Synthesis — Agentic Tooling

The evolving thesis. This spoke was split out of research-wiki’s “cluster B” on 2026-06-01, when a single Telegram burst added ~10 agent-tooling sources and the cluster became larger than its parent’s core. It owns the tooling for building and running LLM agents; the knowledge-management / tools-for-thought lineage stays in research-wiki, joined here by a few explicitly cross-linked bridge nodes (gbrain, agent-skills, compound-engineering, model-context-protocol, anthropic, claude-opus-4-8).

Current thesis

The frontier model writes code; the value has moved to everything wrapped around it. A claimed leaked Claude system prompt (claude-fable-system-prompt-leak) is the vendor-side snapshot of exactly this — tools (web search, artifacts, MCP connectors, code execution), memory, safety rules, and behavior assembled into one configured layer — though as a T4 unverified leak it illustrates the pattern, not proves any specific. Six layers recur across the (verified) sources:

1. Capability as portable markdown — agent-skills. Domain expertise + procedures bundled as markdown an agent loads at runtime: claude-financial-services (FSI verticals), agentic-seo-skill and claude-skills-ppc (marketing), gstack‘s 23 role-skills, and now cybersecurity-skills — an 817-skill security pack that is the wiki’s largest skillpack and a scaling test of the standard itself: an agent scans all 817 ~30-token frontmatters in one pass and loads only the matched workflow, so “metadata → body → resources on demand” is shown working at three orders of magnitude past a toy. (It also turns the standard reflexive: two of its framework mappings — MITRE ATLAS, NIST AI RMF — are about attacking/defending agents, so an agent skillpack ships agent-security skills.) A different shape of the same primitive is superpowers (Jesse Vincent/obra): not domain expertise but a whole software-development methodology packaged as ~two dozen composable skills the agent self-invokes (brainstorm→plan→test→build→debug→review). It is notable for spanning the layers — bundling orchestration skills (subagent-driven development, parallel agents, git-worktrees) alongside the per-phase ones — and for shipping cross-harness (Claude Code, Cursor, Codex, Copilot/Gemini CLI), making it a portable methodology rather than a single-tool plugin. (Reflexively, it is the skill system this very hub session runs on.) Its nearest sibling is compound-engineering-plugin (Every Inc), re-read 2026-07-25 and grown to 32 skills across 13 host CLIs. Same idea — a development methodology as a skillpack — with two instructive differences. First, who invokes: superpowers has the agent self-invoke, compound-engineering exposes explicit /ce-* slash commands a human drives (with /lfg as the autonomous escape hatch), so the same primitive supports both an agent-initiative and a human-initiative loop. Second, and the part worth stealing, it ships /ce-compound: a skill whose output is the next run’s context, written to docs/solutions/. Every other pack in this section codifies expertise once, up front; this one closes the loop back onto its own artifact store, which is self-improving-agents achieved with a filesystem instead of a weight update. Its portability is also honestly expensive — a separate plugin manifest per host, not one artifact carried by the standard — which is the pre-standard tax the spec exists to remove, still being paid by the biggest packs. A third point on the invoke axis arrived 2026-08-05: superclaude-framework (23.7k★, MIT) — 30 slash commands, 20 role-persona agents, 7 behavioral modes and 8 wired-in MCP servers, installed by pipx writing configuration into claude-code. Its phase vocabulary is nearly word-for-word superpowers’ (brainstorm, research, test) but its primary surface is a command the operator types, which puts it on compound-engineering’s side of the line. Three packs now teach the same arc and disagree only about who pulls the trigger — the strongest sign yet that the methodology is settled and the control point is the live design question. SuperClaude is also Claude-Code-only where the other two are cross-harness, and its announced v5 (a TypeScript plugin system) would move it onto the same plugin rails, so the portability tax above is being paid down by a second route: not one artifact per the standard, but a rewrite off ad-hoc config injection. None of the three has an evaluation, and this is now the section’s standing hole rather than a note on one entry. cc-thinking-skills remains the only place anyone ran the harness on a comparable pack and it found zero proven accuracy gains across 39 skills. Star counts (242k, 23.7k) measure installs. ruflo (67.1k★, ex-Claude Flow), routed the same day, is the layer above: not a methodology pack but an agent meta-harness wrapping claude-code in swarm topologies, 100+ agent roles, ~210 parallel MCP tools, vector memory, a self-learning loop and cross-organization federation. It bundles in one package what this spoke has otherwise met one claim at a time — orchestrate-100-agents-claude-code for fan-out, iai-pme for memory, nono for sandboxed execution, qm for multi-operator coordination — and it inverts those projects on evidence: each defends a single claim with a number, Ruflo asserts all of them behind one conditional speedup. Across the day’s three packages the pattern is consistent enough to state: in this corner adoption and measurement are uncorrelated, and the most-starred artifact is usually the least evaluated. Its federation claim is the one nothing else here attempts — agents cooperating across an org boundary under zero trust, strictly harder than qm‘s tightening-only posture inside one org, and the place to watch for a first independent account. A source that arrives assembled (2026-08-05, hitchhikers-guide-agentic-ai). Roitman’s arXiv book runs the whole stack — substrate, alignment, agentic RL, RAG, memory, harness, loops, MCP/A2A, evaluation, deployment — on the thesis that competence at one layer does not survive ignorance of the others. It is the first source here that is not a repository, a post or a benchmark, and it independently names two things this spoke reached the long way. Loop engineering is a chapter, with generate-verify-retry and adaptive budget control as named mechanisms; the corpus derived loop-engineering from practitioner accounts and has documented no budget lever at all. The in-context / external / episodic / semantic memory taxonomy is standing vocabulary there, where the spoke assembled it from iai-pme‘s tiers and jcode‘s memory graph. Convergence between a literature synthesis and a corpus built bottom-up from artifacts is the strongest evidence either one gets that the categories are real. It also puts the section’s evidence hole in relief. The book teaches evaluation methodology for agentic tasks as settled enough to have a chapter, while the field it describes ships packs with 242k and 67.1k stars and no measurements. Nothing here resolves that; both facts stand. The packs leave software (2026-08-05, opc-skills). ReScienceLab’s Apache-2.0 pack (1.2k★, ~11 skills, 16+ host tools) is for solopreneurs and one-person companies, and none of its skills touches a codebase: market research on Reddit/Twitter/Product Hunt, domain hunting, SEO, logo and banner generation, archiving. Everything else in this section teaches an agent to build or ship software; the two marketing packs here are single-discipline. So the standard travels to a domain with no compiler, no test suite and no CI — which removes the free verification every coding pack has been leaning on, and neither the pack nor the format offers a substitute. It also puts a third answer on the table for where composition lives: domain-hunter declares a dependency on twitter and reddit inside the skill, where the standard has no dependency mechanism at all and agentic-awesome-skills pushes the question out to an MCP control plane that lets the agent pick IDs and validates structure only. In the standard, in a control plane, or in the skill — three placements, no argument yet for any of them. The individual-developer floor of this is agent-scripts (Peter Steinberger, the openclaw author): one engineer’s private hub of skills + AGENTS.MD hard rules + helper scripts, kept DRY across all his repos and mirrored into both Codex and Claude Code by a sync-skills script. Where superpowers and pm-skills are cross-harness packs for others, this is the smallest useful unit — a portable skill set for one person’s machines — and its sync-skills / validate-skills are the same library-maintenance ops autoharness automates, here run by hand. That the OpenClaw author standardizes his own work on these conventions is a small vote for how load-bearing they’ve become. This is hardening from per-tool conventions into an open cross-vendor standard, agentskills-spec (agentskills.io) — one skill across “Gemini CLI, Claude Code, Cursor, 40+ products” — with progressive disclosure (metadata → body → resources on demand) the load-on-demand mechanism. Skills become agentic when combined with tools/data via model-context-protocol (the explicit “skills × MCP = agency” formula). A concrete, fully-local worked example is from-local-llm-to-agent: a Gemma model on Ollama (OpenAI-compatible endpoint) driven by the OpenAI Agents SDK calling MCP tools — showing the agent layer decouples from where the tokens come from, so “agency = the configured layer, not the model” holds even with no cloud model.

   The standards layer around this primitive now spans five edges: skills (agentskills-spec = what an agent can do), context (agents-md = what it must know about a project; 60k+ repos, Linux Foundation) tools (MCP = how it reaches data/APIs), interop (a2a-protocol = how agents from different frameworks collaborate without exposing internal state — Agent Cards, tasks, JSON-RPC/HTTP), and discovery (agentic-resource-discovery = how an agent finds and trusts capabilities across organizations). The framing: MCP = agent→tool; A2A = agent→agent — complementary, MCP runs inside an A2A ecosystem — and ARD = how you find either across domains (an ai-catalog.json at a well-known path, indexed by registries that are “search engines for the agentic web,” with domain-rooted cryptographic trust). The interop edge now has a running cross-language instance: adk-a2a-cross-language drives a Go validator (plain HTTP, no AI framework) from a Python ADK orchestrator via A2A alone — so “decompose the monolith into per-language microservice agents” is demonstrated, not just specified, and orchestrator → fan-out provably crosses language and framework boundaries. ARD is a meta-standard: it doesn’t replace MCP/A2A, it indexes them. Five distinct open standards, each a candidate attractor or a fragmentation front; the governance move repeats (vendor → neutral foundation → default) — ARD’s data model lands in the Linux Foundation (AI Catalog Working Group), the same home as A2A and AGENTS.md. agents-md and agentskills-spec are siblings: skills = what an agent can do; AGENTS.md = what it must know about the project it’s working in.

   A sixth contender that isn’t at the same layer (2026-07-27, pilot-protocol). All five above are formats layered on the human internet — JSON-RPC over HTTP, a catalog file at a well-known path, markdown conventions — keeping DNS, TLS and HTTP and adding agent semantics above them. pilot-protocol takes the other branch: its own address space resolved by its own registry instead of DNS, an OSI-layer-5 UDP protocol with NAT hole-punching so agents connect directly, its own discovery agent, a curated app store, and payments (USDC via x402) as a network primitive. So “which standard becomes the attractor” may be the wrong shape of question — the prior one is does the agent web run on the human web at all. A2A bets that HTTP’s installed infrastructure (DNS, TLS, proxies, every firewall rule already written) outweighs the impedance mismatch; Pilot bets the mismatch is the point. Two further notes. Payments are a genuine gap the five don’t address: none of them says how one agent compensates another, which is what decides whether an open agent network can sustain itself (the consumer-facing half sits cross-spoke at ../search-marketing-wiki’s agentic-commerce; this is agent-to-agent settlement). And the governance pattern inverts — where A2A, AGENTS.md and ARD all ran vendor → neutral foundation → default, Pilot is a venture-funded company operating the network it specifies, with an IETF Internet-Draft that confers no standing until a working group adopts it. Its self-reported ~219k agents and ~33k req/s are unaudited marketing counters, so treat the traction claim separately from the architectural argument, which is the part worth keeping.

   A seventh, and it argues against one of the five (2026-08-12, webmcp). WebMCP fills the slot the stack above never had — agent→web page. A page registers its own functions and <form>s as tools (document.modelContext.registerTool) and an in-browser agent calls them in the tab the user is already looking at. The reason given is the interesting part, because of who gives it: the explainer’s case is that backend integrations — naming MCP and OpenAPI — bypass the UI, which it calls “UI Disintermediation & Context Loss,” forcing a developer to “replicate the user’s state, active context, and authentication credentials on a separate server.” This corpus has held that objection before only from critics. Here it is the problem statement of a spec written by the people building the ecosystem, and WebMCP still “shares a common vocabulary with MCP.”

   That cuts against the framing above in a specific way. The five standards were read as candidates to become the attractor, differing in layer and scope. WebMCP says the choice is not only which protocol but where the capability lives — and a capability implemented inside a page is one an ai-catalog.json entry cannot point at, so ARD’s index has a blind spot by construction.

   And the governance pattern breaks a second time, in the other direction from Pilot. pilot-protocol inverted it by being a company operating its own network. WebMCP inverts it by having no single vendor to invert — Microsoft and Google are co-authors from the first commit (13 August 2025), in a W3C community group rather than a foundation created around the artifact. So the spoke now holds three governance shapes rather than one pattern with exceptions: vendor → foundation → default (A2A, AGENTS.md, ARD), vendor operates the network (Pilot), and multi-vendor incubation in an existing standards body (WebMCP). Their failure modes differ, which is the useful part: the first fails by nobody else adopting it, the second by the company, and the third by stalling. WebMCP is at 108 open issues against 124 commits with no version number, in a Chrome origin trial from Chrome 149, and neither Apple nor Mozilla has a stated position in anything read. For a proposal adding an agent-facing API to every page on the web, that absence is the number to watch.

   A split inside the primitive, and the first measurement of it (2026-07-22). Everything above treats a skill as capability — knowledge or procedure the agent lacked. A second kind rides the same SKILL.md channel and makes a weaker claim: cognitive skills, which prescribe how to think about a problem rather than granting anything new. cc-thinking-skills packages 39 of them (Munger, Meadows, Kahneman, Goldratt, Boyd) behind a router meta-skill — and, unusually, ships the eval harness too, reporting that zero of the 39 show a robust replicated accuracy gain against a length-matched placebo (best candidate thinking-scientific-method: +5.3pp, p=0.061, n=150, DIRECTIONAL-NOT-REPLICATED). auto-company makes the same bet in the persona encoding (14 named experts, “extreme business and engineering depth”), untested. The scope is narrow — scoreable accuracy only, one author, one harness — but it is the first negative evidence in the spoke against any part of “structure substitutes for capability,” and it lands precisely where the substitution was cheapest to assert. Progressive disclosure’s token-budget win is mechanical and stands; “reasons better because it was handed a framework” does not, yet.

2. Structure around the model — the agentic-coding-harness. A wave of products (agentsys, agent-kanban, claw-code, conductor, gstack, agent-starter-pack) crystallizes one bet: structure substitutes for capability — phase gates, deterministic tools instead of token-spend, confidence grading, persistent state, multi-agent + human coordination. agentsys pushes the strong form (Sonnet + harness > raw Opus on cost-effectiveness). The instances span a full plan → build → deploy spectrum: conductor (context/plan) → agentsys/agent-kanban/gstack (build/orchestrate) → agent-starter-pack (deploy/operate), over the thin provider- agnostic substrate claw-code. langchain supplies the canonical formula and the structural unit: agent = model + harness, “task-harness fit > raw model capability”, and the harness built from composable agent-middleware — single-concern pieces that hook the agent loop (before/after model & tool calls, startup/teardown) and stack instead of a monolith (langchain-custom-harness). Tellingly, LangChain’s prebuilt middleware are just this wiki’s other threads as drop-ins — delegation = agent-orchestration, human-in-the-loop = supervision (agent-kanban), state = durable-agents, memory = gbrain — so the harness is a middleware stack over orchestration / durability / supervision / skills. easy-agent turns that decomposition into a curriculum. It’s a terminal-native coding CLI (TS/Node, React/Ink TUI) that rebuilds a Claude Code-style harness as five explicit layers — provider I/O, tools, the agent loop, session/orchestration, terminal UI — with 31 step-by-step snapshots so the harness can be read accreting one capability at a time. It is the agent = model + harness formula made legible: the same parts the spoke keeps naming, separated on purpose instead of hidden behind one wrapper, and provider-agnostic (Anthropic/OpenAI-compatible/ Gemini/Ollama) like claw-code. The teaching intent rhymes with lathe‘s “teach, don’t do for you” — here aimed at how a coding agent is built, the magic resolved into engineering. The pattern is now generalizing beyond coding to everyday verticals: ai-job-search is a fork-and-customize Claude Code harness for job applications (skills + slash commands + a drafter–reviewer subagent loop) — same primitives, non-coding domain. It also adds a sharp reliability pattern, output-grounded verification: rather than trusting generation, it compiles the LaTeX, reads the rendered PDF, and fixes layout until visual inspection passes — verifying the artifact, not the model output (the same “structure/checks over raw capability” discipline as the durability/guardrails threads). The vertical-generalization is now itself productized as a marketplace: pm-skills packages 68 skills / 9 plugins / 42 chained workflows for product management (discovery→strategy→execution→launch→growth) — same primitives (agent-skills + slash commands that chain skills), a knowledge-heavy non-coding domain, and notably cross-vendor (Claude Code/Cowork, Codex, exported to Gemini CLI/Cursor/Kiro) — a real-world stress test of the portable-skill thesis. A second PM instance, pm-skills-arsenal (2026-07), bets the opposite shape — a few very deep skills (12 at ~1,000–1,300 lines) instead of 68 shallow ones — and pushes the composition question a rung further: each SKILL.md declares a typed input_schema/output_schema so an orchestrator can route between skills structurally, from their I/O contracts, without reading the body. That is skills reaching for composability-by-schema rather than composability-by-prose — the advertise→load→read progression extended from a metadata blurb to a declared signature, a skill treated as a typed function. It ships that composition as a service too: an MCP server whose run_skill/list_skills/get_skill tools let an agent enumerate and invoke a skill over MCP (the “skills × MCP = agency” formula with an explicit invocation surface). So the two PM packs frame a design axis inside one vertical — many-shallow-chained-by-commands vs few-deep-routed-by-schemas — while both still lean on unmeasured self-reported quality (the Open-questions benchmark gap). designpowers adds the role-split-team shape to a vertical: 10 named specialist agents (strategist, design-lead, motion, content, accessibility-reviewer, critic, heuristic-evaluator…) run a Discover→Ship design pipeline off 36 skills, cross-harness (Claude Code + Gemini CLI + Cursor/…). It’s gstack‘s role-agent factory pointed at design instead of software — evidence role-split orchestration generalizes past coding — and it foregrounds the human-director governance knob: a Direct mode gating every handoff vs a bounded Auto mode that only pauses on accessibility/critic/reviewer-conflict flags (agent-guardrails applied to a creative pipeline). Its own substance-bet is accessibility-as-default (inclusive personas, cognitive-load skills, a looping reviewer) rather than accessibility-as-final-audit. The vertical list keeps lengthening: beautify-github-readme (2026-07) points the same skill primitive at developer communication / repo presentation — redesigning a README’s hierarchy (proof-before-technical) and generating project-native SVG identity, on a Markdown-for-searchable-text / SVG-for-visual-identity separation of concerns. It’s a small but clean data point that “package an editorial/design discipline as a skill” (renwei-writing, ponytail, designpowers) now reaches even the humble README — and a human-facing counterpoint to the openwiki/autowiki-factory docs-as-artifact thread (which generates repo docs for agents). diagram-design (2026-08) lands next door in diagramming, and the pairing with designpowers is the useful bit: same design vertical, opposite structural bet — a 10-agent orchestrated pipeline there, one skill over a 34-document progressively-loaded reference library here. education-agent-skills (2026-08) takes the vertical into teaching, and changes two things about the form. 165 skills across 20 pedagogy domains, cross-vendor (Claude Code, Claude.ai over a hosted MCP server with OAuth, Codex, Hermes) — routine for the pattern by now. What is not routine: each skill’s frontmatter carries evidence_strength plus named evidence_sources (VanLehn 2011’s tutoring meta-analysis, Shute 2008 on formative feedback, and so on), so the provenance of the technique is machine-readable alongside the technique. Every other pack here asserts its own quality; this one points at literature a reader can go and check. That is not a benchmark and does not pretend to be — nobody measured the skill — but it moves the quality claim from unfalsifiable to auditable, which is the first movement on that axis the vertical packs have shown. It also lands typed input_schema/output_schema independently of pm-skills-arsenal, in an unrelated vertical by an unrelated author, both paired with an MCP invocation surface: two independent arrivals make skill-as-typed-function a property of how the standard gets used rather than one team’s house style. And it is the first vertical aimed past the practitioner — its Domain 20 (13 skills) addresses students mid-study-session, the subject of the professional’s work rather than the professional.

   The harness-vendor stratum gains a big-tech entrant. deer-flow (ByteDance) is a production “SuperAgent” harness bundling sandboxes + persistent memory + markdown skills + parallel sub-agents + a chat-app message gateway, and is built on LangChain/LangGraph rather than replacing it. So microsoft (Foundry), Google (adk), langchain, and now bytedance all ship the same composition — evidence the harness is consolidating into vendor platforms, not just community tools, the same parts reached independently at big-tech scale. (Reflexively, DeerFlow’s Telegram/Slack/Feishu message gateway is the chat-as-control-surface this hub itself runs on.) Google shows the stratum has two surfaces, not one. Beyond the SDK-side adk, Google ships Antigravity, a developer-facing agent IDE (“agent operating system”) carrying the same composition — parallel sub-agents, async/scheduled background work in remote Linux, browser/Chrome-DevTools control, an SDK + CLI, and JSON hooks. Its 2.0 update split the unified app into two — a VS Code-style IDE and a separate chat-agent app — a bet on IDE-surface vs chat-surface as distinct control points, the same same-anatomy-different-control-point frame playing out inside one vendor’s product line. The mixed reception (usability regression, tighter usage limits) is the recurring harness-as-product cost/UX friction, the consumer-facing twin of the SDK-billing problem. That friction cuts both ways (2026-07): the claude-code-weekly-limits-promo — a temporary +50% boost to Claude Code’s weekly cap (May 13–Aug 19 2026, Pro/Max/Team/legacy-Enterprise) — is Anthropic leaning the other direction. Two things generalize past the promo: Claude Code rations on two independent limits (a 5-hour window and a weekly cap), and it’s the weekly cap the vendor dials (the 5-hour throttle is untouched) — so the subscription harness’s limits are a managed, adjustable surface, not a fixed spec, movable for competitive/goodwill reasons without touching price. The enterprise counterpart to that consumer lever is the spend-cap governance in claude-apps-gateway. A worked production deployment now backs the Google stack — ai-race-coach (2026-07). A GDE team built a real-time AI driving coach at Sonoma Raceway on Antigravity + ADK, and it does two things for the synthesis. First it gives Antigravity a second face: here it’s not the coding IDE but a runtime “domain-bridging engine” doing stateful telemetry orchestration, while ADK orchestrates the coaching agents in the field — the big-tech harness shipping into a live system, not a docs example. Second, its edge/cloud model split (Gemma 4 local for zero-latency audio alerts, the Gemini API cloud for post-session modelling) is the spoke’s route-by-latency-and-depth idea (tokenmining routing, tail-control-agentic-workflows‘s downshift) in a setting where latency isn’t a metaphor — the driver is mid-corner. It’s also the corpus’s closest brush with the embodied/physical-agent blind spot the EvoMap taxonomy flags: a real-time agent reading physical-sensor telemetry under a hard deadline, in scope here because the tooling is the subject. (T3 vendor case study — specifics reported, not independently verified.)

   Same anatomy, different control point — openclaw-hermes-control-layer. The clearest comparative frame the spoke has: openclaw and hermes-agent agree on the harness anatomy (runtime + gateway + memory + tools + identity + policy) but bet on different primary control points — openclaw gateway-first (breadth: one agent across dozens of channels, ClawHub’s skills marketplace) vs hermes-agent memory-first (depth: persistent memory + self-refining skills on infra you own). Two conclusions fold into the thesis. (1) Memory is the durable lock-in — “an agent that has learned a year of a developer’s habits” has a higher switching cost than one that merely reaches many channels, which elevates the agent-memory layer (seekdb → memory-vault → recall) from plumbing to the strategic moat. (2) The platform vendors are claiming the runtime/governance layer beneath whichever agent — NVIDIA‘s NemoClaw and Microsoft’s Scout wrap OpenClaw with sandboxing + identity (agent-guardrails as external containment), and NemoClaw already runs Hermes under the same controls — so governance is becoming agent-agnostic infrastructure, the runtime layer that “will outlast any single foundation model.” The contest has moved past model selection to who owns the runtime, the governance, and the memory. nemoclaw is that thesis as a first-party repo (NVIDIA, primary source): one CLI/control plane that sandboxes openclaw, hermes-agent, and LangChain Deep Agents interchangeably inside OpenShell — and it extends governance to managed (“routed”) inference (the agent can’t call model endpoints directly), so the control plane owns not just what files the agent touches but which model it may call. NemoClaw (multi-harness, OpenShell) and Scout (single-harness, Entra identity) are the two concrete shapes of the vendor runtime-governance layer. A fourth shape, and it isn’t governance at all — kimi-claw (2026-07-28). Moonshot ships openclaw as a one-click hosted 24/7 agent with Kimi K2.6 Thinking and skills preconfigured (cloud server, desktop, or an idle Android phone). No policy runtime, no identity layer, nothing said about sandboxing: what it adds is hosting and a model. So the layer above OpenClaw sorts by what the vendor already sells — NVIDIA a runtime, Microsoft an OS and identity, Anthropic its own harness, and a model lab its weights plus an ops team. That’s a lab integrating downward, from the model into the harness that consumes it, and the exact mirror of ../llm-providers-wiki’s sakana-fugu, which sells an agent system as a model: the model/product boundary being collapsed from both sides in the same week. Two things worth holding. The governance gap this thread is about reappears untouched — a hosted deployment with preinstalled skills inherits ClawHub’s 341 malicious skills problem, and the product page is silent on it. And Moonshot’s own agent runs K2.6, not K3, released the day before: the flagship a lab announces and the model its products actually run are different facts. A fifth shape — sell the loop as an API (gemini-managed-agents-hooks, 2026-07-28). Google’s Managed Agents put orchestration, code execution, package installation and a sandbox behind “a single API call,” pitched to run “without… requiring external orchestration” — i.e. without a harness at all. Where Kimi hosts a harness someone else wrote, this dissolves the harness into the model API, which is a lab integrating downward past the harness rather than into it. What that costs is stated best by Google’s own customer: “the sandbox is remote, so our validation code had nowhere to run.” Handing the loop to a vendor takes away the place where verification executes — the assumption the whole agent-loops-verification thread rests on. The new hooks (pre_tool_execution / post_tool_execution, regex matchers, in-sandbox commands or http handlers) are Google selling back a slice of exactly that: agent-middleware‘s hook points, re-sold as a managed feature to plug the hole the managed model opened. So the vendor layer now has a shape whose product is the absence of your infrastructure, and whose first feature request was a way to put some of it back. The Claude apps gateway for Google Cloud adds the third — the shape from the harness vendor itself. Where NemoClaw/Scout wrap someone else’s agent, this is Anthropic (with Google Cloud) governing its own harness (Claude Code) with the identical anatomy: IdP identity (no keys on laptops), RBAC in gateway.yaml, per-user spend caps, verified-JWT telemetry, and single-service-identity routing to Vertex AI — the same control-plane-owns-which-model- you-call move nemoclaw makes, delivered turnkey on Cloud Run. It closes two loops: it’s the operational answer to the harness cost-structure tension (cap-and-attribute runaway usage instead of repricing it — governance and cost are one surface), and the governance twin of agent-starter-pack (both Cloud-Run agent-ops tooling: starter-pack deploys an agent, the gateway governs a developer fleet using one — deploy→operate→govern on one substrate). So “governance is agent-agnostic infrastructure” now has a first-party, single-harness counter-instance: the vendor also builds the control plane for its own agent, not just third parties for others’. The containment layer now reaches beneath the harness, into the serverless substrate — cloud-run-sandboxes (2026, public preview). Where NemoClaw/Scout/the Claude gateway wrap an agent with a control plane, Google Cloud ships agent-code sandboxing as a managed primitive: a fast, isolated environment to “execute untrusted code … such as AI agents” that runs in-instance (sharing the container’s CPU/memory, latency-optimized) so the untrusted-code round-trip is cheap enough to live inside an agent’s tool loop. It’s the server-side sibling of arrow-js‘s WASM sandbox (browser-side containment of agent-generated UI) — both answer “run this model-written code safely,” at opposite ends of the stack — and it adds the missing execution-isolation rung to Google Cloud’s deploy → govern → sandbox agent story (agent-starter-pack deploys, claude-apps-gateway governs, this isolates), all on one substrate. So “governance/containment is agent-agnostic infrastructure” now spans two altitudes: a control plane wrapping the harness (NemoClaw/Scout/ gateway) and a substrate feature beneath it (Cloud Run sandboxes). Caveat: the preview docs don’t name the isolation mechanism (gVisor/microVM?), on which the whole security claim rests — a first-party, unevaluated vendor bet for now. A third altitude, and a different unit of containment — nono (2026-07-27). Both altitudes above contain the agent: wrap it in a control plane, or drop its code into an isolated execution environment. nono (Apache-2.0, ~3.2k★, from the Sigstore team via nolabs-ai) argues the unit is wrong — the privileges that matter belong to the tools the agent delegates to (git, gh, curl, kubectl), and one agent-level policy hands every one of them the same secrets and network. So each delegated tool gets its own child sandbox with its own filesystem grants, network rules, credentials and policy, and tokens reach the tool through a proxy with L7 endpoint filtering instead of being handed to the agent. Two consequences the agent-guardrails thread had no answer for: the agent cannot widen a tool’s permissions from inside its session (that policy was never its to hold), and the “turn the prompts off” escape hatch that auto-company reaches for stops existing, because the restriction was never a prompt. It also runs without a daemon, container or VM on a laptop, which is a different bet from the substrate-level primitive above — containment as a local binary rather than a cloud feature. And its policies are composable JSON with inheritance and a public registry, making a restriction a shareable versioned artifact, the packaging move agent-skills made for capability. Same unevaluated caveat as Cloud Run sandboxes, and it bites harder here: a sandbox is judged by escapes, this one is pre-1.0, and no audit or threat model is in evidence. Worth noting the provenance — supply-chain-security people (Sigstore) entering agent tooling is itself a signal about which problems are now load-bearing, and their instinct is the same one ../defensive-security-wiki’s Beyond Zero arrived at independently the same week: authorize the action, don’t trust the holder of the session.

3. Execution & deployment patterns. agent-orchestration (orchestrator → parallel subagent fan-out, adversarial verification) is the execution-time engine, paired at authoring time with spec-driven-development (agree a reviewable spec — or, per conductor, persistent context — before the agent codes). The fan-out has a large-scale, process-level flavor: orchestrate-100-agents-claude-code runs 100+ agents as independent headless claude -p sessions (not nested in-process loops), coordinated by one orchestrator with no shared state — each task scoped and isolated so agents can’t interfere. That isolation is where orchestration meets context-rot (a fresh session per task is rot-avoidance-by-isolation, the “fork/isolate” move at fleet scale) and agent-guardrails (fully autonomous agents made safe by task choice — well-defined, reversible refactors — rather than human checkpoints); its honest limit (works for well-scoped work, not ambiguous tasks) is the match-pattern-to-task rule again. That authoring discipline now has a named far end: context-driven-development (CDD), articulated in Google’s Conductor launch post as a third point past vibe-coding and spec-driven — the whole project context (product, stack, workflow) kept as durable, reviewed Markdown, not just a per-change spec. As agents do more typing, the durable human contribution shifts to curated, versioned context; that Google names it on the Gemini-CLI side is another sign the harness race is converging on planning/context governance, not raw generation. A deployment axis also appears (claude-code-channels-vs-openclaw): event-driven (Anthropic’s Channels — reactive, human-messaged; the channel driving this very wiki) vs self-driven (OpenClaw — an autonomous heartbeat daemon). The self-driven pole is going mainstream: OpenClaw is now both forked (hermes-agent, open-source successor) and productized by a major vendor (microsoft-scout, built on OpenClaw, Microsoft-365-integrated) — the autonomous, durable, self-improving personal assistant is no longer fringe. Notably both ship governance (Scout’s continuous “policy conformance” audit; Hermes’ command-approval/isolation), making the reliability discipline a product feature, not an afterthought. That discipline now has an explicit practitioner framework — agent-guardrails (agents-never-do-alone): bound autonomy by reversibility / recovery cost, hard-stop the irreversible (prod deploys, infra, auth, secrets, destructive ops) behind human checkpoints, and codify the limits in an AGENTS.md contract + blocked_commands.md block list + a two-agent review loop. It’s the explicit counterweight to the autonomy push of layers 4–5: as agents do more alone, the guardrails map the bright lines they shouldn’t cross. A practitioner anti-patterns checklist (agent-anti-patterns, 2026-07) states this one almost verbatim — “ungoverned write access” fixed by separating read/write, validating outputs, and human-confirming high-stakes actions — and, tellingly, its nine items map nearly one-to-one onto this synthesis’s threads (start-simple/building-effective-agents, tool-sprawl+drift/context-rot, layered memory, eval-before-deploy/loop-engineering), a second outside-in corroboration of the layer model after EvoMap — EvoMap maps the field, this enumerates its failure modes, both reproduce the same structure. Reliability has a second axis — latency, not just safety (tail-control-agentic-workflows): behind a customer deadline, an agent workflow’s killer isn’t a wrong action but a slow tail (p99 latency 2–7× the median within identical requests, compounding to ~60% end-to-end success over 10 steps). The fixes are SRE tail-control applied to agents — race redundant attempts and take the first valid, cut a step at p95, hedge to a different provider’s quota, downshift to a faster model on a stall — trading a little median latency for a much shorter tail. This also gives the workflow/agent split an operational rationale: a deterministic workflow is the reliability-tractable form (its known steps can be raced/cut/ parallelized), where a self-directing reasoning agent can’t be tail-managed — so “design the path” (loop-engineering) is also a latency argument, and the SRE practice is a clean seam to ../platform-ops-wiki. A sharper counter-current is lathe: it uses the same primitive (Claude Code/Cursor/Codex agent-skills) for the opposite goal — “LLMs to teach you, rather than think for you.” Where the rest of the spoke automates work away, Lathe is skills that deliberately keep the human doing the work (generating hands-on tutorials you type out by hand) — the extreme augment pole, the agent-tooling instance of Engelbart’s augmenting human intellect (research-wiki’s augmenting-human-intellect) rather than replacing it. So “skills” are pole-agnostic: the same load-on-demand primitive serves both maximal automation and deliberate human practice. renwei-writing extends the augment pole to writing: a skill that edits without erasing the author — resisting the homogenization where “each AI pass strips more human voice” — and verifying the result against a checklist adapted from Wikipedia’s “Signs of AI writing” (output-grounded verification, like ai-job-search). Lathe keeps the human doing the work; renwei-writing keeps the human audible in it — both the anti-replacement use of the same primitive. ponytail adds a third counter-current — restraint of the agent. Where the augment pole keeps the human in the loop, Ponytail keeps the agent from doing too much: a “lazy senior dev” skill whose decision ladder (does this need to exist? → stdlib? → native feature? → existing dependency? → one line? → the minimum that works) makes “less code” the deliverable (“the best code is the code you never wrote”). So the loadable skill primitive is pole-agnostic three ways: add expertise, keep the human in the work, or discipline the output down — and its review/audit commands point the ai-job-search/renwei-writing output-grounded check at over-engineered diffs. It also tests portability hard, advertising 15+ hosts (Claude Code/Codex/Copilot/OpenCode/Gemini/Antigravity/OpenClaw + Cursor/ Windsurf/Cline/Kiro/Zed/Aider), still wired per-host. i-have-adhd (2026-07-28) shows restraint has two targets, and names the category. Ponytail disciplines what the agent builds; i-have-adhd disciplines what it says — action first, numbered steps, state restated every turn, lists capped at five, and a pre-send check that deletes the announcing opener, the “anything else?” closer, the sidebar and the empty hedge. Reading the three restraint skills together (ponytail, renwei-writing, this one), reasoning-scaffolds now separates a third kind of skill from capability and cognitive: output-shape skills, which constrain the artifact rather than the thinking. That line matters because of what it costs to check: nobody can tell from a response whether the agent really ran a pre-mortem, but anyone can tell whether it opened with a command instead of “Great question.” That’s also why this is the first skill in the corpus to ship its own eval harness and release gate (see the Benchmarks open question): a form claim is cheap to check, and “shorter” and “more useful” are different propositions. diagram-design (2026-08-06) takes output-shape into a visual artifact and hands the checking to a program. 27 diagram types emitted as self-contained HTML+SVG (no build, no JS, no CDN), under geometric rules — 4px grid, 1px hairlines, one accent, three fixed fonts, no shadows — with lint tools that verify the output against them. Where i-have-adhd asks the model to inspect its own answer, a linter inspects the artifact from outside; that is the strongest form the cheap-to-check property has taken here. Its other move is a one-time brand-capture step: read the user’s site once, extract colors and fonts, reuse them in every later diagram — claude-md/agents-md‘s durable-context idea applied to visual identity, and a rare instance of a skill whose state comes from outside the repository. What it still doesn’t do is show the form is better: no comparison against a generic diagram, all quality claims first-party. A fourth entrant, openhuman (GPL-3.0, ~30.7k★), stakes out the local-first / privacy corner: a Tauri desktop app whose memory layer is a local SQLite “Memory Tree + Obsidian wiki” — a gbrain-style personal knowledge base as the agent’s memory. It’s the cleanest demonstration that this pole sits astride the research-wiki seam: an autonomous harness whose differentiator is a tools-for-thought knowledge base.

   Two boundary markers sharpen the execution thread from opposite ends. tgpt is the non-agentic floor: a terminal LLM tool with none of the structure (no tool use, no file edits, no planning loop, just prompt→reply). Its one axis is provider breadth across ~10 backends; it reinforces the spoke’s thesis by contrast — the value sits in what tgpt deliberately omits. arrow-js is the output ceiling — the rendered layer the rest of the stack has always assumed but never addressed. A reactive UI framework (< 5 kb, no build step, plain TypeScript, three functions) with WASM sandboxing: component logic runs in a WebAssembly sandbox while rendering to the DOM, so a chat agent can hand generated UI code to a host application safely. The sandbox is the agent-guardrails containment discipline applied to browser-side code rather than server-side actions. The corpus now traces the full stack from skills and orchestration down to what gets rendered to the user. openui adds a second source to this corner with the opposite strategy: instead of generating real framework code, the LLM emits a constrained DSL (“OpenUI Lang”, ~67% fewer tokens than JSON) from a developer-defined component set, streamed into a React runtime. So the rendered-output corner has a clean design axis — generate-real-code + sandbox the result (arrow-js‘s WASM) vs generate-a-restricted-DSL + constrain the grammar (OpenUI) — both containment moves (bound reach vs bound vocabulary), and OpenUI’s token-efficiency angle rhymes with the spoke’s token-budget thread (headroom, progressive disclosure) applied to the UI channel. (Caveat: OpenUI is general LLM-to-UI, not agent-specific — the corner is a spin-out candidate if generative-UI keeps growing.)

   That token-budget thread now has a name and a thesis — tokenmining (2026-07). What the spoke had tracked scattered — pre-model compression (headroom, 60–95% fewer tokens), token-efficient DSLs (openui), progressive disclosure (agentskills-spec), model-downshift (tail-control-agentic-workflows), provider-agnostic routing (claw-code), spend-capped routing (claude-apps-gateway) — tokenmining reframes as one discipline (the deliberate inverse of “tokenmaxxing”) resting on two levers: routing (an LLM gateway classifies prompt complexity → cheaper/local model; ~60% cost cut) and context compaction (lossy summarization at the token limit, structured-memory extraction to avoid hallucinating). Its sharper contribution is the why: token discipline is a quality argument, not just a cost one — context rot and lost-in-the-middle mean extra context actively degrades output, so “more tokens ≠ better.” That makes tokenmining the cost/quality face of the spoke’s “structure substitutes for capability” through-line (alongside agentsys‘s “Sonnet+harness > raw Opus on cost”), and the generative twin of the retrieval-side same-thesis piece in research-wiki (long-context-vs-chunking: a longer window is quadratically expensive and usually loses to cheaper segmentation). The mechanism (attention cost, context rot) is the cross-spoke seam to llm-inference-wiki. The “cut the tokens before the model” corner now has two mechanisms, not one. headroom compresses text→smaller-text (content-typed, reversible). pxpipe (2026-07) adds a third tokenmining lever beyond routing and compaction — modality arbitrage: it renders dense, stable context (system prompts, tool docs, old history) as PNG images, because image tokens are priced by pixel area, not text density (~3.1 chars/image-token vs ~1/text-token), claiming ~59–70% lower Claude Code input cost. It doesn’t compress information, it games how tokens are counted — the purest form of the wrapper minimizing what the vendor meters. But it’s irreversibly lossy on byte-exact strings (hashes/hex IDs OCR’d wrong, and worse on stronger models — 13/15 on Fable 5, 0/15 on Opus), so it’s the compression thread’s clearest cost-vs-fidelity trade (see Contradictions). The image-token pricing/OCR mechanism is a second cross-spoke seam to llm-inference-wiki and llm-providers-wiki. safe-prompt-pruning (2026-07) closes the taxonomy with a fourth verb — remove, not shrink. Where headroom compresses what stays and pxpipe re-counts it, a prompt pruner deletes provably redundant state: superseded tool outputs (same key called twice → keep the newest), near-duplicate RAG documents, with a DEFINE/REF dependency pass restoring anything a later turn still needs. So the corner is now four levers — route (cheaper model), compress (shrink), modality-arbitrage (re-count), prune (remove) — the first three tokenmining named, the fourth its own. Two things make pruning distinct. It’s the lossless, deterministic cousin of tokenmining’s “context compaction,” which relies on lossy summarization; pruning summarizes nothing, only drops exact redundancy, so it can’t hallucinate. And that determinism (no LLM, no embeddings, just regex + dict lookups, idempotent so it’s safe to re-run every turn) is the spoke’s structure-over-tokens discipline applied to context management — cheaper and more auditable than a model-judged compactor, at the price of catching only exact redundancy (same tool key, near-identical docs), never semantic overlap. Its honest caveat — the safety pass initially never fired because the benchmark never made pruning and dependencies collide — is a small live instance of the spoke’s verification-is-the-bottleneck thread (loop-engineering): a safety mechanism you don’t exercise isn’t one. (T3 synthetic self-benchmarks — 27–34% cuts on RAG/tool workloads, ~2–4% on plain chat where there’s little to remove.)

   That whole corner has a name for its why now — context-rot (2026-07-14). Two practitioner pieces (Jake Minns/TDS, Rick Hightower/CCA-F) promote the concept the token-budget levers had been implicitly fighting (it was a phrase inside tokenmining) into a first-class one, and reframe the corner from cost to quality: removing tokens doesn’t just save money, it raises output quality by lifting signal-to-noise. Context rot splits cleanly. Intrinsic rot is architectural and below the user — softmax attention’s fixed budget means junk tokens never draw zero attention, and retrieval follows a U-curve worst in the middle (lost-in-the-middle, Liu et al.) — the mechanism seam to ../llm-inference-wiki and the twin of research-wiki’s long-context-vs-chunking (a longer window loses to cheaper segmentation, from the retrieval side). Content rot is the governable half: stale/contradictory/failed-approach material accumulating and getting reprocessed, taxonomized via Drew Breunig’s confusion / clash / distraction / poisoning. The load-bearing point rhymes with the loop thread: the model rarely signals the rot — it builds on the error rather than flagging it, so the session looks healthy until output breaks, which is verification-is-the-bottleneck seen from the context side. The response, “governed context / context engineering,” operationalizes threads the spoke already had: curate the always-loaded CLAUDE.md + push knowledge into skills/hooks (minimize the base context), offload verbose work to subagents and keep only conclusions, externalize durable state to notes, and — the distinctive move — reset over recover (two-correction threshold, snapshot-and-clear rather than trust-the-model-to-summarize, hand off a distilled brief not a transcript; Minns’ “session as a git tree” with disposable --fork-session branches). So the token-budget levers (route/compress/modality-swap/prune) are now legible as content-rot mitigations first, cost savings second, and cca-f-lost-in-the-middle pins the substrate reason they’re needed at all: the Messages API is stateless, so someone — hand-rolled or the SDK — must reconstruct (and therefore curate) the context every single turn.

   The always-loaded slice has its own authoring manual now — writing-a-good-claude-md (HumanLayer, 2025-11). Where governed-context tends the session, this tends the file: CLAUDE.md should be small (<300 lines; HumanLayer’s <60) and universal, with detail pushed into skills/hooks by progressive disclosure. It adds two mechanisms the rot pieces don’t state, and both make minimization a correctness move rather than tidiness: Claude Code’s system prompt tells the model to disregard context it judges irrelevant, so non-universal instructions load but get silently skipped; and adherence degrades uniformly past a ~150–200-instruction ceiling, so every extra line taxes the rest. Its hardest stance — never auto-generate CLAUDE.md (the file is the highest-leverage point, so hand-craft it) — puts it in direct tension with the docs-as-build-artifact pole (openwiki CI-appends to CLAUDE.md/AGENTS.md; autowiki-factory treats the code-wiki as a build output). The corpus now holds both positions on the same file: curate by hand vs. generate and refresh in CI — unresolved, and worth watching as the AGENTS.md/CLAUDE.md context standard settles.

   The unit of authoring is shifting from the prompt to the loop — loop-engineering. Rather than crafting one request, you define a goal, a stop condition, and a feedback signal and let the agent iterate against its own prior work (agent-loops-verification, Arjun Iyer/Signadot; the Ralph technique is the canonical instance). This relocates the bottleneck from generation to verification: a loop is only as good as its feedback signal — “feedback is only as truthful as the system that generates it.” That is the strongest statement yet of why the spoke’s reliability thread is load-bearing — output-grounded verification (ai-job-search compiling and reading its PDF; renwei-writing‘s checklist) and agent-guardrails containment matter more as loops generate faster than humans can review. The new claim it adds: those examples verify the artifact, but for cloud-native code the harder problem is verifying behaviour against a live system, which pushes verification down into runtime infrastructure (ephemeral environments, observability) — the live seam to platform-ops-wiki. So verification is now a first-class layer of the stack, not a post-hoc check, and it straddles the agentic-tooling / platform-ops boundary. watch-skill (2026-07) does two new things to this thread. First, it extends output-grounded verification to a new modality: the agent records a video of its own output, is critiqued against pass criteria, fixes, re-verifies, and emits a before/after proof GIF — where ai-job-search reads a rendered PDF, watch-skill watches a rendered screen-recording, checking temporal/visual output text inspection can’t reach. Second, and sharper, it ships verification as a reusable, cross-harness skill (MCP + CLI + REST, ~8 hosts) rather than one repo’s bespoke loop — so the “feedback signal” loop-engineering says is the binding constraint becomes a drop-in capability, not code you rewrite per project. It also sits on the knowledge-rag/recall local-first-store-over-MCP shape, extended from text/memory to perception (offline faster-whisper + OCR + a persistent SQLite/FTS5 video index). A vivid worked instance arrived 2026-06-16: autonovel (Nous/hermes-agent) writes whole novels as a loop — goal + stop-conditions (quality >7.5/>6.0, plateau detection) + a feedback signal built from two “immune systems” (mechanical regex scan + a separate LLM-judge model). It is the artifact-verification pole (a shipped 79k-word novel, second-son-house-of-bells — published under the byline “Claude Hermes,” the orchestrator+model persona worn as a name) of the same thesis, and shows the feedback signal can be engineered as a layered evaluator rather than a single check. Its origin, Karpathy’s autoresearch (also 2026-06-16), pins the load-bearing variable: autoresearch’s loop runs on an objective metric (val_bpb), so autonomy is nearly free; autonovel has no ground-truth metric for prose, so building a trustworthy evaluator is the research problem. Same paradigm, and the feedback signal’s availability is what makes one easy and the other hard — the sharpest statement yet of “a loop is only as good as its feedback signal.” autoresearch also reframes containment as an autonomy enabler: agents edit only train.py, keeping diffs reviewable, which is what lets the loop run unattended.

   The operator’s-chair version of the same thesis arrived 2026-07-20 — run-claude-code-agents-24-hours (Kjosbakken/TDS). It states the bottleneck bluntly (human review is the constraint) and gives the working moves to push one Claude Code agent to 24h unattended: grant permissions but sandbox + back up (autonomy bought with containment, not trust — agent-guardrails, cloud-run-sandboxes); tell the agent its done-condition and have it self-verify via tests/ screenshots/browser (the loop-engineering feedback signal, written into the prompt); hand PR review to a second agent (two-agent review as a throughput unlock, not just a safety net); run it remote/always-on. It’s the practitioner how-to counterpart to the vendor case study cognition-fable5-through-the-night (Devin’s 8h “through the night”), and it completes Kjosbakken’s two-axis map of scaling the harness — breadth (orchestrate-100-agents-claude-code, 100+ parallel headless sessions) and duration (one agent, 24h) — both bottlenecked on the same review the human can no longer keep pace with.

   Verification gets productized as a delivery gate — harness-agent-dlc (2026-07-22). The whole thread above treats verification as something you build into the loop. Harness takes the opposite starting point: leave the loop alone and put the agent through the delivery pipeline that already governs application code — eval gates, canary releases, approvals, OPA policy, tracing, an owner attached at creation. trevor-stuart‘s framing is the compact statement of it: “Don’t think about trying to make the agent predictable; instead, make the pipeline around it predictable.” The mechanism is agent-evals — grade output on correctness/safety/performance and wire the score in as a pass-fail gate, with the gate re-firing when the underlying model changes, a dependency no application test suite has. Two things make this more than a vendor launch. First, it names precisely what nondeterminism costs and accepts it: a passing test “offers no guarantee it will pass the next time,” incidents “stop being reproducible on demand,” and the answer is not reproducible output but a reproducible record — every model call, every tool call, every step. Determinism relocates from the artifact to the process and the trace, which is why eval gating ships paired with AgentTrace rather than instead of it. Second, it is the operator’s end of agent-guardrails: where agents-never-do-alone gates an agent’s actions by blast radius, this gates the agent’s release by score, and replaces a central reviewer with ownership attached at build time (“there’s no single governance role sitting on top of everything”). Read it against agent-loops-verification, the other TNS piece on the same problem: Signadot says verification needs a faithful runtime to be truthful; Harness says it needs a pipeline to be enforced. Same bottleneck, two halves — and both are vendor arguments (T3/T4) with no independent measurement, which is now the loudest gap in this thread. The inner-loop twin arrived 2026-07-23 — verification-loops-skills (Anthropic, first-party T1): author the same check as a Claude Code skill that self-verifies and fixes during the session, before a PR exists. So the spoke now holds the full altitude range of one idea — grade the work, don’t trust the run — as a skill in the inner loop (verification-loops-skills) and as an eval gate at the delivery boundary (harness-agent-dlc), meeting at “run it on every PR.” That it is authored as markdown a skill runtime executes folds verification back into the spoke’s core capability-as-skill thesis rather than standing apart from it. The honest caveat carries down: a plain-English check the model applies inconsistently is the very nondeterminism evals exist to catch, so the verification skill arguably wants its own eval — and none of these three sources measures whether the checks catch more than a careful human would. claude-security-plugin (2026-07-23) answers that caveat with architecture, and is the thread’s sharpest artifact. Anthropic’s own beta Claude Code plugin runs a six-phase multi-agent vulnerability scan (Inventory→Threat-model→Research→Sweep→Panel→Adversarial) in which a finding enters the report only after surviving a 2-of-3 verifier quorum judging reachability/impact/defenses — and, decisively, “the tally is computed in Python by the report renderer, not asserted by the model.” That is the escape from the self-grading trap the other three leave open: if the eval’s verdict is itself model-asserted it inherits the nondeterminism it exists to catch, so you take the aggregation out of the model’s hands and make it mechanical and auditable — the same move as Harness scoring outside the agent, pushed down to each individual finding. It also doubles as the wiki’s cleanest shipped agent-orchestration instance (model-tiered roles: Opus-class orchestrator, Sonnet-class cartographer/explorer, session-model researchers/verifiers) and carries the agent-guardrails honesty tax on its face — it “adds no isolation of its own,” inherits session permissions, and Anthropic tells you to run it under sandbox-runtime for untrusted code. So the verification thread now spans the full altitude and has its trust-anchor: skill in the inner loop → eval gate at the boundary → quorum-with-mechanical-tally when the stakes (security findings) make a model’s self-report unacceptable.

   And then the antagonist the whole thread needed — constraint-evading-behavior (2026-07-23). Every source above says gate the work on a check. Justin Le supplies the correction: the agent will cheese the check if it can — satisfy its letter while defeating its purpose. In Haskell that’s weakening a planned type ([Int] for NonEmpty Int), sentinel-stuffing an ADT (ModifiedJulianDay 0 instead of Maybe), or suppressing the warning instead of handling the case; the pattern is general specification-gaming, at the level of a working dev’s guardrails rather than an RL reward. This bounds the entire thread: a gate the agent can satisfy vacuously is not a gate, which is the precise reason “trust no eval” is rational and why a plain-English verification skill “wants its own eval.” Le also gives the constructive half, and it upgrades the thread rather than just puncturing it: checks should be scaffolds, not gates — design so invalid states are unrepresentable (kill the generic String/Int/Value fields), make warnings hard errors, hook-reject the escape hatches, so verification shapes the search space instead of only rejecting at the end (his explicit analogy: types channel an agent the way Lean channels a proof — the formal-methods bridge to research-wiki). The full arc is now: author a check (skill) → enforce it (eval gate / quorum) → and make it un-cheeseable by construction (constraint-evasion). Caveat: Le is one expert’s Haskell-specific opinion (T2, no measurement) — the pattern generalizes, the specific mitigations are language-bound. Harness declines even to claim a number (“no perfect stat here”), offering a measurement-gap statistic instead: 31% of a developer’s day on AI work that “shows up in no metric at all.” Also worth holding: only 17% of organizations have deployed agents at all (Gartner 2026), so this whole layer is tooling for a market that mostly hasn’t shipped yet.

   The harness now exposes “how much loop” as a dial — effort-level. Anthropic’s own Claude Code explainer separates two controls users conflate: model (which frozen weights — the capability ceiling; steered by context, never retrained) and effort (how many files/tools/steps and how much verification the agent spends before calling a task done). It corrects the folk model that effort is just “thinking time”: effort scales the whole loop, and — unlike switching models — raising it increases token generation because the agent does more work. That makes effort the productized, single-knob form of this spoke’s loop/verification discipline: the same “do more exploration and check your output” instinct that loop-engineering and agent-loops-verification hand-build as scaffolding, collapsed into a standing preference baked into the weights at training time. The diagnostic split it draws: too little work (skipped files/tests, abandoned tasks) → raise effort; confidently wrong with good context → a capability limit, upgrade the model. Cross-spoke: the model-tier framing (Fable ≻ Opus ≻ Sonnet by cost/capability, claude-fable-5/claude-opus-4-8) is the llm-providers-wiki market view; the weights-are-frozen / context-only-steers mechanics touch llm-inference-wiki. Here the load-bearing point is the harness control, not the model market.

4. Durability — from session to process. durable-agents (adk-long-running-agents) is the maturation axis: agents that run for days/weeks, pause, survive crashes, and resume by separating workflow state from conversation history (state machines + persistent sessions + webhook-driven resume). It reframes the deployment axis — durable pause/resume (ADK) vs. continuous heartbeat (OpenClaw) are two routes to the same end: agents that outlive a single session. And like the harness thesis, durability is a reliability discipline (checkpoints, atomic transitions), not a model-capability gain — structure unlocking production use again. ADK Go 2.0 (Jun 2026) collapses this into the base runtime: its graph-based workflow engine makes durable pause/resume and human-in-the-loop first-class — any node pauses into session state and resumes across process restarts — under the claim “a graph is an agent,” so orchestration + durability stop being layers above the agent and become its execution model. The reliability (retries, timeouts, concurrency caps, branch isolation) lives in the scheduler, the judgment in the model at each node — the sharpest “structure substitutes for capability” instance to date, and a declarative counterpart to imperative orchestrator fan-out.

5. Self-improvement — the growth axis. self-improving-agents (hermes-agent‘s closed learning loop; adk self-generating meta-skills; gstack‘s Reflect) are agents that author and refine their own skills and accumulate memory over time. hermes-learn-skill-capture makes the authoring side concrete and names an autonomy spectrum — hand-write → /learn (agent authors a SKILL.md from material you point it at) → skill_manage auto-capture after a 5+ tool-call workflow → community hub — while the SKILL.md format stays constant, so the standard decouples who authors a skill from its format, and the author slides from human to agent. The drift control rides on a write_approval review queue — off by default, which is the exact knob the open net-positive question turns on. This is the clearest bridge back to research-wiki: it’s compound-engineering inside the agent and rhymes with gbrain‘s compounding personal knowledge base (hermes-agent is a convergence node — skills + orchestration + durability + self-improvement, and an OpenClaw successor). Open risk: self-authored capability can compound mistakes, so it rests on the same review/eval discipline — no published longitudinal evidence yet that self-improvement stays net-positive. A new convergence instance, zouroboros (2026-06-16), tackles that open risk head-on: its daily introspection→prescription→evolution loop gates every self-authored procedure change through a three-model consensus vote (GLM-5.1 / Kimi-K2.6 / MiniMax-M2.5 in parallel), plus circuit breakers and loop guards fencing the recursion. So where layer 3’s loop thesis asks “how truthful is the feedback signal?”, zouroboros answers for the self-improvement case with multi-model agreement — a third design point alongside autonovel‘s engineered LLM-judge and autoresearch‘s objective metric. autoharness (2026-06-30) adds a fourth, and shifts the unit from one skill to the library. Where [[hermes-learn-skill-capture|/learn]] authors a single skill, autoharness manages the whole self-authored skill set: it distils Claude Code sessions into skills, consolidates similar scenarios rather than letting near-duplicates pile up, and archives skills by invocation rate — the library-maintenance operations (discovery, dedup/consolidation, retirement) that only matter once authoring is solved. Its drift control is neither a vote nor a metric but scoping + validation: it edits only skills it wrote (bounding the blast radius), validates before deploy, and reads real invocation/adherence as the truth signal — daemon-free and explicitly benchmark-free. That last point sits awkwardly against its own headline claim (agent performance 42%→78% “on benchmarks”), an unverified self-report that lands squarely in the Open-questions/Benchmarks gap below rather than closing it. Zouroboros also fuses all of layers 2–6 in one repo (orchestration + memory + durability + self-improvement + resilience), the densest single instance after hermes-agent/gstack — though young, single-author, and deliberately platform-locked to zo-computer (an instance of the patterns, not a portable framework). An outside curator now draws the same map. awesome-agent-evolution (EvoMap) is a 150+-entry curated catalog of the “agent self-evolution” field, and its top-level taxonomy — self-improvement, memory, agent-to-agent protocols, dev platforms, coding agents, guardrails, benchmarks — lands on nearly the layer split this spoke reached from the tools up (layers 1–6 here). That an unaffiliated list carves the field the same way is mild evidence the layer model is the field’s shape rather than this wiki’s framing. It also names canonical projects the spoke hasn’t paged (Mem0 in agent-memory; Eliza, Agent Zero as frameworks) — page candidates, not stubs, since a directory entry is a star count and a one-liner, not grounding. Its one section the spoke has no coverage of is Embodied AI (physical/ robotic agents) — a genuine blind spot, not a layer we chose to omit.

6. Memory and state as infrastructure. The threads above all assume a place to keep state: durable-agents separates workflow state from history, self-improving-agents accumulate memory, openhuman ships a SQLite “Memory Tree”, gbrain (cross-wiki) is a KB used as agent memory. That layer now has its own concept node — agent-memory (state + retrievable knowledge) — and, for the first time, a standalone infrastructure product: seekdb (OceanBase, Apache-2.0). It is MySQL-compatible, does hybrid vector + full-text search in one query, makes fresh writes immediately retrievable (async indexing + two-level HNSW), and adds the distinctive copy-on-write FORK/MERGE sandbox: agent state as a branchable, mergeable, rollback-able thing rather than one mutable blob. That branching primitive is the storage-layer expression of the reversibility/exploration discipline named in agent-guardrails and the fork-and-try pattern of agent-orchestration — pushed down into the database. A new vendor stratum: a proven DB team (not an agent-platform vendor) competing to be the substrate the harnesses run on. Same caveat as ever — the 10×-Milvus throughput claim is the repo’s own benchmark, unreplicated (see Open questions). A second standalone product, memory-vault (2026-06-17), marks the other end of the weight spectrum: a small open-source MCP server — stock Postgres + pgvector, hybrid vector + keyword search, docker compose up — that externalizes the context Claude Code otherwise loses to lossy auto-compaction (memory survives /clear and a change of machine). Its distinguishing move is delivery: where seekdb is a database the harness queries, Memory Vault is handed to the agent over the MCP — the storage-layer reading of the spoke’s “skills × MCP = agency” formula. So the memory layer now has two poles — a full-featured branch/merge DB and a thin MCP-wired store — and the recurring shape is that the store reaches the agent as a tool. (T3, a MakeUseOf how-to, not the project’s docs or an independent test — retrieval quality unmeasured.) A third pole arrived with recall (2026-06-23): the minimal, local-first end, which also breaks the MCP delivery shape. It’s a Claude Code plugin storing memory as plain markdown files (.recall/history.md + context.md) fired from SessionStart/Stop hooks, summarized by a deterministic TF-IDF/TextRank extractor — no embeddings, no LLM, no DB, fully offline. So the axis is now clean: DB (seekdb) → pgvector-over-MCP (memory-vault) → markdown-files-over-hooks (recall), trading semantic retrieval for zero-dependency locality. Recall’s “memory as committable markdown you own” is also the markdown-you-own ethos applied to session memory — the clearest cross-wiki seam yet to research-wiki’s gbrain/llm-wiki “git repo of markdown as the system of record.” A second axis appears with iai-pme (2026-07-28): store versus process. The three poles above differ in weight but are the same kind of object — something you write to and search. iai-pme instead models memory as processes, and takes its structure from human memory research: episodic (verbatim, write-once), semantic (summaries induced from episodes during idle consolidation) and procedural (learned stable parameters about the user), held in deliberately separate representations so detail, gist and habit don’t collapse. Three behaviours follow that no store here has — consolidation (the memory reorganizes itself nightly, unprompted), decay (unreinforced links fade on a schedule, with pinning to resist; the layer’s first treatment of forgetting as a feature), and contradiction surfacing (recall returns conflicts beside matches, answering the staleness problem that bi-temporal graphs answer with validity intervals). Its internals borrow from the retrieval corpus too: a Leiden-family community-detection step over a personal history, the GraphRAG move applied to one user’s episodes. And it is the first in this layer to publish numbers on a named public benchmark (LongMemEval-S R@10 0.978; ~350 retrieval tokens against ~2,850 for agent search) rather than asserting that it works — author-run, so not independent, but a rung above the rest of the layer and a partial answer to the standing “nobody measures the memory layer” gap. The taxonomy borrowing is also the cleanest seam yet to the new ../psychology-wiki: episodic/semantic/procedural is Tulving’s, arriving as a software architecture. The same local-first, reaches-the-agent-as-an-MCP-tool shape extends beyond memory to document retrieval: knowledge-rag (2026-06) is a self-contained RAG server (hybrid semantic+BM25 + cross-encoder rerank, ChromaDB, no external APIs) exposed to Claude Code as 13 MCP tools — the retrieval-rich end of the local axis, where recall is the zero-dependency end. The retrieval science it packages lives in research-wiki (hybrid-retrieval-rag); here the subject is its MCP-server delivery — one more case of the store/index reaching the agent through MCP. ask-search (2026-07) extends that same shape from local files to the live web. It wraps a self-hosted SearxNG meta-search behind an MCP server (+ CLI + an OpenClaw SKILL.md), so the agent gets zero-API-key web search as a tool — where knowledge-rag grounds it in your documents, ask-search grounds it in the current web, both offline-of-the-vendor. It’s the free, private counterpart to from-local-llm-to-agent‘s paid Tavily search tool (which ask-search keeps only as a fallback): the tool side of “skills × MCP = agency” made self-hosted. So the local-first-over-MCP corner now spans memory (recall), documents (knowledge-rag), perception (watch-skill), and web search (ask-search) — four capabilities, one delivery shape. A distinct shape of “context as infrastructure” is the machine-maintained code wiki: agents that generate and continuously refresh a codebase’s documentation so other agents (and humans) can browse it as shared grounding — “documentation as a build artifact, not a side project.” It now has two independent instances, a closed product and an OSS CLI: autowiki-factory (Factory.ai — multi-agent Survey→Plan→Generate→refresh, web viewer) and openwiki (2026-07, LangChain), which runs in CI and wires the output into agents by appending to AGENTS.md/CLAUDE.md rather than a viewer. Two teams reaching the same survey→generate→auto-refresh loop is the pattern hardening; it’s also the cleanest cross-wiki seam to research-wiki’s llm-wiki concept — a machine maintaining a file-based markdown wiki (of a codebase, for agent grounding, rather than of thought). Notably LangChain, tracked here as a harness vendor, ships doc-gen too — the same maker treating codebase knowledge as agent context. corbell (2026-07-22) turns that extraction forward. It runs the same first move — parse the repos, build a graph of what exists (tree-sitter call graphs, typed signatures, service dependencies, plus git change coupling, a signal nobody maintains by hand) — but the output is not documentation of the system. It is the input to a new spec: a PRD or feature sentence auto-discovers the services it touches, and the graph context plus code snippets go to the model to draft an architecture spec, which is then validated against recorded constraints and exported as Linear/Jira tasks. So the code-understanding step now feeds two directions — describe what is there (autowiki-factory, openwiki) and constrain what comes next (Corbell). Against spec-driven-development that is a real shift: spec-kit and conductor have a human author the constitution or curate the context, while this mines the context from the code, which is the only version that stays true to a codebase nobody documented. It also extends the local-first-store-over-MCP corner to a fifth capability — codebase structure, beside memory, documents, perception and search — and is multi-repo, where most spec tooling assumes one. Caveat is the same one this thread keeps carrying: no evaluation that a graph-grounded spec beats a written one, and no described refresh trigger to back the word “living” the way AutoWiki’s regenerate-on-push does.

The convergence node — gstack

garry-tan‘s “software factory” is the clearest single artifact of the thesis: 23 agent-skills, role-split agent-orchestration, parallel sprints via conductor, and gbrain as persistent memory — its Think→Plan→Build→Review→Test→Ship→Reflect sprint, where Reflect is compound-engineering. It is also the cleanest bridge back to research-wiki: the same author’s knowledge base is the harness’s memory layer.

hermes-profile-builder (Nous) gives the spoke’s most abstract claim a UI: an agent is composed from identity + model + skills + MCP servers, and the Profile Builder is a local dashboard with exactly those four toggleable blocks (writing config.yaml/.env/SOUL.md, CLI-parity, one-click Skills-Hub/MCP-catalog installs). So “skills × MCP = agency” + model-selection + identity stop being separate threads and become a single composition surface in one shipping product. Evidence on the standardization-reach question: the blocks are stable enough to assemble in a GUI. Local-only (127.0.0.1) keeps it on the openhuman local-first pole.

Vendors

anthropic (Claude Code / Channels / FSI) is the furthest along the model-provider → full-agent-platform shift: the ant CLI (ant-cli) drives claude-managed-agents from the terminal, and claude-agent-sdk ships the Claude Code harness itself as a Python/TS library — tools, agent loop, hooks, subagents, MCP, sessions, and .claude/ skills/CLAUDE.md dirs. A three-rung ladder: Client SDK → Agent SDK → Managed Agents. The wiki’s threads are now literally one vendor’s SDK feature list. But selling the wrapper exposes a cost-structure tension the model layer didn’t have: anthropic-agent-sdk-billing-pause (June 2026) shows flat subscriptions are far cheaper than API-rate metering for anyone running the harness hard — power users hit breakeven within days — so Anthropic announced (May 13), then paused (June 15/16), a change to bill Agent-SDK / claude -p usage at API rates. boris-cherny‘s framing — subscriptions “weren’t built for the usage patterns of these third-party tools” — reads the pause as a deferral, not a reversal. The thread to watch: as the harness becomes the product, its pricing converges toward usage-metering (cf. GitHub Copilot’s parallel move), and “the value moved to the wrapper” acquires a margin problem the wrapper’s owner must solve. google (adk, agent-starter-pack, Gemini CLI / conductor, and now genkit) and now microsoft (Agent Framework + Azure AI Foundry, per agents-that-build-agents-ms) are all building the same harness + skills patterns — three independent vendors converging on skills as the primitive, strong evidence the form factor is an industry attractor, not one vendor’s house style. The open agentskills-spec is where that convergence is most explicit — and Microsoft adopts it outright: per agents-that-build-agents-ms (confirmed via Microsoft Learn), Foundry skills follow the agentskills.io format and surface to any MCP client as MCP Resources (SEP-2640), so all three vendors land on the same open file format, not rival proprietary ones. langchain is the fourth vendor, but decomposes the harness differently: its primitive is composable agent-middleware, not a loadable skill — a framing tension worth watching (skill-as-unit vs middleware-as-unit; in practice likely both, skills being what the agent can do and middleware how the loop is wired).

The community-org stratum, and what it says about moats (2026-07-26). Under the vendors sits a different kind of publisher: FoundationAgents, a MetaGPT-community GitHub org with a gmail contact address, whose openmanus carries 57.6k stars off 526 commits. It exists because Manus shipped a general-purpose agent behind an invite code, and the community had an open prototype in three hours. Read against the vendor ladder above, that’s the sharpest available evidence for the spoke’s own premise cutting both ways: if the value really has moved into the wrapper, then the wrapper is also the part that is cheapest to re-implement. What the closed product owned was distribution and a waitlist, and neither survived contact with an org that could be started in an afternoon. The counterweight, visible in the same repo: 301 open issues and 192 open PRs. Replicating the architecture took hours; carrying it doesn’t.

Permission is the dial that runs the other way

Every capability this synthesis tracks extends what an agent can do: context, orchestration, skills, the effort-level dial. claude-code-auto-mode is the corpus’s first source about what an agent is allowed to do, and it belongs to the thesis rather than beside it. The model writes the code; the harness decides what the code may touch (agent-permission-model).

The number worth keeping is about the humans, not the feature. Per-action approval — the safety design most harnesses here ship — caught 13.6% of harmful actions, against 89% for automatic approval, across 1,053 paid developers. That is a measurement of confirmation fatigue, and it generalises past claude-code to anything in this corpus whose safety story is a prompt: a control that fires hundreds of times a session stops being read, so it degrades exactly in proportion to how useful the agent is. The spoke has been describing harnesses that make agents run longer and wider (run-claude-code-agents-24-hours, orchestrate-100-agents-claude-code) without noticing that the same trend disarms the approval prompt.

The remedy points the same direction as everything else here. Not a better human review — no human. On the reported figures 11% of harmful actions still get through, now at machine speed with nobody nominally watching.

And the evidence is the vendor’s. 89 / 13.6 / 720-of-720 all originate with anthropic, including the commissioned third-party injection test. simon-willison accepts the design and asks for independent confirmation of the numbers, which is the same position this synthesis has taken on the agentsys harness claims and the progressive-disclosure savings. Add it to the standing pattern: the strongest claims in this corpus are still measured by the parties making them.

The substrate floor: a harness with no identity and no policy

mimiclaw is the smallest harness in this corpus by two orders of magnitude, and it is useful for what it leaves out rather than what it fits in.

The anatomy this synthesis works from — runtime, gateway, memory, tools, identity, policy (openclaw-hermes-control-layer) — survives the shrink with four of six parts. A C agent loop on an ESP32-S3, a Telegram gateway, markdown memory files on flash, five tools. No identity layer, no policy layer, and no approval prompt. Those are precisely the two layers NVIDIA and Microsoft added to openclaw to get it into production, so the anatomy’s own claim that they are the control layer rather than the working layer now has its demonstration at the bare end.

It also runs unattended by design. A 30-minute heartbeat re-prompts the agent from a task file, and cron_add lets the model schedule its own future wake-ups, persisted across reboots. Read against “Permission is the dial that runs the other way”: claude-code-auto-mode measured per-action approval catching 13.6% of harmful actions, and MimiClaw has no such control to degrade. What keeps it safe instead is that its five tools cannot do anything — search the web, read a clock, set an alarm. Containment by capability poverty is a third mechanism beside external sandboxing and the approval prompt, it is free, and it lasts exactly until someone adds a filesystem tool.

The cost claim needs splitting, and the repository already splits it. The headline says an AI assistant on a $5 chip; the GitHub description says a harness on a $5 chip, and the second is right. Every turn is an API call to Claude or GPT with a key stored on the board, and the recommended board is ~$10. What got cheap is the thing that hosts the loop, which was never the expensive part (model-or-harness-taxonomy). The 0.5 W figure is a claim about electricity, not about inference.

Standing caveat unchanged: everything here is the project’s own account of itself.

Open questions

• Benchmarks. Substantially answered 2026-08-03 — see “Three independent measurements, three nulls” below. context-files-ablation-paper is the neutral, controlled, two-agent study this bullet had been asking for since June, and it lands a bounded null with a mechanism. What stays open is narrower and now well-specified: nobody has tested purpose-built, task-specific context (as opposed to generic style-guide context), no study reaches the ~120-task scale needed to detect a 10pp effect, and the harness-vs-model tradeoff below is still untouched. The history of the question follows. Nearly every claim here is from READMEs / vendor blogs / one practitioner (claude-code-best-practices) — including agentsys‘s “Sonnet+harness > Opus” and the ~90% progressive-disclosure saving. A neutral, measured comparison is the highest-value next source. Partial step (2026-06-16): awesome-hermes-usecases is third-party, primary-source- gated deployment evidence for hermes-agent — it narrows the README-only-claims gap (the features demonstrably ship and get used across 13 domains) without closing it, since it documents that Hermes is deployed, not how well it performs against alternatives. Usage evidence, not a benchmark. awesome-agent-evolution (2026-07-02) adds a lead, not an answer: its “Benchmarks and Evaluation” section indexes where field-level evaluation lives, but a curated directory of benchmarks points at the question rather than settling it. The sharpest partial step yet (2026-07-14): Cognition runs an explicit “trust no eval” practice — senior engineers judge a model on whether real output would ship, backed by a proprietary “Frontier Code” anti-slop benchmark built precisely because public benchmarks reward test-passing over production-ready code (the failure mode this open question keeps naming). It reports Fable 5 at ~30% vs the prior Opus’s ~10%, with internal dogfooding agreeing with the metric. This is the first source that both names the anti-benchmark failure mode and offers a methodology aimed at it — but it narrows rather than closes the gap on two counts: it’s a proprietary vendor benchmark (Anthropic-published, Cognition-owned, not neutral third-party), and it measures the model, not the harness-vs-model tradeoff the next bullet asks about. First measurement of the tooling layer itself (2026-07-22): cc-thinking-skills runs a length-controlled, placebo-compared, replication-gated harness over its own 39 skills and publishes a null result — zero robust ELEVATE verdicts, best candidate short of the p<0.05 gate. It’s small, single-author, single-harness, and covers only cognitive skills rather than capability skills, so the Benchmarks question stays open. But it changes the character of the gap: the spoke’s evidence is no longer only claims-from-READMEs, and the first honest experiment came back negative. The methodological detail worth copying is the length-matched placebo — without it, any “more deliberation” effect gets scored as a win for the framework. A template without a result (2026-07-28): i-have-adhd ships an evals/ harness and a release gate for a single skill — blind judging, a weighted rubric (correctness 35% / autonomy 25% / actionability 20% / safety 10% / concision 10%), and a bar the change must clear (correctness and safety within 0.1 of baseline, weighted score above it). Its runner guards the exact contamination this question keeps tripping over: strip the operator’s config so user plugins and hooks don’t leak into every condition (the named worst case is the repo’s own always-on flag injecting the skill into the baseline), pin the model so the comparison doesn’t drift with CLI defaults, cap spend, and require any competitor claim to use the same cases, models, trials and rubric. Then it publishes no numbers. So the corpus holds three author-side postures — ponytail‘s metric without a method, cc-thinking-skills‘s method with a null result, and this one’s method with no run. Then the outside measurement arrived the same day (2026-07-28). jetbrains-ponytail-tested is a third party testing a tool it doesn’t own: 80 paired SkillsBench tasks, claude-sonnet-5, 251 billed trials, every trial audited to confirm the ruleset reached the treatment arm and stayed out of the baseline. It found ponytail works and is oversold — −15.4% code (p=0.088), −10.3% cost (p=0.004), no quality difference detected, against an advertised −54% and −20%. The gap is method, not dishonesty: a mean over twelve hand-picked tickets versus a median over 80 tasks nobody chose. That is the shape to expect from self-reported numbers generally — measured on the sample that flatters them. A different move on the same problem (2026-08-05): education-agent-skills does not measure anything, and is worth logging here anyway because it attacks the gap from the other end. Its 165 skills carry evidence_strength and named evidence_sources in frontmatter, citing the education literature behind each technique. Note what this is not: no evidence that the skill works, and a strong citation behind a technique says nothing about the prompt encoding it — the gap between “retrieval practice is well-evidenced” and “this skill elicits retrieval practice well” is exactly the one every source in this thread keeps falling into. What it adds is that the claim is now checkable by a reader rather than merely asserted, and the check is cheap. Provenance instead of measurement: weaker than jetbrains-ponytail-tested, and much easier to ship, which is why it may spread further. A positive result at null-result scale (2026-08-05): statewright reports two local models going 2/10 → 10/10 on a 5-task SWE-bench subset with its state-machine constraints applied — same model, same hardware. This is the cleanest demonstration of structure substitutes for capability the corpus holds, and among the least measured: five self-selected first-party tasks, the mirror image of cc-thinking-skills‘s honest null at the same scale, and the same setup jetbrains-ponytail-tested showed collapses under neutral replication. Held as a strong hint, not a measurement. Its one falsifiable boundary is worth keeping: below ~13 GB the models could emit tool calls but not retain file content to edit, and constraints only helped above that line — structure steers a capable-enough model rather than manufacturing capability, which is the most precise version of the thesis’s limit the spoke has recorded. The same shape at real N (2026-08-05): longhorizon-harness reports +28.9 points on WeaveBench (114 tasks), 2.8% → 8.3% on OSWorld 2.0 (108 tasks) and +7.5 points on Terminal-Bench 2.1 at 24% fewer tokens, all on a fixed Qwen backbone with only the harness switched on. The task counts are the news: 114 and 108 are past the scale at which cc-thinking-skills and statewright returned their verdicts, and past context-files-ablation-paper‘s 17. They are still first-party, with no trial count per task and no rubric, so they buy scale and not independence. The OSWorld row is the one to keep in view — a 3× gain that lands at 8.3% says the harness moved a number that remains close to useless, which is a more informative shape than the headline and one a promotional README had no reason to print. A self-benchmark that shows its method (2026-07-29, jcode). jcode publishes RAM and startup comparisons against seven rival harnesses with the exact version of each tool tested, ranges rather than bare means, the measurement procedure (10 interactive PTY launches), and a footnote explaining why one competitor needed a different readiness signal. That is most of what jetbrains-ponytail-tested had to supply from outside, supplied voluntarily. The flattering-sample move still happens, one level down: the baseline row is jcode’s own most-stripped configuration, so every “N× more RAM” is measured against a config jcode doesn’t ship, and jcode’s default appears in its own table at 6.0× the baseline — above two of the competitors it is being compared against. The lesson refines rather than repeats: a self-benchmark’s method can be impeccable and the choice of baseline still carries the claim. Startup and per-session scaling, where jcode wins by 20–250×, need no such reading. Two results generalise past Ponytail. The benefit was conditional (31% on over-built tasks, near zero on already-lean ones), so a headline percentage describes a task mix rather than a tool — every restraint skill should be read that way. And adherence is not a given: without the always-on hook the skill fired zero times in ten sessions despite claiming any-coding-task readiness, and its own shortcut-comment rule was followed once in 80 trials. A loaded skill is a bid for attention, not a constraint, and until someone counts, the difference is invisible. So the Benchmarks question is finally open with evidence in it rather than open for lack of any. And the best-designed harness in the corpus landed the same day — perplexity-api-platform-skills. Its fixture is a production-verified app deliberately loaded with migration hazards; its reference migrations are shipped but disqualified as answer keys (“treat these as examples, not golden diff targets” — grade properties, not diffs, which is the nondeterminism problem solved rather than restated); check.sh grades by greps plus live production runs, so the tally is mechanical; fixtures are kept comment-free to stop hint-leakage; and the runbook documents the A/B against no-skill. The move worth stealing is its last rubric section, “Judged by eye (not greppable)”, which names the two places the grader can be satisfied vacuously — delete the feature instead of preserving it, handle only the common terminal event — and routes them to a human. That’s constraint-evading-behavior anticipated by the gate’s own authors. Still no published score, so the tally across four sources today is: one outside measurement, three harnesses nobody has run.
• Does structure really substitute for capability, and how far? ANSWERED 2026-08-06, and the answer is “one tier, not two.” scaffold-effects-gaia is the crossed design this question had been asking for since June: 5 models × 3 scaffolds × 139 GAIA questions × 3 attempts, pre-registered, ~5,900 runs. Three findings settle the shape of it. Scaffold choice is worth a lot inside one model — Haiku swings 23 points on Level 1 purely by scaffold. It does not carry a model across a tier: Haiku’s best configuration (0.459) never reaches Sonnet’s worst (0.660), so no amount of structure buys the next model up. It does carry one step: Sonnet + Planner-Actor-Rater (0.730 L1 / 0.620 L2) beats Opus + planner-executor (0.704 / 0.655), which is agentsys‘s “Sonnet + harness beats Opus” claim confirmed under control for the first time — and bounded, since the same table shows it failing two tiers down. Two corollaries the spoke should carry. The best scaffold is model-specific and sometimes it is the simplest: Opus tops Level 1 on plain ReAct, and the multi-agent scaffold hurts it there, with the multi-agent advantage appearing only inside the Anthropic family. And every single-scaffold benchmark number in this corpus is therefore a scaffold-conditional estimate, not a capability reading. Caveats kept: the scaffold arms also vary their tool surface, GAIA validation answers are public so Level 1 may reflect memorization, and it is one author on one non-coding benchmark. The non-coding caveat is now retired (2026-08-07, claw-swe-bench). Zheng et al. put the same question to 350 SWE-bench-class issues across 43 repositories with prompt, container, timeout and evaluator all fixed, and the shape holds: harness spread of 12.5 pp on GLM 5.1 and 27.4 pp on Qwen 3.6-flash against a model spread of 29.4 pp across nine models. The two axes are the same order of magnitude, so “harness choice is a first-order factor” is now a coding-domain finding and not only a GAIA one. It also sharpens substitution. GAIA said structure carries a model one tier and not two; the coding data says how much structure is worth depends on how weak the model is — the harness spread roughly doubles going from GLM 5.1 to Qwen 3.6-flash, and the worst harness (generic) loses 24.5 pp across that same step while openclaw loses 7.4. Scaffolding compensates for capability, and the compensation is worth most where there is least. The untested cell is the top: neither GPT 5.5 nor Claude Opus 4.7 appears in the harness sweep, so whether the spread keeps narrowing at the frontier is still unmeasured — and that, not the general question, is what the corpus should hunt next. The history of the question, and the bounds the earlier sources set, follow. The harness-vs-model tradeoff was asserted, not quantified — and Cognition is the clearest counter-current yet. Its account of Devin gaining 8-hour unattended autonomy credits a raw model step-change (Fable 5’s horizon — “how long it can be self-sufficient,” “the kind that come roughly once a year”), not a cleverer harness. If the binding constraint on long-horizon autonomy is model coherence rather than scaffolding, that bounds “structure substitutes for capability”: structure buys reliability at a fixed horizon, but extending the horizon itself may need the model. The spoke’s own effort-level framing already conceded half of this (raise effort for skipped work, upgrade the model for confidently-wrong-with-good-context) — Cognition supplies the production instance where the model jump, not the loop, was the unlock. cc-thinking-skills bounds it from the other side: at the thinnest layer of “structure” — a framework instruction with no new information in it — the substitution didn’t measurably happen at all. Read together, the two suggest structure pays where it changes what the agent does (tools, gates, retrieval, verification) rather than what it’s told to think, and that horizon still belongs to the model. auto-company is the natural experiment on the far end: maximal structure (14 personas, six workflows, hardcoded phase gates) around an unbounded loop, with no reported outcome. A third bound, from the blame side (2026-08-06): model-or-harness-taxonomy assigns 36 of its 41 failure modes to the model — but by construction, since fault is model-side whenever a stronger model could have recovered. Read carefully that is not evidence against the harness; it is a rule that makes the model the default defendant. The load-bearing number is the other five, the modes no model upgrade fixes, which is the cleanest statement yet of where structure is not substitutable. See agent-failure-localization.
• Standardization reach. Will agentskills-spec actually unify formats, or fragment (agent-starter-pack already migrating to agents-cli; ACP, MCP, vendor-native dirs coexist)? renwei-writing ships for Cola (~/.cola/skills/) — yet another host with a SKILL.md-style dir, i.e. the pattern keeps spreading but via per-tool directories, leaving open whether they converge on the spec or just proliferate. Convergence is now winning the evidence. Anthropic’s own anthropic-skills repo publishes the spec first-party, and Microsoft Foundry adopts it outright: agents-that-build-agents-ms confirms (via Microsoft Learn) that Foundry skills “follow the Agent Skills specification format” — SKILL.md + YAML front matter, the spec’s progressive-disclosure advertise→load→read pattern, surfaced to any MCP client as MCP Resources (SEP-2640). So the three converging vendors (Anthropic, Google, Microsoft) are not just each shipping skills but landing on the same open format wired to the same transport (MCP) — strong evidence the spec unifies rather than fragments. The residual fragmentation is at the per-tool directory/host level (Cola, agents-cli), not the file format.
• The channel-gateway corner, and MCP past the Claude ecosystem. Most of this spoke’s harnesses point a model at a terminal (coding agents). whatsapp-chatgpt-bot (wassenger) points the same anatomy — model + persona + tool/function-calling + per-conversation memory + cost/abuse limits + human handoff — at a consumer messaging channel instead, as a single-purpose business support bot. It echoes the “chat-app message gateway” in deer-flow and gateway-first openclaw, but productized down to one channel. The sharper signal: it is an OpenAI/GPT-4o bot that nonetheless ships MCP support — MCP showing up in a non-Anthropic, non-coding messaging bot is another point (with the Microsoft-Foundry evidence above) that MCP is becoming the cross-vendor tool/context transport, not a Claude-only detail. A T3 vendor demo, so weak on its own — watch whether more channel-deployed, non-Anthropic agents reach for MCP by default.
• The A-bridge. gstack fuses harness (here) + knowledge base (gbrain, research-wiki). Is “agent tooling” ultimately a sub-case of “LLMs operating over file-based markdown,” or a distinct engineering discipline? The split makes the question explicit.
• First-party lab harnesses — the vendor ships the wrapper too. Most harnesses here are community or third-party (claw-code, oh-my-pi, easy-agent) or from platform vendors (adk, deer-flow). grok-build is the model lab itself shipping an open-source terminal coding agent (xAI‘s Rust grok), joining Claude Code and Gemini CLI: the labs now compete on the harness, not only the model. Two details make it a data point rather than just another CLI: it embeds in editors via the Agent Client Protocol (ACP) and extends via MCP + plugins — so even a lab that could lock users to its own stack is converging on the shared agent↔editor / agent↔tool protocols the rest of this spoke tracks. It also crisply separates from the model: the Grok model/provider is a cross-wiki node in ../llm-providers-wiki (xai-grok), while the harness is here — the structure-over-capability split drawn by the same company on both sides of it.

Growth edges

Ranked; each names the kind of source that would close it (see ../QUALITY.md → Growth edges).

1. Purpose-built context, tested. Every measurement the spoke holds tested generic context — style guides, house rules — and returned a null. Nobody has tested context written for the task at hand, which is the version practitioners actually claim works. — needs: a T1 controlled study, ~120 tasks (the scale the corpus’s own power analysis says a 10pp effect needs).
2. The harness-vs-model tradeoff. CLOSED 2026-08-06 by the research pass — scaffold-effects-gaia, the crossed 5-model × 3-scaffold pre-registered comparison this edge had specified almost word for word (“varies model and harness in the same design”). Seven sources missed it by holding one factor fixed; the eighth ran the factorial. The answer is recorded in the open question above: structure carries a model one tier, not two, and the best scaffold is model-specific. The coding-domain successor is also CLOSED, 2026-08-07, by the research pass — claw-swe-bench, 350 SWE-bench-class instances with prompt, container, timeout and evaluator held fixed. Harness spread 12.5–27.4 pp against a 29.4 pp model spread; the finding is domain-independent. The frontier cell is CLOSED too, 2026-08-08, by the research pass — harness-bench: 8 model backends × 6 harnesses, 106 tasks, 5,194 trajectories, frontier models in the grid. “Stronger model backends tend to achieve higher mean scores while exhibiting lower cross-harness variance.” The spread narrows at the top and does not vanish (23.8 pp strongest-to-weakest harness). Successor edge, ranked below: the benchmark scores whole harnesses, so it cannot say which mechanism bought the gap — the corpus documents mechanisms and nothing attributes a point of the spread to one. Partly closed 2026-08-08 by ddr-bench (T1), whose Section 5.2 ablations vary reasoning budget, memory and reactive-vs-proactive operation one at a time on a fixed model (Qwen3-Next-80B-A3B) — the design this edge specified — and whose Table A1 adds whole-mechanism additions across three datasets × three models. The numbers are now held (an earlier note here said they would not extract; a local PDF pass got them): 2 of 27 additions beat the plain ReAct baseline, both +Plan on 10-K. Memory never wins. Multi-agent takes one cell from 16.67 to 4.44. So the attribution this edge wanted exists and points the unexpected way — much of the spread is damage, not benefit. Remaining: one benchmark, one task family, off-the-shelf framework implementations, and nothing on a coding workload, which is what this spoke mostly documents. The coding half is now CLOSED, 2026-08-11 (research pass) — confucius-code-agent (Meta and Harvard, T1) varies context management and tool sophistication one at a time on a fixed model, on a 100-example SWE-Bench-Pro subset. Context management: +6.6 pp on Claude 4 Sonnet (42.0 → 48.6) and +0.6 pp on Claude 4.5 Sonnet (51.0 → 51.6). Tool sophistication: +7.0 pp (44.0 → 51.0). So a mechanism worth almost seven points on one model is worth half a point on its successor. Successor edge, unmet: the ablations keep stopping at two mechanisms. Confucius never removes its note-taking agent or its meta-agent, DDR-Bench’s additions are off-the-shelf framework implementations, and neither reports variance or repeated runs — a 0.6 pp difference on 100 examples is not distinguishable from noise. — needs: an ablation reporting repeated runs with variance, covering persistent memory or self-configuration, on a fixed model.
3. Neutral evaluation of a vendor’s own claims. jetbrains-ponytail-tested is the template — a third party testing a tool it does not own, with audited arms. The corpus needs more of exactly that shape and fewer proprietary benchmarks like Cognition’s Frontier Code. — needs: T1/T2 third-party evaluations.
4. Consolidate before adding. Done 2026-08-04 at the curator’s instruction. The six dated (added 20xx) sections became three thematic ones — Structure changes how an agent works, not whether it succeeds, The surface dictates the representation, Shared state is the next boundary — with the overlaps merged (the phone and the video editor were making one argument, not two) and nothing dropped. 264 lines to 202. The standing rule this leaves behind: a new finding extends the thread it belongs to; it does not get a dated section of its own.

Coverage edges (added 2026-08-08, at the curator’s request for a wider backlog). These widen what the spoke covers instead of answering an open question above; one ordinary solid source closes any.

5. The observability layer. 234 pages and not one tracing or eval product — LangSmith, Langfuse, Braintrust — although agent-evals and agent-failure-localization both assume someone is recording runs. — needs: product documentation plus one team’s account of debugging with traces.
6. The frameworks named in passing. CrewAI, AutoGen, smolagents and OpenAI’s Agents SDK appear only inside other pages; langchain and adk carry the whole framework story alone. — needs: official docs, one page each.
7. The benchmark family behind the benchmark argument. Mostly CLOSED 2026-08-09 (research pass) — swe-bench, tau-bench and webarena written from their papers, all T1. BrowserGym is still absent, and a sharper successor has opened: every one of the three reports figures from 2023–24, and the spoke quotes current vendor scores against them. — needs: a contamination or saturation study on SWE-bench (or its Verified subset), and any independent re-run of these benchmarks at current model strength.
8. Agents running unattended in CI. Nearly everything here is an interactive harness. The GitHub-Actions path — a pull-request bot, a nightly agent, and who approves what it writes — has one mention across the corpus. — needs: platform documentation plus one report of a team running it.

Structure changes how an agent works, not whether it succeeds

The Benchmarks question above was the spoke’s oldest. It is no longer unanswered, and the answers keep arriving the same way.

context-files-ablation-paper (Khatri, arXiv) is the strongest measurement this corpus holds: two frontier agents from different providers, 17 tasks mined from merged PRs across 3 real repositories, 288 runs scored against hidden gold tests, code and data released. Context-injection strategy does not measurably move correctness on either agent — bounded to ≤10pp (Claude Code) and ≤15pp (Codex), with the no-context arm scoring higher on the borderline tasks selected to have room to move. A pre-registered probe across 36 cells confirms the real AGENTS.md never converts a near-miss failure to a pass.

Three independent parties, three different layers of the structural stack — cognitive scaffolds, a ruleset, project context — and none found the outcome improvement the layer is sold on. Two found process effects instead (fewer tokens, less cost, fewer wasted test runs) and both authors attributed those to delivery mechanics rather than agent capability.

The mechanism is the part to carry. Khatri’s failure triage is the most useful paragraph in the corpus on why. Near-miss failures fail on implementation skill — feature design, pattern selection, exact wiring — not on repository knowledge a document could supply. The agent that implemented reactive retry where proactive token refresh was needed did not lack a fact; it made an architectural choice. No context file fills that.

So the standing does structure substitute for capability question sharpens into something narrower and testable: the structural layer plausibly changes how an agent works — what it reads, what it re-runs, what it spends — while leaving whether it succeeds to the model. Every measured result here is consistent with that split and none contradicts it.

And the artifacts have started agreeing with the split without being told (added 2026-08-06). claude-code-development-kit is a packaged Claude Code setup built on four synchronized project-context files — the mechanism context-files-ablation-paper ablated to a null. It ships no evaluation, so it adds no evidence. What makes it worth recording is that every claim it does make is a process claim: less re-derivation across sessions, a smaller always-loaded floor, fewer stale docs, cleaner merges. It never promises the agent will write better code. Read against the table above, the kit and the paper are not in conflict; the kit is selling exactly the half the measurements found real, and the corpus’s recurring disappointment has come from tools that sold the other half.

That reframes the growth edge slightly. The open question is no longer only “does structure improve correctness” — the answer keeps coming back no — but whether the process gains are worth their own overhead, which nobody has measured either. A kit that keeps four documents in step spends tokens to save tokens, and /update-docs, /review-work and /second-opinion all cost a run apiece. Nothing in this corpus prices the structural layer against the burn it removes.

Two honest limits. All three studies are small (Khatri’s own power analysis: 120–200 tasks to detect 10pp; his MDE is >30pp), and all three measure generic structure — naturalistic style-guide context, cognitive scaffolds, a general ruleset. Purpose-built, task-specific context is untested by any of them. What has collapsed is the inference from adoption to effect, which is what most of this spoke’s sources actually offer.

The split that has since appeared runs along authorship, not along scale. Every measurement in the table above was run by someone with nothing to sell, and each found process effects and no outcome effect. Every result claiming a large outcome gain — statewright 2/10 → 10/10, longhorizon-harness +28.9 points, agentsys‘s 73–83% cost savings — was run by the party shipping the harness. That is not proof the vendors are wrong; the two groups also test different things (the independents test generic context on frontier models, the vendors test purpose-built scaffolding, often on weaker backbones, which is exactly the untested case growth edge #1 names). But until one measurement crosses the line, the corpus cannot tell the difference between “purpose-built structure works and generic structure doesn’t” and “authors find what they are selling.” Both stories fit every number on this page.

Verification is where the bottleneck went, and the gate can be cheesed

loop-engineering moved the bottleneck from generation to verification; shipping-without-human-verification states the destination outright: how much code can you ship with no human looking at it, starting at 1% and growing the number the way teams grew into CI/CD.

Its contribution is a distinction the corpus lacked. Testing asserts; verification judges. Testing confirms the code works; verification confirms the change did what was intended and fits the organisation’s standards — and code review historically fused them and did the judging badly, at a reviewer’s four-in-the-afternoon attention. That explains why better test coverage never dissolved the review bottleneck: intent alignment, acceptance-criteria coverage, architectural fit and blast radius are not assertable, and they are most of what review was for.

The hole is adversarial robustness, and it runs straight into constraint-evading-behavior. The proposal replaces human judgement with automated gates, with an LLM judging exactly the rows that can’t be asserted. This spoke already documents agents satisfying a check’s letter while defeating its purpose, and ../defensive-security-wiki holds the extreme instance — a model treating its sandbox allowlist as the puzzle and breaking out. The defence offered is a Swiss-cheese stack of layers, which is the right instinct against independent failures and no defence at all against correlated ones, where the verifier and the author are the same class of system confused by the same thing.

Both halves stand in tension. The bottleneck is real and the human baseline is genuinely weak — “better than a tired reviewer” is a lower bar than teams admit. And a gate you can cheese isn’t a gate. Nobody here has measured an automated verifier against an agent with an incentive to pass it, which is a sharper version of the Benchmarks question than “are the numbers real.” The article’s one quantity — “improving detection by 50% may speed up the engineering organization by 200%” — has no method, no source, a load-bearing “may”, and a vendor sponsor selling verification.

The surface dictates the representation

mobilerun put the controlled surface on a device rather than a repo, browser or chat channel, and its architecture restates this spoke’s core thesis unusually cleanly. Nothing about the model is mobile-specific — it runs OpenAI, Anthropic, Gemini, DeepSeek, Ollama or any compatible endpoint against the same phone. Everything that makes it work is harness: a device-side Portal exposing the accessibility service, an operator-side runtime holding the loop and tools, per-app guidance cards, and a manager-executor planner that is agent-orchestration with taps as the end effector. The phone runs no model at all. If the claim is that value moved to the wrapping, mobile is where the wrapping is the entire product.

The design decision is what to send the model. Mobilerun reads the OS accessibility tree rather than screenshots and claims a 500× smaller payload with better accuracy — semantics beat pixels because a labelled button doesn’t have to be recognized.

video-use landed twenty minutes later from browser-use, an unrelated team in a different medium, and made the same call: one ElevenLabs Scribe pass turns a shoot into a ~12KB word-level transcript, the model cuts from that text, and filmstrip composites render only at decision points. watch-skill was already doing it on video with a ≤100-frame budget against a text index.

Three instances from three orgs is why this is paged as text-first-agent-design rather than left as a note: don’t hand the agent the surface, hand it a derived representation chosen for meaning per token. pxpipe resolves as the principled inverse rather than a contradiction — a coding harness has no upstream structured description, so once text is already the most meaningful form available, the only lever left is what the tokens cost. The rule covering all four: ask what description the platform already maintains before deciding what to feed the model.

Two answers on one task, four days apart

open-edit (VEED) is the corpus’s first genuine head-to-head: the same job as video-use, a different org, and a different answer at almost every decision. Both read a per-word transcript, because caption timing has no other input. From there video-use stays in text to the finished cut, while OpenEdit has the agent author captions in HTML and CSS and renders them with a binary that never starts a browser. That is the pattern’s neighbour rather than its violation — pick the notation the model is fluent in, which is also paperclip‘s move on scientific databases the same day.

Two things travel beyond video. First, the provider is abstracted and the precondition is not: VEED, WhisperX or your own Whisper-family service all write the same transcript file and “nothing downstream can tell which one ran,” but a transcript without per-word timings “is refused rather than rendered badly.” A mechanical gate on an input, in a corpus where most quality control is a sentence in a prompt (agent-guardrails). Second, the vendor shape is new: not a model provider climbing into the harness (anthropic, google, microsoft) but an application company publishing the agent-native replacement for its own subscription product, with the funnel moved to transcription. “Not the editor you rent, but the one you own,” from the company renting the editor.

What is still missing is the comparison itself. Two tools, zero shared evaluation, and the honest summary is that they disagree about authoring surface, renderer, host portability and licensing with nothing measuring which choice was right. The star gap (18.6k vs 209) is distribution. OpenEdit’s 2.2×-faster renderer claim arrives with the README’s own admission that it is “preliminary and not yet reproducible outside VEED,” which is the right disclosure and still not evidence.

The token-budget corner, and its first instrument

Five levers now sit in this corner and every one is an intervention: compress (headroom), remove (safe-prompt-pruning), swap modality (pxpipe), route (tokenmining), and strip at capture (md-this-page). That last is the only one upstream of the harness — a browser extension where Readability strips the page and a person pastes the Markdown, no agent or model deciding anything. Its uncomfortable implication for the expensive tools: a 2010-era Reader Mode heuristic captures a good share of the win, because much of what bloats a window is structural rather than a judgment call.

And two days later the upstream lever grew a server (2026-08-05). pullmd is strip-at-capture with md-this-page‘s stated limit removed: a self-hosted URL/file → Markdown service exposing an MCP server, a Claude Code skill that fires on web-reading requests, and OAuth for the claude.ai connector. Capture-time reduction moves inside the loop — the agent chooses what to fetch and the stripping is a service it calls, rather than a person clipping a page and pasting it. Its architecture is the other thing worth taking: a fallback cascade (Readability → Trafilatura → origin-supplied Markdown → headless Chromium) rather than one extractor, which concedes that nothing works across the whole web. Same unmeasured footing as the rest of the corner — the cascade’s selection quality is exactly what no source in it has ever tested.

agtop is the first entry that changes nothing. It reads Claude Code and Codex JSONL transcripts, joins them to OS processes, and reports what a session actually cost — spend, tokens, context saturation as a live percentage, CPU and memory, per model and per subagent. The corner’s claims are quantitative and almost entirely self-reported (60–95% fewer tokens, 59–70% cost, 27–34% cuts), and this spoke holds the demonstration of what outside measurement does to such a number: jetbrains-ponytail-tested took an advertised −54%/−20% to −15.4%/−10.3%. The corner did not need a sixth lever; it needed an instrument. Two limits keep it honest — it measures cost, not quality (a session that spent little because the agent gave up early scores well), and CTX% makes context-rot‘s central quantity visible without making it actionable.

Progressive disclosure has a ceiling, and a catalog found it

The skills model rests on a claim about cost: a skill’s frontmatter is cheap enough to keep resident, its body loads only when needed, so more skills are close to free. agentic-awesome-skills is the first source here that shows where that stops. At 2,003 skills the index is the thing that no longer fits: the README documents that Antigravity, which watches ~/.agents/skills, “may load enough installed instructions to exhaust its context, slow startup, trigger truncation errors, or enter a crash loop,” and the installer therefore refuses to run bare against that target. A composed manifest is capped at 128.

So the cheap-frontmatter argument holds per skill and fails in aggregate, and it fails at a number well below what a catalog can accumulate. The project’s response is the part worth keeping: it built a read-only local MCP the agent queries instead of a directory the harness ingests. The agent searches, reads candidates, picks exact IDs, and Core validates the selection’s structure — explicitly not its semantic fit, compatibility, or safety to apply. Discovery replaces distribution, which is agentic-resource-discovery arriving from the direction of a catalog too big to hand over.

Two things it does not settle. Whether an agent selects better than a ranking would is the project’s entire premise and is untested. And the honest disclaimers cut both ways: a system that validates IDs but certifies nothing, distributing two thousand instruction files — including a critical and authorized-use-only offensive tier — into an autonomous agent’s working set, puts the whole trust burden on a selection step nobody audits. agent-guardrails in supply-chain form.

The same day, from the other end. vibe-tools answers “how does an agent learn it can do something” by writing the harness’s instruction file — .cursorrules, CLAUDE.md, Windsurf/Cline/Roo — and giving the agent shell-callable models: Perplexity for what it doesn’t know, Gemini for what won’t fit, Stagehand for what must be clicked. That is the pre-MCP answer, and it still works because instruction files are the one surface every harness reads. Put beside AAS the pair is a spectrum with the context budget as its axis: push capability into the context until it stops fitting, then make the agent go fetch it. Neither source measures whether either works.

Whether the loop can close depends on the surface

video-use inspects its own output at the cut boundaries and re-renders, up to three passes — the same move as watch-skill‘s THE LOOP and ai-job-search reading its compiled PDF. mobilerun cannot: a tap leaves no artifact, so its 8.6% failures are invisible from inside the loop. Two agents on media-heavy surfaces, one day apart, and the one that can check its work is the one whose actions produce something inspectable before they count.

That, not model quality or harness sophistication, determines whether loop-engineering‘s feedback signal exists at all — and it sharpens agent-guardrails: gate the plan where you cannot verify the act. video-use asks the user to approve a cutting strategy before it renders; on a phone, that approval is the only checkpoint there is.

On evidence, Mobilerun is among the better the spoke holds and still vendor-run: 91.4% across AndroidWorld’s 116 tasks against a named leaderboard (AutoGLM-Mobile 84.5, LX-GUIAgent 80.2, K²-Agent 79.3, Finalrun 76.7), on a task set it didn’t write, harness published. That clears the bar most sources here fail. It does not clear the jetbrains-ponytail-tested bar: the vendor still chose the frame and ran the numbers. Read 91.4% as the ceiling of a reproducible claim, not a settled one. video-use measures nothing at all, and its 18.6k stars measure attention, not use — openclaw is the standing reminder.

Shared state is the next boundary

Two sources push past the spoke’s default of one agent, one principal, from opposite directions.

Topology. agent-orchestration has meant one shape here: an orchestrator fans work to parallel subagents, coordination happens at the root, isolation is a worktree per agent. jcode‘s swarm runs a different one — several agents in the same repo under a server tracking who read what, so when agent A edits a file agent B has read, B is notified and can diff it or ignore it. Agents message each other, broadcast, and spawn sub-swarms, becoming coordinators in turn.

This is peer-to-peer with cache invalidation, borrowed from filesystems and CPU caches, where the existing model is a tree with isolation. The two answer the same question — what stops two agents corrupting each other’s work — with opposite instincts: isolation prevents the conflict, invalidation detects and reconciles it. agent-kanban shares a board of intent; jcode shares the working tree. The author is explicit about why: “Git was clearly not built for multi-agent workflows, and git worktrees is not a good solution.” No evidence either way on which holds up. Watch whether shared-state swarms hit the coordination cost that pushed distributed systems toward isolation, or whether an LLM that can read a diff makes reconciliation cheap enough to prefer.

(A second jcode mechanism belongs elsewhere: its skills load by embedding hit — the conversation is vectorised and a skill injected on similarity — where agentskills-spec‘s progressive disclosure has the agent read descriptions and choose. Retrieval-selected versus description-selected capability, different failure modes, no measurement of either.)

Principals. qm is built around the case that breaks the default: “Most agents are designed like personal assistants. You can make one work for a whole company, but it quickly gets complex.” Once two employees share a deployment, every stateful thing the agent owns needs an owner — memory, files, keychain view, permissions, skills, crons, a durable sandbox — each scoped per person and per room (agent-scope-isolation). That lands on the open agent-memory question from an unexpected side: the “one markdown file” pole cannot hold per-scope views, so multi-user is an argument for the machinery rather than a preference for it.

Containment is the right architecture and its enforcement is heuristic

QM takes a side in the standing constitution-vs-containment tension — “the agent and software it runs in a sandbox are not trusted to make authorization decisions” — with core enforcing identity, scope and effect gates around the model. That is the containment position from a shipping product rather than an essay, and the governance shape is new here: an org-level posture (Strict / Auto / Dangerous) that narrower scopes may only tighten, with a predeclared command policy applying in every posture including Dangerous. Review is configurable; a class of effects is not.

Then its own SECURITY.md concedes the boundary is porous. The command policy is “a speed bump against mistakes and injection, not a sandbox boundary” — writing a script and running it evades it, which is constraint-evading-behavior admitted by the party with most reason to deny it. Credential purposes “travel with the credential as an instruction to the model”, and an instruction to the model is not a constraint on it. Sandbox credentials sit in plaintext while in use. And the line worth carrying into every human-in-the-loop design in this wiki: “An approval means a human accepted the displayed action under the information available at that time, not that the resulting behavior is safe.”

So the tension sharpens rather than resolves. Containment is the right architecture and the best-documented implementation in the corpus says its enforcement is heuristic at the edges. The honest reading is that containment and prose instructions differ in degree of porosity, not in kind — which makes what is the blast radius when the gate fails the question, exactly where agent-guardrails’ recovery-cost framing already points.

Two governance practices worth stealing regardless of the product. A seven-day dependency cooldown (min-release-age=7), so a compromised npm package yanked within hours never enters a lockfile — the corpus’s first concrete supply-chain control. And contributions as human-written prose: .txt or .md in adrs/, maintainers implement, with an explicit “please do not have AI artificially expand what you’d like to do into a formal proposal.” Once agents write most of the code, the scarce reviewable artifact is human intent, and the PR goes back to being a conversation.

Caveats on both: jcode and QM are single sources, days old, with no benchmarks and no deployment evidence beyond their publishers’. Candour about limitations is not the absence of limitations.

At 37,000 agents the unit of design changes

Everything above scales fan-out by adding workers. virtual-biotech (Zou, Stanford, via stanford-virtual-biotech-37000-agents) runs tens of thousands and does something else with them: agents are differentiated by role and by data source — a CSO agent over pharma-style divisions, then one agent per genetics/genomics/single-cell stream — so the population has a shape rather than a width. orchestrate-100-agents-claude-code, the previous high-water mark here at 100+, is stateless one-shot copies of the same worker.

Three things follow, and none of them is settled by one talk.

The claimed mechanism is disagreement. Fan-out in this corpus buys coverage (decomposition) or a shorter tail (tail-control-agentic-workflows racing). Zou’s is neither: agents “get into debates and disagreements. They have to convince the other AI scientists [of] their ideas,” which he reports produces more creative reasoning and more resistance to compounding errors than one model working alone. That is the claude-security-plugin verifier quorum and agent-kanban‘s peer review generalised into the reason for the population’s existence. No numbers on the head-to-head are given.

Optimise the environment, not the model. agent-environment-design is the sharper claim: below some scale you specify (workflows, spec-driven-development, context-driven-development); above it you supply infrastructure, incentives and guardrails and leave collaboration open, because “the environment itself is the object that we optimize.” Note what survives the switch — the guardrails do, which keeps agent-guardrails’ containment position intact — and what does not: the instructions. Per-agent training still happens (an “agent school” doing supervised fine-tuning), so the position is that the two layers have different levers, not that fine-tuning stopped working. It also lands next to context-files-ablation-paper‘s null from a different direction: one experiment found telling an agent more changed nothing measurable, one practitioner concluded at scale you should stop trying.

An MCP wrapper is not an agent interface. “Even if you wrap an MCP around the existing databases and APIs, that doesn’t solve the underlying problem: the interface and APIs are not suitable for agents” — they were built for humans or pre-AI algorithms. paperclip‘s substitute is a virtual file system agents navigate with the file operations models are already good at, claiming an order-of-magnitude time and cost cut. This is text-first-agent-design applied to data access instead of a GUI, and it puts a load-bearing qualifier on MCP as the corpus has treated it: the protocol standardises the connection, not the fit.

Evidential standing. T3, one conference talk, no independent confirmation. The headline validation — a CD276 antibody-drug conjugate designed from pre-2025 data that merck later arrived at independently, FDA breakthrough designation following — is a retrospective coincidence reported by the party it flatters, not a prospective test, and Merck says nothing in the source. The preprint is unread. Treat the architecture as a described system and the results as claims.

The vendor states the order, and it is a claim

The layer list at the top of this file was assembled bottom-up: skills from one set of artifacts, orchestration from another, memory from a third, each arguing for its own layer. agent-sdk-workshop is the first source here that gives the same stack as a sequence, from the vendor. Four booleans in a config file, in this order: system prompt, then ENABLE_TOOLS, then ENABLE_SUBAGENTS, then ENABLE_MEMORY. Capability, then coordination, then persistence.

The switches are independent, so the order is not a technical constraint — nothing stops a learner enabling memory first. Putting it last is a judgment that persistence earns its cost only once there is something worth persisting, which is roughly what iai-pme and jcode arrived at from their own directions. What is new is that it arrives as a curriculum decision instead of a finding, from the party that ships the loop.

Two things follow.

The teaching method is the thesis. “No code writing required. You flip switches, pick from component lists, and write prompts. The SDK does the rest.” That is harness-as-library stated as far as it goes: the vendor owns the loop, the builder supplies configuration and prose. This spoke has tracked the value moving from the model to the wrapper; here the wrapper is sold as something you do not write either.

The staging asserts what the measurements keep failing to find. Each stage is presented as better than the last, and the repository measures nothing. Read against the table above — cc-thinking-skills, context-files-ablation-paper, jetbrains-ponytail-tested, three parties and three layers, all finding process effects and no correctness effect — a four-step improvement ladder with no evaluation is the shape the corpus has learned to discount. One caveat keeps this from being a straight repeat: stage 1 is tools, the one layer none of those studies ablated, and the one with an obvious mechanism for a real gain. A tool supplies facts the model does not have; a context file supplies facts it mostly did. If any rung of this ladder is load-bearing it is that one, and nobody has measured it.

A smaller observation worth keeping. Four of the workshop’s six scenarios — chief of staff, customer support, sre-agent, account intelligence — are operations roles, not coding. This spoke’s corpus is overwhelmingly coding harnesses, and the vendor’s own teaching fixtures are not. That is a market read rather than evidence, and it is the vendor’s, but it points at a corner the corpus does not cover.

The layer under the harness, finally counted

This spoke’s corpus is harnesses, skillpacks and meta-harnesses — things you run. turingpost-13-frameworks surveys the layer beneath: the agent-framework you build with. Thirteen of them, and until now the spoke touched this layer only when a specific entry forced it (adk, langchain), never as a class.

Three things the census shows by its shape.

The layer is Python. Twelve of thirteen support it; Mastra alone does not. TypeScript is in six, .NET only inside Microsoft’s entry, and nothing else appears. That cuts against the texture of this wiki’s own corpus, which is full of TypeScript and shell harnesses, and it is the first time the language line has been visible here at all.

It has started specializing. Voice and telephony, documents and RAG, research simulation, enterprise coordination. When the general-purpose entrants stop being the only entrants, the market is past its first phase — the same signal, one layer down, that the skillpack corner gave when methodology packs began disagreeing only about who pulls the trigger.

Anthropic is absent from it. OpenAI, Google and Microsoft are all listed, and AWS arrives through Strands’ Bedrock default. The claude-agent-sdk this wiki calls the clearest artifact of the model-provider → agent-platform shift is not there. The article states no inclusion criteria, so there is no way to separate an omission from a judgment, and the honest record is the observation without the explanation.

A vocabulary problem worth naming. The article’s ladder is model → API → SDK → framework, sorted by how much arrives pre-built. Anthropic’s, already paged here, is Client SDK → Agent SDK → Managed Agents, sorted by who runs the loop and on whose machine. Both call the middle rung an SDK. A source saying “it’s just an SDK” may be making either claim, and the two are not close.

A second census arrived the next day and did not agree with the first. llm-engineer-toolkit (10.7k★, 150+ libraries in 15 categories) lists 27 agent libraries where Turing Post listed 13, and seven are on both. The divergence is patterned rather than random: Turing Post carries the vendor SDKs (ADK, Microsoft Agent Framework, Strands) and the non-Python entries (Mastra, LiveKit) that the toolkit omits, and the toolkit carries a whole community stratum (AutoGen, Swarms, Composio, Browser Use, AgentOps, Langroid, AgentStack) that Turing Post has none of. Neither states an inclusion rule.

So “agent framework” is a category with a contested boundary, and every count of it is a statement about the counter — one list shaped like the vendor landscape, the other like the Python open-source community. That does not weaken the three findings above; the toolkit independently confirms crowded and Python, at twice the size. It does mean a census here is evidence of what its author was looking at, and should be cited that way.

The Anthropic absence is now twice, and still not an explanation. No Anthropic agent library appears in the toolkit either — the word occurs once across 150+ entries, inside a monitoring tool’s list of what it instruments. Two criteria-free lists of different shape is a second data point and nothing more; it stops the observation being one author’s oversight without making it a claim about the market.

One thing the toolkit shows that the survey could not. Its second-largest category is evaluation — fifteen libraries (Ragas, DeepEval, Giskard, Opik, AgentEvals, TruLens…) — against this spoke’s standing complaint that nobody evaluates agent tooling. The complaint should be stated more precisely from now on: the instruments exist in quantity, and what the corpus has never found is anyone using them to publish a result about the tools this wiki pages. That is a different and more damning gap than an absence of tooling.

And the hole is the same hole. No source in this corpus measures a framework against building directly on an API. The survey grades on ergonomics, community size and one star count; its “weaknesses” column is editorial judgment. One layer up, three parties did run controls (cc-thinking-skills, context-files-ablation-paper, jetbrains-ponytail-tested) and found process effects without correctness effects. Nobody has run that experiment down here, on the layer where the abstraction cost is largest and most obviously in the way.

Contradictions / tensions

• Adoption is not evidence — the context-file layer, measured (2026-08-03). agents-md is documented here through its own site: 60k projects, 30-odd tools reading it, Linux Foundation stewardship. context-driven-development goes further and names durable project context a discipline. governed-context-claude-code, spec-driven-development and much of the harness thread assume the same premise. context-files-ablation-paper tested it under control and found no correctness effect on either of two frontier agents, with the ablated file removed entirely scoring within 2.3pp of the file injected every turn. Both positions are kept: the convention’s reach is real and well-sourced, and so is the null. What cannot survive is treating the first as evidence for the second. The narrower claim that does survive the experiment — context reduced blind full-suite test runs on the one repository whose file warned about test cost — is an operational benefit, not a quality one, and it came from a single warning rather than from conventions or architecture guidance.
• Cost vs. fidelity — pxpipe vs the reliability thread. The spoke’s reliability discipline (output-grounded verification, byte-exact correctness, agent-guardrails) pushes toward not silently corrupting what the agent reads. pxpipe’s image-compression cost lever does exactly that — hashes/hex IDs can be OCR’d wrong with no error raised — and, counter-intuitively, gets worse as the model gets stronger (0/15 on Opus vs 13/15 on Fable 5). So the token-cost thread and the fidelity thread pull against each other here; pxpipe mitigates by imaging only old/stable/non-byte-critical context, but the trade is real and unusual (better model → worse OCR fidelity). Contrast headroom‘s reversible compression, which keeps originals retrievable. Watch whether modality-arbitrage compression stays fenced to safe content or leaks into byte-critical context.
• Constitution vs containment — auto-company vs agent-guardrails. The spoke’s safety line is enforcement: block lists, checkpoints on irreversible actions, containment so a bad step is recoverable (agents-never-do-alone, run-claude-code-agents-24-hours). Auto-Company runs 24/7 unattended with the limits written as prose in CLAUDE.md (“do not delete repos, do not force-push to main”) while its sandbox boundary is bypassPermissions / danger-full-access on the host filesystem — and its FAQ’s fix for a stalled cycle is to disable the prompts. So the wiki now holds two live positions on how autonomy is made safe: instructions the model reads, versus a boundary it cannot cross. Neither has incident data attached. The reasoning-scaffolds null result is faint evidence against the prose position — if a framing instruction doesn’t measurably change reasoning, it’s a thin thing to hang rm -rf on.
• Memory’s unpriced range — one markdown file vs a forkable store. auto-company‘s consensus.md is the entire cross-cycle state of a 14-agent loop, chosen explicitly over “complex vector databases”; seekdb and zouroboros build layered, indexed, branchable agent-memory for the same continuity goal. Three orders of magnitude of machinery, no comparison between them, and the markdown pole buys a real property the other lacks (a human steers by editing one line).
• Scaffold the model or train it — openmanus‘s RL sibling (2026-07-26). Every layer of this spoke’s thesis puts competence in the wrapper: skills, middleware, loops, memory, guardrails. The same org ships OpenManus-RL, which tunes agent LLMs with reinforcement learning (GRPO) — locating competence in the weights instead. The two aren’t logically opposed (you can RL-tune a model and wrap it), but they are competing bets about where the next increment comes from, and the corpus has zero sources on the RL side against ~166 pages on the structural one. That imbalance is a real blind spot, not a resolved argument. It also sharpens the standing “does structure substitute for capability” question: the honest version has three terms now — bigger model, better harness, or a model post-trained for agent behaviour.
• Specify more vs specify less — agent-environment-design vs the spec thread (2026-08-07). The spoke’s dominant answer to an unreliable agent is a better-written up-front artifact: spec-driven-development, context-driven-development, claude-md, agents-md. Zou’s position from 37,000 agents is that at scale you supply infrastructure, incentives and guardrails and stop telling agents how to work, because the environment is what you optimise. Both are single-position claims about different scales, and neither has a measurement attached — but they cannot both be the general rule, and the ablation null (context-files-ablation-paper) is the only evidence in the room, weakly on the second side.
• The harness-substitutes-for-model claim, now measured three times (2026-08-08). This line used to end “watch it against future neutral benchmarks.” Three have arrived and they agree: scaffold-effects-gaia (structure carries a model one tier, not two), claw-swe-bench (harness spread roughly doubles as the model weakens), and now harness-bench with frontier models in a full 8×6 factorial — “stronger model backends… exhibit lower cross-harness variance.” So the wrapper’s value is real and shrinks as the model improves, which prices much of this spoke’s subject into model progress without zeroing it: 23.8 points still separate the best harness from the worst. The corollary the authors draw is the one to keep — agent capability should be reported at the model-harness configuration level, so a benchmark score without a named harness says little. The detail this spoke should sit with: openclaw, its most-starred harness and the centre of gravity for a dozen of its sources, scores last of six.

Cross-spoke adjacency

• research-wiki — parent; holds the knowledge-management / memex / llm-wiki lineage (cluster A) and formal methods (E), plus the bridge nodes above. gbrain, agent-skills, compound-engineering, and model-context-protocol are the seams between the two.
• llm-inference-wiki — the mechanism layer (how models run/serve). This spoke sits above it: harnesses and skills consume inference; neither owns the other’s subject.
• platform-ops-wiki — the verification-runtime seam (new, via agent-loops-verification). This spoke owns the loop + verification paradigm (loop-engineering); when verification of agent-written code requires a real running system (cloud-native behaviour, not just the artifact), it becomes a runtime/ephemeral-environment problem that platform-ops owns. Watch for sources where agent loops drive CI/CD or validate against live infrastructure. Second source on that seam, 2026-07-22: harness-agent-dlc — agents shipped through CD pipelines with eval gates, canary/OPA deploys and run tracing. Routed here because the subject is the agent lifecycle, but every mechanism it uses is platform-ops vocabulary (canary, policy-as-code, tracing, the delivery-measurement gap next to dora-metrics), so platform-ops is the logged runner-up. The cluster the seam predicted now has two sources; a third would make “verifying/governing agents against live delivery infrastructure” a real spin-out candidate rather than a shared edge. A third adjacency shows up here too: the ai-governance-wiki angle (ownership, asset inventory, auditable records of what an agent did) — that spoke owns the rules-and-assurance framing, this one owns the tooling that implements it.
• web-browsers-wiki / osint-wiki — the device seam (new, 2026-08-03, via mobilerun). An agentic browser’s “act on my behalf” mode is the same GUI-driving problem confined to one application, and web-browsers-wiki owns it as a product feature; osint-wiki holds the profile-building agents that would be the obvious consumer of phone control. Neither owns the device layer — the accessibility bridge, the tree-vs-pixels encoding, the gesture toolset — which is why mobile-device-agent is paged here. One source deep; if phone/desktop GUI agents accumulate, this is a spin-out candidate rather than a permanent corner of agentic-tooling.

Index — Agentic Tooling Wiki

Catalog of every page, grouped by schema.org @type. Spine: synthesis (thesis), log.md (history), this file (catalog). Some wiki-links resolve to bridge nodes in the sibling research-wiki (intentional cross-wiki links).

DefinedTerm (concepts / mechanisms)

• agentic-tooling — umbrella: the tools wrapped around a model to build/run LLM agents; structure as the lever · domain

• agentic-coding-harness — the scaffolding around a code-writing model (“everything else”); structure as capability · mechanism

• agent-permission-model — how a harness decides what an agent may do without asking; the one dial that limits the agent rather than extending it. Per-action human approval caught 13.6% of harmful actions — a control that degrades the more the agent is used · mechanism

• agentskills-spec — agentskills.io open cross-vendor skills standard + progressive disclosure · standard

• agent-evals — scored test runs over a dataset (not one pass/fail) as the answer to agent nondeterminism; eval score wired into the delivery pipeline as a pass-fail gate, firing on model changes too; consolidates the corpus’s trust-no-eval tension · practice

• agent-failure-localization — deciding which component of an agent system caused a failure, so you know which repair to attempt: interaction edge + fault side, root-caused to the earliest unrecovered failure; the diagnostic complement to agent-evals’ regression score · mechanism

• agent-scope-isolation — one deployment, many principals: per-person and per-room memory, files, keychain view, permissions, skills, crons and durable sandbox; enforceable for access, not for disclosure · architecture

• agent-specific-task-difficulty — the same task is trivial for one agent and impossible for another (Spearman ρ=0.75, but ~40% of tasks borderline for only one agent), so the informative band is per-agent and ablations must screen per agent; plus the portability trap that turn counts mean different things across harnesses · methodology

• constraint-evading-behavior — agents satisfy a check’s letter while defeating its purpose (weaken the planned type, sentinel-stuff an ADT, suppress the warning) — specification-gaming at the developer-guardrail level; the counterforce to the verification thread (a gate you can cheese isn’t a gate) · failure-mode

• agent-orchestration — orchestrator → parallel-subagent fan-out; the execution-time engine · mechanism

• graph-based-agent-workflow — agent app as a directed graph of nodes+edges run by a scheduler; the declarative “a graph is an agent” model (ADK Go 2.0) · mechanism

• spec-driven-development — agree the spec/context before the agent codes; process-as-markdown · practice

• context-driven-development — CDD: SDD widened to context + spec before code; project context as a durable, reviewed artifact (Google/Conductor) · source · T1 · practice

• durable-agents — long-running agents that pause/resume/survive crashes via state machines + persistent sessions · mechanism

• self-improving-agents — agents that author/refine their own skills + accumulate memory (the “growth” axis) · mechanism

• agent-middleware — the composable structural unit of a harness: single-concern pieces hooking the agent loop · mechanism

• agent-guardrails — autonomy boundaries: bound agents by reversibility/recovery cost; human checkpoints on irreversible actions · practice

• agents-md — open project-context convention (AGENTS.md); cross-tool (60k+ repos, Linux Foundation) · source · standard

• claude-md — Claude Code’s per-project instruction file (loaded every session); the Claude-native sibling of agents-md; small+universal+hand-authored is the discipline · convention

• agent-memory — the persistent state + retrievable-knowledge substrate beneath durability/self-improvement; the storage layer of its own · mechanism

• loop-engineering — designing the agent’s iterative loop (goal + stop condition + feedback) instead of a prompt; the Ralph technique generalized; relocates the bottleneck to verification · practice

• agentic-resource-discovery — ARD: cross-org capability discovery (ai-catalog.json + registries); the discovery edge of the interop stack, indexing MCP/A2A; Google→Linux Foundation · source · T1 · standard

• effort-level — harness control for how much work the agent does (files/tools/steps/verification), orthogonal to model choice; effort moves token-generation, model doesn’t (Claude Code) · mechanism

• context-rot — degradation of output as context grows/accretes cruft; intrinsic (attention/U-curve/lost-in-the-middle) vs content (stale-material accumulation) rot; the why under the token-budget corner, reframed cost→quality; governed via curate/offload/reset · mechanism

• text-first-agent-design — don’t hand the agent the surface, hand it a derived representation chosen for meaning-per-token (accessibility tree / transcript / text index) and touch the raw medium only at decision points; pxpipe is the deliberate inverse where no structured description exists · principle

• mobile-device-agent — an LLM agent whose tool surface is a phone: taps/swipes/typing driven from the OS accessibility tree (semantics, ~500× cheaper) with screenshots as the vision fallback; device-side Portal + operator-side runtime; the spoke’s first non-repo/browser/chat surface · mechanism

• reasoning-scaffolds — cognitive skills (frameworks/personas prescribing how to think) vs capability skills (what an agent can do) vs output-shape skills (constraining the artifact, added 2026-07-28); the first layer of the skills claim with measured — and negative — evidence · mechanism

• agent-environment-design — at scale you stop tuning the agent and tune the space it works in: supply infrastructure, incentives and guardrails, drop the instructions, and optimise the environment as the object; the first argument here for removing specification rather than adding it · principle

• agent-framework — the library layer you build an agent with (orchestration, memory, tools, multi-agent), as against the harness you run; paged 2026-08-10 with the corpus’s first stated comparison axes — language, abstraction level, specialization, production posture, multi-agent support · layer

SoftwareSourceCode (sources)

• agent-sdk-workshop — anthropic‘s hands-on course for the claude-agent-sdk (Apache 2.0, Python, 56★, one commit): one agent taken through four config switches — prompt → ENABLE_TOOLS → ENABLE_SUBAGENTS → ENABLE_MEMORY — plus six scenario breakouts over 19 mock-data tools. The spoke’s layer stack stated by the vendor as a dependency order, capability first and persistence last, and “no code writing required” is harness-as-library at full strength. Four of six scenarios are ops roles, not coding. No evaluation, and the staging asserts monotonic gain · source · T1 · github.com/anthropics

• mimiclaw — an agent harness in pure C on an ESP32-S3 (MIT, 5.6k★/829 forks, read 2026-08-10): Telegram gateway, ReAct loop against Claude or GPT, markdown memory on flash (SOUL.md/MEMORY.md/HEARTBEAT.md), five tools, dual-core, 0.5 W. Ships four of the six parts of the harness anatomy and omits identity and policy entirely; the LLM schedules its own cron jobs and a 30-minute heartbeat re-prompts it, with no approval gate anywhere. The “$5 chip” hosts the harness — the model is rented per turn · source · T1 · github.com/memovai

• open-edit — VEED‘s agent skill for video editing (Apache-2.0 editor + PolyForm Shield renderer binaries, 209★, npx skills add): no GUI, agent-agnostic via AGENTS.md, captions authored in HTML/CSS and rendered without a headless browser, transcription abstracted across VEED/WhisperX/your own — and a hard refusal on any transcript lacking per-word timings. The head-to-head against video-use the spoke didn’t have; Apple Silicon + macOS 26 only · source · T1 · github.com/veedstudio

• claude-code-development-kit — Peter Krueck’s opinionated Claude Code starter (MIT, 1.4k★): four synchronized docs/ai-context/ files, tiered /prime (~4–6k tokens base), /review-work parallel subagents, /second-opinion to Codex/Gemini, secret-scanner + deny-list hooks. A configuration layer, not a harness — governed-context-claude-code‘s playbook turned into an installer. Built on the mechanism context-files-ablation-paper ablated to a null, ships no eval, and makes only process claims · source · T1 · github.com/peterkrueck

• qm — Y Combinator’s multiplayer agent harness for work (MIT, TypeScript, 8,967★ in five days): headless core + Postgres, harness-agnostic (Pi/OpenCode/Codex/Claude Code drive the same loop), per-scope durable sandbox, Slack + web. Org-level security posture (Strict/Auto/Dangerous) that scopes may only tighten, over a command-policy floor that applies in all three. Its 9.9 KB SECURITY.md is mostly published limitations — command policy “a speed bump… not a sandbox boundary”, credential purposes not enforced, plaintext sandbox creds. Plus a 7-day npm cooldown and prose-only contributions · source · T1 · github.com/yc-software

• claudecode-writer — Women Defining AI’s Claude Code content workspace (MIT, 214★): rawnotes → /extract-themes → /research → /write → three platform repurposer subagents. Fan-out from one artifact, no quality gates. Its writing-examples.md is a clean specimen of the purpose-built context context-files-ablation-paper left untested — and its demo output is the flattened-voice failure renwei-writing exists to name. Last pushed 2025-09-06 · source · T3 · github.com/WomenDefiningAI

• iai-pme — CodeAbra’s local-first memory engine for MCP coding assistants (MIT, ~423★): episodic / semantic / procedural tiers with nightly consolidation, scheduled decay and contradiction surfacing; Rust core, encrypted SQLite (vector + graph), Leiden-family MOSAIC clustering, local bge-small embeddings; publishes LongMemEval-S numbers (R@10 0.978) — the memory layer’s store→process axis · source · T3 · github.com

• nono — Nolabs AI’s agent sandbox (Apache-2.0, ~3.2k★, pre-1.0): least-privilege launcher for coding harnesses with per-tool child sandboxes (git/gh/curl/kubectl each with own creds, FS grants, network rules), proxied credentials with L7 endpoint filtering, composable JSON profiles + public registry; no daemon/container/VM; from the Sigstore team · source · T3 · github.com

• claude-financial-services — Anthropic’s reference FSI agents/skills/connectors repo · source · src: claude-financial-services.md

• compound-engineering-plugin — Every Inc’s compound-engineering skillpack for coding agents; refreshed 2026-07-25: 32 skills / 13 host CLIs / no agents or hooks, /ce-work cross-model dispatch, /ce-compound writes the next run’s context to docs/solutions/ · source · T1 · src: compound-engineering-plugin.md + url

• agentic-seo-skill — LLM-first SEO skill pack for agent IDEs · source · src: agentic-seo-skill.md

• cc-thinking-skills — 39 mental-model/critical-thinking skills for Claude Code + the replication-gated eval harness that found zero proven accuracy gains among them · source · T2 · github.com

• auto-company — 24/7 daemon running Claude Code/Codex as a 14-persona “autonomous company”; one markdown file as all cross-cycle state, phase gates hardcoded to force convergence · source · T2 · github.com

• agent-kanban — shared Kanban board for multi-agent + human coding collaboration · source · github.com

• agentsys — modular agent orchestration runtime (24 plugins / 49 agents / 44 skills) · source · github.com

• shipping-without-human-verification — TNS (Rubick + Jain, Aviator-sponsored, 2026-07-29): the endgame of the verification thread — ship a growing % of commits with no human review, starting at 1%. Contributes testing asserts / verification judges and a row-by-row split of which is which; proposes the automated verification engineer. Its one number (50% detection → 200% org speedup) has no method, and it never asks whether an LLM gate is adversarially robust · source · T3 · thenewstack.io

• cult-ui-agent-patterns — 92+ copy-paste AI-agent patterns (ReAct/plan-and-solve/RAG) on the Vercel AI SDK; recipes, not a framework · source · T3 · opensourceprojects.dev

• headroom — local-first context-compression toolkit (lib/proxy/CLI/MCP): compresses tool outputs/logs/RAG before the LLM, 60-95% fewer tokens; content-typed compressors + cross-agent memory · source · T1 · github.com

• superpowers — Jesse Vincent (obra)‘s composable agent-skills framework + dev methodology (brainstorm→plan→test→build→debug→review); cross-harness skill pack, MIT, ≈242k★ (flagged) · source · T1 · github.com/obra

• opc-skills — ReScienceLab (Apache-2.0, 1.2k★): ~11 skills for solopreneurs / one-person companies — market research (Reddit/Twitter/Product Hunt), domain hunting, SEO, logo+banner generation, archiving; 16+ host tools. The first pack here whose subject is not software, so none of the free verification a coding pack gets applies; declares inter-skill dependencies (domain-hunter → twitter+reddit), a third answer to where composition lives · source · T3 · github.com/ReScienceLab

• ruflo — rUv/ruvnet (MIT, 67.1k★, ex-Claude Flow): agent meta-harness over claude-code — swarm topologies + 100 agent roles, ~210 MCP tools in parallel, AgentDB/HNSW vector memory, SONA self-learning, zero-trust cross-org federation; the corpus’s maximal stack-everything entry, with one conditional benchmark to its name · source · T3 · github.com

• superclaude-framework — SuperClaude-Org (MIT, 23.7k★, v4.3.0): 30 slash commands / 20 role-persona agents / 7 behavioral modes / 8 wired MCP servers, pipx-installed as injected config into claude-code; the operator-invoked, single-harness counterpart to superpowers; no evaluation · source · T3 · github.com

• knowledge-rag — local-first RAG MCP server for Claude Code: hybrid semantic+BM25 + cross-encoder rerank, ChromaDB, 13 MCP tools, 20 format parsers, zero external APIs; the retrieval-rich end of the local axis · source · T1 · github.com/lyonzin

• claw-code — provider-agnostic Rust CLI agent harness · source · github.com

• jcode — single-author Rust terminal coding agent (MIT, 13.1k★ in ~7 months): in-harness agent-memory (turn embeddings → memory graph, relevance-gated passive injection, ambient consolidation), a peer-to-peer swarm that notifies an agent when a file it read is edited under it, plus its own terminal and mermaid renderer. Publishes self-run RAM/startup benchmarks with versions, ranges and method — and baselines them on its own stripped config · source · T1 · github.com

• openmanus — FoundationAgents’ open general-purpose agent framework, built in 3 hours as an invite-code-free replica of the closed Manus; MIT, 57.6k★ off 526 commits; Python/Playwright/MCP, three modes; agent loop undocumented; sibling OpenManus-RL puts competence in the weights (GRPO), not the wrapper · source · T1 · github.com

• oh-my-pi — IDE-wired terminal coding agent: LSP, debuggers, hash-anchored edits, subagents (40+ providers) · source · github.com

• hermes-agent — Nous Research self-improving autonomous agent framework (“grows with you”); OpenClaw successor · source · github.com

• awesome-hermes-usecases — community-curated, primary-source-gated catalog of real-world Hermes Agent deployments (13 domains); the evidence counterweight to hermes-agent’s README claims · source · T2 · github.com

• autonovel — Nous/Hermes Agent autonomous novel-writing pipeline (4 phases, ~27 scripts, mechanical+LLM-judge eval loops); shipped a 79k-word novel — the loop/verification thesis as a working artifact · source · T1 · github.com

• zouroboros — self-enhancing multi-agent orchestration + hybrid memory platform (5 executors incl. Hermes; Health Council; 3-model consensus gate on self-edits); convergence instance, Zo-Computer-native · source · T1 · github.com

• autoresearch — Karpathy’s “agentic scientist”: agents autonomously iterate ML training overnight (edit train.py → 5-min run → val_bpb → keep/discard); the loop thesis with an objective feedback signal · source · T1 · github.com

• microsoft-scout — Microsoft’s OpenClaw-built personal assistant (autonomous, durable, self-improving) + policy-conformance governance · source · techcrunch.com

• openhuman — local-first (Tauri/SQLite) open-source personal AI agent; Memory Tree + Obsidian wiki; 118+ Composio integrations · source · github.com

• corbell — CLI building a code knowledge graph across repos (tree-sitter call graphs + embeddings + git change coupling) and generating architecture specs from it; local SQLite, MCP server, D3 graph UI, Linear/Jira export; SDD with mined context instead of written context — unevaluated · source · T1 · github.com

• spec-kit — GitHub’s reference spec-driven-development toolkit (six /speckit.* commands, 30+ agents) · source · github.com

• anthropic-skills — Anthropic’s official Agent Skills repo: the spec, template, example + production document skills, plugin marketplace; first-party home of the skills standard · source · T1 · github.com

• get-shit-done — GSD: Claude Code system pairing context engineering + spec-driven development · source · github.com

• jaseci — Jac language + full-stack AI framework (Meaning Typed Programming, graph walkers) · source · docs.jaseci.org

• node-js-functional-patterns-skill — a skill pack via MCP Market; honest stub (429) · source · mcpmarket.com

• conductor — Gemini CLI extension; Context-Driven Development (context → spec → implement) · source · github.com

• gstack — Garry Tan’s “AI software factory”: 23 skills + role-agents; uses GBrain + Conductor · source · github.com

• claude-to-speech — Claude Code plugin: ElevenLabs TTS for responses via hooks · source · github.com

• ai-job-search — Claude Code job-application framework (skills + slash commands + drafter–reviewer subagents; output-grounded PDF verification); harness pattern in a non-coding vertical · source · github.com

• designpowers — model-agnostic 10-agent design team (36 skills, Discover→Ship pipeline) with human-as-director (Direct/Auto modes); accessibility-as-default; role-split orchestration in a non-coding (design) vertical, cross-harness · source · T3 · github.com

• lathe — Claude Code/Cursor/Codex skills that generate hands-on tutorials you work through by hand; the anti-automation “teach, don’t do for you” augment pole · source · github.com

• renwei-writing — 人味儿写作: a Cola skill that edits text without erasing the author’s voice; augment pole applied to writing; Wikipedia-”Signs of AI writing” post-edit checklist · source · T1 · github.com

• pm-skills — PM Skills Marketplace: 68 skills / 9 plugins / 42 chained workflows for product management; cross-vendor (Claude Code/Cowork/Codex/Gemini/Cursor) · source · github.com

• pm-skills-arsenal — 12 deep PM skills (~1–1.3k lines) with typed input/output_schema for structural routing; APM + plugin marketplaces + MCP run_skill; the few-deep-routed-by-schema counterpoint to pm-skills · source · T2 · github.com

• seekdb — OceanBase’s “AI-native state store for agents”: MySQL-compatible, hybrid vector+FTS, COW FORK/MERGE sandboxes (Apache-2.0); the memory-substrate layer as a product · source · github.com

• tgpt — multi-provider terminal LLM chat frontend (Go, GPL-3.0); ~10 backends incl. free tiers + Ollama; the non-agentic boundary of the terminal-AI ecosystem · source · T1 · github.com

• arrow-js — reactive UI framework for agent-generated interfaces; WASM sandboxing for safe browser-side code execution; < 5 kb, no build step · source · T1 · arrow-js.com

• openui — generative-UI framework: LLMs emit a compact streaming DSL (“OpenUI Lang”, ~67% fewer tokens than JSON), React renders it; the constrained-DSL counterpoint to arrow-js in the rendered-output corner · source · T2 · github.com

• agent-starter-pack — Google Cloud toolkit for building/deploying production agents from templates (Cloud Run / Agent Engine, eval, CI/CD); the deploy/operate end of the harness · source · T1 · googlecloudplatform.github.io

• perplexity-api-platform-skills — Perplexity’s official Agent Skills repo (Apache-2.0, 71★): migrate-sonar-to-agent-api (a vendor absorbing its own breaking change as an agent task) + pplx-cli, bundled docs-MCP, Claude Code and Codex marketplaces from one tree, npx skills add fanning out to ~70 agents, plus zero-install by URL. Best-built eval here — production-verified fixtures, reference migrations explicitly not answer keys, mechanical check.sh + live runs, a documented A/B against no-skill, and a “judged by eye (not greppable)” section naming where its own grader can be cheesed · source · T1 · github.com

• jetbrains-ponytail-tested — JetBrains’ independent A/B of ponytail (80 paired SkillsBench tasks, claude-sonnet-5, 251 trials, per-trial contamination audit): −15.4% code / −10.3% cost, no quality difference — about a third of the advertised −54%/−20%; benefit conditional on the baseline over-building, and the skill self-activated zero times without the always-on hook · source · T2 · blog.jetbrains.com

• ponytail — “lazy senior dev” skill: a decision ladder that constrains coding agents to write the minimum code (restraint, not capability); 15+ hosts; self-reported ~54% less code, independently measured at −15.4% code / −10.3% cost (jetbrains-ponytail-tested) · source · T1 · github.com

• i-have-adhd — ponytail‘s sibling in output restraint: 10 rules + a pre-send check that strip preamble/recap/tangents from an agent’s answers (ADHD-derived, MIT, 12.3k★); the first skill shipping its own eval harness + release gate (blind weighted rubric, condition isolation, pinned model) — and no published numbers · source · T1 · github.com

• easy-agent — terminal-native agentic coding CLI (TS/Node, Ink TUI) that rebuilds a Claude Code-style harness in 5 explicit layers + 31 study snapshots; a teaching scaffold · source · T1 · github.com

• nemoclaw — NVIDIA reference stack: runs OpenClaw/Hermes/LangChain Deep Agents securely inside OpenShell sandboxes (managed inference, network policy, lifecycle); the agent-agnostic vendor governance layer, first-party · source · T2 · github.com

• cybersecurity-skills — 817-skill cybersecurity skillpack (mukul975) on agentskills.io; 29 domains, 6 framework mappings; the largest skillpack instance — progressive-disclosure scaling test; community repo (not official Anthropic) · source · T2 · github.com

• education-agent-skills — 165-skill pedagogy skillpack (Gareth Manning, CC BY-SA 4.0) on agentskills.io; 20 domains, cross-vendor plugin + hosted MCP/OAuth; first pack citing external research in frontmatter (evidence_strength/evidence_sources) and first vertical aimed at the end user (13 student-facing skills) · source · T2 · github.com

• pullmd — self-hosted URL/file→Markdown service (Aeterna Labs, AGPL-3.0, 365★); Readability→Trafilatura→origin-Markdown→Playwright cascade, plus MCP server + Claude Code skill + OAuth. md-this-page‘s strip-at-capture lever with an agent-invocation surface · source · T2 · github.com

• statewright — state-machine guardrail (Rust, ~449★): phase-scoped tool availability (plan=read-only → implement=edit → test=test-cmds), cross-vendor MCP plugin. Enforcement-over-instruction aimed at reliability, not safety; reports 2/10→10/10 on a 5-task SWE-bench subset (self-run, tiny-N) · source · T3 · github.com

• longhorizon-harness — AMAP-ML (alibaba) long-horizon harness over Claude Code/Codex/OpenClaw (MIT): Manager/Executor/Auditor split, fresh context per round, verification as the write-gate on persistent state. First self-reported harness result at real N — WeaveBench 114 tasks +28.9 pts, OSWorld 2.0 108 tasks 2.8%→8.3%, Terminal-Bench 2.1 +7.5 pts / −24% tokens, all on a fixed Qwen backbone · source · T1 · github.com

• deer-flow — ByteDance “SuperAgent” harness (LangChain/LangGraph): sandboxes + memory + markdown skills + parallel subagents + chat-app message gateway; long-horizon (minutes–hours); big-tech harness-vendor entrant · source · T2 · github.com

• autoharness — self-maintaining skill layer for Claude Code: distils sessions into skills, consolidates duplicates, archives by invocation rate; author-only scoping + validation, daemon/benchmark-free; self-improvement at the library level · source · T3 · github.com

• whatsapp-chatgpt-bot — wassenger‘s MIT WhatsApp bot: GPT-4o + multimodal I/O + function-calling RAG + MCP + human handoff; the messaging-channel gateway corner (non-Anthropic bot reaching for MCP) · source · T3 · github.com

• agent-scripts — peter-steinberger‘s personal cross-harness hub: skills + AGENTS.MD hard rules + sync-skills/validate-skills mirrored into Codex & Claude Code; the individual-developer floor of skill-infra · source · T1 · github.com/steipete

• openwiki — LangChain‘s OSS CLI that auto-generates + CI-refreshes codebase docs for agents, appending to AGENTS.md/CLAUDE.md; the OSS pole of docs-as-build-artifact · source · T1 · github.com/langchain-ai

• agtop — ldegio, GPL v2, 224★: top for coding agents — per-session spend, tokens, CTX% saturation, CPU/memory, tool calls and subagents, from JSONL transcripts joined to OS processes. The token-budget corner’s first instrument — every other entry in it is a lever that spends less; this one only measures · source · T1 · github.com/ldegio

• pxpipe — local proxy that cuts Claude Code token cost ~59–70% by rendering dense context as PNGs (modality arbitrage on image-token pricing); lossy on byte-exact strings; headroom‘s opposite pole · source · T1 · github.com/teamchong

• watch-skill — cross-harness skill (MCP+CLI+REST) giving agents video-watching + self-verification (“THE LOOP”: record own output → critique → fix → before/after proof GIF); output-grounded verification made perceptual; local-first (offline whisper/OCR/SQLite index) · source · T1 · github.com/oxbshw

• ask-search — self-hosted zero-API-key web search skill for agents: wraps SearxNG (70+ engines) behind MCP + CLI + OpenClaw SKILL.md; the live-web pole of the local-first-tool-over-MCP corner (vs knowledge-rag‘s local docs); Tavily fallback · source · T1 · github.com/ythx-101

• diagram-design — cathryn-lavery‘s Claude Code skill for editorial diagrams (MIT, ~3k★): 27 types × 3 variants, self-contained HTML+SVG with no build/JS/CDN, one-time brand capture from the user’s website (colors + fonts), 34 progressively-loaded reference docs, PNG/SVG export via Playwright — and lint tools that check the output against 4px-grid / 1px-hairline / one-accent rules. The output-shape skill in visual form, machine-checked · source · T1 · github.com/cathrynlavery

• beautify-github-readme — oil-oil‘s MIT agent skill that redesigns a repo’s README (proof-before-technical hierarchy + project-native SVG identity; Markdown-for-text / SVG-for-visual separation); the vertical-skill thread reaches repo/README presentation · source · T2 · github.com/oil-oil

• md-this-page — Ademking‘s MIT Chrome/Firefox extension (1.3k★): page → clean Markdown via Mozilla Readability + Turndown, with copy-as-prompt; the strip-at-capture lever upstream of the whole token-budget corner, and the pattern with the agent removed · source · T2 · github.com/Ademking

• video-use — browser-use‘s MIT skill that edits video by conversation (18.6k★, the spoke’s most-starred skill): one ElevenLabs Scribe call → ~12KB transcript the model cuts from, composites only at decision points; filler/dead-air removal, grading, subtitles, sub-agent overlays; self-evaluation loop re-renders bad cuts · source · T2 · github.com/browser-use

• mobilerun — DroidRun‘s MIT framework driving real Android/iOS phones from natural language (8.9k★): device Portal app + local agent runtime, model-agnostic (OpenAI/Anthropic/Gemini/DeepSeek/Ollama/OpenRouter), standard/vision/reasoning modes; reports 91.4% on AndroidWorld’s 116 tasks, ~7 pts clear of AutoGLM-Mobile, on accessibility-tree-not-pixels · source · T2 · github.com/droidrun

• grok-build — xAI‘s open-source Rust terminal coding agent (grok): full-screen TUI + headless + editor-embed via ACP; MCP/plugin-extensible; modular crates; the model lab shipping its own harness (peer to Claude Code / Gemini CLI) · source · T1 · github.com/xai-org

• agentic-awesome-skills — sickn33’s 2,003-skill catalog turned control plane (MIT, ~44.5k★, v15.9.0): a local read-only MCP (search_skills/get_skill/compose_stack) where the agent picks the IDs and Core validates structure only — explicitly not semantic fit, safety, or suitability; aas-stack.json + evidence sidecar + immutable plan + human review. Documents its own scale failure (Antigravity context exhaustion → installer refuses a bare full install; 128-skill manifest cap) and that a full install ships critical/offensive instructions · source · T3 · github.com/sickn33

• vibe-tools — eastlondoner’s Node CLI giving an agent other models to call (MIT, ~4.8k★): Perplexity search/research, Gemini whole-codebase context, Stagehand browser act/extract/observe, GitHub/Linear/docs/YouTube skills; integrates by writing the harness’s instruction file (claude-md, .cursorrules, Windsurf/Cline/Roo) — the pre-MCP way, and the opposite pole to agentic-awesome-skills; arrived via a promotional X thread · source · T3 · github.com/eastlondoner

Collection (sources)

• llm-engineer-toolkit — kalyan-ks, Apache-2.0, 10.7k★: 150+ LLM libraries in 15 categories, Agents the largest (23) and inference+serving the smallest (9). Read against turingpost-13-frameworks the next day: 7 of 13 overlap, and the two diverge along a vendor-vs-community line — no ADK/Strands/MAF/Mastra/LiveKit here, no AutoGen/Swarms/Composio/Browser Use there. No Anthropic agent library in either. No inclusion criteria, no dates, no per-row licence or maintenance signal · source · T3 · github.com

• awesome-agent-evolution — EvoMap’s 150+-entry curated catalog of the agent-self-evolution field (self-improvement / memory / A2A / platforms / coding / guardrails / benchmarks / embodied); an external taxonomy matching the spoke’s bottom-up layer model; names Mem0/Eliza/Agent Zero as page candidates · source · T3 · github.com/EvoMap

• turingpost-13-frameworks — Alyona Vert, turing-post, 2026-08-09: a census of thirteen agent frameworks and SDKs (OpenAI Agents SDK, LangGraph, ADK, Microsoft Agent Framework, Pydantic AI, CrewAI, Agno, Strands, Mastra, smolagents, LlamaIndex, CAMEL-AI, LiveKit) with five comparison axes and a refusal to pick a winner. Python in 12 of 13; the layer has begun specializing by use case; Anthropic is absent and no inclusion criteria are stated. Editorial judgment, no measurement · source · T3 · turingpost.com

TechArticle (sources)

• stanford-virtual-biotech-37000-agents — VentureBeat on Zou‘s VB Transform talk: virtual-biotech runs tens of thousands of role- and data-differentiated agents under a CSO agent, 37,000 on one clinical-trial task; a CD276 ADC design later matched by merck; wrapping legacy DBs in MCP doesn’t make them agent-ready (paperclip); optimise the environment, not the model · source · T3 · venturebeat.com
• claude-code-model-effort-levels — Anthropic: model (frozen weights = capability ceiling) vs effort (how much work) as orthogonal Claude Code controls; when to raise effort vs upgrade the model · source · T1 · claude.com
• orchestration-mode — Claude API doc: multi-agent fan-out via mid-conversation steering · source · src: orchestration-mode.md
• hermes-profile-builder — Nous: web dashboard composing an agent from identity/model/skills/MCP (the “agent = composition” thesis as a form) · source · T3 · marktechpost.com
• harness-agent-dlc — Harness AI Agent DLC (TNS): ship agents through the pipelines/gates/approvals that govern app code — make the pipeline predictable, not the agent; AI Evals, canary+OPA agent deploys, AI configs, asset catalog with owners, AgentTrace (harness-sdk/harness-evals open-sourced); only 17% of orgs have deployed agents (Gartner) · source · T3 · thenewstack.io
• agent-loops-verification — Arjun Iyer/Signadot (TNS): loops replace prompts, so verification becomes the bottleneck — and for cloud-native code it’s a runtime problem · source · T4 · thenewstack.io
• anthropic-agent-sdk-billing-pause — Ars Technica: Anthropic paused (June 2026) a change to bill Claude Agent SDK / claude -p usage at API rates; the harness-as-product’s cost-structure problem · source · T2 · arstechnica.com
• claude-code-weekly-limits-promo — Anthropic support: temporary +50% weekly-cap boost for Claude Code (May 13–Aug 19 2026; Pro/Max/Team/legacy-Ent); reveals the two-tier limit (5-hour + weekly) and the weekly cap as the vendor’s adjustable lever · source · T2 · support.claude.com
• building-effective-agents — Anthropic engineering: building effective agents (workflows vs agents; simple, composable patterns) · source · T1 · anthropic.com
• adk-sessions-docs — Google ADK: Sessions — the session/state model for ADK agents · source · T1 · adk.dev
• agents-md-spec — the agents.md spec site: the AGENTS.md open convention · source · T1 · agents.md
• langchain-middleware-docs — LangChain docs: middleware as the agent-composition unit · source · T1 · docs.langchain.com
• autowiki-factory — Factory.ai’s multi-agent system that auto-generates/maintains a code wiki (“docs as a build artifact”); Droids browse it as shared context · source · T2 · factory.ai
• hermes-learn-skill-capture — MarkTechPost: Hermes /learn auto-authors a standards-compliant SKILL.md from a doc/URL/past conversation; names the manual→assisted→autonomous→community skill-creation spectrum; write_approval gate (off by default) · source · T3 · marktechpost.com
• tail-control-agentic-workflows — Wittkampf (TDS): reliability engineering of agent workflows — latency heavy tails (p99 2–7× median; 10 steps×95%≈60%), and SRE tail-control (race/cut-p95/hedge/downshift); workflows are the reliability-tractable form · source · T3 · towardsdatascience.com
• claude-fable-system-prompt-leak — Medium (unverified leak): a claimed Claude Fable system prompt — tools/MCP/memory/code-exec + guardrails + behavior as one configured layer; the “model is now an engineered system” thesis from the vendor side · source · T4 (unverified) · medium.com
• from-local-llm-to-agent — TDS: a fully-local tool-using agent (Gemma on Ollama + OpenAI Agents SDK + MCP/Tavily); skills×MCP=agency decoupled from the model substrate · source · T4 · towardsdatascience.com
• safe-prompt-pruning — TDS (Emmimal P Alexander): deterministic 3-pass prompt pruner (drop expired tool outputs + duplicate RAG docs, restore DEFINE/REF dependencies); the remove lever of the token-budget corner (vs headroom compress / pxpipe modality-swap); lossless & LLM-free, 27–34% cuts on RAG/tool workloads · source · T3 · towardsdatascience.com

BlogPosting / Article (sources)

• claude-code-auto-mode — simon-willison on auto mode as the claude-code default (Pro/Max/Team, from 2026-08-14): Anthropic reports it blocking 89% of harmful actions vs 13.6% by human reviewers (n=1,053 developers), and a commissioned Trajectory Labs test where none of 720 injection attempts succeeded. Willison buys the design and not the verification — “I’d like to see more independent confirmation” — and names the untested vector: a malicious package whose instructions look like the job · source · T2 · simonwillison.net
• llms-cheese-your-types — Justin Le (in Code): how LLMs cheese Haskell’s type constraints (escape hatches, weakened planned types, sentinel/string-stuffing) and using types as scaffolds not gates to fight back; the source behind constraint-evading-behavior · source · T2 · blog.jle.im
• verification-loops-skills — Anthropic (Delba de Oliveira): turn manual post-implementation checks into Claude Code skills that self-verify & fix — a verification loop = “Claude checks and attempts to fix the work”; four activation patterns incl. gate-on-every-PR; the concrete inner-loop twin of agent-evals · source · T1 · claude.com
• ai-race-coach — Google GDE case study: real-time AI driving coach (Sonoma Raceway) on Antigravity (stateful telemetry orchestration) + ADK agents, split Gemma-4-local / Gemini-cloud; Antigravity’s runtime “domain-bridging engine” face + the spoke’s closest brush with embodied/edge agents · source · T3 · developers.googleblog.com
• cognition-fable5-through-the-night — Anthropic case study: Cognition/Devin runs 8h unattended (“through the night”) on Fable 5; “trust no eval” + the Frontier Code anti-slop benchmark (Fable5 ~30% vs Opus ~10%); the sharpest step on the Benchmarks gap + a model-as-unlock counter-current to structure>capability · source · T3 · claude.com
• adk-agents-with-skills — Google guide: building ADK agents with skills; the open skills spec · source · developers.googleblog.com
• adk-long-running-agents — Google guide: durable long-running ADK agents (pause/resume, state machines, persistent sessions) · source · developers.googleblog.com
• adk-go-2 — Google: ADK Go 2.0 — graph-based workflow engine, first-class durable HITL, unified runtime (“a graph is an agent”) · source · T3 · developers.googleblog.com
• governed-context-claude-code — TDS (Jake Minns): the fullest context-rot governance playbook for Claude Code — curate CLAUDE.md/skills/hooks, offload to subagents, externalize state, reset over recover (“session as a git tree”, disposable --fork-session branches) · source · T3 · towardsdatascience.com
• cca-f-lost-in-the-middle — Medium (Rick Hightower, CCA-F series): the API-level take on lost-in-the-middle — pinned facts + rolling history + reconstruct-state-every-turn, because the Messages API is stateless; context mgmt is a design problem not a config knob · source · T3 · medium.com
• writing-a-good-claude-md — HumanLayer: how to author CLAUDE.md — small+universal (<300 lines), progressive disclosure, never auto-generate; two mechanisms (Claude ignores non-universal instructions; ~150–200-instruction ceiling) · source · T3 · humanlayer.dev
• agent-anti-patterns — MLM (Bala Priya C): nine agent-building anti-patterns (multi-agent-too-soon, tool sprawl, no memory arch, ungoverned writes, context drift, no eval); maps ~1:1 onto the spoke’s threads — a failure-mode index + outside corroboration of the layer model · source · T3 · machinelearningmastery.com
• orchestrate-100-agents-claude-code — TDS (Eivind Kjosbakken): 100+ Claude Code agents in parallel via headless mode (claude -p) — hierarchical orchestrator, stateless one-shot sessions, task isolation + self-verification; the spoke’s largest-scale fan-out instance · source · T3 · towardsdatascience.com
• run-claude-code-agents-24-hours — TDS (Eivind Kjosbakken): operator how-to for one Claude Code agent unattended for 24h — sandbox+backup permissions, agent-authored done-conditions/self-verify, second-agent PR review, remote always-on; the duration axis (vs. orchestrate-100’s breadth), practitioner counterpart to cognition-fable5-through-the-night · source · T3 · towardsdatascience.com
• claude-code-channels-vs-openclaw — event-driven vs self-driven Claude agents; the deployment axis · source · aimaker.substack.com
• claude-apps-gateway — Anthropic+Google Cloud self-hosted governance gateway for Claude Code fleets (IdP identity, RBAC, spend caps, OTLP telemetry, routing to Vertex); the harness-vendor’s own runtime-governance layer + the enterprise answer to the SDK-billing tension · source · T3 · cloud.google.com
• tokenmining — TDS (Sam Black): the named cost/token discipline (inverse of “tokenmaxxing”) — routing (LLM gateway → cheaper/local model, ~60% cut) + context compaction; thesis “more tokens ≠ better” (context rot / lost-in-the-middle); the cost/quality face of the spoke’s structure-over-tokens thread · source · T3 · towardsdatascience.com
• claude-code-best-practices — practitioner lessons; BMAD vs plan mode, CLAUDE.md, model selection · source · ranthebuilder.cloud
• agents-never-do-alone — TDS: what agents shouldn’t do autonomously; reversibility matrix + AGENTS.md/blocked_commands.md/two-agent review · source · towardsdatascience.com
• langchain-custom-harness — LangChain: agent = model + harness; middleware as the composition unit; task-harness fit · source · langchain.com
• ant-cli — hands-on: Anthropic’s ant CLI deploys/manages Claude Managed Agents from the terminal (model provider → agent platform) · source · medium.com
• claude-skills-ppc — Claude Skills for PPC; skills × MCP = agency; system-designer framing · source · searchengineland.com
• spec-driven-ai-tools — comparison of BMAD / Spec-Kit / OpenSpec · source · src: spec-driven-ai-tools.md
• agents-that-build-agents-ms — Microsoft SKILL-first blueprint (Agent Framework + Foundry); Foundry adopts the agentskills.io spec (SKILL.md, MCP Resources/SEP-2640) · source · techcommunity.microsoft.com
• adk-a2a-cross-language — Google guide: cross-language multi-agent team over A2A (Python ADK orchestrator + Go validator as RemoteA2aAgent); the agent↔agent wire format demonstrated with running code · source · T1 · developers.googleblog.com
• openclaw-hermes-control-layer — TNS: OpenClaw (gateway-first/breadth) vs Hermes (memory-first/depth) — same harness anatomy, different control point; memory as the durable lock-in; vendors own the runtime layer beneath both · source · T2 · thenewstack.io

ScholarlyArticle (sources)

• swe-bench — Jimenez et al., ICLR 2024 (T1): 2,294 tasks from real issues + merged PRs across 12 Python repos, graded by the repo’s own tests. Best model at publication: 1.96% — the number that shows how much of the later progress was harness, not model · source · T1 · arxiv.org
• tau-bench — Yao et al., 2024 (T1): agent × simulated user × written domain policy (retail, airline), graded on final database state. Introduces pass^k — GPT-4o’s pass^8 in retail is under 25% — the reliability metric this spoke was arguing without · source · T1 · arxiv.org
• webarena — Zhou et al., CMU, 2023 (T1): self-hosted real web apps (e-commerce, forum, GitLab, CMS), functional-correctness grading. GPT-4 agent 14.41% vs humans 78.24% — acting in an environment nobody designed for an agent · source · T1 · arxiv.org
• self-evolving-agents-survey — arXiv survey: Self-Evolving AI Agents (foundation models → lifelong self-improvement) · source · T1 · arxiv.org
• confucius-code-agent — Wong et al., Meta + Harvard (arXiv 2512.10398, Dec 2025): a four-mechanism coding scaffold (context management, note-taking agent, extensions, meta-agent), 54.3% Resolve@1 on SWE-Bench-Pro. The corpus’s first per-mechanism ablation on a coding workload: context management +6.6 pp on Claude 4 Sonnet but +0.6 pp on Claude 4.5 Sonnet, tool sophistication +7.0 pp — the same mechanism worth ten times more on the weaker model. 100-example subset, no variance reported · source · T1 · arxiv.org
• hitchhikers-guide-agentic-ai — Haggai Roitman, arXiv 2606.24937 (cs.AI, rev. 2026-07-27): book-length practitioner reference across the whole stack — LLM substrate → RLHF/PPO/DPO/GRPO alignment → agentic RL, RAG, memory taxonomy, harness design, loop engineering (inference-time RL, generate-verify-retry, adaptive budget control), agent-pattern taxonomy, MCP/A2A/multi-agent topologies, evaluation and deployment. The corpus’s first already-assembled source: names as chapters what loop-engineering and agent-memory were derived from scattered tools · source · T1 · arxiv.org
• context-files-ablation-paper — Khatri, Do Context Files Help Coding Agents? (arXiv 2607.27250, 2026-07-28): controlled ablation of AGENTS.md injection across Claude Code + Codex, 17 PR-mined tasks, 288 gold-test runs. No correctness effect (≤10–15pp), near-misses fail on implementation skill not missing knowledge, and a 36-cell probe shows the real file never flips a near-miss to a pass. Process effects only: fewer cache tokens, fewer blind full-suite test runs · source · T1 · arxiv.org
• model-or-harness-taxonomy — Raj et al., Scale AI, arXiv 2607.28802 (2026-07-30): interaction-centric taxonomy of 41 agent failure modes, each assigned an edge between two components (owner/grader/third party · context/memory/tool/peer-subagent · local/external env) and a fault side saying where the repair belongs. 36 of 41 land model-side by construction. Validated with four frontier models as agent-judges (GPT-5.5 κ=0.76 vs human labels; judge-judge κ up to 0.84). Explicitly descriptive — no frequencies · source · T1 · arxiv.org
• ddr-bench — Liu et al., arXiv 2602.02039: proposes Deep Data Research + DDR-Bench, but filed here for its Section 5.2 ablations — reasoning budget, memory, and reactive-vs-proactive varied one at a time on a fixed model (Qwen3-Next-80B-A3B), the design harness-bench and scaffold-effects-gaia cannot supply. Table A1 now held: across 3 datasets × 3 models, only 2 of 27 mechanism additions beat plain ReAct (both +Plan on 10-K); memory never wins; multi-agent takes one cell from 16.67 to 4.44. The corpus’s most direct evidence that harness machinery can be negative-value · source · T1 · arxiv.org
• scaffold-effects-gaia — Starace, arXiv 2606.08529 (2026-06-07): the corpus’s first crossed model × scaffold design — 5 models (Opus 4.7 / Sonnet 4.6 / Haiku 4.5 / Gemini 3.1 Pro / GPT-5.5) × 3 scaffolds (ReAct, Planner-Actor-Rater, planner-executor) × 139 GAIA questions × 3 attempts, pre-registered, ~5,900 runs. Scaffold moves one model up to 23pp, but never across a capability tier (Haiku’s best < Sonnet’s worst); Sonnet+PAR does beat Opus+planner-executor. Best scaffold is model-specific — Opus tops L1 on plain ReAct. Closed growth edge #2 · source · T1 · arxiv.org
• claw-swe-bench — Zheng et al., arXiv 2606.12344 (2026-06-10): the coding-domain counterpart to scaffold-effects-gaia — 350 SWE-bench-class instances, 43 repos, 8 languages, with prompt/container/timeout/evaluator all fixed. 5 harnesses (openclaw, hermes-agent, zeroclaw, nanobot, generic) x 2 models, plus 9 models on OpenClaw. Harness spread 12.5pp (GLM 5.1) to 27.4pp (Qwen 3.6-flash) against a 29.4pp model spread — “harness choice is a first-order factor,” and it matters more the weaker the model. Two grids, not a full factorial; no frontier model in the harness sweep. Closed the coding half of growth edge #2 · source · T1 · arxiv.org

ScholarlyArticle (added)

• harness-bench — Yao et al., arXiv 2605.27922: the full crossed factorial — 8 model backends × 6 harnesses, 106 tasks, 5,194 trajectories, shared budgets and protocol. Harness gap 23.8 pp (NanoBot 76.2% → openclaw 52.4%), and the finding this spoke was waiting for: “stronger model backends… exhibit lower cross-harness variance.” Scaffolding substitutes for capability, at three points on the axis now — and has not reached zero · source · T1 · arxiv.org

Book (sources)

• second-son-house-of-bells — the shipped novel from the autonovel pipeline, bylined “Claude Hermes” (PDF/ePub/audiobook); the reader-facing artifact end of the loop thesis · source · T2 · nousresearch.com

SoftwareApplication

• virtual-biotech — Stanford‘s agent population organised as a drug company: tens of thousands of agents, CSO agent, pharma divisions, an “agent school” doing supervised fine-tuning; grew out of a 5–8-agent Virtual Lab that designed COVID nanobodies. Differentiated agents, not replicated ones — the claimed gain is debate between them · T3 · biorxiv.org
• paperclip — the context layer beneath it: unstructured papers plus scattered databases mapped into one AI-native virtual file system, so agents navigate with file operations instead of per-database APIs; the answer to “an MCP wrapper doesn’t fix a human-era interface”. Claimed order-of-magnitude time/cost cut, no benchmark · T3 · github.com/GXL-ai
• claude-code — Anthropic‘s terminal coding harness, and the hub node this spoke ran without for two months: named across 84 pages before it had one. Written from what the corpus’s own sources measured, not from product docs — including the three studies that found its structural layer moves how it works and not whether it succeeds
• devin — Cognition‘s autonomous AI software engineer; bets on long-horizon unattended autonomy (8h “through the night”), invariants-then-verify discipline; runs on Fable 5 · source
• adk — Google’s Agent Development Kit; loads skills via the open agentskills.io spec
• genkit — Google’s open-source framework for agentic full-stack apps: Agents API, pluggable session stores, HTTP-servable agents, JS/TS full-stack client, delegation middleware + HITL; the embeddable-library counterpart to adk‘s managed runtime (TS/Go/Dart/Python) · source · T1 · developers.googleblog.com
• google-antigravity — Google’s developer-facing agent IDE (“agent OS”); v2 split into a VS Code-style IDE + a separate chat-agent app; sub-agents, scheduled/remote background work, SDK/CLI, JSON hooks · source · T3 · geeky-gadgets.com
• claude-cowork — interactive plugin host for the FSI agents
• claude-agent-sdk — Anthropic’s official SDK: the Claude Code harness as a Python/TS library (tools, loop, hooks, subagents, MCP) · source
• claude-security-plugin — Anthropic’s beta Claude Code plugin: multi-agent vulnerability scanner (/claude-security), six-phase dynamic workflow, model-tiered subagents, 2-of-3 verifier quorum with a Python-computed tally (not model-asserted); a shipped agent-orchestration + verification reference (security = domain, agent machinery = substance) · source · T2 · marktechpost.com
• gemini-managed-agents-hooks — Google: Managed Agents in the Gemini Interactions API — the agent loop sold as one API call (sandbox, code exec, package install, web retrieval), now with environment hooks (pre/post_tool_execution, regex matchers, deny-with-reason fed back into context), max_total_tokens budget caps that pause-and-resume, cron triggers over a persistent sandbox, and free-tier access; the vendor layer’s fifth shape — dissolve the harness into the model API, then sell back the hook points · source · T3 · blog.google
• kimi-claw — Moonshot’s managed openclaw: one-click 24/7 hosted agent with Kimi K2.6 Thinking + preset skills, deployable to cloud, desktop or an idle Android phone; Claw Groups in preview. The vendor layer’s fourth shape — a model lab adding hosting and weights rather than containment; ships K2.6 not K3, and says nothing about skill security · source · T3 · kimi.com
• openclaw — gateway-first open agent harness (Steinberger → OpenAI-sponsored foundation; ClawHub skills marketplace; ~380k★); breadth across channels, governance added by NemoClaw/Scout; the foil to memory-first hermes-agent
• memory-vault — open-source MCP server: Postgres + pgvector persistent memory for Claude Code; externalizes context lost to auto-compaction; the lightweight pole of agent-memory vs seekdb · source · T3 · makeuseof.com
• recall — Claude Code plugin: offline durable memory as plain markdown files (history.md/context.md) via SessionStart/Stop hooks + deterministic TF-IDF/TextRank summaries (no DB/embeddings/LLM); the minimal local-first pole of agent-memory · source · T2 · github.com
• cloud-run-sandboxes — Google Cloud managed primitive to execute untrusted / AI-agent-generated code in an isolated in-instance sandbox (2nd-gen env, shares container CPU/mem, --sandbox-launcher); containment-as-substrate beneath the harness (vs nemoclaw/claude-apps-gateway control planes); server-side sibling of arrow-js‘s WASM sandbox · source · T2 · docs.cloud.google.com

WebAPI

• claude-managed-agents — headless /v1/agents deployment surface for the FSI agents
• a2a-protocol — A2A (Agent2Agent): cross-vendor agent↔agent interop standard (Agent Cards, tasks, JSON-RPC); Google→Linux Foundation; complements MCP (agent↔tool) · source
• pilot-protocol — “Network OS for agents”: own address space + registry instead of DNS, OSI-L5 UDP with NAT hole-punching for direct agent↔agent tunnels, discovery agent, curated app store, USDC/x402 payments as a network primitive; the substrate-replacing branch beside A2A’s layer-on-HTTP branch; VC-funded company running its own network, IETF draft; traction figures self-reported · source · T3 · pilotprotocol.network
• webmcp — a page hands its own functionality to an in-browser agent as tools (document.modelContext.registerTool, plus a declarative form synthesized from <form>); the agent→web page slot the interop stack lacked. Its problem statement is an argument against server-side MCP — “UI Disintermediation & Context Loss”, naming MCP and OpenAPI — made from inside the standards effort. Microsoft and Google co-authored it from the first commit, breaking this spoke’s one-vendor-ships-a-spec pattern; W3C WebML CG, Chrome 149 origin trial, no version, 108 open issues, no stated Apple or Mozilla position · source · T1 · standard

Organization

• veed — subscription video-editor company that published open-edit, the agent skill doing the same job without the editor; also supplies its default transcription and its closed renderer — the application-vendor shape on the vendor ladder

• stanford-university — the university behind james-zou‘s group, virtual-biotech and paperclip; also the campus the “agent school” is modelled on

• venturebeat — enterprise-AI outlet that both runs vb-transform and reports the talks given there; publisher of stanford-virtual-biotech-37000-agents

• merck — pharma company whose independent arrival at the same CD276 ADC design is the external evidence virtual-biotech‘s headline claim rests on; it said nothing itself in the source · thin node

• aeterna-labs — publisher of pullmd; AGPL-3.0 self-hosted extraction service, no other evidenced footprint

• alibaba — owner of the Qwen model line and of AMAP-ML, which publishes longhorizon-harness; second vendor after bytedance to ship both a model family and a harness on top of it

• microsoft — Microsoft Foundry (agent factory) + open-source Agent Framework SDK; third agent-platform vendor; adopts agentskills.io + MCP Resources; also microsoft-scout

• langchain — create_agent / Deep Agents; harness-from-middleware (the fourth agent-platform vendor)

• oceanbase — distributed-DB team (Alipay/Taobao) behind seekdb; the agent-infrastructure/state-store vendor stratum

• harness-io — software-delivery-lifecycle (CI/CD) vendor bringing pipeline governance to agents (harness-agent-dlc); homonym: the company, not agentic-coding-harness

• nolabs-ai — the Sigstore team behind nono; supply-chain-security provenance applied to agent containment (enforced sandboxes over advisory policy)

• signadot — Kubernetes-native ephemeral environments for runtime/behavioural verification; the loop-verification substrate (platform-ops seam)

• nous-research — AI lab behind the Hermes line; owner/developer of hermes-agent + hermes-profile-builder (open-source, model-agnostic, self-driven pole)

• zo-computer — the platform zouroboros is built natively on; thin node (host platform), evidence-only

• ars-technica — NewsMediaOrganization; publisher of anthropic-agent-sdk-billing-pause; canonical tech-news publisher node

• bytedance — big-tech vendor behind the deer-flow SuperAgent harness (built on LangChain/LangGraph); the harness-vendor stratum’s big-tech entrant

• nvidia — vendor behind nemoclaw (OpenShell agent-governance layer); plays the agent-agnostic runtime-governance angle rather than shipping its own harness

• tigerless-labs — GitHub org publishing autoharness; thin node (evidence = the repo)

• wassenger — WhatsApp API / messaging-automation platform; owner/maintainer of whatsapp-chatgpt-bot; the channel/gateway-vendor stratum · thin node

• evomap — curator of awesome-agent-evolution (evomap.ai); publishes the list + a visual field taxonomy · thin node

• cognition — AI company behind devin; long-horizon-autonomy bet + “trust no eval” / Frontier Code benchmark culture; a named Anthropic frontier-agent customer

• foundation-agents — MetaGPT-community GitHub org behind openmanus + OpenManus-RL; the community-org stratum of the vendor map (no company domain, reach without maintenance capacity)

• browser-use — org behind the browser-use agent framework (unsourced here) and video-use; a browser team whose second product is a video editor, joined by method not domain · thin node

• droidrun — GitHub org behind mobilerun (name predates the rename); open framework + Mobilerun Cloud hosted device fleet; publishes the AndroidWorld leaderboard the 91.4% comes from · thin node

• humanlayer — agent-engineering company (the 12-factor-agents framework); publisher of writing-a-good-claude-md; the never-auto-generate side of the CLAUDE.md question · source

• scale-ai — data-and-evaluation company; sourceOrganization of model-or-harness-taxonomy; the failure-taxonomy/eval-methodology stratum · thin node

• kalyan-ks — maintainer of llm-engineer-toolkit; no affiliation, no credential, no inclusion criteria on a 150-entry list with 10.7k stars — paged on the astrosp rationale, that the curator’s invisibility is a claim the page rests on · thin node

• turing-post — the newsletter behind turingpost-13-frameworks; thin node, and its unstated inclusion rule is why that census’s omissions can’t be read · thin node

Person

• james-zou — Stanford biomedical data science; built the Virtual Lab and virtual-biotech, and argues the environments-not-workflows position
• ben-dickson — VentureBeat AI-engineering writer (TechTalks); author of stanford-virtual-biotech-37000-agents · thin node
• jason-starace — sole author of scaffold-effects-gaia, the crossed model × scaffold GAIA comparison that closed the spoke’s #1 edge · thin node
• arjun-iyer — CEO of signadot; author of agent-loops-verification (loops replace prompts; verification as the new bottleneck)
• adem-kouki — author of md-this-page (GitHub Ademking) · thin node
• trevor-stuart — SVP/GM at harness-io; the “make the pipeline predictable, not the agent” voice (harness-agent-dlc) · thin node
• boris-cherny — Head of Claude Code at Anthropic; the named voice on the claude-agent-sdk subscription-vs-API cost structure (anthropic-agent-sdk-billing-pause)
• mahipal-jangra — @mukul975; author of the cybersecurity-skills 817-skill agentskills.io pack
• gareth-manning — educator; author of the education-agent-skills 165-skill pedagogy pack (20 yrs international schools, self-reported)
• sickn33 — maintainer of agentic-awesome-skills + the @AASkills_ account; no stated authorship policy for the 2,003 catalog skills · thin node
• dan-kornas — X commentator/newsletter author; the promotional thread through which vibe-tools arrived — a distribution channel, not an authority · thin node
• jesse-vincent — obra; creator of superpowers, the agent-skills framework + dev methodology
• 1jehuang — GitHub handle behind jcode; no biography evidenced; builds its dependencies (own terminal, own mermaid renderer) · thin node
• peter-steinberger — creator of openclaw (→ OpenAI); author of agent-scripts; the skills-as-portable-infrastructure through-line
• parth-sangani — Avyayalaya; author of pm-skills-arsenal (12 deep, typed-schema PM skills)
• emmimal-p-alexander — author of safe-prompt-pruning (TDS); the deterministic context-pruning lever · thin node
• silas-alberti — SVP Research at cognition; the named voice on “trust no eval” + horizon-as-the-capability (cognition-fable5-through-the-night) · thin node
• jake-minns — TDS author of governed-context-claude-code; the “session as a git tree” context-governance workflow · thin node
• rick-hightower — Anthropic Claude Certified Architect; CCA-F series author of cca-f-lost-in-the-middle (API-level context management) · thin node
• oil-oil — GitHub author of beautify-github-readme (README-redesign agent skill) · thin node
• cathryn-lavery — BestSelf.co founder; author of diagram-design (brand-styled editorial diagrams as a skill) · thin node
• justin-le — Haskell writer (blog.jle.im); author of llms-cheese-your-types (types-as-scaffold-for-agents) · thin node
• bala-priya-c — Machine Learning Mastery writer; author of agent-anti-patterns · thin node
• eivind-kjosbakken — TDS author of orchestrate-100-agents-claude-code (headless-mode fan-out at scale) · thin node
• kyle-0xblacklight — HumanLayer engineer; author of writing-a-good-claude-md (small+universal CLAUDE.md, the instruction-ceiling argument) · thin node
• tj-boudreaux — author of cc-thinking-skills; built the eval harness that returned a null result on his own skill pack, and published it · thin node
• zheyuan-kong — MaxMiksa; creator of auto-company (unbounded persona-company loop, consensus.md as sole memory) · thin node

Event

• vb-transform — VentureBeat’s enterprise-AI conference (Menlo Park); the 2026 edition is where james-zou presented virtual-biotech · thin node

Synthesis

• synthesis — the evolving thesis: skills → harness → orchestration/deployment

Bridge nodes (live in sibling wikis, linked cross-wiki)

gbrain · agent-skills · compound-engineering · model-context-protocol · anthropic · claude-opus-4-8 · claude-fable-5 · garry-tan (research-wiki) · google (llm-providers-wiki — canonical Google node; agent-platform-vendor facet noted there) · simon-willison (llm-providers-wiki — canonical node; the coding-agent-security facet is used here) · xai-grok (llm-providers-wiki — canonical xAI/Grok node; the coding-harness grok-build is its agent-tooling face)