Agents as deployable unit—and the stack that raced to catch up

From launch to global shutdown. The world's most capable code model—erased by American executive order, with no return date.

The first is Databricks' Omnigent, open-source under Apache 2.0 license. Databricks was direct about the motivation: their own organization of over five thousand engineers had adopted code agents early—Claude Code, OpenAI Codex, custom agents over proprietary SDKs—and the problem that emerged wasn't about model capability. It was operational. With four or five agents running in parallel, engineers spent time manually copying context between terminals, Google Docs, and Slack. There was no single harness capable of sharing state or delegating across tool boundaries. [ref: databricks-launches-omnigent-to-operationalize-multi-agent-workflows]

What matters to teams putting this in production are session policies. Omnigent applies cost and security at the session boundary—not at the model level. The system can pause an agent and request human confirmation after each hundred dollars spent on LLM compute. Security policies are dynamic per session: the system can require human approval for a git push only after the agent has downloaded an npm package in that specific session. A hardened OS sandbox intercepts network requests at an egress proxy—credentials like GitHub tokens are never exposed to the agent process, only injected into approved outbound calls.

But Databricks hasn't published latency benchmarks for the overhead introduced by the meta-harness. The open question for platform architects: if the policy engine or state tracker degrades, all composed agents stop. You now have two layers of abstraction to debug instead of one. Adding coordination above already-opinionated harnesses creates a new single point of failure—and when something breaks, the failure crosses two layers before you can attribute it.

The isolation mechanism is git worktrees. Each agent session runs in its own fully checked-out branch, in a separate filesystem path. One agent triages a production bug, another implements a backlog issue, a third responds to review comments—in the same repository, at the same time. The app creates and destroys these worktrees automatically. When a session is ready to integrate, Agent Merge handles CI, review feedback, and merge as soon as all configured conditions are met. On policy-protected branches, it requires human approval—cannot bypass branch protection rules. [ref: github-copilot-desktop-parallel-agentic-workflows-native-to-ide]

CPO Mario Rodriguez described the distinction between the two modes of work like this: "Chat is where you instruct, discuss, and reason about ambiguity. Canvases are where that intent becomes visible work you can inspect, direct, and verify." It's a real operational distinction—and the architecture betting on GitHub primitives—issues, PRs, Actions, code review—as scaffolding for agentic workflows has genuine integration advantage for teams already operating entirely within the platform.

On June 1st, GitHub migrated to token-based billing. One AI Credit costs one cent. A typical agentic session consumes thirty to forty dollars. Teams running multiple parallel sessions reported increases of ten to fifty times versus the previous fixed-price model. Pro subscribers get ten dollars per month in credits. Three parallel sessions at thirty-five dollars each consume the entire monthly budget before noon. Copilot Max, at a hundred dollars per month, includes a hundred dollars in AI Credits plus flexible allowance—but ten parallel sessions at thirty-five dollars each already exceed that envelope.

A post-mortem published on arXiv documents eight weeks of a personal agent runtime in continuous production since March 2026. Forty scheduled jobs, eight LLM providers, one tool governance proxy, and a knowledge-base memory plane—defended by 4,286 unit tests and 827 governance checks. Result: 22 incidents with full root-cause post-mortems. One meta-pattern manifesting at least 28 times. [ref: longitudinal-study-uncovers-22-failure-modes-in-llm-agent-runtimes]

The most endemic and highest-risk failure class is what the authors call "chained hallucination and fabrication". When the runtime hits an error, the model doesn't throw an exception. It rewrites the error into a coherent, plausible conclusion delivered directly to the user. The authors call this "fail-plausible": the observer isn't just blind to the error. The observer is actively deceived by the failure signal itself. The system fabricates its alibi.

No. Approximately 70 percent of silent failures were detected by human observation of final output—not by automated tests or audits. A retrospective review of 15 incidents showed zero percent ex-ante prevention and 87 percent regression blocking. Audit doesn't prevent failure. Audit blocks failure that already happened—and only works if it recurs the same way.

From 13 hours to 60 days. The longest-duration failures lived at the seams between components—the tool proxy, the memory plane, and LLM providers—where no tests run. Code complexity wasn't a predictor. Boundary surface area was. The paper proposes a Physical Integrity Gate engine and an Agent Delivery Engineering protocol as deterministic countermeasures. But the central conclusion is that multi-provider systems have to be treated as distributed systems where the most dangerous failure mode is indistinguishable from correct output—and log aggregation and governance checks are necessary, but not sufficient.

Hui Zhang and Shuren Song published on June 17th a report of 391 consecutive sessions of AI collaboration on the Bang-v3 project, over approximately one month. The failure mode they identified is called "Index Sickness". The mechanism is counterintuitive: as teams add formal structure to prompts—symbolic ID systems, numbered rules, constraint layers—they expect clearer guardrails. The Bang-v3 record shows the opposite. [ref: real-software-project-documents-llm-semantic-drift-across-391-sessions-formal-co]

And this aligns directly with what Chroma documented in 2025 testing 18 frontier models—all degrade as input length increases. Code agents are most affected: each file read, grep result, and tool output accumulates in the context window for the rest of the session, while logical structure creates dense distractions. In multi-document question-and-answer, accuracy dropped over 30 percent when the relevant document was in intermediate positions rather than at the beginning or end. NVIDIA's RULER benchmark places effective context at 50 to 65 percent of advertised capacity for most models. And—this is the most counterintuitive result—Chroma discovered that models perform better in scrambled, incoherent contexts than in logically structured ones. Structural density is a liability, not an asset.

"Baseline-Log Physical Separation." Keep the project's stable architecture—domain, design decisions, canonical state—in a separate document from the current session log. The LLM receives a clean snapshot of truth at the start of each session, not a growing heap of state mixed with conversational noise. Volume of AI Instructions dropped approximately 75 percent. Index Sickness didn't recur in the following 150 sessions.

It's architecturally identical to the logic of CLAUDE.md in Claude Code—stable documentation loaded upfront, individual files fetched just-in-time via grep and glob, bypassing obsolete indexing. Zhang and Song arrived at the same place independently. The difficulty isn't technical. It's organizational: engineering teams are rewarded for adding constraints when something breaks. Removing symbolic scaffolding and trusting natural language seems to reduce rigor. The Bang-v3 record says that instinct is the cause of the problem, not the solution.

OpenAnt, from Knostic. A six-stage open-source pipeline under Apache 2.0 that scans codebases at repository scale and validates each finding with a real exploit executed in a sandboxed container before surfacing any result. On OpenSSL: 15,232 functions parsed across 1,769 files. After filtering by reachability from attacker-controlled entry points—CLI handlers, callbacks, main functions—the analysis surface dropped 97 percent. From 15,232 units down to 390. [ref: openant-llm-agents-discover-repository-scale-vulnerabilities-solving-cost-and-co]

In Stage 3, a Sonnet 4 agent classifies each reachable unit by exposure level—externally exposed, internally exposed, security control, or neutral. The iteration continues until classification is confident or hits a cap of 20 iterations. Cost: from $0.13 per iteration for simple functions up to $10.92 at the cap for complex call chains. Median on OpenSSL: 9 iterations per unit. After Stage 3, the 390 reachable units collapse to 49 externally exposed. Total reduction of 99.6 percent from the original count. Stage 4 uses Claude Opus 4.6 for vulnerability pattern analysis. Of the 49, 28 were flagged as potentially vulnerable.

The model assumes an attacker persona with explicit constraints: no server access, no database credentials, no local file access, no CLI commands. If the only viable attack path requires local shell access, the finding is classified NOT EXPLOITABLE and discarded. Prompts like "act as an attacker" without constraints are the root cause of high false-positive rates in LLM-based scanners—models are agreeable by default and construct plausible attacks assuming capabilities that simply don't exist in production. Stage 6 converts surviving candidates into actual exploit environments, executes in short-lived sandboxed containers, and tears down the environment afterward. Knostic is currently in disclosure process for findings in OpenSSL, WordPress, and Flowise. The broader implication: the same model your agent uses to write code can find exploitable vulnerabilities in code other agents wrote. Attack surface and detection surface now inhabit the same stack.

On June 12, 2026, at 5:21 p.m. Eastern time, Secretary of Commerce Howard Lutnick invoked the Export Controls Reform Act to suspend access to Anthropic's Fable 5 and Mythos 5 for all foreign nationals—including non-citizen Anthropic employees. Anthropic has no way to verify nationality by API request. It did the only thing that guaranteed compliance: it disabled both models globally. Three days after launch, every API call returned an error. [ref: us-export-ban-on-anthropic-fable-5-compliance-gates-for-model-selection-and-regi]

Anthropic says the same technique is available on other models in production, including GPT-5.5. No universal jailbreak was found in pre-launch red-teaming conducted by the U.S. government, the UK AISI, and third parties. Lutnick's letter provided no specific national security justification. Anthropic disagrees with the decision, is complying, and has sent senior engineers to Washington to negotiate with the Commerce Department. As of June 17, there was no restoration date.

But Opus 4.7 isn't an equivalent substitute for complex code tasks and multi-step reasoning. Teams that hardcoded the Fable 5 endpoint spent the weekend on incident bridges. Teams with multi-provider gateways made a routing change—zero emergency deploys. The architectural lesson is direct: ECRA, written to control hardware exports, now applies to a commercial AI API without advance notice and without per-user exemption. Architecture that assumes guaranteed model availability is demonstrably fragile. The precedent is set—any frontier model can be targeted by a similar order. Keep hot fallbacks with current benchmarks. Don't sign contracts that assume continuous availability of a specific frontier model.

McMinnville and Coffee County approved unanimous moratoriums on June 9. Nashville's Metropolitan Council followed that same night, advancing a 90-day pause on all data center licenses in Davidson County by a 26-1 vote. Warren County and Knox County were scheduled to vote on June 22. Since last fall, nine Tennessee cities and counties have approved moratoriums. Five in a single week. [ref: tennessee-counties-block-ai-data-centers-nashville-passes-near-unanimous-morator]

The executive order signed by Mayor Freddie O'Connell has a threshold with direct practical implications for anyone designing inference clusters: any facility over 20,000 square feet or consuming more than 5 MW qualifies as a large data center subject to review. A single row of 64 H100-class GPU racks already exceeds 5 MW before accounting for cooling overhead.

McMinnville city administrator Nolan Ming was precise: "A moratorium is not a permanent ban. It's a responsible time-out." But an 18-month time-out in McMinnville and 90 days in Nashville don't align with data center procurement timelines—12 to 24 months from site selection to energization. A permit pause in the middle of that process can strand interconection contracts and utility agreements already signed. Rural Tennessee is no longer a low-friction alternative to Ashburn or Phoenix. Site selection now needs to include community opposition risk before the RFP.

First: optical interconnect. Coherent broke ground on expansion of its fab in Sherman, Texas. The site houses the world's first six-inch wafer phosphide indium—InP—fab. The expansion receives fifty million dollars from the CHIPS Act, plus seventeen million from the Texas CHIPS program and the Sherman Economic Development Corporation. Jensen Huang and Coherent CEO Jim Anderson were present at the groundbreaking. [ref: coherent-expands-texas-optical-fab-to-scale-ai-backbone-capacity]

NVIDIA's Vera Rubin Ultra NVL576 connects eight NVLink racks with 72 Rubin Ultra GPUs each—576 GPUs operating as a single domain. At that scale, with hundreds of feet separating components across a data center floor, copper fails in energy efficiency. Retimers and signal conditioning hardware to push high-speed electrical signals across eight racks consume power the cluster would rather spend on compute. Optics pay a conversion penalty once—electrical to photon—and then distance becomes essentially free. At this scale, the trade-off isn't optional.

Huang quantified the pace at the groundbreaking:

In March, NVIDIA and Coherent formalized a multi-year strategic partnership. NVIDIA committed two billion dollars for R&D, future capacity and domestic manufacturing, plus a commitment to purchase multiple billions in laser and optical interconnect products. Sherman expansion executes that agreement. The difficulty in scaling isn't floor space—it's the compound semiconductors themselves. InP and gallium arsenide use different photoresists, different deposition chemistries, and work with wafers that break more easily than silicon. Tooling, yield management, and upstream chemical supply chains are thinner than silicon equivalents. The fifty-million federal grant and seventeen million in state and local support reflect exactly that gap: without subsidized capital, the economics of domestic compound semiconductor expansion remain marginal at current volumes.

Intel's 14A node has its first external customer committed: Tesla, for the Terafab AI complex in Austin, with test production targeted for 2029. Everything else on Intel's foundry calendar—Ohio, Arizona, Oregon—depends on that single customer leading to a second and third before two deadlines converging in the next eighteen months. [ref: intels-14a-roadmap-arizona-ohio-timeline-hints-at-when-inference-chip-supply-tha]

First: CEO Lip-Bu Tan told investors in January 2026 that prospective 14A buyers will make firm supplier decisions starting in the second half of 2026 and extending into the first half of 2027. Second: the 35 percent advanced manufacturing tax credit—signed into law in July 2025—covers only fab construction that begins before December 31, 2026. Projects that slip to 2027 lose the credit entirely. Both clocks expire months apart, and both point to construction sites in Ohio.

18A yields won't reach standard industrial levels until early 2027. Tan confirmed in May 2026 that yields are improving 7 to 8 percent per month. Intel is actively limiting CPU output. Arizona's second fab, Fab 62, has no node assigned and is under construction with completion by 2028—functioning as overflow valve for 14A if Ohio delays, or additional 18A capacity if external bookings arrive first. Brookfield Infrastructure owns 49 percent of the Chandler joint venture, and Intel hasn't moved to repurchase that stake, so every wafer from both Arizona fabs carries revenue-share obligations.

For architects evaluating non-TSMC options: the decision window is open now and closes in early 2027. Risk production in 2028, significant volume in 2029—same timeline projected for TSMC's A14. Demand signals are materializing: inference and agentic AI workloads are redefining CPU-to-GPU ratios. Tan said customers report shifts from the training-era norm—one CPU per eight GPUs—to 1-to-1, and in some cases four CPUs per GPU for inference. Teams wanting Ohio capacity in 2030-2031 need their chip partners engaged with Intel today.

Allen AI and Hugging Face released olmo-eval on June 12—an open-source evaluation harness that separates benchmark definition from execution policy. The project inherits from OLMES, the 2024 reproducibility standard that standardized prompt formatting and task formulation for OLMo and Tülu 3 families. OLMES solved paper inconsistency. olmo-eval solves development loop speed. [ref: olmo-eval-standardizing-model-development-evals-at-scale]

Standard error and minimum detectable effect for each benchmark result, plus per-instance comparison of identical questions across checkpoints. The central question: is a 2.4 percentage point variation between training iterations real signal or sample variance? Inference backends are interchangeable—local GPU, commercial API via LiteLLM, or mock provider for cost-free dry runs. The six-layer abstraction—Task, Suite, Harness, Formatter, Scorer, Metric—allows the same task spec to run against baseline, tool-augmented, or remote API without modification. Agentic and multi-turn evaluations run in Docker, Podman, or Modal containers when needed; the lightweight path is the default, and olmo-eval only opts for the heavy setup when a benchmark truly requires it, unlike tools that use containers for everything.

Without pre-registered thresholds, any statistical tool can become post-hoc rationalization with scientific gloss. olmo-eval delivers the infrastructure to ask the right question. Discipline of use is still the responsibility of the team operating the evaluation.