Model selection and tool mode participate in turn construction rather than living only in the visible prompt.
Agent Atlas / Coding agents
openai/codex
A local coding agent whose public Rust runtime makes session state, sandbox policy, tool modes, subagents, and operator control unusually inspectable.
Coding agent
Full dossier
Reported + sourced
Reviewed August 26, 2026
Intended operator
Developers working from a terminal, editor, app, or an integrating client.
Primary surfaces
CLI and TUI / app-server protocol / editor and application clients
Tracked repository
Teaching mechanism
The visible prompt is only one input to the first request
The runtime can inspect pending input, resolve permissions and tool mode, run hooks, and add higher-authority context before a model invocation is assembled.
Evidence limitAn interception point does not prove that injected instructions are correct, disclosed, or consistently enforced.
Inspect the source
System Map
Eight inspection boundariesThread history, goals, skills, instructions, and rollout metadata are assembled and persisted through separate runtime paths.
Typed tools are planned by the model and executed through runtime handlers rather than by the model itself.
Permission profiles and sandbox policy travel with session and turn state.
Thread stores, rollout records, interruption handling, and resume views make work durable and reconstructable.
Subagent lineage, startup hooks, lifecycle events, and send/receive receipts distinguish parent and child work.
The operator can review, interrupt, approve, redirect, and resume work through client surfaces.
Structured events, diffs, tool results, thread metadata, and public tests provide inspectable receipts.
Learn Through This Project
8 lessons
Chapter 1
Before the First Model Request
Chapter 2
The Invisible Prompt
Chapter 3
Tool Calls: Contract, Authorization, Execution
Chapter 4
Loops, Workflows, and Recovery
Chapter 5
Delegation Is a Distributed System
Chapter 7
The Approval Trap
Chapter 8
The Human Control Loop
Chapter 9
Trust Must Make Its Case
Latest Reporting
8 articles
Watching Codex Can Change When Its Tools Start
October 19, 2026 — New request observers expose outcomes and available token usage. Where you put them in the sequence changes when a tool can leave the queue. openai/codex
How Codex made the assignment the center of the appOctober 16, 2026 — Every’s origin story celebrates a desktop built around agents. The public record reveals the quieter achievement underneath: separating the machinery that does the work from the interface that helps people direct it. openai/codex
Pi and Crush Tell the Terminal When They Need YouOctober 9, 2026 — Two released coding agents now share a status protocol for working, waiting and finished runs. It gives compatible terminals a way to surface the agent that needs attention—without deciphering each tool’s screen. charmbracelet/crush, earendil-works/pi, charmbracelet/bubbletea, openai/codex
Who Supplies the Agent? OpenAI Hosts It, Pydantic Assembles ItSeptember 28, 2026 — Pydantic’s weekend changes tie a framework, a coding harness and a terminal client to one release process. Set beside OpenAI’s managed Agents API, they reveal a choice that model rankings miss: which parts of the agent your team still has to run. openai/codex, pydantic/pydantic-ai, openclaw/openclaw
Before Codex Trusts a Workspace, It Stops Letting the Workspace Choose Its HelpersSeptember 3, 2026 — A merged Codex change moves automatic pre-trust helper lookups to known system locations, sanitizes plugin-sync Git, and makes diagnostics inspect a workspace-influenced path without running what they find. openai/codex, google-gemini/gemini-cli
Codex Says It Stopped Wasting Your Allowance. The Public Code Can Prove Only Part of ItAugust 30, 2026 — Eight fixes, five public code trails and three closed rooms: OpenAI's repository strongly supports several mechanisms in its Codex usage announcement, but not the reset, the savings percentages or every background worker. openai/codex
Codex Puts a Broker Between the Agent and the SecretAugust 25, 2026 — A newly merged Codex change says a project file can describe the work, but it should not be able to switch on the credential broker or choose the provider context that reaches an agent shell. openai/codex
An Approval Must Keep Its DenialsAugust 19, 2026 — Codex is tightening the rules beneath its approval layer: a broad remembered grant must not reopen a denied child path, an unfamiliar shell must identify itself, and a stale reviewer score should be visible as stale. openai/codex
Primary Sources
Open Questions
- Which effective instructions and permissions can every client show before a turn begins?
Evidence state describes what this Atlas profile can support today. It is not a product score and it is not evidence that uninspected capabilities are absent.