Executive Summary
The models are no longer the main constraint in production AI. The friction is now in four places: product quality, where agent state lives, how scarce human attention gets spent, and how cost gets routed. Practitioners running heavy agent workloads report that generation is cheap and plentiful. The limits are review capacity, durable execution, and trust boundaries. Two of today's sources point the same way. The value is shifting from the frontier lab's app surface to the layer around it: logs, routing classifiers, risk taxonomies, and gateways. Enterprises that buy frontier capability and stop there are optimizing the part of the stack that matters least.
What Changed
The post Dev Day consensus among heavy users is that OpenAI's Codex app updates were regressions. Power features are hidden to protect about 8M mainstream users. Meanwhile open harnesses (Pi, OpenClaw, Hermes) ship faster and are now competitive with commercial assistants. Agent state is still tied to where it runs: closing a laptop kills the agent. Claude Code and Codex both keep JSONL session logs internally, but neither offers a stable API for them, and no session or trace standard exists.
Small calibrated decision models have moved from curiosity to cost lever. One team's agentic memory pipeline cut cost 10 to 20x while matching Opus 5.5 quality on classification steps. The Claude Code team, for its part, publicly reframed code review as risk-targeted verification that runs continuously during authoring, rather than a human reading every PR.
Model tiering has settled. Astra or Fable class models handle hard work, Opus 5.5 and Soul 6.1 are the daily drivers, and Sonnet runs as a sub-agent. Open models sit roughly a year behind the frontier.
Cross-Expert Synthesis
The Latent Space panel and the Claude Code team reach the same conclusion from opposite directions: human review is now the bottleneck, not generation. The panel's overnight pattern (one orchestrating thread, about 15 bounded sub-agents, queued or detached runs) produces more output than anyone can read. The Claude Code team's answer is to stop treating "a human read it" as the control. Instead, each change is classified by what could go wrong, and each risk class goes to the check best suited to catch it.
Both answers depend on classification. The panel uses cheap classifiers to route work and cut cost. The review reframe needs a classifier, whether human or model, to sort changes by blast radius. The same small, calibrated, auditable decision layer serves both cost control and governance. That layer is the enterprise's to own, because no vendor will build it around your risk profile.
The two sources disagree on trust in one place. The panel is cautious with assistants: read-only or draft-and-approve, prompt injection unsolved, and over-helpfulness as the real way things leak. The Claude Code team is comfortable with model-on-model review for routine changes. Willison's caveat settles it: a model reviewing a model's output produces correlated error. Model review is a filter, not independent verification, unless an orthogonal check (types, tests, sandboxing, permissions) backs it.
Enterprise Implications
Lock-in risk has moved off the model. Enterprises can switch models in an afternoon. They cannot switch an agent runtime whose session history lives in a proprietary, undocumented format. Whoever owns the append-only log owns resumability, audit, and portability between local and cloud.
Review policy is now a governance artifact. Regulators and insurers will ask which check covered which risk, not whether a person looked at the diff. Most enterprises have no written change-risk taxonomy, so an "AI reviewed it" claim cannot be defended today.
Assistant sprawl is a security cost as well as a productivity cost. Every assistant with its own email and drive connections is a separate exfiltration path. A central MCP gateway that holds all connections turns that sprawl into one place to enforce policy.
What To Do About It
- Own the agent log. Standardize on an append-only, resumable session record you control, either built or bought, before any lab publishes its own format and makes it the default.
- Find the classification steps. Inventory pipeline steps that are really routing, ranking, or labeling. Replace them with small calibrated models, and use your existing labeled data as the regression eval. Treat vendor benchmarks as marketing.
- Write the change-risk taxonomy. Map auth, payments, data access, and infrastructure changes to mandatory human sign-off. Map the rest to orthogonal automated checks. Measure escape rates before shrinking human review.
- Gate assistants through one MCP gateway, with read-only or draft-and-approve as the default until the misclassification failure mode is measured in your environment.
- Customer question: "If your agent vendor disappeared tomorrow, could you replay last week's agent sessions and show an auditor what each one did?" Almost nobody can answer yes. That gap is the engagement.
Risks and Blind Spots
The evidence is thin. The review reframe comes from the vendor's own team and includes no escape rates, latency figures, or incident data. The 10 to 20x classifier saving is one team's anecdote on one pipeline. The panel consists of power users whose tolerance for open-source harness fragility is far above an enterprise's. "Open models a year behind" reflects day-to-day coding use and may not hold for narrow, fine-tuned enterprise tasks.
There is also a strategic trap, framed here by analogy from Si Sheppard's resource-curse argument (Sheppard does not apply it to AI, and the thesis itself is contested). Cheap frontier APIs are the easy windfall. Firms that capture the quick productivity gain may never build the evaluation, data, logging, and governance layers that compound. Firms with constraints (regulated data, tight budgets) may end up with the more durable position because those constraints force them to build that layer. Use this as a lens for portfolio conversations, not as evidence.