Assume the Rule Does Not Bind

On July 16 an Antigravity maintainer announced good news on X: version 1.1.3 had fixed headless runs that were "silently auto-approving" permissioned tools.

Two days later, version 1.1.4 recorded what was actually true. Headless runs had only then begun honoring the policies an operator saves in settings.json, and the list is not a detail: permissions, file access, sandbox mode, auto-execution, and artifact review. The July 16 announcement had been made on top of a mode that enforced none of them.

The 1.1.4 release got no post.

Neither did 1.0.16, 1.1.1, 1.1.2, or 1.1.7. Five of the window's nine Antigravity releases passed without a maintainer or official announcement, and they are precisely the ones that loosened a control or admitted one had not been holding: 1.1.1 let an allowlist bypass the diff review that 1.1.0 had just made the default; 1.1.4 disclosed the headless gap; 1.1.7's release body truncates its own changelog entry mid-clause, dropping the part that explains ineligible accounts could bypass a check the interactive interface enforces. Every release that hardened something was posted within minutes.

We are not imputing a motive. Good news travels faster than bad news at every company, and nobody needs a conspiracy to explain a maintainer posting a fix and not posting an embarrassment. The operator consequence is the same either way: a reader following the vendor's own account saw the hardening and never the loosening.

That is this window in one case. Across 25 days and fourteen projects, the thing that kept happening is that controls did not do what their documentation said, and the discovery almost never arrived as a security event.

The rule you wrote

Start with the plainest example, because it is one line an operator actually types.

If you write Edit(src/**) in Claude Code, you believe you have scoped the agent's write access to one directory. Until v2.1.214 on July 18, that rule auto-approved a nested dir/ anywhere in the tree. The same release repaired a Windows PowerShell 5.1 bypass, Bash file-descriptor redirect forms that failed open, commands over ten thousand characters that ran unprompted, zsh subscripts treated as inert, and help and man auto-approving.

Six ways to write a rule that reads exactly like a boundary and was not one.

Then the fix went to a channel most people do not run. At window close the stable endpoint served 2.1.212, published a day before the fix; latest served 2.1.220. An operator on stable, on the Homebrew cask, or on the apt and dnf stable suites had none of it. The rule did not bind, and the repair that made it bind was not in the build they install.

Hermes went further in the same window, and its case is the sharpest in the issue because the change was deliberate. v2026.7.20 makes approvals.mode: smart the default, which means a classifier now decides what would previously have reached a person. That is a defensible design. What is harder to defend is the sequencing: the policy override, the consecutive-denial circuit breaker, the approvals suggest command, and the detectors for docker daemon redirection and recursive rm were all merged in the following days and are in no tag. The release that moved the decision off the human is the release without the guardrails built for moving it.

The same project's egress firewall, its strongest credential-containment control, was merged on July 4, reverted twelve minutes later, and the revert is what shipped. It re-landed on main on July 24 and is still unreleased.

Elsewhere the pattern is quieter but identical. Codex rust-v0.145.0 rewrites an operator's exec policy file on first start, stripping exact allow entries, and its entire network-authority hardening wave is alpha-only. Gemini's stable line runs roughly two weeks behind its own security merges; on July 8 the stable release was less patched than a preview published forty-six minutes earlier. And OpenClaw's sandbox assertion returned success while the escape worked, which is the whole argument compressed into one function call. That fix is in no release on any channel.

This is not new, and we should have said so sooner

Before going further, a correction we owe the reader, because the obvious reading of everything above is that something changed this month. It did not.

We went back through our own archive to test that. The pattern is in the first issue we ever published. In the 2026-04-22 window, Gemini CLI v0.41.0 shipped what we described as a feature: workspace trust in headless mode. It was a fix. Before it, configured workspace trust did not bind in exactly the mode continuous integration uses. The failure was sitting in our own first digest, filed under capability.

It has also led two digests already. The Policy You Wrote Wasn't the Policy You Had counted "at least six ways this week, across six different makers," under a section titled The enforcement gap. Protected on Paper has a section called The authority that didn't bind.

And when we normalize for window length and watchlist size, this window has the lowest rate we have recorded since our instrument stabilized: 3.7 cases per 100 source-days, against a peak of 11.7 in early June. What is unusual about this issue is its size, 350 source-days and two and a half times the next largest, not its density.

Worse for us: the measured rate quadrupled in the exact cycle our own instrument became roughly nine times more sensitive, with the watchlist held constant. The May 27 run harvested 11 findings; the June 3 run harvested 99 using 85 parallel agents, and its own audit notes that it "ran hot." That run produced the digest that first named this pattern. The variable that moved was us.

Now the part that should make any reader cautious about every count in this issue. An unenforced control emits nothing. You cannot observe a rule failing to bind; you can only observe a vendor later fixing it. Every number here is a count of disclosures we noticed, which means Claude Code carries the most rows in our evidence not because it is the worst offender but because Anthropic writes the most down. A vendor that ships the identical bug and says nothing scores zero in our tables and looks clean.

So the honest claim is narrow. Not that agent harnesses got less safe this month. Rather: this failure is ordinary, it is old, nobody has been counting it, and the counting is hard in a way that structurally favors the quiet.

What is genuinely new here is not frequency but the class of surface that failed. Through June, almost every case was a permission rule inside a running binary. This window adds the read surface itself: documentation pinning a vulnerable image, a release body truncating its own security clause, a marketing site selling a subsystem the code deleted, and an advisory channel silent across eight releases that repaired authority.

This also has names, and we should use them rather than coin another. Saltzer and Schroeder called it incomplete mediation in 1975; it is CWE-638, whose own worked example is a deny rule that a search path walks around. The case where a parser failure lets the action through is fail-open, CWE-636. And the formal-methods literature has the only term that names the operator's side of it: a specification is vacuous when it passes for reasons that have nothing to do with what it was written to guarantee.

The thing none of them name is the silence.

Nobody published an advisory

Here is the part that should be uncomfortable for the field. Across 25 days in which eight Claude Code releases repaired authority boundaries, neither Anthropic nor OpenAI published a single security advisory. The newest entry on the Claude Code advisory database predates this window; Codex's most recent is from 2025.

Both vendors did ship a security product during the window. Codex added a Security plugin on July 17; Claude Code's Security plugin reached beta on July 22.

We do not think this is bad faith. Most of these repairs are genuinely ambiguous: is a permission rule that matched too broadly a vulnerability, or a bug? Reasonable engineers answer differently, and a vendor that filed a CVE for every over-broad glob would exhaust its users' attention within a month. But the aggregate effect is that the entire class of failure documented in this issue was disclosed only in changelog prose, which means the operator who most needs to know is the one who reads release notes line by line. Almost nobody does.

The counterexample stopped being a counterexample

For three issues this publication has used eve as its foil. It is the platform-hosted, human-in-the-loop-first product, and after Patched for Whom we wrote that where self-hosted harnesses shipped governance fixes to main and left them there, the platform side "shipped controls you could actually run."

That reading did not survive this window. In fairness to our own record, the warning signs were already there: eve had a comparable instance on July 1 and we flagged a caveat about its approval surface on June 17. This is not a discovery so much as a claim of ours that failed a harder test.

Inside eve, in 25 days: 0.21.0 guaranteed that a delegation tree "can never outspend the budget configured at its root," and 0.27.1 fixed the fact that declining a child's prompt let the parent retry that child against a fresh quota share. For fifteen days, "stop" was a suggestion. 0.26.1 changed the developer interface to show rejected tool approvals as denied "instead of successful," meaning the operator's only window onto the decision had been displaying its opposite. 0.25.0 introduces the guarantee that a stale approval never authorizes an earlier call, which is a guarantee precisely because it was not one before. And 0.24.2 fixed approvals arriving from chat channels that left the tool unrun.

The gate failed open and closed, in the same product, in the same month.

So the comfortable version of this story is dead. It is not that self-hosters are careless while platforms are careful. Buying governance as a service does not buy you a boundary that binds; it buys you a different party's word about a boundary, and this window that word was wrong four times in the product whose entire pitch is that it would not be.

We should say plainly that this cuts against our own reading, because our thesis leans on the idea that platform-hosted operating environments are where durable authority should live. That may still be right. It was not right this month.

What actually works

Three things in this window did work, and the argument is stronger for naming them.

Agent Zero closed the channel gap entirely. Comparing v2.6 to its default branch returns identical: four tags in the window and nothing sitting unreleased. eve, for all the above, has the same discipline, with its main branch three documentation-only commits ahead of thirty-four tags. Whatever else is true, neither project makes you guess whether the fix is in the build.

Paperclip's critical advisory was already fixed. GHSA-x8hx-rhr2-9rf7, published July 22, describes a drive-by remote code execution via DNS rebinding at CVSS 9.6. Reading the source rather than the advisory metadata shows the guard changed from authenticated && private to private && (local_trusted || authenticated) on April 16, ninety-seven days before disclosure. Worse, the advisory's declared vulnerable range points at an npm line abandoned in March, not the calendar-versioned line the project actually ships, so an operator cannot map the range onto their own version string at all.

The odd part is that nobody noticed in either direction. We searched all fourteen social files for any mention of the advisory, the identifier, DNS rebinding, or the severity score. Nothing. A Critical 9.6 landed against a live agent runtime and the public conversation did not register it, including a post reciting that exact release's highlights two days later. We had assumed we might be debunking a panic. There was no panic to debunk, which tells you something less comfortable about how well this class of risk is being watched at all.

eve deleted a knob. This is the most interesting thing any vendor did this month. 0.22.5 tightened the maximum subagent depth to 1. Then 0.23.0 removed the setting altogether and replaced it with a structural constraint: only a root agent may delegate. Not a smaller number. No number.

Hold that against everything above. Every failure in this issue is a promise made in a configuration file that the runtime did not keep. A setting is a claim about behavior, and this window is a catalogue of settings whose claims were false. An invariant is not a claim; it is a shape the system cannot take. You cannot misconfigure a knob that does not exist.

The conversation, and what it is actually good for

This is the first issue in which we swept public X discussion across the whole watchlist as a standing part of the cycle, on rules we have written down separately in how we read the conversation layer: 314 public claims, each carrying a post URL and a date, each adjudicated against the primary record.

We expected the conversation to run ahead of the changelog. It does not. Of 55 claims adjudicated on Codex and Claude Code, exactly one describes something before its receipt: a July 13 post explaining that the GPT-5.6 Sol context limit had been cut from 372k to 272k after unintended usage drain, five days before rust-v0.144.6 recorded the same correction. The version-tracker accounts that look like early warning post two to seven minutes after the release they summarize. The lane buys latency, not foresight, and we would rather say so than sell it.

What the conversation is genuinely good for turned out to be three other things.

It is the only running summary when the vendor stops writing one. Claude Code's own What's New digest stopped at Week 29, so for the last stretch of this window the crowd was the only continuous narrative covering v2.1.214 through v2.1.220.

It is wrong in ways that are worth correcting in public. A widely shared July 20 post held that auto mode is "mostly bypass permissions with less risk." The comparison is backwards on the specific point that matters: under the bypass flag a PreToolUse hook is not consulted and the operator knows it, while v2.1.211 had just fixed auto mode consulting the hook and overriding its ask decision. The operator who believed the post was told they had less risk than they had.

And it is where fixes get reported as bugs. Users complaining since about July 19 that auto mode "still constantly asks" for file-edit permission are describing v2.1.214 narrowing Edit(src/**) to the working directory. They experienced the repair as a regression, which is what happens when a rule silently means one thing and then starts meaning what it said.

The sharper finding is what the conversation never mentioned. Zero of twenty Codex posts referenced any authority change: not the exec policy rewrite, not the removal of "don't ask again," not that the network-authority wave is alpha-only. Zero of twenty-four OpenHands posts mentioned the tag freeze, the draft release, the install documentation still pointing at 1.8, or the cloud-only advisory.

And the loudest silence of all: across eighty-three claims covering Hermes, OpenClaw, and Pi, not one mentions that Hermes moved the approval decision from a person to a classifier. No post about approvals.mode, smart approvals, auto-approval, or a changed default. The same sweep captured a stale installer, a Telegram gateway crash, a WSL2 database corruption, and a Discord routing complaint. The single approval-adjacent post in the set is an OpenClaw user asking for fewer prompts. A default that decides what an agent may do without asking you moved, and the public record of the field did not register it.

So there are three surfaces and a hole. The conversation covers capability. The changelog covers shipping. Neither covers enforcement, and enforcement is the one an operator is betting on.

There is one place where the lane paid for itself outright, and it is worth being precise about why. Three heypi posts predate their confirming tags by thirteen, six, and five days, and one of them refuted a baseline we had published: we expected heypi to be holding at 0.2.0, and it was not. But the honest caveat is that all three are the builder narrating his own work, so this is a maintainer telling you what he is about to ship, not a practitioner detecting something the vendor concealed. It is early warning of a kind. It is not the crowd catching anything.

The same lane also produced the window's most quotable concession, from the author of Agent Flywheel describing his own system on July 25: the file-reservation and concurrency mechanism that keeps parallel agents from colliding is, in his word, advisory. That is this issue's entire subject stated plainly by someone who built the mechanism, without anyone pressing him on it. Advisory is the honest label for most of what this window called a control.

One structural note, because it explains why the sweep felt so different per project. Hermes has zero fully confirmed social claims and 1,712 commits between its newest tag and its default branch. Pi has zero unconfirmed ones and two. When a project's released build is far behind its branch, almost nothing anyone says about it can be checked against something you can install; when the two are the same artifact, almost everything can. The merged-to-released gap does not only determine whether you have the fix. It determines whether any public claim about the project is verifiable at all.

Where the tags went

OpenHands deserves its own note, because we warned about it for three issues and it half resolved.

The open-source line, frozen at 1.8.0 since June 10, took six tags in four days starting July 6, through 1.11.0. The authlib open-redirect fix we flagged as main-only shipped in 1.9.0, which was in fact the first tag on any line to carry it. Self-hosters got a supported build.

Then it refroze. Nothing has been tagged on the open-source line since July 9, its default branch is fifty commits ahead, and the 1.12.0 release pull request has sat in draft with a clean mergeable state for eighteen days while cloud tags kept shipping. A new high-severity vite advisory, CVE-2026-53571, an unauthenticated arbitrary file read that exposes .env files and TLS keys, is in cloud tags and no open-source one.

And the install documentation still tells a self-hoster to run the 1.8 image and calls it the most recent stable release, which means the official instructions hand a new user every advisory that 1.9.0 closed. Of all the gaps in this issue, that is the purest: a document that does not merely fail to describe the system, but actively walks the reader into the version it already fixed.

Provider notes

Codex (stable rust-v0.145.x) rewrote operator exec policy files on upgrade and kept its network-authority wave in alpha. Its documentation moved hosts to learn.chatgpt.com, and Codex is now part of the ChatGPT desktop application, so allowing that app allows Codex.

Gemini CLI (stable v0.52.0) closed the memory-import symlink escape we tracked in nightly, which reached preview and stable fifteen days after merge. A zero-click a2a-server remote-code-execution fix remains preview-only. The shipped documentation at the stable tag still describes consumer authentication as live, more than a month after the service ended, which makes the public conversation about the shutdown more accurate than the vendor's versioned docs.

Pi (v0.82.1) has two commits unreleased, the smallest gap on the watchlist. Note our own error here: this publication was watching an abandoned package name, so Pi read as static for eleven weeks while it shipped.

heypi did not hold at 0.2.0 as we expected. It shipped a 0.3.0 beta line and a Pi-native rewrite. Its enforcement contract is the strongest in the harvest, failing closed with the audit write as a precondition for execution, but the identity half is advisory: omit both admins and approvers and anyone who can reach the approval interface may answer it, with a startup warning as the only protection.

Flue tagged nothing in the window while its default branch removed workflows entirely, with no compatibility stubs and no replacement for code-first entrypoints. Its marketing site still headlines the feature. Its tracing now captures prompt and tool content by default, on the reasoning that installing an instrumentation is the consent.

Paperclip shipped three tags and the advisory discussed above. Agent Zero shipped four and holds zero unreleased work, though its v2.6 narrowed secret masking to API-key and login shapes, so other values in a .env are no longer redacted. Agent Flywheel remains at v0.7.0 from before the window with 73 untagged commits on main.

The verdict

The title is an instruction and we mean it literally: assume the rule does not bind, then go find out.

Every surface a vendor publishes is downstream of a decision about what to say. The changelog records what shipped, not whether it holds. The release notes are selectively silent, and this window we can show which way the selection ran. The documentation rots, sometimes into actively dangerous advice. The advisory database stayed empty through eight releases that repaired authority. The conversation, which we swept properly for the first time, never once mentioned enforcement.

The runtime is the only surface that cannot lie to you, and it will only answer if you ask. Write the deny rule. Run the command it forbids. Watch what happens. That is a tedious hour, and it is the only hour in this issue that produces knowledge rather than belief.

The better answer is the one eve reached by deleting its own setting: a control you can misconfigure is a control someone will misconfigure, including the vendor who wrote it. The systems that came through this window cleanest were not the ones with the most careful policy engines. They were the ones with the fewest places where policy could be wrong.

---

Revised 2026-07-27 (artifact_version 2): added the section testing whether this pattern is new, which found it is not. Our own first issue contains an instance we filed as a feature, two prior digests have led with it, and the normalized rate this window is the lowest we have recorded. Also corrected the eve framing from discovery to a claim of ours that failed a harder test, and added the prior-art names for the failure class. No receipt or window judgment changed.

Window: 2026-07-02 to 2026-07-27, 25 days across 14 projects. This issue adds a public X sweep as a standing part of the cycle. Social posts are receipts for what was said, never for what is true; every product claim sourced from a post was adjudicated against the primary record before it appeared here. The research trail holds the harvest, the cross-checks, and the claims we declined.