1. 🤖 Coding Agents

This layer has three tiers now. The gap between tier 1 and tier 2 is real, and tier 3 is growing fast.

Tier 1 — Dominant

These are the tools most professional developers use daily. The SWE-bench scores tell part of the story; the real picture is more nuanced.

What changed this year: Claude Code went from research preview to $2.5B+ run-rate. Cursor crossed 1M paid users. GitHub Copilot switched to credit-based billing (June 2026) and upset a lot of enterprise customers. Windsurf was acquired by Cognition, raising questions about its roadmap independence.

Tier 2 — Powerful & Open

These are the open-source tools that serious developers swear by. They trade polish for control.

The trend here: BYOK (bring your own key) is standard now. Opaque SaaS-only subscriptions are dying. Developers want to own their model relationship and swap providers freely.

Tier 3 — Cloud Autonomous

These run in the cloud and operate on their own. Different value proposition entirely — you delegate, not pair-program.

2. 📊 Observability & Monitoring

This layer is fragmenting into three sub-categories: pure observability, gateway+observability convergence, and the legacy tools that are being left behind.

Core Players

The key tension here: LangFuse vs LangSmith is becoming the main OSS-vs-closed debate. LangFuse wins on portability and self-hosting; LangSmith wins on LangChain ergonomics. Phoenix has the best OTel story but the ELv2 license is a procurement headache for some enterprises.

Gateway + Observability Convergence

A new pattern: tools that handle both routing AND tracing in one stack.

⚠️ Deprecated / Avoid for New Projects

3. 🔗 Agent Orchestration Frameworks

This layer has seen the most dramatic change in 2026. One of the Big Three is effectively dead, and the provider-native SDKs are maturing fast.

The Big Three

What happened to AutoGen: Microsoft merged it into Microsoft Agent Framework (MAF) — a combined runtime with Semantic Kernel. Python + C# parity, durability, governance features. ~10K ★. The community fork lives on at AG2 (ag2.ai).

Provider-Native Agent SDKs

The cloud providers are building their own. These are getting good.

Key trend: All three now support MCP. Google is pushing A2A for cross-vendor agent discovery. OpenAI has the best sandbox story. Anthropic has the deepest OS-level tools.

Rising / Niche Frameworks

4. 🛡️ Gateway & Guardrails

Two distinct sub-layers that are increasingly being sold together.

LLM Gateways

Supply chain alert: LiteLLM v1.82.7/1.82.8 on PyPI contained credential-stealing malware in March 2026 (TeamPCP attack). Live for ~3 hours. NHS issued a national alert. Official Docker images were unaffected. Pin versions and prefer Docker.

Guardrails / Safety

Important architectural distinction from Microsoft's own docs: Guardrails validate LLM outputs. Agent governance controls agent actions (tool calls, identity, sandboxing, crypto auth). These are complementary, not competing.

5. 🔀 A New Category Forming: Active Agent Runtime

There's a pattern visible across all four layers above. Every tool either watches or executes. None of them intervene.

The missing layer: something that watches the agent in real time, detects when it's going off the rails, and intervenes autonomously.

Enter Active Agent Runtimes

A few projects are starting to fill this gap:

What makes this different from observability: Observability tells you "cost spiked at 2:34 PM." An active runtime detects the spike at turn 3 and swaps the model — you save the money before the spike happens.

What makes this different from guardrails: Guardrails check outputs. An active runtime understands agent behavior — loops, deadlocks, context degradation, goal drift, model mismatch. These aren't output problems; they're behavioral problems.

6. 🏢 The Complete Stack — What Production Teams Actually Use

Based on 2026 surveys and public engineering blogs, here's what a typical production stack looks like:

┌──────────────────────────────────────────────────────────────┐
│ TYPICAL PRODUCTION STACK (Mid-2026)                          │
│                                                              │
│  IDE/CLI Agent          Observability          Gateway       │
│  ─────────────          ─────────────          ───────       │
│  Cursor + Claude Code   LangFuse               Portkey       │
│  (daily flow + deep     (traces, evals,        (routing,     │
│   architectural work)    prompt management)     fallback)     │
│                                                              │
│  Orchestration          Guardrails              CI/CD        │
│  ─────────────          ──────────              ─────        │
│  LangGraph or CrewAI    NeMo + Guardrails AI    GitHub       │
│  (multi-agent flows)    (output validation)      Actions      │
│                                                              │
│  Model Access           Sandbox                              │
│  ────────────           ───────                              │
│  OpenRouter or LiteLLM  Docker / E2B / Modal                 │
│  (multi-model routing)  (safe code execution)                │
│                                                              │
│  Active Runtime (emerging)                                   │
│  ─────────────────────────                                   │
│  HarnessForge or MSFT Agent Gov                              │
│  (real-time detection + intervention)                        │
└──────────────────────────────────────────────────────────────┘

No single tool wins. The norm is 2–3 tools per layer, chosen based on team size, compliance requirements, and framework preferences.

7. ⚡ Market Shifts — What Changed in 2026

8. 🔮 What I'm Watching

Short term (next 6 months):

• Who acquires LangFuse? It's the biggest independent OSS observability tool left
• Will OpenAI release a coding agent (not just an SDK)?
• How does A2A adoption play out vs MCP for agent-to-agent communication?

Medium term (12–18 months):

• The active runtime category either takes off or gets absorbed by observability tools adding "actions"
• Framework consolidation — there are too many orchestration frameworks; 3–4 will survive
• First major AI agent-related security incident that drives regulation

Long term (2–3 years):

• AI governance becomes a standard part of the SDLC, like SAST and dependency scanning are today
• The boundary between coding agents, observability, and orchestration blurs
• "AI safety engineer" becomes a standard job title

Summary — The Layers at a Glance

This is a point-in-time snapshot. The market is moving fast. I'll update this quarterly.

Disclosure: I'm the author of HarnessForge, one of the tools mentioned in the Active Runtime section. Everything else in this survey is based on publicly available data, vendor documentation, and community analysis.

Found a tool I missed? Drop it in the comments.