The Orchestrator

The toolkit survey covers products; this section is about formats, meaning the files and schemas the industry is beginning to share. Use them, and do not mistake any of them for the finished governance layer.

Three formats show up over and over in orchestration work. MCP, the Model Context Protocol from the table above, is the connectivity layer, and it has moved quickly from an experimental integration format toward shared agent infrastructure.¹⁴ It does not decide the agent’s goal, decompose the work, manage a fleet, provide durable memory, or enforce the organization’s complete policy by itself. Agent Skills (SKILL.md with YAML frontmatter and a Markdown body) is an open standard for procedural memory: a small, versionable description of how to do one thing, loaded only when needed. AGENTS.md is a freeform convention — a Markdown file in a repository that tells an agent how to work in that repo. An orchestrated system uses all three at once.

5.6.1 Skills: SKILL.md and friends

The open Agent Skills specification is the closest thing we have to a portable runbook for agents. AGENTS.md now sits under the Linux Foundation’s Agentic AI Foundation alongside MCP and Goose.¹⁵¹⁶

A short warning for readers. Skills are still an emerging standard. There is very little standardization in how skills are interpreted by agents and tools from different vendors. A lot of these new primitives are released by one model provider and then catch on quickly: for a while skills were called “Claude skills” because they were first made popular by Anthropic’s Claude, and the term has only recently broadened. The descriptions in this chapter are accurate to the best of my knowledge at the time of writing; treat them as a snapshot, not a stable taxonomy.

What they get right is procedure you can version, a home for “how we do this kind of work” that is not trapped inside one person’s chat history, and progressive disclosure: at startup the agent sees only each skill’s name and description, and the full instructions and auxiliary files load only when they are needed. The agent never carries instructions it is not using, which keeps context small and behavior focused. What they are not is a permission envelope. An allowed-tools hint in frontmatter is an experimental pre-approval signal whose enforcement depends on the runtime, and nothing in the skill format records who authorized widening the agent’s tool set, or links a skill revision back to the outcomes that justified it.

Chapter 3’s distinction between deterministic and nondeterministic parts matters when you build with these tools. A skill and a tool are not the same kind of thing. Tools are what an agent uses to impact the outside world: read a file, call an API, run a query, post a message. A skill is a natural-language description of a procedure, interpreted by an agent when the procedure is needed. The interesting thing is what happens to a skill over time. Run the same skill over and over, and the orchestrator will often convert it into a tool — a Python script, or a function in another language — that reduces interpretation variance and can be tested. Skills are a good starting point because they are cheap to write and easy to revise. Tools are what you graduate to when reliability matters more than flexibility.

5.6.2 Memory: Markdown files and Memory Blocks

Hermes and OpenClaw treat memory as files: USER.md, MEMORY.md, dated notes, sometimes a dreaming or consolidation step. Letta, from the MemGPT line, treats memory as structured blocks with labels, size limits, and read-only flags that can be shared across agents.¹⁷

What they get right is persistence a human can open in a text editor or an API, and a clean separation between the facts we keep and the procedures we run. What they are not is a portable standard. Moving memory from OpenClaw’s layout into Letta blocks is a migration project rather than a checkbox, and none of these formats enforce what may be written or who may write it. These memory systems are at the stage the web was when a browser first offered to remember your password. Memory is what lets an agent get better at your particular work over time, yet there is no common, mature standard for auditing it: what was written, when, by which part of the system, whether it is still true, and what the system believed at the moment it made a decision. For anything touching eligibility, identity, or medical and financial context, memory you cannot inspect or correct is a liability.

Memory is also beginning to separate from the agent itself. Mem0, LangGraph’s long-term stores, and Amazon’s AgentCore Memory treat it as shared infrastructure rather than a private feature of one agent instance.¹⁸ Vector databases became a distinct infrastructure category when retrieval stopped being an application detail and became a shared service, and agent memory may follow the same path, toward a database category with its own schemas, retention rules, permissions, and lifecycle. Memory as an independent infrastructure layer is still emerging, and none of these systems has reached the maturity or scale of an established database category. But the direction is visible.

Dreaming, or memory consolidation. A memory file that just accumulates every event the agent ever saw is not useful — it is a firehose. Many systems now run a periodic step that reviews the memory, summarizes what is still relevant, and lets older entries fall off. Some call this step dreaming, after the way human sleep consolidates and reorganizes memories overnight.¹⁹ Hermes, Nanobot, and Letta all ship some version of it; Letta calls its variant sleep-time compute.²⁰ In practice the dreaming step is where you decide what an agent is allowed to remember, for how long, and under whose authority. The same governance questions you have about a decision record apply here: who scheduled the dreaming run, what was rewritten, what was discarded, and how would you reconstruct the agent’s state at a given moment in time.

The context window is finite. Memory also runs against the context window of the model the agent is talking to: the maximum amount of text in a single interaction. Anything that does not fit in the window, the agent simply cannot see. The job of memory management, then, is curating what is preserved and what is discarded when the window is full. As systems run longer and accumulate more memory, that curation becomes the difference between an agent that remembers what matters and one that drowns in its own history, which is one reason dreaming is becoming standard practice.

5.6.3 Evals: datasets and Inspect tasks

LangSmith-style datasets, OpenAI’s agent-eval surfaces, and Inspect AI from the UK AI Security Institute all give you reproducible ways to ask whether an agent still behaves on the cases you care about.²¹

What they get right is treating regression as engineering, with versioned datasets, scorers that can fail a build, and repeated runs that record how much a stochastic model’s results vary. What they are not is an operating record for what actually happened to the people the system touched. Passing an offline suite does not establish that last Tuesday’s run was carried out inside policy; it only shows the model still knows how to handle the cases in the suite.

5.6.4 Audit and traces: OTel GenAI, OpenInference, Temporal history

OpenTelemetry’s generative-AI semantic conventions and Arize’s OpenInference conventions define a vendor-neutral shape for trace data, and Temporal’s workflow event history lets workflow logic be replayed from recorded events.²²

What they get right is that you can stop inventing a private log format per framework, and you can finally see tool calls and handoffs. What they are not is a complete audit standard for what the agent decided and why, and the GenAI conventions are still in development status. A trace can show every step the system took. It does not record which policy verdict allowed the step, which human owned the decision, or whether the action actually had the result it intended. That is the difference between debugging and governance. Chapter 8 returns to that gap and Chapter 10 turns it into meeting evidence.

5.6.5 Permission: MCP and ACS

The Model Context Protocol specification is explicit that MCP is connectivity, not enforcement: it standardizes how tools connect, not what they are allowed to do. Its HTTP authorization profile is real OAuth work, but the spec cannot enforce security principles at the protocol level, and a good many implementors will not.

ACS is the Agent Control Specification, a Microsoft-led specification for portable permission envelopes around agents, still in public preview. Where MCP says “here is how to call a tool,” ACS says “here is how to decide whether this agent is allowed to call this tool, in this situation, under this policy, with this verdict.” An ACS manifest describes an agent’s allowed scope, and policies written in Rego or Cedar return a verdict such as allow, deny, warn, escalate, or transform. The verdict matters only when the host or runtime invokes it and enforces the result; the specification itself does not reach into your deployment.²³

What these standards get right is that tools become typed edges and policy can live outside the model. What they are not is the full loop this book keeps naming: ownership, delegation lifecycle, learning policy, fleet-wide envelopes, outcome linkage.

5.6.6 Topology: A2A Agent Cards

A2A, originally from Google and now open, defines Agent Cards and a task/message/artifact exchange so that agents can discover one another and collaborate across servers.²⁴

What it gets right is the horizontal edge: who else exists, what skills they advertise, and how to hand work across frameworks. What it is not is authority. An Agent Card advertises claimed capabilities and security requirements; discovery alone does not verify them. Discovering that a downstream action agent exists tells you nothing about whether your intake agent may invoke it, under whose budget, or with which escalation when something goes wrong downstream.

5.6.7 The long-term bar

This book is aimed at systems that operate under human authority for years. For that, interoperability is not enough. You need an inspectable chain:

owner → permission envelope → escalation contract
      → learning policy (what may self-edit)
      → audit record (proposal → verdict → actor)
      → outcome (what happened to the customer or system)

Today’s standards cover the middle of that chain — tools, skills, spans, emerging policy manifests — but do not yet form one integrated orchestration standard, and the two ends, where ownership registries, learning policies, and outcome records belong, are the thinnest. So use the available pieces now, prefer the open ones you can inspect and swap, and write contracts yourself to cover the gaps. Choosing open-weight models, open harnesses, and open audit formats where they fit the job keeps an exit ramp open, and Chapter 5 returns to that preference under the name O’Reilly gave it: the architecture of participation.

---

14. Model Context Protocol specification, 2026-07-28, https://modelcontextprotocol.io/specification/2026-07-28 (stateless core, multi-round-trip requests, header-based routing, cacheable list results, authorization hardening, extension framework); release notes, “The 2026-07-28 Specification,” https://blog.modelcontextprotocol.io/posts/2026-07-28/; authorization profile, https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization. Cited for tool/resource connectivity and OAuth patterns; the specification’s own security posture is that MCP cannot enforce implementor security principles at the protocol level.↩︎

15. AGENTS.md, https://agents.md/. Convention for repository-level agent instructions; freeform Markdown without a required schema. Stewardship associated with the Linux Foundation Agentic AI Foundation (AAIF) founding projects.↩︎

16. Linux Foundation, “Linux Foundation Announces the Formation of the Agentic AI Foundation,” https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation; OpenAI, “Agentic AI Foundation,” https://openai.com/index/agentic-ai-foundation/. Cited for stewardship of MCP, goose, and AGENTS.md — not as a claim that AAIF defines authority, memory portability, or audit of decisions.↩︎

17. OpenClaw, “Memory,” https://docs.openclaw.ai/concepts/memory (workspace Markdown: USER.md, MEMORY.md, dated notes; docs note memory does not enforce policy); Hermes Agent memory/skills documentation under https://hermes-agent.nousresearch.com/docs/; Letta, “Memory Blocks,” https://docs.letta.com/guides/core-concepts/memory/memory-blocks/. Cited for concrete persistence layouts and their governance limits.↩︎

18. Mem0, “Introduction,” https://docs.mem0.ai/introduction, and “How It Works,” https://docs.mem0.ai/core-concepts/how-it-works (memory layer between application and model, persisting across sessions, tools, runs, and multiple agents; managed and self-hosted deployments, https://docs.mem0.ai/platform/platform-vs-oss); LangGraph memory overview, https://docs.langchain.com/oss/python/concepts/memory (thread-scoped checkpoints versus long-term stores read across threads); AWS, Amazon Bedrock AgentCore prescriptive guidance, https://docs.aws.amazon.com/prescriptive-guidance/latest/agentic-ai-frameworks/amazon-bedrock-agent-core.html (AgentCore Memory as a managed service usable independently of a particular model or agent framework). Cited as evidence that memory is separating from individual agent runtimes — not as a claim that any has reached the maturity of an established database category.↩︎

19. UC Irvine News, “Dreaming is linked to improved memory consolidation and emotion regulation,” https://news.uci.edu/2024/05/13/dreaming-is-linked-to-improved-memory-consolidation-and-emotion-regulation; Nature Scientific Reports, “Evidence of an active role of dreaming in emotional memory processing,” https://www.nature.com/articles/s41598-024-58170-z. Cited for the metaphor that motivates agent “dreaming” steps — human dreaming appears to consolidate and reorganize memories during sleep.↩︎

20. Letta, “Sleep-Time Compute,” https://www.letta.com/blog/sleep-time-compute (research paper and Letta 0.7.0 release shipping sleep-time agents); Fast Company, “Why sleep-time compute is the next big leap in AI,” https://www.fastcompany.com/91368307/why-sleep-time-compute-is-the-next-big-leap-in-ai. Cited as one of the names for periodic memory consolidation in modern agent runtimes.↩︎

21. LangSmith dataset JSON types and evaluate APIs, https://docs.langchain.com/langsmith/; Inspect AI, UK AI Security Institute, https://inspect.aisi.org.uk/; OpenAI, agent evals / trace grading guides under https://developers.openai.com/. Cited for regression and capability evaluation — not as complete production decision audit.↩︎

22. OpenTelemetry generative AI semantic conventions, https://github.com/open-telemetry/semantic-conventions-genai (Development status; opt-in stability flags apply); OpenInference semantic conventions, https://arize-ai.github.io/openinference/spec/semantic_conventions.html; Temporal on AI / durable agents, https://temporal.io/solutions/ai. Cited for trace and durable-execution substrates — not as a finished audit standard.↩︎

23. Microsoft Agent Governance Toolkit — Agent Control Specification, https://github.com/microsoft/agent-governance-toolkit/blob/main/policy-engine/spec/SPECIFICATION.md (versioned manifests, intervention points, allow/deny/warn/escalate/transform). Cited as the closest open portable policy-envelope artifact at time of writing; still early/beta relative to long-term fleet governance needs.↩︎

24. Agent2Agent (A2A) Protocol specification, https://a2a-protocol.org/v1.0.0/specification/ (Agent Cards, Task/Message/Artifact). Cited for discovery and agent-to-agent task exchange — not for authority ownership after handoff.↩︎