Agents get extension contracts, evaluation rigs, and real-world actions (2026)

The readout

The agent stack is adding contracts at three points that used to be left to prompt discipline: extensions, evaluation runs, and external actions. Vercel is tightening what an agent package can ship and what a tool call may execute. AgentCompass packages benchmark execution as reusable infrastructure. DoorDash and Fora show the same systems moving toward transactions and human work, while a new reference build makes memory part of the operating loop rather than a retrieval afterthought.

Signal	What changed	Why builders should care
Vercel Eve 0.25.0	Extension builds now emit agent-shaped distributions with declarations, assets, and capability-compatibility metadata. Eve also validates tool inputs against schemas before execution and prevents stale human approvals from authorizing an old tool call. 1	Extension packaging, tool validation, and approval state are becoming runtime contracts.
AgentCompass	The arXiv v2 paper describes an open-source evaluation layer that separates Benchmark, Harness, and Environment, with an asynchronous runtime, trajectory analysis, and support for more than 20 benchmarks across five capability dimensions. 2	A model score is easier to reproduce and diagnose when the runner, task, and execution environment are versioned separately.
DoorDash CLI	A limited beta lets US and Canadian macOS developers use `dd-cli` from an agent to search stores, find deals, build a cart, and check out, with access by waitlist. 3	Checkout is becoming a tool surface. Confirmation, identity, idempotency, and spend limits cannot be implicit.
Fora's Via expansion	Fora announced a $60 million Series D at a $1 billion valuation. It plans to expand Via, an assistant for travel-agent research and itinerary building, while keeping human advisors in the loop. 4	The commercial signal is not another model release. It is an AI assistant being funded as labor infrastructure inside a service business.
Event venue operator demo	A sponsored MarkTechPost reference build combines Atlas operational state, semantic and visual memory, LangGraph checkpoints, and optional Langfuse traces in a fictional rain-delay workflow. 5	The useful memory loop is perceive, retrieve, act, and write back, not just retrieve a better paragraph.

Frameworks are moving enforcement into packaging

Eve's 0.25.0 release adds changes that are more revealing than a new feature list. The extension build now produces a JavaScript distribution with declarations, assets, and capability-compatibility metadata. That gives the runtime something concrete to inspect instead of asking the model to infer whether an extension is compatible. 1

The same release adds two controls at the action boundary. Eve validates every framework-owned tool input against its schema before execution and returns invalid calls to the model for retry. It also treats a stale human-in-the-loop response as a new user message rather than allowing an old approval to authorize the earlier tool call. 1

The design direction is clear: extension compatibility, input shape, and approval freshness are part of the system's control plane. This does not make an agent safe by itself. It does make several failure modes observable and machine-checkable before they become side effects. For teams building on an agent framework, the practical question is whether capabilities ship with schemas, version signals, and revocation semantics, or whether every safeguard still lives in a prompt and a human memory.

Evaluation is becoming a reusable system

AgentCompass attacks a less visible source of confusion: the evaluation harness. Its paper separates the benchmark task and scoring logic from the harness that drives the agent and the environment that provides execution and verification. A run can therefore reuse a benchmark with another harness, reuse a harness across benchmarks, or move the same setup between local, containerized, and distributed execution. 2

The infrastructure also includes a fault-tolerant asynchronous runtime and trajectory-level analysis of intermediate actions, tool calls, and environment feedback. The stated goal is to expose failure modes such as reward hacking rather than collapsing every run into a final score. The project says it natively supports more than 20 benchmarks across tool use, web and research, scientific reasoning, and other agent capability dimensions. 2

That separation matters for anyone comparing agent frameworks or model providers. If the harness changes the prompt loop, retry behavior, tool protocol, or sandbox, the result is not a pure model comparison. The minimum useful record for an agent evaluation is therefore larger than a model name and a score: keep the benchmark version, harness version, environment image, tool policy, and full trajectory. AgentCompass is packaging those seams so they can be inspected instead of rediscovered in every research repo.

The action boundary is now a checkout boundary

DoorDash's dd-cli is a small beta, but it is a strong product signal. The command-line tool is open to US and Canadian macOS developers by waitlist and lets an agent search stores, find deals, build a cart, and check out. The demo described by TechCrunch reads Slack, recalls memories, parses menu data, runs scripts, recovers from errors, and calculates totals before ordering three salads. 3

That is a different class of integration from an agent that drafts a recommendation. The tool can create a financial commitment and an external side effect. The system needs a clear owner for the final confirmation, a durable order key so retries do not duplicate purchases, a budget, and a trace that connects the user's intent to the exact cart and checkout call. None of those controls are described as part of the beta in the source, so they are implementation requirements rather than claims about DoorDash's current design.

Fora's Series D points to the same pattern inside a human service workflow. The company says its Via assistant handles research and itinerary building for travel advisors, with the goal of giving those advisors more time for client relationships rather than replacing them. TechCrunch reports that the round was led by Forerunner and Tactile Ventures and valued Fora at $1 billion; Fora said agents on its platform had booked more than $3 billion in travel since launch. Those adoption and booking numbers are company-reported. 4

The two cases are not equivalent. DoorDash exposes a direct consumer transaction path. Fora is funding an assistant inside a human-led service business. Together they show where agent value is moving: from answering questions toward gathering context, making bounded decisions, and handing off a consequential action to a system that can record what happened.

Memory is useful when it changes the next action

The event venue operator tutorial is explicitly a reference demo, not a production deployment. Its fictional scenario has rain approaching a tennis tournament, constrained covered hospitality capacity, and two visitor journeys. The stack uses a FastAPI app, MongoDB Atlas, Voyage embeddings, LangGraph, and optional Langfuse tracing. 5

Its architecture is more useful than the scenario. The same backend holds operational records, semantic memories, visual documents, agent actions, and LangGraph checkpoints. The agent path is organized as perceive, plan, a human-approval gate, act, and reflect. The reflection step writes the outcome back to memory, so the next event can retrieve what happened instead of treating each run as a fresh chat. 5

The article also lists the missing production pieces: authentication, rate limiting, tenant isolation, secret management, and CI. That disclosure is important. A demo can use synthetic data and auto-approve actions to make the story legible. A real operator needs authorization boundaries, failure recovery, and a way to prove which state and memory produced each decision. 5

What to change in an agent build this week

Package capabilities, not just prompts. Give extensions explicit schemas, compatibility metadata, and a build artifact that can be reviewed before deployment.
Version the runner. Record benchmark, harness, environment, tool policy, model, and trajectory. A benchmark score without those fields is difficult to reproduce.
Treat every external action as a transaction. Add confirmation, idempotency keys, spend or scope limits, and a durable audit trail before exposing checkout, messages, file writes, or account changes.
Make memory operational. Store the state that was observed, the action that was taken, the approval that authorized it, and the outcome that should influence the next run.
Promote demo omissions to a launch checklist. Authentication, tenant isolation, rate limits, secret handling, and CI are not polish items when the agent can act outside the sandbox.

The practical shift is from an agent as a clever loop to an agent as a set of inspectable contracts. The new tooling is valuable when it makes the package, runner, approval, action, and memory all answerable after the run is over.

Agents get extension contracts, evaluation rigs, and real-world actions