The New
Commons

The escalator has reached the agency rung. Profit is migrating down to substrate — Nvidia at ~73% gross margin, its data-center segment higher still — and up to the agentic orchestration and interface layer, exactly as Christensen's conservation of attractive profits predicts. The model layer in between is being commoditized by roughly 10x-per-year token-cost deflation. The question this raises is the one that decides the next decade: at which layer can a durable commons actually form, and what would it cost to build one on purpose?

The answer, in one line: a genuine, volunteer-and-institution-scaffolded open-source commons is forming at the agentic interface layer — MCP, A2A, vLLM, llama.cpp — and it is the winnable frontier of the escalator. But two halves make a commons, and only one of them is technical. The other half is institutional, and it has to be funded before the first xz-scale disaster hits the agent layer. The fork is live and will be decided by 2028: a LAMP-stack moment for agency, or five agent walled gardens.

1. The escalator has reached the agency rung. Profit migrates down to substrate (Nvidia at ~73% gross margin, its data-center segment even higher) and up to the agentic orchestration/interface layer, as Christensen's conservation of attractive profits predicts. The model layer itself is commoditized by ~10x/year token-cost deflation ("LLMflation").
2. The interface-layer commons is empirically real and structurally different from "open weights." Unlike Llama/Qwen/DeepSeek (corporate subsidies under withdrawable licenses — "open weight," not open source per the OSI's October 2024 definition), vLLM (Apache 2.0), llama.cpp (MIT), and MCP's technical governance are genuinely plural and merit-governed. MCP hit 97M+ monthly SDK downloads and 10,000+ active servers within one year.
3. The old commons was institutionally scaffolded, not free. DARPA/NSF funded TCP/IP and Berkeley's CSRG; IBM committed $1B to Linux (2000); over 80–92% of kernel work is paid; the 1956 Bell consent decree freed 7,820 patents. The volunteer phase is a brief early window, not a steady state.
4. The cautionary tales define the failure mode. Heartbleed (OpenSSL on $2,000/year) and xz-utils (CVE-2024-3094, CVSS 10.0 — one socially-engineered volunteer maintainer) show what happens when a critical commons rests on unpaid labor. The agentic layer has a larger attack surface.
5. The funding rails already exist — Germany's Sovereign Tech Agency (€23M+ in two years), NSF POSE/PESOSE (up to $40M), CZI EOSS ($53M / 195 projects), the EU Cyber Resilience Act's "open-source steward" category — and can be pointed at the agentic layer deliberately and early.
6. Enclosure is already visible. OpenAI's ChatGPT app directory (opened December 2025, 800M-user base, App Store–modeled) shows how a representation-layer commons gets enclosed at the distribution surface even while the protocol beneath stays open.

The companion analysis established where value actually accrues in the agentic turn. Hyperscale clouds are not obsolescing themselves; they are the tollbooth. Nvidia reported GAAP/non-GAAP gross margins of 73.4%/73.6% in Q3 FY2026 (its November 19, 2025 filing), with data center as its highest-margin segment — SEC-filing analysis estimates its FY2025 data-center gross margin near 78%. AWS posted a 35.0% operating margin in Q4 2025 and 34.6% in Q3 2025 (with a Q2 2025 dip to 32.9%, its lowest profit-to-revenue ratio since late 2023). The foundation-model labs are squeezed between them, their cost of goods sold being rent paid to the clouds.

Token-cost deflation — the phenomenon a16z's Guido Appenzeller named "LLMflation," where "for an LLM of equivalent performance, the cost is decreasing by 10x every year," and which Epoch AI measured at 9x–900x per year across benchmarks — is commoditizing the model layer itself. Per Christensen's law of conservation of attractive profits, profit migrates down to the substrate (chips, datacenters, power) and up to the agentic orchestration and interface layer.

Here the critical disanalogy surfaces. The previous foundational software commons — libc, Linux, BIND, Apache, Python, MySQL, sendmail — was built by volunteer, glory-motivated commons-based peer production of the kind Yochai Benkler theorized. LLMs, even the "open weight" ones — Llama, Qwen, DeepSeek, Mistral — are not volunteer-built. They are corporate subsidies released for strategic "commoditize-your-complement" reasons (Spolsky's phrase, Gwern's elaboration), governed by withdrawable, restrictive licenses: Llama's 700-million-monthly-active-user cap, its no-training-competitors clause. The OSI's Open Source AI Definition, released October 2024, treats them as "open weight," not open source. A durable commons cannot form at the model layer, because that layer is capital-intensive substrate masquerading as grammar.

But one rung up, the grammar of agency is genuinely open. This is the New Commons signal. Ibn Khaldun's insight about institutional timing applies with unusual force: the commons must be installed after capability is proven but before incumbent gravity — asabiyyah captured and ossified — sets the mold. In Carlota Perez's terms, we are in the installation-to-deployment transition of the agentic key factor, the moment when the shape of the deployment period is decided. That window is open now.

The serving substrate is already communal. The clearest signal comes from inference serving. vLLM — originating in 2023 at UC Berkeley's Sky Computing Lab, built on the PagedAttention algorithm (Kwon, Li, et al., SIGOPS 2023) — is Apache 2.0 and has become the de facto production inference standard. Its scale is genuinely commons-like: 2,000+ contributors, a core team of 50+, running on 400,000+ GPUs concurrently worldwide, supporting 500+ model architectures across 200+ accelerator types, in production at Meta, Google, and Character.AI, with hardware vendors contributing directly for day-one compatibility. It was contributed to the Linux Foundation in July 2024 and became a PyTorch Foundation-hosted project in 2025 — neutral governance at the serving layer.

The protocol layer: MCP as the winnable grammar. The Model Context Protocol is the load-bearing example. Created inside Anthropic by David Soria Parra and Justin Spahr-Summers and open-sourced November 25, 2024, MCP solves the N×M integration problem: instead of a custom connector for every model-tool pair, a tool is built once as an MCP server and any compliant client can use it. The design deliberately reuses the message-flow architecture of the Language Server Protocol — grammar borrowed from a prior successful commons.

The agent-to-agent layer and the frameworks. The complementary protocol is Google's Agent2Agent (A2A), announced April 2025 and donated to the Linux Foundation on June 23, 2025 at Open Source Summit North America — founding members AWS, Cisco, Microsoft, Salesforce, SAP, ServiceNow, and 100+ supporting companies. Where MCP connects agents to tools and data, A2A connects agents to each other: Agent Cards for capability discovery, JSON-RPC 2.0 over HTTP for messaging. By early 2026, A2A v1.0 introduced signed Agent Cards and crossed 150 adopting organizations. Cisco's AGNTCY "Internet of Agents" initiative integrates rather than competes with A2A. Alongside these sit OpenAI's Apps SDK and Agentic Commerce Protocol, AG-UI, and ACP — a plural protocol ecosystem, still fluid.

Which pieces are genuinely communal — and which are enclosure. A sober taxonomy is essential. Genuinely community-governed: vLLM and llama.cpp (foundation-hosted, plural contributors, permissive licenses); MCP's technical governance (individual, not corporate, membership; the SEP process; Apache 2.0). Corporate-controlled-open (open licenses but single-vendor strategic control, at least initially): goose (Block), AGENTS.md (OpenAI), A2A (Google, now transitioning), the vendor agent SDKs. Proprietary and enclosing: OpenAI's ChatGPT app directory and Apps SDK, launched to its 800-million-user base; the GPT Store; walled agent marketplaces; platform-specific agent formats; and browser/edge-level gatekeeping (Cloudflare sits at a chokepoint for remote MCP servers).

University and state scaffolding. The internet's grammar was state-funded. TCP/IP was developed and stewarded under DARPA and NSF; the Berkeley Software Distribution (BSD) — from which the sockets API, much of the TCP/IP reference implementation, and countless utilities descend — was produced at Berkeley's Computer Systems Research Group (CSRG) on DARPA contracts. The universities were the labor pool and the neutral ground. The deepest commons of all, the transistor, was pried open by antitrust: the 1956 AT&T consent decree compelled royalty-free licensing of 7,820 Bell patents. Watzinger, Fackler, Nagler, and Schnitzer have shown this decree caused a large, durable increase in follow-on innovation; Gordon Moore credited it with letting "the merchant semiconductor industry really get started." Grindley and Teece called AT&T's licensing policy "possibly far exceeding the Marshall Plan in terms of wealth generation." State action, not volunteerism, seeded the substrate of the digital age.

Corporate subsidy and paid maintainers. The Linux commons was corporate almost from adolescence. IBM CEO Lou Gerstner announced in December 2000 that IBM would spend $1 billion on Linux in 2001 — a watershed that, in Jim Zemlin's words, "helped start a flurry of innovation that has never slowed" — and IBM helped establish both the Apache Software Foundation (1999) and the institutional home that became the Linux Foundation. The decisive datum is the paid-contributor statistic. The Linux Foundation's "Who Writes Linux" reports document that the kernel is overwhelmingly built by paid professionals: by 2008, 70–95% of contributors were paid; by 2014–2016 unpaid volunteer contributions had fallen to 7.7% of the total, and the top ten corporate sponsors accounted for nearly 57% of changes. Linus Torvalds' explanation is telling: volunteers "don't stay that way for long," because they get hired almost immediately. The lesson for the agentic layer is stark — a mature, mission-critical commons is a paid commons. The volunteer phase is a brief early window, not a sustainable steady state.

The cautionary tales: Heartbleed and xz-utils. The counterfactual is written in two near-catastrophes. Heartbleed (2014): OpenSSL, securing roughly 17% of the internet's certified secure servers, was maintained — in the words of OpenSSL Software Foundation president Steve Marquess — on "about $2,000 a year in donations," with lead developer Stephen Henson earning around $20,000/year and approving more than half the changes to 450,000 lines of code. The response was the Linux Foundation's Core Infrastructure Initiative — roughly $2M/year over three years, backers pledging ~$100,000 each — which funded full-time OpenSSL developers and became the OpenSSF. xz-utils (2024): the canonical modern tale. Over two years, an actor operating as "Jia Tan" used sock-puppet social engineering to pressure an exhausted volunteer maintainer, gained maintainer rights, and inserted a backdoor (CVE-2024-3094, CVSS 10.0) into a compression library on billions of Linux systems, targeting OpenSSH. It was caught by accident — Andres Freund noticed a fractional SSH latency. Alex Stamos called it potentially "the most widespread and effective backdoor ever planted in any software product." The structural diagnosis: a critical global commons resting on one unpaid, socially-engineerable maintainer. This is the failure mode the agentic commons must design against from the start.

The current public-funding rails. A funding infrastructure for digital commons already exists — Germany's Sovereign Tech Agency (€23M+ across 60+ projects in two years, with a Maintainer-in-Residence fellowship and a Bug Resilience Program); NSF POSE and its security-focused successor PESOSE (up to $40M, Phase II grants to $1.5M); CZI's Essential Open Source Software for Science ($53M across 195 projects); and EU instruments including Next Generation Internet and the Cyber Resilience Act, which entered force December 10, 2024 and created the novel legal category of "open-source software steward." The rails are built. They have not yet been pointed at the agentic layer.

First — audit the governance of what exists (Ostrom 3, 4, 7). The Linux Foundation's Agentic AI Infrastructure Fund (AAIF) is the test case, and its design is more sophisticated than open-washing skeptics allow — but it has real weaknesses. It is a directed fund, a lighter vehicle than a CNCF-style foundation with a Technical Oversight Committee. Platinum dues run $350,000–$370,000, capped at eight seats — the eight founding members fill it. The Governing Board decides strategic investments, budget allocation, and project approval, with each Platinum member holding a guaranteed seat. The demand of Ostrom-grade neutrality — individual-not-corporate technical membership, permissive licenses without CLA, trademark neutralization — should be a condition of funding and participation.

Second — fund the maintainers directly (Ostrom 2; the xz lesson). The most important, least glamorous action. Pay the maintainers of MCP, A2A, vLLM, and llama.cpp directly, before the first xz-scale disaster hits the agent layer. Sustaining models are well-mapped: Red Hat's support-subscription model; Mozilla's search-default deal; the Apache and Eclipse foundations; and newer rails — GitHub Sponsors, Open Collective, Tidelift, and Sequoia's equity-free Open Source Fellowship.

Third — build the universities into the new CSRG (Ostrom 7). Berkeley's Sky Computing Lab is already functioning as the CSRG of the agentic era — vLLM, Ray, and Spark trace to Berkeley. Fund university agentic-systems labs as neutral ground through NSF POSE/PESOSE Phase II grants and philanthropic matching, with an explicit mandate that outputs ship under permissive licenses into foundation governance. Universities supply what corporations cannot: credible neutrality, a renewable labor pool, and a mission orthogonal to any single vendor's commoditize-your-complement calculus.

Fourth — use the state's two levers: procurement and antitrust (the 1956 precedent). Require open, foundation-governed agent protocols in public-sector AI procurement — the interoperability-by-mandate logic already visible in the EU's Digital Markets Act and in the CFPB's recognition of the Financial Data Exchange as an open-banking standard-setter (January 8, 2025), a ready-made governance template: transparency, no conflicts of interest, free public availability, non-members with the same access as members. And if an agent-store duopoly forms — two or three platforms arbitrating which agents reach users — the remedy is the one applied to Bell in 1956: compulsory interoperability on non-discriminatory terms. The state's role is not to build the commons but to refuse to let anyone own the grammar.

Fifth — fund security auditing as core, not horizon (the xz lesson). The sharpest critique of the current AAIF is that security appears in MCP's "On the Horizon" section rather than as a core-funded priority — despite disclosed vulnerabilities affecting large numbers of MCP deployments (CVE-2025-6514 in mcp-remote; CVE-2025-49596 in MCP Inspector). Agent infrastructure has a larger attack surface than a compression library: prompt injection, tool poisoning, confused-deputy attacks, credential exfiltration. A security-auditing fund for agent infrastructure — seeded by the AAIF's corporate backers, matched by state cyber-resilience budgets (the EU CRA's steward regime is the natural vehicle) — is the highest-leverage single intervention available.

The pattern is invariant: where the grammar stays open and foundation-governed, innovation is permissionless and the long tail of industries and small actors participates. Where distribution is enclosed — the ChatGPT app-directory model — the same protocol underneath yields a gatekeeper world.

Where the grammar stays open and foundation-governed — SMART on FHIR in healthcare, FDX in finance, A2A in supply chains — innovation is permissionless across every industry. Where distribution is enclosed, the same open protocol underneath still yields a gatekeeper world. The fork is live.

This commons will not sustain itself on volunteerism, because the old commons never did: the Linux kernel is ~92% paid-professional work, OpenSSL nearly caused a global catastrophe on $2,000/year, and the transistor was pried open by a 1956 antitrust decree. The single most important institutional action is to pay the maintainers of MCP, A2A, vLLM, and llama.cpp directly, before the first xz-scale disaster hits the agent layer — and to demand Ostrom-grade neutrality (individual-not-corporate technical membership; permissive licenses without CLA; trademark neutralization) as a condition of funding.

The stakes are a LAMP-stack moment for agency versus five agent walled gardens. The benchmark that decides it: if, by 2028, a plurality of new agentic projects default to an open stack (open serving + open framework + MCP/A2A) the way new web projects defaulted to LAMP, the commons has won the deployment period. If new projects default to a single vendor's SDK and store, enclosure has won — and the antitrust lever becomes the last resort.

The deepest caveat returns to the thesis. The signal — vLLM, llama.cpp, MCP — shows a real commons can form at this layer. But the Linux paid-contributor data shows that a mature commons is a paid commons, and the xz disaster shows what happens when the paying stops at one maintainer. The volunteer-labor subsidy that built LAMP does not automatically exist at the agentic layer — which is the entire argument for deliberate, early institutional action. The window is open now. Ibn Khaldun's clock is running.