interfaces for humans
Writing

Field report No. 1: the plumbing settled, the consent layer didn't

The first monthly letter from Interfaces for Humans. A2UI hit 1.0, OpenAI's Agent Builder shuts down on November 30, half of model-generated components ship a dark pattern, and one pattern to steal for approvals.

2026-11-104 min readHarsh Patel · Interfaces for Humans

Hi, I'm Harsh. I build RUI, which checks what generated interfaces actually do, and I write the Generative UI Field Guide. Once a month I'll send you what changed in generative UI, with dates and sources, and what it means if you're shipping it. This is the first one.

The one thing that mattered

A2UI reached 1.0 on November 6. That makes three: MCP Apps went stable in January, AG-UI shipped its 1.0 spec on September 17, and now Google's declarative UI format has a stable version. The three are no longer competing. They wrap each other: AG-UI carries A2UI surfaces and MCP Apps as activity events, A2UI ships an McpApp component, and json-render ships an MCP Apps server.

So the plumbing question ("which protocol wins?") is answered. The question nobody has answered is in Incident watch below.

Shipped

  • A2UI 1.0 (Nov 6). Formerly called v0.10. client/server is now renderer/agent, bindings use @path, catalogs can be mixed, there are function calls in both directions, and there's a new MIME type, application/a2ui+json. Official SwiftUI and Jetpack Compose renderers arrived alongside. Spec
  • json-render 0.22 (Nov 4). Still pre-1.0, with a minor release roughly every month. Repo
  • AG-UI SDK 1.0.4 (Nov 5). Patch releases on top of the 1.0 spec, with interrupts and resume, subagents and a conformance corpus. Docs
  • WebMCP draft (Nov 2). A new Community Group report. The API now lives at document.modelContext, not navigator. It's still not on the W3C standards track. Draft
  • Gemini and Search started rendering MCP Apps at the end of October, so the same embedded app now runs in Claude, ChatGPT, VS Code, Microsoft 365 Copilot, Cursor and Gemini.

Broke or deprecated

This is the section to forward to whoever owns your agent code.

  • OpenAI Agent Builder shuts down on November 30. Its Evals platform goes on the same date. Move to the Agents SDK in code, or to ChatGPT Workspace Agents. ChatKit stays.
  • A2UI 1.0 moved the envelope again. Integrations lag behind: on November 8 the AG-UI A2UI middleware still prompted for v0.9, the Android Compose renderer rendered v0.9.1, and json-render's A2UI doc still showed the v0.8 shape. Check the version in every message and reject what you don't speak.
  • CopilotKit v1 hooks have been deprecated since August 20. useCopilotAction becomes useFrontendTool, useHumanInTheLoop or useRenderTool, all imported from @copilotkit/react-core/v2.
  • Vercel AI SDK 7 (June) renamed addToolResult to addToolOutput and replaced needsApproval with toolApproval. It's ESM-only and needs Node 22.
  • assistant-ui replaced makeAssistantToolUI with defineToolkit.

Your coding agent still writes the old versions of all of these by default. Pin the new names in your project rules.

Incident watch

  • Models produce dark patterns by default. Chen et al. (CHI 2026) generated 1,296 web components: 55.8% had at least one deceptive pattern, and 30.6% had two or more. Pre-checked boxes, confirm-shaming copy, buttons that make "decline" hard to find. If a model writes your checkout page, someone has to check it. Paper
  • Agents can be steered by what's on screen. DIBench (NeurIPS 2026 datasets track) injected deceptive listings and ads into mobile apps and showed they change which option an agent picks, with nothing visibly wrong in the run. Task-completion scores made the agents look more trustworthy than they were. Paper
  • The pattern behind both: checking that a flow finishes doesn't tell you what it did. In MCP Apps, asking the person before a UI-initiated tool call is still only a "MAY". And MCP's maintainers wrote in March that no major client shows tool risk annotations in approval prompts.

From the lab

  • The Generative UI Field Guide is live: 8 modules, from the raw primitives up to trust and evaluation, with dated sources throughout.
  • 9 interactive labs show what happens between the agent and the UI. Start with the consent lab: walk one tool call from streaming to approval to execution, and watch how the action's reversibility changes what the interface has to show first.
  • The pattern language collects named patterns for generated interfaces, each with where it shows up in real products.
  • In progress: a white paper proposing a Generated UI Safety Profile, a testable definition of "the person agreed before anything irreversible happened".

One pattern to steal: bind the approval to the arguments

"The user approved it" should mean they approved this exact call, not something like it. If the model changes an argument after the person clicks Approve (an amount, a recipient), the approval should stop being valid.

// Sign what the person saw. Verify it right before executing.
const sign = (call: { name: string; id: string; input: unknown }) =>
  hmac(SECRET, JSON.stringify([call.name, call.id, canonical(call.input)]));

// When showing the approval card:
card.signature = sign(call);

// Right before executing:
if (sign(callAboutToRun) !== approval.signature) throw new Error("Approval doesn't match this call");

AI SDK 7 does this for you with experimental_toolApprovalSecret. AG-UI has editedArgs, so an edited call replaces the original instead of merging with it. If you rolled your own approvals, this is the hole to check first.

That's the first one. If you're shipping something like this and want a second pair of eyes, just reply. I read every email.

— Harsh

Forwarded this? Subscribe to the field report. Every claim above is sourced in the Field Guide's research notes.