Agent Atlas / Comparison Lab

Delegation Receipts

How does a parent agent prove what a child did, received, and returned?

Inspection test

Find parent IDs, child IDs, sent payloads, received results, lifecycle states, cancellation behavior, and merge rules.

Read The Course

3 lessons

Project Mechanisms

14 mapped projects

A project appears here because the boundary is relevant to its documented or reported architecture. The evidence label says how far this Atlas has checked the mechanism.

Coding agentsReported + sourced

openai/codex

The visible prompt is only one input to the first request

The runtime can inspect pending input, resolve permissions and tool mode, run hooks, and add higher-authority context before a model invocation is assembled.

LimitAn interception point does not prove that injected instructions are correct, disclosed, or consistently enforced.
Coding agentsReported + sourced

google-gemini/gemini-cli

Hooks can add context or stop work before execution

BeforeAgent and related hook boundaries let the runtime attach delimited context or block a run before the next agent step.

LimitA documented hook boundary does not establish that every extension is safe or that every client exposes the added context.
Agent frameworksReported + sourced

NousResearch/hermes-agent

Approval state follows the worker thread

Thread-local approval state narrows the risk that consent for one task becomes ambient authority for another.

LimitThread-local state does not prove that every executor or plugin consumes it correctly.
Runtimes and workbenchesReported + sourced

openclaw/openclaw

A generated diff needs a reproducible base

Diff evidence becomes trustworthy only when the runtime records enough repository state to distinguish agent output from a guessed comparison.

LimitA better diff base does not prove the patch is correct or that every downstream review preserves the provenance.
Coding agentsReported + sourced

anomalyco/opencode

OpenAPI becomes a typed tool contract

An adapter can turn a public API description into model-visible tools while keeping schema validation, credentials, execution, and result handling separate.

LimitA valid schema does not establish that credentials are correctly scoped or that the remote API is safe and reliable.
Runtimes and workbenchesReported + sourced

shepherd-agents/shepherd

The proposal, not the patch, is the result

A retained run keeps changes beside the working tree until a reviewer selects, applies, releases, or discards the output once.

LimitProject-owned tests and documentation do not establish an independent security audit or broad production use.
Coding agentsProject documented

Kilo-Org/kilocode

Autonomous mode deliberately removes confirmation prompts

The project documents an automation mode in which permission prompts are disabled, making the trust placed in the surrounding CI or sandbox environment explicit.

LimitProject documentation states the contract; TheGitReporter has not yet traced the enforcement path through the implementation.
Coding agentsProject documented

QwenLM/qwen-code

One daemon can expose a shared agent session over ACP

The documented daemon mode serves one agent session to multiple clients over HTTP and server-sent events, turning client identity and session ownership into protocol questions.

LimitThe daemon is documented as experimental; multi-client reliability and authority require source and interoperability testing.
Agent frameworksProject documented

mastra-ai/mastra

Suspension persists workflow state before human input

The project documents human-in-the-loop suspension backed by storage so a workflow can pause and later resume from durable execution state.

LimitTheGitReporter has not yet inspected storage adapters, failure recovery, or enforcement across deployments.
Coding agentsProject documented

cline/cline

Plan and Act separate exploration from approved effects

The project documents a Plan mode for investigation and strategy, an Act mode for execution, per-action approvals, optional auto-approval, diffs, and reversible checkpoints.

LimitProject documentation describes the control contract; TheGitReporter has not yet traced every surface through the shared engine.
Agent frameworksProject documented

pydantic/pydantic-ai

Types can make model output and tool contracts explicit

The framework presents agent dependencies, tool inputs, and structured results through Python types and validation boundaries.

LimitTyped validation narrows representation errors; it does not prove semantic correctness or safe execution.
Agent frameworksProject documented

microsoft/agent-framework

Orchestration is an application contract, not a model feature

The repository separates agent construction from explicit multi-agent workflow and deployment APIs in two language ecosystems.

LimitTheGitReporter has not yet compared lifecycle, persistence, and authority guarantees across the Python and .NET implementations.
Coding agentsProject documented

OpenHands/OpenHands

The executor boundary changes with the selected backend

The same control surface can connect to an agent running directly on a host, in Docker, on a VM, or in a cloud service; the README explicitly warns that an unsandboxed server has full filesystem access.

LimitDeployment options and warnings do not establish equivalent isolation or operational guarantees across backends.
Agent frameworksProject documented

crewAIInc/crewAI

A role name is not yet a delegation contract

Crew and task abstractions make responsibilities explicit, but dependable delegation also requires lifecycle, authority, result, cancellation, and evidence semantics.

LimitTheGitReporter has not yet inspected how those semantics behave across current execution and persistence paths.

Teaching Receipts

Latest Reporting

This is a mechanism comparison, not a feature score. “Reporting underway” means the Atlas has not verified the relevant path; it does not mean the project lacks it.