Can the runtime prove which rules governed the child?
Consider a resumed thread that delegates work to a child. The assurance question is not whether the interface displays a reassuring approval label. It is whether the runtime can prove which permission profile, tool mode, policy layers, and parent identity governed the child when it acted.
Recent Codex evidence provides parts of that case: permission profiles persist through thread storage, resolved tool modes travel on TurnContext, and parent-thread lineage is added to turn metadata. These mechanisms improve inspectability, but they do not prove that every downstream action obeyed the recorded controls.
What changed since the first Atlas draft
Plugin trust moves from marketplace framing into runtime policy.
mistralai/mistral-vibe Mistral Vibe Makes ACP Compatibility A Release ContractRelease claims become stronger when compatibility has tests and constraints.
mistralai/mistral-vibe Mistral Vibe Turns Release Claims Into Trust BoundariesRelease framing must be backed by diff-level trust boundaries.
An assurance case is more than a receipt pile
A useful assurance case begins with a bounded claim: this run used these policies, exposed these tools, inherited this authority, and produced these actions. It connects the claim to implementation evidence and names what the evidence cannot establish.
Commit counts and generic source lists are not enough. The important evidence is relational: which policy won, which control reached the turn, which worker owned the action, and whether the record remained intact through resume, delegation, failure, and recovery.
Policy needs provenance and conflict behavior
Codex requirements-layer composition adds ordered precedence, domain-specific merging, provenance, additive deny-read behavior, and fail-closed handling for conflicting managed hook directories. Policy combination becomes an inspectable operation rather than an unexplained final configuration.
Cloud-managed config support preserves backend-supplied layer identities through diagnostics, debug output, hook attribution, and app-server surfaces. Provenance can explain where a rule came from without proving that every runtime consumer applied it.
The control envelope must survive movement
Agent work crosses boundaries constantly: turns resume, models switch, workers spawn, and execution moves between local and remote paths. Trust weakens whenever active control state is reconstructed from assumptions instead of carried as explicit runtime data.
Persisted permission profiles, ToolMode on TurnContext, and parent-thread plus subagent-kind lineage create a stronger chain of custody. They let an inspector ask whether the same control envelope survived storage, model selection, delegation, and later analysis.
Recovery is evidence, not absolution
Hermes undo rewinds by soft-deleting transcript rows for audit and rebuilding the next context from active history. Codex separately exposes parent lineage so subagent relationships remain distinguishable from copied-history forks.
Those mechanisms improve reconstructability, but they do not reverse every external effect. A transcript can be rewound while a file write, network request, or remote action remains. Assurance must separate recoverable conversation state from irreversible world state.
The assurance case assembled
-
Bounded claim
known and limited authority
-
Policy evidence
layers, precedence, provenance
-
Runtime evidence
permissions and tool mode
-
Action lineage
worker, call, effect
-
Recovery evidence
rewind and reconstruction
-
Residual risk
gaps remain explicit
Where the contract breaks
Provenance theater
The runtime records where policy came from, but a consumer ignores the composed result.
Control-state split brain
Persisted metadata diverges from effective execution state.
Reversible transcript, irreversible world
Undo repairs conversation history while external effects remain active.
What the product must prove
- Show the effective policy layers, their precedence, and the provenance of winning values.
- Compare persisted permission, tool-mode, and lineage metadata with controls used for a resumed or delegated turn.
- Separate transcript recovery from external-effect recovery and identify actions requiring compensation.