community-org stratum of the vendor map (no company domain, reach without maintenance capacity)

• browser-use — org behind the browser-use agent framework (unsourced here) and video-use; a browser team whose second product is a video editor, joined by method not domain · thin node

• droidrun — GitHub org behind mobilerun (name predates the rename); open framework + Mobilerun Cloud hosted device fleet; publishes the AndroidWorld leaderboard the 91.4% comes from · thin node

• humanlayer — agent-engineering company (the 12-factor-agents framework); publisher of writing-a-good-claude-md; the never-auto-generate side of the CLAUDE.md question · source

• scale-ai — data-and-evaluation company; sourceOrganization of model-or-harness-taxonomy; the failure-taxonomy/eval-methodology stratum · thin node

• kalyan-ks — maintainer of llm-engineer-toolkit; no affiliation, no credential, no inclusion criteria on a 150-entry list with 10.7k stars — paged on the astrosp rationale, that the curator's invisibility is a claim the page rests on · thin node

• turing-post — the newsletter behind turingpost-13-frameworks; thin node, and its unstated inclusion rule is why that census's omissions can't be read · thin node

• singularitynet — Swiss foundation behind OpenCog Hyperon and omega-framework; the README names Superintelligence Alliance Ltd. (Singapore) as distributor, and two of Omega's LLM providers are the alliance's own endpoints. No Wikipedia/Wikidata entry found; same-as is the site and GitHub org · publisher

Person

• avi-fenesh — © holder of agent-workspace-linux, maintainer of agent-sh; systems engineer on AWS ElastiCache, Valkey GLIDE maintainer, founder of the tiyuvta inference service advertised in the README · author
• sepivip — GitHub handle behind seekerclaw; no name or biography published beyond the account · thin node
• xunzhuo — author of inferoa (128 of 132 commits); works on intelligent routing at the vLLM project and open source/AI at AMD. Why an unbenchmarked harness still argues serving mechanics credibly · thin node
• alp-yalay — KhazP, Istanbul; sole author of vibe-coding-prompt-template. GitHub bio: "Vibe Coder" — the label worn as an identity by someone shipping the discipline it was coined against · thin node
• can-boluk — can1357, Netherlands; author of omp and harness-problem-hashline. Self-described security researcher and reverse engineer (Windows kernel, low-level programming, static analysis, cryptography) — not an LLM-tooling background, and omp reads like it: 80k lines of Rust, coreutils compiled in, debuggers as ordinary tools · author
• mario-zechner — badlogic on GitHub (262 repos, 7,536 followers, blog mariozechner.at); author of Pi and, in a post dated 2025-11-02, of the "you don't need MCP" argument KOT reached independently nine months later · author
• sayash-kapoor — Princeton; co-author of science-of-agent-reliability; the evaluation position — one run in a fixed environment says nothing about tomorrow · thin node
• arvind-narayanan — Princeton; senior author of the same, which proposes no method for improving reliability, only twelve metrics for seeing it · thin node
• li-yin — founder/CEO of sylphai, designer of @skills and first author of the skills crawl; earlier, the creator of AdalFlow — the same author on both sides of the prompt-budget line (prompt-optimization and now spending as little of it as possible)
• tyson-trautmann — cloudflare; co-author of cloudflare-agent-memory · thin node
• rob-sutter — cloudflare; co-author of cloudflare-agent-memory · thin node
• swizec-teller — engineer/blogger at swizec.com; reported his own team's model-review spend ($1,000/week BugBot, $1,000/day for review skills in CI) and the linter-compiling answer to it · author
• fatih-kadir-akin — created awesome-chatgpt-prompts in Dec 2022 and maintains it as prompts-chat; publishes as @f · thin node
• james-zou — Stanford biomedical data science; built the Virtual Lab and virtual-biotech, and argues the environments-not-workflows position
• amanda-caswell — AI journalist at the-new-stack; author of anthropic-browser-use-tool, the spoke's only source on claude-browser-use · thin node
• ben-dickson — VentureBeat AI-engineering writer (TechTalks); author of stanford-virtual-biotech-37000-agents · thin node
• jason-starace — sole author of scaffold-effects-gaia, the crossed model × scaffold GAIA comparison that closed the spoke's #1 edge · thin node
• arjun-iyer — CEO of signadot; author of agent-loops-verification (loops replace prompts; verification as the new bottleneck)
• adem-kouki — author of md-this-page (GitHub Ademking) · thin node
• trevor-stuart — SVP/GM at harness-io; the "make the pipeline predictable, not the agent" voice (harness-agent-dlc) · thin node
• boris-cherny — Head of Claude Code at Anthropic; the named voice on the claude-agent-sdk subscription-vs-API cost structure (anthropic-agent-sdk-billing-pause)
• mahipal-jangra — @mukul975; author of the cybersecurity-skills 817-skill agentskills.io pack
• gareth-manning — educator; author of the education-agent-skills 165-skill pedagogy pack (20 yrs international schools, self-reported)
• sickn33 — maintainer of agentic-awesome-skills + the @AASkills_ account; no stated authorship policy for the 2,003 catalog skills · thin node
• dan-kornas — X commentator/newsletter author; the promotional thread through which vibe-tools arrived — a distribution channel, not an authority · thin node
• jesse-vincent — obra; creator of superpowers, the agent-skills framework + dev methodology
• 1jehuang — GitHub handle behind jcode; no biography evidenced; builds its dependencies (own terminal, own mermaid renderer) · thin node
• peter-steinberger — creator of openclaw (→ OpenAI); author of agent-scripts; the skills-as-portable-infrastructure through-line
• parth-sangani — Avyayalaya; author of pm-skills-arsenal (12 deep, typed-schema PM skills)
• emmimal-p-alexander — author of safe-prompt-pruning (TDS); the deterministic context-pruning lever · thin node
• silas-alberti — SVP Research at cognition; the named voice on "trust no eval" + horizon-as-the-capability (cognition-fable5-through-the-night) · thin node
• jake-minns — TDS author of governed-context-claude-code; the "session as a git tree" context-governance workflow · thin node
• rick-hightower — Anthropic Claude Certified Architect; CCA-F series author of cca-f-lost-in-the-middle (API-level context management) · thin node
• oil-oil — GitHub author of beautify-github-readme (README-redesign agent skill) · thin node
• cathryn-lavery — BestSelf.co founder; author of diagram-design (brand-styled editorial diagrams as a skill) · thin node
• justin-le — Haskell writer (blog.jle.im); author of llms-cheese-your-types (types-as-scaffold-for-agents) · thin node
• omar-khattab — MIT EECS/CSAIL assistant professor; lead author of dspy, ColBERT and the DSP→DSPy→MIPRO→GEPA paper line. The corpus's first framework author who arrived through peer review rather than a launch post
• bala-priya-c — Machine Learning Mastery writer; author of agent-anti-patterns · thin node
• eivind-kjosbakken — TDS author of orchestrate-100-agents-claude-code (headless-mode fan-out at scale) · thin node
• kyle-0xblacklight — HumanLayer engineer; author of writing-a-good-claude-md (small+universal CLAUDE.md, the instruction-ceiling argument) · thin node
• harsh-raj — Scale AI; lead author of model-or-harness-taxonomy, the 41-failure-mode edge-plus-fault-side scheme behind agent-failure-localization · thin node
• agrici-daniel — "AI Workflow Architect"; sole maintainer of claude-seo, run with a contributor programme and a paid Skool community around it · thin node
• ruc-nlpir — Renmin University of China's NLP & IR group; published long-horizon-agents-survey. The spoke's first academic lab — the model-vs-harness corner had come from a company research group and unaffiliated preprints · thin node
• zubair-trabzada — author of geo-seo-claude (9.9k★) and ai-marketing-claude (2.7k★); one repo maintained six months, the other abandoned nine minutes after creation — the abandonment signal belongs to the artifact, not the builder · thin node
• tj-boudreaux — author of cc-thinking-skills; built the eval harness that returned a null result on his own skill pack, and published it · thin node
• zheyuan-kong — MaxMiksa; creator of auto-company (unbounded persona-company loop, consensus.md as sole memory) · thin node
• andrew-sims — androoAGI; sole named creator of starnet, holds the name/logo/artwork separately from the MIT code · thin node

Event

• vb-transform — VentureBeat's enterprise-AI conference (Menlo Park); the 2026 edition is where james-zou presented virtual-biotech · thin node

Synthesis

• synthesis — the evolving thesis: skills → harness → orchestration/deployment

Bridge nodes (live in sibling wikis, linked cross-wiki)

gbrain · agent-skills · compound-engineering · model-context-protocol · anthropic · claude-opus-4-8 · claude-fable-5 · garry-tan (../research-wiki) · google (../llm-providers-wiki — canonical Google node; agent-platform-vendor facet noted there) · simon-willison (../llm-providers-wiki — canonical node; the coding-agent-security facet is used here) · xai-grok (../llm-providers-wiki — canonical xAI/Grok node; the coding-harness grok-build is its agent-tooling face)