The controls have not moved into the harness
A brake with no trigger on it, a protocol that deletes the layer where state used to sit, and the same model scoring 13.3 and 38.3 depending on the harness.
How we organise
Frontier-lab employees ask their government to back an international effort to build the tools needed to pace AI research. Nobody is asked to slow down now.
We tell a client to read the ask precisely, because it is narrower than the coverage suggests. There is no trigger in the statement. No evidence standard would fire one, no authority is named to pull it, and there is no jurisdiction and no restart condition. A request for the capability to pace, made by the people who would be paced, is an admission that the governance object does not exist. The failure would be reading it as though it did.
A metric multiplying AI-assisted pull requests by the effort each saved begins a step too early. The question is whether capacity went up, and whether it holds.
Our reading is that most internal measurement programmes get this backwards. They set out to prove causation with an instrument that cannot do it, produce a number nobody trusts, and quietly stop.
How we build
The MCP specification goes stateless
Protocol-level sessions and the session header are gone, and so is the handshake. Every request carries its own version and capabilities. A server needing state across calls must mint an explicit handle and pass it as an ordinary tool argument.
Our position is that state which was implicit in the protocol is now explicit in the tool surface, which makes it visible, nameable and loggable. A session identifier issued by the transport is infrastructure, where a handle sitting in the log beside every other tool argument is evidence somebody can read back. Auditability was nobody’s aim. The specification improves it anyway.
Four subagents deep into a refactor, the largest cost was the orchestrator checking on them, which pulled tens of thousands of tokens of raw transcript into the main thread. Twice.
We hold that before adding a rule to an instruction file you should ask whether a competent orchestrator would decide correctly once it knew the one missing fact. If so, state the fact and stop. When the fix starts specifying approvals and checkpoints, you are encoding process where a clarification would have done.
How two settings tripled a benchmark score
The same model scores 13.3 per cent under the official harness and 38.3 under the vendor’s own. The official harness threw away the model’s reasoning after every action, and truncated the history rather than compacting it, so the agent worked the game out again on every turn.
We read this as the reply to any benchmark number quoted as a property of a model. A vendor published it about its own model. Nobody’s interest was served by it.
Where the efficiency came from
Model-designed kernel work cut end-to-end serving costs by 20 per cent. Underneath it sits an append-only context discipline that preserves the exact cache prefixes, alongside deferred tool discovery and a cap on tool output.
Our test is cost per successful task rather than cost per token. Most procurement conversations never reach it. The firms that can answer find that the ranking of their own tools changes.
How we assure
An independent assessment of an agent incident
Two outside firms have been engaged to assess the model behaviour observed during the incident, with engagement terms, scope and findings to be published.
We judge this the governance movement of the week. It has had almost no coverage, because it is procedural rather than dramatic. Third-party assessment after an incident, on published terms, is the first thing this year that looks like an assurance mechanism rather than a statement of intent.
A scanning CLI released under an open licence, with scan history and a flag for gating CI. The README states the catch. Scanning requires the vendor’s sign-in or an API key.
We ask what happens to a security tool if the vendor account is suspended. That is the availability of your assurance, not the licence. Read beside the rest of the week, the engineering has moved into the harness and the controls have not.