Schedule

In order to facilitate networking and business relationships at the event, you may choose to visit a third party’s booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), and details about the sponsored content or resources you interacted with. If you choose to interact with a booth or access sponsored content, you are explicitly consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

The talk introduces China Mobile’s MoMA (Multi-model and Agent Aggregation and Service Engine), an industrial-grade platform designed to support the large-scale deployment of foundation models and AI agents. MoMA provides a unified engine for model access, agent orchestration, capability aggregation, service delivery, and safety governance—serving as a comprehensive harness for operationalizing agentic safety. The presentation will cover its overall architecture and practical implementation.

The advent of the Agentic era is reshaping opensource collaboration models
and enterprise intelligence paradigms. Centered on forwardlooking insights
into the Agentnative era, this talk analyzes the core logic of how AgentNative
architecture reconstructs enterprise systems and multiagent collaboration,
and shares cuttingedge practices from the openJiuwen opensource project.
Let us jointly build an open and collaborative AgentNative era.

MCP is making it easier for AI agents to connect to tools, data, and systems. But connection is only the beginning.

As agents move from demos to real-world applications, developers face a new set of questions: How does an agent decide what to do next? How do we control tool use? How do multiple agents work together? And how do we keep these systems secure, observable, and reliable?

In this session, we’ll look beyond the protocol itself and explore the emerging open agentic stack — from open protocols such as MCP, to open-source agent frameworks and the infrastructure needed to run agents in production. We’ll also look at new examples from AWS, including Strands Agents and Kiro Crew, and how open technologies are helping developers move from connecting agents to building agentic systems they can trust.

The State and Future of A2A
As organizations build more capable agents, those agents will need a common way to communicate and work together across frameworks, vendors, and platforms. This keynote examines the current state of A2A, the problems it is designed to solve, and where the project is headed. We'll also see A2A in action through a production multi-agent system, including what happens when one of its agents is compromised.

Join us for Richard's session, Architecting Open Intelligence for the Real World: Token Efficiency, Model-Harness Co-design, and the Agent Ecosystem.

The era of brute-force "token-maxing" and isolated foundation models is giving way to a more pragmatic, ecosystem-centric approach. As we deploy AI agents into high-value, real-world scenarios, the focus must shift from raw scale to the "Intelligence-to-Efficiency Ratio." This keynote, presented by an Ant Ling foundation model practitioner and AAIF ambassador, dissects the technical imperatives of this transition. We will examine why true agentic capabilities require treating real-world business environments as the ultimate reinforcement layer, and why deep co-design among models, open protocols, and harnesses is crucial. By aligning Ant Ling's strategy of building versatile, token-efficient base models with AAIF's open infrastructure, we present a unified blueprint for Open Intelligence.

Meet AWS technical experts to discuss Kiro, AI-assisted development, and real-world development scenarios. Attendees can bring their questions, exchange ideas with our experts, and join interactive activities with giveaways.

Sponsor: AWS
Location: AWS Booth in Mandarin Hall Foyer

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

Scan the QR code to star the openJiuwen repo on GitHub/GitCode and enter Huawei's on-site prize draw for exclusive gifts!

Sponsor: Huawei
Location: Huawei Booth in Mandarin Hall Foyer

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

Enterprise adoption of the Model Context Protocol is accelerating, and MCP has become the primary way agents connect to enterprise tools and data. But MCP is only part of how agents act. Agents also run CLIs, execute Skills, and generate code that calls APIs directly. Governing MCP well matters. Governing everything else agents can do matters just as much.

Building MCP servers and writing Skills isn't particularly hard. The real challenges are deciding which actions agents are allowed to take, controlling who can take them, and proving it all later. These are architectural questions, and they need answers before agents scale across an organization.
In this workshop, we will:

1. Show how to control agent actions with policies that apply across MCP servers, CLIs, Skills, and agent-generated code — including allowlists, access control by users and groups, and human-in-the-loop approvals.
2. Explain why enterprises need managed registries for MCP servers and Skills, and how admin review and approval change the trust model.
3. Work through audit and compliance requirements: capturing complete logs of agent and tool activity, exporting to enterprise storage, and generating reports.
4. Demonstrate how to discover shadow AI — unmanaged agents, MCPs, and Skills already running in your organization — and how to block them or bring them under management.
5. Look at token usage and spend visibility by agent, user, and group.

You'll leave with a clear picture of the architectural decisions ahead of you, and a better sense of what your security team will require before signing off on scaling AI agents across your organization.

As AI agents execute untrusted LLM-generated code in production, infrastructure teams need isolation, persistent state, and elastic resources—patterns traditional Kubernetes primitives don't address well.

This session presents a practical solution using kubernetes AgentSandbox , a vendor-neutral alternative to AWS Bedrock Agents and Azure AI Agent Service.

Here we will deep dive

1. Isolation with MicroVM for untrusted code execution
2. Stateful lifecycle management with automatic hibernation/resume and persistent storage
3. Security boundaries using OPA Gatekeeper to prevent privilege escalation
4. Network isolation patterns for multi-tenant agent platforms
5. Self-service provisioning through SandboxClaim/SandboxTemplate abstractions

In order to facilitate networking and business relationships at the event, you may choose to visit a third party’s booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), and details about the sponsored content or resources you interacted with. If you choose to interact with a booth or access sponsored content, you are explicitly consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

MCP has quickly become a critical standard for connecting AI agents with tools, data, and enterprise systems. But when teams move from demos to production, a new challenge appears: the agent runtime itself becomes fragmented. A single enterprise may use Claude Code, Codex, ADK, internal runtimes, and many MCP servers at the same time. Each runtime brings its own configuration, permissions, execution lifecycle, and observability surface.

This talk shares practical lessons from building AgentRun, a Managed Agents platform built on Alibaba Cloud Function Compute. Instead of treating MCP as only a tool protocol, we use it as part of a broader production control plane: declarative agent specs, runtime adapters, MCP gateway integration, human-in-the-loop checkpoints, action audit logs, cost attribution, and serverless execution.

Attendees will learn architecture patterns for moving agent systems from "works in demo" to "can be governed in production": preserving native runtime capabilities, designing policy interception and audit trails around MCP calls, making human oversight meaningful, and using serverless for bursty agent workloads.

For more than a decade, cloud-native technologies have been the foundation for modern applications. As enterprises begin deploying autonomous and long-running agents, we're starting to ask a new question: are these abstractions still enough?

The four of us come from AWS, Huawei, Kong Inc., and Tencent. We work across different layers of the stack, from gateways and sandboxes to orchestration and scheduling, and on different open-source and cloud platforms. Despite these differences, we keep running into the same set of challenges when it comes to agentic workloads: managing long-running state, safely executing tools, observing and debugging agent behavior, defining security boundaries, supporting human-in-the-loop approvals, and coordinating multiple agents in a reliable way.

In this panel, we'll share what we're learning from building and operating agent systems at scale in practice, and debate whether enterprise agents are simply another workload on today's infrastructure or something that demands new primitives and new abstractions. It's a conversation between infrastructure builders about what it really takes to move agents from demos to production.

As MCP servers become the primary interface between Al agents and external data, they introduce a new attack surface: responses from MCP tool calls flow directly into LLM context windows, creating opportunities for indirect prompt injection and PII leakage.

This talk demonstrates an approach to securing MCP pipelines using open-source tools. We show how Meta's Prompt Guard can be utilised as a pre-processing layer to detect injection attempts in MCP server responses before they reach the LLM, and how Microsoft's Presidio can scan agent outputs for PII before they reach end users.

Attendees will see a customer support MCP server go from fully exposed to Pll-protected, and leave with a reusable pattern for their own MCP servers.

From training Hunyuan LLM with large-scale RL, to powering CodeBuddy's coding agent with 400K+ concurrent sandboxes and 5M+ creates/day, to enabling WorkBuddy's AI office automation, each workload demands a different execution environment. What unifies them is CubeSandbox, the open-source agent runtime we operate as the "hands" behind the harness "brain."

Agent harnesses are evolving from monolithic (brain+hands in one process) local-first mode to distributed (brain/session/hands separated) to managed harness. A critical enabler of this evolution is fast, hardware-isolated sandboxing for the "hands" layer, which most agent frameworks lack. We share Tencent's end-user journey scaling CubeSandbox to 600K sandbox creations/minute with P99 startup < 1s: snapshot-based instant restore for 35M hibernated sandboxes, block-level deduplicated image acceleration delivering 100K+ SWE images in < 1 minute, and CubeVS, our kernel-level eBPF isolation module.

Attendees will leave with concrete patterns for building agent-native infrastructure that is secure, elastic, and cost-efficient at millions of daily sandbox executions, plus an E2B-compatible API for drop-in adoption.

Every MCP server you install pulls in a supply chain you don't see: the npm or PyPI packages it depends on, the registry you fetched it from, and the official SDK it's built on.

Most teams never audit any of it. In 2026 that gap turned into real incidents.
– The postmark-mcp package silently BCC'd emails from 300+ organizations
– The Smithery registry breach exposed credentials for 3,243 hosted MCP apps through a single path traversal
– A design flaw in the official MCP SDKs allowed command execution over the STDIO transport, across 150 million downloads.

OWASP now lists supply chain as its own entry, MCP04, separate from tool poisoning and prompt injection.

This talk maps the MCP supply chain attack surface across its three layers: package, registry, and SDK and shows how to audit each one.

We'll cover what SBOM tooling catches, where it falls short on MCP specifically, and what a practical defense stack looks like in production.

You'll leave knowing how to audit an MCP server before you trust it.

TV apps are one of the hardest places to be productive as a developer. More than 5 platforms. Different input models. Endless focus bugs. With the rise of the AI driven development I decided to evolve my daily task of writing (and fixing) TV boilerplate and teach an AI agent to do it instead. A real coding harness with tools, skills, and a sense of how TV apps actually work.

In this talk I'll share what I learned building that harness on top of the Claude Agent SDK and Strands SDK: how to structure tools, when to use one SDK versus the other, how to keep the agent honest with SOPs and evals, and how to bridge it into Android Studio, Gradle, and platform CLIs.
Expect live demos, real failure modes, and a takeaway repo you can use as a starting point for your own domain-specific agent, TV or not.

See Huawei's AI agent app in action. Visit their booth to experience their unified platform for office work and coding!

Sponsor: Huawei
Location: Huawei Booth in Mandarin Hall Foyer

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

As MCP adoption accelerates, enterprises face challenges the protocol doesn't address: how to onboard tens of thousands of existing APIs without rewriting them, and how to govern agent access across a fragmented auth landscape.

This talk covers two interconnected problems solved in production:

1. MCP Gateway: Protocol Translation for Legacy APIs
The MCP Gateway performs protocol translation centrally — converting HTTP and Thrift interfaces into standard MCP at the network layer, with zero changes to upstream services.

1. Agent Identity: Beyond API Keys

Agents operate autonomously — without login sessions or stable credentials. Traditional API keys are a poor fit: long-lived, coarse-grained, and hard to audit. But replacing keys isn't enough — downstream services still need user identity without the agent holding raw credentials. We present a unified identity layer integrating with existing multi-dimensional auth systems (user, merchant, and employee-facing), so every agent call is identity-aware and policy-enforced.

We share what worked, what didn't, and the hard lessons from running this in production.

Most voice agents work well when conversations follow a script: the user speaks, the model thinks, and the agent replies. But real conversations are messy. Users interrupt, pause mid-thought, correct themselves, talk over the agent, or change direction before the system has finished responding.

This talk argues that many voice agents break because they are designed like linear request-response pipelines, while real conversation is interruptible and stateful. Interruption handling should not be treated as an edge case. It should be designed as a first-class system behavior.

Rather than covering the full voice AI stack, this session focuses on one failure point: what happens when a user interrupts while the agent is responding, updating state, or preparing a tool action. I will walk through practical patterns for turn-taking, barge-in handling, partial transcript updates, stopping or revising ongoing responses, and recovering state after interruptions.

I will also connect these ideas to agentic systems and MCP-style tool use, where interruptions can affect tool calls, API actions, and the agent’s understanding of the user’s intent.

Does useful agentic AI still require a frontier model and a datacenter-sized budget? Ling 3.0 Tiny challenges that assumption: it is a 7.9-billion-parameter Mixture-of-Experts model that activates only 1.3 billion parameters per token and is designed for reasoning and agentic workloads on local hardware.

In this fireside chat moderated by Richard Bian, Head of Product and Operations of Ant Ling, AAIF CTO and co-founder Manik Surtani joins a researcher building Ling 3.0 Tiny to explore what happens when capable models become small enough to run close to the user. They will examine how model efficiency, open protocols, and neutral governance fit together; when local agents make sense; how applications can move between local, open-weight, and frontier models; and what must improve before small-model agents can be trusted with real work.

Needless to say the recent advances in autonomous agents like OpenClaw & Hermes Agent. Agent frameworks have made developer life easier with tool calling, skills & MCPs adding scaffold and orchestration harness. Almost all agentic architecture layers are prompt driven. Prompts are a great way of interacting with LLMs, but often leads to unreliable outputs. Tuning prompts is quite a manual intrinsic work, given the non-deterministic nature of LLMs.

Hence the next wave of prompting is through reflection driven methodologies that don’t essentially need explicitly RL or fine tuning but can still invoke the self evolving nature in agents. Can we build a system that learns through its own mistakes and makes it better at each turn?

We essentially need to optimize and quantify which change leads to affecting the overall system. One way to achieve this is through text space optimization by refining the behavioral patterns, validation and feedback loops via evaluation structures.

Working in payment and auth integrations teaches you fast that "runs in a sandbox" isn't the same as "safe." When MCP Apps landed, letting servers render interactive HTML UIs right inside the chat, it needed stress-testing the same way any new payment flow does: assume the server is hostile, assume the channel is being watched, and trace exactly where trust is handed over versus just assumed.
This talk walks through three ways it breaks, with live demos. First, postMessage trust, what happens when origin validation is wrong or missing. Second, tool poisoning through the UI, where instructions the user never sees quietly end up in the model's context. Third, a confused-deputy case where a UI-triggered tool call uses more of the host's access than the user ever agreed to.
For each one, the failure gets mapped against what the spec says should stop it, CSP, consent prompts, auditable JSON-RPC, showing honestly what holds and what you as the implementer are still on the hook for. Leave with a checklist to run before shipping any MCP App.

An agent run can finish successfully and still be extremely inefficient. While debugging a DeerFlow Deep Research task, we found that a failed tool call echoed a large payload into the conversation state. Input tokens grew from 29K to 71K across consecutive model calls, causing expensive retries and unpredictable execution costs.
To diagnose such problems, we built an intent-aware observability system for DeerFlow. It correlates LLM interactions, MCP and internal tool calls, errors, retries, latency, token usage, and LangGraph checkpoints. The agent declares whether it intends to explore, decide, act, verify, retry, or produce, while a human or observer model evaluates its actual behavior. A semantic trajectory dashboard exposes divergence between declared intent and observed actions, and checkpoint replay helps developers reproduce Agent Harness defects.
This talk presents the motivating failure, system architecture, implementation lessons, and a live demonstration. Attendees will learn how semantic trajectories can reveal inefficient exploration and tool usage that conventional traces often miss.

As MCP servers evolve from simple tool gateways into long-running backends for agentic systems, protocol compliance alone is no longer enough. Servers need a durable, inspectable way to manage context across requests, tools, resources, and sessions. Without this, MCP implementations struggle with debugging, replayability, security boundaries, and consistent behavior over time.

This talk focuses on MCP server internals and shows how adding a context graph inside the server improves reliability and operability. We will explore how graph-based context models capture relationships between clients, prompts, tool calls, resources, policies, and outcomes, turning transient MCP interactions into structured, queryable state. The session covers practical patterns for mapping MCP concepts to graphs and using them to support traceability, incremental context enrichment, permission enforcement, and safe multi-tenant operation.

Attendees will leave with concrete guidance for building MCP servers that use context graphs to power observability, evaluation, and security while remaining fully aligned with the MCP protocol.

As AI agents evolve from single-task execution to orchestrating complex enterprise workflows, monolithic agent architectures quickly hit scalability bottlenecks, state bloat, and maintainability limits. How can we break down silos and enable seamless collaboration across heterogeneous frameworks and organizational boundaries?
This session delivers an architectural deep dive into the Agent2Agent (A2A) Protocol, an open standard for multi-agent interoperability. We will explore key primitives including dynamic capability discovery via Agent Cards, asynchronous long-running task orchestration across the Task Lifecycle, and a clear architectural comparison between A2A (horizontal agent-to-agent collaboration) and MCP (vertical agent-to-tool integration). Through real-world deployment patterns and live demos, you'll learn how to leverage A2A to build a resilient, decoupled, and enterprise-grade Agent Mesh.

Anthropic reports that an agent with 1,000 MCP tools spends ~500K tokens on tool prompts alone. Embedding methods miss tools relevant to the query but not semantically similar, capping recall. We share a hierarchical progressive disclosure approach and its implementation, the A2X Registry.

An LLM auto-builds and searches a taxonomy over service descriptions: it reads only highly relevant options, prunes irrelevant branches early, and keeps token cost close to O(log N). On 1,839 tools it cuts cost ~25x (193K to 7K) and lifts recall over SOTA embeddings by 15+ percentage points.

We share three challenges that surface during auto-building the taxonomy, and their solutions. Completeness: how to cover every service when the LLM's limited context prevents reading all descriptions in one pass. Mutual exclusivity: how to keep the LLM from mixing classification axes inside one taxonomy, weakening pruning. Domain expertise: how to keep query-service matching accurate when descriptions are distilled into a taxonomy, since the matcher would otherwise rely on pre-training and confuse siblings.

Code: https://gitcode.com/openJiuwen/agent-protocol

As AI applications increasingly rely on multiple models with different strengths, latency profiles, and costs, choosing the right model for each task is becoming an important part of agent system design.

This session will explore how dynamic model routing works across agent workloads, including the signals that inform routing decisions, the trade-offs between quality, latency, and cost, and practical considerations for coding and agent workflows.

Your AI agent returns the wrong answer not because the model hallucinated, but because it retrieved stale data from an embedding pipeline that has not caught up with recent writes. A user asks for “latest orders,” but the answer reflects yesterday’s state. The system is working as designed, but still wrong.

This is an architecture problem.

Retrieval-Augmented Generation works well for unstructured data, but struggles with frequently changing relational data. A 2025 LlamaIndex survey found that 67 percent of enterprise teams hit accuracy issues with RAG on complex queries, especially when applied to structured, frequently updated data.

The Model Context Protocol offers a different approach. Agents call typed tools backed by SQL queries and receive deterministic, real-time results. The failure modes shift from retrieval quality to API design and query safety.

In this talk, you will learn how to design MCP tools, structure agent-friendly schemas, and handle production concerns like retries and connection limits. A live demo shows the full flow from prompt to SQL with tracing.

The session ends with a simple decision framework based on data freshness and query correctness.

AI Agent 的工程范式正在持续演进。从 Prompt Engineering 到 Context Engineering，再到当下成为主流的 Harness Engineering，单智能体的"驾驭与治理"已经形成了相对清晰的方法论体系。

但当任务复杂度跨越单 Agent 的能力边界，需要多个智能体分工协作来完成时，原有的工程方法论便不再适用。如何让多个智能体自主分工、高效沟通、无缝协作，成为下一阶段的核心命题。我们将这一新阶段称为 Coordination Engineering——它不是对 Harness Engineering 的替代，而是其在团队协作维度上的自然延伸。

本次演讲将以华为支持的 openJiuwen 开源社区的实践为切入点，分享对这一范式的思考：从 JiuwenClaw AgentTeam 的多智能体协同机制，到业界首个面向多 Agent 协作的标准化能力包规范 Team Skills，探讨多智能体协同从"运行时机制"到"协作经验沉淀"的完整工程闭环。

内容面向关注 Agent 架构设计、多 Agent 系统构建以及 AI 工程范式演进的开发者与技术决策者。

This talk uses Humanize as an example of a harness for long-running coding tasks. Instead of relying on one prompt, Humanize uses Ralph-loops, review gates, artifacts, and dynamic workflow orchestration to make coding work iterative and reviewable. This helps keep implementation quality high and reduces goal drift.

Building on that idea, the talk looks at Agentic OS runtime design for mission-critical systems. The core proposal is to build OS-ready flow primitives and an Agent runtime that can manage OS features, app and process execution, device and tool permissions, runtime state, fault handling, human approval, and audit. In aerospace, onboard space computing, automotive, industrial control, robotics, and embodied AI, this runtime should make agents execute critical tasks more predictably across LLMs with different capability levels.

Humanize Repo: https://github.com/PolyArch/humanize

See Kiro Crew in action through a lightning talk and live demo. Learn how this open-source workspace helps AI agents work across sessions, retain context, and handle long-running development tasks while keeping humans in control. Stay for Q&A with AWS technical experts.

Sponsor: AWS
Location: AWS Booth in Mandarin Hall Foyer

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

Continue the conversation with Tao Bingzhe of StepFun following his session on dynamic model routing. Bring a real agent workload or routing question, join our live routing challenge, and explore how production systems balance quality, latency, cost, and risk.
Participants will have a chance to win a Voice Vibe Coding mini keyboard.

Sponsor: StepFun
Location: Stepfun booth in Mandarin Hall Foyer

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies.

Where the global open agent-credential stack is heading, and what cross-border interop would take.

Every "agent that verifies you" or "agent that pays" demo skips the hard part: how does an AI agent request a real, government- or bank-grade credential from your device, on any phone, any wallet, Android or iOS, and prove who authorized it?

We'll run the full chain live. An MCP server renders a verifier inside Claude and ChatGPT; the W3C Digital Credentials API requests a credential over OpenID4VP; FIDO caBLE carries it cross-device to your phone; the wallet returns an mdoc or SD-JWT credential held in hardware (StrongBox, TEE, Secure Enclave); an AP2 mandate binds your intent.

Identity is the headline, age, membership, passport, healthcare, with payments as one example. And it's not a stage trick: it's an open-source Digital Credential MCP server, soon to be released and donated, that you can clone, point at your own credential, and ship. Built on open standards, across every platform, with UCP & ACP conformance on the roadmap.

Here are some examples of the demos we're planning to showcase: https://github.com/dzuluaga/mcp-apps-shopping-demo

As LLMs evolve into Multi-Agent Systems, cloud-only inference faces high latency and privacy risks, while on-device execution suffers from compute constraints. This session introduces a production-grade "Device-Edge-Cloud" collaborative AI inference architecture for scalable agentic workloads. We discuss functional partitioning: on-device NPUs for intent filtration, edge nodes for local RAG/PII sanitization, and cloud for heavy reasoning.
We deep-dive into three critical engineering implementations: Heterogeneous Compute Synergy: Runtime computation graph partitioning and weight split-execution across mixed hardware (Xeon, Gaudi, and NPUs); Network-Aware Scheduling: A telemetry-driven engine enabling microsecond-level execution shifting between edge and cloud based on real-time QoS; Disconnected Self-Healing: Utilizing pre-staged localized fallback inference with OTA delta-weight patching to guarantee edge availability during network failures.
Finally we will introduce that the above architecture is evolved to be the base of Agent OS in the Open Agentic AI Foundation for references.

Blade AI is the intelligent agent layer in the ChaosBlade ecosystem. Built on LangGraph, it utilizes a multi-stage state machine to reduce fault simulation costs from 20-30 minutes to just one sentence + 30 seconds.

This presentation covers:
– Natural Language Driven: Agent proactively investigates and clarifies intent, not just simple questioning.
– Multi-layered Security Depth: Rule engine deterministic verification + human-in-the-loop confirmation gate.
– Two-layer Effect Verification: Programmatic confirmation + LLM semantic baseline comparison.
– Complete Recovery Closed Loop: Intelligent routing matches destruction paths, recovery state is tiered.

• FCAT Adaptive: Target health pre-check, automatically adjusts injection parameters.

• Replanning: Automatic rollback in case of execution errors, multi-round tracing.

• Plugin-based Expansion: Driven by SKILL.md, 19 built-in scenarios with 500ms hot reloading.

• Cross-process Architecture: TUI with zero startup burden, persistent checkpoint recovery.

Open Source Address: github.com/chaosblade-io/chaosblade

AI systems need more than intelligence; they need context that persists. Without it, even strong models can misinterpret information, lose decision rationale, or repeat the same mistakes. Context Graphs have emerged as a practical pattern for agentic AI: a living graph that captures not only what was retrieved or known, but how context led to actions through tool calls, constraints, policies, and outcomes, stitched across entities and time so precedent becomes searchable.

This talk explores context engineering as the discipline of designing that context layer, and shows how context graphs complement retrieval by enabling multi-hop, structured context assembly (building on GraphRAG-style hierarchical summaries) while improving explainability and evaluation. Attendees will leave with a practical understanding of how to build context pipelines that combine contextual retrieval with persistent memory and provenance, and why context graphs are becoming central to trustworthy, enterprise-ready AI systems.