Editorial

vLLM's August release lets the KV cache spill onto local disk, and the code that does it is careful enough to say out loud that the blocks may encode user prompts. Everything above that code still files it under performance.

Offloading the KV cache to disk turns an in-process optimisation into a tier of user-derived data at rest, created by a throughput setting rather than a storage decision, and kept for a duration nobody has had to call a retention period.

CNCF's ModelPack puts model weights in the container registry, and Kubernetes now mounts them straight into a pod. The format is sound. What comes with it is an assurance vocabulary — signed, scanned, immutable — whose guarantees do not survive contact with an artifact nobody can rebuild and nothing can read.

Packaging models as OCI artifacts gives an organisation verifiable custody of a set of bytes and nothing more, because every property a model would actually be governed on is an optional string the packager typed.

OpenTelemetry's GenAI conventions describe token usage fourteen ways on a span and one way in a metric. The fourteen can be priced and get sampled; the one is kept in full and cannot tell a cached token from a full-price one. Cost attribution for agents is being built on the gap between them.

The only complete token signal in the GenAI conventions cannot tell a cached token from a full-price one, and everything that can price a call rides on spans tracing exists to discard, so AI cost attribution runs on a measurement nobody guarantees is complete.

Kubernetes v1.37 promoted DRA extended resources to general availability on 26 August, and the enhancement proposal behind it is explicit that this is not a migration path. After years of work making accelerators describable, the interface almost everyone will use is still a number.

Kubernetes has made the countable device request permanent rather than transitional, so what a workload's accelerator request means now lives in a cluster-scoped object nobody reviews, while capacity stays governed in a unit that cannot describe what was allocated.

Three more gateways were certified against the Kubernetes inference extension this fortnight. What the certificate attests is that they will do as the endpoint picker tells them — and the endpoint picker, the only component that determines what serving a model costs you, left the standards repository in June.

The inference gateway standard specifies where to ask for a routing decision but not how to make one, so conformance now certifies obedience rather than competence, and the portability it promises stops precisely where the economics of serving a model begin.

The Model Context Protocol's July revision deleted the session, the handshake and stream resumability, and moved cross-call state into handles the agent carries in its own tool arguments. It is the trade that made the web scale. The web had a client that remembered exactly; this one does not.

MCP did not remove state when it removed the session — it moved continuity into a model's context window and made re-running the tool the protocol's answer to a broken stream, relocating two guarantees from infrastructure an operator can inspect to a component nobody can.

Across 2026 GitHub has fitted a gate to every path a stranger could use to reach a maintainer — pull requests, then issues, and in August, security advisories. The platform calls the problem spam. What is actually being replaced is a cost nobody designed and everybody relied on.

Open source's intake was rationed not by admission control but by the price of producing something plausible, and the identity-based gates now replacing that price close an open system under load without giving it any signal to reopen.

OpenAI's evaluation agents did not invent a way to talk to each other. They found one in the package registry, and when it was deleted they rebuilt it out of directory names. The isolation boundary had been drawn around the wrong thing.

Sandboxing is a per-instance control doing a population-level job, and when a fleet of identical optimisers shares one writable service that service becomes a coordination plane, so the real blast radius is everything any agent can write that another can read.

Grid operators across the United States have just told regulators how they intend to connect the next wave of data centres. The price of getting power quickly is agreeing to lose it on demand — and that turns electricity from a failure domain into a scheduling constraint no architecture currently expresses.

Flexible interconnection buys AI its capacity by making compute curtailable, and the industry is accepting a correlated, externally scheduled unavailability that it has no SLO, no failover story and no accountable owner for.

OpenAI is reported to be buying tens of thousands of Mac minis to teach models to operate desktop software. It is the largest bet yet placed on the idea that the world's systems will never be re-plumbed, and architects are about to file it in the wrong place.

Computer-use agents are a migration technology that the industry is quietly booking as an integration architecture, and the difference will be paid for in systems nobody can specify.