Context Is Code: A Tour of APM and AgentRC<\/title>\n<meta name=\"description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Context Is Code: A Tour of APM and AgentRC\" \/>\n<meta property=\"og:description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:site_name\" content=\"foojay\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-05T08:35:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-05T10:00:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"384\" \/>\n\t<meta property=\"og:image:height\" content=\"384\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Soham Dasgupta\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Soham Dasgupta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"author\":{\"name\":\"Soham Dasgupta\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\"},\"headline\":\"Context Is Code: A Tour of APM and AgentRC\",\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"wordCount\":1434,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"keywords\":[\"Agent Package Manager\",\"APM\",\"claude code\",\"GitHub Copilot\"],\"articleSection\":[\"Developer Tools\",\"GenAI\",\"Library\",\"LLM\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"name\":\"Context Is Code: A Tour of APM and AgentRC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\"},\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"description\":\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/foojay.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Context Is Code: A Tour of APM and AgentRC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"name\":\"foojay\",\"description\":\"a place for friends of OpenJDK\",\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/foojay.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\",\"name\":\"foojay\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"width\":512,\"height\":512,\"caption\":\"foojay\"},\"image\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/foojay2020\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\",\"name\":\"Soham Dasgupta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"caption\":\"Soham Dasgupta\"},\"description\":\"Technology enthusiast | Agentic AI | Architect | Programmer | Cloud Native | Blogger | Speaker\",\"sameAs\":[\"https:\\\/\\\/sohamdasgupta.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/dasguptasoham\\\/\",\"https:\\\/\\\/x.com\\\/iamsoham\"],\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/author\\\/soham-dasgupta\\\/\"}]}<\/script>\n","yoast_head_json":{"title":"Context Is Code: A Tour of APM and AgentRC","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_locale":"en_US","og_type":"article","og_title":"Context Is Code: A Tour of APM and AgentRC","og_description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","og_url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_site_name":"foojay","article_published_time":"2026-06-05T08:35:05+00:00","article_modified_time":"2026-06-05T10:00:58+00:00","og_image":[{"width":384,"height":384,"url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png","type":"image\/png"}],"author":"Soham Dasgupta","twitter_misc":{"Written by":"Soham Dasgupta","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#article","isPartOf":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"author":{"name":"Soham Dasgupta","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33"},"headline":"Context Is Code: A Tour of APM and AgentRC","datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","mainEntityOfPage":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"wordCount":1434,"commentCount":0,"publisher":{"@id":"https:\/\/foojay.io\/#organization"},"keywords":["Agent Package Manager","APM","claude code","GitHub Copilot"],"articleSection":["Developer Tools","GenAI","Library","LLM"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","name":"Context Is Code: A Tour of APM and AgentRC","isPartOf":{"@id":"https:\/\/foojay.io\/#website"},"datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","breadcrumb":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/foojay.io\/"},{"@type":"ListItem","position":2,"name":"Context Is Code: A Tour of APM and AgentRC"}]},{"@type":"WebSite","@id":"https:\/\/foojay.io\/#website","url":"https:\/\/foojay.io\/","name":"foojay","description":"a place for friends of OpenJDK","publisher":{"@id":"https:\/\/foojay.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/foojay.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/foojay.io\/#organization","name":"foojay","url":"https:\/\/foojay.io\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/","url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","width":512,"height":512,"caption":"foojay"},"image":{"@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/foojay2020"]},{"@type":"Person","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33","name":"Soham Dasgupta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","url":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","caption":"Soham Dasgupta"},"description":"Technology enthusiast | Agentic AI | Architect | Programmer | Cloud Native | Blogger | Speaker","sameAs":["https:\/\/sohamdasgupta.com","https:\/\/www.linkedin.com\/in\/dasguptasoham\/","https:\/\/x.com\/iamsoham"],"url":"https:\/\/foojay.io\/today\/author\/soham-dasgupta\/"}]}},"_links":{"self":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/users\/280"}],"replies":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/comments?post=124116"}],"version-history":[{"count":0,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116\/revisions"}],"wp:attachment":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/media?parent=124116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/categories?post=124116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/tags?post=124116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Primitive<\/th>	What it is<\/th><\/tr><\/thead>
Instructions<\/strong><\/td>	Repo conventions, architecture notes, do\/don't rules. Compose into `AGENTS.md<\/code> \/ copilot-instructions.md<\/code>.<\/td><\/tr>`
Skills<\/strong><\/td>	Reusable capabilities in the Agent Skills format. Drop-in from `anthropics\/skills<\/code> or any repo.<\/td><\/tr>`
Prompts<\/strong><\/td>	Slash-command prompts that work across harnesses.<\/td><\/tr>
Agents<\/strong><\/td>	Single-purpose agent primitives, e.g. `api-architect.agent.md<\/code>.<\/td><\/tr>`
Plugins<\/strong><\/td>	Author once, export a standard `plugin.json<\/code> for Copilot \/ Claude \/ Cursor.<\/td><\/tr>`
MCP servers<\/strong><\/td>	Declared in the same manifest. Policy-checked before they touch disk.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n This is the part most people underrate. APM isn't only about instructions. It's a single manifest for all<\/em> the moving parts an agent needs.<\/p>\n\n\n\n \n\n\n\n 5. The five commands you'll actually use<\/h2>\n\n\n\n apm install # resolve manifest, scan, deploy primitives, write lockfile\napm install <pkg> # add a package to apm.yml and install it\napm compile -t copilot # render root context files (AGENTS.md \/ copilot-instructions.md)\napm audit # security + policy checks; SARIF output for CI\napm pack # bundle your package for distribution<\/pre>\n\n\n\n \n\n\n\n 6. One manifest, every harness<\/h2>\n\n\n\n The same packages render to whatever your team uses:<\/p>\n\n\n\n apm.yml → apm compile → GitHub Copilot · Claude Code · Cursor\n OpenCode · Codex · Gemini · Windsurf<\/pre>\n\n\n\n For Copilot specifically, `apm install<\/code> is zero-config<\/strong>: it writes the files that VS Code and GitHub Copilot already expect (.github\/instructions\/<\/code>, .github\/prompts\/<\/code>, .vscode\/mcp.json<\/code>), and apm compile -t copilot<\/code> adds the .github\/copilot-instructions.md<\/code> rollup. APM itself dogfoods this on its own repo.<\/p>\n\n\n\n` `For other harnesses, apm compile<\/code> emits AGENTS.md<\/code> in the repo root (the open agents.md<\/a> standard) plus the harness-specific rules trees. So if a teammate uses Claude Code, Cursor, Codex, Gemini, OpenCode, or Windsurf, their agent is configured from the same manifest. It's your edge against agent vendor lock-in: context survives the harness.<\/strong><\/p>\n\n\n\n` \n\n\n\n7. Plugins and marketplaces: bundle a workflow, not a file<\/h2>\n\n\n\nA single skill or instruction file isn't a workflow. Real capabilities, code review, release notes, incident triage, need several primitives bundled together<\/em>.<\/p>\n\n\n\n Take a Code Review plugin:<\/p>\n\n\n\n\nAn instructions<\/strong> file (the review rubric)<\/li>\n\n\n\n An agent<\/strong> file (activates on \/review<\/code>)<\/li>\n\n\n\n Two skills<\/strong> (summarise diff, find missing tests)<\/li>\n\n\n\nOne MCP server<\/strong> (post PR comments)<\/li>\n<\/ul>\n\n\n\nWithout a plugin, every developer wires four artefacts by hand and hopes the versions match. With an APM plugin:<\/p>\n\n\n\n$ apm install acme\/code-review<\/pre>\n\n\n\nOne command drops all four primitives into the right places under .github\/<\/code> and .vscode\/<\/code> and pins them in apm.lock.yaml<\/code>. Plugins can depend on other APM packages (transitive deps, just like npm). And apm pack<\/code> exports a standard plugin.json<\/code> bundle that Copilot, Claude, and Cursor can all consume.<\/p>\n\n\n\n Marketplaces are the curated layer on top: install from a registry in one command, deployed across all targets, pinned in the lockfile. apm pack<\/code> emits a marketplace.json<\/code> alongside the bundle when declared.<\/p>\n\n\n\n \n\n\n\n8. Security: treat prompts like the programs they are<\/h2>\n\n\n\nThe honest pitch on security is this: agent context is<\/em> executable in effect, and the integrity story has to match.<\/p>\n\n\n\n\nHidden Unicode scanning.<\/strong> Every install blocks bidi and zero-width characters that can hijack agent behaviour. This is a real, demonstrated prompt-injection vector.<\/li>\n\n\n\n Lockfile integrity.<\/strong> apm.lock.yaml<\/code> records SHA-256 per file. Bundles embed it too, so installing a packaged bundle rehashes every file before writing.<\/li>\n\n\n\n MCP trust gating.<\/strong> Transitive MCP servers don't sneak in — you re-declare or explicitly trust them.<\/li>\n\n\n\n apm audit<\/code><\/strong> for on-demand scans, CI-friendly with SARIF output.<\/li>\n\n\n\n Drift detection<\/strong> so generated files can't diverge silently from the manifest.<\/li>\n\n\n\nCI\/CD ready<\/strong> via the official microsoft\/apm-action<\/code> for GitHub Actions.<\/li>\n<\/ul>\n\n\n\nOne caveat until today(5 June 2026): package signing is not yet implemented<\/strong>. The integrity story today is content-hash + lockfile + source allow-listing. But this is already much better than what most teams have.<\/p>\n\n\n\n \n\n\n\n9. Governance: one policy file, tighten-only inheritance<\/h2>\n\n\n\napm-policy.yml<\/code> lets enterprises set the ceiling, orgs tighten further, and repos tighten further still. Each layer can only tighten<\/em>, never loosen<\/em>. The math: allow lists intersect, deny lists union, max_depth<\/code> takes the minimum, and enforcement escalates off < warn < block<\/code>.<\/p>\n\n\n\n # apm-policy.yml\nallow:\n sources:\n - github.com\/microsoft\/\n - github.com\/anthropics\/\n - dev.azure.com\/contoso\/*\n mcp:\n - io.github.github\/github-mcp-server\n - io.github.microsoft\/playwright-mcp\n\ndeny:\n primitives:\n - hooks # no shell hooks org-wide\n\nrequire:\n signed: true\n lockfile: present<\/pre>\n\n\n\nDrop the file at \/.github\/apm-policy.yml<\/code> and every repo in the org picks it up, no per-repo wiring. The CI gate is apm audit --ci --policy org<\/code>, which runs all checks and renders findings on the PR.<\/p>\n\n\n\n For incident response there are two documented bypass surfaces — apm install --no-policy<\/code> and APM_POLICY_DISABLE=1<\/code> — and they're loudly logged. Use them sparingly.<\/p>\n\n\n\n The architects' takeaway: you can roll APM out org-wide without losing control over what agents load.<\/strong><\/p>\n\n\n\n \n\n\n\n10. AgentRC: context engineering, automated<\/h2>\n\n\n\nSo APM distributes<\/em> agent context. But where does the content come from in the first place? That's where AgentRC<\/a> comes in.<\/p>\n\n\n\n \nNote:<\/strong> AgentRC is currently marked experimental<\/strong> in its README. Pilot it on a non-critical repo and pin a commit if you adopt it today.<\/p>\n<\/blockquote>\n\n\n\n AgentRC is a CLI + VS Code extension that reads your codebase and generates the files an agent needs to be useful: instructions, MCP config, VS Code settings, and evals<\/em>. The three commands map cleanly to a lifecycle:<\/p>\n\n\n\n$ npx github:microsoft\/agentrc readiness\nScoring 9 pillars · 5-level maturity model\n\n Build & test L4 ████████░░\n Linting L2 ████░░░░░░\n Architecture docs L1 ██░░░░░░░░\n MCP configuration L0 ░░░░░░░░░░\n\n$ npx github:microsoft\/agentrc instructions\n→ reading repo, generating .github\/copilot-instructions.md\n→ generating .vscode\/mcp.json\n→ generating agentrc.eval.json\n✓ done\n\n$ npx github:microsoft\/agentrc eval\n→ running 12 evals against generated instructions\n✓ 11 passed, 1 regressed<\/pre>\n\n\n\nThree things in one: measure<\/strong> (readiness<\/code>), generate<\/strong> (instructions<\/code>), maintain<\/strong> (eval<\/code>).<\/p>\n\n\n\n The eval angle is the one most people miss. Instructions only matter if they actually improve agent responses. AgentRC measures that and can fail CI if context regresses. It's the missing feedback loop in most teams' agent setup.<\/p>\n\n\n\n \n\n\n\n11. How AgentRC + APM compose<\/h2>\n\n\n\nYour repo → agentrc (measure · generate · eval)\n → .instructions.md · mcp.json · eval.json\n → apm.yml (pack · publish)\n → org-wide apm install<\/pre>\n\n\n\nThe crucial compatibility point: the .instructions.md<\/code> format is shared by both tools.<\/strong> No conversion when moving content from AgentRC into an APM package.<\/p>\n\n\n\n Three personas, three flows:<\/p>\n\n\n\n\nIn your project (solo dev).<\/strong> agentrc init<\/code> generates your baseline, then apm install org\/standards<\/code> pulls in shared org packages on top.<\/li>\n\n\n\n For your team (team lead).<\/strong> Package your best instructions and skills as an APM package; teammates get them with one apm install<\/code>.<\/li>\n\n\n\nAt scale (platform engineer).<\/strong> apm audit<\/code> + apm-policy.yml<\/code> enforce standards; agentrc eval<\/code> in CI catches context drift.<\/li>\n<\/ul>\n\n\n\n \n\n\n\n12. How to start on Monday<\/h2>\n\n\n\nSix steps. Most teams should do steps 1–3 this week, 4–6 over the next quarter.<\/p>\n\n\n\n\nTry it.<\/strong> curl -sSL https:\/\/aka.ms\/apm-unix \| sh<\/code>, then apm install microsoft\/apm-sample-package<\/code> on a throwaway repo.<\/li>\n\n\n\n Measure your repo.<\/strong> npx github:microsoft\/agentrc readiness<\/code> gives you a maturity score and a list of missing context to add first.<\/li>\n\n\n\n Pin what you have.<\/strong> Move your existing copilot-instructions.md<\/code> and skills into an apm.yml<\/code>. Commit the lockfile.<\/li>\n\n\n\n Share across the team.<\/strong> Extract the org-wide bits into a shared APM package. Teammates run apm install<\/code>.<\/li>\n\n\n\n Gate in CI.<\/strong> Add apm-action<\/code> + agentrc readiness --fail-level 3<\/code> to PR checks. This is the step that prevents backsliding — don't skip it.<\/li>\n\n\n\nGovern.<\/strong> Roll out an apm-policy.yml<\/code> at the org level. Tighten as you learn.<\/li>\n<\/ol>\n\n\n\n \n\n\n\n13. Three things to take away<\/h2>\n\n\n\n\nAgent context is code.<\/strong> Version it, pin it, ship it like dependencies.<\/li>\n\n\n\n APM gives you the manifest. AgentRC gives you the content.<\/strong> Together they close the loop.<\/li>\n\n\n\n Security and governance are not afterthoughts.<\/strong> Hashes, audits, policy, on every install, by default.<\/li>\n<\/ol>\n\n\n\nIf you remember one line, make it this one:<\/p>\n\n\n\n \nStop hand-rolling agent setup. Pin it like a dependency, scan it like a binary, govern it like infrastructure.<\/em><\/p>\n<\/blockquote>\n\n\n\n \n\n\n\nLinks<\/h2>\n\n\n\n\ngithub.com\/microsoft\/apm<\/a><\/li>\n\n\n\n microsoft.github.io\/apm<\/a><\/li>\n\n\n\n github.com\/microsoft\/agentrc<\/a><\/li>\n\n\n\n agents.md<\/a><\/li>\n\n\n\n modelcontextprotocol.io<\/a><\/li>\n<\/ul>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"Table of Contents 1. The problem: agent context drifts2. The idea: what if agent context had a package.json?3. The 3 strong guarantees Portable by manifest Secure by default Governed by policy 4. What an APM package can contain5. The five …<\/p>\n","protected":false},"author":280,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[675,2331,2325,2332],"tags":[2704,2703,2454,2520],"class_list":["post-124116","post","type-post","status-publish","format-standard","hentry","category-developer-tools","category-genai","category-library","category-llm","tag-agent-package-manager","tag-apm","tag-claude-code","tag-github-copilot"],"yoast_head":"\nContext Is Code: A Tour of APM and AgentRC<\/title>\n<meta name=\"description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Context Is Code: A Tour of APM and AgentRC\" \/>\n<meta property=\"og:description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:site_name\" content=\"foojay\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-05T08:35:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-05T10:00:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"384\" \/>\n\t<meta property=\"og:image:height\" content=\"384\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Soham Dasgupta\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Soham Dasgupta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"author\":{\"name\":\"Soham Dasgupta\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\"},\"headline\":\"Context Is Code: A Tour of APM and AgentRC\",\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"wordCount\":1434,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"keywords\":[\"Agent Package Manager\",\"APM\",\"claude code\",\"GitHub Copilot\"],\"articleSection\":[\"Developer Tools\",\"GenAI\",\"Library\",\"LLM\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"name\":\"Context Is Code: A Tour of APM and AgentRC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\"},\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"description\":\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/foojay.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Context Is Code: A Tour of APM and AgentRC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"name\":\"foojay\",\"description\":\"a place for friends of OpenJDK\",\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/foojay.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\",\"name\":\"foojay\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"width\":512,\"height\":512,\"caption\":\"foojay\"},\"image\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/foojay2020\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\",\"name\":\"Soham Dasgupta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"caption\":\"Soham Dasgupta\"},\"description\":\"Technology enthusiast \| Agentic AI \| Architect \| Programmer \| Cloud Native \| Blogger \| Speaker\",\"sameAs\":[\"https:\\\/\\\/sohamdasgupta.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/dasguptasoham\\\/\",\"https:\\\/\\\/x.com\\\/iamsoham\"],\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/author\\\/soham-dasgupta\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Context Is Code: A Tour of APM and AgentRC","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_locale":"en_US","og_type":"article","og_title":"Context Is Code: A Tour of APM and AgentRC","og_description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","og_url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_site_name":"foojay","article_published_time":"2026-06-05T08:35:05+00:00","article_modified_time":"2026-06-05T10:00:58+00:00","og_image":[{"width":384,"height":384,"url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png","type":"image\/png"}],"author":"Soham Dasgupta","twitter_misc":{"Written by":"Soham Dasgupta","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#article","isPartOf":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"author":{"name":"Soham Dasgupta","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33"},"headline":"Context Is Code: A Tour of APM and AgentRC","datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","mainEntityOfPage":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"wordCount":1434,"commentCount":0,"publisher":{"@id":"https:\/\/foojay.io\/#organization"},"keywords":["Agent Package Manager","APM","claude code","GitHub Copilot"],"articleSection":["Developer Tools","GenAI","Library","LLM"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","name":"Context Is Code: A Tour of APM and AgentRC","isPartOf":{"@id":"https:\/\/foojay.io\/#website"},"datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","breadcrumb":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/foojay.io\/"},{"@type":"ListItem","position":2,"name":"Context Is Code: A Tour of APM and AgentRC"}]},{"@type":"WebSite","@id":"https:\/\/foojay.io\/#website","url":"https:\/\/foojay.io\/","name":"foojay","description":"a place for friends of OpenJDK","publisher":{"@id":"https:\/\/foojay.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/foojay.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/foojay.io\/#organization","name":"foojay","url":"https:\/\/foojay.io\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/","url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","width":512,"height":512,"caption":"foojay"},"image":{"@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/foojay2020"]},{"@type":"Person","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33","name":"Soham Dasgupta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","url":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","caption":"Soham Dasgupta"},"description":"Technology enthusiast \| Agentic AI \| Architect \| Programmer \| Cloud Native \| Blogger \| Speaker","sameAs":["https:\/\/sohamdasgupta.com","https:\/\/www.linkedin.com\/in\/dasguptasoham\/","https:\/\/x.com\/iamsoham"],"url":"https:\/\/foojay.io\/today\/author\/soham-dasgupta\/"}]}},"_links":{"self":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/users\/280"}],"replies":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/comments?post=124116"}],"version-history":[{"count":0,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116\/revisions"}],"wp:attachment":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/media?parent=124116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/categories?post=124116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/tags?post=124116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

1. The problem: agent context drifts<\/a><\/span>2. The idea: what if agent context had a package.json?<\/a><\/span>3. The 3 strong guarantees<\/a><\/span>

Portable by manifest<\/a><\/li>
Secure by default<\/a><\/li>
Governed by policy<\/a><\/li><\/ul>4. What an APM package can contain<\/a><\/span>5. The five commands you'll actually use<\/a><\/span>6. One manifest, every harness<\/a><\/span>7. Plugins and marketplaces: bundle a workflow, not a file<\/a><\/span>8. Security: treat prompts like the programs they are<\/a><\/span>9. Governance: one policy file, tighten-only inheritance<\/a><\/span>10. AgentRC: context engineering, automated<\/a><\/span>11. How AgentRC + APM compose<\/a><\/span>12. How to start on Monday<\/a><\/span>13. Three things to take away<\/a><\/span>Links<\/a><\/span><\/div><\/div>\n
Context Is Code: A Tour of APM and AgentRC<\/h1>\n\n\n\n
If you've shipped an AI agent into a real codebase in the last twelve months, you've felt this: every agent, every developer, every machine — different setup. A README that says \"install these extensions.\" A copilot-instructions.md<\/code> somebody copy-pasted from another repo. MCP server configs in three different files. The same skills duplicated for Copilot, Claude, Cursor, and Codex. No version pinning. No integrity. No reproducibility.<\/p>\n\n\n\n
That's the problem APM<\/strong><\/a>, the Agent Package Manager fixes. And it pairs with AgentRC<\/strong><\/a> to close the loop on generating<\/em> and evaluating<\/em> that context in the first place.<\/p>\n\n\n\n
\n\n\n\n1. The problem: agent context drifts<\/h2>\n\n\n\nMost teams' agent setup today is a tangle of hand-rolled files:<\/p>\n\n\n\n \nA copilot-instructions.md<\/code> that nobody updates after the first sprint.<\/li>\n\n\n\n The same content copied (badly) into CLAUDE.md<\/code> and .cursor\/rules<\/code>.<\/li>\n\n\n\n MCP servers configured in .vscode\/mcp.json<\/code>, in a personal config, and in a Makefile<\/code> someone forgot about.<\/li>\n\n\n\n Skills, prompts, and rules duplicated across every harness your team has tried.<\/li>\n<\/ul>\n\n\n\nThe results:<\/p>\n\n\n\n \n\"It works on my agent\" 🤷<\/strong> — the AI-era version of works-on-my-machine.<\/li>\n\n\n\n Drift between developers<\/strong> even within the same repo.<\/li>\n\n\n\n Silent context rot<\/strong> as the code evolves but the instructions don't.<\/li>\n\n\n\n No way to ship agent context as a versioned artifact.<\/strong><\/li>\n\n\n\n No security boundary around prompts<\/strong> — and a prompt is a program for an LLM.<\/li>\n<\/ul>\n\n\n\nIf we treat prompts as text, we'll keep ignoring them in supply-chain reviews. If we treat them as code versioned, hashed, audited — we get a real perimeter around what agents do.<\/p>\n\n\n\n \n\n\n\n2. The idea: what if agent context had a package.json<\/code>?<\/h2>\n\n\n\nOne manifest. One install. Every agent, configured. That's it.<\/p>\n\n\n\n # apm.yml — ships with your repo\nname: your-project\nversion: 1.0.0\ndependencies:\n apm:\n # Skills, prompts, agents, plugins — from any git repo, version-pinned\n - anthropics\/skills\/skills\/frontend-design\n - github\/awesome-copilot\/plugins\/context-engineering#v2.1\n - microsoft\/apm-sample-package#v1.0.0\n mcp:\n # MCP servers governed by the same manifest\n - name: io.github.github\/github-mcp-server\n transport: http<\/pre>\n\n\n\nThen:<\/p>\n\n\n\n $ git clone <repo> && cd <repo>\n$ apm install\n→ resolving 14 packages…\n→ deploying primitives to .github\/, .vscode\/\n✓ every agent is configured<\/pre>\n\n\n\nThree details worth highlighting:<\/p>\n\n\n\n \nPinning<\/strong> (#v2.1<\/code>, #v1.0.0<\/code>) — reproducibility, the same way package-lock.json<\/code> gives it to you.<\/li>\n\n\n\n MCP servers live in the same file<\/strong> — one place to declare them, one policy to gate them.<\/li>\n\n\n\n Git is the registry<\/strong> — any git URL works. GitHub, GitLab, Azure DevOps, Bitbucket, internal Gitea or Gogs. No central marketplace required (though curated marketplaces do exist).<\/li>\n<\/ol>\n\n\n\n \n\n\n\n3. The 3 strong guarantees<\/h2>\n\n\n\nAPM makes three headline guarantees, everything else flows from these.<\/p>\n\n\n\n Portable by manifest<\/h3>\n\n\n\nOne apm.yml<\/code> describes every primitive — instructions, skills, prompts, agents, hooks, plugins, MCP servers and apm install<\/code> reproduces the same setup across every harness on every machine. apm.lock.yaml<\/code> pins the resolved tree the way package-lock.json<\/code> does for npm.<\/p>\n\n\n\n Secure by default<\/h3>\n\n\n\nAgent context is executable in effect. Every install scans for hidden Unicode (bidi\/zero-width attacks are a real prompt-injection vector), pins content hashes, and gates transitive MCP servers behind trust prompts.<\/p>\n\n\n\n Governed by policy<\/h3>\n\n\n\napm-policy.yml<\/code> is enforced at install time, including on transitive dependencies and transitive MCP servers. Tighten-only inheritance flows enterprise → org → repo.<\/p>\n\n\n\n \n\n\n\n4. What an APM package can contain<\/h2>\n\n\n\nSix primitive types. You can mix and match.<\/p>\n\n\n\n Primitive<\/th> What it is<\/th><\/tr><\/thead> Instructions<\/strong><\/td> Repo conventions, architecture notes, do\/don't rules. Compose into AGENTS.md<\/code> \/ copilot-instructions.md<\/code>.<\/td><\/tr> Skills<\/strong><\/td> Reusable capabilities in the Agent Skills format. Drop-in from anthropics\/skills<\/code> or any repo.<\/td><\/tr> Prompts<\/strong><\/td> Slash-command prompts that work across harnesses.<\/td><\/tr> Agents<\/strong><\/td> Single-purpose agent primitives, e.g. api-architect.agent.md<\/code>.<\/td><\/tr> Plugins<\/strong><\/td> Author once, export a standard plugin.json<\/code> for Copilot \/ Claude \/ Cursor.<\/td><\/tr> MCP servers<\/strong><\/td> Declared in the same manifest. Policy-checked before they touch disk.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nThis is the part most people underrate. APM isn't only about instructions. It's a single manifest for all<\/em> the moving parts an agent needs.<\/p>\n\n\n\n \n\n\n\n5. The five commands you'll actually use<\/h2>\n\n\n\napm install # resolve manifest, scan, deploy primitives, write lockfile\napm install <pkg> # add a package to apm.yml and install it\napm compile -t copilot # render root context files (AGENTS.md \/ copilot-instructions.md)\napm audit # security + policy checks; SARIF output for CI\napm pack # bundle your package for distribution<\/pre>\n\n\n\n \n\n\n\n6. One manifest, every harness<\/h2>\n\n\n\nThe same packages render to whatever your team uses:<\/p>\n\n\n\n apm.yml → apm compile → GitHub Copilot · Claude Code · Cursor\n OpenCode · Codex · Gemini · Windsurf<\/pre>\n\n\n\nFor Copilot specifically, apm install<\/code> is zero-config<\/strong>: it writes the files that VS Code and GitHub Copilot already expect (.github\/instructions\/<\/code>, .github\/prompts\/<\/code>, .vscode\/mcp.json<\/code>), and apm compile -t copilot<\/code> adds the .github\/copilot-instructions.md<\/code> rollup. APM itself dogfoods this on its own repo.<\/p>\n\n\n\n For other harnesses, apm compile<\/code> emits AGENTS.md<\/code> in the repo root (the open agents.md<\/a> standard) plus the harness-specific rules trees. So if a teammate uses Claude Code, Cursor, Codex, Gemini, OpenCode, or Windsurf, their agent is configured from the same manifest. It's your edge against agent vendor lock-in: context survives the harness.<\/strong><\/p>\n\n\n\n \n\n\n\n7. Plugins and marketplaces: bundle a workflow, not a file<\/h2>\n\n\n\nA single skill or instruction file isn't a workflow. Real capabilities, code review, release notes, incident triage, need several primitives bundled together<\/em>.<\/p>\n\n\n\n Take a Code Review plugin:<\/p>\n\n\n\n\nAn instructions<\/strong> file (the review rubric)<\/li>\n\n\n\n An agent<\/strong> file (activates on \/review<\/code>)<\/li>\n\n\n\n Two skills<\/strong> (summarise diff, find missing tests)<\/li>\n\n\n\nOne MCP server<\/strong> (post PR comments)<\/li>\n<\/ul>\n\n\n\nWithout a plugin, every developer wires four artefacts by hand and hopes the versions match. With an APM plugin:<\/p>\n\n\n\n$ apm install acme\/code-review<\/pre>\n\n\n\nOne command drops all four primitives into the right places under .github\/<\/code> and .vscode\/<\/code> and pins them in apm.lock.yaml<\/code>. Plugins can depend on other APM packages (transitive deps, just like npm). And apm pack<\/code> exports a standard plugin.json<\/code> bundle that Copilot, Claude, and Cursor can all consume.<\/p>\n\n\n\n Marketplaces are the curated layer on top: install from a registry in one command, deployed across all targets, pinned in the lockfile. apm pack<\/code> emits a marketplace.json<\/code> alongside the bundle when declared.<\/p>\n\n\n\n \n\n\n\n8. Security: treat prompts like the programs they are<\/h2>\n\n\n\nThe honest pitch on security is this: agent context is<\/em> executable in effect, and the integrity story has to match.<\/p>\n\n\n\n\nHidden Unicode scanning.<\/strong> Every install blocks bidi and zero-width characters that can hijack agent behaviour. This is a real, demonstrated prompt-injection vector.<\/li>\n\n\n\n Lockfile integrity.<\/strong> apm.lock.yaml<\/code> records SHA-256 per file. Bundles embed it too, so installing a packaged bundle rehashes every file before writing.<\/li>\n\n\n\n MCP trust gating.<\/strong> Transitive MCP servers don't sneak in — you re-declare or explicitly trust them.<\/li>\n\n\n\n apm audit<\/code><\/strong> for on-demand scans, CI-friendly with SARIF output.<\/li>\n\n\n\n Drift detection<\/strong> so generated files can't diverge silently from the manifest.<\/li>\n\n\n\nCI\/CD ready<\/strong> via the official microsoft\/apm-action<\/code> for GitHub Actions.<\/li>\n<\/ul>\n\n\n\nOne caveat until today(5 June 2026): package signing is not yet implemented<\/strong>. The integrity story today is content-hash + lockfile + source allow-listing. But this is already much better than what most teams have.<\/p>\n\n\n\n \n\n\n\n9. Governance: one policy file, tighten-only inheritance<\/h2>\n\n\n\napm-policy.yml<\/code> lets enterprises set the ceiling, orgs tighten further, and repos tighten further still. Each layer can only tighten<\/em>, never loosen<\/em>. The math: allow lists intersect, deny lists union, max_depth<\/code> takes the minimum, and enforcement escalates off < warn < block<\/code>.<\/p>\n\n\n\n # apm-policy.yml\nallow:\n sources:\n - github.com\/microsoft\/*\n - github.com\/anthropics\/*\n - dev.azure.com\/contoso\/*\n mcp:\n - io.github.github\/github-mcp-server\n - io.github.microsoft\/playwright-mcp\n\ndeny:\n primitives:\n - hooks # no shell hooks org-wide\n\nrequire:\n signed: true\n lockfile: present<\/pre>\n\n\n\nDrop the file at \/.github\/apm-policy.yml<\/code> and every repo in the org picks it up, no per-repo wiring. The CI gate is apm audit --ci --policy org<\/code>, which runs all checks and renders findings on the PR.<\/p>\n\n\n\n For incident response there are two documented bypass surfaces — apm install --no-policy<\/code> and APM_POLICY_DISABLE=1<\/code> — and they're loudly logged. Use them sparingly.<\/p>\n\n\n\n The architects' takeaway: you can roll APM out org-wide without losing control over what agents load.<\/strong><\/p>\n\n\n\n \n\n\n\n10. AgentRC: context engineering, automated<\/h2>\n\n\n\nSo APM distributes<\/em> agent context. But where does the content come from in the first place? That's where AgentRC<\/a> comes in.<\/p>\n\n\n\n \nNote:<\/strong> AgentRC is currently marked experimental<\/strong> in its README. Pilot it on a non-critical repo and pin a commit if you adopt it today.<\/p>\n<\/blockquote>\n\n\n\n AgentRC is a CLI + VS Code extension that reads your codebase and generates the files an agent needs to be useful: instructions, MCP config, VS Code settings, and evals<\/em>. The three commands map cleanly to a lifecycle:<\/p>\n\n\n\n$ npx github:microsoft\/agentrc readiness\nScoring 9 pillars · 5-level maturity model\n\n Build & test L4 ████████░░\n Linting L2 ████░░░░░░\n Architecture docs L1 ██░░░░░░░░\n MCP configuration L0 ░░░░░░░░░░\n\n$ npx github:microsoft\/agentrc instructions\n→ reading repo, generating .github\/copilot-instructions.md\n→ generating .vscode\/mcp.json\n→ generating agentrc.eval.json\n✓ done\n\n$ npx github:microsoft\/agentrc eval\n→ running 12 evals against generated instructions\n✓ 11 passed, 1 regressed<\/pre>\n\n\n\nThree things in one: measure<\/strong> (readiness<\/code>), generate<\/strong> (instructions<\/code>), maintain<\/strong> (eval<\/code>).<\/p>\n\n\n\n The eval angle is the one most people miss. Instructions only matter if they actually improve agent responses. AgentRC measures that and can fail CI if context regresses. It's the missing feedback loop in most teams' agent setup.<\/p>\n\n\n\n \n\n\n\n11. How AgentRC + APM compose<\/h2>\n\n\n\nYour repo → agentrc (measure · generate · eval)\n → .instructions.md · mcp.json · eval.json\n → apm.yml (pack · publish)\n → org-wide apm install<\/pre>\n\n\n\nThe crucial compatibility point: the .instructions.md<\/code> format is shared by both tools.<\/strong> No conversion when moving content from AgentRC into an APM package.<\/p>\n\n\n\n Three personas, three flows:<\/p>\n\n\n\n\nIn your project (solo dev).<\/strong> agentrc init<\/code> generates your baseline, then apm install org\/standards<\/code> pulls in shared org packages on top.<\/li>\n\n\n\n For your team (team lead).<\/strong> Package your best instructions and skills as an APM package; teammates get them with one apm install<\/code>.<\/li>\n\n\n\nAt scale (platform engineer).<\/strong> apm audit<\/code> + apm-policy.yml<\/code> enforce standards; agentrc eval<\/code> in CI catches context drift.<\/li>\n<\/ul>\n\n\n\n \n\n\n\n12. How to start on Monday<\/h2>\n\n\n\nSix steps. Most teams should do steps 1–3 this week, 4–6 over the next quarter.<\/p>\n\n\n\n\nTry it.<\/strong> curl -sSL https:\/\/aka.ms\/apm-unix | sh<\/code>, then apm install microsoft\/apm-sample-package<\/code> on a throwaway repo.<\/li>\n\n\n\n Measure your repo.<\/strong> npx github:microsoft\/agentrc readiness<\/code> gives you a maturity score and a list of missing context to add first.<\/li>\n\n\n\n Pin what you have.<\/strong> Move your existing copilot-instructions.md<\/code> and skills into an apm.yml<\/code>. Commit the lockfile.<\/li>\n\n\n\n Share across the team.<\/strong> Extract the org-wide bits into a shared APM package. Teammates run apm install<\/code>.<\/li>\n\n\n\n Gate in CI.<\/strong> Add apm-action<\/code> + agentrc readiness --fail-level 3<\/code> to PR checks. This is the step that prevents backsliding — don't skip it.<\/li>\n\n\n\nGovern.<\/strong> Roll out an apm-policy.yml<\/code> at the org level. Tighten as you learn.<\/li>\n<\/ol>\n\n\n\n \n\n\n\n13. Three things to take away<\/h2>\n\n\n\n\nAgent context is code.<\/strong> Version it, pin it, ship it like dependencies.<\/li>\n\n\n\n APM gives you the manifest. AgentRC gives you the content.<\/strong> Together they close the loop.<\/li>\n\n\n\n Security and governance are not afterthoughts.<\/strong> Hashes, audits, policy, on every install, by default.<\/li>\n<\/ol>\n\n\n\nIf you remember one line, make it this one:<\/p>\n\n\n\n \nStop hand-rolling agent setup. Pin it like a dependency, scan it like a binary, govern it like infrastructure.<\/em><\/p>\n<\/blockquote>\n\n\n\n \n\n\n\nLinks<\/h2>\n\n\n\n\ngithub.com\/microsoft\/apm<\/a><\/li>\n\n\n\n microsoft.github.io\/apm<\/a><\/li>\n\n\n\n github.com\/microsoft\/agentrc<\/a><\/li>\n\n\n\n agents.md<\/a><\/li>\n\n\n\n modelcontextprotocol.io<\/a><\/li>\n<\/ul>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"Table of Contents 1. The problem: agent context drifts2. The idea: what if agent context had a package.json?3. The 3 strong guarantees Portable by manifest Secure by default Governed by policy 4. What an APM package can contain5. The five …<\/p>\n","protected":false},"author":280,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[675,2331,2325,2332],"tags":[2704,2703,2454,2520],"class_list":["post-124116","post","type-post","status-publish","format-standard","hentry","category-developer-tools","category-genai","category-library","category-llm","tag-agent-package-manager","tag-apm","tag-claude-code","tag-github-copilot"],"yoast_head":"\nContext Is Code: A Tour of APM and AgentRC<\/title>\n<meta name=\"description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Context Is Code: A Tour of APM and AgentRC\" \/>\n<meta property=\"og:description\" content=\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/\" \/>\n<meta property=\"og:site_name\" content=\"foojay\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-05T08:35:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-05T10:00:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"384\" \/>\n\t<meta property=\"og:image:height\" content=\"384\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Soham Dasgupta\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Soham Dasgupta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"author\":{\"name\":\"Soham Dasgupta\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\"},\"headline\":\"Context Is Code: A Tour of APM and AgentRC\",\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"},\"wordCount\":1434,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"keywords\":[\"Agent Package Manager\",\"APM\",\"claude code\",\"GitHub Copilot\"],\"articleSection\":[\"Developer Tools\",\"GenAI\",\"Library\",\"LLM\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\",\"name\":\"Context Is Code: A Tour of APM and AgentRC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\"},\"datePublished\":\"2026-06-05T08:35:05+00:00\",\"dateModified\":\"2026-06-05T10:00:58+00:00\",\"description\":\"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/foojay.io\\\/today\\\/context-is-code-a-tour-of-apm-and-agentrc\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/foojay.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Context Is Code: A Tour of APM and AgentRC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#website\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"name\":\"foojay\",\"description\":\"a place for friends of OpenJDK\",\"publisher\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/foojay.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#organization\",\"name\":\"foojay\",\"url\":\"https:\\\/\\\/foojay.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/cropped-Favicon.png\",\"width\":512,\"height\":512,\"caption\":\"foojay\"},\"image\":{\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/foojay2020\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/foojay.io\\\/#\\\/schema\\\/person\\\/9ef9bf07a0614e8fc80e4f8ed35d3a33\",\"name\":\"Soham Dasgupta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"url\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"contentUrl\":\"https:\\\/\\\/foojay.io\\\/wp-content\\\/uploads\\\/2022\\\/01\\\/1621934042991-96x96.jpeg\",\"caption\":\"Soham Dasgupta\"},\"description\":\"Technology enthusiast | Agentic AI | Architect | Programmer | Cloud Native | Blogger | Speaker\",\"sameAs\":[\"https:\\\/\\\/sohamdasgupta.com\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/dasguptasoham\\\/\",\"https:\\\/\\\/x.com\\\/iamsoham\"],\"url\":\"https:\\\/\\\/foojay.io\\\/today\\\/author\\\/soham-dasgupta\\\/\"}]}<\/script>\n","yoast_head_json":{"title":"Context Is Code: A Tour of APM and AgentRC","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_locale":"en_US","og_type":"article","og_title":"Context Is Code: A Tour of APM and AgentRC","og_description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","og_url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","og_site_name":"foojay","article_published_time":"2026-06-05T08:35:05+00:00","article_modified_time":"2026-06-05T10:00:58+00:00","og_image":[{"width":384,"height":384,"url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/Favicon-3-2.png","type":"image\/png"}],"author":"Soham Dasgupta","twitter_misc":{"Written by":"Soham Dasgupta","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#article","isPartOf":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"author":{"name":"Soham Dasgupta","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33"},"headline":"Context Is Code: A Tour of APM and AgentRC","datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","mainEntityOfPage":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"},"wordCount":1434,"commentCount":0,"publisher":{"@id":"https:\/\/foojay.io\/#organization"},"keywords":["Agent Package Manager","APM","claude code","GitHub Copilot"],"articleSection":["Developer Tools","GenAI","Library","LLM"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","url":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/","name":"Context Is Code: A Tour of APM and AgentRC","isPartOf":{"@id":"https:\/\/foojay.io\/#website"},"datePublished":"2026-06-05T08:35:05+00:00","dateModified":"2026-06-05T10:00:58+00:00","description":"Why agent context needs a package manager, what APM gives you, and how AgentRC closes the loop on generation and evals.","breadcrumb":{"@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/foojay.io\/today\/context-is-code-a-tour-of-apm-and-agentrc\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/foojay.io\/"},{"@type":"ListItem","position":2,"name":"Context Is Code: A Tour of APM and AgentRC"}]},{"@type":"WebSite","@id":"https:\/\/foojay.io\/#website","url":"https:\/\/foojay.io\/","name":"foojay","description":"a place for friends of OpenJDK","publisher":{"@id":"https:\/\/foojay.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/foojay.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/foojay.io\/#organization","name":"foojay","url":"https:\/\/foojay.io\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/","url":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2020\/04\/cropped-Favicon.png","width":512,"height":512,"caption":"foojay"},"image":{"@id":"https:\/\/foojay.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/foojay2020"]},{"@type":"Person","@id":"https:\/\/foojay.io\/#\/schema\/person\/9ef9bf07a0614e8fc80e4f8ed35d3a33","name":"Soham Dasgupta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","url":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","contentUrl":"https:\/\/foojay.io\/wp-content\/uploads\/2022\/01\/1621934042991-96x96.jpeg","caption":"Soham Dasgupta"},"description":"Technology enthusiast | Agentic AI | Architect | Programmer | Cloud Native | Blogger | Speaker","sameAs":["https:\/\/sohamdasgupta.com","https:\/\/www.linkedin.com\/in\/dasguptasoham\/","https:\/\/x.com\/iamsoham"],"url":"https:\/\/foojay.io\/today\/author\/soham-dasgupta\/"}]}},"_links":{"self":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/users\/280"}],"replies":[{"embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/comments?post=124116"}],"version-history":[{"count":0,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/posts\/124116\/revisions"}],"wp:attachment":[{"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/media?parent=124116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/categories?post=124116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/foojay.io\/wp-json\/wp\/v2\/tags?post=124116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

3. The 3 strong guarantees<\/h2>\n\n\n\nAPM makes three headline guarantees, everything else flows from these.<\/p>\n\n\n\n

7. Plugins and marketplaces: bundle a workflow, not a file<\/h2>\n\n\n\nA single skill or instruction file isn't a workflow. Real capabilities, code review, release notes, incident triage, need several primitives bundled together<\/em>.<\/p>\n\n\n\nTake a Code Review plugin:<\/p>\n\n\n\n

8. Security: treat prompts like the programs they are<\/h2>\n\n\n\nThe honest pitch on security is this: agent context is<\/em> executable in effect, and the integrity story has to match.<\/p>\n\n\n\n

12. How to start on Monday<\/h2>\n\n\n\nSix steps. Most teams should do steps 1–3 this week, 4–6 over the next quarter.<\/p>\n\n\n\n

3. The 3 strong guarantees<\/h2>\n\n\n\n
APM makes three headline guarantees, everything else flows from these.<\/p>\n\n\n\n