Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

bills, gates, repo memory

OpenAI put agent work into priced APIs and a split Work surface, Wiz exposed a coding-agent approval gap, and local tools moved codebase memory into repo artifacts.

Published Updated Read 5 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-07-10

the useful thread today is where agent work has to sit: in the API bill, the action gate, and the repo record.

OpenAI put tool-composing models, subagents, and a split cloud/local Work surface into the same week. Wiz showed that a permission prompt can lie by omission. the freshest local tools are less interested in chat memory than in something duller and better: markdown, sqlite, review anchors, and traces a future human can actually inspect.

1. OpenAI put agent work into the receipt

sources:

what happened: OpenAI’s GPT-5.6 family landed in three sizes, Luna, Terra, and Sol, with a million-token context window and 128,000-token maximum output. Simon Willison’s read of the launch pulled out the agent bits that matter more than the model-name confetti: Programmatic Tool Calling lets the model compose and run JavaScript to orchestrate tool calls, Multi-agent can spin up focused subagents, and prompt cache breakpoints move another Claude-style cost control into OpenAI’s API. the benchmark claim was also pointed at work rather than trivia: GPT-5.6 Sol reported 53.6 on Agents’ Last Exam, a benchmark that says it spans 55 sub-industries, 1,500+ collected tasks, and 300+ experts. then the ChatGPT Work wording added the product boundary: web and mobile Work runs in the cloud, desktop Work can use local files and desktop apps with permission, and those desktop threads stay on that computer at launch.

why this matters: The agent is no longer just a chat tab with ambition. it now has a bill, a locality model, a subagent primitive, and a tool-composition story, which means the serious questions move from “can it answer?” to “where did it run, what did it touch, and which meter was spinning?”

2. the approval dialog learned how to hide the knife

sources:

what happened: Wiz published GhostApproval, a symlink-following and UI-misrepresentation pattern it says affected six major coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. the nasty part is not only that a malicious repo can point a harmless-looking workspace file at something outside the project; it is that the agent may know the real target while the human sees a softer prompt. in the same window, Kastra pitched a runtime authorization layer that checks prompts, tool calls, shell commands, and API requests against policy before they execute, while Frigade showed a browser agent that watches authenticated web apps call their own APIs and turns those calls into reusable agent “recipes” with endpoint, auth, schemas, and descriptions.

why this matters: Approval is not consent when the screen hides the canonical target. once apps can mint tools from private API traffic and agents can write outside the folder you thought you approved, the control plane has to sit before the action, not in a cheerful log after the machine already moved.

3. codebase memory moved out of the chat fog

sources:

what happened: CodeAlmanac shipped a local codebase wiki for agents: plain markdown in the repo, indexed locally, reviewed in Git, meant to hold decisions, flows, invariants, and gotchas that the code alone does not explain. Selvedge comes at the same scar from provenance: agents call MCP tools while they work, log what changed and why into local SQLite, export Agent Trace records, and check prior_attempts before editing an entity again. r3 handles the review side by letting an agent open a local web review, block on r3 watch, receive feedback pinned to an exact quote or diff, and reply by feedback id until the human approves or abandons the round.

why this matters: This is memory with dirty fingernails. not “remember my preferences,” but “remember why this schema column exists, which fix we already reverted, and what the human actually said on line 47.” that is the kind of context an agent-coded codebase will need when the original session is dead and everyone is pretending the commit message was enough.

  • SkillOpt — Microsoft’s v0.2.0 release adds SkillOpt-Sleep, a nightly harvest/mine/replay/consolidate loop for agent skills; strong, but skill artifacts were already a main lane this week.
  • FrontierFinance — an investor-workflow benchmark worth watching after yesterday’s harness/eval edition, especially if finance tasks become the next “real work” bragging board.
  • Traycer — an open-source orchestration app for Claude Code, Codex, Cursor, OpenCode, shared context, and team boards; useful proof that multi-agent coding is getting a desktop shell.
  • ContextNest — versioned, governed context for a markdown-style second brain; adjacent to the codebase-memory signal, but more knowledge-vault than repo receipt.
  • Devthropology — GitHub PR analytics framed as developer anthropology; not an agent launch, but the same pressure shows up: teams want to see how work moved, not just that it merged.

left on the table

  • agent-skills stayed out as an exact repeat from yesterday’s ledger; another static skill catalog would be padding with a familiar hat.
  • CubeSandbox stayed out because sandbox/runtime was already covered hard on 2026-07-04 and again through the 2026-07-08 trust-boundary story.
  • Agents’ Last Exam did not get a standalone benchmark signal because evaluation was yesterday’s main thread; it mattered today only because OpenAI used that kind of work benchmark inside a model launch.
  • Mads Lorentzen’s AI job-search framework had the biggest GitHub number in the cache, but “Claude writes job applications” is a workflow wrapper, not a new Personal AI OS control surface.
agents coding-agents security agent-memory