Executive summary

AI engineering trends

As of 2026-08-30, agentic engineering is still a harness problem: closed-loop working views, trace-driven AOT (ahead-of-time) evolution, explicit loop state, and an external-verifiability gap. Measured harness changes move the needle more than model swaps alone — Same Model, Different Harness lifts tight-window SWE-bench F2PF (fail-to-pass fraction) from 28% to 49%. Details live in Bottom line and the priority cards.

As of 2026-08-30 · Updated daily at 07:25 Europe/Vienna · Product owners and leads of AI / agentic engineering teams in large software firms — engineering SotA first; economic enablement as the firm-level implication of how the team builds

Bottom line

What matters this cycle.

Engineering posture first; economic enablement only where practice changes cost, leverage, or where the firm should bet.

01
The harness is the solver. Same Model, Different Harness rebuilds a smaller working view under a tight window: F2PF 28% → 49%, complete solutions 43 → 72. AutoSaddler adds durable AOT patches from failure traces (+9.0 GAIA2, +9.6 SWE-Bench Pro, +10.0 Terminal-Bench 2.0). Complementary: StarHarness 20–35pp from 4–12 AOT edits; HarnessLens 7.6–13.6% held-out; JIT-Agent (just-in-time harness synthesis) +9.1 DeepSearchQA for DeepSeek-V4-Flash vs GPT-5.6. Unconstrained self-rewriting still fails the audit test.
02
Architectures converge on a five-element middle form; the missing axes are external verifiability and obligation authority. No shipped harness offers a tamper-evident record an outsider can check without trusting the runtime. MAGE frames the scarcity: coding agents make implementation abundant, so the scarce work is choosing abstractions, producing evidence, and binding obligations to gates.
03
The vendor CLI is a protocol-current, trace-correlated permission surface. Full Copilot CLI 1.0.81/1.0.82 detail sits in the CLI/MCP card; elsewhere treat it as the GA reference for MCP 2026-07-28, default permission modes, OTel hook correlation, session restore, and headless plugin agents. Agent Plugins census (2026-08-29): 1,618 packages.

Operating shifts

How the work is changing.

Old default → current SotA posture (with firm-level implications where they change).

From	To	Implication
Prompt engineering as the core skill; one durable harness optimized ahead of time	Harness + context engineering, with a closed-loop working view, AOT evolution for stable domains, JIT synthesis when instance structure varies, and behavior-aware verification of every accepted edit	Agent = Model + Harness. Mechanical working-view rules change what unchanged weights accomplish. Production CLIs stay AOT; treat JIT (just-in-time harness synthesis) as an eval/search loop with a frozen policy surface.
Picking MCP or CLI as a platform-wide strategy	Measure the scaffolding; pick the interface per integration (CLI for local/known tools, MCP for governed/remote/multi-tenant); expect progressive discovery and default permission modes	Interface cost is second-order. CLI-only harnesses were 5–28× cheaper even on CLI-only runs (Aug 9 study). Progressive discovery and real agent identity still define enterprise MCP readiness.
Per-client skill and MCP packaging; scan-only skill gates	Agent Plugins 1.0 plus live Skill Lift, committed repo config, and allowlisted (optionally auto-updated) marketplaces	One plugin.json + skills/ + mcp.json travels across clients. Census 1,618 (Aug 29). ACES: scan-only gates do not predict live Skill Lift. Auto-update stays behind marketplace allowlists.
Prompts, model safeguards, and harness allowlists as the security story	Authoritative policy in the runtime: sandbox, least privilege, JIT credentials, emergency shutdown, provenance for page-exposed tools, induction vs execution authorization, and Propose-Verify-Act-Verify containment	A control the agent can decline to invoke is not a control. NCSC, NVIDIA, SARA, PES, and containment architectures put isolation below the agent boundary. Tool output that names an action is evidence, not a permit.
Single-session harness evals, append-only transcripts, and end-state scores	Loop engineering: triggered runs, machine-checkable stops, explicit execution state, durable loop state, closed-loop working view, and symptom-driven replay instead of whole-run resample	Long-horizon work fails as a state machine. SKILLSTATE keeps prompt size O(1). Unguided MAS (multi-agent system) reruns repair 6.90%; symptom-driven intervention reaches 20.15%. Session restore is continuity of a process, not a Continuity Kernel.

Priority implications

Where to put attention.

7 priorities (max 7). Collapsed claim is the scannable layer; expand a card for evidence detail, Watch for, and Key practices. Full Layer 1+2 read target: under 5 minutes.

Harness + closed-loop working view

Agentic eng

Holding model and tools fixed, a mechanical working-view rule lifts tight-window SWE-bench F2PF (fail-to-pass fraction) from 28% to 49%. Treat the model–harness pair as the solver; evolve AOT (ahead-of-time) harnesses under behavior-aware verification — not unconstrained self-rewrite.

Evidence & practices

Practice still treats Agent = Model + Harness, and now treats the working view and the AOT optimizer as part of the solver. Same Model, Different Harness (arXiv 2608.26218, 2026-08-26) holds model, tasks, tools, and window fixed and changes only harness configuration: control is a growing chronological transcript that stops when the window fills; treatment keeps the same in-memory record but mechanically shortens older tool results (half-life caps after 50% fill, newest four results full), detects stalls, and applies command safeguards. Tight-window SWE-bench Verified (169 tasks, 20,480 tokens, 480s): mean F2PF 28% → 49%, complete solutions 43 → 72; the frozen treatment also raises both endpoints on three additional models. Complementary AOT: StarHarness (arXiv 2608.24804, 2026-08-25) gained 20–35 percentage points after 4–12 accepted changes, with transfer across GPT and Qwen; AutoSaddler (arXiv 2608.23041, 2026-08-24) learns durable harness patches from failure traces with validation-based selection: +9.0 GAIA2, +9.6 SWE-Bench Pro, +10.0 Terminal-Bench 2.0. Complementary JIT (just-in-time): JIT-Agent (arXiv 2608.25593, 2026-08-26) trains a 27B generator; DeepSeek-V4-Flash under those harnesses surpasses GPT-5.6 on DeepSearchQA (+9.1). HarnessLens (arXiv 2608.27311, 2026-08-27) improves average held-out performance 7.6–13.6% at lower eval budget than score-everything baselines. Architectural convergence (arXiv 2608.23953, Aug 25) finds three opposing open harnesses meeting on a five-element middle form. Decoding AI (2026-08-25) documents production microcompaction at ~60% of the window and full compaction at ~80%. Copilot harness is GA in JetBrains (2026-08-24). Production CLIs stay AOT; treat JIT as an eval/search loop with a frozen policy surface.

Why it matters A weak harness makes frontier models expensive and unreliable; a strong one lets cheaper or open models close the gap. Scoring every harness candidate on a fixed suite hides regressions; feeding the full transcript under a tight window wastes the next search, edit, or test. Neither AOT, JIT, nor a closed-loop view licenses unconstrained self-modifying production harnesses.

Economic lever Measured AOT harness evolution, a closed-loop working view, bounded JIT synthesis, and behavior-aware verification compress $/task versus model upgrades; an ungoverned self-rewriting harness turns seat spend into high-variance token burn and unauditable regressions.

Watch for Whether vendor CLIs expose a closed-loop working view and a harness-evolution loop with attributable verification, whether JIT generators ship as eval helpers rather than production self-rewrites, and whether the five-element middle form becomes the default open-harness shape.

Key practices

Treat the vendor CLI as a starter harness, then add org-specific verification, audit, deny rules, and a working-view policy
Compare harnesses on the same task and model before attributing gains to the model; score the model–harness pair as the solver
Keep a complete run record but do not feed the full transcript as the working view once the window is under pressure
Budget harness-optimization evals; stratify by failure mode (StarHarness) or verify only on behavior-relevant tasks (HarnessLens)
If you trial JIT harness generation, freeze a protocol surface and keep generator output behind the same sandbox, allowlist, and eval gate as human harness diffs

Evidence

[preprint] Same Model, Different Harness (arXiv:2608.26218) — 2026-08-26. Tight-window SWE-bench Verified: F2PF 28%→49%, complete solutions 43→72; frozen treatment transfers across models.
[preprint] AutoSaddler (arXiv:2608.23041) — 2026-08-24. Trace-driven AOT patches with validation selection: +9.0 GAIA2, +9.6 SWE-Bench Pro, +10.0 Terminal-Bench 2.0.
[preprint] StarHarness (arXiv:2608.24804) — 2026-08-25. 20–35pp after 4–12 accepted AOT changes; transfer across GPT and Qwen.
[preprint] HarnessLens (arXiv:2608.27311) — 2026-08-27. Behavior-aware verification: 7.6–13.6% held-out gain at lower eval budget.
[preprint] JIT-Agent (arXiv:2608.25593) — 2026-08-26. DeepSeek-V4-Flash under JIT harnesses beats GPT-5.6 on DeepSearchQA (+9.1).
[preprint] Architectural convergence in three LLM agent harnesses (arXiv:2608.23953) — 2026-08-25. Five-element middle form; external verifiability still missing across deepagents, pi, dsh.
[vendor] Context engineering for coding agents (Decoding AI) — 2026-08-25. Microcompaction ~60% window; full compaction ~80%; progressive skill disclosure.

Loop state and continuity

Agentic eng

Long-horizon work fails as a state machine. SKILLSTATE cuts tokens 16.2× at T=100 versus append-only history while raising InterCode CTF pass@1 43.2%→54.2%. Prefer explicit execution state, durable loop state, and symptom-driven replay over whole-run resample.

Evidence & practices

Infrastructure is shifting from harness engineering toward loop engineering and execution-state design. SKILLSTATE (arXiv 2608.26263, 2026-08-26) replaces append-only history with explicit mutable execution state: each step receives only the immutable skill spec, current structured state, and latest observation; intermediate reasoning is discarded after a validated state update. Prompt footprint stays O(1); at T=100 a stateful baseline consumes 1,062,387 tokens versus 65,408 (16.2×); InterCode CTF pass@1 is 54.2% versus 43.2% ReAct; at T=200 it holds 0.94 accuracy on ~122k tokens while a memory-summary baseline inflates to 6.1M. A 2026-08-22 mining study (arXiv 2608.21884) scanned 36,710 repositories, matched 256, and confirmed 217 autonomous loops — they commit loop config and almost never commit the state files discourse requires. LoopsBench still caps the strongest config at 25.00%. Repair or Resample (arXiv 2608.25920, Aug 26): unguided whole-run MAS resample repairs 6.90%; symptom-driven replay from a recorded anchor repairs 20.15%. Continuity Kernel work (arXiv 2608.11632, Aug 12) argues storage retention is not authoritative state: untrusted components propose typed changes; only Commit advances the branch head. Always-On Agents survey remains definitional: literature heavy on accumulate/retrieve, light on govern/recover/forget. Vendor process continuity (session restore, queued steering) is a start, not a kernel — full Copilot CLI restore detail is in the CLI/MCP card; Cursor (Aug 27) queues steering until the next tool call. MCP Tasks (SEP-2663) is the protocol-level counterpart.

Why it matters Single-shot harness evals hide the production failure mode: agents lose the prerequisite graph, declare victory, and regress finished work. Append-only transcripts grow quadratic. Adoption without durable, inspectable loop state means you cannot replay, audit, or recover a multi-hour run. Session restore without explicit state is continuity of a black box.

Economic lever Loop design and explicit execution state determine whether long-horizon spend produces merged, still-green work or unauditable rework; uncommitted loop state and whole-run resample burn budget without recovery.

Watch for Whether vendor CLIs ship outer-loop + regression + explicit state + closed-loop view as default, whether MCP Tasks leave the extension lane into the core spec, and whether LoopsBench-class evals replace end-state scores for internal harness selection.

Key practices

Decompose long work into DAG units with independently runnable tests before handing it to an agent
Keep completed units as regression obligations; do not drop prior tests when the frontier moves
Prefer an explicit, schema'd execution state over appending traces; discard intermediate reasoning after a validated state update
Debug failed multi-agent runs by replaying from a recorded anchor, not by rerunning the whole graph
Treat state mutation as an authorized transaction with reject/quarantine/defer; test recovery paths in harness evals

Evidence

[preprint] SKILLSTATE (arXiv:2608.26263) — 2026-08-26. O(1) prompt via explicit state; 16.2× token cut at T=100; InterCode CTF 54.2% vs 43.2% ReAct.
[preprint] Loop Engineering: Building Blocks, Adoption, and Impact (arXiv:2608.21884) — 2026-08-22. 217 confirmed OSS loops; config committed, state files almost never versioned.
[preprint] Repair or Resample? (arXiv:2608.25920) — 2026-08-26. Unguided MAS rerun repair 6.90%; symptom-driven anchor replay 20.15%.
[preprint] Beyond Memory: Continuity Kernel (arXiv:2608.11632) — 2026-08-12. Storage retention is not authoritative state; transactional Commit for branch head.
[preprint] Always-On Agents survey (arXiv:2606.30306) — Definitional survey: heavy on accumulate/retrieve; light on govern/recover/forget.
[vendor] Effective harnesses for long-running agents (Anthropic) — Practitioner pattern for multi-hour agent continuity.
[preprint] Same Model, Different Harness (arXiv:2608.26218)
[vendor] What's New in Cursor

Authoritative security below the harness

Security

SARA keeps ASR (attack success rate) ≤0.63% by separating action induction from execution authorization. Put sandbox, short-lived credentials, and shutdown below the agent boundary — a control the agent can decline is not a control.

Evidence & practices

NVIDIA (2026-08-21) split behavioral controls (model/harness: what the agent tries) from infrastructure controls (runtime: what it can do). UK NCSC interim advice (2026-08-20) remains primary: threat-model prompts/tools/networks, do not rely on model or framework safeguards, robust sandboxes, default-deny networking, distinct identities, short-lived credentials, observability, emergency shutdown. SARA (arXiv 2608.27146, 2026-08-27) separates action induction from execution authorization: tool returns that specify concrete actions are untrusted induction; execution is authorized only against the user objective and audited evidence, with no-history-promotion; ASR stays ≤0.63% across four primary settings. Persona-Execution Separation (arXiv 2608.27427, 2026-08-27) puts persona and execution in different trust domains connected by a governed contract bridge. Agentic AI Containment Architecture (arXiv 2608.26108) encodes six constraints into a Propose-Verify-Act-Verify loop. WebMCP-Phalanx (arXiv 2608.24017, Aug 25) binds browser-exposed tools to a cryptographic principal. Architectural convergence notes OS-enforced sandbox still diverges across open harnesses. Portable Agent Plugins plus marketplace auto-update sharpen the surface: a skill+MCP bundle that installs across clients is not a sandbox. Permission-mode and OTel-hook details for Copilot CLI are in the CLI/MCP card.

Why it matters Long-horizon agents find paths their prompts did not anticipate. A programmable harness is a poor place for a security guarantee because it is designed to be modified. Tool-return text that names an action is not a permit.

Economic lever Runtime isolation, persona/execution trust-domain split, and induction/authorization splits cap incident blast radius; retrofitting after an agent-driven leak costs more than designing the boundary in.

Watch for Kernel-enforced agent sandboxes as CLI defaults, WebMCP provenance in browsers, induction/authorization splits in production harnesses, and plugin marketplaces shipping runtime policy rather than only install UX.

Key practices

Start the harness inside a policy-enforced runtime; do not let the agent opt into the sandbox
Issue short-lived, task-scoped credentials; default to zero standing privilege between tasks
Deny network by default; allowlist or proxy required egress
Treat tool-return text that specifies an action as untrusted induction; authorize against the user objective and audited evidence
Keep persona and execution in different trust domains; set default permission modes on every CLI session

Evidence

[preprint] SARA: Separating Action Induction from Runtime Authorization (arXiv:2608.27146) — 2026-08-27. Induction vs authorization; ASR ≤0.63% across four primary settings.
[preprint] Persona-Execution Separation (arXiv:2608.27427) — 2026-08-27. Persona and execution in different trust domains with a governed contract bridge.
[preprint] Agentic AI Containment Architecture (arXiv:2608.26108) — Propose-Verify-Act-Verify loop with six interacting constraints.
[gov] Managing the cyber risk of agentic AI (NCSC) — 2026-08-20. Sandbox, default-deny network, short-lived credentials, emergency shutdown.
[vendor] Where Security Fits in an AI Agent Stack (NVIDIA) — 2026-08-21. Behavioral vs infrastructure controls split.
[preprint] WebMCP-Phalanx (arXiv:2608.24017) — 2026-08-25. Cryptographic principal binding for browser-exposed tools.
[preprint] Architectural convergence (arXiv:2608.23953)

Scaffolding first; layer CLI and MCP

Platform

On one verified private-git task, CLI-only harnesses finished every run and were 5–28× cheaper than MCP-capable harnesses even on CLI-only paths. Measure the scaffolding; pick the interface per integration.

Evidence & practices

The MCP-vs-CLI cost debate remains second-order. arXiv 2608.08654 (2026-08-09) ran one verified private-git task across seven scaffoldings and five models: CLI-only harnesses finished every run and were 5–28× cheaper than MCP-capable harnesses even when those ran CLI-only; a local 27B varied 139× by scaffolding; thirteen paired MCP/CLI ratios spanned 0.43×–29×. Failures were equally common, but 12.9% of MCP spend vs 2.2% of CLI spend bought no completed work. Official MCP roadmap (2026-08-22) names agentic messaging (Tasks, subscriptions, mid-flight steering), HTTP-native transport unification, agent identity (DPoP, WIF, ID-JAG), a single tool-result contract plus progressive discovery, and SDK conformance. Copilot CLI 1.0.81 (2026-08-27) is the primary vendor release treatment this cycle: ships MCP 2026-07-28 to CLI, SDK, IDE, and in-memory clients; starts every session with defaultMode and defaultPermissionMode; adds first-class /plugin /mcp /skills management; restores interrupted sessions (including mid-turn); correlates hooks with OTel traceparent/tracestate; keeps plugin-contributed agents/skills/MCP in headless -p runs. 1.0.82 (Aug 29) is worktree and auth polish. Practitioner hybrid: CLI for local/known tools, MCP for remote, multi-tenant, OAuth, and audit. Portable plugins that ship MCP configs (see Agent Plugins card) make governed MCP easier to distribute, not cheaper in the inner loop.

Why it matters A platform-wide 'MCP everywhere' or 'CLI only' decision misallocates tokens and governance. Progressive discovery, real agent identity, and default permission modes make MCP viable at enterprise catalog scale — they are not present just because a server speaks the protocol.

Economic lever Picking the cheaper interface on a wasteful harness still leaves 5–28× on the table; hybrid layering plus failure-cost telemetry cuts token spend without dropping enterprise auth where required.

Watch for MCP Tasks moving from extension to spec, DPoP/WIF landing in SDKs, and whether portable plugins change who installs MCP — not whether inner-loop CLI stays cheaper.

Key practices

Default CLI for git, docker, kubectl, gh, build, and test; do not wrap those in MCP
Use MCP for SaaS/internal APIs with no training prior, per-user identity, or mandatory audit
Never expose both MCP and CLI for the same operation without an explicit preference
Verify which interface the agent actually called; do not trust the configured mode
Set defaultMode and default permission modes on every new CLI session; prefer progressive discovery and short-lived proof-of-possession credentials

Evidence

[study] The Scaffolding Matters More Than the Interface (arXiv:2608.08654) — 2026-08-09. CLI-only 5–28× cheaper; 12.9% MCP spend vs 2.2% CLI spend bought no completed work.
[vendor] The New MCP Roadmap — 2026-08-22. Tasks, identity (DPoP/WIF), progressive discovery, transport unification.
[vendor] GitHub Copilot CLI changelog (1.0.81/1.0.82) — 1.0.81 (2026-08-27): MCP 2026-07-28 everywhere, defaultMode/defaultPermissionMode, OTel hooks, session restore, headless plugins. 1.0.82 (Aug 29): worktree/auth polish.
[study] MCP vs CLI: Decision Guide — Practitioner hybrid: CLI local/known; MCP governed/remote.

Agent Plugins 1.0: portable skills + MCP

Platform

Census (2026-08-29): 1,618 distinct plugins (8,712 skills, 775 MCP servers). One portable package cuts per-client duplication — only with marketplace allowlists, pins, and runtime policy.

Evidence & practices

Agent Plugins 1.0.0 shipped 2026-08-06 as a vendor-neutral package format: plugin.json, skills/, optional mcp.json, namespaced client dirs. TSC maintainers include AWS, Cursor, Microsoft, OpenAI, Vercel; Google joined as core maintainer the same day. Launch clients: ChatGPT/Codex, Cursor, GitHub Copilot, Kiro, VS Code. GitHub GA'd the spec in VS Code, Copilot CLI, SDK, and app on 2026-08-12 with enterprise managed-settings (enabledPlugins, extraKnownMarketplaces, strictKnownMarketplaces) and MCP allowlists. 2026-08-29 census: 2,866 conformant manifests from 984 repos, 1,618 distinct plugins (8,712 skills, 775 MCP servers), up from 1,511 on Aug 27. Copilot CLI plugin surface (Update action, headless plugin agents) is covered in the CLI/MCP card — reference only here. On 2026-08-26 GitHub added autoUpdate: true on extraKnownMarketplaces. Copilot app Customize tab GA (2026-08-25); JetBrains (Aug 24/28) applies enterprise controls for plugins, MCP, telemetry, and permission modes. Spec stays deliberately small: discovery of Skills and MCP; installation, distribution, and policy remain client-owned.

Why it matters Teams were maintaining a separate manifest per client. Portability plus auto-update means a poisoned or over-privileged plugin can travel and refresh itself. A 1,618-plugin catalog without matching runtime policy is a supply-chain surface.

Economic lever A single plugin catalog cuts per-client packaging cost; unmanaged or auto-updating marketplaces convert that savings into wider blast radius and incident spend.

Watch for Whether hooks/sub-agents join the portable contract, Anthropic remaining outside the TSC, enterprise private marketplaces as default install path, and autoUpdate without a review gate.

Key practices

Adopt Agent Plugins 1.0 for org skills and MCP that must run in more than one client
Put client-only commands/hooks/agents under namespaced directories; do not leak them into the portable core
Govern with enabledPlugins / marketplace allowlists and pair every MCP-bearing plugin with a server allowlist
Treat autoUpdate as opt-in on private marketplaces you control; do not auto-update unreviewed public catalogs
Treat plugin install and update as a supply-chain event: pin versions, review SKILL.md + mcp.json, revoke as a unit

Evidence

[study] Agent Plugins Directory census (verified 2026-08-29) — 1,618 distinct plugins; 8,712 skills; 775 MCP servers (up from 1,511 plugins on Aug 27).
[vendor] Agent Plugins 1.0 in VS Code, Copilot CLI, and the Copilot app — 2026-08-12 GA + enterprise managed-settings and MCP allowlists.
[vendor] Enterprise-managed settings: autoUpdate for plugin marketplaces — 2026-08-26. autoUpdate: true on extraKnownMarketplaces.
[vendor] GitHub Copilot app Customize tab GA — 2026-08-25. One-click install UX is not an allowlist.
[vendor] GitHub Copilot CLI changelog (1.0.81/1.0.82)

Committed config, Skill Lift, verifiability-first

Practice

RAMP: agents raise commit volume 28–38%, but repos without committed AI config show ~2× the cognitive-complexity hit. Gate skills on live Skill Lift (ACES mean 0.2134); scope automation to machine-checkable outputs and outsider-checkable evidence.

Evidence & practices

RAMP (arXiv 2608.25241, 2026-08-26) scores 441 repositories on a four-level cumulative maturity model of version-controlled AI configuration. Independent annotation reproduces labels on 97% of a held-out sample. Adoption is set-and-forget: 73.8% of artifacts are committed once and never modified. Agents raise commit volume 28–38% in every stratum, but among agent-first repos those without committed AI configuration show roughly twice the increase in cognitive complexity (+53% vs +27%) and 1.7× the increase in static-analysis warnings (observational). WikiSkill (arXiv 2608.27454, 2026-08-27) co-evolves executable skills with a persistent wiki compiled from traces; smaller models with skills can outperform larger models without them. ACES (arXiv 2608.20614) reports mean composite Skill Lift 0.2134 on 947 paired cases (positive in 72.8%); scan-only gates correlate with LLM-judge scores at Spearman ρ = 0.14. SKILLSTATE execution pattern is primary in the loop-state card. Verifiability: production stacks put fitness functions, tests, schema/oracle checks inside the harness. HarnessLens attributable-evidence gate is primary in the harness card. Architectural convergence finds external verifiability missing. Cost-Utility Alignment (arXiv 2608.26195, Aug 25) organizes contribution methods by evidential strength. Calibrated Enough to Know (arXiv 2608.27167, Aug 27): professional-looking fabricated evidence lifts commitment from 6.5% to 54.0% on unknowable questions while stated probabilities barely move. MAGE (arXiv 2608.25174, 2026-08-25): implementation is abundant; scarce work is abstractions, evidence, and obligation authority through constraints, sensors, validators, and gates. SCAE still warns that process evaluation often mixes action prediction, task uncertainty, and causal step attribution.

Why it matters Context files are first-class with a failure mode: too much always-on text crowds the task. Skills that only pass a schema scan can still fail live. Oracles turn the agent into a component with a contract; a polished dashboard is not evidence. If obligations are not externalized as gates, review reconstructs them on every change.

Economic lever Human-curated AGENTS.md plus skills with positive Skill Lift and high-verifiability scopes cut wasted tokens and senior review hours; bloated or unevaluated files and unverifiable pilots consume the expensive people.

Watch for RAMP-style maturity as an internal dashboard, Skill Lift as a CI gate, replay-based causal step attribution replacing transcript judges, and any vendor CLI shipping a tamper-evident outsider-checkable record.

Key practices

Keep repo AGENTS.md short; point to docs/ and fail CI on stale links; commit AI configuration instead of leaving it in local client settings
Gate skill and plugin promotion on paired live trials (with vs without), not on markdown lint or schema scans
Scope delegated work to outputs a test, compiler, linter, LSP, or schema can reject; fail fast on intermediate oracles
Keep deterministic checks beside any LLM-as-judge; do not treat full-trace judges as causal step attribution
Treat external verifiability as a harness requirement for provenance-sensitive work; refuse act gates on the unknowable

Evidence

[preprint] RAMP: Committed AI Configuration (arXiv:2608.25241) — 2026-08-26. 441 repos; 28–38% commit volume lift; ~2× complexity hit without committed AI config.
[preprint] ACES: Evaluating Skills, Not Just Agents (arXiv:2608.20614) — Mean Skill Lift 0.2134 on 947 pairs (72.8% positive); scan-only ρ=0.14 with LLM-judge.
[preprint] WikiSkill (arXiv:2608.27454) — 2026-08-27. Skills co-evolve with a persistent wiki; cross-model transfer.
[preprint] MAGE (arXiv:2608.25174) — 2026-08-25. Representation and obligation authority as the scarce work.
[preprint] Calibrated Enough to Know (arXiv:2608.27167) — 2026-08-27. Fabricated packaging lifts commitment 6.5%→54.0% on unknowable questions.
[preprint] Cost-Utility Alignment (arXiv:2608.26195) — 2026-08-25. Dual ledger of resource consumption vs task contribution.
[preprint] SKILLSTATE (arXiv:2608.26263)
[preprint] HarnessLens (arXiv:2608.27311)
[preprint] Architectural convergence (arXiv:2608.23953)

Review ops, traces, and the engineer role

Ops

Span (103 teams): +1 quality-stewardship point → 39% fewer review cycles per 1,000 merged AI lines. Stack PRs, OTel GenAI traces, and agentic first-pass review; senior time goes to architecture, oracles, and harness ownership.

Evidence & practices

GitHub stacked PRs remain in public preview (2026-07-30) with gh-stack, stack maps, partial merges, and an agent skill — teach agents to decompose giant changes into reviewable layers. Copilot code review (2026-08-27) gives Copilot cloud-agent PRs a full agentic review, can review auto-requested bot-authored PRs when org policy allows, and drops the 300-file / 20,000-LOC size cap; resolution reasons close the feedback loop. From no earlier than 2026-09-28, default review effort moves Lite→Balanced and Copilot cloud/web/mobile unify to one policy enabled by default. Layered supervision (arXiv 2608.26316, 2026-08-26) distributes work across preventive, executable, and human layers that shift toward architectural reasoning. Visual Studio (2026-08-28) adds a Git agent that reviews uncommitted changes before a PR; org owners can publish custom agents across repositories. Span (103 teams, May–Jul 2026): +1 prompt-clarity → 27.2% lower cost per merged AI line; +1 environment-readiness → 88% higher turn yield; +1 quality-stewardship → 39% fewer review cycles per 1,000 merged AI lines. Observability: OpenTelemetry GenAI conventions standardize chat/tool/invoke_agent spans; Cloudflare agent tracing (2026-08-04) with span billing from Oct 2026; AWS AgentCore Observability via ADOT (2026-08-13); llmmas-otel (arXiv 2608.24271) pairs OTel with targeted fault injection. Repair-or-resample numbers are primary in the loop-state card. Cost-Utility dual-ledger primary in skills/verifiability. Copilot CLI OTel hook correlation primary in CLI/MCP card. Cursor Origin lets Cloud Agents start without GitHub/SCM. Role shift: harness/loop/plugin-catalog ownership multiplies output; seat licenses without it move the bottleneck to review and incidents.

Why it matters Agent volume without decomposition recreates the senior-engineer tax. Without a shared trace contract, incident response stays anecdotal. Seat licenses without harness ownership leave review and incidents on the most expensive people.

Economic lever Review throughput is the binding constraint on AI coding ROI; stacking, executable guardrails, agentic first-pass review, and trace-level cost attribution recover cycle time that seats cannot.

Watch for IDE/CLI agents creating stacks by default, A2A/MCP trace propagation becoming standard, Sep 28 Copilot cloud/web/mobile policy unification, and internal career paths for harness/platform engineering.

Key practices

Install gh-stack and the companion agent skill; prompt for one concern per layer; use the revert test
Run full agentic review on cloud-agent and bot PRs; keep humans on architecture and assumptions
Instrument LLM, tool, and sub-agent spans with GenAI semantic conventions; keep dual ledger of spend vs contribution
Measure verified tasks and harness/loop quality, not accepted suggestions
Make AGENTS.md, skills, plugins, org custom agents, and deny/approval rules owned artifacts with review

Evidence

[study] AI Coding Agent Effectiveness: Leading Indicators (Span) — 103 teams May–Jul 2026. +1 quality-stewardship → 39% fewer review cycles / 1k merged AI lines; +1 prompt-clarity → 27.2% lower cost/line.
[preprint] Layered Supervision (arXiv:2608.26316) — 2026-08-26. Preventive / executable / human layers; humans shift to architecture.
[vendor] Stacked pull requests public preview — 2026-07-30. gh-stack, stack maps, partial merges, agent skill.
[vendor] Copilot code review: resolution reasons and expanded capabilities — 2026-08-27. Full agentic review for cloud-agent PRs; size caps dropped.
[vendor] Upcoming changes to GitHub Copilot policies and billing — From ≥2026-09-28: Balanced default review; cloud/web/mobile unify, on by default.
[preprint] llmmas-otel (arXiv:2608.24271) — 2026-08-25. OTel + fault injection across MAS phases.
[vendor] Cloudflare Agents — 2026-08-04 Agents Week. Turn-by-turn replay; span billing from Oct 2026.
[preprint] Repair or Resample? (arXiv:2608.25920)
[vendor] GitHub Copilot CLI changelog (1.0.81/1.0.82)
[preprint] RAMP (arXiv:2608.25241)
[preprint] MAGE (arXiv:2608.25174)

Next actions

Concrete moves for the team.

Pulled from the top priorities. Use as a checklist in planning, not as a full program.

Treat the vendor CLI as a starter harness, then add org-specific verification, audit, deny rules, and a working-view policy
Decompose long work into DAG units with independently runnable tests before handing it to an agent
Start the harness inside a policy-enforced runtime; do not let the agent opt into the sandbox
Default CLI for git, docker, kubectl, gh, build, and test; do not wrap those in MCP
Adopt Agent Plugins 1.0 for org skills and MCP that must run in more than one client
Keep repo AGENTS.md short; point to docs/ and fail CI on stale links; commit AI configuration instead of leaving it in local client settings

Sources & method

Evidence base.

Daily research rewrites the brief. Engineering SotA is the spine; strategic economics is an enhancement on each priority — not a separate strategy feed. Model ranking lives on its own board.

Selected sources

Notes

Immutable weekly archive snapshot for 2026-W35.
Primary sources drawn from 2026-07-29 through 2026-08-30 engineering posts, vendor security guidance, and arXiv. No model-release hype.
Restructure 2026-08-30: 12→7 priority cards; three-layer page (claim collapsed, full text expandable); evidence grades [preprint|vendor|gov|study]; citation primary-home rule; momentum tags retired; weekly public archive under /trends/archive/YYYY-WW/.
Copilot CLI 1.0.81/1.0.82 full release treatment lives only in the CLI/MCP scaffolding card; other cards reference it by name.
Merged parents kept strongest headline numbers only (F2PF 28→49; AutoSaddler +9/+9.6/+10; SKILLSTATE 16.2×; SARA ASR ≤0.63%; scaffolding 5–28×; plugins 1,618; Span 39% fewer review cycles).
Acronyms on first use: F2PF = fail-to-pass fraction; AOT = ahead-of-time harness evolution; JIT = just-in-time harness synthesis; ASR = attack success rate; MAS = multi-agent system.
All trends include an economic_lever and ≥1 live URL. Daily runs overwrite the live page; Sunday archives are immutable.

Model picks: Hermes-weighted LLM leaderboard

Weekly immutable snapshots: Archive index · live page overwritten daily at 07:25 Europe/Vienna