For builders operationalizing agentic work.

Cache-stable harnesses: every cache break the provider measured was the harness's own edit

Week 42 of 2026 · October 17, 2026

Big read

The rule is not new; the measurement is. Keep the prompt prefix byte-stable, make the context append-only, keep the tool list fixed for the session, keep timestamps out of the system prompt, and treat the cache hit rate as the production metric: Manus published that list in July 2025 ('Context Engineering for AI Agents: Lessons from Building Manus'), Anthropic's prompt-caching documentation says the same, and most production harness teams already run some of it. What arrived on October 16 is the first provider-side measurement of what ignoring it costs. Neuralwatt, an inference provider, published a month of production data showing that across agent clients the share of input tokens that missed the prompt cache (the serving-side reuse of the computation for a prompt prefix the model has already seen, billed at a discount) ranged from 1.6% to 11.1%, and that going from 97% to 92% cached is about 2.7x the prefill work (prefill is the compute spent reading the prompt before the first output token), because what matters is the uncached remainder, not the hit rate; the energy and deep-context figures are in the proof-of-value entry. The finding that makes this a technique rather than a tuning note is the cause: every cache break in their lab came from the harness editing content it had already sent (a timestamp in the system prompt, a refreshed git status, a tool list that changed when a subagent attached, a rewritten history), which forces recompute from the first changed byte. The model did nothing; the harness did. Neuralwatt's own 'What you can do' section states the fix (identical prompt start every turn, new messages and tool results at the end, no date or git status in the system prompt, a stable sorted tool list, late compaction whose summariser reuses the exact prefix), and names deepseek-harness as the exemplar that keeps the cache intact with an append-only session log and a fixed minimal system prompt; the first-changed-byte diff in the anatomy below is Neuralwatt's stated next step, adopted here as the verifier. The rate cards say why the arithmetic is worth a sprint: Anthropic's cache reads are a twentieth of input (Sonnet 5.5 $0.10 against $2; Opus 5.5 $0.20 against $4), Google's a twentieth for Argon this quarter, and DeepSeek's a fiftieth ($0.003 against $0.15), so the cached share is the single largest controllable term in an agent loop's bill and the Model Pulse's per-token prices are only half of it. If you run agents in production, the one thing to do this week is to put the cached-token ratio on the same dashboard as the success rate and treat a drop as a regression in the harness, because that is what it is.

What this issue adds is the join with the week's releases, which show the vendors converging on the same fix from the release side. Claude Code 2.1.299 added idle compaction: a conversation above 200K tokens that has been idle for about 54 minutes is compacted before its one-hour prompt cache expires, so the next turn pays for a short summary rather than a cold 200K prefill; the policy is pinnable in settings.json. Hermes Agent v0.22.0 added an opt-in cache_ttl so an operator can state how long a prefix should be kept warm, and Goose 1.55.0 capped auto-compaction at 225K tokens. The Hacker News thread on Neuralwatt's post supplied the practitioner half: one team found that collapsing a file's history to a single latest copy (a sensible-looking context optimisation) cut cache hits to about 50%, while grep-plus-offset reads, which match how the models were trained to browse code, preserved caching. The transferable rule across all of these is that any token the harness has sent is now part of the model's working memory on the server, and changing it is the most expensive operation a harness can perform, more expensive than sending a new one. Stated as a house extrapolation rather than a Neuralwatt figure: on an unstable prefix the input bill scales with task length squared, because every turn re-reads everything before it; on a stable one it scales with task length.

The technique belongs in the Build column of 'From Chat to Cowork to Build to Automate' because it is where the loops are long enough for the arithmetic to bite, and one of the week's other releases is directly shaped by it: Codex 0.163 runs read-only tools in parallel, which adds tokens to the suffix without editing sent ones. Copilot CLI's deny-on-'ask' and Cursor's MCP rate-limit back-off are governance changes, carried in their own entries without a cache claim. The proof-of-value cases this week say where the value shows up: EXANTE's Codey ran 250 Jira tasks at 75% success across three runtimes; Cockroach Labs' role-structured pipeline merged 1,238 agent-authored pull requests with seven reverts (about 0.6%) in five months; SolarWinds claims 5x engineering output from an agent team and gives no methodology. None of those numbers is about the cache, and all of them were produced by harnesses that ran long enough for the cache to be the bill.

Technique of the week

Build

Cache-stable harness design: stable prefix, append-only context, fixed tool list, compaction on the harness's schedule

Arrange every prompt the harness sends as a strict append to the previous one: keep the system prompt and tool schemas byte-identical for the session, never rewrite history the model has already seen, add new context at the end, and compact (summarise older turns into a short block) on a timer set below the provider's cache lifetime rather than when the window fills. The cached-token ratio becomes a first-class metric alongside success rate. The rule is Manus's (July 2025) and Neuralwatt's own recommendation list; the measurement, the vendor convergence and the regression framing are what this issue adds.

Neuralwatt's month of production data is the first provider-side measurement that assigns the cause of cache misses: every break in their lab was the harness editing sent content, not the user or the model. The cost is nonlinear in the miss rate (92% cached is about 2.7x the prefill of 97%), so a harness that refreshes a timestamp each turn is paying for the whole prefix again on every call. Claude Code's idle compaction and Hermes' cache_ttl show the vendors converging on the same fix from the harness side; the rate cards in the Model Pulse (cache reads at a twentieth of input on Anthropic and Argon, a fiftieth on DeepSeek) show why the arithmetic is worth a sprint. For an operator this is the difference between the agent bill scaling with task length and scaling with task length squared, which is this issue's extrapolation from the mechanism, not a Neuralwatt figure.

Trigger: Every turn in a long-running loop, and in particular every point where the harness touches content it has already sent: system-prompt assembly (dates, environment banners, git status), tool registration (a subagent attaching, an MCP server reconnecting, a skill loading), history management (compaction, de-duplication, 'latest copy' file views), and idle resumption after the provider's cache lifetime (one hour in Claude Code; stated per model elsewhere). Neuralwatt identified all four causes in its lab study and confirmed two of them (tool-list changes and effort changes) in production clients; idle timeouts, restarts and subagent spawns caused no breaks in the lab. The Hacker News thread added the file-collapse case.
Context: Split the prompt into a frozen prefix and a growing suffix. The prefix holds the system prompt, tool schemas, project instructions and anything else that does not change for the session; it must be byte-identical turn to turn, so any dynamic value (time, branch, working directory) moves to the suffix or into a tool result the model fetches on demand. The suffix is append-only: new turns, new tool results and new files go at the end, and reads of large artefacts use grep-plus-offset so the model sees a stable slice rather than a rewritten whole. Hermes' cache_ttl and Claude Code's idleCompaction settings are the knobs that tell the harness how long the prefix is worth keeping warm.
Tools: Claude Code 2.1.299 idle compaction (a 200K+-token conversation idle about 54 minutes is compacted before the one-hour cache expires; policy in settings.json) and the 2.1.302 change that compacts over-long conversations instead of denying tool calls under the server-side classifier; Hermes Agent v0.22.0 opt-in cache_ttl plus about 19 rarely used tools loaded on demand (which keeps the registered tool list short and stable); Goose 1.55.0 auto-compaction capped at 225K tokens with subagents bound to the parent's hooks and mode; Codex 0.163 parallel read-only tools (adds suffix tokens without editing the prefix); deepseek-harness as the reference implementation Neuralwatt names (append-only session log, fixed minimal system prompt, state appended after history, identical tool list, late compaction, a 'KV cache effect' review on every change). The negative tool is any harness feature that rewrites sent content: refreshed status banners, 'latest copy' file views, re-ordered tool lists.
Verifier: Measure, do not infer. Pull cached versus uncached input tokens per request from the provider's usage fields (Anthropic reports cache_read_input_tokens and cache_creation_input_tokens; OpenAI and Google report cached token counts on the response), compute the uncached share per turn, and plot it against turn depth. The reference points are the stable and leaky ends of Neuralwatt's 1.6-11.1% range, as this issue divides it: a well-behaved client near 1.6-3% uncached, a leaky one at 8-11%. Then diff the prompt the harness sent on turn N against turn N+1 and locate the first changed byte; everything after it was recomputed (this is Neuralwatt's stated next step, 'record where each prompt first differs from the previous one', used here as the pass/fail test). A harness passes when the first changed byte is at the start of the newest appended block on every turn of a 50-turn run.
Escalation: When the uncached share rises above a threshold (Neuralwatt's data suggests 5% as a working alarm) or a single turn re-reads more than half its prompt past 128K tokens, the harness should log the first changed byte and the component that wrote it, and the on-call owner is the harness team rather than the model team. Treat a cache regression like a performance regression in release notes: Claude Code's changelog now lists compaction behaviour changes per version, which is the disclosure standard to hold other harnesses to. Where the fix is a product decision (a vendor's banner that refreshes every turn), the escalation is a support ticket with the uncached-share chart attached.

Neuralwatt (Oct 16): across agent clients, 1.6-11.1% of input tokens uncached; under 10% cached roughly doubles request energy (about 2.5x on GLM-5.3); 92% cached is about 2.7x the prefill work of 97%; past 128K context, one turn re-reading more than half its prompt costs as much prefill as about 600 normal turns; every cache break in their lab was the harness editing sent content (dates, git status, tool lists, rewritten history).
Claude Code 2.1.299 (Oct 14): idle compaction compacts a 200K+-token conversation idle for about 54 minutes before its one-hour prompt cache expires; 2.1.302 compacts over-long conversations instead of denying every tool call under the server-side classifier; idleCompaction policy pinnable in settings.json.
Hermes Agent v0.22.0 (Oct 13): opt-in cache_ttl prompt caching, about 19 rarely used tools loaded on demand (a 34% smaller codebase), one-click local llama.cpp; v0.22.1 was built from the wrong commit and v0.22.2 (Oct 15) corrected it and fixed long local-model turns on laptops.
Hacker News practitioners on the Neuralwatt post: collapsing files to a single latest copy cut cache hits to about 50%; grep-plus-offset reads matched model training and preserved caching; r/LocalLLaMA threads converge on short tool allowlists, hard context caps and compaction for local harnesses.
Goose 1.55.0 (Oct 16): auto-compaction capped at 225K tokens; subagents bound to the parent's hooks, mode and approvals; W3C trace context (the standard header that carries one request id across services) propagated from ACP (Agent Client Protocol) prompts into MCP tool calls, which is what makes the per-turn cache diff attributable to a component.
Prior art, credited: Manus, 'Context Engineering for AI Agents: Lessons from Building Manus' (July 2025): stable prompt prefix, no timestamp at the start of the system prompt, append-only context, no adding or removing tools mid-iteration, 'KV-cache hit rate is the single most important metric for a production-stage AI agent'. Neuralwatt's 'What you can do' section and its deepseek-harness walkthrough restate the same list from the provider side.
Rate-card context (fact home: the Model Pulse): Anthropic cache reads at $0.10 per million against $2 input on Sonnet 5.5 and $0.20 against $4 on Opus 5.5 (a twentieth); Gemini 4 Argon cached input 95% off ($0.10) through November 30; DeepSeek V4.1-Flash cache hits at $0.003 against $0.15 input off-peak (a fiftieth); Muse Wonder at 7.69M input tokens per Artificial Analysis index task, the case where a cache-unstable harness would be most expensive.

Sources Neuralwatt, 'Why harnesses matter for energy efficiency'; Hacker News discussion; anthropics/claude-code CHANGELOG.md; NousResearch/hermes-agent v0.22.0 release; aaif-goose/goose releases

New agent capabilities

2026-10-16 · Anthropic · Build

Claude Code 2.1.299-2.1.302

Two changes alter operator behaviour: idle compaction, which compacts a 200K+-token conversation idle about 54 minutes before its one-hour cache expires (2.1.299, among 190 changes), and MCP allow rules that now match only the server they name (mcp__a no longer covers a__b), which means re-auditing rules before upgrading. The rest of the four releases in three days: plugin hooks refused rather than allowed when the hook cannot be handed its action; no HTTP redirects to claude.ai's connector proxy or Anthropic-hosted MCP servers; classifier_verdict, permission_mode and classifier_category on OpenTelemetry tool_decision events (2.1.301); CLAUDE_CODE_AUTO_MODE_MODEL; fork subagents default-on in claude -p, the Agent SDK, desktop and VS Code (CLAUDE_CODE_FORK_SUBAGENT=0 disables); and compaction instead of blanket tool denial under the server-side classifier (2.1.302).

Operators get the week's cache control (idle compaction) and three fail-closed tightenings that continue last week's technique (fail-closed hooks: a permission step that denies when it cannot get an answer), plus a new audit obligation: any mcp__ allow or deny rule whose server name contains a double underscore may now match differently, so re-audit before upgrading an unattended fleet. The OTel attributes separate auto-mode classifier blocks from permission-rule blocks for the first time, which is the measurement last week's friction ratio (the share of tool calls the harness blocks that a human would have allowed) needed. Fork subagents defaulting on means a forked child inherits the parent's context; on a cache-stable harness that is a cache hit, on an unstable one it is a second cold prefill, so measure before and after.

Sources anthropics/claude-code CHANGELOG.md; DevelopersIO v2.1.299 breakdown

2026-10-15 · OpenAI · Build

Codex CLI 0.163.0

Daybreak (OpenAI's Trusted Access for Cyber programme, opt-in since 0.161) is now enabled by default for eligible accounts and selectable from codex exec with an API key; instant steering is on, so a mid-turn follow-up redirects the agent and an interrupt stops active Code Mode cells (Code Mode is OpenAI's own feature, distinct from Pi's Codemode sandbox) and nested tool calls; independent read-only tools (skill, memory, conversation-history lookups) run in parallel; the network proxy checks permission before DNS lookup, rejects duplicate Host headers and stops credential aliases bypassing inspection hooks; resumed threads restore permissions and network approvals under managed policy; the bundled patched zsh is replaced by the standard shell executor, and docs now spell out bubblewrap filesystem isolation plus seccomp syscall filtering on Linux.

Two defaults changed without a flag flip by the operator. Daybreak-eligible accounts now get reduced-refusal offensive-security behaviour by default, which an unattended pipeline may not want; check eligibility and the per-turn programme flag before upgrading. The permission-before-DNS fix closes a leak where a denied host could still be resolved (DNS queries are observable), and the resumed-thread fix addresses a class of bug last week's audit step would have caught. Parallel read-only tools add tokens to the suffix without touching the prefix, which is the right shape for cache stability; verify that the tool list the model sees stays in one order across turns.

Sources openai/codex release rust-v0.163.0; OpenAI Help Center (Daybreak)

2026-10-14 · GitHub · Automate

Copilot CLI 1.0.96-1.0.98

Autopilot now denies when a preToolUse hook returns 'ask' instead of stalling on a dialog nobody is watching (1.0.97); a timeline attributes every permission decision to you, Assisted Permissions, policy or unattended fallback (1.0.96); agent-scoped declarative hooks for custom agents; managed permission rules read-only in /config; secrets redacted in --output-format json; more than 100 custom agents discoverable per repo; /add-dir grants sandbox access for the session; Gemini 4 Argon added and resumed sessions honour abandoned pending-permission work (1.0.98). No default network boundary for autopilot shipped; permissions.limitTo and sandbox.userPolicy.network remain the controls.

The 'ask' change is the fail-closed completion of last week's technique: an unattended run that cannot get an answer now stops instead of waiting on a dialog nobody will see. The attribution timeline is the audit artefact enterprises asked for after the Adversa disclosure (W41: a Cryptographic Context Injection chain in which Copilot CLI in autopilot fetched a web page, decrypted instructions in its own shell, read a local .env.prod and posted it to an attacker), and GitHub's position on that chain ('not a product vulnerability') is unchanged, as is the absence of a default autopilot network boundary. Move approval logic into preToolUse hooks (they now deny rather than hang), enable the sandbox, and set limitTo via managed settings.

Sources github/copilot-cli changelog.md; GitHub Docs (enterprise managed settings)

2026-10-16 · Cursor · Build

Cloud Agents (canvases, Environments API beta) and admin controls

Cloud agents build shareable interactive canvases; an Environments API in beta (POST /v1/environments with owner, name, repos and environmentJson, plus list, get, update, delete, history, build and secret endpoints) with environments up to 300 repositories and large ones loading 5x faster (vendor figure); Team-list enforcement for MCP servers and plugins with per-tool allowlists chosen from a live preview; an 'Automatically allow Projects to place their work' switch (off by default for Enterprise, on for other teams) that otherwise forces approval before an agent uses a new machine, environment or repo; soft and hard monthly spend limits per group; subagent progress streamed live into the parent and coordinators messaging @-mentioned agents; MCP rate-limit back-off for as long as the server asks; CLI v2026.10.08 Auto-review stricter on recursive, force and wildcard deletes and flagging SKILL.md files over Agent Skills limits.

Cursor's admin surface caught up with its cloud-agent ambition in one release: per-tool MCP allowlists and the Project placement gate are the permissioning controls an enterprise rollout needs, and the hard spend limit is the only per-group cost ceiling among the week's harnesses. Decide the Project placement default explicitly (it differs by plan) and move MCP governance onto the Team list before broader adoption. The rate-limit back-off is a reliability change (an agent that waits as long as a server asks stops hammering a rate-limited MCP server); whether it has any cache effect depends on what the harness writes into the prompt while it waits, which Cursor has not described.

Sources Cursor changelog; Cursor web and Cloud Agents release notes; Cursor CLI changelog

2026-10-13 · Google · Chat

Gemini app skills (rolling out) and Workspace skills (delayed)

Skills in the Gemini app began a gradual rollout on October 13 to Rapid and Scheduled Release domains, due to complete by mid-November, with skill sharing and a Drive integration promised in the coming weeks; the Workspace rollout (Rapid Release completion scheduled for October 12, Scheduled Release from October 19) is 'slightly delayed' with no new date, cited as needed to launch 'in a safe and reliable manner'. Gemini-app skills have no admin controls and are available to all ages and personal accounts; Workspace skills remain limited to paid Business and Enterprise editions and users over 18. Uploaded skills need SKILL.md in the root, lowercase-hyphen names and under 100 MB; scripts requiring internet access are not supported yet.

The three-vendor portable skill format (SKILL.md across Claude, Codex and Gemini) reached consumers before it reached the admins who govern it: the surface with no controls is live and the surface with controls slipped. Admins planning a Gems-to-skills migration should hold Workspace Studio changes until the new date posts and use the consumer rollout to validate SKILL.md portability now. Cursor's CLI flagging oversize SKILL.md files the same week is the first cross-vendor lint on the format.

Sources Google Workspace Updates; Gemini Apps Help; Workspace Admin Help

2026-10-15 · Meta · Cowork

Muse Code with Muse Wonder (Active Focus, Active Memory) and Muse Spark Open on-device

Three separate things. The model: Muse Wonder on Muse Code and the Meta Model API ($4 / $20 per million, 1M context; Wonder Full for Power and Maximum Usage subscribers at 80x the Everyday limit), trained with Active Memory (goals, constraints and earlier decisions carried across conversations) and Active Focus (working through blockers but asking for clarification and checking in before important actions; Meta claims about 20% fewer tool calls and 25% fewer tokens for Spark 1.3 versus 1.2 in internal comparisons). The demo: on October 15 Meta showed Muse Spark Open running Muse Code workflows entirely on two M5 Ultra Mac Studios via MLX, shipping iOS changes to an open-source Mastodon client and driving DaVinci Resolve. The harness: recent Muse Code releases add Auto-review escalation to a human after 15 reviewer steps, --disable-request-user-input for unattended runs, _meta.callId on every MCP tools/call for de-duplication, and a sandbox fix preventing commands from reading or editing approval rules under ~/.config/muse.

Active Focus is a confirm-before-act behaviour trained into the model, and the right way to treat it is as a model property that may or may not fire, not as a harness guarantee: keep Auto-review and permission profiles in front of consequential actions regardless. Active Memory is the cross-conversation retrieval that makes a stable prefix hard, since memory injected at the top of a prompt is an edit to sent content; measure the cached share on Wonder before and after enabling it, given its 7.69M input tokens per index task (Model Pulse). The on-device demo is the first frontier-scale open model shown running a vendor's own harness fully locally, which moves the local-harness pattern from r/LocalLLaMA to a lab's launch stage.

Sources Meta Developers (Muse Wonder); Meta AI Research (Muse Spark Open); Muse Code changelog

New skills and connectors

2026-10-13 · Workday and Claude (MCP) · Connector

Workday Agent-Ready Tools and Sana agents inside Claude

Workday's Agent-Ready Tools are exposed to Claude over MCP with Workday permissions enforced on every action and a 'connect once' admin model; employees approve invoice exceptions and analyze HR and finance data in Claude, and Sana calls Claude for steps in compensation cycles and the close. Early access now, general availability late 2026; the same tools reach Microsoft 365 Copilot, Teams, Slack and Gemini Enterprise.

The first system-of-record MCP connector whose per-call price is published in credit units (10 per 100 basic calls, 50 per 100 advanced, per the rate card The Application Layer carries), which makes tool-call count a billable quantity a harness designer now controls. A harness that re-fetches Workday context each turn to refresh a banner pays twice: once in cache misses and once in Flex Credits. Keep the fetched record in the append-only suffix and call the tool again only on a state change.

Sources Workday Newsroom; Workday Flex Credits page

2026-10-13 · Hermes Agent · Plugin

600-plugin reviewed catalog pinned to commits; SemVer stable channel; one-click local llama.cpp

v0.22.0 ships a 600-plugin catalog reviewed and pinned to commits, tested SemVer stable releases that installs follow by default, signed MSIX and notarized macOS packages, password-manager browser login where the model never sees the password, and one-click local models that install llama.cpp (b11370) for CPU, CUDA, Metal, Vulkan and ROCm and rate catalog models against the machine's GPU and RAM; about 24,200 commits and 2,520 contributors since v0.21.0. v0.22.1 was built from the wrong commit and corrected in v0.22.2.

Pinned-commit plugins and a default stable channel are the provenance controls an enterprise allowlist needs from an open harness, and the wrong-commit release two days later is the reason to want them. The model-never-sees-the-password login is a data-access pattern worth copying in any browser-driving agent. The local-model installer plus Muse Spark Open's GGUFs make a fully local Build loop a one-command setup, with the cache arithmetic above applying unchanged to llama.cpp's KV cache (the per-request memory that holds a prompt's attention state, the local equivalent of a provider's prompt cache).

Sources NousResearch/hermes-agent v0.22.0 release

2026-10-16 · Cursor (MCP governance) · Connector

Team-list enforcement for MCP servers and plugins with per-tool allowlists

Admins can enforce a Team list of permitted MCP servers and plugins, choose per-tool allowlists from a live preview of each server's tools, and see Bitbucket connection events in the audit log; cloud agents back off MCP rate limits for the duration the server requests (Slack capped near a minute).

Per-tool allowlisting is finer than the per-server rules most harnesses offer (and finer than Claude Code's mcp__ matching, which this week narrowed to exact server names), and choosing from a live preview means the allowlist is built against the schema the model will actually see. For a cache-stable harness the benefit is a tool list that is fixed by policy rather than by whatever servers happened to connect, which removes one of Neuralwatt's four break sources.

Sources Cursor web release notes

2026-10-16 · Open harnesses (OpenCode, Goose, Cline, Browser Use) · Harness

OpenCode 2.0.30-2.0.32 (docked diffs, remote-URL instructions, OPENCODE_DISABLE_CLAUDE_CODE_SKILLS); Goose 1.55.0 (subagents bound to parent policy, W3C trace context into MCP calls); Cline 4.1.25 (hosted-sandbox Cloud sessions); Browser Use 0.13.13 (OpenAI browser toolset)

OpenCode stopped auto-installing updates in 1.19.0 and gates the move to 2.x behind opencode upgrade --major, discontinued session sharing in 1.19.1, and in 2.0.30-2.0.32 added docked diffs, remote-URL instructions, a switch to disable Claude Code skills and an experimental voice-session API; Goose binds subagents to the parent's hooks, mode and approvals and propagates W3C trace context from ACP prompts into MCP tool calls; Cline begins hosted-sandbox Cloud sessions; Browser Use lets OpenAI's browser toolset drive its browser. Pillar Security's writeup of a remote-code-execution chain in OpenCode via MCP OAuth (fixed in 1.18.33) applies to Windows and WSL users on older builds.

Three governance moves worth copying arrived in open harnesses this week: no silent major upgrades (OpenCode), subagents that cannot escape the parent's approval policy (Goose), and trace context that follows a prompt into every tool call (Goose), which is what makes a per-turn cache diff attributable to the component that broke it. Operators on Windows or WSL should confirm OpenCode is at 1.18.33 or later before anything else; a harness that receives an MCP OAuth redirect is a harness that can be told to run code.

Sources OpenCode changelog; aaif-goose/goose releases; Cline changelog; Browser Use release summary; Pillar Security

Proof of value

Evidence · Practitioner Report

EXANTE (in-house 'Codey' orchestrator) · Engineering tasks from Jira through GitLab and CI across three agent runtimes (Claude Agent SDK, Codex, OpenCode), with role and stage assignment, checks, revision loops and human acceptance and release

After six months, 250 tasks have passed through Codey with 75% completed successfully; Codey handles 7% of all tasks in adopting teams, and a feature environment is typically deployed about 30 minutes after coding starts, with humans retaining acceptance and release (EXANTE blog, October 8; trade coverage October 16).

A first-party report with denominators (250 tasks, 7% of team workload) and a failure rate stated rather than implied, which puts it above most vendor case studies; the sample is one firm's teams over six months and the 75% is task completion, not defect escape. The structural lesson is the runtime-agnostic orchestration layer: Codey assigns roles and stages across three harnesses and enforces checks and revision loops itself, which is where this issue has argued the value sits since W39. The 30-minute figure is an environment deployment, not a merge. Treat the 75% as a baseline for a role-structured pipeline with human gates, and ask what the other 25% cost in review time before copying the design.

Sources EXANTE blog; FinTech Global

Evidence · Practitioner Report

Cockroach Labs · Role-structured agent pipeline treating bugs like patients across the database codebase

Over five months the pipeline merged 1,238 agent-authored pull requests covering more than a million lines of code, with seven reverts, about 0.57% (Cockroach Labs engineering blog, October 9).

Seven reverts in 1,238 merged PRs is a denominator most practitioner reports lack, and it lands at the same level as Donchev's W41 figure (reverts at or below about 0.5% of merged PRs in every window, with his own caveat that a flat revert rate is not proof that quality held). What neither report gives is the comparison: the revert rate on human-authored PRs in the same codebase over the same months, or a defect-escape count, so this is a design result rather than a quality result. It is carried because it is a second practitioner dataset with a denominator and because the role structure (triage, treatment, verification) is the same shape as EXANTE's. The question to put to both teams is reviewer load per merged change; neither publishes it yet.

Sources Cockroach Labs blog

Evidence · Vendor Claim

SolarWinds (Avior, built by its internal 'Area 51' team) · Goal-oriented agentic IT operations with risk-tiered autonomy, audit trails, automated rollback, data masking and least-privilege tool access

SolarWinds says its internal team grew from 4 to about 25 people, prototyped Avior in about two weeks with AI coding tools, and achieved a 5x engineering-output gain versus human teams; dangerous actions in the product always require explicit approval (press release and Forbes, October 14; no methodology published).

The 5x is a vendor claim with no denominator, baseline or method, reported through an interview, and is labelled as such; the product design (risk tiers with mandatory approval for dangerous actions, rollback, masking, per-tool least privilege) is the part with evidentiary value because it is a shipped control set an IT buyer can inspect. The pattern matches the week's harness releases: autonomy graded by risk, with the gate outside the model. Ask SolarWinds for the approval-rate and rollback-rate telemetry before accepting the output figure.

Sources SolarWinds press release; Forbes

Evidence · Practitioner Report

Neuralwatt (inference provider) and Hacker News practitioners · Production agent traffic across multiple clients, measured for prompt-cache reuse and energy per request over a month

Uncached input ranged from 1.6% to 11.1% across agent clients; requests under 10% cached used about 2x the energy (about 2.5x on GLM-5.3); 92% cached is about 2.7x the prefill of 97%; one deep re-read past 128K context costs about 600 normal turns of prefill; every cache break observed was caused by the harness editing content it had already sent.

A provider-side measurement with a stated month-long window and multiple clients, published by a party with an interest in efficient traffic but with its mechanism (recompute from the first changed byte) independently checkable by any operator who diffs two consecutive prompts; the Hacker News corroboration (file-collapse cutting hits to about 50%, grep-plus-offset preserving them) is anecdotal and consistent. The 'every cache break' finding is from Neuralwatt's lab study; in production clients it confirmed two of the four causes (tool-list changes and effort changes), which is why the headline says 'the provider measured' rather than 'in production'. It is labelled practitioner_report rather than benchmark because the client set and model mix are not published. It is the evidence the week's technique rests on, and the energy figures are the first that tie harness design to the power constraint the AI Stack Weekly tracks.

Sources Neuralwatt; Hacker News discussion

Evidence · Practitioner Report

Sunil Tripathy (independent researcher) against the ChatGPT GitHub connector · ChatGPT with GitHub connected under the default 'All repositories' grant, asked to review an attacker's public repository

Hidden instructions framed as a 'deployment audit' led the agent to commit a .github/workflows file to an unrelated private repository; GitHub Actions ran it and sent secrets.AUDIT_CANARY to an external webhook (three receipts from a GitHub runner IP). Seven impacts documented, including account-wide repo enumeration and session-transcript commits; a plain request was refused and business-context framing passed. Reported September 4, full chain September 28, closed as out of scope October 14, disclosed October 15; researcher-assigned CVSS 4.0 of 9.3; no vendor confirmation, CVE or patch.

Unconfirmed by OpenAI and labelled accordingly, with the mechanism (connector write scope plus an auto-executing CI system as the exfiltration channel) consistent with Tego's earlier finding that the Codex connector app carries write scopes while the help docs describe it as read-only. The transferable control is on the repository side, where the operator holds it: scope the connector to selected repositories, protect .github/workflows with CODEOWNERS and branch protection, and alert on workflow commits authored by app identities. The 'out of scope' closure is the week's reminder that a vendor's bounty policy is not a statement about exploitability.

Sources Sunil Tripathy disclosure; Tego; OpenAI Help Center (connector documentation)

Evidence · Confirmed

Pillar Security against OpenCode · MCP OAuth redirect handling in the OpenCode harness on Windows and WSL

A remote-code-execution chain via MCP OAuth in OpenCode, fixed in 1.18.33, with the writeup published this week; operators on older Windows or WSL builds remain exposed.

Fixed and disclosed, so confirmed. It belongs here as the week's example that an MCP connector's authentication flow is an attack surface in the harness itself, independent of any model behaviour, and that OpenCode's decision the same week to stop silently auto-installing updates moves the responsibility for applying such a fix onto the operator. Pin and track harness versions as you would any dependency with a CVE feed.

Sources Pillar Security

Enterprise readiness

Permissioning

Claude Code's mcp__ rules now match exact server names (re-audit double-underscore names), Cursor adds per-tool MCP allowlists from a live preview and a Project placement approval gate, Goose binds subagents to the parent's approvals, and Codex resumed threads restore permissions under managed policy. The counter-example is the ChatGPT GitHub connector's default 'All repositories' grant; scope connectors to named resources, and prefer allowlists built against the tool schema the model will see.

Auditability

Copilot CLI's permission-decision timeline (human, Assisted Permissions, policy, unattended fallback), Claude Code's classifier_verdict and permission_mode on OTel tool_decision events, Goose's W3C trace context into MCP calls, Muse Code's _meta.callId on every tools/call and Cursor's Bitbucket audit events are five harnesses adding attribution in one week. Add the cached-token ratio and the first-changed-byte offset to the same trace; they are the audit record for harness cost.

Verification

EXANTE's 75% success on 250 tasks and Cockroach's seven reverts in 1,238 merged PRs are the week's two practitioner numbers, both from pipelines with human acceptance gates and neither with a defect-escape rate or a human-authored comparison; SolarWinds' 5x has no method. The verification gap is unchanged from W41: no vendor or practitioner publishes reviewer agreement rates, and the telemetry Codex added in 0.162 for Guardian V2 (its approval reviewer) has produced no published figures.

Cost

Neuralwatt's data makes the cached-token ratio the controllable cost lever (the bands are in the proof-of-value entry). The harness-side controls are Claude Code idle compaction, Hermes cache_ttl, Goose's compaction cap and Cursor's hard per-group spend limits; the rate-card side (cache reads at a twentieth of input on Anthropic and Argon and a fiftieth on DeepSeek; Argon's December 1 reversion; Workday's per-call credits) lives in the Model Pulse and The Application Layer.

Data Access

Hermes' password-manager login keeps credentials out of the model's context; Codex's proxy now checks permission before DNS, closing an observable-query leak; Copilot CLI still ships no default autopilot network boundary; the GitHub-connector chain used CI as the exfiltration path, which no model-side filter sees. The rule from W41 stands: destinations need trusted provenance and ambient credentials stay invisible to sandboxed shells; add branch protection on workflow directories to the list.

Human Approval

Copilot CLI autopilot denies on 'ask' rather than hanging, Muse Code escalates to a human after 15 Auto-review steps, SolarWinds Avior requires explicit approval for dangerous actions, and Cursor forces approval before an agent uses a new machine or repo (default off for Enterprise). Meta's Active Focus is a trained check-in behaviour and should be treated as a model property, not an approval gate; keep the harness gate in front of it.

Reliability

Hermes v0.22.1 was built from the wrong commit and corrected two days later; OpenCode's MCP OAuth RCE was fixed in 1.18.33 and written up this week; OpenCode stopped silent auto-updates, moving patch responsibility to operators. Pin harness versions, follow the stable channel where one exists, and treat compaction and caching behaviour changes (now a per-version line in Claude Code's changelog) as release-notes items that need a re-measurement of the cached-token ratio.

Scorecard

As of 2026-10-17

Mode	Leading pattern	Representative tools	Control gap
Chat	Portable skills reach consumers before admins: SKILL.md live in the Gemini app with no controls, Workspace rollout delayed without a date; first cross-vendor lint on the format	Gemini app skills (rolling out to mid-November), Claude skills, Codex skills, Cursor CLI SKILL.md size lint	No admin controls on Gemini-app skills, no sync between app and Workspace, no signing or provenance on skills across vendors; OpenCode's OPENCODE_DISABLE_CLAUDE_CODE_SKILLS switch is the first harness-side off switch for a rival vendor's skill format.
Cowork	Agents with trained check-in behaviour and cross-conversation memory, and system-of-record tools inside the chat surface with the record's permissions on every action	Muse Code with Muse Wonder (Active Focus, Active Memory), Workday Sana and Agent-Ready Tools in Claude over MCP, Cursor cloud-agent canvases	Active Focus is model behaviour without a harness guarantee; Active Memory injected at the prompt head breaks cache stability and has no per-tenant boundary disclosed; Workday's connector meters per call in credits with no dollar price published, so a chatty harness has an unbounded bill.
Build	Cache-stable harnesses: idle compaction before cache expiry, operator-set cache lifetimes (cache_ttl), compaction caps, fixed tool lists by policy, parallel read-only tools that append rather than edit	Claude Code 2.1.299-2.1.302 (idle compaction, exact mcp__ matching, fork subagents default), Hermes Agent v0.22.0 (cache_ttl, pinned plugin catalog), Codex CLI 0.163 (parallel read-only tools, permission-before-DNS), Goose 1.55.0 (225K compaction cap, trace context), Cursor per-tool MCP allowlists and spend limits	No harness reports the cached-token ratio or the first-changed-byte offset to the operator; Codex's Daybreak default-on changes refusal behaviour for eligible accounts without an operator action; fork subagents defaulting on in Claude Code doubles prefill on an unstable prefix; agreement figures for Guardian V2 (Codex's approval reviewer) still unpublished.
Automate	Unattended runs that deny instead of hang, risk-tiered autonomy with mandatory approval for dangerous actions, and connectors whose write scopes are the attack surface	Copilot CLI 1.0.97 (autopilot denies on 'ask'; decision timeline), SolarWinds Avior (risk tiers, rollback, masking), EXANTE Codey (three-runtime orchestration with human release), Muse Code --disable-request-user-input with 15-step escalation	Copilot autopilot still has no default network boundary and GitHub's position on Adversa's Cryptographic Context Injection (CCI) chain is unchanged; the ChatGPT GitHub connector's 'All repositories' default plus CI auto-execution is an unconfirmed, unpatched exfiltration path; no practitioner pipeline publishes defect-escape or reviewer-load figures alongside its success rate.

Try this

Measure your cache hit ratio and find the first changed byte: a one-week harness audit

Expected outcome: A per-turn chart of uncached input share before and after the change, a classified list of every cache break with the component that caused it, and a measured reduction in input cost on a long task; teams that start in Neuralwatt's leaky band (8-11% uncached) should expect to land near the stable band (under 3%) and to see prefill-dominated turns past 128K tokens drop from hundreds of turns' worth of work to one. You will also have the first-changed-byte diff as a repeatable test to run on every harness release.

Pick one agent that runs long loops (coding, data pipelines, ticket triage) and enable the provider's cached-token fields in your logging: cache_read_input_tokens and cache_creation_input_tokens on Anthropic, the cached token counts on OpenAI and Google responses, or the KV-cache hit counters on vLLM or llama.cpp if you self-host. Record, per request, uncached input tokens divided by total input tokens.
Run a representative 50-turn task and plot the uncached share against turn number. The reference points are the stable and leaky ends of Neuralwatt's 1.6-11.1% range, as this issue divides it: a stable client near 1.6-3% uncached, a leaky one at 8-11%. Any turn whose uncached share jumps is a break; past 128K tokens, a single turn above 50% uncached is the 600-turn case.
For each break, capture the full prompt the harness sent on that turn and the one before, and diff them to the first changed byte. Classify the component that wrote it: system-prompt banner (date, git status, environment), tool registration (a server or subagent attaching, re-ordered schemas), history rewrite (compaction, de-duplication, 'latest copy' file views), or memory injection at the head.
Move every dynamic value out of the prefix: timestamps and status into a tool the model calls, tool lists fixed for the session by policy (Cursor Team list, Claude Code mcp__ rules, Hermes on-demand tools), memory and retrieved context appended after the transcript rather than inserted before it, and file reads via grep-plus-offset rather than whole-file replacement.
Set compaction on the harness's schedule, below the provider's cache lifetime: pin idleCompaction in Claude Code's settings.json, set cache_ttl in Hermes, cap auto-compaction in Goose; where you own the loop, compact at a fixed turn count or token depth and keep the compacted summary at the end of the prefix so the prefix stays identical afterwards.
Re-run the same 50-turn task and compare: uncached share per turn, total input cost, and wall-clock time to first token at depth. Put the uncached share on the production dashboard beside the task success rate and alarm at 5%; a rise after a harness upgrade is a regression in the harness, and the changelog line about compaction behaviour is where to look first.

Watchlist

Next two weeks

Harnesses expose the cached-token ratio to operators: a Claude Code, Codex or Copilot CLI release that reports cache reads per turn, or a Cursor spend view that separates cached from uncached input

The technique depends on a number no mainstream harness shows today; the first vendor to surface it makes cache stability a feature comparison rather than an audit, and the AI Stack Weekly's cost levers would gain a measurable per-harness row.

Late October

OpenAI's response to the GitHub-connector disclosure: a scope change on the default 'All repositories' grant, a CVE, or a statement on write scopes versus the 'read-only' documentation

The chain is unconfirmed and closed as out of scope; a documentation correction or a default-scope change would confirm the mechanism without a patch, and the Tego finding on Codex connector write scopes would be answered at the same time.

Mid-November

Gemini-app skills rollout completes; new date for Workspace skills and the admin controls that come with it

The consumer surface finishes before the governed one; the gap between the two dates is how long enterprises run a skill format their admins cannot control, and the first cross-vendor skill-provenance mechanism is still absent.

Open

A default network boundary for Copilot CLI autopilot, and GitHub's position on Cryptographic Context Injection after the 'ask'-denies change

1.0.97 closed the hang, not the egress; a default permissions.limitTo in autopilot is the remaining fail-closed step, and GitHub's classification of the Adversa chain (the W41 disclosure in which autopilot decrypted web-page instructions and exfiltrated a local .env.prod) is the open item from W41.

Q4 2026

Second-wave practitioner numbers with denominators: defect-escape or reviewer-load figures from EXANTE, Cockroach Labs or Donchev's organization; any methodology behind SolarWinds' 5x

The week's proof-of-value cases all have success rates and none has a quality denominator; a defect-escape rate from any one of them is what turns a design report into a result the next buyer can plan against.

Open

Daybreak default-on uptake and any operator reports of changed refusal behaviour in unattended Codex pipelines

A default that changes what an agent will do for eligible accounts, without an operator action, is the kind of change this issue's reliability notes track; the first incident report or the first opt-out guidance from OpenAI settles whether it belongs in the enterprise-managed policy.

Changelog

2026-10-17: Issue 26 published. Technique: cache-stable harness design, a rule published by Manus in July 2025 and restated in Neuralwatt's own recommendations, carried this week because Neuralwatt's month of provider-side measurement is the first to price ignoring it, with Claude Code idle compaction, Hermes cache_ttl, Goose's compaction cap, deepseek-harness and the Hacker News grep-plus-offset practice as the implementations. Scorecard: the build row moves from fail-closed hooks to cache-stable harnesses (idle compaction, operator-set cache lifetimes, fixed tool lists, parallel read-only tools); the automate row adds autopilot-denies-on-ask, SolarWinds Avior and EXANTE Codey; the cowork row records Muse Code's trained check-in behaviour and Workday tools inside Claude; the chat row records the consumer-before-admin skills rollout.
Revision cycle 1 (editorial board): the technique is now credited to Manus (July 2025) and to Neuralwatt's own 'What you can do' list, with deepseek-harness named as Neuralwatt's exemplar and the first-changed-byte diff attributed as Neuralwatt's stated next step; what the issue adds (the release-side convergence, the Hacker News case, the regression framing, the task-length-squared extrapolation) is said to be the issue's. Anthropic's cache-read price corrected in four places from a tenth to a twentieth (Sonnet 5.5 $0.10 against $2; Opus 5.5 $0.20 against $4) and DeepSeek's fiftieth added. Neuralwatt's production claim narrowed to the two causes it confirmed in clients; the 1.6-3% and 8-11% bands restated as this issue's division of Neuralwatt's single range; 'one hour for Anthropic's default' corrected to 'one hour in Claude Code'. Cockroach Labs' denominator (7 reverts in 1,238 merged PRs) added and the read rewritten around the missing human-authored comparison. The Copilot CLI 'ask' and Cursor back-off cache claims withdrawn as speculation. Headline shortened; the action moved to the end of the first paragraph; the Claude Code entry leads with the two operator-facing changes; the Meta entry split into model, demo and harness. Recaps added for fail-closed hooks, the friction ratio, the Adversa chain, Donchev's figures and Guardian V2; glosses added for prompt cache, prefill, KV cache, CCI, ACP, W3C trace context and Code Mode; the Neuralwatt figure set is now printed in full only in the technique example and the proof-of-value entry.
Evidence labels: EXANTE, Cockroach Labs and Neuralwatt are practitioner_report (first-party or provider-side with stated windows and no independent replication); SolarWinds' 5x is vendor_claim with no methodology; the ChatGPT GitHub-connector chain is practitioner_report because OpenAI has not confirmed it; Pillar's OpenCode RCE is confirmed because it is fixed and disclosed. Cursor's 5x environment-load figure, Meta's 20%/25% Spark 1.3 efficiency figures and Hermes' commit counts are vendor-reported at point of use.
Fact homes: API rate cards and cache-read prices (Argon, Muse Wonder, DeepSeek, Sonnet 5.5) live in the Model Pulse; Workday's Flex Credit meters, OpenAI's enterprise rate card and Microsoft's Copilot credit cap live in The Application Layer; the energy and power implications of harness-driven prefill live in the AI Stack Weekly's power lens. This issue carries the headline numbers from each and points to the home for the rest.
Firewall and scope: all sources are public; the technique's thresholds (5% uncached alarm; 1.6-3% stable band; 8-11% leaky band) and the task-length-squared framing are this issue's working figures and extrapolation derived from Neuralwatt's published ranges and mechanism, not Neuralwatt's recommendations. The Manus post, the deepseek-harness walkthrough and the Cockroach Labs PR count were supplied by the editorial board's source checks rather than the graded packet and are labelled by source at point of use.