I watched the silence break the noise of 2021. Not on a trading floor this time — in a GitHub Discussion thread numbered #741.
Somewhere between the comments, an engineer named Carles Arnal wrote a sentence that stopped me cold: at least five mutually incompatible registry implementations were shipping, each with an incompatible API, and nobody had produced a specification.
No green candles. No liquidation cascade. Just the quiet arithmetic of fragmentation.
I've spent twelve years reading markets, and I've learned that the loudest events are rarely the most important. The LUNA collapse taught me that in a cabin in Coorg, three weeks of exhaustion, staring at a chart that had already printed its verdict. The real failure was never in the code. It was in the story people told themselves about the code. What I'm watching now in the agent infrastructure stack is the same story wearing a different shirt.
The Layer Nobody Is Watching
For two years, the conversation about AI agents has been about models. Bigger context windows. Better reasoning. Faster inference.
That was the wrong floor of the building.
The actual contest — the one that decides who captures value — is happening one level down, in the protocol and interface layer. Not the model. The plumbing between models.
Three specifications were supposed to arrive this cycle. All three are late. The PAP draft, backed by Sierra and Meta, promised delivery in "late October" and produced a verbal commitment instead — a work-in-progress with thirty-five design partners and five construction modules, still not shipped. Google's Gemini agent entered private preview, with general availability described only as "coming soon." The A2A Registry converged on an architecture in GitHub Discussion #741 and produced no approved specification at all.
Meanwhile, the implementation layer didn't wait. It never does.
MCP — Model Context Protocol — is already published, already deployed, and already carrying the advantage of being first. It also carries the disadvantage of being first: ClawSecure has disclosed serious vulnerabilities in the protocol itself, and federated MCP servers are being deployed without any security framework at all. Docker's agent work reuses OCI registries — a clever move that borrows the entire maturity of the cloud-native stack, and quietly surrenders differentiation to it.
State management is worse. Fourteen vendors. Zero standards. Fourteen separate answers to a question that only has room for one.
This is what "implementation before specification" looks like in practice. It is not chaos. It is a strategy, and somebody chose it.
The Mechanism Behind the Mess
Here's how standards actually form. They don't get written and then adopted. They get written to describe what the biggest players already shipped.
I watched this happen in the ETF era of 2024. A small team and I tracked 200 institutional accounts and found the language shifting — the narrative shifted from "store of value" to "institutional yield play" months before price confirmed it. The vocabulary moved first. The definition of what Bitcoin "was" got rewritten by whoever had the most capital to enforce the new definition. The ETF didn't create the narrative. It ratified one that was already forming underneath it.
Agent infrastructure is running the same play, faster, and with more players.
Look at the control plane. MongoDB Atlas Agent Engine, Palo Alto Networks, and New Relic each describe themselves as the "system of record" for agent activity. Three companies. One title. No winner. New Relic sells the concept under the label "agent debt" — a neat piece of packaging that converts a customer's technical liability into a recurring subscription. Who holds the behavioral logs holds the renewal. That's the real prize, and everyone in the room knows it.
Then there's the commerce layer, where the numbers get uncomfortable.
In September 2026, PYMNTS published data showing that 93% of merchants want the provider to absorb the loss when an agent makes an error. Only 28% are willing to expose their full product catalog to agents at all.
Sit with that gap. Thirty-five percentage points of pure hesitation.
The bottleneck in agent commerce is not capability. It is liability. Merchants aren't refusing to sell to agents because the technology is immature. They're refusing because nobody has told them who pays when the agent buys the wrong thing, at the wrong price, from the wrong warehouse. The identity and signal layer is being standardized before the settlement layer — not because it's more exciting, but because you cannot settle a transaction between two parties who don't trust each other's identity.
The economics follow the governance. Not the other way around.
And the security picture is not theoretical. Progress DataDirect ARCGenAI Agents carries a command injection vulnerability rated 9.6 out of 10. The attack surface has moved. It used to live in the model. Now it lives in the tool call, the federation, and the registry distribution — three layers stacked on each other, each one a new door. Supply chain risk sits at the top of the list, because a registry is now an agent's supply chain, and federated deployments are shipping without the frameworks to govern them. Liability and compliance rank just as high, because no legal template exists to distribute responsibility across platform, provider, and merchant. Data leakage sits in the middle. Jailbreaks and hallucination-driven purchases sit just below — and in a commerce context, a hallucinated purchase is not an amusing error. It is a disputed invoice.
I spent six months in 2025 interviewing developers and policymakers about verifiable AI origins. Twelve conversations. The pattern I found then is the pattern I see now: the people building the identity layer understand the stakes, and the people shipping the registry layer are moving too fast to care. "Federated MCP servers deployed without a security framework" is not a bug report. It is a business decision, made by someone, on a deadline, with a launch date attached.
The Consensus Is Wrong
The consensus reading is that agent infrastructure is in a healthy, competitive, pre-standardization phase — messy but productive, the way the early internet was messy.
I don't buy it. And here's the uncomfortable part.
The fragmentation isn't a failure of coordination. It's the objective. When five registries ship with incompatible APIs, the company that gets its implementation adopted as the de facto standard wins the entire next decade of agent traffic. So the rational move for any well-capitalized player is to ship first, fragment the field, and let the specification be written to fit what's already in production. Apicurio's warning that "the interoperability window is closing" is not a lament. It's a countdown clock that somebody set on purpose.
This is where the smile curve returns. Application layers are absorbing infrastructure layers — Oracle's Fusion Claw is the clearest example — while independent middleware gets squeezed from both ends. Distribution and packaging consolidate. Connectivity fragments. Value pools at the extremes and drains from the middle. The five-registry problem and the fourteen-vendor problem are the same problem seen from two angles.
And the deepest blind spot: everyone is treating the missing specification as a technical problem. It is a governance problem. Google, Meta, Sierra, Cloudflare, MongoDB — five parties, no forced coordinator, no authority with the power to compel convergence. History doesn't repeat the technical debates. It repeats the coordination failures. Eight AAIF working groups and 3,500 attendees at AGNTCon is mobilization, not resolution. Scale is not the same as agreement, and a conference is not a specification.
There is one more layer of irony. The security debt that worries me most is also the most monetizable. "Agent debt" is simultaneously a risk and a product. ClawSecure's disclosure creates demand for the very compliance services that will later be sold back to the same teams. The same problem is the wound and the bandage. I have watched this pattern before, and it never resolves cleanly — it resolves expensively.
What to Watch Instead
Don't watch the model benchmarks. Watch the registry count.
When five incompatible implementations become three, then two, the standard war is resolving — and the resolution will tell you who owns the next layer of the stack before any press release does. Watch the liability templates, not the capability demos. The first legally binding contract that defines who eats an agent's mistake is worth more than any launch announcement this quarter.
And watch the security debt quietly compounding in federated deployments that shipped without a framework, because that debt will be repriced eventually, and the repricing will be sudden.
The narrative shifted from "can agents do it" to "who is responsible when they do it wrong." That shift is the real event. Everything else is noise.
The question worth sitting with: when the specification finally arrives, will it describe the best architecture — or just the most deployed one? I think we already know the answer. We just haven't admitted it yet.
