The Owner Can Be an Agent

Cursor Origin, Cursor’s early-beta code-hosting service, can accept its agent’s ownership decision in place of the code-owner approval count in Agentic mode. Origin can therefore clear the code-owner gate without a human owner’s approval; teams must choose which paths may work that way.

Issue window: 13-24 October 2026 (UTC). The 13 October label marks the previous issue’s cutoff. This 11-day catch-up covers everything after 13 October, 23:59:59 UTC, through the 24 October source reads. Origin’s ownership rules describe its current beta; the release note does not establish that they launched during this window.

Code review can carry the owner’s authority

For Origin teams, the code-owner setting decides who can clear the review gate. It offers three modes: Off; Classic, where an owner must approve the files they own; and Agentic. An installed app named in ORIGIN_CODEOWNERS can also approve the paths it owns, including under Classic. Yannis asks for narrower worker authority:

Can Cursor Origin give each cloud agent its own permissions? I’d like an agent to push fixes and open PRs without being able to merge just because my account can. And I’d want every action linked to the exact agent run.

Before wider delegation, require documentation stating when agent decisions replace owner approval, inspectable approval records and tests showing whether an app can approve its own patch.

Claude’s hosted code-review service leaves approval to others. ClaudeDevs announced Code Review is now generally available for Claude Team and Enterprise plans.@ClaudeDevs The 15 October announcement and service contract describe findings and a check, without the service approving or blocking the PR. For Claude, count useful findings. For Origin, count owner decisions avoided and overturned.

Where a required check must actually run, test whether a skipped or neutral result lets a merge through. Origin runs agents in CI prompt steps in team-owned namespaces, while its required-check rule accepts neutral and skipped conclusions. An agent deciding that the work does not apply can therefore satisfy the gate. Where that is unacceptable, require a separate check that can pass only by running.

For Claude tool calls needing human approval, verify that the host callback reaches a person. Claude 2.1.304 adds decider: "person", which selects who may approve the call. Ayyaz describes the boundary: Only the permission dialog or a host callback can approve that call. With nobody around to ask, it's refused with the mod's reason.@ayyazdev

Netlify describes its documented beta integration: Push a commit, and Netlify starts a build. Open a pull request, and the deploy preview link shows up right in the PR.@Netlify Cynthia Toporowski argues for a separate forge: It's simple. We need an open-source git platform for the agentic era. No vendor lock-in.@ItsCynnamoroll Before moving a repository to Origin, decide who should hold it and what switching away would cost.

Native tools give builders machinery to retire

Pi adapter users have a second interpreter to reconsider. On 22 October, optional pi-mcp-adapter 6.0.0 removed QuickJS, its separate script tools and scripting skill in favor of Pi’s codemode, Pi’s native scripting tool. Before maintaining a separate interpreter for external-tool calls, test whether Pi’s native scripting tool covers the same work.

Permission checks can now see which tool a script actually calls. The adapter exposes real deferred MCP tool identities to permission hooks. For the supported integration with Executor app tools, when the adapter recognizes an approval request, Pi asks in a dialog; the model cannot approve, and the call fails without a confirmation UI.

Gemini CLI stable 0.65.0 leaves referenced directories for the agent to explore instead of eagerly reading their files. A directory can become a place to investigate instead of a sack of text to stuff into context. Name indispensable files explicitly while testing whether your directory-packing wrapper still earns its keep.

Claude 2.1.302 enables forks on specified headless and SDK paths, and 2.1.305 reuses completed pipeline() and parallel() agents from the workflow journal. Try these supported replacements before maintaining prompt-copy and completed-step bookkeeping code.

Copilot 1.0.101 adds structured workflow-child output on supported models. Workflows remain in public preview, with legacy annual-billing exclusions. Ayyaz describes the subsequent handoff changes: Copilot CLI 1.0.102: subagents now honor the custom and MCP tool approvals you already gave, so no duplicate permission prompts. 1.0.103 reuses cached local MCP tool snapshots across worktrees in one repo.@ayyazdev Check the returned content and test a denied child action before retiring parsing or grant-reinjection code.

OpenHands users can try the supplied factory procedure before writing their own. Canvas 1.33.0 bundles extensions 0.35.0, including a factory setup recipe and code-changing work requested through GitHub mentions.

OpenHands monitor owners must decide who can request code changes using their token. The repository-write authorization has token-owner and explicit-allowlist bypasses, while work-mode restrictions and the fallback template rely on prompts. Choosing anyone for who may request work plus implement for making changes lets arbitrary non-bot commenters request work using your token.

A continuing job needs a recovery owner

Codex repairs conversation recovery: 0.164.0 records compaction summaries only after completion and restores compressed histories. Test an interrupted compaction and a resumed history before retiring your supervisor. Restoring what the agent can read does not, by itself, schedule another invocation or establish whether an external action finished.

Pi Durable addresses the next invocation. Builders trying experimental 1.4.0 should back up state before its one-way SQLite upgrade; 1.3.0 and earlier cannot reopen it. It checkpoints a sleeping phase and releases the invocation. On hosts that can evict running work, persist onWake alarms outside the invocation and reopen the harness before relying on sleeping jobs. Mario Zechner describes a phase:

the whole agent is composed of tasks. each task is made of phases. a phase is: store intent durably, execute effect, store result + next phase. process dies. reopen, get all previously live tasks and rerun the last phase they've been in. no event sourcing. that doesn't work well with long running sessions.

Lucas Meijer reports restart trouble with an earlier setup: kind of sad I have a pi durable coding agent with durable subagents, but I'm not using it because I wanna use opus55, and its long subagent-using sessions completely crumble on a restart@lucasmeijer. Cloudflare Agents SDK 0.30.0 wires Pi recovery through onWake, and its changelog promises Your harnesses can recover from evictions and storage errors automatically.@CFchangelog Test that host integration against restart failures in your own workload.

Hermes command-line users must track the gateway’s session and explicit completion status. Stable 0.22.5 keeps supported classic CLI work running after EOF or detach. Set agent.run_budget_seconds, the wall-clock budget for each turn. Closing that terminal is no longer a stop button.

Claude Code users should check eligibility before relying on background MCP work. ClaudeDevs announced Tasks and Elicitations are available today in the Claude Code CLI, rolling out to more Claude products soon.@ClaudeDevs The MCP Tasks public beta requires CLI 2.1.304 or later, feature eligibility and a supporting protocol-2026-07-28 server. Ordinary one-shot prompt runs, Desktop, VS Code, third-party providers and telemetry-off sessions are excluded. As with Hermes, remote task handles can survive client exit; a stdio server may die with it.

Before retrying an interrupted action, check what changed outside the agent. Andrzej Dabrowski describes adopting Eve: and a huge amount of custom code just evaporated.@ardabrowski Dmitry Dirin proposes a recovery test: If an 'add to cart' call succeeds just before a worker crashes, resuming the run shouldn't add the item twice.@chaka_kuka Claude 2.1.309 marks interrupted tool outcomes as unknown when a self-hosted session moves to a new runner. Keep an action identity and reconcile the external result before retrying. The cart lives outside the transcript.

Paperclip administrators can reconcile interrupted bills with the provider using stable 2026.1023.0’s usage receipts, retained until committed settlement. Its unpriced-usage block requires an applicable active, positive-amount hard-stop policy: the rule must apply to that usage, be enabled and set a positive limit. Better reasoning does not replace the record or the budget policy.

Fewer prompts can leave more work to review

OpenClaw skill owners should plan for review after a change. OpenClaw announced Skill Workshop 2.0 gets Undo@openclaw. Workshop has applied learned-procedure edits immediately since stable 2026.10.5; current 10.7 keeps ten versions per skill and defaults background learning to auto. Test Undo with independent backups. Restoring a procedure still leaves you to reconcile actions already taken.

Add another worker when it removes a waiting point you can name. Stephen Schoettler reports repairing a custom Hermes handoff and sets an acceptance test: the real test is whether useful work finishes without me babysitting it.@SteveSchoettler Teknium suggests shrinking the setup: Ya'll could just use one agent, Hermes, and be done with this madness lol@Teknium.

For Codex Goals users, report-reading time belongs in the supervision bill. In Will Depue’s account, the interface is part of the problem: they write giant unreadable .txt reports, which i open in this tiny markdown panel which crushes these 5 column tables into 150px. like come on@willdepue. A reply from Eric Provencher proposes a workaround: My pro tip after that, is to tell the manager to write all your steers down, and reconcile them against the overall goal before dispatching new work.@pvncher

Paperclip teams should count coordination interventions per accepted result. Jay describes a previous setup: eventually the agents go crazy with their own sub-tasks and it becomes more complex than it should.@jayrao In reply, dotta says fwiw in the most recent versions of paperclip we've curbed this too-many-subtasks behavior@dotta. The claimed improvement still needs testing: stable’s planning record leaves the live comparison unfinished.

Noah traced an earlier complaint to an old authentication restriction in saved instructions: It saved it as a hard rule and I only found it because I had Codex comb through CLAUDE.md and all of Claude Code’s memory files.@noahreeveshq Once Codex edited those memories, the agent could do the task. Check saved instructions before adding another workaround to the prompt.

A portable host must earn its operating cost

For Codex cost planning, distinguish a cache promise from a measured bill. Tibo writes You can now cache for 12h in the API and for logged in users across Codex & Work we keep cache forever and you don’t have any penalty for coming back to an old conversation or resuming after a few hours and are now guaranteed to hit the cache.@thsottiaux Separately, Kirill Dubovitskiy reports the same thread, ChatGPT login and 6.1 Sol: Same thread resumed after 13h: 0% cached.@bra1n_dump The accounts do not supply a matched comparison of request prefixes, access routes or subscription charges.

Codex’s prefix-preserving forks, with a legacy-compaction exception, do not establish perpetual subscription credit. Budget from actual charges on your own setup.

The portability objection comes from swyx: you also want to take into account kv cache and dreaming optimizations that only harness-model colocation can achieve.@swyx Judge a reusable host by accepted work, migration effort and observed inference cost. For Pi, weigh the adapter machinery you can retire against the recovery work your host must own, then compare that operating cost with the provider harness you would otherwise use.

Upgrades still decide what can be delegated

Codex fleet owners. Keep marketplace installation inputs and destinations constrained until the URL-policy parsing repair, only in 0.165.0-alpha.1, reaches stable and rejects conflicting URL forms. Test the updater with saved settings, because CLI overrides do not reach that updater.

Managed Claude Code owners. Test a policy-required approval against a user-written permission extension on latest 2.1.310; at the 24 October read the stable selector served 2.1.308. Verify that sec-default, the built-in policy guard, is loaded and its verdict holds are enabled. These preserve policy-backed approval requests and refusals against user-written extensions. An extension returning allow must not let the tested action run.

Claude Code unattended-job owners. Set each job’s permission mode explicitly, with refusal for actions requiring human approval. Do not depend on unconfigured headless defaults, which changed in 2.1.302.

Claude Code users receiving repository bundles. Test the exact bundle on your installed binary before treating the earlier hostile-repository concern as resolved. Use 2.1.309’s released ultrareview workspace-trust repair, included in released 2.1.310.

OpenClaw shell-review owners. Verify that replacement command arguments require separate approval. Use stable 10.7’s approval check on final hook-rewritten arguments or extended-stable 2026.9.34’s backport.

OpenClaw operators using Bash. Keep reviewing shell-test operands: the Bash predicate repair remains on main: a quoted test -v operand on Bash 4.2 and later can execute substitution without its expected allowlist review.

OpenClaw service owners. Check the runtime before upgrading: stable 10.7 requires Node >=24.22.1 <25 || >=26.12.1.

Copilot CLI fleet owners. Choose explicitly whether sandboxed commands may reach local services. Hazem Omier flags its sandbox now lets commands reach localhost and private-network services by default.@hazemomier 1.0.100’s released default widens local-service access inside an enabled sandbox; 1.0.101 permits direct macOS localhost TCP when local access is enabled and no host filters apply.

Origin integration owners. Budget migration work for nine breaking API changes dated 14-23 October. Test IP checks for machine-credential archive requests and signed downloads at both steps; ordinary app and service-account git/API access remains exempt. An archive refusal proves too little about the rest of the integration’s reach.

Copilot plugin and Gemini extension users. Compare installed content with the requested commit before loading pinned code. Copilot 1.0.103’s closing notes name no checkout-verification repair; Gemini 0.65.0 retains the unchecked checkout path. Require a named tagged repair and a check of the installed commit before trusting either installer to enforce the pin.

Cursor Rollouts teams. Count saved review hours only after retaining the failing input, regression test and human interventions from a completed repair handoff.

Teams moving code hosting to Origin. Test namespace transfer and continued bot access under its early-beta account restrictions. Sun of Dog reports My account ID changed, and there is no user-driven way to migrate the codebase. Support confirmed they must handle it manually.@thesunofdog Diane Liu offers help: this is a gap in our repo lifecycle that we'll work on fixing ASAP. in the meantime if you DM me your account info or support ticket # i can fix this for you now!@dianeliu21 A successful first push is too small a migration test.

Paperclip 2026.1023.0 administrators. Audit active human Operators’ permissions before restart or Cloud sign-in. Stable can add fourteen grants at startup or Cloud sign-in. Choose a narrower role where necessary: deleting rows can let seeding recreate them. Verify any stored scope intended to restrict access.

Paperclip remote-worker owners. Keep Codex within the supported range >=0.149.0 and <0.161.0; standalone 0.164.0 is outside it. Changes for call_api parity, live-review preservation and Stop recovery remain on preview.

Hermes external-tool launcher owners. Update MCP launchers to install mcp-serve in the selected profile and use hermes mcp-serve, because stable 0.22.5 removes the old built-in command. The implementation remains in the Hermes plugin.

OpenHands local operators. Keep production secrets out of the shared local store until your deployed stack prevents a terminal-enabled agent from reading an excluded credential. Canvas 1.33.0’s automation-key alias still reaches raw secrets without conversation-profile filtering in server 1.58.1.

The other providers need narrower checks

OpenCode integrators. Port SDK, event and plugin contracts before upgrading the V2 server; test saved sessions, tool results and compaction with your intended client/server pair. V2 2.1 keeps older history readable while moving replay fields under native and removing session.compacted. Choose the package explicitly: V1 opencode-ai 1.19.4 and V2 @opencode/cli 2.1.4 both own the opencode command.

DeepSeek Harness testers. Use disposable trials and retain recovery for processes and external actions. 0.2.1-rc.2 is a prerelease, and 0.2.1-rc.3 is also a prerelease. SDK resume restores saved history and the working directory. The security question remains same-user isolation of browser-owner authority: commands sharing your OS account still need separate scrutiny.

Eve tool owners. Before re-enabling consequential tools, test that queued text sent before an approval question cannot answer it and that Cancel followed by Approve stays cancelled. Those are 0.79.1’s queued-consent timing repair and 0.81.0’s repair that makes the first consent answer final. Current non-prerelease 0.83.0 remains a beta product; its sandbox migration writes state older releases cannot resume.

Antigravity users. Apply 1.4.7’s MCP OAuth account-switch isolation repair, reconnect affected servers and inspect earlier calls for the wrong account. Conversation approvals now reach children, widening what one grant authorizes.

Grok Build users. Test a forked shell’s actual directory against the repair already documented in 1.0.60. Worktrees inherit main-checkout allows from 1.0.67. The setting worktree_inherits_main_approvals controls that reuse; turn it off where each checkout needs a fresh decision.

Grok Build users receiving repositories. Admit hostile .git/config only after a named repair or controlled startup-refusal test; 1.0.70’s closing notes name no background-Git repair.

Omnigent administrators. Coordinate 0.19.0’s delegated Slack-credential migration across clients and bot before the server. Update OS and image trust separately from 0.19.1’s certificate-dependency updates after the eMudhra compromise.

Oh My Pi users. Test stable 18.12.6 for the released ACP command-approval and debug-log redaction repairs. Restrict existing models.yml files and rotate exposed keys: the inline-key file-permission repair remains on main. Choose computer.backgroundFallback: refuse, which refuses the input call if background delivery is unavailable instead of taking over the desktop.

A machine owner is a policy choice

Bitter Lesson Maxing means building where improving general agents compound your advantage. Retire prompt-copy, interpreter and restart code when the supported replacement preserves your application’s contracts. Keep the procedures, accounting records and recovery code that still cover work the general loop leaves undone.

Amdahl Maxing means spending scarce human attention where judgment changes the outcome. Thariq puts the question to anyone running several agents at once: what's your P0? what would it look like if you gave it your full attention?@trq212 Keep the task and acceptance test fixed. Judge delegation by accepted results per hour of human intervention, counting recovery, overturned decisions, report reading and migration.

Choose the Origin paths where an agent’s ownership decision can stand without routine human review. Keep a named person responsible for exceptions and reversals.