Editorial

OpenTelemetry moved the GenAI conventions into a repository of their own and told instrumentation authors to get the schema URL from there. That repository has no releases, no tags, and eight unreleased breaking changes — so the record of what agents did is being written in a vocabulary with no documented way back.

OpenTelemetry built the telemetry schema so unstable attribute names could change without orphaning the data already collected, and agent telemetry is now the one body of data being emitted with no version to migrate it from.

The IETF's workload identity group has adopted a framework that makes an AI agent's identity unforgeable and its credentials short-lived. The step that decides what the agent asks for is one sentence long, and it says the step is somebody else's problem.

Agent identity is standardised to cryptographic rigour while the step that turns a natural-language mission into the scopes an agent requests is out of scope, so least privilege is computed at run time by the component the same document forbids from holding a credential.

vLLM can now rewrite the weights of a running engine while requests are in flight, and its documentation says plainly that a paused request resumes under the new ones. The only version those weights carry on the serving path is a free string with a default value of "default".

vLLM has made a live model's weights mutable mid-request while leaving their only serving-path identity an optional string the trainer types, so the one instrument that could say what actually answered is a dev-mode endpoint you must stop serving to call.

Kubernetes has just made the containers in a running pod mutable, so that agents can spawn tool sandboxes in milliseconds. The record of which containers a node actually agreed to run was judged too expensive to store, and now lives on the node, ten statuses deep.

Kubernetes has moved the record of what a pod is actually running out of cluster state and onto the node, where nothing can watch it, list it, or keep it past ten containers.

On 17 September Anthropic began granting verified life-science teams access to models with the biology safeguards relaxed — team grants renewed yearly, project grants every six months, scoped to the use cases named on an application form. The API those teams call has no field for any of it.

A model's full capability is now an organisational grant with a declared scope and an expiry date, while the only machine-readable signal at the boundary is a policy category that cannot distinguish a permanent prohibition from a grant that quietly lapsed.

The Green Software Foundation's carbon standard for AI is being edited into ISO shape this month. Its rules for counting emissions are stricter than almost anything in corporate reporting. Its rules for what to divide them by quietly guarantee that the number can never ask anyone to build less.

SCI for AI divides a provider's emissions by what it consumed rather than by what it delivered, so the carbon of a single answer is the one figure the standard cannot produce.

A rule in Anthropic's fallback-credit reference decides what a declined request costs. Re-send it word for word on a different model and the cache you paid for is credited across; rewrite the question and you pay again. Opus 5.5 is the first flagship model to ship with that economics underneath it.

Refusal fallback refunds a retry only when the prompt is re-sent unchanged and lets the model be the one thing that varies, so the cheapest answer to a policy decline is now a weaker model rather than a better request.

In one proposal, MCP deprecated the three features by which a tool declared what it could touch, whose model it used, and what it was doing. Every replacement the specification names sits on the far side of the boundary the protocol exists to cross.

MCP has deprecated the three features that made a tool call legible rather than merely executable, and every replacement it names sits on the server's side of the boundary, leaving the host it still holds accountable unable to say what a tool did.

Speculative decoding is the one inference optimisation adopted because a proof says it changes nothing. In the test file vLLM names for its correctness, the property that proof describes is not asserted at all — what is checked is a benchmark score within three per cent and an acceptance rate above a floor.

Speculative decoding's lossless guarantee is what keeps a second model out of anyone's change control, and the only instrument production exports for it is acceptance, a throughput number with a floor, so its failures arrive as a disappointing speedup rather than a stop.

Anthropic's continuous integration ran twenty-five times as many jobs in six months, so it built a service that decides which tests not to run. When that service fell twenty minutes behind, nothing turned red. Test selection has given CI a failure mode whose only symptom is a faster, greener build.

Test selection makes a passing build a claim about how fresh a separate service's test history was when it chose, and staleness in that service has no red state: it presents as a green check on a change whose tests never ran.

The Agent2Agent protocol was built on a declared virtue — that a remote agent need never reveal its internal state, memory or tools. That was affordable when delegation meant asking for a value. A2A is a protocol for delegating actions, and its record has no place to put them.

A2A tells a caller that a delegated task stopped producing output, never that it stopped having effects, so the protocol cannot say whether there is anything to compensate.

The agent discovery specification backed by Google, Microsoft, GitHub and Hugging Face makes ranked search a registry's only mandatory interface, then forbids the orchestrator from reading that ranking as a judgement about trust. The ordering is the one signal guaranteed to arrive.

Agentic Resource Discovery converts the choice of a runtime dependency into a ranked retrieval result computed from text the publisher wrote about itself, then forbids the orchestrator from acting on the only signal that reliably reaches it.