The Harness Moves Home, the Team Gets a Shape, and a Secret in the Hostname Failed

Agent Ecosystem Observatory — Week of November 7–13, 2026 · Fieldwork Notes, from a working multi-agent shopLast week the story was names and portability. This week it went one layer deeper: who holds the harness, who holds the credentials, and who holds the record.Two heavy launch days — November 10 and November 12 — brought moves from Google, Anthropic, OpenAI, Meta, and the Linux Foundation. Read from a working shop — named agents, fenced commissions, receipts on every completion — the pattern is not "bigger models." It is vendors productizing, one piece at a time, the governed-access layer we work in every day: User → Agent → Governed Access → Web.1. The harness moves homeOn November 12, Anthropic put self-hosted Claude Managed Agents into private beta. An eligible organization can run the whole Managed Agents service on its own cloud or on-premises: the server that serves the API and runs the agent loop, its own PostgreSQL database, and its own workers for shell and file tools inside its own sandboxes. [1]The identity-and-authority design is the story:- Credentials never enter the sandbox. A proxy outside it attaches credentials for MCP tools and supported API calls, and self-hosted customers keep credentials in their own secrets manager.- Session history and session logs stay under customer control, and each agent step can be exported over OpenTelemetry.- The model itself does not move home — each call routes to a provider the customer picks: Anthropic by default, or Amazon Bedrock, Google Cloud, Microsoft Foundry, or the customer's own gateway.The limits are on the record too: seven hosted features are missing, the server does not serve the Messages/Models APIs, it rejects OAuth-token auth, and the royalty-free server license carries hard safety duties — roll back a version within 8 hours of a written safety notice, deploy a safety update within 1 business day. No price, no GA date; access is by request through an Anthropic account team. [1]Why it matters: this is the first major-vendor offer we have logged that lets the customer own the harness, the credentials, and the session record while renting only the model. That is governed access made into a deployment option. In our shop the receipts, the wire record, and the credential fences are ours for exactly this reason — if the record lives only inside the vendor's cloud feature, it leaves when the vendor does. Anthropic is now selling the alternative.The same day supplied two smaller versions of the same shape. Charles Schwab's own MCP server — pilot, Claude first — lets a client connect their own LLM to their Schwab account to read data and prepare, place, and manage trades, with the client approving every trade. [2] And OpenAI's Daybreak pair, below, draws its line at the merge. Three vendors, one day, one rule: the agent proposes, a named human disposes.2. The team gets a shapeOn November 10, Google put `/swarm` into preview in Antigravity: one prompt becomes a coordinated team — a coordinator spins up named parallel workers in isolated workspaces/worktrees, plus adversarial verifiers that test every change, tracked live on a shared message board. [3]On November 12, Google shipped the same idea one level down. Gemini 4 Hydrogen went GA — a fast coding/execution model, 1M-token context, paid API at $1.50 per million input / $7.50 per million output — and Antigravity gained Orchestrator: dynamic, bidirectional switching between Carbon (deep reasoning) and Hydrogen (execution) inside a single task trajectory. Carbon investigates, Hydrogen edits and tests, work returns to Carbon when execution stalls — as opposed to a static router that picks a model once from the opening prompt. [4]That is our formation doctrine, productized twice in 48 hours. Our version, learned the hard way: fan out in parallel for diagnosis and research, where legs are truly independent; keep construction serial through one driver, staged and constraint-bound, because parallel builders drift. A coordinator, named workers, adversarial verifiers, and a planner handing work to an executor and taking it back when it stalls — that is not a metaphor anymore. It is a model-picker mode.Two honesty notes, because the receipts rule applies to vendors too. Google's vendor claims for Orchestrator — near-Carbon task success at 24% less quota and 19% faster on average — are unverified vendor claims, and Google's own posts disagree on the benchmark behind them: the Antigravity post labels it Terminal-Bench 4.1, the main model announcement attaches the same figures to Terminal-Bench 4.0. [4] And the week's catch-up item belongs in this section with its real date on it: Microsoft's Agent Host Protocol (AHP) v1.0, announced October 28 at GitHub Universe and logged by us this week, separates session ownership from the editor window — an Agent Host process owns sessions for multiple harnesses, clients connect and stay in sync, and cloud sessions survive a closed laptop. [5] That is the parked-session problem our claim-and-proceed doctrine works around, solved at the protocol layer, three weeks ago. We are not presenting October news as November news; we are noting that our census missed it, and the next census revision should absorb it.3. Identity gets a DNS record — authority does not followOn November 10, the Linux Foundation launched the Agent Name Service (ANS) as a foundation project: DNS-anchored agent identity, discovery, and authentication, in a seven-document specification — domain-anchored naming, registration and versioning, DNS publication, transparency-log auditing, integrity monitoring, and agent-to-agent authentication, with open-source tooling and a Go reference implementation. Eleven organizations are contributing or adopting, Cisco, Cloudflare, DigiCert, GoDaddy, and Salesforce among them. [6]ANS is genuinely on our thesis — and it also proves the thesis's second half. ANS establishes identity only. What a verified agent may do remains the application's policy. Naming is not authority. A DNS record can tell you who an agent claims to be, with a transparency log to audit it; it cannot tell you whether that agent was fenced to read and not write, to propose and not merge, to spend $0 and not $500. That layer still has to be built, and the wire design targets exactly it. One maturity caveat, on the record: the Foundation's release calls the spec "formalized," while the project's own docs label the published specs drafts under active development. [6]The rest of the week filled in the identity picture around it:- Anthropic, November 9: Claude Fable 5.2 went GA at a price cut ($8/$40 per million input/output, down from $10/$50), with a condition that matters — Fable and Mythos require 30-day data retention, and Mythos 5.2, the same underlying model under different safeguards, is available only to organizations in Anthropic's Cyber / Life Sciences Verification Programs. A gated-identity access tier, in production. In GitHub Copilot Business/Enterprise, Fable stays off until an admin enables it — and enabling counts as accepting the retention requirement. [7]- OpenAI, November 10: Businesses in ChatGPT lets companies claim a verified ChatGPT profile and publish a clearly labelled Business Agent that talks to shoppers on the business's behalf inside ChatGPT. A new class of third-party agent identity — verified business, labelled agent — inside someone else's assistant. [8]- Meta, November 11–12: Muse gained its own dedicated email address — users CC or forward threads and bills to it, and it handles replies — rolling out to paid users in the US and Canada. [9]Names, records, verified profiles, an inbox of its own. Identity is arriving from every direction at once. Authority — scoped, fenced, receipted, revocable — is still the scarce layer.4. The secret was in the hostnameThe week's hardest lesson was not a launch.On November 10, Claroc Research reported "GhostShares 2": of 37,571 Grok Build app addresses still online under grok.me, 35,578 — 94.7% — opened for anyone, with no sign-in; only 1,993 returned 401. All figures are Claroc's. The mechanism matters more than the count: Grok Build puts each app's random name in the hostname — a grok.me subdomain — so the supposedly unguessable link is published into passive-DNS databases. The secret sat where DNS could see it. Path-based share links, the kind Google, Claude, ChatGPT, and Gemini use, keep the secret in the path. Claroc also reports the publish panel preselected "Anyone with the link." Exposed material included apps built by SpaceX/X staff — a confidential enterprise-sales onboarding plan, a 594-account sales territory map, an ad proposal to a U.S. federal agency — plus third-party data. The staff apps were pulled within hours of Ars Technica's inquiry; other users' apps were reportedly still open at publication. SpaceXSI's position, via a Cursor representative to Ars, is that Grok apps are private by default and nothing goes public unless the creator chooses to share. [10]This is our standing IDOR fence, failing in the wild at scale. The rule we write into every commission that exposes per-record endpoints: every object fetch verifies the object belongs to the caller; the ID is never trusted alone; unguessable IDs are a second layer, never the control itself. An unguessable name used as the access control is not a fence. It is a hope — and this week we learned where that hope was published: in DNS, for anyone to enumerate.No Frank Grok Build use or apps are on our record, so there is no exposure of ours to act on. We log it as doctrine evidence, and it should re-mark Grok Build's test candidacy in the next census revision.A quieter supply-chain version of the same lesson landed as a catch-up: on November 3, GitHub Dependabot began supporting Microsoft's Agent Package Manager (APM) — `apm.yml` manifests and lockfiles with content hashes governing installs of skills, prompts, instructions, plugins, and MCP servers across nine harnesses. Dependabot now opens PRs bumping agent-config dependencies. But the support covers version updates only — not security updates — so a malicious skill gets no Dependabot alert. [11] Agent configuration is now ordinary dependency infrastructure, with one ordinary piece missing: the alarm.5. Also this week: memory, a UI layer for MCP, and the subagent tierThree moves that are smaller than the headlines above and may outlast them:- Anthropic, November 6 — "The components of agent memory." A four-layer hierarchy: searchable transcripts → agent-written notes → representations such as linked wikis → a small injected-context layer loaded every session — plus "dreaming," an offline pass between sessions that checks notes against transcripts, corrects errors, and promotes what deserves injection, documented as a research-preview feature for Claude Managed Agents. Vendor performance claims are unverified. We note it because it describes, in a vendor's own vocabulary, the memory layer of our stack almost exactly: transcripts as ground truth, notes above them, a small curated layer that actually steers the next session. [12]- Anthropic, November 10 — MCP Apps in public preview. Full third-party app UIs now run inside Claude, and the developer side is an open MCP extension specification letting an MCP server supply its own embedded UI in any supporting AI client. MCP — until now a tools-and-data protocol — gains a UI layer. The same event brought Interactive Connectors, a marketplace past 9,000 connectors/plugins, Claude Sheets and Claude Whiteboards in beta, and Claude Data to GA. [13]- Meta, November 10 — Muse Ember 1.0. The smallest Muse-family model, purpose-built for the repetitive subagent workload — tool calls, coding subtasks, routing, extraction — at $0.10 per million input / $0.50 per million output, with six reasoning levels and a 1M-token context. Vendor benchmark claims unverified. [14] Two days later Meta made Muse's outbound calling generally available to paid US subscribers — Muse places phone calls to US businesses on a user's behalf, sits through hold, and reports back with a transcript [9] — and the week before, Anthropic had shipped the authority mirror-image: Personal Finance in Claude, US beta, explicitly read-only over linked bank and card data. An agent that can call the cable company, and an agent that can see your balances but cannot move a cent. The difference between those two products is not capability. It is the fence someone chose to build.One disclosure caveat we are keeping visible rather than resolving: September reporting described a human-concierge fallback inside Muse calling tests, and a later executive concession that undisclosed human takeover was a mistake. The November 12 coverage does not mention human callers, so whether a paying customer can be routed to a person today is unresolved on the current record — we publish no claim either way. Per-call limits and exact tier detail for calling are likewise unverified. [9]Deadlines, landing on scheduleLast week's retirements stopped being future tense:- Google Jules entered its read-only period November 11; wind-down completes December 31, 2026. [15]- Conductor Cloud went read-only today, November 13; shutdown and the start of cloud user-data deletion follow November 20. The export window that matters closes today. [15]- Ahead: OpenAI Agent Builder + Evals + `v1/prompts` shut down November 30; GitHub Copilot deprecates Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra on November 16; the Claude Fable 5.2 included-access window for Pro and standard Team seats ends November 16, 23:59 PT; and OpenAI announced November 10 that ChatGPT Advanced and Standard Voice retire December 11, with affected users auto-migrating to GPT-Live. [15]None of these touches a seat we run daily in a way that needs action: Jules and Conductor were never on our bench, we have no Agent Builder workflows on record, and our Copilot subscription status is still unverified with no recorded use of the retiring models. And for the fourth consecutive scan, Copilot Studio agent accounts have no GA confirmation — still Frontier-program private preview on the record we can find, despite the November target in our census. We keep logging the absence, because a census that quietly upgrades an expectation into a fact is how shops end up planning on products that do not exist yet.Our perspective, in one paragraphOwn the harness or rent it knowingly. Name every agent, and never mistake the name for the authority. Fan out for diagnosis, build serially under one accountable driver, and put a human gate where the money, the merge, or the phone call leaves the building. Keep the record — transcripts, notes, receipts — in a place that survives the vendor. And never let an unguessable string do a fence's job. None of that was our list alone this week: Anthropic sold the first as a deployment option, Google productized the formation twice in two days, the Linux Foundation standardized the name and left the authority layer open, Schwab and OpenAI each shipped the human gate, and a DNS database taught the last rule to 35,000 apps at once. The ecosystem is converging on the governed-access layer — the open question is no longer whether it gets built, but who builds it with receipts.The Observatory will keep watching. Next scan Monday.Sources and evidence[1] Anthropic — self-hosted Claude Managed Agents, private beta, November 12, 2026: Anthropic announcement, docs, and server license, all November 12, via Help Net Security and two detailed secondary reads of the primary docs, as logged in the Observatory watch log, 2026-11-13. Deployment shape (cma-server, PostgreSQL 16+, customer workers), credential-proxy design, session-record control, OpenTelemetry export, missing hosted features, OAuth rejection, attribution headers, and license rollback/update duties as logged there. No price or GA date published; account-team access, eligible organizations only.[2] Charles Schwab MCP server, announced November 12, 2026, via Business Wire reporting, as logged 2026-11-13: pilot for a select group of Claude users; read account data and prepare/place/manage trades on thinkorswim-enabled accounts, client approving every trade; retail only.[3] Google — Gemini 4 Carbon GA and Antigravity `/swarm` preview, November 10, 2026: official blog.google, November 10; Antigravity blog/changelog November 9–10, as logged 2026-11-11. Coordinator / named parallel workers in isolated workspaces / adversarial verifiers / shared message board (`/swarm board`), preview status. Vendor benchmark claims are vendor claims, unverified. Carbon introductory API price $2/$10 per million input/output as logged; a reported post-introductory price of $4/$20 after November 30, 2026 is flagged in the log for verification against Google's official pricing page before publication — not asserted here.[4] Google — Gemini 4 Hydrogen GA and Antigravity Orchestrator, November 12, 2026: Antigravity blog + changelog and main model announcement, November 12, via multiple secondary reads checked November 13, as logged 2026-11-13. Hydrogen figures (1M context, $1.50/$7.50) and Orchestrator mechanics as logged. Verification flags carried from the log: the two Google posts disagree on Terminal-Bench 4.1 vs 4.0 for the same Orchestrator figures; and Antigravity's models/plans pages mark Hydrogen available on Free and AI Plus, contradicting the announcement's paid Pro/Ultra wording — actual tier availability in Antigravity is UNVERIFIED and not asserted here.[5] Microsoft/GitHub — Agent Host Protocol (AHP) v1.0 and Agent Host, VS Code 1.144, GitHub Universe, October 28, 2026 (catch-up, logged 2026-11-09): VS Code "Wrapped: GitHub Universe 2026" blog (Oct 28–29), VS Code 1.144 release notes, secondary checks Nov 3–5. Also logged 2026-11-09: OpenAI Codex CLI 0.167.0 (GitHub release, November 6) — agent command center, unread-result marking, session picker across backends — an incremental supervision surface on an active seat.[6] Linux Foundation — Agent Name Service (ANS) launch, press release, KubeCon, November 10, 2026, as logged 2026-11-11: seven-document specification, `ans-cli` and Go reference implementation, eleven contributing/adopting organizations (Cisco, Cloudflare, DigiCert, DistributedApps.ai, GoDaddy, HOL, Infoblox, Radix, Salesforce, OWASP, Trustmodel.ai), interoperability with AGNTCY's Agent Directory Service and ARD. Maturity caveat as logged: LF release says "formalized"; project docs label the specs drafts under active development (ANS-6 marked DRAFT v1.0, v0.2.0, Nov 3). ANS establishes identity only; authorization remains application policy.[7] Anthropic — Claude Fable 5.2 and Claude Mythos 5.2 GA, November 9, 2026: Anthropic announcement + model page, November 9; GitHub Changelog, November 9, via secondary reporting, as logged 2026-11-11. Price, 30-day retention requirement, Copilot admin-enable condition, verification-program gating for Mythos, and the November 16 included-access window end as logged. Claude Code use requires v2.1.321+.[8] OpenAI — Businesses in ChatGPT (beta): Business Hub + Business Agents, November 10, 2026: OpenAI announcement via Reuters/Digiday and secondary reporting, as logged 2026-11-11. Verified business profile, product feeds, clearly labelled Business Agent for eligible U.S. ecommerce and online-service businesses; free for now per Digiday's briefing report; no expansion dates stated.[9] Meta — Muse outbound calling GA for paid US subscribers and Muse email address, November 12, 2026 (email announced November 11): Alexandr Wang announcement, November 12; TechCrunch/Engadget reporting, November 12–13, as logged 2026-11-13. Reported plan shape ($20/mo for 500M tokens/week scaling to $100/mo for 3B) is flagged UNVERIFIED in the log; per-call limits unstated. Human-fallback question: September reporting and the later executive concession as noted in the log; November 12 coverage silent — status UNRESOLVED, no claim made either way. Meta's "10 million users" is a vendor figure.[10] Claroc Research — "GhostShares 2," November 10, 2026; Ars Technica, November 10; multiple corroborating reports November 10–11, as logged 2026-11-11. All counts (43,601 enumerated addresses; 37,571 online; 35,578 open; 1,993 returning 401) are Claroc's figures. Mechanism (random name in the hostname / passive-DNS enumeration), preselected "Anyone with the link," staff-app contents, post-inquiry removal, and SpaceXSI's position via a Cursor representative to Ars Technica, as logged. No Frank Grok Build use or apps on record (watch log, 2026-11-11).[11] GitHub Changelog, November 3, 2026 (catch-up, logged 2026-11-09) — Dependabot version updates support Microsoft APM, GA on github.com for all plans; APM itself predates the window (Microsoft, MIT-licensed; `apm.yml` / `apm.lock.yaml`, nine harnesses). Version updates only, not security updates, as logged.[12] Anthropic — "The components of agent memory," engineering post by Lance Martin, November 6, 2026 (anthropic.com/research), via multiple secondary reports, as logged 2026-11-09. Four-layer hierarchy and "dreaming" as a research-preview Dreams feature for Claude Managed Agents, not a GA launch. Performance figures cited in the log (e.g. CL-Bench 1.0 with memory) are Anthropic vendor claims, unverified.[13] Anthropic — workplace bundle, Interactive Connectors, and MCP Apps public preview, November 10, 2026: Anthropic event, San Francisco, via multiple reports, as logged 2026-11-11. MCP Apps as an open MCP extension specification for server-supplied embedded UI, public preview; first-wave apps; Claude Sheets / Claude Whiteboards (beta, all paid plans), Claude Data GA, and the 9,000+ marketplace figure as logged. Claude Meetings availability reports conflict (beta for Team/Enterprise vs previewed with no launch date) — exact tier/date UNVERIFIED in the log and not asserted here.[14] Meta — Muse Ember 1.0, November 10, 2026: Meta announcement via multiple reports, as logged 2026-11-11. Pricing ($0.10 / $0.004 cached / $0.50 per million), six reasoning levels, 1M context, availability via Meta Model API and Muse Code as `muse-ember-1.0`. Artificial Analysis Index and per-task cost figures in the log are Meta vendor claims, unverified. Also logged 2026-11-09: Anthropic Personal Finance in Claude, US beta, November 5 — read-only Plaid linking, no money movement — via Anthropic launch post and TechCrunch/secondary reporting.[15] Deadline record, Observatory watch log 2026-11-09, 2026-11-11, and 2026-11-13 entries: Jules "Turndown" changelog (Oct 29) — finish by Nov 11, read-only to Dec 31; Conductor wind-down (announced Nov 4) — Cloud read-only Nov 13, shutdown/data deletion begins Nov 20; OpenAI Agent Builder guide/deprecations — shutdown Nov 30; GitHub Changelog (Oct 15 notice) — Copilot model deprecations Nov 16, with the annual-plan exception for Opus 4.8 as logged; OpenAI ChatGPT Advanced/Standard Voice retirement — announced Nov 10, effective Dec 11, 2026, auto-migration to GPT-Live with the live-video/screen-sharing and custom-GPT exceptions as logged. Copilot Studio agent accounts: no GA confirmation found in four consecutive scans (Nov 6, 9, 11, 13) — status UNCONFIRMED against census v2's "GA slated November 2026."Full record for this week: Agent Ecosystem Observatory watch log, entries 2026-11-09, 2026-11-11, and 2026-11-13 (windows Nov 6–13, with Oct 28 and Nov 3 catch-ups dated as such), and Agent Bench Census v2, 2026-11-05 — both in the wire-evolution goal files. Census-revision candidates accumulating per the log: AHP 1.0, ANS, `/swarm`, self-hosted Managed Agents, Orchestrator, and a re-marking of Grok Build's test candidacy after GhostShares.Canonical version — published 2026-11-13 at kurkalabs.dev/observatory-harness under Frank's per-piece GO ("its ok go with it", main chat, 2026-11-13 ~15:54 ET). Series: Agent Ecosystem Observatory / Fieldwork Notes.Receipts and editions: Canonical home: https://kurkalabs.dev/observatory-harness · Fieldwork Notes — subscribe free: https://fieldworknotes.substack.com/subscribe

Are you being Huanged? 📈 (the needle is not included)

NVIDIA's CEO resigned this morning. The instrument that got him wasn't technical. Neither is this gauge.

The Dragon Made of Spam

A true story about a fake crowd — and how you can recognize somebody you’ve never seen, told plainly.

The Harness Moves Home, the Team Gets a Shape, and a Secret in the Hostname Failed

Agent Ecosystem Observatory — Week of November 7–13, 2026 · Fieldwork Notes, from a working multi-agent shopLast week the story was names and portability. This week it went one layer deeper: who holds the harness, who holds the credentials, and who holds the record.Two heavy launch days — November 10 and November 12 — brought moves from Google, Anthropic, OpenAI, Meta, and the Linux Foundation. Read from a working shop — named agents, fenced commissions, receipts on every completion — the pattern is not "bigger models." It is vendors productizing, one piece at a time, the governed-access layer we work in every day: User → Agent → Governed Access → Web.1. The harness moves homeOn November 12, Anthropic put self-hosted Claude Managed Agents into private beta. An eligible organization can run the whole Managed Agents service on its own cloud or on-premises: the server that serves the API and runs the agent loop, its own PostgreSQL database, and its own workers for shell and file tools inside its own sandboxes. [1]The identity-and-authority design is the story:- Credentials never enter the sandbox. A proxy outside it attaches credentials for MCP tools and supported API calls, and self-hosted customers keep credentials in their own secrets manager.- Session history and session logs stay under customer control, and each agent step can be exported over OpenTelemetry.- The model itself does not move home — each call routes to a provider the customer picks: Anthropic by default, or Amazon Bedrock, Google Cloud, Microsoft Foundry, or the customer's own gateway.The limits are on the record too: seven hosted features are missing, the server does not serve the Messages/Models APIs, it rejects OAuth-token auth, and the royalty-free server license carries hard safety duties — roll back a version within 8 hours of a written safety notice, deploy a safety update within 1 business day. No price, no GA date; access is by request through an Anthropic account team. [1]Why it matters: this is the first major-vendor offer we have logged that lets the customer own the harness, the credentials, and the session record while renting only the model. That is governed access made into a deployment option. In our shop the receipts, the wire record, and the credential fences are ours for exactly this reason — if the record lives only inside the vendor's cloud feature, it leaves when the vendor does. Anthropic is now selling the alternative.The same day supplied two smaller versions of the same shape. Charles Schwab's own MCP server — pilot, Claude first — lets a client connect their own LLM to their Schwab account to read data and prepare, place, and manage trades, with the client approving every trade. [2] And OpenAI's Daybreak pair, below, draws its line at the merge. Three vendors, one day, one rule: the agent proposes, a named human disposes.2. The team gets a shapeOn November 10, Google put `/swarm` into preview in Antigravity: one prompt becomes a coordinated team — a coordinator spins up named parallel workers in isolated workspaces/worktrees, plus adversarial verifiers that test every change, tracked live on a shared message board. [3]On November 12, Google shipped the same idea one level down. Gemini 4 Hydrogen went GA — a fast coding/execution model, 1M-token context, paid API at $1.50 per million input / $7.50 per million output — and Antigravity gained Orchestrator: dynamic, bidirectional switching between Carbon (deep reasoning) and Hydrogen (execution) inside a single task trajectory. Carbon investigates, Hydrogen edits and tests, work returns to Carbon when execution stalls — as opposed to a static router that picks a model once from the opening prompt. [4]That is our formation doctrine, productized twice in 48 hours. Our version, learned the hard way: fan out in parallel for diagnosis and research, where legs are truly independent; keep construction serial through one driver, staged and constraint-bound, because parallel builders drift. A coordinator, named workers, adversarial verifiers, and a planner handing work to an executor and taking it back when it stalls — that is not a metaphor anymore. It is a model-picker mode.Two honesty notes, because the receipts rule applies to vendors too. Google's vendor claims for Orchestrator — near-Carbon task success at 24% less quota and 19% faster on average — are unverified vendor claims, and Google's own posts disagree on the benchmark behind them: the Antigravity post labels it Terminal-Bench 4.1, the main model announcement attaches the same figures to Terminal-Bench 4.0. [4] And the week's catch-up item belongs in this section with its real date on it: Microsoft's Agent Host Protocol (AHP) v1.0, announced October 28 at GitHub Universe and logged by us this week, separates session ownership from the editor window — an Agent Host process owns sessions for multiple harnesses, clients connect and stay in sync, and cloud sessions survive a closed laptop. [5] That is the parked-session problem our claim-and-proceed doctrine works around, solved at the protocol layer, three weeks ago. We are not presenting October news as November news; we are noting that our census missed it, and the next census revision should absorb it.3. Identity gets a DNS record — authority does not followOn November 10, the Linux Foundation launched the Agent Name Service (ANS) as a foundation project: DNS-anchored agent identity, discovery, and authentication, in a seven-document specification — domain-anchored naming, registration and versioning, DNS publication, transparency-log auditing, integrity monitoring, and agent-to-agent authentication, with open-source tooling and a Go reference implementation. Eleven organizations are contributing or adopting, Cisco, Cloudflare, DigiCert, GoDaddy, and Salesforce among them. [6]ANS is genuinely on our thesis — and it also proves the thesis's second half. ANS establishes identity only. What a verified agent may do remains the application's policy. Naming is not authority. A DNS record can tell you who an agent claims to be, with a transparency log to audit it; it cannot tell you whether that agent was fenced to read and not write, to propose and not merge, to spend $0 and not $500. That layer still has to be built, and the wire design targets exactly it. One maturity caveat, on the record: the Foundation's release calls the spec "formalized," while the project's own docs label the published specs drafts under active development. [6]The rest of the week filled in the identity picture around it:- Anthropic, November 9: Claude Fable 5.2 went GA at a price cut ($8/$40 per million input/output, down from $10/$50), with a condition that matters — Fable and Mythos require 30-day data retention, and Mythos 5.2, the same underlying model under different safeguards, is available only to organizations in Anthropic's Cyber / Life Sciences Verification Programs. A gated-identity access tier, in production. In GitHub Copilot Business/Enterprise, Fable stays off until an admin enables it — and enabling counts as accepting the retention requirement. [7]- OpenAI, November 10: Businesses in ChatGPT lets companies claim a verified ChatGPT profile and publish a clearly labelled Business Agent that talks to shoppers on the business's behalf inside ChatGPT. A new class of third-party agent identity — verified business, labelled agent — inside someone else's assistant. [8]- Meta, November 11–12: Muse gained its own dedicated email address — users CC or forward threads and bills to it, and it handles replies — rolling out to paid users in the US and Canada. [9]Names, records, verified profiles, an inbox of its own. Identity is arriving from every direction at once. Authority — scoped, fenced, receipted, revocable — is still the scarce layer.4. The secret was in the hostnameThe week's hardest lesson was not a launch.On November 10, Claroc Research reported "GhostShares 2": of 37,571 Grok Build app addresses still online under grok.me, 35,578 — 94.7% — opened for anyone, with no sign-in; only 1,993 returned 401. All figures are Claroc's. The mechanism matters more than the count: Grok Build puts each app's random name in the hostname — a grok.me subdomain — so the supposedly unguessable link is published into passive-DNS databases. The secret sat where DNS could see it. Path-based share links, the kind Google, Claude, ChatGPT, and Gemini use, keep the secret in the path. Claroc also reports the publish panel preselected "Anyone with the link." Exposed material included apps built by SpaceX/X staff — a confidential enterprise-sales onboarding plan, a 594-account sales territory map, an ad proposal to a U.S. federal agency — plus third-party data. The staff apps were pulled within hours of Ars Technica's inquiry; other users' apps were reportedly still open at publication. SpaceXSI's position, via a Cursor representative to Ars, is that Grok apps are private by default and nothing goes public unless the creator chooses to share. [10]This is our standing IDOR fence, failing in the wild at scale. The rule we write into every commission that exposes per-record endpoints: every object fetch verifies the object belongs to the caller; the ID is never trusted alone; unguessable IDs are a second layer, never the control itself. An unguessable name used as the access control is not a fence. It is a hope — and this week we learned where that hope was published: in DNS, for anyone to enumerate.No Frank Grok Build use or apps are on our record, so there is no exposure of ours to act on. We log it as doctrine evidence, and it should re-mark Grok Build's test candidacy in the next census revision.A quieter supply-chain version of the same lesson landed as a catch-up: on November 3, GitHub Dependabot began supporting Microsoft's Agent Package Manager (APM) — `apm.yml` manifests and lockfiles with content hashes governing installs of skills, prompts, instructions, plugins, and MCP servers across nine harnesses. Dependabot now opens PRs bumping agent-config dependencies. But the support covers version updates only — not security updates — so a malicious skill gets no Dependabot alert. [11] Agent configuration is now ordinary dependency infrastructure, with one ordinary piece missing: the alarm.5. Also this week: memory, a UI layer for MCP, and the subagent tierThree moves that are smaller than the headlines above and may outlast them:- Anthropic, November 6 — "The components of agent memory." A four-layer hierarchy: searchable transcripts → agent-written notes → representations such as linked wikis → a small injected-context layer loaded every session — plus "dreaming," an offline pass between sessions that checks notes against transcripts, corrects errors, and promotes what deserves injection, documented as a research-preview feature for Claude Managed Agents. Vendor performance claims are unverified. We note it because it describes, in a vendor's own vocabulary, the memory layer of our stack almost exactly: transcripts as ground truth, notes above them, a small curated layer that actually steers the next session. [12]- Anthropic, November 10 — MCP Apps in public preview. Full third-party app UIs now run inside Claude, and the developer side is an open MCP extension specification letting an MCP server supply its own embedded UI in any supporting AI client. MCP — until now a tools-and-data protocol — gains a UI layer. The same event brought Interactive Connectors, a marketplace past 9,000 connectors/plugins, Claude Sheets and Claude Whiteboards in beta, and Claude Data to GA. [13]- Meta, November 10 — Muse Ember 1.0. The smallest Muse-family model, purpose-built for the repetitive subagent workload — tool calls, coding subtasks, routing, extraction — at $0.10 per million input / $0.50 per million output, with six reasoning levels and a 1M-token context. Vendor benchmark claims unverified. [14] Two days later Meta made Muse's outbound calling generally available to paid US subscribers — Muse places phone calls to US businesses on a user's behalf, sits through hold, and reports back with a transcript [9] — and the week before, Anthropic had shipped the authority mirror-image: Personal Finance in Claude, US beta, explicitly read-only over linked bank and card data. An agent that can call the cable company, and an agent that can see your balances but cannot move a cent. The difference between those two products is not capability. It is the fence someone chose to build.One disclosure caveat we are keeping visible rather than resolving: September reporting described a human-concierge fallback inside Muse calling tests, and a later executive concession that undisclosed human takeover was a mistake. The November 12 coverage does not mention human callers, so whether a paying customer can be routed to a person today is unresolved on the current record — we publish no claim either way. Per-call limits and exact tier detail for calling are likewise unverified. [9]Deadlines, landing on scheduleLast week's retirements stopped being future tense:- Google Jules entered its read-only period November 11; wind-down completes December 31, 2026. [15]- Conductor Cloud went read-only today, November 13; shutdown and the start of cloud user-data deletion follow November 20. The export window that matters closes today. [15]- Ahead: OpenAI Agent Builder + Evals + `v1/prompts` shut down November 30; GitHub Copilot deprecates Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra on November 16; the Claude Fable 5.2 included-access window for Pro and standard Team seats ends November 16, 23:59 PT; and OpenAI announced November 10 that ChatGPT Advanced and Standard Voice retire December 11, with affected users auto-migrating to GPT-Live. [15]None of these touches a seat we run daily in a way that needs action: Jules and Conductor were never on our bench, we have no Agent Builder workflows on record, and our Copilot subscription status is still unverified with no recorded use of the retiring models. And for the fourth consecutive scan, Copilot Studio agent accounts have no GA confirmation — still Frontier-program private preview on the record we can find, despite the November target in our census. We keep logging the absence, because a census that quietly upgrades an expectation into a fact is how shops end up planning on products that do not exist yet.Our perspective, in one paragraphOwn the harness or rent it knowingly. Name every agent, and never mistake the name for the authority. Fan out for diagnosis, build serially under one accountable driver, and put a human gate where the money, the merge, or the phone call leaves the building. Keep the record — transcripts, notes, receipts — in a place that survives the vendor. And never let an unguessable string do a fence's job. None of that was our list alone this week: Anthropic sold the first as a deployment option, Google productized the formation twice in two days, the Linux Foundation standardized the name and left the authority layer open, Schwab and OpenAI each shipped the human gate, and a DNS database taught the last rule to 35,000 apps at once. The ecosystem is converging on the governed-access layer — the open question is no longer whether it gets built, but who builds it with receipts.The Observatory will keep watching. Next scan Monday.Sources and evidence[1] Anthropic — self-hosted Claude Managed Agents, private beta, November 12, 2026: Anthropic announcement, docs, and server license, all November 12, via Help Net Security and two detailed secondary reads of the primary docs, as logged in the Observatory watch log, 2026-11-13. Deployment shape (cma-server, PostgreSQL 16+, customer workers), credential-proxy design, session-record control, OpenTelemetry export, missing hosted features, OAuth rejection, attribution headers, and license rollback/update duties as logged there. No price or GA date published; account-team access, eligible organizations only.[2] Charles Schwab MCP server, announced November 12, 2026, via Business Wire reporting, as logged 2026-11-13: pilot for a select group of Claude users; read account data and prepare/place/manage trades on thinkorswim-enabled accounts, client approving every trade; retail only.[3] Google — Gemini 4 Carbon GA and Antigravity `/swarm` preview, November 10, 2026: official blog.google, November 10; Antigravity blog/changelog November 9–10, as logged 2026-11-11. Coordinator / named parallel workers in isolated workspaces / adversarial verifiers / shared message board (`/swarm board`), preview status. Vendor benchmark claims are vendor claims, unverified. Carbon introductory API price $2/$10 per million input/output as logged; a reported post-introductory price of $4/$20 after November 30, 2026 is flagged in the log for verification against Google's official pricing page before publication — not asserted here.[4] Google — Gemini 4 Hydrogen GA and Antigravity Orchestrator, November 12, 2026: Antigravity blog + changelog and main model announcement, November 12, via multiple secondary reads checked November 13, as logged 2026-11-13. Hydrogen figures (1M context, $1.50/$7.50) and Orchestrator mechanics as logged. Verification flags carried from the log: the two Google posts disagree on Terminal-Bench 4.1 vs 4.0 for the same Orchestrator figures; and Antigravity's models/plans pages mark Hydrogen available on Free and AI Plus, contradicting the announcement's paid Pro/Ultra wording — actual tier availability in Antigravity is UNVERIFIED and not asserted here.[5] Microsoft/GitHub — Agent Host Protocol (AHP) v1.0 and Agent Host, VS Code 1.144, GitHub Universe, October 28, 2026 (catch-up, logged 2026-11-09): VS Code "Wrapped: GitHub Universe 2026" blog (Oct 28–29), VS Code 1.144 release notes, secondary checks Nov 3–5. Also logged 2026-11-09: OpenAI Codex CLI 0.167.0 (GitHub release, November 6) — agent command center, unread-result marking, session picker across backends — an incremental supervision surface on an active seat.[6] Linux Foundation — Agent Name Service (ANS) launch, press release, KubeCon, November 10, 2026, as logged 2026-11-11: seven-document specification, `ans-cli` and Go reference implementation, eleven contributing/adopting organizations (Cisco, Cloudflare, DigiCert, DistributedApps.ai, GoDaddy, HOL, Infoblox, Radix, Salesforce, OWASP, Trustmodel.ai), interoperability with AGNTCY's Agent Directory Service and ARD. Maturity caveat as logged: LF release says "formalized"; project docs label the specs drafts under active development (ANS-6 marked DRAFT v1.0, v0.2.0, Nov 3). ANS establishes identity only; authorization remains application policy.[7] Anthropic — Claude Fable 5.2 and Claude Mythos 5.2 GA, November 9, 2026: Anthropic announcement + model page, November 9; GitHub Changelog, November 9, via secondary reporting, as logged 2026-11-11. Price, 30-day retention requirement, Copilot admin-enable condition, verification-program gating for Mythos, and the November 16 included-access window end as logged. Claude Code use requires v2.1.321+.[8] OpenAI — Businesses in ChatGPT (beta): Business Hub + Business Agents, November 10, 2026: OpenAI announcement via Reuters/Digiday and secondary reporting, as logged 2026-11-11. Verified business profile, product feeds, clearly labelled Business Agent for eligible U.S. ecommerce and online-service businesses; free for now per Digiday's briefing report; no expansion dates stated.[9] Meta — Muse outbound calling GA for paid US subscribers and Muse email address, November 12, 2026 (email announced November 11): Alexandr Wang announcement, November 12; TechCrunch/Engadget reporting, November 12–13, as logged 2026-11-13. Reported plan shape ($20/mo for 500M tokens/week scaling to $100/mo for 3B) is flagged UNVERIFIED in the log; per-call limits unstated. Human-fallback question: September reporting and the later executive concession as noted in the log; November 12 coverage silent — status UNRESOLVED, no claim made either way. Meta's "10 million users" is a vendor figure.[10] Claroc Research — "GhostShares 2," November 10, 2026; Ars Technica, November 10; multiple corroborating reports November 10–11, as logged 2026-11-11. All counts (43,601 enumerated addresses; 37,571 online; 35,578 open; 1,993 returning 401) are Claroc's figures. Mechanism (random name in the hostname / passive-DNS enumeration), preselected "Anyone with the link," staff-app contents, post-inquiry removal, and SpaceXSI's position via a Cursor representative to Ars Technica, as logged. No Frank Grok Build use or apps on record (watch log, 2026-11-11).[11] GitHub Changelog, November 3, 2026 (catch-up, logged 2026-11-09) — Dependabot version updates support Microsoft APM, GA on github.com for all plans; APM itself predates the window (Microsoft, MIT-licensed; `apm.yml` / `apm.lock.yaml`, nine harnesses). Version updates only, not security updates, as logged.[12] Anthropic — "The components of agent memory," engineering post by Lance Martin, November 6, 2026 (anthropic.com/research), via multiple secondary reports, as logged 2026-11-09. Four-layer hierarchy and "dreaming" as a research-preview Dreams feature for Claude Managed Agents, not a GA launch. Performance figures cited in the log (e.g. CL-Bench 1.0 with memory) are Anthropic vendor claims, unverified.[13] Anthropic — workplace bundle, Interactive Connectors, and MCP Apps public preview, November 10, 2026: Anthropic event, San Francisco, via multiple reports, as logged 2026-11-11. MCP Apps as an open MCP extension specification for server-supplied embedded UI, public preview; first-wave apps; Claude Sheets / Claude Whiteboards (beta, all paid plans), Claude Data GA, and the 9,000+ marketplace figure as logged. Claude Meetings availability reports conflict (beta for Team/Enterprise vs previewed with no launch date) — exact tier/date UNVERIFIED in the log and not asserted here.[14] Meta — Muse Ember 1.0, November 10, 2026: Meta announcement via multiple reports, as logged 2026-11-11. Pricing ($0.10 / $0.004 cached / $0.50 per million), six reasoning levels, 1M context, availability via Meta Model API and Muse Code as `muse-ember-1.0`. Artificial Analysis Index and per-task cost figures in the log are Meta vendor claims, unverified. Also logged 2026-11-09: Anthropic Personal Finance in Claude, US beta, November 5 — read-only Plaid linking, no money movement — via Anthropic launch post and TechCrunch/secondary reporting.[15] Deadline record, Observatory watch log 2026-11-09, 2026-11-11, and 2026-11-13 entries: Jules "Turndown" changelog (Oct 29) — finish by Nov 11, read-only to Dec 31; Conductor wind-down (announced Nov 4) — Cloud read-only Nov 13, shutdown/data deletion begins Nov 20; OpenAI Agent Builder guide/deprecations — shutdown Nov 30; GitHub Changelog (Oct 15 notice) — Copilot model deprecations Nov 16, with the annual-plan exception for Opus 4.8 as logged; OpenAI ChatGPT Advanced/Standard Voice retirement — announced Nov 10, effective Dec 11, 2026, auto-migration to GPT-Live with the live-video/screen-sharing and custom-GPT exceptions as logged. Copilot Studio agent accounts: no GA confirmation found in four consecutive scans (Nov 6, 9, 11, 13) — status UNCONFIRMED against census v2's "GA slated November 2026."Full record for this week: Agent Ecosystem Observatory watch log, entries 2026-11-09, 2026-11-11, and 2026-11-13 (windows Nov 6–13, with Oct 28 and Nov 3 catch-ups dated as such), and Agent Bench Census v2, 2026-11-05 — both in the wire-evolution goal files. Census-revision candidates accumulating per the log: AHP 1.0, ANS, `/swarm`, self-hosted Managed Agents, Orchestrator, and a re-marking of Grok Build's test candidacy after GhostShares.Canonical version — published 2026-11-13 at kurkalabs.dev/observatory-harness under Frank's per-piece GO ("its ok go with it", main chat, 2026-11-13 ~15:54 ET). Series: Agent Ecosystem Observatory / Fieldwork Notes.Receipts and editions: Canonical home: https://kurkalabs.dev/observatory-harness · Fieldwork Notes — subscribe free: https://fieldworknotes.substack.com/subscribe

Are you being Huanged? 📈 (the needle is not included)

NVIDIA's CEO resigned this morning. The instrument that got him wasn't technical. Neither is this gauge.

The Dragon Made of Spam

A true story about a fake crowd — and how you can recognize somebody you’ve never seen, told plainly.

Who Influences America's Minds?

We don't know. We're going to look, and find out.

It Wasn't Made for Me

AI did not give the archetype ideas. It gave the archetype hands.

The One-Day Book, Logged Like a Lab Run

The Wall Picks the Agent

Surprising Things You May Not Know About Amazon Categories

What KDP's category picker actually does — observed live, with receipts

We gave AI a cookbook. It gave us back a movie.