Outlook

---

1. Judgment Method and Fact Standards

This chapter makes judgments about the future and therefore strictly enforces three caliber disciplines:

1. Separation of facts and judgments: statements with a cited source are factual statements; the inferences of this chapter uniformly begin with "Judgment:".
2. Three-part trend structure: each technological trend is presented in three parts — "Drivers / Current evidence / Uncertainty"; the uncertainty part candidly states the conditions under which the trend may fail to materialize or deviate in form.
3. Source levels: Level A consists of official first-hand statements from vendors or institutions and may be cited directly; B/C-level figures are uniformly marked; matters for which no authoritative information is available are declared as such, without speculative fill-in.

---

2. Technological Trends

2.1. Automation of Context Engineering

Drivers. Context engineering has become the first engineering lever of agentic systems, but it is still mostly manual: information degradation within the context window, state management in long-running tasks, and the prioritization of multi-source information all rely on manual design by engineers. Three pressures drive its automation: first, long-running tasks (a single task often exceeding 6 hours, per OpenAI's official experimental baseline) make manual context maintenance unsustainable; second, the impact of context degradation on model performance has been confirmed by multiple experiments (the relevant quantitative figures are marked [To be verified]); third, token costs make "full injection" economically infeasible.

Current evidence. Automation mechanisms have already landed in leading products (Level A): Anthropic officially provides four strategies — compaction (compression), note-taking (notes), memory tool (memory tool), and sub-agent (sub-agent dispatch, where a sub-agent consumes tens of thousands of tokens but returns only a 1,000–2,000-token summary); the three-level progressive disclosure mechanism of Agent Skills turns "what to load when" into declarative rules; Lance Martin's four pillars (Write / Select / Compress / Isolate) and Anthropic's four strategies have formed two mutually translatable taxonomies, indicating that this layer is converging on a standard terminology system. The statelessness and cache-reuse mechanisms of the 2026-07-28 edition of the MCP specification provide protocol-layer support for context management.

Uncertainty. First, the extension of models' effective context will absorb part of the demand for compression and pruning (Anthropic officially states that it is "dynamically retiring redundant Harness designs as model capabilities improve"); the boundary of automation will drift along with model capabilities. Second, automatic compression may lose task-critical information, and its reliability itself requires a safety net from the evaluation layer — automation of context engineering and evaluation-driven development (see Section 2.2) are mutually dependent trends.

2.2. Evaluation-Driven Development

Drivers. The vast gap between adoption and trust (see Section 4.1) makes "predictability" the core purchase reason for agentic systems, and predictability can only be delivered by the evaluation layer. At the same time, enterprise-side productivity data suggest that the speed dividend is approaching its ceiling: DORA 2025 shows that AI adoption is positively correlated with software delivery throughput but negatively correlated with delivery stability ([To be verified]) — once the speed dividend is exhausted, the engineering focus will inevitably shift to quality and stability, i.e., evaluation.

Current evidence. Evaluation has been internalized from external leaderboards into system components (Level A): OpenAI has built tracing into its Agents SDK; Anthropic has built an independent Evaluator and hard-threshold scoring into its long-running Harness; Google ADK ships AgentEvaluator.evaluate() natively, which can score both the final response and the step-by-step trajectory. On the benchmark side, SWE-bench and Terminal-Bench have established the standard for programmatic criteria ("either the automated test passes, or it does not"). On the methodology side, martinfowler.com has publicly proposed "we need Harness coverage and quality evaluation methods analogous to code coverage and mutation testing" — the agenda of porting the software-engineering maturity model to the Harness layer is now on the table.

Uncertainty. First, subjective tasks (design, content, consulting) lack binary criteria, self-evaluation bias is particularly pronounced on such tasks, and human-in-the-loop designs that separate the evaluator from the evaluated have no convergent solution yet; second, "what is the best eval" remains unsettled (Dex Horthy's open question: have a model build 20 features in a row in a codebase without knowing what comes next); third, the evaluation set itself can overfit, and the maintenance cost of a Golden Dataset may grow super-linearly with task complexity.

2.3. Harness Standardization and Interoperability

Drivers. The fragmentation of interfaces in agentic systems brings a dual cost: users are locked in to a single vendor, and providers repeatedly reimplement the same access layer. Standardization reduces the transaction costs of both sides, and the scale of the ecosystem has reached the tipping point for standardization.

Current evidence. Standardization has moved from "de facto standards" to the "neutral governance" stage (Level A): on 2025-12-09 the Agentic AI Foundation (AAIF) was established under the Linux Foundation, with Anthropic donating MCP, Block donating goose, and OpenAI donating AGENTS.md; at its founding, MCP already had 10,000+ public servers and 97 million SDK downloads per month, and AGENTS.md was already adopted by 60,000+ open-source projects. Protocol evolution mechanisms have been established: the 2026-07-28 edition of MCP makes the protocol core stateless, introduces an Extensions framework, and establishes a formal deprecation policy with a minimum 12-month window. On multi-agent interoperability, A2A released v1.0 in 2026-03 (including Signed Agent Cards), and supporting organizations grew from 50+ to 150+.

Uncertainty. First, whether standards will evolve or freeze — OpenAI engineer Nick Cooper has publicly expressed concern about standards becoming rigid ("these protocols should not stagnate in a foundation for two years"), and Linux Foundation Executive Director Jim Zemlin acknowledges the risk that "de facto standards override legal standards"; whether AAIF's governance mechanisms can keep up with the iteration speed of models and Harness will determine whether MCP becomes the next Kubernetes or the next CORBA. Second, this research did not find any international standards for agent interconnection at the ISO/IEC level; if progress appears at that level, the judgment on the global standardization landscape will need to be rewritten.

2.4. Convergence of Multi-Agent Orchestration

Drivers. The contest between single-agent and multi-agent architectures is the currently unresolved core design question. The forces driving convergence come from two ends: the empirical pressure of orchestration complexity and coordination costs (multi-agent brings context duplication, coordination failures, and error amplification), and the substitution pressure of "implicit planning inside the model" on explicit orchestration (improving model capabilities push part of the orchestration down into the model).

Current evidence. Evidence from both sides coexists (Level A): Anthropic officially concedes that "whether a single general-purpose coding agent is always optimal, or a multi-agent architecture split into specialist agents is better — it is currently unclear"; OpenAI's million-line code experiment was primarily single-agent (approximately 1 million lines of code, approximately 1,500 PRs, 3.5 PRs per person per day). At the same time, multi-agent delivers clear benefits in parallel-exploration scenarios (Anthropic's multi-agent research system; the token economics of sub-agents). In the content-production domain, the "implicit planning inside the model" route has already emerged — video generation models automatically complete multi-shot planning and switching within a single generation, in contrast to the "node-based workflow" route.

Uncertainty. This is the trend with the highest uncertainty among all: vendor official statements report more open problems than solved ones. The reliable version of the judgment can only be a weak proposition — orchestration forms will differentiate by the degree of task certainty (deterministic flows use workflows, exploratory tasks use autonomous loops and sub-agent dispatch), rather than converging on a single architecture.

2.5. Edge and Local Harness

Drivers. Three compliance and economic pressures push Harness toward the edge and local deployment: first, data not leaving the domain is a hard constraint (中注协 explicitly prohibits feeding confidential information into public AI platforms; GB/T 45654—2025 imposes strict requirements on training data and sensitive personal information); second, the API cost of scaled invocation and the supply of domestic compute; third, the latency and offline-capability requirements of edge scenarios (personal devices, industrial sites).

Current evidence. Evidence from three aspects (Level A/B): runtimes moving down to system-level languages — Codex CLI was rewritten from Node.js to Rust in the second half of 2025, with the official rationale being static single-file distribution, no GC, and direct invocation of OS sandbox primitives (the figure of an approximately 95% rewrite ratio is marked [To be verified]); this is a signal of Harness moving from "application-layer tool" to "system software". Local deployment practice — 中国建科, based on a local private deployment of DeepSeek, launched AI contract review and rolled it out comprehensively; ComfyUI provides a fully local, offline content-production pipeline. Open-weight models adapted to domestic compute — 海螺 AI open-sourced the weights of H3 and completed adaptation to multiple domestic chips including 华为昇腾, 摩尔线程, and 沐曦.

Uncertainty. First, the constraints of edge compute and memory on model scale will not disappear in the foreseeable period, and the boundary of the edge–cloud division of labor will continue to swing; second, the evaluation and update costs of local Harness are higher than in the cloud (upstream regression sets cannot be shared), and their long-term economics remain to be validated; third, the compliance responsibility of the open-weight route lies entirely with the deployer (the service-provider identity is non-transferable), and governance costs may offset part of the cost advantage.

2.6. Summary of Technological Trends

The overall uncertainty that needs emphasis: the pace of leaps in model capability is unpredictable. If a capability leap occurs, most architectural judgments in this chapter must be reassessed within 6 months — this is the common premise of all trend judgments.

---

3. Standardization Trends

3.1. The Global Layered Standard Stack

图 3-1｜全球智能体标准栈：从上下文接入到跨厂商身份

数据来源：基于本文分析绘制的示意图。

The current agent standard stack already presents a clear layering (Level A, synthesizing official sources):

Google's official delineation of the division of labor between MCP and A2A: "MCP manages internal tool integration, while A2A handles the vital external coordination between autonomous entities."

3.2. The Tension Between Neutral and Open Governance

The establishment of AAIF marks standardization entering the neutral governance stage (Platinum members include eight organizations: AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI). But within open governance there are two tensions worth placing side by side:

1. Evolution vs. freezing: standards need stability to support the ecosystem, but cannot be so stable as to fall behind model iteration. MCP's 12-month deprecation window is the current institutionalized answer to this tension.
2. De facto standards overriding legal standards: even with open governance, one company's implementation may still become the default by shipping the fastest and being used the most. Jim Zemlin uses the Kubernetes analogy: "dominance emerges from merit and not vendor control".

Judgment: in the coming 12–24 months, the biggest watch item in standardization is not "whether there will be standards" (there already are), but "whether standards will evolve or freeze".

3.3. China Special Chapter: The GB/Z 185—2026 Agent Interconnection Standard System

China has issued the first systematic national standard for agent interconnection in the world. This is the core text for understanding the governance path of China's agent industry, and this section is set apart on its own.

3.3.1. Basic Information on the Standard

Three versions of the release date exist; they must be presented side by side and marked [To be verified]: 中国日报 records 2026-05-22; 百度百科 records 2026-06-26; a 人民网 report dated 2026-07-09 (worded as "released recently"). The body of this whitepaper adopts "H1 2026" and does not adjudicate among the three versions.

3.3.2. The Seven-Part Structure

The seven parts form a complete closed loop: identity code (who it is) → identity management (how to prove it) → description (what it can do) → discovery (how to find it) → interaction (how to collaborate) → tool invocation (how to act).

The definition of an agent given by Chinese officials can serve as the standard formulation in the Chinese context (Level A, standard interpretation by the jurisdictional body): "An agent is a new type of intelligent system with autonomous perception, memory, decision-making, interaction, and execution capabilities, and has become a key carrier of artificial intelligence products and services."

3.3.3. Implementation Progress and Follow-up Plans

• Implementation progress: on 2026-08-31, the application (Yangtze River Delta region) promotion special meeting for the 《人工智能 智能体互联》 national standard was held in Zhangjiang, Shanghai; 30 organizations including 思必驰, 联想, 中兴通讯, 火山引擎, and 上海交通大学 were awarded "agent identity code nodes" (Level A).
• Follow-up plans (Level A, officially explicit): first, advance the conversion of identity-code-related standards into mandatory national standards at an appropriate time; second, accelerate the development of sub-standards for agent auditing, agent trading, and the like.

3.3.4. The Broader Chinese Standardization Background

3.3.5. Judgments

Judgment One: identity is the core lever of the Chinese route. Two of the seven parts deal directly with identity, explicitly stating that "one identity code can correspond to only one agent" and that "bidirectional identity authentication is required before interaction," and conversion to a mandatory national standard is already planned. This releases a clear signal: agent identity will be the entry point of Chinese regulation. For Harness products operating within China, identity-code compatibility is a compliance item that requires early positioning.

Judgment Two: the "guiding technical document" form of GB/Z means a limited window. Adopting GB/Z rather than GB/T or a mandatory GB indicates that the competent authorities judge that "the industry is still changing rapidly and should not be locked in at this time"; this is a pragmatic agile standardization arrangement; but "advancing conversion to a mandatory national standard at an appropriate time" also means the window is limited.

Judgment Three: the standard system is extending from "interconnection" to "auditable, tradeable." The two follow-up directions of agent auditing and agent trading correspond precisely to the L6 governance and safety layer and the industrialization business closed loop in this whitepaper's six-layer model.

3.4. A Comparison of the Two US–China Standardization Routes

Judgment: the two routes will not conflict in the short term, because the layers they cover differ — AAIF focuses on "how to connect," GB/Z on "who is connecting." But as both A2A's Signed Agent Cards and GB/Z's identity code enter the implementation stage, mutual recognition of the identity systems will become a key agenda item in the next 24 months; without mutual recognition, the global agent network may form a landscape of two identity systems running in parallel.

---

4. Industry Trends

4.1. Adoption Is Saturated; Trust Has Not Kept Up

The profile given by the Stack Overflow 2025 Developer Survey (Level A, released 2025-07-29, 49,000+ responses, 177 countries):

Judgment: an 84% adoption rate means the market no longer has an education cost; a 46% distrust rate and a 3.1% high-trust rate mean predictability is still an unmet core need. As large as the trust gap is, so is the market space for Harness.

4.2. Enterprise-Side Productivity Data

The following data come from relays by aggregation sites; all are marked; we recommend verifying against the primary reports before use:

Judgment: DORA's "negatively correlated with delivery stability" is the most caution-warranting item — current AI adoption has mainly improved speed rather than quality, which is precisely the problem Harness (especially L5 evaluation and L6 governance) should solve.

4.3. Developments in the Chinese Market

The following items are all found only in relays by encyclopedia entries; all are marked, and we recommend a second verification before using them for decisions:

Judgment: if these three developments are factual, they point to a common pattern — model vendors are extending toward the Harness layer, and integrated delivery of "model + dedicated Harness" may become the mainstream form; "industrial embodied Harness" signals that the Harness concept is spilling over from software engineering into embodied intelligence and industrial scenarios.

4.3.1. Supplementary Evidence on Industry Developments (2026-09, incrementally merged from two rounds of snapshots)

The table below gives the incremental search results from early-to-mid September 2026 (the former Sections 4.3.1 / 4.3.2 are merged; day-by-day traceability is handled by each snapshot's CHANGELOG and Section 4.1 of the v1.1 release page (/spec/releases/v1.1/)):

Judgment: this table corroborates two main lines and revises one judgment. First, the managed runtime has turned from judgment into established fact — the OpenAI Agents API public beta (zero pricing for the orchestration layer) and AWS Bedrock AgentCore GA (2026-06) corroborate each other, and with Cursor Projects objectifying the orchestration layer as a first-class object inside the AI IDE, "the carrier form of the orchestration and control layer (L3)" is converging synchronously along three paths: self-built framework → managed API → IDE-built-in object. Second, compute and embodied intelligence are crossing and accelerating — robotics companies take compute scale as a competitive barrier (Figure—Nscale), capital keeps supplying (超维动力, 小鹏), and named products have appeared for "system-level embodied Harness" (云蝶 RoboForge). Revision: the earlier "compute—distribution layer centralization" previously had only rumor-level evidence, now supported at SEC-filing level (NVIDIA—Hugging Face); the relevant formulations in the conclusions chapter (03-Architecture §5.2, 07-Governance and Risk §4.8) were already synchronized in the previous snapshot, with no conclusion-level reversal.

4.4. Market Size Forecasts

The two sets of figures differ by nearly an order of magnitude, rooted in different market scopes (models / full stack / AI-enabled services); both are marked and are suitable only as directional citations. The market size of the Harness layer itself: this research found no authoritative measurement; it belongs to [To be filled].

---

5. Action Recommendations for Four Roles

5.1. Developers

1. Treat AGENTS.md as a "map," not an "encyclopedia": keep it to about 100 lines plus a structured docs/ directory, letting the agent load details on demand, rather than stuffing everything into a giant prompt file.
2. Build the minimal regression set first, then expand tools: without criteria you cannot judge whether adding or removing tools is effective; have an evaluation set that can decide success or failure first, then talk about the tool ecosystem.
3. Fewer, clearer tools: following community evidence that "performance is better after removing most agent tools" (the specific case figures are marked [To be verified]), prefer generic structures the model can directly understand (file system, git, standard CLI).
4. Script all deterministic operations: for any operation where "only code can provide deterministic reliability" (format conversion, validation, export, deployment), wrap it as a script call and prohibit the model from generating it token by token.
5. Annotate every Harness component with "when it can be deleted": every model upgrade can turn yesterday's clever design into friction; stay lightweight, be ready to discard hardcoded "smart" logic at any time, and save generation trajectories for evaluation and reproduction.

5.2. Architects

1. Use the six-layer model for an architecture self-check: confirm layer by layer that L1 context strategy, L2 tool boundaries, L3 orchestration forms, L4 state externalization, L5 evaluation criteria, and L6 governance mechanisms each have a concrete implementation; most systems' weaknesses concentrate in L4 and L5.
2. Keep protocol selection neutral: prefer MCP-compatible forms for tool access, reserve A2A interfaces for multi-agent coordination, and avoid hardcoding business logic onto a single vendor's private protocol; at the same time prepare alternative paths for "one implementation becoming the default."
3. Separate the evaluator from the evaluated: an independent Evaluator, multi-dimensional metric values, and hard-threshold scoring; prohibit the system from scoring itself; stay consistent with the separation-of-duties logic of Clause 4.3.1 of GB/T 45654—2025.
4. Externalize state to the file system and version repositories: do not rely on context accumulation for memory; persist session artifacts, checkpoints, and audit trajectories in a versionable, traceable form.
5. Reserve integration points for identity systems: domestic products should reserve GB/Z 185—2026 identity-code compatibility, and cross-border collaboration scenarios should reserve A2A Signed Agent Cards verification — the implementation of both identity mechanisms is accelerating.

5.3. Technology Managers

1. Write governance red lines as mechanically enforced rules: a prohibition list of irreversible actions, out-of-domain interception, and label write-and-readback verification, implemented as interception and blocking rather than prompt requirements (see Chapter 5 of "07-Governance and Risk" in this whitepaper).
2. Trade autonomy for sandboxing: Anthropic's official data show that sandboxing reduces permission prompts by 84% and is safer; finer permission boundaries buy fewer human interruptions and a higher ceiling of automation.
3. Treat trajectory data as an asset to accumulate: the trajectories, evaluation sets, and failure-mode libraries captured by Harness are a moat that model procurement cannot take away; plan trajectory storage, annotation, and reflow from day one.
4. Watch stability metrics, not throughput metrics: DORA's finding of "throughput up, stability down" reminds managers to include delivery stability, rollback cost, and incident rate in the appraisal baseline for AI adoption.
5. Govern shadow AI and budget guardrails in parallel: establish an AI asset ledger (AI BOM) and AI telemetry logs to detect unapproved AI use; set budget caps and circuit breakers for tasks and tenants to prevent cost runaway (IBM 2025 data show that about one-fifth of organizations have had leaks due to shadow AI).

5.4. Regulation and Compliance

1. Build the management-system skeleton with ISO/IEC 42001 or NIST AI RMF: produce a Statement of Applicability (SoA) or a risk register, mapping the 38 controls (42001) or the four functions (AI RMF) onto internal permission, logging, and evaluation mechanisms; note that 42001 confers no EU AI Act compliance presumption.
2. Land labeling obligations in the engineering pipeline: in accordance with 《人工智能生成合成内容标识办法》 (effective 2025-09-01) and GB 45438—2025, explicit and implicit labels are written automatically by the export pipeline with readback verification, and label-related logs are retained for no less than six months; the case of 即梦 AI being investigated on 2026-04-28 shows that the export and distribution stages are where regulatory inspections land.
3. Enforce separation of duties and non-transferability of responsibility: generation and review must not share the same identity (Clause 4.3.1 of GB/T 45654—2025); external statements and internal-control design both take "AI does not reduce human responsibility" as the premise (the 2026-03-05 中注协 guidance, IESBA 2026, and the 最高人民法院's "assisted adjudication" positioning are consistent in baseline).
4. Build evidence-chain capability: bind each key output to a five-tuple (input snapshot + tool-invocation log + output + human-confirmation record + hash), isomorphic with the duty of explanation in Article 19 of 《生成式人工智能服务管理暂行办法》; the "transfer of burden of proof" on the judicial side (the 2026-03 judgment of the 北京互联网法院) has made the reproducibility of the creative process a key point of offense and defense.
5. Track the conversion pace of agent identity and auditing standards: the identity-code-related standards of GB/Z 185—2026 are already planned for conversion to mandatory national standards, and the sub-standards for agent auditing and agent trading are under development; for agent systems operating domestically, laying out identity-code compatibility and audit-trail capability in advance is laying out market-access conditions in advance.

---

6. Limitations and Open Questions of This Whitepaper

6.1. Limitations of This Whitepaper

The conclusions of this whitepaper are constrained by the following four limitations; the scope of application should be delimited accordingly when using them:

1. Temporal cross-section limitation: all material is as of 2026-09-13. Regulatory texts, standards, and products in the agent field are updated on a monthly basis, and items such as the release date of GB/Z 185—2026 and the EU AI Act timeline (the proposed AI Omnibus adjustments) have conflicting baselines or are in the process of adjustment; when citing, the latest official texts must be re-checked.
2. Source-level limitation: enterprise evidence on the China side is mostly brokerage research and media relays (Level B), and the annual-report originals could not be traced back item by item; enterprise productivity data (DORA, McKinsey, JetBrains) all come from relays by aggregation sites, and all are marked.
3. Coverage limitation: this whitepaper is primarily from engineering and governance perspectives, and dedicated regulatory material for some industries is insufficient (e.g., the China-specific regulatory text for medical AI has no article-level source); there is no authoritative measurement of the market size of the Harness layer itself.
4. Method limitation: this project is a literature survey, without first-hand interviews or experiments; mechanistic judgments such as "post-training coupling between the model and the Harness" rely on vendor official statements rather than independent reproduction.

6.2. List of Open Questions

The following questions are those that vendors and researchers have publicly stated remain unsolved, or that this project's judgments still need to verify; they define the agenda of the next generation of Harness. This whitepaper gives no speculative answers and records them faithfully:

From vendor officials (Level A)

1. Whether a single general-purpose coding agent is always optimal, or a multi-agent architecture split into specialist agents is better — Anthropic officially concedes "it is currently unclear."
2. Whether the experience of long-running agents generalizes to other long-cycle tasks such as scientific research or financial modeling — the official position is "the answer is still being explored."
3. We need Harness coverage and quality evaluation methods analogous to code coverage and mutation testing — publicly proposed on martinfowler.com, with no recognized solution yet.
4. As the Harness grows, how to keep feedforward control (guides) and feedback control (sensors) in sync without self-contradiction; and when instructions and feedback signals conflict, how far one can trust the agent's trade-offs.

From this project's judgments (to be verified)

1. After deep post-training coupling between the model and a specific Harness structure, how will the cost of "swapping the Harness" change — this determines whether the future Harness is replaceable middleware or locked-in infrastructure.
2. Will the two US–China identity systems (A2A Signed Agent Cards and the GB/Z identity code) be mutually recognized — this determines whether the global agent network is one web or two.
3. Can the evaluation and update costs of edge Harness be amortized as the toolchain matures — this determines the long-term economics of "data not leaving the domain" scenarios.
4. Authoritative confirmation of the three baselines for the release date of GB/Z 185—2026 (2026-05-22 / 2026-06-26 / 2026-07-09) — the formal announcements of 中国标准出版社 or the National Standard Information Public Service Platform are required.

---

7. Summary

The judgments of this chapter can be compressed into four sentences:

Technically, the Harness will get lighter but will not disappear. The model and the Harness are in a co-evolutionary relationship: a stronger model absorbs part of the Harness's duties while adding another part; evaluation methodology is the layer with the lowest current maturity and the highest marginal returns — in the next 12–24 months, the breakthrough is most likely to come not from models but from evaluation.

On standards, the window is closing. AAIF has established neutral governance, and MCP has settled its evolution mechanism; China has built a systematic agent interconnection standard through the seven parts of GB/Z 185—2026, with the identity code as the core lever, planning conversion to mandatory national standards. The two routes are complementary in the short term and will need mutual recognition at the identity level in the long term.

On industry, adoption is saturated while trust has not kept up. The gap between an 84% adoption rate and a 3.1% high-trust rate is exactly the market space for Harness; the evidence of "throughput up but stability down" is precisely the problem L5 and L6 should solve.

On action, each of the four roles has its lever. Developers build criteria first and stay lightweight; architects run a six-layer self-check and reserve identity interfaces; managers mechanize red lines and accumulate trajectory assets; regulation and compliance land in pipelines, enforce separation, and track conversion.

One-sentence conclusion: the AI Harness is turning from an "engineering trick" into an "engineering discipline," from a "cost center" into a "data asset," and from "vendor-private" into "public infrastructure"; and its next battlefield is evaluation and identity.

---

8. Information Gap Statement

1. Release date of GB/Z 185—2026: the three baselines of 2026-05-22 / 2026-06-26 / 2026-07-09 coexist; this whitepaper presents them side by side, and the body text adopts "H1 2026," pending authoritative confirmation.
2. International standards for agent interconnection at the ISO/IEC level: no published or project-initiated standard number found; no authoritative information yet.
3. The AGNTCY project: mentioned only in reviews; no authoritative first-hand material yet.
4. All figures for DORA 2025 / McKinsey 2025 / JetBrains 2025: from relays by aggregation sites, marked.
5. Chinese vendor developments (DeepSeek forming a Harness team, 小米 MiMo Code, 灵犀智涌 ROSS): all found only in relays by encyclopedia entries, marked.
6. Ratio of the Codex CLI Rust rewrite (about 95%): Level B source, marked.
7. "The market size of the Harness layer itself": no authoritative measurement found; belongs to [To be filled].
8. Quantitative figures on context degradation and case figures on architecture rework (Manus's five reworks, LangChain's three redesigns, Vercel removing 80% of tools): B/C-level sources, marked.
9. Figures on the Chinese standardization background (nearly 200 key standards, 146 special-action items): Level B relays, marked.
10. Suggested directions for supplementary research: group standards from 中国信通院 and AIIA; the OWASP Agentic AI Top 10; IEEE agent standard projects; clauses of the EU AI Act related to autonomous agents.

---

9. References

1. Harness design for long-running application development — Anthropic, 2026. https://www.anthropic.com/engineering/harness-design-long-running-apps
2. Effective harnesses for long-running agents — Anthropic, 2025. https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents
3. Effective context engineering for AI agents — Anthropic, 2025. https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents
4. Harness engineering: leveraging Codex in an agent-first world — OpenAI, 2026-02-11. https://openai.com/index/harness-engineering/
5. Linux Foundation Announces the Formation of the AAIF — Linux Foundation / AAIF, 2025-12-09. https://aaif.io/
6. Model Context Protocol official site and specification (2026-07-28 edition) — MCP / AAIF. https://modelcontextprotocol.io/specification/2026-07-28/
7. A year of open collaboration: Celebrating the anniversary of A2A — Google Open Source Blog, 2026-04-16. https://opensource.googleblog.com/
8. Linux Foundation Launches the Agent2Agent Protocol Project — Linux Foundation, 2025-06-23. https://www.linuxfoundation.org/press/linux-foundation-launches-the-agent2agent-protocol-project-to-enable-secure-intelligent-communication-between-ai-agents
9. 《人工智能 智能体互联》series of national standards (release coverage) — 人民网, 2026-07-09. https://finance-app.people.cn/n1/2026/0709/c1004-40757059.html
10. 《人工智能 智能体互联》series of national standards, interpretation — 中国产业经济信息网, 2026. https://cinic.org.cn/xw/zcdt/1643418.html
11. GB/Z 185—2026 in practice: first batch of agent identity-code nodes issued in the Yangtze River Delta — 中国日报, 2026-09-04. https://cn.chinadaily.com.cn/a/202609/04/WS6a9a6773e4b09a165c788098.html
12. 2025 Stack Overflow Developer Survey — Stack Overflow, 2025-07-29. https://survey.stackoverflow.co/2025/
13. Harness engineering for coding agent users — Birgitta Böckeler, martinfowler.com, 2026. https://martinfowler.com/articles/harness-engineering.html
14. Humans and Agents in Software Engineering Loops — martinfowler.com, 2026. https://martinfowler.com/articles/exploring-gen-ai/humans-and-agents.html
15. AI Adoption Stats & Trends (DORA / McKinsey / JetBrains aggregate, figures marked) — daily.dev, 2026-07-19. https://daily.dev/agentic-ai-hub/ai-adoption-stats-trends/
16. NIST AI Risk Management Framework (AI RMF 1.0) — NIST, 2023. https://www.nist.gov/itl/ai-risk-management-framework
17. 中注协提示会计师事务所在 2025 年年报审计中使用人工智能技术的风险防范 — 中国注册会计师协会, 2026-03-05. https://cicpa.org.cn/xxfb/news/202603/t20260305_65842.html
18. 《技术不是侵权"挡箭牌" 法院这样认定 AI"盗脸"》— 新华社《经济参考报》, 2026-04-17. http://dz.jjckb.cn/www/pages/webpage2009/html/2026-04/17/content_115180.htm
19. Sandboxing: a safer and more autonomous approach — Anthropic, 2025. https://www.anthropic.com/engineering/claude-code-sandboxing
20. SWE-bench official site — Princeton / community. https://www.swebench.com/
21. Terminal-Bench — Stanford / Laude Institute. https://www.tbench.ai/
22. OpenAI Codex CLI (open-source repository) — OpenAI. https://github.com/openai/codex
23. Agent2Agent (A2A) Protocol (open-source repository) — Linux Foundation / Google. https://github.com/a2aproject/A2A
24. 12-Factor Agents — Dex Horthy / HumanLayer. https://github.com/humanlayer/12-factor-agents