Agent products are becoming operational systems, but their evidence remains thin

OneDev places an agent inside the existing software trail: the issue holds requirements, an isolated workspace contains execution, and the linked pull request records review and CI results. This design makes agent work inspectable and lets failed builds trigger revisions. It has no measured evaluation.

Fast code generation also increases the human review burden. A three-month first-person account reports prototypes completed in hours, alongside sustained architecture decisions, mental fatigue, and difficulty reconstructing why generated code took a particular form. Together, these reports make review capacity and decision pacing practical constraints on coding-agent throughput.

Model choice is becoming a workload-specific operating decision. Dam Secure tested ten models on ten synthetic pull requests with planted access-control flaws, repeating each model five times. GPT-5.6 Sol reported 100% recall, 0.91 F1, and $0.70 per pull request. Grok 4.5 reached 0.77 F1 at $0.20, while Gemini 3.1 Flash Lite reached 0.75 F1 at about $0.04. The small, private corpus limits broader conclusions, especially for full-code scans.

Avriz addresses the same cost problem during live coding-agent use. Its contextual bandit selects among five model tiers using 11 content-free features and billing-derived rewards. Learned routing remains in shadow mode until coverage gates pass, then reaches only a capped traffic share under a model-tier ceiling. The report gives implementation detail, though it does not report aggregate savings or quality gains.

Persistent context is being treated as data with explicit ownership rules. Mango proposes local execution, plain-text memory, replaceable models, and deterministic client-side permissions for actions across logged-in services. xysq targets teams with isolated vaults that collect context from Slack, Drive, Notion, and other tools; access is consent-gated, encrypted, exportable, and deletable.

These designs specify where memory lives and who can authorize its use. Their evidence is architectural and promotional. Mango has no controlled security audit, and xysq provides no deployment metrics, retrieval evaluation, or independent verification of its privacy claims.