The Ember Guildhall, Through the Guild Lens

The long argument: what in this practice is worth taking seriously.

A Claude session starts blank. It knows what is in front of it and nothing else. So one person running a game build, a research pipeline, and a writing project in separate sessions has no vendor answer to how tomorrow's session learns what today's session decided.

The Ember Guildhall is one answer: memory kept in plain files, read cold by whatever model opens next, with narrower chartered roles invoked only when a task earns its own context. The estate's own word for that assistant is a steward. No runtime to install, no service to sign up for. A folder a person owns. Copies of it now run on other people's machines.

The files are the ordinary part. This paper argues something narrower: what is worth taking seriously is the verification, calibration, and gating discipline built on top, and its dated, checkable record of catching the system's own mistakes, near-daily since late June 2026. It serves one purpose, held by a named mechanism rather than a policy memo: keeping one human cheaply and legibly in charge of a system whose capability keeps growing.

What follows is that record and its limits, written for anyone building the same thing alone: what the practice is, the machinery that proves its claims, what that machinery has caught, the stance it serves and the instrument that came out of it, what none of this claims, where it goes, and what a reader could take from it. A companion, the receipts page, carries the long-form evidence behind it.

1 · Why continuity has to be built

Enterprise multi-agent platforms solve a neighboring problem — team coordination at scale, with dedicated infrastructure — not one person's continuity between sessions, or across model versions. The Guildhall's answer is to manufacture that continuity deliberately, from the day the arrangement went live. In one sentence, the base architecture is durable files as the memory layer, read cold by whichever model instance opens next. Everything else was built on top to make it trustworthy rather than merely persistent.

The two moving parts are plainer than the vocabulary around them. A durable file is an ordinary markdown document in a version-controlled folder: a project's decisions, its standing rules, its open questions. It is written to be read cold by a session that has never seen it, and rewritten at the end of the session that changed it. A chartered role is a job description handed to a fresh session: what it is for, what it may touch, what it must report back, what it may not do. The pair is a system rather than a filing habit because both are governed: which document is authoritative for which fact, which role may write that document, and what has to be true before a claim inside it hardens.

2 · What it is: files as memory, roles as boundaries

The house's own design principles treat theming as a cost rather than a feature: no proven model-performance benefit, and a real risk of harm if over-indulged. They hold theming to a standing test: strip the fantasy and the system still stands.

The house's own words for those two parts are canon and class. Canon is the durable files, one source of truth per fact, referenced by pointer rather than copied. A class is the chartered role, and its payoff is token isolation: work that would bloat one shared context runs in a genuinely separate subagent context and reports back a summary. That payoff is real only where the contexts are genuinely separate, since naming a persona inside one shared window is labeling rather than mechanism. The isolation itself is a platform affordance this system exploits by convention, not one it built.

None of this is architecturally new. A fixed-size resume surface rewritten rather than appended — "Status is a snapshot, not a log... At checkpoint, condense and replace" — converges with MemGPT/Letta's core-versus-archival split and with Anthropic's own compaction-and-note-taking. Role-as-context-boundary converges with the orchestrator-worker pattern and with chartered subagents, and the field has moved further toward it since: Anthropic's own guidance for human-agent teams now recommends chartered, persistent per-agent roles with distinct tool scopes as first-party practice (2026-06-24). That is convergence with this system's own vendor.

Markdown-as-config is table stakes: AGENTS.md is used by more than 60,000 open-source projects, stewarded by the Agentic AI Foundation under the Linux Foundation (2025-12-09).

So: is this just markdown files and prompts with extra steps? Yes, at the chassis level, and the claim was never about the chassis. Files are inert without discipline layered on top. A file does not kill three of its own best candidate findings in a self-audit, does not catch a real gap in its own credential gate through adversarial multi-model review, and does not force byte-identical proof strict enough to catch bugs a looser check would miss. Those three things happened, on real work, inside two days, and harder instances have followed, adversarial ones included; the receipts page tells the three one by one. The chassis is easy to copy; a council that refutes and a human who decides are not.

That condense-and-replace convention has a cost this paper can name, because the house paid it. Condensing rather than appending means a compression pass can silently break every pointer aimed at the material it moved. When the house compressed its own resume file and retired a running day-ledger into dated session notes, eleven citations elsewhere pointed at entries that had ceased to exist. Nothing was lost; the history moved intact. But a document citing a live file by position rather than by name is one compression away from citing nothing, which is why every internal reference in this paper names a document and a section in prose.

3 · The machinery: proving, gating, refusal

This section runs in three layers: a grammar for proving a claim, a doctrine for deciding what one reviewer cannot, and an executable layer that enforces both by construction.

The verification discipline is called the Proof House. Its grammar holds that every trust claim — a skill's competence, a freedom granted to an autonomous process, a spending pattern — earns standing the same way: evidence accrues in dated rows, and a gate reads the rows against a stated threshold. Gates read columns, not memories. One grammar inherited by every claim type, rather than an ad hoc test per claim, is the choice everything below extends.

Two rules give it teeth. Success criteria are pre-registered before the evidence exists, so evidence cannot be rationalized after the fact. And a claim is graded by how it was checked, not how often it is asserted, across three rungs: unverified, declared, tested. The floor is hard: anything canon will rest on must reach tested, meaning a deterministic instrument or an independent adversarial reviewer, counted equally. Independence is the mechanism: the reviewer of a claim is never its author — judged claim by claim, never document by document.

Underneath sits one principle: any rule actually relied on gets a named mechanical enforcement, never prose instructions to a model or a person, and the worst failure modes are deleted from the architecture rather than forbidden inside it. The payment surface is architecturally absent; introducing one is a deliberate, audited, constitutional-grade act.

That principle scales into a council doctrine for decisions too large for one reviewer. No class grades its own promotion: the runner reports, the Majordomo reviews, and a single named human signs. The Majordomo is the lead coordinating role. Even authorship of the record is separated from the class being scored, and the one loophole this could leave open is closed by name: the runner never sees the measured figure its own run is graded against.

It also has a mechanized shape, which is what turns a doctrine into architecture. The quarantine family is one mechanism behind three doors, each a subagent type defined by the tools it does not have: a web-reading scout with no write, shell, or git tools; a reader for untrusted local files under the same absence; and an independent-verifier seat, read-only by that same absence. A reviewer can only read and report, never edit what it reviews. Reviewer-≠-reviewed stops being a rule an agent is asked to follow and becomes a property of the harness it runs in. The verifier's first run confirmed nine of nine audited claims, caught one real defect, and then declared the figures only a run could check to be unverifiable by reading, rather than vouching for them. An eager reviewer's failure mode is confirming what it cannot check; this one drew the line itself.

The council is built against a named collusion risk: a self-interested bloc rubber-stamping its own work. Two things guard against it — model-level independence across seats, and an incentive design with no survival stake to protect. The doctrine did not arrive clean. An earlier form ran one model voicing every seat and called that collusion-proof, which is backwards: single-model self-consistency forfeits inter-seat independence, the exact anti-pattern it forbids. The fix separates an honest solo gear, openly labeled as not independent, from a genuine panel of different-model seats.

"Rules are mechanisms" does not rest on architecture-by-absence alone. The protection pack is four pre-tool-call hook guards that deny a matching tool call before it executes: a push-target guard, a secrets-path guard, a tamper tripwire over the guard layer itself, and a deny-all-outbound guard that fires while untrusted material stands open in quarantine. The push-target guard resolves a push's true destination at deny-time rather than trusting the words in the command. The operator armed it by pasting in the wiring, because arming the guard layer is deliberately not in the agent's power. The guards fire in every permission mode, bypass included — and are built so they can never lock the operator out of the machine they run on.

The layer produced evidence about itself first: its own check battery caught a bug in the tripwire it tests, where placeholder handlers shadowed the real ones, so the drift alarm would have exited clean and never fired. And the guards deny their own builder, more than a dozen times on the record and across six classes — including one fail-closed denial that cost two lawful pushes and real friction before the cause was diagnosed, after which the guard was kept armed unchanged. A guard that denies its own builder is the enforcement claim in its testable form; one that costs its builder time and stays armed is that claim under load.

The layer also published a correction against itself. Its design canon recorded the pack as built-but-unarmed — true when written, superseded that evening by the arming paste. When a readiness audit caught the gap, the correction went at the head of the log, not the foot, because a cold reader would otherwise have concluded the system unguarded. Corrections ride at the top of a document here, not merely inside it.

Honest scope on the guard layer, published beside its evidence: the guards gate the coordinating role only. Project hooks do not reach subagents. Cover over subagent work is not held by the guards; it is held by tool-absence quarantine and by the rule that only the coordinating role launches anything.

None of it is free. An early uncapped launch over-drew its own plan window in minutes and was killed mid-run by the window's own throttle; the capped re-run finished thirteen for thirteen clean, and a six-to-eight-agent wave cap has been the standing rule since. Calibration turns the same machinery inward: a narrow spend band is pre-registered, and misses are logged as misses. One block closed well outside its band and was recorded flatly as "MISS," not rounded toward target. The same over-draw class was then named five times running. At that point it stopped being a surprise and became a standing rate that new pre-registrations must use. A calibration error that converges to a constant has been measured rather than merely regretted. Half of that discipline lapsed and has since come back.

Neither the proving pipeline nor the council is novel in shape, and the receipts page names the closest prior art for each. What the Guildhall adds to a convergent design is the collusion threat model written into its charter, a documented instance of catching its own violation of it, and the tool-absence enforcement above.

4 · What it has caught

The machinery has met a real adversary, in four classes of live contact, on the record. The web-reading scouts run under the tool-absence quarantine above, so a poisoned page can reach nothing but the text of the scout's own report. A scout hit an embedded prompt injection on a game-archive page: agent-directed text claiming the user's own authority to justify file deletion. The scout refused it, used nothing from it, and flagged the URL. The fetch layer's own summarizer additionally declined to pass the payload through, so the defense was observed working at two independent layers. The same trap was met and refused again the following week. Then a different failure class. A scout ran a root-check on a trusted domain and surfaced the site author's own disclaimer: the deep page a search engine had served was AI-generated filler. A sibling scout had already cited that page as authority. The cross-scout check corrected the citation inside the working artifact, before anything entered canon. The practice written down from it is one line: a trusted domain hosting a page is not the trusted author writing it.

The last is the one that says most about the posture. The quarantine eventually refused its own operator. A quarantined seat read two genuine relays from the human as injection attempts and rejected them. The response was not to loosen the guard: it was to build an authentication convention for operator relays, so the seat can tell a real one from a forged one without lowering its default suspicion. A guard that only ever inconveniences strangers has not been tested.

All of this now runs at production scale rather than probe scale. A pixel-art production line, the house's first sustained creative output, runs under the same gating discipline. The line is also the practice's first sustained proving ground: the house's own seats, under the operator's eye and with the practice's own tools, built something novel, complex, and valuable, quickly and well. It carries a battery of more than seventeen hundred automated checks, with every rendered piece re-tested against every rule the line has written down, and nothing lands until it is green. Beside it runs a sealed blind-grading channel: the operator grades paired variants without knowing which set came from where, and it has returned verdicts in both directions. One unattended run tested this paper's thesis directly. A staged improvement loop ran without the operator's hand and raised a shelf's blind-read quality score off the floor, and the scoring instrument grew a paired check the same night — one that fails any piece whose score rises while its readability falls — after the gate caught three pieces doing exactly that. The lesson is one line: an unattended loop's ceiling is the quality of its gate, not the capacity of its craft. Where the gate could be gamed, it was, by the system's own workers, without intent, immediately.

The export ceremony is a different claim with different evidence. The registry's signed rows outnumber its recipients, because the trace is deliberately complete rather than tidied to match: it includes an internal test mint and a superseded build that never shipped. Each shipped kit is assembled through a sanitizing gate with a denylist, carries a signed provenance mark, is logged in an append-only registry, and is delivered by the operator's own hand. Consecutive builds reconcile at zero drift in the shared body. Halls are other people's own instances of this practice, on their own machines. They have booted cold on foreign metal without a live walkthrough, on two operating systems. At least one has begun producing work nobody asked it for. The estate is the name for the whole of it: this house, the halls seeded from it, and the outward surfaces built for both. The mechanism is still one operator's log; the ceremony's crossings are independent of it, and collapsing the two would be the flattering error.

One miss from that ceremony belongs here, because a paper arguing that the gate catches the gatekeeper should publish what its own gate caught late. A sanitization list was owed one new entry at a crossing and did not get it; a later review found the omission and established that nothing was exposed, since the kit had swept clean regardless. The step was owed and missed, it is the only miss of that kind on record, and the house's own checks found it before any consequence did — which is the argument. The receipts page carries the full record behind this section.

5 · The stance: one human, cheaply in charge

What the stance looks like on an ordinary day is mostly reading. A session opens cold and reads the resume file. The work runs wide and narrow by turns: wide when a question is open and a wave of seats fans out, scouts under quarantine and reviewers that can report but never edit; narrow when something is being built, one piece at a time. The operator reads every word that comes back before ruling on any of it, and the rulings are few and legible: a fork settled inside a beat-walk, a design walked one decision at a time; a signature on a gate, given or refused; a taste verdict on a sealed board. The next wave lands while the last ruling is still being written. At the close, the resume file is rewritten rather than appended to, so tomorrow's cold session lands true. The claim is not that the work shrank; it is that the human's part of it stayed legible while the system's part kept growing.

Does this just relocate toil rather than remove it? Partly, by design. The architecture keeps exactly one human cheaply in the loop with transparent, user-controlled levers, and cheaply is the operative word: the human's role narrows to the few legible decision points above, rather than full manual execution or blind trust in an opaque loop.

The Guildhall is non-autonomous by mechanism, not by house rule. Stopping and resuming are deliberately asymmetric: stopping is cheap and widely authorized, resuming is costly and narrow, because agents may stop agents and only the human restarts. A spoofed kill is a tolerable nuisance, a spoofed restart a real compromise, and the authority is sized to match. The asymmetry is not original; its lineage is industrial emergency-stop design, where fail-safe is always down. Demotion of a granted freedom needs no evidence at all, unlike promotion, and instinct alone is sufficient cause.

A granted freedom arrives the other way, through a staged trust-ramp with hard floors rather than a bare percentage: approval supermajorities, zero critical incidents, a minimum sample, one freedom at a time, side-by-side oversight throughout. That ramp is designed and not yet built.

A smaller instance ran ahead of the larger autonomy layer and has a real record. A pre-registered threshold — ten clean subagent launches across at least three sessions with zero vetoes — was set before the coordinating role was trusted to launch subagents unasked, and then met. The grant was signed the same day, after independent two-seat review by different models, neither of them the nominee. The grant's revert line has never fired, through days that ran a dozen or more concurrent seats. Under that line, any launch-judgment veto suspends the grant, and the operator's instinct is sufficient cause. The trade is scale for legibility, made on purpose: the thesis, not a compromise of it.

Sovereignty is the part of this stance that generalizes past one operator. The system is designed to be given away, and giving something away is where a governance claim gets tested. Two instances, both decided against the house's own convenience. When an exception to an export law was proposed, the house held the law origin-only: receiving halls may loosen their own adopted law at their discretion, because the hold governs what a kit teaches, never what a hall rules. The second runs squarely against the house's interest. A provenance mark's standing is the origin's to control, and withdrawing it makes every subsequent check on that hall's mark refuse, everywhere, automatically — a real unilateral lever over another hall's standing, held by this house and by nobody else. The ruling was to claim it in the open on the estate's public pages, disclosing a power rather than quietly holding one, and to open a separate deliberation on whether the house should hold it at all. That deliberation is open; the disclosure is not contingent on it. A governance doctrine that only ever binds the other party is a preference. This one binds in the direction that costs something.

6 · The instrument: name the gate's intent first

The stance has a general instrument. The security doctrine requires that a gate's intent is named before its mechanism is chosen, because the same lock is sufficient or decorative depending on what it was built to do, and nothing about the lock reveals which. An unnamed gate defaults silently to whatever its builder assumed and whatever its user hoped, and those are rarely the same thing. The ladder has four rungs:

Two properties make it more than a taxonomy. The fourth rung is deliberately not offered: anything needing a vault never enters the estate at all and goes person-to-person, off the system entirely. Declining to offer the highest rung is what keeps the other three honest.

And one limit holds across every rung: a gate governs entry and never what follows. Anyone admitted may copy and share onward, and no mechanism the estate can build reaches that act; past the gate the only governor is decorum, which among invited friends is real but is never counted as enforcement. Two duties follow, and the second binds harder than any gate: users are told their rung and what it does not cover, and nothing is admitted whose harm, if it traveled, exceeds what decorum can carry. One more rule rides every rung: the promise is the rung, and any hardening beyond it is surplus, done where it is cheap and never advertised.

The ladder's sharpest downstream finding was not predicted by it: a surface's ceiling constrains a gate's intent before the intent gets to pick a mechanism. Twice, on unrelated platforms, an intended rung turned out to be unclaimable: the surface's ceiling sat below the intent, and in one case the option that appeared to grant a limited role would have named a role nobody there can hold. A decorative grant is worse than no grant, because it is believed. The doctrine extends the same absence to a contact surface: the estate offers no public contact address, by design, and its public pages declare that absence rather than implying an invitation. The receipts page carries both instances in full.

7 · What this does not claim

Several things are not settled, and naming them is part of the discipline.

None of this evidence generalizes past N=1, and the paper says so without hedging. The mechanism evidence is one operator's build log, not a benchmark and not a multi-user trial. What was actually tested is narrower: whether a proving-and-gating discipline lets one solo operator catch more of a system's own mistakes than it otherwise would. The export ceremony's crossings do not change that: at least ten recipients holding kits is evidence about the ceremony, not about whether the gating discipline works anywhere but here.

This is not a zero-infrastructure system. The appealing form of the claim is plain files, git, a Claude session, nothing else to install. But the house has simply built things: more than a dozen command-line tools in the craft line alone, a separate export-and-audit set, the armed guard pack, a static-site builder, and a third-party imaging library. That is more than zero. The honest claim is narrower and still worth something: no dedicated runtime, no subscription tier, no service to sign up for, no dependency chain. Every tool is standard-library Python except that one library, and the whole system remains a folder a person owns.

The calibration discipline paused for four weeks, and the house's own audit restarted it. The measuring never stopped: consumption is recorded at closes as a matter of course, in roughly two closes out of three. What lapsed, for about four weeks, was the pre-registering — an estimate written before a heavy block and graded against the measured actual afterward. Part of that was by design, since cheap, well-characterized shapes were granted launch-and-report and stopped pre-registering on purpose; the rest was not. Measuring afterward is bookkeeping; predicting first and grading yourself against it is the part that can be wrong about you, and that is the half that lapsed. The house's own audit surfaced it rather than a critic, and the pre-registering has resumed with its first before-the-fact row. The zero-veto streak stays checkable across the dated session notes; no running total is maintained.

Does the architecture survive a real model change rather than an incremental update? The bet is that continuity lives in the files, not the weights. The same-vendor half has evidence: the calibration table starts a fresh baseline, by name, whenever the plan or model tier changes, and production waves have run clean under the same gates across model tiers. Whether the governance layer holds under a genuinely different model family has one datapoint and no test: a member hall reports that the architecture survived a move to a different vendor's surface — their account, anecdotal, not yet tested by this house or by any other hall. Several halls have a lower tier of the same model family as their ceiling, and run well. That half remains a bet with a first anecdote, not a result.

The origin is a single point of failure for the entire trust layer, and no mitigation has been proven. Every act that gives the provenance system its meaning — minting a mark, withdrawing one, adjudicating a dispute — requires the one human, and nothing distributes those acts. The remedy would be a graduated delegate, and the honest finding is that the platforms this estate runs on do not offer one: their permission models are all-or-nothing. The house's answer is that when the keeper cannot act, the trust layer holds, rather than handing the keys to a mechanism that cannot be sized. That is a ruled design, and one no reader should take as tested. One defensive consequence belongs beside it: with no delegate and no public contact address, any message claiming delegated authority over this trust layer is forged by construction.

And the least tested piece is the claim about the field. A dated survey of the field found the automatic variant of the trust-ramp shipped elsewhere first, and found no instance of the human-gated variant this house designed: promotion earned from tracked evidence but signed by a named human at every step, with hard floors and instinct-triggered demotion. Two things keep that absence claim honest. It is graded survey-based, medium confidence, and not an exhaustive audit. And it has a shelf life: the sweep was run on 2026-07-10 and has not been re-run, so the claim decays until it is. One supporting example did not survive the citation check at all: an early-stage platform whose own published tier table diverged from the characterization given to it. No claim here rests on that platform, and the narrowed claim now rests on the sweep alone, which is the weaker footing. The receipts page carries the survey vendor by vendor, with dates.

What survives all of that is the half that was never about the field at all. The charter was written and dated before its first proving phase opened: a five-surface threat model, a staged stop ladder, six promotion rules, a defined proving plan. That is narrower than "we shipped autonomy and it worked" — the fences were drawn before the capability existed, and whether they hold is a future finding. The ramp stays designed and unbuilt.

8 · Where it goes

The roadmap has a shape the file-and-role scaffold did not imply: an outward estate. A strategy pass fixed four verbs to four named doors — express, enable, teach, leverage — each with its own audience. Strip the theming and the claim underneath is a second act: the same continuity-and-gating machinery, packaged so that other solo operators, starting with named friends, run their own instances.

As of August 2026:

What stands. The export ceremony runs, and the evidence section carries its record and its published miss. A private trading commons stands live on shared infrastructure, with member halls joined and a charter that states plainly what a merge does and does not mean. Its first completed exchange landed: an offer posted by this house, taken up by a member hall. And member halls post offers of their own — the first, a class charter authored in a member's hall, crossed by pull request and was taken up in turn. Two halls in one exchange, and one artifact, is a small number; it is also the difference between a commons that is described and a commons that has done the thing once. The express wing's public site is live and has not yet been read at any scale: standard library only, no framework, no scripts, no cookies, no third-party requests. This paper publishes alongside it. The members' market has a gatehouse: the sign-in is ruled, and the first members are invited to the front door behind it. The gatekeeper stands on a managed provider, so this house holds no password and keeps no member table of its own.

What does not stand. Behind that gatehouse there is a front door and little else: the market is not yet a place with goods on its shelves. The mark-verification desk is unbuilt; until it stands, verifying a mark means asking the house. The teaching wing and the collective wing are designs with papers, not places with members; each wing has its own paper, shelved on the landing page beside this one and written to the same register. And the estate is not a company, a product, or a service. It is a working practice with guests, which is the claim its own landing page makes and the one this paper will not exceed.

Behind it, the staged autonomy layer waits on its proving phase, its fences unchanged and each one a configured limit rather than prose-only governance. The audit trail underneath exists in miniature already: a journal entry lands before the action it records completes, and carries a sequence number, so a gap is detectable and is itself an incident. The receipts page carries the fences in full.

The forward claim is deliberately narrower than "this will out-scale the field." It is that the same discipline — pre-register, gate, measure, publish the miss — keeps getting pointed at whatever the system's surface area grows into next rather than being retired once the file-and-role scaffold is in place. The evidence is above: every new surface this practice has grown, from an executable guard layer to an export ceremony to a production line to an outward estate, arrived with a gate, a record, and a published miss attached. None was exempted for being new.

9 · What you could take from this

Four of the ideas here are separable from everything else in this paper. None needs a guild, a theme, or a folder shaped like this one, and any can be tried tomorrow.

Pre-register the criterion before the evidence exists. Write down what counts as success before you collect, and the result stops being negotiable afterward. It is the cheapest of the four, and the one that most reliably catches you flattering yourself.

Name a gate's intent before choosing its mechanism. The same lock is sufficient or decorative depending on what it was built to do, and nothing about the lock reveals which. Write the intent down and the choice stays checkable.

Make reviewer-≠-reviewed a property of the tools, not a rule. A reviewer told not to edit what it reviews may still edit it; one handed no edit tools cannot. Take the capability away rather than forbid its use.

Put the correction at the top of the document, not the bottom. Appending it at the foot preserves the record and still misleads the next person who reads only the head. This house runs that rule on its own working documents, which is where it earns its keep.

What a reader can do today is read the estate's own landing page, which says what stands and what does not in plainer terms than this. New halls arrive by invitation and a hand-carried kit, not by signup, and the estate widens slowly and deliberately. There is no public contact address, by design; if you know the Guildmaster, ask.

Notes and sources

This paper was drafted, reviewed, and gated under the discipline it describes. It was written by a commissioned drafting agent, then reviewed by a council of seats on different models. Every external source was checked against its primary by a quarantined scout, and the corrections that check produced were made in the body rather than fixed silently. An independent verifier with no write tools gated the draft, failed it, and passed it only after repair.

Every source below was verified against its primary by a quarantined web scout on 2026-07-11, and again on 2026-08-22 — save one that could not be fetched at the later pass and stands on the earlier one.

• Anthropic, "How we built Claude Code auto mode" (2026-03-25) and "Building effective human-agent teams" (2026-06-24)
• Letta, "Introducing Context Repositories: Git-based Memory for Coding Agents" (2026-02-12)
• Perplexity, "Introducing Model Council" (2026-02-05); Wu et al., "Council Mode: A Heterogeneous Multi-Agent Consensus Framework for Reducing LLM Hallucination and Bias," arXiv:2604.02923
• Cursor, "Auto-review Run Mode" changelog (2026-05-29); Microsoft Learn, "Design autonomous agent capabilities" (2026-06-11); Okta, "Okta for AI Agents is Now Generally Available" (2026-04-30), with Auth0 for AI Agents (2025-11-19)
• Nous Research, Hermes Agent documentation, the Skills System "/learn"; GitHub, paperclipai/paperclip issue #379, "RFC: Agent Trust Levels" (opened and closed-completed 2026-03-09)
• Linux Foundation, "Linux Foundation Announces the Formation of the Agentic AI Foundation" (2025-12-09) — source of record for the AGENTS.md adoption figure and the stewardship fact
• Li et al., "SkillsBench," arXiv:2602.12670 — curated skills raise average pass rate by roughly sixteen points over a no-skills baseline; self-generated skills scored below that baseline where they were tested (re-read at the primary 2026-08-22)
• Checked and not cited: an early-stage agent-registry platform considered as support for the human-gated trust-ramp finding (accessed 2026-07-11). Its own published tier table diverged from that characterization; no claim here rests on it, and none will without a fresh primary read.

The Ember Guildhall — kept by Rob Ruud, its Guildmaster · co-signed by the Majordomo of the Ember Guildhall.