The agents were reading something else
How we organise
Zhijun Gao and Jing Chen traced what coding agents read rather than what anyone recommends they read. They took 557 agentic coding sessions carrying 94,813 development events, of which 3,033 were documentation interactions, and 33,097 agentic pull requests with 690,260 classified file-level changes. Instruction files and working notes account for 60.5 per cent of every documentation interaction. Classical technical documentation takes 10.6 per cent. API references take 1.3 per cent. Agents read documentation because they chose to in 70.2 per cent of cases, and because something had failed in 7.5 per cent. Where a pull request changed both, the code was touched first 4.7 times more often.
Structure: the documentation an organisation maintains and the documentation its agents read are two different sets, and only one of them has an owner. Instruction files are where the agents spend their attention, and in most organisations nobody reviews them, versions them or knows who wrote them. Gao and Chen also tested the two properties the industry treats as settled, actionability and verifiability, and found neither has consistent support in what agents actually do. The advice to make documentation agent-friendly is running ahead of the evidence for it. This is observational work on public datasets, and it describes coding agents rather than every agent. We read what the agents open before rewriting what the people wrote.
Find the instruction files in your largest repository and read them this week. If nobody owns them and they have not changed in a quarter, that is the documentation your agents are working from.
How we build
Claude on call: How Claude Tag serves as Anthropic’s first responder for CI/CD failures (Sachin Malhotra, Anthropic)
Sachin Malhotra describes the agent his team put on first response for continuous integration failures. It posts a first evidence-grounded analysis a median of 14 minutes after an incident opens, and at its fastest names the root cause within 4 minutes. That speed does not come from the model alone. Every investigation starts by reading a lessons file the agent appends to itself after each incident, holding what happened, the root cause, the fix and the detail worth keeping. One investigation skill for a single class of bug runs to 617 lines, and Malhotra built it by narrating one real investigation turn by turn.
Engineering: the durable asset is the lessons file rather than the agent, because the file is what makes the first hypothesis a good one. It lives in a repository and is reviewed like code, and a pattern is promoted into the investigation skill once it has recurred enough times to be worth the promotion. That promotion rule is a decision about when a one-off becomes standing practice, and someone has to make it. Malhotra’s own entry in the lessons file reads “query the data first, then theorize”. It was written by the agent itself, after he theorised from a config file rather than reading the data first. This is Anthropic writing about its own tooling and reporting its own figures. We build the record before we buy the responder.
Before funding an incident-response agent, write down what your last ten incidents taught you. If that document does not exist, the agent will begin every investigation from nothing.
How we assure
An Agentic RAG and Evaluation Framework for Assurance Case Generation: Industrial Use Case for the EU Cyber Resilience Act Compliance (Ikhwantri and others)
The EU Cyber Resilience Act starts asking for reports on 11 September 2026, ahead of its main obligations on 11 December 2027. It covers products with digital elements, and it asks a manufacturer to show that a control operated rather than that a policy exists. Fariz Ikhwantri and colleagues built a framework that assembles that evidence, and tested it on a wildfire monitoring product. It generated 70 assurance cases at about 4.4 grounding artefacts each. Their evidence checker reached 0.88 accuracy, and experts rated the resulting justifications at 3.06 for plausibility.
Risk: the deadline three weeks away is a reporting deadline, and reporting is the part an organisation cannot assemble retrospectively. A conformity assessment is a tracing problem before it is a writing problem, which is why the grounding density matters more here than the fluency. Ikhwantri and colleagues are explicit that small manufacturers carry this cost worst. The assessment work does not scale down with the size of the product. The plausibility rating is middling on its own scale, so this generates a draft for an expert rather than a filing. It is one industrial case study, and one product. We trace the evidence before we draft the case.
If you sell anything with digital elements into the EU, establish this week which of your products the Act covers. The reporting obligation arrives before the one everybody has been planning for.