Model selection and tool mode participate in turn construction rather than living only in the visible prompt.
Agent Atlas / Coding agents
openai/codex
A local coding agent whose public Rust runtime makes session state, sandbox policy, tool modes, subagents, and operator control unusually inspectable.
Coding agent
Full dossier
Reported + sourced
Reviewed August 26, 2026
Intended operator
Developers working from a terminal, editor, app, or an integrating client.
Primary surfaces
CLI and TUI / app-server protocol / editor and application clients
Tracked repository
Teaching mechanism
The visible prompt is only one input to the first request
The runtime can inspect pending input, resolve permissions and tool mode, run hooks, and add higher-authority context before a model invocation is assembled.
Evidence limitAn interception point does not prove that injected instructions are correct, disclosed, or consistently enforced.
Inspect the source
System Map
Eight inspection boundariesThread history, goals, skills, instructions, and rollout metadata are assembled and persisted through separate runtime paths.
Typed tools are planned by the model and executed through runtime handlers rather than by the model itself.
Permission profiles and sandbox policy travel with session and turn state.
Thread stores, rollout records, interruption handling, and resume views make work durable and reconstructable.
Subagent lineage, startup hooks, lifecycle events, and send/receive receipts distinguish parent and child work.
The operator can review, interrupt, approve, redirect, and resume work through client surfaces.
Structured events, diffs, tool results, thread metadata, and public tests provide inspectable receipts.
Learn Through This Project
8 lessons
Chapter 1
Before the First Model Request
Chapter 2
The Invisible Prompt
Chapter 3
Tool Calls: Contract, Authorization, Execution
Chapter 4
Loops, Workflows, and Recovery
Chapter 5
Delegation Is a Distributed System
Chapter 7
The Approval Trap
Chapter 8
The Human Control Loop
Chapter 9
Trust Must Make Its Case
Latest Reporting
8 articles
Before Codex Trusts a Workspace, It Stops Letting the Workspace Choose Its Helpers
September 3, 2026 — A merged Codex change moves automatic pre-trust helper lookups to known system locations, sanitizes plugin-sync Git, and makes diagnostics inspect a workspace-influenced path without running what they find. openai/codex, google-gemini/gemini-cli
Codex Says It Stopped Wasting Your Allowance. The Public Code Can Prove Only Part of ItAugust 30, 2026 — Eight fixes, five public code trails and three closed rooms: OpenAI's repository strongly supports several mechanisms in its Codex usage announcement, but not the reset, the savings percentages or every background worker. openai/codex
Codex Puts a Broker Between the Agent and the SecretAugust 25, 2026 — A newly merged Codex change says a project file can describe the work, but it should not be able to switch on the credential broker or choose the provider context that reaches an agent shell. openai/codex
An Approval Must Keep Its DenialsAugust 19, 2026 — Codex is tightening the rules beneath its approval layer: a broad remembered grant must not reopen a denied child path, an unfamiliar shell must identify itself, and a stale reviewer score should be visible as stale. openai/codex
When a Context Limit Drops the User’s TurnAugust 17, 2026 — OpenClaw found a required Codex compaction preflight treating an intentional no-op as a fatal failure—so an overlong session could lose the incoming user turn before the model ever answered. openai/codex, openclaw/openclaw
Codex Stops a Thread’s Permission From Leaking Into a Read-Only EnvironmentAugust 15, 2026 — A new Codex regression test makes the sharpest promise in its permissions work: a selected environment configured read-only must stay read-only even when the surrounding thread can write. openai/codex
Coding Agents Are Building Themselves—But Git Can Prove Only Part of ItAugust 11, 2026 — Across 40,345 unique commits in ten public agent codebases, coding-agent credit becomes sharply more visible in 2026—and the missing receipts matter as much as the names that appear. openai/codex, google-gemini/gemini-cli, anomalyco/opencode, QwenLM/qwen-code, cline/cline, aaif-goose/goose, OpenHands/OpenHands, charmbracelet/crush, mistralai/mistral-vibe, Kilo-Org/kilocode
Permissions now travel with Codex’s work environmentAugust 6, 2026 — Codex is moving a permission choice out of the thread’s background and into the selected environment that runs the command, applies the patch, sees the image, and carries work to another agent. openai/codex
Primary Sources
Open Questions
- Which effective instructions and permissions can every client show before a turn begins?
Evidence state describes what this Atlas profile can support today. It is not a product score and it is not evidence that uninspected capabilities are absent.