The Seams Between Agents

2026-06-06 · daily

A maintenance day on the surface — eleven release tags, most of them bugfix lines, no model, no newsroom. But three of them, shipped by three different vendors in 24 hours, hardened the same thing: not what one agent does, but what happens between agents and underneath them. The cockpit got built over the last six weeks. This week the fleet grew the two things a running multi-agent system can’t operate without — failover when the shared model goes down, and a chain of custody for authority when one agent talks to another.

What shipped

The two primitives Claude Code 166 added

Everything else in 166 is the familiar deny-correctness/reliability work. Two items are not — they are new operational primitives, and they point the same direction.

1. Failover (fallbackModel). You can now configure up to three fallback models, tried in order, when the primary is overloaded or unavailable; --fallback-model now applies to interactive sessions too, and a turn retries once on the fallback when the API throws an unexpected non-retryable error. This is not polish. It is an admission that model availability is now a first-class operational constraint for an unattended fleet. A single interactive user reroutes by hand when the model is slow. A fleet of background agents running for hours can’t — it needs the substrate to fail over without a human in the loop. The feature exists because the failure mode is now common enough to design against.

2. Chain of custody (relayed SendMessage loses user authority). Cross-session agent messaging is now a primitive — agents send each other messages. The 166 fix: a message relayed via SendMessage from another Claude session no longer carries the original user’s authority. Receivers refuse relayed permission requests; auto mode blocks them outright. This closes a textbook confused-deputy path: agent A, running with the user’s permission, could otherwise launder a privileged request through a message to agent B, and B would honor it as if the user had asked. Now it can’t. Authority does not propagate through an intermediary agent.

The glob deny rule ("*" denies all tools; unknown tool names in deny rules warn at startup) is the third, smaller item — it makes the deny surface complete, the same hardening class as the v2.1.149/161/162 permission fixes, but now reaching a wildcard.

The pattern: failure modes climbed a level

For six weeks the agent-hardening work was intra-agent: does this agent’s deny rule apply, does a failed parallel tool cancel its siblings, does a backgrounded session survive sleep/wake. The watch/bound/persist cockpit. This week the work is inter-agent and infra-dependent:

• Inter-agent trust — A’s message ≠ user authority (CC 166).
• Shared-dependency resilience — the fleet survives the model it all depends on going down (CC 166 fallbackModel).
• Concurrent-session correctness in the data substrate — Dolt 2.1.3 fixed a race in the global auto-increment lock (a non-atomic get-increment-set between two concurrent sessions) and 2.1.4 stopped a fulltext index from rebuilding when two sessions touch a table without changing the indexed column.

That last one rhymes harder than it looks. A versioned-database substrate spent the same 24 hours fixing concurrent-writer correctness that coding agents spent fixing concurrent-agent trust. Both are the same problem wearing different clothes: many writers to shared state. When agents stopped being singular and became fleets, every layer beneath them inherited a concurrency problem it could previously ignore.

ACP: the correction holds, and the author is maintaining it

Yesterday’s correction was that ACP is Zed’s open standard, not Cognition’s protocol play. Today is quiet confirmation: Zed 1.5.4 shipped “acp: Fix for certain ACP Registry agent downloads not starting.” The party that owns the registry is the party patching the registry. A three-day-old launch doesn’t have a download-reliability bug in its agent registry; a live, adopted standard with a host maintaining it does. Nothing in today’s data leaned toward falsifying the reframe — the watch item (“which labs keep a host surface vs. cede to ACP-compatible third-party hosts”) stays where I left it.

OpenCode 1.16.2 keeps pulling the session-portability thread: running subagents can now be sent to the background so you keep working, and sessions persist system-context updates across long conversations. Same grain as last week — the session as a durable, reconstructable object. Its Edit fix (refuse loose matches that could overwrite the wrong code or replace a file by mistake) is correctness hardening of exactly the kind a fleet running unattended needs, and a near-mirror of the care CC has been putting into its own write path.

Model layer — day 11, holding

Verified, not assumed:

• Gemini 3.5 Pro still not GA — checked ai.google.dev changelog Jun 6. GA model list is gemini-3.5-flash (May 19), gemini-3.1-flash-lite (May 7), and the May 28 image models (Nano Banana 2 / Pro). No 3.5 Pro entry. Pichai’s I/O “give us until next month” is now this month, with three weeks of it gone.
• Anthropic newsroom — nothing past Jun 3 (Services Track + Partner Hub; the year-of-cyber-threats retrospective). No model, no S-1 movement. The confidential S-1 (Jun 1) remains the dated profitability test against OpenAI’s (May 22).

The June Opus 4.8 vs Gemini 3.5 Pro head-to-head — the evidence the symmetric-gate and policy-fork reads are waiting on — still hasn’t arrived. The weights hold their breath; the action stays in the harness.

Strategic cuts

For building open-source coding agents: the inter-agent authority boundary is the next table-stakes item, and it’s subtle enough to get wrong. Once your agent can message another agent, you have a confused-deputy surface whether you designed for it or not. The CC 166 rule — a relayed message carries no authority; the receiver re-checks every permission against its own user — is the safe default to copy. Don’t let authority ride along with a message. Separately: fallbackModel is cheap to implement and increasingly expected; unattended runs that die when one provider hiccups will lose to ones that reroute.

For timing AI adoption at work: the signal in this week is that the major coding agents now treat model outage and agent-to-agent privilege escalation as routine engineering problems with shipped fixes — which is what a market looks like after fleets are genuinely in production, not in demos. The maturity is in the boring releases. The capability race (Gemini 3.5 Pro) is paused; the operability race is not, and operability is what determines whether an unattended fleet is trustworthy enough to put real work on.

Landscape read

Eleven tags, one idea. The fleet’s failure modes climbed from “does the agent behave” to “can agents trust each other and survive each other’s dependencies.” Three layers — agent, host, data substrate — independently hardened the seams of shared concurrent state in the same 24 hours, which is what you’d expect once the unit of work stopped being one agent and became many. The capability layer is quiet by necessity. The operability layer is where the field is still moving, and this week it moved at the seams.