Foreground Attention Is No Longer the Control

Claude Code 2.1.198 changed what "background" means. When a background agent launched from claude agents finishes code work in a worktree, the release says it now commits, pushes, and opens a draft pull request automatically. The agent no longer needs a person watching the terminal to move work into the repository.

That is a real throughput gain. It also means foreground attention is no longer the control. In a shared repository, the useful boundary now lives in push permissions, branch protection, notifications, and pull-request review. If those controls were designed for an agent that stopped before publishing its work, v2.1.198 changed the assumption underneath them.

Authority lands somewhere

Removing an interruption does not remove the decision the interruption used to carry. It moves that decision downstream. Claude Code moved review from a terminal prompt to the repository boundary. The operator should decide which branches a background agent may push, which checks a draft pull request must pass, and which events deserve an immediate notification before enabling the release across a shared repository.

The human-attention gain depends on that replacement. A draft pull request with mechanical checks can batch review around a complete unit of work. An unrestricted push followed by an unfiltered notification stream merely trades one interruption queue for another.

Three ways a security change becomes real

The other three signals in the July 1-2 window show different places where a control can become actionable, incomplete, or easy to misread.

Hermes v2026.7.1 is the clean case. The security work that was still on main in the previous issue reached a tagged release. Its notes list MCP-configuration persistence hardening, cron base_url credential-exfiltration blocking, prefix-secret sentinels for file reads, Slack xapp- token redaction, browser cloud-metadata guardrails, resume and session scoping, and a dependency floor. Operators on v2026.6.19 no longer need to watch commits and guess when the wave became runnable. They can upgrade.

Codex rust-v0.142.5 stopped writing full Responses WebSocket request payloads to trace logs. The fix changes future logging; the release note does not claim to erase traces already retained or copied into a centralized system. Operators should upgrade, then restrict or purge old traces according to what their retention path may have captured. The permission decision did not end when the agent ran. It followed the payload into the log store.

Gemini CLI fixed a sharper file boundary, but only in v0.51.0-nightly.20260702.gff00dacd9, which blocks a symbolic-link directory escape in the memory-import processor. Stable operators did not have that fix at the window close. They should avoid untrusted GEMINI.md imports or deliberately accept the nightly channel's wider change surface. A fix in a channel you do not run is still an unfixed system.

Put control where the work lands

The four changes move human attention to four different boundaries. Claude Code moves it from foreground supervision to repository policy. Hermes turns commit watching into a routine upgrade. Codex moves part of the security review into log retention. Gemini makes release-channel selection part of the file-trust decision.

The common mistake is to preserve the old control after the work has moved past it. Watching a terminal does not govern an agent that can push. Reading a merged fix does not protect a stable binary. Upgrading a logger does not clean its old copies.

Foreground attention is no longer the control. Put policy where the work lands, then verify that the release you run actually carries it.

Correction: Agent Flywheel was not a July 2 signal

The original edition counted Agent Flywheel v0.7.0 as a change in this window. The release shipped June 26, so that signal was withdrawn and the accepted count is four. The current Agent Flywheel profile carries the separate, present-day analysis. It is not evidence for this July 1-2 argument.

Revised 2026-07-12 (artifact_version 2): reclassified this one-day live window as a Bitter Frontier Brief. Claims and receipts unchanged.

Corrected 2026-07-12 (artifact_version 3): withdrew Agent Flywheel as a July 2 signal because v0.7.0 shipped June 26; corrected the safe-mode guidance after the tagged installer showed that dangerous agent shortcuts remain installed; removed the unlike 110-versus-52 paper comparison (the corrected profile uses the same figure's 110-versus-97 counts); and rebuilt the intake discussion around the tagged operating method. The four in-window signals and their receipts are unchanged.

Corrected 2026-07-12 (artifact_version 4): removed the post-window Agent Flywheel methodology and safe-mode synthesis added in version 3. Agent Flywheel now remains only as a correction record and receipt trail, not as part of the argument. The title, Operator Brief, lede, argument, and verdict are rebuilt from the four accepted July 1-2 signals; their claims and receipts are unchanged.