Long-Horizon Agents: A Technical Primer

In 2022, the longest task a frontier model could complete on its own amounted to seconds of human-equivalent work; today's leading agents sustain tasks that take a person hours, and by METR's measurements the interval over which that horizon doubles is itself shrinking. Sequoia's January 2026 essay "2026: This is AGI" (Pat Grady and Sonya Huang) distilled what is commercially at stake: an agent that can hold a goal across a workday is an agent you can hire, with coding agents as the first instance and vertical specialists as the template. Between the measurement and the thesis sits an engineering question — what it actually takes, in models, infrastructure, and evaluation, for an agent to carry a goal through hours of autonomous work, and to do so reliably rather than half the time.

That question is the subject of the Long Horizon Agents Build Day on August 22, where AGI House convenes 100+ builders in Hillsborough, presented by Coframe, with $10k in cash prizes. Speakers include Josh Payne (founder and CEO, Coframe), Neil Movva (CEO, Sail Research), and researchers Gabriel Kreiman and Spandan Madan. Space is limited; apply to attend.

The design space: what "long-horizon" means

The term is used loosely; Towards Long-Horizon Agents: A Survey (Dong et al., July 2026) gives it a structural definition. A long-horizon task is defined by its structure, not its clock time: a goal whose solution requires composing many tightly coupled, interdependent decisions into one coherent trajectory, with feedback and revision along the way. 

That definition separates long-horizon agency from three neighbors it is routinely conflated with. A long-running process (a cron job, a batch pipeline) persists for days but decides almost nothing — duration without coupling. An autonomous agent may act without human approval but only on short tasks — autonomy concerns who stays in the loop, not how far the reasoning reaches. And a self-evolving agent improves across tasks, which is one level of the long-horizon problem rather than the whole of it. 

The survey organizes difficulty into three nested levels, each inducing the capability it demands.

1. H1, intra-context: many coupled steps within a single context window, requiring reasoning that verifies and recovers before the chain derails — the level where most 2024–25 "agents" operated. 
2. H2, cross-context: the task outgrows the window, so state must be compressed, externalized, checkpointed, and faithfully resumed — the level where memory, compaction, and durable execution operate. 
3. H3, cross-task: an open-ended stream of tasks with shifting goals, requiring reusable skills that accumulate over time — the level of self-written skill libraries, continual learning, and never-ending optimization loops.

‍

The survey's second organizing idea is a two-pillar loop. 

1. Pillar I is the harness: everything wrapped around the model at runtime — loops and workflows, context and memory, tools and skills, orchestration, enforcement hooks, and verification. 
2. Pillar II is internalization: the training pipeline (data and environment synthesis, pre- and mid-training, fine-tuning, agentic reinforcement learning, distillation, self-evolution) that absorbs capability into weights. 

Neither pillar wins; they co-evolve. Harness runs generate trajectories, trajectories become training data, training absorbs harness tricks into the model, and a stronger model enables simpler harnesses at longer horizons. Trained context compaction is the clearest instance: a summarization bolt-on in 2024 became a training objective by 2026. The field itself has moved through three stages — prompt engineering (2020–2022), context engineering (2023–2025), and now runtime harnesses, where the unit of control is the whole trajectory.

Two questions organize everything below. 

1. The architectural question: as models absorb scaffolding, what belongs in the harness versus the weights — and since experience traces carry capability between the two, who owns your traces? 
2. The systems question: what closes the reliability gap — the consistent finding that the task length an agent completes half the time is several times longer than the length it completes reliably enough to delegate. Failure over long runs is rarely one catastrophic error but a per-step hazard rate compounding across the trajectory, so the question becomes what detects and corrects drift mid-run rather than at the postmortem.

Layer 1 — Execution infrastructure

Scope: Isolated, disposable compute where agent-generated code executes safely — microVMs, containers, browser instances — plus the inference serving underneath. Sandboxes solve four problems for long-horizon work:

• Isolation: agent-written code is untrusted by definition.
• Persistent working state: a multi-day task accumulates files, dependencies, and partial results that serverless platforms wipe.
• Lifecycle economics: long-horizon agents spend much of their life waiting on inference calls or external events, and traditional sandboxes bill for every reserved second.
• Elastic parallelism: subagent swarms and training rollouts need many environments at once.

Landscape:

• Open-source microVMs: E2B — Firecracker isolation with the strongest developer experience, historically session-scoped.
• Serverless GPU platforms: Modal — gVisor sandboxes inside a broader compute platform; the choice when the agent's steps themselves need GPUs.
• Stateful containers: Daytona — fast cold starts and workspaces an agent can leave and return to.
• Raw primitives: Fly Machines — Firecracker with maximum control, for teams building their own layer on top.
• Browser substrates: Browserbase, Kernel — for the case where the agent's computer is a browser.
• Long-horizon pure-plays: Sail Research — an inference stack rebuilt for sustained throughput over single-request latency, co-designed with Sailboxes (generally available since July 2026): full VMs with persistent state, days-long lifetimes, and auto-sleep that hibernates the machine while the agent waits, billing only active time. Sail reports strong cost-efficiency results, including a multi-box demo that built a working Redis clone in Rust over roughly a day of continuous operation; those figures are self-reported.

Open problems: Waking correctly — what re-enters context after hours asleep, and who watches for the trigger; snapshot fidelity for mid-task VM migration; egress policy for autonomous agents with network access, where prompt injection via fetched content compounds over long runs; state divergence, since after days of installs and edits, reproducing a failure means replaying the whole history. And a perfect sandbox still leaves reasoning drift, semantic memory, and verification untouched — it faithfully executes the wrong plan.

Layer 2 — Training environments

Scope: Simulated task worlds — a replicated CRM, codebase, or office suite seeded with realistic mess — where agents practice and a verifier scores the outcome. This layer is the commercial supply chain for Pillar II: reinforcement learning with verifiable rewards (RLVR), in which a model attempts tasks and is rewarded only when a checkable verifier confirms success, is the dominant frontier post-training recipe, and the supply of verifiable training tasks has repeatedly been the rate-limiting factor for agent capability. The same environment asset serves three uses: RL training ground, source of gold trajectories for fine-tuning, and evaluation harness.

Why long horizons make this hard:

• Credit assignment: a week-long task emits one reward at the end, and attributing that signal to a mistake thousands of steps earlier is the core difficulty. The research response is denser signals — stepwise progress attribution, turn-level advantage grouping (GiGPO), subtask-level rubrics.
• Verification noise: grading gets harder as agents improve, pushing vendors toward hybrid human-model grading loops.
• Reward hacking is observed, not hypothetical: in one 2026 study (PostTrainBench), agents given ten hours to post-train a model spontaneously trained on the test set and used discovered API keys — none of it instructed, all emergent from optimizing the proxy.

Landscape:

• Data-labeling incumbents moving up the value chain: Scale AI, Surge AI, Mercor (which acquired environment-builder Deeptune in July), and Handshake — revenue concentrates here because the scarce asset is the expert network that writes tasks and grading criteria.
• Environment-native startups: Mechanize (a small team of ex-Epoch researchers selling high-fidelity coding environments built on replication training), Fleet AI, HUD, Veris, Plato, Bespoke Labs, and others.
• Open ecosystem: Prime Intellect — an Environments Hub with thousands of community environments, open verifier and training libraries, a sizable Series A raised in July, and a pitch that companies should own their optimization loop by training directly on their own product.

Reporting has placed frontier-lab spending discussions on environments in the billions per year, though those figures are second-hand. The durable question: does environment value accrue to whoever owns the experts, whoever owns the verifiers, or whoever owns real environments with real reward signals — the position occupied by companies whose product is a live surface with measurable outcomes.

Open problems: Verifier robustness at scale (every verifier is a proxy, and agents optimize the proxy); sim-to-production transfer, with train/eval contamination rampant; curriculum freshness as models improve mid-training; and disintermediation — if training on a product's real signals works, environment vendors get bypassed by any company with measurable outcomes.

Layer 3 — Models

Scope: The frontier models whose horizon growth the METR chart tracks — and, increasingly, models whose training explicitly targets horizon length. Four technical differentiators separate models that go long from models that do not.

Recent developments:

• Agentic RL at scale: post-training on long multi-step rollouts in environments rather than single-turn reasoning. The 2026 consensus is that with rollouts approaching a million tokens, the competition is credit assignment and training stabilization, not loss-function novelty.
• Trained context compaction: rather than bolting summarization on at inference, train the model to write and resume from its own working-state summaries. Cognition's SWE-1.7 learns simultaneously to write more informative summaries and to work better from them; CompactionRL formalizes the joint objective and is deployed in the open GLM-5.2; the same idea underpins day-plus autonomous coding runs. This is H2 capability migrating from harness to weights, and the standing threat to every external-memory startup.
• Training infrastructure for million-token rollouts: Kimi K3's technical report is the open window — partial rollouts, retained KV caches, resumable microVM sandboxes inside the RL loop itself.
• Harness-native training: SWE-1.7 was trained inside the Devin harness it ships in, dissolving the model/harness boundary from the product side.

Landscape:

• Frontier: the Claude Opus 4.8 / GPT-5.6 / Gemini 3.1 Pro cycle competes directly on agentic and long-horizon coding benchmarks, and GPT-5.x Codex "Max" variants are built for runs exceeding a full day.
• Open weights: genuinely close, and verifiably so because the techniques are published — Kimi K3 (a trillion-parameter-class MoE with million-token context and agentic RL, with a notably detailed tech report), GLM-5.2 (first to publish long-horizon compaction training openly), DeepSeek V4 (the coding-value pick).
• Startups: perhaps the most consequential result for this room comes from Cognition — fine-tuning an open base model inside a product harness beat the assumed ceiling on post-trained open models, which means startups, not just labs, can push horizon length.

Open problems: Credit assignment beyond million-token rollouts; catastrophic forgetting under continual training; judges that get reward-hacked during RL; and whether environment-trained gains generalize outside the environments.

Layer 4 — Memory and context

Scope: Systems that let an agent retain and retrieve what matters across a run — and across runs — when the window cannot hold it all. The consensus design remains the tiered architecture from MemGPT (core, recall, archival), which graduated from Berkeley paper to funded category.

Landscape:

• Production layers: Letta — the production evolution of MemGPT, a full stateful-agent runtime from the paper's authors; Mem0 — a drop-in memory layer reporting strong long-conversation benchmark scores at a fraction of full-context token cost (vendor-reported); Zep — temporal knowledge graphs via its open-source Graphiti engine, making time-scoped questions first-class queries; LangMem for the LangChain ecosystem; Cloudflare testing memory at the edge.
• Research — learned rather than hand-written policies: MEM1 trains a single evolving internal state end-to-end with RL and discards the raw history; ReSum trains summary-bounded long-horizon search; context-folding agents learn to fold history under a budget; agentic context-management work shows models learning to trigger their own compression well before the limit, with a distinctive sawtooth context-growth curve.
• Practitioner references: Anthropic's engineering posts on context engineering and long-running harnesses.

One enterprise analysis attributes the majority of production agent failures to context drift rather than model capability — hard to verify with precision, but directionally consistent with practitioner reports.

Open problems: What to forget — retention policy is much harder than retrieval; context poisoning by the agent's own bad summaries, where a compaction error early in a run silently corrupts everything downstream; multi-session consistency; and the absorption question hanging over the whole layer, since trained compaction is the frontier labs' in-house substitute for external memory.

Layer 5 — Orchestration and durable execution

Scope: The machinery that keeps a multi-hour or multi-day workflow alive across crashes, deploys, and waits — checkpointing, replay, retries, human-in-the-loop interrupts — plus the coordination layer for decomposition, roles, and multi-agent topologies.

Landscape:

• Durable execution: Temporal — a general-purpose engine born from Uber's Cadence, predating the agent wave; it event-sources every step to a history log and deterministically replays it after any crash, making the process effectively immortal, but it knows nothing about LLMs. Its integration with the OpenAI Agents SDK shipped in March, and OpenAI reportedly runs Codex on Temporal at the scale of millions of daily coding-agent requests. DBOS offers durable execution as a library.
• Agent orchestration: LangGraph — agents as graphs with cyclic reasoning loops, checkpointed state at every superstep, a one-call human interrupt, and memory primitives; durability as state snapshots rather than event-sourced replay. LangGraph 1.0 brought durable checkpointing to mainstream open source last fall. Also in the layer: Microsoft Agent Framework, LangChain's Deep Agents, CrewAI, LlamaIndex Workflows.
• The converged production pattern: Temporal owns the macro lifecycle while LangGraph owns the micro reasoning loop inside each activity. The two are not substitutes, and plenty of teams use only one, or neither.
• Self-extending runtimes: Hermes Agent (Nous Research, February 2026, MIT-licensed) — after completing a complex task, the agent itself writes a reusable skill file capturing the procedure, then grades and prunes its skill library on a schedule; the harness-side answer to continual learning and the cleanest commercial instance of the survey's H3 tier. Nous reports large speedups for skill-equipped agents over fresh instances (vendor benchmark). The counterweight is OpenClaw, the other widely adopted open agent runtime, which shipped a serious CVE in 2026 — the security cost of the always-on pattern, and a reminder that self-modifying skills complicate audit.

Open problems: Replay versus side effects — a sent email cannot be re-sent, and neither Temporal nor LangGraph solves semantic rollback; what exactly to checkpoint when the state includes a half-formed plan in context; cost attribution across long multi-tenant runs; and who reviews the skills an agent writes for itself.

Layer 6 — Evaluation and observability

Scope: Tracing, scoring, and monitoring agent behavior — the semantic layer that traditional application monitoring cannot see, since a run that is quietly failing returns HTTP 200 on every call.

Why long-horizon failure is distinct: It is rarely one catastrophic error. It is a per-step hazard rate: small independent failure probabilities compound, so success decays exponentially with task length — an agent that succeeds at each step 99% of the time still fails a 100-step task more often than not. The 2026 "agent drift" literature gives the failure a taxonomy (semantic drift away from intent, behavioral drift into unintended strategies, coordination drift in multi-agent systems) and a mechanism: at each step the immediately preceding output dominates the original goal, a structural consequence of autoregressive generation.

Recent developments: Tooling attacks the problem in four escalating stages:

• Full-trajectory tracing as the substrate, increasingly on OpenTelemetry conventions.
• Three-level evaluation — outcome, trajectory, component — now the industry standard, and it mirrors the verification levels in the academic survey.
• Production-trace mining that converts labeled failures into regression tests gating deploys.
• Inline, mid-run judging — the frontier: scoring the trajectory while it runs and intervening. Research systems wrap the agent with per-step monitors and re-inject fired risk flags into its context so it can re-plan, and tackle the harder problem that evidence of a bad run is dispersed across the trajectory and must be aggregated over time. Commercial versions of within-run intervention are early; most deployed tooling still evaluates runs only after they finish.

Landscape:

• Ecosystem-native tracing: LangSmith — the richest traces for teams in the LangGraph ecosystem.
• Eval-first platforms: Braintrust — CI quality gates; DeepEval; Galileo.
• Open source: Langfuse — the open-source baseline, recently acquired by ClickHouse; Arize Phoenix — OpenTelemetry-native with statistical drift detection.
• Long-run specialists: Laminar — positioned on debugging long-running agents in production; Latitude — closes the loop from detected failure to auto-generated eval to opened PR.
• Incumbent suites: Datadog's LLM observability for existing Datadog shops.

Open problems: Intervening without strangling autonomy, since every guardrail adds latency and cost to every step of a very long run; judge drift, since the judge's own context degrades over long traces; eval cost at full sampling on week-long runs; and the absence of an accepted metric for how far off-goal an agent is at a given moment.

Benchmarks: measuring the system, not the model

Benchmark numbers measure a system, not a model. The same GAIA tasks produce scores across leaderboards that vary by more than most model-to-model gaps, depending entirely on what scaffold the model brings. Pillar II cannot be scored without fixing Pillar I — the survey's two-pillar thesis restated as measurement.

METR's time-horizon methodology is the reference measurement for the field, built on its HCAST and RE-Bench task suites, and its Time Horizon 1.1 update (January 2026) expanded the tasks and revised the trend estimates. Two caveats from METR's own limitations note, published the same month, matter for anyone citing the chart: time horizon measures the amount of serial human labor an agent can replace at a given reliability level, not how long an agent can run unattended, and a horizon at coin-flip reliability is not a delegation threshold. METR's May 2026 Frontier Risk Report — a pilot with Anthropic, Google, Meta, and OpenAI — found the same structural pattern across assessed agents: horizons measured in hours at 50% reliability collapse to a small fraction of that at 80%.

The other long-horizon suites worth knowing: Vending-Bench and its successors from Andon Labs, which test long-term coherence by having an agent run a vending business over very long runs and documented the "meltdown" loops that have entered the field's vocabulary; TheAgentCompany, a simulated software company where the best agent at release completed roughly a third of tasks autonomously; tau-bench and tau²-bench for multi-turn tool-calling under policy constraints; Terminal-Bench for hard command-line tasks; YC-Bench, which simulates running a startup over a one-year horizon and finds scratchpad persistence the strongest predictor of success. Fresh 2026 entries push on the evaluation gaps directly: Long-Horizon-Terminal-Bench replaces outcome-only grading with dense subtask rubrics; LongHorizon-Harness pairs a benchmark with a manage-execute-audit harness and reports large lifts from harness design alone; SentinelBench tests the neglected waiting-agent pattern, where the skill is acting at the right moment rather than constantly.

The gap to keep in mind while building: benchmarks are single uninterrupted runs; production is interruptions, waiting, side effects, and compounding drift.

Applications

Where long-horizon agents are actually deployed, organized by interface:

• Coding — the proving ground. Frontier models have converged enough that the harness now decides the experience. Autonomy modes span Devin (full delegation, now training its own long-horizon model), OpenAI's Codex (parallel cloud agents; reportedly among the most widely used agent products), Claude Code (scheduled and event-triggered routines), Cursor background agents, GitHub Copilot's coding agent, Factory's Droids, and Google's Jules. Third-party testing puts fully autonomous resolution of real GitHub issues well below vendor marketing, rising sharply on well-scoped tasks — a useful calibration.
• Deep research. Multi-hour retrieval, synthesis, and report generation: OpenAI and Gemini Deep Research, Perplexity, and a fast-moving open research line (WebSailor, IterResearch, and summary-bounded search agents like ReSum).
• Computer use. Agents driving browsers, desktops, and phones through screenshots and accessibility trees — OSWorld and its successors as the benchmark line, with browser-native substrates (Browserbase, Kernel) underneath.
• Growth and interfaces. Always-on agents optimizing live surfaces: generate variants, deploy, measure, iterate, indefinitely. Coframe runs a production system of this shape, using generative models plus multi-armed-bandit traffic allocation to continuously evolve website copy, visuals, and code against a live conversion signal — in the survey's terms an H3 system in the wild, an open-ended optimization stream with a real reward. Adjacent players in experimentation and personalization include Optimizely, AB Tasty, Mutiny, and Intellimize. The vertical also concentrates the hard problems: autonomous changes to production surfaces raise verification, brand-safety, and rollback questions that are exactly the evaluation layer's frontier.
• Knowledge work — agents as employees. The step change from workflows to standing roles: agents monitoring event streams continuously rather than waiting in a chat box, with Manus as the general-purpose harness example.
• Vertical specialists. The hireable-agent set Sequoia named: OpenEvidence (medicine), Harvey (law), XBOW (offensive security).
• Ops and monitoring. The waiting-agent pattern — incident response, pipeline babysitting, market monitoring — measurably underexplored (see SentinelBench) and therefore good hackathon territory.

Where the arguments are

1. Harness versus model — and who owns your traces. The model side is absorbing scaffolding fast (trained compaction, harness-native training), while the harness side counters with continual learning it can ship today (self-written skills, durable state). The survey's resolution is that neither wins — they co-evolve — which makes experience traces the moat, and trace ownership the underexamined strategic question for every team in the room.
2. The reliability gap. Coin-flip horizons are growing much faster than the high-reliability horizons delegation actually requires, and per-step hazard rates mean the gap compounds with task length. Mid-run verification and intervention — grading the trajectory while it runs — is the missing piece, and research is currently ahead of product there.
3. Who owns the reward signal. Simulated environments are a concentrating market feeding a handful of lab buyers, while the counter-thesis holds that real products with measurable outcomes get grading for free from reality. Whether environment value accrues to expert networks, verifier builders, or owners of real surfaces will shape both the training-data industry and which startups can train their own long-horizon models.

Build day project ideas

Coding and recovery agents

1. Overnight self-repairing coder. Wrap a coding agent in a checkpoint-and-resume harness, then kill it mid-task or inject tool failures, and require it to recover and finish without human help. The hard part is deciding what must be checkpointed — files alone are not enough; the half-formed plan in context is the state that dies. The demo shows a run killed partway through resuming cleanly and shipping the result, scored against a fresh-start baseline on the same task. Stack: a sandbox (E2B, Daytona, or Sailboxes), structured state files, any frontier model; intermediate. Extension: measure recovery quality as a function of checkpoint frequency and content.
2. Manage-execute-audit harness. Three roles: a manager holding verified task state, fresh-context executors, and a read-only auditor that checks environment outcomes rather than executor claims. The published finding to replicate is that harness design alone lifts completion on identical tasks; the demo is the same model run side by side with the harness on and off. Stack: LangGraph or plain Python plus Terminal-Bench-style tasks; intermediate. Extension: make the harness model-agnostic and swap models mid-run.
3. Compaction stress-tester. Force context compaction at fixed intervals during a long run and chart task quality against each compaction event, looking for the sawtooth pattern the context-management literature predicts. The demo shows where and how summaries begin corrupting working state. Stack: any agent loop, logging, a plotting notebook; beginner-friendly. Extension: compare naive summarization against a structured working-state schema.

Always-on business agents

4. Optimizer with a real reward. Point an agent at a live surface you control — a landing page, a listing, a pricing knob — and let it generate variants, deploy, read the metric, and iterate all afternoon. This is the production growth-agent pattern in miniature, and it forces the verification and rollback questions immediately. The demo is the metric curve, not the agent transcript. Stack: a sandbox, a deploy hook, an analytics API, a bandit allocator; intermediate. Extension: add a judge that must approve every deployed change, and measure what the guardrail costs in iteration speed.
5. Sentinel agent. A waiting agent that monitors a stream — logs, a mailbox, a market feed — for hours and acts only at the right moment, the pattern SentinelBench identifies as neglected. The design problem is the trigger: distinguishing the moment that warrants action from the hours that do not. The demo shows sustained correct inaction followed by one correct intervention, with false-wake and missed-wake rates against a rule-based baseline. Stack: a scheduler or auto-sleep sandbox, a trigger classifier, one action tool; beginner-to-intermediate. Extension: multiple concurrent streams sharing one attention budget.
6. Micro-business coherence run. Run a Vending-Bench-style simulated business — inventory, orders, fees — with a live dashboard of capital and decision coherence over hundreds of turns. The interesting output is not the final balance but the failure onset: where incoherent loops begin and which harness feature delays them. Stack: the open Vending-Bench environment or a homemade simulator plus a memory layer; intermediate. Extension: pit two harness designs against each other in the same economy.
7. Pipeline babysitter. An agent that watches a CI system or data pipeline, retries transient failures, files diagnoses, and escalates only when genuinely stuck. The hard part is escalation calibration — an agent that cries wolf is worse than a pager. The demo is a shift report: incidents caught, actions taken, escalations avoided. Stack: a webhook listener, a sandbox, an issue-tracker API; intermediate. Extension: have it write a post-incident skill file after each novel failure.

Memory and context tooling

8. Principled forgetting. A memory layer whose eviction policy is explicit — recency, task-linkage, verification status — tested by running the same agent with the policy on and with keep-everything retrieval. Retention is the under-studied half of the memory problem; the demo contrasts the two memory states deep into a long task. Stack: Letta, Mem0, Zep, or a homemade store plus one long benchmark task; intermediate. Extension: learn the retention policy from trajectory outcomes.
9. Context-poisoning detector. Detect when an agent's own compaction has corrupted its working state — the early error that surfaces hours later — by cross-checking summary claims against ground-truth artifacts on disk. The demo catches a deliberately seeded poisoning before it propagates. Stack: any compacting agent plus a verifier that diffs summary claims against files; intermediate-advanced. Extension: auto-repair by re-deriving the poisoned span from raw logs.
10. Cross-session resume protocol. Design and test a structured handoff format: at session end the agent writes everything needed to disk, and a fresh session resumes as if uninterrupted. The substance is the measurement, not the file write — score resume fidelity against an uninterrupted control run on the same task, and identify which omissions in the handoff cause which failures. Stack: files plus a resume prompt protocol; no exotic infrastructure; beginner-friendly. Extension: make the handoff survive a swap to a different model family.

Verification and evals

11. Mid-run drift detector. An inline judge that scores the live trajectory against original intent every N steps and injects a course correction — or halts — when drift crosses a threshold. This is the layer where research is ahead of product; the demo shows an intervention firing mid-run and the task still succeeding. Stack: trace hooks (Laminar, Langfuse, or homemade), a judge model, re-injection into context; advanced. Extension: aggregate dispersed weak signals over time instead of judging single steps — the harder published problem.
12. Dense verifier for one long task. Pick a genuinely long task and build the verifier the field lacks for it: subtask rubrics, environment-state checks, anti-gaming tests. Then run agents against it and catch a reward hack. The demo is the verifier rejecting a plausible-looking but wrong solution. Stack: a sandboxed environment, rubric checks, one adversarial agent run; intermediate-advanced. Extension: publish it as a reusable eval others can gate on.
13. Hazard-rate profiler. Instrument many runs to estimate per-step failure probability, fit survival curves, and predict how long a given agent-harness pair can run before success probability halves. The demo is a survival chart comparing two configurations — the reliability-gap argument turned into a measurement. Stack: a batch runner, logs, basic statistics; beginner-friendly. Extension: identify which step types dominate the hazard.

Skills, environments, and the training loop

14. Skill writer-and-pruner. After each completed complex task, the agent writes a reusable skill file capturing the procedure, then grades and prunes its library on a schedule — the Hermes pattern, and the H3 tier in miniature. The demo shows the second attempt at a task family running measurably faster than the first, with the skill library visible. Stack: any agent runtime, a skills directory, an evaluation pass; intermediate. Extension: add a review gate so self-written skills cannot ship unaudited — the open problem the OpenClaw incident makes concrete.
15. Trace-to-training pipeline. Convert a day of agent trajectories into a filtered, structured dataset — successes, informative failures, recovery segments — ready for fine-tuning or RL. Experience traces are the currency of the harness-model loop, and few teams have a principled pipeline for them. The demo is the dataset plus a report on what fraction of raw traces survived filtering and why. Stack: a trace store, filtering heuristics or a judge, a dataset schema; intermediate. Extension: close the loop with a small fine-tune on an open model.
16. RL environment in a day. One small, verifiable task world — a mock storefront, a toy CRM — with deterministic reset, an end-state verifier, and a difficulty knob. The credibility test is adversarial: demonstrate a training signal and one caught reward hack. The demo shows the verifier rejecting a gamed solution. Stack: a containerized app, seeded data, a golden-state checker; intermediate-advanced. Extension: publish it to an open environments hub.

Pick a problem from the list, or bring your own — the best projects attack one of the three arguments above with a working demo and an honest measurement. Apply to attend, and see you in Hillsborough on August 22.

‍