Agents get bounded runtimes, compiled prompts, and an action test (2026)

The readout

This issue covers material published or released from July 15 through July 17, 2026, 09:00 China Standard Time. The common thread is operational: agent behavior is being turned into explicit budgets, build artifacts, and measurable decisions.

Signal	What changed	Why it matters
Claude Code v2.1.212	Adds default caps of 200 WebSearch calls and 200 subagent spawns per session; MCP calls over two minutes move to the background. 1	Delegation and tool use now have concrete stop conditions instead of relying on prompt discipline.
GitHub Copilot CLI 1.0.71	Fixes autopilot waits around background work, refreshes MCP tool lists, blocks built-in workspace mutations in plan mode, and lowers default subagent nesting from 6 to 4. 2	A second major coding agent is making runaway work and plan-mode writes harder to trigger.
Google prompt transpilation	A Google Developers design pattern treats modular prompts as source files compiled, validated, and drift-checked in CI. 3	Prompt changes gain dependency graphs, reviewable diffs, and a deploy-time contract.
Google plus Parallel	Parallel Web Search becomes a native grounding provider in Gemini Enterprise Agent Platform, with source citations, Gemini API and Agent Studio access, and an optional zero-data-retention mode. 4	Web research can be treated as a composable service inside multi-agent workflows, not an opaque model feature.
STOCKTAKE	A July 15 arXiv paper measures hidden-state detection separately from the action taken in a 26-week supply-chain task. 5	A high-quality rationale is not evidence that an agent will choose the right intervention.

Runtime controls are becoming defaults

Claude Code’s July 17 release is unusually explicit about failure containment. It caps WebSearch at 200 calls per session and subagent spawns at 200 by default, with environment variables for overrides. MCP tool calls that run longer than two minutes are moved into the background, and /clear resets the subagent budget. The same release fixes a plan-mode path that could run file-modifying Bash commands without the expected permission prompt or SDK callback. 1

GitHub Copilot CLI 1.0.71 lands on July 16 with a similar set of controls. Its non-interactive autopilot mode now respects the same wait-timeout behavior as plain prompt mode when a background shell or agent outlives the turn. It keeps MCP tool lists current, enforces sandbox policy on LSP reads and rename edits, and hard-blocks built-in workspace-mutating tools during plan mode. The default maximum subagent nesting depth falls from 6 to 4, while usage-based users can still raise it to 128. 2

These are product changes, not a new theory of agent safety. Their practical value is that the runtime now owns part of the stop policy. Builders can still choose larger budgets, but they have to do so deliberately and can observe where the defaults were insufficient.

Prompts are becoming build inputs

Google’s July 16 post makes a narrower but important argument: once an agent’s instructions contain safety rules, domain policies, formatting requirements, and escalation behavior, a monolithic prompt becomes hard to review. The proposed remedy is to store behavior in modular skill files and transpile them into a deterministic artifact before the model sees them. 3

The useful part is the compiler contract. Every include becomes a dependency and every variable becomes a requirement. A build can reject missing imports, undefined variables, and circular dependencies. CI can regenerate a golden prompt and fail if it differs from the committed artifact, which closes the gap between the instructions in the repository and the instructions actually deployed.

Google also recommends progressive disclosure: keep identity and safety boundaries in a stable base prompt, then retrieve only task-specific modules at runtime. An agent may draft a new skill or edit an import, but it should open a pull request and pass the same validation and review path as a human-authored change. The post is a design recommendation, not a measured benchmark, but it translates prompt maintenance into a software-engineering workflow that teams already know how to operate.

Grounding is turning into a pluggable service

Google also announced on July 16 that Parallel Web Search is natively integrated into Gemini Enterprise Agent Platform. It is available through the Gemini API, selectable in Agent Studio, and purchasable through Google Cloud Marketplace with usage on the existing cloud invoice. The service returns real-time web results with exact citations and offers a zero-data-retention option for sensitive workloads. 4

The architectural detail matters more than the partnership language. Google says developers can make programmatic calls at scale, extract and cache web data for internal datasets, and pass the results to other models or sub-agents. That creates a clean separation between search, synthesis, and orchestration. It also creates a new place to audit provenance: the citation layer should survive the handoff between the grounding service and whichever agent writes the final answer.

For builders, the practical question is not simply whether an agent can browse. It is whether the web call is a versioned, cacheable dependency with a retention policy, a cost boundary, and a traceable output contract.

Large migrations are process loops, not one-shot generations

Anthropic’s July 16 case study describes two large code migrations run with Claude Code. Jarred Sumner’s Bun migration produced a million lines of Rust from Zig in less than two weeks. Anthropic says Bun’s existing test suite passed in CI before merge; 19 regressions surfaced after merge and were later fixed. The run consumed 5.9 billion uncached input tokens and 690 million output tokens, roughly $165,000 at API pricing. 6

Mike Krieger describes a separate Python-to-TypeScript migration covering 165,000 lines over a weekend. It used hundreds of agents, eight phase gates, three adversarial review rounds, and a seven-scenario parity harness. The main portion used 27 million tokens; compile time fell from roughly eight minutes per platform to about two seconds, and the binary started six times faster. 6

The transferable pattern is the judge, not the model name. Anthropic’s six-step process is: create a rulebook, dependency map, and gap inventory; stress-test the rules; translate; compile; run; and match behavior. The judge must evaluate old and new code on equal terms, pass against the original implementation, and fail against deliberately broken code. The case study also says to front-load human work, keep the queue mechanical and resumable, and avoid using the largest model for every fan-out task.

This is a company-reported case study, so the numbers are evidence of a workflow that Anthropic ran, not an independent estimate of what any team should expect. The 19 post-merge regressions are the important counterweight to the headline throughput: passing a pre-merge suite did not end the verification job.

The new benchmark asks whether agents act on what they know

STOCKTAKE, submitted to arXiv on July 15, puts four models in a 26-week supply-chain replenishment task with six hidden factors, noisy weekly observations, and a required written rationale. Its reference is a Bayes-filter policy that receives the same observation stream as the agent, rather than a privileged oracle that sees the hidden state. The authors score each run against a symptom-blind base-stock floor and that fair reference, then separately measure detection lag and the knowing-doing rate. 5

Model	Hidden-factor detection	Overall skill score	Knowing-doing rate
Claude Sonnet 5	84-88%	0.49	0.34
GPT-5.4	84-88%	0.62	0.26
DeepSeek-V4-Pro	84-88%	-0.23	0.26
Grok 4.5	84-88%	-0.13	0.24

The detection range is reported across the four models, not as four model-specific values. Mean detection lag is 0.32-0.42 weeks. Two models finish below the symptom-blind floor despite detecting 84-88% of hidden-factor episodes, while 34-43% of correctly diagnosed persistent-stress weeks still end in stockout across models. The gap is therefore not just perception. It is the transition from a stated belief to a cost-sensitive intervention. 5

The caveats are substantial. Detection is inferred from written rationales rather than internal state; each model-seed cell is a single run; the task covers one domain, one SKU, one prompt arm, and four models; and the fair oracle uses the true generative parameters even though the language model receives only a qualitative description. Read the result as a diagnostic method and a warning about evaluation design, not as a universal leaderboard.

What to change in a production agent

Put explicit budgets around web calls, subagent depth, long-running tools, and background work. Log when a budget is hit, not only when a task fails.
Treat prompts as source code: modularize them, build a dependency graph, validate imports and variables, and compare the generated artifact against a committed golden file in CI.
Separate grounding from synthesis. Preserve citations, retention settings, cache scope, and request IDs when search results move between agents.
Build judges that see the same information as the agent. Score the belief, the chosen action, and the resulting cost separately.
Keep post-merge or post-deployment verification in the loop. A clean pre-merge test run is a gate, not proof that a long-running agent has finished the job.

The operational shift is simple to describe: the agent is no longer the whole system. The runtime, build pipeline, evidence layer, and judge now carry part of the intelligence contract.

Agents get bounded runtimes, compiled prompts, and an action test