The Agent–UI Protocol

The one-sentence version, from the README

A chat app where a Claude Managed Agent acts as a personal finance assistant. Anthropic hosts the agent loop and its container, CopilotKit renders the chat, and replies stream token by token. — managed-agents/copilot-kit-ag-ui/README.md

That is accurate and it hides the interesting thing. Four organisations' code has to agree on a wire format for that sentence to be true, and only one of the four pieces is Anthropic's.

The whole server integration, unabridged

This is the entire runtime wiring. Sixteen lines do the work that a hand-rolled streaming endpoint usually spends three hundred on.

const runtime = new CopilotSseRuntime({
  agents: {
    'financial-assistant': new ManagedAgentsAgent({
      managedAgentId: ids.agentId,
      agentVersion: ids.agentVersion,
      environmentId: ids.environmentId,
      backendTools: vizTools,
      sessionStore: store,
      sessionTitle: (threadId) => `Finance assistant thread ${threadId}`,
    }),
  },
});

const app = express();
app.use(
  createCopilotExpressHandler({
    runtime,
    basePath: '/api/copilotkit',
    cors: allowedOrigins ? { origin: allowedOrigins } : true,
  }),
);

ManagedAgentsAgent is a plain AG-UI AbstractAgent. That is the load-bearing fact of the whole architecture: because it implements one interface — run(input): Observable<BaseEvent> — the CopilotKit runtime doesn't know or care that Anthropic is on the other end. Swap in a LangGraph agent, a CrewAI crew, or a Bedrock AgentCore endpoint and the frontend does not change.

Managed Agents is not the Agent SDK

The quickstart lives in a managed-agents/ folder for a reason, and the distinction matters because it is where your infrastructure decision actually gets made.

The docs put it plainly: “The difference is where they run: the SDK runs in a process you operate, while Managed Agents runs in Anthropic's infrastructure.” Things you lose moving from SDK to Managed Agents and must reimplement client-side: plan mode, output styles, slash commands, PreToolUse/PostToolUse hooks, and max_turns.

The security posture is the most instructive file in the repo

The setup script provisions an environment with no outbound network at all, and turns off exactly one built-in tool. The comment explaining why is better security writing than most threat models:

// The chat endpoint that fronts this agent is unauthenticated in the demo, so
// keep the blast radius small: the container gets no outbound network (bash
// and files still work for calculations), and web_fetch stays off because
// arbitrary URL fetches are the classic prompt-injection + exfil channel.
// web_search stays on for current rates and limits.
const environment = await client.beta.environments.create({
  name: `financial-assistant-demo-${Date.now().toString(36)}`,
  config: {
    type: 'cloud',
    networking: {
      type: 'limited',
      allowed_hosts: [],
      allow_package_managers: false,
      allow_mcp_servers: false,
    },
  },
});

Two design notes that are really ecosystem bug reports

Buried in CLAUDE.md are two notes that tell you more about the maturity of this stack than any version number:

What it is, as an artifact

The event vocabulary

The widely repeated figure is “16 event types.” That was the May 2025 launch set, and AG-UI's own architecture page still says it. The current enum has 33 members: 28 active and 5 deprecated. If a blog post tells you 16, it is a year out of date — and so, on this page, are the official docs.

Note that the rename was not a clean prefix swap: THINKING_TEXT_MESSAGE_START became REASONING_MESSAGE_START, dropping the TEXT_ segment. Every event also carries type, optional timestamp, rawEvent and metadata, and the Zod schemas are .passthrough(), so unknown fields survive.

Why this is not just streaming tokens

The difference is not the streaming. It is the framing. Compare:

Module 7 shows what happens when you don't have that framing, using real code from Learn Imagine that exists only because a chunk boundary inside a JSON string still parses as valid JSON.

The state model — and its soft failure

This is the part with real intellectual content, and the part with the real hazard.

• STATE_SNAPSHOT carries the complete state object. The docs are emphatic: frontends should “replace their existing state model with the contents of this snapshot rather than trying to merge it with previous state.”
• STATE_DELTA carries an array of JSON Patch operations (RFC 6902) with JSON Pointer paths (RFC 6901). The reference client applies them with fast-json-patch as applyPatch(state, delta, true, false) — validate on, mutate off, so patches apply atomically to a new document.

“Transport agnostic” means SSE

The docs claim support for “Server-Sent Events (SSE), webhooks, WebSockets, and more.” Checked against the repo in August 2026:

The honest reading: transport agnostic means the event schema embeds no transport assumptions — they are JSON objects with a type discriminator, so you could put them on anything. It does not mean the SDKs give you a choice today. Design as if it is SSE, because it is.

Where it sits in the protocol landscape

The three-legged framing — MCP for agent-to-tool, A2A for agent-to-agent, AG-UI for agent-to-user — is verbatim from AG-UI's own docs, on a page called agentic-protocols. Two caveats worth carrying:

• It is self-positioning by the party that benefits from it. Neither Anthropic nor Google has endorsed a three-legged stool. It is a useful mental model and a marketing frame at the same time.
• The boundary is already blurring: AG-UI declares MultiAgentCapabilities with delegation, handoffs and subAgents, and there is an open issue proposing subagent support in the protocol. That is A2A's layer.

The docs also describe AG-UI, approvingly, as the “kitchen sink protocol — informed by bottom-up, real-world needs” whose mandate is “to support the full set of building blocks required by modern agentic applications.” Hold that sentence next to “33 event types and growing” and you have a fair prediction of where it goes.

Every team that ships an agent with a non-trivial UI hits the same five walls. The order is remarkably consistent, because each one is only visible once you've solved the previous one.

1. No frame boundary, so you write a parser

You stream JSON. The client wants to render as it arrives. But a chunk can split anywhere — including inside a string — and the truncated result is often still valid JSON. So {"text": "Hel"} parses cleanly and you render “Hel” as a finished sentence.

Every team invents the same fix: never trust the last element. Then they invent the second fix: repair known model near-misses. Then the third: rescue turns the model double-encoded. Module 7 has all three, from your own repo, with dates in the comments.

A framed protocol deletes this category. TOOL_CALL_ARGS deltas are declared incomplete; TOOL_CALL_END declares them complete. There is nothing to infer.

2. State divergence, with no shared source of truth

The agent believes the UI shows one thing. The UI shows another. Nothing detects it.

This is the expensive one, because it does not fail loudly. It fails as a tutor referring to a diagram the student cannot see, or a copilot citing a row that scrolled away. The hand-rolled fix is almost always the same: re-send the entire state to the model every turn, serialised as prose. It works, and it costs tokens linearly in state size, forever. Module 9 puts a number on that.

3. Tool-call rendering, and the args-shape problem

Rendering a tool call as a component sounds trivial until you meet the wire format. The quickstart's comment on this is one of the most useful things in the repo:

/** Tool args have arrived in several shapes across CopilotKit versions: a
 *  typed object, an object with every number stringified, and an object whose
 *  nested arrays/objects are JSON strings. Normalize the structure here and
 *  let the schemas' z.coerce handle stringified leaf numbers. */
const asRecord = (parameters: unknown): unknown => {
  let value = parameters;
  if (typeof value === 'string') {
    try { value = JSON.parse(value); } catch { return parameters; }
  }
  if (value && typeof value === 'object' && !Array.isArray(value)) {
    return Object.fromEntries(
      Object.entries(value).map(([key, field]) => [key, parseStructured(field)]),
    );
  }
  return value;
};

Read the design note that goes with it, from CLAUDE.md: “blind-spreading props.parameters breaks silently when the wire format shifts.”

4. Interruption and resumption

What happens when the user hits stop, or closes the tab, or the network drops mid-turn?

Hand-rolled systems usually pick one of three unsatisfying answers: lock the input so interruption is impossible; let the user interrupt and throw away the partial turn; or let the user interrupt and keep a partial turn that nobody can reconstruct. AG-UI's answer is RUN_FINISHED with outcome.type === "interrupt" — a first-class, renderable, resumable outcome, which CopilotKit surfaces through useInterrupt.

Worth knowing that the protocol's own record here is imperfect: an open issue reports that a user-triggered stopGeneration produces a server ECONNRESET rather than a clean abort. The model is right; the implementation is 0.0.58.

5. Human-in-the-loop approvals

The moment an agent can do something consequential, someone will ask for an approval step. Hand-rolled, this means inventing a pause-and-resume protocol inside your own stream: a message type that means “I am waiting,” a way to carry the user's answer back into the same turn, and a way to not lose it on refresh.

CopilotKit v2 gives you two distinct mechanisms, and the distinction is worth learning because people conflate them:

The symptom checklist

You can diagnose a hand-rolled pipeline without reading its architecture doc. Look for these:

Learn Imagine has all six. That is not a criticism — it is what a well-built system looks like when it solves these problems before a standard existed. Module 7 walks each one with the file and line.

Lock-in is in the client, not the protocol

The protocol is MIT, has nine community SDKs, and three hyperscalers ship it. On paper it is the least lock-in-shaped thing in your stack. The lock-in is one layer up.

Recall that AG-UI states plainly it is not a generative UI specification. So the thing you actually want — a tool call becoming a React component, sliders that recompute client-side, an approval gate that pauses the agent — is CopilotKit's. Concretely, in the quickstart: useRenderTool, CopilotKitProvider, CopilotChat, CopilotSseRuntime, createCopilotExpressHandler. Those are the five symbols that would have to be rewritten if you left. The AG-UI events would survive; the surface that makes them useful would not.

CopilotKit is MIT and self-hostable, which is genuinely more than most of the category offers. But the commercial gradient is real and worth reading before you commit:

Pricing is Developer free, Pro $39/mo, Team $100/seat/mo, Enterprise custom. Note precisely which rows are paid: persistence and multi-client sync — which is to say, three of the five stress tests from Module 4. The protocol does not standardise persistence, and the reference implementation sells it. That is a coherent business model and you should still see it clearly.

Debugging through a protocol layer

When your hand-rolled stream misbehaves, there are two places to look: your server and your client. With this stack there are five, and the failure can be in any of them:

1. The Managed Agents session (Anthropic's infrastructure — you get the Console trace)
2. The @ag-ui/claude-managed-agents adapter, at 0.0.1
3. The AG-UI event stream itself
4. The CopilotKit runtime's transformation of those events
5. Your React renderers

Two of those five you cannot step through. The quickstart's own troubleshooting list is the evidence: instanceof errors mentioning Observable (duplicate rxjs), a repl-parked session the adapter interprets as unanswerable, tool args arriving in three different shapes across runtime versions. None of those are bugs in the finance assistant. All of them cost the author time.

The mitigation is real, and it is the best thing about the Managed Agents half of this stack: every session logs a Console trace URL, and the Console gives you a timeline minimap, a full transcript grouped by model request with thinking and tool inputs/results, and an inspector with Session, Events, Tools, Resources and Threads tabs, downloadable as JSON. That is genuinely better observability than most teams build for themselves.

Latency and bundle

The “just use SSE” argument, made properly

The argument runs like this. You already have SSE. You already have JSON. A discriminated union over a type field is thirty lines of TypeScript and a Zod schema. What AG-UI adds is not a capability — it is agreement, and agreement is only valuable if you are actually going to interoperate with someone.

So the question is not “is a protocol good?” It is: who is the second party?

The counter to the counter: your second party is often future you. The event vocabulary you invent this quarter is the one you are stuck with in three years, and it will not have an interrupt outcome in it, because you did not need one yet. That is exactly what happened in Learn Imagine, and Module 7 shows the line of code where it happened.

What AG-UI does not standardise

There is no published non-goals section. I looked. The boundaries below are inferred from absence plus one first-party integrator's docs, which means they are not commitments and could change:

• Auth. Nothing. Microsoft's integration docs say it plainly: “AG-UI does not include a built-in authorization mechanism”, adding “do not expose AG-UI servers directly to untrusted clients” and documenting five injection vectors — message list, client-side tool, state, context, and forwarded-properties injection. They recommend a trusted-frontend/BFF pattern.
• Persistence. threadId and runId are opaque strings. No store, no history endpoint, no retention semantics. Microsoft again: “don't treat a thread ID as proof of identity or ownership.”
• State shape. snapshot is typed any. AG-UI standardises how state moves, never what is in it.
• Error taxonomy. RunError.code is a free string. AWS had to invent its own UNAUTHORIZED/SESSION_BUSY/AGENT_ERROR codes to make it usable.
• Ordering, delivery guarantees, rate limiting, retry, billing. All yours.

The comparison that actually matters

For your stack the real fork is Vercel AI SDK versus AG-UI, because you are already on the former and it is not obviously worse. The distinction is not quality — it is category.

Adoption signal, read carefully

The npm numbers look enormous and are partly an artifact. @ag-ui/core shows ~5.9M downloads a month, but @ag-ui/proto (4.33M) and @ag-ui/encoder (4.33M) sit within 2% of @ag-ui/client (4.27M) — exactly what you would expect if they are forced transitive dependencies, which the open bundle-size issue confirms. So read it as roughly one number around 4.3M, counted four times, plus ~1.5M direct core installs. Real, and not 6M-distinct-adopters real.

The signal that is strong is institutional: AWS documents AG-UI as a Bedrock AgentCore Runtime protocol contract alongside A2A, Microsoft publishes dedicated AG-UI security and integration docs for Agent Framework, and Google ADK has a supported middleware. Three hyperscalers shipping it is meaningfully beyond “one startup's protocol.”

The counter-signal: the Show HN launch got 36 points and 5 comments, two of them from CopilotKit staff, and the most substantive outside comment was straightforward confusion about what it was for. Later AG-UI stories got 7 and 6 points. Star count and practitioner traction are badly out of step, and that gap is worth watching rather than dismissing.

The vocabulary you already have

The whiteboard's wire format is a zod v4 discriminated union on op. Its header comment states the design intent better than most protocol specs do:

// The whiteboard's wire format. The LLM emits a stream of these validated
// actions — never markup, never pixels. The shape model IS the wire format
// IS the prompt serialization IS the DB row: zero impedance mismatch.
//
// ONE stable schema forever: the action array is part of the Anthropic
// prompt-cache prefix (jsonTool mode) — never mint per-turn variants.

export const BoardAction = z.discriminatedUnion("op", [
  SayAction, AddTextAction, AddMathAction, AddArrowAction, AddShapeAction,
  AddGraphAction, AddTableAction, HighlightAction, AnnotateAction,
  DeleteAction, MoveViewAction, AskCheckAction, PauseAction,
]);

Thirteen ops. Plus a separate student vocabulary (student_pen, student_text, student_erase, message, check_answer, look_at_work, start) and a system vocabulary (turn_end, session_end), wrapped in an actor-tagged envelope:

export type BoardEventPayload =
  | { actor: "ai"; action: BoardActionT }
  | { actor: "student"; event: StudentEvent }
  | { actor: "system"; event: { kind: "turn_end"; turnId?: string }
                            | { kind: "session_end" } };

Stop and notice what that is. An actor-tagged, append-only event log with a closed vocabulary and server-assigned sequence numbers, persisted to board_events with a unique(board_session_id, seq) constraint, where fold(events) reconstructs the entire board. You did not build a chat app that happens to draw. You built an event-sourced system.

The mapping

What the mapping looks like in code

Here is the quickstart's tool contract — the thing the agent sees, which the adapter registers on each session and CopilotKit renders as a React component. Compare its shape to your AddMathAction:

/** ... The rendering IS the result, so the handlers ignore
 * their input and just confirm. */
const rendered = (name: string) => () =>
  `Rendered "${name}" to the user as an interactive visual.`;

export const vizTools: BackendCustomTool[] = [
  {
    name: 'show_payoff_timeline',
    description:
      'Render an interactive debt-payoff chart in the chat: remaining balance by month, ' +
      'payoff date, and total interest, with a payment slider the user can drag ...',
    parameters: {
      type: 'object',
      properties: {
        title:          { type: 'string', description: 'Short chart title' },
        principal:      { type: 'number', exclusiveMinimum: 0 },
        aprPercent:     { type: 'number', minimum: 0, maximum: 100 },
        monthlyPayment: { type: 'number', exclusiveMinimum: 0 },
      },
      required: ['title', 'principal', 'aprPercent', 'monthlyPayment'],
    },
    handler: rendered('show_payoff_timeline'),
  },
  // ... show_growth_projection, show_budget_breakdown, show_comparison
];

Three things to notice, because all three are already true of your board and none of them is obvious.

The handler ignores its input and returns an acknowledgement. The rendering is the result; the ack exists only to let the turn keep flowing. That is exactly your add_math — the model does not need a return value, it needs the shape to appear.

The visual tools are deliberately not registered on the agent. Per CLAUDE.md: “setup does not put them on the agent. The adapter registers them on each session as tool overrides… so changing a tool contract never requires re-provisioning.” This is the architectural inverse of your cache law and worth sitting with: the quickstart optimises for changing the vocabulary cheaply; Learn Imagine optimises for never changing it, because the vocabulary is the cache prefix. Neither is wrong. They are different bets about how settled your vocabulary is.

Sliders recompute client-side without another agent turn. Also from CLAUDE.md: “The agent supplies starting numbers, and the sliders recompute everything client-side without another agent turn.” That is the single most transferable idea in the quickstart for a tutoring product. A student dragging a parameter on a graph should not cost a model call — and today, in Learn Imagine, exploring a graph means asking the tutor.

For contrast, the same contract expressed as an AG-UI event sequence rather than a tool definition. This one is mine, written to show the framing — it is not from either repo:

// what the browser would actually receive, one SSE frame per line
{ "type": "TOOL_CALL_START", "toolCallId": "tc_7", "toolCallName": "add_math" }
{ "type": "TOOL_CALL_ARGS",  "toolCallId": "tc_7", "delta": "{\"id\":\"m2\",\"la" }
{ "type": "TOOL_CALL_ARGS",  "toolCallId": "tc_7", "delta": "tex\":\"(x+5)(x-2)=0\"" }
{ "type": "TOOL_CALL_ARGS",  "toolCallId": "tc_7", "delta": ",\"place\":{\"col\":\"work\",\"below\":\"m1\"}}" }
{ "type": "TOOL_CALL_END",   "toolCallId": "tc_7" }   // <- now, and only now, parse

The second frame is {"id":"m2","la — unparseable, and declared unparseable. Under your current transport the equivalent moment is a growing array whose tail happens to parse as a complete action. That single difference is the whole tail-holding problem, and it is the first piece of scar tissue below.

The four pieces of scar tissue

Each of these exists because the transport has no frames. Each has a dated comment. This is the strongest evidence in the course for what framing buys, because it is evidence from your own repo.

1. The tail element is never trusted

/** Feed the streaming partial array. The TAIL element is never applied —
 *  a chunk boundary inside a string still parses ({"text":"Hel"} is a
 *  valid say), so the tail only commits via finish() or once the stream
 *  grows past it. */

That comment is the entire case for TOOL_CALL_END in three lines. Under a framed protocol there is no tail problem, because incompleteness is declared rather than inferred.

2. A whole repair layer

lib/board/guard.ts contains repairRawAction (fixes add_math arriving with text instead of latex, missing color, leaked top-level col, legacy x/y), rescueTurnArray (unwraps a turn the model double-encoded as a JSON string inside {"text": "..."}), normalizeAction and clampTurn. One comment reads “observed live 2026-08-02.”

Be precise about what a protocol fixes here: roughly half. The double-encoding rescue is a framing problem and would go away. The field-name repairs are the model getting the schema slightly wrong — that happens under any protocol, and the quickstart's own coercing zod layer is the same thing. Module 3 made this point; here is the receipt.

3. Signals travelling in HTTP headers

return result.toTextStreamResponse({
  headers: {
    "Cache-Control": "no-cache, no-transform",
    "X-Accel-Buffering": "no",
    ...(verdict ? { "x-board-verdict": verdict } : {}),
    ...(verdictCheckId ? { "x-board-check": encodeURIComponent(verdictCheckId) } : {}),
  },
});

The judge's verdict on a student's short answer rides in a response header, because there is no event channel to put it on. That is textbook out-of-band signalling — the Module 3 symptom. Under AG-UI it is a CUSTOM event, or better, a STATE_DELTA on the check's status.

And note no-transform is load-bearing: per CLAUDE.md, “the CDN's brotli otherwise truncates slow token streams in browsers (curl hides the bug).” A text/plain stream can be silently truncated by infrastructure and nothing notices, because there is no frame whose absence would be detectable. SSE has a media type that intermediaries know not to touch. That is a real, unglamorous operational benefit.

4. Interruption made impossible rather than handled

/** Fast-forward the rest of the current turn (caller cancels voice). */
const skip = useCallback(() => {
  fastRef.current = true;
  flushSleeps();
}, [flushSleeps]);

skip() fast-forwards playback. It does not cancel generation. While busy, the text input, Send, “Look at my work” and “I'm stuck” are all disabled, with the placeholder “The tutor is drawing…”. PLAN.md records this as deliberate: “input stays locked — no mid-stream race.”

That was the correct engineering call given the transport. It is a bad pedagogical outcome, and Module 8 argues it is the single strongest reason to change something.

The layout engine — the best thing in the codebase

The model emits no coordinates. It says where a thing belongs semantically:

export const Placement = z.object({
  col: z.enum(["work", "visuals"])
    .describe("work = derivations/steps/checks; visuals = graphs/tables/diagrams"),
  below: z.string().optional()
    .describe("existing shape id: stack aligned under it (its column wins)"),
  beside: z.string().optional()
    .describe("existing shape id: sit to its right when it fits, else below"),
});

And pixels are decided inside the fold — the one code path shared by client render, server prompt serialisation, and replay:

// Layout happens inside the fold — the only code path shared by client
// render, server prompt serialization, and replay — so a position can never
// desync between what the student watched and what the server persisted.
// The engine (lib/board/layout.ts) owns every pixel; the model's actions
// carry only semantic placement.

lib/board/layout.ts guarantees no-overlap by construction rather than by mitigation: disjoint regions, monotone column cursors, beside admitted only after an explicit intersection test, and a new section opened below when one fills. 384 lines with 606 lines of tests. There is no persisted layout state at all — LayoutState is created fresh inside every foldEvents() call.

/board-lab is the tell

The fixture harness at app/board-lab/page.tsx exists, per its own header, to prove “the canvas + animation player with ZERO AI cost… if a scripted turn plays smoothly here, the live path only adds transport.” Its playback loop deliberately simulates ragged chunking:

const tick = () => {
  i = Math.min(fixture.length, i + Math.ceil(Math.random() * 3));
  if (i < fixture.length) {
    feedPartial(fixture.slice(0, i));
    setTimeout(tick, 250 + Math.random() * 900);
  } else {
    // Mirror the live client: feedPartial holds the tail element
    // back; stream end flushes it via finish().
    finish(fixture);

You built a bespoke event-log replay harness because you have an event log and no standard tooling for it. That is not a flaw — the sims memo would call this the highest-ROI artifact in the repo (flavour F3, replay & fork: real, faithful, never drifts). It is also the clearest possible signal that you converged on the protocol's model independently.

Where the mobile story actually stands

One correction to the brief: there is a mobile layout, and it is more considered than “none.” PLAN.md records a verified 390px pass, the desktop transcript rail is hidden md:block with a 70vh bottom sheet below md, the check overlay switches from centred modal to bottom sheet, and the input bar has icon-only fallbacks.

What is desktop-bound is the board itself: a fixed 1600×900 logical viewBox squeezed into 390px; COLUMNS in layout.ts hardcoded as a two-column 1600px partition with 112px annotation gutters and no responsive branch anywhere (it can't have one — it runs server-side too); serializeBoard hardcoding x < 800 as the column boundary; and zoom that is wheel-only with no pinch handler. The chrome is responsive; the canvas is not.

This matters to the protocol question in one specific way: a responsive board means layout becomes viewport-dependent, which means the isomorphic-pure-function guarantee breaks. If you ever ship a phone layout, you will be forced to choose between server-side layout for the prompt and client-side layout for the render — which is precisely the moment shared state stops being optional. Worth knowing that the mobile decision and the protocol decision are coupled.

The code cost is small. That is the surprise.

The board is 48% of the codebase, but the transport touches only four files, because the original author enforced the separation:

Transport-independent and untouched: actions.ts (the schema is already a valid event vocabulary), state.ts, layout.ts, bounds.ts, all 13 render components, lib/db/repo/boards.ts, and 2,681 lines of tests — which test the fold, the layout and the guard, not the wire. Six to eight files, roughly 800–1,000 lines.

The non-code cost is the real one

What human-in-the-loop should mean in tutoring

The generic framing — “approve this action before the agent does it” — is the wrong shape for a tutor. Nobody wants to approve a rectangle. The tutoring version of HITL is interruption as a pedagogical event, and there are three distinct kinds:

Where CopilotKit's components would help, and where they would fight

The verdict

Four surfaces where it matters

The token bill: richer UI means more tokens, not fewer

There is a comforting story that model prices fall roughly 50% a year, so agent products get cheaper. The story is wrong in a specific way: price per token falls while tokens per task rise, and in agentic products the second effect is at least as fast as the first. A 50% price decline is exactly cancelled by a doubling of tokens per interaction, and richer agent UIs are a machine for doubling tokens per interaction.

Three mechanisms, all visible in the systems in this course:

• State reconciliation. With no shared-state channel, you re-send the UI state to the model every turn. Learn Imagine spends 1–2k tokens per turn re-serialising the board in prose. This grows with the board, every turn, forever.
• It is uncacheable by construction. This is the sharp bit. That serialisation sits in the user message specifically so the system prefix stays cache-hot — and it changes every turn, so it can never be cached itself. Prompt caching does not rescue you here; the architecture guarantees a cache miss on exactly the tokens that grow.
• Generative UI invites more turns. A tutor that draws gets asked more questions than a tutor that types. That is the product working. It is also the bill going up.

Build vs adopt, at platform scale

The question is not “is AG-UI good.” It is “what layer are we standardising, and what is the exit.” Three separable decisions that people wrongly bundle into one:

Vendor risk, itemised

What you would need to see before standardising

1. 1.0 with a conformance suite. Today “AG-UI compliant” is untestable. A platform cannot make an untestable claim a requirement of its partners.
2. Multi-vendor governance in something more than name. A foundation, or a spec editor who does not work for the reference client's vendor.
3. A resumable-stream design that exists. It is currently a reserved capability flag. For a learning session on a phone on a train, resumption is not optional.
4. An auth and multi-tenancy story in the protocol or an authoritative pattern from it. Not a third party's security page.
5. A second reference client. One protocol, one usable client, one company is a library with extra steps.

Accessibility: a model choosing your DOM is a compliance surface

Generative UI means a language model decides, at runtime, what interface a learner sees. For a learning platform with accessibility obligations that is not a feature detail. It is a category of compliance risk that did not exist when interfaces were written by people.

Cognitive load: a tutor that draws can teach worse

The instinct that a richer interface teaches better is not supported, and in places is contradicted. Four results worth holding when someone proposes adding a panel:

And the finding that should govern the whole programme: high- versus low-fidelity simulation differs by 1–2% across 24 studies. Realism is a cost centre. The best-documented simulation win in the physics education literature happened because the simulation was less realistic than the real equipment — it made the invisible visible and deleted irrelevant variables.

The measurement that would actually settle it

The failure mode is measuring engagement and calling it learning. The relevant evidence is uncomfortable and specific: a preregistered study of ~1,000 students found that a plain AI tutor produced +48% performance while using it and −17% on the unassisted exam; a guardrailed version got +127% with the tool and a null result unassisted. The guardrails removed the harm and delivered nothing. A separate semester-long study of a RAG chatbot with ~500 undergraduates found “no statistically significant impact on any measured outcome.”

Where this lands

A protocol between an agent and a UI is a good idea whose value is almost entirely a function of how many parties have to agree. For a solo whiteboard tutor, that number is one, and the honest answer is to steal the vocabulary and skip the dependency. For a platform, that number is large and rising, and the honest answer is that you need a contract — while the leading candidate is at 0.0.58 with no conformance suite and a commercial gradient running through the middle of it.

The part that is not contingent on any of that: a student who says “wait, why?” should be able to say it. Everything else in these ten modules is an engineering trade with a defensible answer on both sides. That one isn't.