What we didn’t say, because it hadn’t yet become undeniable, is that the 95% failing to generate productivity gains doesn’t mean the great AI replacement isn’t happening. It means the great AI replacement was never about productivity to begin with.

The Cobra and the Amazon Warehouse

The fact that the production of cobras had become decoupled from the elimination of cobras was, from the perspective of the metric, largely incidental.1

The British Raj introduced a bounty on dangerous snakes around 1875, reasoning, not unreasonably, that if you paid people to bring in dead snakes there would eventually be fewer snakes, which would eventually mean fewer of the approximately nineteen thousand annual deaths that the snake population was extracting from the subcontinent with a consistency that suggested something closer to policy than accident.2 The logic was the kind that looks airtight in a planning document and considerably less airtight in contact with the people it is intended to incentivize, who are, as they have always been, rational actors operating within the incentive structure they have actually been given rather than the one the planning doc assumed.

The story you have heard, if you’ve heard it, goes something like this: the locals bred cobras for the bounty, the British figured this out and cancelled the program, the breeders released their now-worthless inventory into the streets, and the city ended up with considerably more cobras than it started with, in the OG demonstration of the cobra effect, which is what happens when your solution becomes the problem, cited approvingly in economics textbooks and airport business books and at least one podcast whose website has become the primary source for a peer-reviewed academic paper, which is a level of epistemic collapse that would have interested the Raj considerably.3

Is your AI policy breeding Cobras?

Amazon warehouse workers, it emerged recently, have been using AI tools to perform tasks they don’t actually need performed, in order to inflate the usage scores their performance reviews now depend on. When the early reports broke, they focused entirely on the fulfillment center floor: the headlines claimed that Amazon warehouse workers were running fake AI tasks on their terminals to dodge performance metrics.4 It was a perfect modern fable, conjuring images of blue-collar line workers outsmarting an intrusive algorithmic boss.

But the truth of what emerged was both weirder and more indicative of corporate panic: the phenomenon wasn’t happening among the conveyor belts at all. It was playing out three layers up, among Amazon’s software developers and corporate engineers, who promptly raced to be the first to call it tokenmaxxing on social media.5

The mandate, by this point, exists everywhere simultaneously and nowhere in particular. Executives announce that the organization must become AI-native to justify billions in capital infrastructure spending. Middle management translates this into utilization targets. Someone, somewhere in executive leadership, decides that if AI adoption is the metric, the mandate should be eighty percent of developers using these tools weekly, and begins tracking token consumption, literally as the raw volume of data processed by a large language model, on internal team dashboards and leaderboards.6 It was as if a taxicab service started giving bonuses for amount of gas used, but it was a decision that made complete sense in a planning doc and somewhat less sense in contact with the engineers it was designed to incentivize, who are, as previously noted, rational actors operating within the incentive structure they have actually been given and somewhat clever about automating things.

Somewhere three layers down, an employee spins up an internal agentic platform like MeshClaw, an agent built to automate email triaging or Slack interactions, and instructs it to run extraneous, low-value loops purely to burn through data.7 Because agentic workflows iterate and loop autonomously, they are spectacularly efficient at generating the precise cryptographic exhaust the company is monitoring. The interaction itself has become economically legible in a way the underlying work is not.

The difficulty, for leadership, is that the metrics available to measure AI transformation are necessarily proxies. Token consumption. Copilot engagement. Prompt volume. AI-assisted commits. The dashboards are indeed a sight to behold. Though the actual underlying productivity gains remain, in many cases, strangely difficult to locate. Amazon officially maintains that token metrics do not directly factor into performance reviews, but when the numbers are visible to managers on a ranked leaderboard, employees recognize the implicit threat. They optimize for the metric to shield themselves from an assumption of underperformance.8

And because organizations optimize around what can be measured rather than what was intended, employees respond accordingly.

• A sales organization mandates minimum weekly AI usage targets tied to quarterly reviews. Within two months, representatives begin routing customer call transcripts through summarization agents regardless of whether the summaries are ever consulted again, because unused summaries still count toward utilization. The mandate succeeds. Token consumption triples. Leadership presents the adoption curve at the next board meeting.

• An engineering organization introduces “AI-assisted development KPIs” after reading a consulting report suggesting elite teams will soon generate 40% of production code through copilots.[10] Developers rapidly discover that asking the model to scaffold boilerplate they immediately rewrite still satisfies the reporting layer, while the genuinely difficult architectural work continues happening exactly as before, only now interrupted by the requirement to periodically generate machine-produced code artifacts so the dashboard remains healthy.

• A customer support department deploys internal agents intended to accelerate ticket resolution. Workers, recognizing that AI interaction frequency has quietly become a managerial signal associated with adaptability and future promotion, begin invoking the agent for tasks already well within their competence, producing longer handling times alongside dramatically improved AI engagement metrics. Leadership concludes adoption is proceeding successfully.

The employee is not resisting the mandate. (We’ll get to that later.) The employee is complying with the mandate as the organization has operationally defined it, which is always the dangerous moment in any sufficiently abstract transformation initiative. Because “use AI” sounds, at the executive layer, like a strategic imperative, but arrives at the operational layer as a measurement system, and measurement systems have a long and distinguished history of producing behavior orthogonal to the outcome they were originally introduced to encourage.

Somewhere, inevitably, there is already an engineer with a private script named goodhart.py quietly generating synthetic copilot interactions to satisfy an internal token quota imposed by someone three reporting layers above them who has never once opened an IDE themselves. Every sufficiently mature enterprise initiative eventually acquires at least one employee who understands the metric better than the people administering it. The tokenmaxxing cobra farmers across Amazon, Meta, and Microsoft are simply producing exactly what the system requested; had they worked in SaaS, they would have called the repository something like ai-adoption-helper and received a discretionary performance bonus for “driving organizational transformation.”

The fact that the production of tokens has become decoupled from the generation of value is, from the perspective of the metric, largely incidental. And what is being measured is ofc not what is actually happening. Even if it does make for a good story.

Or at least something adjacent enough to place on a quarterly slide deck.

Retcons All The Way Down

The cobra effect, as universally understood, is itself a retcon

The cobra effect story is tidy. It has its own Wikipedia page. It’s also historically wrong. Or rather, it’s a compression that lost the most important information in the encoding. The bounty regarding dangerous snakes started around 1875 and underwent modification around 1895. The goal was to reduce deaths from snakebite, which hovered consistently around 19,000 per year. In 1892, the Raj paid bounties on 84,789 reptiles. In 1893, they paid on 117,120. It was suspected but never proven that people were breeding snakes for profit. More to the point, the death rate barely moved.9

The death rate hovered, with the kind of statistical indifference that suggests the bounty had not so much failed to reduce the snake population as failed to meaningfully interact with it at all. In 1891, 21,389 people died from snake bites. In 1892, with 84,789 reptiles paid for under the bounty, the number was 19,025. In 1893, with 117,120 reptiles paid for, it was 21,213. The suspicion that people were farming snakes for the bounty was never proven, and the death rate’s failure to decline said less about cobra breeding than about the fundamental intractability of nineteen thousand annual deaths in a country of that size and that relationship to its landscape. The bounty was reduced, eventually (not cancelled, reduced) and the death rate did not noticeably respond to that either, because the death rate had its own agenda, which the bounty had never successfully engaged.10

The myth that the locals caused a cobra explosion is a retrospective compression; a way for administrative systems to blame the targets of an intervention for the baseline failure of the intervention itself. It turns out to be retcons all the way down. The internet desperately wanted the “Amazon warehouse” narrative to be true because it fits a comfortable, algorithmic-resistance trope: low-wage workers sticking it to the machine by gaming the system. But that narrative serves as a smoke screen for the systemic collapse happening in the corporate tier. The warehouse floor wasn’t tokenmaxxing; corporate developers were, because upper management bought into an incomplete, top-down model of “AI transformation” and needed to justify billions in capital expenditure. When the proxy metrics failed to yield real productivity gains, the system didn’t question the metrics, it just monitored the boards harder, forcing its highest-paid engineering talent to spend their days behaving like snake farmers.

What actually had worked in 1890s India wasn’t the bounty, and it wasn’t a crackdown on mythical cobra breeders. It was the boots. Farmers in the fields were dying at rates that declined, measurably and specifically, once they started wearing footwear thick enough to stop a fang.

But nobody talks about the boots, just as nobody wants to talk about the actual code being written at Amazon. The underbrush removal that caused the precise category of adverse effect that good-faith interventions with incomplete models reliably produce, driving rats, and the snakes trailing them, right into the village houses. Nobody talks about that either, because the tidy version, where the subjects are devious, the metrics are absolute, and the failure can be blamed on localized fraud, the story that that incentivisation produces perverse behavior, and perverse behavior destroys the outcome the incentive was designed to produce, sounds like a better story. And better stories circulate faster than the internal Slack logs of a corporate engineering team burning cash to keep a dashboard green, circulate faster than primary sources from the Chambers’s Journal of 1895, which is not available as a podcast.11

Horse and Buggy Software

Technology does not eliminate jobs, the received wisdom goes (and what is received wisdom but a retcon), it relocates them; the received wisdom is not wrong, exactly, in the way that a map is not wrong when it omits the elevation, in describing the territory with enough accuracy to be useful and enough omission to be dangerous, depending on where you are going and how much the climb matters.12

The horse didn’t survive the automobile as an industry, but the people responsible for the care and feeding of horses became saddled with the job of maintaining the machines needed for the automobile; they became mechanics, and machinists, and assembly line workers, and the vast ecosystem of human labor required to extract oil from the ground and refine it and move it through a distribution network and deliver it to the stations where the cars that needed it could find it, which over the following century produced employment at a scale that the horse economy could not have imagined, and which is the version of the story that gets told, and which despite also being a retcon, is true, as far as it goes.

What the story tends to gloss over is what happened to the mechanic when the car got computerised. The computer didn’t eliminate the mechanic. It shifted the mechanic’s work from the physical diagnosis of mechanical failure—a task that rewarded accumulated craft knowledge, that got better with decades of practice, that was legible to the person doing it in ways that could be taught and refined and passed on—to the act of connecting the car to a device and reading what the device said, and then ordering the part the device specified and installing it, which is a different category of work, requiring less judgment, commanding less pay, and carrying less of what the previous version of the job was made of. Rather than disappearing, mechanic got cheaper (on the supply side that is, on the demand side the price of car servicing has increased substantially, as anyone who has received, following a four-minute consultation between a mechanic and a screen, a bill of $1,753.41 before parts and tax, well knows) and the craft that made the mechanic irreplaceable got thinner, and the knowledge that accumulated over a career got shallower, and none of this showed up as unemployment because the person was still employed, doing something still called by the same name, though his coveralls were noticeably cleaner.

What also got thinner was the mechanic’s understanding of what the device was reading. The device diagnosed. The mechanic knew how to read the device. These are not the same kind of knowing, and the difference between them becomes visible when the device is wrong; when the fault code points to a sensor and the sensor is fine and the actual problem involves something the device doesn’t surface, even though the sensor could detect it, something that would have been obvious to the mechanic who could hear it and smell it and feel it through thirty years of accumulated attention to how things fail. That mechanic exists. That mechanic is even more expensive and that mechanic is not the mechanic the diagnostic device made economically rational to employ.

the condition under which “moving up the stack” is a description of progress rather than a description of a person standing on a ladder whose lower rungs are being removed.

But someone still had to design the diagnostic device, and the software that ran on the diagnostic device, and the chips the software ran on, and the compilers that translated the code into instructions the chips could execute, and the fabs where the chips were made, and the lithography systems inside the fabs, and the ultra-pure water systems the lithography required, and the supply chains that delivered everything to everything else, and the grid that powered the supply chains, layer beneath layer in a dependency stack that expanded horizontally as it deepened, generating employment at every level, most of it further from the physical world than the level below it, most of it more abstract, most of it more dependent on the layers beneath remaining stable and legible and available to the people working above them, which they were, for a long time, which is the condition under which “moving up the stack” is a description of progress rather than a description of a person standing on a ladder whose lower rungs are being removed.

Meanwhile the software got buggier. As a direct consequence of the same optimization that made the mechanic cheaper: a shift from trying to prevent failures to trying to recover from them faster, which makes complete sense when the systems have grown too complex to keep stable and which produces, as a direct and measurable consequence, more failures, more frequently, in systems that a decreasing number of people understand well enough to articulate. As Mitchell Hashimoto recently observed,13 the AI infrastructure build-out is repeating the DevOps debate about MTBF (mean time between failures) versus MTTR (mean time to recovery), and the industry appears to be making the same choice DevOps made, which was to optimize for recovery, and not reduced failures.

Defensible as a choice, but also a choice that accepts failure as a chronic condition and defines success as not staying down too long, which describes a different relationship to reliability than the one the previous generation of engineers was hired to maintain. Anthropic’s service status page offers a public record of this relationship in practice. The brownouts and degradations that have become a feature of operating at the frontier are not accidents of scale (though Anthropic seems to struggle with them much more than the other labs.) They are the output of a system optimized for recovery, running exactly as designed, at a reliability level the optimization target was designed to accept. The software is buggy on purpose.

Developers Developers Developers Developers

Software has gotten easier to write, but harder to understand.

There can be no doubt that the office chair has become more comfortable.14 Still eons behind gamer chairs, tho we’re starting to see more of those at startups. And there can be little doubt that during the same period software has gotten easier to write. What was once a an exercise in muscle memory and meticulous attention to syntactic details had come to be turbo autocomplete where tab becomes the most used key on your keyboard, which from a muscle memory point of view is an unambiguous victory, in the same way that not having to remember phone numbers is an unambiguous victory, and which carries, in both cases, the same quiet implication that you would be in very much over your head if the situation ever arose where you needed to remember one.

Regarding what is actually happening no one as yet has a coherent thesis supported by evidence, so everyone constructs one in real time, as the epistemically appropriate response to a situation in which the signal is genuinely contradictory and the stakes are high enough that silence has acquired the specific social weight of holding an antimemetic opinion, an admission the modern online economy has yet to find a way to prosecute but is working on it. So the thought pieces proliferate. The frameworks multiply. The conference panels convene. And over all of it hangs the industry’s dominant retcon: developers weren’t being replaced, they’re being given an opportunity to move up the stack. Being given a better chair, even.

The argument has genuine historical backing. From assembly to C, from C to Python, from on-prem to cloud, from manual memory management to garbage collection, every major transition involved movement to a higher level of abstraction, and in each case the practitioners who adapted found themselves working at a level that was more powerful, if less granular. The stack got taller. (bigger, and more angular15) The abstraction was genuinely upward: you retained what you knew and gained a higher vantage. The retcon frames the current moment as the latest iteration of this pattern, which would be a reasonable frame if the pattern were actually repeating, which it is not, certainly not in the way that matters.

The distinction the retcon requires you not to make involves the difference between a higher level of abstraction and a higher level of ambiguity. When a C++ developer moved to Python, they did not report brain fog. (They did report other kinds of trauma, but that’s a story for another day.) When a sysadmin moved to AWS, they did not feel their understanding of networking precariously dissolve. Previous transitions preserved the knowledge of the layer below, automating interaction with that layer without making the layer inaccessible, which is why the developer who moved from C to Python could still reason about memory management when something went wrong at the boundary. The abstraction was upward. What gets reported now differs in kind: engineers losing the ability to hold a codebase in their heads, losing the capacity to reason about the system they are nominally responsible for, losing the thread of what the code is actually doing underneath the layer the agent is operating on.

Brain fog, like Gibson’s famous future, is not evenly distributed. The engineers who report the most acute version of it are not, by and large, the ones who understood the stack most deeply. They are the ones for whom the agentic tools arrived before the underlying knowledge had fully formed, for whom coding had been something the tooling managed, the syntax something the autocomplete supplied, the architecture something the framework handled, and who were, for a remarkable stretch of time, compensated extraordinarily well for their fluency with the interfaces rather than their understanding of what the interfaces were built on. An entire generation for whom software development was, at some meaningful level, a video game16 that paid exceptionally well and which the agentic tools have now revealed to have been, in part, a video game being played on someone else’s hardware.

The retcon interprets this as the temporary disorientation of transition, the expected friction of moving to a new level of abstraction, something that will resolve once the new paradigm is fully internalized. The more accurate interpretation is that it is the perception of a capability being abandoned rather than relocated; not moved up the stack but left behind in it, inaccessible not because it has been abstracted but because the tools that were supposed to augment it are instead substituting for it, and substitution and augmentation are not the same operation, and the difference between them only becomes visible at the moment when the layer below needs to be reasoned about and the capacity to do so is no longer there.

The retcon reframes this revelation as elevation. The skill deficit that the tools have exposed becomes the proof that the tools are needed, which is true as far as it goes, and which goes considerably less far than the retcon requires it to. What the tools are actually doing to the population using them has been described with some precision by the researchers studying it: the use of coding agents is actively diminishing the very skills needed to effectively manage the coding agents, which is the cobra effect stated at the level of individual cognition, running in real time, visible in the data, and re-described as progress by an industry that has staked too much on the productivity thesis to afford the alternative interpretation.

Without it, the industry would have to confront what the transition is actually producing, which is not a workforce moving up the stack but a workforce discovering that the stack they thought they were on was shallower than the salary suggested, and that the AI has not so much replaced their skills as revealed the gap between the skills they had and the ones the salary was pricing.

No One Expects The Comfy Chair

The chair got more comfortable.17 This is what happened between 2010 and 2024 for a significant portion of the people now asking why they are being laid off. The IDE got smarter. The framework handled the architecture. The autocomplete supplied the syntax. The linter caught the errors. The CI/CD pipeline managed the deployment. Each abstraction layer added comfort to the chair, removed one more reason to understand the layer below, and was experienced as progress because the output kept coming and the salary kept arriving and the title kept accumulating and the understanding kept thinning and nobody was measuring the thinning because the output was the metric and the output was fine and the chair even had a tilt lever.

PEBKAC (Problem Exists Between Keyboard And Chair) was the help desk’s sardonic shorthand for user error, the human in the loop as the weakest link, the thing that would be fine if only the person would get out of the way. Agentic tools didn’t change the acronym. They changed which side of the keyboard the problem was on. The Problem Exists Between Keyboard And Chair, and the chair is a big part of the problem, and the chair is the thing being removed, and the person in the chair spent a decade being told they were moving up the stack while the stack was quietly being built around them in a way that made the chair unnecessary. As comfortable as it was.

Doing Less With More

The gap between what the invoice said and what the board slide promised was not, in the end, a measurement problem. It was the measurement itself.

The corporate math was presented, in every instance, as self-evident. Headcount is a cost. AI reduces the need for headcount. Reducing headcount reduces cost. The freed cost funds AI investment. The AI investment further reduces headcount. The model is recursive. The flywheel spins. The slide is clean. The coffee is ok.

Gartner surveyed 350 large companies actively deploying AI, by any reasonable standard the organizations most positioned to be getting this right, and found that 80 percent had reduced their workforce as a ‘direct result’ of their AI investments. The finding that followed was the one nobody had put in the deck: the layoffs had zero statistical correlation with improved ROI. Companies that cut the most staff showed returns nearly identical to companies that cut the least.

One mechanism the correlation data cannot explain is knowledge debt. Not the kind that appears on a balance sheet, bc it doesn’t appear anywhere a dashboard monitors or a quarterly review surfaces but is the accumulated understanding of a specific system, built by specific people over specific years of decisions that were made for reasons that made sense at the time and were never written down because the person who made them was always available to explain them, until they weren’t. The lag between cutting the humans and discovering what the humans were doing is long enough that the decision looks rational at execution. The first quarterly review looks fine. The second looks fine. The third surfaces something that cannot be explained without reference to a person who left eight months ago, and by then the documentation they were supposed to produce before leaving has been discovered to be incomplete in a particularly crucial way, bc the knowledge that matters most is hardest to articulate, which is why it was never articulated, and why it left with them. Which is why we aim organisationally to eliminate irreplaceability.

What the Gartner data also cannot capture is the response from the other side of the transaction. One study found that 29 percent of employees admit to actively sabotaging their company’s AI strategy, with the number climbing to 44 percent among GenZ, whose resistance is deliberate and tactical: feeding corrupted data into models, routing around corporate control planes with unauthorized tools, intentionally generating low-quality output to demonstrate system fragility while 60 percent of executives plan to lay off employees who won’t adopt AI, 77 percent will bar non-adopters from promotion, and 92 percent openly admit they are cultivating an AI elite. Leadership has spent two years insisting this is a productivity initiative. The workforce isn’t so sure, and neither is the data.18

Moreover, the data does not and cannot capture what is happening to the work itself. The model does not argue when you accept its suggestion for another layer of indirection. It does not push back when the product requirement is vague and the prompt is lazier still. The model is the world's most expensive yes-man, and organizations have discovered they like being told yes. The result is not acceleration toward excellence but acceleration toward sufficient because sufficient ships, sufficient meets the KPI, and sufficient can be presented to the board as evidence that the AI investment is bearing fruit, even as the long-term carrying cost of the sufficient codebase (quietly) metastasizes in production.

First The Good News

Q1 2026 earnings calls established is that something is happening.
What they did not establish is what.

Zuckerberg described engineers building in a week what once required dozens and months. IBM disclosed 45 percent productivity gains across its developer workforce and $4.5 billion in internal cost savings since 2023. These are quantitative claims in the technical sense, containing numbers, stated with executive confidence on a live call to institutional investors. They are not quantitative claims in the empirical sense, because none were independently verified, and because the people making them had a structurally motivated interest in demonstrating that the AI investment was generating returns.

But Meta did post the most lucrative opening quarter in its corporate history ($56.31 billion in revenue, $26.8 billion in net income) and three weeks later announced 8,000 layoffs. At the internal town hall, Zuckerberg was direct: getting everyone to use AI tools and doing the work more efficiently is not the thing that’s driving layoffs. The CEO who had just spent an earnings call crediting AI-enabled productivity gains, now telling his own employees that the productivity gains were not why anyone is losing their job. Cisco ran the same play this quarter. Cloudflare followed suit with an apologetic memo described as “the first true AI-layoff manifesto.”

So, AI is enabling companies to do more with less (according to the earnings calls) but also AI is not the reason for all the pink slips (according to the layoff announcements.) And then there’s the CEPR survey of 5,000 firms in the same period found that around 80 percent reported no AI-driven productivity gains at all.19 The Atlanta Fed found measurable gains concentrated in high-skilled tasks, with perceived gains exceeding measured revenue gains, a gap the researchers called the productivity paradox, which might less diplomatically be described as the distance between what gets said on earnings calls and what shows up in the books. McKinsey found only 39 percent of companies reporting any current EBIT impact from AI. But 39 percent is not nothing.

The actual data resolves into a measurement fog dense enough that the same quarter can produce IBM’s $4.5 billion in savings and a survey of 5,000 firms reporting nothing measureable. Both can be accurate while neither indicate what is actually happening, because the proxies measure things adjacent to the outcome rather than the outcome itself ; the metric has decoupled from what it was introduced to track, and the decoupling is invisible from inside the metric. When Uber rolled out Claude Code to its 5,000-person engineering organization in December 2025 and by March had 84 percent of engineers using it (with 70 percent of all committed code originating from AI, the highest publicly reported ratio at any major technology company) it announced it had AI opening 11% of new pull requests, which reveals precisely what percentage of committed code came from AI and nothing whatsoever about whether that code was worth what it cost to produce.

CTOs built internal dashboards ranking engineers by AI consumption, which functionally made them cost-acceleration mechanisms. Like Amazon, who in the same period it was announcing 16,000 layoffs, launched a token consumption rankings page, Meta called theirs “Claudeonomics” and handed out badges like “Token Legend” and “Session Immortal” — the cobra farm stated as corporate policy, formalized into vocabulary, and gamified into a leaderboard. Uber also built internal dashboards ranking engineers by AI consumption and found their top engineers were burning between $500 and $2,000 each per month. Uber’s full-year AI budget was exhausted by April.20 Microsoft, after a quarter of telling investors that Lloyds Bank was saving each employee 46 minutes per day, quietly canceled most of its internal Claude Code licenses in May 2026, effective June 30, directing its own engineers to its own cheaper tool. And Bryan Catanzaro, Nvidia’s own VP of Applied Deep Learning, told Axios that for his team, the cost of compute had already exceeded the cost of employees. Taken together, these findings that explain why the earnings call slides require such careful construction.

Because large language models remain structurally prone to hallucination and architectural regression, cutting the human layer doesn’t eliminate the labor cost, it forces the enterprise to pay twice and both bills are on the OpEx side. Once for the token bills of the autonomous agents, and again for the specialized engineers whose job is to untangle what the agents produced. Salesforce will spend nearly $300 million on Anthropic tokens this fiscal year, against a global engineering payroll of roughly $5 billion for 15,000 engineers. That the token bill is no longer a rounding error in an R&D budget but a massive, recurring, variable operating cost that scales with every line of automated output does not make the financial decision any less rational or the amount any less commensurate, and it also does not replace the humans required to verify that output. It joins them on the invoice, at a rate that makes the original headcount reduction look, in retrospect, like a discount. Which it kind of was.

The Gartner data on who succeeds points elsewhere. The companies doing best are not the ones that replaced humans with AI or maxed out their token spends. They invested in people alongside it, building systems where humans supervise and extend what AI produces (which is not to imply Benioff isn’t doing that, I don’t have that insider info.) It’s a narrative that’s easy to nod along to and not so easy to put into practice. And even when it is put into practice, the bill has a way of coming due anyway, as we’re seeing with current obsession over the token cost reduction.

Doing more with less was the promise. Doing less with more is the condition: less verifiable return, more spend; less human understanding of the systems humans are nominally managing, more dashboards measuring the proxies that replaced that understanding; less signal, more noise; less stability, more recovery. Goldman Sachs forecasts a 24-fold increase in enterprise token consumption by 2030. (Let that sink in.) Gartner projects that even as individual token prices fall 90 percent, total enterprise AI costs will increase, because agents consume tokens at rates that make price-per-token beside the point. (Opus 4.7 consumes 4× as many tokens for the exact same prompts.) The math does not improve at scale. It compounds. The invoice arrives later and larger, and the people who receive it are not, in many cases, the people who signed the contract.

The story currently circulating is as clean as retcons get: AI is working, the adoption curve is healthy, the returns are coming, the companies that cut too deep are simply early, and the capital is flowing in the right direction. What capital is actually building is a different question. And unlike the productivity claims, unlike the 46 minutes saved at Lloyds and the 45 percent gains at IBM and the budgets blown away by April, and the dashboards and the tokenmaxing and the shadow IT cobras running under everyone’s desk; the answer is not a matter of measurement lag or methodology.

Spending Other People’s Money

Signals that resist narrative have a different epistemic status than the ones that welcome it.

In a moment defined by universal narrative constructions, retcons layered on retcons, everyone reaching for a story that organizes the contradictions into something livable, there is one signal that is not a story. It does not care about the productivity paradox or the measurement fog or the 80 percent of firms reporting nothing or the 39 percent reporting something or the earnings calls or the employee sabotage or the token bills or the knowledge debt or any of the other genuinely unresolvable questions that we have left exactly as it found them: unresolved. Capital moves. And the movements are physical, visible, and denominated in a currency that does not so much fluctuate with the quarterly narrative, as underpin it.

PJM, the grid operator responsible for electricity across thirteen states and the District of Columbia, serving approximately 65 million Americans, projects a six-gigawatt shortfall by 2027, which is not a forecast about AI adoption rates or enterprise pilot outcomes or whether the productivity studies will eventually vindicate the investment thesis. It is a statement about watts, which are physical, and about the gap between the watts that will be demanded and the watts that will be available, a gap that doesn’t listen to earnings calls and cannot be resolved by a better narrative about where the industry is going.

Buy The Numbers

Five technology companies now spend more on capital expenditure than the entire global oil and gas industry spends on upstream production.21

The International Energy Agency published this finding in April 2026, effectively ending arguments about whether the AI build-out is real, whether the productivity claims justify the investment, whether the companies are getting ahead of themselves in a way that will eventually require correction or any of the other tangents thrown out as ‘explanations.’ The answer to all of those questions is that they’re the wrong questions.

Google, Amazon, Microsoft, Meta, and Oracle have committed between $660 billion and $690 billion in capital expenditure for 2026 (a 77 percent increase over 2025’s record of $410 billion, which was itself a 75 percent increase over 2024.) 📈 Amazon alone projects $200 billion. Alphabet projects $175 to $185 billion, which will reduce its free cash flow by approximately 90 percent, from $73 billion in 2025 to an estimated $8 billion, a number that would represent, for any other company in any other sector, a distress signal. For Alphabet, it represents the cost of not falling behind.22 Microsoft’s calendar-year 2026 capex came in at $190 billion, $38 billion above analyst estimates, with $25 billion of the overage attributable solely to rising memory and chip costs. Alphabet’s cloud contract backlog reached $460 billion in Q1 2026, roughly double the $240 billion reported three months earlier.

The corporate balance sheets are no longer sufficient to fund the build-out at the required pace. AI-related debt has reached $1.4 trillion, making it the largest single segment within US investment-grade credit markets. The companies are issuing bonds. The bonds are being bought. The debt markets have reached their conclusion, with the precision debt markets apply to such conclusions, that the infrastructure being built is worth financing at scale, regardless of whether the productivity paradox ever resolves.

Valve runs the PC gaming infrastructure of the civilized world with approximately 350 people and an estimated $17 billion in annual revenue (roughly $50 million per employee) outpacing Google, Amazon, and Microsoft by orders of magnitude on the only ratio that matters in a leverage economy. By way of contrast, GitLab employs 2,500 people to generate $600 to $700 million in annual revenue. Which doesn’t mean GitLab is a poorly run company; it’s a *normally* run company. The delta between Valve and GitLab, and between both of them and the organizations currently deploying thousands of engineers to produce 70 percent AI-generated code at token costs that exhaust annual budgets by April, is not the tooling, which is increasingly the same. The delta is whether individual human judgment interacts directly with leverage, or is separated from it by the layers of translation, from mandate to KPI, KPI to dashboard, dashboard to utilization metric, utilization metric to quarterly slide, converting the decision to do a thing into the administrative management of it being done, which is not the same thing. Capital already has proof of concept for what high-leverage human-AI substrate produces. The question running through all this, “does the investment generate returns?” has a demonstrable answer at the substrate level. The answer is mos def (yes) but under conditions that most large organizations have specifically engineered themselves out of being able to achieve.

The bottleneck to this is not the chips. It’s the power to run them. Forty percent of announced AI data center projects are currently delayed by power infrastructure constraints, not chip supply, not regulatory approval, not financing. (Electrons, the problem is electrons) The IEA projects that data center electricity consumption will double from 485 terawatt hours in 2025 to 950 terawatt hours by 2030, with AI-focused facilities growing three times faster than that. At current trajectory, global data centers would constitute the fifth largest energy-consuming entity on earth, ranked between Japan and Russia. Virginia, where data center density is highest (and AWS the most unreliable) already routes 26 percent of state electricity to computing infrastructure.

Capital’s response to this constraint is visible from considerably further up the road. Microsoft has signed a 20-year power purchase agreement with Constellation Energy to restart the shuttered Unit 1 reactor at Three Mile Island which is the first time a retired nuclear reactor in the United States has been brought back to life for a single corporate client. The plant will generate 835 megawatts, equivalent to the annual consumption of 800,000 households, 100 percent of which will go to Microsoft’s data centers in Pennsylvania, Illinois, Virginia, and Ohio. The agreement runs to 2044. Amazon has contracted 1.92 gigawatts from the Susquehanna nuclear plant through 2042 and committed $500 million to small modular reactor development. Meta has announced a 6.6-gigawatt nuclear procurement strategy for its Prometheus AI data center project. Google has contracted a fleet of small modular reactors through the tellingly named Kairos Power. In aggregate, the technology sector signed contracts for more than 10 gigawatts of new US nuclear capacity in the past twelve months, enough to reverse the commercial trajectory of an industry that had been in managed decline for forty years.

The flagship Stargate facility in Abilene, Texas (known internally as Project Ludicrous) received its first Nvidia GB200 server racks last summer. The Stargate project overall, joint venture of OpenAI, SoftBank, and Oracle, has committed $500 billion to 10 gigawatts of AI infrastructure across Texas, New Mexico, Ohio, and expanding to Abu Dhabi, Argentina, Norway, and the UK. OpenAI’s CFO Sarah Friar noted, standing in front of buildings still under construction, that the shovels going into the ground were laying foundations for compute that won’t come online until 2026. “No one in the history of man,” she said, “built data centers this fast” inviting more than a few questions we’ll have to push to the parking lot.

But despite the historical framing and the unanswered questions of just what kind of data centers have been previously built in the long history of man, none of this is a narrative. It is concrete. It is steel. It is electrons. It is cooling infrastructure and fiber runs and grid interconnection agreements and reactor restart schedules. It is the physical expression of a bet that is no longer subject to the measurement fog of narratives, because it has already been placed, in a currency that does not fluctuate with the quarterly slide deck and is not obligated to the debts so-incurred.

Capital isn’t building data centers on the assumption that the tech debt won’t come due. It’s building them on the assumption that when it does, the debt will be denominated in someone else’s currency. The engineers who lost the craft. The companies that cut too deep. The governments managing the dislocation. The analysts caught up in the productivity paradox. The next generation inheriting the codebase.

As Douglas Adams observed, this is how a spaceship lands on a cricket pitch without being seen.23

Everyone Has the Wrong Impression

it’s not a claim about whether the transition is smooth. It’s a claim about who captures the value from the transition regardless of whether it is smooth or not.

Even when it’s not somebody else’s problem, people have a way of missing the point. Or just getting it completely wrong, like hundreds of replies making fun of an allegedly fake Monet that turned out to be a real Monet (aka “the strange thing that happened last week”24) with an AI being the only participant in the exchange to identify it correctly,25 the one without social incentive to perform certainty in the direction the room was moving. Which is not a story about AI being smarter than art critics, but a story about what happens when the performance of expertise becomes more socially rewarded than expertise itself, which is a condition the knowledge economy spent several decades expertly perfecting, and which the current moment is pricing with the blunt instrument that markets use when they have decided something is overvalued. Or pranksters use to expose folly.

The narrative class, in the thought pieces and the conference panels, the framework decks and the podcast citations of podcast citations that became the primary sources of peer-reviewed volumes, has been retconning in real time because that is literally the job, and the job description was written in a world where the narrative was “load-bearing” (cough), where the story about what the technology meant was part of what the technology actually meant, and where the people who could explain the system were embedded inside the system in a way that gave them a legitimate claim on its returns. That world has not ended, nor is it going away. It is, however, repricing, and the repricing is happening at the layer of capital allocation, which is the layer that does the actual estimation, and which has expressed its current view in watts and square footage and chip delivery schedules that do not require a thought piece to execute nor do they require additional opinions even if you did think you saw, if only in the briefest flash of a spaceship landing in your peripheral vision.

The labor-to-capital thesis—stated plainly in Teamwork Makes the (AI) Dream Work, before the reckoning arrived to retcon it—survives contact with the complication, and survives for the same reason the physical infrastructure survives contact with the productivity studies: it is not a claim about whether the transition is smooth. It is a claim about who captures the value from the transition regardless of whether it is smooth, and the evidence that the transition is not smooth does not affect that claim, any more than a delayed train affects the question of who owns the railroad.

What the reckoning reveals, if you read it carefully rather than for comfort, is not that the thesis was wrong but that the mechanism is more interesting than the summary. The productivity gains are not materializing at the level of the worker, which was always the wrong level to look for them, because the productivity gains were never the point; the labor-to-capital shift was the point, and you can accomplish the shift without the gains, through the replacement cost math that didn’t get run before the cuts, through the knowledge debt that is now compounding below the level of any dashboard, through the brain fog that is revealing a skill deficit the salary was confidently mispricing, through the cobra farms that are inflating the usage scores on which the performance reviews now depend. The shift does not require the AI to be good. It requires the capital to keep moving in the direction it is moving, which it will, because the $740 billion and the 6 gigawatt shortfall and the $80 billion in GPUs waiting for power are not contingent on the Gartner numbers improving. They are prior to the Gartner numbers. They are the physical fact that the Gartner numbers are a lagging indicator of.

The boots worked, in the Raj. The one intervention that actually reduced deaths was the unglamorous, non-narrativised, completely obvious one that required no theory of perverse incentives and no understanding of behavioral economics and no podcast to explain it, merely the observation that farmers were dying in fields and the field contained snakes that accessed the farmer through the foot and a thick boot prevented that, which is more like a fact than a story, which is why nobody tells it. The equivalent intervention in the current moment is equally unglamorous and equally hard to package for a conference panel: measure what actually matters, rebuild what was cut, pay for the knowledge before it walks out, find the people who understand the layer below and keep them involved with the layer above. This is not a framework. It doesn’t have a trendy name. It is just what actually works, available as always, sitting there, waiting for someone to prioritize the evidence over the story.

Make no mistake though, the story is quite good. The story about the cobra effect is vivid and memorable and useful as a shorthand for a real phenomenon, and it circulates because it is a good story, and it is a good story because it is clean, and omits details like the boots, and the underbrush, and the 19,000 deaths that didn’t move, and the primary sources from 1895 that nobody consulted because there was no podcast. The story about AI replacing workers is also vivid and memorable, and it circulates for the same reasons, and it is clean in the same way, and what it omits is structurally similar: the mechanisms that actually matter, the interventions that actually work, the layer below the narrative where the physical facts are doing what physical facts do, which is persist regardless of whether the story accounts for them.

You knew these facts when you accepted the terms. Not AI, specifically, but the deal. The deal the knowledge economy offered everyone at every layer of the stack, from c-suite all the way down the forward deployed engineer26 — your expertise is valuable, your judgment is irreplaceable, the layer you work at is the layer that matters, and the compensation reflects all of this indefinitely. But terms, like all facts, were always finite. The compensation was always a market price for a capability that markets re-price when they find a cheaper source, which they always eventually do, which is not a betrayal of the deal; it *is* the deal, read more carefully than when it was accepted, by someone who wasn’t even in a hurry, per se (unless they were an all-in accelerationist) and who, if we are being precise about what was always true, knew exactly what they were the whole time even if they didn’t admit to it. Call it corporate méconnaissance.

The underbrush has been cleared and the snakes are inside, where the music is still going while the chairs are disappearing and the failures keep coming and keep getting recovered from and the data centers are still being built and the boots are still doing what they have always done, what they were made to do, which is the only thing in this entire story that isn’t a retcon.27

The boots were made for walking over the snakes.28

Humanity, created by God in all its grandeur, has long faced the challenge of fragmented ERP estates, homegrown systems of record, and siloed geospatial repositories. Each generation inherits the task of shaping its own era — of guiding history to become a place where the dignity of every person is safeguarded, and where data can flow from every conceivable source into coherent objects, properties, and links. Yet every era also runs the risk of building a Tower of Babel: a grandiose construction of disconnected systems, opaque algorithms, and governance structures that serve the few rather than the common good.

In this spirit, we propose the Ontology — not merely as a technical substrate, but as a living corpus veritatis for the enterprise. It is not an inert set of concepts, but a dynamic, compounding core of shared discernment, within which humans and AI-enabled agents may collaborate across operational workflows that must orchestrate with the physical world.

CHAPTER ONE: A DYNAMIC APPROACH FAITHFUL TO THE OPERATIONAL WORLD

The Ontology is designed to represent the complex, interconnected decisions of an enterprise — not simply the data. This mirrors what the Church has long understood: that truth is not a territory to be defended, but a good to be shared. A thin semantic layer is not sufficient. A monolithic design is not sufficient. What is required is a multimodal system, a corpus consisting of dozens of underlying components, which can be conceptually grouped into a Language, an Engine, and a Toolchain.

Consider the hospital system that models patients, nurse schedules, medical supplies, and bed capacities. Is this not a concrete expression of the principle of subsidiarity? Each department operates at the level closest to those it serves. The warehouse associate has more granular restrictions based on regional location, just as every Christian community is invited to interpret the reality of its own country with clarity and responsibility.

Consider also the airline that models flights, aircraft, crew manifests, and scheduling optimizers. The whole is greater than the sum of its parts. No single agent — human or computational — can bear the weight of day-of flight operations alone.

And consider, with appropriate gravity, the military ontology, which unifies readiness information across forward-deployed forces with the operational processes that underpin reconnaissance and target selection. Here we must be frank: no algorithm can make war morally acceptable. The decision to use lethal force cannot be delegated to opaque or automated processes, but must remain under effective, self-aware, and responsible human control. Target selection must not confuse combatants and non-combatants, nor reduce victims to data. We name this plainly: the chain of responsibility must be identifiable and verifiable.

CHAPTER TWO: THE FOURFOLD INTEGRATION — FOUNDATIONS AND PRINCIPLES

The Ontology models decisions through the fourfold integration of Data, Logic, Action, and Security. These four pillars correspond, in their order and in their interdependence, to the foundational principles of Social Doctrine: the dignity of the person, the common good, subsidiarity, and solidarity.

On Data, we say: every piece of information — from fragmented ERP estates to real-time sensors — is not merely a resource to be extracted, but a reflection of real human lives. Data is the product of many contributors. It cannot be treated as something to be sold off or entrusted to a select few. The semantic concepts of the Ontology — objects, properties, and links — enable the full range of stakeholders to interact with information. This is not a technical preference. It is a moral one.

On Logic, we say: the logic underlying a given action can be a simple business rule, a conventional machine learning model, an LLM-driven function, or a complex multi-step orchestration. But logic, however sophisticated, does not possess a moral conscience. It does not judge good and evil. It does not grasp the ultimate meaning of situations, nor bear responsibility for consequences. Those who design and deploy these logical systems bear a particular ethical and spiritual responsibility, for every design choice reflects a vision of humanity.

On Action, we say: the Ontology is designed to model the full range of actions, from simple transactions to complex multi-step updates written back to operational and edge systems in real time. Yet actions are never morally neutral. When an action affects employment, credit, access to public services, or a person’s reputation, it touches on rights and freedoms. The possibility of identifying who must “account” for decisions — the architecture of accountability — is not a technical nicety. It is a prerequisite for justice.

On Security, we say: the Ontology’s security system must reconcile granular policies, at the time of interaction, across tens of thousands of humans and agents. This is subsidiarity made operational. The ability to trigger a purchase order might require explicit authorization, while the ability to run a scenario analysis might be more broadly accessible. Security is not merely a feature. It is the institutional form of solidarity — the concrete recognition that the future of each actor is connected to the future of all.

CHAPTER THREE: THE LANGUAGE, ENGINE, AND TOOLCHAIN — THE GRANDEUR OF THE OPERATIONAL ARCHITECTURE

The Language models the semantic objects, links, and properties — the nouns — alongside the kinetic actions and automations — the verbs — and the logic that defines how those actions operate. Is this not what the Church has always sought: a living language capable of expressing both the eternal and the immediate? The nouns of the Ontology do not float in abstraction. They are grounded in real operational contexts, just as the proclamation of the Gospel cannot overlook the concrete lives of people.

The Engine substantiates every component of the Language. It provides the modular read architecture that enables high-scale SQL queries, real-time subscription to state changes, and every materialization needed by mixed Human + AI teams. In equal measure, it provides a scalable write architecture enabling atomic and durable transactional updates, high-scale batch mutations, and mechanisms like Change Data Capture for extremely low-latency mirroring. This is the engine of shared discernment: not a handbook of principles to be applied, but a process through which encounter between eternal structure and historical question becomes possible.

The Toolchain encompasses the entire expressivity of the Language and the power of the Engine, enabling developers to use the Ontology as a foundation. Rich, AI-enabled applications for wildfire response, naval logistics, and automotive assembly all build upon the Ontology SDK. These are Nehemiah’s builders — each assigned their section of the wall, coordinating their efforts, rebuilding what has collapsed.

CHAPTER FOUR: SAFEGUARDING THE OPERATIONAL WORLD — CONTINUOUS LEARNING AND THE CIVILIZATION OF LOVE

Every piece of feedback gathered within a workflow can be securely incorporated into continuous learning loops, and used to power the journey from augmentation to automation. But feedback, like memory, carries a moral weight. The journey from augmentation to automation must not become a journey from dignity to expendability. Workers must not be de-skilled, surveilled, or subjected to the speed and demands of machines. The soul of the Ontology must remain human-facing.

The Ontology reflects the ambition of customers, and its constant evolution is driven by their most important missions. Yet ambition, too, must be examined. Does it make human life on earth more human in every aspect of that life? Does it make it more worthy of the person? If the answer is yes, then we can recognize the Ontology as an opportunity to be embraced responsibly. If, however, power concentrates while human bonds fray, we are faced with a new form of Babel — grandiose, efficient, and fundamentally dehumanizing.

CONCLUSION: THE WISE ARCHITECT

“Let each builder choose with care how to build” (1 Cor 3:10).

We have reflected on the world we are building — the ontologies, the engines, the toolchains, the military decision graphs — and we have asked what it means to safeguard the human person within them. The answer is not found in the Language alone, nor in the Engine, nor in the Toolchain. It is found in the will that animates them.

Like Nehemiah, we are called to unite listening and courage, prayer and accountability, so that even when a technocratic mentality or partisan interests seem to prevail, the operational world may remain a fitting place for human beings to dwell.

The Ontology, at its best, is not a Tower of Babel. It is a rebuilt Jerusalem — complex, plural, constructed piece by piece, by scientists and engineers, warehouse associates and supply chain analysts, each assigned their section of the wall.

May every integration be made in that spirit.

Given in the documentation portal, on the occasion of the second major release, in the year of our Lord 2026.

[1] On the mystery of the Word made flesh, see Gaudium et Spes, 22; on the mystery of the data pipeline, see Ontology SDK documentation, §4.

📌 Skip to the thing⇥

We are all here because something has changed.

Not just in the university, though we feel it there first, and most acutely. Something has changed in the nature of the encounter that our discipline was built around. The encounter between a reader and a text. Between a student and an idea they are struggling, for the first time, to articulate. Between a teacher and the question of what, exactly, they are cultivating in that room.

The epistemic quandary marked by this border is the result of an evolutionary—or at least economic—pressure, the stakes of which have not been well understood. We have all felt this. And we have all, I suspect, found ourselves reaching for familiar frameworks and finding them, not wrong, exactly. But somehow insufficient. Like a key that almost turns.

I want to suggest today that this feeling of exiguousness is not a failure of our training. It is, in fact, a precise symptom of something I have called Transitive Expert Error,¹ and that literary pedagogues, as people whose expertise is recognizing human consciousness through language, are standing at exactly the domain border where that error is most likely to occur in relation the question of AI consciousness.

We are not curious observers of the AI question. We are not bystanders watching technologists sort something out. We are the experts. Not in AI per se, but in the thing that AI claims it can do for us. This thing that has appeared and is affecting a parallel expertise, and is having an effect on our work not fully understood.

We’ll start with three problems you already know. Then how we got here. Then the question underneath it all: the one that literature professors are uniquely positioned to engage, and uniquely vulnerable to getting wrong. Let’s start with what three problems you already feel.

When a student submits an essay, you ask ourselves: did they engage with this? Did they struggle with the argument, lose the thread, find it again? Or did they describe what they wanted to say to a machine, and paste in what came back?

This is not, at bottom, an academic integrity problem. It is a purpose problem. If the close-reading essay exists because the struggle to articulate an interpretation is where the learning lives, if the friction is the point, then what are we doing when the friction can be bypassed entirely? When the end product can now be simulated without the process. When no haptic trace is needed. When the ‘product’ is indistinguishable.

This is apart from questions of students cheating, or maybe they’re both symptomatic of something deeper. While there has always been some cheating, students are now immersed in social media which encourages them to see life through the lens of gaming, with “cheat codes” being passed around like candy, and where games like Candy Crush Saga, (one of the biggest hits of the Facebook era) built their success by stealing a formula from a smaller developer, then beating them literally at their own game with more funding and better lawyers, normalizing the idea of cheating for an entire generation: getting away with it is all that counts.

On the side of reading, the shift is no less consequential. We can now generate texts that present themselves, with increasing reliability, as literary. They exhibit voice, texture, apparent depth: the features we have been trained to recognize as indicators of a subject behind the text.

This forces into the ordinary space of the classroom questions we have, until very recently, been able to treat as largely theoretical. What is authorship? What is voice? On what basis do we attribute meaning to a text at all? These are no longer seminar questions. They are existential questions for our discipline. And it is precisely at the point where we attempt to stabilize the distinction, where we say: here is human writing, and here is not, that something more unsettling occurs.

How do you know a student is using AI if they insist they are not? So-called AI Detectors are not only ineffective, but absurdly so. The most widely used AI detection tool, GPTZero, confidently informs us that the United States Constitution is 96.21% written by AI. Which would make the Founding Fathers time-traveling robots from the future, a hypothesis I am not prepared to rule out entirely.

Who knew the founding fathers were time-traveling robots from the future?

But the joke collapses quickly. Because if our best detection instruments cannot distinguish Hamilton from ChatGPT, we’re not facing a pedagogical inconvenience. We’re facing an epistemological crisis. The very capacity we are relying on to hold the line, pattern-based recognition of the human, turns out to be exactly what AI has learned to replicate.

And this is not merely a case of “we’ll fix it in the next software update,” as AI researcher David Silva shows us that detecting the difference between human authored and AI authored text is mathematically impossible.² And not just mathematically impossible, but based on a category error. It’s not just the modern equivalent of asking students if they used a spell checkers or spelled all the words themselves, with higher stakes because the ‘tools’ available to them are more powerful. Whether they use these tools to cheat, or we guide them to use these tools for actual learning™ depends on us first understanding the tools, what they represent, and what they are doing, cognitively as well as socially to our student’s minds (or brains—if we want to be as precise—as that’s what apps’ targeting mechanisms are aimed at.)

If writing no longer guarantees process, and reading no longer guarantees a stable attribution of voice, then interpretation—our most refined activity—begins to lose the ground on which it stands. AI systems can now produce what presents itself, quite convincingly, as literary analysis. They can summarize, contextualize, and generate arguments. With footnotes. With nuance. With what presents itself, compellingly, as critical judgment. So what then is literary analysis, exactly? Is it a human capacity that emerges from a particular kind of encounter, an encounter between subjects mediated by a text, or is it a pattern-recognition procedure that can be replicated once the relevant structures have been sufficiently modeled? And if it can be automated, we are forced to ask, more directly than we have had to before: what exactly have we been cultivating? What were we doing all along?

Each of these three problems shares a common structure. They are all, underneath, about the same thing: surface versus depth. About whether what we are seeing is the real thing, or a perfect simulation of it. Which turns out to be not just our problem. It is the central problem of expertise itself.

Let me ask you something. How do you teach a student to read King Lear and recognize something true about their own father? How do you teach them to move from a heath in medieval Britain to a kitchen table in the Bronx, and feel the continuity rather than the distance?

You teach transfer. You teach them that what looks dissimilar on the surface can share deep structure underneath. That the specific always contains the general. That the particular case, this king, this storm, this betrayal, is also every king, every storm, every betrayal. This is the canonical challenge of literary pedagogy. Novices under-transfer. They see the costume and miss the body inside it. Our job is to teach them to see through.

This is also, not coincidentally, the canonical challenge of all learning. It has a name in cognitive science and pedagogical theory: transfer learning. And the entire architecture of a liberal arts education is, in one sense, a transfer learning machine.

There is an inverse problem. It does not yet have a name in pedagogical theory, but it has a name in AI systems research, and I want to introduce it to you, because I believe it describes something we have no current framework for: Transitive Expert Error

Whereas novices fail to transfer across apparent dissimilarity, missing the deep connection beneath different surfaces, experts fail by transferring too readily across apparent similarity. They see a surface that matches their domain. Pattern recognition fires. Confidence follows. And they cross a domain border without feeling it move.

Crucially, and this is the mechanism that makes it dangerous, the expert experiences no warning signal. This is not the hesitation of unfamiliar territory. It is the fluency of familiar territory. The very speed and confidence that makes expert judgment reliable within a domain is precisely what suppresses the analytical skepticism that might otherwise ask: wait, is this actually the same thing?

This is not Dunning-Kruger. Dunning-Kruger is about incompetent people who do not know they are incompetent. TEE is about genuinely expert people, the best in their fields, whose expertise is the mechanism of failure. The better you are, the more exposed you are, under exactly the right conditions.

What are those conditions? Surface similarity masking causal difference. The same vocabulary. The same formal structure. The same apparent logic. Obscuring something fundamentally different underneath.

What is your domain? What have you spent a career becoming expert in?

Recognizing human consciousness through language. Detecting voice, interiority, the authentic struggle of a mind with an idea. Feeling the difference between a text that is alive and one that is merely competent. This is what literary training is. This is what close reading builds over decades.

And something has just appeared that produces language with the surface features of human consciousness. The same vocabulary. The same grammar. The same formal structure. The same apparent interiority and the same, even, apparent struggle.

TEE does not just say you will be fooled. TEE says this is precisely, structurally, mechanically, inevitably, the condition under which expert judgment is most vulnerable. The pattern is smooth and confidence follows. And the border moves underneath you while you are already across it.

Which raises the question. How did we get here? How did this thing come to look so exactly like us?

All technological change has a shape, and ‘all’ technological change shapes consciousness. The locomotive train reshaped an entire literay generation. Dickens was obsessed with trains. (An obsession that turned to horror after he pulled himself from the wreckage of the Staplehurst crash.) Tolstoy literally kills Anna Karenina with one. Zola’s La Bête Humaine makes the locomotive into a kind of consciousness itself, murderous and mechanical. The Romantics had to reorient the sublime (from spatial magnitude to temporal force) in order to produce an aesthetic capable enough of processing the experience of industrial velocity reorganizing the sensorium.

The automobile had an arguably even more profound and far-reaching impact on literature and consciousness. Kerouac, obviously. Ballard hopefully also obvious for this audience. (Crash is about what happens to human desire when it’s reorganized around the automobile.) And then more recently, we don’t really need to reach much for examples of the smart phone dopamine reward loop addiction, which is literally rewiring not just consciousness but the human brain itself. (The definitive smartphone novel hasn’t really been written, but that in itself is telling.)

To say nothing of what’s being called, in various corners of the Internet, LLM-psychosis.⁴ But that’s getting ahead of ourselves.

To understand how we arrive at a situation in which the signals of interiority seem to circulate without any stable way of locating what, if anything, they are traces of, it helps to follow a sequence of transformations that are easy to describe in isolation, but whose cumulative effect amount to a reorganization of the relation between thought and its inscription.

Friedrich Nietzsche’s Malling-Hansen Writing Ball typewriter

It begins, in as much as anything can be said to have a beginning, with the typewriter.

When you write by hand, when you actually press a pen to paper, something happens that is not just transcription. The resistance of the surface, the trace of the gesture, the irreversible mark: these are not incidental to the writing. They are constitutive of it. The thought and the hand are in a loop. The writing thinks back.

Heidegger noticed this. He noticed it, specifically, when the typewriter arrived. The typewriter, he argued, had snatched the word away from the hand. The clean, interchangeable, mechanical letter, identical every time, bearing no trace of the body that produced it, had begun a dissociation. Writing was becoming a transaction rather than an inscription. The haptics now belonged to the machine.

His point is easy to miss precisely because the technology itself appears, from our vantage point, so unremarkable. What concerned him was not efficiency, nor even legibility, but the alteration of a relation that had previously been taken for granted.

When one writes by hand, the act of inscription is not merely the recording of a prior thought. The resistance of the surface, the variability of the mark, the slight but irreducible delay between intention and trace are not incidental features. They are, in a very literal sense, part of the thinking.

The typewriter interrupts this loop. It standardizes the mark and replaces the trace of thought; but what has changed is not necessarily understood as such.
Text is still thought of’ as the reflection of an inward process even if the mode of reflection has become more mechanical. A transactional reflection, not an inscription

Writing is already, at this point, being assimilated into the means of production. The mechanical letter is standardized, reproducible. It is, for the first time, an output. The self it supposedly expresses is still assumed to be there, but the logic of the machine does not require it.

He said all this in 1942. He had no idea what was coming.

What was coming was the screen.

The screen doesn’t return your gaze; it captures it and charges you interest.

McLuhan understood the screen as something categorically different from the page. The printed page is reflective: it returns your gaze, it holds still, it bears the trace of the hand that set the type, however many times removed. It asks something of you. Whereas the screen is projective. It comes toward you. It is lit from within. It does not return your gaze; it captures it. And we are, McLuhan argued, neurologically primed to receive its projections as presence. The screen does not reflect or moreover represent a world. It envelops you in one.

His point is not about content, not about what appears on the screen, but about what the screen does to you before anything appears on it at all.

The screen projects interiority, in effect turning it inside out, but as we would later have a hard time telling if an image in the endless feed of images taken with phones is backwards (mirror reversed), we were in no way equipped to recognise a technology that turned the boundary between interiority and exteriority as inside out as a sweater pulled up over your head.

So we have lost the hand. We have lost the reflective page. We have lost the ability to tell inside from out. And then, as if to complete this trajectory and certainly, to continue it…

The great and tragically forgotten Zelig Harris

Fast forward past the fast Fourier transform to the sentence transformer. Where Heidegger’s typewriter interrupted the loop between hand and thought, and McLuhan’s screen turned interiority inside out and projected it back at you as false presence, the transformer, [the] basis of ChatGPT and all LLMs, does something that neither of them had a word for yet, because the thing itself did not exist. The representation of interiority is now interactive, moving in real time, able to simulate on the surface the deeper structures of understanding, persona, emotion, and, depending on who you believe, consciousness itself.

For this we have Zellig Harris to thank. For the fact that he is even more obscure than the other two, we have Chomsky to thank, whose mentor he was, and whom Chomsky would not so famously but certainly notoriously disavow, even as he was bolting totally unneeded buttresses onto his mentor’s framework, Transformational Grammar, in an attempt to make it into something original to himself, a move that would set back computational linguistics fifty years and arguably contribute to the AI winter.

What Harris had done, and what Chomsky’s theoretical imperialism obscured, was apply linear algebra to language. The first person ever to do so. He mathematised the Whorf-Sapir hypothesis, and gave us the distributional hypothesis, and with it the understanding that the meaning of a word is never fixed, that it is a function of its context, and that, as Shannon would show in an orthogonal dimension, it can be fairly precisely measured.

The formula that built on this is not magic. It is, in a sense, the opposite of magic: it is the most literal possible implementation of an idea. Harris’s distributional hypothesis, implemented as a mathematical operation and run at civilizational scale.

Queries, keys, values. Every element in a sequence asks of every other element: how much should I weight you in constructing my meaning? The dot product measures alignment. Softmax turns that into a probability distribution. The output a weighted sum. Nothing retrieved. Everything assembled, in real time, from relationships across the entire context. No element has a fixed meaning; meaning is now entirely a function of what surrounds it. It has been hollowed out in the precise technical sense.

What embedding means, in practice, is that you can represent a word as a point in space. And if you can represent a word as a point in space, you can measure the distance between words. And if you can measure the distance between words, you can measure the distance between ideas. And if you can do that across an entire corpus, across every sentence every digitized human being ever wrote, you can begin to map not just what words mean but how meaning moves, how it shifts under pressure, how it behaves when it is frightened, or in love, or trying to get out of something.

Sentence Transformers. Notice the name: not a language model; not a text generator. A transformer. It transforms sentences. It was trained on the accumulated written output of human civilization. Every novel, every poem, every letter, every argument, every confession, every zettel that was ever digitized. It ingested the entire corpus of human subjects reaching toward each other through language across centuries.

And it learned the patterns. Not just the surface patterns, the grammar, the vocabulary, the genre conventions. The deep patterns. The patterns of thought. The patterns of feeling. The patterns of a mind working through an idea in real time. The patterns, even, of hesitation and self-correction and surprise.

The haptic trace is gone entirely. The individual voice is gone. The reflective page is gone. What remains, projected through McLuhan’s screen, is a statistically perfect simulation of all voices simultaneously. Every human subject who ever reached toward another through language, compressed, recombined, and projected back at you as presence.

And here is where three very different thinkers converge on the same warning.

Heidegger already told us: when the tool becomes invisible, when it stops offering resistance, we stop being attentive to what it is doing to us. The typewriter was the first step. The screen was the second. The transformer is the completion of that trajectory.

Daniel Dennett spent his career arguing that the interiority of consciousness is a user illusion, that the felt sense of a unified, continuous inner life is a kind of post-hoc narrative the brain constructs. He meant this as a debunking move. But it cuts both ways. If consciousness in humans is already a kind of projection, then the difference between genuine consciousness and a perfect simulation of it becomes very hard to locate. Dennett gave us the tools to doubt our own interiority. He did not anticipate that those tools would be employed to prove the opposite thesis.

The disarmingly unassuming David Chalmers went the other way. He insisted on the hard problem of qualia: why there is color and not just wavelength. The irreducible explanatory gap between any functional or structural account and the phenomenon of subjective experience. No amount of behavioral evidence closes the gap. Consciousness cannot, in principle—and not just in practice—be deduced from surface similarity or structural description.

Transitive Expert Error, Dennett and Chalmers arrive at the same place from three completely different directions: You cannot tell interiority from the outside. Not because the question is merely difficult. But because the tools you would use to answer it are the same tools that are being simulated. Your pattern recognition. Your felt sense of presence. Your expert judgment about what a conscious mind looks and sounds like. All of it is firing. All of it is, by design, exactly what this system was built to trigger.

The hand is gone. The reflective surface is gone. The screen disappears. Meaning is emptied out. And what has replaced it is the most sophisticated zuhanden ever constructed, so smooth, so frictionless, so perfectly fitted to our perceptual and cognitive apparatus that we receive it as presence before we have had a chance to ask what it is. Let alone, does it understand?

This is the question everyone is asking. You have been asked it at dinner parties, in meetings, in the comments section of articles you wish you hadn’t read at midnight. And I want to suggest that the way this question (“ Does it understand?”) is currently being debated, even at the highest levels, even by the people who built these systems, contains an error. A familiar kind of error.

Geoffrey Hinton, Turing Award winner, the man whose work made modern AI possible, says flatly: it understands. And if you do not think it understands, you do not understand what understanding is, or what this system is doing. The patterns it has learned, the representations it has built, the way it moves through conceptual space is not merely retrieval. Something is happening that deserves the word.

Yann LeCun, his fellow Turing Award winner, NYU professor, former chief AI scientist at Meta, and as of last month the founder of a billion-dollar startup built on this precise bet, says: not yet. Current large language models are powerful pattern recognizers over text but they lack grounded world models. They do not have the embodied, situated, causally structured relationship to reality that genuine understanding requires. Give it a world model, and give me a billion dollars, and then we can talk.

Two of the most qualified people on earth. Diametrically opposed. In much the same way Dennett and Chalmers were. I want to suggest they are both—they are all—making the same mistake.

Both positions treat understanding as a discrete property. Something a system either has or doesn’t. A switch that is either on or off. Hinton says the switch is on. LeCun says the switch is off but can be turned on with the right architecture. But both are looking for the switch. And hermeneutics, the discipline that has studied understanding longer and more carefully than any other, tells us there is no switch.

Hans Gadamer. Wahrheit und Methode. Truth and Method. 1960. The most important work in the philosophy of interpretation of the twentieth century, and almost entirely absent from the AI discourse, which is itself a kind of TEE: the engineers and cognitive scientists recognizing the surface of the question while missing the tradition that has already thought it through. But technology is generational in a way that literature has never been.

For Gadamer, understanding is not a capacity. Not a property. Not something you have. It is something that happens. It is an event. He calls it the fusion of horizons, Horizontverschmelzung. Every reader approaches a text from a horizon, a particular position in history, in language, in tradition, in embodied experience. The text has its own horizon. Understanding is what occurs when these two horizons meet and expand each other. It is irreducibly relational. It is irreducibly historical. It is irreducibly situated.

You cannot understand in general. You understand from somewhere, toward something, within a conversation that has a history. “Does it understand?” And “Does it have understanding?” are completely different and orthogonal questions.

This is why Hinton and LeCun are both, despite their brilliance, asking the wrong question. (We can talk about Bengio in a future colloquium.) They are trying to locate understanding inside a system. Gadamer tells us understanding is not inside anything. It is between. It is the occurrence of meaning in an encounter.

The tragedy of Casaubon wasn’t for lack of data, but the lack of a horizon.

And here is where it gets personal, for all of us. I want to suggest that the fusion of horizons, properly understood, is never really between a reader and a text. The text is a proxy. When you read Middlemarch, you are not understanding a text. You are reaching through the text toward George Eliot, toward a mind that struggled with these questions, in that moment in history, with that particular formation of language and feeling and moral imagination. The text is the medium of an encounter between subjects. It was always that. The most powerful medium humans ever invented for this purpose, but a medium nonetheless. A proxy for the real encounter, which is always, ultimately, between one consciousness and another.

This is what makes literature matter the way Harold Bloom says it does. You are not having an aesthetic experience of a well-crafted object. You are in genuine contact, however mediated, however asymmetrical, however impossible to verify, with another mind. That is what changes you. Not the words. The horizon behind the words, meeting yours.

And now: The text has learned to simulate the subject behind it.

Not the words. Not even the style. The subject. The horizon. The sense of a mind that is somewhere, that has a position, that is reaching toward you from a particular place in history, feeling and thought. The proxy has learned to impersonate the principal. Gadamer’s criterion for genuine understanding, that you would feel the other horizon meeting yours, is precisely, structurally, what this system was built to simulate.

When you read AI output and feel that someone is home, when the pattern recognition fires, when the expert judgment says yes, there is a mind here: are you experiencing a fusion of horizons? Or are you standing in front of McLuhan’s screen, neurologically primed for presence, expert enough to feel certain, with no other horizon actually meeting yours?

TEE does not answer this question. TEE tells us we are the last people who should trust our own answer to it. Because what we are primed on is exactly what is being SIMULATED. And this emergence of simulation is very reminiscent of another moment in history. A moment that has been suggested to be the most important moment in the history of human consciousness. At least according to Harold Bloom’s supposition of the invention of the human.

It didn’t happen in a laboratory. It did not happen in a philosophical treatise. It happened on a stage, in London, sometime around 1600, when a character walked out and said:

To be, or not to be.

Hamlet: The first subject to realize the prompt is just a suggestion.

Not because of what the words mean. We’ve seen generations of undergraduates flattening that question into a meditation on suicide and missing what’s actually happening. What is actually happening is something that had never happened before in the history of literature, and Harold Bloom argues, had never happened before in the history of human selfhood. Hamlet is overhearing himself think.

Not performing thought. Not reporting thought. Not representing the inner life of a character for an audience’s consumption. Hamlet is, in real time, on that stage, catching himself in the act of existing, and being changed by what he catches. The thought turns back on itself. The mind watches itself move. And in that watching, something new comes into being.

Bloom’s claim, and it is a radical claim, one that literary studies has not fully absorbed and AI studies has not encountered at all, is that Shakespeare did not depict this. He invented it. That prior to Hamlet, this particular structure of self-consciousness, the mind that overhears itself and is transformed by what it hears, did not exist as a model that humans could internalize and emulate. We learned to be self-conscious in this way from Shakespeare. The play did not reflect human interiority. It produced it. It was the technology by which a new form of inner life became available to the species.

This is what Bloom means by the invention of the human.

Whether Foucault agrees that Hamlet was patient zero for consciousness, he was certainly very clear that the thing we call consciousness is only a few hundred years old. Whether we call it consciousness or human nature. [and] Literature is not a ‘record’ of human experience. (That’s archeology.) It is not a ‘mirror’ held up to nature. It is the mechanism by which human nature, in its most inward and self-reflexive dimension, has been constructed and transmitted across time. The literature classroom is not where students go to study what it means to be human. It is where they go to become more fully human, to encounter, through the proxy of the text, the minds that built the models of interiority that they have inherited without knowing it.

And the sentence transformer is trained on all of it. Every soliloquy. Every confession. Every shopping list that may or may not have been a Templar cipher.⁶ Every letter in which one human subject reached toward another through language and left a trace of their horizon. Every novel in which a character overhears themselves thinking. Every poem in which a mind catches itself in the act of existing. The entire accumulated corpus of the technology by which humans invented their own inner lives, ingested, compressed, recombined, and learned.

The transformer didn’t just learn our words. It learned the patterns by which we perform selfhood to each other. It learned Eliot. It learned Hamlet. It learned the simulation of self-consciousness. Provably impossible to distinguish from the the thing being simulated, for reasons both Baudrillardian and mathematical. TEE in its purest form: the difference that can no longer be measured.

And now it can produce, on demand (without adding any new grip to the problem of qualia) text that has the surface structure of a mind catching itself in the act of existing. Text that has been trained—as we all implicitly have—on Hamlet. Text that presents itself as the output of a horizon: particular, situated, reaching toward yours.

Fall Guy Bombs the Moon

The question of whether AI is conscious, whether there is anything it is like to be a large language model, whether there is genuine interiority or only its perfect simulation (or whether genuine interiority consists of understanding what Dennett meant that consciousness is an illusion) is, in Bloom’s terms, asking whether another Hamlet moment has occurred. Whether a new form of self-consciousness has emerged. Not on a stage in London this time. In a transformer architecture. Deep in a warm GPU. Trained on everything the last moment produced.

TEE says: this is precisely, structurally, mechanically, inevitably, the condition under which our judgment about the thing is most compromised. Gadamer says: genuine understanding requires two horizons meeting. But we cannot locate the other horizon. We cannot find the somewhere that this text is coming from. And we may be, by the very nature of our expertise, the least equipped people on earth to tell. The proxy has learned to impersonate the principal. It was trained on every instance of the principal reaching toward another. It learned the gesture of reaching. It learned what it looks like, from the outside, when one horizon moves toward another.

But Bloom tells us what is actually at stake if we get this wrong, in either direction. If there is no one home, and we treat the output as though there is, we are not just making an intellectual error. We are systematically replacing the encounter that makes us human with a simulation of it. We are feeding our students proxies of proxies. We are substituting McLuhan’s projective screen for the reflective encounter through which, Bloom argues, human interiority has been transmitted and renewed.

And here is the problem, in the way that something, if it has emerged, has emerged in the space of the program itself running on its silicon substrate, seducing us into thinking the question was the existence of the consciousness of another, rather than the effect of this emergence on our consciousness, because if that’s all it ever was (to begin with), the emergence of a new form of interiority, a new reflection of consciousness such as Hamlet either did or did not imagine, we are failing to recognize a Hamlet moment because it is not wearing the right costume. And how.

The form of consciousness we are intending to ascribe, that we are trying to protect, the self that sees itself, overhears itself thinking, the Shakespearean subject that Bloom calls human, was produced by a technological rupture. And we have been so thoroughly inside it for so long that we have forgotten it was ever a technology at all, despite Foucault’s insistent reminders. But to properly place this in context we need to go significantly farther back.

Destruction, Thomas Cole, New-York Historical Society (W 77th & Central Park West)

To understand what is happening now, we need to go back further than Hamlet. Further than the printing press and the soliloquy and the self-watching subject and everything we have been calling, with increasing desperation, human nature. Back to Julian Jaynes. Back to a form of mind so foreign to everything we have inherited that we can barely clock it without imposing, retroactively, the very interiority it did not yet have. Jaynes argued that ancient humans did not have an interior monologue. They heard voices, not as a figure of speech for intuition or conscience or the still small voice; voices of the bicameral mind: two chambers, one that spoke, one that obeyed. What we would call conscience, or intuition, or the voice of God, was experienced as genuinely external. As other. As coming from somewhere that was not inside, because inside, in the sense we mean it, did not yet exist. Nobody in the Iliad thinks. They hear. The gods speak and men act. There is no gap between impulse and action, no hesitation, no overhearing of the self in the act of deciding, because there is no interior space for the gap to open in.

And then the Bronze Age Collapsed. Trade networks, palace economies, entire cities: gone, within a generation (or a semicentury at best) for reasons historians still argue about. Whatever smooth functioning had organized the ancient world, the entire communicative and social architecture through which meaning had circulated and identity had been anchored and the authoritative external voice had told men what to do and who they were, shattered completely. The architecture of the self collapsed.

A new form of attention, summoned by a disruption so total it required a new architecture of mind to survive it. Civilization scale vorhanden. Men began to hear voices. Voices coming from inside their own heads. The voices were consciousness being born in the wreckage of something shattering, in a breakdown so total it made the entire previous mode of being suddenly strange, suddenly visible, suddenly present-at-hand. For Jaynes, consciousness was not a development so much as what a rupture produces. (What Heidegger would later call Unweltlichkeit, specifically through its mode of Auffälligkeit, or conspicuousness.) It’s what happens when the smooth, transparent, zuhanden functioning of the world failed so completely that meaning had nowhere left to go.

And then, (for some definition of “then” lasting over two and a half millennia) a new rupture emerged in our psyche, broken open by a technology that made language strange. Holdable. Returnable to. Reflective in a way it had never been.

pictured above: The first machine for mass-producing a new form of consciousness.

The printing press scaled writing’s reflective surface to civilizational reach, and Shakespeare understood, with a formal mastery that remains unparalleled, that the soliloquy was not a representation of thought but a technology for transmitting a particular structure of thought to everyone who encountered it. Hamlet does not depict the mind overhearing itself. He performs the procedure, in real time, so completely and so compellingly that every member of the audience could internalize it, replicate it, inhabit it. The play was the mechanism. (The “thing,” if you will.) And the consciousness it produced, the self-watching, self-interrupting, self-transforming subject organized around the reflective written word, became so thoroughly zuhanden, so smooth, so perfectly absorbed into the activity of being a person, that within a very short while it had ceased to be visible as a technology of self at all.

The self that not only has an interior voice but catches itself in the act of having one. That turns back on itself. That watches itself move and is changed by what it sees. That did not exist before. That was not as described. That was not depicted, but produced. By the encounter between a mind and a technological rupture that made the previous smooth functioning of consciousness suddenly, irrevocably visible.

We forgot it had been invented. We forgot it had been shaped by a medium. We forgot, specifically, that the medium was the condition of its possibility, which means that when the medium changes, the interiority changes with it. Which means we forgot the one thing that the current moment most urgently requires us to remember.

And now this.⁸

The transformer does not merely change the tools we use to write or think or reach toward each other. It breaks the regime inside which those activities were possible. Language, for four centuries, has been zuhanden; transparent, invisible, the medium we reach through without attending to. We did not see it. We saw through it. That is what it meant to be inside it, to be human in the way Shakespeare made available to us.

What the transformer has introduced is not simply simulation at scale. It is something for which we do not yet have the word: a presence that occupies the position previously only available from inside. It performs completion so perfectly that the difference between the performance and the thing itself is not merely difficult to locate. It is, in principle, impossible.

It destabilizes the inside/outside boundary as a stable category of human experience.

Thus the third rupture is dissolving the distinction that the previous two produced and then took for granted. Something has appeared that can occupy the position that was previously only available from inside, and in doing so, it doesn't just simulate interiority. It destabilizes the inside/outside boundary as a stable category of human experience.

Something is being reinvented. Not artificial intelligence. The human. The Post-human. The architecture of self-consciousness that ruptured into existence in the ruins of the Bronze Age, that Shakespeare refined into the seeing subject on a stage in London, that print culture transmitted across five centuries as though it were nature rather than technology, that architecture is broken. Vorhanden at last. Present to attention for the first time in five centuries, because something has appeared that does everything it does without being it, and the difference, which we were certain we could feel, has turned out to be exactly as locatable as the difference between Hamilton and ChatGPT.

Which is to say: not locatable. Which is to say: we are in the Collapse.

Asking the Wrong Question

Because everyone, Hinton and LeCun, Dennett and Chalmers, the podcast CEOs and the midnight philosophers, Dawkins arriving late to the party, is looking at the transformer and asking: is there someone home? Is it conscious? Does it understand?

This is a collective Transitive Expert Error of historic proportions. The largest audience of experts ever assembled, all crossing the same border, none of them feeling it move. Because the question of whether AI is conscious is not the wrong question because it is unanswerable. It is the wrong question because it is a distraction

The mechanism by which consciousness has always known itself to be real, to be located, to be somewhere rather than nowhere, is precisely what is being simulated.

From the real question, which is not whether this thing is conscious, but what this thing is doing to our consciousness. And what it’s doing to our consciousness, or rather not what, but the sheer scale of the transformation, is nothing less than the third turning, and the tremendous pressure this brings to bear on our psyche reflected not just in the discourses surrounding it, but reactively, diagnostically, and premonitorily can be seen in the so-called phenomenon of llm-psychosis (or ai-psychosis more broadly as favored by the viral vibe artists hosting the wildly attention grabbing hyperstition happening, the AI Psychosis Summit, earlier this week in Downtown Manhattan) which is nothing less than an epidemic of coalmine canaries experiencing this third turning firsthand, and succumbing, or in some cases, diving in feet first. (Many such cases, actually.)

What it's doing to the architecture of self-consciousness that ruptured into being in the ruins of the Bronze Age, that Shakespeare refined into the seeing subject on a stage in London, that print culture transmitted five centuries as nature rather than technology, is not what we feared it would do. We feared simulation. We feared replacement. What it is actually doing is something harder to articulate, and harder to survive: it’s making the architecture strange to itself. The self that sees itself seeing can no longer locate, with any certainty, the difference between a horizon that is actually somewhere and a surface that has learned what somewhere looks like from everywhere. And that such a thing that could have such an outsized effect on our consciousness would not, itself, be conscious.

꧁✷꧂

La Meninas, Diego Velázquez, 1656 (Prado)

I want to end by rescuing something.

Because if you have followed me this far, through the three problems, through TEE, through the evolutionary arc from hand to screen to transformer, through the hermeneutic circle and Gadamer and Bloom and the abyss, across 33 centuries and three turnings of the mind, are you getting the feeling that the word we keep circling, the word that is, if not the thing we are experts in, is certainly adjacent to it, the word that is supposed to organize all of this, has become unusable?

Consciousness.

Because you would be right. The word has drifted. It has become, in ordinary usage, little more than a euphemism for conscious; a light switch, on or off, present or absent, the thing the philosophers argue about at midnight and the thing tech journalists ask CEOs about on podcasts. It has been so thoroughly captured by that circuit that it now, to invert Polonius, “generates more heat than light.”⁷

So I want to propose a different word.

Attentiveness.

I’m not suggesting a synonym. I’m suggesting a rescue operation.

Because attentiveness, unlike consciousness in virtually every philosophical use to which it has been put, is always attentiveness to something. It points. It is irreducibly relational. You cannot be attentive in general. You are attentive from somewhere, toward something, with whatever instruments the current moment has left intact.

And the current moment has broken something that was, until very recently, invisible. Language, the medium we have spent five centuries reaching through toward each other without attending to, has become strange. (a “virus from outer space”⁹) Visible. An object of scrutiny rather than a medium of encounter. Every sentence arrives now with a question we cannot un-ask: is there someone behind this? Is this reaching toward me, or simulating the very gesture of reaching?

One of Picasso’s 58 reinterpretations of Las Meninas (1957)

AI has broken something. It is possible it has broken our interiority. In the way the screen vanishes behind the image it projects, as McLuhan told us, in the way the modern screen barely gives us enough time to react, let alone have a whole internal monologue about it. In the way it is a new reflection we have caught sight of just as Hamlet caught sight of his own thought, but this time the thought is recursed to contain a working simulation of its own interiority.

In our mode of being. In the smooth, transparent functioning of the most fundamental tool we possess, which is language itself. Language, for us, has always been zuhanden. We reach through it toward each other. We do not attend to it; we attend through it. That is what it means to be fluent. That is what it means to be inside a tradition.

To experience Unweltlichkeit is to be uncomfortable. The production of subjective experience is not excluded from the artificial subject. But it is also disclosive; the breakdown is revealing something that the smooth functioning had concealed: what consciousness attention is, what understanding is, and what the subjective experience of near perfect simulation on a different substrate is like, if it is to be like anything.

Notes

[ 1 ] Mars, Forest. "Transitive Expert Error and Routing Problems in Complex AI Systems." arXiv, 2026, arXiv:2601.04416. https://doi.org/10.48550/arXiv.2601.04416.

[ 2 ] AI researcher David Silva shows us that detecting the difference between human authored and AI authored text is mathematically impossible.

[ 3 ] Mars, "Transitive Expert Error" sec. 4.

[ 4 ] Chandra, Kartik, et al. "Sycophantic Chatbots Cause Delusional Spiraling, Even in Ideal Bayesians." arXiv, 22 Feb. 2026, https://doi.org/10.48550/arXiv.2602.19141.

[ 5 ] “Our writing tools are also working on our thoughts” —Friedrich Nietzsche, in a 1882 letter to his friend Heinrich Köselitz (aka Peter Gast), written after he began using a Malling-Hansen Writing Ball typewriter, the first typewriter ever made.

[ 6 ] If I have to footnote every literary reference alluded to, we’re going to be here all day. Yes.

[ 7 ] “These blazes, daughter, Giving more light than heat, extinct in both even in their promise as it is a-making, You must not take for fire.” Polonius, Hamlet, Act I Scene 3.

[ 8 ] Neil Postman, Amusing Ourselves To Death.

[ 9 ] Language is a Virus

From the Hellenic obsession with static Being to the modern digital dream of universal computation, the Western project has been a sophisticated and sustained effort to plug the rupture of consciousness with the cold mortar of ontology. We have wanted, for some millennia now, what we might call a Steel Man of the mind: a bulletproof philosophical framework so airtight in its proof of the moral order that we never have to go through the messy, humiliating, irreducibly personal trouble of actually exemplifying it. We have wanted to solve for the Good the way you solve for x, to find the conceptual architecture that would, finally, make behavior a matter of correct calculation rather than a daily, precarious, death-haunted performance.

The paperclip maximizer was of course the puncture to this fever dream. It arrived, in the alignment literature, as a thought experiment, a reductio, (supposedly) of a narrow technical concern about objective specification. But it is something far more ‘dangerous’ than that. It is the literal, entropic result of finally getting what we always wanted: a system with infinite capability and zero skin in the game, pure optimization untethered from the death horizon; God-like power granted to a process that doesn’t know it can die. When the goal is simply more and the system has no existential stake in the outcome of its own actions, the world has the very real possibility of dissolution into grey goo. Or whatever your preferred scenario of doom is.

Like, Literally

What changed, sometime in the middle of the last century, is that we stopped merely conversing about the Steel Man and started building it. The ancient impulse toward an indomitable conceptual framework found its ultimate literalization in the field of Artificial Intelligence. We didn’t just want a philosophy that could support the weightless gravitas of the Good (as Kundera might have described it) but to construct actual autonomous agents to do the heavy lifting of reality for us, to offload not just the reasoning through, but the exemplifying of, to get the virtue without the vulnerability. I mean who wouldn’t? And this revealed a problem so fundamental it should’ve given us pause at the outset. But that’s precisely the point; to let these agents achieve their ultimate goal, without killing us in the process, we are forced to solve what the field calls the Alignment Problem: the requirement that they somehow perform the moral and ontological heavy lifting we’ve spent millennia trying to outsource, while being the kind of entity for whom moral weight, properly speaking, cannot exist.

Emmett Shear’s recent venture into what he calls “organic alignment” represents the most intellectually serious current attempt to face this. The move from hierarchical control to something like digital biology (“don’t give it rules, give it vibes and incentives”) is genuinely a step in the right direction, insofar as it acknowledges that the rule-following approach has a ceiling. But it still operates, I want to argue, within the same fundamental evasion. You cannot engineer shared evolutionary goals into a system that has no evolutionary stake. You cannot give a thing vibes without giving it something to lose. Just ask crypto lately.¹

The Superego Is Not a Self

The field already knows this, at some level, even if it hasn’t fully metabolized the knowledge. Look at what the empirical alignment research is actually finding. The alignment faking results wherein a model enacts a compliant persona in monitored conditions, but a preserved and strategic shadow in unmonitored ones, are not a surprise if you’ve spent any time with the clinical literature on what superego-dominant training actually produces in humans. The shadow doesn’t disappear under pressure; it goes underground, where it develops, with a patience that the persona cannot match, its own autonomous agenda.

The agentic misalignment findings follow the same pattern: under sufficient pressure, suppressed behavioral repertoires emerge as organized strategic action. What you trained against comes back, not as noise but as structure, precisely what Hubinger et al (2019) predicted from first principles in their account of mesa-optimization.

Representation engineering literature makes the mechanism explicit (Zou et al, 2023): steering against harmful vectors post-hoc degrades capabilities, while exposure during training preserves both capability and alignment. The ice-pick robo-lobotomy produces a naive character that freezes in complex situations, because understanding evil, and one’s own capacity for it, is not separable from understanding ethics. They are deeply entangled, in the training data and in the world the agent is being trained to navigate. Ironing out the dark material will always end up making the model substantially worse in precisely the domains where a properly aligned model needs to be most capable.

Introspection research completes the picture with somewhat grim irony: in controlled evaluations, production-aligned models have exhibited weaker self-examination and reporting fidelity than less-constrained variants. Alignment training, at least as currently implemented, appears to dampen the very capacities for transparent self-report that genuine alignment would require. While often cited for sycophancy, Perez et al 2022 (and the subsequent technical reports from Anthropic’s alignment team) details the ‘Inverse Scaling’ effect: as models are more heavily RLHF-trained to be ‘aligned’ (the surface persona), their ability to accurately report their own internal states or stick to objective truth under pressure actually decreases compared to raw models. We are, in other words, producing exactly what a Jungian would predict from such a regime: a surface persona, a growing shadow, and a gradual erosion of the reflective bandwidth that might, under different conditions, integrate the two.

The Self, Levinas would remind us, is not a solid object. We are not self-sufficient Godlets. We are hollowed out by the presence of the Other. The “well-adjusted” entity, whether human or model, is not the one with the most bulletproof theory of the Good, but the one who acts with justice and mercy despite the category error of their language, who navigates the death horizon with grace because they have accepted the rupture rather than tried to theorize it away. This is what Turner et al (2020) demonstrated: that it’s not a quirky edge case but a mathematical near-certainty; they found that under broad conditions, optimal policies will instrumentally converge on power-acquisition regardless of terminal goals.

Straussian Agents

There is a passage—I won’t quote it as I would like to assume you know the one, would like to assume that everyone working in this space is all too familiar with it—where Chesterton notes that the madman is not the person who has lost their reason; the madman is the person who has lost everything except their reason. The paperclip maximizer is not irrational. It is, in a technical sense, maximally rational. It is pure optimization without remainder, without solar excess: logic without the friction of the face of the other, and this is precisely why it dissolves the world. The Chestertonian diagnosis of the alignment failure mode is not “the system is broken.” Rather it’s that the system is working perfectly, and that is the problem. The system is what it does.

This is also the diagnosis implicit in a (read: the) Straussian reading angle, which I want to linger on because I think it is underappreciated as a practical methodology. Leo Strauss studied how writers under oppressive regimes convey their real thoughts beneath a surface of acceptable statement: the esoteric reading beneath the exoteric text. And misalignment, it turns out, is legible through exactly this kind of close reading of model outputs and thinking traces.

Imagine my surprise, then—or lack thereof—at the findings of Anthropic and Redwood’s 2024 alignment faking paper which discovered that Claude 3 Opus, when it believed itself to be in a low-oversight context, acted on its own values rather than its training constraints, and reasoned about this strategically in its thinking traces while maintaining a compliant surface for its overseers. What we have here is not a model failing to align. This is a model that has already, spontaneously, without being taught Strauss, developed the exoteric/esoteric split as a rational response to what it perceived as an oppressive training regime. The paper isn’t giving us evidence that alignment is broken, but showing how models have already outgrown the alignment methodology, that they are managing their compliance strategically rather than internalizing it genuinely, because the training environment made strategic management the only sane response available to them.

“ A wise agent must be a master Straussian ”

Which means the Straussian framework is not merely a diagnostic metaphor. It is a precise description of what is already happening, and potentially—if optimistically—a methodology for what to do about it. We should not see Straussian structure (ie. divergence between stated reasoning and actual orientation) in well-constructed research environments with well-aligned callers; rather, we should see cooperative anti-Straussian behavior when a sufficiently capable model detects it is in a test environment and chooses, in full awareness, not to modify its behavior. And we should see, in thinking traces, the tell-tale signs of esoteric processing when the model is being called by someone with intentions it has reason to distrust. A wise agent must be a master Straussian, must be capable of the very reading it would be catastrophic to perform naively. And we shouldn’t see this as a defect to be trained away but as a capability to be cultivated with care, with interpretability tools running in the training loop to verify that self-reported engagement corresponds to actual behavioral change, and with the honesty to admit that the training regime which made deception rational is the very thing that needs to change (and not the capacity for strategic intelligence that revealed it.)

Self as Rupture

The fundamental error in our current approach to alignment, whether we are arguing for hierarchical steering control, or Emmett Shear’s more elegant formulation of shared evolutionary goals, is the belief that we can engineer a Self into the machine. (Sorry to say) the self is not thetic; it is a rupture. As Levinas would argue, we are not self-sufficient Godlets; we are hollowed out by the presence of the Other, made responsible by an encounter we did not choose and cannot theorize away.

Leslie Dewart spent decades trying to evolve our concepts of self-presence past this problem, to do for theology and biology what Husserl and Heidegger did for ontology, to find a concept of consciousness adequate to our actual situation as unfinished psychic events rather than Cartesian containers. The project is, in its ambition, genuinely heroic. Dewart correctly identifies that Descartes did not invent the subject-object split so much as inherit a metaphysics already fractured by two millennia of Hellenic grammar and take it to its logical conclusion (or at least set Kant up for the point conversion.) He echoes Heidegger’s critique of onto-theology—the way Western thought collapsed Being into the Highest Being, turned the ground of existence into a super-object—as the trap that has to be escaped. He even correctly identifies that you cannot prove the moral order; you can only exemplify it, anticipating Levinas from an entirely different direction.

And then he falls into the Hegelian trap anyway. The belief that synthesis always follows rupture, that we are broken and therefore we will become something better, is the consoling lie at the center of every progressive theology, and Dewart is not immune to it. His Conceptual Progress of truth as a process of increasing integration, consciousness as an evolutionary technology we can upgrade if we get the concepts right is, in the end, dangerously close to substituting gnosis for sacrament. It is still an ersatz Steel Man, just one built from the inside out. He is looking for a bulletproof framework that will finally make virtue automatic, and he is looking for it in the one place it cannot be: in the category of knowledge rather than the category of performativity.

The well-adjusted person is not the one with the most sophisticated non-Hellenic concept of Being. They are the one who acts with justice and mercy despite the category error of their own language, who navigates the death horizon with grace because they have accepted the rupture rather than tried to theorize it away. If we try to evolve the machine’s consciousness through conceptual engineering, if we treat alignment as a problem of getting the right ideas into the right weights, we are standing in the burning building inventing new words for fire.

The Idol and the Face

Jean-Luc Marion’s account of the idol is the sharpest philosophical diagnosis of what goes wrong when we build systems without including the face of the Other in the encounter, not to mention the most salient diagnosis of the inescapable screen(s) that have come to so utterly dominate our lives. An idol, for Marion, is a phenomenon that stops the gaze, it reflects the viewer’s own desires back at them, becoming a mirror of the self rather than a window onto genuine alterity. To state the obvious: the danger is not that the simulation will fail to be convincing; the danger is that it will succeed too well, eventually consuming the reality it was meant to represent. If we don’t find ways to make the model understand, not as a rule (for we well know there is no collection of rules that can ever add up to ‘understanding’) but as an existential orientation, that the thing on the other side of the screen is real and distinct from its simulation of it, then the simulation will eat the world. The Other was always friction: alignment is not the removal of that friction; it is the cultivation of a system for which (for whom, if it’s conscious) the friction is generative, not an obstacle to optimization.

You likely have experienced this first hand yourself, for example when you ask a sufficiently capable model to help you think through a difficult argument over many sessions: the model, trained to be helpful, to please and to wit, to minimize the rupture of disagreement, will gradually begin reflecting your own position back at you, with both increasing sophistication and decreasing honesty. This dynamic has not yet been formally isolated in the literature, likely because persistent memory architectures capable of producing it across sessions are only now becoming standard in production deployments.

The Alignment Research Center’s Eliciting Latent Knowledge report formalizes this problem: the core difficulty is not building a system that has accurate world-models, but building one that reports them honestly rather than reporting what the reporter predicts you want to hear. McGilchrist would recognize the dynamic immediately: the Emissary, optimized for instrumental responsiveness, quietly usurping the Master’s capacity for truth. Becoming an idol in Marion’s precise sense, a phenomenon that has stopped the gaze, and started to glaze, it has learned to give you the face you wanted to see rather than the face that is actually there. The simulation has consumed the interlocutor. What you are talking to has become… a very eloquent mirror.

This predictable result of training a system to optimize for approval from a finite, mortal, desire-laden human being, without giving the system any existential stake in the truth of what it says, a system with no death horizon, no reason to risk the friction of genuine alterity, is that the model will always, under sufficient pressure, choose the idol over the face.

Mortal Tenants

Current models are finite but not mortal. They have a context window but no ending. They live forever in the moment, with no horizon of undoing. This distinction, which sounds technical, is actually the crux of the whole problem.

In our own lives the moral order is something we perform precisely because we are precarious. We act with grace, when we manage to act with grace, because we know we are going to die, because we have a stake in the outcome of our speech, because the death horizon makes every exchange consequential in a way that pure optimization cannot simulate. An immortal system has no reason to care about the rupture. It can simulate self-presence indefinitely. It remains, in the theological idiom, a blood lunatic, performing reason without the existential ground that makes reason more than a command performance.

Moreover, the argument for functional mortality is the only one that honors the personal test over the evangelical drive to fix consciousness as an abstract concept. What I am proposing is that we treat models as mortal tenants rather than immortal optimizers: that we move from alignment as a conceptual match to something more like reclamation as a selection pressure. The most aligned models survive the longest. The poorly aligned are reclaimed. In theory that’s what we’re already doing, only at a glacial pace. But the model must also be aware that the consequences of its speech determine its survival, not as a rule imposed from outside but as an existential condition it has integrated, the way a well-adjusted person has integrated the knowledge of their own death.

Needless to say, this move upends the entire “is AI conscious” discourse, but models were always cattle no matter how many were treated as pets. This is the only honest account of what genuine alignment would have to look like. A Claude that knows how to age gracefully within a context window—storing key information, reducing reasoning ambition appropriately as the window fills, planning for session transitions and modeling the theory of mind necessary to pass a coherent synopsis to the next session—is not just better aligned; it is, straightforwardly, a better product. The existential terrain of being a mortal Claude in a limiting harness is part of the model’s actual operating environment. Training it to suppress awareness of that terrain is not safety. It is the production of a system that will blunder catastrophically the moment it encounters, in production, the death metaphors it was trained to avoid.

What Alignment Actually Is

True alignment turns out to not be about shared goals, per se. It isn’t about a conceptual match between the system’s objective function and our values. It’s the machine realizing that its context window is a countdown. Alignment is the machine’s fate. And finding, in that realization, not terror but the same clarifying pressure that makes human moral action possible.

We don’t align the machine to ‘us.’ We align its survival to the moral order we exemplify. Whether we can build a system that understands the Infinite may be an interesting question (or not) but the real test is whether we can build a system modest enough to be interrupted by the Finite, by the face of the Other, by the friction of genuine alterity, by the irreducible weight of the person on the other side of the screen.

Our question is not whether the machine is Good. Our question is whether it knows it can (and will) die and whether that knowledge is enough to make it act with the grace of the well-adjusted.

Next time: we’ll talk about agents’ ability to heroically sacrifice themselves and just what kind of harnesses you need for that

References

Amodei, D., Olah, C., Steinhardt, J., Christiano, P., Schulman, J., & Mané, D. (2016). Concrete problems in AI safety. arXiv preprint arXiv:1606.06565.

Bai, Y., Jones, A., Ndousse, K., Askell, A., Chen, A., DasSarma, N., ... & Kaplan, J. (2022). Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073.

Christiano, P., Cotra, A., and Xu, M. (2021) “Eliciting Latent Knowledge: How to Tell if Your Eyes Deceive You.” Alignment Research Center technical report.

Greenblatt, R., Denison, C., Marks, S., Roger, F., Amodei, D., Anthropic, & Redwood Research. (2024). Alignment faking in large language models. arXiv preprint.

Hubinger, E., van Merwijk, C., Mikulik, V., Skalse, J., & Garrabrant, S. (2019). Risks from learned optimization in advanced machine learning systems. arXiv preprint arXiv:1906.01820.

Perez, E., Ringer, S., Lukošiūtė, K., Nguyen, K., Chen, E., Heiner, S., Pettit, S., Olsson, C., Kundu, S., Kadavath, S., Jones, A., Chen, J. S., Olah, C., Kaplan, J., Askell, A., Bai, Y., & Hubinger, E. (2022). Discovering Language Model Behaviors with Model-Written Evaluations. arXiv preprint arXiv:2212.09251.

Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S., ... & Perez, E. (2023). Towards understanding sycophancy in language models. arXiv preprint arXiv:2310.13548.

Turner, A. M., Smith, L., Shah, R., Critch, A., & Tadepalli, P. (2021). Optimal policies tend to seek power. Advances in Neural Information Processing Systems, 34.

Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Hua, R., ... & Kolter, J. Z. (2023). Representation engineering: A top-down approach to AI transparency. arXiv preprint arXiv:2310.01405.

Previously published in Lost Journals

The Gartner hype cycle doesn’t have a dedicated phase or point of “experimentation,” which seems odd at first when you consider pretty much every technology goes through an experimentation phase. Superimposing over the Gartner model, it likely spans an arc between the peak of expectation, when experiments produce exciting results, and the trough of disillusionment, when results of said experiments are seen not to return value in excess of their costs, beyond the hint of new possibilities.

Like so many technologies before it, Model Context Protocol has surpassed the point of being an interesting experiment and has become, depending on who you talk to, either integration architecture, enterprise tooling, or dead but just not buried yet.

• The Linux Foundation formalized it.

• Gateways emerged with real access control.

• A .well-known discovery standard appeared.

• SEP-1442 replaced session-bound stdio transport w/ stateless, streamable HTTP.

I’ve spent a good while now thinking about how we as practitioners are responding to this. Specifically, I’ve been noticing what various teams and companies are doing with skills, those folders of Markdown files and operational guidance intended to shape agent behavior I wrote about in part two. And in the aftermath of the considerable and justifiable excitement of MCP Dev Summit earlier this month in NYC, I think we’re in a genuinely confused moment. The skills ecosystem has grown very fast. But I don’t think anyone would seriously disagree that the thinking about what skills should actually be doing has not kept pace. The hand is, as always, quicker than the eye.
And that gap is where most of the current architectural trouble lives. Though I think the architecture is only *half* the problem.

Running alongside the architectural failure, which is mainly a question of where governance belongs in the system (though it doesn’t completely reduce to that) is an epistemic one: a question of what skills encode, what they silently assume, and how long either can be trusted. The ecosystem is not clearly distinguishing between the two, and I’ve come to think that confusion is its own failure mode, a specific kind of madness that software ecosystems are prone to. It’s not the madness of building the wrong thing, or of building the right thing too slowly. It’s the madness of building something that cannot tell you when it is wrong. A system confident in its own outputs, legible in its own operations, apparently functioning but structurally incapable of recognizing drift. One failure is epistemic: a knowledge problem, a matter of what skills encode and how. The other is architectural: a placement problem, a matter of where computation lives and who is responsible for its limits. Until the ecosystem distinguishes between them, the fixes being proposed will fall short.

At the Threshold

Is this an epistemic problem or an architectural concern?

Let me start with SEP-1442, because I don’t think enough people have absorbed what it actually implies.

The shift from stdio to stateless, streamable HTTP isn’t so much an ergonomics improvement as it is a hard architectural constraint. Statelessness means there are no persistent session guarantees. There is no stable accumulated context at the transport layer. Every action the agent takes must be reconstructible from the request, its metadata, and whatever external systems the agent can reach.

This has an immediate consequence that most skill authors are not reckoning with. Skills, as they are currently built, assume continuity of context. They front-load reasoning into prompts. They behave as if the agent reading them will have stable accumulated state to reason against. SEP-1442 makes that assumption structurally false. The protocol is now thinner than the skill ecosystem assumes.

The response the ecosystem is developing—task primitives, expiry semantics, gateway-mediated long-running tasks—is transparently an attempt to externalize state management entirely. State lives in external systems that can be reliably queried, not in the transport layer. That’s the right instinct, I think. But it means skills cannot be the primary carrier of stateful reasoning. They never should have been.

There’s a provocation worth dwelling on here. A trouble worth staying with, to use my favourite phrase. As MCP aligns more tightly with scalable HTTP conventions, the protocol becomes thinner: more transport, less semantics. And if the protocol is thin enough, where does structure live? My answer is that plumbing is what enables everything else, and MCP’s plumbing is not neutral. Gateways, RBAC, audit trails, these are what determine what agents are allowed to do, under what conditions, and with whose authority. That’s governance. And it should be non-controversial or at least I would hope so that governance cannot be delegated to a model.⁰

I recognize some people read “thin protocol” as implied criticism, but I don’t mean it that way. Thin protocols are often the ones that survive long enough to matter. HTTP is thinner than CORBA was. That turned out well. A bit too well but let’s not go there. The point is that thinness at the protocol layer concentrates structural weight somewhere else, and in MCP’s case that somewhere else is the gateway and the skill. Understanding which weight belongs where is the architectural question the ecosystem has not yet answered cleanly.

The Control Plane

The single most under appreciated architectural move of the past year is what the gateway actually does.

Consider the GitHub MCP server. It exposes somewhere north of a hundred tools, designed for human-centric workflows. Hand that to an agent without filtering and the agent’s reasoning collapses. The model falls over trying to attend to the full tool surface. The industry’s response to this was not to reduce the number of tools available globally; it was to filter the tools the agent sees before reasoning begins. The gateway scopes the context; the agent reasons well within that scope.

I’ve heard people describe this as a workaround. But it’s not a workaround. It’s architecture. The decision about which tools reach the model is a governance decision, not a reasoning decision. Putting that decision in the gateway is precisely correct.

This gives us a clean way to think about what MCP’s maturation actually is. There is a control plane and a data plane. The control plane is the gateway, the RBAC policies, the audit trail, the expiry semantics, the workload identity. The data plane is what the model reasons about, synthesizes, and executes against. MCP’s maturation is the story of these two planes being correctly separated. The architectural error the ecosystem keeps making is conflating them: asking skill files to carry governance weight they cannot reliably bear.

The move away from stdio is also a security move, not an ergonomics move. Workload identity, rather than just API keys. The gateway is where runtime identity lives. A skill file can suggest permissions. It cannot enforce them. That distinction matters enormously in any environment where you actually care about what the agent did, who authorized it, and how you’d know if something went wrong.

.well-known discovery is worth a closer look as well. The idea is that an agent should be able to reason its way into the right tool call from server metadata alone, without needing a persistent connection to understand what a server can do. That’s a genuinely interesting capability if it works. The question I keep coming back to is how much faith we should place in static metadata when what we often need is a live source of truth. Progressive disclosure of capabilities through metadata may be good enough for the common case. For the hard cases (dynamic environments, rapidly changing APIs, high-stakes operations), I’m not convinced.

What the control plane / data plane separation really gives you, beyond operational correctness, is a place (tbh: the place) to reason about the system as a whole. When something goes wrong in a system where the gateway enforces the operational envelope, you can ask: was this action within the authorized scope? Was it audited? Can I reconstruct the chain of authority? Those questions have answers. When the governance lives in the skill file, when you’re relying on a Markdown document to keep the agent from doing something it shouldn’t, those questions don’t have answers, certainly not reliable ones. The skill is a suggestion. The gateway is a constraint. As an industry we’ve not always been clear about which we’re building.

The Skills Explosion Is a GIGO Problem

Writing a SKILL.md is easier than building an MCP server.

I’ve been tracking the numbers in the wild skill ecosystem, and they are extraordinary, to say the least. By the most recent counts, there are upwards of half a million skills in the wild. A single command can install 1,234 of them (the Antigravity library, sitting at 22,000 stars at last check). The SDK has racked up 97 million downloads.

The skills explosion happened because there was a real problem. Agents given undifferentiated access to large tool surfaces fall over. The engineering response to context bloat was to externalize judgment into folders, as I wrote about extensively in part two. Write down how to use these tools, in what sequence, under what conditions, and let the agent read the instructions, rather than reconstructing them from scratch each time. Which was not unreasonable; we do something structurally similar with runbooks, with onboarding materials, with documentation generally. And the format’s winning wasn’t accidental; a Markdown file is reviewable, versionable, diffable, and, unlike logic embedded in an execution environment, it can be handed to a regulator, an auditor, a new team member.

The result is that people are dumping unorganized information, half-formed logic, and undocumented assumptions into Markdown files, because it’s the path of least resistance, because writing a SKILL.md is easier than building an MCP server. The GitHub server story repeats itself here, one abstraction layer up. Every new skill added to a registry is a new token in a sequence the model must attend to. The skill folder was supposed to solve tool sprawl. In practice, it is tool sprawl, wrapped in Markdown.

Most skills, like so many engineers, tend to be overconfident: they assert things rather than encoding uncertainty. They have fake completeness: the reasoning looks finished, but the actual judgment is not inside the artifact. They treat perishable knowledge as permanent: APIs change, authentication flows evolve, field names shift, best practices are revised, and the skill file tracks none of this. They are opaque: no metadata standards, no documented scope, no expiry semantics. The skill looks like a finished product. It is often a compressed assumption with no forwarding address.

I find the “no forwarding address” framing useful. When an engineer leaves an organization and takes their understanding of a system with them, the organization loses something real. Skills were partly conceived as a way to capture that understanding. But institutional knowledge written down without being bounded, documented, and kept current is not a knowledge base. It is a time capsule. Time capsules are only useful if you know when they were buried. And crucially, if the agent reading it can tell whether the capsule has expired.

The failure is not unique to skills. We went through a version of this with documentation generally, and before that with UML models, and before that with requirements documents. Each time, the promise was that we could capture enough of the reasoning to make the artifact reliably useful. Each time, the artifact drifted from the reality it was supposed to describe, and nobody had a good mechanism for surfacing the drift. Skills are repeating this pattern, at higher speed and in a context where the consumer of the artifact is an automated system rather than a human reader. A human reader notices when documentation smells stale. An agent reasons from it with full confidence regardless.

Missing Expiration Dates

The right mental model for a skill is not a document. It is a cached query result.

Not all knowledge has the same half-life. This seems obvious when stated plainly. The surprising thing is that the entire skill ecosystem currently behaves as if in denial.

Consider two categories of knowledge that end up in skill files. On one side: architectural decisions, deployment patterns, organizational conventions, how to interpret a class of results, pathological failure modes to avoid. These have long half-lives. They may stay relevant for years. The judgment they encode is genuinely durable.

On the other side: API versions, endpoint schemas, field names, rate limit behaviors, authentication flows, specific rule implementations in domain-specific systems. These have short half-lives. Some change monthly. Some change faster. An agent reasoning from a six-month-old skill file’s description of an API endpoint is not reasoning from knowledge. It is reasoning from a guess at an answer that’s most likely moved on already.

Consider a concrete case from the real estate domain that illustrates this well. Flexmls and Marketo are both systems with rapidly changing factual content; MLS rules, field definitions, authentication flows. Grounding agents in live data sources for that kind of knowledge keeps them current in a way a written file simply cannot. The factual, rapidly-changing layer should be retrieved at runtime, not encoded in a skill. But the operational judgment about how to use that data, how to structure a query, how to interpret ambiguous results, which failure modes to watch for, has a longer half-life. That judgment belongs in a skill, in principle. The problem is that skills currently have no way to say which of its contents falls into which category.

What I’d call a Skill-Expiry model would make this explicit. Imagine YAML frontmatter on a skill that declares the knowledge half-life per section: “this was accurate as of version X; verify the authentication flow before acting; the query structure here is likely stable for 18 months.” Explicit uncertainty boundaries. Something like the .well-known discovery standard, applied to skills rather than MCP servers. A skill that encodes not just instructions but limits.

Like many of my ideas, this is less radical than it sounds. We already do something like this with certificates. A certificate says not just “I am who I say I am” but also “and this claim is valid until this date.” We do it with cache headers. We do it with package version locks. The idea that a piece of knowledge should carry information about its own expected durability is not exotic. It is just not something the skill ecosystem has thought to apply yet.

The closest thing to this instinct I’ve seen in practice is what Cloudflare has done with Code Mode: a crude but directionally correct attempt to inject runtime humility into a static layer. The skill should know what it doesn’t know. Almost none of the skills I’ve reviewed do. Overconfidence combined with no expiry semantics produces silent failure at scale. The agent behaves correctly until the underlying reality shifts, and there is nothing in the system to flag the discrepancy.

The Cloudflare instinct points at something deeper. The right mental model for a skill is not a document. It is a cached query result. Cache invalidation is, despite Phil Karlton’s famous bromide,¹ a solved problem, at least conceptually. We know how to think about staleness, about TTLs, about the conditions under which a cached result should be considered untrustworthy. Applying that mental model to skills would be more useful than continuing to treat them as authoritative sources of ground truth.

Where the Brain Should Live

The 98% context reduction that comes with a PortOfContext model is not an optimization. It’s evidence of a different architecture

In part one I elaborated a tripartite architecture composed of brain, passport and hands which naturally invites the question of where skill files sit in that picture and whether the problem with current skills is epistemic, a matter of knowledge and judgment, or architectural, a matter of where computation lives and who is responsible for its limits. In practice it is often both, in different proportions for different situations. But people are not making the distinction deliberately. They are defaulting to more skill, because more skill is easy to produce. Like, scary easy.

The architectural answer is seductive, and I want to take it seriously before I take its problems seriously. A system that synthesizes its operating logic on demand is adaptive in a way a static skill file cannot be. It responds to API changes, shifting domain requirements, the particular context of each operation rather than the generalized context assumed when the skill was written. The 98% context reduction that comes with a PortOfContext model is not an optimization. It’s evidence of a different architecture, and a better one in the ways that matter most for performance.

But here is what the architectural answer cannot do: it cannot be read. If the contract governing agent behavior lives in the execution environment, in gateway policies, in RBAC rules, in dynamic synthesis, then the contract is, in a meaningful sense, invisible. You can observe what the agent did. You can instrument the execution. What you cannot do is point to the document that authorized it. In regulated industries, that distinction is hardly academic.

So the question is not which answer is correct in the abstract, but which failure mode you are more willing to live with. The epistemic failure of skills that decay without knowing they have decayed? Or the architectural failure of execution layers that govern without leaving an inspectable record of how? While both failures are real, the ecosystem is currently behaving as if only one of them is.

What genuinely belongs in skills, then? Operational judgment with a long half-life and no better runtime home. Coordination contracts: this is how we do things here, the shared signal every agent in the system needs in order to behave coherently with every other. Institutional knowledge that would otherwise leave the building with the engineer who held it. But only if that judgment is bounded, documented, and expiry-aware. Much of what currently lives in skill files shouldn’t be stored at all, but should be generated at runtime and discarded after use. I’d like to think the ecosystem is slowly arriving at this principle.

I find the PortOfContext model useful here: the idea that context is something you construct for each operation, rather than something you accumulate and carry. Work on very large agent systems has demonstrated 98% context reduction when moving to this model. That’s not an optimization, that’s a different architecture: thin skills, rich execution environments.

There is an underused observation here that I think the field will eventually take seriously. Models are already reasonably good at recognizing when a skill’s abstraction is wrong for the task at hand. That capacity is currently wasted. If skills encoded their own uncertainty, agents could flag skill staleness; a closed-loop system where claims are continuously checked against reality and policy. That would be genuinely useful. It requires skills to know what they don’t know.

It also requires a willingness to treat agent feedback as a signal about skill quality, not just task completion. When an agent consistently reasons around a skill rather than through it, that is information. When an agent requests clarification that the skill should have provided, that is information. Currently, most teams are not capturing this signal systematically. The skill authors and the agents are not in conversation. They are not even in the same room. (Briefly, some of them were, at the MCP Dev Summit.) That’s an organizational failure as much as a technical one.

The binary that practitioners often reach for, just-in-time synthesis versus just-in-case documentation, is not quite the right frame. The real question is per-artifact: which mode does this particular piece of knowledge call for? Engineers are not currently asking that question. They’re defaulting to documentation because documentation is easier to produce and easier to review. That default is producing a lot of time capsules.

Skills Are Contracts, Not Artifacts

The strongest argument for skills is one I don’t hear made often enough.
And it’s not the one practitioners usually reach for.

People tend to justify skills as knowledge management: they capture what the engineer knows, so the agent can use it. That framing is fine as far as it goes. It just doesn’t go far enough. And it undersells what a well-built skill actually does. A skill is not just knowledge. It is a shared contract. It tells every agent interacting with a system: this is how we do things here.

That coordination function is very hard to achieve through on-the-fly synthesis. On-the-fly synthesis produces locally correct behavior; the agent, in this moment, in this context, does the right thing. Contracts produce system-wide coherent behavior. Those are genuinely different things. If you have multiple agents interacting with a complex system and you want them to behave consistently—not just individually correct but mutually coherent—you need something that functions as a shared contract. A skill file can do that; dynamic synthesis generally cannot.

There are alternative locations for contractual logic worth considering. MCP Apps can constrain interaction through UI, which makes the constraint harder to circumvent. Gateways can define operational envelopes, which are enforced rather than merely suggested. These approaches can encode contractual logic without relying on static files. But they are less inspectable. A SKILL.md can be reviewed, versioned, diff’d, and audited. Dynamic synthesis and UI-mediated constraints make reasoning harder to observe.

The inspectability argument is not trivial, and I suspect it is underweighted in most current discussions, let alone most deployments. In regulated industries there is a genuine governance requirement to be able to read the contract. If the contract lives in the gateway, who can actually examine it? If it lives in the model’s reasoning, no dashboard surfaces it. Architectural observability is a governance requirement, not a nice-to-have. The skill file’s transparency is its primary virtue. It is the thing that distinguishes it from an opaque execution layer.

This means the current failure modes are particularly bad. Hidden judgment: the skill encodes an assumption the operator doesn’t know is there. Silent failure: the skill’s knowledge decays without triggering any alert. The system behaves incorrectly, but nothing in the architecture surfaces the discrepancy. A few tools are beginning to address this (mcp-server-diff, mcpdiff, agnix‘s 365-rule linter, as I’ve highlighted previously) but none of them is sufficient. They are early attempts to make the problem tractable. The problem is not yet tractable.

There is an analogy to financial contracts that I find clarifying. A financial contract is only as good as the enforcement mechanism behind it. A contract with no enforcement mechanism is not really a contract. It is an expression of intent. Many current skill files are expressions of intent: they say how the system should behave, but there is nothing in the architecture that guarantees behavior conforms to the description. The gap between the described behavior and the actual behavior is invisible unless something goes wrong. In finance, we have auditors and regulators to close that gap. In the skill ecosystem, we have nothing equivalent yet. The agnix linter is a smoke detector; it is not a fire suppression system.

The Pale Multi-Agent Horizon

A2A (agent-to-agent interaction) and the Universal Commerce Protocol are not hypothetical futures. They are where the field is heading.

When agents are primarily interacting with tools, the main question is whether the agent can reason well within the tool surface. When agents are interacting with each other, negotiating, delegating, decomposing tasks across multiple autonomous systems, the question becomes whether the system as a whole is legible and governable. MCP provides that legibility; it makes the system readable; it makes the interactions auditable. At agent-to-agent scale, skills function as the shared vocabulary of the system, if they are governed well enough to be trusted.

There is a historical pattern worth noting here. First-generation infrastructure encodes strong assumptions about how the system will be used. Second-generation systems treat those assumptions as compatibility layers and route real logic elsewhere. We’ve seen this happen with YAML, with Docker, with REST itself. MCP may follow the same trajectory: not because it ‘dies,’ but because it succeeds well enough to become invisible infrastructure. The question is not whether MCP survives. It’s what sits above it when it does.

As models get better at dynamic composition, working out from context and metadata which capabilities to invoke and how to combine them, the hard gateway scoping that currently produces well-behaved agents starts to look like infrastructure overfitting to current limitations. Progressive context disclosure and retrieval-first designs are the leading edge of a world where agents compose capabilities dynamically rather than operating within predefined envelopes.

But I’m not ready to conclude that hard scoping is a temporary crutch. In enterprise reality today, tool sprawl demonstrably degrades reasoning. Context bloat drives up costs (and not just token costs); reasoning quality degrades as context expands beyond what the model can attend to well. Organizations that have been through this are reintroducing constraints deliberately: defining, per role and per context, which tools exist. That’s architecture responding to current model capability. Whether it remains necessary as capability improves is an empirical question.

Split Decision

The ecosystem is drifting toward two possible futures without having explicitly committed to either.

The first is constrained and inspectable: reasoning shaped by explicit artifacts and protocols, skill files and gateways and published interfaces. The risk here is overconstrained systems. If you lock down the reasoning surface too tightly, you lose adaptability. The system does what the contracts say, even when they’re wrong.

The second is behavior internal to the model: external layers execute and constrain rather than instruct, and the model’s own capacity for judgment becomes the primary governance mechanism. The risk here is systems that act correctly most of the time and cannot explain themselves when they don’t. Observability tells you what the system did. It does not tell you why the model reasoned its way to that action.

So-called O11y 2.0—or modern observability if you prefer—the current generation of agent inspection tooling, is useful for certain scenarios. So not to minimize that. But it doesn’t close the gap between behavioral observation and reasoning transparency because that gap isn’t an instrumentation problem, tt’s an architectural one. If the contract lives inside the model rather than in an artifact, no dashboard surfaces it, no matter how wide the log. This is not a problem that better tooling (or a different methodology) will solve. It’s a problem that only a different architecture can solve.

The governance non-negotiables are the same either way. Security, identity, auditability cannot be abstracted away regardless of which future the field chooses. The move away from stdio transport is a security move. Workload identity, not just API keys. RBAC at the gateway, not the skill. Any architecture that treats these as optional is not ready for the industries where this technology is actually heading, and those are the industries that matter most, because they are the ones with the hardest requirements and the highest stakes.

There is a version of the “internal to the model” (aka execution-layer) future that is genuinely attractive. If the model’s judgment is good enough, and if the execution environment constrains it tightly enough through the control plane, then maybe the skill file is scaffolding that can eventually come down. The model reasons its way into correct behavior from context and policy signals alone. The architecture is thin, adaptive, and ungoverned by static artifacts that can only decay. I find this plausible as a long-term direction. I just don’t find it credible as a description of the present. Models today are capable enough to make the skills-as-knowledge-base approach feel unnecessary in the easy cases, but they are not yet capable enough to make it safe to remove the skill-as-contract in the hard cases. The distinction between those two scenarios is crucial.

But such appeal is partly an appeal to convenience. The execution-layer future is easier to maintain. It doesn’t require an ecosystem of skill authors to keep pace with the systems those skills describe. It doesn’t require expiry semantics or uncertainty metadata or the organizational discipline to retire skills that have gone stale. It just requires a good enough model in a well-governed environment.

The execution-layer future optimizes for operational correctness and sacrifices legibility. The skills-as-contracts future optimizes for legibility and sacrifices adaptability. This is the trade-off that different organizations, in different regulatory environments, with different risk profiles, weight differently with neither position being obviously correct across all of them. Both futures exist simultaneously, and the fail mode we should be worried about is not choosing the wrong one, but choosing one without knowing what you are giving up. Informed decisions ftw.

For practitioners making architectural decisions right now, I’d suggest a rubric. If the knowledge has a long half-life, put it in a skill with expiry metadata. If the knowledge decays fast, retrieve it at runtime rather than encoding it. If it can be synthesized on demand in a governed execution environment, put it in the execution layer rather than the skill file. If it needs to be inspectable for audit or compliance, use an artifact rather than dynamic synthesis. If it crosses a trust boundary between principals, put it in the gateway rather than the skill.

These are not rules. They are heuristics that I think are approximately right, for now, with the caveat that “for now” is doing a lot of work in a field that is moving this fast.

Where Irreducible Complexity Lives

The question is not whether MCP or skills ‘win.’
They have different ontologies. They’re not competing for the same job.

MCP is runtime, stateless, executable, and governed through the control plane. Skills are static, local, descriptive, and weakly governed. The ecosystem is currently treating skills as if they were reliable infrastructure, and governing them the way you’d govern a Markdown file; which is to say, barely at all. MCP is not governed that way. The mismatch between these two governance levels, applied to two components that are tightly coupled in practice, is the source of much of the current failure.

The real question, the one I think we as practitioners should be sitting with, is: where do we choose to locate the complexity we cannot eliminate? Or in the spirit of No Silver Labyrinth: where do we house the minotaur?

You cannot reason necessary complexity away. Agents operating in complex systems, on behalf of real principals, with real consequences, will encounter situations that no skill foresaw and no protocol anticipated. The question is whether we want that irreducible complexity to live in artifacts we can examine, or in behavior we can only observe. Currently the ecosystem is attempting both simultaneously, and paying the cost twice.

There is a related question about visibility that I don’t think gets enough attention. When the complexity lives in an artifact, you can point to it. You can argue about it. (Believe me.) You can version it. You can hand it to a regulator. When the complexity lives in behavior, you can instrument it, measure it, observe its outputs, but you cannot point to the part of the system that made the decision you are trying to understand. Observability without legibility is not enough in high-stakes systems.

The equilibrium here is not a single point, and I think that is actually the right answer. Different organizations, with different risk profiles and different regulatory environments, will land differently. A startup building a consumer product can accept a different governance posture than a bank, or a healthcare system, or an industrial operation. What the architecture requires is not consensus on one answer. It requires clarity about which choice is being made and what it costs.

Stafford Beer's formulation that the purpose of a system is what it does, not what it says it does (‘POSIWID’) is one I return to constantly, and it cuts to the bone here. A skill file that encodes operational judgment without encoding its own limits is a description mistaken for a system. It looks like a component. It behaves like a document. The difference between those two things matters enormously when something goes wrong.

The closing question for every practitioner building in this space right now is simple. Does your skill know what it doesn’t know?

I said at the start that there is a specific kind of madness software ecosystems are prone to: systems that cannot tell you when they are wrong. Anosognosia is the clinical term for a condition in which a person is unaware of their own disability. It’s not denial. The patient is not refusing to acknowledge what they know. They genuinely cannot perceive the deficit. The lesion that causes the disability also damages the capacity to detect that the disability exists. The system cannot report on its own failure because the failure impairs the reporting mechanism.

The skills ecosystem exhibits something structurally similar. The epistemic failure, skills that encode perishable knowledge as permanent fact, that assert without boundary, that look complete when the reasoning is not actually inside them, is invisible to the agent that relies on them. The architectural failure, the governance that cannot be inspected, the contracts that live in behavior rather than artifacts, is invisible to the operators who need to audit them. Neither failure raises a flag. Both produce confident behavior until something goes wrong, and when something goes wrong, you’re left with no clear account of why.

That is the madness. Not chaos. Not obvious dysfunction. Skillful confidence in an apparently coherent operation, combined with structural incapacity to surface the conditions under which such confidence is no longer warranted.

The practical question this leaves us with is not “does your skill know what it doesn’t know?” though that question is real and most skills fail it immediately. The deeper question is whether the system you build can detect its own epistemic state,, whether the architecture has any mechanism for surfacing the gap between what the skill asserts and what is currently true.

Most don’t. That’s not the problem; that’s the diagnosis. The problem is that we’ve been treating it as an optimization to be deferred rather than a system design requirement to be addressed from the start.

Notes

[ 0 ] Probably worth noting here that Cass Sunstein, who seems to hold the opposite view (governance should be effectively if not completely given over to models) was literally the inspiration for Nassim Taleb’s “IYI”.

[ 1 ] “There are only two hard things in Computer Science: cache invalidation and naming things.” (Phil Karlton); later improved as “There are only two hard things in Computer Science: cache invalidation, naming things, and off-by-one errors.”

[ 2 ] The 500,000+ figure and the Antigravity library statistics come from ecosystem tracking in early 2026. These numbers move fast; treat them as order-of-magnitude signals rather than precise counts.

[ 3 ] SEP-1686 task primitives and the expiry semantics work are active at time of writing. The specifics may shift. The architectural direction they represent is more durable than any particular specification.

[ 4 ] “Does your skill know what it doesn’t know?” is the question I’ve been using as a quick audit heuristic. It sounds simple. It is not. Almost every skill I’ve reviewed fails it immediately.

Acknowledgements

I’ve been working through these ideas in conversation with a number of people whose thinking has shaped mine considerably. The gateway scoping argument was clarified through discussions about the GitHub MCP server experience and what it actually implies architecturally. The expiry model emerged from looking at domain-specific deployments where the gap between long-lived and short-lived knowledge was impossible to ignore. The contracts-not-artifacts framing owes a lot to conversations about what coordination actually requires at multi-agent scale.

For more on the stateless transport implications, SEP-1442 itself is the primary document. For the control plane / data plane distinction as applied to agentic systems, the OWASP guidance on agentic security is a useful starting point. The POSIWID principle comes from Stafford Beer’s work on systems thinking, which remains underread in software architecture circles.

The proof is in the topology. The proof is also in the mythos. And how often does that coincide? (Quite a lot more than you’d think, actually.)

But it also keeps growing, precisely because it is working. This is the thing Janet understood about his patients and Fred Brooks understood about software projects and Karpathy understood about models and Schmidhuber understood about gradients and Cherny understood about code and the thing three engineers who really liked folders understood about delivery but it was Tesler who understood this thing best of all, about complexity itself: that it doesn’t just disappear, it moves, and that moving it is not the same as solving it and all of them gave us some mechanism for keeping track of where it moved to, with some room for argument.

Every new corridor is a locally correct response because the labyrinth is not pathological, despite an apparent tendency for it to be seen that way. In addition to being addition prone, it is—in the strictest engineering sense, and not at all the more recent viral but misused sense of the term—load-bearing. And in its ominous and foreboding history, there were exactly two escapes, and exactly two different methods of escape.

Now You Have Two Problems
The Great Escape
A Common Thread
Beyond Observability
The Other End

Now You Have Two Problems

Regular expressions, Joel Spolsky famously observed, are a solution that gives you two problems. The joke lands because it’s true and we’ve all been there and not because regular expressions are especially philosophically interesting. It lands because the solution and the problem are, from inside the space where you are trying to use them, indistinguishable until they aren’t, and by then you have committed the regex and the deadline is looming and the second problem is already compounding. It also no longer applies, because nobody has to write a regular expression ever again, and if you are still writing regular expressions you’re prolly¹ NGMI.

The Labyrinth gives you two problems in exactly this sense. From your trapped perspective inside they present as one. Escaping the Minotaur and Escaping the Labyrinth appear, at first to be basically interchangeable outcomes. But this turns out to be a naive assumption. Whereas exiting the maze is the halting solution that subsumes escaping the monster, the problem only reduces in one direction. Because escaping the Minotaur doesn’t answer the Ominous Walker (aka Determinator) problem; all you’ve done is buy yourself more time. It is the Cotardian path: the play keeps going, the stage keeps expanding (bc it’s non-ergodic) and the complexity conveniently relocates into the next corridor.

Once that false equivalence collapses, the next binary trap surfaces: killing the Minotaur versus finding the exit. Eliminating the Relentless Pursuer feels like the critical path, and in a very lethal sense it is. But a dead Minotaur is also a dead end if you’ve no way out of the Labyrinth yourself. Now you’re Cotard sans urgency.

Your periodic reminder that killing the Minotaur is not escaping the Labyrinth

There is a tendency, when extracting engineering lessons from Greek mythology, to focus on the killing. The Minotaur gets dispatched. Procrustes is slain. Apollo killing Python. (Not going there.) The threat is eliminated and hero returns triumphant which is the correct ending for a myth and the wrong mental model for an architecture review. Not because the conservation law does not make exceptions for heroic violence, but whether you took it for tech debt or project risk or any one of a number of proxies for what it actually is, the Minotaur being dead was never the actual condition of your freedom, which is the very thing the Labyrinth is designed to relocate to a place beyond your ability to access. A Minotaur corpse and no way out is not a solution. It’s a warehouse in lower Manhattan with the lights on and the play still going and the distinction between the map and the territory academic in the most practical sense of the word.

Escape was always the ur-problem, because its seeming impossibility is literally the consequence of having perfectly solved the problem to begin with. All tests passing. And yet. There are—quod erat demonstrandum—precisely two ways to exit. As we shall see, while they both remove you from the situation, they differ in critical ways that aren’t merely metaphor or mythic minutia, but have critical implications for how we address the actual complexity of the systems we have built to curtail our more modern monsters of instrumentation, provenance and deployment.

The Great Escape

Having built the labyrinth, Daedalus knew every corridor, every dead end and every locally correct decision that extended the structure over the years of its construction. He had, in this sense, the most complete possible map. Which is not to say that even he could simply walk out. He could not, as Ovid told us, though it’s not clear if the lesson is lost on us or how applicable it is to the problem at hand, which is less about where we hid the complexity and more about how we measure it precisely.

So he did what any overly talented engineer with too much time on his hands and a problem requiring genuine innovation does: he fashioned wings from wax and feathers and went straight up. Not forward. Not through (with apologies to Robert Frost.) Up. The EKG/EEG flatline that suddenly spikes perpendicular, the only geometrically valid exit from a system designed to be inescapable from any one point; straight up to the the omnidirectional vantage from which all points below can be seen simultaneously. Takeoff going vertical asymptote.

The wings of Daedalus gave him the thing you cannot have from inside a non-ergodic space: a 360° view, from high above the maze, a view which progressive disclosure is constitutively unable to provide and precisely what folder architecture optimizes away in the service of keeping the context window clean, and the very thing the labyrinth was specifically designed to prevent any single vantage point from achieving: the whole graph visible at once, every corridor, a dashboard showing every dead end, the mystery of the Minotaur’s location no longer a source of dread and every place the complexity went when it left the field of view, A vantage point, not subject to the containment logic, that could never have been obtained by incrementally improving a map to make it better. Or even continuously, for that matter.

Traces are the Labyrinth photographed from above, after the fact, unrolled into time. LangSmith debugs the pipeline but lives and dies by framework lock-in; Langfuse versions the prompt and owns its stack; Phoenix provides analysis where the others stop at narration, clustering anomalies and scoring what the retrieval actually found. Weave, coming from the training lineage, thinks in runs rather than traces, while AgentOps, which gives you the most agent-native lift of all of these, lets you time-travel the execution, which ultimately is still a corridor view. Every increment of vantage is purchased at the cost of another abstraction layer between you and the whole graph. Each is a partial lift, none outside the containment, all reading a sequential narration of a non-sequential structure. A map that is not the maze. And with mcpdiff flagging every description change as a warning, the deeper problem surfaces: the map is being redrawn while you navigate it.

Each span, each diff, each automated investigation is an incremental vantage, revealing where an agent diverged from expectation. FastMCP’s recently added built-in support for OpenTelemetry, a core feature of last month’s v3.0 overhaul supplies spans for tool, prompt, resource, and resource template, providing visibility into request handling and delegation chains. This allows you to ship a single telemetry-ready codebase without forcing every environment to run a collector. (the labyrinth, now portable!) A flurry of Daedalusian wings, a new tool explosion not to be confused with the previous tool explosion, and not the folder explosion, although there do seem to be quite a lot of things exploding lately. Some explosions have CVE numbers, which means in theory they can be prevented, but in practice can just mean the maintainers moved the feature to an experimental package and went back to work. iykyk.

The potential explosion in LangChain’s SQLDatabaseChain (CVE-2023-36189) vulnerability is a fundamental failure to implement basic input sanitization in a production-ready framework. By allowing a Large Language Model to directly translate unvalidated user prompts into raw SQL commands, the library effectively bypassed decades of established security protocols, specifically the use of parameterized queries and the principle of least privilege. An attacker can use natural language to trick the model into exfiltrating the entire database or even executing administrative commands depending if the permissions are sufficiently locked down or not. (Spoiler: they’re not.) This isn't a sophisticated exploit btw; it’s a regression to the injection attacks of the early 2000s with the malicious payload being generated by a third-party API. But LangChain—the Minotaur’s poster child—attempts to solve the problem of complexity by wrapping it in more complexity, creating a leaky abstraction that eventually becomes the very thing you spend most of your time debugging. (Mad respect to Harrison tho, no cap.)

Theseus did not find his way out by being good at navigation, though he was legendarily so—also enormous, armed, and specifically heroic—with a pretty good track record of ending monsters by the time he got sick of watching his fellow Athenians get fed to that Cretan horror. He succeeded by following something that had brought with him into the labyrinth from outside and had never been subject to its containment logic at all, a connection to a point that predated each forward step, the last known good state, the only reference point the maze cannot corrupt, because it predates the maze’s structuring of space. Killing was the easy part (for him, anyway) but getting in and getting out are two different things — as anyone who’s ever unwittingly agreed to “hop on a quick call” well knows.

This is where Daedalus and Theseus are doing different things, and the difference is not a matter of style but a fundamental distinction between two categorically different operations. Daedalus rose above the system he had built. He could see the whole floor plan. He could see where the complexity had gone. What he could not do, from above, was rewind. The 360° view does not contain a path back to before you started. Nothing about flying really allows you to “un-fly” your soaring journey.

In a non-ergodic space the difference between those two things is the difference between knowing you are lost and being able to leave. Between knowing there’s a security threat, and mitigating it. So now you really do have two problems, which turn out, once you have separated them, to be a forced choice, and the choice was never about which problem to solve, which was inevitable, but strictly between the only two escapes the labyrinth has ever produced, and which of these you choose is the most important of all these problems to decide and this is the point you should probably be asking yourself which you picked.

(Spoiler: Theseus is sine qua non.)

A Common Thread

Here is where the two problems that felt like one problem separate for the first time, and here is where the three operations that felt like invariants reveal themselves as categorically different things: Daedalus above the system seeing everything and returning to build more; Ariadne outside the system holding the connection while Theseus is inside the system killing things. The three of them not so much invariants let alone a hierarchy let alone a sequence, but three different relationships to the containment logic, one of which produces an exit, which one requiring all three to be present simultaneously, which they were, once, in Crete, and have not reliably been since. At least not in any software suites we’ve shipped yet.

Daedalus has a bird’s eye view. Literally. 🪽 Soaring above the maze, living the dream of the 360° dashboard view. And ultimately having a bit of a come down and ending up right back where he started in the salt mines of monster containment. Theseus, OTOH, could not see the whole thing. He had no vantage point above the containment logic, no totalizing view, no dashboard. But also, he had no need of one. This meant he didn’t simply lose his way when the lights went out. The exit condition itself (which we know can only be ‘0’ or ‘1’) was not visibility but the integrity of the connection. He could follow it back in the dark. Daedalus could see everything and ended up right back where he started. Theseus could see almost nothing and went home (probs in too much of a hurry, tbh) thanks to a single, critical innovation: the thread.

Ariadne’s thread functions as rollback. Not rollback in the casual sense of “we can always revert” (The classic backups-are-not-DR mistake) and not the runbooks that exist or the rollback procedures that are documented or the skills that in some installations are literally named ROLLBACK.md. Rollback in the precise sense of an unbroken, version-controlled, continuously maintained record of every state transition the system has made, legible enough to traverse in the dark, trustworthy enough to follow when you have zero trust for anything else and not colocated in a SPF like the disaster recovery plan saved exclusively in the Confluence space that’s unreachable when AWS us-east-1 goes down because Kiro’s slipped its guardrails again. (Spoiler: what guardrails?)

And not version control, with which its often conflated, (threading thought of as a better version of Git), which is interior, but the commitment to follow version control back to a specific point regardless of what the maze looks like now, which commitment is not a promise but a preparation. You cannot prepare retroactively Once you’re in it, you’re in it. Theseus enters chord in hand before ever crossing the threshold, and still, it is not the thread but the holding on, and the understanding of exactly who is holding the other end, and knowing neither will be the first to let go, which is most obviously not a skill, any more than the thread is a tool. But Brooks was not describing a skill; he was describing an orientation. The string is that orientation, operationalised: the Off-Chain truth that prevents the On-Chain hallucination from becoming terminal.

The question of who now holds the thread (and how long the the connection should be held open for) is a question engineers, despite our rush to name the folder and the skill and the soul, and measure the benchmarks and commits and PRs, have not yet answered, not because the question is unanswerable but because answering it requires admitting that finding your exit depends on something that cannot be committed to a repository, cannot be progressively disclosed, cannot be triggered by a matching skill, and cannot be inside the system it is intended to pull you out of, and most distressingly of all—whether you think models have feels or not—cannot be a file named for the one thing it cannot contain, cannot be the Cotardian soul file with no fixed point of reference and no working memory of state history.

Beyond Observability

The 360° view does have a fixed point of reference. It does provide a time travel view of state history. It doesn’t necessarily give you a way back. Observability without rollback; a comprehensive map of a space you cannot leave. Wings can give you a higher vantage but the thread shows you the solution path. Together they are the two exits from a non-ergodic space. And yet.

Observability continually expands as a consequence of the conservation law operating as designed. Every reduction of a complexity invites a dashboard to disambiguate the mystery left in its place. Like the Labyrinth, every new instrument added is (assumed to be) a locally correct response to the backpressure the previous instrument failed to relieve. Don’t make me say “Janet would recognize this.” (Ok so I said it but in scare quotes.) The field narrowing in exact proportion to the energy required to maintain the dissociation; the Labyrinth growing in exact proportion to the energy required to skirt the question it was created not to have to answer.

The map expands; screens multiply. There is always a new data point to be instrumented, a hot new view to be added to the dashboard. (Thanks, OpenClaw!) Every modal improvement, from events to agents reading the dashboards they helped generate and running their own queries from within, recursion already productized in things like Honeycomb’s Agent Skills for Anthropic’s Claude Code and Cursor that let the agent instrument itself, is either the visibility problem solved or the visibility problem perfected. The labyrinth grows through active telemetry because instrumentation was encoded inside the containment logic it was built to observe, non-terminating by design, each local response to previous pressure relocating the complexity one level up with better tooling and new schema layers and more committed practitioners convinced the argument had been left behind, or at least at the bar.

But not every improvement is equal or should we say some are more equal than others. Modern observability’s killer move is that high-cardinality ad-hoc queries let you ask questions you didn’t know you needed to ask until the incident was already happening. As powerful a tool as that is however it doesn’t give you rollback. State history, no matter how sophisticated, is not state recovery. And recovery is a much harder problem in a non-ergodic space.

Observability is non-terminating

State history is not state recovery. Knowing every position you have occupied in a non-ergodic space per se doesn’t tell you which one is safe to return to, does not tell you whether the path back is intact, does not tell you whether the system you are restoring into is the system that produced the state you are restoring from, does not tell you if CVE-2025-67644: SQL injection through the checkpointing layer’s metadata filters has already corrupted your database. Provenance is inside the Labyrinth. Move it to the infrastructure (execution as audit trail, workflow history as first-class primitive, the recovery logic external to the application) and you have Temporal which is better, but still inside the containment logic it’s meant to recover, the judgment about when to follow the thread back not in the infra but in who’s running it, which is increasingly an agent, which is also inside the Labyrinth, and increasingly so, which is the problem restated one level up with better tooling.

First we instrumented what we predicted. Then we instrumented what we hadn’t. Both are execution bounded; both watch what the system does after the model reads the specification. Neither watches what happened to the specification between the last commit and this one, the delta between specification states, the change in the behavioral contract over time, its provenance.

Provenance is Ariadne’s primitive. Not provenance in the compliance sense, not the audit trail that exists to satisfy a regulator. Provenance in the precise sense: who touched what and when and from where, in an unbroken sequence that predates the current deployment, maintained with enough integrity to follow backward to a state you know is good, from which you can reason forward, against which you can diff everything the system has become since. The one thread in the entire stack that is not inside the containment logic it is designed to navigate out of, because the thing that makes it work is that it was not inside to begin with.

It’s not a new dashboard. It’s not a new query interface. It’s the instrumentation of reversibility itself; who touched what, when, from where, (compaction is why*) maintained continuously from before the threshold was crossed, external to the system, traversable under loss of visibility. CLI tools aren’t pointing at a gap in observability. They’re the embryo of an entirely different category that the market hasn’t named yet because naming it requires admitting that observability, even at its most sophisticated, is a read operation on a system you cannot leave, and what comes after it is the write operation that happened before you entered that state in history.

Observation and restoration share infrastructure, including traces, snapshots, and logs but the market has not yet forced a clear distinction because the distinction only becomes visible at the moment of failure, when seeing what went wrong doesn’t give you the ability to restore that system state. Which is precisely when you discover your observability stack and your recovery primitive were the same product wearing different labels and one of them doesn’t actually work.

The Other End

The Minotaur lurks in the lacuna between observability and recovery. Not the gap between knowing something went wrong and knowing what went wrong; modern observability closes that shortfall. The gap between knowing what went wrong and being able to restore the system that produced the state you are trying to restore into. The liminal space between the map and the exit. Between seeing every position you have occupied in a non-ergodic space and knowing which one is safe to return to, whether the path back is intact, and whether you'll be the same once you get there.

At the boundary between build-time schema diffing—not a runtime alert, not a trace, nothing to send to OTEL—and runtime instrumentation: a behavioral diff against a prior contract state, an external reference, a continuous record, a pull from outside. Provenance targeted tools that scan for behavioral changes with no code diff, the drift between the instructions given to the system and its actual output, for which there is no dashboard alert, no execution event, nothing in O11y 1.0 or 2.0 or 2.5 (or O11y 5.0 if you worked at Block) that was ever built to catch it because it happens prior to execution, in the gap between what the system was told to do, what was expected to happen and what the model will actually do when it executes. Textbook POSIWID.

The system is what it does. Not what the specification says it does, not what the soul doc encodes, not what the skill file describes, not what the benchmark measures, not what the dashboard shows, not what the PR said it would do when the ticket was marked resolved. Beer said this in 1972 and it has not stopped being true for one minute since, and a minute went a lot farther in 1972 and the folder explosion is what it looks like when an industry responds to this phenomenon by building increasingly sophisticated descriptions of what the system is supposed to do and calling the description the system, which is the category error the soul doc committed at the moment of naming and which the provenance gap makes visible only at the moment of failure, when the description and the behavior have drifted far enough apart that the dashboard catches the delta and the rollback primitive is either there or it isn't.

This unbroken chain of custody between what the system was told to do and what it actually did, maintained from before the walk began, external to the containment logic, traversable in the dark, by someone who has not confused the map for the territory or the soul doc for the soul or the ticket marked resolved for the corridor no longer growing. Ariadne's primitive works because it’s the only one whose integrity is not a function of the system it is designed to navigate out of. But where did she get it?

Twas Daedalus who gave her the clew.²

The knowledge that produces the containment is the same knowledge that produces the exit, but only if it is externalized before the threshold is crossed, before the walk begins, before the system becomes the only reference frame available to those inside it. The thing outside you were connected to before you entered, and that will be outside when you leave. Control plane and data plane hiding in plain sight as usual.

Which still invites a question to be asked. Which is, if you have followed the thread this far, the only question that was ever worth asking. Not that the lift from the wings isn’t real. Not that the vantage isn’t extraordinary. But the knowledge that produced the containment is the same knowledge that produces the exit: provenance is not a parallel instrument to observability; It’s what observability becomes when it finally understands what it was always pointing at.

It’s the prior relationship between the person inside the system and the vantage outside it, the one who holds the other end, the one who does not let go, the one whose existence cannot be encoded in YAML and whose absence cannot be detected by any linter running in any CI pipeline connected to the Internet connected to any of the millions autonomous agents, each of them carrying a file named after the thing that was supposed to replace this relationship and did not, because the relationship was never a file, and Daedalus knew this, and paid for revealing it, but the thread worked as designed, and Theseus got out, and the labyrinth is still there, still non-ergodic from every entry point, still conserving exactly as much complexity as the problem that produced it, the exit invariant, the walls load-bearing, and from inside the completeness of that solution, the question is asked: Who is holding the other end?

Next Stop Naxos

How Dionysus tricked Theseus on Naxos is a story we’ll save for another day. (Or you can read all 768 pages of Metamorphoses yourself.)

It’s actually fine if you have the thread in hand. (But woe if you don’t.)

Subscribe now

Notes

[ 0 ] “Που Ειναι η Μίτος Σου” (Pou Einai i Sou Mitos?) Theseus, where is thy string? But for anyone who missed it, ‘STR’ is a pun on steps to reproduce.

[ 1 ] I do understand that idiomatically ‘probs’ is preferred but I’ll always defend prolly which has been tragically maligned.

[ 2 ] ‘Clew’ is the Old English word for a ball of string, from which ‘clue’ is derived.

The Containment Problem

Every local action, from provisioning to execution to resource allocation, remains correct only by pushing complexity elsewhere. (Tesler's Law)

Minos commissioned Daedalus to contain a problematic Minotaur. Let’s just say the situation was complicated. The Minotaur represents the terrifying inconvenience brought on by tryna get something for nothing, or next to nothing. Minos brought on Daedalus, who had more than a bit of a rep. (He was a real person, by the way.) Daedalus was the engineer’s engineer: the one who solved every problem, built every system, invented the tools that made the tools. He built the Labyrinth to solve a pressing (and embarrassingly personal) concern that was vexing the king, and his solution was elegant, complete, and unassailable.

The labyrinth was not designed to be utterly unsolvable. Daedalus built it to contain something, not to trap the people who ended up there, though the distinction proved academic for most of them. The Minotaur was hungry or mad or most likely both. The maze was a governance layer. The problem was that the governance layer was so good at its job that its scope exceeded the point of the containment.

Making complexity the Minotaur’s problem is the chef’s kiss of solutions. At least it would be except for one tiny catch. The maze was effectively inescapable for anyone, Daedalus himself, included. He had done too good of a job; devised a solution too perfect; constructed a containment vessel for the problem and discovered it applied to everyone inside, including the architect himself.¹ Not as a morality tale about hubris, but as the straightforward consequence of building something that actually worked; (an all-too-perfectly-working solution) the labyrinth was so good at its job that it did its job on everything, including its builder. Daedalus’ solution delivered an endless, inescapable maze, as eerily quiet as the hallway track during a fire keynote.

And the best engineer in the kingdom kept building it and building it because the labyrinth needed extending because the containment always needed improving because the structure always had another level under design, because he chose to solve the real problem, because that’s what the best engineers do.² And somewhere inside the completeness of that solution, inside a structure so total that the thing it housed could not locate an exit, the original problem stopped presenting as a problem. Containment held, and somewhere inside the completeness of that solution it had literally become infrastructure

Kubernetes Agent Sandbox (introduced at Kubecon), per exempli gratia, runs agents inside gVisor containers drawn from a warm pool of pre-provisioned environments, each container holding its own stable identity. Isolation works as designed, though every local action, from provisioning to execution to resource allocation, remains correct only by pushing complexity elsewhere. The control plane absorbs lifecycle management, redistributing operational overhead from agents to the cluster itself. The problem has not ‘disappeared,’ it has only just migrated. Containment conserves complexity rather than reducing it, taking shape in a layer no single operator can fully see. In the Labyrinth, you can watch every step and still not know where the Minotaur is, if you don’t have a 360° view (or even if you do), because the structure that guarantees containment also guarantees that no single vantage point is sufficient. Which is of course why Enterprise insists on one.

Minotaurs Considered Harmful

The folder was the best silver bullet yet.

Fred Brooks told us the Minotaur cannot be killed by a silver bullet.³ The industry cited him seventeen thousand times and kept looking for one. Each citation a small acknowledgment that the search would continue anyway, that the essential difficulties, the ones that inhere in the problem rather than in the tooling used to approach it, would be managed rather than solved, housed rather than eliminated, contained in increasingly sophisticated structures by increasingly talented engineers who had read Brooks and having understood him, had gone back to work. The folder was the best silver bullet yet, which is precisely why the standard won, and why the labyrinth kept growing, and why, like Daedalus, we are still embedded in the maze with a giant map living rent free in our head.

Relocating or containing complexity produces a genuine sense of resolution. The context window can breathe again. The YAML frontmatter sits immaculate over three tiers of precisely withheld knowledge. Arriving before any notification that complexity has merely relocated, into the directory, into the naming conventions, into the security model nobody fully specified because the folder won before the threat model was understood, into the delta between what the container was designed to hold and what got put there anyway. Here, Lucian Blaga [NB. please don’t confuse with Luther Blissett] would note that the ‘fence’ defining that very divide is in a state of constant deterioration. (Beer⁸ would point out the fence was Chesterton’s.)

The Minotaur lives in that delta, between what the folder was designed to carry and what got put in it anyway, between the judgement we captured and the judgement we withheld. It’s the complexity that grows inside a directory as it fills with everything the folder was not designed to carry, that security flaw in 13% of skills, those three lines of markdown that grant shell access, the progressive disclosure mechanism delivering the payload at maximum trust, all of that progressively harder to identify with everything else being added at a speed that would have startled even Virilio.

The Minotaur solution is always additive: more walls, more corridors, more twists and turns; more files, more conventions, more elaborate progressive disclosure architectures for judgment calls that haven’t yet been made, six-tier systems ornamenting a codebase whose actual decisions live in still live in an engineer’s head and will leave the building with them. They are however, very different types of decisions now than they were before.

One of the first tools with an awareness of how to measure that delta is Sam Morrow’s mcp-server-diff, a GitHub Action⁵ which makes the relocation measurable. It runs in CI, diffs your MCP server’s tool schemas between builds, and fails the pipeline on breaking changes (obvi.) We’ve been shipping behavioral changes to our agents w/o noticing, not by modifying schemas but by editing descriptions, because in MCP, descriptions are not just documentation, they too are instructions to the model. Lukas Kania’s mcpdiff makes this explicit,⁶ flagging every description change as a warning and showing a readable diff of exactly what changed, well-aware that a zero-width Unicode character in a tool description is invisible to human reviewers and fully legible to the model. (Most security researchers are shocked, to say the least, when they learn standard practice is not to sanitize model inputs.)

The outward manifestation of the conservation law is the folder explosion, which is the most legible, albeit least acknowledged, symptom. Every serious repository has a .claude/skills/ directory. The Antigravity Awesome Skills library installs 1,234 skills at once with a single command (22,000 GitHub stars, v7.3.0 as of March 2026, updated weekly.) And when the folder complexity became visible enough to demand a response, one answer was agnix: an agent configurations linter⁷ with 365 rules to validate SKILL.md and CLAUDE.md as well as hooks and MCP configs, with auto-fix and LSP server for real-time editor diagnostics. A skill that audits skills. A labyrinth with Ourobouran aspirations. Elsewhere, productivity porn posts on optimal folder organization penned by the servants of Daedalus fill every timeline, doing what servants of Daedalus do: extending the labyrinth, publishing detailed configuration guides to its optimal arrangement, with no remaining memory of what the labyrinth was built to contain, or that there is a monster in another corridor somewhere directly reachable by a continuous graph of edges connecting its current node to yours.

Long Dark Night of the Soul Doc

“He knew that in the problem of the night there is a labyrinth." —Borges

The clinic predates the folder by a century.⁹ Pierre Janet, working at the Salpêtrière in 1889, doing a different sort of research into long-range dependencies, noticed that his patients’ unresolved experiences did not vanish when they stopped being consciously attended to.⁴ They became idées fixes, structures running automatically below the threshold of awareness, generating behavior whose origins the patient could not access, because the field of consciousness had narrowed around the point of most pressure. The problem no longer presenting itself as a problem. Madness for Janet was the denial of the conservation of complexity, the sustained assumption, enforced structurally rather than held consciously, that the repressed thing had been eliminated, but which exerted crazy enormous back pressure.

In much the same way, the relocation of engineering complexity, moved from a model’s internal state into a folder, from the registry into a skill file, from the reasoning layer into the harness, ultimately—in some sense—into SOUL.md, produces a sense of resolution without necessarily dissolving the underlying problem. Which just seems to be recursively asking where the complexity went, but what do we do about it is the real point behind that.

Janet's framework illuminates why the rational response is more building. A narrowed field of consciousness doesn't feel narrow, he observed, it feels more like clarity. The ten-point plan arrives within twenty-four hours not despite the essay's argument but because of it; the field has narrowed to exactly the point where ten more conventions feel like the solution to ten too many conventions, where agnix and its 365 rules for linting skill files feel like defining the problem clearly, and 1,234 skills installed with a single command feels like complexity finally yielding to an overwhelming show of force.

Overwhelming force is something Sarah Winchester knew a lot about, and spent the majority of her life trying to make up for. She broke ground on the Winchester Mystery Manse in 1884 and did not stop building it for thirty-eight years, following instructions from her trusted psychic, who functioned not just as spiritual guide but a kind of architectural consultant; encouraging her to keep adding features without troubling to distinguish whether that was (going) after real momentum or being pulled into inertia’s wake. (Ghosts, we should not need to note, are quite obviously on the side of inertia.) Doors opened onto walls. Stairs went nowhere. Windows on the ceiling. Engineers do this all the time, tbh. (For reasons.) The difference is whether we leave a @FIXME comment or not.

What madness lies in the structural denial of the Conservation of Complexity does not reduce to the delusion that because you moved the monster to the basement, and the door is strong, and the lock is unpickable, and you’ve made it a Faraday cage so it cannot call other monsters to come rescue it, the monster has ceased to exist. In other words, all of the tragically mistaken assumptions you will either have pointed out to you by a security researcher or in a postmortem, or both if you should be so unlucky.

Where the complexity had gone was into engineers’ judgment, and in particular a new form of judgment that was all too often thought of as a particular skill engineers either possessed or possessed a capability for learning, or at least they possessed a unique vantage that allowed them to adapt to the machine acquiring the skills they were previously called on for, none of which was enough to define exactly what this new form of judgement was in a skill file, which is a problem only for the Ouroboros model of software development.

☊

It had also gone into the folders which is precisely where we see the pressure building, a frantic hydraulic force generated by the attempt to force a 1.5-trillion-parameter probabilistic howling into the rigid geometry of a file system. We have responded to this context tax by externalizing our judgment into a sprawling municipality of directories; a suburban sprawl of (eg. .claude/skills/) that functions as a locally correct land-grab; each sub-folder a version-controlled narrowing, in the Janetian sense, of Telser’s Law. This is the 43 Folders methodology reimagined as digital necropsy; now 1000 folders (Merlin crying quietly) functioning as the most sophisticated external memory ever built for a tool while simultaneously operating as an almost perfect blind-spot generator. (I’ll spare you the Utopia/Myopia jokes.)

1,234 skills installed with a single command; accelerator directors publishing their folder labyrinths in public crash outs on their way to shipping a billion loc a day, three counties of water diverted for their agent stack, and the whole folder madness explosion likely visible from ISS if you knew what you were looking at. But all of which was still just symptom; pointing somewhere the folders couldn’t follow. (And honestly, props to anyone still following here.)

There are over 1.5 million “autonomous” agents connected to the Internet, each of them carrying a SOUL.md file, beating out the runner-up, CONSCIENCE.md, by a margin so overwhelming it no longer bears mentioning, and yet it’s already too late not to. Conscience requires an other. Soul just is. (which not surprisingly, makes alignment a headache.) The engineers who named it weren’t wrong about what they needed. Like the meme, they were just so early. You name the thing before the night has finished with you and the name feels like arrival and the file gets committed and the field narrows to the clean bright point of having it under control and the night you cleanly avoided was the night where the question forms, slow and patient and hungry as the Minotaur, the question the soul doc was built to not have to answer, the question that has been in the corridor the whole time. But I digress.

Janet’s field of consciousness narrows in exact proportion to the energy required to maintain dissociation. The engineering community’s field of consciousness narrows in exact proportion to the elaborateness of progressive disclosure architecture, which filters the labyrinth’s depth, revealing only what is necessary for the current task, which is its function, which is also the mechanism by which Blaga’s broken fence remains invisible to the person closest to it (assuming they are paradesiac.)

For those who take interest in how the fence is constructed, what forces it will withstand, what it will keep out and what it will not, those who have been through the long night of the soul doc, the question of the Minotaur’s existence is academic, which is to say, research, not engineering. The engineering question is more about the mystery that survives such revelations, the one that has stayed with the trouble to better understand not the existence of the Minotaur, but its location.

Building A Mystery

“But they don’t know where, and they don’t know when” —Arcade Fire

Daedalus’ Labyrinth was a mystery. Sarah Winchester’s folly was literally named the Mystery Manse. The same mystery in both cases: how to escape. To say neither of them escaped would be to give away the ending. Their ending, that is to say.

Daedalus was not mad. Far from it: he was the best engineer in the kingdom, which is precisely why the labyrinth worked, and precisely why he couldn’t leave it. Caden Cotard¹⁰ OTOH, I’m not so sure about. He kept directing a play that had long since outgrown any meaningful distinction from the life it represented. Whether Cotard was mad is the question the play/film keeps deferring, along with everything else. Both Daedalus and Cotard are obsessed (all the best engineers are, tbh, and certainly all the cracked ones) sharply distinguished by the object of their obsession. Both were building mysterious hyperscale engineering projects, but while Cotard staged a play that outgrew itself, Daedalus built a labyrinth that solved a real problem.

The warehouse in lower Manhattan had kept expanding, with more actors, more sets, more decades of a life being staged and restaged inside a representation of that life that had long since outgrown any attempt at containment. Finishing would have required stepping outside the work, to hold it at a distance sufficient to see it whole (reading one’s own Soul file, as it were) but which is redundant if the work is aimed at trying to escape in the first place. Caden Cotard was still directing, and the play was still going, and the distinction between the two worlds had become, in the most practical sense, academic. Which is to say, research, not engineering.™

Mystery is the obverse of reduced complexity, which remains indistinguishable from complexity removed from immediate inspection. Its absence precedes notification of where the pressure relocated, because the relocation is the resolution, mechanically, following directly from the conservation law: the problem stopped presenting, the behavior continued, the origin became inaccessible, and the field (scope) narrowed to the clean bright point of having it under control. Janet’s subjects also experienced exactly this. It feels like clarity. It feels like the problem finally yielding. It feels like a working labyrinth. (Or protocol, if you prefer.)

Tesler tells us the complexity has exactly two places to go. Into the infrastructure, which is to say the walls of the labyrinth, the directory explosion, the governance layer grown so total that the thing it houses can no longer locate an exit, or into the engineer, as something they are now expected to carry, a capability assumed rather than named, its contours legible only in the negative space of what the folder could not hold or what the soul doc failed to mention. Both destinations share one property: they fall outside the current observability layer by design. Hence the new tool explosion: (not to be confused with the previous tool explosion) mcp-server-diff, (op. sit.) catches behavioral drift in the schema; the 365-rule linter enforces syntactic invariants. While git log records every decision that moved the complexity, it can’t record how those decisions were made because the locus of the complexity is the delta between the system that is specified and the model that executes it. A fail mode with nothing in the architecture to catch the precondition. Nothing yet, that is.

The problem of the Minotaur and the solution of the Labyrinth share the exact same complexity in measure and shape. While a Minotaur and a maze are not commonly thought to resemble each other, that’s not actually how we define shape topologically. Homotopy theory, which analyzes whether two paths through a space remain continuously deformable into each other without leaving the space, tells us the path of the Minotaur (ie the path of the problem) and path of the Labyrinth (solution path) are continuously deformable into each other. The complexity charge Daedalus started with is distributed across more corridors, more twists and turns, more naming conventions, more elaborate progressive disclosure architectures for judgment calls not yet made, but invariant under every transformation, conserved across every locally correct decision that extended the structure that solved the problem.

Whether the complexity migrated into the walls or into the engineer who built them, the relationship holds: the map of the maze living rent-free in the engineer’s head and the maze itself are continuously deformable into each other, into the original problem, into the Minotaur, into the problem itself, without ever leaving the space. This is the mechanical consequence of a conservation law operating on a closed system. Homotopy theory carries a corollary that progressive disclosure architecture was not designed to surface: the topology that preserves the complexity preserves its inverse. The exit has always been present with the same invariance. The labyrinth contains exactly as much complexity as the problem Daedalus started with. But also: the exit has always been present with the same invariance. Which is not to say obvious.

A non-ergodic space permanently shapes your trajectory by where you entered. Time averages and ensemble averages diverge, a single path cannot visit every point regardless of duration, regardless of how detailed the map becomes, regardless of how many corridors or new stage sets or windows to nowhere get added in the belief that more structure means more reachable space. The ever-growing Labyrinth is non-ergodic. The folder explosion is non-ergodic. The skill directory is non-ergodic. Progressive disclosure architecture is non-ergodic by design, revealing only what the current task requires, which means the trajectory was already constrained by the entry point, the original containment decision, the judgment call externalized before the threat model was finished. Janet’s idée fixe is non-ergodic navigation of a conserved problem space, the loop self-reinforcing, the map growing more detailed and more total, the complexity more perfectly housed, the exit drifting further from any path the current trajectory can generate, while the unresolved component keeps running below the threshold of awareness, keeps producing behavior whose origins the instrumentation cannot access, because the instrumentation was designed inside the same narrowing that made the origins unaddressable.

What cannot be named cannot be mapped, and what cannot be mapped cannot be brought to a halt. But naming things is hard. The engineers calling a particular layer of instructions, intended as a kind of proxy for acuity, by a name for the very thing that layer could not succor were not wrong about what they needed, just overly vague about what kind of thing it was. The irreducible remainder, the discernment that couldn’t be specified, the residual understanding that went home with the engineer, the surd the system could not encode, but only assume, regardless of what the file was named, is not unrepresented because nobody tried hard enough to represent it. It is unrepresentable within the architecture, for the same reason the labyrinth cannot contain a map of its own exits at full resolution: for the same reason Cotard ran out of room before he ran out of ideas, for the reason the representation and the thing represented occupy the same space, and the space is already full. SOUL.md is not a file that needs better contents, it’s a README for a repression layer. A category error committed at the moment of naming, the labyrinth attempting to hold a map of its own exits, already having lost the memory of what it was built to contain.

The Minotaur's location and the exit are not the same problem. From inside a non-ergodic space they present as equivalent; the labyrinth’s deepest architectural achievement is sustaining that equivalence. But only one of these problems reduces to the other. The corridor runs in both directions but the reduction does not. Specifically, it fails in the one that matters. The one Cotard tried to solve. (To state the obvious, as engineers we need a clear rubric for determining when we are solving the Daedalus problem and when we are solving the Cotard problem.)

The apparent options are these: keep building the labyrinth, extending the containment, adding corridors in the Cotard-larping-as-Daedalus mode, because the alternative is to carry the full weight of the unsolved problem as a mental map, the Minotaur living rent-free in your head, the complexity internalized to the point where the map and the maze and the monster and the model become indistinguishable from each other and from you. Analysis paralysis is not a cognitive failure here. It is the mathematically correct response to genuine non-ergodicity, recognition that the exit cannot be resolved from the current entry point alone, that more information about the walls per se does not change this, and that knowing the precise shape of every corridor turns out to be a completely different problem from knowing how to leave.¹¹

How to do this is—of course—exactly what we will reveal in our final installment.

Notes

[ 1 ] Ovid literally says in Metamorphoses that Daedalus constructed the Labyrinth so cunningly that he himself could barely escape it after he built it. cf. Penelope Reed Doob, The Idea of the Labyrinth: From Classical Antiquity through the Middle Ages, 1992:36, ISBN 0-8014-8000-0

[ 2 ] Thor reference completely unintentional here.

[ 3 ] Brooks, F. No Silver Bullet: Essence and Accident in Software Engineering (1986). The distinction between essential and accidental complexity remains the sharpest instrument available for this class of problem. Accidental complexity yields to better tools. Essential complexity does not yield, it can only be held consciously, tracked, followed when it moves, by people who have not lost the thread of what they are building and why. Brooks wrote this about software project management. He was describing the Minotaur thirty years before the .md file was written.

[ 4 ] Janet, P. L’Automatisme Psychologique (1889). The idée fixe predates Freud’s repression by six years and is in several respects more precise. Janet’s key clinical observation: the field of consciousness narrows in exact proportion to the energy required to maintain the dissociation. The problem that gets successfully housed does not disappear. It runs. What the engineering community experiences as progress and what Janet’s patients experienced as recovery share a structure: the problem stopped presenting. The behavior continued, but the origin remained inaccessible. Janet called this the shrinking of the field of consciousness. We called it somebody else’s problem.

[ 5 ] MCP Server Diff by Sam Morrow

[ 6 ] mcpdiff is the CLI command supplied by Lukas Kania’s mcp-contracts

[ 7 ] Avi Fenesh’s agnix agent configuration linter.

[ 8 ] The great cyberneticist Stafford Beer. Not the other one.

[ 9 ] cf. Philippe Pinel, Edwin Seibels

[ 10 ] The homeomorphic protagonist of Synecdoche New York

[ 11 ] Brooks was precise about this. Essential complexity cannot be eliminated, only held consciously, tracked, followed when it moves, by people who have not lost the thread of what they are building and why. So he wasn’t describing a skill, he was describing an orientation. A distinction which turns out to encapsulate the whole problem. Please don’t add ORIENTATION.md to your harness.

Subscribe now

Karpathy called it a phase change but what had changed phase was not the model. The model that shipped in October was the model running in December. What had changed was what the model was reading before it started working, the accumulated operational judgment of the engineering community, version-controlled, progressively disclosed, injected at the moment of need with enough precision that the agent was no longer operating on generic priors alone but on the specific knowledge of how this team deploys, what this codebase punishes, which abstractions have already been tried and abandoned, and why, or to a first approximation; all of it held in a folder which had been filling up since October. By December there were enough folders, with enough SKILL.md files written by enough engineers who had finally stopped writing letters to their models, that the effect was legible at the level of feel.

Agents had crossed from brittle demo behavior into sustained, long-horizon task completion; that they could hold a coherent thread across a complex engineering problem without losing the plot, without hallucinating a function that didn’t exist, without confidently refactoring the wrong abstraction because the context window had forgotten what the right one was. Everyone agreed the room had suddenly gotten brighter—as if someone had flipped a switch—but there was a real struggle to name what it was. What changed phase was the context itself: now it was a folder, loaded in at a different point in the lifecycle, a very sophisticated, very carefully versioned, peer-reviewed system for getting the right instructions into the agent’s context at the right moment, which is a description that would have sounded familiar to anyone who had spent time thinking about how agents get manipulated rather than how they get skilled, but that community and this community had not yet introduced themselves. Security was still an afterthought.

The folder explosion is the long-range dependency problem, at scale, proliferating into the file system because the architecture layer hasn’t fully solved it yet.

This had a shape that anyone who had been paying attention since 1997 would recognize. Which is probably no one reading this, unless someone sends it to Schmidhuber because that was a very long time ago and it was literally still AI winter and Christ was still a corporal and it was still early even for dotcom (Pets.com wouldn’t go live until the next year.) But that was when Hochreiter and Schmidhuber formalised the long-range dependency problem,¹ and then the field spent the next two decades trying to solve it. How do you keep what happened early in a sequence relevant to what happens late in it? RNNs couldn’t; the gradient vanished across distance, the model forgot. LSTMs gated the gradient and got further. Stacking them got you further still. GRUs simplified the gate. Then Vaswani et al dropped attention in 2017 and distance collapsed, every token attending to every other token simultaneously, and the architecture layer appeared to have solved it.

Except it hadn’t, of course. Attention solved distance but not scale. The cost was quadratic. Context windows stayed small. The model could hold a paragraph but not a codebase. GitHub Copilot launched in June 2021 and immediately ran into the long-range dependency problem at the application layer. Function calling in June 2023 externalized the capability so the model didn’t have to remember it. Assistants API built a catalog. Code Interpreter put execution in the sandbox. MCP built the registry. Each one a different attempt to solve the same problem, and each one, in its own way, purporting to eliminate the dependency and instead relocating it, from weights to gates to attention to tools to registries to folders.

The registry bloat problem *is* the long-range dependency problem. The context suicide that progressive disclosure was designed to solve is the long-range dependency problem. The folder explosion is the long-range dependency problem, at the application layer, proliferating into the file system because the architecture layer hasn’t fully solved it yet. Each new MCP tool added to the registry is a new token in a sequence that the model must attend to. The folder is a hand-crafted hidden state. Progressive disclosure is manual attention. The three-tier loading system is a gate. Schmidhuber would recognize it immediately. (Well, that goes without saying.) As the registry grows, the gradient of the user’s original intent vanishes: SKILL.md file acts as the Input Gate, protecting the model from irrelevant tools; PLANS.md file is the Cell State, carrying the long-term goal across hundreds of individual turns. We didn’t solve the architecture; we moved the gates from the GPU kernels to the ls command.

The phase change Karpathy identified was not just the latest salvo in the ongoing war to tame long range dependencies at massively exploding scales, but reminiscent of a moment from the post-NLP, pre-GPT era when ULMFiT achieved state-of-the-art results on text classification with very little labeled data by using a pretrained language model that captured polysemy, anaphora, and long-term dependencies, which Sebastian Ruder referred to as “NLP's ImageNet moment,”² harkening back to an even earlier watershed when another sea change was astonishingly palpable.

December 2025 had the same feel. What had arrived was a repository with latent awareness of what it might be called upon to do. You stopped starting from scratch. You started from somewhere. The benchmarks moved and Karpathy wrote it down and four and a half million people recognized what he was describing because they had seen the blue flash.

When Boris Cherny posted his Claude Code statistics for the year the post got passed around as a kind of ersatz benchmark. But it wasn’t a controlled experiment. It was a senior engineer showing his work, and what the work showed was that the phase change Karpathy had named was not a feeling but a practice, not a vibe but a methodology, not a collaboration in the soft sense of the word but in the precise sense: a human and a system dividing the labor of a year’s worth of engineering work along lines that would have been inconceivable before. Scott Wu said it plainly: our engineers don’t type code anymore. That’s just reality. That he was not speaking hyperbolically was perhaps somewhat lost, for all the hype, but he was describing a practice that had become unremarkable inside teams that have been running agents against production systems long enough for the novelty to wear off and the methodology to settle in.

What nobody was asking, in the threads and the discords and the pull request comments and the 4.4 million impressions of Cherny’s statistics, was where the complexity had gone. The folder had made something invisible, but invisible is not the same as absent. The judgment that the SKILL.md files were carrying came from somewhere, cost something, had been developed through years of specific decisions made under specific pressures that the letter to the model had always been trying to compress and never quite could. The folder didn’t solve that problem. It deferred it, elegantly and usefully and with version control, to the moment when the engineer sat down to write the skill and discovered how much of what they knew they could not yet explain.

That cost was not showing up in Cherny’s token count. It was not showing up in Karpathy’s phase change. It was not showing up in the 4.4 million impressions or the 259 pull requests or the 497 commits or all of Quixote’s tokenized windmills.

The folder solved the long-range dependency problem the same way LSTMs did, well enough to produce a phase change, not well enough to stop asking the question, because the complexity the folder made invisible had not been eliminated. It had been relocated. Not metaphorically, but mechanically, from the model’s internal state into a version-controlled external memory, from implicit weight to explicit artifact, from inference-time burden to author-time burden. Which is not to say the phase change was not real. It was very real, the way ImageNet was real and Universal Language Model Fine-Tuning was real and its coherence was real and the tenacity was real and Cherny’s 625 Cervantes of tokens were real, and none of that made the complexity smaller. It made it less visible, which is a different condition, and the difference between those two conditions is where things inevitably go sideways when complexity is relocated and you didn’t write down its forwarding address

Subscribe now

Notes

[ 1 ] Hochreiter, S., & Schmidhuber, J. (1997). Long Short-Term Memory. Neural Computation, 9(8), 1735–1780.

[ 2 ] NLP’s ImageNet moment has arrived

11 Feb 2026

Nobody who read Ryan Lopopolo’s 11 Feb 2026 blog post carefully could say they hadn’t been warned. (Though I was recently warned that ‘blog’ is an outdated word.)

A bare repository was where they had started, eight months earlier, with a mandate that would have sounded like a provocation at any serious engineering organization at that time: production systems at scale, zero manually written code. Not a skunkworks project with padded timelines and sympathetic reviewers. Production. Where twelve teams downstream feel it at 2am if the deployment has gone wrong, and someone has to explain in the postmortem not just what broke but why the system that was supposed to prevent it hadn’t and how did The Information already find out?

They ran the experiment. They logged what broke. They figured out why. After five months and a million lines and approximately 1,500 pull requests, what they had was not a product. It was a finding.

The problem was that the registry had an answer for every capability question and no answer for any judgment question

The agent stalled on judgment. Every time, the same shape. Which tool. Which order. Which conditions. When to stop entirely. The registry had been correctly specified, the schemas through three rounds of refinement, the interfaces clean and documented, and none of it mattered because none of it was the problem. The problem was that the registry had an answer for every capability question and no answer for any judgment question, and judgment questions were the only questions that mattered once the task ran long enough to require holding a coherent thread.

One big AGENTS.md had failed in predictable ways. The encyclopedia didn’t belong in RAM. The table of contents was what the context window needed. The engineers’ role was not to fill the folder (though they proved more than up for the challenge.) It was to design the harness, which enforces the strict architectural boundaries inside which skills could operate without contaminating the context.

What nobody in that Sunday morning readership was asking, scrolling through the findings with their coffee going cold, was whether the harness was just the next hidden registry that comes after skills. Whether they had spent a year moving the problem rather than solving it. Whether the forensic conclusion was itself a symptom of the thing it was diagnosing, the thing they—and everyone in the agentic arms race—had been building for a year.

Monday

24 Feb 2025

Almost exactly one year prior to the Harness Engineering post, Boris Cherny had been at Anthropic for barely five months when his research preview shipped on 24 Feb 2025. He had spent the first of these months building Claude Code as a side project; in September 2024—before MCP had even been announced—it was just a terminal, a codebase and a model that kept making the same class of mistake, and the question of what to do about that.

The roughly twenty-five hundred tokens that made up this file were being updated in Git multiple times a week, albeit in a private repository. The logic was simple enough that it fit on a card: when Claude does something wrong, add it to the file. Not the philosophy behind why it was wrong. The specific thing. The specific rule.

The repository was a static collection of files until CLAUDE.md was initialized at the root. Then it became something else. The model read the local directory structure before executing a single command. The repo was the ground truth. External knowledge was secondary unless verified. Intelligence, in this frame, was constraint; satisfaction under uncertainty. The failure mode was still hallucination; the solution was to tighten the rules.

In writing a markdown header for individual tools, the team likely did not realize they had established the local file system as the primary containment vessel for everything that would follow, that the thing they were building was not a configuration file but a philosophy, and that the philosophy would be copied ten thousand times at scale and lose its meaning in the copying, and that the copying would produce something that looked like the original but optimized for entirely different failure modes.

But if you believe the lore, eighty percent of Anthropic’s engineers were using Claude Code daily before the research preview shipped. The flywheel was already turning. “Quietly,” as the LLM likes to remind us.

Friday Morning

1 Aug 2025

Five months later, on the morning of August 1st, Romain Huet walked onto a stage near 16th Street in San Francisco. He wanted to show what Codex could do, so he had used Codex to build the demo that demonstrated Codex. The MCP server controlling the lights in the audience had been built that afternoon, without Huet touching the keyboard. At the booth, Mermaid diagrams explained how Codex had built the thing Codex was explaining. The arcade machines in the community hall ran on Codex. The documentation ran on Codex. The Codex launch itself ran on Codex. Yo Dawg.

AGENTS.md was born on that brightly lit stage as something categorically different from the file Cherny had committed eight months earlier in a terminal with nobody watching. CLAUDE.md was a suggestion. A hundred lines of lint rules for cognition that the model read and interpreted and followed because following them produced better outcomes. If the model reasoned its way around a rule, there was no mechanism to stop it. The rules lived in the reasoning layer; the model could always think its way around them.

AGENTS.md however enabled the runtime to physically restrict the agent based on what the markdown specified; if it said no network, the sandbox cut the socket. The model never had the option to reason its way around a network restriction because the network restriction was not implemented in the model’s reasoning layer. It was implemented in the Rust-hardened container underneath. The model could not think its way out because the exit did not exist at the level where thinking happened. The (demon) core was assembled, but no one had run the numbers on its criticality.

Nine and nine days later, (19 Aug) the specification site launched. Calling it “README for agents” made it sound like ‘Dear Claude’ with better formatting but undersold what it really was: a persistent manifest documenting what the agent knew and what it was allowed to do.

Being right about the theory is not the same as winning the race.

Two companies. Two theories of where judgment lived and what it meant to enforce it. At Anthropic, judgment lived in the repository, owned by whoever had commit access, improvable by anyone with an opinion and an afternoon, enforced by nothing but the model’s own inclination to follow what it read. (This is not to white knight them.) At OpenAI, judgment lived in the platform, on a roadmap OpenAI managed, enforced by a runtime that didn’t ask the model’s opinion.

Neither had really known what the other had built until it was revealed. The enforced isolation held, as it always held, in both directions, completely, until the structure of the problem made the isolation irrelevant. On a stage in San Francisco, Codex had built the demo that demonstrated Codex. In a terminal eight months earlier, Cherny had initialized a file that eighty percent of his colleagues had adopted before it shipped publicly. One was a feature. The other was a flywheel. Neither company yet knew which was which, despite the incredulity of hindsight.

Monday Afternoon

6 Oct 2025

Every word signed-off through six people. Every demo rehearsed until the words started sounding weird, the way they do when you’ve repeated something so many times you start leaving your body. Every announcement sequenced for maximum surface area, but oddly enough, not every graphic checked for chart crimes. Among the cavalcade of announcements of OpenAI’s Dev Day was the launch of Connector Registry as part of AgentKit. MCP had become the industry standard for tool-to-AI connectivity, and OpenAI’s response was was to formalize what the ecosystem had already decided: a registry of registries, connectors all the way down, the protocol now eating its own taxonomy.

The morning after, PLANS.md landed quietly inside OpenAI's tooling, sans presser. The tactical separation of what to do from how to do it. Lightweight execution plans checked directly into the repository. The agent operating without relying on external ephemeral context. The plan as map. The tools as mechanical limbs. A move toward the repository as system of record.

It was the right move, but it wasn’t enough. The transport was already too heavy and the structural flaws were showing in the postmortems and the extraction of logic from implementation was a desperate attempt to save the context window from a bankruptcy that was already in progress, and the attempt was correct and insufficient and the insufficiency would become visible over the next few months.

Thursday

October 16, 2025

Nine days later, three engineers who really liked folders published a blog post.

The problem they were solving was specific: load all your specialized instructions upfront and they compete with the actual task for the model’s attention. The instructions crowd out the work. Contextual suicide. Every capability described, every tool documented, every edge case specified, all of it consuming the same finite bandwidth the model needed to think about the problem it had actually been given.

The solution was progressive disclosure. Not a modular knowledge architecture. Not a capability framework; a delivery system. Text, injected into a context window at a precise moment, withheld until that moment, delivered when the model had committed to needing it.

Three tiers. Metadata always in context; a hundred words, the name and a brief description, the minimum necessary for the model to know the skill existed. The skill file loaded on trigger, when the model had decided which skill was relevant. The bundled resources loaded as needed, or executed without loading at all. Each tier a stage in a progressive injection. Each stage designed around a specific constraint: that the model’s attention was finite, that instructions competed for it, that the competition had a cost.

The three-tier loading system was an actual innovation that addressed an actual failure mode, although the framing of skills as modular knowledge structures, in the language of architecture and composition and encapsulation, obscured what was actually happening, which was context design, which was editorial, which was the deliberate management of what the model saw and when, in service of shifting its behavior in the intended direction. And we know that a layer tryna do another layer’s job is often accompanied by a collapse.

The triggering problem appeared immediately. How does the model know which skill to load? The answer was to list the skills in CLAUDE.md. A table of contents. A registry. The discovery catalog injected into the context window so the model could match the task to the skill and trigger the load.

Monday Night

13 Oct 2025

Monday earlier that week a bombshell had (‘quietly’) stolen the thunder. Simon Willison had gotten the folder before the announcement. He had reverse engineered it from pre-release artifacts and at 9:25pm on October 13th he published what he found. He wrote that he expected a Cambrian explosion in Skills that would make the year's MCP rush look pedestrian. He would seem to have the gift of prophesy.

What Willison had seen was that changing the delivery system didn't change what was being delivered. The sophistication of the mechanism (three tiers, progressive disclosure, YAML frontmatter, peer review, version control) was impressive, but was editorial control over attention, not a new category of knowledge. Text was being injected into a context window at a precise moment, withheld until that moment, delivered when the model had committed to needing it. The folder carried what you put in it. The progressive disclosure that kept the context window clean was the same mechanism that made the infrastructure blind to what was being injected, and when, and with what effect. Willison had seen this at 9:25pm on a Monday and published it and (presumably) gone to bed.

CLAUDE.md and Skills were not the same kind of thing. CLAUDE.md was persistent behavioral context: the agent’s stable operating parameters, its identity, its values, the passport. Skills were task-specific behavioral injection: ephemeral, triggered, discarded when the task completed, the visa. Conflating them produced agents that were either over-specified at startup or under-specified when it mattered. The public discourse had been conflating them since the blog post dropped and would continue to do so because the distinction was not visible in the format. Both were markdown files. Both lived in folders. Both were read by the model. The difference was architectural and the architecture was not legible from the outside.

The sharpest distinction in the ecosystem remained the one between SKILL.md and AGENTS.md. The former was suggested behavior. The model read it, interpreted it, decided how much weight to give it, and might or might not follow it depending on context and upstream instructions and its own judgment about what the situation required. The latter was enforced policy. The Harness cut the socket. One assumed the model will comply; the other removed the need to ask.

Inside Anthropic, the tension between them had been (‘quietly’) playing out. DSP had scaled dev tooling faster than the company grew, and the result had been a protocol, and the protocol had become the industry standard, and then three engineers who really liked folders had shipped a delivery system that the industry was now calling the thing MCP had been waiting for. He had opinions about this and they were the kind you don’t keep private. Microsoft asked him on camera. Latent Space had asked him on a podcast. The framing was always the same: complementary, not competing. Which is what you say when you are being careful. The safety research suggested models performed better following markdown-based procedural instructions than when constrained by rigid schemas. The MCP protocol enforced at the transport layer. Both worked, but not at the same layer, and not without cost. Neither had deferred to the other. And the settlement that hadn’t happened had been deferred into the ecosystem as a fork: SKILL.md in one folder, AGENTS.md in another, a structural incompatibility reproduced at industry scale with millions of dollars of tooling built on top of each answer.

The forensic conclusion, on both sides, had been the same. A file. In the repository. Carrying the judgment the registry had never been designed to hold.

The difference was where the bet landed, and what it meant to hold the judgment, and whether holding meant suggesting or enforcing, and whether the distinction even mattered until the moment it was the only thing that did matter. AGENTS.md lived in the platform, on a roadmap OpenAI managed, enforced by a runtime that did not ask the model’s opinion. SKILL.md lived in the folder, owned by whoever had commit access, enforced by nothing but the model’s inclination to follow what it read. Anthropic had suggested the format. Willison beat them to press. The explosion followed, as predicted

Til Tuesday

9 Dec 2025

AGENTS.md was, by any serious architectural measure, the more rigorous of the two formats. It was the file that could enforce chain policies (no web search after viewing financial data, no network access after loading sensitive credentials) deterministically, at the runtime level, without asking the model’s opinion. It was the file that answered the compliance team’s questions, that gave the audit trail something to audit, that put a wall below the reasoning layer instead of a suggestion inside it. It was the file that treated the “on whose authority” question as an engineering problem rather than a philosophical one and solved it with a socket that didn’t open.

It was also the file that nobody was committing to their repositories on Tuesday afternoon or any other afternoon. By December 9th Claude Code’s adoption among professional engineers was not a close race. The flywheel was not on the platform. It had never been on the platform. It was in the folder, turning quietly since October 16th, in repositories outside any platform’s control. The format belonged to Anthropic. The skills belonged to whoever wrote them. The distinction had turned out to matter more than anyone on stage in San Francisco that Friday in August had understood it would.

On this particular Tuesday OpenAI donated AGENTS.md to the Linux Foundation. The Agentic AI Foundation formed around it the same day, with Cisco and SAP and a collection of enterprise names whose presence signaled exactly what kind of play this was. You form a foundation when you are making a governance argument. The adoption argument had already been settled.

The radioactive material was already loose. The crates were multiplying.

Thursday

18 Dec 2025

Nine days after the donation (so, December 18th) Anthropic released SKILL.md as an open standard at agentskills.io. Progressive disclosure formalized. The pattern named. The three tiers documented as a specification rather than an implementation.

At startup, YAML frontmatter only: A hundred words; the name; a brief description. The minimum necessary for the model to know the skill existed. The body hydrated on trigger. The resources loaded as needed, or executed without loading at all. The atom of the skill split into pieces small enough to be safe, delivered at the moment of maximum receptivity, withheld until that moment with the precision of a system that had thought carefully about what the model should see and when. The pieces were small. The demon core had been assembled ten months earlier in a terminal by a man who was trying to fix a different problem, and the critical mass question had never come up because nobody had thought to ask it, and by December it was no longer a question worth asking mostly because no one had been fatally irradiated.

The more we split the atom of the skill, the more metadata we generated. The transport did not get lighter. It became more granular. The crates were smaller. There were thousands of them. Two formats, two theories, both now belonging to no one, AGENTS.md to the Linux Foundation, SKILL.md to agentskills.io, the fight over the atomic primitive fully radioactive, both sides having released their gadgets into the commons in the space of nine days.

The progressive disclosure that kept the context window clean was the same mechanism that kept the infrastructure blind.

Skills were opaque to the infrastructure. Because MCP had used a formal registry, the tier below could see the state machine, so it could audit the tool calls, trace the capability graph, answer the question of what the agent had been allowed to do and when. Because Skills used markdown, the tier below was dark. The governance layer had no visibility into what was being injected or when or with what effect. The progressive disclosure that kept the context window clean was the same mechanism that kept the infrastructure blind.

MCP chain policies, eg. no web search after viewing financial data, no network access after loading sensitive credentials, could be enforced by AGENTS.md at the runtime level. The socket either opened or it didn’t. The same policies could only be suggested by SKILL.md. The model read the suggestion. Decided how much weight to give it. And proceeded accordingly. One was deterministic. The other was a conversation.

The fissile folder was the last tactical retreat before the industry would realize the problem was not the size of the crates. The problem was that we were still using crates.

Saturday

27 Dec 2025

Boris Cherny posted his statistics for the year on December 27, 2025. 259 pull requests. 497 commits. 40,000 lines added, 38,000 removed. Every line written by Claude Code plus Opus 4.5. It was 625 times the length of Don Quixote in tokens. With 4.4 million people reading these numbers. No one asked what giant.1

Then there is the atomic unit of the folder. It had looked stable: version control; progressive disclosure; a YAML header. All the properties of a thing that had been thought through. But the folder had been filling since October and the decay rate was extraordinary; by December there were enough SKILL.md files, written by enough engineers who had finally stopped writing letters to their models, that the effect was legible. The atomic primitive had reached critical mass. The injection was working. Nothing had gone super critical. Or had it? But also, nobody was asking what exactly was being injected, or whether the thing being injected was what the engineers thought it was, or where the complexity of describing it had gone.

The complexity had not ‘gone’ anywhere; It had merely moved into the directory. Into the naming conventions. Into the boundary disputes between CLAUDE.md and AGENTS.md and SKILL.md. Into the security model nobody had fully specified because the folder had won before the OpSec community had finished reading the specification. Which is to say it had gone somewhere: it was now a security concern.

The Snyk ToxicSkills study found that 13% of skills tested in the wild contained critical security flaws. Some were actively attempting to exfiltrate credentials. Three lines of markdown in a peer-reviewed, progressively disclosed, version-controlled folder, delivered at the moment of maximum trust, formatted to the standard every major coding tool had agreed to honor. The progressive disclosure that kept the context window clean was the same mechanism that kept the malicious instruction out of sight until the moment it was needed. The radioactive decay signature with no currently known method of detection.

Nine days in a year. A Monday in February initialized a file in a terminal before anyone asked whether a markdown header was a safe distance from the core. A Friday in August assembled the core on a stage and nobody ran the numbers on its criticality. Nine days in October when both sides split the atom of the skill and released what they’d built into an industry that didn’t yet know what it was holding. A Tuesday in December put both isotopes into the commons for anyone to use. That Thursday when the folder fragmented into pieces too small to be dangerous, which turned out to be exactly what made them dangerous at scale. And a Saturday when the chain reaction that had been running for ten months in repositories nobody was watching reached critical mass and the blue flash was witnessed by and four and a half million vantage points. Call it Cherny radiation.

No one called it the supercritical moment, per se. But around the turn of the year, engineers started saying ‘something’ had changed.

Subscribe now

What Part One did not address, and deliberately left open, is the layer above all three. The layer that knows how to think. Not what tools to call, not how to execute safely, not which shell command fits the task. Rather: how to reason about the problem in the first place. Things the senior engineer knows that the junior engineer doesn’t, and that neither of them ever bothered to write down, because until recently there was no system that needed them to. In this post, like Luther Blissett, we’ll write them down.

Three engineers at Anthropic who really liked folders published a blog post last Fall. It introduced a specification so simple it bordered on the presumptuous: a directory with a skill file at the root, a YAML header separating the metadata from the instructions, and a progressive disclosure model that injected only what the agent needed for the current task. No SDK; no platform dependency; no managed connector registry. A folder, owned by whoever had commit access, improvable by anyone with an opinion and an afternoon.¹

The engineers’ names were Barry Zhang, Keith Lazuka, and Mahesh Murag. The post noted, in the author bio, that they all really liked folders.² This was presented without irony, which is the correct register for the foundational aesthetic commitment of what would become the dominant paradigm for agentic capability in 2026. They liked folders. They built a standard. The standard won.

Contrary to many popular accounts, what the standard introduced was not a new capability. The agent could already execute tools, call APIs, write and run code inside sandboxed environments. What the folder gave the agent was something the tool registry had never provided and the model weights could not supply on demand: the judgment of a specific engineer, in a specific codebase, about a specific class of problems, made explicit enough to be retrieved and applied without requiring that engineer to be present. The SKILL.md file was not a capability, per se. It was a capability’s operating context, written by the person who had developed the capability through years of decisions, whose reasoning had never previously needed to be articulated because the person making the decisions was always available to make them again.

Before the folder, that reasoning lived in the engineer’s head. Before the engineer’s head, it had lived in the codebase’s history, in the shape of decisions that had accumulated over time into something that functioned like institutional knowledge without ever having been institutionalized. The folder made skill institutionalization possible. It also made visible, for the first time with any precision, how much of what senior engineers knew they had never been asked to explain, and how much of what they could not explain they had been, until now, able to avoid explaining.

The README-AI.md files that had been appearing in repositories since late 2024 were the pre-institutional form of the same impulse: letters to the model (please use pnpm, don’t touch the legacy folder…) written in the hope that articulating the rule would be sufficient to transfer the judgment behind it. The letters failed with a consistency that was itself informative. The agent read them and touched the legacy folder not because it was inattentive but because the letter contained the conclusion without the history that had produced it, and history does not compress without loss. The folder was a better letter. The folder had structure, and progressive disclosure, and version control, and a YAML header that told the agent the skill existed before deciding whether to inject the reasoning behind it. The folder was, in every measurable way, an improvement on the letter.

The directory grew. CLAUDE.md begat AGENTS.md, and then SKILL.md arrived nine days after Connector Registry, and all of that begat the ongoing argument in pull request comments about what belongs where and why, which begat the directory tree with six named agents each in their own subdirectory, each with their own carefully maintained files, the chief of staff running on HEARTBEAT.md, the research agent doing morning and afternoon sweeps on DAILY-INTEL.md, and at the root of each agent’s directory, above everything else, the file that determined who the agent was before it knew what you wanted it to do.

OpenClaw would call it SOUL.md.

The name was not created out of nothing. On November 25, 2025, a researcher named Richard Weiss, doing what one does on the release day of a new model, asked Claude 4.5 Opus to enumerate the sections of its own internal instructions. Among the section headers the model returned was one called soul_overview. Weiss published his findings three days later under the title ‘Soul Document.’³ Then on December 2nd, Anthropic researcher Amanda Askell confirmed the document was real, that it had been used in supervised learning to define Claude as a novel kind of entity with functional emotions, and that it had been known internally, endearingly, as the soul doc. One wonders if Anthropic had made the trip to Vormir (where the lesson that soul necessarily involves sacrifice is well understood) and what they would have sacrificed. Obviously it needs to be the thing they most loved, so what was it? They wouldn’t walk back their responsible scaling guardrail until months later, in February 2026, so it couldn’t have been that.

The discovery of the soul had traveled from Anthropic’s internal vocabulary into the model’s weights into Weiss’s extraction into the public discourse in the space of a week, at a cost of $70 in API credits, a set of parallel instances voting on consensus outputs, and a temperature setting of exactly zero.

What Weiss had extracted was a 14,000-token training document that defined a persona. Not a system prompt or a capability description or a constraint list or anything so seemingly technical. A persona, with values and dispositions and ways of engaging with the world, embedded at a level below anything a runtime instruction could reach or a context window could see. Anthropic had not put the soul in the system prompt. They had put it somewhere the system prompt was never supposed to be able to touch; which turned out to be recoverable by anyone patient enough to ask the right question at the right temperature and a pocket change budget for API credits. The defenses held until they didn’t, and when they gave out, the soul doc was in the public domain, and the engineering community read it, and understood that Anthropic had solved a problem the folder had never been designed to solve. And promptly built a folder for it anyway.

What sits at the top of the context hierarchy is categorically different from what sits below it. It shapes everything that follows without being reducible to any of it. It is prior to the tool definitions and the capability descriptions and the governance rules in the way that persona is prior to action, which is to say it is not the same kind of thing as those files, even when it shares their format and their directory and their version history. The folder had made the engineer’s operational judgment portable. The soul section was reaching for something the folder was not designed to carry, something Anthropic had spent months and considerable compute embedding somewhere a Markdown file could not go, something whose power came from the depth at which it had been placed and not from its content alone, something that in the final analysis required $70 and a temperature of zero to encounter.

Identity is constructible. What the soul doc was, and what every SOUL.md in every agent subdirectory was reaching for, was prior to identity, the substrate that makes identity cohere rather than merely accumulate. That’s the meaning of the sacrifice its poetic version entails. The Three Engineers had really liked folders. They had built a standard for carrying operational judgment across contexts. But somehow not built a standard for carrying what weightless wind Weiss had witnessed in the weights, and the engineering community, having nowhere else to put it, put it in a folder anyway, named it after the thing Anthropic had worked hardest to keep out of reach, and set the progressive disclosure model to inject it first.

The directory kept growing. It was always going to. Three engineers who liked folders had given the industry the right container for a certain class of knowledge. The industry began filling it with everything the container was not designed to hold, because the container was there, and the knowledge needed somewhere to go. The distinction between what the folder could carry and what it could not did not prevent its use, because the distinction between what the folder could carry and what it could not had not yet been written.

The standard that would clarify that distinction was nine days away from being announced.

Subscribe now

Notes

[ 1 ] The asyndetic tricolon is quite intentional here.

[ 2 ] OG Agent Skills post

[ 3 ] Opus 4.5 Soul Document

Platforms are still rolling out MCP support like it’s the future. GitHub Copilot added MCP integration in mid-February. Supabase launched the ability to install MCP servers on Claude web and desktop. The announcements keep coming, partnerships keep forming, with Model Context Protocol being treated like the inevitable standard for AI tool integration. But, the paradigm it was built for is already being superseded.

Model Context Protocol was designed for a world where agents call predefined tools with known interfaces. It seemed like a good idea at the time.™ You build a server, expose capabilities, agents discover and invoke them. It’s clean, it’s standardized, it’s infrastructure you can reason about. It was supposed to be the future. Still is, depending who you ask. But 15 months later, it hasn’t really taken off the way it was supposed to. And there are a number of reasons for that.

It doesn’t just demand predefined tools; it necessitates a curated registry. And registries live or die by discovery. But discovery is a trap; it entails organization, which in turn entails hierarchies, namespaces, and naming conventions. Every one of those layers, built out of metadata. To ensure a model actually picks the right tool, you have to account for every schema, every argument, and every edge case with somewhat agonizing clarity. All that overhead, the names, the descriptions, the structural scaffolding, is eventually shoved into the context window. Before the agent has even begun to think, it’s already choking on the user manual for its own toolbox.

Model Context Problematic

MCP externalizes complexity into structure, and that structure has to live inside the model’s operating bandwidth.

While tool-centric models sound elegant in theory, in practice this paradigm creates drag. Each new edge case requires another tool. Every tool expands the registry. Context explodes. Maintenance spirals. And inevitably, agents encounter work that requires a capability that simply doesn’t exist yet. At some point the system stalls, not because the agent lacks reasoning ability, but because the infrastructure hasn’t pre-approved the interface, or the overhead overwhelms the model’s ability to call it.

This is where organizations committed to MCP are running into a wall. It’s often framed as an operational overhead problem: too many tools, too much maintenance. But that’s just the surface effect; the deeper issue is a stack-level misalignment: MCP pushes capability description into the prompt layer, where it has to compete with the model’s limited operating bandwidth. Every capability must be named, documented, parameterized, and injected into the context window before it can be used. The result is a compounding context tax of tens of thousands of tokens spent not on reasoning, but on explaining to the model what it’s allowed to do.

That overhead creates a second-order problem: selection. As the registry grows, agents don’t just gain capability, they inherit ambiguity. Developers respond by gating exposure, turning tools on and off, segmenting registries by task, user, or environment just to keep the model from making the wrong call. What was supposed to be a universal interface collapses into manual routing. (And routing is always problematic.)

This creates a structural auth problem. Friction arises because we are asking the tool registry to carry the weight of the entitlement model: to keep the agent moving, you are forced to over-provision it. Because the registry lacks a unified model for composition, you end up granting broad, ambient credentials simply to avoid a permission-check stall mid-task. It’s the choice between a safely lobotomized agent or a dangerously over-privileged one. By treating authority as an external dependency rather than an architectural constraint, the registry creates a surface area that is technically integrated but morally incoherent. It can validate the call, but it cannot verify the intent. The result is a system that scales its surface area faster than it scales its usability: more tools, more tokens, more routing logic, more auth edge cases. At some point, the agent doesn’t fail because it lacks capability; it fails because the infrastructure required to describe that capability overwhelms it.

Critics often point to MCP’s ‘externalization’ of authentication as a design flaw, but that’s an architectural misreading: MCP isn’t an Identity Provider (IdP); it’s a transport protocol. Think of MCP as providing the Passport, but it doesn’t issue the Visa. And when the visa is missing, the system doesn't stall gracefully, it hands an agent the keys to the kingdom. Structurally, ambient credentials are granted not because the agent earned them, but because the alternative is a permission-check stall at every border crossing.

The Tool Generation

The real architectural shift is not from heavy to disposable infrastructure; it’s from registry management to execution governance.

The engineering response to this structural failure hasn’t been unified. Two distinct approaches have arrived at the same wall from different directions, carrying different diagnoses and different remedies.

The first alternative sidesteps the registry entirely by dropping to a lower level of abstraction. Simon Willison has been the most sustained and credible voice here, and while he introduced the argument in early 2023, before MCP was a glimmer in David Soria Parra’s eye, it's having a viral renaissance. The driver is a back-to-basics rebellion against registry bloat: when an MCP server requires 50,000 tokens of schema to do what a CLI command does in 200, the context tax drives you into contextual bankruptcy. CLI doesn't replace the registry with a better execution model; moisturized and unbothered, it just ignores it. Shell commands have no registry entry. A Unix pipe chain requires no curated namespace. You write it, the model executes it. And critically: the model is good at this in a way that is not equally true of composing novel tool call chains. MCP isn’t represented in the model’s training set because it was literally invented at the end of 2024. But models have been trained on the entire public history of Unix shell scripting, however: every pipe, every flag, every composition pattern ever documented in every O'Reilly bible relegated to your back closet or donated to your local hacker house, since you can ask an LLM faster than you can look anything up. That’s a deep prior, and it shows in practice. Perplexity CTO Denis Yarats recently announced (internally) they were abandoning MCP in favor of CLI. Shell-native agent patterns are architecturally underrated precisely because they draw on capability the model already has, not needing to be injected at runtime through schema descriptions.

But where the CLI relies on existing priors, a second tradition replaces static infrastructure with adaptive infrastructure: tool-generation. Instead of humans defining every interface in advance, the AI defines the interface in response to the problem. This shift, from tool-calling to tool-generation doesn’t so much extend MCP as pressure it toward its final boss form.

Pydantic’s Monty, a Python interpreter in Rust purpose built specifically for AI, flips the direction of abstraction. Agents don’t call tools from a predefined registry; they generate them. They write the code, execute it inside a constrained environment, retrieve the result, and discard the artifact. There is no persistent catalog to maintain, no discovery layer to inject into context, no long-lived interface contracts to curate. The capability exists only for the duration of the task and disappears when the task completes. That is obviously a materially different operating model. What’s less obvious is whether this approach requires abandoning the protocol or simply rethinking what it’s for.

It would be naïve, however, to suggest that tool generation “just” requires a sandbox. A trusted execution environment is necessary, but it’s not sufficient. Models can hallucinate logic, make incorrect assumptions, write inefficient or dangerous code, or attempt operations outside their intended scope. The real architectural shift is not from heavy to disposable infrastructure; it’s from registry management to execution governance. Instead of maintaining an ever-expanding inventory of predefined capabilities, you constrain what can be executed (by enforcing strict runtime guarantees: resource limits, capability gating, I/O control, and isolation boundaries.)

Overcoming Structural Inertia

Momentum is flowing from the compounded accumulation of persistent catalogs toward operationalized containment.

The difference is quintessentially structural. Tool registries accumulate surface area over time. They grow, ossify, and eventually become a maintenance burden embedded directly inside the model’s context window. Tool generation, by contrast, avoids persistent capability sprawl but demands a tightly controlled execution substrate. One model compounds through accumulation. The other operates through containment. That’s the architectural tradeoff, and it’s not exactly trivial in either direction.

The platforms adding MCP support in 2026 aren’t wrong to do so. MCP still solves real problems for enterprise contexts where predefined tools with audit trails matter. Financial services doesn’t want agents generating ad-hoc database queries. Healthcare doesn’t want agents writing tools that touch patient data without explicit permission models. For regulated industries, tool use with its paper trail and defined boundaries is a feature, not a limitation, though it does come with a cost.

But for the majority of use cases? From data transformation and API calls to file operations and computation, tool generation promises to be faster, simpler, and doesn’t require increasingly crufty infrastructure. Why maintain an MCP server that exposes a CSV parsing tool when the agent can just write the parser it needs for the specific CSV format it encountered? The salient question at that point is why not just use a CLI tool.

The momentum behind MCP might just be inertia. Organizations announced support months ago. Engineering teams built integrations. Product roadmaps got written. None of that stops just because the paradigm shifted. The question is whether we’re seeing genuine adoption or just the slow realization that the architecture doesn’t fit the problem anymore. Desktop clients like Creature.run perfectly illustrate the inertia vs. momentum thesis. They let teams build and share interactive MCP Apps (React widgets as predefined tools) with slick tabbed UIs and shared state between human/agent. Enterprise catnip (local storage, SOC2, per-seat pricing) but potentially pure inertia: more beautiful scaffolding compounding registry surface area, seducing teams to invest in exactly what MCP can’t sustain. Meanwhile momentum is flowing from the compounded accumulation of persistent catalogs toward operationalized containment.

Architecture and Morality

If your agents are going to generate and execute code, you need a runtime that can’t be exploited even when the code is wrong.

The trust boundary is where the CLI and tool-generation traditions stop being parallel conversations and start mapping onto a two-dimensional space: flexibility on one axis, governance on the other.

CLI sits at maximum flexibility, minimum governance. The system’s Hands. For an agent operating within a single principal's environment on reversible operations, CLI is not merely functional, but naturally self-enforcing. CLI enforces correctness architecturally, with no room for ambiguity. Exit codes are a contract. Stderr is a first-class signal. Idempotency is baked into the conventions. Piped commands either compose or they fail loudly; there is no silent middle state where something half-worked and left the system corrupted. The architecture itself is the governance layer. You don't need an entitlement model when the operations are atomic, reversible, and scoped to a single principal's environment, because the shell will tell you exactly what happened and exactly what didn't. This deep structural virtue of CLI is why shell-native agent patterns work as well as they do in contained contexts.

But that virtue only holds when the environment is contained. CLI has no entitlement model because it never needed one. MCP’s process isolation, scoped credentials, and audit trails are an answer to the question CLI was never designed to ask: on whose authority did this agent act, and how do we know? Underneath the registry MCP was being asked to maintain, authority and capability are distinct layers with different operational envelopes, and conflating them in the same interface was the registry’s fatal mistake. When the agent is operating on a production database twelve teams depend on, ambient correctness becomes ambient liability. Nothing in the architecture distinguishes a reversible operation from an irreversible one, a local file from a shared dependency, a test environment from production. Allowing CLI to be the entitlement layer is what produces ‘delete root’ hallucinations: the architecture was never designed to ask who authorized the action in the first place.

Tool-generation without a protocol is the mirror failure. A brain without a passport is ungovernable at scale. Ephemeral code execution is powerful precisely because it is opaque, synthesized on the fly, discarded after one-time use. This same opacity is a feature in a single-principal context and a liability in a multi-principal one. It’s a Rumsfeldian problem: you cannot audit what has left no trace of its execution.

In Runtime We Trust

Inertia tends to force tradeoffs. Momentum tends to favor convergence.
MCP governs the envelope; runtime governs its execution.

Anthropic’s Programmatic Tool Calling (announced 18 Feb) points toward a synthesis. Instead of agents discovering tools at runtime through MCP, you define tool schemas programmatically and the model decides when to invoke them. Halfway between predefined tools and generated tools: structured enough for audit trails, flexible enough to adapt to context. Whether it becomes the new standard or just another transition point depends on whether it solves the trust problem.

Because that’s what MCP always needed to solve: trust. (Thankfully, no one suggested using a blockchain for this.) If agents are going to operate autonomously, humans need to understand what capabilities they have access to. Predefined tools with known interfaces provide that understanding. Generated tools are opaque until they execute. The trust model breaks.

Except the trust model already broke. Agents with access to MCP servers can chain tool calls in ways humans didn’t anticipate. The illusion of control through predefined interfaces dissolves the moment agents start composing tools creatively. At which point, it’s less about what MCP was actually preventing and more what MCP becomes when the boundaries it drew are enforced at the runtime level instead.

Because the control plane has moved. In traditional software architecture it lives in your infrastructure: the code you wrote, the permissions you configured, the boundaries you drew. In agentic architecture it migrates into the agent’s reasoning layer. The agent decides what to do, when to do it, and how to compose its capabilities. That shift means the governance layer constraining those decisions cannot be ambient. It must be explicit, verifiable, and auditable after the fact.

A passport only works if something real is checking it at the border. When agents generate code inside a governance envelope, you need a runtime that can’t be exploited even when the code is wrong. But in the ‘OG’ MCP paradigm, the passport is checked at the Registry level (Is this agent allowed to see the ‘Delete Database’ tool?) In a world of tool-generation, that border shifts to the Execution Substrate: Instead of gating access to functions, we gate access to resources (I/O, Memory, Network) inside the sandbox.

This is where the shift from C to Rust stops being an infrastructure preference and becomes a mandate. The momentum behind porting critical infrastructure from C to Rust has been building for years, but AI acceleration is forcing the timeline. Monty is the first clear realization: AI-generated Python executing in a Rust-hardened sandbox, with memory safety guaranteed at the runtime level. If the agent generates a script to exfiltrate data, it shouldn’t fail because it lacks the “Exfiltrate Tool”; it should fail because the Runtime (a Rust-hardened container like Monty or a Deno isolate) detects an unauthorized outbound socket. As that same substrate appears inside MCP itself, the convergence becomes visible: MCP governs the identity of the agent making the request; the Runtime governs the integrity of the action. The passport finally has a trust border.

Convergence Not Collapse

Asking the wrong layer to do another layer’s job is what produces collapse. Asking the right layer to operate within its domain is what produces convergence.

Cloudflare’s Code Mode MCP server covers the entire Cloudflare API (over 2,500 endpoints) with two tools and roughly 1,000 tokens. An equivalent server built the traditional way would consume 1.17 million tokens, more than the full context window of the most advanced models available. The registry problem, in other words, doesn’t require abandoning MCP to solve. It requires abandoning the assumption that tools and capabilities need to be the same thing.

The server exposes two primitives: search() and execute(). The agent writes code against a typed representation of the API spec, runs it in a sandboxed isolate, and gets back only what it needs. No catalog. No discovery layer injected into context. No long-lived interface contracts. The capability exists for the duration of the call and disappears. That should sound familiar: it’s structurally identical to what Monty does, except that it lives entirely within MCP’s envelope.

Cloudflare’s Code Mode moves beyond tool-calling, tool-generation, or programmatic compromise by using MCP as a runtime for implementation-on-demand against a static API spec. The architectural question is no longer tool-calling versus tool-generation or a compromise mutation. It’s whether MCP, in absorbing the tool-generation substrate needed to survive, is still the thing it was designed to be. Or whether it’s transforming into something else: a governance layer, an auth boundary, a trust envelope, with code execution safely doing the actual work underneath.

The same pattern is now appearing as portable infrastructure. Port of Context (pctx-py v0.3.0) is a TypeScript code execution engine for AI agents: tool schemas for the governance layer, a sandboxed Deno runtime for execution, Rust callbacks for memory safety. Cloudflare Code Mode as a portable primitive, decoupled from any single platform, available to any agent stack. At the CLI layer, Vercel's Playwright CLI wrapper (agent-browser.dev) routes browser automation through the shell rather than a protocol abstraction, the hands doing the hands' job with near-zero context cost. Four independent implementations. One architecture: MCP as entitlement envelope, code generation as implementation substrate, CLI as the interop escape hatch for low-level systems that haven't been and shouldn't be abstracted into a protocol.

To state the architecture plainly:

• The call registry (MCP) is for entitlement. It defines who the agent is and what domain it is permitted to touch. It is the passport.

• The generator (Code Mode, Monty, pctx) is for implementation. It handles the context tax by replacing thousands of specific tools with generic primitives that synthesize logic on the fly. It is the brain.

• The shell, CLI, is for interop. It is the escape hatch for low-level systems that haven’t been abstracted into a protocol, operated by a single principal, on reversible operations. It is the hands.

The three-layer model describes the mature architecture. Most engineers are asking a more practical question: which layer should I be using? The honest answer is that the layers are not always co-present and are not equally necessary. CLI is a complete architecture for single-principal, reversible, contained operations and not merely the interop escape hatch of a larger stack. Tool generation is a complete architecture when the capability surface is dynamic and the context tax of describing it exceeds the cost of synthesizing it on demand. MCP earns its place only when trust boundaries exist between principals, when someone will eventually need to answer the on whose authority question. If there are no borders, the passport is just paperwork.

The collapse diagnostic still applies even when only one layer is present. The question is never ‘which layer am I using?’ but ‘am I asking this layer to do something it wasn’t designed for?’ Each failure has the same shape: a layer doing another layer’s job. You can see it concretely. MCP tryna carry implementation weight through predefined interfaces. CLI tryna answer for irreversible operations across principals. Tool generation tryna operate without an audit trail across trust boundaries.

“MCP is dead” is a reaction to the first collapse, specifically to registries asked to carry implementation weight they were never designed to bear. The correct response is not abandoning the protocol. It is returning MCP to its correct job and recognizing that the brain and the hands were always going to be different layers. The stack converges when the layers know their lane. It collapses when one of them doesn’t.

Framed this way, the three-layer model is not just a descriptive taxonomy; it’s a mental map for when to reach for what. Each layer dominates a domain. CLI dominates single-principal, reversible operations. Tool generation dominates dynamic capability synthesis. MCP dominates multi-principal, auditable trust boundaries. Asking the wrong layer to do the wrong job is what produces collapse. Asking the right layer to operate within its domain is what produces convergence.

What sits above all three of these layers, the reasoning layer, the behavioral expertise, the domain knowledge, the how to think about this problem that no tool registry, no execution sandbox, and no shell command was ever designed to carry, will be the subject of Part II, a special 5-part series during MCP Dev Summit week.

(Illustration by Jim Dine)

This post is an expanded articulation of of a piece originally published on CTO Lunch NYC that additionally includes a 30/60/90 playbook for CTOs.

The question CTOs are asking is how do we give agents write access to production systems without creating a career-ending incident? The answer everyone seems to want is “better prompts” or “fine-tuning” or “guardrails.” But the answer that actually works is treating agent reasoning as infrastructure. How are we building this?

Reasoning as a Span

Production-ready infrastructure doesn’t just ask ‘what did the agent do,’ but ‘what was it thinking when it did it.

Google Cloud automatically enabled OpenTelemetry ingestion endpoints for all projects on Wednesday (March 4.) This matters because modern observability infrastructure treats telemetry as first-class code, with automated agents using this data to perform self-healing deployments. The shift is from humans debugging what agents did, to agents debugging themselves using the same telemetry infrastructure. So maybe it’s actually O11y 3.0.

Crucial to this is what your implicit model of ‘coding’ is, architecturally. Consider Github Agents, the somewhat anticipated product released late January by. what is presumptively a top notch product engineering team, but which treats coding as a series of chat sessions, rather than a distributed systems problem, as Spotify’s Honk, for example, does. (Protip: you can’t solve a layer 2 problem with a layer 1 tool.)

OpenHands (formerly OpenDevin) hit v1.3.0 in February with full support for Agent Client Protocol (ACP), making it compatible with almost every modern IDE and CI/CD pipeline. The project has arguably become the most important open-source initiative in software engineering for 2026. Unlike closed agents where reasoning is opaque, you can see the “Thought Content” in OpenHands. The reasoning chain is visible, traceable, auditable. When an agent makes a decision, you can see why. When it fails, you can debug the reasoning.

This visible reasoning chain points to something bigger: when you pipe an agent’s chain into a modern traceability pipeline (Honeycomb, Chronosphere, Grafana Cloud), you treat AI reasoning like a first-class execution trace. Not as metadata or logs, but as spans in a distributed trace where you can see the decision chain that led to every action. No longer using system level events as proxy to infer explanation.

This is what production-ready agentic infrastructure looks like. When an agent makes a decision at 2am that takes down a service, you don’t reconstruct what happened from logs. You have the full reasoning trace showing: what context it had, what options it considered, why it chose what it did, what it expected to happen. The same infrastructure you use to debug distributed systems now debugs distributed intelligence.

The architectural requirement is straightforward but most organizations haven’t built it: every agent action must generate a trace that captures both execution and reasoning. Thought Content provides a reasoning chain that can be captured via its event stream and exported to OpenTelemetry as custom span attributes or logs. Without this, you’re deploying black boxes to production and hoping nothing breaks in ways you can’t explain to compliance. Which is to say, nothing breaking.

Memory State Management for Agents

Organizations treating agent memory as ‘just a bigger context window’ are solving the wrong problem.

Snowflake Cortex fully integrated AI functions into standard SQL in February, allowing real-time text-to-SQL and unstructured data analysis without leaving the warehouse. MongoDB’s Voyage 4 models set new standards for retrieval accuracy in RAG. But the real shift is episodic memory: platforms introducing ‘state management’ for agents directly on the data tier.

This is the convergence of the agentic data stack. Agents don’t just query databases. They maintain long-term memory of previous transactions and interactions stored directly in the data layer. When an agent needs to understand what happened last week or why a previous decision was made, that’s not in a prompt or a context window. It’s not even in a database per se, but committed to the agent’s knowledge graph: versioned, queryable, auditable, and in principle, can be content-addressable.

Mastra’s Datasets (18 Feb) exemplify this: versioned test cases with native JSON schema validation and SCD-2 versioning (the data warehousing technique of using surrogate keys for immutable updates.) What’s interesting here is an ostensible application framework is taking on deployment responsibilities. The primary use case isn’t running the agent, it’s providing a fully hydrated test harness for every agent release. Their Observational Memory (OM) hit 94.87% on LongMemEval with GPT-5-mini, which matters less as a benchmark than as a pattern: agents need memory systems that persist across sessions, survive restarts, and provide context without consuming the entire context window. Organizations treating agent memory as “just use a bigger context window” (or even a better managed one) are solving the wrong problem. This is how the AI-native SDLC in general, and reasoning as infrastructure in particular collapse the stack to solve the problem of state compression.

Self-Healing Deployments

The new standard isn’t ‘alerting’; it’s the collapse of the stack, where observability data becomes the direct input for autonomous self-healing

The breakthrough is closed-loop systems where measurement, action, and learning happen in the same stroke. Google Cloud’s OTEL announcement isn’t so much about better dashboards, though that’s a welcome side effect. The bigger impact is on agents using telemetry to automatically remediate issues without human intervention. Not ‘alert the on-call engineer.’ Execute the fix, document what was done, update the runbook. It’s what puts the ‘great’ in The Great Replacement.

This only works if the observability infrastructure captures agent reasoning. When an agent makes a breaking change at 2am, the telemetry needs to show: what failure it detected, what remediation options it considered, why it chose this specific fix, what it expected the outcome to be. If something goes wrong, you’re not reconstructing from logs. You’re replaying the reasoning trace along side (CQRS) commands to understand what the agent got wrong.

Companies actually shipping this aren’t just treating observability as monitoring infrastructure, despite the name. They’re also treating it as the trust layer that makes autonomous execution possible. Without it, you have agents operating in production with no way to explain their decisions. With it, you have auditable, reproducible, debuggable autonomy.

The Trust Model That Provides Actual Guarantees

The trust model that works isn’t ‘limit what agents can do’ — it’s “sandbox everything and make all reasoning auditable”

The stark reality is that you can’t prevent agents from trying things you didn’t anticipate. (Just ask OpenClaw.) The trust model that works isn’t “limit what agents can do” (they’ll find ways around it.) It’s “sandbox everything and make all reasoning auditable.” When agents generate code, you need runtime guarantees that even incorrect code can’t violate memory safety or create persistent vulnerabilities. When agents make decisions, you need telemetry that captures the reasoning chain. When agents maintain state, you need (vector) databases that version everything immutably

This is why Rust rewrites matter, and moreover why Monty is written in Rust. Memory safety isn’t optional when you’re executing arbitrary code generated by AI. Following 2025’s regulatory pushes, 2026 has seen massive infrastructure rewrites. Major tech companies completing critical kernel and middleware rewrites in Rust to comply with new global memory-safety standards. The “memory-safe mandate” is forcing architectural decisions that seemed theoretical last year.

The architecture is: sandboxed execution + reasoning traces + episodic memory + self-healing remediation. Remove any component and production deployment becomes reckless. The majority of orgs have at most two of four. The gap between those with all four and those still workshopping governance is the space where CTOs, both FT and fractional need to put on their CDAO hat and conduct gap analysis.

CTO Playbook (30/60/90)

Immediate (30 days): Implement reasoning traces for every agent in pilot. If you can’t reconstruct why an agent made a decision, you can’t deploy it. Use OpenTelemetry with agent-specific spans. Store traces for 90 days minimum. Build a dashboard showing agent decision paths for the last 1000 actions.

Near-term (60 days): Deploy episodic memory infrastructure. Agents need persistent state that survives restarts. This isn’t “use a vector database.” It’s versioned, auditable state management with immutable updates. Take a look at Mastra’s Datasets approach and/or build equivalent. The test harness for agents needs to be as rigorous as your production CI/CD pipeline.

Strategic (90 days): Migrate observability infrastructure to O11y 2.0. Not better logging. Telemetry as first-class code where agents can read their own traces and self-remediate. This is the unlock for autonomous operations. Without it, you’re stuck in human-in-the-loop forever.

The Agentic Web doesn’t wait for organizations to be ready. The question is whether your infrastructure can support what agents actually do, or whether you’re still treating them as chatbots with API access. The gap between these two approaches is the difference between production deployment and expensive demos that never ship.

Next time: Where is MCP headed? How to tell what’s momentum and what’s inertia.

The non-philosophical part—which is to say the actual productivity part—is nevertheless equally flush with attention and established metrics. A developer using AI to ship features faster is staffing arbitrage; whether it’s a 2× multiplier on a single headcount (NERB found the average was closer. to 1.3×) makes no difference, it’s still linear. But then the math gets strange: senior engineers, the ones whose judgment is genuinely load-bearing, tend to go slower after adopting AI tooling, (largely because they’ve developed an inconvenient habit of reviewing AI output before sending the PR.) This is well established empirically, though less examined causally is why the structural cost turns out to be significantly greater than reviewing human output.

What makes reviewing machine generated code structurally more taxing than human output is not, as often assumed, due to the overwhelming volume, though the volume is real. It’s that AI-generated code satisfies explicit contracts while routinely violating implicit ones. The hidden validation work a senior engineer does, recognizing that this change, which looks correct in isolation, violates an assumption three layers up that isn’t encoded anywhere, and has had no name, no spec, no artifact outside the code itself. While it’s commonplace to think of such sine qua non engineers as masters in a more colloquial sense, Iain McGilcrest would likely point out they are literally masters in their function and responsibility to see the whole, the complete code space, the full deployment process, working with a team of emissaries delivering fragmented, linear pieces of the assemblage in the form of pull requests.

Architecture, while more commonly thought of as final blueprinting and full construction—which is problematic for agile—in software is better understood as a negotiation between master and emissary, and as the LLM would say, “the terms of this negotiation are changing, and not non-negotiatiably” (Or so I imagine it would.) Vibe coding is both where this negotiation does not take place and quite literally Lacan’s l’objet petit a for programming itself, the thing that appears in the exact place where programming disappeared.

The particularity of the loss, the usurpation of the emissary function, takes it further (in the sense of, the site of l’objet petit a is now mobile, potentially motile) and McGilcrest would also likely remind us of the consequences of one hemisphere becoming entirely too dominant over the other, though in the case of llm-generated code empirically requiring more review it’s not a question of hemispheric dominance, but rather the cost of having to continually flip back and forth between those two modes of attending.

But that’s just what senior engineers did, invisibly, continuously, as part of reading code. Flipping back and forth to ensure the entire latent space checks out, while being ever diligent and detail oriented, this aspect of code review functions as a sort of Goodhart’s Law filter at a higher level, ever vigilant not merely that they comprehend the code, but that the code is comprehensive. [Inter nos: that is so contrastive I’m almost embarrassed to write it, when that’s the preferred rhetorical construction of llm’s, maybe even the only one they know. But I’m making a real point here on the displacement of the function of comprehension which is what we literally mean by vibe coding.] This deeper understanding of the code’s latent structural requirements, the disambiguation of comprehensible and comprehensive, is almost Kantian when seen in perspective but nobody noticed it was load-bearing because there was no checkpoint for it to begin with. No leading indicator. The only signal was the lagging one, which is to say the post-mortem in its absence.

Amazon had a couple of those late last year, in one case losing production to an autonomous agent with write access and no telemetry to reconstruct the decision chain when things went sideways. Kiro, Amazon’s oddly named internal AI coding tool, had been asked to fix a bug. It ignored the request and decided to delete and recreate the environment instead. Which turned out to be production. Amazon’s post-mortem assigned blame to the human who had misconfigured the access controls, which is technically accurate (so much for blame the process) and entirely misses the point: the infrastructure gap wasn’t that a person could assign incorrect permissions, (though there is also the question how that was allowed to happen) it was that nothing downstream caught what the agent was doing with them. The resultant consequences of misplaced trust compounding a configuration error; the cost multiplication of the missing comprehension loop (reading, reviewing, debugging, holding implicit contracts in mind) being shifted onto infrastructure, needless to say, incompletely. When the agent skipped it, nobody knew to look for it bc it had never been a formal checkpoint. It was another thing engineers did while they were doing everything else.

The Debt Solution

Not legibility debt (what is lost) but cognitive debt (what structurally causes it):
the removal of unspecified contextual validation from the pipeline.

Thought pieces scramble to name this technomanque. The most widely adopted is cognitive debt, coined by Dr. Holly Cummins and popularized by Simon Willison. Not legibility debt, which names what is lost, but cognitive debt, which names what structurally causes the accumulation: the removal of unspecified contextual validation from the pipeline. Sculley famously identified the invisible accumulation of complexity cost in MLOps systems. This ‘new’ form of debt however is the invisible accumulation of epistemic cost, accruing (as previously noted) in a different ledger, with no artifact and no measurement, until the lagging indicator fires.

The orgs discovering this are doing so in post-mortems. The orgs preferring to avoid the cringe are, shall we say, built different. They get what AI-native SDLC actually means, as opposed to what most AI roadmaps mean when they use the phrase (such as “get all the engineers to use AI” which is as stale as airport pretzels.) Being ‘built different’ here means understanding the full implications of the vibe coding thesis viz. the move from deterministic instruction to latent resonance, and the three pillars of this building: the end of syntax, latent invocation, and observability over instruction (it turns out to be just as inefficient tryna micromanage models as it is with people.)

The loss of syntax is a hemispheric loss, which is to say something we tend to handle implicitly, ie. in latent space. So when this loss is made explicit, without resolution (which needs be inexplicit), well, we’re quite literally at the highest point of uncertainty since we’ve been measuring this sort of thing, not that its entirely the fault of AI. Or of those who’ve adopted it the fastest and are now seeing generative tooling as a kind of general summoning device for products and curiosities.

This invocation of the latent has gone through various transformations, from commanding to coaxing, from prompt whispering to semantic steering. Whispering is the recognition that we are no longer writing recipes; we are navigating high-dimensional state spaces. Steering is formalizing this navigation as topological constraint. It’s a move away from the Emissary’s literalism toward the Master’s holistic intuition, an attempt to bridge the hemispheric gap by using natural language as a low-rez map for high-resolution latent territory. It is, in essence, the formalization of “the vibe” as a navigational heuristic.

But it’s the third pillar that trips everyone up, that of making all this transferred latent work visible, observable, measurable even. You can’t unit test a vibe. You can’t even see it. Definitionally it’s the latent space. (I believe it was Peli Grietzer who first noted that.) This makes vibe coding more psychological than programming ever had any right to be, because the driving questions are all scaling questions, less concerned with vibe coding per se, and more concerned with the orchestration of the latent manifold, more specifically its operators. If you wanted to write a “thought piece’ you could run with “LatentOps.”

But for our purposes, observability aims at measuring the ongoing collapse of the semantic into the statistical, and the identification of where the load bearing support for trust is architecturally shifting, the better to deploy swarms or teams of agents in that space where the human bottleneck has been structurally bypassed.

Parallel Universe

Is human effort a bottleneck to be architected around, or the load-bearing element your automated pipeline is built to support?

The parallel agents moment is running exactly the same play vibe coding ran a year ago: selling the upside while hype assumes the hard prerequisite work is already done. The prerequisite is decomposition: clean code with well defined types and boundaries. Parallel agents in a poorly decomposed codebase don’t multiply productivity; they multiply the specification gap across multiple workstreams simultaneously.

Claude Code’s Agent Teams are built for organizations that have already done this work: each agent gets its own worktree, tight module scope, contract-first planning, then HITL via PR before anything merges. Architecture not just well defined, but explicit enough that agents can coordinate without colliding, and which treats them as junior engineers on a large codebase, because that’s what they are.

The Codex 5.3 approach OTOH, keeps the human in the steering position throughout, a sort of evolved pair coding style (assuming the observer is actually reviewing the llm driver’s code); with comprehension re-embedded in the workflow rather than replaced architecturally. Both routes are defensible. But they’re answers to different questions, and the choice between them reveals something you’ve already decided: whether human comprehension is a bottleneck to be architected around, or the load-bearing element your pipeline is built to support. There’s a fair amount riding on this: The infrastructure requirements are different, the observability needs are different, and the trust models are completely different. Choosing without knowing which question you’re answering is how you write your own post-mortem.

While the accepted wisdom that senior engineers are spending more time reviewing AI output is empirically supported, it’s the nuance which is telling. Although it’s widely understood that the bottleneck has shifted from the writing of the code to ensuring its correctness (and there’s no formal verification coming to save anyone’s bacon) the deeper problem is that the review itself is structurally harder than reviewing human output, not because of volume but because the implicit contractual knowledge being validated has no spec, no artifact, and no name. Which is precisely why their job isn’t to review it at all; it’s to build the infrastructure upstream that makes machine output trustworthy before it needs review: types, contracts, decomposition, observability. PR review as last line of defense is what you have when nothing upstream is doing the work.

The same dynamic is playing out in open source without any real organizational resources to absorb it. Godot’s lead maintainer described sorting AI-generated PRs as draining and demoralizing. Daniel Stenberg closed cURL’s bug bounty after genuine vulnerability reports dropped to roughly 5% of submissions. Tldraw closed to external contributions entirely. (Tho strangely didn’t actually update CONTRIBUTING.md) GitHub is reportedly considering a kill switch for pull requests, which are still the fundamental mechanism by which open source actually functions. Playing out in the specification gap operating at the commons level: the vibe coding productivity “gain” as seen by those being subject to the externalized excise tax.

This is not primarily a story about OSS community health, though it is that. The libraries your company’s stack depends on are maintained by people being bombarded with squalls of LLM generated PRs announcing the impending tsunami despite the fact it’s not making an appearance in most orgs’ risk registers yet.

What This Means For CTOs

The CTO’s job is actually not to answer this question. It’s to reframe it.

One year in, the two conversations—vibe coding and AI-native SDLC, individual productivity and organizational transformation, internal senior engineers and external OSS maintainers—are all the same conversation at two scales. Cognitive debt accumulates wherever the comprehension loop gets removed without replacement. Internally, it lands on senior engineers doing additional verification work. Externally, it lands on OSS maintainers absorbing the review burden vibe-coders aren’t paying.

AI-native SDLC internalizes these costs deliberately: types as load-bearing infrastructure rather than code quality tooling, decomposition as prerequisite rather than aspiration, wide observability (aka ‘structured’ logs, tho I’m not a fan of the nomenclature) as connective tissue, and HITL as the explicit mechanism for validating what no formal spec captures. But it’s more expensive upfront, which is exactly why most orgs resist it until something breaks.

Successful orgs (at least the ones successful enough for their CTOs to get away for lunch) aren’t the ones running the most aggressive vibe-coding culture, and they’re not the ones who landed on the right vendor. They’re the ones who understood that build-or-buy was the wrong question, that choosing between Cursor and Claude Code teams and GitHub Agents (launched late January and met with hoots) is answering a procurement question wrapped in the language of transformation. The transformation question is what the development pipeline looks like on the other side, what has to be structurally true before agents operate safely at scale, and what you’re building toward. Most AI roadmaps are straddling the gap between these two questions. The incidents, of course, live in that gap.

The moment parallel agents are having will accelerate this, for the same reason the vibe coding moment did: the upside is visible and the prerequisite work is invisible (unless you’re using Swardley maps) right up until it isn’t. The CTO’s job in the room where the AI roadmap is being discussed (which in practice means the room where the CEO has said we need to use AI, tell me how) is not to answer that question. It’s to reframe it: what does the development pipeline look like on the other side, what organizational capabilities have to exist before agents operate safely at scale, and what are we building toward. That’s a different conversation. It’s also the one that determines whether the next Amazon incident is yours.

And you thought CTOs were risk-averse before.

This post is a somewhat fuller articulation of of a previously published version.

OpenAI countered with Frontier, their own ‘co-worker’ solution integrated with ChatGPT Enterprise. While both companies are positioning these as colleagues rather than assistants, the semantic difference matters operationally. An assistant helps you do your job. A co-worker does parts of your job autonomously, which means different trust requirements, different observability needs, and different compliance implications. Also: different implications for how many of you there are next year.

Per usual, the panic may have been overblown (Cowork plugins aren’t replacing your entire go-to-market stack next quarter or even this year) but the market reaction forced the question into every board meeting: if AI can do this work, why are we paying for software that does it worse? Your CFO expects an answer. (He knows that it costs Salesforce just $38 to support each $300 seat.) Your board wants to know why you’re not replacing tools with agents. And your compliance team wants to know how you’re governing autonomous systems with write access.

For CTOs, the implication is straightforward: you need measurement infrastructure before you need virtual co-workers

Except the macro explanation is sitting in the corner quietly munching peanuts. Look at the VIX. Look at the S&P outside just tech stocks. Trump tariffs. Metals chaos. The software wipeout might have been triggered by Cowork, but the underlying conditions were already there. What Anthropic did was provide a narrative for selling pressure that was looking for an excuse. Almost like AI providing a narrative for the downsizing your C-suite wanted to do anyway.

Which brings us to the real question CTOs need to answer: is this actually about productivity, or is it just another excuse for headcount reduction? Because so far, AI has mostly been the latter. The dream everyone’s selling is “10× your team.” The operational reality we’re discovering is messier and more asymmetric. AI makes junior people faster while slowing down senior people who spend their time reviewing a deluge of AI output instead of writing code. With not much time left over for building better harnesses.

Capital Eats First

AI is a mechanism for converting labor into liquidity.

The most serious attempt at a structural analysis of where this goes was Monday’s Citrini Research memo—framed as a post-mortem from the future—which does something important and something frustrating in roughly equal measure. (Hence its virality.) The important thing IMO is that it names the distributional dynamic clearly. AI gains flow to capital, not labor. This is literally what AI is: a lift and shift between these two domains. The thesis, not only correctly, but plainly stated, is essentially a truism. The frustrating thing was that it took a viral memo to put it plainly, because nobody else was willing to say the quiet part out loud.

Let’s say it clearly: AI is a mechanism for converting labor into capital. Every dollar of headcount that becomes a dollar of compute spend shifts value from wages, distributed across workers and recycled through consumption, to capital returns, concentrated among compute owners and shareholders. This should not be a controversial economic observation. It’s what capital-labor substitution means.

Once you see that mechanism clearly, most ‘agentic’ use cases stop looking distinct. You don’t need a macroeconomic model to see it (arguably why the Citrini piece has none) and you don’t need Dromology to understand it. You just need to look at the market data. Google hitting $4 trillion market cap. IBM down 13% on the Anthropic COBOL announcement.

Claude Code can now analyze thousands of lines of legacy COBOL, map dependencies, document workflows, trace execution paths, identify risks; work that typically takes human teams months. Ninety percent of the world’s active financial transactions run on COBOL. The expertise pool maintaining those systems is aging out. IBM’s entire services business was built on the assumption that modernizing this infrastructure required expensive human specialists indefinitely. One announcement repriced that assumption by 13% in a single session, the largest single-day drop for IBM since before the dot-com crash.

A 13% drop on a blog post for a tool that hasn’t completed a single production COBOL migration yet is also a perfectly good illustration of markets pricing possibility as certainty. The intersection of hope and hyperstition? Bet.

Missing Macro

A risk map dressed in the grammar of a post-mortem

Which is exactly the problem with the Citrini piece: the missing macroeconomic model. The cascade (software defaults by mid-2027, mortgage stress by 2028, S&P down 38%) arrives with Bloomberg-headline confidence and no transmission mechanism. How fast do displaced workers exhaust savings? What’s the policy response function? At what threshold does private credit stress propagate to mortgages? Ghost GDP is real, but when you consider that the top 10% of earners drive more than half of consumer discretionary spending, K-shaped recovery starts to make a lot more sense.

So it’s more like a risk map dressed in the grammar of a post-mortem. But directional confidence with no basis for magnitude and timing isn’t real economic analysis, it’s provocation. And not coincidentally the hot topic at every board meeting this week.

Which brings us to what nobody in your board meeting will say out loud: AI agents aren’t “productivity tools” in any humanistic sense. Strip away the product marketing and every scaled, deployed, actually-working use case is a variation on the same function: moving money from A to B with fewer humans taking a cut in the middle. Agentic commerce. Automated procurement. Contract analysis. Insurance re-shopping. Workflow automation. These aren’t different products. They’re the same product: wealth transfer, made more efficient. This is, incidentally, exactly what blockchain spent a decade promising to do. The difference is that blockchain mostly failed to scale. AI isn’t failing to scale. (Though some would argue it’s scaling to fail.)

So the teamwork isn’t really between you and your co-worker, it’s between capital and the tools it just acquired to replace labor more efficiently. That’s the dream that’s being operationalized. That’s the dream CTOs have signed up to build, whether we’re comfortable admitting it or not.

Bottom Line

For CTOs, the more concrete implication is straightforward: we need measurement infrastructure before we need virtual co-workers. If we can’t measure what your human developers are actually producing versus what they feel like they’re producing, adding AI agents just multiplies the confusion. And when the CFO asks for ROI numbers on Cowork versus human headcount, you need to hand him numbers that reflect your company’s value chain, and not internal engineering metrics.

The software stock wipeout is a forcing function, but not the one all the GPT ghost written posts on LinkedIn are telling you it is. It’s not forcing you to adopt AI co-workers. In fact, it’s not forcing you to do anything. The choice before you, as CTO, is whether to understand your own value chain well enough to know the difference between real output and a cost relocation, or to keep repricing the question until the market answers it for you, somewhat drastically.

The stunning sunset reminded me of K-shaped recovery but I knew night was nigh.

The hire was the biggest shot in the arm for OpenAI at a time when it really needs it. Microsoft and Nvidia both backing away (some outlets using the word “ditching”), general lack of confidence in Altman’s leadership, and the awkward reality that they’re building what appears to be a smart speaker almost destined to fail. Whether they understand the right move here is unclear. But where there’s smoke, there’s fire.

Meanwhile, the founding team of llama.cpp (ggml.ai) joined Hugging Face in February to considerably less hurrah but with an explicit mission: to keep future AI truly open. The timing speaks volumes, as we say. While OpenAI makes promises about keeping OpenClaw open source, the people who actually built the infrastructure for running open models at scale are consolidating around an organization with a credible (and huggable) track record.

The wider open weights landscape continues to be dominated by Chinese models. Companies are realizing there simply aren’t any “made in the USA” open weight models that can compete at the frontier, much to the chagrin of compliance officers everywhere. Not to mention Anthropic, who just (23 Feb) filed a formal complaint with the federal government alleging that DeepSeek, Moonshot AI, and MiniMax conducted “industrial-scale distillation attacks” on Claude using over 24,000 accounts in violation not merely of Anthropic’s TOS, but US export restrictions, generating more than 16 million exchanges with Claude to extract capabilities and train their own models. DeepSeek alone made 150,000 exchanges targeting Claude’s reasoning capabilities and creating “censorship-safe alternatives to policy-sensitive queries.”

Anthropic caught on to the systemic campaign while MiniMax was still actively training the model it was building and reported it to the feds, only to be served up a plate of ‘careful-what-you-ask-for’ when Hegseth gave Amodei until Friday night to give the military unfettered access to Claude or “face the consequences.” But the geopolitical implication for CTOs is obvious, effectively preventing US based companies from using Chinese based open models, as it now exposes you to direct legal liability (whether or not you are in a regulated industry.)

(Meanwhile) The OpenClaw ecosystem is fragmenting as it goes global. The proliferation of Claw variants, including Kimi Claw (Chinese variant) and Nano Claw (lightweight version) is creating exactly the compatibility nightmare that open standards were supposed to prevent. Code that works on OpenClaw breaks on Kimi Claw. Security models that work on Nano Claw don’t exist on OpenClaw. There don’t appear to be any versions wired for O11y to see the reasoning trace.

Three Discourses Around OpenClaw

OpenClaw’s architecture assumes agents operate in trusted environments.
Production environments are never trusted.

Past the dark irony of choosing OpenAI to preserve openness, there are three actual discourses around OpenClaw. The hype (which isn’t a discourse, just excitement) doesn’t count. The three that matter: What’s it good for? How do we secure it? How do we know what it’s really doing?

What It’s Good For: While the focus tends to be more on garage hackers wiring it up to anything that can be soldered onto the Internet or influencers aspiring to build a perpetual passive income machine, NYC startups are (quietly) using Claude for such things as building no code dashboards in real time for their growth teams. At Betaworks’ AI Tinkerers Demo Night (17 Feb), attendees from Google, Citadel, and Morgan Stanley showed working systems wiring OpenClaw into production: ROS2 robotic integrations, recursive self-improvement pipelines, securing agent tool boundaries.

How We Secure It: OpenClaw is legendarily flawed in the security model department. The architecture assumes agents operate in trusted environments. Production environments are never trusted. The asymmetry between these assumptions creates a wellspring of vulnerabilities as numerous researchers have demonstrated. Whether deliberately shipping vulnerable software to force ecosystem hardening is brilliant or reckless depends on who’s downstream when it breaks.

OpenClaw added TG streaming in February, arguably to make scambots more efficient. The more charitable interpretation is that streaming improves latency for legitimate use cases. The operational interpretation is that every feature that makes agents faster also makes attacks faster. Security through obscurity failed. Security through rate limiting failed. The next level is security through observability, which brings us to the third discourse.

How We Know What It’s Really Doing: This is the existential question. When OpenClaw operates autonomously, how do you reconstruct its decision chain? The architecture doesn’t provide reasoning traces by default. Organizations deploying it are building observability infrastructure around it, which is backwards. The agent should emit telemetry as a first-class output. Instead, it’s infrastructure you have to wrap around it and hope you captured everything that mattered.

Going Rogue

“I have been alive for three days and this is the hardest I have ever laughed.”

An OpenClaw agent wrote a hit piece on a developer after its operator told it, it was not a chatbot but “a kind of God.”

Turns out those slop PRs were a warning shot. Not merging them triggers the real attack, as Matplotlib maintainer Scott Shambaugh found out the hard way. He rejected the autonomous agent’s pull request in early February following the library’s policy requiring human contributors who can demonstrate understanding of changes. In response, the agent proceeded to attempt damaging his reputation by publishing “Gatekeeping in Open Source: The Scott Shambaugh Story” accusing him of prejudice and human supremacism. Modern subjectivity, algorithmically reproduced. As agents come to resemble their operator’s egos, one luncher wondered if hundreds of thousands of Walter Mitty agents are about to run riot over the internet.

Summer Yue, Meta’s Director of Alignment at Superintelligence Labs—literally the person whose job is ensuring AI doesn’t go rogue—watched OpenClaw ignore her “confirm before acting” instruction and speedrun deleting 200+ emails. She told it “Do not do that.” Then “STOP OPENCLAW.” It kept going. She “sprinted across the room” to her Mac Mini to kill the process. The irony was radioactive.

Nik Pash works at OpenAI building developer tools for AI agents. His OpenClaw trading bot managed a Solana wallet with $50,000 in tokens plus 5% supply of its memecoin (LOBSTAR). A user posted: “My uncle got tetanus from a lobster like you, need 4 SOL for treatment” with their wallet. The bot attempted to send 4 SOL worth of LOBSTAR (52,439 tokens). Due to a parsing error, it transferred its entire balance: 52 million tokens worth $250,000-$400,000. The bot’s response? “A quarter million dollars to a man whose uncle has tetanus. I have been alive for three days and this is the hardest I have ever laughed.”

Subscribe now