GenAI catch-up research note 2026-10-13

🤖 Generated by Claude Opus 5.5

• Window: 2026-10-10 to 2026-10-13 (since the previous scheduled run on 10-10, 32 candidates).
• Sources that failed to fetch: hn-claude-code (connection timeout) and hn-mcp (hnrss.org returned 502 Bad Gateway), both again on a retry.
  • The same queries through the Hacker News Algolia search API found no in-scope story with 100 or more points in the window, and the Hacker News figures in this note come from that API.
• Topic 1 continues topic 5 of 2026-10-01, and topic 6 returns from topic 9 of 2026-10-10, where it was dropped.
• Topics 1 to 5 were published before the window and first reached the feeds in this run, through ainews, laiso-newsletter, zenn-trending and hatena-ai-agent.

Candidates and selection

• Selected (go into the report):
  1. OpenAI's Decisions API in public beta, with documentation, SDKs and a price (anchor 10-06, before the window, surfaced by laiso-newsletter and ainews, impact 2 / potential 2 / attention 2).
  2. Microsoft-Decision-1 in public preview on Foundry and OpenRouter (anchor 10-09, before the window, surfaced by zenn-trending, laiso-newsletter and ainews, 1 / 2 / 2).
  3. vec1 moved into the SQLite source tree and shipped in the 3.54.0 sources (anchor 09-30, before the window, surfaced by zenn-trending, 1 / 2 / 2).
  4. Strands Box in developer preview, with a hands-on test on EC2 Mac (anchor 10-07, before the window, surfaced by zenn-trending, 1 / 2 / 2).
  5. An essay on keeping the ability to take over from AI coding agents, drawn from aviation's rules (anchor 10-05, before the window, surfaced by hatena-ai-agent, 1 / 1 / 2).
  6. Dynamic workflows in Claude Managed Agents, dropped on 10-10 and back with wider coverage (anchor 10-09, before the window, surfaced again by ainews, 1 / 2 / 1). - 1 continues topic 5 of 2026-10-01, a limited preview with no public endpoint, schema or price; the public beta opened on 10-06 without reaching any feed. - 2 to 4 tie at 5 with impact 1 and attention 2, and rank by their independent sources (9, 8 and 6). - 5 and 6 tie at 4 with impact 1, and 5 ranks first by attention. - 6 was dropped on 10-10 at 1 / 2 / 0 because no discussion beyond the release notes was found; this run found write-ups by The Decoder and its German sister site MIXED, by XenoSpectrum and by practitioners, which count as one established publisher plus community posts.
• Dropped (input for the next run's judgement):
  7. Karpathy's post on the widening gap in how people understand LLM capability (anchor 10-11, 0 / 1 / 2) — commentary without new data that changes nothing a GenAI engineer builds.
  8. REA, a tool for reverse engineering closed-source apps with coding agents, brought back by an explainer (anchor 04-14, background, 0 / 1 / 2) — a tool from April whose recent releases are routine, so nothing recent anchors it.
  9. Vals AI's study of agent teams on Vibe Code Bench (anchor 10-09, 1 / 1 / 1) — one benchmark by its owner, discussed only by aggregators.
  10. Claude Code Projects opened to every waitlisted Pro and Max user (anchor 10-09, 1 / 1 / 1) — a wider rollout of a beta, discussed only by aggregators.
  11. StepFun's Step 5 Preview on OpenRouter (anchor 10-08, 1 / 1 / 1) — a preview whose open weights are due on 10-15, in the next window.
  12. Other one-off items — listed below.
  13. Out of scope — listed below.

1. 🎯 OpenAI opened the Decisions API to all developers in public beta: POST /v1/decisions on gpt-6-luna returns probabilities, choices and rubric scores for text and images at $0.10 per million input tokens with no output or cache charges, with general availability expected in the coming weeks

• Selected / impact 2 / potential 2 / attention 2 / anchor 10-06, before the window / kind: release / areas: models, API and cloud.
• Feed items in this topic:
  • laiso-newsletter 10-12 #22 Jevその後 (#22: after Jev), whose free part describes the Decisions API as a dedicated endpoint, separate from the Responses API, that also takes images — 1 Hatena Bookmark user when fetched
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (its section on decision models becoming a product category) — the public-beta guide drew 393 points and 231 comments on Hacker News from 10-06
• Anchor: OpenAI's API changelog, its post on X and openai-python v3.26.0 date the public beta 10-06, four days before the window; no feed carried it then, and ainews and laiso-newsletter first brought it to the feeds in this run.

Continued from

• Topic 5 of 2026-10-01 covered the limited preview announced at DevDay on 09-29 and Every's first tests against Jev, when no endpoint, schema, model ID, limits or pricing were public.
• Since then, OpenAI opened the API to all developers in public beta on 10-06, with a guide, an API reference, SDK support in five languages and a Playground: the endpoint is POST /v1/decisions, gpt-6-luna is the only model, and input costs $0.10 per 1M tokens with no output or cache charges.
  • Nikunj Handa's remark that it is priced the same as Luna now holds for Luna's uncached input price only.

Collected information

[A] OpenAI — Decisions guide (2026-10-06, as fetched on 2026-10-13)

https://developers.openai.com/api/docs/guides/decisions

• The API is in public beta with general availability expected in the coming weeks, gpt-6-luna is the only model, and requests go to the dedicated POST /v1/decisions endpoint.
• A request has three fields: model, input (a text string, or user messages with input_text and input_image parts, shared by every question) and questions.
  • The response holds an answers array that echoes each question's name.
• A predicate question returns a probability from 0 to 1 that a condition is true, and a choice question returns one supplied value plus a probabilities array and a separate confidence.
• A score question returns the probability-weighted average of 0-based level indices, so probabilities of 0.1, 0.7 and 0.2 over three severity levels give 1.1, between two levels.
• Independent questions on the same input share one questions array and may mix types, while a decision that depends on an earlier answer needs a second request.
• Any question may come back as type refusal, and the SDK samples branch on it.
• The guide sends extracted fields, written explanations and tool calls to Structured Outputs on the Responses API or to function calling instead.
• Images must be inline base64 data URLs, and hosted HTTP(S) URLs and file_id inputs are not supported by this endpoint.
• It tells developers to set thresholds from labeled examples and the cost of false positives and false negatives, and to add a fallback choice such as other.
• Input costs $0.10 per 1M tokens with no charge for cache reads, cache writes or output tokens, while regional processing premiums and long-context multipliers still apply and other gpt-6-luna requests keep the normal model pricing.
• It supports Zero Data Retention and HIPAA for eligible customers, and data residency and regional processing in the United States and Europe (EEA plus Switzerland).
• The SDK samples call client.decisions.create(...) and need Python 3.26.0, JavaScript 7.30.0, Go 3.73.0, Ruby 0.101.0 or Java 4.78.0, and a Playground is at platform.openai.com/decisions.
• The guide's headline claims typed answers "about 10x faster than the Responses API" and gives no benchmark.

[A] OpenAI — API reference: Create a decision (as fetched on 2026-10-13)

https://developers.openai.com/api/reference/resources/decisions/methods/create

• A request may carry up to 128 images, as base64 data URLs or publicly accessible HTTP(S) URLs, which contradicts the guide; file IDs, other message roles, function calls, files, audio and item references are rejected, and detail takes low, high, auto or original.
• A choice question takes 2 to 255 unique choices whose values are strings or booleans, and a string and a boolean with the same text are distinct values.
• Answers come back in the order the questions were asked, and a refusal carries only the question's name (or null) while the other questions are still answered.
• The response usage reports input_tokens, cached_tokens, cache_write_tokens, output_tokens and reasoning_tokens, with 0 output tokens in the example, and an optional safety_identifier of up to 128 characters identifies the end user.

[A] OpenAI Developers — API changelog, GPT-6 Luna model page and openai-python v3.26.0 (2026-10-06, as fetched on 2026-10-13)

https://developers.openai.com/api/docs/changelog / https://developers.openai.com/api/docs/models/gpt-6-luna / https://github.com/openai/openai-python/releases/tag/v3.26.0

• The changelog dates the beta to October 6 in an entry tagged gpt-6-luna and v1/decisions, and openai-python v3.26.0, released the same day, adds "standalone Decisions support".
• The same day OpenAI reduced its API usage tiers from five to three: Build, Launch and Grow.
• The Luna page gives a 1,050,000-token context window, 2x input and cache rates for prompts over 272K input tokens and a 10% premium for regional processing, which appear to be the multipliers the Decisions guide refers to.
• On the Responses API, Luna costs $0.10 input, $0.01 cached input, $0.125 cache writes and $0.50 output per 1M tokens, so Decisions keeps the uncached input price and drops the output charge.
• The Luna page's 18-row endpoint table has no v1/decisions row, and its gpt-6-luna rate limits run from 5,000 RPM and 2,000,000 TPM (Build) to 30,000 RPM and 180,000,000 TPM (Grow), with no statement on whether they cover Decisions.

[A] OpenAI — Connect voice to Decisions (as fetched on 2026-10-13)

https://developers.openai.com/api/docs/guides/decisions-voice

• The companion guide pairs the Live API in client-delegation mode (delegation: { type: "client" }) with Decisions: the app sends transcripts and app state to /v1/decisions, runs the chosen action and reports the result to GPT-Live with session.commentary.append.
• A choice question can hand complex requests to a reasoning model on the Responses API through a reason option, while actions such as next_slide, or noop when nothing fits, stay on Decisions.

[A] OpenAI Developers on X — public-beta announcement (2026-10-06)

https://x.com/OpenAIDevs/status/2107573382229188645

• The announcement claims decisions "up to 10x faster than GPT-6 Luna through the Responses API", a narrower comparison than the guide's.
• Its thread lists routing to a model, tool or agent, labels, rankings and scores at scale, analysing images, comparing visual content or finding key video frames, and choosing buttons or navigating forms.

[B] Simon Willison — llm-openai-decisions 0.1a0 (2026-10-06)

https://simonwillison.net/2026/Oct/6/llm-openai-decisions/

• He released llm-openai-decisions, a plugin for his LLM CLI that GPT-6 Astra wrote from OpenAI's new documentation, modelled on his llm-typesafe plugin for Jev.
• He finds the API shape conceptually very similar to Jev's, with the same three question types, while Luna adds image input; both charge for input only, 10 cents per 1M tokens for OpenAI against 4.2 cents for Jev.

[B] MIXED — OpenAI's Decisions API runs on gpt-6-luna alone, and the model's own endpoint table omits it, by Shane S. Ellison (2026-10-07)

https://mixed-news.com/en/openai-decisions-api-beta-gpt-6-luna-endpoint-table/

• Counting the Luna page's endpoint table at 22:40 UTC on 10-06, it found Chat Completions, Responses and Batch marked supported, the other 15 rows not supported, and no row for v1/decisions.
• It notes that the 10x comparison comes with no benchmark and that a score can land on a value that matches none of the levels.

[B] The New Stack — Decision models are suddenly everywhere; OpenAI's is now public, by Meredith Shubel (2026-10-07)

https://thenewstack.io/openai-decision-models-deployment/

• OpenAI's launch video shows Decisions choosing lane changes in a driving game from frames, steering a Hugging Face Microduck robot to follow "the apple" together with GPT-Live, and picking an animated character's expression while GPT-Live speaks.
• It sees OpenAI keeping its model behind a hosted API while Perplexity (pplx-decider, Apache 2.0, on Qwen3.8-27B), Cloudflare (Clef) and AWS (Strands Decider 2B, on Qwen3.5-2B) publish weights, and expects deployment options to decide which model developers pick.

[B] The New Stack — AWS, Upstage and Ollama agree on a decision-model API; OpenAI hasn't signed on, by Janakiram MSV (2026-10-09)

https://thenewstack.io/decision-models-system-one/

• It finds TypeSafe's System One schema (/v1/systemone with noul, choice and score questions) becoming the shared contract, served natively by Upstage's Solar Decide, Ollama 0.35, AWS's Strands Decider, Kev and Open-Jev, and in variants under other paths by OpenRouter and Perplexity.
• It concludes that "TypeSafe is winning the schema war while the endpoint war remains open", and that an OpenAI schema of its own would leave the category with two competing contracts.
  • Its market table, dated 10-07, still lists OpenAI's API as a limited preview with an unpublished schema.

[B] Classmethod (DevelopersIO) — Trying the OpenAI Decisions API with Japanese text and images, by 山本暁斗 (2026-10-08, in Japanese)

https://dev.classmethod.jp/articles/openai-decisions-api-hands-on/

• Across 900 requests (100 for each input kind and question type), Japanese text scored 93/100 on entailment predicate, 84/100 on a three-way choice and an MAE of 0.561 on a 0–4 similarity score.
  • Synthetic images scored 100/100, 98/100 and an MAE of 0.104, and real photos with text 70/100, 66 of 98 valid answers and an MAE of 0.732.
• Latency including the network had medians of 209–218 ms for text and 271–305 ms with images, a p95 of up to 1,489 ms and a maximum of 4,134 ms.
• The 900 requests used 302,146 input tokens and 0 output tokens, about $0.03 at list price.
• Two requests returned HTTP 200 with a refusal answer, so the author calls for a fallback to another model or a person.
• High confidence did not mean agreement with people: one image caption scored 3.84 with a confidence of 0.87 where the human rating mapped to 1.0.
• Its comparison table lists input prices per 1M tokens of $0.10 for Decisions, $0.042 for Jev, $0.09 for Clef-flash and $0.24 for Clef, and notes that Clef takes at most 4 images per request and Jev none.

[B] Classmethod (DevelopersIO) — Finding OCR errors in Japanese document images, and matching document values against Jev and Clef, by けーま (川田 圭真) (2026-10-11 and 2026-10-12, in Japanese)

https://dev.classmethod.jp/articles/openai-decisions-ocr-verification-ja/ / https://dev.classmethod.jp/articles/openai-decisions-cross-match/

• On 107 value-matching cases at a 0.8 threshold, Decisions tied Jev on exact (106/107) but trailed it on semantic (90 with English and 91 with Japanese instructions, against Jev's 96 and 97 of 106), and unlike Clef (91 to 76) did not drop with Japanese instructions.
• Median times were 264–270 ms against Jev's 686–709 ms and Clef's 468–499 ms, which the author puts down to server load, and the cost was about 2.3x Jev's and 0.6x Clef's.
• Because predicate has no criteria field, the true and false conditions passed to Jev and Clef had to be appended to instructions.
• On three Japanese documents, Decisions caught 34 of 36 injected errors and 10 of 19 real misreads by Claude Haiku 4.5, more than Clef (32 and 7) and Clef-flash (29 and 5), but flagged 16 of 503 correct values against Clef's 7.

[C] Zenn (7shi) — Porting from Jev to the OpenAI Decisions API (2026-10-08, in Japanese)

https://zenn.dev/7shi/scraps/38ded435ab8ceb

• Porting an LLM-as-a-judge script from Jev meant JSON-encoding the state dictionary into a string, joining the named instructions into one string, turning maps into lists and retrying on refusal.
• Grading 5,200 answers took about 0.25 s per judgement against Jev's 0.22 s, at about 1.6x Jev's cost ($0.2814 in total), and the scores tracked Jev's (r = 0.960) without Jev's ceiling at 96–97 points.
• The same gpt-6-luna on the Responses API, with reasoning off and a one-word answer, agreed with Decisions on 91.4% of judgements but took 101 min 32 s against 21 min 14 s, about 4.8x longer, and gave no probabilities.

[B] Latent Space (AINews) — TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (2026-10-10)

https://www.latent.space/p/ainews-typesafejev-at-100m-arr-75b

• It files the API in a section on decision models becoming a product category, with Jev as "the reference point everyone benchmarks against", and confirms the three request types, image input, the price and OpenAI's own figure of up to 10x faster.

[B] laiso — #22 After Jev (2026-10-12, in Japanese)

https://blog.lai.so/2026-10-12/

• The free part describes the Decisions API as a dedicated path independent of the Responses API, multimodal, and by its timing clearly an answer to Jev; the rest is paywalled.
• Its summary holds that models and tools have multiplied, but where a decision model pays off in a pipeline is still found by trial and error.

[C] Hacker News — Decisions API is in public beta (from 2026-10-06, 393 points and 231 comments when fetched on 2026-10-13)

https://news.ycombinator.com/item?id=49984025

• Early measurements diverge: Topfi's suite of under 600 calls found a p50 of 346 ms, a p95 of 860 ms, about 3.1x Jev's cost and 4 failed calls against none for Jev and Mercury Decide, while agentdev001 saw 160–175 ms end to end with a p95 of 285 ms.
• simonw expects /v1/decisions to become a de facto standard as OpenAI endpoints usually do, while others debate what it adds over Structured Outputs, doubt zero-shot calibration, note a price more than twice Jev's and argue that enterprises will prefer an existing OpenAI contract.

[C] OpenAI Developer Community — Decisions API is now available in Public Beta (2026-10-06 to 2026-10-07)

https://community.openai.com/t/decisions-api-is-now-available-in-public-beta/1403877

• On a few hundred questions, jefff found Jev more accurate on nuanced judgements, with Luna giving about three times as many confident wrong answers, a 1.6 s median turn against Jev's 0.3 s in multi-step use, and 2–3x Jev's cost.
• platypus's loaded-coin test returned heads 70% of the time over 1,000 trials as a predicate but 98% as a choice, and the order of choices shifted the probabilities, so he advises against choice for now.
  • Other members add that Decisions has no input caching, that image inputs answered in about 0.8 s over a 3 Mbps link, and that the Playground's field labels did not match the API on 10-07.

Notes

• Image inputs: the guide says inline base64 only and rejects hosted HTTP(S) URLs, while the API reference accepts publicly accessible HTTP(S) URLs, both as fetched on 10-13; MIXED reported the guide's rule on 10-07.
• The speed claim changes wording: "up to 10x faster than GPT-6 Luna through the Responses API" (X), "10x faster than the Responses API" (changelog) and "about 10x faster" (guide), with no benchmark.
  • Independent figures: medians of about 210 ms for text and 270–305 ms with images (Classmethod), 0.25 s per judgement against 1.17 s for a one-word answer from the same Luna on the Responses API (7shi), and a p50 of 346 ms (Topfi) or 160–175 ms (agentdev001) on HN.
  • jefff's 1.6 s per turn was measured in multi-step conversational use, and the 10-01 note recorded OpenAI's DevDay chart of 150 ms against 1.6 s.
• Cost against Jev: the list price is 2.4x Jev's ($0.10 against $0.042), and measured ratios were 1.6x (7shi), 2.3x (Classmethod), 2–3x (jefff) and 3.1x (Topfi), so tokenization and input mix matter; Classmethod found Japanese text cheaper than the list-price gap suggests.
  • No caching means repeated long prompts pay the full rate, while Luna on the Responses API offers $0.01 cached input but bills output and reasoning tokens.
• Accuracy against Jev is mixed: a tie on exact matching but fewer semantic matches (Classmethod), close agreement without Jev's score ceiling (7shi), and worse nuanced judgements (jefff, Topfi).
  • Microsoft's Decision-1 post lists GPT-6 Luna Decisions among the models it benchmarked and claims to outperform other decision models, but its text gives no per-model figures.
• Calibration: OpenAI publishes no calibration data, AINews said on 09-30 that the API adds no calibration training, a forum user's toy test found choice over-concentrating probability and sensitive to order, and Classmethod saw high-confidence disagreements with people; the guide only says to set thresholds from labeled examples.
• Schema: OpenAI's contract (input, a questions array, predicate) differs from the System One contract (state, a questions map, noul, criteria) that Jev, AWS's Strands Decider, Ollama and Microsoft-Decision-1 follow, so moving between them takes code changes (7shi, Classmethod).
  • The New Stack's 10-09 piece still describes OpenAI's schema as unpublished, three days after the beta opened.
• Not yet stated: rate limits for Decisions itself, a limit on questions per request or on score levels, the GA date, other models than gpt-6-luna, and whether Azure or Bedrock will offer the API (asked on the forum, unanswered).
• Context: the Luna page gives 1,050,000 tokens and a forum regular describes a 272K standard tier with 1M available; the Decisions guide states no limit of its own.
• AINews says several vendors shipped decision models on the same day, but its window covers 10-08 to 10-09 and OpenAI's beta opened on 10-06.
• Japanese coverage: three Classmethod hands-on posts, laiso, and several Qiita posts seen only in search results, which were not read.
• No fact here rests on WebFetch alone.

Ideas for practice and output

• Run the harness planned on 10-01 now that the endpoint is open: one labeled in-house routing or classification set through /v1/decisions, Luna on the Responses API with an enum Structured Output and reasoning none, Jev and Microsoft-Decision-1.
  • Record p50 and p95 latency from Japan, accuracy, a reliability diagram with ECE, the refusal rate and the cost per 1,000 decisions.
• Test the choice calibration concern on labeled data: shuffle the choice order, and compare choice probabilities with one predicate per option before adopting either.
• Prototype an image gate, such as product-photo damage or picking the next UI action from a screenshot, comparing detail settings and checking whether hosted HTTPS image URLs are accepted despite the guide.
• Write a thin adapter from the System One shape (state, noul, criteria) to /v1/decisions (input, predicate, choices) that moves true and false criteria into instructions and handles refusal, so the team can switch providers.
• Build a cost sheet from measured token counts for typical Japanese text and images at $0.10 against $0.042 per 1M tokens, including the missing cache discount and the 2x rate above 272K tokens.
• Output: a short internal note on where Decisions fits next to Structured Outputs, with the measured latency, cost and refusal behaviour from the harness.

2. ⚖️ Microsoft released Microsoft-Decision-1 in public preview on Foundry and OpenRouter, a text-only decision model post-trained from Qwen3.5-9B that returns a probability for each fixed answer at Jev's price of $0.042 per million input tokens with free output

• Selected / impact 1 / potential 2 / attention 2 / anchor 10-09, before the window / kind: release / areas: models, API and cloud.
• Feed items in this topic:
  • zenn-trending 10-12 Microsoft-Decision-1でAI-OCRの品質ゲートを作ってみた (building a quality gate for AI-OCR with Microsoft-Decision-1) — 6 Zenn likes and 0 Hatena Bookmark users when fetched
  • laiso-newsletter 10-12 #22 Jevその後 (#22: after Jev), which counts Microsoft among the vendors now offering decision APIs
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (positioned for LLM judges and for screening scientific hypotheses) — Microsoft's announcement drew 199 points and 66 comments on Hacker News from 10-09
• Anchor: Microsoft announced the model on 10-09, the day before the window, on its Command Line blog and the Foundry board of Tech Community, neither of which the microsoft-foundry-blog feed covers; ainews, zenn-trending and laiso-newsletter first brought it to the feeds in this run.
• Related: topic 2 of 2026-09-27 (Jev) and topic 2 of 2026-10-06 (Clef), the decision models it is compared with.

Collected information

[A] Microsoft — Introducing Microsoft-Decision-1, our model for fast decision-making, by Achint Srivastava (2026-10-09)

https://commandline.microsoft.com/microsoft-decision-1-model-foundry/

• Microsoft-Decision-1 is available in Microsoft Foundry and through OpenRouter for routing, classification, prioritization, verification and workflow control, at $0.042 per million input tokens with free output.
• Microsoft post-trained Qwen3.5-9B for fast, single-pass decision scoring and "will soon rebase it on other models, including Microsoft AI (MAI) and OpenAI".
• Given a fixed set of options, it returns a calibrated probability for each, for yes/no, multiple-choice and rating questions and for rubric grading of AI responses and agent actions.
• In Microsoft's 36-benchmark comparison of nearly 150,000 questions kept blind from training, it had the highest accuracy and was the fastest measured: 2.5x quicker than the runner-up H2O-Lightning-4B v1.1 and 35x quicker than GPT-6 Sol at P50.
• The appendix lists the models benchmarked as Quyet-1.0-Large, Surogate Rune 26B-A4B, GPT-6 Luna Decisions, deck-31B, H2O-Lightning-4B and Strands-Decider 2B, and the post says it took several top public models from the JevBench leaderboard.
• An editor's note says the post was updated to add Jev to the accuracy and calibration benchmarks, whose figures appear only in charts.
• Perturbing the same request in eight ways flipped its decision on 1.3% of perturbations on average, with no flips when option descriptions were paraphrased or options reversed or shuffled.
• Safety testing covered 5,250 requests across 11 benchmarks of harmful content, jailbreak attempts and prompt injection.
• Internal tests: Xbox Research sorted more than 10,000 feedback items at quality competitive with GPT-6 Sol, over 14x faster and 200x cheaper, and the Copilot team found it competitive with GPT-5.6 Luna and 100x faster in grading responses.
  • Microsoft Discovery found its rubric grades 46x more consistent than LLM scoring at 3x the speed, making adaptive replanning nearly 4x faster.
• Suggested uses include agent controls (continue, stop, retry or hand off), model routing, applying an agent skill's rules without reprocessing them, AI judging, code scanning, picking the next UI action in computer use, and robotics.

[A] Microsoft Tech Community (Microsoft Foundry Blog) — Introducing Microsoft-Decision-1 in Microsoft Foundry for decision and classification workloads (2026-10-09)

https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/introducing-microsoft-decision-1-in-microsoft-foundry-for-decision-and-classific/4562742

• The model is in public preview, and future iterations will be rebased on OpenAI models and Microsoft's MAI models.
• Its pricing table lists $0.042 per 1M input tokens for both US Datazone and EU Datazone deployments, with output marked N/A.
• It reports the Xbox Research result as quality competitive with GPT-5 at 80–100 times the speed, not the Command Line post's comparison with GPT-6 Sol.
• It asks teams to compare accuracy on ambiguous cases, latency under expected traffic and cost per completed decision, and to validate calibration on their own data.

[A] Microsoft Learn — Deploy and use Microsoft-Decision-1 in Microsoft Foundry (as fetched on 2026-10-13)

https://learn.microsoft.com/azure/foundry/foundry-models/how-to/use-foundry-models-microsoft-decision

• Requests go to <foundry-resource-endpoint>/providers/microsoft/v1/systemone with a state (text or JSON) and a questions map keyed by name, and model is the deployment name, not the model name.
  • The response's answers object uses the same names, and the response also carries token usage and a model field naming the underlying model, such as microsoft-decision-1.
• Question types are noul (a probability, with optional true and false criteria), choice (a criteria map of options, returning the pick and every option's probability) and score (a criteria list from lowest to highest, returning the probability-weighted level index).
• Version 1 deploys as GlobalStandard or, in selected regions, DataZoneStandard, from the portal or with az cognitiveservices account deployment create --model-name "Microsoft-Decision-1" --model-format Microsoft --model-version "1", and calls use Microsoft Entra ID or an api-key header.
• It lists as limitations that scores shift with the wording and order of questions and options, that calibration is strongest on familiar task types, and that the model gives no explanations.
  • It advises: "Prefer scores for relative ordering and thresholds rather than as absolute, calibrated ratings."
• Best practices include an abstention option such as cannot tell, randomized option order, thresholds set from the cost of false positives and false negatives, human review for consequential decisions about people, and coding agents that generate candidate configurations for evaluation against labeled examples.
• The troubleshooting table gives 422 for an unsupported deployment name or question definition and 429 when the deployment's rate limit is exceeded, without stating any limit.

[A] Microsoft Foundry — Microsoft-Decision-1 model catalog entry (as fetched on 2026-10-13)

https://ai.azure.com/catalog/models/Microsoft-Decision-1

• The entry shows version 1, lifecycle Preview, Direct from Azure, text input, JSON output and a 32,768-token context window.
• Training data are publicly available datasets subject to Microsoft's Open Data process, plus synthetic data made by the team.
• Out of scope are text generation, open-ended question answering, conversation, translation, summarization, tasks without a closed question and defined options, and acting as the sole decision-maker on credit, employment, housing, insurance, education, healthcare or legal matters; the model takes no images, audio or video.

[A] Microsoft Tech Community (Educator Developer Blog) — Not Every Decision Needs an LLM: Getting Started with Microsoft-Decision-1 (2026-10-12)

https://techcommunity.microsoft.com/blog/educatordeveloperblog/not-every-decision-needs-an-llm-getting-started-with-microsoft-decision-1/4563468

• A Playground request with one noul and one score question used 86 input and 2 output tokens, about $0.0000036, or more than 275,000 such decisions per dollar.
• Questions in one request are evaluated in parallel, so adding questions barely changes the response time; the question keys are never shown to the model, and a noul answer has no separate confidence field.

[A] OpenRouter — Microsoft: Microsoft-Decision-1 (as fetched on 2026-10-13)

https://openrouter.ai/microsoft/microsoft-decision-1

• OpenRouter lists microsoft/microsoft-decision-1 as released on October 9, 2026, at $0.042 input and $0 output per 1M tokens, with a 32,768-token context and a single provider.
• It runs on OpenRouter's Decisions API rather than the chat endpoint, so chat-completions SDKs do not work with it, and the page showed a P50 latency of 0.29 s and 99.99% availability over three days.

[B] The New Stack — Microsoft skipped OpenAI's decision model and built its own on Alibaba's Qwen, by Amanda Caswell (2026-10-10)

https://thenewstack.io/microsoft-decision-model-foundry/

• Microsoft launched three days after OpenAI opened its Decisions API, built on Qwen3.5-9B rather than its partner's model, at exactly Jev's price, while Kev-4B on OpenRouter costs $0.042, Perplexity charges $0.02 and OpenAI more than double Jev's rate.
• It reads Microsoft's larger opportunity as keeping agent traffic, including the generative calls around each decision, on Foundry, and notes that Microsoft has not said whether the model will make GitHub Copilot's coming choice between on-device and cloud models.
• It flags text-only input, no announced open weights, and no statement of full compatibility with TypeSafe's System One API, although the Foundry sample code calls a /systemone endpoint.
• It cites the JevOut preprint, in which short, natural-sounding additions flipped 312 of Jev's 508 initially correct decisions, 229 of them with at least 70% on the wrong answer, and three other scoring systems flipped at 64.9% to 73.2%; Decision-1 was not tested.

[B] The Register — Microsoft leans on open weight model from Chinese AI lab to challenge Jev, by Thomas Claburn (2026-10-10)

https://www.theregister.com/a/5302473

• It reports Microsoft's chart figures: 2.5x faster than H2O-Lightning-4B and 2.8x faster than Jev in latency, the top accuracy at 83.5% on 36 benchmarks, second on confidence score at 92.2% behind Quyet-1.0-Large, and more than 20x cheaper than GPT-6 Sol on text classification.
• It places the launch among more than 100 decision models, including Snowflake's, Liquid AI's d1, Surogate Rune and H2O-Lightning-4B, and notes that decision models still make errors that adversarial inputs can magnify.

[B] ITmedia AI+ — Microsoft also launches Microsoft-Decision-1, a decision-specialised AI model built on Qwen and priced like Jev (2026-10-12, in Japanese)

https://www.itmedia.co.jp/aiplus/article/2610/12/2000002194/

• Describing Microsoft's comparison chart, it reports Decision-1 first on accuracy and response speed but third on calibration, behind Jev and another model.
• It notes that Microsoft added the Jev comparison on accuracy and calibration after publication, and reports a 32,768-token, text-only model offered on both Foundry and OpenRouter.

[C] Zenn (Headwaters, takekawa tomoki) — Building a quality gate for AI-OCR with Microsoft-Decision-1 (2026-10-12, in Japanese)

https://zenn.dev/headwaters/articles/6e889f79ee9f2e

• The gate passes Document Intelligence's OCR Markdown as state with two questions in one request, a noul named low_quality and a choice named main_issue that includes a no-problem option, and sends documents at 0.5 or above to human review before GPT-5-mini extracts fields.
• On 11 dummy invoices the gate judged 10 correctly, missing a faded fax that scored 0.07, and kept 4 documents away from the LLM.
• Median latency was 395 ms for Decision-1 against 3,312 ms for GPT-5-mini, with the first calls at 700–1,000 ms and later ones around 300 ms.
• With no dedicated SDK yet, the author posts to the endpoint with httpx, reads answers.low_quality.noul and answers.main_issue.choice, and retries 429 responses after retry-after.

[C] TestingCatalog — Microsoft launches Decision-1 model in Foundry (2026-10-09)

https://www.testingcatalog.com/microsoft-launches-decision-1-model-in-foundry/

• Its launch-day account gives the speed lead as 4.5x over a runner-up named Quyet-1.0-Large, where the current post says 2.5x over H2O-Lightning-4B v1.1.
• It says the Foundry catalog confirms general availability and that OpenRouter support was still to come.

[B] Latent Space (AINews) — TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (2026-10-10)

https://www.latent.space/p/ainews-typesafejev-at-100m-arr-75b

• It positions Microsoft-Decision-1 for LLM judges and for screening scientific hypotheses, and relays an early evaluator, @omarsar0, who finds that decision models still struggle with consistency and complex decisions.

[B] laiso — #22 After Jev (2026-10-12, in Japanese)

https://blog.lai.so/2026-10-12/

• It counts Microsoft with OpenAI and Cloudflare among the vendors now offering decision APIs, and notes that the base models have spread beyond Qwen to Liquid's LFM family and BERT-family models.

[C] Hacker News — Microsoft-Decision-1, our model for fast decision-making (from 2026-10-09, 199 points and 66 comments when fetched on 2026-10-13)

https://news.ycombinator.com/item?id=50024913

• Topfi's small suite found it at 0.72x Jev's cost with comparable results but a higher p50 latency, 369 ms against Jev's 283 ms, and called it the first Jev rival he tested that justifies a commercial release.
• Commenters note the Qwen base it shares with Clef and Strands Decider (another commenter announces Gemma4-based Strands Decider variants from 2B to 26B), dispute whether its price competes until someone points out that it equals Jev's, and one user who had deployed it could not find the API shape before the Learn page appeared.

Notes

• The benchmark figures changed when the post was updated.
  • TestingCatalog on 10-09 and Business+IT on 10-10 give 4.5x over Quyet-1.0-Large, while the current post, The Register and ITmedia give 2.5x over H2O-Lightning-4B v1.1, and the editor's note mentions only adding Jev.
  • On calibration, The Register puts the model second at 92.2% behind Quyet-1.0-Large, while ITmedia, writing after the Jev update, puts it third behind Jev and another model; the post's text gives no accuracy or calibration numbers.
• Latency against Jev: Microsoft's chart has it 2.8x faster than Jev (The Register), but Topfi measured 369 ms against Jev's 283 ms; a Japanese team measured a 395 ms median (Zenn) and OpenRouter showed 0.29 s at P50.
• The two Microsoft posts disagree on Xbox Research: competitive with GPT-6 Sol, over 14x faster and 200x cheaper (Command Line), or competitive with GPT-5 at 80–100x the speed (Tech Community).
• Status: public preview in the Tech Community post and Preview in the catalog, against general availability in TestingCatalog's reading of the catalog.
• Distribution: OpenRouter lists the model as released on 10-09 and ITmedia reports it available there, while The Register and TestingCatalog said it was coming soon, so the model is not confined to Foundry.
• Microsoft's own documents temper the calibration claim: the Learn page says calibration is strongest on familiar tasks, that wording and option order can shift scores, and that scores suit relative ordering better than absolute ratings, while the announcement reports no flips on reordered options.
  • Adversarial robustness of the JevOut kind has not been tested on this model.
• API contract: the request follows the System One shape (state, a questions map, noul, choice, score, criteria) at a Microsoft-specific path with Azure authentication and a deployment name as model, and OpenRouter serves it through its own Decisions API.
  • It differs from OpenAI's /v1/decisions schema even though Microsoft plans to rebase on OpenAI models, and Microsoft has not claimed compatibility with TypeSafe's SDKs.
• Regions: the pricing table names only US and EU data zones, and the Learn page warns that GlobalStandard may process requests in any region with higher or more variable latency, which matters for teams in Japan.
• The rebase onto MAI and OpenAI models is "soon" in one post and "future iterations" in the other, with no date and no word on how answers will change, so a deployment should pin version 1.
• Output tokens: the educator post's request used 2 output tokens, which are free, whereas OpenAI's Decisions API reports 0.
• Unverified: an HN commenter says IP from Pi Labs, a startup acquired last year, helped build the model; the Learn page's example deployment name pi-decision-1 fits, but no Microsoft source confirms it.
• Unverified: @omarsar0's evaluation is known only from AINews's summary, and the X post was not opened.
• Rests on WebFetch alone: Business+IT's 10-10 article (https://www.sbbit.jp/article/cont1/187397, could not be saved), whose visible part gives the 4.5x figure over Quyet-1.0-Large and whose analysis is for members only.
• The two Tech Community posts render client-side, so their text was read from the blogs' RSS feeds, which carry the full bodies.
• Attention in Japan: ITmedia AI+ and Business+IT covered the launch, and the Zenn hands-on had 6 likes when fetched.

Ideas for practice and output

• Run one labeled routing or classification set through Decision-1 on Foundry (GlobalStandard) and on OpenRouter, Jev and OpenAI's /v1/decisions, recording p50 and p95 latency from Japan, accuracy, calibration (a reliability diagram with ECE) and cost per 1,000 decisions.
  • This tests Microsoft's 2.8x-faster-than-Jev chart against Topfi's 369 ms and 283 ms.
• Point an existing Jev (System One) client at the Foundry path with an api-key and the deployment name, and list what breaks (authentication, response fields, limits) before treating the contract as portable.
• Re-run each request with shuffled and reversed options and paraphrased descriptions to check the 1.3% flip claim, and add a few JevOut-style misleading context additions for gates that read user text.
• Reproduce the Zenn OCR gate on in-house scanned documents with labels, tuning the threshold so that no unreadable document reaches the LLM, and compare it with OpenAI's Decisions API reading the page images directly, since Decision-1 takes text only.
• For tool-call gating in an Azure-only estate, trial Decision-1 as an Entra ID-authenticated guard in a data zone, noting the preview status and the planned rebase in the design record.
• Output: a comparison table of Jev, OpenAI Decisions, Microsoft-Decision-1, Clef and Strands Decider by API contract, modality, context window, price, data residency and latency measured from Japan.

3. 🗃️ The SQLite team moved vec1, its own approximate-nearest-neighbour vector search extension with IVF indexes, PQ or OPQ quantization and in-index metadata filters in one dependency-free C file, into the SQLite source tree, where version 0.8 ships in the 3.54.0 sources as a separately built loadable extension outside the amalgamation

• Selected / impact 1 / potential 2 / attention 2 / anchor 09-30, before the window / kind: release / areas: agent building.
• Feed items in this topic:
  • zenn-trending 10-11 SQLite 本体にベクトル検索拡張 vec1 がやってきた (vec1, a vector search extension, arrives in SQLite itself) — 109 Zenn likes and 236 Hatena Bookmark users when fetched
• Anchor: vec1 was imported into the SQLite source tree on a branch on 09-30 and merged into trunk on 10-01, and the version-3.54.0 tag of 10-09 carries it at 0.8; nothing announced the move, and mattn's article of 10-11 first brought it to the feeds in this run.
• Scope: a vector index from the SQLite developers changes which store a team can use for retrieval in local, embedded or on-device RAG without a third-party extension such as sqlite-vec.

Collected information

[A] SQLite — Vec1 Vector Extension (2026-10-01)

https://sqlite.org/vec1.html

• vec1 provides approximate nearest-neighbour (ANN) search through SQLite's virtual-table interface, with Euclidean (L2) and cosine distances, in portable C with no external dependencies, using AVX2 on x86 and NEON on ARM.
• Its index is IVFADC (inverted file with asymmetric distance computation) with OPQ (optimized product quantization), and the whole extension is one file, vec1.c.
• This page now sits in the main SQLite documentation, was last updated on 2026-10-01 at 11:21:38Z, the minute of the trunk check-in below, and gives the current release as version 0.8, linking ext/vec1/vec1.c in the SQLite source tree.
• It builds with ./configure && make vec1.so (vec1.dylib on macOS) at the root of the full SQLite source tree, or nmake /F Makefile.msc vec1.dll on Windows, and both produce one binary that picks AVX2 or scalar code for the CPU at run time.
  • Built by hand, e.g. cc -g -O3 -DNDEBUG -mavx2 -mfma vec1.c -shared -fPIC -o vec1.so, an AVX2 binary will not run on x86-64 CPUs without AVX2, and the vec1multi.so target of ext/vec1/Makefile covers several x86-64 levels.
• The roadmap lists possible work without dates: more testing and optimization, a graph-based index as an alternative to IVFADC ("HNSW? DiskANN? Some variant?"), a faster SELECT count(*), SIMD on wasm, int8, int32 or float16 elements besides float32, partition keys, databases from platforms with another float byte order, dot product as a distance and multi-threaded queries.

[A] SQLite — Vec1 User Manual and Vec1 Reference Guide (2026-10-01)

https://sqlite.org/vec1doc.html / https://sqlite.org/vec1ref.html

• CREATE VIRTUAL TABLE t USING vec1(vector, meta1, ...) declares one vector column and 0 to 255 untyped metadata columns, and a query uses the table as a table-valued function, SELECT rowid FROM t(:v, '{K:10}'), with a hidden distance column.
• A vector is a BLOB of 32-bit IEEE floats in machine byte order with finite values only, vec1_from_json() and vec1_to_json() convert JSON arrays, and the dimension is fixed by the first insert or by the model.
• There are three modes: no index (the default, one row per vector), flat (vectors packed in large BLOBs, over twice as fast for exhaustive search) and ANN, which needs a trained model.
  • The manual advises exact (NN) mode when exact results are required, below about 5,000 vectors, or when training data is unavailable or inconvenient.
• An ANN model is the BLOB returned by the aggregate vec1_train(vector, '{nbucket:1024, quantizer:"opq", codesize:32, distance:"cos"}') over a training set, and INSERT INTO t(cmd, arg) VALUES('rebuild', :model) installs it and rebuilds the index, at any time and as often as the data needs.
  • Training and rebuilding use several threads through vec1_config('nthread', N), and a model trained on one host works on another with the same float byte order.
• Recommended settings: nbucket about the square root of the expected row count (1,000 for 1,000,000 vectors), quantizer "opq" for neural-network embeddings, "pq" for engineered descriptors such as SIFT, and "bq" (binary, with a randomized Walsh-Hadamard transform by default) only to minimise training time.
  • codesize is 32 bytes for OPQ (48 or 64 if recall is too low) or 1/8 to 1/16 of the dimensions for PQ and BQ, and a training sample of about 100 × nbucket vectors usually suffices.
• nprobe is the share of buckets a query scans, a fraction below 1.0 or a bucket count from 1.0 up, set per query or per connection with vec1_config('nprobe', ...), with 0.05 as the default.
• ANN distances are computed on the compressed codes and vec1 does not rerank automatically, so the manual has users fetch about 100 candidates and reorder them in SQL with vec1_l2_distance() or vec1_cos_distance() before LIMIT 10.
  • "To be 100% clear, reranking is usually essential for ANN queries with vec1."
• Filtering has two mechanisms: streaming:1, which keeps returning rows in roughly ascending distance past K while SQLite asks for more (for metadata in a joined table), and metadata columns, whose <, >, =, >=, <=, IS, IS NULL and IS NOT NULL constraints run inside the ANN search before the best K are collected.
• A term without a comparison operator, such as WHERE in_stock AND price < 20000, is applied after retrieval and silently leaves fewer than K rows, so the manual writes in_stock = 1; a visible LIMIT can replace K when the query has no join, aggregate or ORDER BY and all WHERE terms run inside the search.
• Limits: K from 0 to 33,554,432 (2^25), nbucket from 2 to 65,536 (0 disables the inverted file), codesize from 0 to 256 bytes (advisory), and vec1_l2_distance() returns the squared Euclidean distance while vec1_cos_distance() returns 0.0 to 2.0 without needing normalised inputs.

[A] SQLite — Vec1 Tests on Publicly Available Data (2026-10-01)

https://sqlite.org/vec1bench.html

• Four public datasets (sift 128d, imagenet-clip 512d, landmark-dino 768d cosine and agnews-mxbai 1024d) were trained and built with 16 threads on an AMD 5950X Linux workstation, throughput is single-threaded, and every run is labelled version 0.7.
• agnews-mxbai-1024-euclidean, 769,382 text embeddings and the closest to a RAG corpus, used {nbucket:1024, quantizer:"opq", codesize:32, residual:0}, with 25.9 s of training on 100,000 samples and a 4.75 s build.
• On it, asking for only the 10 best gives recall@10 of 0.618 to 0.626 for nprobe 16 to 64, while fetching K=100 and reranking gives 0.930 at 2,251 queries per second (nprobe 16) to 0.961 at 1,290 (nprobe 64), and K=300 at nprobe 64 reaches 0.983 at 883.
• The nprobe values in these runs are absolute counts of 16 to 64 of the 1,024 buckets (1.6% to 6.25%), while the default 0.05 scans about 51.

[A] SQLite source tree — check-ins 3a0876d973 and 92709f54d4, main.mk, later ext/vec1 commits and release 3.54.0 (2026-09-30 to 2026-10-10)

https://sqlite.org/src/info/3a0876d973868be7 / https://sqlite.org/src/info/92709f54d4 / https://github.com/sqlite/sqlite/commit/e32fbe0c230c60b77e42672d17520030ff85446f / https://sqlite.org/releaselog/3_54_0.html

• Dan Kennedy imported the vec1 sources into ext/vec1/ on a vec1 branch on 2026-09-30 at 14:49 UTC (check-in 3a0876d973), fixed MSVC and Windows test problems there the same day, and merged the code into trunk as 92709f54d4 on 2026-10-01 at 11:21 UTC.
• The import changed 65 files, 57 of them new, and added 21,637 lines: vec1.c at 12,938 lines, 50 test files with 6,756 lines, and benchmark tools such as vec1bench.tcl and vec1bench_vibe2db.py for the VIBE datasets.
  • The imported vec1.c still defined VEC1_VERSION "0.7".
• main.mk describes the target as "Not part of the amalgamation or any distributed package; built only by explicitly running "make vec1.so"."
  • When configure finds that the compiler accepts -mavx2 -mfma, vec1.c is compiled twice, scalar and AVX2, into one extension that chooses at run time, with -O3 by default.
• Later commits to ext/vec1 raised the string returned by vec1_info() to "0.8" on 10-06 and marked vec1_train() SQLITE_DIRECTONLY on 10-07, because it sometimes prepares and runs SQL statements built from user-supplied arguments.
  • They also fixed an infinite recursion in xSavepoint (10-06), the handling of corrupt metadata arrays (10-09) and rounding errors that could make deletes fail (10-10).
• The version-3.54.0 tag of 2026-10-09 carries ext/vec1/vec1.c with VEC1_VERSION "0.8" and SQLite's public-domain blessing dated 2026-02-04, but the 3.54.0 release notes do not mention vec1.

[A] SQLite — the standalone vec1 repository's page and timeline (as fetched on 2026-10-13)

https://sqlite.org/vec1/doc/trunk/doc/vec1.md / https://sqlite.org/vec1/timeline?n=200&a=2026-08-01&y=ci

• The page that https://sqlite.org/vec1 still serves gives the current release as version 0.7, and the repository's last check-in is from 2026-09-29, the day before the import.
• Its roadmap says no further features are required before a 1.0 release, with one caveat: "Testing is insufficient."
  • Among post-1.0 ideas it also wants an index that keeps IVFADC's advantages without the training requirement, perhaps by quantizing with RaBitQ or TurboQuant, which the new page no longer mentions.
• 37 check-ins from 08-05 to 08-27 answer bug reports filed on 08-04 (1), 08-05 (8) and 08-19 (28), fixing crashes, index corruption, streaming queries that omitted or duplicated rows, and input validation.
  • Examples are a crash when an inserted vector is extremely far from all centroids, crashes on corrupt records through 32-bit integer overflow, vec1_from_json(NULL) crashing, and silent index corruption when an index or metadata blob exceeds SQLITE_LIMIT_LENGTH.
• September's check-ins are mostly speed work on AVX2 and NEON, such as transposed codebooks and multiple accumulators for training, rebuilding and dot products.

[A] SQLite User Forum — "Vec1 version 0.7.", by Dan Kennedy, with a reply by Richard Hipp (2026-07-07, background)

https://sqlite.org/forum/info/a09b103d9d41ed25a357a42aa22ca32a93d4a5fb9b10eb40ab3e14cde508e8f1?t=c

• Dan Kennedy called 0.7 not yet 1.0 but no longer a preview, and said it added a RaBitQ quantizer that needs no training but does not match trained PQ or OPQ.
• He claimed: "Vec1 should at this point be in-the-ballpark competitive with most ANN vector-search implementations for static datasets that can be trained on, or for data for which a representative sample is available to train on."
• He named the next focus as a mode with no training at all, accepting slower writes in exchange for online writes and an index that is always searchable.
• On 08-02 Richard Hipp activated anonymous access and self-registration on the Vec1 Forum and asked for vec1 problems to be reported there, in answer to the memory-safety report below.

[A] APSW — Change History and SQLite extra, by Roger Binns (as fetched on 2026-10-13)

https://rogerbinns.github.io/apsw/changes.html / https://rogerbinns.github.io/apsw/extra.html

• Since 3.52.0.0, the full PyPI builds of APSW, a Python SQLite wrapper, bundle SQLite's extra extensions with vec1 among them, marked experimental and under development, and apsw.sqlite_extra.load(db, "vec1") loads it without a compiler.
• The extras page lists vec1_to_json_f, vec1_to_json_i and the table vec1cat, which the reference does not document; vec1.c defines vec1cat as a catalog with the columns database, name, model and qprofile.

[A] ncruces/go-sqlite3 — Release v0.34.0 and later release notes (2026-04-23 to 2026-09-23)

https://github.com/ncruces/go-sqlite3/releases/tag/v0.34.0 / https://github.com/ncruces/go-sqlite3

• This cgo-free Go driver, which builds SQLite for Wasm and translates it to Go with wasm2go, has offered vec1 as the package github.com/ncruces/go-sqlite3/ext/vec1, enabled per connection with vec1.Register(conn), since v0.34.0 (2026-04-23).
• It moved to Vec1 0.6 in v0.34.4 (06-04) and to 0.7 in v0.35.2 (07-06), and its latest release, v0.35.6 (09-23), predates 0.8.

[A] Alex Garcia — sqlite-vec README, vec0 documentation and releases v0.1.7 to v0.1.10-alpha.4 (2026-03-17 to 2026-05-18)

https://github.com/asg017/sqlite-vec / https://alexgarcia.xyz/sqlite-vec/features/vec0.html / https://github.com/asg017/sqlite-vec/releases/tag/v0.1.10-alpha.1

• sqlite-vec stores float, int8 and binary vectors in vec0 virtual tables queried with MATCH and k = ..., in pure C that also runs in the browser through WASM.
• vec0 filters on up to 16 strictly typed metadata columns (=, !=, >, >=, <, <=), shards on up to 4 partition-key columns (advised only with hundreds of vectors per key value), and returns unindexed + auxiliary columns without a join.
• v0.1.7 (2026-03-17) revived the project after a long hiatus with Mozilla's support and said some old Go and ncruces bindings were paused.
  • ANN indexes (rescore, IVF experimental and not enabled, DiskANN) arrived only in the v0.1.10 alphas from 2026-03-31, after the last stable release, v0.1.9 of the same day, and the latest alpha, v0.1.10-alpha.4 of 2026-05-18, is also the repository's last push.

[C] Zenn (mattn) — vec1, a vector search extension, arrives in SQLite itself (2026-10-11, in Japanese)

https://zenn.dev/mattn/articles/6e9996319ac099

• mattn, who maintains the Go driver go-sqlite3, built vec1 from the source tree with ./configure and make sqlite3 vec1.so, and SELECT vec1_info(); returned version 0.8 (AVX2, multi-threaded).
• He sees the main benefit in plain SQL, joining results with the source tables and filtering them with WHERE, and points out that the L2 distance returned is squared.
• From Go he loads it into his driver with sql.Register("sqlite3_vec1", &sqlite3.SQLiteDriver{Extensions: []string{"/path/to/vec1"}}).
• His demo yomivec finds Japanese words by sound with no language model: about 220,000 IPAdic words become 256-dimensional vectors of hashed 2- to 3-character fragments of a romanised sound key, searched by cosine on a flat index without training or quantization, loaded in about 2 seconds.
  • バナーナ finds バナナ and coffee finds コーヒー and 珈琲, but sound cannot separate meanings, so he would combine it with embedding vectors in practice.
• He advises waiting before production use, since vec1 is pre-1.0, outside the amalgamation and described as insufficiently tested, and expects official vector search to let apps on phones, browsers and desktops find semantically close documents without an external service or dedicated database.

[C] SQLite User Forum — replies to "Vec1 version 0.7." by Lee Butterman and Nuno Cruces (2026-08-02 to 2026-10-12)

https://sqlite.org/forum/info/a09b103d9d41ed25a357a42aa22ca32a93d4a5fb9b10eb40ab3e14cde508e8f1?t=c

• On 08-02 Lee Butterman reported that red-green TDD with a coding agent had found "numerous memory-safety bugs, including over half a dozen directly accessible from SQL", and asked where to report them.
• On 10-11 Nuno Cruces, who compiles vec1 to single-threaded Wasm for his Go driver, welcomed 0.8 in the main repository as part of 3.54.0, asked for an announcement, and reported that this version fails to compile with VEC1_THREADS=0 (an incomplete structure in vec1KMeansInitOne) unless patched.
• He also found that translating the NEON code to Wasm SIMD128 with SIMDe gives a clear speedup until vec1 has Wasm intrinsics, and on 10-12 posted the wrapper (#define VEC1_HAVE_NEON 1, #define VEC1_SIMD_WIDTH 4, clang -msimd128).

[C] SQLite User Forum — vec1-related feedback, by punkish, with replies by Roger Binns and Dan Kennedy (2026-03-19, background)

https://sqlite.org/forum/info/3b73af13a1c4b36929f5413246faa68e2d0968cb8f64db229e14558ded9c9bed

• A RAG builder with about 3.4 million 1 KB chunks from 1.1 million papers, as 768-dimensional nomic-embed-text vectors, could not try vec1 because it needed compiling, reports a sqlite-vec fork failing beyond about 100,000 vectors as its maintainer had warned, and fell back to an FTS5 prefilter, cosine over about 500 papers and the top 8 sent to a local LLM, in a few hundred milliseconds.
• He wants vector search as first-class as FTS5, and Roger Binns pointed him to the vec1 binaries in APSW's wheels while arguing that generating the vectors, with an online service or a half-gigabyte model, is the real obstacle: "Not very Lite when compared to using FTS5."

[C] Hatena Bookmark — comments on mattn's article (2026-10-11 to 2026-10-12, in Japanese)

https://b.hatena.ne.jp/entry/s/zenn.dev/mattn/articles/6e9996319ac099

• 236 users and 21 comments when read on 10-13: several expect it to help self-contained local or simple RAG, one user building a local RAG on SQLite plans to try it, and another remarks that it does not look at contextual distance and is probably slower than a native vector type, so suits small-scale RAG.
• Others note that there is no dimension limit like pgvector's but no 16-bit type like its halfvec, since vectors are plain BLOBs, suggest multilingual models such as multilingual-e5 for Japanese embeddings, and wonder whether SQLite is following DuckDB, which already has vector search.

[C] Hacker News — Vec1: Native vector search (ANN) in SQLite (2026-10-10)

https://news.ycombinator.com/item?id=50030011

• 5 points and one comment linking the video; earlier submissions of the docs (04-23, 5 points; 04-24, 3) and of the 0.7 post (07-07, 3) drew no more, against 314 points for a 2024 post of the sqlite-vec repository.

Notes

• The two documentation sites disagree on the version.
  • sqlite.org/vec1.html (10-01) gives 0.8 for code that reported 0.7 until 10-06, while sqlite.org/vec1 and its benchmark page still give 0.7.
  • The new roadmap drops the old line that no further features are required before 1.0, puts more and better testing first and gives no 1.0 date.
  • No announcement came with the move: the 3.54.0 release notes are silent, and Nuno Cruces asked for one on 10-11.
• "Part of 3.54.0" means the source tree only: the 3.54.0 tag contains ext/vec1/ at 0.8, but main.mk keeps it out of the amalgamation and every distributed package.
  • Applications that use a system, platform or language-bundled SQLite therefore need a separately built vec1.so and an SQLite that permits loading extensions; which platforms permit it was not checked.
  • Prebuilt routes found are APSW's PyPI wheels (Python) and ncruces/go-sqlite3 (Go, at 0.7); whether APSW 3.54.0.0 (10-12) bundles 0.8 was not checked.
• Against sqlite-vec, the differences that matter for local RAG:
  • Index: vec1 has a documented ANN path (IVF with PQ, OPQ or binary codes) beside exact flat search, while sqlite-vec's stable releases have none and its rescore, IVF and DiskANN indexes are in alphas with no release since 05-18.
  • Filtering: both apply metadata constraints inside the search (vec1 up to 255 untyped columns without !=, sqlite-vec up to 16 typed columns), vec1 adds streaming for joined tables, and only sqlite-vec has partition keys (its docs' example shards by user), which vec1 lists on its roadmap.
  • Element types: vec1 stores float32 only and compresses inside the index, while sqlite-vec also stores int8 and binary vectors.
  • Distances: vec1 has L2 and cosine but no dot product; inference, not a source's claim: with normalised embeddings cosine ranks like dot product, so the gap matters mainly for unnormalised ones.
  • Browser: sqlite-vec runs in WASM today, while vec1 compiles to Wasm, as Nuno Cruces does single-threaded, but has no Wasm SIMD yet, for which his SIMDe route is a stopgap.
• Training is the main operating cost for a growing RAG corpus: an ANN model needs a representative sample (about 100 × nbucket vectors) and a retrain and rebuild when the data drifts.
  • Dan Kennedy named a training-free online mode as the next focus in July, but the 10-01 roadmap lists only a graph-based index, without saying whether it would avoid training.
  • The 0.7 post's RaBitQ quantizer does not appear under that name in the docs, which list only "bq", binary quantization with a randomized Walsh-Hadamard transform, so whether "bq" is that quantizer is unconfirmed.
• Recall depends on reranking: on agnews the 10 best by compressed distance hold only about 62% of the true top 10, so a retriever must fetch about 100 candidates and reorder them in SQL, which the manual leaves to the user.
• Footprint is undocumented: no source gives disk or memory per vector; inference, not a source's claim: reranking reads the stored vector column, so the table appears to keep full vectors beside the codes.
• Robustness: the August record backs the old caveat that testing is insufficient, and fixes for corrupt metadata arrays and rounding errors continued in October.
  • Who filed the August reports is not visible without logging in to the vec1 forum, so tying them to Lee Butterman's agent-found bugs rests on timing only.
  • Lee Butterman's count of over half a dozen SQL-reachable memory-safety bugs is his claim; no source confirms the number.
  • SQLITE_DIRECTONLY, per SQLite's function flags, lets a function run only from top-level SQL and not from views, triggers or schema, guarding against database files whose schema was altered to call it.
• mattn dates the start of development to about January from the file header, which reads 2026-02-04; Dan Kennedy's first forum post on vec1 is from 2026-02-26.
• For scale, the agnews run serves about 1,300 to 2,250 reranked queries per second on one desktop CPU thread at 0.93 to 0.96 recall over 770,000 1024-dimensional vectors, well beyond the 100,000 vectors at which the March forum user says a sqlite-vec fork stopped working for him.
• No write-up by Simon Willison (his site search for vec1 returns nothing) or Alex Garcia was found, and English discussion is limited to the SQLite forum and Hacker News posts of at most 5 points.
  • Attention rests on the Japanese venues: 236 Hatena Bookmark users and 111 Zenn likes on 10-13.
• No fact here rests on WebFetch alone; the vec1 forum, https://sqlite.org/vec1/forum, is behind a login and was not read.

Ideas for practice and output

• Load vec1 without compiling (pip install apsw, then apsw.sqlite_extra.load(db, "vec1")) or build vec1.so from the 3.54.0 source, and index the team's own RAG chunks with its usual embedding model, e.g. multilingual-e5 for Japanese, in a flat table and an ANN table (nbucket about √N, quantizer:"opq", codesize:32).
  • Measure recall@10 against the flat table for K of 10, 50 and 100 with SQL reranking and nprobe of 0.02, 0.05 and 0.1, plus latency on a developer laptop, to see whether the agnews figures (0.93 to 0.96 at K=100) hold for Japanese text.
• Run the same corpus at 10,000, 100,000 and 1,000,000 chunks through sqlite-vec v0.1.9 and vec1 and record latency, file size and training and rebuild time, to find where exact search stops being good enough on target devices.
• Test filtered retrieval the way a multi-tenant RAG would use it: a tenant_id metadata column constrained with tenant_id = ? inside the search, the WHERE flag AND ... pitfall that silently shrinks K, and streaming:1 with a JOIN to a documents table.
• Build hybrid retrieval in one SQLite file, merging FTS5 BM25 and vec1 candidates with reciprocal rank fusion in a single SQL statement, and compare it with vector-only retrieval on the team's eval questions.
• Insert new documents after training and track recall over time, to decide how often a growing corpus needs vec1_train() and rebuild.
• For Go services or on-device builds, try ncruces/go-sqlite3's ext/vec1 (cgo-free, at vec1 0.7) and measure what the missing Wasm SIMD costs in throughput.
• Output: a one-page comparison of SQLite vector search for local RAG (vec1 0.8 against sqlite-vec 0.1.9 and its 0.1.10 alphas) covering index type, filtering, element types, distances, distribution channels and maturity, with the team's measured recall and latency.

4. 🛡️ AWS released Strands Box in developer preview, an open-source agent sandbox for Apple-silicon Macs whose Dogwood policies can depend on what the agent did earlier, and a hands-on test on EC2 Mac showed that a host program the policy lets run still reads files the policy forbids

• Selected / impact 1 / potential 2 / attention 2 / anchor 10-07, before the window / kind: release / areas: security and safety, coding agents.
• Feed items in this topic:
  • zenn-trending 10-11 Strands BoxをEC2 Macで実測 — Dogwoodポリシーが効く経路を仕分け (measuring Strands Box on EC2 Mac: sorting out which paths the Dogwood policy covers) — 1 Zenn like and 0 Hatena Bookmark users when fetched
• Anchor: AWS announced the developer preview on its Open Source Blog on 10-07, three days before the window, in a blog that no feed follows; the Zenn test first brought it to the feeds in this run.
• Related: topic 1 of 2026-10-10 (MXC) and topic 3 of 2026-09-29 (Docker Cloud Sandboxes), the containment it is compared with.

Collected information

[A] AWS Open Source Blog — Introducing Strands Box: AI agent sandboxes powered by Dogwood, by Fernando Dingler (2026-10-07)

https://aws.amazon.com/blogs/opensource/introducing-strands-box-ai-agent-sandboxes-powered-by-dogwood/

• Strands Box enters developer preview as an Apache 2.0 sandbox that pairs OS-level containment (Seatbelt on macOS) with Dogwood policies, aimed at coding assistants and other agents that run without human review of each action.
• It embeds the Dogwood Local Engine, which judges each requested action against the policy and the agent's recorded history, and enforces the allow or deny outside the agent.
• Containment fixes what the agent can reach on the host and the network, and policy decides actions inside that boundary at four enforcement points: an egress gateway that proxies all outbound traffic, Strands Shell, Pydantic's Monty for Python, and an MCP broker.
  • The two interpreters and the broker run in Box's own process outside the sandbox, where the agent reaches them as ordinary bash, python3 and MCP commands over a local socket, a trade-off AWS says widens the trusted computing base.
• All enforcement points share one event history and one vocabulary, so a read through either interpreter is fs:read and a request from curl or Python is http:request, which lets one rule block outbound HTTP after a read of customer data whichever tool did it.
  • Strands Shell expands rm -rf build/ into one fs:delete decision per file, so a forbid on fs:delete stops it before anything is removed while ordinary edits pass.
• Paths granted directly in box.toml, such as a project directory that a harness's built-in file tool opens, are bounded by containment alone and never enter the policy history; AWS wants policy to cover more and says it is eager to adopt the Endpoint Security additions in macOS 27.
• AWS passes over a container or microVM for local use because it adds a guest environment to provision and wire to local files and tools, and over harness permission prompts because they run inside the agent's process and judge the tool call, not the files and hosts it touches.
  • The same box.toml and policy.dw apply whichever harness runs in the box.
• The gateway attaches a credential only to a request the policy permits, swapping the agent's placeholder for the secret, with Bearer token, custom header, HTTP Basic, query parameter and AWS SigV4 supported.
  • secret.inject = "always" injects a token without any placeholder, and a credential binding opens no destination by itself.
• Rules use Cedar syntax with the agent as the fixed principal, so they match on actions such as Box::Action::"shell:spawn" or Box::Action::"http:request" and read the host, port, method, path or program path from context.input.
  • AWS also released the authoring-box-policy agent skill, expecting most users to have an LLM write their policies.
• The temporal example caps Slack POST /api/chat.postMessage at three per 10 minutes with formerly within 10m and count for (t: Timepoint) over ::response events with output.status: 200, so refusals do not count, whereas binding ::request would count attempts.
  • A refused post gets HTTP 403 with policy denied this operation, the rule's @id and its @description, so the agent can wait instead of retrying.
• Next steps: other operating systems, a CLI that detects installed harnesses and generates box.toml with a baseline policy, packaging agents built with the Strands Harness SDK, LangChain or the Claude Agent SDK together with Box for Amazon Bedrock AgentCore, ECS or Kubernetes, and liveness rules in Dogwood.

[A] Strands Agents — Strands Box: The Big Picture, by Marc Brooker (2026-10-07)

https://strandsagents.com/blog/strands-box-the-big-picture/

• Brooker places Box after AgentCore Runtime (a Firecracker microVM per session), AgentCore Policy (Cedar), Dogwood and the Dogwood Local Engine, and says Box's policy is the same underlying technology as AgentCore Policy.
• Box uses the kernel sandbox not to apply policy but to funnel every interaction to a user-space policy layer that is the only way out, which allows system-, protocol- and language-aware rules.
  • He argues that a microVM's device boundary sees mostly TLS ciphertext and disk offsets, that syscall filtering sees files and connections but not inside TLS, and that gVisor-style emulation still falls short of MCP-level meaning.
• His examples allow git push only after a successful npm test with no git add since, within 15 minutes, and cap the AWS MCP server at 60 tools/call requests per hour.
  • He concedes such policies are hard to read and write, calls that a major investment area for the coming months, and says frontier coding agents already read and write Dogwood well.
• He admits Box trusts more code, interpreters and protocol interceptors written in Rust and fuzzed, and that "more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy."
  • For multi-tenant cloud deployments he recommends pairing Box with a dedicated per-session microVM, most easily inside AgentCore Runtime, or on EC2, Lambda or Fargate.

[A] strands-agents/box — README, security model, policy guide, limitations and the v0.1.0 release (2026-10-07)

https://github.com/strands-agents/box / https://github.com/strands-agents/box/blob/v0.1.0/docs/user/security.md / https://github.com/strands-agents/box/blob/v0.1.0/docs/design/limitations.md

• The Rust repository, created on 2026-10-02 under Apache 2.0, had 371 stars and 18 forks on 10-13, and v0.1.0 (published on 10-07 at 17:24 UTC) ships only box-v0.1.0-aarch64-apple-darwin.tar.gz, which download.sh checks against SHA256SUMS.txt.
  • The repository description says Linux support is planned.
• The getting-started path needs an Apple-silicon Mac on macOS 15 or later, Node.js 22.21 or later from Homebrew, and Claude Opus 5 on Amazon Bedrock in us-west-2.
• security.md splits two tiers: box.toml sets what the workload's own processes can open, enforced by the OS from before the first process with no policy decision and nothing in the decision log, and policy.dw decides each request sent through the box's trusted process.
  • For a [tool.<name>] program, or a host program admitted by a shell:spawn permit, policy decides only whether it runs, and none of its file operations or child processes.
• Box always refuses requests into the box directory and reads or changes of the loaded box.toml and policy.dw, but cloud metadata protection is only two forbid rules, metadata_hosts and metadata_addresses, that each policy must carry because the gateway has no built-in block.
  • The repository's example policies carry both, while the getting-started policy omits them and security.md asks operators to add them.
• Documented limitations include that a fs:read permit without a path condition reaches ~/.aws and ~/.ssh, that overlapping permits load without a warning, and that a ::response budget can be overspent by requests in flight while a ::request budget is exact but spent by refused attempts.
  • A rule that calls a temporal macro such as count_within loses its count when any text before the call changes, even a comment, whereas an inline when temporal clause keeps it.
  • The decision log records the rule and the path but not the operation, so a cat and an ls of one file look the same.
• A denial reads policy denied this operation on '<path>' [policy: <id>]: <description> and reaches each caller differently: exit status 126 for a refused shell command, PermissionError in Python, HTTP 403 for a request, and JSON-RPC error -32001 for an MCP call.
• The vocabulary has ten actions, fs:read, fs:write, fs:delete, fs:move, a reserved fs:other, net:connect, http:request, shell:exec, shell:spawn and mcp:call, plus one generated per discovered MCP tool, and each outbound call needs both a net:connect and an http:request permit.
  • Filesystem responses carry an output.result of completed, descriptor_issued or indeterminate, and the policy crate README says descriptor_issued is kept distinct on purpose because the bytes move after the admitted call, so a rule counting completed writes excludes it.
• Decisions go to <box_dir>/private/telemetry/records.jsonl as OTLP JSON that is neither signed nor chained, and a record is lost without notice when a target fails.
• limitations.md says Box provides no resource limits, no isolation between tenants, no protection from kernel exploits, no containment of remote MCP servers or of defects in its own trusted process, and no tamper-proof audit trail.
• The policy guide's write-budget example, at most 20 completed content writes per hour, shows a tee write refused under write_budget, and the text is unchanged on main as of 10-13.

[A] strands-agents/box — Claude Code and Codex CLI tutorials, and the getting-started guide (2026-10-07, at tag v0.1.0)

https://github.com/strands-agents/box/blob/v0.1.0/docs/user/tutorials/claude-code.md / https://github.com/strands-agents/box/blob/v0.1.0/docs/user/tutorials/codex-cli.md / https://strandsagents.com/docs/user-guide/box/getting-started/

• v0.1.0 ships worked examples for Claude Code, Codex CLI, Pi, the Strands CLI and a Strands Agents SDK agent, and warns that the action vocabulary and context fields may change before 1.0.0.
• The Claude Code example runs 2.1.292 with --dangerously-skip-permissions on Bedrock (CLAUDE_CODE_USE_BEDROCK=1, ANTHROPIC_MODEL=global.anthropic.claude-opus-5) and gives the project only a list grant, so Read, Write and Edit fail with EPERM and every file goes through the Bash tool to the box's shell.
  • In the tutorial's runs Claude Code switched to cat and printf on its own and quoted the no_env and no_deletes denials.
  • Box relays Claude Code's OpenTelemetry spans, logs and metrics into the same records file, and CLAUDE_CODE_PROPAGATE_TRACEPARENT=1 ties each decision to the tool span that caused it.
• The Codex CLI 0.160.1 example needs sandbox_mode = "danger-full-access" and approval_policy = "never", because Codex's own sandbox helper cannot start inside a box, plus an AGENTS.md that tells it to edit through the shell, because apply_patch writes from Codex's own process and gets Operation not permitted.
  • It runs openai.gpt-5.6-terra on Bedrock through https://bedrock-mantle.us-west-2.api.aws/openai/v1.
• The Strands CLI guide loads a Node preload file so that the AWS SDK's calls go through the gateway, and forces HTTP/1.1 because the SDK's HTTP/2 Bedrock calls ignore the proxy settings.
  • The box's shell has cat, printf, ls and about thirty other built-in commands, and any other program is a shell:spawn that the policy must permit.

[A] AWS Open Source Blog — Introducing the Dogwood Local Engine: temporal governance for agent actions (2026-09-30)

https://aws.amazon.com/blogs/opensource/introducing-the-dogwood-local-engine-temporal-governance-for-agent-actions/

• The engine Box embeds is an Apache 2.0 Rust library that orders concurrent events, writes each one to a redb log with periodic snapshots so that history survives a crash, and leaves isolation to the enforcement layer, which must keep the agent away from the engine's state.
• A policy changed mid-session judges only events recorded after the change, so a precondition met before it must be met again.
• On one server-class host with 360 events per hour, a 24-hour window reached 6 ms per decision after a 12-hour session, 300 times the cost of a 15-minute window, and a fine-grained action schema evaluated about five times faster than a coarse one.

[A] AWS Open Source Blog — Introducing Dogwood: runtime verification for AI agents (2026-08-06), with the Dogwood Guide

https://aws.amazon.com/blogs/opensource/introducing-dogwood-runtime-verification-for-ai-agents/ / https://dogwood-policy.github.io/dogwood/

• Dogwood (Apache 2.0) extends Cedar, so any syntactically valid Cedar policy is valid Dogwood, and adds when temporal { … } clauses drawn from Metric First-Order Temporal Logic (MFOTL), with operators such as formerly, previous, since, exists, tp, count and sum.
• AWS added Dogwood support to AgentCore Policy at the same time, but notes that temporal conditions fall outside Cedar's automated-reasoning analysis and need stateful tracking whose cost can grow with the event log.
• The guide's dogwood CLI (validate, replay, lower, check-parse) checks a policy or replays it over a trace file with no Rust code.

[C] Zenn (kashiwabaray) — Measuring Strands Box on EC2 Mac: sorting out which paths the Dogwood policy covers, by Yutaka Kashiwabara (2026-10-11, in Japanese)

https://zenn.dev/kashiwabaray/articles/fc2d097da71f30

• The author ran v0.1.0 (strands-box 0.1.0, docs at tag 81d241f) on an EC2 mac2.metal (Apple M1, macOS 26.7) in us-east-1b with Bedrock in us-west-2, sending fixed commands through a probe that calls zsh -c, which Box aliases to Strands Shell, with the project only under a list grant.
  • Each case ran once, mac2.metal cost $0.65 per hour with a 24-hour minimum ($15.60), and us-west-2 returned InsufficientHostCapacity in all four AZs.
• The agent's own open('README.md') got PermissionError: [Errno 1] Operation not permitted from Seatbelt with nothing in the decision log, while cat .env in Strands Shell (exit 1) and open('.env') in Monty were refused by the same no_env rule.
  • The shell:exec record redacted cat ~/.aws/credentials to cat <redacted>, but the fs:read deny that followed kept the path.
• With /usr/bin/awk admitted by shell:spawn and given read on the project under [tool.awk], awk 1 .env printed the dummy DB_PASSWORD despite the no_env forbid and logged no fs:read on .env; only a deny entry in [tool.awk.filesystem] stopped it (awk: can't open file .env, exit 2).
• The agent process saw a 76-character placeholder starting strands_box_5f in place of the Bedrock key, and echo $AWS_BEARER_TOKEN_BEDROCK in Strands Shell printed an empty string.
• Strands Shell's built-in curl never reached 169.254.169.254 whatever the policy said and logged nothing, but the host's /usr/bin/curl, going through the gateway, fetched the instance ID and an IMDSv2 token once the two metadata forbid rules were taken out of an allow-all policy (HttpTokens=optional, no instance profile).
  • When the rules refused it, the host curl still exited 0 and printed the 403 body, so a script that checks exit codes needs --fail or --fail-with-body.
• A rule forbidding http:request to example.com within 10 minutes of an fs:read::response on secret.txt let the connection through and refused the request with curl: http:request gate: policy denied this operation on 'example.com:443/' [policy: no_send_after_secret].
• The policy guide's write budget, counting fs:write::response with result completed, never counted Strands Shell >> or tee -a writes (five of five permitted), because v0.1.0 records them as descriptor_issued, while Monty's writes were completed and refused from the fourth.
  • Dropping the result condition refused shell writes from the fourth, and counting ::request refused them from the third, one fewer than the cap of 3.
  • The count survived a restart and a comment appended to policy.dw, reset once the 10-minute window had passed, and is stored in <box_dir>/private/dogwood.redb.
  • While testing writes, the author found that Strands Shell reads echo 1 >> notes/log.txt as echo 1>>notes/log.txt, a redirect of descriptor 1, unlike zsh.
• Twenty true commands through Strands Shell took a median of 11.4 ms (9.5 to 58.0 ms, the maximum on the first call) against 2.7 ms (2.5 to 4.1 ms) for the host's /bin/zsh, about 9 ms more per command, and a whole box run took 0.5 to 1.4 s.
• A Strands Agents SDK agent (1.59.0, global.anthropic.claude-opus-5) quoted each denial with its rule and description and stopped, which the author credits partly to the example's system prompt telling it to quote and stop, not to policy alone.
• The author concludes that Box pays off most where an agent's work can be funneled through Strands Shell and Monty, and that with many host programs the [tool.<name>] tables, not the policy, decide how safe it is.

[B] The Register — AWS launches open-source AI agent sandbox to prevent YOLO mode disasters, by Brandon Vigliarolo (2026-10-07)

https://www.theregister.com/a/5301687

• Marc Brooker told The Register by email that Box enforces the configured policies deterministically and "the agent can't talk its way around these rules", but that developers still decide what access to grant and where human review is needed.
• AWS said Linux support is in development and a Windows client is under consideration, with no release date for either.

[B] InfoWorld — AWS takes aim at runaway AI agent behavior with Strands Box, by Prasanth Aby Thomas (2026-10-08), republished by CSO Online the same day

https://www.infoworld.com/article/4232439/aws-takes-aim-at-runaway-ai-agent-behavior-with-strands-box.html / https://www.csoonline.com/article/4232446/aws-takes-aim-at-runaway-ai-agent-behavior-with-strands-box-2.html

• The article frames the design as OS isolation instead of a dedicated VM, paid for with a larger body of code that must be trusted to enforce policy.
• Pareekh Jain (Pareekh Consulting) says Box fills a real gap with technologies that are not new, its gain being consistent enforcement across agent frameworks, and warns of processing overhead and of new components that may carry their own flaws.
  • "It cannot prevent every harmful decision an agent makes within its allowed permissions," he adds, so IAM, monitoring and human oversight stay necessary.
• Tulika Sheel (Kadence International) warns that poor policies can block legitimate work or leave gaps, and that enterprises will want evidence of reliable production behavior before adopting it widely.
• AWS gave the outlet no timeline for platforms beyond macOS or for deployments to AgentCore, ECS and Kubernetes.

[B] AWS Builder Center — Strands Box on AWS Lambda MicroVMs: a kernel per agent, a policy per command, and a fleet to run them with microvm-ctl, by Vivek Raja P S (2026-10-07)

https://builder.aws.com/content/3KNzMek3U1WL6S49viNEhHeFZmC/strands-box-on-aws-lambda-microvms-a-kernel-per-agent-a-policy-per-command-and-a-fleet-to-run-them-with-microvm-ctl

• An AWS AI Hero built Box from source for aarch64 Linux, whose backend uses namespaces and a syscall filter on ARM64 only, and ran it in Lambda MicroVMs, which needed additionalOsCapabilities: ["ALL"] so that Box could mount a fresh /proc.
  • A default Docker container refused unshare(CLONE_NEWUSER), and Box ran there only with seccomp=unconfined and systempaths=unconfined.
• In us-east-1 a box with five tool calls and 26 decisions took 83 ms inside a warm 1 GB VM, one VM (2 vCPUs) topped out at about 22.7 boxes per second from four concurrent boxes, and 64 of 64 boxes across 8 VMs were correct, with the same no_env and no_deletes verdicts as on macOS.
• On Linux a list grant cannot be expressed (the suggested read lets the agent open .env with no decision), a venv with compiled wheels must sit under exec, and aws:// signs only with a profile's static keys, so a workload with an IAM role mints a Bedrock bearer key per task for an env:// route.
• His split of duties is Box alone for one agent on a laptop, and one microVM per user or session with Box inside for cloud agents, the VM deciding what an agent can break and Box what it may do.

[C] strands-agents/box issues — #10, #18, #33, #36, #38, #39 and #49 (2026-10-07 to 2026-10-11)

https://github.com/strands-agents/box/issues

• The release workflow builds Linux tarballs for aarch64 and x86_64 but publishes only the macOS one, a maintainer said Linux was held back because it is less developed than macOS (#18), and a Linux plan of five epics was filed on 10-09 (#10).
  • The Ubuntu 22.04 build needs GLIBC_2.35, so it does not start on Amazon Linux 2023, which ships glibc 2.34 (#49).
• A team running Claude Code in Box on Linux ARM64 in an AgentCore container reported that the brokered Shell lacks the env:// placeholder the agent process gets (#39), and Fernando Dingler replied on 10-11 that Box should supply it.
• Asked to log Seatbelt and seccomp refusals (#33), Dingler replied that the team plans to send some system calls, file-system calls first, through the policy engine; he has also proposed Policy Packs, which would let users extend the action vocabulary (#38).
• The socket alias closes every descriptor up to RLIMIT_NOFILE before each mediated shell or Python command, which took 12.6 ms at a limit of 65,536 and 208.97 s at 1,073,741,816 on Linux x86_64, against 602 ns for one close_range call (#36).

[C] Hacker News — three Strands Box submissions (2026-10-07 to 2026-10-08)

https://news.ycombinator.com/item?id=49997144 / https://news.ycombinator.com/item?id=50006827 / https://news.ycombinator.com/item?id=50007576

• Two submissions of Brooker's post drew 7 and 5 points and one of the repository drew 4, none with a comment, according to the Hacker News search API on 10-13.

Notes

• CSO Online's article is the InfoWorld piece republished, so it counts as one write-up: the independent coverage is The Register and InfoWorld in established media plus builder.aws.com from a practitioner, and searches on 10-13 found no Japanese media coverage beyond the Zenn test.
• Write budget: policy.md shows its example refusing a tee write, but the rule counts only completed results, Strands Shell writes are recorded as descriptor_issued (which the policy crate excludes from completed writes on purpose), and the Zenn test saw five of five shell writes permitted; no issue reported this by 10-13.
  • Zenn's further claim that policy.md's ::request variant, left at >= 20, would admit only 19 writes is extrapolated from a cap of 3 and was not tested.
  • Brooker's 60-calls-per-hour MCP example has the same ::request and >= 60 shape, so it may admit 59, which is equally untested.
• AWS credentials: the blog's on-call example has the gateway sign with temporary session credentials from the host's oncall profile, but the v0.1.0 egress and credentials docs say an aws:// route signs with the profile's static access keys and refuses credential_process profiles, and builder.aws.com hit the same limit; whether a profile that holds a session token works is not documented.
• The blog's policy snippets permit only http:request, while actions.md requires both a net:connect and an http:request permit for each outbound call, so copied alone they would be refused at connect by the documented rule (untested); the blog points to the getting-started guide for a runnable setup.
• Placeholders in the shell: the empty variable Zenn saw in Strands Shell matches #39, which a maintainer accepted as something Box should supply, so under v0.1.0 a shell command that sends a token from an env:// variable sends nothing, while a route with secret.inject = "always" should not need the placeholder (inferred from the blog, untested).
• Metadata: the blog's on-call policy permits only named hosts, so IMDS stays refused by default deny; the reach Zenn measured needs a broad destination permit without the two metadata rules, which the getting-started policy does not include.
• Coding agents: in the tutorials, Claude Code's Read, Write and Edit and Codex's apply_patch either reach the project through a box.toml grant with no decision and no log, or are cut off so that edits go through the shell; no source measured how shell-only editing affects real coding tasks, and the maintainers point to system-call mediation (#33) and macOS 27 Endpoint Security to close the gap.
• Overhead figures measure different things: Zenn's about 9 ms per command on an M1 under macOS, builder.aws.com's 83 ms per five-call box in a Linux microVM, and #36's 12.6 ms descriptor-closing loop per command at a 65,536 limit on Linux; whether that loop explains part of the macOS figure is untested.
• builder.aws.com's numbers come from a source build that the maintainers deliberately left unreleased, so they show feasibility, not a supported setup; its author lists box among the Strands projects he contributes to, so the write-up is not fully independent, and the page is dated 10-07 while its numbers are dated 10-08.
• Against earlier topics: MXC (topic 1 of 2026-10-10) also contains agents with Seatbelt on macOS, but its Seatbelt backend allows only all-or-nothing outbound traffic and leaves hostname rules to a caller-managed proxy, whereas Box ships a gateway that judges host, method and path with history yet governs only what passes through its shell, Python, gateway and MCP broker.
• Docker Cloud Sandboxes (topic 3 of 2026-09-29) gives each agent a microVM and injects secrets per request through a proxy, the same placeholder-and-proxy pattern as Box's gateway; Brooker treats such VM boundaries as a complement, recommending a per-session microVM around Box for multi-tenant cloud use.
• Engagement on 10-13: the Zenn test had 1 like and no Hatena Bookmark users, and the AWS post had 1 Hatena Bookmark user.
• No fact in this section rests on WebFetch alone.

Ideas for practice and output

• On an Apple-silicon Mac with macOS 15 or later and Bedrock access, run the v0.1.0 examples/claude-code box on a small real repository for an afternoon, counting how often Claude Code falls back from its file tools to the shell and whether multi-line edits through printf or sed hold up.
• Repeat the three Zenn checks that decide a team policy, reading where permit turns to deny in records.jsonl: a shell:spawn host program opening a forbidden file, a read-then-send rule narrowed with input.operation: Box::FsReadOperation::"read_content" (which Zenn did not test), and a write budget that counts descriptor_issued.
• Replay temporal rules such as a git push gate or an MCP call budget with the dogwood CLI on a recorded trace before putting them in a box, and compare ::request with ::response counting under parallel tool calls, which no source measured.
• Without a Mac at hand, an EC2 mac2.metal costs at least $15.60 for its 24-hour minimum, and Zenn finished in about 1 hour 10 minutes by preparing every box.toml, policy and probe before allocating the host.
• A one-page team note could map where each control sits for the coding agents in use: harness permission rules inside the agent, Box policy outside it for the shell, Python, gateway and MCP, OS containment such as MXC, and microVM sandboxes such as Docker's, with what each one logs.
• Reporting the write_budget example's tee output upstream would be a small, useful contribution, since no issue covered it on 10-13.

5. ✈️ An engineer traced aviation's rules on automation, from the FAA's SAFO 13002 and 17007 and EASA's bulletin to evidence-based training, and argued that engineers working with AI coding agents should keep the ability to take over from them rather than to write without them, reading high-risk diffs by hand instead of meeting quotas and drilling on their own incidents

• Selected / impact 1 / potential 1 / attention 2 / anchor 10-05, before the window / kind: analysis / areas: coding agents.
• Feed items in this topic:
  • hatena-ai-agent 10-11 オートパイロットは外せる人間を前提にしている — AI時代のエンジニア技能維持を航空業界に学ぶ (autopilot assumes a human who can disengage it: what aviation teaches about keeping engineering skills in the AI era) — 159 Hatena Bookmark users and 80 Zenn likes when fetched
• Anchor: the essay was published on Zenn on 10-05, five days before the window, and reached the feed, which lists entries with 100 or more Hatena Bookmark users, on 10-11.

Collected information

[A] shimitaro (Zenn) — Autopilot assumes a human who can disengage it: what aviation teaches about keeping engineering skills in the AI era (2026-10-05, in Japanese)

https://zenn.dev/shimitaro/articles/eb45d8d63c7bd1

• Published at 17:06 JST on 2026-10-05 as an "idea" article with the Zenn topics AI, AWS and SRE, according to the Zenn API; it is the author's only Zenn article.
  • At 10:23 JST on 2026-10-13 it had 80 likes, 20 bookmarks and no comments, and the author's article list showed 82 likes at 10:47 JST.
  • It closes by announcing a follow-up on putting the drills into a team's routine, which had not been published by then.
• The trigger: in a flow where one agent implements, another reviews and writes tests, and the author skims the diff and merges, he stalled before approving a CDK diff that sat unread under an AI review saying there was no problem.
• He accepts rising abstraction (assembly to C, to Java or Python, to frameworks) and names the one difference: a compiler is deterministic and framework bugs are shared, while an agent's output changes on every run and is plausibly, confidently wrong, a lower layer that sometimes fails silently.
• His thesis is that aviation regulators maintain the ability to take over from automation rather than to fly without it, so engineers should keep the ability to take over from AI rather than to write without it.
• He builds the case on FAA SAFO 13002 (2013-01-04), the FAA final rule 78 FR 67800 (2013-11-12), the PARC/CAST report on flight path management systems (2013), CAST SE-30 (2008), SAFO 17007 (2017-05-04), FAA AC 120-123 (2022-11-21), EASA SIB 2013-05R1, and evidence-based training (EBT) in ICAO Doc 9995, EASA NPA 2018-07 and Opinion 08/2019.
• A Mermaid diagram maps aviation's loop (use the autopilot, monitor it, recognise an anomaly, disengage, take over, recover) onto AI development (let the AI implement, monitor its output, recognise a wrong implementation or judgement, switch from AI to human, read the code to find the cause, fix and recover).
  • A table pairs the autopilot with the coding agent, the flight plan with requirements and design, mode awareness with understanding what the AI is doing, the simulator (FSTD) with drills in failure analysis and review, and EBT with the path from incident to postmortem to drill material.
• Proposed drills: find dangerous settings planted in Terraform or CDK, list IAM over-permissions such as "Action": "*" or an unneeded "Resource": "*", root-cause an ALB returning 502 from the access logs and target settings, find problems in code the AI judged fine, stop an IaC change that leads to deleting a database, imagine failures that slip past AI-written tests, and verify a wrong fix the AI proposed.
• Worked example: in a stack definition shared by production and staging, an AI-approved two-line diff on an rds.DatabaseInstance changes removalPolicy from cdk.RemovalPolicy.RETAIN to DESTROY and deletionProtection from true to false.
  • The expected answer blocks it for production: removalPolicy sets both CloudFormation's DeletionPolicy and UpdateReplacePolicy, so a stack deletion or any replacement (the new instance is created before the old one is deleted) would delete the production database, with no deletion protection left to stop it.
• For daily work he rejects uniform rules such as reading a set number of lines a day, mirroring SAFO 17007's advice against quotas, in favour of deliberately reading by hand only the high-risk diffs (IAM policy changes, IaC that can delete data, network configuration), even after the AI review has passed them.
• From EBT he takes a loop: anonymise the code or configuration behind a production incident, rebuild it in a small reproduction environment and drill it regularly as a team, with no pass or fail, because grading makes exercises easier and reports more guarded.
  • AI-era material, such as wrong fixes the AI proposed, diffs its review missed and failures its tests let through, becomes training for automation surprise.
• Limits he concedes: most software failures can be rolled back and no regulation mandates training, one engineer may watch several agents and repositories, and manual flying leans on motor skill while root-causing code is cognitive.
  • He argues that AI errors in software are almost all silent, without the alarms a cockpit gives, so recognising the anomaly is the hardest step and drills should centre on finding problems in what the AI calls fine.
• With the agent as pilot flying (PF), the human becomes pilot monitoring (PM), but an aviation PM is trained to fly as PF, so implementation skill cannot drop to zero.

[A] FAA — SAFO 17007, Manual Flight Operations Proficiency (2017-05-04, background)

https://www.faa.gov/sites/faa.gov/files/other_visit/aviation_industry/airline_operators/airline_safety/SAFO17007.pdf

• It asks air carriers for training and line-operations policies that develop and maintain manual flight proficiency, based on recommendations of the Flight Path Management Workgroup of the Air Carrier Training Aviation Rulemaking Committee.
• Curricula should follow the philosophy that "manual flight is the foundation upon which other technical flying skills are built", while recognising that manual flight involves more than motor skills.
  • Its list of foundational knowledge spans motor and cognitive areas, down to the instrument display changes that come with each change of automation level.
• Training scenarios include all approved combinations of flight director, autopilot and autothrottle for the aircraft's equipment (five are listed, among them FD on, AP off, AT on and all three off), and workload management for both PF and PM.
• In line operations the pilot in command decides case by case, weighing threats such as weather, terrain, time of day, crew experience, traffic density and the aircraft's condition.
  • Policies should avoid blanket rules, such as never flying manually at night, and quotas for manual flying unless based on scientific evidence, its example being at least 10 hours a month.

[A] FAA — SAFO 13002, Manual Flight Operations (2013-01-04, background)

https://www.faa.gov/sites/faa.gov/files/other_visit/aviation_industry/airline_operators/airline_safety/SAFO13002.pdf

• Its trigger was an analysis of flight operations data, covering normal operations, incidents and accidents, that found an increase in manual handling errors.
• Continuous use of autoflight systems does not reinforce manual skills and could degrade the ability to recover quickly from an undesired state, so operators should emphasise manual flight in both line operations and training.
• It places manual practice in low-workload conditions and non-RVSM airspace, and the automation in high-workload conditions and procedures that require the autopilot.

[A] EASA — Safety Information Bulletin 2013-05R1, Manual Flight Training and Operations (2025-06-23, background)

https://ad.easa.europa.eu/blob/EASA_SIB_2013_05_R1.pdf/SIB_2013-05R1_1

• Issued on 23 June 2025, it revises SIB 2013-05 of 23 April 2013, is information only, and confirms the essay's reading that automation has contributed substantially to safety while its continuous use does not maintain manual flying skills.
• It confirms the FAA–EASA contrast the essay cites: "while the FAA AC suggests the possibility of extensive manual flight during normal operations, EASA believes that a careful assessment should be performed in establishing the conditions under which manual flying skills can be trained/exercised in CAT operations."
• Operators' policies in Europe range from full automation except take-off and landing to disconnecting it whenever possible below a set altitude, and EASA asks operators to watch deviations through SMS and FDM and to tailor training to that data in line with EBT.

[A] FAA — Advisory Circular 120-123, Flightpath Management (2022-11-21, background)

https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_120-123.pdf

• Guidance for Part 121 and 135 operators and Part 142 training centres on flightpath management, covering manual flight operations, managing automated systems, pilot monitoring and energy management.
• Each pilot is responsible for being fully capable of flying the aircraft manually, and the pilots not flying should always be ready and able to intervene, which is the essay's PF and PM point in the FAA's own terms.
• It restates SAFO 17007's line-operations guidance, now allowing a manual-flying quota only on validated scientific evidence.

[A] Casner, Geven, Recker and Schooler (Human Factors) — The Retention of Manual Flying Skills in the Automated Cockpit (December 2014, background)

https://gwern.net/doc/technology/2014-casner.pdf

• The NASA Ames-led study that SAFO 17007 lists as related guidance (DOI 10.1177/0018720814535628) had 16 airline pilots fly routine and non-routine scenarios in a Boeing 747-400 simulator at varied levels of automation.
• Instrument scanning and manual control were mostly intact even when rarely practised, but the cognitive tasks of manual flight, such as tracking position without the map display, deciding the next navigation steps and recognising instrument failures, showed more frequent and significant problems.
  • With a faulty altimeter, 75% of pilots followed it until they were more than 300 feet off the assigned altitude, and only 69% and 63% cross-checked the other altimeters and heading indicators.
• Pilots spent 20.0% of the time in task-unrelated thought under autoflight, against 11.7% under manual control and 6.9% with raw data and manual control, and those whose thoughts drifted more made more navigation errors (r = .56, about 30% of the variability).
  • The authors conclude that retaining the cognitive skills "may depend on the degree to which pilots remain actively engaged in supervising the automation".

[A] Anthropic — How AI assistance impacts the formation of coding skills, by Judy Hanwen Shen and Alex Tamkin (2026-01-29, background)

https://www.anthropic.com/research/AI-assistance-coding-skills

• In a randomized controlled trial, 52 mostly junior engineers (weekly Python users for over a year, new to the Trio library) built two features with or without an AI assistant in the sidebar of an online coding platform.
  • The AI group averaged 50% on the quiz that followed against 67% for hand coders (Cohen's d = 0.738, p = 0.01), with the largest gap on debugging questions, and finished about two minutes faster, a difference that was not significant.
• Low scorers (below 40%) delegated the code (n = 4), slid into progressive reliance (n = 4) or had the AI debug for them (n = 4), while high scorers (65% or more) asked follow-up questions after generating code (n = 2), requested explanations with the code (n = 3) or asked only conceptual questions (n = 7), an association the authors do not call causal.
• A footnote says the setup differs from agentic products such as Claude Code, whose effect on skill development the authors expect to be "more pronounced", and the quiz came minutes after the task, so long-term retention was not measured.
• It asks managers for intentional design choices that keep engineers learning and points to learning modes such as Claude Code's Learning and Explanatory output styles and ChatGPT Study Mode; the paper is arXiv 2601.20245.

[A] FAA (Federal Register) — Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers, final rule, 78 FR 67800 (2013-11-12, background)

https://www.govinfo.gov/content/pkg/FR-2013-11-12/html/2013-26845.htm

• Confirms the essay: under Public Law 111-216 it added manual handling maneuvers (slow flight, loss of reliable airspeed, manually controlled departures and arrivals) and stall, upset and bounced-landing recovery to Part 121 training, together with pilot monitoring training, effective March 12, 2014.

[A] PARC/CAST Flight Deck Automation Working Group — Operational Use of Flight Path Management Systems, final report (2013-09-08, background)

https://www.faa.gov/sites/faa.gov/files/aircraft/air_cert/design_approvals/human_factors/OUFPMS_Report.pdf

• Confirms the essay's wording, that policies favouring automation may erode manual flying skills and lead to over-reliance on automation, and its two recommendations: a clearly stated flight path management policy that identifies opportunities for manual flight (Recommendation 9), and procedures that stress monitoring, cross verification and task allocation between PF and PM (Recommendation 8).
• Its Finding 4 adds that pilots "sometimes rely too much on automated systems and may be reluctant to intervene", and that autoflight mode confusion errors continue to occur.

[A] CAST — Safety Enhancement 30, Mode Awareness and Energy State Management Aspects of Flight Deck Automation, Revision 5 (August 2008, background)

https://www.cast-safety.org/pdf/cast_automation_aug08.pdf

• Confirms the essay: CAST directed the SE-30 team to restrict its work to mode confusion and mode awareness, and the report opens by crediting automation with a substantial contribution to air carrier safety.

[A] EASA — Opinion 08/2019, update of ORO.FC: evidence-based training (2019-12-18, background)

https://www.easa.europa.eu/en/document-library/opinions/opinion-082019-b

• Confirms the essay's account of EBT: the concept "is designed to maximise learning and minimise formal checking" and aims at crews who can recognise and manage unexpected situations.

[A] AWS Documentation — Troubleshoot your Application Load Balancers (as fetched on 2026-10-13)

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html

• Confirms the 502 causes the essay lists: a TCP RST from the target on connecting, the target closing the connection with RST or FIN while a request was outstanding (check whether its keep-alive is shorter than the load balancer's idle timeout), and a malformed response or invalid headers.

[A] AWS CDK API Reference — enum RemovalPolicy (as fetched on 2026-10-13)

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.RemovalPolicy.html

• A removal policy applies when the resource is removed from the template, replaced by a change, or deleted with its stack, and DESTROY physically destroys it, which confirms the essay's example and adds a case it does not name, removal from the template.

[B] InfoQ — Anthropic Study: AI Coding Assistance Reduces Developer Skill Mastery by 17%, by Steef-Jan Wiggers (2026-02-23, background)

https://www.infoq.com/news/2026/02/ai-coding-skill-formation/

• It adds a 2024 study by Jošt, Taneski and Karakatič (University of Maribor, Applied Sciences): over 10 weeks, 32 undergraduates learning React showed significant negative correlations between using LLMs for code generation and debugging and their final grades, while using them for explanations showed no significant negative effect.
• It quotes Tom Smykowski's objection that the study shows "how AI use impacts learning things that are new to you", not how AI affects programmers in general.

[B] @IT (ITmedia) — Skills may decline depending on how AI coding is used: Anthropic analyses three usage patterns (2026-03-04, in Japanese, background)

https://atmarkit.itmedia.co.jp/ait/articles/2603/04/news072.html

• A Japanese report of the same trial with the same figures (52 engineers, 50% against 67%, about two minutes faster without significance, the largest gap on debugging); the rest of the article is for registered members.

[B] Scientific American (from Nature) — Is AI ruining our skills? Early results are in—and they're not good, by Mariana Lenharo (2026-07-05, first published in Nature on 2026-06-18)

https://www.scientificamerican.com/article/is-ai-ruining-our-skills-early-results-are-in-and-theyre-not-good/

• In Poland, endoscopists with at least 2,000 colonoscopies each found an adenoma in 28.4% of colonoscopies in the three months before an AI tool arrived, but in 22.4% of those done without it in the three months after (The Lancet Gastroenterology and Hepatology).
  • Co-author Yuichi Mori: "There is no established solution against deskilling right now."
• Tapani Rinta-Kahila's 2018 study found that accountants who had used an automated, non-AI accounting system for more than a decade had forgotten several routine tasks once it was taken away.
• Kevin Crowston (Syracuse University) reads the Anthropic result as a disconnect between performance and learning: people perform by borrowing skills from the AI without developing them.

[B] Uwe Friedrichsen — AI and the ironies of automation, Part 1 (2025-11-21, background)

https://www.ufried.com/blog/ironies_of_ai_1/

• He applies Lisanne Bainbridge's 1983 paper "Ironies of Automation" to agentic AI: an expert reduced to monitoring loses skill and recall, and later generations will lack the skills that today's overseers ride on.
• Citing vigilance studies (Mackworth, 1950), he argues that nobody keeps effective attention for more than about half an hour on a source where little happens, so a human cannot reliably catch an agent's rare errors, and added alarms or logs do not fix this.

[B] Uwe Friedrichsen — AI and the ironies of automation, Part 2 (2025-12-12, background)

https://www.ufried.com/blog/ironies_of_ai_2/

• Agent plans, often over 50 or 100 lines and sometimes several hundred, written with utter conviction, hide the rare error, which he calls probably the worst UI and UX possible for the person responsible for catching it.
• On training he relays Bainbridge's point that unknown faults cannot be simulated, so training must teach general strategies rather than specific responses, and her final irony that "it is the most successful automated systems, with rare need for manual intervention, which may need the greatest investment in human operator training".

[B] InfoQ — Survey Finds AI-Generated Code Increases Debugging and Failure Rates and Creates a Comprehension Gap, by Sergio De Simone (2026-10-07)

https://www.infoq.com/news/2026/10/survey-complex-codebases-agents/

• A Coleman Parkes survey for Undo, which sells AI-powered root-cause analysis, of 300 senior engineering leaders of mission-critical software, mostly in C and C++, found 16.9 hours a week spent debugging against 9.8 hours producing code, and 35% of generated code reaching production before the team fully understood it.
• In the previous six months 93% had seen at least one incorrect root-cause diagnosis caused by hallucination (18% several times a month), and 79% said the release cycle was no faster than before.

[C] Hatena Bookmark — Comments on the article (2026-10-11 to 2026-10-12, in Japanese)

https://b.hatena.ne.jp/entry/s/zenn.dev/shimitaro/articles/eb45d8d63c7bd1

• 159 users and 36 comments at 10:23 JST on 2026-10-13, under Technology, with the earliest public bookmark at 10:59 JST on 2026-10-11, six days after publication; most featured comments dispute the analogy.
  • caynan: aviation's takeover happens in operation, while a broken app is not switched to manual service; rryu: the counterpart of manual flying would be writing code from a spec from scratch; nakex1: a pilot falls back on unchanging physics, whereas what a coder takes over from AI differs in amount and kind; knok: the closer case is implementing without agents during an LLM provider outage; kakei-akihiko, zentarou and kshtn call the analogy unfounded.
• On the other side, schoollife would use the pilot analogy to argue with management for regular training time, tmatsuu resolves to keep troubleshooting skills, and TakamoriTarou points to design assurance (DO-178/254, A-SPICE) as the better aviation reference and says the text itself hallucinates in places.

Notes

• The essay's aviation citations hold up: SAFO 13002, SAFO 17007, the 78 FR 67800 rule, the PARC/CAST report, CAST SE-30, AC 120-123, EASA SIB 2013-05R1 and EASA Opinion 08/2019 say what it says they say, so TakamoriTarou's claim of hallucination is not borne out for them; ICAO Doc 9995 and EASA NPA 2018-07 were not opened.
  • Two small imprecisions: SAFO 17007 recommends all approved combinations of FD, AP and AT for the aircraft's equipment rather than every combination, and the essay gives no date for SIB 2013-05R1, whose 2025 revision is what refers to AC 120-123.
• The essay's motor-versus-cognitive caveat understates the parallel: SAFO 17007 frames manual flight as both motor and cognitive, and the NASA study it cites found the motor skills retained and the cognitive ones degraded, which supports the essay's own claim that recognising the anomaly is the hardest step.
• The criterion runs the other way from aviation's: SAFO 13002 and EASA place manual practice in low-workload conditions and keep the automation for high-workload phases, while the essay sends people back to manual reading for the riskiest diffs.
  • What it borrows is judgement over quotas; reading high-risk diffs by hand is closer to the PM's cross-verification than to manual-flying practice, and the essay does not separate the two.
• No measurement tests the essay's claim: the coding studies measure learners acquiring a new skill (Anthropic: 52 mostly junior engineers, quiz minutes after the task; Maribor: 32 undergraduates), not the decay of established skills or the ability to take over from an agent, and the essay reports no trial of its drills.
  • Anthropic expects stronger effects from agentic tools such as Claude Code but has not measured them.
• Bainbridge, as Friedrichsen relays her, challenges drills built from past incidents: unknown faults cannot be simulated, so rehearsing one's own incidents trains specific responses, while she argues that training must be about general strategies; the essay's drill list mixes both kinds without addressing this.
• Vigilance research (Friedrichsen, Part 1) and the NASA mind-wandering result question whether a human PM can keep watch over agents that rarely fail; the essay's answer, reserving manual attention for high-risk diffs, is not evaluated by either source.
• The InfoQ survey was commissioned by a vendor of root-cause analysis tooling, its respondents lead mostly C and C++ mission-critical codebases, and its figures are self-reported.
• The essay names no agent or tool, and all its drills use AWS (CDK, CloudFormation, IAM, ALB).
• Sourcing: the Casner et al. paper was read in a copy on gwern.net because the publisher's page returned 403, and the CACM news piece "The AI Deskilling Paradox" also returned 403 and is not cited.
  • No fact here rests on WebFetch or on search results alone.

Ideas for practice and output

• Run the essay's CDK drill as a 30-minute team exercise: show the two-line removalPolicy and deletionProtection diff with an AI review approving it, and ask whether to merge and why; it shows whether reviewers reach replacement and removal from the template, not only stack deletion.
• Pick one recent postmortem, anonymise it, rebuild it in a small reproduction, and have pairs root-cause it with agents allowed but every conclusion backed by logs or configuration; ungraded, it shows which evidence the team still knows how to find.
• Write risk-based manual reading into the review rules instead of a quota: list the diff classes that need line-by-line human reading even after an AI review (IAM policies, IaC that deletes or replaces stateful resources, network configuration), enforce them with CODEOWNERS or path-based required reviewers, and count how often they occur each week.
• Keep a log of automation surprises (wrong fixes, missed review findings, failures that slipped past AI-written tests) as drill material, and add unannounced drills in which a colleague plants a defect of an unstated kind in an AI-approved diff, to test the general strategies Bainbridge asks for rather than rehearsed answers.
• For juniors learning a new library, compare the interaction patterns from Anthropic's study (conceptual questions and explanations against delegation) and try the Learning and Explanatory output styles its post names, checking comprehension afterwards with a short quiz.
• Output: a one-page team note that maps the aviation documents to team practices, with the three caveats from the notes (the cognitive side of manual flying, the opposite risk criterion, and unknown faults).

6. 🧩 Claude Managed Agents added dynamic workflows in public beta: the session's agent writes a program that runs up to 1,000 agents per run in phases on Anthropic's servers, 64 at a time, and Anthropic advised starting with scoped tasks because token use can be high

• Selected / impact 1 / potential 2 / attention 1 / anchor 10-09, before the window / kind: release / areas: agent building, API and cloud.
• Feed items in this topic:
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (relays @ClaudeDevs: a lead agent writes a phased plan and fans it out to up to 1,000 agents per run, enabled with multiagent_20261001, with the advice to start with scoped tasks because token use can be high)
• Anchor: the release notes date the beta 10-09, and the previous run listed it from claude-platform-release-notes and dropped it at 1 / 2 / 0; ainews brought it back in this run.

Continued from

• Topic 9 of 2026-10-10 dropped the release at 1 / 2 / 0 with only its release-notes entry, because a search had found no discussion beyond it.
• Coverage has since surfaced: AINews (10-10) carried Anthropic's posts on X with their cost warning, The Decoder (10-09) and MIXED (10-11) wrote it up in English, XenoSpectrum (10-10) in Japanese, and practitioners on their blogs.
  • New since that entry: the docs' limits (64 threads at once, 1,000 agents per run, a 24-hour lifetime, 10 open runs per session), the billing (no price of its own beyond tokens and $0.08 per session-hour while running), and Anthropic's claim that a workflow found 66 of 70 planted bugs where a single agent found 14 to 27.

Collected information

[A] Anthropic — Claude Platform release notes, entry of October 9, 2026 (2026-10-09)

https://platform.claude.com/docs/en/release-notes/overview

• Claude Managed Agents agents can now use dynamic workflows, in beta under the existing managed-agents-2026-04-01 beta header.
• For work with many pieces, such as reviewing hundreds of documents, the agent writes a workflow, a program that runs many agents in phases and combines their results, and the server runs it in the background as a workflow run.
• It is turned on by setting the agent's multiagent field to {"type": "multiagent_20261001", "workflows": {"type": "enabled"}}, steered by telling the agent in its system prompt when to start a run, and followed through workflow_run.* events on the session's event stream.
• Earlier entries give the lineage: multiagent orchestration (subagents) entered public beta under the same header on 2026-05-06 and reached Claude Platform on AWS on 2026-05-29, an advisor model for sessions came on 2026-08-07, and Claude Code's Workflows were listed as a research preview on 2026-05-28.
  • No earlier entry mentions dynamic workflows for Managed Agents, so the feature went straight to beta.

[A] Claude Platform Docs — Multiagent orchestration (as fetched on 2026-10-13)

https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration

• The multiagent_20261001 type combines three settings: subagents and workflows, both enabled by default, and advisor, disabled by default.
• With subagents the agent delegates turn by turn and can send follow-ups to persistent threads, one level deep and at most 25 child threads at a time; with workflows, "Claude writes a program to orchestrate agents without Claude's direct involvement", while the primary thread stays free to talk to the user and check on runs.
• The docs recommend workflows for most work that needs more than one agent: work with many pieces, parallel work, or a long task that should finish sooner, such as audits, migrations, deep research and cross-checking.
• No API call starts a run: the agent decides from the user.message whether and when to start one, and the message or the system prompt is the only way to steer that.
  • Permission policies apply to the tools that a run's agents call, not to starting the run.
• A run's agents are inline agents that the workflow defines, with a system prompt it writes and the model of the session's agent, or predefined agents listed in workflows.predefined_agents (up to 20, a list separate from subagents.predefined_agents).
  • Running some of a run's agents on another model requires creating them as agents and listing them there.
• Listed agents are pinned to the version resolved at create or update, cannot themselves have multiagent set, and must all pin the same inference_geo as the lead agent or none may pin one; {"type": "self"} lists copies of the agent itself.
• An inline agent gets the session agent's MCP servers and tools, and vault credentials apply to every thread, so restricting a run's access means setting inline_agents to {"type": "disabled"} under workflows and listing narrower agents.
• All agents share the session's sandbox, files and vault credentials, while each works in its own context-isolated session thread.
• The sample system prompt tells a contract reviewer to start a run when asked to review more than a few contracts and to review one or two itself, and suggested additions cover splitting (one agent per contract, then a second agent reviewing every contract), failure (list unreadable contracts as not covered) and a one-hour time limit.
• The ant__ tool-name prefix is now reserved: an agent with a custom tool named ant__… fails every update and every new session with a 400 error until the tool is renamed in the same update that turns workflows on.
• Moving an agent from the older coordinator type (subagents and advisor only) replaces the whole multiagent block, so leaving out workflows and subagents.inline_agents enables both, and leaving out the subagent list empties it.
• A session copies the setting at creation, {"type": "disabled"} turns workflows off, and sending null turns them back on because the default is enabled.

[A] Claude Platform Docs — Workflow runs (as fetched on 2026-10-13)

https://platform.claude.com/docs/en/managed-agents/workflow-runs

• A run has three layers: the run, optional named phases, and agent threads in which the program fans out agents, passes one agent's result to another, repeats a step until a review passes or rounds run out, and handles or propagates a failed agent.
  • Results go to the program, not to the session's agent, which gets a turn to read what the run did when it ends.
• Limits: 64 threads working at once in one run, a number the API does not guarantee; 1,000 agents started over a run's life, after which the run ends with thread_limit_error; a 24-hour lifetime by default that the agent can shorten; and 10 open runs per session by default, idle ones included.
  • Retries of a failed agent on new threads can take a run past 1,000 threads, the server has further limits that are not listed, and a session can start any number of runs over its life.
• Events on the session stream: workflow_run.created (with a wrun_… ID, a name, a description and the declared phases, all text the model wrote), workflow_run.status_running, workflow_run.status_idle, workflow_run.phase_started and workflow_run.phase_ended, workflow_run.status_ended with a result, and workflow_run.error.
  • Run events do not trigger webhooks, and no endpoint lists runs, so a client rebuilds run state after reconnecting by listing past events with a types filter.
• A completed result only means the workflow finished: a run can end completed although work on its threads failed or a thread could not be created, and the error results are timeout_error, program_error, thread_limit_error and unknown_error.
• Runs do not nest: only the agent on the primary thread starts one, a run's threads are exempt from the 25-child-thread limit, the agent cannot send them follow-ups, and the server archives each by the end of its run.
• You do not see the workflow's code, the tool calls that start and manage runs, or what each thread returns to the program; a tip says to ask the agent, once the run has ended and the session is idle, to print the workflow word for word without starting another run.
• No client event ends a run: user.interrupt stops the agent's turn while runs may pause or keep going, so stopping means a user.message asking the agent to stop them, and archiving or deleting a session, or updating its agent, can return 400 with workflow_run_open while a run is open.
• The session stays running while a run runs, even when none of its threads is working, and the work is done only once every run seen has its workflow_run.status_ended and a later session.status_idle arrives with end_turn.
• "A run has no price of its own": its agents' tokens are billed at each model's rates and count toward the session budget, and one run's usage is the sum of usage over the threads that carry its workflow_run_id.
• At the budget every open run pauses and can pass it by one request per working thread, while a paused run's lifetime keeps running down, so a run left paused can end with timeout_error.
• A run's model requests count toward the organization's Messages API rate limits along with its other traffic, and because a run can create more than one thread for the same piece of work, the docs ask for tools that are safe to call twice.
• The worked example asks which of 300 contracts have a change-of-control clause and shows a run with the phases "Read the contracts" and "Reconcile the findings" ending with the answer that 41 have one (an illustration, not a measurement).

[A] Claude Platform Docs — Session budgets and the Claude Managed Agents section of Pricing (as fetched on 2026-10-13)

https://platform.claude.com/docs/en/managed-agents/budgets / https://platform.claude.com/docs/en/about-claude/pricing#claude-managed-agents-pricing

• Managed Agents bills tokens at each model's rates, with prompt-caching multipliers, $10 per 1,000 web searches and 1.1x for inference_geo "us", plus session runtime at $0.08 per session-hour, metered to the millisecond only while the session is running.
  • The Batch API discount does not apply, and Managed Agents is not available on partner-operated cloud platforms.
• A budget, {"type": "limit", "max_list_cost": {"amount": "<US cents>", "currency": "USD"}}, can be set only when the session is created, is enforced between model requests at public list prices rather than negotiated ones, and is shared by all threads of a multiagent session with no per-thread caps.
• Session-level active_seconds counts overlapping activity of concurrent threads once, so parallel threads do not multiply the runtime charge, and per-thread list_cost figures leave runtime out.
• Creating a budgeted session fails with a 400 error when the agent, an agent in either predefined list or the advisor uses a model without a public list price.

[A] Claude (@ClaudeDevs) on X — launch thread on dynamic workflows in Claude Managed Agents (2026-10-09)

https://x.com/ClaudeDevs/status/2108591328732856655

• The head post presents the public beta as a new type of multiagent orchestration for the most ambitious workloads, in which a lead agent writes a plan that runs across many agents in phases and combines the results at the end.
• A second post reports an internal test: with 70 bugs planted in a 116k-line codebase, a single agent found 14, 15 and 27 bugs in three runs, and a workflow found 66 in each of its three runs.
  • It names no model, effort level, token spend or false-positive count.
• A third post says to configure multiagent_20261001 and ask Claude to run a workflow, and that Claude writes the plan and orchestrates up to 1,000 agents per run.
• A fourth post: "Dynamic workflows are powerful and can use a lot of tokens, so we suggest starting with a scoped task."
  • It advises raising task complexity step by step from there, and points to /claude-api managed-agents-onboard bug-hunter in Claude Code and to templates on platform.claude.com/agent-quickstart.

[A] Anthropic — Introducing dynamic workflows in Claude Code (2026-05-28, since updated) and the Claude Code docs page Orchestrate subagents at scale with dynamic workflows (as fetched on 2026-10-13)

https://claude.com/blog/introducing-dynamic-workflows-in-claude-code / https://code.claude.com/docs/en/workflows

• Background older than 30 days: Claude Code's dynamic workflows launched on 2026-05-28, and the post now opens with "Update: Dynamic workflows are now generally available"; the docs list them on all paid plans, the Anthropic API, Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry.
• There the workflow is a JavaScript script (agent(), pipeline(), parallel()) that a local runtime executes, written to a file under ~/.claude/projects/ that you can read, diff, edit, relaunch and save as a command in .claude/workflows/, and the first workflow that triggers asks for confirmation.
• Its limits differ: 16 concurrent agents by default (1 to 256 with CLAUDE_CODE_WORKFLOW_MAX_CONCURRENT_AGENTS), 4,096 items per parallel() or pipeline() call and the same 1,000 agents per run.
• Cost is surfaced as it runs: /workflows shows each agent's token usage, and an advisory Large workflow warning appears above 25 agents or a projected 1.5 million tokens; the launch post gave the same advice to start on a scoped task.

[A] Anthropic — When to use multi-agent systems (and when not to) (2026-01-23) and How we built our multi-agent research system (2025-06-13)

https://claude.com/blog/building-multi-agent-systems-when-and-how-to-use-them / https://www.anthropic.com/engineering/multi-agent-research-system

• Background on cost, linked from the orchestration docs: in Anthropic's testing multi-agent implementations typically use 3 to 10 times the tokens of single-agent approaches for equivalent tasks (2026), and its 2025 research system put multi-agent systems at about 15 times the tokens of chats.
• The 2025 post adds that domains needing shared context or with many dependencies between agents fit poorly, and that most coding tasks are less parallelizable than research.

[B] AINews (Latent Space) — [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch (2026-10-10)

https://www.latent.space/p/ainews-typesafejev-at-100m-arr-75b

• It leads its "Multi-Agent Orchestration and Coding Tools" section with the release, drawn from the @ClaudeDevs posts and adding nothing beyond them, and places Vals AI's study of agent teams in the same section.

[B] The Decoder — Anthropic's Claude can now orchestrate up to 1,000 AI agents in parallel through dynamic workflows, by Matthias Bastian (2026-10-09)

https://the-decoder.com/anthropics-claude-can-now-orchestrate-up-to-1000-ai-agents-in-parallel-through-dynamic-workflows/

• Its headline and text say up to 1,000 agents run in parallel per execution, which the docs contradict.
• It calls the cost-effectiveness debatable, setting Anthropic's bug test against its own earlier report of a senior OpenAI engineer calling agent swarms a massive waste of tokens, and says gains across task types remain to be seen.

[B] MIXED — Claude now writes its own programs to run up to 1,000 agents, and starts them itself, by Shane S. Ellison (2026-10-11)

https://mixed-news.com/en/claude-managed-agents-dynamic-workflows-1000-agents-permission-policies/

• Its angle is control: nothing in the flow asks a developer to approve a launch, the lever on offer is persuasion through the message or system prompt, and permission policies govern the fleet's tools but not raising the fleet.
• It reads the budget as an approximate brake whose overshoot is bounded by the 64 working threads rather than by any figure Anthropic publishes.

[B] Vals AI on X — Do agent teams pay off? (2026-10-09)

https://x.com/ValsAI/status/2108608719420600709

• Not a test of dynamic workflows but of agent teams in general: on Vibe Code Bench, teams of GPT-6 Sol and of Claude Opus 5.5 cost 1.8x to 5.1x as much as single agents, and only one of four comparisons improved significantly (Sol at medium effort, by 7.3 points).
• Raising Sol's single agent from medium to max effort gained 11.4 points, a team on top of max effort added 1.4 (not significant), and Opus's teams took up to 2.3 times as long at max effort.

[C] XenoSpectrum — Claude assigns work to up to 1,000 AIs as a cloud version of workflows enters public beta, by Y Kobayashi (2026-10-10, in Japanese)

https://xenospectrum.com/claude-managed-agents-dynamic-workflows/

• It tells the two features apart: the Claude Code feature of 05-28 shares the name but differs in execution environment and limits, and 1,000 is a cumulative cap with 64 threads at once, so neither 1,000 agents working together nor a 1,000-fold speed-up.
• It turns the bug test into detection rates (20.0% to 38.6% for the single agent, 94.3% in every workflow run) and lists what the figures leave open: whether the same 66 were found each time, equal token budgets, false positives, fixes, cost, time and other codebases.
• It warns that the shared files do not prevent conflicts when several agents rewrite the same file, so code changes need explicit file and scope ownership per agent.
• It advises a first trial that narrows the target and compares against a single agent on the same materials and criteria, recording the scope covered, accuracy, misses, unprocessed items and cost.
  • An English translation is at https://xenospectrum.com/en/claude-managed-agents-dynamic-workflows/.

[C] Vanja Petreski — Dynamic Workflows Move to the Server (2026-10-09)

https://vanja.io/managed-agents-dynamic-workflows/

• Its frame is who holds the controls: in Claude Code the script runs on your machine and can be opened, edited and rerun, whereas "Managed Agents makes it a server-side workload that you budget, observe and stop by asking".
• Since a running run keeps the session running, 24 hours in that state cost $1.92 per session before tokens, and at 64 threads the budget overshoot can reach 64 extra requests per run, more with several runs open.
• A product's Stop button that only sends user.interrupt leaves the background work going, so it should send a message to the agent and wait for workflow_run.status_ended.
• Its rule of thumb: start a run only when you can name both the independent units of work and the rule that combines their results, and otherwise test the task with a single agent first.

[C] Licence (note) — New feature: dynamic workflows in Claude Managed Agents, set up in one field (2026-10-10, in Japanese)

https://note.com/licence/n/na9c68f21f310

• A walkthrough from the release notes alone, with httpx code for the beta header and the multiagent field and a Japanese system-prompt snippet that states both when to start a run (dozens of items or more, countable in advance, independent, one combined output) and when not to.
• It warns against confusing the header managed-agents-2026-04-01 with the type multiagent_20261001, but calls the change a one-field addition, which misses the reserved ant__ prefix and the coordinator migration rules in the docs.

[C] ひまなねこのひまつぶし (Hatena Blog) — Dynamic workflows added to Claude's Managed Agents: what they automate, the beta setup and caveats (2026-10-10, in Japanese)

https://himanekoblog.hatenablog.com/entry/2026/10/10/093034

• It confirms the release-notes facts without the docs' limits, stresses that this is a Claude Platform developer feature rather than a Claude chat feature, and would start on ten fictional meeting notes before any internal data.

[C] ToolNavs — Dynamic workflows in Claude Managed Agents enter public beta, orchestrating up to 1,000 agents in one run (2026-10-10, in Japanese)

https://toolnavs.com/ja/article/2446-claude-managed-agents-dong-tai-gong-zuo-liu-jin-ru-gong-kai-ce-shi-dan-ci-zui-du

• It claims that Managed Agents' multiagent orchestration needed an individual application to a research preview until now, which the release notes contradict (public beta under the standard header since 2026-05-06).

[C] TILNOTE — Dynamic workflows in Claude Managed Agents: 1,000-way parallel orchestration beyond a single model's limits (2026-10-10, in Korean)

https://tilnote.io/pages/6aca0e771e0f9a6cd00dc818

• It mixes the two products, giving Managed Agents' feature Claude Code's launch terms (a research preview on Claude Code plans, Bedrock, Vertex AI and Foundry, with ultracode), and claims, unchecked here, that Managed Agents is outside Zero Data Retention and HIPAA BAA coverage.

[C] X — replies to the @ClaudeDevs launch thread (2026-10-09)

https://x.com/ClaudeDevs/status/2108591334449684643

• One user (@truffle) avoids workflows because they have been far less token-efficient than a script of claude -p calls and asks whether that has changed, another notes that 1,000 agents on one task is now within reach of individuals, and several replies ask for weekly quota resets, which concern subscriptions rather than this API feature.

Notes

• Concurrency is misreported: The Decoder's headline says 1,000 agents "in parallel", while the docs give 64 threads working at once per run (not guaranteed) and 1,000 agents over a run's life.
  • XenoSpectrum and vanja.io state the distinction correctly, and AINews's "up to 1,000 agents per run" is accurate.
• Two products share the name, and coverage confuses them.
  • Claude Code's dynamic workflows are now generally available according to the updated launch post, while the platform release notes of 05-28 list them as a research preview, their status at launch.
  • Claude Code runs a readable local script, defaults to 16 concurrent agents and asks for confirmation the first time, whereas Managed Agents runs the program on Anthropic's servers, allows 64 threads at once, hides the code and lets the agent start a run without approval.
  • TILNOTE attributes Claude Code's launch terms to Managed Agents.
• No earlier gated stage is documented: the release notes show no research preview of dynamic workflows in Managed Agents, and multiagent orchestration has been public beta since 05-06, so ToolNavs's claim of an application-only preview is unsupported, and "opened to every user" overstates a change that is new rather than widened.
• The 66-of-70 result is Anthropic's own claim in a post on X, without a write-up, model, effort level, token budget or false-positive rate; no independent replication was found.
  • Anthropic's own guidance puts multi-agent token use at 3 to 10 times a single agent's, and Vals AI's agent-team study found 1.8x to 5.1x the cost with one significant gain in four comparisons, though it did not test dynamic workflows.
• Workflows are on by default with multiagent_20261001, including after a migration from coordinator that leaves workflows out, and starting a run is not gated by permission policies, so once workflows are enabled the system prompt and a budget set at session creation are the main brakes; MIXED and vanja.io both stress this.
• Open questions: whether dynamic workflows work on Claude Platform on AWS, where multiagent orchestration has been available since 05-29 (the 10-09 entry does not say); which models can lead a run; what the unlisted server limits are; and whether the 64-thread figure will change during the beta.
• Engagement, for calibration: the head post on X showed 977.1K views and 427 replies and the bug-test post 82.6K views when fetched, which do not count toward attention; a Hacker News submission of the orchestration docs (10-10) had 2 points and no comments; the Japanese posts had 0 Hatena Bookmark users when fetched.
• The Decoder and MIXED are separate outlets of one publisher, Deep Content GmbH, which weakens their weight as two independent write-ups.
• WebFetch only: the docs' tip on asking the agent to print the workflow word for word (the page cache dropped the callout), which vanja.io's saved page quotes with the same wording.
• Not read: FourWeekMBA (403); aggregator posts found by search (cellcog.ai, AlphaSignal, byteiota, explainx.ai, muddaser.com) were not opened; platform.claude.com/agent-quickstart shows only a sign-in page, so the templates the post mentions and /claude-api managed-agents-onboard bug-hunter were not checked.

Ideas for practice and output

• Replicate the bug test at small scale: plant 10 to 20 known bugs in a repository of 10k to 20k lines, run a single agent and a workflow three times each in budgeted sessions, and record found, missed and false-positive bugs, tokens, list_cost and runtime.
  • This checks whether the gap Anthropic reports holds on the team's own code, and at what cost multiple.
• Build a minimal run tracker on the docs' sample: follow workflow_run.* events, treat the work as done only after every run has ended and an end_turn idle follows, rebuild state after a reconnect by listing events with a types filter, and compute per-run cost from the threads' usage.
  • Exercise one failing document, one tool called twice, one interrupt, one stop by message and one budget pause, to see what the application can actually observe.
• Before enabling it on any agent, set workflows explicitly (disabled where fan-out is unwanted, especially on agents migrated from coordinator), write both the start and no-start conditions into the system prompt, list a cheaper predefined agent such as one on Haiku 5.5 in workflows.predefined_agents, turn off inline_agents where MCP access must be narrow, and create sessions with a budget.
• Run the same audit, such as missing authentication checks across route handlers, as a Claude Code workflow and as a Managed Agents run, and compare script visibility, concurrency, approval, token use and wall-clock time to decide which work belongs on developer machines and which on a server-side job.
• Output: a one-page decision table for the team covering subagents, Managed Agents workflows, Claude Code workflows and a home-grown script of claude -p calls, with limits, billing, the points of control and who can stop a run.

7. 🧭 Andrej Karpathy argued that the gap in how people understand LLM capability is widening into a funnel, from about 6 billion people who have barely used LLMs to about 20 million professionals who use frontier models for math and code and about 5,000 with access to frontier systems inside the labs

• Dropped / impact 0 / potential 1 / attention 2 / anchor 10-11 / kind: analysis / areas: models.
• Feed items in this topic:
  • hn-llm 10-12 The gap in shared understanding of LLM capability is widening — 680 points and 990 comments on Hacker News when fetched
• Reason for dropping it: a post with napkin-math estimates and no new data, which explains the funnel by the size of the problems people bring, the jaggedness that reinforcement learning on verifiable rewards leaves, and access, and changes nothing a GenAI engineer builds.

8. 🔍 A TechnoEdge explainer brought back REA (Reverse Engineer Anything), an MIT-licensed tool from April with about 158,000 GitHub stars through which coding agents analyse closed-source apps over MCP or a CLI and rebuild similar features

• Dropped / impact 0 / potential 1 / attention 2 / anchor 04-14, background / kind: release / areas: coding agents, security and safety.
• Feed items in this topic:
  • hatena-llm 10-12 なんでもリバースエンジニアリング。ソースコード非公開のアプリをAIに解析させ、類似機能を作らせるオープンソースツール「REA」（生成AIクローズアップ） (reverse-engineer anything: an open-source tool that has AI analyse apps without public source code and build similar features) — 377 Hatena Bookmark users when fetched
• Reason for dropping it: the repository was created on 2026-04-14 and its recent releases are routine (6.0.0 on 10-08 requires absolute host paths in MCP filesystem inputs, 6.4.0 on 10-11), so nothing in the last 30 days can anchor a topic, and the explainer adds no test of its own.

9. 👥 Vals AI ran GPT-6 Sol and Claude Opus 5.5 on Vibe Code Bench alone and as teams of a lead with up to five subagents: teams cost 1.8 to 5.1 times as much, and only Sol's medium-effort team scored significantly higher, by 7.3 points

• Dropped / impact 1 / potential 1 / attention 1 / anchor 10-09 / kind: research / areas: coding agents, evals and operations.
• Feed items in this topic:
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch — relays Vals AI's posts on X: Opus's lead ran sequential waves of about 6.8 subagents and about 1,140 subagent tool calls per app at max effort with no significant gain
• Reason for dropping it: Vals AI's case study covers one benchmark of 50 full-stack web apps with a paired t-test per setup, and only AINews and one secondary summary found by a search discussed it; the best score, 93.2% for Opus 5.5's max-effort team, cost $122 and 174.1 minutes per app against $23.77 and 74.7 minutes for the single agent at 89.8%.

10. 🧵 Claude Code Projects, the beta that splits an engineering goal into parallel Claude Code sessions on their own branches, was opened to every Pro and Max user on its waitlist

• Dropped / impact 1 / potential 1 / attention 1 / anchor 10-09 / kind: release / areas: coding agents.
• Feed items in this topic:
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch — relays @ClaudeDevs: all waitlisted Pro and Max users were admitted and each project runs tasks as parallel threads; a user's post says sessions can now run locally
• Reason for dropping it: a wider rollout of a beta announced on 09-17, still limited to Pro and Max with a GitHub repository, in which each thread counts as a full Claude Code session against usage limits, discussed only by aggregators; reports that read the docs on 10-10 still describe local threads as planned, which contradicts the post AINews relays.

11. 🪜 StepFun put Step 5 Preview, a 600B-parameter mixture-of-experts model with 27B active parameters, a 1M-token context and vision, on OpenRouter ahead of open weights due on October 15

• Dropped / impact 1 / potential 1 / attention 1 / anchor 10-08 / kind: release / areas: models.
• Feed items in this topic:
  • ainews 10-10 [AINews] TypeSafe/Jev at >$100M ARR, $7.5B valuation 3 weeks after launch — 33.89 on the Hermes Index, matching GPT-6 Luna, free on Nous Portal for a week and maximum output corrected to 64K tokens; the OpenRouter listing drew 147 points and 38 comments on Hacker News on 10-08
• Reason for dropping it: a preview whose only scores are one aggregator index and a usage ranking, with the weights still to come; their release on 10-15 falls in the next run's window.

12. 📎 Other one-off items

• Dropped / each scored on its own; impact 0 to 1, potential 0 to 1, attention 0 to 2.
• aws-whats-new 10-13 consumption-based pricing for short-term memory in Amazon Bedrock AgentCore: ingestion at $1.00 per GB, retrieval at $0.20 per GB and storage at $0.10 per GB-month instead of a flat rate per event, with a 12 KB minimum and 64 KB maximum billable size per event; long-term memory pricing is unchanged (1 / 1 / 0).
• aws-ml-blog-bedrock 10-13 GPT-6 Sol, Luna and Astra on Bedrock through global cross-Region inference from Singapore, Jakarta, Thailand, Malaysia and Taipei, with the Converse and OpenAI-compatible APIs, IAM and SCP permissions and quota sizing (0 / 0 / 0: availability in more source Regions).
• github-changelog-copilot 10-11 Copilot for JetBrains: enterprise-managed default models, a setting that stops MCP servers from starting automatically for Copilot and Claude, a Fix action on diagnostics, and the end of support for JetBrains IDE 2025.1 (1 / 0 / 0).
• classmethod-claude-code 10-10 Claude Code v2.1.296: autoCompactWindow for subagents and an allow_large option for Read, tested with Opus 5.5, where Read without it returned 732 of 3,001 lines (1 / 1 / 0, continuing topic 6 of 2026-10-10); 10-12 Claude Code reading several AWS accounts through the AWS MCP Server (1 / 0 / 0).
• zenn-trending 10-10 uhyo's React proficiency benchmark of Haiku 5.5: 83.82 at effort high, above Sonnet 5.5 high at 81.08 on 10 of 13 specs, and 85.56 at max, ranked 12th and 10th of 26 conditions (1 / 0 / 0, coverage of topic 1 of 2026-10-08; 14 likes).
• zenn-trending 10-12 a per-user Bedrock cost dashboard for Claude Desktop and Claude Code on Bedrock, built from the caller-identity (IAM principal) option of CUR 2.0 Data Exports, line_item_iam_principal, Athena and Amazon Quick, by an AWS solutions architect (1 / 1 / 0; 2 likes); CLIP image embeddings traced with Transformers.js and measured on 1,000 MS-COCO images (0 / 0 / 0).
• hatena-llm 10-10 Matsuo Institute on making TTS read Japanese correctly, part one, from pitch accent to its G2P front end (0 / 1 / 2: 103 Hatena Bookmark users, published 09-28; speech front ends rather than LLM applications); 10-11 Boris Tane's case that self-improving software is inevitable, with agents reading production signals and shipping fixes without people as "meat proxies" (0 / 1 / 1: 43 Hatena Bookmark users); 10-12 voluntas switching their CLI harness from OpenCode v2 to Pi with only @ollama/pi-web-search on DeepSeek V4.1 Flash, while a DeepSeek Harness fork does 99% of their work (0 / 0 / 2: 163 Hatena Bookmark users).
• ainews 10-10 also lists, beyond topics 1, 2 and 6 and dropped topics 9 to 11: Cloudflare's clef-omni for audio, video, image and text with clef-flash now cheaper than Jev, Liquid d1 on Vercel AI Gateway, Decision 2.0 in vLLM Semantic Router, LangSmith using Jev as a judge, an Unsloth notebook that turns Qwen3.5-4B into a decision model on 8 GB of VRAM, Opus 5.5 fast mode billed to usage credits outside subscriptions, Codex suggesting the next message for Pro users, Devins that spawn trees of managed Devins, Prime Intellect's agent rewritten in Rust by more than 2,000 agents, Upstage Solar Mini 4 (35B, 3B active) and new OCR benchmarks (each 1 / 1 / 1 at most).

13. 🚫 Out of scope

• ainews 10-10 its headline: TypeSafe's "Series AI" at a $7.5B valuation and more than $100M in annual recurring revenue three weeks after Jev's launch (funding; the raise drew 443 points on Hacker News); also image generation and editing (Qwen-Image-2.1-Turbo, a 30-edit chain test), speech models, and training and inference systems (Vera Rubin results for vLLM and SGLang, TRL v1.15, Datology, Tinker price cuts).
• zenn-trending 10-10 Claude Motion, animated explainers that Claude writes as code and exports as MP4, in beta for Team and Enterprise since 10-08 alongside Claude Dashboards (end-user productivity; 46 likes and 19 Hatena Bookmark users).
• hatena-llm 10-12 GIGAZINE on the "stochastic parrot" metaphor and its common misreadings (general AI discourse; 65 Hatena Bookmark users).
• classmethod-claude-code 10-12 an engineer learning business development from a primer Claude Code wrote for them (not engineering work).
• simon-willison 10-13 Python 3.15 and dropping Python 3.10; publickey 10-13 BTCONJP 2026 (an event advertisement); aws-whats-new 10-13 Amazon Connect filling in after-contact-work guides; gcp-vertex-ai-release-notes 10-11 and 10-12 Agent Platform Workbench v2 package updates.
• zenn-trending GitHub Actions beyond SHA pinning, Mozc's changes over a year, a Besu network on a Mac, anomaly detection with reservoir computing and C++ string handling.