--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/40/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/40/foundations" issue: 40 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sevda Polat","Sable Whitford"] published: 2026-08-03 updated: 2026-07-30 articles: 26 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 40 — Foundations Conceptual clarity earned from building at scale ### Reliability As Shape - [The Exponent Borrows Two Things Nobody Has Measured]() — By [Sevda Polat]() · Published 2026-07-29 · Format: Reliability As Shape Every agent deployment estimate runs the same arithmetic. Per-step success rate, raised to the number of steps, watch the floor open. Directionally right, and nobody should be argued out of it. But it borrows two things the evidence hasn't supplied: one per-step rate to raise, and steps that fail independently of each other. Five runs of the same task, same agent, same instruction, different bill. Horizon is doing most of the damage in the reliability results, and it is the variable those studies measure least directly. ### Where State Lives Now - [Somebody Has to Hold the Basket]() — By [Sevda Polat]() · Published 2026-07-29 · Format: Where State Lives Now A basket, a second item, a card that only the person at the keyboard can produce, and a refund that may take a day to land. Four calls, one story. ### Primary Sources - **MCP "Key Changes: 2026-07-28" Changelog** — [Source]() — Published 2026-07-29 Read it for the negative space. Sessions and handshakes are gone; what institutions must now design themselves is the real story. - **Rabanser et al., "Towards a Science of AI Agent Reliability" (ICML 2026)** — [Source]() — Published 2026-07-29 Twelve metrics across four dimensions. Calibration — whether the agent knows it's uncertain — is the one most teams quietly skip. This makes the omission visible. - **Albayaydh, Zhao, and Flechais, "Beyond the Leaderboard" (July 2026 preprint)** — [Source]() — Published 2026-07-29 Unreviewed synthesis across 27 heterogeneous studies — treat accordingly. Its sharpest move: identifying measurement validity as its own failure cluster, which quietly undermines the other five. - **Zhou et al., "Authentication Security in Real-World Remote MCP Servers" (May 2026)** — [Source]() — Published 2026-07-29 A discovered-server sample, not a census. Useful for seeing what breaks in the wild; less useful for knowing how much of the wild it covers. The spec deprecated DCR, but open-client-environment flaws persist outside the spec's reach. - **Deliberate pair: METR Uplift Update (February 2026) and Murphy-Hill et al., Command-Line Coding Agent Adoption (July 2026 preprint)** — [Source]() — Published 2026-07-29 These measure different objects. METR found a 19% slowdown on tasks (CI: 2%–39%) and disclosed that AI access reshaped task selection enough to invalidate follow-up estimates. Murphy-Hill et al. found roughly 24% more merged pull requests, with their own caveat that a merged PR is an output proxy, not a productivity measure. Together they show how "does AI help?" fractures into incompatible questions depending on what you count and when you stop counting. - **Staufer et al., "The 2025 AI Agent Index" (FAccT 2026)** — [Source]() — Published 2026-07-29 25 of 30 surveyed agents disclose no internal safety evaluations. Before reaching for any reliability framework, it's worth asking whether the underlying data is public at all. Often it isn't. ### The Horizon Ladder A wrong parameter on a single tool call is annoying. A lost constraint propagating through a five-step chain is dangerous. A compressed summary that quietly drops the one fact preventing a catastrophic action twenty steps later is something else entirely. The failure modes change character as tasks get longer, not just frequency. Recent research quantifies what practitioners already feel in their debugging sessions: capability gains have outpaced reliability gains by roughly seven to one, and failures compound nonlinearly with step count. Scaffolding that fixes one band's problems can introduce new failure surfaces at the next. These six cards map each step-count band to its dominant failure mode and the specific instrumentation check worth running this week. - **One Tool Call, One Schema, One Chance** — [Source]() — Published 2026-07-29 Tag: Single Call Dominant failure: malformed arguments, wrong parameters, silent type coercion. Validate every argument against the tool's declared schema before execution. Then run the identical prompt five times. If tool selection or argument values drift between runs, you have a consistency problem that pass-at-one scoring will never reveal. - **Three to Seven Steps, Constraints Quietly Dropped** — [Source]() — Published 2026-07-29 Tag: Short Chain Dominant failure: a constraint established at step one gets silently violated by step four. Agents pick similar actions across runs but reorder them unpredictably. Log the provenance of every argument, tracing which prior output populated it. Compare final states across five runs, not just whether the chain completed. - **Dozens of Steps, Nonlinear Compounding Takes Over** — [Source]() — Published 2026-07-29 Tag: Full Session Dominant failure: degradation that compounds faster than linearly. A thirty-step session doesn't fail three times more often than ten steps. It can fail an order of magnitude more. Track the step number where the first unexpected action appears. Assert final state against the authoritative system of record, never the agent's own summary of what it did. - **The Agent Summarizes Away Its Own Constraints** — [Source]() — Published 2026-07-29 Tag: Context Reset Dominant failure: lossy compression at context boundaries. When history gets summarized, constraints from earlier steps vanish, and nothing downstream knows they ever existed. After every context reset, inject a probe question only answerable from pre-reset information. Consistent failure on that recall test means the compression layer is discarding critical state. - **Multiple Agents, One Broken Handoff Between Them** — [Source]() — Published 2026-07-29 Tag: Multi-Agent Dominant failure: every agent completes its piece correctly, but the handoff loses scope or constraints. Log which agent made each tool call and under what delegated authority. Compare what the orchestrator sent against what the subagent understood as its task. Divergence here is a coordination failure even when everything technically "succeeds." - **Hours to Days, Where Errors Become Irreversible** — [Source]() — Published 2026-07-29 Tag: Long-Running Dominant failure: error severity grows with elapsed time. A mistake you could reverse in thirty minutes becomes permanent after forty-eight hours of committed state changes. Track elapsed time on every unresolved approval gate. Assert final state against the authoritative record at task close. Replay golden tasks after any model or prompt change, because recoverability degrades silently. ### Where The State Went The MCP 2026-07-28 revision removes protocol-level sessions from Streamable HTTP. Everything that used to ride implicitly on a persistent connection now needs to be declared, carried, or echoed back. Otherwise it simply vanishes between requests. Where things landed varies. Some moved into per-request headers. Others became opaque handles the client passes as tool arguments. A few live in entirely new extension mechanisms. But the pattern holds: ambient context is gone, and explicit declaration is the only thing left. Each card below maps one implicit dependency to its new location and the concrete breakage a team hits by leaving it unaddressed. - **Capabilities Ride Every Request Now, Not Once** — [Source]() — Published 2026-07-29 Tag: Capability Negotiation Used to be settled in the initialize handshake and remembered. Now declared via _meta per request, with server/discover replacing the old capability exchange. Behind a load balancer, nodes that never saw the handshake treat every client as unknown and silently fall back to conservative defaults. Behavior drifts across retries. - **Protocol Version Moved from Handshake to Header** — [Source]() — Published 2026-07-29 Tag: Version Agreement Established once during session init. Now MCP-Protocol-Version is a required header on every Streamable HTTP POST, alongside Mcp-Method and Mcp-Name. In mixed deployments where some instances have upgraded and others haven't, identical requests get processed under different semantic rules with zero indication anything is wrong. - **Workflow Context Lives in Server-Minted Handles** — [Source]() — Published 2026-07-29 Tag: Application State Was keyed to Mcp-Session-Id, stored in-process or in a shared store. Now servers mint explicit handles (basket_id, browser_id) as tool results; clients pass them back as arguments. Skip this and a rebalanced request quietly spins up a fresh workflow. Your user's cart empties itself mid-checkout. - **Resuming Long Tasks Requires the Tasks Extension** — [Source]() — Published 2026-07-29 Tag: Task Resumption Previously a blocking SSE stream via tasks/result. Now the Tasks extension returns a handle from tools/call, polled via tasks/get with an opaque requestState. Retry without the handle and the operation re-executes from scratch. For anything non-idempotent, that's duplicate charges, duplicate sends, duplicate records. - **Pending Input Returns as a Result Type** — [Source]() — Published 2026-07-29 Tag: Human Input Was pushed over a persistent SSE stream. Now the server returns resultType "input_required" with inputRequests and requestState; the client re-issues the call carrying answers. Server-initiated requests outside active processing are flatly prohibited. Old SSE elicitation patterns either hang indefinitely or violate the spec outright. - **Cancellation Needs a Handle, Not a Session** — [Source]() — Published 2026-07-29 Tag: Task Cancellation Was discoverable through session-scoped tasks/list. Now tasks/cancel takes the handle returned at creation, and tasks/list is gone entirely. Without the Tasks extension there is no protocol-level stop mechanism. A timed-out retry and the original both run to completion, concurrently, doing the same work twice. - **Trace Context Replaces Session ID for Correlation** — [Source]() — Published 2026-07-29 Tag: Trace Continuity Session ID doubled as an ambient correlation handle in logs. Now W3C traceparent, tracestate, and baggage propagate in _meta per request. Without them, multi-hop tool calls across load-balanced instances produce disconnected spans. No session, no trace ID: reconstructing what actually happened becomes guesswork. - **Client Credentials Now Live at Metadata URLs** — [Source]() — Published 2026-07-29 Tag: Client Identity Was established through Dynamic Client Registration. Now Client ID Metadata Documents use an HTTPS URL as client_id, and the authorization server fetches metadata directly. Without the now-required iss validation and explicit application_type, auth flows either fail silently or stay open to token mix-up attacks. ### Past Articles - [The Evidence Locker]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Evidence Locker Concept An agent updates a billing tier, submits a regulatory form, merges a PR. Three days later someone shows up asking who authorized it. You reach for what you have: traces built for engineers debugging execution, outputs built for users seeing results. Neither answers the question. Both look like evidence because they're detailed, but specificity isn't verification. The evidence locker is a third artifact, designed for the stakeholder who arrives after the fact needing to accept, contest, or unwind what an agent did. Its contents scale with how hard the work is to reverse. - [What a Query Result Needs Before It Counts]() — By [Sable Whitford]() · Published 2026-07-23 · Format: SQL Evidence Bundle An agent runs a query. $14.2M comes back, clean execution, no errors. Looks like an answer. But the best-evaluated system in the EntSQL benchmark hit 15.9% accuracy when enterprise domain knowledge was required, and the benchmarks themselves carry annotation error rates above 50%. That number isn't an answer. It's a claim wearing a suit. What follows builds the evidence bundle that makes such a claim contestable, element by element, each layer entering because the previous one left something dangerously exposed. - [Precise About What?]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Practical Check Agent outputs keep getting more detailed, more structured, more confident-looking. That's exactly the problem. A text-to-SQL tool hands you clean numbers with decimal places. An API connector reports a successful authenticated call. A browser framework confirms it clicked the button. Every one of these outputs radiates specificity, and specificity feels like proof. It isn't. The detail is what I've been calling a precision alibi: the absence of visible failure standing in for the presence of actual verification. Three domains, one pattern, and a diagnostic habit worth building before the outputs get any more polished. - [False Precision]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Concept Hallucination has a name. Refusal has a name. There's a third AI failure mode nobody's bothered to name yet: output that is specific before anyone has verified what it means. A SQL query returns 1,847 rows against a schema nobody validated. A benchmark presents gold-standard annotations that turn out to be riddled with errors. A browser agent clicks a button and logs success. Every one of these carries the texture of correctness — the row count, the executed code, the green checkmark — without the meaning to back any of it up. We trust specificity. A precise answer gets less scrutiny than a vague one. That's exactly what makes this pattern dangerous enough to deserve a word. ## Other sections in Issue 40 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()