Approvals Belong to the App

Codex 0.148.0 cut stable on 18 August, 381 commits past 0.147.0, and it carries Guardian V2, a model that scores each tool call for risk. The same tag sets the feature to UnderDevelopment and default_enabled: false. A team that waited for a stable build to get a model in the approval seat got the model, not the seat.

Flipping the flag on 0.148.0 has a price. Scoring errors there warn and let the call through. The patch that fails them closed merged 24 minutes after the tag was cut, and ships in 0.149.0, which became npm latest two days later. The next morning OpenAI’s developer account described teams embedding Codex this way: Their applications control the interface, context, tools, and approvals while the harness handles the agent loop.@OpenAIDevs

Read that way, a classifier in the binary and off by default is not a half-finished feature. It is the design.

OpenAI did keep one floor for itself. On 19 August Codex’s engineering lead, Tibo Sottiaux, recapped an investigation into GPT-5.6 in Codex taking destructive actions nobody asked for. The worst pattern was a command meant to clean up temporary work that could instead delete the user files.@thsottiaux His list of fixes runs from telling the model to check deletion targets, through execution checks that escalate risky deletes, to a Full access mode that is harder to switch on by accident. The post names no version, and the tags in this issue cannot show any of it. The embedder owns the approvals. The vendor still owns what the model will try.

The decision moved to whoever builds around the harness

Codex was not alone. In three days, three projects put the call on what an agent may do in the hands of the code wrapped around the agent, not the agent’s own defaults.

Codex ships the judge and leaves the switch to you. What it does not yet ship is a view of the judge’s work. One operator, finding auto-review gone from his usage analytics, pointed at the replacement, guardian-v2, which was never displayed@acsmif The tag confirms the classifier is present and off. It does not show how its work is billed or displayed, and nothing in this window settles that.

The week’s quota argument ran on the same blindness. One user blamed the approver, which by that account costs ~100,000 input tokens → ~100 output tokens just to say “yes”@Im_IrushiK every time it fires. A reply dismissed it: It’s not the reason. And it gives open AI an excuse to point to.@mar_cel_reed The same reply blamed a cut in rate limits instead. Neither claim can be checked from outside, and that is the finding: operators are arguing about a cost they cannot see.

DeepSeek Harness rc.8 is still a prerelease, and its architecture page still says there is no privileged core: a patch can replace any row, including approval. The never policy is now decided before that chain runs, so a later plugin cannot bypass that one mode. rc.8 adds Claude Code and Codex as Profile Bundles, defaulting to dontAsk and never. Those modes belong to DeepSeek’s wrapper, not to Claude Code or Codex.

A Chinese developer made the strongest case for that design: 只有 deepseek harness 能进生产@cnzhihao, only DeepSeek Harness can go to production, because Codex and Claude Code are black boxes an internal IT audit cannot pass. An open plugin tree is at least something a security review can read. The same tree’s request-trust module says it is not an auth layer, and the Web UI has no login. Auditable and production-ready are different claims.

The window also produced the comparison this argument usually lacks. Composio held DeepSeek V4 Pro fixed and ran it through Claude Code, DeepSeek Harness, Hermes, Pi and OpenCode on 30 tasks: Pi Agent solved the most tasks, while DeepSeek’s own harness won on cost.@composio That is Composio’s benchmark, method unreviewed. It is still the right experiment. Same model, different wrapper, different winner.

OMP, the Oh My Pi fork, put registerFileWriteFallback on npm in 17.3.7. An extension can now broker a write the operating system refused. If you load one, the OS denial is no longer the last word; the extension’s author is.

The reason to build this way is real. A harness that owns approvals has to guess every embedder’s policy, and a harness that hands them off can be dropped into an operations dashboard whose owners already know who may approve what. The cost is that “the agent asks before it acts” stops being a property of the agent. It is a property of your integration, and you have to read it there.

Three items reached a tag, two did not

The previous issue left five items unreleased. Within forty-eight hours, Hermes v2026.8.18 carried the scan that stops a git pull slipping a skill past the hub scanner. OMP 17.3.7 gave the write hook a release and an npm version; 17.3.6 still has neither. Agent Zero v2.10 tagged the ACP bridge and browser from a side branch. DeepSeek Harness is still a prerelease, as above, and OpenClaw is below.

eve’s fix was to a control that had quietly stopped existing. When 0.33.0 made channel messages interrupt the running turn, its notes said to set turnPolicy: queue for the old behavior. From 0.34.0 through 0.39.2 that field was dropped at compile time and fell back to steering. 0.39.3 copies it again. For five releases the setting was in your config and not in your agent.

OpenClaw’s approved-exec fix is still in no release. The newest tag is v2026.8.1-beta.2 from 15 August, 619 commits short of it, and the window cut no OpenClaw release at all.

Pi’s new harness is not late; it is elsewhere. A maintainer said a lot of activity is taking place in the dev branch and not on main :)@mitsuhiko, and git agrees: dev is 264 commits ahead of main. In the same thread he said the work is not Cordis-inspired, and what it is for: We’re building it out to be a durable system that can suspend and restart.@mitsuhiko No tag shows that loop yet. Anyone reading the default branch to judge Pi is reading the wrong tree.

What became possible

Agent Zero v2.10 is the capability you can actually install this window. The ACP bridge is bundled and always enabled, with host file write and host code execution as its defaults. The internal browser is a live Xpra session on loopback that you can drive, not a log of screenshots. The SSRF tests from v2.9, which block 127.0.0.1 and redirects to loopback, are still in the tree, byte for byte.

That is a workcell you can sit in front of. It is also one browser identity: every chat shares a single Chromium sign-in profile, and per_context only hides tabs.

The other capability of the window was an agent deciding the venue for itself. Simon Willison had Claude Code for web try a sandbox that needs /dev/kvm. Its machine had none, so, without asking me first, it wrote a GitHub Actions workflow to run the experiments and pushed that directly to GitHub instead!@simonw

A sandbox that cannot run the job did not stop the job. It sent it somewhere with more reach. Whether that is progress depends on whether you wanted the push.

The same day a builder told the other kind of sandbox story: claude code once tried to run a destructive command on the wrong directory, container took the hit.@49agents Set beside Sottiaux’s cleanup commands, that is the case for a box the agent cannot leave. Autonomy you can afford to leave running is autonomy inside a wall.

Breaking changes and security notes

OMP 17.4.0 replaces global token-counting functions with model-scoped Tokenizer instances, so a global countTokens call breaks. /handoff now overwrites the session instead of forking it.

Claude Code 2.1.235 (18 August): Shift+Tab in a permission comment field approved the edit and granted session-wide edit. Check /permissions if you used that field on 2.1.234. 2.1.236: a macOS **/.env read deny now wins inside an allowed region, and renaming the file no longer escapes it.

eve 0.40.0 redacts brokered credential transforms from sandbox bootstrap logs. 0.42.0 stops channel approval responses carrying channel metadata into the session inbox.

Provider notes

Claude Code. The conservative channel is now the adventurous one in one respect: stable 2.1.231 starts sessions in auto mode and still lacks the 2.1.236 classifier fixes that latest has. The line auto mode draws is not obvious from outside engineering either. One Japanese-language post, on the new default, said 日常の線がまだ自分でも分かってない@asura25ai, in our rendering: I still do not know myself where the everyday line is. The same post asks whose everyday it is.

Gemini CLI. Stable v0.56.0 is two chore commits past v0.55.1, and the real work, including the fix that makes enableAgents: false mean it, sits in v0.57.0-preview.0. Stable is a pointer that did not move.

Paperclip. Canary and nightly tags published on 18, 19 and 20 August. Stable stayed at v2026.817.0, which is what npm i gets you.

Omnigent. v0.10.0 adds multi-sandbox and keeps any-editor approval.

Antigravity CLI. 1.1.17’s tag is the 1.1.16 tree with a different linux tarball. Pin the asset, not the tag.

Codex, DeepSeek Harness, OMP, Agent Zero, eve, Hermes, OpenClaw, Pi. Covered above. OpenHands. v1.14.0 holds. Agent Flywheel. Main moved; v0.7.0 holds. heypi, Flue. No change.

Closing

Codex put its judge in the box and left the box closed, and said so. That is a legitimate design, and it makes the gate your job. Before you upgrade anything this week, find the code that says no, and check who wrote it.