Clarion Street

Ten Projects, One Foundation, and the Gaps That Now Have Numbers

·12 min read

On 22 October the Agentic AI Foundation announced four new projects: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face, and OpenSandbox from Alibaba. The foundation’s summary of what that adds up to is one sentence. “AAIF has grown from three projects to 10 in its first year.”

Four competitors, four contributions, one foundation, twelve months. In August I wrote that the model providers were commoditizing the framework layer while standardizing the interfaces they cared about under neutral governance, and I said at the time that this was my reading of the evidence and not a sourced claim. Half of it is on the record now. Manik Surtani, the foundation’s CTO and co-founder, describes four different companies choosing “to contribute them to neutral governance.” Whether the commoditizing was anyone’s plan is still my inference, and a release that counts contributions does not establish intent. What it does establish is that four more layers have neutral homes. The one I did not expect to see handed over was the request format.

What is in the portfolio

The foundation hosts ten projects, and the release names the six that were already in place: Agent2Agent, Agent Router, agentgateway, AGENTS.md, goose, and the Model Context Protocol. The four new ones take it from six to ten. The “three to 10” in the headline counts from launch in December 2025, when the portfolio was MCP, goose and AGENTS.md.

Grouped by the job rather than by the donor:

  • Tool and context access: MCP, AGENTS.md
  • Agent to agent: A2A, Agent Router, agentgateway
  • Capability packaging: Agent Skills
  • Model interface: Open Responses
  • Training: OpenEnv
  • Execution: OpenSandbox

Two of those I have already covered, A2A’s move into the foundation in August and the Agent Skills format in September, and I will not re-derive either. Donating Agent Skills to the foundation changes who governs it, not what a SKILL.md folder does.

The interface they gave away

The release describes Open Responses as “an open specification for building multi-provider, interoperable LLM interfaces, based on the OpenAI Responses API.” It also defines “a shared schema, consistent streaming events and extensible tooling, so developers can describe requests and outputs once and run them across model providers with minimal translation.”

The request format is the thing an application sends to a model, rather than the tools layer or the agent-to-agent layer. MCP and A2A were already neutral, and the August story was those two learning to coordinate under one roof. This is the company whose Responses API is the base of the shared schema handing the schema to a foundation that describes its own job as giving the community “one place to build shared standards, protocols, and infrastructure, with no single company controlling the outcome.”

I keep turning over how to read it. The generous reading is that a multi-provider interface only works if nobody owns it, so universal adoption is worth more to OpenAI than ownership is. The ungenerous reading is that “based on the OpenAI Responses API” is the part that matters, and it is already settled. Either way the format is no longer theirs alone to change.

The caveat is worth more than either reading. An open specification for a request format is not interoperability. The release says “minimal translation,” and translation is exactly where the divergences live: streaming event ordering, tool-call semantics, what happens on a partial response. Nothing in the announcement says another provider has implemented it. The project’s own page on the foundation site is one line and a link to a repository: “A shared LLM API format for agents across providers.”

The same shape runs through the whole portfolio, and it is why I am cautious about all of it. The specification is a documented fact, the adoption is an open question, and I have not found an independent measurement of the distance between the two.

The September question, answered one layer down

In September I looked at five enterprise vendors shipping the same three-layer governance stack as a single product and left the buyer question open: plumbing that makes agents production-ready, or lock-in dressed as governance. That post concluded the answer hung on whether MCP stayed open now that the vendors had built their moats on top of it.

At the protocol layer it stayed open, and it got more open. The enterprise platform layer did not move in anything I read for this post. Governance still ships inside a platform, and Broadcom’s still ships only inside VMware Private AI Cloud. Both readings were right about different layers. The plumbing is being given away by the companies best positioned to charge for it, and the platform is being bundled by companies that would rather you did not assemble it yourself. Those two layers are not moving in the same direction, and nothing in the October announcement suggests they will.

Four papers on the gaps

None of the four abstracts cites the foundation. They are not evaluations of the AAIF portfolio. They are four groups looking at multi-agent systems and finding the problems sit where two components meet, which are the same places a portfolio of standards leaves to whoever implements it. What connects the announcement and the preprints is the stack, not a citation.

All four are dated 3 or 4 November 2026.

Containment: fault spread, or healthy work thrown away

The Airlock paper describes the failure without decorating it: “a single agent’s faulty output can spread across tasks before detection, creating a system-wide blast radius. Single-agent guardrails are confined to individual harnesses, while existing multi-agent controls either cancel only the faulty source and miss downstream consumers or halt and roll back the entire workflow at the cost of healthy work.”

Then the number that made me stop reading: “native controls in A2A and LangGraph either contain at most 33.3% of faults or retain at most 16% of work without redo”.

The “or” covers two baselines with two different failure modes, and that is how it should be read. One set of native controls lets most of a fault through. The other stops the fault by discarding most of the healthy work with it. The abstract never says which framework does which, and I am not going to guess.

Airlock’s answer is a tree-structured runtime that narrows permissions from parent to child, plus an append-only provenance DAG recording what each agent consumed. On an alert it traces forward to isolate tainted work and actions still pending, and backward to narrow the cause, then either freezes the affected branches or computes a deadline-aware cut. The reported results, across 1,832 testbed runs, 161 smart-home runs and 24,266 simulation records: all post-alert faulty actuations blocked on the main testbed and smart-home grids with zero post-convergence leaks, 68 to 96 percentage points more healthy work retained than the baselines, and the optimized cut retaining 46 points more than full quarantine under dense spread.

The caveat is structural rather than a quibble. This is the Airlock team measuring its own system against baselines it characterised itself. It is a v1 preprint from 4 November with no venue attached. It is also the only public measurement of fault containment at those surfaces that I found, which is why it gets the space.

Cost: the question billing cannot answer

The second paper asks something a finance team asks and a platform team cannot answer. “The business question (what did this order, claim, or case cost in AI?) cannot be answered from billing data, because providers never see enterprise transaction boundaries.”

The evidence is FOCUS, the FinOps Open Cost and Usage Specification, which has added AI token and requester attribution and still reports at settlement grain. Settlement grain is an invoice line: this many tokens, this SKU, this billing period. What finance wants is transaction grain: this claim, this case, this order. Those are different units, and no number of attribution fields in a billing schema converts one into the other.

The proposal is two ledgers, one of FOCUS-conformant billing joined to one of invocation-grain usage records, with a correlation spine of trace context, A2A and MCP metadata, business keys and probabilistic matching doing the joining. Whatever is left unexplained after reconciliation is the unmetered spend.

The numbers come from a simulation with known ground truth, not a deployment: cost coverage above 99% as trace propagation falls to zero, the reconciliation residual recovering planted unmetered spend within 0.24 percentage points, and mid-flight gating cutting p99 transaction cost by up to 61% at a 2 to 4% false-pause rate. The single author also proposes his ledger as a FOCUS profile for standardization, which makes this a standards play as much as a research result, and it should be read that way.

The design detail interests me more than the numbers. The chain is built to keep working as trace propagation degrades toward nothing, which moves the matching work onto business keys and probabilistic correlation. Teams could copy that ordering today without waiting on anybody’s release schedule.

Authority: enforce at the message, not at the generator

The third paper names a failure I have watched happen and never had a term for. In a multi-agent system, “an agent can produce a locally reasonable message that exercises authority belonging to another role: a verifier that begins planning, a retriever that asserts unsupported conclusions, an executor that changes state no one approved.”

They call it role drift, a turn-level breach of an agent’s role contract. The mechanism is the part worth keeping: “Enforcement acts on the message rather than the generator, so ATC governs agents whose internal representations are unavailable.”

Once the other agent belongs to another company, the message boundary is the enforcement point you still control. You cannot see its weights or its activations, and you cannot patch a harness you do not run, so enforcement moves to where the message enters the shared conversation. It is also the boundary A2A names and then hands to the implementer, since the spec requires authorization and leaves the policy to the application.

This is the most credible of the four, accepted at EMNLP 2026, and its abstract carries no figures at all. It reports improvement over baselines spanning prompting, memory, workflow control and activation editing, with the largest gains under role-confusion stress tests and in larger, more diverse teams. I would like to see the numbers, and the abstract does not give them.

Reliability: voting does not beat the best model

The fourth ends with a sentence I keep coming back to. “More agents yield a more defensible reliability claim, not automatically a more reliable system.”

The setting is a pipeline extracting regulated chemical-hazard statements. Majority voting over three models “protected against the weakest but did not clearly exceed the best,” and the detail that decides it is this one: “a voter failing on 5% of demands would largely erase its advantage over the middle model.”

That is the argument against treating architecture as evidence of reliability. Three models and a vote bought a claim these authors could defend to an auditor, and on their pipeline it did not clearly beat the strongest single model. This one is submitted to IEEE Software Magazine, not accepted.

What I take from the two weeks

The portfolio is wider than the surface anyone tested. A2A shows up in Airlock’s baseline as the standard being compared against. FOCUS shows up in the cost paper. LangGraph is not an AAIF project at all, it is LangChain’s, and it appears in the containment baseline as the framework to beat. Agent Router, agentgateway and goose appear in none of the four abstracts. Ten projects is a governance and membership count. The measured surface is three or four protocols and a voting pipeline.

The glue got built anyway, and the gaps it did not close are the interesting part. Each of those gaps has a vendor on both sides, which is why I doubt any of them gets closed by one company’s product.

I do not read ten projects as a failure of the standards, or the numbers as a scandal. A specification covers what its contributors argued about, and the published descriptions of these ten projects do not mention any of the four problems above. Expecting the portfolio to close them is asking a standards body to solve problems outside the scope its own project pages describe.

What I would watch is the inverse of what the topic card behind this post predicted. Whether the stack fragments is settled. It did, at the framework layer, and the fragmentation there is not the problem. The open question is whether these gaps get covered by specifications or by products. Two of the four papers ship code with the text: Airlock’s abstract links a repository, and Two-Ledger’s comments point to code and synthetic data. ATC and the reliability paper expose no such artifact on their records, so the honest version is that half of the people measuring these gaps are also building. I would rather the gaps closed as specifications. I do not expect it, and the code links are part of why.

What I would not claim

The 22 October announcement is fifteen days old, so the news peg is not fresh. The freshness is the preprints from 3 and 4 November. Two of the four have no venue: Airlock and Two-Ledger are v1 preprints, and the reliability paper is submitted rather than accepted. Airlock’s baseline figures are the authors’ own characterisation of A2A and LangGraph controls, not an independent audit. Two-Ledger’s percentages come from a simulation, and its author is proposing his own artifact as a standard. Ten hosted projects is a governance fact and says nothing about whether ten layers interoperate.

Sources

  1. Agentic AI Foundation Announces Four New Projects: Agent Skills, Open Responses, OpenEnv, and OpenSandbox (The Linux Foundation, 22 October 2026)
  2. Agentic AI Foundation: project index (AAIF, retrieved 6 November 2026)
  3. Airlock: Bounding the Multi-Agent Blast Radius via Selective Online Containment (arXiv 2611.06727v1, 4 November 2026)
  4. The Two-Ledger Model: Transaction-Grain Cost Accounting for Multi-Agent AI Systems Across Clouds, Models, and Systems of Record (arXiv 2611.06989v1, 4 November 2026)
  5. ATC: Agent Trajectory Control for Role-Contract Enforcement in Black-Box Multi-Agent Systems (arXiv 2611.04321v1, 3 November 2026; accepted at EMNLP 2026)
  6. More Agents, More Reliable? System-Level Reliability of Multi-Agent LLMs under Operational-Profile Uncertainty (arXiv 2611.07140v1, 4 November 2026; submitted to IEEE Software Magazine)
  7. The Open-Source Agent Stack Is Fragmenting, and That’s the Point (Clarion Street, 28 August 2026)
  8. A2A Joins the Agentic AI Foundation (Clarion Street, 25 August 2026)
  9. The Skill Standard: How a Markdown Folder Became the Portable API for Agent Capability (Clarion Street, 11 September 2026)
  10. Five Vendors Converged on the Same Agent Stack. Nobody Coordinated. (Clarion Street, 13 September 2026)