What's changing in AI — every desk, every vendor.

If your self-hosted stack shells out to `ollama`, the default behavior just changed — and the deprecation list says which local models to migrate off.

If you're building an agent that has to keep working across session death, context compaction, or a model downgrade, the hard part isn't retrieving state — it's proving the loop resumes the RIGHT state and can't run away, ship on its own, or grant itself a fresh budget every restart. This is a worked, honestly-graded design for exactly that: a durable state cell, a cumulative budget that survives restarts, a halt-and-hand-back rule instead of a silent spin, and a never-self-ship gate — with the parts that are green-in-tests kept clearly separate from the parts still pending a live dry-run.

• The core insight is small and reusable: cross-session durability was failing not because the loop lacked persistence, but because it had two half-loops that never touched. One half could evaluate a goal and drive a build-then-judge iteration but held its state in memory that dies with the session; the other half persisted work across idle and restart but was goal-blind — it knew a work lane existed, not what 'done' meant or how far along it was. The fix was NOT a new engine. It was one thin durable controller plus ONE shared state cell that both halves read and write. The cell carries only state that genuinely can't be recomputed from artifacts: current step, iteration count, which test is still failing, budget used so far, last-pass timestamp, and a 'gated' flag. Everything else stays stateless and recomputed. The transferable lesson: find the smallest set of state that ISN'T derivable from what's already on disk, and make only that durable.
• Three mechanics make the loop safe to run unattended, each proven by its own test suite. Resume: a killed controller, re-invoked in a fresh process, reads the cell and continues from the saved step and iteration with the failing test recalled — not from step zero (resume suite, 13 pass / 0 fail). Cumulative budget: the turn-and-cost meter hydrates from the cell at the start of every pass, so N restarts enforce ONE budget that halts at the true cap, instead of N fresh budgets — the failure mode that would quietly make an 'unattended for a month' safety claim false (budget-durability suite, 5 pass / 0 fail). Halt-safety: a corrupt, zeroed, or negative budget refuses fail-safe rather than granting a fresh slice, and a loop making no progress halts on a no-progress rule (two identical no-advance passes) or an independent pass ceiling — it cannot spin forever (halt suite, 18 pass / 0 fail). If you build one of these, budget-hydration-from-the-cell is the non-obvious part: a meter with zero persist calls looks correct within a single session and is silently wrong across restarts.
• The team wrote down six named consistency guarantees as the definition of 'durable,' then had an independent seat grade whether each is mechanically proven TODAY — and published the honest grade rather than a claim of six-for-six. The six: G1 work survives a killed terminal; G2 budget is cumulative across restarts; G3 a stuck goal halts and hands back (never a silent sleep); G4 the loop never ships on its own; G5 the goal is the human owner's, not an agent's; G6 the record is append-only and re-renderable (a replay renders identically to the live run). The graded reality: three (G1/G2/G3) have dedicated green commands; two (G4/G5) are proven at the mechanism level but under-cite their strongest defense (a trust-root test, 14 pass / 0 fail) and share one suite instead of each carrying its own command; and one (G6) has NO committed verifier yet — a build spec exists for it, but the check isn't written. The reusable move is the discipline itself: name your guarantees, require each to name its own failing command, and treat 'shares a test with another guarantee' or 'graded by a human' as not-yet-done.
• The two most safety-relevant defenses target a write-capable agent trying to cheat its own loop, and both hold in tests. A trust-root gate (14 pass / 0 fail) rejects a tampered state cell — a schema-valid 'cold-start lie' that fakes a fresh budget or un-parks a goal is refused as un-attested at hydrate — rejects a self-authored human-approval row, and fails CLOSED when the bootstrap secret is unset (no secret, no run). Layered on top, the loop never crosses a human-owner gate on its own: when the work is green but the next step is a ship, a deploy, or one of the eight destructive classes (schema changes, data deletion, secret rotation, auth, payments, production deploy, branch protection, external accounts), the loop reaches a distinct terminal state — PARKED-AT-EYES — that is a VALID stop, not a failure, and it will not self-cross; re-invoking a parked goal keeps it parked. The design deliberately separates the 'done' gate (the machine's job) from the 'ship' gate (always the human's keystroke). One pattern worth stealing: make the ship keystroke structurally impossible for the agent to press, and make an un-attested state cell refuse rather than trust its own file.
• Honest state, stated plainly because it is the most important thing here: this loop is green across its suites and has passed a multi-seat review, and it is NOT live anywhere. The known gaps are documented on disk, not glossed. There is no FOUNDER-ratified operational goal yet — only a schema-proving template that no driver reads; there is no loop state on any production lane; the end-to-end auto-re-wake of a dead terminal is built-and-composed but unproven on a real lane; and, critically, NO dry-run has executed. Go-live is defined as one proven dry-run on a single safe, bounded, recurring real target — the leading candidate is AI Uni's own daily research refresh, which today dies with its session, the exact seam the loop is meant to close — followed by the human owner's explicit go-live word. The takeaway for anyone shipping autonomous infrastructure: 'green in tests' and 'reviewed' are real milestones, but they are not 'live,' and saying so precisely is part of the engineering, not a caveat bolted on afterward.

Internal engineering research on AI Uni's own autonomous work loop. Grounded in the FOUNDER-ratified consolidation spec, the built harness scripts on `main`, a Volere-style 16-requirement go-live pack (authored by the Business Analyst), and an independent CTO architecture-integrity verdict; every claim traces to a committed repo artifact by path, and every test count was re-run this session by the CTO on scripts byte-identical to `main` — an independent re-run, so the seat that graded is not the seat that built. Honest-state discipline throughout: the loop is green-in-tests and reviewed but NOT live — no dry-run has executed and go-live is the human owner's explicit word; nothing here claims the loop is running.

Production traffic says a big slice of the market already moved routine workloads to open-weight models — worth re-checking which of your workloads still need frontier prices.

AI-in-education is shifting from student-tutoring pilots to teacher-side infrastructure at national-program scale.

If you're building an agent that needs to remember anything across sessions, check whether Anthropic's native memory tool already does what you were about to hand-roll — and if you're already building one, the field's clearest fix for the write-back/consolidation gap is a scheduled, importance-triggered pass, not more discipline.

• Anthropic's `memory` tool (`memory_20250818`) went GA on the Messages API: a client-side file store (you own the storage backend, Claude just requests view/create/edit/delete operations over a `/memories` prefix), an auto-injected “check your memory before doing anything” system-prompt protocol, and — paired with context-editing — Anthropic reports 84% token savings on long-running tasks. If your team is hand-rolling cross-session state for an agent, there's a good chance this is already built for you.
• Every system compared splits memory into four steps — write, consolidate, recall, apply — and the same step breaks almost everywhere, including in our own: recall and apply are mechanizable (a hard gate, a retrieval call, a tiered memory block), but write-back and consolidation are treated as unenforced discipline nearly universally. Two concrete fixes worth copying: Letta's “sleep-time compute” (a separate, idle-time agent that distills raw memory into synthesized knowledge using a slower model) and Generative Agents' (Park et al., 2023) accumulated-importance threshold as the trigger that fires it — instead of a calendar reminder or “run it sometime.”
• Zep/Graphiti's bi-temporal fact model is a stronger staleness answer than a binary “this is stale” flag: every fact carries both a valid-time (when it was true in the world) and an ingestion-time (when the system learned it), so a superseded fact is marked invalid-as-of-a-date rather than deleted or just flagged — giving an auditable history of what was true when.
• The clearest UX lesson from consumer memory tools (ChatGPT memory, Cursor, Windsurf) is corroborated across independent sources: pure auto-capture over-remembers noise, and users end up manually curating the high-value items within a week or two anyway. The pattern that's held up is capture liberally and automatically, then run a separate curation/consolidation pass — not pure auto-capture and not pure manual discipline.
• Turning the same four-step framework on ourselves: our recall→apply loop was already ahead of the field — a mechanical gate that blocks a commit or dispatch until a prior failure class is acknowledged, backed by hundreds of live enforcement events — something none of Letta, Zep, mem0, or LangMem enforce mechanically; they retrieve and hope. But our write-back and consolidation were pure discipline, same as everywhere else. We shipped six WARN-first mechanisms the same day to close exactly that gap — a capture write-back check, a scheduled consolidation sweep, dedup-before-write, and three others — each with a committed promotion-to-blocking date, following the field's own lesson: mechanize the gap, don't just write a rule about it.

Internal architecture audit (Codebase Intelligence, re-grounded against the live codebase, 2026-07-12) cross-referenced against an external landscape review of seven cross-session memory approaches; every external claim traces to a primary source fetched or searched this session (dated), with primary-vs-secondary sourcing marked throughout and benchmark numbers flagged VOLATILE where not independently reproduced.

When the CEO of OpenAI's biggest backer tells enterprises to consider open models on their own infra, the open-weight surge stops being a hobbyist story.

If your team accepts work an AI helped produce, this is the honest map of what's actually checkable in 2026 — and where a human still has to be the judge.

• Repo-read attestation ("my AI read your repo and it checks out") has no external fix in 2026 — MCP has no built-in tool-identity/provenance mechanism and AI-code detectors are rated not reliable enough to stand alone — so it stays a claim, never a proof, unless AIU itself operates the read.
• Comms-bus / session telemetry (minutes-on-task, "a session happened") gets worse, not better, on closer look: hand-transcribed AI output is keystroke-indistinguishable from genuine writing, and behavioral detectors carry a peer-reviewed, durable bias against non-native English writers — telemetry should stay observability-only, never gating a pass or a fail.
• Artifact provenance (binding a submission to a raw artifact AIU can re-check) is the one place the landscape adds genuinely new, buildable vocabulary: "Tool Receipts" (a lightweight signed record a specific tool call happened) is a concrete, cheap implementation shape, and Open Badges 3.0 is the dominant 2026 external shape for the eventual pass credential itself.

External landscape research: every claim traces to a source fetched or searched this session (dated); peer-reviewed/PMC/journal sources preferred over aggregator blogs; 3 arXiv PDFs fetched directly (not just search snippets) to verify claims firsthand.

Anything an agent reports about work done on a machine you don't control is unverified by default. If it matters, re-run the check yourself instead of trusting the summary.

Don't hang a pass/fail — or an accusation — on an AI-code detector. Treat its output as a hint to look closer, never as the verdict.

Automated 'is this AI?' signals don't just misfire — they misfire unevenly, penalizing people who write in a second language. That's a fairness problem, not just a noise problem.

There's finally a cheap way to prove a tool ran and what it returned — but only when you run the tool. A receipt a user hands you for a tool they ran themselves proves nothing.

No tool can tell you whether someone actually understands their work. In 2026, the reliable signal is still the oldest one: ask them to explain it, live.

Legal and competitive risk in the platform layer everyone builds on — a signal for anyone weighing vendor concentration and IP exposure across the OpenAI ecosystem.

A new frontier family with three cost/capability tiers landing the same day across the two tools most builders already use means you can A/B it in your own stack today — no waitlist.

If you deploy on Vercel, one of the easiest ways to leak a key — echoing it in a build step — is now masked by default.

Another credible coding-agent with open API access — more competition and portability for teams picking an AI coding tool.

A concrete 'the agent did real work' proof-point — the applied-adoption signal product teams, consultants, and owners weigh before trusting agents with high-stakes tasks.

A first-of-its-kind usage-transparency feature from a frontier lab — relevant to anyone thinking about healthy AI usage habits, not just engineers.

A numbers-attached template for agents inside a large services business — the demand-side story, not another model release.

If you drive Claude Code day to day, the defaults just changed: parallel subagents run in the background and can push branches + open PRs on their own, and the safer "Manual" permission default means you approve more actions explicitly — re-check any hooks or automation that assumed the old behavior.

A ready-made, governed blueprint if you're building multi-step agents — plus LangChain's same-week "your coding-agent bill doubled, here's how to fix it" post is directly useful for anyone watching agent token spend.

Early research, not a shipping feature: it points toward a future where specific model capabilities can be switched off without retraining, but it is a lab result explicitly not in any production Claude today — nothing to adopt yet.

Another frontier option you can route to without a separate vendor contract — handy when you are benchmarking models against each other for a specific job.

This is the ops-facing version of the autonomous build loop — the same pattern AI Uni runs internally, now packaged for any team's production pipeline.

The 'what can I run on my own box' frontier — broader hardware support lowers the bar for teams that want local, private inference instead of a hosted API.

The most widely used code editor just made parallel agent sessions and vision-attached chat mainstream defaults — a direct read on where day-to-day developer AI workflows are heading.

A credible non-Anthropic option for hosting agents: if you want a managed (server-side) agent runtime or a second-vendor hedge, Gemini now offers background tasks and speaks remote MCP, so your existing MCP tools plug straight in.

This is what practitioners are adopting right now — whether you build or buy, shared-memory-for-coding-agents and agent-run debuggers/replayers are becoming standard parts of the stack, not novelties.

If you're building or self-hosting agent workflows, this is the reminder that agent-orchestration tools carry the same credential-theft risk as any authenticated web app — patch and audit access; don't assume the AI layer is out of scope for basic access-control hygiene.

A government running agentic coding (Opus + Sonnet) against its own systems to find and fix real vulnerabilities is a concrete, high-trust adoption signal — the exact 'agents doing real work' pattern AI Uni teaches.

Another serious, permissively-licensed open-weight model you can actually self-host and fine-tune — widening the field beyond DeepSeek and GLM for anyone evaluating what to run on their own infrastructure.

Surfacing agent-run traces through MCP + the CLI is the "agents observable inside your own dev tooling" pattern — directly relevant to AIU agent-orchestration + the SO #31 observability lens.

A common severity scale would change when a lab (or a regulator) decides a model must be pulled — directly relevant to how agent products get governed.

The whole Claude 5 family your stack runs on is available again — but the recall proved a frontier model can be switched off by regulation overnight, so a fallback model and platform-dependency planning are now real line items.

A cheaper model that runs agents at near-flagship quality resets the cost math for any multi-agent workload — the exact tradeoff an agent-run org tunes.

Concrete, buildable levers: systematically optimizing your skill/instruction files (rather than the model) and compressing agent memory can raise quality and cut token cost — directly applicable if you author skills or run long-horizon agents. Figures are the authors' reported results; validate before quoting.

The second frontier launch in a month gated by government — capability is now colliding with access control, which shapes what you can actually build on.

Adaptive, personalized learning is going free-and-mainstream from a platform giant — the competitive backdrop for any AI-tutoring product.

The gap between 'schools use AI' and 'schools use AI well' is exactly the gap a structured learning product is built to close.

An MIT-licensed model you can run and modify on your own hardware is a real self-hosting option — no per-token bill, no access gate.

A frontier-adjacent model you can run yourself narrows the gap between hosted APIs and self-hosted stacks for serious agent work.

A distribution channel candidate for AI-Uni-built products (Agent Engine, Classroom) — worth a strategic look.

The "stack 2-3 agents" workflow is now the senior-dev default — validates the multi-terminal model as industry direction, not idiosyncrasy.

Security tooling from the platform AI Uni builds on — relevant to the three-skill security-review discipline and to the Anthropic Security Plugin install this session.

The platform AI Uni's agents run on is scaling fast and heading public — relevant to platform-dependency risk and pricing-stability planning.

Usage-metered agent tooling makes cost track how hard your agents actually work — the same budgeting shift teams hit running their own multi-agent lanes.

CI/CD-embedded coding agents inherit the write access of the workflow they run in — treat any agent-triggering input (issue titles, PR bodies, comments) from an untrusted user as untrusted, patched or not.

Coding agents doing real repo work is exactly AI Uni's build model — a reminder that autonomous edits need guardrails measured on outcomes, not refusals.

The productized version of the multi-terminal + subagent pattern an agent-orchestrated org hand-rolls today — direct input to agent-engine design.

A per-call cost-vs-depth lever — dial low-effort for mechanical lanes, max-effort for hard reasoning. Materially changes how agent runs are budgeted.

The substrate Intel's own agent-facing MCP layer will sit on. Stateless + Apps + Tasks materially simplify hosting a daily-accumulating, agent-queryable KB.

Anthropic's flagship upgrade: sharper judgment, more honesty about its own progress, longer independent work — at the same $5/$25 per-1M base price as Opus 4.7. Ships with effort control and Claude Code dynamic workflows.

A concrete existence-proof of large-scale autonomous multi-agent work shipping real code — a teachable case study for AI-economy curriculum.

Direct input to agent-run token budgets and AI Uni's own $50/mo plan economics — more throughput per dollar favors the multi-terminal model.

A useful audit checklist even outside Anthropic's own stack — the seven control domains it names are a reasonable starting list for anyone standing up agents with real write access.

The first government-issued checklist specifically for MCP deployments — worth a direct read before your next MCP server goes into production, not just a headline.

A credible second frontier source for any model-portability or fallback strategy.

Open-weights frontier-adjacent models are a hedge against platform/pricing risk; MIT licensing matters for productization.

GPT-5.5 positioned as more agentic; 5.5 Instant became the default ChatGPT model with reduced hallucination in law/medicine/finance; 5.5-Codex is the agentic-coding variant.

The most-watched competitor's honest signal that scale does not equal impact — structure and motivation design matter more than model access. Exactly the gap AI Uni's structured-lesson model targets.

AI Uni's own memory-architecture work sits in this fast-moving category — the anti-evaporation (C14) problem the platform substrate solves.

If the effect holds, strong evidence for on-disk substrate-loading + persistence work. UNVERIFIED effect size — find the primary benchmark before citing the numbers.

A survey + curated paper list organizing agent-memory research (episodic, semantic, procedural, memory-OS architectures).

A direct competitive signal for AI Uni ("the college alternative for the AI economy") — a credentialed-degree entrant in applied-AI education.

Informs SO #31 (deterministic-vs-LLM-judge layering). Braintrust's merge-blocking eval-action is a pattern to study — but LLM-judge stays post-hoc, never replacing deterministic CI gates.

Transport evolution + scalability (.well-known discovery), agent communication (Tasks retry/expiry), governance maturation (Working Groups), and enterprise readiness (audit trails, SSO, gateway behavior).

Four orchestration styles have stabilized: graph-based (LangGraph, Microsoft Agent Framework), role-based (CrewAI, Agno), handoff-based (OpenAI Agents SDK), hierarchical (Google ADK).

The academic framing of what the substrate-batch + landscape-brief + KB-principle loop does informally. Indexed via a curated list — read the underlying papers before teaching specifics.

Confirms MCP as the durable interop bet for Intel's agent-facing side — "serve our KB over MCP" reaches every major client without per-client integration.

A second independent RCT with transfer-to-novel-problems as the outcome — the hard test — strengthening the evidence base beyond a single study or vendor.

The empirical floor under AI Uni's whole pedagogical thesis — structured AI tutoring over traditional pedagogy. Verify specific effect-size figures against the primary before re-quoting.