Unit 1
Anatomy
Separate the operator, runtime, model, executor, and environment before attributing agency to any one layer.
Agent Atlas
How AI Agents Work
An updated field guide to coding-agent runtimes: what the model can see, what the runtime coordinates, what the operator can approve, and what the environment actually enforces.
Updated July 21, 2026
The Problem
The phrase AI agent hides several different systems. A model proposes. A runtime assembles context, authorizes requests, and coordinates work. An operator supplies intent and approves scoped requests. An executor acts under a bound principal. The environment accepts, rejects, and persists effects. Confusing those roles makes failures look mysterious and trust impossible to justify.
Evidence Boundary
Updated through the July 5, 2026 Daily Edition. The Atlas uses TheGitReporter articles, public repository evidence, and primary project sources as teaching material; it is a source-grounded field guide, not a claim that every project has converged on one architecture.
Field Desk
Updated July 21, 2026Choose a concept to connect the long-form map to the newest reporting. Each route gives you chapters, daily receipts, and one reusable inspection question.
Concept pressure
When does an API, MCP resource, shell command, or UI action become a model-usable tool?
Check whether the project separates discovery, schema validation, credential authority, approval, execution, and receipts.
Read The Chapters
Inspect The Receipts
OpenCode Turns OpenAPI Into Agent Tool Contracts
OpenAPI becomes a bounded tool adapter instead of a raw prompt trick. anomalyco/opencode
Shoubhit Dash Made OpenCode Read MCP ResourcesMCP resources become part of the reviewable tool surface. anomalyco/opencode
Agent Tools Are Getting Capability SwitchesCapability switches show tool availability as runtime policy. openai/codex, NousResearch/hermes-agent, earendil-works/pi
Concept pressure
Who owns saved agent context, and how can a reader tell whether it is current, scoped, and safe?
Look for provenance, namespace, retention, no-secrets rules, search scope, compaction visibility, and migration tests.
Read The Chapters
Inspect The Receipts
OpenWork Makes Team Memory A Governed Agent Surface
Memory Bank turns saved context into a tested user-scoped capability. different-ai/openwork
Mario Zechner Kept Pi Compaction VisibleCompaction becomes visible maintenance state rather than silent compression. earendil-works/pi
Fenglanhua Made OpenClaw Prove Its Memory MigrationA memory migration becomes credible because the patch adds proof paths. openclaw/openclaw
Concept pressure
How does a parent agent prove what a child did, received, and returned?
Find parent IDs, child IDs, sent payloads, received results, lifecycle states, cancellation behavior, and merge rules.
Read The Chapters
Inspect The Receipts
Codex Gives Subagents A Delivery Receipt
Structured send and receive logs make subagent work traceable. openai/codex
Builder Work: 143 Turns Coding Agents Into Team InfrastructureA builder project routes agents through durable sessions, sandboxes, previews, and PRs. assembledhq/143
Agent Events Are Getting Return AddressesReturn addresses explain why event identity matters before delegation scales. openai/codex, openclaw/openclaw, charmbracelet/crush, NousResearch/hermes-agent
Concept pressure
Where does consent live when an agent uses tools, wakes later, or delegates work?
Trace the decision from prompt to worker thread to executor, and reject designs that collapse scoped approval into global trust.
Read The Chapters
Inspect The Receipts
Hermes Makes Agent Approvals Thread-Local
Thread-local approval state narrows where consent can accidentally leak. NousResearch/hermes-agent
OpenClaw Narrows Who Can Wake An AgentWake authority becomes a permission boundary, not just scheduling plumbing. openclaw/openclaw
Agent Safety Gates Catch Edge CasesCross-repo edge cases show safety gates as runtime contracts. google-gemini/gemini-cli, openclaw/openclaw, NousResearch/hermes-agent
Concept pressure
Can the operator see enough of the agent system to steer, review, stop, and resume work?
Inspect review surfaces, status indicators, session threads, branch summaries, pending work, and evidence rendering.
Read The Chapters
Inspect The Receipts
OpenCode Turns Agent Review Into A First-Class Work Surface
Review panels make agent output easier to inspect before acceptance. anomalyco/opencode
Mario Zechner Makes Pi Sessions Render Their Own EvidenceDurable session entries become a place to show proof, not just text. earendil-works/pi
Tau Turns Agent Architecture Into OnboardingArchitecture notes become onboarding infrastructure for contributors and agents. alejandro-ao/tau
Concept pressure
What survives interruption, restart, protocol change, or a client disappearing?
Find durable session identity, serialized state, replay rules, expiry, cancellation, reconciliation, and the point where an unknown effect becomes safe to retry.
Read The Chapters
Inspect The Receipts
Tau's Protocol Rewrite Keeps Yesterday's Sessions
Compatibility fixtures keep persisted histories usable across a protocol rewrite. alejandro-ao/tau
Codex Keeps the Prompt After You Interrupt ItPending input remains attributable after an interruption instead of disappearing into runtime state. openai/codex
OpenWork Gives MCP Failures a Useful AddressA failed session becomes recoverable when the runtime can identify the exact connection that died. different-ai/openwork
Concept pressure
What would prove that the agent did the intended work rather than merely reporting success?
Look for traces, diffs, tests, environment effects, failure classes, eval criteria, provenance, and a caveat that separates project-owned evidence from production outcomes.
Read The Chapters
Inspect The Receipts
The Diff Can't Be Guesswork Once an Agent Writes
A trustworthy patch receipt needs a reproducible repository base. openclaw/openclaw, openai/codex
A Computer-Use Agent Needs a Second Meaning of SuccessTask completion and intended real-world consequence are different evaluation targets. NousResearch/hermes-agent
Shepherd Makes Safety Evidence a Release StoryNamed, executed, skip-free checks make a release claim inspectable. shepherd-agents/shepherd
Concept pressure
Which changes show agent projects leaving prototype mode and becoming maintainable infrastructure?
Favor tests, rollback decisions, release contracts, self-hosting checklists, source-visible caveats, and boring operational edges.
Read The Chapters
Inspect The Receipts
Mistral Vibe Makes ACP Compatibility A Release Contract
ACP compatibility is treated as a release contract with tests. mistralai/mistral-vibe
OpenWork Puts Self-Hosting On The ChecklistSelf-hosting becomes an operational checklist, not a hand-wavy promise. different-ai/openwork
OpenCode's Hardening Day Removes Layer ShortcutsLayer cleanup is a maturity signal because it removes shortcuts before they become contract. anomalyco/opencode
Learn The System
10 lessonsThe course is cumulative: first separate the layers, then trace state and action, then inspect control, and finally ask what would count as proof.
Unit 2
State And Action
Trace how a runtime chooses the next step, stores context, recovers work, and turns a proposed tool call into an effect.
Unit 3
Control
Inspect delegation, approval, and human intervention as lifecycle contracts rather than interface decorations.
Unit 4
Proof And Futures
Build an evidence-based trust case and distinguish durable architecture from an attractive forecast.
The Tracked Field
Open every dossier ›Complete scope does not mean false equivalence. The roster is divided into products, runtimes, frameworks, and specialist systems, and every page says what has and has not been inspected.
24tracked projects
13full dossiers
11scope profiles
0unmapped
13 projects
Coding agents
Operator-facing systems that can inspect, change, run, or review code.
4 projects Runtimes and workbenchesSystems that host, schedule, retain, or supervise agent work.
6 projects Agent frameworksLibraries for constructing agents, workflows, tools, and application-level control.
1 project Specialist agentsAgent systems whose primary execution environment is narrower than a general coding workspace.
The field guide follows every project included in Agent Pulse while keeping unlike products in distinct scope rings. A full dossier means the Atlas can teach through at least one public mechanism; it does not mean every capability has been exhaustively audited.
The Stakes
Today ›The most consequential changes in agent systems are no longer arriving only as model releases. The newer evidence shows tool adapters, memory banks, review panels, session lifecycles, approval state, delivery receipts, and public API contracts becoming the practical architecture of agent work.
The tracked field has widened to coding agents, runtimes, workbenches, frameworks, and specialist executors. Codex and Gemini CLI still anchor the early map, while newer project dossiers show how the same boundaries change across IDEs, terminals, shared services, browser environments, and application frameworks.
The useful question is therefore not whether an app has an agent feature. It is which boundary the project makes inspectable: context, tool authority, delegation, memory, recovery, human control, or trust.
OpenCode Turns OpenAPI Into Agent Tool Contracts
The tool-contract story: an OpenAPI adapter turns public API specs into bounded agent tools. anomalyco/opencode
OpenWork Makes Team Memory A Governed Agent SurfaceThe memory story: saved context becomes user-scoped, searchable, tested, and constrained. different-ai/openwork
Codex Gives Subagents A Delivery ReceiptThe delegation story: send and receive logs make multi-agent work easier to trace. openai/codex
Hermes Makes Agent Approvals Thread-LocalThe approval story: consent state moves from a shared flag toward thread-local runtime control. NousResearch/hermes-agent
Where Runtimes Disagree
The newer projects do not converge on one implementation. Their disagreements reveal which agent boundaries are still being negotiated in public code.
Tool contracts
OpenCode can adapt OpenAPI specs into CodeMode tools, Pi exposes session-specific rendering, and MCP resource support keeps moving into agent clients.
Open tensionA model-visible tool, a validated schema, a credentialed call, and a safe executor remain separate facts.
Memory ownership
OpenWork turns team memory into a governed surface, Pi keeps compaction visible, and OpenClaw makes chat-history lifecycle a maintainer concern.
Open tensionSaved context is useful only when source, scope, freshness, retention, and secret boundaries stay inspectable.
Delegation receipts
Codex adds structured subagent send and receive logs, 143 routes agent work through durable sessions and pull requests, and older return-address work explains why event identity matters.
Open tensionParallel workers help only when the parent can prove which worker acted, what it inherited, and whether its result still applies.
Approval state
Hermes makes approvals thread-local, OpenClaw narrows who can wake an agent, and cross-repo safety-gate coverage keeps exposing edge cases.
Open tensionConsent must follow the exact work without becoming an invisible global bypass.
Human work surface
OpenCode upgrades review, Tau turns architecture into onboarding, Pi renders durable session evidence, and OpenClaw exposes session threads.
Open tensionAgent autonomy becomes usable only when the interface can show state, evidence, pending decisions, and recovery options.
The Course Lessons
10 chaptersChapter 1 / 10
Before the First Model Request
A prompt reaches the model only after the runtime has restored state, resolved permissions, selected tool behavior, run interception hooks, and decided which hidden instructions belong in the request.
The visible prompt is one input to a runtime sequence that resolves identity, control state, and hidden instructions.
Chapter 2 / 10
The Invisible Prompt
The model acts on an assembled viewport containing visible messages, hidden turn context, path-triggered instructions, memory records, tool schemas, permissions, and inherited state.
The model request is assembled from visible and hidden layers; excluded information remains outside the decision viewport.
Chapter 3 / 10
Tool Calls: Contract, Authorization, Execution
A tool call crosses independently governed boundaries: schema, registration, policy, approval, execution authority, result handling, and audit.
A tool request becomes an action only after validation, policy, any required operator decision, bound execution, and environment enforcement.
Chapter 4 / 10
Loops, Workflows, and Recovery
Repeated model-tool interaction is only one control structure. Production runtimes combine probabilistic loops with host-defined workflows, queues, interrupts, terminal states, and recovery operations.
The workflow owns admissible transitions and blocks retry when an external effect may have committed without a known outcome.
Chapter 5 / 10
Delegation Is a Distributed System
A subagent is a remote worker with its own lifecycle, context snapshot, authority, failures, and result stream. Treating delegation as a prompt trick hides the contracts that determine whether the work can be trusted.
Delegated work crosses control, policy, execution, observation, and integration boundaries.
Chapter 6 / 10
Memory Is a Typed Storage Contract
Calling every retained fact memory obscures incompatible stores and guarantees. Thread history, notes, retrieval indexes, summaries, caches, and archives have different owners, lifetimes, and deletion behavior.
Memory layers differ in lifespan, fidelity, ownership, retrieval cost, and correction path.
Chapter 7 / 10
The Approval Trap
Approval is useful only when it catches a meaningful change in authority, explains that change, and keeps the decision attached to the work.
Useful friction appears where authority changes; repeated low-value prompts feed broad bypass modes.
Chapter 8 / 10
The Human Control Loop
A useful interface exposes active work, gives intervention a defined runtime effect, preserves evidence during correction, and resumes the intended session.
Every intervention must return evidence showing what changed before work resumes.
Synthesis / Chapter 9 / 10
Trust Must Make Its Case
Trustworthy behavior is not a personality trait or product promise. It is an assurance case built from inspectable policy provenance, durable control state, bounded execution, traceable lineage, recoverable records, and explicit residual risk.
A trust claim requires policy, runtime, lineage, and recovery evidence while unresolved risks remain visible.
Forecast / Chapter 10 / 10
The Future Has Three Branches
There is no single inevitable agent future. Current source evidence supports three competing scenarios: supervised software organizations, governed capability markets, and managed but less inspectable runtime stacks.
Current mechanisms branch into competing futures depending on whether identity, capabilities, and managed policy become more inspectable or more opaque.
Source Discipline
Begin with a source-visible mechanism, not a product claim.
Keep model proposals, runtime control, operator supervision, executor authority, and environment effects distinct.
Connect each concept to a recent Daily Edition receipt so the reader can inspect the concrete code story.
Place evidence beside the claim it supports, then state what the evidence cannot prove.
Name failure signals and give readers an inspection test they can reuse.
Primary External Sources
OpenAI Agents SDK: Agent class
Defines an agent in terms of instructions, tools, guardrails, handoffs, model settings, MCP servers, and run context.
OpenAI Agents SDK: handoffsFrames handoffs as delegation from one agent to another specialized agent.
OpenAI Agents SDK: guardrailsShows how input, output, and tool guardrails attach to different workflow boundaries.
Model Context Protocol specificationDefines resources, prompts, tools, sampling, roots, elicitation, progress, cancellation, logging, and trust considerations.
Model Context Protocol toolsDescribes model-controlled tool discovery and invocation, with human-in-the-loop guidance for sensitive operations.
Anthropic: Building effective agentsSeparates workflows from agents and treats retrieval, tools, memory, orchestration, evaluator loops, and tool design as the practical substrate.
Anthropic: Introducing the Model Context ProtocolExplains the motivation for a common protocol connecting assistants to data sources, tools, and workflows.
Google Gemini CLIPublic repo for a terminal-first open-source AI agent with built-in tools and MCP support.
Google Gemini CLI: subagentsDocuments specialized subagents with focused prompts, tool scopes, independent context windows, and delegation back to the main agent.
OpenAI CodexPublic repo for a local coding agent, useful as an operator-facing example of sandboxed tool work and source-visible runtime choices.
LangGraphDocuments durable execution, human-in-the-loop state inspection, memory, and debugging for long-running stateful agents.
ReAct: Synergizing Reasoning and Acting in Language ModelsResearch foundation for interleaving reasoning traces and actions in external environments.
TheGitReporter Daily Edition archiveThe local article corpus feeding this Atlas update, including June and July agent-runtime coverage.
OpenCodePublic repo now used heavily for tool-contracts, review surfaces, MCP resources, and runtime hardening examples.
OpenWorkPublic repo for team memory, self-hosting, OpenCode workbench, and governed agent workspace examples.
OpenClawPublic repo for session threads, wake controls, command approval, memory migration, and operator-facing runtime state.
PiPublic coding-agent repo useful for compaction visibility, session evidence, package boundaries, and maintainer policies.
Hermes AgentPublic repo used for approvals, worker-thread authority, undo, session UI, telemetry, and reliability examples.
TauPublic agent-harness repo used for onboarding, branch context, and contributor workflow examples.
Mistral VibePublic repo used for release contracts, ACP compatibility, and trust-boundary examples.