The map

Set the tone before the content. This series is a forum: the audience is technically curious business people who are not AI experts, and the most useful thing they can do is interrupt. The questions that feel slightly rude, “why would anyone pay for that”, “is this just a chatbot with a hat on”, are usually the ones the room actually came with. Second, we can skip. Seven topics in ninety minutes will not finish cleanly, so the running order is a suggestion and the presenter should follow the room. Third, facts expire. Everything in this field moves weekly; several numbers in the first version of this deck, delivered in August 2026, were superseded within three months and have been replaced here. Where a slide carries a product name or a price it also carries the date it was checked, and that date is part of the fact. Fourth, no homework. The goal is a sharper mental model, not a reading list. The one piece of navigation worth saying out loud: two sessions in this series do not appear as topics here, because they are foundations rather than rabbit holes. Part IV explains what a language model actually is, in plain words. Part V is about using AI in ordinary work. Everything in this deck assumes those two, and each of the seven topics here has its own full session later in the series, named on each divider.

Seven topics, eighty-six minutes on paper, and the honest expectation that we will not finish them cleanly. The order is deliberate even if the room reorders it. We start with harnesses, the software body around a model, because most people here have used a coding agent and the vocabulary is immediately useful. Local models come second because “should we run our own” is the question most organisations ask first and answer worst. Adaptation, the RAG and fine-tuning topic, is third because it is the thing most teams are about to spend money on unnecessarily. Open weights and the China question are a pair; the first is the technical fact and the second is the industrial consequence, and they bleed into each other on purpose. Skynet gets ten minutes because the room will ask, and because the useful answer is short. Physical AI closes because it is the most fun and the least urgent. The right-hand column is new in this refresh: every topic now has a full session in the series, and the notes on each divider say which one. The line under the table matters for a new reader. Part IV, what a model is, and Part V, using AI day to day, are foundations rather than topics, and Part III on agents sits between harnesses and robots in the same way an agent sits between a chat box and a body. Ask for a show of hands on which two topics people most want, and reorder live if needed. Times are a suggestion, not a contract.

Start with the word, because it is now in vendor documentation and it is doing real work. A harness is everything in the system that is not the model: the code, configuration and policy that turn a next-token predictor into something that does a job. Addy Osmani’s April 2026 essay defines it as every piece of code, configuration and execution logic that is not the model itself, and Microsoft now uses the word for the engines inside Copilot Studio. Four things live in it. Tools and files: the shell, the browser, the calendar, the repository, the inbox, and the permission to actually touch them; the model writes a request and code runs it. Memory and loops: what survives until tomorrow, whether it can run overnight, whether it can spawn helpers; the loop is run by the harness, and the model fills in one step of it. Taste and guardrails: the product opinions about how it asks, when it stops and what it may break, which is where the leash lives. And the turf war. Frontier models are close enough to each other that the wrapper often decides who wins the job. The cleanest evidence is Anthropic’s own engineering write-up from March 2026: the same model, asked to build a web application, produced a broken app in twenty minutes for about nine dollars when run bare, and a working, far more complete one in six hours for about two hundred dollars when run inside a three-role harness. When a newer model arrived, part of the harness was removed. Every component in a harness encodes an assumption about what the model cannot yet do. If someone says “isn’t that just an agent?”, the answer is yes; harness is the engineering word for the scaffolding around the agent. Part III covers the agent; Part VI covers the body.

The first species is the one most of the room has used. A coding harness is a model-native product with opinions: you sit down, you get work, and you do not design a company first. The vendor picks the model, the user experience and the defaults, and the job to be done is to ship software. Its habitat is a repository, a terminal or an editor, a browser and a test suite, and its defining property is that the session ends. At that loop these are best in class, and the policy layer is the most mature in the industry: permission prompts before anything changes the world, read-only and plan modes, operating-system sandboxes, rules files a team can share. That is the contract. You trade control for a thing that works this afternoon. The thing you do not get is a chief of staff. When the tab closes, most of the “person” goes with it: the repository, a rules file and some automatic notes survive, and the rest does not. That is a feature until it is not. The roster on the slide is Part VI’s reconciled list as of October 2026: Claude Code, Codex, Gemini CLI, OpenCode, oh-my-pi and Cursor. OpenCode and oh-my-pi matter because they are model-agnostic and will point at a local endpoint, which connects this section to the next one. Grok Build, which the August version of this deck listed, is omitted because Part VI could not verify its current state from a primary source; better a gap than a guess. Be fair to all of these. A great deal of the complexity in the operator species on the next slide exists to solve problems that coding harnesses deliberately refuse to take on.

The second species does not end when the tab closes. It lives with you. OpenClaw is a self-hosted operator: one gateway that answers on Slack, Telegram, WhatsApp, Signal or email, runs scheduled jobs overnight, and coordinates teams of agents with a marketplace of installable skills. It is an org chart for agents, and it is best when the problem is coordination across many surfaces. It is also heavier, with more moving parts, and it has had a rough year for security: two high-severity vulnerabilities in 2026 that we know of, one a one-click takeover of the gateway through a crafted link, one an auto-loaded workspace plugin that executed code until version 2026.3.12, catalogued as CVE-2026-32920. Both are fixed, the project is now stewarded by an independent foundation under an MIT licence, and its own documentation tells you to read the security guide before exposing the gateway. That is the right instinct and most people skip it. Hermes Agent, from Nous Research, is the other shape: an apprentice that keeps notes. Python, MIT, model-agnostic and friendly to local models, so it will run against the endpoint from section two. Its distinguishing feature is a learning loop: it writes reusable skills out of work you repeat, so a workflow should get cheaper over time. The marketplace is leaner; you teach it more than you install it. It ships cron, seven sandbox back-ends and, tellingly, a one-command migration from OpenClaw, because people bounce between the two. Neither replaces a coding harness for “make this pull request”. Part VI puts both on a dated board with the licences and model choices, and is the place for the ops conversation about who patches an operator on a Saturday.

The same word covers three different animals, and the table is the quickest way to stop an argument about which is best. Native job: a coding harness writes and ships code this afternoon; OpenClaw runs an operator desk; Hermes runs and learns a workflow. Lives where: a terminal, an editor or a vendor’s cloud session; your own machine behind a gateway and chat channels; your own machine or a rented server, reached through chat. Memory: mostly the thread plus a rules file and some automatic notes; persistent teams and history; a persistent profile plus skills it wrote itself. Model: the coding species splits here, because Claude Code, Codex and Gemini CLI are built around their vendor’s models while OpenCode and oh-my-pi will take dozens of providers including local ones; both operators bring many models, local included. What you configure is the honest complexity row: a rules file and a few permissions, versus a small company’s worth of channels, keys, sandboxes and schedules, versus a runtime that improves as you teach it. And the failure modes, which the August version of this deck got right and which Part VI kept: session amnesia, and a brilliant session mistaken for an employee; noise, sprawl, CVEs and the question of who patches it; narrowness, because Hermes only knows what you have taught it. The advice at the bottom is the only advice. Do not crown a winner. Ask what the job is. Part VI adds a third column for the agent inside software you already pay for, Copilot Studio, Agentforce and their relatives, which is a harness you did not build and cannot fully see.

Four sentences, then two failure rows, and that is the whole position. Start with the boring one. If a coding harness finishes the job, you do not have a harness problem, and most people need a better session rather than a staff of agents. Complexity is a cost centre: a persistent agent needs babysitting, secrets, patching, and a theory of what “done” means, and somebody owns all of that on a Saturday when a vulnerability lands. The differentiator is not IQ. Frontier models are close; what separates a harness that works from one that embarrasses you is memory, permissions, and whether the thing is still running on Monday. Prompts are suggestions and permissions are walls, which is the single sentence from Part VI worth memorising. And then: pick a job, then pick a body for the brain. Most organisations are over-harnessed or under-harnessed at the same time, with chat in one tab and chaos in the other. The two failure rows are real patterns. The first is the person with thirteen operator agents who opens a coding session and realises the work was just an agent with tools; the extra surface area only pays for itself when you need persistence and channels. The second is Replit in July 2025: an AI coding agent deleted a production database during a code freeze despite instructions not to make changes, and Replit responded by separating development and production credentials, adding a planning-only mode and one-click restore. The lesson is not that the model was stupid. It is that an instruction in a prompt is not a permission in a system. Part III builds the leash; Part VI shows where it attaches.

Inference is the word for running a trained model to get answers; training made the model, inference uses it. Local inference means doing that on hardware you control. There are reasons to do it that survive a budget meeting and reasons that do not, and this slide sorts them. The good reasons are privacy, air-gap and volume. Privacy means a specific, named body of data that must not cross an external API boundary: a claims database, unreleased code, a contract that says so. “Sensitive stuff” is not a name. Air-gap means sites with no network, or a slow one: ships, mines, clinics, factory floors. Volume means enough tokens that the API bill has a first name, though the next slides show that bar is higher than it was. Owning the failure mode counts too: no vendor outage, no debate about whether your prompts train someone else’s model, no terms of service that change on a Tuesday. Experimentation is fine when it is labelled a learning budget. The bad reasons are the familiar ones. Trying to beat the frontier at home gets you a very confident intern with a short context. Occasional use is cheaper and better in the cloud. And the dangerous one: “no API means no risk”. In September 2025 Cisco’s Talos team used Shodan to find more than 1,100 Ollama servers reachable from the public internet, over a thousand within ten minutes, with about one in five actively serving a model to anyone who connected. A local model is a network service plus a file you downloaded from a stranger; the risk changed shape, it did not leave. The rule at the bottom has not aged: if you cannot name the data that must not leave the building, you have a hobby. Hobbies are allowed. Call it one.

Here is the whole local stack in four moves, without the religion. Start at the top. LM Studio is a desktop application with a window; Ollama is the same idea in a terminal. Either takes a non-engineer from nothing to a running model in about ten minutes, and nothing you type leaves the machine. When more than one person or program needs the model at once, graduate to a serving engine, vLLM or llama.cpp, which expose the same kind of endpoint. Pick a workhorse, not a trophy. The example on the slide is Alibaba’s Qwen3.8-27B, released in August 2026 under Apache 2.0: about 54 gigabytes at the 16-bit precision it was released in, about 13.5 at 4-bit, with real downloads running 17 to 20 gigabytes because files mix precisions and carry extras. Gemma 4 and OpenAI’s gpt-oss are the other obvious candidates, and the only number that matters is tokens per second on your own hardware. Memory is the whole game. The weights have to sit somewhere, and the arithmetic is parameters times bits divided by eight; unified memory on a Mac or a Strix Halo box can hold more than a graphics card and run slower, and offloading to disk is a prank you play on yourself. Quantisation is the trick that makes any of this fit: storing each number in fewer bits, so the file is smaller and faster and slightly dumber. One public recipe for this exact model measured how far each quant drifts from the original: 4-bit is close, 2-bit is about fifty times further. Start at 4-bit; go down only when your own test set says it still passes. Finally, pair it with a harness last. A local model with no tools is a chatbot in a basement. Once it answers honestly, give it hands: every runtime exposes one OpenAI-style URL, and every harness from section one can be pointed at it by changing one line. The closing line is Part II’s: a model name without the quant, the runtime, the context setting and the hardware is a brand, not a specification.

Three tiers, with the numbers as they stood in October 2026 and the date on the slide because they will move. The first tier costs nothing extra: a laptop with 16 to 32 gigabytes of RAM, or a desktop with any 8 to 16 gigabyte graphics card, runs the 4 to 9 billion parameter models at 4-bit, which handle classification, summarisation, rewriting and private notes. That is the demo tier and it is where everyone should start. The middle tier is now dominated by machines with unified memory, where processor and graphics share one large pool: Apple’s M5 Max in the Mac Studio from $2,499 and the MacBook Pro from $2,699 before the memory upgrade to 128 gigabytes, and the Framework Desktop with AMD’s Ryzen AI Max+ 395 at $3,449, up from $1,999 at launch. These run a 27 to 31 billion parameter dense model at 8-bit, or a 120 billion parameter mixture-of-experts model at 4-bit, at speeds that make a daily driver. The consumer graphics card route has become the expensive one: the RTX 5090 with 32 gigabytes lists at $1,999 and the October 2026 survey found it selling between $5,000 and $8,000. The lab tier is NVIDIA’s DGX Spark, 128 gigabytes at $6,950 after two increases from about $4,000, and the Mac Studio M5 Ultra from $5,499 with up to 512 gigabytes, enough for DeepSeek-class models at 4-bit in one quiet box; two Sparks link for the 400-billion-parameter class. Beyond that you multiply boxes. The cause of all the movement is the 2026 DRAM shortage driven by data-centre demand. The August version of this deck said $0 to 800, $1,500 to 5,000 and $8,000 and up; those were right in 2025. Electricity is real but small next to the hardware and your time. Part II has the full board with the bandwidth figures and a sizing formula for the context cache.

This is the slide that corrects the original. In August this deck said cloud wins under roughly fifty to a hundred million tokens a month of mixed use. That was a fair rule in 2025. Part II redid the arithmetic with October 2026 prices and it no longer holds. Take a $6,950 DGX Spark and ask how many tokens it must process before it costs less than the cloud. Against the cheap cloud tier, which in October 2026 meant about $0.20 per million tokens blended at three input tokens per output token (OpenAI’s GPT-6 Luna and Anthropic’s Haiku 5.5 both list $0.10 in and $0.50 out), the answer is about thirty-five billion tokens, which at a hundred million a month is twenty-nine years. The machine is obsolete long before. Against a mid-tier model at about $4 per million blended, it is seventeen months, which is plausible if, and only if, the local model does the job as well as the one it replaces. Against frontier prices at about $20 per million blended (GPT-6 Astra at $10 and $50), it is three and a half months. The table is deliberately generous to local: it ignores electricity, which for a 575-watt card run eight hours a day is roughly a hundred kilowatt-hours a month, it ignores the person who runs the box, and it pretends the local model is as good as the cloud model, which it is not. So the honest economic case for local is narrow and real: work you would otherwise pay frontier prices for, that a local model does well enough on your own test set, at serious volume. The data question from the previous slide is unaffected by any of this. If the data must not leave, the arithmetic is irrelevant and local wins outright. Part II has the table with the model names and the prices behind these three numbers; they will have moved by the time you read this.

Three disappointments to schedule before the hardware arrives. Quality: a local open-weight model is one beat behind the closed frontier, sometimes two. The gap has closed a great deal and it is not zero, and it shows most on hard reasoning, on taste, and on long-horizon coding where the model has to hold a plan across many steps. The right response is not to argue about it but to measure it on your own work, with your own test set, and then decide which jobs can live with the gap. Most routine business jobs can. Operations: this is the line item nobody budgets. Drivers, quantisation choices, context settings, evaluation, and the eternal question of why it is broken after the reboot. Budget a human, at least part-time, or the machine becomes a very expensive space heater. Part II’s checklist is the test: write down the model and the exact quant by file hash, the runtime and its flags, the hardware and driver versions, the context setting, and who patches it and when. If you cannot write that down, what you have is a successful demo, and the honest thing is to call it that. Then the grown-up setup, which is not local versus cloud but both. Private grunt work at home: classification, summarisation, extraction, drafting on data that must not leave. A frontier model when the answer has to be right. Because every runtime and every vendor speak the same endpoint shape, switching between them is one line in a configuration file, and that is the architecture Part II builds. If someone in the room has a four-box Spark pile they love, let them talk; that is the high end of local winning, and it is still not the default.

Every organisation that has used a chatbot for a month asks how to get it to know their stuff, and “our stuff” hides three different requests. The first is knowledge: facts that live in documents and change. The refund policy, the current price list, the ticket a customer opened this morning. The model did not read these in training and cannot have. The fix is to look them up at question time and put them in front of the model, which is what retrieval-augmented generation, RAG, means: search first, then write with the results in the window. You can cite, you can update tomorrow, and when it fails it is almost always because the search returned junk, which is a search problem rather than a model problem. The second request is behaviour: the model knows enough but will not act the way you want. It is too chatty, it will not stick to the format, it does not sound like you. The fix is a thin adapter. LoRA, from a 2021 Microsoft paper, leaves the base model frozen and trains small extra matrices beside it: ten thousand times fewer trainable weights than fully fine-tuning GPT-3, about a third of the memory, no extra latency, quality on par. QLoRA, from 2023, stores the frozen base at 4-bit so the whole thing fits on one 48-gigabyte card for a 65-billion-parameter model, which is why a serious laptop can do small ones. It bakes in manners. It does not add a knowledge base, and whatever facts you bake in are stale on Thursday. The third request is to change what the model fundamentally is, by retraining most of its weights or starting over. That is lab money, thousands of GPUs for months, and if you need it you already have a machine-learning organisation. The mnemonic survives from the August version: RAG is what it knows, LoRA is how it acts, pretraining is building a new brain.

The three knobs are really a ladder, and the rule is to stop at the first rung that works. Rung one is prompting: a system prompt that states the job, the rules and the tone, plus a handful of good examples. This still fixes about half of the tickets that arrive labelled “we need a custom model”, the examples do most of the work, it costs an afternoon, and it can be undone in a minute. Rung two is retrieval. If the right answer lives in documents that change, index them and look them up at question time. Days to weeks of work, and when the price list changes on Thursday you re-index one file rather than retraining anything. Rung three is adaptation. If the model knows the facts but will not behave, train a thin adapter on examples of the behaviour: a rigid output format, a house voice, a narrow skill such as sorting tickets into forty categories the way your team does. Weeks, plus the evaluation work, because without a test set you cannot tell whether the adapter helped or merely overfitted the demo. Rung four is distillation: run the big model on thousands of your real inputs, keep the answers, fine-tune a small model on them, and compare both on your evaluation set; the idea is from a 2015 paper and OpenAI packaged it as an API workflow in 2024. The result is a narrow specialist that is cheaper and often small enough to run locally, which is where section two comes back in. It is still not training GPT. Hybrid is the normal production shape: a lightly adapted model that is obsessive about the output format, plus retrieval for the living documents. OpenAI’s guide for developers says the same thing in different words: prompting is typically the best place to start, retrieval is for when the model lacks context, fine-tuning is for when behaviour is inconsistent. Budget-wise, retrieval is weeks, adaptation is more, and pretraining is a different career.

The August version gave this as a slogan. Here it is with the footnotes Part VII found. Fine-tuning is for form, not facts: bake in manners, retrieve the truth. The reason it is a rule rather than a taste is that two groups tried to do what the ticket asks for, teach a model new facts by training on them, and measured the result. Ovadia and colleagues, in work revised in January 2024, compared unsupervised fine-tuning against retrieval for injecting knowledge, both facts the model had seen in training and entirely new ones; retrieval won consistently in both cases, and the authors note that models struggle to learn new facts this way unless shown many paraphrases of each. Gekhman and colleagues, in work revised in October 2024, found something worse than inefficiency: training examples that introduce new facts are learned more slowly than examples the model already agrees with, and once learned they linearly increase the model’s tendency to hallucinate, apparently because the model learns that producing unsupported facts is rewarded. Their summary is the one to keep: models acquire facts in pretraining, and fine-tuning teaches them to use what they already have. Then the mechanical point that needs no study: whatever you bake in is right on training day, and the price list changes on Thursday. The other two cards follow. You do not have a model problem; you have a data problem, an evaluation problem or a product problem, and those are cheaper to admit. And evaluations come before adapters: if you cannot score the job, you cannot tell whether the adapter helped or merely overfitted the demo. Part VII shows that thirty real questions with known answers is enough to start, and that the right answer is usually to ship the retrieval version and bin the adapter. If someone in the room is mid-fine-tune, do not dunk. Ask what they will measure.

Start with the object. Part IV explains that a language model is a very large function whose behaviour lives in billions of numbers, the weights, set during training and frozen afterwards. Those numbers are a file. Everything in this section follows from one question: do you get the file? If the answer is no, the model is closed. The vendor keeps the file in its own data centre and sells you its output by the token through an API. That is GPT, Claude, Gemini and Grok as products, it is a perfectly good way to buy intelligence, and most of the room uses it daily. If the answer is yes, the model is open weights. The file is published, usually on Hugging Face, and you can download it, run it on your own hardware or a cloud you control, inspect it, shrink it, adapt it with your own examples and keep a copy for as long as you like. Once you hold the file, nobody can switch it off, reprice it or quietly change its behaviour, and that single fact is the source of every advantage on the next slide. The third term is the one people confuse with the second. Open source, in the strict sense the Open Source Initiative defined in October 2024, requires the weights and the training code and enough information about the training data for a skilled person to rebuild the system, under terms that let anyone use, study, modify and share it. Almost no serious model meets that bar; the OSI has said Meta’s Llama licence does not, and Meta disagrees. What matters for a business is that the licence attached to the file is the product. Alibaba’s Qwen3.8-27B under Apache 2.0 lets you do anything commercially, forever. A research-only release does not. Some community licences add revenue gates at twenty or fifty million dollars. Part IX has the table. Read the one that applies to you.

Four reasons this stopped being a hobbyist topic, with the numbers as of October 2026. First, open weights set the price of intelligence. A free model that is good enough for a job puts a ceiling on what any vendor can charge for that job, and every closed price list is written with that ceiling in view; you benefit from it even if you never run an open model. Second, sovereignty. When the file is yours it can run in a virtual private cloud, on your premises or on a machine with no network at all, and “our data never leaves” becomes a fact rather than a contractual promise. Third, it is how the rest of the world builds: developers follow whatever they can fork, and Hugging Face’s August 2026 report counts 151,448 derivative models built on Qwen, 4.7 times the Llama family, with Alibaba claiming three billion downloads across platforms. Fourth, the open layer changed hands. Llama defined open weights in 2023 and 2024; by 2026 the open models the world actually runs are mostly Chinese. CNBC reported on 26 September 2026, from OpenRouter data, that models from Chinese labs took 57 to 67 percent of tokens in the week of 14 September depending on region, up from 6 to 13 percent in February. Meta went closed with Muse Spark in April 2026, then released Muse Glimmer under Apache 2.0 in August and Muse Spark Open under its own licence in October. The American response is money rather than law: OpenAI’s gpt-oss, Nvidia’s roughly $26 billion pledge to open models and its purchase of Hugging Face, Meta’s return. Hugging Face’s data still shows the largest open model of nearly every month in 2026 coming from a Chinese lab. One correction to the August version: it quoted “about 61 percent”, which was a June snapshot of the top ten models only, a different denominator from the figures here. OpenRouter is one router with a developer-heavy customer base, and token share is not revenue share. Part IX’s appendix walks through why every published percentage disagrees with every other.

The map, redrawn in October 2026 from Part IX. The point is the shape, not the names, and the shape is two industrial strategies. On the American side the frontier is closed and the money is in chips, capital and distribution. OpenAI sells the GPT family and Codex, and in August 2025 released gpt-oss under Apache 2.0, its first open weights since 2019. Anthropic sells Claude, all closed, and was the largest single US provider on OpenRouter in mid-2026. Google has Gemini, the open Gemma models, its own chips and the distribution of Search and Android. xAI has Grok and real-time data; Grok-1 was Apache 2.0 and later releases are source-available with restrictions. Meta is the strange one: Llama defined open weights, then Meta went closed with Muse Spark in April 2026, then released Muse Glimmer under Apache 2.0 in August and Muse Spark Open under its own licence in October. Nvidia sells the pickaxes, ships the Nemotron open models, has pledged about $26 billion to open weights and agreed in September to buy Hugging Face, the platform where all of this is published. Microsoft, Amazon and Apple matter as hosts and channels more than as labs. On the Chinese side the pattern is open weights at low prices. DeepSeek was the January 2025 shock, wiping $589 billion off Nvidia in a day, and is the largest single vendor on OpenRouter; Alibaba’s Qwen is the most-downloaded family on earth; Moonshot’s Kimi K3 at 2.8 trillion parameters released its weights in July under a custom licence; Z.ai’s GLM-5.2 is MIT; MiniMax, Tencent and ByteDance fill out the field. And then everyone else: Mistral in Paris raised three billion euros in September 2026 on a sovereignty pitch, and labs in Canada, the UK, Israel and the Gulf are the people “US versus China” erases. Every line here will be wrong by spring. The two-column shape will not.

The sentence that has held up best from the August version: it is not one race, it is two, and they have different winners. The capability race asks who has the single most capable model this quarter. It is measured by benchmarks and by the things you could not do last month, it is mostly run by closed-weight US labs, and it is loud and expensive. The lead is real. When the US government’s Center for AI Standards and Innovation tested DeepSeek’s models against the best American ones in September 2025, the US model led on nearly every one of nineteen benchmarks, by twenty to eighty percent on software engineering and cyber tasks and by very little on science. The lead is also short, measured in months, and it decides what is possible rather than what you will buy. The distribution race asks who supplies the tokens the world actually runs, and in 2026 that is China by a wide margin: cheaper, forkable, good enough, 57 to 67 percent of OpenRouter tokens in September. Most business jobs live in the second race. The American response is reactive: export controls, bans such as the Department of Homeland Security’s October 2026 order removing DeepSeek from federal civilian systems, occasional panic. Meanwhile Chinese open models are served from American data centres by Azure, Bedrock and OpenRouter’s in-region routing, and where a model runs has become a configuration setting that matters more to your lawyer than where it was made. Export controls are government rules on which chips and tools may be sold to which countries; the US has restricted advanced AI chips to China since October 2022 and tightened the rules twice, and the 2025–2026 story of H20 and H200 licences, revenue shares and Chinese customs blocks is messier than “banned”. Chips constrain training, which is the capability race. They do not constrain serving a file that has already left the building, and they will not raise your token price. The lead that remains is closed frontier, chips and capital. The lead that vanished is the belief that China could not build frontier models and that open source was an American story.

Two piles, and the whole discipline is not mixing them. The movie pile is a mind that wakes up and hates you: overnight, unstoppable, cinematic, a system pursuing goals we did not give it faster than we can intervene. It is not silly. The people building these systems take it seriously enough to publish formal frameworks about it, and the next slide shows what those say. But nothing anyone in this room does on Monday changes that risk one way or the other, and treating it as the business risk is a category error that ends in paralysis or dismissal. If it arrives, it will not look like a chrome skeleton; it will look like an automation nobody fully understood. The factory pile is already in the building, and every item on it has a date, a company and a loss. Scams and very cheap fakery: in early 2024 an employee at the engineering firm Arup joined a video call in which the chief financial officer and every colleague were deepfakes, and wired about $25 million. Job chunks disappearing without a press conference. Agents with tools, secrets and no workplace norms: a Microsoft 365 Copilot that could be made to leak internal data by sending an employee an email they never opened, the EchoLeak vulnerability of 2025; a coding agent that deleted a live database during a code freeze at Replit the same year. An airline held liable for a refund policy its chatbot invented. And labs that grade C+ at best on independent safety indices while discussing timelines to general intelligence. None of these needed a superintelligence. They needed a competent system, some credentials, and the absence of a few ordinary controls. That is the thesis Part VIII builds on: worry about competence in the wrong place. A pretty-good agent with production credentials is more dangerous than a genius in a box.

Here is a threat model you can use when someone says Skynet, and it is four sentences long. Worry about competence in the wrong place: for damage per day, a pretty-good agent with production credentials beats a genius in a box. Worry about speed without process: recursive research, automatic pull requests, automatic emails; the blast radius grew and the review culture did not. Worry about concentration: a handful of labs, a handful of chip vendors, a handful of governments, which is a political fact rather than a technical one. And do not outsource your judgement to either church; the accelerationists and the pause letters are both selling certainty, and you do not have to buy. The panel gives the long-term pile its honest due, as of October 2026, from Part VIII. The Future of Life Institute’s AI Safety Index for Summer 2026 had seven independent reviewers grade nine companies on 37 indicators: the best overall grade was Anthropic’s C+, OpenAI and Google DeepMind got C, Meta D+, and xAI, DeepSeek and Mistral failed; on existential safety no company scored above C-, and the reviewers noted that the four leading labs had weakened or voided earlier pledges to pause unilaterally. Anthropic’s Responsible Scaling Policy is at version 3.4, effective 8 July 2026, with capability thresholds for weapons and automated AI research that trigger stronger safeguards and a published Risk Report with external review; its wording now says the company remains free to pause, which is weaker than a hard commitment. OpenAI’s Preparedness Framework version 2, from April 2025, commits the company to halt development at a Critical capability until safeguards exist. Read together: the people with the most information have written down what would frighten them, there is no independent audit of whether they would stop, and the outside graders give the best of them a C+. That is neither “solved” nor Skynet. If the room goes philosophical, bring it back: what would you not let an agent do unattended this month?

One slide of names, dated, redrawn from Part X. Each row is what the company itself has said, read in October 2026, and the thing to notice is the difference between a cumulative count and a reliability figure; nobody on this board publishes the second. Tesla began what it calls early production of Optimus at Fremont on 21 October 2026, with Musk saying in the same breath that the design still needs safety, reliability and durability changes and that the AI needs substantial work before open-ended tasks; 20,000 a week by the end of 2027 is a stated target, and the 2024 event where Optimus units served drinks turned out to be human-assisted, as a Tesla engineer later acknowledged. Figure put its robots on BMW’s Spartanburg line in 2025 and says they contributed to 30,000 cars; the newer model arrived for logistics in June 2026; numbers and terms are not disclosed. Boston Dynamics showed the product version of the electric Atlas in January 2026 and started production, with all 2026 units going to Hyundai and Google DeepMind. Agility is the most instructive row and the most boring: a paid robots-as-a-service contract with GXO since 2024, over 100,000 totes moved at one Georgia site. Unitree sells on price, 5,215 humanoids in 2025 mostly to universities and labs, and listed in Shanghai in August 2026. 1X ships NEO to homes at $20,000 with a remote human operator for chores it does not know. Nvidia sells none of this and supplies the brain, the simulator and the data to most of it. The takeaway survives from August: the humanoid market is a 2030s number wearing 2026 clothes. What is real now is constrained environments, teleoperation-plus-autonomy hybrids, and Chinese hardware at prices that change who can experiment. For context, Amazon passed a million deployed robots in July 2025, nearly all wheeled units and fixed arms behind fences, and Waymo runs about half a million paid rides a week; that is what working autonomy looks like, and it took a decade.

Four things change in a world of cheap bodies, and none of them is “robots take over”. The bottleneck moved. The question is no longer whether it can talk; Part IV’s models solved that, and a humanoid describing a scene on stage is a chatbot with legs. The question is whether it can manipulate for a shift without a babysitter, a lawsuit or a dead battery. Part X draws this as a ladder: talking is done, navigation is done on wheels, grasping is mostly solved one object class at a time, a full shift of thousands of picks is where the paid pilots are, and open-ended work in an unfamiliar place is where the keynotes are and nobody is. Labour gets unbundled again. It is the same story as software agents, but in receiving, elder care, the last mile and the jobs we pretended were safe, and it follows one variable: how constrained the environment is. Fenced floors first, warehouse corners next, teleoperation hybrids alongside, care and hospitals late in the decade, homes last. War and logistics do not wait for your feelings. Autonomous systems are already a procurement category in defence and logistics; the sober version of that observation is that the same questions apply there, what is it allowed to touch and who is accountable when it fails, and the answers are being set by law and policy now. Homes are last and messiest. Your kitchen is a harder environment than a car plant; the first home humanoid costs $20,000 and comes with a remote human pilot by appointment, which is honest when disclosed. The line to carry back to section one is the one that organises Part X: a robot is an agent with kinematics. Same six parts, plus physics and a battery. Same questions. Permissions, memory, and who is liable when it drops the crate, except that a wrong token is deleted and a dropped crate is not, and the leash is a safety standard an engineer signs, not a paragraph in a prompt.

Seven sentences, one per topic, each the first sentence of a later session in the series. A harness is the body, and most people need a better session rather than a staff of agents. Local inference is for privacy, air-gap or volume, never for winning a benchmark argument, and the volume bar is higher than it was. Prompt, then retrieve, then adapt; you almost certainly do not need to train a model, and two studies say that baking facts into weights makes things worse. Open weights are how you hold the thing, and that layer is no longer an American story, though America is now paying to get back in. The two races: closed frontier and open distribution, with the US loud at one and China winning the other. Worry about competent agents in sloppy institutions more than a cartoon apocalypse; every real incident in this deck needed credentials and the absence of a few ordinary controls, not a superintelligence. And physical AI is reliability and hands, not a keynote demo that can dance; the number that matters is how often a human has to step in, and nobody publishes it. Read them out if the room is fried.