may 28Opus 4.8ships alongside Dynamic Workflows and ultracode; ~4x less likely to let its own flaws pass unremarked
jun 9Fable 5 + Mythos 5Mythos-class model reaches general availability; sustains focus across millions of tokens
jun 12-30export suspensionUS government directive disables Fable 5 and Mythos 5 worldwide – the first forced revocation of deployed models
jun 30Sonnet 5Opus 4.8 performance at $2/$10; the new default
jul 24Opus 51M context by default in Claude Code; approaches Fable 5 at half the cost
Five model generations and one federal intervention in six months. The prompts from February still work. Everything else in this deck is about the part that had to survive that.
2023 – 2026 · three eras · this deck's framing, not an official taxonomy
The discipline grew up.
PROMPT ENGINEERING
2023 – 24 · the right words
optimized the phrasing of the ask
missed died of non-determinism at scale – same words, different day, different code
→
CONTEXT ENGINEERING
2025 · the right information
optimized what the model sees – curate, don't incant
missed information without enforcement is advice
Anthropic, "Effective context engineering for AI agents" (Sep 2025)
12-factor agents · ~23.5k GitHub stars (aug 2026)spec-driven development · GitHub Spec Kit, AWS KiroAgent Skills · open standard at agentskills.iovibe coding · Collins Word of the Year 2025, declared passé by Karpathy in 2026
Each era kept the previous era's tools – and demoted them from strategy to hygiene.
the thesis · three layers, one owner each
Where this deck plants its flag.
MODELS
rented
Five GA generations plus one federal intervention in six months. You do not own this layer; you subscribe to it, and it changes under you.
PLUMBING
shipping
Moving into the harness while you watch: workflows, native memory, the subagent mesh, sandboxing, skills marketplaces. Whatever glue you hand-rolled here is on a deprecation clock.
DISCIPLINE
yours
Instructions as code. Standards. Evidence. Evals. Governance. The one layer no vendor can ship you, because it encodes what your shop means by done.
The model is rented. The plumbing is shipping. The discipline is yours.
The rest of this deck walks the discipline layer – and proves it with 19 weeks of receipts.
"it feels faster"
→
what the telemetry actually says
PART I
The Reckoning
What six months of 2026 data settled about agentic development.
the real cost · industry data, 2026
Velocity without governance produces rework, not results.
+441.5%
median PR review duration. Throughput per engineer went up – and code started merging unread.
duplicated code blocks, 2023–2026 – the highest on record. Refactoring collapsed from 21% of changes to 3.8%.
GitClear, The Maintainability Gap (2026) · 600M+ commits
amplifier
AI amplifies the system around it. Good process compounds; missing process compounds too – they call it the "verification tax".
DORA, ROI of AI-assisted Software Development (2026)
84% / 29%
84% of devs use AI tools. 29% trust them. The top frustration, at 66%: output that's "almost right, but not quite".
Stack Overflow Developer Survey (2025)
The agents aren't broken. The instructions are missing. "Shipping 50% more, but half of that is cleaning up last week's slop." – Dexter Horthy, Coding Agents Conference 2026
the delegation gap · anthropic trends data, early 2026
AI is in 60% of your work. You can hand off a fifth of it, at best.
SHARE OF DEVELOPER WORK
AI-assisted
~60%
Fully delegable
0–20%
Everything between those two bars is work you still have to watch, steer, and verify. And ~27% of AI-assisted work is work that wouldn't have been done at all otherwise – the total pile grew.
Anthropic 2026 Agentic Coding Trends Report · early 2026
THE ROLE SHIFT
The same report's conclusion: the engineer's job moves from implementer to orchestrator. You spend less time typing code and more time directing the things that type it.
THE BOTTLENECK MOVED
Generation is no longer the constraint – verification is. That's DORA's verification tax showing up in your own calendar.
nobody promoted you to manage the workforce. the workforce arrived anyway.
the failure taxonomy · five plagues, coined v1
In 2024 these were surprises. In 2026 they're a taxonomy – with fixes.
We named these in v1 of this talk. They carried through every edition since – not because they're clever, but because they keep happening. Each one now has a discipline that answers it, later in the deck.
01 · CONTEXT DEATH
The window grew 5x this year and the plague moved instead of dying – compaction still eats your "why". Anthropic's own harness research (Mar 2026): context resets + structured handoffs beat compaction.
→ answered by context economics
02 · AGENT AMNESIA
New session, who dis? Everything you taught it yesterday is gone.
→ answered by state
03 · SCOPE CREEP
You asked for a bug fix. It rewrote your architecture. The yak shaving is real.
→ answered by standards
04 · QUALITY EROSION
Tool call 1: brilliant. Tool call 200: introduces the bug it was hired to fix.
→ answered by evidence
05 · "WORKS ON MY AI"
Your teammate's Claude produces completely different code from the same prompt.
→ answered by canonical content + generated adapters
quality erosion, live · the masked exit code
Lint passes. Tests pass. Production breaks.
real code that passed every check
local result=$(validate_input "$path") if [[ $? -ne 0 ]]; then
handle_error # never runs fi
The local keyword masks the exit code. $? is always 0. The error handler never executes. And every automated check says "all good."
AUTOMATED CHECKS
✓bash -n – syntax OK ✓shellcheck – no warnings ✓ unit tests – passing ✓ integration tests – passing ✗ production – silent data loss
THE INSIGHT
There are whole classes of bugs no linter can catch. Semantic correctness requires adversarial review, not just green checkmarks.
a wish list the agent skims
→
standards it cannot skip
PART II
The Standards
Instructions are the product – treat them like one.
Not tips. Not vibes. Engineering standards for the instruction layer.
every rule in this section was paid for.
standard 01 · the constitution
Your CLAUDE.md is the constitution. Everything else is legislation.
~/.claude/CLAUDE.md
Global · your personal conventions, every project inherits them
GLOBAL
workspace/CLAUDE.md
Workspace · shared standards across sibling projects, one source
WORKSPACE
project/CLAUDE.md
Project · architecture, variables, test details. Checked into git.
PROJECT
.claude/ · memory/ · docs/plans/
Governance dirs · settings, hooks, memory, plans – state that survives
GOVERN
START WITH THESE 5 LINES
1. Your language/framework conventions
2. "Don't add features I didn't ask for"
3. Commit message format
4. Testing requirements
5. Things that have gone wrong before
CLAUDE.md · from a real project (ours)
# Shell Standards
- Shebang: #!/bin/bash
- Use $() not backticks
- Double-quote all variables
- grep -E not egrep
- command -v not which
# Commit Protocol
- One commit per logical unit
- Format: VERSION | Description
- No Co-Authored-By lines
# Common Anti-Patterns
- NEVER local var=$(...)
- NEVER cd without || exit
- NEVER bare cp/mv/rm
# ...285 lines of hard-won rules
standard 02 · the qualifying bar
What makes an instruction a standard.
WRITTEN FROM INCIDENTS
Every NEVER rule maps to something the agent actually did wrong – not something you imagine it might do. My own slop report card: 28 documented corrections, 119 lessons learned, 34 NEVER rules. Zero hypotheticals.
the AI slop report card · author's own audit
ENFORCEABLE IN ONE LINE
A rule a grep or a hook can check beats a paragraph of intent. "command -v not which" is verified across the whole tree by one grep. A PreToolUse hook exiting 2 blocks the call outright – intent doesn't come into it.
if you can't check it mechanically, it's a hope
DERIVED, NOT REMEMBERED
Stats and counts are grep'd from source at write time, because forward-copied numbers rot. My README claimed "19 releases in 19 weeks"; re-derivation from git said 26 in 18. Doc counts now fail CI on mismatch.
rdf 3.6.3 · `rdf doctor doc-stats`
CONTEXT-BUDGETED
Every word is paid on every turn; instructions compete with the actual work for the same window. Governance overhead here is a measured number: 100 tokens default, 2,068 with full rules loaded – and the gap is deliberate.
measured 2026-08-17 · rdf-overhead.sh
A standard is an instruction that survives contact with an agent that did not read your mind.
standard 03 · evals
Your CLAUDE.md is code. Test it like code.
governance-contracts.bats
RDF ships behavioral contracts for its own prose: BATS tests that assert the evidence-discipline chain still exists in the canonical instructions. Not "does the file parse" – does the rule still say what it must say.
A prompt edit that silently drops a contract fails CI. The reworded paragraph that quietly deleted your safety rule gets caught by a machine, not by the incident it would have caused.
rdf 3.2.0 · derived from CHANGELOG, aug 2026
THE INDUSTRY CAUGHT UP
Anthropic's eval guidance treats agent behavior as a tested surface, not a vibe. If your instructions steer an agent, they need regression coverage.
"Demystifying evals for AI agents" · Anthropic engineering, jan 2026
DON'T LET IT GRADE ITSELF
Agents overrate their own work. Use a separate, calibrated evaluator – a different context judging the output, not the author judging its homework.
Anthropic harness-design post, mar 2026
Prompts regress exactly like code, and nobody diffs prose – so make the CI do it.
standard 04 · enforcement
Prose doesn't enforce. Hooks do.
prose asks
violated in 5 of 5 live dispatches
→
review catches
only what it reads, when it reads it
→
hooks block
PreToolUse exit 2 – can't talk past it
→
physical rejection
the bad state is unrepresentable
WHAT PROSE GOT ME
6 recurring concurrent-session incidents.
One live dispatch showed a 75% out-of-scope leak rate.
Written instructions violated in 5 of 5 live dispatches.
The rules were clear. The agents read them. It didn't matter.
WHAT ACTUALLY WORKED
UUIDv7 session IDs on a session bus.
Session-scoped state files.
A pre-commit hook that physically rejects out-of-scope commits.
Not a request. A wall. The commit doesn't happen.
ANTHROPIC REACHED THE SAME CONCLUSION
"How we contain Claude across products" (May 25, 2026): gVisor containers for claude.ai, OS-level sandboxing with network-deny-default for Claude Code, full VMs for Cowork – and allowlists framed as capability grants, not suggestions.
Two independent shops, same ladder: the rule that matters is the one a process enforces when nobody's reading.
standard 05 · evidence
Evidence or it didn't happen.
phase result · gate 1
STATUS: DONE EVIDENCE:← one line per claim, or DONE fails
- <path>:<line>– where the change landed
- <cmd> -> <output>– the test run, pasted
- <sha> <message>– the commit that exists
GATE 1– empty or missing block on DONE: REJECTED QA– re-runs the cited commands, compares output a claim is an input to verification, not a result
rdf 3.0.6 · evidence discipline, from CHANGELOG
/r-verify-claim
Five closed-set claim classes – commit-landed, pattern-absent, pattern-present, file-unchanged, behavior-observable – plus an honest UNVERIFIABLE verdict. Reviewers must run it on MUST-FIX assertions before asserting them.
REGRESSION-CASE, NAMED
Every plan phase names its regression case, or declares N/A from a closed-set category. The security category demands a CVE, bug, or issue reference – not a shrug.
TWO SHOPS, ONE FINDING
Anthropic's harness research: agents overrate their own work – use a separate, calibrated evaluator. My report card said it shorter:
"The AI will tell you it checked, and it didn't."
Anthropic harness-design post, mar 2026 · the AI slop report card
DONE is not a status the agent grants itself. DONE is a verdict the evidence earns.
one agent, one window, one prayer
→
forks, workflows, skills, state
PART III
The Runtime
The harness industrialized – what's worth building on it now, and what's worth letting the vendor build for you.
the machinery layer. bring a budget.
the mechanics · context is a bill
What one turn actually costs.
A turn is one message + one response. Every turn re-sends the entire payload:
system prompt, every CLAUDE.md layer, memory, tool schemas, and the whole conversation so far.
Nothing is free just because you sent it already. Context is a budget you measure, not a vibe.
ONE TURN · WHAT THE MODEL RECEIVES, EVERY TIME
system
CLAUDE.md
mem
tool schemas
conversation + tool results (unbounded)
TOOL SEARCH
MCP tool definitions deferred until actually needed. Default-on since Jan 2026: ~85% less MCP token overhead. The schema tax mostly fixed itself.
Anthropic engineering figure
PROMPT CACHING
The stable prefix (rules, schemas) is cached and re-billed at a discount. Since Aug 2026, forked subagents inherit the conversation and its cache instead of paying cold.
Claude Code, aug 13 2026
CONTEXT DISCIPLINE
Subagents keep file dumps and grep spew out of the main thread. /compact compresses, /clear resets – use them on purpose. Anthropic's own finding: context resets + structured handoffs beat compaction.
Anthropic harness-design post, mar 2026
THE PUNCHLINE ·
every word in CLAUDE.md is paid on every turn. governance overhead is a real number you can measure –
the pipeline you'll see shortly runs at 100 tokens by default (measured 2026-08-17).
the state layer · why it remembers
Four files give the agent a persistent brain.
~/my-project/ · what the agent reads on startup
CLAUDE.md– the rules (checked into git) PLAN.md– current work state .claude/settings.json– hooks & perms ~/.claude/ CLAUDE.md– your personal rules projects/*/memory/ MEMORY.md– learned context user_role.md, feedback_*.md, ...
THE KEY INSIGHT
No database. No cloud service. No setup wizard. It's just files. The agent reads them every session, automatically.
That's how it remembers your rules, your preferences, and where you left off.
CLAUDE.md
solves Plague 05 "works on my AI"
MEMORY.md
solves Plague 02 agent amnesia
PLAN.md
solves Plague 03 scope creep
settings.json
solves Plague 04 quality erosion
RDF STATE LAYER · THE INDUSTRIAL VERSION
session bus – every session gets a UUIDv7 ID and session-scoped state files. Two concurrent sessions stop clobbering each other's plans and locks. lessons index – an ID-index of hard-won lessons, hard-capped at 400 bytes, injected at SessionStart. The full lesson loads only when relevant.
THE HOOK CHAIN · MEMORY THAT SURVIVES /compact
PreCompact → snapshot state before context squeeze
SessionStart → re-inject snapshot + lessons index
SessionEnd → git-snapshot journal of what happened
MEASURED OVERHEAD · 2026-08-17
100
tokens · default
674
tokens · rdf-lite
2,068
tokens · full rules
governance you can afford on every turn
the orchestration layer · ladder, mesh, doctrine
Orchestration: rent the plumbing, keep the doctrine.
SUBAGENTS
spawn a worker, get a report back
→
AGENT TEAMS
research preview, Feb – obsolete by May
→
DYNAMIC WORKFLOWS
May 28 – control flow in code, judgment in models; hundreds of subagents
→
ULTRACODE
xhigh reasoning + auto orchestration, one violet keyword
THE MESH · JUL–AUG 2026
forking – subagents inherit the full conversation + prompt cache
background sessions – /fork and keep working
SendMessage – talk to running agents across sessions, even across machines
Self-contained payloads – subagents can't prompt the user or update the parent's task list
Commit hash = delivery – no hash in the result means the work didn't land
One owner per shared file – two agents on one file is a guaranteed merge conflict
Verify with git log – never trust the agent's summary; check the actual commits
SIMPLICITY BUDGET ·
parallel fan-out is a ~15x cost bet. Serial is the default; parallel is reserved for provably breadth-first work. "Hundreds of subagents" is a capability, not a suggestion.
HOW THIS FELT FROM THE GROUND
MARCH– RDF hand-builds exactly this: dispatcher, gates, parallel worktrees MAY– Anthropic ships it native as Dynamic Workflows AFTER– RDF deletes its version. no regrets
build the discipline, rent the plumbing. the discipline transfers; the plumbing gets shipped out from under you.
the runtime · skills
Skills: instructions that load only when needed.
.claude/skills/deploy-runbook/SKILL.md
--- name: deploy-runbook description:Use when shipping a release --- # instructions live here, plus any # scripts and references the task needs
PROGRESSIVE DISCLOSURE
Only the name and one-line description sit in context. The full instructions load when the task actually triggers them. This is the context-cost answer to the fat CLAUDE.md that taxes every single message whether it's relevant or not.
Open standard at agentskills.io – skills are portable across tools, not a Claude Code lock-in.
MARKETPLACES
Plugin marketplaces distribute skills, commands, and agents as installable bundles. Archive sources are SHA-256-pinned – you install a hash, not a moving tag.
THE SECURITY PART
A skill is instructions your agent will follow. Anthropic's own guidance: audit third-party skills before install. Said plainly: a skill is a prompt-injection surface you chose to mount. Treat it like installing a shell script from a stranger, because that's what it is.
memory = what the agent knows. skills = what the agent knows how to do.
vendor churn · the line item nobody budgets
Surviving your vendors.
CLAUDE.md
.cursorrules
copilot-instructions.md
GEMINI.mdORPHAN
Four rule files for one codebase – and they drift the moment someone edits one and forgets the other three.
THE FREE TIER VANISHED
Google cut Gemini CLI's free tiers on Jun 18, 2026. The tool left the workflow mid-quarter; the GEMINI.md stayed in the repo – a rule file governing nobody.
THE ABSTRACTION DIED YOUNG
Agent Teams: research preview in Feb, obsoleted by Dynamic Workflows in May – one release cycle. RDF had bet a whole dispatch abstraction on it, and deleted the lot.
THE ANSWER IS A PATTERN, NOT A PRODUCT · CANONICAL CONTENT, GENERATED ADAPTERS
canonical/
write governance once
→ generate →
claude-code
plugin marketplace
codex
agents-md
.agents/skills/
gemini-cli FROZEN
RDF runs 6 adapters off one canonical source. When Google cut the tiers, the Gemini adapter was demoted to frozen legacy – the content lost nothing, the dead surface just stopped regenerating. The industry is converging the same direction: AGENTS.md and shared .agents/skills/ as cross-tool surfaces.
your governance should outlive every tool it governs.
"this framework stuff sounds nice in theory"
→
git log says otherwise
PART IV
The Evidence
19 weeks of building a governance framework, now public.
Version numbers you can grep for, failures with exact blast radii.
everything in this section actually happened.
march – july 2026 · the version arc
The arc: 28 releases in 19 weeks.
mar 61.0.0the workforce framework – agents get names, roles, and rules
mar 162.0.0canonical-first: one source of truth, a CLI, adapters generate the rest
jul 15-163.6.1–3.6.3the truthfulness releases: fixed nothing but honesty and parity bugs
Each version answered a failure the previous one exposed. 8 releases shipped on jul 15 alone; the first outside contributor landed at 3.1.3.
where the arc landed · rdf 3.6.3
What a mature pipeline actually looks like.
/r-spec
requirements + challenge review
→
/r-plan
phases, deps, scope classes
→
/r-build
TDD, worktrees, gated phases
→
/r-verify
QA gate, read-only
→
/r-review
adversarial sentinel
→
/r-ship
release + publish
planner
opus
dispatcher
sonnet
engineer
opus · sonnet small
qa
sonnet · read-only
uat
sonnet · read-only
reviewer
challenge: sonnet pre‑impl sentinel: opus post‑impl
GATES · AUTO-DERIVED FROM PHASE SCOPE
G1 self-report → G2 QA → G3 sentinel → G4 UAT
TIERS · FULL / QUICK / BUGFIX
max(security_floor, min(scope_gate, tier_cap))
a 5-line fix isn't a 12-gate ceremony. the security pass never drops.
july 2026 audit: 518 governed sessions · 30+ projects · 2,513 commits · 6,871 BATS tests across 13 repos
war stories · eating the dog food
The framework had bugs too
💣
RCE in the audit tool – git commit messages interpolated into Python; a ''' in a message could execute code3.3.0
🟢
CI green because it never ran – a bad workflow guard meant 0 jobs on every push since 3.0.53.1.3
🏠
The enforcement hook never left home – the headline 3.1.0 safety feature was never deployed outside RDF's own checkout3.6.2
🪄
The Codex adapter shipped a hallucinated command catalog – commands that never existed. inventories now derive from the filesystem3.6.1
📏
The overhead meter measured itself wrong – mis-resolved its own home, reported 100/null instead of 2,068/674 tokens3.6.3
🤐
The plugin tier lied by omission – 10 commands silently degraded with no disclosure. same seam broken 3 times3.6.3
📜
15 of 37 command files emitted unparseable TOML – nobody parses your output until someone does3.6.0
Three consecutive July releases (3.6.1–3.6.3) fixed nothing but honesty – the framework's own adversarial review machinery, pointed at its own documentation.
the governance system ate its own dog food and found it half-cooked.
war stories · rapid fire
The Greatest Hits
💀
Named a function head() – shadowed /usr/bin/head across entire codebaseAPF
💥
Moved run() into test namespace – 1,185 of 1,599 tests instantly failedBFD
📦
RPM/DEB packages missing 9 runtime libraries – would ship a non-functional appBFD
👻
Audited functions that don't exist – hallucinated duplicate code bodiesAPF
🔀
Asked to fix path traversal RCE – fixed a different bug, declared successLMD
✅
Signatures "passed validation" but used syntax LMD silently rejects – dead on arrivalSigforge
🤖
Used -i flag in bats-assert – flag doesn't exist, was testing for literal string "-i"APF
all real. all committed. all caught before release – by governance, not by luck.
the proof · telemetry, derived not remembered
2,159 sessions. One developer.
LIVE derived 2026-08-17
2,159
sessions
47
project workspaces
158
days
5,900+
commits since March
GOVERNANCE AUDIT july 2026
518
governed sessions
30+
projects
2,513
commits
6,871
BATS tests, 13 repos
RDF CADENCE mar–jul 2026
28
releases in 19 weeks
418
commits, 26 working days
8
releases in one day (jul 15)
Blast radius: ~350,000 active servers run software maintained under this governance.
these numbers were re-derived from source the day this deck was rebuilt – because the framework's own changelog caught me forward-copying stats once. README said 19 releases; git said 26. doc counts now fail CI on mismatch.
the model is rented
·
the plumbing is shipping
·
the discipline is yours
PART V
The Position
What's left to own.
Where to stand while the ground keeps moving.
the ladder · april vs august
The ladder got shorter. The discipline didn't.
L1 · Prompts
ask and pray
L2 · Instructions
CLAUDE.md + memory
L3 · Governance
plans, hooks, review gates
L4 · Pipelines
spec → ship, orchestrated
WHAT 2026 DID TO L4
In april, L4 meant building your own orchestration. Then the plumbing went native: Dynamic Workflows (may 28), background agents and subagent forking, cross-session mesh (jul–aug) – all shipping in the harness itself. RDF deleted its hand-rolled version by July. The climb from L3 to L4 is now mostly a config file.
WHAT STAYS YOURS, AT EVERY LEVEL
Standards. Evidence requirements. Evals for your own prose. Enforcement that can't be talked past. Canonical governance that survives a vendor change. No release note will ever ship your judgment about what "done" means – that layer is the job now.
Most teams are still at L1. You don't need L4 to be productive – L2 is a 30-minute investment that changes everything. Next slide is the whole investment.
fixture · starter CLAUDE.md
The 30-minute harness.
CLAUDE.md
# CLAUDE.md
## Style
- <language> · <formatter> · <test command>
- Match existing conventions; read neighboring code first
- Quote everything; no clever one-liners I'll debug later
## Done means tested
- Run the tests before claiming done
- Paste the output; a claim without evidence is a guess
## Scope
- NEVER add features I didn't ask for
- NEVER "fix" code adjacent to the task
- Ask when the spec is ambiguous; don't pick silently
## Commits
- One commit per logical unit; stage files by name
- No Co-Authored-By lines
## Scars
- When something goes wrong, the fix is a new NEVER rule here
EVERY BLOCK IS A SCAR
Style rules stop drift. Scope rules kill day-one feature creep. The evidence rule exists because "the AI will tell you it checked, and it didn't."
WRITE IT ONCE
The same file serves AGENTS.md-style tools across the ecosystem. One canonical source of truth; every harness reads it.
THIS IS L2
This file is the L2 investment from the maturity ladder: 30 minutes, and it changes every session after it.
closing argument · four truths and a bet
Four truths and a bet.
01The model is capable. The instructions are the product.
Your CLAUDE.md is more important than your prompt.
02Every rule is written in blood.
Don't skip governance because you haven't been burned yet.
03The gap between vibing and engineering is 30 minutes.
Start with CLAUDE.md + memory. Grow from there.
04The ground will move again.
Gemini free tiers died jun 18; Agent Teams was obsoleted in one release cycle. Canonical content plus generated adapters is how governance outlives its vendors.
2026
The bet: this is the worst AI-generated code will ever be.
aging note · aug 2026: the thesis was written in april. four model releases (opus 4.8 → opus 5) and one federal export-control intervention later, it held.
Prompts to Pipelines
Stop vibing. Start engineering.
Ryan MacDonald
ryan@rfxn.com
|
rfxn.com
R-fx Networks
|
github.com/rfxn
APF · BFD · LMD · RDF
first assembled april 2026 · rebuilt foundationally august 2026 – by claude code, under the governance it describes
every stat re-derived from source at rebuild time
no vibes were harmed in the making of this deck