Agent Atlas / Comparison Lab

Delegation Receipts

How does a parent agent prove what a child did, received, and returned?

Inspection test

Find parent IDs, child IDs, sent payloads, received results, lifecycle states, cancellation behavior, and merge rules.

Read The Course

3 lessons

Project Mechanisms

19 mapped projects

A project appears here because the boundary is relevant to its documented or reported architecture. The evidence label says how far this Atlas has checked the mechanism.

Coding agentsReported + sourced

openai/codex

The visible prompt is only one input to the first request

The runtime can inspect pending input, resolve permissions and tool mode, run hooks, and add higher-authority context before a model invocation is assembled.

LimitAn interception point does not prove that injected instructions are correct, disclosed, or consistently enforced.
Coding agentsReported + sourced

google-gemini/gemini-cli

Hooks can add context or stop work before execution

BeforeAgent and related hook boundaries let the runtime attach delimited context or block a run before the next agent step.

LimitA documented hook boundary does not establish that every extension is safe or that every client exposes the added context.
Agent frameworksReported + sourced

NousResearch/hermes-agent

Approval state follows the worker thread

Thread-local approval state narrows the risk that consent for one task becomes ambient authority for another.

LimitThread-local state does not prove that every executor or plugin consumes it correctly.
Runtimes and workbenchesReported + sourced

openclaw/openclaw

A generated diff needs a reproducible base

Diff evidence becomes trustworthy only when the runtime records enough repository state to distinguish agent output from a guessed comparison.

LimitA better diff base does not prove the patch is correct or that every downstream review preserves the provenance.
Coding agentsReported + sourced

anomalyco/opencode

OpenAPI becomes a typed tool contract

An adapter can turn a public API description into model-visible tools while keeping schema validation, credentials, execution, and result handling separate.

LimitA valid schema does not establish that credentials are correctly scoped or that the remote API is safe and reliable.
Runtimes and workbenchesReported + sourced

shepherd-agents/shepherd

The proposal, not the patch, is the result

A retained run keeps changes beside the working tree until a reviewer selects, applies, releases, or discards the output once.

LimitProject-owned tests and documentation do not establish an independent security audit or broad production use.
Coding agentsProject documented

Kilo-Org/kilocode

Autonomous mode deliberately removes confirmation prompts

The project documents an automation mode in which permission prompts are disabled, making the trust placed in the surrounding CI or sandbox environment explicit.

LimitProject documentation states the contract; TheGitReporter has not yet traced the enforcement path through the implementation.
Coding agentsProject documented

QwenLM/qwen-code

One daemon can expose a shared agent session over ACP

The documented daemon mode serves one agent session to multiple clients over HTTP and server-sent events, turning client identity and session ownership into protocol questions.

LimitThe daemon is documented as experimental; multi-client reliability and authority require source and interoperability testing.
Agent frameworksProject documented

mastra-ai/mastra

Suspension persists workflow state before human input

The project documents human-in-the-loop suspension backed by storage so a workflow can pause and later resume from durable execution state.

LimitTheGitReporter has not yet inspected storage adapters, failure recovery, or enforcement across deployments.
Coding agentsProject documented

cline/cline

Plan and Act separate exploration from approved effects

The project documents a Plan mode for investigation and strategy, an Act mode for execution, per-action approvals, optional auto-approval, diffs, and reversible checkpoints.

LimitProject documentation describes the control contract; TheGitReporter has not yet traced every surface through the shared engine.
Agent frameworksProject documented

pydantic/pydantic-ai

Types can make model output and tool contracts explicit

The framework presents agent dependencies, tool inputs, and structured results through Python types and validation boundaries.

LimitTyped validation narrows representation errors; it does not prove semantic correctness or safe execution.
Agent frameworksProject documented

microsoft/agent-framework

Orchestration is an application contract, not a model feature

The repository separates agent construction from explicit multi-agent workflow and deployment APIs in two language ecosystems.

LimitTheGitReporter has not yet compared lifecycle, persistence, and authority guarantees across the Python and .NET implementations.
Coding agentsProject documented

OpenHands/OpenHands

The executor boundary changes with the selected backend

The same control surface can connect to an agent running directly on a host, in Docker, on a VM, or in a cloud service; the README explicitly warns that an unsandboxed server has full filesystem access.

LimitDeployment options and warnings do not establish equivalent isolation or operational guarantees across backends.
Agent frameworksProject documented

crewAIInc/crewAI

A role name is not yet a delegation contract

Crew and task abstractions make responsibilities explicit, but dependable delegation also requires lifecycle, authority, result, cancellation, and evidence semantics.

LimitTheGitReporter has not yet inspected how those semantics behave across current execution and persistence paths.
Runtimes and workbenchesReported + sourced

yc-software/qm

The conversation address selects the tenant

A direct message resolves to a personal scope, a group message to a group scope, and a channel to a channel scope; the resolver then mounts organization state read-only and the active scope read-write before a harness runs.

LimitThe project calls itself early and experimental; its security policy documents incomplete audience filtering, conditional egress enforcement, plaintext in-use credentials, durable-data retention gaps, and other controls that are not yet complete.
Adjacent referencesReported + sourced

unslothai/unsloth

The harness is not the model

The launch command configures distinct protocol, context, compaction, state, and permission adapters for Claude Code, Codex, OpenCode, OpenClaw, Hermes, and Pi instead of treating one compatible endpoint as complete agent equivalence.

LimitDesktop is a beta, compatibility does not establish feature or behavioral parity, and TheGitReporter did not run a live model, GPU, tunnel, or agent session for the launch article.
Adjacent referencesReported + sourced

braintrustdata/agentbehavior

The answer key is versioned separately from the test

A BEHAVIOR.md names recurring expected conduct and its failure boundary; prompts, skills, traces, rubrics, and scorers can change around it without silently becoming the source of truth.

LimitThe CLI validates paths and frontmatter, not behavioral quality; useful judgments still depend on observable trajectories, calibrated fixtures, trustworthy judges, and human agreement about the intended conduct.
Runtimes and workbenchesReported + sourced

laude-institute/headlong

The next thought is a scheduled systems event

The monolith writes a future wake epoch, the always-alive dispatcher turns it into a trajectory step, and a backoff policy decides how soon the agent should think again based on whether the last wake produced visible work, only a thought, an idle, or an error.

LimitA continuous wake loop demonstrates persistent execution, not consciousness, reliable initiative, production safety, or measured long-term value.
Runtimes and workbenchesProject documented

andrewyng/openworker

Security coworkers drive scanners instead of impersonating them

The bundled code, dependency, and cloud-posture workflows name concrete scanners, require coverage disclosures when a tool is missing, and reserve fixes or cloud changes for reviewable code paths.

LimitOpen instructions make the intended workflow auditable, but do not establish scanner availability, model judgment quality, safe configuration, or production effectiveness on a particular machine.

Teaching Receipts

Latest Reporting

This is a mechanism comparison, not a feature score. “Reporting underway” means the Atlas has not verified the relevant path; it does not mean the project lacks it.