A three-day code watch can end with a winner, a draw, or an excuse disguised as a scoreboard. This one ends with a split decision. The decisive sources do not describe one kind of control, and treating them as a single race would erase the thing a reader needs to see: supervision is a chain of boundaries, not a feature that one repository can win by adding more of.
Codex earns the consequence and operator-control edges. Its new capability-discovery patch sends the executor’s filesystem sandbox context through the metadata checks, directory walk, and file reads that discover skills and plugin material. An adjacent execution patch records likely filesystem-sandbox denials from both ordinary and unified execution. In plain terms: a policy that constrains execution should also constrain the route by which the agent learns what it can use, and an operator needs a visible record when that boundary is hit.
That is not a claim that every Codex surface is now uniformly contained, nor that the event record is a complete operator experience. It is a source-backed move from an abstract permission setting toward a policy that travels with the runtime.
Qwen Code has the sharper child boundary
Qwen Code takes execution and durability. Its new fork tool execution allowlist does something unusually concrete: an empty list means deny-all, and a disallowed tool call is rejected before the runtime constructs the tool, runs a hook, asks for approval, or schedules work. The restriction lives separately from the model-visible declarations, is stored in fork metadata, and is reapplied when a background fork revives against the parent’s current tool registry.
That last detail is the durable part. Resume should not quietly widen a child’s authority because the surrounding runtime changed. But Qwen Code’s design also supplies the crucial counterargument: this is a parent- or caller-provided child-capability restriction, not an administrator-enforced security sandbox. It can make a delegated task more steerable; it cannot replace the machine boundary that contains it.
The quieter moves still change the operation
OpenHands has the clearest adoption-path edge. Its MCP-server card patch lets an existing user enable or disable an installed server, then preserves an explicit disabled state through a form edit and the awkward cloud-merge case where secrets are redacted. An off switch that silently turns back on after an edit is not a control. The source shows the project defending that mundane but decisive state transition; it does not prove a disabled server can never be reached elsewhere in the stack.
Gemini CLI’s capacity-exhaustion fix is narrower still, but honest. A capacity error without a server-requested retry delay becomes terminal so the CLI can move to a model fallback instead of retrying the same exhausted model. The focused tests cover both exhaustion labels and retain a server-supplied delay when present. That is recovery hygiene, not a general supervision system.
The finish line is a map, not a trophy
The split follows the mechanisms. Codex has the edge where enforcement and observability meet. Qwen Code has the edge where a delegated child’s executable surface is narrowed and restored faithfully. OpenHands has the most direct control an existing user can reach; Gemini CLI has a credible, bounded exit from a retry failure. None of those sources proves adoption, a released build, a safe deployment, or a complete end-to-end recovery path.
The next signal that could rearrange the call is equally concrete: a public end-to-end test showing that a resumed restricted fork cannot regain a forbidden tool, that capability discovery cannot read beyond its filesystem policy, and that a disabled MCP server is blocked at invocation. Until then, “which agent is most controllable?” has the wrong shape. Ask which layer you are actually controlling—and which one is still merely a promise.