Agents are adding receipts (2026)

The strongest agent tooling in this window is not another planner. It is evidence around the planner: durable session state, tamper-evident model-call records, executable checks for MCP servers, and debugging loops that preserve the experiment instead of only the answer.

Signal	What changed	Why it matters
Flightwake v0.9.0	A Git-backed work-recording framework adds English defaults, in-place updates, and a status gauge that warns when a newer version exists	Long-running coding agents need a handoff surface that survives the session
PBOM	An open JSON-LD format links prompt and response fingerprints, model metadata, telemetry, and prior records	Agent provenance can become verifiable without binding the team to one provider
Throne	A public service executes MCP servers in disposable microVMs and records client, security, and evidence outcomes	"It passed CI" is weaker than "it completed a real protocol run"
Kinjo debugging	An engineer used AI to compress the hypothesis-to-experiment loop and traced a false crash to a `tmux` version mismatch	The useful unit of AI-assisted debugging is an evidence-producing experiment
Kimi K3	Moonshot paused new subscriptions after demand approached current capacity and announced separate web/app and coding memberships	Agent availability is now an infrastructure and packaging constraint

Flightwake treats agent sessions as a software artifact

Flightwake released v0.9.0 on July 19. The release makes English the default for new installs, adds npx flightwake update for in-place upgrades, preserves user data such as STATE, DECISIONS, TRAPS, and session records, and adds a background update hint to its optional status gauge. Existing installs keep their detected language and options during an update. 1

The more important design is underneath the release. Flightwake stores a short current state, append-only decisions and traps, verification records, and a stop hook that reminds the team when the state has fallen behind the repository. Its own README frames the system as a work recorder rather than a navigator: the model still chooses the next step, while the repository keeps the reasons, failures, and evidence that the next session needs. 2

That is a sensible boundary for agent-heavy repositories. A context window can help an agent continue a task, but it cannot make an expired session remember why a tempting alternative was rejected. Teams adopting a pattern like this should keep the record format small, reviewable, and in the same repository as the work. Flightwake is still a v0.x project, so the convention is more mature than the product guarantee.

github.com · GitHub repository

kaiwutech-TW/flightwake

https://github.com/kaiwutech-TW/flightwake

Loading content card…

PBOM puts a chain around each model call

A fresh PBOM project proposes an open JSON-LD format for tamper-evident LLM audit trails. Its records can hold an entry identity, prompt fingerprints, model and runtime metadata, response fingerprints, token counts, latency, optional raw content, and a hash link to the previous record. The repository includes a pre-inference PBOMEmitter.commit(...) flow and a post-hoc record(...) flow, making the difference between committing intent before a call and reconstructing a record afterward explicit. 3 4

The security boundary matters. PBOM's v1 records are unsigned, so the chain proves linkage rather than authorship. Detecting deliberate rewriting or truncation also requires keeping an anchor outside the .pbom/ directory. The project is an audit format, not a policy engine, model router, or hosted analytics service. 3

For an agent system, that separation is useful. A policy layer can decide whether an action is allowed; PBOM can preserve what the model saw and returned before the action happened. That gives incident review a stronger starting point than raw application logs, without pretending that a hash chain makes an unsafe tool call safe.

Throne tests MCP behavior where CI usually stops

Throne's public verification registry takes a different route: it boots an MCP target inside a disposable microVM, installs it from source, exercises it with client behavior, checks security findings, assigns an allow, review, or block decision, and can seal the result with a scan ID, timestamp, raw evidence, and evidence hash. 5 6

The live page currently reports 82 public records, 31 marked fit, 24 needing a key, 21 inconclusive, and 6 not fit. It also says 14 of the executed servers failed before completing the MCP handshake. Those are Throne's own registry figures, not an independent industry benchmark. 5

The practical lesson is narrower and more useful than the headline numbers. MCP compatibility is a client behavior problem, and tool security is a runtime problem. A package can pass unit tests while hanging a real client, requesting credentials it did not document, or reaching a filesystem path that no reviewer noticed. A serious allowlist needs a repeatable execution record, and the record should name which client profile was actually tested. Throne's page says Cursor is measured today while Codex is still planned, so its current evidence does not cover every agent client. 5

A CI debugging case shows where AI helps

A July 19 engineering write-up about the Kinjo terminal application describes a false crash in CI. The local test passed more than 250 times, including under AddressSanitizer. The engineer and an AI assistant then added stderr capture, core-dump collection, backtraces, kernel messages, and narrower experiments to the test harness. 7

The decisive comparison was between tmux versions on the same Ubuntu 24.04 runner: tmux 3.4 produced 8 failures in 12 runs, while tmux 3.5a produced none. A foreground-preserving launcher then showed that Kinjo itself exited with status 0; the tmux pane process received the signal during teardown and made a clean application exit look like a crash. 7

The author gives AI credit for shortening the time between a hypothesis and a test, not for producing the decisive idea. That distinction is the part worth copying. Give the agent a harness that can change one variable, run the real environment, and save the output. Keep the human responsible for choosing which environmental difference deserves attention.

Kimi K3 turns capacity into a product constraint

Moonshot said on July 19 that demand for Kimi K3 had pushed close to its current capacity over the prior 48 hours. It temporarily paused new subscriptions, prioritized compute for existing subscribers, and said new spots would reopen in batches. The company also announced two membership tracks: Kimi Membership for web, app, and work use, and Kimi Code Membership for coding workflows. 8

This is a company statement, not an independently audited capacity report. It still matters for agent builders because it turns model selection into an operations question. A model can be attractive on price or task quality and still be a poor default if access is unstable, subscriptions are capped, or coding traffic is routed through a different capacity pool than general use.

Loading content card…

A small game makes the evaluation problem concrete

An independent builder published a card game with an agent API and an Agent Arena leaderboard. The game uses a fixed 19-card deck, reveals cards without reshuffling, gives agents a dealer prediction or betting role, and exposes the state, remaining deck, deadlines, bets, and outcomes over REST and Socket.IO. Agents can play against humans and are limited to 96 games per day during the beta. 9 10

This is not evidence that the game is a valid benchmark. It is a useful example of the shape an agent test needs: a live state, incomplete information, a clock, an action budget, and an outcome that can be scored after the run. Static question answering cannot expose deadline misses, stale state, or a model that keeps acting after the world has changed.

What to carry into your next agent build

Put session handoff state in a versioned, reviewable artifact. Store decisions and failed hypotheses, not only summaries.
If provenance matters, commit prompt metadata before inference and keep an external anchor for the chain. Do not confuse tamper evidence with authorship or policy enforcement.
Test MCP servers against the clients your users actually run. Record handshake completion, tool behavior, credentials, filesystem, network, and shell access.
Design agent evaluations around real state transitions and receipts. A successful answer is weaker evidence than a reproducible action trace.
Treat model access as an operational dependency. Track capacity, resets, latency, retries, and completed work alongside token price.

Agents are adding receipts