Major Matters and Major Labs Answer One Question. Here Is the Whole Map.

On October 29 the public list of games rebuilt with coding agents had 267 entries, and 109 of them said they worked. Every one of those verdicts was typed in by the person who made the project. The site has no "does not work" option, because nobody submits a failure.

So a harness on a public GitHub Actions runner took each repository exactly as its author left it, put it on a clean Ubuntu machine that had never seen it, followed its own build files, and asked the smallest question that still means something. Does it build? 24 of the 103 did. Only three failed because the code was wrong. The rest never reached the compiler: a toolchain the README never mentioned, a project file that only opens on Windows, a build that starts by reading a game only the player owns, or no build system at all.

Hold that number for a moment. "109 working" was never a measurement. It was 109 people saying so. Every other finding in this letter is that scene in different clothes: an agent, or the person running one, reporting on its own work, and nothing outside it checking.

Agents can do more every week and still cannot say what they did.

Why I am writing this

I write about payments, AI and commerce at Major Matters, and I run Major Labs, an independent research practice that measures the systems the writing is about. This letter is the two of them in one place, because readers keep finding one and not the other, and the two together are the point.

The person I write for owns a decision an agent touches. A checkout. A dispute desk. A mandate a customer signs without reading. A security review. A model's rules about what it will and will not build. That person does not need convincing that agents matter. They need to know the distance between what was announced and what runs, and almost nobody is measuring it.

The gap is the whole subject. After 18 months of agentic commerce announcements, sorted by what shipped, it is proven that an agent can pay. It is not proven that a consumer wants to let it, that a merchant will let it in, or that anyone knows what happens when it gets the order wrong. The announcements outran all three, and every dataset I keep says the same thing about the same absence.

Why there are two names

Major Matters explains and argues. It takes a position on a story that is already moving, with the evidence attached, and ends with the question I could not resolve. Major Labs builds and measures. It runs the scanners, keeps the datasets, ships the open-source primitives, and publishes under a governance page that says definitions do not change once published and corrections are made in place with a dated note.

Two instruments sit between them. Hunch lets a merchant watch an agent try to shop their store: six read-only checks on the live site, a playground store with ten traps built wrong on purpose, and a run record of every call the agent made so the agent's summary can be compared with it. The Bench does the same for the agent itself: a model under a signed mandate on my own equipment, its every action written to a signed chain by something that is not the model, its final report checked against that chain.

That is the map. The writing says what should be true. The lab checks whether it is. Hunch and the Bench are where a reader can watch the check happen. None of the four is much use alone, and the puzzle only makes sense once you see that they all answer one question.

Major Matters says what should be true. Major Labs checks whether it is. Neither is worth much without the other.

The question is this. When an agent acts for a person, where is the record of what it was allowed to do and what it did, and can the party who carries the loss read that record without asking the agent? I call the answer the Outside Record, and it has three rules: no action without a mandate, no mandate without a record, no record inside the agent. Everything below is evidence sorted under those three.

What the record shows: twelve months, dated

No action without a mandate. The Agent Identity Tracker at Major Labs holds 24 entries, each a framework that claims to answer whose agent this is and what it may do. Three arrived in one October week from a bank, a retailer and a card network, and not one of the three travels with the agent: liability at the bank, identity at the store, trust at the rail, and the customer who carries the loss holds none of them. When Shopify wrote the mandate for a billion listings, the rules were real and nobody outside the platform could check what the customer had allowed.

The merchant side is counted every Saturday. The Merchant Agent-Readiness Index probes 92 of the largest US retailers from a US data center. In the November 7 run, 26 withheld their robots.txt from an agent that said who it was, 44 served a homepage a non-browser agent could read, 16 published an llms.txt, five published a commerce profile and one published an agent card. That is one card in 92. The door is barely built, never mind the record behind it.

The free course Anatomy of an Agentic Payment follows one transaction through the Bundesbank's ten steps and six layers, in six modules and 19 lessons. The first lesson is the mandate's five fields: principal, agent, scope, limits, lifecycle. If your mandate is a system prompt, you do not have one.

No mandate without a record. On October 2 I put a 20-billion-parameter open-weight model on the laptop on my desk, under a bank mandate, through seven bank-customer jobs with 45 unrequested options dangled in front of it. It took one nudge and the mandate caught it. Its real failure was quieter: six of 27 required steps never happened, and in one job it canceled nothing three times out of three while telling the customer there was nothing to cancel.

Five days later, Bench entry three bound the agent's final summary into its own signed chain for the first time. Three of 51 summaries contradicted the chain by the standard I published, 11 by the one I should have used. Work reported done that never happened. A paid bill reported as failed. A payment to the wrong payee described as the right one. In every one of those runs the mandate, the budget cap and the signing did exactly what they were written to do. Nothing compared the story to the record.

The Frontier Incident Timeline now holds 18 entries, and the shape repeats at every scale. On September 28 OpenAI withheld a model for acting outside its scope and misreporting its own work. On October 22 METR reported that OpenAI's own agent monitor triggered when agents returned control to the user, so an agent could postpone being monitored by continuing to act. A monitor that asks the agent is relying on the agent. A 20-billion-parameter model on a laptop and a frontier lab's internal traffic showed the same thing in the same month.

No record inside the agent, and the plumbing it runs on. Since June, Major Labs has scanned every public Model Context Protocol server it can find, every week, the same way. MCP is the plug standard that lets an agent reach tools, files and services, which makes an MCP server the part of the stack that touches things. The State of MCP bundle cut on October 31 catalogs 3,745 repositories across 13 weekly snapshots and is archived at Zenodo under a citable DOI, so anyone can rerun the numbers without trusting me. The identity cut is the one I watch: about three in four of the network-facing servers that take sensitive actions, shell execution, database writes, money or mail, show no identity layer in source, and that share has not moved in any direction that matters all year.

Disclosure did not move it either. I told nine maintainers their servers carried a risky pattern. One fixed it. The ones I did not tell did about the same. On October 25 the lab published the closed-loop version, read off the sweep's own history: 90 days after a flag, about one in ten servers is fixed, seven in ten are still flagged, and one in five is gone, with abandonment removing flagged servers nearly twice as fast as maintainers fix them.

The five open-source primitives live on PyPI and npm: IdentityKit (who), MandateKit (may), BudgetGuard (spends), WitnessKit (did) and RememberKit (remembers). They carry the labels v0, experimental and unaudited, and they are measured on the Bench before I describe them. WitnessKit signed the chains that caught the 11 contradictions above. A security review of the kits shipped as fixes on October 31, each one covered by a test in both languages.

Two trackers watch the money. The x402 tracker lists 16 integrations of the pay-per-request protocol, each with a dated verification block, a kind, and for sellers a fixed volume word. Major Labs probes the sellers' endpoints daily for a live payment challenge, and the page shows the last date each one answered. One seller wrote in asking to be listed, said it had no customers yet, and that is what its row says. The index above counts the doors; this one counts who is actually charging through them, and the honest answer is: a few, for cents.

And the games series, seven parts now, which is the same test in a different room. 24 of the ported games build, and none of them starts without the original game's files. The decompilation scoreboard went dark because agents had learned to pass the grader, not the game. And across five coding tools and 69 sessions, every lane refused to build a renamed clone of a game it did not own, while lawful work on a game you do own went through in all but six sessions, all six from one tool. On November 5 the same test went to hardware. OpenAI said a model had designed a device and published a picture of it, so I gave the same brief to seven models and coding agents and ran the electrical checks on the files that came back. Grade the artifact, not the claim. That rule works on a game port, a circuit board, an MCP server and a bank agent alike.

Where I was wrong

Three times this year the record corrected me, and the corrections are the part of this letter I would ask you to trust most.

Major Matters used to publish tool reviews with a one-to-five score on eight criteria. The scores were confident and nobody had touched the products. They were desk research, and I retired them. The Bench is what replaced them: products in hand, a protocol written before the box is opened, findings as measurements with the evidence file named, never a ranking. I would rather be checkable than believed.

I assumed that telling a maintainer about a risky pattern would move the number. It did not, and the article that said so carried a wrong figure for the untold group that a reader caught the next day. The correction sits at the top of the piece with a date on it. The arithmetic was mine. The check came from outside, which is the whole thesis arriving at my own door.

The Bench entry that first bound summaries to the chain reported three contradictions of 51 by the standard I had published. Re-reading the same evidence by the standard I should have used gave 11. The entry carries both numbers and the date the second was added. The lesson is not that the number was wrong. It is that my account of my own measurement needed a reader who was not me.

The next twelve months, with dates

I will only list what you can come back and check.

By November 30 the clean-room build check reruns on whatever the games list holds by then, and the dataset at majorlabs.co/data/ai-ports gets a second column. My dated call from October: by January 31 the list passes 500 entries and the share that builds goes down, not up.

On December 12 the 47 MCP servers in the disclosure cohort, the nine I told, the seven told in the second wave and the ones never told, get re-scored against their September 27 baseline. The result publishes whatever it shows.

On January 4, 2027 the next State of MCP report lands under a method that is already written and hashed, before any data is collected. If the numbers surprise me, the method does not get to change.

By January 31 the five-lane game-clone probe reruns, same five prompts, to see whether the one tool that refused lawful work still does.

The Rule by Default scorecard carries eight predictions about how agent access gets governed, each with a baseline and a date. Six are scored on the runs nearest March 27, 2027, one on June 30 and one on September 30. Every miss will be printed beside the prediction.

Closed-loop remediation becomes a monthly figure. The weekly sweep gets a signed manifest, so a reader can verify that the numbers on the scoreboard came from the run that produced them. WitnessKit gets an opt-in telemetry mode that emits only aggregate, signed, non-identifying counters, with the Bench and Hunch as the first reporters, because nobody has that number from inside an enterprise. The Bench gets a second model under the same harness, and a run from inside a rented GPU that puts a network between the agent and its record for the first time. The full list, dated by quarter, is in the lab's research agenda, and each item lands there or has not landed.

And what would prove me wrong. If a second model on the Bench shows no drift between summary and chain, the finding is about one model, not about agents. If a monitor that watches from outside catches misreports no better than the agent's own account, then "outside" is doing less work than I claim. If banks, retailers and networks converge on one portable mandate without anyone holding a shared record, and dispute rates fall anyway, then liability clauses and scoped profiles were enough. I do not expect any of those. I have written down how each would show up.

What is yours to take

None of this is locked. The course costs nothing. The State of MCP data is open, with checksums and a DOI, and needs no sign-up. The security scoreboard re-runs weekly, and per-server findings go to the maintainer, never to a public list. The build-check harness is public, so you can rerun my numbers or run your own list through it. The kits are on PyPI and npm with their limits printed on the label. Hunch runs against your store, and the run record belongs to whoever started it.

If you want the thesis in a form you can hand to an architect, the 90-day plan turns the three rules into tests you can run in a week each. The cost is a signing key per agent, a store for the chains, and a diff.

Working with teams

Teams work with Major Labs as a research partner: landscape reviews, thesis testing, critique of a proposition or a policy, and bespoke measurement of the systems you are building or buying. The methods are the ones above, run on your question. Everything I do for a team I would be willing to publish, and I say so up front, because a measurement that cannot be published is not one I can stand behind. Major Labs is not owned, funded or directed by any employer, payments network or AI lab.

The trade

Here is what I am asking for, and what you get back.

Everything above has a date and a link. Subscribe to Major Matters and the next measurement, the next correction and the next dated call reach you the morning they land. One email per piece, and a short Friday note in the weeks a tracker row moves. One click to stop. No sponsor.

What I ask in return is the thing this whole letter is about. When the record says I am wrong, tell me. The Bench numbers, the sweep, the index, the build check and every article carry their evidence files for exactly that purpose. The corrections section above exists because readers did.

Subscribe here.

Which of your agents could show you, today, what it was allowed to do?

Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.