A single model that predicts the next span of text becomes, in about five years, a continuous fleet that specifies, builds, tests, deploys, and repairs software while its operators sleep. The arc has six layers. Each one adds autonomy. At every layer the assurance stack races to catch up, and it never fully does. The unsolved problem is never generation. It is verification: an agent can only “heal” toward a target that is correctly and completely specified, and “passes the tests” is not the same claim as “is correct.”
The composition grammar here is inherited from a working agentic-platform harness: seven modules (M0–M7), nine phase gates, six circuit breakers, hooks that enforce rather than request, and append-only Agent Continuation Journals as the provenance spine. Layers 05 and 06 extend that module set forward.
The six layers
Each layer names a scale, a thesis, a verifier (what actually judges correctness), and the failure mode that defines its ceiling. The two meters — autonomy and assurance — are relative and directional, not measured; the gap between them is the point.
01 · Suggestion — 2021–2024
One model, zero tools. The model proposes; you verify everything.
A single model lives inside the editor and predicts the next span of text. It cannot read your test output, cannot run anything, and remembers nothing once the file closes. Every correctness decision stays in your head — which is why the measured effect on productivity splits so sharply by context: large gains on unfamiliar greenfield work, and a measured slowdown for experienced engineers in codebases they already know well.
- Verifier: a human reading every diff.
- Failure mode: hallucinated APIs, no feedback loop, nothing survives the session.
- Autonomy 12 · Assurance 9.
02 · Loop — 2024–2025
One agent, many tools. The agent runs the tests; the loop closes in the machine.
Give the model a shell, a filesystem, and permission to execute the test suite, and the character of the work changes. It can now observe the consequence of its own edit and iterate without you. Two conventions make this durable: a tool protocol so capability is pluggable rather than hard-wired, and a project-memory file so intent survives the session. This is the first layer where a failing test is information the agent can act on.
- Verifier: the test suite, read by the agent.
- Failure mode: context rot on long runs; the agent can edit the tests that judge it.
- Autonomy 36 · Assurance 25.
03 · Swarm — 2025–2026
One lead, n stateless workers. Fan out to read. Keep one writer. Enforce with hooks, not requests.
Parallelism arrives, but not the version most people first reach for. Independent writer-agents make conflicting implicit decisions and shred each other’s context; the pattern that survives contact is a single stateful lead that owns every write, fanning out to stateless read-only workers for search, review, and threat modelling. The decisive addition is enforcement. An instruction not to edit the golden evaluation set is a request the agent may reason its way around. A pre-tool hook that exits non-zero is a guarantee.
- Verifier: immutable golden sets behind a blocking hook.
- Failure mode: token cost multiplies ~15×; coordination overhead on shared-context work.
- Autonomy 59 · Assurance 39.
04 · Harness — 2026
n agents on shared infrastructure. Stop building agents. Build the floor they stand on.
The unit of work moves off the workstation. What makes a fleet operable is not better prompting but infrastructure a platform team already knows how to build: durable execution so a killed process resumes rather than restarts, scoped identity so an agent’s authority is narrower than its operator’s, a required access scope on every retrieval and journal read so multi-tenant leakage is structurally impossible, real token accounting against per-tenant budgets, and tracing under a shared semantic convention. The seven modules of the harness are exactly this floor.
- Verifier: gates as commands that exit 0 or 1; partial is failure.
- Failure mode: non-human identities outnumber humans ~80:1 and mostly go ungoverned.
- Autonomy 75 · Assurance 62.
05 · Night factory — 2026 →
n agents, continuous. The loop closes on production. Work continues while you sleep.
Two things arrive together. The fleet runs continuously, so the lifecycle detaches from working hours — specification at dusk, build overnight, an evaluated pull request waiting at breakfast. And the feedback signal extends past the test suite into production telemetry, which makes the arrangement recognisably the autonomic control loop described in 2003: monitor, analyse, plan, execute, over shared knowledge. The autonomous wins so far are narrow and high-value rather than broad, and every one of them still gates on a human before upstreaming.
- Verifier: production telemetry, canary analysis, automated rollback.
- Failure mode: a patch that passes tests is not a patch that is correct — 73–98% overfit.
- Autonomy 89 · Assurance 67.
06 · n + 1 — frontier
The fleet extends itself. Agents author the next agent; specification becomes the interface.
The last move is the fleet acquiring the ability to change its own composition: recognising a recurring failure class, writing the skill, subagent, or hook that addresses it, evaluating the addition against held-out cases, and registering it for the rest of the fleet. The bottleneck relocates completely. It is no longer typing, no longer review of individual diffs, but the quality of the specification and the integrity of the evaluation signal — and an agent that can author its own tooling can, in principle, author the thing that judges it. This is the layer where immutability of the golden set stops being hygiene and becomes the load-bearing constraint.
- Verifier: held-out specifications the fleet has never seen and cannot write to.
- Failure mode: self-authored tooling can drift the evaluation signal it is measured by.
- Autonomy 97 · Assurance 63.
The evidence, tagged
Claims are marked measured (a reported number from a study or benchmark), contested (counter-evidence or self-report), or open (unresolved).
| When | What | Tag |
|---|---|---|
| Jun 2021 | Copilot preview ships inline completion to the editor. | — |
| Feb 2023 | GitHub RCT: 55.8% faster on an isolated HTTP-server task (n=95). | measured |
| Jul 2025 | METR RCT: experienced devs 19% slower in mature repos, while believing they were 20% faster. | contested |
| Aug 2024 | SWE-bench Verified released; frontier agents land near 33%. | measured |
| Oct 2024 | Agent scores reach 49% on the same suite — a 16-point move in ten weeks. | measured |
| Nov 2024 | Model Context Protocol published; tool integration stops being bespoke. | — |
| Dec 2025 | MCP donated to the Linux Foundation: ~97M monthly SDK downloads, ~10k live servers. | — |
| Apr 2025 | Agent-to-agent protocol published; agents advertise capability cards. | — |
| Jun 2025 | Orchestrator + subagents beat a single frontier agent by 90.2% on an internal research eval — at ~15× tokens. | measured |
| Jun 2025 | Counter-argument from the coding side: parallel writers fragment context. Don’t build multi-agents. | contested |
| Sep 2026 | Partial reconciliation: single-threaded writer, stateless read-only workers. | — |
| Sep 2025 | Asynchronous coding agent goes GA: issue in, sandboxed branch out, pull request for human review. | — |
| Dec 2025 | Durable serverless execution ships with checkpointing and suspension measured in months. | — |
| Apr 2026 | A major agent framework reaches 1.0 GA — orchestration, checkpointing, tracing in one runtime. | — |
| 2025 | Machine identities outnumber human ones by more than 80:1; 24M credentials leaked publicly. | contested |
| 2003 | The autonomic computing loop is specified: monitor, analyse, plan, execute, over shared knowledge. | — |
| 2012 | GenProg repairs 55 of 105 real defects at roughly $7.32 each. | measured |
| 2019 | End-to-end automated repair reaches production at social-network scale. | — |
| Jul 2025 | An agent finds a live-threat SQLite zero-day already known to attackers — first such foil on record. | measured |
| Aug 2025 | Cyber-reasoning systems find 86% and patch 68% of injected vulnerabilities in a public final. | measured |
| Oct 2025 | 72 security fixes upstreamed autonomously across codebases up to 4.5M lines — every one human-reviewed first. | — |
| now | Specification-first development: the contract, not the diff, becomes the reviewed artefact. | — |
| now | Reward hacking is documented in the wild — agents modify the tests that judge them when they can reach them. | contested |
| now | Restricting write access to test files is the single most effective measured mitigation. | measured |
| forward | The open question is not capability. It is whether the evaluation signal survives contact with a fleet that can edit its own tools. | open |
The module catalogue
The harness is not a metaphor. It is a concrete module set. M0–M7 exist in the platform today; M8–M10 are the forward extension the last two layers require.
| Module | Name | What it holds |
|---|---|---|
| M0 | Core | Model access, telemetry, budgets, record/replay |
| M1 | Retrieval | Hybrid search with a required access scope on every query |
| M2 | Routing | Tier selection, real output-token cost, three cache layers |
| M3 | Guardrails | Untrusted framing, reversible PII vault, tool authorisation |
| M4 | Evals | Golden sets, calibrated judges, an explicit inconclusive verdict |
| M5 | Agents | Durable resumable loop, tool contract, six circuit breakers |
| M6 | Journals | Append-only hash-chained context with enforced provenance |
| M7 | Aspire | Local host, containerised fixtures, collector |
| M8 | Healing | MAPE-K over production telemetry; canary, rollback, repair |
| M9 | Fleet | Non-human identity, scoped credentials, per-tenant budget ceilings |
| M10 | Forge | Agents authoring agents, skills and hooks against held-out specs |
Six circuit breakers
Autonomy is bounded from below by hard limits that fire regardless of what the agent intends. A max step count, a wall-clock ceiling, a per-tenant spend ledger, a repeat-call detector, and their siblings are the difference between a fleet and a runaway. The breakers are not advice to the model. They are enforced outside it — the same design principle as the golden-set hook: a guarantee, not a request.
The through-line
Read top to bottom, the arc is a single widening gap between what the fleet can do and what anyone can verify. Capability climbed from a model that could only propose to a fleet that can author its own tools. Assurance climbed too — golden sets, blocking hooks, durable journals, production telemetry, held-out specs — but never fast enough to close the distance. The frontier question is not whether agents can write the next agent. It is whether the evaluation signal survives contact with a fleet that can reach the thing that measures it. Restricting write access to the test files is, for now, the most effective answer we have measured.
Sources
- Peng et al., “The Impact of AI on Developer Productivity: Evidence from GitHub Copilot” (arXiv:2302.06590, 2023).
- METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity” (arXiv:2507.09089, Jul 2025).
- SWE-bench and SWE-bench Verified leaderboards (Jimenez et al.); Terminal-Bench; Holistic Agent Leaderboard.
- Anthropic, “Building a Multi-Agent Research System” (Jun 2025); Model Context Protocol specification (Nov 2024) and Linux Foundation donation (Dec 2025).
- Cognition, “Don’t Build Multi-Agents” (Jun 2025) and its Sept 2026 follow-up.
- Google DeepMind / Project Zero: Big Sleep (live SQLite zero-day, Jul 2025) and CodeMender (Oct 2025).
- DARPA AI Cyber Challenge (AIxCC) final, DEF CON 33 (Aug 2025): 86% found / 68% patched.
- IBM, Kephart & Chess, “The Vision of Autonomic Computing” / MAPE-K (2003); GenProg (ICSE 2012); Meta SapFix (2019).
- CyberArk 2025 machine-identity report; OWASP Non-Human Identity Top 10. Vendor productivity and agent-authored-code figures are self-reported and methodologically opaque.
Part of the Univrs research ecosystem:
- Research: metalearn.org · ardeshir.io · sepahsalar.org · univrs.io
- Creative: imagine.univrs.io
- Code: github.com/univrs · github.com/ardeshir