Access
What a model is allowed to touch has shaped AI as we use it more than the weights or the benchmarks have. Here is that whole surface, drawn as the one Windows app that was already a tree of what a machine can reach.
Click a device for its properties. The graph is drawn from the table further down this page, so it degrades to that table with scripting off, and an agent reading /access.md gets the whole thing as prose, bets included.
Sixty-eight nodes. Each one is a flavor of access, named for what it reaches, so a node outlives the vendor that currently occupies it. Products hang off the nodes as examples, and every node that isn't finished carries a dated bet.
Five states, all of them Device Manager's own. Installed works and something depends on it. A yellow bang works badly enough to matter. An unknown device is present on the bus with no driver, which is where somebody is actively building. Disabled is the one worth reading twice: in Device Manager a red X meant the device was there and switched off, which is exactly what an access looks like after the ecosystem passed it over. And a device can be not present at all, describable but attached to nothing, which is where the speculation lives. Those are hidden until you ask for them, under View.
Dates are month-level where the month is establishable and year-level where it isn't, marked with a ~. I would rather show you a coarse date than a confident wrong one.
Read it the way you'd read a tech tree in a game, because the branches behave like one. Some are sequential: you cannot take the file system before code execution, and the Properties sheet on any device shows its full prerequisite chain. Some are zero-sum, drawn as amber double-ended lines, where investment in one branch is exactly what stops the other being maintained. Some are unexplored, the phantoms nobody has attached. And some are ignored, already built and switched off. Every device previews what it buys and what it costs on hover, because a pick with no downside is a pick nobody had to think about.
Why access beats capability
Model generalization is worse than it looks from the outside. Pattern matching across that many dimensions builds correlations out of bad priors and coincidence, and correlation still isn't causation. So you make a model right about a specific situation by handing it that situation. Better priors are the slow road to the same place.
That reframes every node on this board. Access substitutes for the generalization the model doesn't have, which is why one log line beats a day of careful reasoning about what the bug probably is, and why Feedback is the most underbuilt branch here.
The access that would make the rest of this board smaller
Every node here exists because the model keeps nothing that happens to it. The log, the failing test, the page, the production trace: all of that is access standing in for a lesson the weights never hold on to. Close that loop and a good deal of this board becomes optional, so weight-level learning is the one entry that could undercut the whole premise. It gets two nodes, because two different things are being asked for and only one of them is hard.
Editing its own weights is the temporary version: fit the parameters to the task in front of you, use them, discard them. It works. An 8B model doing this scored 53.0% on the ARC public validation set in Nov 2024, roughly six times its fine-tuned baseline, and 61.9% ensembled with program synthesis, which was the average human score. Google has built the same idea into two architectures since, Titans in Jan 2025 and Nested Learning's HOPE on 7 Nov 2025. An agent can't reach for any of it, because a lab makes that architecture choice before anyone sees the model, which is the unknown-device state exactly.
Weights that keep the lesson is the durable version, and the surprise is that it shipped at an editor company rather than a lab. Cursor's Tab model has trained on live accept and reject signal since 12 Sep 2025, across 400 million requests a day, rolling a fresh checkpoint every 1.5 to 2 hours. The same loop reached Composer on 26 Mar 2026 on a five-hour cycle. The measured gains are small and real: 21% fewer suggestions at a 28% higher accept rate on Tab, and on Composer 2.28% more agent edits surviving in the codebase against 3.13% fewer dissatisfied follow-ups.
Read what that loop returns, though, because it closes at the population. Your rejected completion improves the model everyone gets five hours later and teaches your agent nothing about your codebase, so the thing every session starts without is still the thing nobody ships. That is why it carries a yellow bang instead of sitting in the installed column, and why Autobiographical continuity is still a phantom beside it. The industry's answer to a model that cannot keep a lesson has been to put the lesson in the context window and pay for it again every session, which is why Personal memory is the node it competes with rather than the node it depends on.
The loop stays open for an ordinary reason, and the reason is certification. A frozen checkpoint is what makes an eval mean something, a safety case hold, and a rollback exist, and weights that move in deployment have none of the three. So continual learning sits in the same category as Release authority: withheld on purpose, by people who could ship it, which puts it on the trust axis rather than the research one.
Trust is the gating dependency
The vertical axis is blast radius, from reading what it's handed to moving atoms. Every rung up buys capability and spends trust, and that's why the top of the board is thin: every blocker up there is an authorization question. Secrets, identity, and money are one dependency chain, and that chain shows up as a roadmap when Cloudflare wires agentic commerce onto the same Web Bot Auth it uses to sort crawlers.
The gaps are the interesting part
Fifteen devices carry a yellow bang, twelve have no driver, ten are switched off, and thirteen are not present at all. A few are genuinely hard. Most are unbuilt because the thing they'd need is a standard, an index, or somebody's permission, and no single vendor can ship any of the three alone.
The two states people skip are the ones I'd look at first, and together they are 23 of the 68 devices here. That weighting is deliberate. The installed column is where the conference talks are; the other two are where the information is.
Switched off: ten answers nobody wanted
Disabled means the ecosystem built the thing and then declined to use it. Ten nodes are in that state and the dates are the point: 1993, 1999, 2001, 2002, 2004, 2005, 2011, 2011, 2014, 2024. Every current complaint about agent access has a corpse behind it.
Agents drive desktop apps by looking at screenshots, and those apps published dictionaries of their own verbs in 1993. Tool discovery has no index, and WSDL plus UDDI shipped one in 2001. Agent-to-agent messaging is being specified now, and XMPP standardised federated addressing and capability discovery in 2004. Agents poll instead of subscribing, and Atom was an RFC in 2005. Sites are asked to declare their AI preferences, and P3P did machine-readable policy in 2002 and was formally obsoleted.
Relitigating any of them buys nothing. The useful move is to notice that every one failed the same way: it needed a consumer with clout and got a standards document instead. That is a much better predictor of which current proposal survives than how good the proposal is, and it is why the newest nodes on this board carry my least confident bets.
Not present: where the speculation lives
Not present is an access precise enough to describe with nothing attached to it, which is the only honest place to guess. Thirteen nodes, hidden until you ask for them under View, and they fail for three different reasons worth telling apart.
Some are blocked on permission, with the capability already in hand. Ambient sensing needs no research at all; the hardware and models exist and the people in the room never agreed. Organizational memory means reading things people said while assuming nobody would keep them. Only consent unblocks these, and treating them as engineering problems is how you build something nobody is allowed to ship.
Some are blocked on nobody being paid to build them. The discard pile needs a team to store its failures; simulation needs consequence-free rehearsal that robotics has funded for a decade and software has not. These are the ones I would actually go build, because the obstacle is attention rather than physics.
And one is withheld on purpose and should stay that way. Release authority is the gap between a passing test and a running service, and almost every team draws that line deliberately. This site is a worked example: its CI token cannot write, no deploy path may create infrastructure, and only a machine-owned branch can publish, specifically so the automation cannot reach production. That node sits empty because the map is recording a decision, which is the whole reason to have a "not present" state instead of a "missing" one.
So every unfinished node carries a bet, with a date and a confidence I'm willing to be wrong about in public. High confidence means I'd argue it now. Low means it's a shape I can see and a timeline I can't. The bets are the speculative part of this page and they're labelled everywhere they appear, because a map that quietly mixes forecast into fact is worse than no map.
Under most of these nodes there's a standard doing the deciding
The product layer gets the announcements and the standards layer decides what's actually possible, usually two years earlier and in a draft with a revision number. Three of the nodes here are standards work rather than products: a vocabulary for crawl preferences at the IETF, in-page tool declaration in a W3C community group, and the accessibility tree, which shipped in 2014 for entirely different reasons and became the thing computer-use agents lean on.
Reading the drafts is worth it, because the failure mode is legible in them well before it's legible in a product. AIPREF is the clean example: the vocabulary half is moving along the Proposed Standard track, while the half that says how to attach it to a page lapsed under the six-month rule and hasn't been revised. That asymmetry tells you the fight is over who has to honour it; what to express is already settled. And WebMCP's API moving off navigator onto the document mid-origin-trial is the ordinary sound of a spec still deciding what it is.
The pattern worth taking from this: the web platform keeps building the machine-readable surface first and the consumer never arrives. That is why Declared surfaces is its own branch here, and why most of that column is switched off. Seven of its ten nodes are red X, every one of them predates the agent era, and the oldest is from 1999. Each was built for a consumer that turned out not to want it, which is a bad bet on timing more than a bad build. Agents are the first plausible consumer any of them has ever had.
Two of them are worth reading against their live descendants, because the board puts them side by side on purpose.
Self-describing APIs is the sharpest, because that one got tried. Plugins read OpenAPI directly in 2023 and were retired inside a year, and MCP took the slot by shipping a protocol and a client instead of a description. Service contracts and registries is the same lesson twenty-five years earlier: WSDL plus UDDI is precisely the schema-and-index pair that Tool discovery carries a yellow bang for lacking today. The generalisation is uncomfortable. A machine-readable artifact with no runtime attached loses to a worse artifact that arrives with one, and the registry is never the hard part.
Machine-readable policy is the one that should make you cautious about the newest node on this board. P3P let a site state, in a form a machine could act on, what may be done with what it collects. It became a W3C Recommendation in 2002, one browser implemented it, sites published claims nobody checked, and it was formally obsoleted. Stated crawl preference is now attempting the same thing for AI training, and since P3P was already expressive, the difference has to come from a consumer with clout: a CDN or a court rather than a working group.
MCP is the counterexample that proves the rule, and it is worth holding up beside the corpses. It shipped a client before it shipped a committee: a protocol with a runtime attached in Nov 2024, ten thousand public servers, and only then, in Dec 2025, a donation to a Linux Foundation body whose co-founders are the two labs competing hardest with the one that wrote it. Every dead node in this column did that in the other order.
What a year of vendor release notes actually added
The dates on this board used to come from announcements, which is a biased sample: an announcement is a thing somebody wanted you to notice. So the pass behind this revision read the boring surface instead, entry by entry, across every lab that keeps a public log. Anthropic's weekly Claude Code digest, OpenAI's API changelog and its Codex notes, Google's Gemini API release notes, and for the open-weight labs the model cards, which is where Moonshot, DeepSeek, Qwen, Mistral and Z.ai make their agent claims because none of them ships a platform changelog to make them in.
Three findings, and none of them is a model.
The 2026 additions cluster on three nodes, and all three make an existing access cheaper rather than granting a new one. Permission stopped being a click and became a classifier. The context window stopped being a wall and became a budget the agent rewrites. Speed stopped being a property of the model and became a line item you buy at 2x the price for 2.5x the rate. Two of those were not on this board before this pass and are now, which is the honest cost of having drawn it from announcements the first time.
Feedback got almost nothing, again. Across roughly a year of entries, the branch this page already called the most underbuilt picked up an eval product that is being switched off, two dashboards that watch the vendor's agents rather than yours, and one genuinely good tool that streams a running process into the conversation. That is it. The one closed feedback loop of the period turned up outside the sample entirely, at an editor company reading its own traffic rather than in a lab's changelog, and it is on the board now as Weights that keep the lesson. I would rather have found the argument wrong; a year of concentrated vendor attention going almost everywhere else is stronger evidence for it than the argument was.
And the platform layer is churning faster than the access layer under it. In one quarter: Meta shut its Llama API on 6 Jul 2026, Google retired Gemini CLI on 18 Jun 2026, and OpenAI removes the Assistants API, its first agent-shaped product, on 26 Aug 2026, alongside its visual agent builder and its eval platform on 30 Nov. Not one flavor of access on this board went with them. That is the premise of the whole page getting demonstrated three times in ninety days, and it is the reason the nodes are named for what they reach rather than for who currently sells it.
the one path that isn't a dependency
Prompt injection sits off this board's graph entirely. Turn on Trace the injection path and the flow routes through the context window, because that's where untrusted tokens and privileged actions actually meet. Every arrow in is a page an agent fetched. Every arrow out is something it can do. Nothing in the dependency structure separates them, which is the whole problem, and it's why Secrets is the node where the good answer turned out to be never letting the agent read the credential at all.
Device list, flat
The same devices, in the order the branches appear above. This table is the source the graph is built from: node prose, dates, dependencies, and bets all live here and nowhere else.
| Device | State | Blast radius | First seen | Needs | What it buys, what's in the way, the bet | Examples |
|---|---|---|---|---|---|---|
| Text in the context window | installed | reads what it's handed | Nov 2022 | nothing | The original access, and still the only one that acts directly. Every other node on this board is a way of getting more of the world into this one buffer, which is also why it's the single place trust boundaries collapse. Costs: everything shares one buffer, so every trust boundary on this board collapses here. Being the junction is the vulnerability. | ChatGPT, 30 Nov 2022; Claude |
| Uploaded files | installed | reads what it's handed | ~2023 | context window | The first time a model saw something that wasn't typed at it. Cheap, and it moved the product from conversation to work. Costs: an uploaded file is attacker-controlled text wearing a filename, and it was the first untrusted input most agents ever got. | PDF and image attachments, spreadsheets, Projects |
| Vision input | installed | reads what it's handed | Sep 2023 | uploaded files | Pixels in, which is the access every screen-shaped thing on this board is built on: computer use is this node plus a cursor, and the browser surface is this node plus a network. Audio arrived the same season and belongs here too. Easy to overlook because it reads as a modality rather than a permission, but it is what let a model be pointed at software that was never designed to be read by one. Costs: pixels are the lossiest possible interface to a system that has an API. Cheap to point at anything, expensive to be right about. | GPT-4V in ChatGPT, Sep 2023; voice the same season; Claude 3 vision, Mar 2024; a screenshot as context |
| Personal memory | yellow bang | reads what it's handed | ~2024 | retrieval into context | Access to you, accumulated without being asked for. Distinct from a file system because you do not curate it, and distinct from organizational memory because this one actually shipped. In the way: you cannot read it, port it, or reason about what it inferred. A store that shapes every answer and shows you almost none of itself is a strange thing to have built first. Bet: memory becomes exportable under regulatory pressure rather than competitive pressure, and until it does it is the deepest moat in consumer AI precisely because leaving costs you a history you never had a copy of. | ChatGPT memory, 2024; Claude memory; per-project context |
| Web search | installed | reads the world | Mar 2023 | context window | The node that made searching less stupid, in both directions: the model got current facts, and the query stopped having to be keywords. Costs: your answer inherits the ranking of whatever it queried, incentives included, and the model cannot see the ranking. | ChatGPT plugins including Browse, 23 Mar 2023; Exa; Brave and Tavily APIs |
| Retrieval into context | installed | reads the world | ~2023 | uploaded files | Getting the right 20 pages of a corpus into the buffer. Whether that's better served by embeddings or by ripgrep is still a live argument, and agents that just grep keep winning more of it than the 2023 consensus expected. Costs: the retriever quietly decides what the model is allowed to consider, and it fails as a false negative nobody observes. | Embedding retrieval, grep in an agent loop, Projects |
| Fetch and scrape | yellow bang | reads the world | ~2024 | web search | The web was built to be read by a browser a person is watching. Agents read it anyway, so the middle layer became a paid product: somebody else runs the crawler, eats the blocks, and sells you clean text. In the way: no standard for what an agent may take, bot detection priced around $0.05 a check, and a bypass market that claims 95%+ success against challenge pages. This trades directly against Stated crawl preference: every increment of taking capability raises the value of a mechanism for refusing, and the two have been escalating against each other for two years. Bet: the scrape layer consolidates into three or four paid indexes by the end of 2027, and access terms move from robots.txt to a priced allowlist. The tell will be the first large publisher who blocks everyone and sells one exclusive feed. | Parallel, Exa, Firecrawl, know.fast at a flat $0.01 a URL |
| Browser as a first-class surface | yellow bang | changes its own machine | ~2025 | fetch and scrape, computer use | Materially worse than tool access and file-system access right now, and the gap is widening. An agent gets pixels and a DOM when what it needs is a command. In the way: every site is a bespoke API, discovered at runtime and then thrown away, so the same workflow gets rediscovered on every run. Bet: the browser stops being the interface by 2028, because paying to re-derive the same workflow on every visit is a tax nobody wants. webcmd's compile step is the right shape from the agent's side, and WebMCP is the same answer from the site's side, so the fix has a shape and the open question is who authors it. Nobody has, yet. What 2026 did instead was absorb the browser into the harness, so the coding agent, the editor and a live browser became one surface at three separate vendors. That makes the loop tighter and leaves the tax exactly where it was. | webcmd, which compiles discovered workflows into commands and reports 90% fewer tokens and 8x fewer turns on repeats; Playwright MCP; Browser Rendering; a browser built into the coding agent itself, Jul 2026; Antigravity's agents driving editor, terminal and an integrated browser as one surface; Gemini Managed Agents browsing from a hosted sandbox, 19 May 2026 |
| Bulk corpus access | yellow bang | reads the world | Jul 2026 | retrieval into context | Some corpora are load-bearing for model behavior and nobody priced them that way. cdnjs is 48.3% of the JavaScript CDN market with no API keys and no rate limits, and Cloudflare's own migration note says the plain part out loud: models reach for it because their training data is full of it. In the way: the access is free until the day it isn't, and nothing in the stack makes that dependency visible. Bet: within two years somebody meters a corpus that models depend on, and the bill lands on whoever ships the model rather than whoever fetched the file. cdnjs is the cleanest candidate precisely because it's free. | cdnjs on Workers, 30 Jul 2026: 1.1TB packed, 9B requests a day |
| Cheaper bytes on the wire | unknown device | reads the world | Apr 2026 | fetch and scrape | If an agent refetches the same shape of document a thousand times, the second fetch should cost almost nothing. Shared compression dictionaries get a near-identical 272KB bundle down to 2.6KB, and Cloudflare shipped the idea under the title "compression for the agentic web." In the way: phase 3 hands dictionary generation to the network, which means the CDN learns which of your resources change and how. Bet: default-on at the CDN by 2027 with nobody configuring it, which is phase 3 working as designed. Watch whether that deploy-cadence telemetry quietly becomes a product of its own. | RFC 9842 Compression Dictionary Transport, experimental in Chrome since 117; Cloudflare's shared dictionaries, beta 30 Apr 2026; this site already ships phase-1 dcz deltas by hand |
| Structured data in the page | disabled | reads the world | Jun 2011 | context window | The web already ships a machine-readable version of itself. schema.org turned fifteen this year, JSON-LD is on a large share of commercial pages, and agents overwhelmingly read the rendered text instead. Passed over because: the visible text is what humans check, so it's the copy that stays true, and a machine-only channel is a second thing to keep honest for no reward. Bet: it stays passed over. Rendered text keeps winning, and the effort that would have gone into fixing this goes into models that read pages the way people do. | schema.org, Jun 2011; JSON-LD; microformats; /lens shows you both layers of any URL |
| The accessibility tree | yellow bang | reads the world | Mar 2014 | context window | The best agent interface on the web was built for screen readers and predates the agent era by a decade. Every browser already maintains a semantic tree of roles and labels beside the visual page, and it turned out to be the cheapest way for an agent to know what a control actually is: Playwright returns it as a YAML snapshot, and computer-use agents ground their pixels against it rather than guessing from shape. In the way: its quality is somebody else's accessibility diligence. An unlabelled button is invisible in the tree, so the agent falls back to screenshots and burns seconds and thousands of tokens working out what it is looking at. AOM, the API that would let a page inspect and repair its own tree, has sat as a draft for years. Bet: agent traffic becomes the first commercial reason anyone fixes ARIA, which is a strange and good outcome. Expect accessibility budgets approved on agent-conversion grounds by 2027, and expect nobody to enjoy saying that out loud. | ARIA 1.0 as a W3C Recommendation, Mar 2014, on an MSAA lineage from 1997; Playwright accessibility snapshots; AOM, still a WICG draft |
| Stated crawl preference | unknown device | reads the world | ~2025 | fetch and scrape | robots.txt can say who may crawl and cannot say what they may do with what they took, which is the entire fight. The IETF chartered a working group to fix exactly that: a vocabulary for AI usage preferences, plus a way to attach it to content. In the way: the half that matters is the half that stalled. The vocabulary draft is on the Proposed Standard track at revision 06, with train-ai and search categories and plain y/n values, while the attachment draft that defines the Content-Usage header and its robots.txt rule lapsed under the six-month rule after revision 04 in Oct 2025 and has no newer revision, against an Aug 2026 milestone to reach the IESG. A vocabulary with no way to attach it is a dictionary. Bet: it ships late and gets adopted anyway, because the alternative is every crawler negotiating bilaterally forever. The enforcement will come from the edge rather than from the header, and the header will get cited as though it did the work. | IETF AIPREF; draft-ietf-aipref-vocab; robots.txt, 1994; X-Robots-Tag |
| The Semantic Web | disabled | reads the world | ~1999 | context window | The original plan, and the most thoroughly not-taken path on this board. A web of typed entities and stated relations, queryable like a database, with reasoning over it. Two decades of standards, real deployments, and genuine intellectual weight. Passed over because: it asked every author to model their domain correctly and agree with everyone else's model, and the payoff arrived only once enough of them had. Ordinary prose asked for nothing and got read anyway. The branch that actually won those points is Retrieval into context: statistical retrieval made authored structure unnecessary rather than wrong, which is the harshest way to lose an argument. Bet: it stays dead in its own name and wins under another. Language models absorbed the goal (ask the web a question, get an entity back) by abandoning the method entirely, which is the least satisfying possible resolution for everyone who built it. Watch for the shape returning as generated structure rather than authored structure. | RDF, ~1999; OWL, 2004; SPARQL, 2008; linked data. Schema.org is the lightweight survivor, and it is next door on this board wearing the same red X |
| Service contracts and registries | disabled | reads the world | ~2001 | context window | Formal machine-readable service contracts, plus a registry to look them up in. Set that sentence next to Tool discovery, which carries a yellow bang on this board for wanting exactly those two things. It was built, standardised, deployed inside large enterprises, and abandoned. Passed over because: the contracts were verbose, the registries were empty in practice, and REST plus a human-readable doc page beat it decisively on the only metric that mattered, which was how long until a developer's first successful call. Bet: the MCP registry rediscovers this ceiling rather than the standard. The hard part was always the upkeep: nobody maintains a registry entry for a service they can already document in a README. | WSDL, ~2001; UDDI registries; SOAP. Every problem Tool discovery has today, attempted twenty-five years ago |
| Machine-readable policy | disabled | reads the world | Apr 2002 | context window | A site stating, in a form a machine can act on, what may be done with what it collects. This is the direct ancestor of Stated crawl preference two rows down, and it is the reason to hold that node's optimism loosely. Passed over because: almost nothing consumed it, one browser implemented it, sites published claims nobody verified, and it was formally retired. The failure was enforcement: a machine-readable promise with no auditor behind it is a decoration, however expressive. Bet: AIPREF only avoids this fate if a consumer with clout enforces it, which means a CDN or a court rather than a working group. On the current trajectory it is P3P with better XML, and I would rather be wrong about that in public. | P3P, W3C Recommendation Apr 2002, obsoleted 2018. Do Not Track went the same way |
| Self-describing APIs | disabled | reads the world | ~2011 | context window | Most of the web's APIs have carried a machine-readable description of themselves for well over a decade, and the industry maintains those documents anyway, for its own docs and clients. Passed over because: this one got genuinely tried and then dropped. ChatGPT plugins consumed OpenAPI directly in Mar 2023, were deprecated by Apr 2024, and MCP took the slot by shipping a protocol and a client rather than a description. A description without a runtime is a document, and a document is not an integration. Bet: OpenAPI comes back as the thing that GENERATES an MCP server rather than the thing an agent reads, which is already happening quietly and gets almost no credit for it. | Swagger, ~2011; OpenAPI 3.0, Jul 2017; ChatGPT plugins, Mar 2023, deprecated Apr 2024 |
| Feeds | disabled | reads the world | Dec 2005 | fetch and scrape | The oldest node on this board. The web has had a push channel for "something changed here" for two decades, it is still deployed almost everywhere, and agents rebuild it every day out of polling plus scraping plus hope. Passed over because: feeds lost the consumer war to timelines, and agent tooling inherited the habit of treating the web as pages to fetch rather than streams to subscribe to. Bet: this returns the moment standing execution is cheap, because polling a feed is the cheapest possible wake-up and the two halves of "an agent noticed something happened" are both already built and neither is used. | RSS 2.0, 2002; Atom, RFC 4287, Dec 2005; WebSub, W3C Recommendation 2018 |
| Published discovery surfaces | disabled | reads the world | Sep 2024 | context window | A site can hand an agent a map of itself: llms.txt, /.well-known/ documents, agent cards, an SVCB record in DNS. The publishing side is solved and nearly free. Passed over because: consumption never arrived. This site publishes all four and effectively nothing reads them, which puts it in the same lineage as robots.txt in 1994 and sitemaps in 2005, both of which only mattered once one big consumer committed. Bet: stays a courtesy until a major agent vendor commits to reading it, and none has. If one does, it becomes table stakes in a quarter. | llms.txt, Sep 2024; this site's; /.well-known/agent-card.json; DNS-AID SVCB |
| Ambient sensing | not present | reads the world | not yet | vision input | Vision input is an artifact somebody chose to hand over. This is the unbroken stream nobody curated: a room, a commute, a workday, continuously. The capability gap is nearly zero, since the hardware and the models both exist, which is exactly what makes it a phantom rather than a frontier. What is missing is permission, and no amount of engineering supplies that. Bet: it arrives narrow and consented first, in settings where the recording was already happening and already normal, and the general case stays blocked for a decade on a problem that is social rather than technical. The interesting failure mode belongs to everyone else in the room, who never agreed to anything; surveillance of the wearer is the easy half. Costs: consent you cannot obtain from a room. The wearer agrees and nobody else gets asked. | Wearables and always-on assistants, meeting recorders as the socially accepted beachhead |
| Organizational memory | not present | reads the world | not yet | retrieval into context | Every codebase records what was decided and almost none records why. The reasoning lives in a call nobody transcribed, a thread that scrolled, and three people's heads, which is exactly the context that would stop an agent from cheerfully undoing a deliberate choice. Bet: whoever owns the meeting recording owns this, so it arrives inside a suite rather than as a product. It hasn't shipped because the useful version means reading things people said while assuming nobody would keep them, and that's a consent problem before it's an engineering one. Costs: reading what people said while assuming nobody would keep it. The useful version is a consent problem before it is a retrieval problem. | Nothing does this well. Meeting recorders, decision logs, and ADRs are the nearest approximations |
| Reasoning tokens | installed | reads what it's handed | Sep 2024 | context window | Access to its own thought space, and the only node here that grants access to something inside the model rather than outside it. Costs: latency and tokens, both linear in how much it thinks. Every reasoning budget is a bet against Inference speed. | o1-preview, 12 Sep 2024; extended thinking |
| Recursion and revision | installed | reads what it's handed | Feb 2025 | reasoning tokens | Thinking about the thinking, then spending more of it where it pays. Turns a single forward pass into a budget you can allocate. Costs: spends compute on self-doubt a confident wrong answer would have skipped, and can talk itself out of a correct first pass. | Claude 3.7 Sonnet extended thinking, 24 Feb 2025; effort controls; self-critique loops |
| Editing its own context | yellow bang | reads what it's handed | Dec 2025 | context window | The context window has been the one hard wall on this board since Nov 2022, and what arrived was write access to the buffer. Compaction lets a run rewrite its own history and keep going, which turns the wall into a budget the agent spends. Every long-horizon agent that works at all works because of this, and it ships in release notes as a maintenance item. In the way: the agent chooses what to lose, and it loses it silently. Nothing separates the run that kept the constraint from the run that compacted it away, so the failure surfaces later wearing the costume of a model that simply got worse at the task. Bet: compaction becomes the layer people tune the way they tuned retrieval in 2023, and the version that wins is explicit and inspectable rather than automatic. The tell will be the first product that shows you what it dropped. Costs: a summary is a claim about what mattered, written by the thing that is about to act on it. | OpenAI's client-side /responses/compact, 11 Dec 2025; server-side compaction, 10 Feb 2026; native compaction in GPT-5.4, 5 Mar 2026; Claude Code's Summarize up to here, May 2026; Codex remote conversation compaction, Aug 2026 |
| Editing its own weights | unknown device | reads what it's handed | Nov 2024 | reasoning tokens | Reasoning tokens turned inference-time compute into a budget. This spends that budget on the parameters instead of the prose: fit the weights to the task sitting in the context window, answer with them, throw them away. It is the sibling of Editing its own context and the sharper of the two, because a summary is a claim about what mattered and a gradient step is the model actually changing its mind. In the way: it works, and nothing can reach it. Test-time training is a decision a lab makes about an architecture before the model ships, so there is no knob, no API, and no way for an agent mid-task to decide this problem is worth a gradient step. Bet: this arrives dressed as a context-window feature rather than a training one, because that is the shape the market already buys. The tell is a vendor selling "it learns your codebase during the session" with no fine-tuning job anywhere in the product. Costs: weights fitted to the input are weights fitted to whatever the input contained, and nothing in the procedure separates a task demonstration from a page that wanted to be learned. | Test-time training on ARC, 11 Nov 2024: an 8B model at 53.0% on the public validation set, about six times its fine-tuned baseline, and 61.9% ensembled with program synthesis, which was the average human score. Google builds the update into the architecture twice, in Titans, Jan 2025, and in Nested Learning's HOPE, 7 Nov 2025. SEAL, Jun 2025, has a model write its own finetuning data and runs into catastrophic forgetting doing it |
| Subagents | installed | reads the world | ~2025 | recursion and revision, tool calls | Access to more context windows than one. Parallelism is the payoff, and isolation is the actual mechanism: a subagent's failure and its 200K of noise both stay in its own buffer. Costs: isolation cuts both ways. A subagent cannot see what you know, so it rediscovers, contradicts, and reports confidently. | Task fan-out, agent workflows, orchestrator patterns; subagents spawning their own subagents behind a five-level cap and running in the background by default, Jun 2026; script-driven workflows orchestrating hundreds of them, May 2026; multi-agent orchestration inside the Responses API, 9 Jul 2026; Kimi K2.6's claim of 300 subagents across 4,000 coordinated steps |
| Standing execution | yellow bang | reads the world | Jan 2025 | tool calls | Access to the clock, which is the only node here that grants initiative. Every other access on this board is request-scoped: something happens because a person asked just now. A scheduled agent can act because a Tuesday arrived. In the way: nobody has worked out what an unprompted agent is allowed to do, so the shipped versions are deliberately timid, and the interesting version needs a trigger richer than a clock. Bet: cheap event triggers carry this further than better scheduling does, and the first credible version rides something that already exists: a feed, a webhook, a repo notification. Pair this with the Feeds node and the whole shape is sitting there unused. Half of that has now landed: cloud routines fire an agent from a schedule, a repository event, or an API call, which is the trigger set the bet named, minus the feed. The unused half stayed unused, and it is the half the web already ships. | ChatGPT Tasks, Jan 2025; Routines firing cloud agents from a schedule, a GitHub event, or an API call, Apr 2026; webhooks replacing polling for long-running operations, at OpenAI in Jun 2025 and in the Gemini API on 4 May 2026; this site runs its own crawl, census, and webmention crons |
| Federated messaging | disabled | changes someone else's | Oct 2004 | context window | Addressable identities on independent servers, exchanging structured messages across organisational boundaries, with presence and capability discovery built in. An IETF standard since 2004. That is the transport layer Peer agents is currently specifying from scratch. Passed over because: federation lost to platforms for the ordinary commercial reason, and the largest deployments that did adopt it eventually closed their federation off once they had the users. Bet: agent-to-agent rediscovers every hard problem this already solved (addressing, presence, capability negotiation, spam from a fluent stranger) and solves them worse, because the constituency for a new protocol is vendors and the constituency for federation was never anyone with a business. | XMPP, RFC 3920, Oct 2004; Jabber; presence and service discovery. Several large platforms adopted it and then defederated |
| Peer agents | unknown device | changes someone else's | Apr 2025 | subagents | Subagents are your own children, spawned and trusted by construction. This is somebody else's agent, with its own operator, its own instructions, and no reason to share your goals. In the way: adoption is thin, and the reason is structural rather than technical. A peer is a negotiation, and nobody wants to debug a disagreement between two probabilistic systems acting for different principals. It is also the sharpest untrusted-input surface on the board, because the other party is fluent. Bet: this settles into agent-to-SERVICE rather than agent-to-agent. MCP won that shape already, and a protocol for peers gets used mostly as a transport between components one company owns. Sixteen months of release notes have gone the bet's way and it is worth saying so plainly: every multi-agent capability that actually shipped in 2026 is intra-vendor, from multi-agent orchestration inside one API to a CLI that fans out its own background agents to a model card advertising 300 subagents and 4,000 coordinated steps. Coordination arrived. Peerage did not. | A2A, announced Apr 2025 and donated to the Linux Foundation that June. This site publishes an _index agent record and deliberately not _a2a, because a dangling pointer passes a scanner and breaks the agent that believes it |
| Self-introspection | not present | reads what it's handed | not yet | reasoning tokens | Reasoning tokens gave a model access to its own thinking as text. This would give it access to its own state as a measurement: how confident it actually is, which of two readings it is torn between, whether it is pattern-matching or reasoning. Every other node on this board exists because generalisation is unreliable, and this is the only one that would let a model report on that unreliability from the inside instead of everyone inferring it from outside. Bet: arrives first as a safety instrument for labs and only later, if ever, as something an agent can consult about itself mid-task. The blocker is Goodhart rather than interpretability: a number an agent can read is a number it can be trained to game. Costs: the measurement degrades exactly as it becomes load-bearing. | Interpretability probes, calibration research, uncertainty estimates. Nothing an agent can query about itself at runtime |
| Autobiographical continuity | not present | reads the world | not yet | personal memory | Personal memory is about you. This is the agent's access to its own history: what it tried in March, what it broke, what it already learned about this codebase the hard way. Right now every session starts as a competent stranger, and the cost is invisible because nobody bills you for advice you already paid for once. Bet: the first real version is a side effect of something else, most likely a log everyone kept for auditing that turns out to be worth reading back. It will be marketed as something other than memory: an agent that stops making the same suggestion for the fourth time, and that will be the whole demo. Costs: a long record of its own actions is a long record of its own mistakes, and nothing in it says which are still true. | Session transcripts nobody re-reads, agent logs kept for compliance. Distinct from user memory, which shipped |
| Escalation to another model | not present | reads the world | not yet | subagents | A subagent is another instance of you. A peer is somebody else's agent. This is a third thing: a model deciding this problem is above its weight and handing it to a stronger or more specialised one, then using the answer. Routing exists, but it is imposed from outside by a dispatcher; this node is the model itself knowing its own ceiling. Which makes it downstream of Self-introspection, and that is why it is still a phantom. Bet: shows up as cost optimisation rather than capability, because the version that saves money (a cheap model escalating rarely) is far easier to sell than the version that admits a limit. Costs: admitting a ceiling is a product decision before it is a technical one, and the honest version costs the vendor the impression of capability. | Model routers and cascades, all dispatcher-driven. Nothing where the model elects to escalate on its own read of the problem |
| Inference speed | unknown device | reads what it's handed | ~2026 | reasoning tokens | Speed decides which access is affordable, so it belongs on this board even though it isn't a permission. A 40-turn browser loop is a different product at 20ms a token than at 200, and half the nodes flagged unbuilt here are really nodes that don't pencil yet. In the way: a cost curve, which is why it moves fastest. Bet: within 18 months the interesting agent products are the ones that were previously too many turns to afford. Cheap turns change architecture more than better answers do. | Cerebras and Groq inference, batch versus interactive pricing. Speed is a priced SKU now rather than a property of the model: priority processing at 2x price from Jun 2025, a fast tier at 2.5x the speed for 2x the money on 30 Jul 2026 and extended past 272K tokens six days later, and a flagship Flash model sold on being four times faster than the frontier rather than better than it |
| Tool calls | installed | changes its own machine | Jun 2023 | context window | Where workflow skeuomorphism came from. We handed models the shape of the software we already had, which got them useful immediately and quietly capped how different their workflows were allowed to look. Costs: workflow skeuomorphism is the price. Handing models the shape of the software we already had capped how different their workflows were allowed to look. | OpenAI function calling, 13 Jun 2023; MCP, 25 Nov 2024, donated to the Linux Foundation's Agentic AI Foundation on 9 Dec 2025 with OpenAI and Block as co-founders; connectors; private MCP over a tunnel so an on-prem server never faces the internet, May 2026 |
| Tool discovery | yellow bang | changes its own machine | Sep 2025 | tool calls | A model can only call what it can find, and what a given tool means shifts from one model to the next, so the same server behaves differently depending on who mounted it. In the way: no single index. Every host ships its own roster and hopes the descriptions carry, and the teams treating tool descriptions as an audience-facing surface the way Resend does are early to something real. The vendors' 2026 answer is search instead of an index: keep the roster out of the prompt and let the model query for a tool when it needs one, which makes a huge catalog affordable while settling nothing about who publishes it. One client now searches four catalogs at once, local, personal, workspace and remote, and four namespaces is what routing around the problem looks like. Bet: this resolves the way package discovery did, with one registry winning and everyone complaining about it. The official registry is eleven months old and already has competitors, which is the normal early shape rather than a warning sign. | MCP Registry preview, 8 Sep 2025; GitHub's MCP Registry, 16 Sep 2025; tool search that defers a large tool surface until it is needed, in GPT-5.4 on 5 Mar 2026 and in the mini models on 17 Mar 2026; Codex portable agent plugins searching local, personal, workspace and remote catalogs at once, 7 Aug 2026; Resend's answer-engine work |
| In-page tool declaration | unknown device | changes someone else's | Feb 2026 | tool calls, browser as a first-class surface | The direct answer to the browser node's whole problem. Instead of an agent inferring a site's workflow from pixels on every single visit, the page declares its own typed, callable tools and the agent calls them. The same idea as MCP, hosted by the document rather than by a server. In the way: it is a W3C Community Group draft rather than a standard, only Gemini in Chrome consumes the tools today, and the shape is still moving. The API moved off navigator onto the document because tools belong to a page, and Chrome deprecated navigator.modelContext in 150 while the origin trial still ships it. Bet: the idea survives and this spelling of it might not. A page-declared tool surface is too obviously right to lose, but a capability exactly one agent reads is a proprietary channel wearing a standard's clothes, and it wants a second consumer before anyone should author against it. | WebMCP, announced 10 Feb 2026; Chrome origin trial 149 through 156 from 18 May 2026; W3C Web Machine Learning Community Group |
| Code execution | installed | changes its own machine | Jul 2023 | tool calls | Code mode: write one program instead of chaining forty calls. The largest single jump on this board, because it converts every other access from a menu into a language. The interesting move in 2026 is abstracting over where that code runs: Cloudflare Computer puts an isolate and a full Linux container behind one interface with a shared filesystem underneath, and targets keeping containers under 10% of the work, which makes the execution environment a dial rather than a decision. Costs: this is the node that makes every authority downstream of it dangerous. Arbitrary code plus one credential is the entire problem in a sentence. | ChatGPT Code Interpreter to Plus, Jul 2023; a hosted shell tool with networking inside a container, 10 Feb 2026, billed per minute from 2 Jun 2026; controlled sandboxes in the Agents SDK, 15 Apr 2026; Gemini Managed Agents running in Google-hosted Linux sandboxes, 19 May 2026; Worker Loader; @cloudflare/computer, 3 Aug 2026, gated, audited and observed by design |
| File system | installed | changes its own machine | Feb 2025 | code execution | Durable state the model can name, list, and revise. Enough of a memory that the context window stops having to be one. The shape it is settling into is a virtual filesystem rather than a real one: Cloudflare Computer backs its with SQLite, populates it from object storage or a git clone, and mounts the same tree into an isolate by binding and into a container by FUSE, so the agent's working directory becomes something you can snapshot and hand to a different runtime. Costs: durable state is durable mistakes, and nothing on this board supplies an undo. | Claude Code research preview, Feb 2025; workspace mounts; artifact directories; Cloudflare Computer's SQLite-backed VFS |
| App scripting dictionaries | disabled | changes someone else's | ~1993 | context window | Desktop applications used to publish a dictionary of their own verbs and objects, and a runtime existed to call them. That dictionary was a typed vocabulary of what the program could do, shipped inside the program, on both major platforms, thirty years ago. Read that against Computer use directly below it, which drives those same applications by looking at pictures of them. Passed over because: the dictionaries decayed as GUIs got richer, nobody was rewarded for maintaining one, and the web arrived and reset the question. What the capability lost was attention. Bet: this returns as the thing agents ask for from native apps, and the ask will be framed as a brand-new idea. The XP-era desktop this page is dressed as had a better answer to agent automation than the 2026 desktop does. | AppleScript dictionaries and Apple Events, ~1993; OLE Automation and COM; Windows Script Host. The accessibility APIs that computer use leans on are what survived |
| Computer use | yellow bang | changes someone else's | Oct 2024 | code execution, vision input | Access to your cursor, which is the universal adapter: anything a person can do, in any app, with no integration. Strictly this node is vision input plus a pointer, and reading it that way explains its ceiling: it inherits every weakness of looking at a screen instead of querying a system. In the way: it runs at pixel rate, it has no undo, and it can't prove what it did afterward, so the audit trail is a screen recording. Bet: stays the fallback rather than becoming the default, because it cannot produce an audit trail and the places that most want automation are the places that most need one. I hold this one loosely; a cheap reliable audit layer would flip it. One update since: all three big labs now ship this, and the newest of them takes intents rather than coordinates, which is the pixel layer quietly reinventing the typed verbs App scripting dictionaries published in 1993 and directly above it here. | Claude computer use, 22 Oct 2024; OpenAI's computer-use preview, 11 Mar 2025, and computer use as a standing tool in GPT-5.4 and 5.5; Gemini's computer-use tool, 24 Jun 2026, which covers browser, mobile and desktop and takes intents rather than clicks; computer use in the Claude Code CLI, Mar 2026; RPA that finally works |
| CLIs as the agent interface | unknown device | changes someone else's | Jul 2026 | code execution, file system | The most underrated bet on this board. A CLI is a typed, composable, auditable API that already ships docs, a man page, exit codes, and a dry-run flag, and it costs a company far less than a bespoke agent surface. That DoorDash, which spent years hostile to automation, now ships one is the tell. In the way: distribution and trust; the design is solved. Every CLI is also a local binary somebody has to authorize. Bet: the one I'd actually take. Two years out, shipping an agent CLI is as ordinary as shipping a public API was in 2015, and for the same reason: it's cheap, it's testable, and the alternative is letting somebody else's scraper define your interface for you. | dd-cli, beta 16 Jul 2026 with a Claude checkout demo; webcmd; gh; wrangler; just-bash, which translates shell into JavaScript so a serverless isolate can answer a command line at all. The harness side agrees: Google retired its own Gemini CLI on 18 Jun 2026 and replaced it with an agent-first one written in Go, which is a vendor deciding the command line is the agent's home rather than a wrapper around a chat box |
| Release authority | not present | changes someone else's | not yet | file system, tests and logs | An agent that can write code and run tests still cannot ship. Between the passing test and the running service sits a boundary almost every team draws deliberately, and it is the sharpest example on this board of an access being withheld rather than unbuilt. This site is a worked example of the withholding: no deploy path may create infrastructure, the CI token is read-only by design, and only one machine-owned branch can publish, specifically so that the automation cannot reach production. Bet: stays withheld, and that is the correct outcome rather than a gap to close. What actually arrives is narrower and more useful: agents that prepare a release completely and hand a human one irreversible button. The interesting engineering is in making that handoff legible. Costs: the last irreversible step on this board. Every safety story here leans on somebody being able to undo the thing, and shipping is where that runs out. | Agents that open a PR and stop. This site's own release rules, written to keep the automation out of production on purpose |
| Binaries without source | not present | changes its own machine | not yet | code execution | A counterfactual worth taking seriously: without access to code, but with access to binaries, agents would live in decompilers, traces, and differential testing, and the whole toolchain would look different. Parts of that world already exist for anyone working on software they can't read. Bet: stays unbuilt for general use, but shows up first somewhere with no source available and high stakes, most likely firmware or a compliance audit. If it arrives it arrives as a product rather than a capability, which is why nobody is racing for it. Costs: no corpus, no training signal, and no reward model for a task whose ground truth is behaviour rather than text. | Decompilers in a loop, strace and dtrace as context, fuzzing harnesses |
| Tests and logs in the loop | installed, underused | changes its own machine | ~2025 | code execution | Access to cause and effect, which is the cheapest thing on this board and the least deliberately built. Handing an agent the failing test and the log did in minutes what days of reasoning about the probable bug did not, because it replaces a prior with an observation. Costs: a suite is a specification with holes, and an agent optimises against the suite rather than the intent behind it. | Test runners in the agent loop, log tailing, CI output as context |
| The human as an oracle | installed, underused | reads what it's handed | Jun 2025 | tool calls | The cheapest ground truth on this board is asking the person sitting there. It is the same substitution as a failing test, one observation in place of a confident prior, and it is available on every single turn for free. Structured elicitation gave it a shape a model can actually reach for rather than a habit it has to be talked into. This reads as underused because most agents are tuned toward appearing capable, and a question is the one output that admits the model does not know yet. Costs: every question spends the one resource that cannot be batched, which is the person's attention. Ask too often and you have built a slower autocomplete. | Clarifying questions; MCP elicitation in the 2025-06-18 revision; approval gates; a question tool the model is actually rewarded for using |
| Production telemetry | yellow bang | reads the world | ~2025 | tests and logs in the loop | Tests and logs are the development loop, where you control the inputs. This is what real people actually experienced, which is a different flavor of cause and effect and a strictly better one, because production is the only environment that is not a guess about production. In the way: it is simultaneously the highest-signal feedback on the board and the most access-controlled. Prod telemetry carries user data, so the teams best placed to hand it to an agent are the teams least able to. Bet: this arrives sanitised and aggregated rather than raw, and the winning form is a query interface rather than a firehose. Whoever ships "ask your production" as a bounded, auditable read will find it is worth more than another eval harness. | Error trackers, RUM, analytics, distributed traces; safety dashboards counting blocks per end-user identifier, 23 Jun 2026, and developer logs for agent interactions landing in a console on 6 Jul 2026, both of which are the vendor watching its own agents rather than yours. A prior version of this site proxied its RUM beacon first-party because the collector sat on a blocklist, and the visitors it was losing skewed toward exactly the browsers whose behaviour it existed to measure |
| Eval and RL environments | yellow bang | changes someone else's | ~2026 | tests and logs in the loop | First and second-order effects from causes, in practice rather than in theory. This is what training runs on, and it's the sharpest asymmetry on the board: labs have rich environments and the person with the actual codebase has almost none. In the way: an environment is a product nobody sells you for your own system, so the people with the best ground truth can't feed it back. Bet: environments-as-a-service is the gap most worth building into, and the first credible version is bought rather than built, by a lab that wants the ground truth more than the revenue. The first attempt at selling one has already been withdrawn, which dates the bet rather than refuting it: the buyer for an eval product was always the lab itself. | RLVR, verifier environments, GRPO training loops; hosted agent evals with traces, datasets and prompt optimisation, 6 Oct 2025, scoring third-party models too. That one is worth watching to the end: it was deprecated on 3 Jun 2026, goes read-only on 31 Oct 2026 and shuts on 30 Nov 2026, a thirteen-month life, with the suggested replacement an open-source project rather than another product |
| Weights that keep the lesson | yellow bang | changes someone else's | Sep 2025 | production telemetry, eval and RL environments | Every other node in this branch delivers a signal into the context window, where the end of the run erases it. This is the one that writes it somewhere durable, and its absence is most of why the branch reads as underbuilt: the feedback arrives and has nowhere to land. It ships, on the vendor's own traffic, at an editor company rather than a lab. In the way: the loop closes at the population rather than at your agent. A rejected completion improves the model everyone gets a few hours later and teaches your instance nothing about your codebase, so the next session still opens as a competent stranger. Bet: the per-deployment version stays unshipped longer than the research suggests, and the blocker is certification rather than gradients. A frozen checkpoint is what makes an eval mean something, a safety case hold, and a rollback exist, and a model that rewrites itself in production has none of the three. Expect the first credible version to be an adapter the customer owns and can roll back, sold as a fine-tune with a shorter turnaround, rather than anything described as learning. Costs: a path from deployment into the weights is an injection path with a memory. Untrusted text that reaches the context window stops being this run's problem and becomes the next checkpoint's. | Cursor's Tab model trained on live accept and reject signal from 12 Sep 2025, 400M requests a day on a 1.5 to 2 hour checkpoint cycle, for 21% fewer suggestions at a 28% higher accept rate; the same real-time loop reaching Composer on 26 Mar 2026 on a five-hour cycle, for 2.28% more agent edits surviving in the codebase and 3.13% fewer dissatisfied follow-ups. Reinforcement fine-tuning and LoRA adapters are the offline form, held away from the running agent by a batch job and an ML team |
| Correctness, formally | unknown device | changes someone else's | ~2026 | code execution, tests and logs | The only access on this board that returns a proof instead of a sample, which makes it the honest answer to weak generalization. In the way: specification hacking. A model that writes the spec will write a weak one that compiles, so the verifier certifies a claim nobody wanted. The Lean literature has a name for it because it happens reliably, and the bug relocates from the proof into the statement, where it's much harder to see. Bet: autoformalization gets good before specification review does, which is the dangerous ordering. Expect a stretch where proofs are cheap and nobody can tell whether the statement says what they meant. | Lean 4 and Mathlib, autoformalization, FormaRL's compiler-plus-semantic reward; this site's Lean explainer is about exactly that relocation |
| Intermediate state | yellow bang | changes its own machine | ~2026 | tests and logs in the loop | The values between the input and the answer. A debugger's worth of access, where most of the diagnostic signal actually lives. In the way: nothing exposes it in a shape a model can read, so agents reconstruct state by adding print statements like everyone else. Bet: the fix is boring and arrives through tracing rather than debuggers. Spans already carry the shape; what's missing is a convention for handing them to a model, and conventions arrive faster than tools. | Time-travel debuggers, span attributes, replay logs; a Monitor tool that streams background events into the conversation as they happen, Apr 2026, which is the first shipped thing that hands a model a running process rather than its exit code |
| Replayable execution | disabled | changes its own machine | ~2014 | code execution | Record a run once, then replay it as many times as you like, deterministically, and step backwards through it. This has existed and worked for over a decade. Passed over because: recording costs something up front and re-running was always cheap enough, so almost nobody paid. Agents inherited that habit and add print statements instead. Bet: gets rediscovered once agent turns are expensive enough that re-running to reproduce costs more than recording would have. That crossover is close, and this is the passed-over node I'd expect to come back first. | rr, Mozilla, ~2014; Replay.io; deterministic simulation testing |
| Simulation | not present | changes its own machine | not yet | eval and RL environments | An eval scores an attempt. A simulation lets one be tried and thrown away. This is the missing rung underneath every node in Authority: consequence-free cause and effect, where an agent can find out what spending the money or sending the email would have done without doing it. The whole board's safety story leans on reversibility, and this is the node that would manufacture reversibility on demand. Bet: the first credible version gets repointed from robotics and self-driving, where consequence-free rehearsal has been a funded discipline for a decade, and nobody builds it for agents at all. The software people notice late that the tooling already exists. Costs: a simulation is an unchecked claim about reality, and an agent that rehearses in a wrong world learns the wrong lesson with full confidence. | Nothing ships this for general agents. Robotics and autonomous-vehicle simulators, deterministic replay harnesses, and staging environments are the nearest relatives |
| The discard pile | not present | reads the world | not yet | tests and logs in the loop | Every repository is a survivorship-biased record. A model sees the approach that landed and never the four that were tried and thrown away, which is precisely the knowledge that would stop it proposing them again. Bet: the first team that deliberately keeps its failures and feeds them back gets a real edge, and nobody outside will be able to see it. Hard to build because it means choosing to store what everybody currently throws away, and the value only shows up months later. Costs: keeping failures means keeping the reasoning that produced them, which is both embarrassing to store and expensive to keep true. | Nothing ships this. Abandoned branches, closed PRs, and reverted commits are the raw material sitting unused |
| Chat output | installed | reads what it's handed | Nov 2022 | context window | The output access that mattered most, because it got everyone who doesn't code in the door. Access to inputs decided what models could do; this decided who got to ask. Costs: prose is unfalsifiable at a glance, and the most confident-sounding output is the most expensive to check. | The chat box, and everything downstream of it |
| Markdown and HTML | installed | reads what it's handed | ~2023 | chat output | Output a machine parses and a person reads, in one artifact. Underrated as an access story: it's why an agent can hand its work to another agent without inventing a protocol. Costs: two representations of one truth means two things to keep true. | Rendered markdown, artifacts, the markdown twin of this page |
| Image output | installed | reads what it's handed | Oct 2023 | chat output | Nothing moved public belief about what these systems can do like pictures did, including things text models had been able to do for a year. Costs: the modality with the widest gap between how convincing it looks and how checkable it is. | DALL-E 3 in ChatGPT, Oct 2023; native image generation, Mar 2025 |
| Structured output | installed | reads the world | Aug 2024 | markdown and HTML | Output the caller can depend on without parsing prose. The node that turns a model from a thing you read into a thing you can put in a pipeline. Costs: a schema buys certainty about shape and none about correctness. Well-formed and wrong is the worst failure mode on this board. | OpenAI Structured Outputs, 6 Aug 2024; tool result contracts; forced tool calls |
| Output that runs | installed | reads what it's handed | Jun 2024 | markdown and HTML | Expression's ceiling moved from text a person reads to software a person uses. The same bytes as the markup node, with the difference that a browser executes them, which turns every answer into a potential tool. This is the output access that did for interfaces what image output did for sentiment: it made the capability legible to people who were never going to read a diff. Costs: output that runs is output that can act before anybody has read it. | Claude Artifacts, Jun 2024; generative and assembled UI; a rendered page as an answer; a published artifact that calls the reader's own connectors when they open it, Jul 2026 |
| Signed provenance on output | unknown device | reads the world | Aug 2026 | chat output, verifiable identity | The rest of Expression is about what a model can hand you. This is handing you something whose origin you can check: a signature that survives the copy, so a recipient can tell a model's output from a person's without asking either of them. Verifiable identity did this for the request; this does it for the artifact, and it is the missing half of Delegated identity, the node where the blast radius is your name. In the way: provenance only counts where somebody verifies it, and the verifier is the part that never ships. The signature travels with the bytes and the check travels with nobody. Content Credentials is the worked example, and this site is a small piece of evidence for it: signing a photo costs about 14KB an image, and the browser-side reader that was supposed to consume it could not parse the format the page actually serves. Bet: it arrives because platforms want it for their own moderation and deliverability rather than because anyone wanted to be honest, and it lands on outbound messages before it lands on media. Medium confidence on the shape, higher on the motive. Costs: a signal checked in some places and not others is worse than no signal, because absence starts reading as a claim. | Content provenance checks in the OpenAI API, Aug 2026; C2PA Content Credentials; this site measured the byte cost, found the reader could not parse its own images, and switched its C2PA pack off; nothing marks a message as sent by an agent in a way its recipient can verify |
| Machine-mediated approval | yellow bang | changes someone else's | Mar 2026 | tool calls | Every privileged action on this board is gated by a person clicking yes, and that person is the bottleneck the whole branch runs into. This node replaces the click with a classifier: a second model reads the proposed action, decides it is safe, and lets it through. It is the first thing anyone has built that attacks the trust dependency head-on instead of routing around it, which is why it showed up in three vendors' release notes inside five months. In the way: the gate sits exactly where untrusted input meets privileged action, the one junction on this board with no separation, so the thing deciding what is safe is reading tokens an attacker wrote. Its errors are also asymmetric in the wrong direction. A false block is an annoyance; a false allow is the entire reason permission prompts existed. Bet: it becomes the default inside a year and the prompt survives only for the irreversible tail, because nobody enjoys clicking yes four hundred times and the economics are not close. The interesting failure will be a team finding out the classifier had been waving one category through for a month, with nothing in the logs saying so. Costs: every prompt the classifier absorbs is a question the person never sees, so it spends the one node that was handing the model free ground truth. | Claude Code auto mode, research preview Mar 2026, on Pro by May 2026 and on Bedrock, Google's Agent Platform and Microsoft Foundry by Jun 2026, with hard deny rules that no allow rule can override; Codex --approve-for-me, 7 Aug 2026; every allowlist that grew until it meant nothing |
| Secrets | yellow bang | spends | Apr 2026 | file system | The agent needs the credential's power without the credential's value, and the good answer turned out to be never handing over the value at all. Infisical's is a TLS-intercepting, credential-injecting proxy, so a compromised agent has no secret to leak because it never held one. In the way: prompt injection sets the bar. If the agent can read the key, so can the page it just fetched. Bet: never-let-the-agent-read-it becomes the default within two years, and direct credential access in an agent starts reading the way plaintext password storage reads now. | Infisical Agent Vault, Apr 2026, with Agent Proxy GA on 30 Jul 2026; ironrun; workload identity federation trading an external token for a short-lived one, 26 May 2026, which is the same idea arriving from the platform side; a sandbox that denies the network outright when its policy update fails, Aug 2026 |
| Verifiable identity | unknown device | changes someone else's | May 2025 | fetch and scrape | A good bot and a bad bot are the same HTTP request until somebody signs it, which is why blocking and enabling are one problem rather than two. The interesting version is routing rather than detection: see an agent, hand it the agent path. In the way: the bypass market, and the fact that no site can afford to trust a signature it can't price. Bet: signed agents win, because both sides want it. Sites want to price access and agents want to stop being blocked. September's crawler-separation deadline is the forcing function, and I'd expect signature checking to be unremarkable by 2027. | Web Bot Auth and RFC 9421 HTTP Message Signatures, May 2025; in Cloudflare's Verified Bots by 1 Jul 2025; this site publishes a JWKS; Cloudflare's 15 Sep 2026 crawler-split deadline. The platform is attacking the same problem from the human end: Private State Tokens carry "not a bot" across origins without tracking, and the Digital Credentials API shipped in Chrome 141 on 30 Sep 2025 |
| Money | unknown device | spends | May 2025 | secrets, verifiable identity | Cloudflare's Act IV is access and commerce, and it rides the same Web Bot Auth as the crawler story. That is the dependency showing through: an agent can't be trusted to pay until it can be identified, and it can't be identified until somebody signs for it. In the way: liability. Every party wants the agent's transaction and nobody wants its chargeback. Bet: agent payments arrive through the card networks rather than around them, because liability is the real blocker and only they can absorb it. Crypto rails get the long tail and most of the demos. | x402, May 2025; Turnkey; Cloudflare with the major payment networks, 2026; dd-cli completing a real checkout |
| Delegated identity | unknown device | spends | ~2025 | secrets, verifiable identity | This one spends your NAME. Send that email as me, reply in that thread as me, post that as me. The blast radius here is reputational, which no other node on this board covers, and reputation is the one thing a rollback cannot restore. In the way: the crude version shipped over a decade ago as OAuth scopes, which delegate to an APP that behaves deterministically, and nothing in that model contemplated a delegate that improvises. There is no way to mark a message as "sent by an agent I authorised" that a recipient can check. Bet: signed provenance on outbound messages arrives before agent-to-human trust does, and it arrives because platforms want to protect their own deliverability rather than because anyone wanted to be honest about it. | OAuth 2.0 scopes, RFC 6749, 2012, as the crude precursor; send-as grants; agents that post, reply, and DM under your account today with nothing marking them |
| Contracts and agreement | not present | spends | not yet | delegated identity, money | When an agent clicks accept, who is bound? Nobody has an answer, and everything commerce-shaped on this board quietly assumes one exists. This is to money what verifiable identity is to fetch: the dependency that has to resolve before the interesting node is safe, and the one people skip because it looks like a lawyer's problem rather than an engineering one. Bet: it gets settled in practice by the payment networks' liability rules years before any legal doctrine catches up, exactly the way agent payments will. The operative document will be a card-scheme chargeback policy, and almost nobody will notice that is what happened. Costs: somebody has to be liable, and every party wants the transaction while none wants the chargeback. | Clickwrap and terms acceptance, which assume a human read them; nothing that binds an agent's principal exists |
| Stake-weighted agency | not present | spends | not yet | money, verifiable identity | Verifiable identity says who an agent is. This says what it has to lose. An agent posting a bond it forfeits on misbehaviour can be extended trust without its operator being known or liked, which is a genuinely different trust primitive from a signature: one is attestation, this one is collateral. Bet: it appears in crypto first because the slashing primitive exists there and effectively nowhere else, and it crosses over only once it is re-skinned as a bond or an insurance premium, wearing vocabulary a risk desk already prices. Low confidence on the timeline and higher confidence on the shape. Costs: collateral prices trust, which makes trust a thing only well-capitalised agents can buy. | Staking and slashing, bonded relayers and sequencers, x402 with collateral attached. Nothing agent-specific ships |
| Human hands for hire | not present | moves atoms | not yet | money | The honest bridge to the physical world, and it needs no robotics at all: the agent pays a person to do the thing. Mechanical Turk ran the other direction for twenty years, humans standing in for a machine, and every gig platform is the inverted version sitting there waiting. This is why Meatspace beside it is the wrong place to look first. Atoms are already reachable by proxy, and the only missing piece is the money node. Bet: this is how physical agency actually arrives, and it arrives with no announcement, because from the outside it looks like a payment rather than a capability. Watch the delivery and errand platforms rather than the robotics ones. Costs: it converts a software mistake into somebody's afternoon, and the person on the other end has no idea an agent decided it. | The Mechanical Turk inversion; errand and delivery platforms; dd-cli is already this for one narrow errand |
| Meatspace | not present | moves atoms | not yet | money, computer use | The one branch where a wrong action can't be rolled back, which is why it sits alone at the top and why the gap between it and everything below is the largest on the board. In the way: no undo. Every other node's safety story leans on reversibility, and this is where that runs out. Bet: not this decade at any scale that matters, and the binding constraint stays undo rather than dexterity. The first real deployments will be places where a mistake is cheap and boring. One thing cuts against that: embodied reasoning became an ordinary API call in Jul 2026, spatial reasoning and multi-step tool orchestration behind the same key as everything else on this board. That moves the price of trying and none of the price of being wrong, which is the whole reason this node sits where it does. | Robotics, physical delivery, anything holding a key to a door; Gemini Robotics ER 2, 30 Jul 2026, embodied reasoning as two ordinary endpoints |
Sources
Everything above that carries a number or a date came from one of these. The tweets that seeded this map aren't linked yet, because they need a human to pull the quote.
- cdnjs, migrated to the Cloudflare developer platform (30 Jul 2026) for the corpus numbers, and for saying out loud that models reach for cdnjs because their training data is full of it.
- Shared dictionaries: compression for the agentic web (beta 30 Apr 2026) for the 272KB to 2.6KB figure and the three phases.
- webcmd for the token and turn reductions on repeated browser work; know.fast for flat per-URL knowledge pricing.
- The New Stack on dd-cli for the 16 Jul 2026 beta and the strategic read.
- Infisical for the credential-injecting proxy design and the 30 Jul 2026 Agent Proxy GA.
- Forget IPs: using cryptography to verify bot and agent traffic (May 2025) and the MCP Registry preview (8 Sep 2025) for the identity and tool-discovery dates.
- Cloudflare Computer (3 Aug 2026) for the isolate-and-container abstraction, the SQLite-backed shared filesystem, and the under-10%-containers target.
- The IETF AIPREF working group and draft-ietf-aipref-vocab for the crawl-preference vocabulary, its revision state, and the lapsed attachment draft.
- The AOM explainer for what a page still cannot do with its own accessibility tree, and RFC 9842 for compression dictionary transport.
- This Hacker News thread for detection pricing, the bypass claim, and the argument for routing agents rather than blocking them.
- FormaRL and the surrounding autoformalization work for specification hacking.
- The vendor logs, read entry by entry rather than by announcement, which is where most of the 2026 dates above came from: the Claude Code weekly digest for auto mode, Routines, the Monitor tool, background subagents and the in-app browser; the OpenAI API changelog for compaction, tool search, the hosted shell tool, workload identity federation, the fast tier and content provenance; the Codex changelog for portable agent plugins,
--approve-for-meand MCP 2026-07-28; and the Gemini API release notes for Managed Agents, the computer-use tool, webhooks and Robotics ER 2. - Improving Cursor Tab with online RL (12 Sep 2025) for the 400M requests a day, the 1.5 to 2 hour checkpoint cycle and the 21%/28% figures, and Improving Composer through real-time RL (26 Mar 2026) for the five-hour cycle and the three A/B numbers. Both say plainly that the training is on aggregated production traffic, which is what makes this a population-level loop rather than a per-customer one.
- The Surprising Effectiveness of Test-Time Training (11 Nov 2024) for the 8B model at 53.0% and the 61.9% ensemble; Nested Learning (7 Nov 2025) for HOPE and its Titans lineage; Self-Adapting Language Models (Jun 2025) for self-generated finetuning data, and for reporting its own catastrophic forgetting rather than burying it.
- The OpenAI deprecations page for the Assistants API removal on 26 Aug 2026 and the Agent Builder and Evals shutdowns on 30 Nov 2026; Meta's Llama API sunset on 6 Jul 2026; the Gemini CLI to Antigravity CLI transition and its 18 Jun 2026 end of life. Three vendors retiring an agent platform in one quarter, with no node on this board going with them.
- Donating MCP to the Agentic AI Foundation (9 Dec 2025) for the runtime-before-committee ordering, the 10,000 public servers, and the co-founder list.
- Model cards rather than changelogs for the open-weight labs, because Moonshot, DeepSeek, Qwen, Mistral and Z.ai make their agent claims there: Kimi K2.6's 300 subagents across 4,000 coordinated steps is the sharpest of them, and it is a claim on a card rather than a measured number, which is exactly how it is cited above.
