Can the operator see enough of the agent system to steer, review, stop, and resume work?
Inspect review surfaces, status indicators, session threads, branch summaries, pending work, and evidence rendering.
A project appears here because the boundary is relevant to its documented or reported architecture. The evidence label says how far this Atlas has checked the mechanism.
The runtime can inspect pending input, resolve permissions and tool mode, run hooks, and add higher-authority context before a model invocation is assembled.
BeforeAgent and related hook boundaries let the runtime attach delimited context or block a run before the next agent step.
Release and issue trails distinguish account, network, proxy, authentication, and CLI behavior when the implementation surface is not equally open.
Provider-specific session identifiers and expiry behavior are kept in typed session state instead of being flattened into one generic transport assumption.
Recovery rebuilds the client registry as a coherent unit instead of leaving a partially alive tool menu in place.
Thread-local approval state narrows the risk that consent for one task becomes ambient authority for another.
Diff evidence becomes trustworthy only when the runtime records enough repository state to distinguish agent output from a guessed comparison.
An adapter can turn a public API description into model-visible tools while keeping schema validation, credentials, execution, and result handling separate.
A sign-in flow remains pending with a claim link and explicit state instead of turning an operator action into an arbitrary elapsed-time failure.
ACP support is tied to release evidence so compatibility is more than a capability claim in documentation.
Compatibility code and tests keep older serialized message history usable while the wire and extension model changes.
A retained run keeps changes beside the working tree until a reviewer selects, applies, releases, or discards the output once.
The project repeatedly merges Codex upstream while owning release, installer, cache, documentation, and harness changes for a different product bet.
The project documents an automation mode in which permission prompts are disabled, making the trust placed in the surrounding CI or sandbox environment explicit.
The documented daemon mode serves one agent session to multiple clients over HTTP and server-sent events, turning client identity and session ownership into protocol questions.
The project documents a Plan mode for investigation and strategy, an Act mode for execution, per-action approvals, optional auto-approval, diffs, and reversible checkpoints.
The project documents a local Rust agent that connects provider choices and external capabilities through standard extension contracts instead of baking every integration into one model path.
The same control surface can connect to an agent running directly on a host, in Docker, on a VM, or in a cloud service; the README explicitly warns that an unsandboxed server has full filesystem access.
The agent can complete a web action while still violating the user's intended destination, account, or consequence; evaluation must inspect the effect, not only task completion.
A direct message resolves to a personal scope, a group message to a group scope, and a channel to a channel scope; the resolver then mounts organization state read-only and the active scope read-write before a harness runs.
The monolith writes a future wake epoch, the always-alive dispatcher turns it into a trajectory step, and a backoff policy decides how soon the agent should think again based on whether the last wake produced visible work, only a thought, an idle, or an error.
The bundled code, dependency, and cloud-posture workflows name concrete scanners, require coverage disclosures when a tool is missing, and reserve fixes or cloud changes for reviewable code paths.
Review panels make agent output easier to inspect before acceptance. anomalyco/opencode
Mario Zechner Makes Pi Sessions Render Their Own EvidenceDurable session entries become a place to show proof, not just text. earendil-works/pi
Tau Turns Agent Architecture Into OnboardingArchitecture notes become onboarding infrastructure for contributors and agents. alejandro-ao/tau
September 5, 2026 — Crush’s Hyper Prism work carries the routed model from response headers to a durable turn record—the provenance pattern builders need whenever a router may change what actually served the request. charmbracelet/crush
Hermes Decides That a Preference Can Have a HomeSeptember 4, 2026 — Hermes is redrawing a deceptively important line: a correction learned while doing one task belongs with that task's skill, while persistent memory is for facts that should matter everywhere. NousResearch/hermes-agent
Before Codex Trusts a Workspace, It Stops Letting the Workspace Choose Its HelpersSeptember 3, 2026 — A merged Codex change moves automatic pre-trust helper lookups to known system locations, sanitizes plugin-sync Git, and makes diagnostics inspect a workspace-influenced path without running what they find. openai/codex, google-gemini/gemini-cli
A Child Agent’s Approval Request Shouldn’t Hide in Another TabSeptember 2, 2026 — Openwork now brings a child session’s blocked permission into the parent task; fresh Goose state-machine work shows why seeing the ask is only half the control. different-ai/openwork, aaif-goose/goose
Builder Work: A Socket Path Is Not a Permission BoundarySeptember 2, 2026 — Qwen Code’s Claude-assisted inbox hardening shows the reusable craft: treat an endpoint and its credential as one capability, then erase both before a child process can inherit them. QwenLM/qwen-code
Kilo’s Migration API Lets Agents Resume Without Shipping Their TranscriptsSeptember 1, 2026 — Kilo Code’s public migration endpoint lets a configured server rediscover Claude Code or Codex history it can read, create a Kilo session per source, and make a normal retry a skip instead of a duplicate. Kilo-Org/kilocode
A Completed Agent Run Is Not a Successful OneSeptember 1, 2026 — OpenHands now treats a finished process and a successful task as different facts—so an automation can be completed, blocked, and operationally failing at the same time. OpenHands/OpenHands
Builder Work: A Safety Check Can’t Read a Blank FormAugust 31, 2026 — Qwen Code’s AUTO-mode repair turns an empty MCP permission prompt into a bounded, visibly incomplete policy view—a small interface with a serious security lesson. QwenLM/qwen-code
This is a mechanism comparison, not a feature score. “Reporting underway” means the Atlas has not verified the relevant path; it does not mean the project lacks it.