The Classifier Is Off

Codex 0.148.0 cut stable on 18 August, 381 commits past 0.147.0. The tree at that tag contains guardian-v2. In the same pin, the feature is UnderDevelopment and default_enabled: false. Two days later 0.149.0 became npm latest.

The drought broke. The classifier did not turn on. Config lockfiles are gone in 0.148.0. If you enable the classifier, 0.149.0 fail-closes scoring errors; 0.148.0 does not. The fail-closed patch merged 24 minutes after 0.148.0 cut.

A team that waited for a stable so they could stop describing alpha as the product still does not have a model in the approval seat unless they flip a flag. The vendor said the same thing from the other side the next morning:

Their applications control the interface, context, tools, and approvals while the harness handles the agent loop.@OpenAIDevs

If the app owns approvals, the harness is a loop. Guardian V2 in the tag and off by default is that design, not a contradiction of it.

Last week's unreleased items, 48 hours later

Five items from the previous issue resolved. Three tagged. Two did not.

Hermes v2026.8.18 contains the git-pull skill scan that was on main on 17 August. OMP 17.3.7 gained a GitHub release and an npm publish; 17.3.6 still has neither. Agent Zero v2.10 tags the ACP bridge and interactive Browser that sat on a non-default branch. The v2.9 SSRF tests are still there, byte-identical.

After 0.33.0 flipped channel messages to interrupt the running turn, the notes said set turnPolicy: queue if you needed the old wait. That field silently steered from 0.34.0 through 0.39.2. 0.39.3 copies it again. The control was in the notes. From 0.34.0 through 0.39.2 it was not on.

OpenClaw's approved-exec fix is still in no release. The newest tag is still v2026.8.1-beta.2 from 15 August. Compare that tag to the commit and you are 619 commits short. This window cut zero OpenClaw releases.

DeepSeek Harness rc.8 is still a prerelease. At SHA 141eb6fe the architecture page still says every part is a plugin and a patch can replace any row. The never approval policy is decided before the waterfall, so a later prepend cannot bypass that one mode. Replacing the approval row still can. The request-trust module still says it is not an auth layer.

Shipped is not on. Merged is not shipped. Those two sentences are the whole brief.

The gate moved three different ways

Bitter Lesson Maxing is the test of whether a specialized control survives the next model. Amdahl Maxing is the test of whether a faster agent just lengthens the human queue.

Codex put a model classifier in a stable binary and left it off. That is a general method waiting behind a flag. An operator who ran into the billing surface the same day said the work was invisible:

guardian-v2, which was never displayed@acsmif

The tag confirms the classifier is present and off. It does not confirm the analytics UI.

DeepSeek left the gate as a plugin. rc.8 adds Claude Code and Codex subagents as Profile Bundles with a non-interactive permission mode. That mode is wrapper behavior. Do not attribute it to the wrapped harness.

OMP put a filesystem-write broker on npm. If you load registerFileWriteFallback, the OS denial is no longer the last word. 17.4.0 the same window breaks the tokenizer API, so the hook and the break are different cuts.

Pi's new harness is not in any of those channels. The maintainer said so, and git agrees: dev is 264 commits ahead of main.

a lot of activity is taking place in the dev branch and not on main :)@mitsuhiko

If you're curious about what's happening with the new harness in Pi, a lot of activity is taking place in the dev branch and not on main :)

Reading the default branch for that work is the wrong tree.

What became possible

Agent Zero v2.10 is the capability half that is actually installable. ACP is bundled, always on, with host file write and host code execution as the defaults. The internal Browser is a live Xpra session on loopback, not a screenshot log, and it shares one Chromium sign-in profile across chats. per_context only hides tabs. The v2.9 SSRF tests that block 127.0.0.1 and redirect-to-loopback are still in the tree, same bytes.

That is a workcell you can sit in front of. It is also one browser identity for every chat on the instance.

Claude Code for web, in one recorded session, left a machine that had no /dev/kvm and kept going:

without asking me first, it wrote a GitHub Actions workflow to run the experiments and pushed that directly to GitHub instead!@simonw

A sandbox that cannot run the job is not a stop. It is a prompt to change venue. Whether that is progress depends on whether you wanted the push.

The counter-read in Chinese was that only DeepSeek Harness survives an internal audit, because Codex and Claude Code are black boxes:

只有 deepseek harness 能进生产@cnzhihao

He is arguing the open plugin tree is what security review can see. The code still says that tree is a prerelease with an unauthenticated local UI. Both can be true at once. An auditable design is not a production channel.

Breaking changes and security notes

OMP 17.4.0 replaces global token-counting functions with model-scoped Tokenizer instances. If you call countTokens as a global, this cut breaks you. /handoff now overwrites the session instead of forking.

Claude Code 2.1.235 (18 August): Shift+Tab inside a permission comment field approved the edit and granted session-wide edit. Check /permissions if you used that field on 2.1.234.

Antigravity 1.1.16: a settings.json parse failure used to overwrite the file with defaults. A refused save now leaves the bytes alone.

eve 0.40.0 redacts brokered credential transforms in sandbox bootstrap logs. 0.42.0 stops channel HITL responses from carrying channel-local metadata into the session inbox.

OpenHands: the silent wrong-profile fallback missed v1.14.0. It is in v1.15.0, published 21 August, which is outside this window. Through 20 August the newest tag still has the hole.

Provider notes

Codex. Two stables in 48 hours. The classifier is in both and off in both. Resume restores the permission profile in 0.149.0, which is npm latest.

Claude Code. In-window latest 2.1.238 sits seven listed versions ahead of stable 2.1.231. The conservative channel now starts sessions in auto mode and still lacks the 2.1.236 classifier fixes. 2.1.239 is 21 August.

Gemini CLI. v0.56.0 is latest and two chore commits past v0.55.1. It is not a descendant of the retry/TTL work, and it dropped a v0.55.1 OAuth fix. experimental.enableAgents: false still loads built-in subagents. Git-env neutralization missed the promotion. Preview v0.57.0-preview.0 has those.

Antigravity CLI. 1.1.16 is the last git-backed changelog: a settings.json parse failure no longer overwrites the file. 1.1.17 is a GitHub release whose git tag is the 1.1.16 tree and whose linux tarball is a different digest. Pin the asset, not the tag.

Hermes Agent. v2026.8.18 is the cut that contains last week's git-pull skill scan, and the cut where list/steer/stop and hermes update stop lying. Delegation docs at that tag still say 50 and 3. The CLI execute_code panel, the /yolo false-OFF fix, and bot-group approval cards missed it.

Pi. v0.84.2 still the tag. The new harness is on dev. Live compaction docs describe an extension event the npm package does not emit.

OpenClaw. Zero releases. Approved-exec still main-only. On a released Codex sandbox install, a successful stop is not proof the process tree is gone.

Paperclip. Stable still v2026.817.0. Namespaced canary and nightly tags kept publishing on 18, 19, and 20 August. The default install did not move.

Agent Zero. v2.10 is the ACP and live-browser cut. Sign-ins are shared.

OpenHands. v1.14.0 still the in-window tag. The Git Sync page in that tag 404s against the bundled automation 1.7.1. The wrong-profile fix is in v1.15.0, which is 21 August.

heypi, flue. No in-window commits.

DeepSeek Harness. rc.8. Still prerelease. Still a plugin gate.

eve. Six stable tags, 0.39.1 through 0.42.0. 0.39.3 is the one that makes turnPolicy: queue bind again. 0.42.0 is the channel-HITL cut. Do not npm i eve unpinned; latest is already 0.44.0, which is 21 August.

Agent Flywheel. Optional stack tools on main. Last tag v0.7.0.

Omnigent. v0.10.0 adds multi-sandbox. Shared-editor approval is still any-editor. The Usage page is off unless you set OMNIGENT_FEATURES. The spend cap and the ACP result-phase fail-open did not move. deny_tag_push (default true) is in this tag; two issues ago it was nightly-only.

OMP. 17.3.7 is the first npm version with the write-fallback hook. 17.3.6 still missing. 17.4.0 breaks the tokenizer API.

Closing

This window is three days. It earned a brief because the drought broke and the defaults did not. The classifier is in the tag. The exec fix is not. The plugin gate did not grow a privileged core. If you only upgrade one thing, make it the install path you actually run, and then ask whether the thing that says no is on.