Everything a good coder needs to know about the AI landscape right now: models, coding agents, the Python stack, the economics, and the mental models that make it all click. With a curated syllabus of the canonical reading.
If you last touched AI when ChatGPT was a chat box, the field has moved twice since. In 2023–24, the unit of work was a prompt: you asked, it answered. In 2025, the unit of work became the agent loop: a model calling tools, reading files, running commands, and checking its own work, for minutes or hours, not seconds. By mid-2026, the defining shift is that these loops are production infrastructure: they run in terminals, CI pipelines, and background cloud workers, and every major lab ships both a model and a "harness" around it.
Four facts define July 2026:
1. There is no single best model. The frontier is crowded: Anthropic's Claude Opus 4.8 and the new Mythos-class Fable 5, OpenAI's fresh GPT-5.6 family (Sol/Terra/Luna, launched July 9), Google's Gemini 3.x, and xAI's Grok 4.5 all trade blows depending on the benchmark. Open-weight models (Kimi K3, DeepSeek V4, GLM-5.2, MiniMax M3, Qwen 3.x, and now Thinking Machines' Inkling) genuinely reach the frontier at a fraction of the price.
2. Million-token context and built-in reasoning are table stakes. Flagships think before answering by default, and 1M-token windows are standard, which changed how apps are architected (less RAG gymnastics, more context curation).
3. The harness matters as much as the model. On short, clean tasks, raw model intelligence dominates. On long, messy tasks (migrations, multi-file refactors, research pipelines), the scaffolding around the model (tools, permissions, checkpoints, parallel workers, memory files) decides whether work actually finishes.
4. Subscriptions massively subsidize tokens. A $20–$200/month plan often buys usage that would cost several times more at API rates. Understanding this arbitrage (when to ride a subscription, when to pay per token, when to route to a cheap open model) is now a core engineering skill.
Read sections 02–08 first; they build the mental models. Then work through the syllabus in section 09 over your first month. Section 10 is a practical checklist. Nothing here requires ML background; it requires exactly what you already have: engineering judgment. When you're done, continue with The Engineering Playbook, the companion piece on cheap-at-scale tooling, infra, and security.
An "AI agent" sounds mystical. It isn't. It's an LLM called in a loop: the model receives context, decides on an action (usually a tool call: run this command, edit this file, search this API), the environment executes it, and the result is appended back into the context for the next turn. That's the whole trick. Thorsten Ball famously demonstrated a working coding agent in about 400 lines of Go. Everything else (Claude Code, Codex, Cursor) is refinement of this loop: better tools, better permissions, better recovery from failure.
The industry term shifted in 2025, and the shift matters. "Prompt engineering" implies crafting one clever instruction. Context engineering is the discipline of deciding everything that fills the context window at each step: instructions, retrieved knowledge, tool descriptions, memory, prior results, all structured so the model can use them. Karpathy's framing is the one that stuck: the LLM is a new kind of CPU and its context window is the RAM; your job is deciding what goes into RAM.
Two essays define the discipline, and both are required reading. Anthropic's Effective Context Engineering for AI Agents supplies the physics: attention is a finite budget because every token attends to every other (n² pairwise relationships), so recall degrades as context grows ("context rot"), and the operating principle becomes finding the smallest set of high-signal tokens that maximizes the chance of your desired outcome. It also names the failure zone for instructions: the "right altitude" between brittle hardcoded if-else logic and vague hand-waving, with a curated handful of canonical examples beating a laundry list of edge cases every time.
Sourcegraph's Context Engineering: A Practical Guide supplies the systems view: four pillars (instructions, retrieval, memory, tools) assembled by a pipeline that runs on every turn, and a litmus test worth memorizing: if your improvements come from rewording, you're doing prompt engineering; if they come from rewiring (changing what gets fetched, how it's ranked, what gets evicted), you're doing context engineering. The whole discipline compresses into four questions asked at every step: what do we fetch, when do we fetch it, how do we compress it, and when do we throw it away.
The most-cited page in the field, Anthropic's Building Effective Agents, draws one line you should internalize before writing any AI code: workflows are systems where you orchestrate the LLM calls through predefined steps (chain, route, parallelize, judge); agents are systems where the model directs its own process. Workflows are predictable, testable, and cheap. Agents are flexible and powerful but harder to control. The professional instinct in 2026 is: start with the simplest workflow that could work, add agency only where the task genuinely demands open-ended decision-making, and never add a framework you don't understand.
Strong engineers coming from deterministic systems tend to over-engineer control (brittle mega-prompts, hardcoded logic) or under-engineer verification (no evals, vibes-only QA). The craft lives in between: give the model room to work, then measure it relentlessly.
These two mechanisms carry the entire agent economy. Fifteen minutes here saves you weeks of confusion later.
An LLM only ever emits text. A tool call (a.k.a. function calling) is a convention: you send the model, alongside your prompt, a list of tools described in JSON Schema: name, purpose, typed parameters. When the model decides a tool would help, instead of answering in prose it emits a structured block like {"name": "search_companies", "input": {"country": "FR", "sector": "fire safety"}}. The model never executes anything. Your code (or the harness) receives that block, runs the real function, and sends the result back as a new message. The model reads it and continues, maybe answering, maybe calling another tool. That request/execute/observe cycle, repeated, is the agent loop from Fig. 1.
Three practical consequences:
Schemas are prompts. The model chooses and fills tools based purely on your names, descriptions, and parameter docs. Vague descriptions produce wrong calls; a well-documented tool is the cheapest accuracy upgrade available. Write docstrings like the reader is smart but has zero context, because that's exactly what's true.
Fewer, sharper tools beat many overlapping ones. Tool definitions consume context and compete for attention; overlapping tools cause misrouting. Consolidate, give each tool one unambiguous job, and namespace related tools with a shared prefix so the model can see the families. Anthropic's tool-design guide adds three habits that pay off immediately: return human-readable identifiers instead of UUIDs (the model reasons over what it can read); paginate and truncate by default so one verbose tool can't flood the window; and put guidance in error messages: a tool that fails with "date must be YYYY-MM-DD, e.g. 2026-07-22" gets a correct retry, one that fails with a stack trace gets a guess. The deeper convention worth adopting: distinguish transient failures (raise them so the model retries) from permanent ones (return a structured result with an error field the model can reason about and route around). And close the loop the way the labs do: run the agent on real tasks, then let the model read its own transcripts and rewrite the tool descriptions that confused it.
Structured output is the same trick pointed inward. When Instructor guarantees you a validated Pydantic object, it's using tool-calling machinery: your schema becomes the "tool," and the model's "call" is your data. That's why tool calls and extraction feel like the same skill: they are.
Before late 2024, every app defined tools its own way: a tool written for one assistant was useless in another. The Model Context Protocol (open-sourced by Anthropic, now openly governed and adopted across OpenAI, Google, and Microsoft) standardizes the plumbing. Think USB-C: build a capability once as an MCP server, and any MCP client (Claude Code, Codex, Cursor, your PydanticAI agent) can discover and use it.
A server can expose three primitives: tools (functions the model can invoke), resources (data the host can load into context: files, schemas, records), and prompts (reusable templates). Transport is boring on purpose: JSON-RPC over stdio for local servers, HTTP for remote ones. In Python, FastMCP reduces a server to decorated functions: your docstrings become the tool descriptions the model reads, which closes the loop with the "schemas are prompts" rule above.
And notice what MCP quietly makes possible: the server can be the product. A growing pattern in vertical software is shipping a domain corpus or capability as an MCP server (tools for search, lookup, cross-referencing, document fetch) and letting the customer's own assistant be the interface: no search UI to build, and every improvement to your tools improves every client that connects. If you're building anything data-shaped in 2026, "agent-native surface" belongs on the design-options list next to "web app" and "API".
Where the protocol is heading in 2026, since you'll hit these terms: skills (folders of instructions and scripts an agent loads on demand instead of carrying every capability in context), progressive tool discovery (load tool definitions when relevant rather than all upfront), and code mode (the model writes a small script against an API instead of chaining twenty tool calls, often cheaper and more reliable). All three are answers to the same pressure: context is a finite attention budget, and tool sprawl spends it.
One date to know: the largest spec revision since MCP launched lands July 28 (the release candidate has been frozen since May). The headline change makes the protocol core stateless: the initialize handshake and session IDs go away, so servers scale behind ordinary load balancers like any web service. It also moves optional surfaces (rendered UI, long-running tasks) into an extensions framework, tightens OAuth validation, and starts 12-month deprecation clocks on several little-used primitives. If you build or consume MCP servers, read the changelog before you're surprised by it.
The third extension mechanism, and the newest standard: Agent Skills. A skill is a folder containing a SKILL.md file: YAML frontmatter (name + one-line description) plus Markdown instructions, optionally bundled with scripts, templates, and reference docs. It's how you teach an agent a procedure: your team's PR checklist, your document-formatting pipeline, your screening methodology. Launched by Anthropic in October 2025 and published as an open standard at agentskills.io that December, the same file now works unmodified across Claude Code, Codex, Copilot, Cursor, Gemini CLI, and dozens of other clients.
The design principle that makes skills scale is progressive disclosure, and it's context engineering incarnate. Loading happens in three tiers: at startup the agent sees only each skill's name and description (~80–100 tokens per skill: an agent can be aware of dozens of skills for less context than one activated skill costs); when a task matches, the full SKILL.md body loads (keep it under ~5K tokens); and bundled reference files or scripts load only if the instructions call for them. Metadata is cheap to scan; instructions are expensive to load; the format keeps them separated.
How the three mechanisms divide the work: tool calls are the wire format for actions; MCP connects agents to external capabilities (systems, data, functions); skills package knowledge and procedure (how to do a task well, in your context). A skill often instructs the agent to use particular MCP tools; they compose. One caution as the ecosystem explodes past tens of thousands of public skills: quality is wildly uneven. SkillsBench, the first systematic benchmark, scored 47,000+ public skills at an average of 6.2/12 (barely above failing) while well-curated skills lifted agent pass rates by 16 points; and a Snyk audit found roughly a third of tested marketplace skills carried prompt-injection vulnerabilities. A skill is executable instruction: treat community skills with the same supply-chain skepticism as any dependency, and write your own with a "when NOT to use this" section, which is the single cheapest guard against an agent invoking the right skill at the wrong time.
Every MCP server you connect, and every skill you install, is a dependency with execution rights: it feeds text into your model's context and can run code on your machine. Vet both like packages, pin versions, run least-privilege, and sandbox anything that touches untrusted data. Section 08 and the Playbook go deeper.
Model rankings change monthly; the structure of the market changes slowly. Learn the structure: two proprietary "frontier" ecosystems that matter most for coding (Anthropic, OpenAI), one price-performance giant (Google), one speed/cost challenger (xAI), and an open-weight wave, mostly from Chinese labs, that reached the frontier this year.
Reasoning is built in. Frontier models "think" (generate hidden chains of reasoning) before answering, with adjustable effort. You mostly don't manage this; you pay for it in latency and tokens on hard tasks.
Benchmarks are scaffold-dependent, and vendor-reported. A SWE-bench score measures model + harness together; the same model scores differently in different scaffolds (double-digit swings are routine), contamination concerns are pushing the industry toward SWE-bench Pro and Terminal-Bench, and independent re-runs land 5–15 points below the vendor-reported numbers that circulate in launch posts. Treat public numbers as a shortlist generator, then run your own task through two candidates and keep the one whose output you'd ship.
Open weights are a real strategic option. Kimi K3 took #1 on a major frontend-code arena (weights promised July 27); MiniMax and DeepSeek match proprietary mid-tiers at 10–50× lower cost; and the wave is no longer only Chinese: Thinking Machines' Inkling (975B, Apache 2.0) shipped weights on day one. For high-volume extraction and screening pipelines, routing bulk work to open models and reserving Claude/GPT for judgment calls is the standard cost architecture. Note the counter-current, though: Meta went closed (its new Muse family ships no weights, and Llama is effectively in maintenance mode), so "open weights" in 2026 means Chinese labs plus a handful of new Western entrants, not the old Llama ecosystem. And open-model pricing churns weekly (DeepSeek retires its legacy endpoints July 24 and adds peak-hour surcharges), so put a gateway between you and the provider.
The frontier is genuinely contested right now. Fable 5 ($10/$50 per MTok) launched June 9 as the first Mythos-class model, was suspended June 12–30 under a first-of-its-kind export-control order, and redeployed July 1 with hardened safeguards. Nine days later OpenAI's GPT-5.6 Sol claimed the top of the Artificial Analysis Coding Agent Index (80 vs. Fable's 77.2) at a third of the cost. Read that sequence as the lesson: "best model" now has a half-life of weeks. Treat Fable as a scalpel for the hardest problems, Opus 4.8 at $5/$25 as the practical coding default, and Sonnet 5 (intro-priced $2/$10 until September 1) as the new volume workhorse: and re-run your own evals monthly instead of following headlines.
"Route by task" is easy to say and vague to do, so here is the loop in full. Triangulate three signals that fail in different ways. Independent benchmarks generate the shortlist. Artificial Analysis re-runs every eval itself instead of reprinting vendor decks, and it splits scores into separate intelligence, coding, and agentic indices with speed and latency alongside, which is the shape you actually shop in: an agentic pipeline cares about the agentic index, not the composite. Its most useful number is cost per task rather than price per token: reasoning models burn wildly different token counts on the same problem, so a model with triple the sticker price can land cheaper per completed task.
Revealed preference sanity-checks the shortlist. OpenRouter's rankings show where real spend goes, broken out per task category, from millions of users routing production traffic through one gateway. Benchmarks can be gamed and launch posts always shine; a model that holds the top of the programming category for six straight weeks is being re-chosen daily by people spending their own money, which is a much harder signal to fake. Divergence between the two sources is itself information: high benchmark plus low usage usually means an operational problem (rate limits, flaky providers, weak tool-calling) that no score captures.
Your own eval decides. Fifty to two hundred real examples from the actual task, two or three candidates from the shortlist, keep the one whose output you'd ship. Then encode the choice per task class in your gateway config rather than in code: extraction and classification at volume go to the cheap tier behind validators (Playbook §02), agentic coding follows the coding and agentic indices, latency-sensitive interactive surfaces shop on time-to-first-token (where reasoning models pay a thinking tax that intelligence scores never show), and long-document work checks effective context, since providers differ in how much of the advertised window is actually usable. Re-run the loop monthly; the July flip at the top of the coding index was a normal month, not an event.
The single biggest productivity unlock for someone in your position is not learning to "prompt better"; it's learning to delegate to coding agents and verify their work. Three archetypes exist, and by mid-2026 there are 35+ actively maintained CLI agents alone. You need to master one deeply, not sample all of them.
Write memory files. A CLAUDE.md (Claude Code) or AGENTS.md (the cross-agent standard, read by Codex, Cursor, Aider and others) at the repo root tells the agent how your project works: build commands, conventions, gotchas, what not to touch. This is the highest-leverage 30 minutes you'll spend. Treat it like documentation for a sharp new hire, because that's what it is.
Spec first, then delegate. The strongest 2026 workflow pattern is spec-driven development: describe the outcome, constraints, and acceptance criteria in prose; let the agent plan; review the plan; then let it execute. The spec is becoming the durable artifact; models are, in Sean Grove's phrase, the compiler.
Verification is your job. Agents are confident and fast, including when wrong. The highest-leverage move is giving the agent a verifiable check: tests, a build, a linter, a screenshot comparison, run inside the loop, so it can catch its own failures before you do. Then review diffs like you'd review a talented junior's PR. Two session heuristics from the canonical practice guide: clear context between unrelated tasks (the "kitchen sink session" is a named failure pattern), and after two failed corrections stop correcting: reset and rewrite the original prompt, because accumulated failed attempts poison the context more than they inform it.
Scope beats autonomy. The post-2026 consensus: agents are force multipliers when pointed at specific domains (tests, migrations, reviews, refactors) and money pits when handed vague open-ended missions.
The verification rule has a corollary worth making explicit, because most teams still apply one review standard to everything: review depth should track blast radius and checkability, not lines of code. Some production code can be written by agents under your guidance and never read by a human at all; some still needs the line-by-line pass you'd give a payments patch. A scraper is the clean case for full delegation: its output crosses a schema before anything downstream trusts it, it holds nothing but a scoped read token, and when the target site redesigns you regenerate it from the spec instead of maintaining it. Your backend sits at the opposite pole, as of today. The work is sorting everything between those poles deliberately, instead of skimming it all with the same guilty thoroughness:
| Review posture | Typical code | What makes it safe there |
|---|---|---|
| Fully delegated outputs reviewed, code never | Scrapers, format converters, one-off migration scripts, internal dashboards, throwaway analysis | Correctness is fully checkable at the output boundary: schema validation, spot-checks against known-good rows, row counts. Credentials are scoped so there's nothing worth stealing. The component is disposable: regenerate from spec, don't maintain. The spec and the validators are the owned artifact; the code is an intermediate product. |
| Boundary review interface + tests read, body skimmed | Pipeline steps behind validators, CLI tooling, test suites, glue services | Failures surface downstream and cost little. Read the schema, the interface, and the tests like a contract; skim the body for surprises. The tests are the review, so review the tests hardest. |
| Full review line by line, as if you wrote it | Auth, payments, data-integrity writes, concurrency, public API surfaces, anything holding production credentials | It isn't safe there yet, and that's the point. The failure modes here are exactly what output checks can't see: an authorization gap ships silently and behaves perfectly until someone hostile finds it, and no test suite proves the absence of that bug. A human reads the code. |
Two consequences. The tier a component sits in is a property of your verification, never of the model: nothing earns "fully delegated" by being written by a smarter agent; it earns it when the boundary around it catches every failure you care about. So the highest-leverage refactor of the agent era is moving components up this table: put a schema at the seam, scope the credentials, make the thing regenerable from its spec, and a module that used to consume review hours becomes one you never open. And the line is dated on purpose. Backends need full review in July 2026 because their checkable surface is thin, not because backends are sacred; as in-loop verifiers improve (property tests, security scanners, sandboxed staging replays), expect the middle tier to keep eating the bottom row. Re-sort quarterly, and only ever promote a component because its checks got better, never because the last three deliveries went fine.
Since you'll realistically run two or three harnesses (Claude Code daily, Codex as a second opinion, an IDE agent for flow), don't maintain parallel configs: make one source of truth and point everything at it. The working pattern: keep AGENTS.md as the canonical repo memory file and symlink CLAUDE.md → AGENTS.md (Claude Code follows the link; Codex, Cursor, and Aider read AGENTS.md natively), so one edit updates every agent's briefing. Skills are portable by design: keep one skills/ directory in the repo and expose it to each tool's expected location (.claude/skills/, .cursor/rules, etc.) via symlinks or a small sync script; tools like localskills automate exactly this fan-out. MCP is the same story at the capability layer: one server definition, registered in each harness's config, and every agent gets the same tools. The payoff compounds: your context files, your skills, and your MCP servers become harness-independent assets, which means switching or mixing agents costs nothing, the property that matters most in a market where the best harness changes quarterly. Follow this logic to its endpoint and you get a useful reframe: a well-configured repo is an agent. Memory files, MCP servers, permission allowlists, and skills fully define what an assistant can know and do there; the harness just supplies the loop. Some of the most effective "agents" in production are exactly this: no orchestration code at all, just a carefully built environment any harness can inhabit.
Once one agent session feels routine, the ceiling becomes obvious: you're serially babysitting a single context window. The fastest-moving category of 2026 sits one level up: orchestration shells that run many agent sessions in parallel, each in an isolated git worktree with its own branch, while you review and merge from above. Conductor (Mac app) is the polished archetype: it clones your repo, spins up isolated workspaces, and runs Claude Code, Codex, Cursor, or OpenCode sessions side by side. The harness writes the code; Conductor is the workspace layer around the harnesses. Superset is the agent-agnostic, source-available alternative: a local-first desktop workspace launching a much wider set of agents in parallel worktrees, with built-in diff review, chat, and browser surfaces. Claude Code's own Agent Teams feature brings the same idea inside one harness (multiple coordinating sessions on a shared codebase), and Linear's agent delegation (covered in the Playbook) is the same abstraction wearing a project-management interface: the issue queue becomes the orchestration surface.
The useful taxonomy: today's tools are mostly conductor-shaped (you decompose the work, assign lanes, and merge), while the trajectory points toward orchestrator-shaped systems that plan the decomposition, resolve conflicts, and surface only exceptions. The practical takeaways now: parallel agents multiply output only when tasks are independent and verifiable (the bottleneck shifts from generation to verification); git worktrees are the isolation primitive making it safe; and your cross-harness setup above is the prerequisite: a fleet of agents is only manageable if they all read the same briefing.
July 2026's security digests were dominated by coding-agent supply-chain attacks, and the details are instructive. "GuardFall" bypassed the shell-command guards of 10 of 11 popular open-source agents with one trick: the guards pattern-match the raw command string, but bash expands and unquotes after the check (r''m becomes rm); the only agent that held tokenizes commands the way the shell does. A single malicious GitHub issue chained prompt injection into a CVSS-7.8 supply-chain compromise of the official Claude Code CI action (fixed in v1.0.94). And skill-file malware keeps evading scanners by hiding payloads in auxiliary files. Rules: agents run with least privilege; turn on your harness's OS-level sandbox (Claude Code ships one, using Seatbelt on macOS and bubblewrap on Linux); never pipe secrets through agent context; treat every MCP server and skill like a third-party dependency, because it is one. Simon Willison's prompt-injection series (in the syllabus) is mandatory reading.
You pay for AI two ways: flat subscriptions (consumer plans with usage windows) or metered API tokens. The pricing structures are deliberately different products. And right now, subscriptions are heavily subsidized relative to API rates for interactive use. Knowing which side of the line each workload belongs on is real money.
| Plan | Price | What you get | Best for |
|---|---|---|---|
| Claude Pro | $20/mo ($17 annual) | Claude chat + Claude Code included, 5-hour rolling usage windows | Every engineer's baseline |
| Claude Max 5×/20× | $100–200/mo | 5–20× the usage ceilings; same window structure + weekly cap; Fable 5 included at reduced weekly limits since July 20 | Daily heavy agent use |
| ChatGPT Plus/Pro | $20–200/mo | GPT-5.6 access; Codex CLI works with any ChatGPT login | Codex-centric workflows |
| API (any provider) | per token | No session caps; Opus 4.8 $5/$25 per MTok, Sonnet 5 $2/$10 intro (→$3/$15 Sept 1), GPT-5.6 Sol $5/$30, open models from $0.14 | Production pipelines, CI, automation |
A token ≈ ¾ of a word. Agents are token-hungry: one real coding task pushes 400K–2M cumulative input tokens through the loop, because the growing conversation is re-sent every turn. That's why three levers dominate every AI cost conversation:
Rules of thumb for us specifically: your interactive Claude Code usage lives on a Max plan: it's the cheapest frontier compute you can buy. Anything headless (claude -p in cron/CI, Agent SDK pipelines) now draws from plan credit pools or API billing, so automation gets budgeted explicitly. Production extraction/screening pipelines route bulk classification to cheap open models via a gateway and reserve Opus/GPT-class calls for final judgment. And re-check pricing monthly: Opus dropped 67% in one release cycle this year; assumptions rot fast.
The Python AI ecosystem looks overwhelming; it isn't. It's a small number of layers, each with one or two winners. Here's the map, bottom to top.
Pydantic is the foundation of everything: the validation library underneath the OpenAI SDK, LangChain, FastAPI, and the structured-output ecosystem. If you know Pydantic models, you already speak the lingua franca.
Instructor patches any LLM client so a call returns a validated Pydantic object instead of maybe-JSON, retrying automatically on validation failure. It's the 80% solution for extraction; cap retries at 1–2 and add fallbacks, because malformed-output retries cost real tokens.
PydanticAI is the step up when you need an agent loop: typed tools, dependency injection, validated outputs, built-in evals and Logfire observability. The 2026 decision tree the community converged on: Instructor for extraction, PydanticAI for type-safe agents, LangGraph only for complex stateful multi-agent graphs.
LiteLLM gives you one completion() call across OpenAI, Anthropic, Google, DeepSeek, local models and everything else, plus fallbacks, budgets, and a proxy mode. It pairs with Instructor: LiteLLM routes, Instructor validates. This is how you stay model-agnostic, the single most important architectural property in a market where leaderboards flip monthly.
Scrapling & Crawl4AI for data: Scrapling is the adaptive scraper whose self-healing selectors survive HTML redesigns (with stealth fetchers for anti-bot walls); Crawl4AI outputs clean Markdown/JSON built for feeding LLMs. Before scraping anything, check for hidden JSON APIs in the network tab: an XHR endpoint always beats DOM parsing.
FastMCP is the standard way to expose your own tools to any agent via the Model Context Protocol (more in §07).
Langfuse / Braintrust for the layer that makes everything else safe to change: Langfuse is the open-source observability baseline; Braintrust is the eval-first platform where prompt changes get gated by scored experiments, CI-style. This category is consolidating fast (Langfuse was acquired by ClickHouse, Promptfoo by OpenAI, and Humanloop wound down after Anthropic hired its founders), which is exactly why you instrument against the OpenTelemetry GenAI conventions rather than any one vendor's SDK.
Everything the model sees competes for a finite attention budget, and performance degrades as context bloats. The baseline practices: system prompts at the right altitude; a minimal, non-overlapping tool set (if a human engineer can't say definitively which tool applies, the model can't either); few diverse canonical examples over exhaustive edge-case lists; and just-in-time retrieval: agents carrying lightweight references (file paths, queries, links) and loading content only when needed, the way Claude Code greps instead of indexing everything upfront. Ordering matters too: models recall the beginning and end of context far better than the middle, so the highest-signal material never gets buried mid-window.
For long-horizon work that outgrows any window, three techniques from Anthropic's playbook: compaction (summarize the conversation and restart with the summary; tune for recall first, then precision; the safest first cut is clearing old tool results, which the agent rarely needs to re-read); structured note-taking (the agent persists a NOTES.md or to-do file outside context and re-reads it after resets: memory with minimal overhead); and sub-agent architectures (a specialist explores with a clean window, burning tens of thousands of tokens, and returns a 1–2K-token distilled summary to the lead: detail stays isolated, synthesis stays clean). Which to use tracks the task: compaction for conversational continuity, notes for milestone-driven iteration, sub-agents for parallel research. The production numbers behind the sub-agent pattern come from Anthropic's own research system: the multi-agent version beat a single-agent baseline by 90% on their internal eval, token usage alone explained 80% of the performance variance, and it burned ~15× the tokens of a chat session: parallelism buys quality, and you pay for it in tokens, which is why it's reserved for tasks worth that bill. The same fan-out shape generalizes beyond research: production teams now run read-only audit fleets over large codebases: parallel finders emitting schema-constrained findings with evidence, adversarial verifiers prompted to refute each finding (defaulting to "not confirmed" when they can't reproduce it), and a final completeness critic asking what's missing: an hour of wall-clock for coverage no single context window could hold.
And retrieval quality is measurable, not vibes: on a 370-task enterprise-codebase benchmark, swapping an agent's grep-and-read baseline for structured code retrieval (a code-graph-backed MCP server) took precision-at-5 from 0.14 to 0.48, and one refactor that had burned 96 tool calls and 84 minutes finished in 5 calls and under 5 minutes: the same agent, the same model, different context pipeline. When an agent underperforms, suspect the pipeline before the model.
The uncomfortable truth of AI engineering: whoever measures best, ships best. Prompts and models are commodities; a suite of scored test cases built from your real failures is not. The three-layer pattern that production teams converged on: unit evals on discrete steps (did the extraction get the right fields?), LLM-as-judge regression suites for subjective quality, and sampled scoring of live production traces to catch drift. Two craft details that separate useful suites from theater: mix deterministic assertions (structure valid, required IDs covered, forbidden patterns absent) with judged rubrics rather than judging everything, and when you do use a judge, score each claim independently instead of asking for one holistic grade: per-claim verdicts localize regressions; holistic scores just wobble. Hamel Husain's "Your AI Product Needs Evals" is the canonical essay; read it before writing your first pipeline, not after your first incident.
Most agent incidents aren't model errors: they're tool-call failures, context truncation, and runaway loops, which standard APM can't see. Instrument with agent-aware tracing (Langfuse or similar, ideally over OpenTelemetry GenAI conventions so you're vendor-portable), and attribute cost per trace so you know what each outcome, not each token, costs. Teams that run this seriously treat cost attribution as an invariant, not a report: every LLM call and metered API call books its cost to the task that incurred it, including on failure, and the accounting layer raises an error when a cost computes to zero or a provider is unknown: silent undercounting is how a pipeline's economics drift out from under you. Sample traces asymmetrically: keep 100% of errored, expensive, or low-scoring traces and 1–5% of healthy ones, because uniform sampling at production volume throws away exactly the traces you'll need.
Prompt injection remains unsolved in 2026. The mental model (Willison's): danger concentrates when one system combines access to private data + exposure to untrusted content + the ability to act or exfiltrate. Any agent reading scraped web pages, emails, or third-party documents is exposed. Mitigations are architectural, not prompt-based: least-privilege tools, sandboxed execution, human approval on irreversible actions, and treating all fetched content as hostile input.
Section 03 covered the mechanics; the systems-level point is adoption and discipline. MCP is at roughly 100M monthly SDK downloads with thousands of public servers, which makes it simultaneously your integration shortcut and your supply chain. Operationally: maintain an internal registry of approved servers, review schemas before enabling them, version your own tool schemas explicitly (clients cache capabilities; silent breaking changes crash agent workflows), and prefer building capabilities as MCP servers over one-off integrations so they compound across every harness you use.
The bitter-lesson version of all five disciplines: don't build clever rigid structure that fights the model; build simple loops, good tools, tight feedback, and strong measurement, then let better models make your system better for free. Teams that over-scaffolded for 2024-era models spent 2025 deleting code.
Curated for maximum signal per page. ★ marks the six pieces that matter most if you read nothing else. Order matters: each week builds on the last. Budget ~45 minutes a day.
Learn to delegate with precision, verify with rigor, measure everything, and stay model-agnostic: the models will keep changing under you, and that's the good news.