Procedures Are The Interface

If You Only Read One Thing

The agent story on 2026-06-20 was not smarter prompts; it was procedures becoming durable objects. Codex Learns The Procedure shows why OpenAI's Record & Replay guide matters, while ARD Gives Tools An Address explains the matching ecosystem move: agents need reusable work patterns and a way to find trusted capabilities at runtime.

Codex Learns The Procedure

The interesting thing about OpenAI's new Codex feature is not that it records a screen. It is that it turns a human demonstration into an inspectable skill the agent can reuse later.

Record & Replay is available in Codex on macOS, with initial availability excluding the European Economic Area, the United Kingdom, and Switzerland. Computer Use must be available and enabled. The workflow is deliberately mundane: open the Codex app, record a known task, stop when the task is complete, then let Codex draft a skill that specifies when to use it, which inputs vary, what steps to follow, and how to verify the result. OpenAI's Business release notes frame it as a feature for eligible Business users who need stable repeatable workflows across Codex, Computer Use, browser actions, and plugins.

Why it matters: This is the macro recorder returning in agent form, but with a different economic role. The old macro copied clicks. A Codex skill turns those clicks into editable operational memory: a reusable procedure, plus inputs, conditions, and a verification step. That shifts the scarce object from the prompt to the procedure. If the work is filing an expense, creating a correctly configured issue, publishing a report, or collecting a recurring artifact, the durable asset is no longer "the right instruction." It is a tested pattern that can be called in a new thread with changed variables.

That changes the boundary between automation and training. A prompt teaches the model once, inside one context. A recorded skill teaches the workspace. It also moves skill formation closer to the person who already knows the task, instead of requiring an engineer to translate every office workflow into code, MCP wiring, or a brittle browser script. That is a real distribution shift for computer-use agents: the interface becomes "show me the procedure," not "describe the procedure perfectly."

The catch is that this makes governance more important, not less. OpenAI warns users to avoid secrets and sensitive data while recording. That is the right warning, but it is also the product's core tension: the most valuable workflows are precisely the ones that touch authenticated apps, internal fields, account-specific defaults, and tacit preferences. Once demonstrations become reusable assets, teams need review, ownership, expiration, and auditability for skills in the same way they need review for scripts.

Room for disagreement: This may start as a narrow convenience feature. Many workflows are too unstable, too exception-heavy, or too sensitive to record safely. But the direction is clear: agent platforms are trying to convert tacit workflow knowledge into portable runtime state, and that is more structurally important than another chat-side shortcut.

What to watch: Watch whether OpenAI adds workspace-level review and provenance for generated skills. If Record & Replay remains a personal productivity feature, it is useful; if it gains approval flows, versioning, and run logs, it becomes a team automation layer.

ARD Gives Tools An Address

The other side of reusable procedure is discoverable capability. Google, with partners across the agent ecosystem, published Agentic Resource Discovery, an open specification for finding and verifying tools, skills, MCP servers, A2A agents, OpenAPI tools, and other agentic resources across organizations.

The spec's design is simple enough to matter. Organizations publish catalogs under domains they control, using files such as ai-catalog.json. Registries crawl and index those catalogs. When an agent needs a capability, it can query a registry in plain language, fetch a known partner catalog directly, verify publisher metadata, then connect using the selected resource's native protocol. Google says Agent Registry in Gemini Enterprise Agent Platform will support ARD in the coming months, including namespaced URNs, egress policies, tool and spec pinning, Agent Identity, and trust manifests.

Why it matters: Agents have a supply-chain problem before they have an autonomy problem. The current model assumes the useful tools are already installed, hard-coded, or manually wired into a workspace. That works for a few canonical connectors. It fails when every product team, vendor, and internal platform publishes its own specialized agent, skill, workflow, MCP server, or API wrapper. ARD is an attempt to create the discovery layer before agent ecosystems become an unsearchable pile of private registries.

The important distinction is that ARD does not try to be the invocation protocol. It sits before invocation. That matters because the agent stack already has too many competing ways to call tools. ARD's narrower claim is: publish capabilities under a trustworthy domain, index them, verify them, then hand off to whatever protocol the tool already uses. That is less glamorous than a universal agent operating system, but it is more plausible. The web scaled because discovery, identity, and transport were separable enough for different layers to evolve.

The structural bet is that trust will attach to publication and policy, not only to execution. Domain ownership becomes the first proof of identity. Registries become the search surface. Enterprise policy decides which discovered tools are allowed to leave the workspace, which versions are pinned, and which publisher manifests count as trusted. If this works, agents stop being bundles of preinstalled connectors and become clients that can resolve capabilities just in time.

Room for disagreement: Specifications often arrive before adoption, and agent standards are especially vulnerable to vendor theater. ARD also does not prove that a discovered tool is safe or that the agent should use it. It proves identity and metadata, not judgment. Still, that is not a weakness so much as a useful boundary: discovery should not pretend to solve behavior.

What to watch: The adoption test is not whether Google supports ARD. It is whether Microsoft, Hugging Face, Snowflake, GitHub, and independent agent runtimes publish real catalogs that developers can query outside one vendor's control plane.

The Contrarian Take

Everyone says: The agent market is about which model gets better at tool use.

Here's why that's wrong (or at least incomplete): Tool use is becoming the commodity layer. The differentiating layer is how a workspace turns human procedures into reusable state, discovers external capabilities, and controls which actions are allowed. Codex Record & Replay, ARD, GitHub's Qubot, and DeepMind's AI Control Roadmap all point the same way: the agent platform is moving from chat transcript to operating surface.

Under the Radar

• GitHub's data agent says context is the product. GitHub described Qubot, an internal Copilot-powered analytics agent available through Slack, VS Code, and Copilot CLI. The important detail is not natural-language SQL; it is the context layer. GitHub splits warehouse knowledge into bronze, silver, and gold context, loads it at runtime through the GitHub MCP Server, stores results as markdown reports in pull requests, and runs offline evals with known answers and ground-truth SQL. The reported lesson is blunt: better curated context made Qubot more accurate and three times faster at returning the right answer.
• DeepMind is turning agent safety into instrumentation. Google DeepMind's AI Control Roadmap treats internal agents as potential insider threats and maps mitigations to capability levels. The useful practitioner idea is not the policy framing. It is the measurement loop: coverage, recall, and time-to-response for monitoring; Detection levels D1-D4; Prevention and Response levels R1-R3; and an internal prototype that has analyzed a million coding-agent tasks to build live monitoring for Gemini Spark.

Quick Takes

• vLLM moved model panels into the serving router. vLLM Semantic Router Fusion lets a route run a panel of models, use a judge model to analyze agreement and gaps, synthesize one answer, and preserve routing policy and traces inside an OpenAI-compatible serving layer. The structural point is that multi-model routing is moving from offline evaluation into request-time infrastructure. (Source)
• Microsoft named the host-compromise risk. Microsoft's Security Blog published AutoJack, a single-page remote-code-execution attack against the host running an AI agent. Even without treating the writeup as universal, the lesson is clear: browser-facing agent environments are not only prompt-injection surfaces; they are local-host security boundaries. (Source)
• Repo-local memory got a small but useful prototype. Agent Memory Layer is an experimental GitHub project for preserving intent, decisions, and evidence inside a repository so Codex, Cursor, Claude Code, Gemini, and humans can continue work with less rediscovery. It is not a standard, but it matches the day's pattern: agent memory is becoming an artifact model, not a chat habit. (Source)

The Thread

The thread is that agent systems are beginning to externalize their working memory. A recorded Codex workflow becomes a skill. An ARD catalog gives a capability a searchable address. Qubot turns analytics tribal knowledge into a curated context layer. DeepMind turns agent behavior into monitored trajectories and response tiers. These are all different answers to the same problem: once agents act across real tools, the durable unit cannot be the conversation. It has to be a procedure, catalog, context record, trace, or policy object that other agents and humans can inspect.

Predictions

New predictions:

• I predict: By 2026-08-31, at least one major coding-agent platform will add workspace-level review, ownership, or run-history controls specifically for demonstration-generated skills or recorded workflows before those skills can be shared across a team. (Confidence: medium; Check by: 2026-08-31)

Generated on 2026-06-20 at 04:10 ET.