In July 2026, twelve repositories in the Knowledge Context Protocol ecosystem took 1,012 commits and shipped 88 releases. The specification went from v0.22 to v0.30.3 — sixteen releases in a single month.
That is either a lot of noise or a lot of signal, and the only honest way to tell you which is to show you the whole thing.
This is the complete map. If you have never heard of KCP, start at the top and it will make sense. If you have been following since February, skip to July in focus — that is where everything new is.
Anthropic published a long, careful writeup of how they built self-service data analytics
on Claude internally — the system that lets anyone at the company ask a business question
in plain English and get back a governed, provenance-tracked answer. 95% of their
analytics queries are now automated this way, at roughly 95% aggregate accuracy.
We read it the way we read anything that touches how agents know things: looking for
where we were wrong.
We found something else instead. Strip away the domain — theirs is a data warehouse,
ours is a codebase and a governance practice — and the architecture underneath is close
enough to feel less like inspiration and more like recognition. Two teams, no contact,
building the same shape from opposite doors.
In 2023, if you wanted an AI to help you cut a release, you typed a small prayer into a
chat window and pasted the answer into your terminal.
This morning, an agent in my toolchain was offered a release skill by a deterministic
planner, which noted — in writing, in a receipt — that the skill was relevant to the task
but not eligible to run, because no human had granted it enactment rights. The skill
itself declared, in a signed manifest, exactly which tools it may invoke and which files
it may touch. A linter had checked that declaration. A different program stood ready to
block any tool call that reached outside it.
Same workflow. Same twenty lines of playbook. Completely different kind of object.
The distance between those two moments is about three and a half years, and almost nobody
noticed the transitions while they happened — each one looked like a small quality-of-life
improvement at the time. Told end to end, they form one story: the agentic skill slowly
acquiring the properties of a charter — a scoped, reviewable, revocable grant of
authority. This post walks that history with one deliberately boring running example,
because boring examples keep us honest: how does the AI help you cut a release?
Here is a confession. Our AI development rig — the one we call ExoCortex — has 644 skills: little packets of procedural memory that tell it how we deploy, how we review, how a specific client's CI is wired, how to publish to this very blog. And until this week, the way it found the right one, out of 644, was grep.
Keyword match against a flat index. No ranking. No freshness. When a query touched a common word, it got back a pile of candidates and had to read through them to guess. We only really noticed the cost the day we discovered that one of the skills it leans on daily had sat three weeks stale — describing a system four pull-requests out of date — and nothing, anywhere, had flagged it.
An agent that can't tell which of its own memories is rotting is not, in any deep sense, remembering. It's hoarding.
A reveal — the defendable agent: a new kind of AI agent that keeps a receipt for everything it does. Not a log written afterward — a written, checkable verdict produced at the moment it reads a document, runs a playbook, reaches a conclusion, takes an action, or spends a dollar. Built, open-source, and running. Here it is.
Overnight, with no human watching, an AI agent read a stack of customer records, downgraded an account, and paid a data broker $50 for a report. On Thursday, your compliance officer walks over: What did it read? Why those documents? How sure was it? Who approved the downgrade? And what, exactly, did it spend our money on?
A new kind of agent — the defendable agent — is roughly 85–90% built. Here's the complete picture, one organ at a time.
On Tuesday, an AI agent called Nora followed the risk-assessment playbook, drafted an assessment for a customer account, and downgraded their status. On Wednesday the customer complained. On Thursday your compliance officer walks over: What did Nora read? Why those documents and not the newer policy from March? What playbook did she follow — the current one? How sure was she? Which human signed off, under which policy?
There are now eight open-source tools in the KCP ecosystem. They were built incrementally over 140 days, each solving one specific problem. If you're arriving for the first time, the map is not obvious.
Everyone is building firewalls for what agents do. Sandboxes, budget caps, tool permissions, egress filters — the action side of agent governance is getting crowded, and that is good news. But almost nobody is building firewalls for what agents know. Your agent's context window is an unauthenticated ingestion pipeline: whatever text lands in it becomes, functionally, trusted input. If someone edits a policy document, swaps a mirror, or serves your agent a stale copy of the rules, no sandbox in the world will catch it — because nothing wrong ever executed. The agent just knew the wrong thing.
This post is the hands-on companion to Two Halves of the Governance Problem. That one argued the thesis; this one is a tutorial. In about ten minutes, we take two markdown files and give them a declared, signed, tamper-evident boundary that an agent verifies before loading a single byte. Every command output below is pasted from a real run.
The first version of the Knowledge Context Protocol shipped on February 25, 2026. This is a record of what it was, what it became, and why the decisions made in the first week turned out to still be the right ones 140 days later.
