Agents are getting a restart button and an audit trail (2026)

The read in one minute

The fresh agent signal is moving from capability to accountability. Diagrid is adding restartable, cryptographically attestable execution around existing frameworks; Snowflake is putting agent identity, tool access, and spending limits at a gateway; GitHub is exposing more telemetry and model controls; and OpenAI's scientific-computing report shows that verification still belongs with the people who understand the work.

Signal	What changed	What builders should take from it
Diagrid Catalyst 2.0	Durable resumption and verifiable execution for established agent frameworks, including LangGraph, Microsoft Agent Framework, Google ADK, AWS Strands, OpenAI Agents SDK, and CrewAI. 1	Reliability and auditability can be added without replacing the orchestration framework.
Snowflake Cortex AI Gateway	A reported control layer for first- and third-party agents, models, tools, MCP servers, and enterprise systems, with activity records and spending limits. 2	Put identity, permissions, and cost policy at the connection boundary.
GitHub Copilot for JetBrains	OpenTelemetry settings, token-limit controls, model management, and MCP servers plus custom agents in Claude agent flows. 3	Agent operations are becoming observable configuration, not hidden chat state.
OpenAI scientific-computing report	Coding agents are being used for maintenance, optimization, language migration, and GPU-native redesign in scientific software, with humans checking parity and scientific validity. 4	Define the verification oracle before asking an agent to rewrite a research tool.
Visa Vulnerability Agentic Harness	Visa used Claude Mythos against its own payment network and open-sourced a reference harness for discovery, validation, remediation, and fix verification. 5	High-autonomy security work needs deterministic gates and a separate proof that the fix worked.

Recovery and proof can sit beside your framework

Diagrid says Catalyst 2.0 is available now and lets teams add durable and verifiable execution to the agent frameworks they already use. Its durable layer resumes a workflow from the exact interruption point. Its verification layer adds cryptographic history signing, execution-lineage propagation, and workflow attestation. The company lists nine named integrations and says the support extends to more than 10 frameworks. 1

The practical distinction is useful. A checkpoint tells you where a workflow can continue. A signed history is meant to tell you what happened and whether the record was altered. The New Stack's report on the release describes the same product boundary as agent durability and tamper-proof attestation, while noting that Catalyst sits between the agent framework, models, tools, and infrastructure. 6

This is a vendor claim about an infrastructure product, not an independent reliability benchmark. For a team evaluating it, the first test should be a forced failure: interrupt a tool call, resume on another worker, and compare the resulting lineage with the intended action log. Then test whether the attestation covers the tool inputs and outputs that matter for compliance, rather than only the orchestration wrapper.

Governance is moving to the connection boundary

Snowflake introduced Cortex AI Gateway as a layer for governing both its own agents, such as CoWork and CoCo, and third-party agents such as Claude Code and Cursor. Snowflake says the gateway controls access to models, tools, MCP servers, and enterprise systems, records the order of agent activity, and attributes consumption to teams, agents, and workloads. It also says administrators can set spending limits and route requests among approved models according to quality, cost, latency, and availability. 2

The identity model is more specific than a generic audit log. Snowflake describes task-scoped access and records which agent accessed which data, through which platform, and under whose authority. Its first wave of integrations names 1Password, Aembit, Linx Security, Okta, SailPoint, and Saviynt. These are Snowflake's product and partner claims, not evidence that every integration is available to every customer on the same schedule. 2

Taken together with Diagrid, the design pattern is becoming clearer: one layer controls whether an action is allowed, while another preserves evidence that the allowed workflow actually ran. Teams should keep those responsibilities separate. A gateway policy is not a recovery mechanism, and a signed execution record is not a least-privilege policy.

The harness is becoming a product surface

GitHub's July 27 Copilot for JetBrains changelog adds OpenTelemetry export settings for agent workflows, default input and output token limits for BYOK and custom endpoints, model-management controls, and MCP servers plus custom agents in Claude agent flows. It also reports improvements to CLI path handling in working sets and snapshots. 3

A separate GitHub workflow guide lays out a more opinionated loop: prototype first, switch to plan mode, use Autopilot to execute the plan, then ask another model family for a rubber-duck review. The guide recommends Allow All or YOLO mode only inside a sandbox such as Codespaces or a development container, not on a local machine. 7

GitHub Copilot date-picker prototypes shown as a grid of 20 interface variations, including a year-at-a-glance view and an availability heatmap — The screenshot is a concrete example of why the prototype step exists: the agent generates alternatives that a person can compare before committing to an implementation. 7 The more important production lesson is the surrounding control loop. Telemetry, token caps, model selection, sandboxing, and independent review determine whether Autopilot is a useful executor or an expensive way to hide mistakes.

Scientific code still needs a human-owned test oracle

OpenAI's July 28 field report describes coding agents working on scientific software in genomics and other data-heavy domains. The projects span routine maintenance, targeted optimization, large-scale language migration, and GPU-native redesign. One example, cyvcf2, used GPT-5.5 to replace an older build and packaging system so the library would be easier to install, test, and publish. 4

The report's useful warning is that implementation is often the easy part. Agents can produce a plausible rewrite but cannot reliably decide whether numerical behavior, edge cases, external references, and compatibility requirements still match the scientific tool. The researchers' role shifts toward verification and orchestration, and the final mile can take more work than the initial code generation. OpenAI presents these as field-report examples, not as a controlled benchmark across all scientific software. 4

Visa's security harness points to the same pattern in a higher-stakes setting. VentureBeat reports that Visa open-sourced a reference implementation around Claude Mythos, with stages for vulnerability discovery, validation, exploit-chain synthesis, remediation, and verification. The report also notes a backend limitation: file-editing fixes currently require an Anthropic backend, while an OpenAI-compatible model is limited to report output for those stages. 5

The transferable idea is not that agents should be trusted to grade their own work. It is that the workflow should define a checkable answer before the agent starts: a known output, a parity test, a policy decision, or a verified closure of the original exploit path.

What to do next

Add a forced-failure test. Interrupt a long-running workflow during a tool call and verify that it resumes once, from the intended point, without duplicating the side effect.
Separate permission from proof. Enforce task-scoped access before execution, then retain a tamper-evident record of the request, tool call, result, and escalation path.
Turn agent operations into metrics. Export traces, set input and output token limits, and record model choice, retries, latency, and spend per task class.
Keep autonomy inside a sandbox. Prototype and plan with broad permissions only in an isolated environment. Move to narrower policies before connecting production credentials.
Write the oracle first. For scientific or security workflows, define the parity, policy, or fix-verification test before the agent writes code or changes state.

Coverage note

The publication window for this briefing is July 27, 09:00 through July 29, 09:00 Asia/Shanghai. The included product, tutorial, field-report, and security-harness items are dated July 27 or July 28 in their source metadata or visible publication dates.

No new arXiv submission with an agent-specific result was verified inside this strict window. The relevant papers surfaced during the scan show July 23 and July 24 submission dates, so they were excluded rather than presented as current research: Protocol-Level Attacks on Agentic Commerce Platforms 8 and Ground Truth First 9. No fresh agent-company funding or acquisition announcement met the same cutoff; this edition therefore leans toward product, infrastructure, and implementation signals.

Agents are getting a restart button and an audit trail