The child has two identities: parentage and history
Codex separates parent_thread_id from forked_from_thread_id. The first records the active delegation relationship; the second records where copied conversation history originated. A child can belong to one parent while beginning from another thread's snapshot.
Collapsing those fields destroys the distinction between control topology and data provenance. It also makes recovery, permissions, and result integration harder to reason about when a child resumes or reports late.
What changed since the first Atlas draft
Subagent send and receive logs make delegation easier to reconstruct.
assembledhq/143 Builder Work: 143 Turns Coding Agents Into Team InfrastructureDurable sessions, sandboxes, previews, and pull requests turn multiple agents into team infrastructure.
openclaw/openclaw, openai/codex, NousResearch/hermes-agent Agent Control Hints Become Runtime ContractsControl hints show how metadata becomes the contract a delegated runtime must honor.
What actually happens
-
Parent run
goal, topology, authority
-
Child A
scoped task and context
-
Child B
separate lifecycle
-
Child C
correlated events
-
Verify and merge
lineage, freshness, result
Spawn is a lifecycle transition
A production delegation surface needs more than spawn. Codex groups spawn, send, resume, wait, and close as a multi-operation protocol. Each operation implies valid state transitions, idempotency rules, terminal states, and behavior when control messages arrive late.
SubagentStart runs before a child's first model request and receives its identity and resolved type. This is a concrete interception point for policy, tracing, and task envelopes, but it does not by itself guarantee deadlines, cancellation, or safe result merging.
Topology, context, and authority are separate
Parentage answers who controls the child. Fork lineage answers which history produced its initial state. Authority answers which tools, credentials, and approvals it may use. Copying context must not silently copy privileges.
Hermes propagates approval context into local and remote execute_code worker threads and applies a fail-closed guard before child scripts start. Authority must cross execution boundaries explicitly and refuse work when required control context is missing.
Every event needs a return address
Session IDs, thread IDs, turn IDs, task IDs, request IDs, tool-call IDs, and parent-child relationships form a correlation spine for reconstructing distributed work. Timestamps and display names are not substitutes for explicit identifiers.
Crush exposed the failure case by carrying a caller RunID through events while commands shared a channel. Without strict correlation, an error from another prompt can terminate or contaminate the current command.
Completion requires join and merge semantics
A child reporting success does not mean its output is still applicable. The parent may have changed files, revoked authority, exceeded a deadline, or accepted another result. Join must validate the input snapshot, output schema, terminal status, and freshness.
Cancellation must be observable and monotonic. A cancelled child may still emit buffered events or finish remote work. The parent needs a policy for discarding late results, compensating side effects, and recording why an otherwise valid result was rejected.
Where the contract breaks
Orphaned child execution
Parent cancellation or shutdown does not propagate.
Misattributed result or error
Events share a channel without run, parent, and child identifiers.
Stale result integration
The child works from an old snapshot while the parent changes the same state.
What the product must prove
- Enumerate every delegated job with job ID, parent, fork source, child kind, state, deadline, and authority profile.
- Verify spawn, send, resume, wait, close, and cancel transitions reject invalid terminal-state changes.
- Trace one child result from input snapshot through tools and approvals to the parent's accept, reject, or merge decision.