Artificer’s Grimoire — Edition 25 · August 16, 2026
Edition 24 documented the human approval gate failing at its job. This week shows what is being built in its place: policy that reads an agent’s history before permitting its next action, compliance surfaces that reach the coding agents themselves, and vendor guidance conceding that context accumulation is an operator problem. The week’s counterweight is a careful negative result — TDD ceremony inside the agent loop bought nothing measurable at several times the cost.
Must Read
AWS open-sources Dogwood, a policy language for sequences of agent tool calls
Dogwood extends Cedar — the authorization language behind AgentCore Policy — with temporal conditions that read the agent’s event history, so a rule can reason about prior tool calls instead of one request in isolation. Four constructs cover the common shapes: the formerly operator, plus three standard-library macros — count_within, count_distinct_within, and sum_within — which AWS defines over a core subset of Metric First-Order Temporal Logic rather than as language primitives. The language and a reference interpreter are Apache 2.0, AWS has added Dogwood support to AgentCore Policy, and InfoQ’s analysis this week is what put it in front of the wider ecosystem.
Why it matters: AWS’s own worked example names the defect this publication has been documenting: “Because this policy only sums the amounts associated with responses, an agent can circumvent the intended limit by issuing many concurrent transfer requests before any one of them resolves.” That is post-response metering losing to concurrency — the same failure shape the Grimoire’s spend-governance scout found in billing-plane spend controls. A vendor shipping a policy language with that failure as its motivating example is strong corroboration that admission-time, sequence-aware policy is where the control has to live. Two honest caveats from AWS: the reference interpreter is scoped to exploration and testing rather than production authorization, and temporal conditions do not yet support Cedar’s automated reasoning tools — evaluation cost grows with the event log.
A ThoughtWorks experiment finds no measurable quality gain from TDD inside the agent loop
Birgitta Böckeler ran TDD and non-TDD agent workflows across three task sizes, generating with Sonnet 4.6 and having Opus 4.8 judge the results blind to which workflow produced them. Her conclusion: “no clearly discernable difference” in quality between the two — and more than once the judge ranked non-TDD solutions slightly higher on design and test quality. TDD consumed roughly 3–8.5× the tokens depending on task size, with no meaningful difference in mutation scores.
Why it matters: Telling the agent to do TDD is one of the most reflexively prescribed practices in this ecosystem, and this is a credible practitioner source reporting it bought nothing measurable at a multiple of the cost. It is one exploratory evaluation with an LLM judge, and Böckeler frames it that way — but the burden of proof just moved. If the value of TDD in human hands is the fast feedback loop, an agent that already compiles and tests continuously may be getting that loop through the harness, making the ceremony redundant.
Anthropic’s Compliance API now reaches Claude Cowork and Claude Code
Compliance API coverage now extends to Cowork across desktop, web, and mobile, and to Claude Code in the CLI and desktop app — in beta, for Enterprise customers with an existing Compliance Access Key. Exposed session content includes “prompts and responses, tool calls content (web and MCP), and skills and artifacts content captured as transcript text,” alongside verified user identity and session metadata. Claude Code on the web and Platform, and sessions on Bedrock, Vertex AI, or Foundry, are excluded from the beta.
Why it matters: This is the next brick in the boundary Edition 24 described — own-compute sessions and pre-inference DLP moved the enforcement point; this moves the audit plane. The agent surfaces developers actually run are joining the same programmatic compliance view as the chat products, which is the prerequisite for every downstream governance control. The exclusions are the practitioner detail: if your fleet runs through Bedrock or Vertex, this visibility does not reach you yet.
Anthropic publishes the cost mechanics of Claude Code sessions
Lydia Hallie’s guidance states the accumulation problem plainly — “Turn 40 is also re-reading the 39 turns before it” — and publishes the operational numbers: prompt cache expiry of one hour on subscriptions and five minutes on API keys, which ENABLE_PROMPT_CACHING_1H=1 extends to an hour; a 30,000-character threshold above which shell output is written to files instead of the conversation; and MAX_THINKING_TOKENS=0 to turn thinking off for a session on every model but Fable 5. The prescription is short, task-scoped sessions: /clear between unrelated tasks, /compact before stepping away, and the claim that one long session costs more than the same work spread across several short ones.
Why it matters: This is first-party context-engineering economics with actual numbers on one of the Grimoire’s highest-weighted topics. It is also a vendor conceding that context accumulation is a cost problem the operator must actively manage — the position practitioners have argued from measurement while tooling marketed ever-longer sessions. Read it beside the paper below on marginal evidence value: the research and the vendor guidance are converging on the same shape.
A specification-first agent refactor across 189 files, with no human code review and no test oracle
Joel Abenhaim reports a fully instrumented case study: an agent dismantling a core lifetime invariant in a 717,725-line production TypeScript application — 189 files changed, 31 new — under a specification-first protocol with no human review of the generated code and no pre-existing oracle. The agent authored a formal spec, refined it against source across 14 audit cycles, implemented, then verified code against the frozen spec across 17 more cycles; 201 defects were caught and corrected in audit before any human ran the result. Convergence was declared at “two consecutive verification passes returning zero findings.” Three days, $2,430, and no observed bugs across roughly thirty subsequent sessions.
Why it matters: SDD’s strongest claim — that a sufficiently precise spec can substitute for human review — is usually argued, not run. This is a rare documented case of running it at production scale, and the convergence criterion is the detail the whole result rests on: zero findings against the spec proves agreement with the spec, not correctness of the spec. One self-reported case establishes feasibility and price, not safety. But feasibility at $2,430 for a three-day invariant migration is itself a data point most teams’ review-cost models do not yet contain.
Worth Scanning
- MCP goes stateless, and developers ask whether that just makes it an API again (InfoQ) — The reaction to the 2026-07-28 spec change (the change itself ran in Edition 24): gateways can now route, rate-limit, and meter agent traffic from two required headers without parsing bodies, which is either a scaling win or an admission that the protocol is converging on ordinary HTTP, depending on who is talking.
- Your contributors are AI-first now. Is your project? (GitHub Blog) — AutoGPT maintainer Nicholas Tindle on the repo instructions, gates, and boundaries that keep maintainers in control as agent-generated contributions arrive in the queue.
- How Claude’s text watermark works (Anthropic) — Anthropic explains its text watermark; Ars Technica’s coverage presses on the detail that matters for practitioners — per Ars, the mark flags anything Claude processed, including human writing it only edited.
- Trivy, not LiteLLM, behind the 2,500-org compromise (SecurityWeek) — The reattribution is the story: SecurityWeek reports 95% of the 2,188 organizations with attributable records were exposed before the malicious LiteLLM packages were published, revising the week’s earlier framing of the credential-leak incident.
- OpenAI and Anthropic in price war as Chinese AI rivals gain ground (Ars Technica / FT) — Both labs cut or held prices on frontier tiers in late July and August as enterprises trial cheaper Chinese models; CNBC reported the OpenAI cuts that opened the sequence.
- How AI disrupts engineering progression (InfoQ) — Alasdair Allan’s argument that AI removes the learning rungs of the career ladder while letting people perform above their experience level; the Unaccountable Delegation paper below maps the same territory taxonomically.
- Cloudflare adds agent tracing, with truncation limits and uneven payload defaults (InfoQ) — Spans for agent invocations, model calls, tool runs, and approvals; the disclosed limitation is the interesting part, because an audit trail that silently truncates is a governance gap, not just an observability one.
- The Right 300 Tokens Beat 100k Noisy Ones (InfoQ) — Baruch Sadogursky and Patrick Debois on context engineering as architecture: lazy-loaded skills, versioned context artifacts, and why stuffed prompts fail.
New Tools & Repos
- Dogwood — Apache 2.0 policy language extending Cedar with temporal conditions over agent event history; reference interpreter explicitly not for production authorization.
- Flue 2 — Astro creator Fred Schott’s agent meta-harness, now with React-style hooks, on the argument that agents are defined by their harnesses.
- Muse Glimmer — Meta’s 30B open-weight agentic model under Apache 2.0; Willison likes the size because a 32 GB machine still has room to run other applications beside it.
- Credentio — Google’s open-source C++ library for local-first validation of C2PA Content Credentials.
- OpenHands v1.13.0 — client-side conversation archive and a substantial features batch.
- LangGraph 1.2.11 — exposes
trace_policyonadd_node. - CrewAI 1.15.16 — execution context management and flow-level human-in-the-loop signal reporting across two releases this week.
- BMAD Method v6.11.0 — consolidates code implementation into a single official
bmad-buildpath, deprecating the parallel routes.
Papers
- Stateful Governance for Concurrent Agentic Systems — Yuxiang Peng, Xiaodi Wu — Introduces MasuGate, a runtime that prevents stale-authorization failures by keeping policy state serializable, so a committed effect is explainable against policy state at execution time rather than request time. The academic formalization of the same concurrency defect Dogwood’s worked example names.
- Beyond Memory: A Transactional Continuity Kernel for Long-Lived AI Agents — Jun He, Deying Yu — Argues storage retention alone cannot identify authoritative state; proposes a transactional control plane that decouples state-change proposals from atomic activation.
- LoopsBench: From Harness Engineering to Loop Engineering in Coding Agent Evaluation — Han Li, Zhemin Fang, Rili Feng, et al. — A long-horizon benchmark of 112 tasks structured as dependency DAGs, evaluating sustained development work rather than localized fixes.
- SpecPath: Testing Coding Agents Across Contract-Equivalent Specification Histories — Yangfan Wu, Haozhe Wang, Huanyu Yang, Jianmin Ji, Fangzhen Lin — Shows agents given functionally equivalent specifications through different revision histories do not produce equivalent behavior, naming the failure “specification-path sensitivity.” Directly relevant to anyone practicing SDD with evolving spec documents.
- Engineering Reliable Coding Agents: Evaluating and Operating the System Around the Model — Stephanie Jarmak — A monograph on the position that agents are evaluated as models but deployed as systems, cataloguing 206 documented practices across harness, state, permissions, and review interfaces.
- Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents — Gabriele La Malfa, Lakmal Meegahapola, Edyta Bogucka, et al. — A 15-category taxonomy of workplace agent risks built from 2,078 job tasks, distinguishing automation-mode from augmentation-mode harms.
- QuoteBench: How Matched Scores Can Hide Command-Path Failures — Shangao Li, Yao Zhang, Volker Tresp, Yuanyuan Yang — Demonstrates that matched execution scores can hide failures introduced after generation, in the serialize-wrap-reparse path between model output and shell.
Ecosystem Watch
- Kiro is now five surfaces — IDE, CLI, web, mobile, and Kiro Crew, with a guide to choosing among them; the same week’s changelogs add cloud sessions in preview and nested AGENTS.md scoped per directory tree. The app sprawl is the signal: the agent is the product, and every surface is a delivery mechanism for it.
- Cloudflare previews WebMCP — any website can expose a WebMCP interface from a single dashboard switch, letting browser agents interact with unmodified pages.
- Vercel’s v0 API goes GA — programmatic generate/iterate/preview/deploy, aimed at agents building apps headlessly.
- Google ships Gemini 3.7 Flash three weeks after 3.6 — the release cadence itself is the story for anyone pinning model versions in production harnesses.
- JetBrains publishes its evaluation and deployment process for Claude Fable 5 — a vendor-published account, worth reading as one of the few public descriptions of enterprise frontier-model evaluation, with that framing caveat attached.
- Spec Kit ships three releases in a week and OpenSpec lands v1.9.0 — both add Command Code support days after its launch; SDD tooling now tracks new agent surfaces at release speed.
The Long View
Edition 24’s lead was a control failing: the human approval prompt, measured catching a minority of dangerous commands, replaced as the Claude Code default by a classifier. This week is a study in what grows where that gate stood, and none of it is a person saying yes.
AWS’s Dogwood makes the agent’s history part of the authorization decision. MasuGate makes policy state transactional so concurrent actions cannot slip past a stale counter. Anthropic’s Compliance API makes the coding agent’s whole transcript a queryable record. Cloudflare’s tracing — lossy defaults and all — tries to make the loop observable after the fact. Each one moves control out of the conversational loop and into deterministic infrastructure around it, which is where this publication has argued it belongs: the model proposes, the infrastructure disposes.
Böckeler’s TDD result reads as the same lesson from the opposite direction. Ceremony inside the loop — telling the agent to perform the rituals that discipline humans — bought no measurable quality at several times the token cost. The practices that made human software development trustworthy do not automatically transfer to agents; the trust has to be rebuilt in the layer around them, where it can be enforced rather than requested.
The open question is whether that layer arrives before the autonomy does. Abenhaim’s case study — 189 files, no human review, no oracle, $2,430 — is what the demand side looks like. The supply side shipped a reference interpreter this month, explicitly not for production. That gap is the ecosystem’s real backlog.
The Artificer’s Grimoire — weekly intelligence on harness engineering for agentic systems — a practitioner’s field guide, by Tim Schiller (Artificer Digital).