It is tempting to read a coding agent associated with a model family as a delivery vehicle for that model: pick the provider, run the loop, compare the answer. Qwen Code's public source offers a more demanding picture. The project has provider, tool, session, workspace, and server paths that must make sense even before the next model response arrives. Its July 25 workspace-trust change is a fresh receipt for that less glamorous work.
The patch's public summary says that trust-policy changes rebuild workspace runtime generations, affected daemon routes fail closed, and reconciliation state becomes visible to SDK and Web Shell clients. Its size is not the argument. The important shape is: a policy change can arrive while a workspace has sessions, persisted settings, tool capabilities, and work in flight. Treating it as a bare boolean flip would leave the runtime to guess which state remains authorized.
A policy edit is a lifecycle event
The source responds by giving the transition a name. A policy monitor observes changed trust; a reconciler computes the next state; generation guards stop old work from crossing into a new authority; public route handlers return untrusted or generation-closed responses instead of quietly proceeding. The diff also adds tests around drain and retry behaviour, stale session ownership, persistence, and cancellation. That is the kind of implementation a terminal-agent demo rarely has to show, but a long-lived runtime cannot avoid.
There is a practical operator lesson here. A workspace trust change is not finished when a settings file has been saved. The useful audit asks which task owns the old generation, which tool call gets stopped, what survives the drain, and how a later client learns that the old world is gone. If those answers are absent, a policy update can be less a guardrail than an unexplained mid-run fork.
Co-evolution is a pressure, not a score
Qwen Code's public repository gives a coding-agent team a close place to adapt tool and runtime behaviour around its intended model ecosystem. That can be useful: a harness may expose the provider assumptions it needs to inspect and revise. It also makes a careless claim more tempting. No repository change can tell us that a Qwen model is better, more adopted, or safer than another model. Nor does the source prove what a hosted account has enabled.
The public evidence supports a narrower and more useful conclusion: model-aware agents still need model-independent operational contracts. Trust state, tool routes, context, sessions, and recovery are the work that makes a model call part of a system rather than a screenshot. Qwen Code is putting one of those contracts in code.
This is late work against the original July 24 commitment, not an on-time substitute. The next signal should be a tagged release and a public end-to-end trace that changes a workspace policy during active work and shows the blocked, drained, restarted, and persisted states an operator would actually need to understand.