What Shaped the Run

On April 30, Codex changed what a session is. CLI release 0.128.0 made /goal a first-class surface: a persistent objective with its own app-server APIs, model tools, and terminal controls for creating, pausing, resuming, and clearing it. A prompt used to die with its window. A goal survives -- across sessions, across interruptions, across the operator's attention. It is the strongest signal of the fortnight, and it swaps the operator's question. Not "can the agent remember?" It can. The question is what it is remembering, and who decided that is still the right thing to pursue.

Codex was not alone; every harness on the watchlist spent the fortnight thickening the layer around the model. (By harness we mean the practical wrapper -- the CLI, permission system, memory surface, sandbox, plugin layer, and review flow that determine what the agent can actually do.) Claude Code put review and recaps into the product. Gemini CLI tightened workspace trust and started treating memory as a reviewable patch. Hermes gave its skill library a groundskeeper. Pi rebuilt its provider list twice.

The direction is one direction: coding agents are becoming less like chat boxes and more like working environments. And a working environment has furniture. Five kinds of it -- goals, memory, review verdicts, permissions, plugins -- can now shape a run without leaving a mark in the transcript.

A goal is memory with authority

The memory work came from three directions at once, and the differences matter more than the trend.

Claude Code added automatic session recaps: return to a terminal you left and the agent tells you, in a line, what happened while you were gone. Gemini CLI, in a preview build, is testing an Auto Memory inbox where memory lands as a canonical patch -- proposed, reviewed, accepted -- rather than smeared silently into hidden context. That is the right shape, and the only one of the three that asks permission.

Hermes went furthest: Curator, shipped in v2026.4.30, is an autonomous background process that grades, consolidates, and prunes the agent's skill library on a default seven-day cycle, writing its own run logs and reports. The agent now has an employee whose job is editing what the agent knows.

On the window's final day Anthropic put a research preview of the same idea in front of everyone: dreaming, which Dreaming reviews your agent's past sessions, extracts patterns, and curates memories so your agents learn over time@claudeai. Four harnesses, four names, one function -- a process that decides what the agent knows, running when nobody is looking.

Put /goal next to these and the shape of the fortnight is clear: agent-side state stopped being chat history. A serious run may now be shaped by a standing goal, a recap, an accepted memory patch, and a skill some background process decided to keep -- and none of that appears in the prompt you can read. Use these surfaces; they are genuinely good. But keep the record of what touched the run in something the agent does not own, and decide deliberately which of its memories graduate into the project's.

Five tools, five names for permission

The authority work points the right way and speaks five languages. Codex 0.128.0 expanded permission profiles and sandbox profile selection, with active-profile metadata so a run can say which profile governed it. Gemini CLI v0.41.0 added secure .env loading and workspace trust in headless mode, plus shell command validation and a core-tool allowlist. That middle item is filed here as a capability and it is a repair: before v0.41.0, configured workspace trust did not bind in exactly the mode continuous integration runs.

Three months later Google's closed-source replacement fixed headless mode honouring no configured policy at all -- same vendor, same failure, in the successor product. That line is where Rules Became Judgment starts. Claude Code kept reworking its permission prompts, plugins, hooks, and MCP surfaces.

More visible authority is progress. The cost is that "profile," "trust," "allowlist," and "sandbox" now name different mechanisms in every tool, and none of them translates. For serious work, "the agent had access" was never an answer; the answer is what it could read, change, execute, and install, and this fortnight made that answer easier to get and harder to compare.

The review is coming from inside the harness

Claude Code's Week 17 notes introduced /ultrareview, a research preview that runs a cloud fleet of bug-hunting agents against a branch or pull request and returns the findings to Claude Code and Desktop. Agent tools that can criticize their own work are a direction worth wanting.

The line to hold is between evidence and verdict: a native review can tell you "this path looks risky"; it cannot tell you what done means, because the project owns that standard, not the provider. Before a fleet's findings feed anything, run it against a branch you already reviewed by hand and see where it disagrees with you.

The constraint that moved

Two things on 2026-05-06 explain why all this furniture arrived at once. Anthropic doubled Claude Code's five-hour rate limits and removed the peak-hour reduction, citing new compute:

And Paperclip described planning work that could plan features that delegate across the agents organization and run for 12 hours or more@dotta. A twelve-hour delegated run is the practical reason goals, recaps, memory patches and curators exist. Nobody watches a transcript for twelve hours. The furniture is what you install when the thing outruns your attention, and this fortnight the leash got longer on the same day the furniture shipped.

Do not marry the integration list

Pi spent the window demonstrating why the harness's integration list is weather, not climate. Across five releases it added DeepSeek, Cloudflare Workers AI, Moonshot, Mistral, Azure, and Xiaomi MiMo providers, moved its Codex integration to a cached websocket transport, added provider retry and timeout controls -- and removed built-in Gemini CLI and Antigravity support in the same breath.

Meanwhile the practical power of every agent kept moving into the attachments: Codex shipped plugin marketplace workflows and bundled hooks, Claude added plugin distribution and theming, Hermes runs on skills, and Gemini's stable, preview, and nightly channels differ enough that the memory inbox exists in one and not the others.

None of this is a warning against the tools. It is a warning against mistaking their current shape for architecture. If a run depended on a plugin, a transport, or a release channel, that dependency is part of the work environment and belongs in the record. The layer that deserves to be stable is the one you own: the objective, the permissions, the evidence, the review standard, and what the next run needs to know.

That is the fortnight's real product. The working environment is here, it is good, and it shapes work the way any environment does -- invisibly. The operator's job, starting now, is to keep a record the environment does not own.