Policy Gets A Compiler

If You Only Read One Thing

The prompt is losing its monopoly over agent behavior. Agent Script Compiles The Policy turns instructions into a lintable program before execution; AgentLens Scores The Journey judges the trace after execution. Salesforce's open Agent Script toolchain is the must-read because it shows both the attraction and the catch: the specification is inspectable, but the runtime that gives it force remains proprietary.

Agent Script Compiles The Policy

Agent builders usually hide an unstable mix of workflow graphs, prose instructions, and platform settings behind a visual canvas. Salesforce is consolidating those pieces into something closer to source code.

Starting this week, the new Agentforce Builder becomes the default for new agents, and Agent Script is generally available. A one-click migration converts an existing agent's actions, subagents, system messages, data connections, and configuration. The resulting indentation-sensitive file can declare state, actions, model selection, instructions, and execution flow. It also supports deterministic gates such as before_reasoning, if/else, and explicit state updates around the model's free-form reasoning.

The useful distinction is policy versus improvisation. A customer-service agent may be allowed to reason freely about a product question but must check account state before offering a refund. In a prompt, that boundary is advice. In Agent Script, it can be a named transition that a parser and linter inspect before the agent runs. The memory handle is simple: compile the guardrail, prompt the judgment.

Why it matters: Agent Script makes agent behavior reviewable through familiar software machinery: source control, syntax checking, compiler errors, and editor tooling. The Apache-licensed repository includes a parser, linter, compiler, language server, and editor integrations. That is more than a nicer authoring format. It moves part of reliability from probabilistic instruction-following into a static artifact that teams can diff and test. Model pinning also makes a model change an explicit code change rather than an invisible platform default.

The open/closed boundary is the strategic point. Salesforce has not open-sourced the runtime; the compiler targets an internal specification that executes on Salesforce infrastructure, and outside changes to the language specification are not yet accepted. The toolchain is therefore an open integration surface around a proprietary execution engine. If Agent Script spreads, Salesforce gains the ecosystem benefits of a language without surrendering control of where the program runs.

Room for disagreement: Declarative syntax does not make the hidden reasoning loop deterministic, and migrating a fragile prompt into a file can preserve the fragility with better formatting. The standardization signal strengthens if a non-Salesforce runtime can execute the same script, or if governance of the language specification moves beyond the vendor whose infrastructure interprets it.

AgentLens Scores The Journey

Most coding-agent benchmarks answer one question: did the final repository pass? AgentLens asks a more operational question: how did the agent get there, and would that behavior survive repeated use?

The AgentLens benchmark combines formal repository checks with model-written reviews of the full trajectory—prompts, tool calls, edits, tests, and intermediate decisions—plus side-by-side comparisons between agents. Its released fold contains 16 Java scenarios, each run under two personas, producing 32 trajectories per evaluated agent. The repository is built for recurring runs, including Claude Code through a REST adapter, rather than a one-time model launch chart.

The key distinction is outcome versus conduct. Two agents can leave the same tests green while one makes a narrow, reversible change and the other wanders through unrelated files or papers over a defect. Formal checks see the shared destination; trajectory review sees the route. The memory handle is: green tests can conceal red habits.

Why it matters: The public results show why a second lens changes interpretation. Explyt with Opus 4.7 and Claude Code with the same model both score 81.2 on formal checks, yet their combined quality indices are 81.5 and 76.2. Claude Code with Sonnet 4.6 reaches a higher 90.6 formal score but a lower 70.1 quality index. Those gaps are not proof that the ordering is correct; they are proof that pass/fail and process quality measure different things.

That makes AgentLens most interesting as a regression instrument. A team can hold its task set and review rubric steady, update an agent, and inspect whether planning, file discipline, validation, or error recovery changed even when completion rate did not. The benchmark turns trajectories into test artifacts rather than disposable transcripts.

Room for disagreement: The current evidence is narrow: 16 Java scenarios, GPT-5.4 as the sole review model, and a leaderboard topped by the authors' own Explyt agent. Model-written process judgments can also encode stylistic preferences that do not predict production outcomes. Independent reruns across languages, multiple judges, and real defect rates would separate a useful diagnostic from an elaborate house rubric.

The Contrarian Take

Everyone says: Reliable agents will come from smarter models and harder pass/fail benchmarks.

Here's why that's wrong (or at least incomplete): A model can pass more tasks while remaining difficult to control, and a benchmark can certify the final state while missing reckless behavior along the way. Agent Script and AgentLens attack opposite sides of the same problem: one makes intended behavior inspectable before execution; the other makes actual behavior reviewable afterward. Neither replaces model capability. Together they show why reliability is becoming a property of the specification-and-evidence loop, not a score attached to the model alone.

Under the Radar

Agent traces are acquiring a common viewing layer — Hugging Face now renders raw JSONL sessions from Claude Code, Codex, and Pi without conversion, including prompts, tool calls, and results. That lowers the cost of building shared eval datasets, but the docs carry the right warning: traces can contain private code, local paths, screenshots, command output, and secrets. Observability is also a data-governance surface.
Your discarded sessions can become an instruction file — Ditto mines Claude Code, Codex, and Copilot CLI histories into a local you.md: recurring definitions of done, rejection patterns, and demands for evidence. Its creator extracted roughly 1,656 sessions and three million user-authored tokens. Redaction is best-effort, and the profile cannot improve the base model, but it turns behavioral residue into portable context backed by dated session receipts.

Quick Takes

Open weights entered Copilot as a product tier, not a deployment choice. Kimi K2.7 Code is GitHub Copilot's first selectable open-weight model, hosted by GitHub on Azure and billed at provider list pricing. Enterprise access is off by default pending an administrator policy decision. The weights may be open, but the delivered product still bundles hosting, governance, and metering. (Source)
Agent configuration has become its own code-review surface. agentlint audits CLAUDE.md, AGENTS.md, skills, subagents, hooks, and other harness files, reasoning about whether a rule is always loaded, conditional, hook-injected, or returned by a tool. That load-path model matters because contradictory instructions can alter every agent run while remaining invisible to a conventional code reviewer. (Source)
Cross-agent delegation inherits the weakest sandbox. agent-intern exposes Codex, Copilot, Cursor, and Google's Antigravity CLI as MCP subagents inside Claude Code, reusing existing subscription logins and supporting parallel fan-out. Its documentation is unusually candid: Codex has an enforced sandbox, while other backends rely on weaker tool or agent controls. A unified interface does not create a unified security boundary. (Source)

The Thread

Today's artifacts form a control loop. Agent Script records what an agent is allowed to do; common trace viewers preserve what it actually did; AgentLens scores the difference; Ditto feeds recurring human preferences back into the next run. The important change is not that prompts disappear. It is that fewer consequential decisions live only inside an undifferentiated prompt. As specifications, traces, and rubrics become separate files, each can be versioned, challenged, and replaced without treating the whole agent as one inscrutable product.

Prediction Ledger

Weekly Scorecard

No AI predictions reached their check dates from July 6 through July 12, so the record did not change. Two representative calls from the week's pending backlog:

A serious coding-agent benchmark will publish an operating-footprint metric alongside pass rate for repository-sensitive tasks by September 15. — Made July 6, medium confidence. Pending: AgentLens adds trajectory-quality evidence, but not the specified tokens, file revisits, wall time, or cost metric.
A coding-agent runtime besides VS Code will expose the first cache-breaking instruction, tool definition, or message by September 30. — Made July 12, medium confidence. Pending: no qualifying implementation has shipped.

New prediction

I predict: By September 30, 2026, at least one major agent framework outside Salesforce will add a text-based agent specification combining model pinning, explicit state transitions, and lintable pre-reasoning gates. (Confidence: medium; Check by: 2026-09-30)

Issue date: July 13, 2026 · Generated: 4:20 AM ET