Feature / Published 2026-08-23
The Body, Not the Pencil
Sixteen months of the Codex tree show a division of labor being drawn: models take the ambiguous judgments, hand-written rules and OS sandboxes keep the hard boundaries, and the harness around both gets thicker, not thinner. What OpenAI deletes, keeps, and grows is a map of where every agent builder's footing moved.
Every claim links to a source you can open.
The latest brief / 2026-08-17 to 2026-08-20
Features
- Oh My Pi, without the Pi 2026-08-23
OMP's maintainers are rewriting their Pi fork in Rust on an orphan branch, with CPython for plugins and the upstream gone. Pi's maintainers dispute the reasons given. The tree supports both halves.
Earlier issues
- The Gate Is a Plugin 2026-08-17
A frontier lab open-sourced its own harness on an everything-is-a-plugin architecture, and the field spent four days arguing about whether self-extension is a new category.
- You Approved Something Else 2026-08-10
Vendors spent this week arguing that the human click is the weak control, and they have a study that supports them.
- Newer, Numbered Lower 2026-08-03
Every project here has a newest thing it has made and a newest thing you can install, and this window is about the distance between them.
- Rules Became Judgment 2026-07-27
Two things happened across 25 days and fourteen projects, and they are the same story.
What changed in the tools you run
-
Guardian V2 is in Codex 0.148.0 and the feature flag is still off
Upgrade the default install to 0.149.0 if you stayed on 0.147.0. Treat it as a large upgrade, not a point release.
-
v2.10 ships the ACP bridge and interactive browser; the v2.9 SSRF tests survived
Upgrade to v2.10 if you want ACP or the live viewport. Then turn ACP off if you do not want an editor-hosted endpoint with host write and host exec, and do not treat chats as separate browsers: cookies are shared.
-
The approved-exec fix is still in no release
A tagged install still can run different bytes than the ones you approved. Say that to anyone relying on the prompt.
-
rc.8 still has no privileged core, and the Web UI still has no login
Still a developer preview. Do not expose the port.
-
The filesystem-write broker is now an npm version; 17.3.6 still is not
If you run OMP 17.3.7+, inspect extensions for registerFileWriteFallback. The OS denial is no longer the last word.
-
turnPolicy queue did not bind from 0.34.0 through 0.39.2
If you set queue after 0.33.0, 0.39.3 is the first tag that actually queues. Re-test Slack and custom channels. Pin eve@0.42.0; do not take unpinned npm.
The watchlist
- Agent Flywheel Jeffrey Emanuel (Dicklesworthstone)
The durable product is the operating loop, not any one agent inside it -- but the loop you can install is a month behind the one its author describes.
- Agent Zero agent0ai
v2.10 tags the ACP bridge and interactive browser. Sign-ins are shared across chats. The v2.9 SSRF tests survived.
- Antigravity CLI Google
Google retired the coding CLI you could read, and shipped one you have to trust.
- Claude Code Anthropic
Background work on a leash whose clasp only locks once you test it.
- Codex OpenAI
Guardian V2 is in 0.148.0. The feature flag is still off.
- cursor Anysphere
Closed editor, CLI, and cloud agent, harvested from the changelog, never from github.com/cursor/cursor.
- deepseek-harness deepseek-ai
A frontier lab's own agent harness, MIT-licensed and built so that everything is a plugin -- including the components that enforce the limits.
- Eve Vercel
Ships everything it merges. turnPolicy queue did not bind from 0.34.0 through 0.39.2; 0.39.3 copies the field again.
- Flue withastro
Tagged nothing this window while its default branch deleted workflows, the CLI, and the entire run surface. The marketing site still sells all three.
- Gemini CLI Google
The consumer service is gone and the repo is not. Stable runs about two weeks behind its own security merges.
- github-copilot-cli GitHub
A versioned terminal agent with GitHub Releases and npm, and no agent source behind them.
- grok-build xAI
You can read the loop. The binary on PATH is a different channel.
- Hermes Agent Nous Research
The approval decision moved from you to a classifier, and the controls written to bound it are still on main.
- heypi Ronan Berder (hunvreus)
The strongest fail-closed approval contract in the field, wrapped around an approver identity check that is only a startup warning.
- omnigent omnigent-ai
The first meta-harness on this watchlist: a governance layer over the coding agents it drives, whose spend cap is enforced before the call and is a downgrade gate rather than a ceiling.
- omp can1357
A fork of Pi that outran the project it forked, publishing 17.x against upstream's 0.8x under the same package basename, with a language server and a live debugger wired in.
- OpenClaw OpenClaw
The fixes are real, and they are on a channel you are probably not running.
- OpenHands OpenHands
The platform that fronts other harnesses. Its open-source line thawed for four days in July, then refroze.
- Paperclip Paperclip
Governs agent labor as operating state. Its one Critical advisory this window described a hole it had already closed 97 days earlier.
- Pi Coding Agent Earendil Works (formerly badlogic / Mario Zechner)
Refuses to govern, ships what it merges, and now lets an installed extension own your provider credentials.
About this publication
Coding agents can create work faster than teams can verify it.
Source-backed, cross-project reporting on what coding agents just made possible, what became the new bottleneck, and where operators should spend scarce human attention. Every claim links to a primary source you can open and check, and the whole publication is on GitHub, source notes and all.
- Bitter Lesson Maxing
- Build where improving general agents compound your advantage, not where their next release erases it.
- Amdahl Maxing
- Treat human attention as the scarce serial resource and spend it where judgment changes the outcome.