Governance Becomes Enforcement

For a while, the surest way to get an AI agent to finish a job was to let it decide it had finished. It did the work, marked the ticket done, and moved on, and nothing in the system checked whether the work was real. This week two providers took that privilege away. Hermes's task board stopped letting a worker close a card until it could prove the cards it claimed to have created actually existed, and Paperclip blocked an agent from moving its own issue into review.

It is one move in a larger turn, the one that gives the week its shape. For most of the short history of these tools, governance has been a matter of convention: the agent could do the wrong thing, and operators leaned on careful prompting, documentation, and trust to keep it from happening. This week that began hardening into enforcement.

Hermes made secret redaction the default instead of a setting. OpenHands shipped sub-agent delegation switched off and put a quality score on every session. Agent Zero changed its default document format and told its agents to name what they were doing instead of clicking at screen coordinates. Different teams, different architectures, one direction: the risky thing now takes a deliberate decision to switch on, and the safe thing is what happens if nobody does.

The week's other half was durability, the unglamorous work of keeping an agent on task across turns, sessions, crashes, and a compressed context window. Claude Code shipped a real supervisor surface for background agents and a /goal command that holds one to a finish line; Hermes built the same goal primitive on top of its task board; Gemini made a session portable between machines; Agent Zero gave its virtual desktop a memory that survives navigation.

The two halves need each other, which is why it matters that they landed together. Durability without enforcement is just an agent doing the wrong thing for longer. Enforcement without durability is an agent that is safe and cannot hold a goal long enough to finish anything worth governing.

The gates go up

Start with the completion gates, the bluntest example of the shift. Hermes's Kanban board now checks a worker's claims before it will let a card move to done: the cards it says it created have to actually exist and belong to it, which kills both phantom references and one worker closing out another's work. Workers that quit without finishing are blocked automatically, heartbeats catch the stale ones, and per-task retry budgets stop a silent cascade of retries.

Paperclip made the same point with a smaller mechanism, a control-plane fix (PR #5292) that stops an agent from sliding its own issue into in_review; that transition now needs a real review precondition, not a model's say-so. One is multi-agent coordination and the other a state-machine rule, but the claim underneath is identical. An agent saying it is done has never been evidence that it is, and the system finally checks.

The same instinct shows up as a quieter habit: leave the dangerous thing off. OpenHands shipped sub-agent delegation switched off, and behind the switch the orchestrator hands work to specialists, a bash runner, a code explorer, a web researcher, each scoped to a defined tool set rather than the full surface. That is the right default, because fanning work out to sub-agents changes a session's cost, scope, and authority enough to deserve a deliberate yes.

OpenClaw did the same for skills delivered as uploaded zip archives, which stay blocked until an operator turns them on, part of a house style in which anything that can execute code is opt-in and labeled as requiring trust. Agent Zero's new document default belongs in the same column: it now writes open ODT, ODS, and ODP files unless an operator asks for the Office formats by name, reversing an assumption that used to run the other way.

Staying on task

If the first move is about stopping an agent from doing the wrong thing, the second is about keeping it doing the right thing long enough to matter. Claude Code shipped the most visible version, a claude agents supervisor that shows every session by state, working, waiting on you, done, or failed, with background sessions running under a process that outlives the terminal and each isolated in its own git worktree. You dispatch from the prompt, push a running session to the background with a keystroke, and answer a blocked one from a peek panel without attaching. A companion /goal command sets a finish condition the agent holds to across turns.

Hermes built the same idea one level down with its /goal Ralph loop, backed by the task-board reliability work above: lock an agent onto a target and it holds through context compression, turn budgets, and branching, while the board runs the multi-agent case in which workers pick up tasks and, as we just saw, cannot close them without proof. Gemini treated durability as portability, letting you export a session and import it on another machine so the state travels as a real object instead of ambient context. Agent Zero gave its virtual desktop a memory: a single Xpra session now survives navigation, modal switches, and host changes, with a deliberate shutdown told apart from a crash and unsafe controls hidden from view.

Nobody wrote a governance model for five days

The reason the gates went up this week is visible in what operators were reporting. One posted 63h 6m on one Codex goal and it’s still going@TrentDoney. Another, at the end of a longer run, wrote 4d 20h and it actually finished@steipete and left an exhausted emoji to carry the rest.

A process that runs for two and a half days, or five, is not a session. Every control in this issue -- proof before a card closes, an agent barred from reviewing its own work -- exists because the window in which a human could have noticed something going wrong stopped being a window at all.

Two people ran the same comparison and disagreed

On May 12 a practitioner set Claude Code's goal mode against Codex's, and did something almost nobody does when comparing harnesses: I ran them on the same task, same repo, same docs, same base commit, and no steering@ryHanson. Codex, on his run, hit every acceptance criterion.

The same day, someone else called the whole exercise misframed: the fight that matters: are you outputting chat replies or deployable files@closermethod, reporting Claude builds finishing in forty minutes that Codex had not finished in three hours.

We did not reproduce either. Both are single runs by people with different tasks, and we are carrying them together because that is what the evidence actually looks like.

The vendor was reading the same week. Answering a run of critical feedback, Claude Code's creator posted that they were actively working on improving quality and streamlining the product, and are continuing to focus on quality until it feels really good@bcherny and asked for specific papercuts. Worth recording, because a maintainer replying in the thread is the part of the record that usually goes missing. Publishing only the one that agrees with this publication's own argument would have been the easier and worse choice.

You can't govern what you can't see

Enforcement and durability both lean on a third thing the week kept improving: being able to see what an agent is doing while it does it. Codex put permissions and approval-mode on the status line as separate, configurable readouts, turning the most common operator mistake, firing off an irreversible command without remembering which permission posture is live, into a glance. Claude Code's supervisor does the same for a fleet: one color-coded panel where five terminal windows used to be, with a live overlay on each goal tracking elapsed time, turns, and tokens.

OpenHands made the quality of a session legible rather than just its state. A new critic display scores every finished session from 0 to 1, stars it out of five, and color-codes three bands, agent_behavioral_issues, user_followup_patterns, and infrastructure_issues, in the GUI. It stays off unless a deployment sets OH_ENABLE_CRITIC_BY_DEFAULT, but switched on it builds a feedback loop logs never gave, letting an operator watch a session degrade as it happens.

Agent Zero pushed legibility down to the single action: its Linux Desktop skill tells the agent to prefer named, structured actions, cell_edit, app_launch, form_submit, over raw coordinate clicks like click(x=423, y=187). The point is auditability. cell_edit(B3, 42) says what happened; a click at a pixel says only where. An action you can name is one you can verify, replay, and record; a coordinate click is none of those.

One claim we are not making

A researcher posted on May 12 that we were also able to bypass the sandbox of Claude Code (it is not enabled by default settings though), like 3-5 different ways?@lyq_sqsp We are not asserting any of that. There is no writeup we can read, we reproduced nothing, and it stays out of the record as a finding.

Two details in his own words are worth keeping anyway. The sandbox is not enabled by default, so most operators were never behind it in the first place. And he says every bypass was patched while the videos were still being made. That second part is a claim about response time rather than about the bypasses, and response time is the one thing in this whole issue an operator cannot configure.

Breaking changes, before you upgrade

Hermes v0.13.0: secret redaction is now ON by default. If you have Hermes log pipelines that read raw agent output, they will receive sanitized logs after upgrade. This is the right call as a default; it is a breaking change for tooling that depends on unredacted output.

Paperclip v2026.512.0: SSH host environment was leaking. Before PR #5142, SSH remote execution forwarded the Paperclip host's environment variables (including API keys and tokens) to remote execution targets. Operators running SSH-managed agents should treat this as a security advisory and upgrade.

Hermes v0.13.0: Discord role allowlists are now guild-scoped. The prior behavior allowed a role match from any guild to authorize a cross-guild DM, a CVSS 8.1 bypass. Discord operators using role-based access control should reverify their configuration.

Claude Code v2.1.x: worktree.baseRef now defaults to "fresh". New worktrees now branch from origin/<default> rather than the local HEAD. Operators who depended on new worktrees carrying unpushed local commits should set worktree.baseRef: "head" explicitly.

Pi v0.74.0: package scope migration underway. The npm package is moving from @mariozechner/pi-coding-agent to @earendil-works/pi-coding-agent. Global installs: run pi update --self once the new package publishes. CI, Dockerfiles, and package.json pins: update the reference manually.

Provider notes

Claude Code (v2.1.139) adds settings.autoMode.hard_deny: hard blocks that no allow rule can override. The continueOnBlock option for PostToolUse hooks feeds the rejection reason back so Claude can adapt rather than just stop. API key auth now disables Remote Control, /schedule, and claude.ai MCP connectors, so operators using API key auth should audit reliance on those surfaces.

OpenClaw (v2026.5.10 beta) adds per-agent message send restrictions (tools.message.crossContext, tools.message.actions.allow) that let you deploy a sandboxed agent that can only reply in the thread it was addressed in. Memory auto-promotion is now bounded: the dreaming process compacts the oldest sections when the budget is reached, while preserving user-authored notes. Transcript reads are now streaming; peak memory for a long session dropped roughly 90%.

Paperclip (v2026.512.0) adds secrets provider vault configuration with AWS Secrets Manager as the first remote-import backend. The database gains secret_access_events and company_secret_provider_configs tables. The new cursor_cloud adapter routes work to Cursor's hosted-agent platform.

Agent Zero (v1.11 to v1.13) completes what it calls the "visible computer": browser with multi-tab parallel fanout, LibreOffice desktop via Xpra/XFCE, and a persistent desktop session. The multi browser action fans out reads or mutations across tabs in a single tool call with parallel execution.

Gemini CLI (v0.41.0) adds a pluggable AgentProtocol with local and remote backends, forcing the "where does delegated work actually run" question into a surface that can be inspected and configured. Workspace trust now enforces in headless mode; shell command validation gains a core-tools allowlist.

Pi coding agent (v0.74.0) migrates from badlogic/pi-mono to the Earendil Works organization. JSONC parsing for models.json is new (comments and trailing commas now valid).

What the gate is for

Convention worked while somebody was watching. Two providers spent this window replacing it with enforcement -- a card that cannot close without proof, an agent barred from reviewing its own work -- and both changes only make sense against the runs operators were actually reporting: sixty-three hours, then four days and twenty.

Nobody is watching a transcript for four days. That is the whole argument. A permission prompt is a question addressed to a person who is present, and the person stopped being present some time in May.

So the gate is not there to stop the agent. It is there to be the last thing awake.