Two things moved the ground under a solo founder's stack this week: the protocol that connects your agent to its tools is going stateless, and a jurisdiction of hundreds of millions just deleted persistent-memory agents by law. The throughline is portability — the systems that survive a spec change or a regulator are the ones that don't assume the platform owns your session or your users' memory. All four items below are verified, dated, and each carries the one line that matters for a team of one.
1. MCP goes stateless — the 2026-07-28 release candidate is out, spec locks July 28#
The Model Context Protocol published its 2026-07-28 specification release candidate, and the headline is that MCP is now stateless at the protocol layer. The Mcp-Session-Id header and the session it implied are removed, and so is the initialize/initialized handshake. Protocol version, client identity, and negotiated capabilities now ride inside the _meta object on each JSON-RPC request, and a new server/discover method replaces the old capability dance with a stateless, cacheable call. The final specification publishes July 28, 2026 — this is the window to validate against.
For authorization, six proposals harden the spec to align more closely with how OAuth 2.0 and OpenID Connect are deployed in practice — including validating the iss parameter on authorization responses per RFC 9207 and declaring an OpenID Connect application_type at registration. (Note the primary spec references OAuth 2.0 and OIDC specifically, not "OAuth 2.1.")
What it means: A remote MCP server that used to need sticky sessions, a shared session store, and gateway-level packet inspection can now sit behind a plain round-robin load balancer — the cheapest, most boring infrastructure a bootstrapped founder can run. Read the RC now and start your client migration before the July 28 lock; we wrote the step-by-step in how to migrate your MCP client to the 2026-07-28 stateless spec.
2. China's persona law took effect July 15 — Doubao and Qwen pulled their agents#
China's Interim Measures for the Administration of AI Anthropomorphic Interactive Services — co-issued in April by the Cyberspace Administration of China and four partner agencies — took effect July 15, 2026. We flagged this as tomorrow's shutdown in last week's wire; it is now live. Neither ByteDance's Doubao nor Alibaba's Qwen could make their consumer custom-agent architecture compliant in time, so both switched the features off.
The data handling diverges sharply. Doubao gives users read-only access to their agent configs and chat histories until October 15, 2026, after which the data is handled under ByteDance's standard privacy policy. Qwen has announced permanent deletion with no grace period and no migration path. The regulation's anti-addiction, mandatory-notification, and instant-exit requirements are architecturally incompatible with agents built to hold a persistent emotional relationship — which is why the answer was to shut them down, not retrofit them.
What it means: Treat this as a portability fire drill for your own product. If a platform can wipe your users' agent memory on a regulator's clock, "the model owns the memory" is a liability, not a feature — export paths and user-owned memory stores stop being optional the moment a jurisdiction you sell into writes a rule. The founder checklist is in what founders should do now that it's in effect.
3. Microsoft Agent Framework 1.11 — your tool catalog stops taxing every turn#
Microsoft shipped Agent Framework python-1.11.0 on July 10, 2026, and the headline for anyone running a large tool set is progressive MCP disclosure: an agent can now discover, load, and unload MCP tool schemas on demand within a single run, while the allowed_tools boundary stays intact. The release also strengthens AG-UI and provider support and adds session and skills-caching improvements.
What it means: Every tool schema you expose is tokens the model re-reads on every turn. Progressive disclosure lets you register a hundred tools and only pay for the handful in play right now — the same lever that makes big MCP catalogs affordable instead of context-bloating. Even if you're not on Agent Framework, this is the pattern to copy; we walked through the implementation in progressive MCP disclosure.
4. CrewAI 1.14.7 — bring your own memory, knowledge, and RAG backend#
CrewAI 1.14.7, released June 11, 2026, added pluggable default backends for memory, knowledge, RAG, and flow, plus a Chat API for conversational flows. It also surfaced real finish_reason, sampling params, and response.id on LLM events and added a native Snowflake Cortex provider.
What it means: Pluggable backends mean you're no longer married to the framework's default storage and retrieval — you can point memory and knowledge at the vector store, database, or RAG stack you already run and pay for. For a solo builder, that's the difference between a framework you rent and one you own the guts of. If you started on CrewAI defaults, this is the release to audit where your agent's memory actually lives — and, per item 2, whether you could export it tomorrow.
Do this before Friday: read the MCP RC and scope your client migration, add an export path to wherever your agents keep memory, and check whether your framework lets you swap in your own backend. Three moves; every one of them got more urgent this week.
