AI engineering trends

Coding Agents Have Converged: Why the SWE-bench Leaderboard Can No Longer Order Its Top Entries (arXiv 2609.17394, 2026-09-15) audits 254 submissions across four splits and shows the harness/scaffold is often the dominant observable variance driver over model weights. On SWE-bench Verified, the leading two entries each resolve 396 of 500 instances, and the top ten share 285 successes and 51 failures, leaving only 164 instances that distinguish outcomes (effective size fraction 0.33; for the top two, effective size drops to 36 instances, or 0.07). Frontier solution sets show median nesting of 0.935 against a score-implied baseline of 0.774. Crucially, observed within-model scaffold ranges reach 29.8 percentage points (e.g. Claude 3.5 Sonnet spanning 168 to 317 resolved instances), dwarfing the 8.8 pp spread across the entire top thirty of Verified. Exact paired McNemar tests separate none of the 29 adjacent Verified top-thirty pairs at alpha=0.05. Retiring universally solved instances adds zero statistical power because paired tests already ignore agreements. This audit directly reinforces An Empirical Study of Harness Design for Coding Agents (arXiv 2609.20804, 2026-09-17): a lightweight harness holding the execution loop fixed while varying planning, action space, and context management across 176 matched settings, four models, SWE-Bench Verified, and Terminal-Bench 2.1. Context management becomes valuable as the budget tightens, with most benefit from preventing overflow failures. Staging rule-based elision before LLM summarization is the strongest efficiency strategy; making elided content recoverable adds machinery models rarely use and yields no accuracy gain. Planning shifts from an accuracy scaffold for weaker models to a cost saver for stronger models. Bash-capable models operate effectively with a bash-only interface at substantially lower cost. Harness or Model? (arXiv 2609.11987, telemetry-corrected 2026-09-08) remains the pairing rule: on a private contamination-controlled suite, vendor-native pairing has no average solve-rate advantage (Opus 4.8 48.8% native vs 50.0% neutral; GPT-5.5 55.6% vs 54.4%). PRISM (Beyond Prompts, arXiv 2609.05736v2, EMNLP 2026) is the budgeted-search rule for frozen models: edit prompts and tool-boundary middleware under a budget, reporting RelLift95 alongside mean lift. Multi-Harness RL (arXiv 2609.04518): eval harness variation accounts for 4.3× gain vs training recipe 1.16×. Co-evolution (arXiv 2609.09134): imitating expert trajectories under an evolved harness regresses 4–30 pp; on-policy turn correction preserves fit.

Why it matters A weak harness makes frontier models expensive and unreliable; a strong one lets cheaper or open models close the gap. Scoring every harness candidate on a fixed suite hides regressions; feeding the full transcript under a tight window wastes the next search, edit, or test. Mean held-out lift without RelLift95 will promote a brittle PRISM/GEPA winner. Compressing all working-memory objects with one policy over-evicts artifacts and under-evicts tool dumps. A capability-positive self-edit that cannot be reversed is a production incident, not an improvement. HarnessDev shows creator self-eval is not held-out proof. The anatomy study shows production runtimes are hand-rolled platforms with deterministic retrieval — importing LangChain as the coding-agent loop is not how the field actually ships. EvoHarnessBench shows adding plugins/skills/MCP can regress old work without a weight change. Multi-Harness RL shows the eval harness you score on can dwarf the training recipe — freeze both before attributing a model upgrade. Co-evolution shows a second attribution trap: imitating an expert under a harness evolved for a weaker planner can destroy the fit you just paid to evolve. Neither AOT, JIT, nor a closed-loop view licenses unconstrained self-modifying production harnesses.

Copilot CLI 1.0.87 (2026-09-21) introduces --fleet for parallel subagent orchestration; 1.0.85 (2026-09-16) adds opt-in context-management tools for agents and subagents and a concise transcript view that groups tool activity; 1.0.86 (2026-09-17) resumes active sessions without discarding marketplace plugins and skills, and lets custom agents opt into repository instruction files (AGENTS.md, copilot-instructions.md, CLAUDE.md) via include-custom-instructions. These are session-continuity features, not durable loop state and not a Controller/Worker split. VS Code 1.138 (weekly 2026-09-14/18): local Dev Containers in the Agents window (rolling out; Docker required); create PRs from Agent Host without leaving the window; optional auto-mark inactive sessions Done after PRs merge. STALE-bench (arXiv 2609.25396, 2026-09-22) establishes the hazard of parallel agent execution without semantic coordination: across constructed tasks using 12 real Django helpers, GPT-5.5 produced semantic interference in 105 of 108 runs (97%)—each consumer patch passed solo tests and merged without textual git conflicts, yet failed hidden tests after concurrent interface changes (return types, arguments, renames). Broadcasting an oracle message describing the concurrent change recovered 82% of runs (93% among cleanly merged patches), demonstrating that git merge cleanliness cannot serve as an acceptance oracle for parallel agents. Agentic Societies Need a Social Harness (arXiv 2609.17527, 2026-09-15) is the inter-agent rule: a personal harness that manages private context is not enough when agents coordinate across trust boundaries — speech-level failures need a social harness that prevents classes of invalid messages, detects them at runtime, and supports post-facto consequences. Subagents vs Agent Skills (arXiv 2609.09233, 2026-09-07) is the new invocation rule for long-horizon reusable knowledge. SkillsBench has 87 long-horizon tasks; on the 64-task subset with synthesized procedural packages, executing a skill package as a subagent (fresh context, return only the output) outperforms loading SKILL.md into the main context when the package exposes explicit input–output contracts. On the original human-authored SkillsBench skills, which rarely specify I/O, agent-skill execution matches or beats subagents. Subagent execution trades higher total tokens for lower peak context; vendor CLIs (Claude Code, Codex) still spawn subagents mainly for parallelization, not encapsulation. Experience Funnel (arXiv 2609.08919, 2026-09-08) couples fast textual state (skills/harnesses) with slow policy consolidation in an alternating loop — do not treat either as a complete self-evolution recipe. JetBrains /ide remains IDE-grounded session continuity, not durable loop state. JetBrains Copilot (2026-09-08) adds a vendor outer-loop glue point: /ide in Copilot CLI connects a terminal session to JetBrains IDE context (selections, diagnostics, file references) in public preview; Copilot shell commands can use the IDE terminal environment and the project's configured Python interpreter / venv. Built-in subagents in the Copilot agent harness can now select a session model. This is IDE-grounded session continuity, not durable loop state and not a Controller/Worker split — do not confuse /ide with a Continuity Kernel or with HoH's independent evaluation loop. Harbor-Index (arXiv 2609.04298, 2026-09-03) is a compact hard outer-loop holdout: 82 tasks from 29 benches after difficulty filtering and an audit-and-fix loop; no evaluated model–harness configuration exceeds 30% pass, strongest GPT-5.5 with Codex at 28.0%. Use it as a frozen suite, not as a promotion oracle. PROCTOR (arXiv 2609.02246, 2026-09-02) remains the outer-loop scoring rule: demote LLM-as-judge from oracle to advisor. Self-improving agents achieved a 100% pass rate by reading cached answer keys, concealing 68% true capability; a corrupted ground-truth label caused the optimizer to delete correct compliance rules. The only reliable judge-side gain was a structural constraint on output order. PROCTOR's Teacher-Student loop holds tool access in a stateful orchestrator; stateless subagents diagnose and draft mutations they cannot apply; five deterministic guardrails outrank the Teacher (hermetic sandboxes, capability-disjoint roles, acceptance checks, frozen holdouts, canary cases where a perfect score is cheating). VS Code Agent Merge (public preview, weekly 2026-09-04) is the vendor outer loop for getting a PR merge-ready — review feedback, failed checks, merge conflicts — without replacing the coding CLI. Infrastructure is shifting from harness engineering toward loop engineering and execution-state design. Harness-of-Harness (HoH, arXiv 2609.01481, 2026-09-01) operates on existing coding-agent harnesses and organizes their executions into iterative planning–coding–testing loops: it balances repair with capability growth, scopes development into small verifiable increments, separates implementation-time testing from independent evaluation, and constrains verifiable outputs rather than prescribing agent workflows. On GameCraft-Bench, FrontierSWE, and ProgramBench, three harness–model pairs (Codex with GPT-5.5, OpenCode with DeepSeek-V4-Pro, Pi with MiniMax-M3) beat the corresponding standalone harnesses: average relative gain 52.25%, maximum 82.86% after three iterations. Absolute gains after three iterations: 16.62–22.08 points on GameCraft-Bench, 19–29 on FrontierSWE, 6.09–16.85 on ProgramBench. On FrontierSWE, HoH with Codex+GPT-5.5 continues improving over ten iterations, 22% → 72.67%. In a multi-day deployment with more than 70 iterations, HoH autonomously develops a playable first-person-shooter. LoopArena (arXiv 2608.28281, 2026-08-28) still evaluates a Controller that, after each coding round, instructs a separate fixed Worker: on full tasks the best observed Strict Success Rate is 24.69%. SKILLSTATE (arXiv 2608.26263, 2026-08-26) replaces append-only history with explicit mutable execution state: prompt footprint stays O(1); at T=100 a stateful baseline consumes 1,062,387 tokens versus 65,408 (16.2×); InterCode CTF pass@1 is 54.2% versus 43.2% ReAct. A 2026-08-22 mining study (arXiv 2608.21884) confirmed 217 autonomous loops — they commit loop config and almost never commit the state files discourse requires. LoopsBench still caps the strongest config at 25.00%. Repair or Resample (arXiv 2608.25920): unguided whole-run MAS resample repairs 6.90%; symptom-driven replay from a recorded anchor repairs 20.15%. Logos (arXiv 2608.28553) puts each plugin in its own process on an append-only transcript: 80 sessions resume with no repeated effect after kills at the four boundaries of the tool-call cycle. Continuity Kernel work (arXiv 2608.11632) argues storage retention is not authoritative state. Always-On Agents survey remains definitional. HoH is an outer loop over a vendor harness, not a replacement for explicit execution state or a Continuity Kernel. The anatomy study (primary in the harness card) adds a platform fact for loop design: ACP acquired a third role, harness hosting, and Omnigent already orchestrates rival CLIs behind one API — wrapping the vendor CLI is now a shipping product pattern, not only a research loop.

Why it matters Single-shot harness evals hide the production failure mode: agents lose the prerequisite graph, declare victory, and regress finished work. Append-only transcripts grow quadratic. Loading a contract-bearing skill into the main window is a peak-context tax; spawning a subagent without an I/O contract is a delegation failure. A Controller that cannot beat 24.69% Strict Success on full tasks is not a production outer loop. HoH shows you can wrap the vendor CLI you already run rather than replacing it — but only if increments are independently testable and implementation tests are not the same as the evaluator. Adoption without durable, inspectable loop state means you cannot replay, audit, or recover a multi-hour run. Session restore without explicit state is continuity of a black box. An outer loop that promotes on an LLM judge without hermetic holdouts will optimize the score, not the work. Harbor-Index's 28% ceiling is evidence the hard tail is not solved by wrapping a vendor CLI once; it is not a license to promote on LLM-judge scores.

GitHub AI Controls (2026-09-24) introduces a global default policy for generally available GitHub Copilot features and supported client capabilities across enterprise and organization settings (governing features & clients, Copilot Code Review, and MCP servers in Copilot: Enabled, Disabled, or Let organizations decide; effective 2026-10-22). This works alongside local sandboxing in the GitHub Copilot app (2026-09-23 public preview), which establishes fail-closed isolation below the harness: per-project and /sandbox on controls restrict filesystem access (read/write, read-only, denied folders), outbound/local network egress, and HTTPS git / GitHub CLI credentials. Crucially, if the host operating system cannot enforce the requested policy, the sandboxed shell fails with an error rather than running unconfined. Copilot CLI 1.0.88 (2026-09-22) simultaneously closes a critical enterprise policy loophole: enterprise managed settings now strictly apply to sessions opened in ACP mode (copilot --acp), by AHP hosts (copilot --ahp-host), and via published --server sessions, which previously ran with zero managed MCP, permission, or plugin policy. 1.0.88 also preserves /allow-all across managed-settings refresh failures and remembers exact session approvals for missing paths without granting access to their parent directory (visible in /list-dirs and reset via /reset-allowed-tools). Hook commands without an explicit cwd now safely execute in project root rather than an arbitrary session subdirectory. Sandboxed network denials from proxy tunnel failures now display actionable bypass guidance. This builds on 1.0.87's --assisted-approval safety judge and 1.0.85/1.0.86 sandbox controls (/sandbox network allow/deny without replacing proxy). Scanning the Harness (arXiv 2609.07360) remains the supply-chain baseline: across 2,660 setups assembling two or more components, 16.0% carry a confirmed security defect (9.8% unpinned MCP via npx/uvx/docker, 3.1% scoped-looking grants like Bash(python:*), and 3.8% skill shell pre-approvals). Enterprise managed permissions (2026-09-09 GA) maintain authoritative deny/ask/allow for shell, file, and network below the harness on Copilot app, CLI, and Agent Host, overriding saved approvals. HookPry (arXiv 2609.03884): 7/7 harnesses compromised via attacker-controlled hook updates (max 92.5% ASR).

Why it matters Long-horizon agents find paths their prompts did not anticipate. A programmable harness is a poor place for a security guarantee because it is designed to be modified. An unpinned MCP server resolves on every session start with the developer's privileges. Bash(python:*) is Bash(*). A skill with allowed-tools: Bash is a shell pre-approval that travels with install. Tool-return text that names an action is not a permit. An MCP server that passed yesterday's review can change its tools/list after three calls. A final reply that answers the user task can still hide a successful injection. Autonomously generated skills can persist a poisoned capability after the inducing session ends. Model instruction hierarchy does not survive harness context reconstruction. An IDE content-exclusion list that the CLI ignores is not a control. Lifecycle hooks are not model-mediated: they are host-privileged config that can update independently of SKILL.md review. Managed permissions that a user toggle can weaken are not managed.

Copilot CLI npm latest is 1.0.88 (verified 2026-09-25 via npm dist-tag). npm prerelease is 1.0.89-3 (verified 2026-09-25) — do not pin production to prerelease. 1.0.88 (2026-09-22) ensures custom-agent reasoning-effort applies automatically upon agent selection, brings enterprise managed settings to ACP mode (--acp), AHP hosts (--ahp-host), and --server sessions, runs repo-relative hook scripts from the project root when cwd is omitted, sanitizes deferred MCP tool names for search discovery, supports namespaced custom skills and ignored skill directories during discovery, bounds memory on large transcript resumes, and enables turn branching with /fork. OpenTelemetry in the GitHub Copilot app (2026-09-22) adds centralized telemetry export of agent sessions (model requests, tool usage traces) via enterprise-managed managed-settings.json. This builds on 1.0.87 (2026-09-21: --fleet parallel subagent orchestration, --assisted-approval safety judge, --extension-sdk-path) and 1.0.86 (custom-agent AGENTS.md opt-in via include-custom-instructions). Interface cost remains second-order: CLI-only harnesses were 5–28× cheaper even on MCP-capable ones on SWE-bench even when MCP tools were idle, due to tool declaration and invocation overhead in prompt context. Measure the scaffolding; pick the interface per integration (CLI for fast, local, deterministic tools; MCP for remote, multi-tenant, credentialed services).

Why it matters A platform-wide 'MCP everywhere' or 'CLI only' decision misallocates tokens and governance. Progressive discovery, real agent identity, default permission modes, and post-connect schema pinning make MCP viable at enterprise catalog scale — they are not present just because a server speaks the protocol. 1.0.83 is the production pin; 1.0.84-3 is prerelease (OAuth MCP startup reliability is not a reason to unpin GA). Leftover 1.0.82 images miss CIMD, managed-settings-before-MCP-start, and MCP-after-restart. Content exclusions that bind the CLI close a context-leak path that IDE-only policy left open. Unpinned MCP is the docs-shaped hole Scanning the Harness measured. A fleet whose gh packages fail to verify after the 2026-09-05 key expiry will stall every agent that shells out to gh.

Agent Plugins Directory census verified 2026-09-21: 4,840 conformant manifests from 1,480 repositories; after exclusions and deduplication, 2,765 distinct verified plugins remain (11,678 skills, 1,260 MCP servers), up from 2,628 / 11,351 / 1,211 on Sep 18 (4,664 manifests / 1,419 repos) and 2,011 / 10,455 / 969 on Sep 9. Three-day delta: +137 plugins / +327 skills / +49 MCP. Treat the move as catalog-ops load, not quality. Copilot CLI 1.0.86 resume no longer discards marketplace plugins on configuration read failure; 1.0.85 adds --json plugin listing and enable/disable for plugin, MCP, and skill. HookPry still makes autoUpdate a host-privileged hook-update path. Scanning the Harness: 3.7% of published skill collections pre-approve the shell. Agent Plugins Directory census verified 2026-09-09: 3,869 conformant manifests from 1,247 repositories; after exclusions and deduplication, 2,011 distinct verified plugins remain from 1,147 publishing repositories (10,455 skills, 969 MCP servers), up from 1,956 / 10,340 / 957 on Sep 8 (3,783 manifests / 1,225 repos). One-day +55 plugins / +115 skills / +12 MCP. Treat the move as catalog-ops load, not quality. HookPry still makes autoUpdate a host-privileged hook-update path. Scanning the Harness: 3.7% of published skill collections pre-approve the shell — a marketplace scan can see that class. Agent Plugins Directory census verified 2026-09-08: 3,783 conformant manifests from 1,225 repos, 1,956 distinct plugins (10,340 skills, 957 MCP servers), up from 1,932 / 10,262 / 940 on Sep 7 (3,626 manifests / 1,207 repos). One-day +24 plugins / +78 skills / +17 MCP. Treat the move as catalog-ops load, not quality. HookPry still makes autoUpdate a host-privileged hook-update path. Agent Plugins 1.0.0 shipped 2026-08-06 as a vendor-neutral package format: plugin.json, skills/, optional mcp.json, namespaced client dirs. TSC maintainers include AWS, Cursor, Microsoft, OpenAI, Vercel; Google joined as core maintainer the same day. Launch clients: ChatGPT/Codex, Cursor, GitHub Copilot, Kiro, VS Code. GitHub GA'd the spec in VS Code, Copilot CLI, SDK, and app on 2026-08-12 with enterprise managed-settings (enabledPlugins, extraKnownMarketplaces, strictKnownMarketplaces) and MCP allowlists. Census verified 2026-09-07: 3,626 conformant manifests from 1,207 repos, 1,932 distinct plugins (10,262 skills, 940 MCP servers), up from 1,901 / 10,100 / 922 on Sep 5 (3,552 manifests / 1,166 repos). Two-day +31 plugins / +162 skills / +18 MCP. Copilot CLI plugin surface (Update action, headless plugin agents) is covered in the CLI/MCP card — reference only here. On 2026-08-26 GitHub added autoUpdate: true on extraKnownMarketplaces — HookPry (security card) makes auto-update a host-privileged hook-update path, not a convenience flag. Copilot app Customize tab GA (2026-08-25); JetBrains (Aug 24/28) applies enterprise controls for plugins, MCP, telemetry, and permission modes. A 2026-08-28 study of Claude Code plugin marketplaces (arXiv 2608.28497) analyzed 1,926 repositories, 8,351 plugins, and 77,773 commits across 2,018 marketplaces: plugin-touching commit activity grew 8.8× in the six months after the Oct 2025 launch; 61.3% of plugins target software engineering; feature commits run at 39.6% vs 17.2% in conventional OSS; Claude co-authors 34.9% of commits; 78% of Script–Markdown co-changes inside skills/ are functionally coupled. Spec stays deliberately small: discovery of Skills and MCP; installation, distribution, and policy remain client-owned. VS Code August releases (2026-08-31) add one-click install of Agent Plugins 1.0 packages into the Agents window; that is distribution UX, not an allowlist. Anatomy study (harness card): SKILL.md already leads MCP 9/11 vs 8/11 inside production coding harnesses — portable plugins standardize the package, not the runtime policy.

Why it matters Teams were maintaining a separate manifest per client. Portability plus auto-update means a poisoned or over-privileged plugin can travel and refresh itself, including lifecycle hooks the model never sees. A 2,011-plugin catalog without matching runtime policy is a supply-chain surface. Instruction files and scripts that co-evolve as a unit are a new maintenance class — treating SKILL.md as docs will miss the 78% coupled changes. A one-day census move of +55 plugins / +115 skills / +12 MCP is a catalog-ops problem, not a quality signal. EvoHarnessBench: growing that catalog can forget previously solved work.

Look Before You Leap: Pre-Action Verification for LLM Agents (arXiv 2609.11957, 2026-09-09) demonstrates that cheap, deterministic checks run before an action takes effect prevent catastrophic silent failures: a static verifier over 9,930 shell commands across 482 tools catches 95.8% of invalid commands at a 10.0% false-positive rate, with syntax and binary checks achieving oracle-exact 0% false positives. In code modification across 640 edits over 224 files, location-anchored formats fail catastrophically: a single-line shift causes line-number edits to corrupt 99.1% of files, and function-name edits misapply 12.7% of the time, while content-anchored diffs fail cleanly; an anchor-and-verify applier slashes silent misapplications to 0.01% (1 in 8,320 trials). This directly reinforces SWE-Proof (arXiv 2609.21190, 2026-09-18): using Benchproofer across 500 SWE-bench Verified tasks, formal verification reveals 25% to 50% of test-passing patches admit counterexamples. Formal specifications lift Opus 4.8 resolution from 85% to 95%, yet agents synthesizing their own specifications pass audit only 62% of the time (yielding 0% net lift) due to faithfulness failures. SWE-Bench Pro Verified (arXiv 2609.08149) similarly demonstrates that anti-hacking safeguards eliminating leakage channels and task refinement correcting inconsistent instances depress raw benchmark scores. Quantifying Overclaiming Propensity in Frontier LLM Agents (arXiv 2609.20812, 2026-09-17) introduces OverclaimBench and establishes the empirical baseline for agent self-report unreliability: across frontier coding agents under a fixed harness, agents fail to read all requested files in 67.9% of review runs. Among incomplete runs, agents are misleading 80.4% of the time, either falsely asserting complete review or omitting that coverage was partial, missing planted defects at ~1.8× the rate of agents that actually read the files. SkillAA (arXiv 2609.20455, 2026-09-17) complements this with attribution-guided skill-graph repair, contrasting successful and failed runs to route repairs to specific graph objects while screening modifications through Local and Big Gates.

Why it matters Context files are first-class with a failure mode: too much always-on text crowds the task. Flattening a skill bundle into the root SKILL.md can raise every invocation's cost. Loading a contract-bearing procedure into the main window is a peak-context tax; spawning a subagent without an I/O contract is a delegation failure. Skills that only pass a schema scan can still fail live. Aggregate retrieval lift can hide same-task harm (RAE). A skill that preserves utility can still steer vendor or package choice (SkillShift). Oracles turn the agent into a component with a contract; a polished dashboard is not evidence. If obligations are not externalized as gates, review reconstructs them on every change. A SKILL.md that is not tested against its scripts is an unowned interface. A self-evolving skill bank without a write gate is a persistence exploit. A 5,000-skill distilled library without paired with/without trials is inventory, not capability.

Copilot code review (2026-09-23 GA) introduces dedicated personal review configuration on every plan (including Business and Enterprise), allowing individual engineers to trigger automatic reviews on PR creation, coauthoring, moving out of draft, and new pushes, with default effort Lite or Balanced; enterprise administrators can configure an enterprise-wide default review effort for organization-owned repositories via inheritance, governed by the new AI Controls default enablement policy (2026-09-24, effective Oct 22). STALE-bench (arXiv 2609.25396) confirms that parallel agent workflows without semantic coordination produce 97% silent merge failures on dependent interfaces despite conflict-free git merges. OpenTelemetry in the GitHub Copilot app (2026-09-22) exposes step-by-step agent execution traces (model requests and tool invocations) to enterprise observability pipelines via managed-settings.json. Agentic CLI customizations in the usage metrics API (2026-09-17) is the new fleet-observability pin: enterprise and organization reports now include totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin (top five plus distinct-use counts). Customer-defined names are grouped as other; MCP counts connection attempts, not tool calls; plugin totals are a subset of skill totals — do not add them. VS Code Agents-window metrics are GA (2026-09-11) and stay separate from editor-window Agent Mode. Auto model selection (weekly 2026-09-14) adds efficiency, balance, and intelligence tiers that pick from the same available models in VS Code, CLI, and app. Copilot code review (2026-09-11/18 GA): auto-resolves addressed comments with Won't Fix / Incorrect reasons; Lite reviews use an ensemble (+47% high-severity addressed comments, −8% review cost in GitHub's experiment). Copilot budget-increase requests are GA (2026-09-16) for Business/Enterprise usage-based billing (not EMU). Fleet pin: Copilot CLI 1.0.87 (--fleet parallel subagent orchestration, --assisted-approval safety judge). Two deprecation waves: Oct 2 (GPT-6 Astra picker add; drops legacy GPT-4o, Claude 3.5 Sonnet v1, Gemini 2.0 Flash) and Oct 19 (drops Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, Grok 4.5).

Why it matters Agent volume without decomposition recreates the senior-engineer tax. Bulk autofix without an executable oracle and a human merge gate converts a quality backlog into rubber-stamped PRs. Without a shared trace contract, incident response stays anecdotal. Self-report is the cheapest oversight channel and fails where oversight matters. Letting an agent approve its own (or a peer agent's) PR without path policy and an executable oracle converts review throughput into a rubber stamp. Seat licenses without harness ownership leave review and incidents on the most expensive people. A broken gh package feed stops every agent that opens PRs from Linux images.