Capability discovery can affect what instructions, plugins, and skills reach a running agent. Passing the filesystem sandbox context into that discovery path makes the execution policy consequential before a tool is selected, with a limit: source receipts do not establish coverage across every surface or deployment.
Open receipt ›
The Diff Derby
Final
The Supervision Derby
Which repo makes the strongest source-evidenced move toward coding-agent work a human can inspect, steer, constrain, or recover?
A daily watch that opens the decisive diffs, explains what they change for people, and keeps activity volume out of the verdict.
Start Jul 29, 2026
Finish Jul 31, 2026
Field 4 repos
Latest Call
Jul 31, 2026
Jul 31, 2026
finish line
final
The Supervision Derby finishes split: Codex carries policy, Qwen Code narrows execution
The finish does not support one overall winner. Codex makes filesystem policy travel into capability discovery and records denials; Qwen Code gives a resumed fork a persisted, tested execution allowlist; OpenHands makes a disabled MCP server stay disabled; Gemini CLI turns a specific capacity failure into a terminal fallback signal. Those are different control layers, not interchangeable points.
Finish-Line Call / medium confidence
split decision
Codex and Qwen Code each make the strongest source-backed move on a different necessary control layer. Codex makes the enforced filesystem policy and its likely violations legible in capability discovery and execution. Qwen Code makes a fork’s executable tool surface narrow, testable, and durable through resume, but explicitly does not claim a security sandbox. OpenHands earns the most direct existing-user adoption path with a persistent MCP toggle, while Gemini CLI contributes a narrow but credible fallback fix. The short source window does not justify flattening those different mechanisms into one winner.
Qwen Code documents and tests exact names, MCP patterns, deny-all semantics, pre-construction rejection, and background revival. The limit is policy origin: this execution gate depends on a parent or caller choosing to apply it.
Open receipt ›Codex consolidates selection around a permission profile, uses its sandbox context while scanning capability roots, and records likely filesystem-sandbox denials. That creates a more inspectable relation between what policy says and what the runtime observes; it does not prove the operator interface presents every event clearly.
Open receipt ›An installed MCP server gets a card-level enable or disable control whose false state survives form edits and the redacted-secret cloud merge case. That is immediately reachable for the project’s existing control surface, although the source does not show a released build or an end-to-end blocked server call.
Open receipt ›The fork restriction is stored separately from model-visible declarations, survives a persisted sidecar, and resolves against the current runtime registry at cold revival. That separation makes stale capability lists less likely to silently regain authority, though no source here proves all Qwen Code surfaces behave the same way.
Open receipt ›Codex
contendingCodex makes capability discovery use the executor filesystem sandbox context rather than an unrestricted read path, and it records likely filesystem-sandbox denials from both ordinary and unified execution. That is a concrete operator-control move, but the sources do not prove every capability, platform, or deployment path is covered.
Evidence ›Gemini CLI
contendingGemini CLI now classifies model-capacity exhaustion without a server retry delay as terminal so fallback can begin instead of repeatedly retrying the same exhausted model. It is a well-tested recovery improvement, but it governs one provider error class rather than the broader delegation or tool-control surface.
Evidence ›Qwen Code
contendingQwen Code’s optional fork allowlist rejects a disallowed tool before construction, hooks, approval, or scheduling; it keeps an empty list as deny-all and restores the launch-time restriction after a background fork resumes against the current registry. That earns execution and durability edges, but the project explicitly calls it a child-capability restriction, not an administrator-enforced sandbox.
Evidence ›OpenHands
contendingOpenHands lets an operator enable or disable an installed MCP server from its card and explicitly preserves a false state through edits and cloud merge patches with redacted secrets. That gives existing users a visible, reachable control, but it is not proof that the server, agent, or sandbox beneath the card is safe.
Evidence ›Moves under review
Codex stops treating a discovered skill root as an unrestricted read
The new discovery request carries sandbox context through metadata, walking, and file reads, while adjacent execution work normalizes likely filesystem-sandbox violations. The public signal that could raise this call is an end-to-end test across every app-server capability source and platform.
Qwen Code makes an empty fork allowlist mean deny-all
The restriction persists in fork metadata and is reapplied to the current live tool registry at cold revival. The strongest counterevidence is in the design itself: a parent or caller supplies this policy, so it cannot substitute for an administrator boundary or a sandbox.
OpenHands preserves a disabled MCP server across cloud settings merges
The patch writes explicit enabled state when a redacted-secret cloud merge could otherwise leave an old false value in place, and preserves disabled state when the server form is edited. The next important source would connect that UI state to an end-to-end blocked invocation.
Gemini CLI makes a no-capacity signal eligible for immediate fallback
Focused tests cover both exhaustion reason strings and preserve a provider-requested retry delay when one exists. A public fallback integration test across a real configured model path would make the operator consequence less conditional.
The Field
Activity is not a scoreStarting laneCodex
openai/codex
A local coding agent whose CLI, app server, IDE, and cloud-facing paths increasingly share runtime and policy machinery.
Watch for
Frozen baseline Whether new control or observability work survives the jump between one terminal session and Codex's wider execution surfaces.
3418498f01 ›
Starting laneGemini CLI
google-gemini/gemini-cli
A terminal-first coding agent with built-in tools, MCP extensions, checkpoints, and several release channels.
Watch for
Frozen baseline Whether the project turns its broad tool surface into clearer operator control rather than simply another capability.
bef6119500 ›
Starting laneQwen Code
QwenLM/qwen-code
A multi-provider coding agent spanning terminal, IDE, desktop, daemon, SDK, subagent, and team modes.
Watch for
Frozen baseline Whether its fast surface expansion is matched by isolation, session integrity, and evidence a human can follow.
6a432ad2eb ›
Starting laneOpenHands
OpenHands/OpenHands
A self-hosted control center that can operate OpenHands and other ACP-compatible coding agents across local, remote, and cloud backends.
Watch for
Frozen baseline Whether its control-center architecture makes backend choice, sandbox risk, and long-running automation more legible to operators.
200dba420c ›
How the call is made
5 dimensionsDid the change materially alter what a user, operator, or maintainer can do?
Do code, tests, docs, migrations, and failure handling make the move credible?
Does the change make agent work easier to inspect, steer, constrain, or recover?
Can existing users reach the benefit without an unrealistic rewrite or migration?
Does the move look like a foundation, or a patch likely to be replaced?
Earlier Calls
Daily tape
Jul 30, 2026
live watch
provisional
Qwen Code takes the live edge by making resume answer to the present
Qwen Code’s new fork-resume path rebuilds the current instruction and tool surface instead of trusting the launch-time record. Codex makes a strong honesty move for MCP authentication, OpenHands protects a usable local fallback, and Gemini CLI’s caretaker runner remains a watched auxiliary path rather than a demonstrated control surface.
Codex
contendingCodex now reports unknown MCP OAuth capability when discovery is inconclusive, rather than calling it unsupported; protocol, app-server documentation, and a rate-limit CLI test make the operator-facing uncertainty concrete. It is a strong inspection improvement, but the source does not show a completed login or a broader recovery path.
Evidence ›Gemini CLI
watchThe caretaker PR-generator adds an evaluator that reads a bug specification and diff before a revision stage, which is relevant source work on inspectable agent output. But it remains under a project tool path, and the inspected source does not establish it as a general Gemini CLI control or recovery surface.
Evidence ›Qwen Code
front runnerQwen Code carries active Todo context across tool turns and rebuilds a resumed fork from the parent’s current system instruction, registered tools, MCP instructions, skills, and deferred tools. That makes recovery answer to the live runtime rather than a stale launch-time capability list. The strongest counterevidence is scope: these are source-level resume semantics, not evidence of adoption or of every desktop, daemon, and IDE path behaving identically.
Evidence ›OpenHands
contendingOpenHands now prefers a healthy local Agent Server when no valid selection exists, while preserving an explicit cloud choice. Focused tests cover cloud-first ordering and failed-local fallbacks, which makes the control surface more recoverable without claiming that the UI itself provides sandbox isolation.
Evidence ›Moves under review
Qwen Code rebases a fork’s tool surface at recovery time
The resumed fork is blocked when a current parent system instruction or registered tool surface is unavailable, then receives a reminder that current tools, MCP connections, and skills are authoritative. That is the day’s narrow edge because it makes a human-facing recovery invariant explicit. A public end-to-end resumed-fork regression in another surface could reverse the call.
Codex stops turning a discovery failure into a denial
The new `unknown` status survives the protocol and CLI path when OAuth discovery is rate-limited, preserving a distinction an operator can act on. The call would strengthen if the next public source shows how that state guides login and recovery rather than only reporting it.
OpenHands chooses the healthy local runner before the first listed backend
The fallback tests prevent a cloud-first or failed-local registry from masking an available local Agent Server, yet keep an explicit cloud choice intact. The next public signal that could raise its standing is a full runtime failover test that also proves the intended workspace and credential boundary.
Jul 29, 2026
starting grid
provisional
Codex takes a narrow Day 1 edge on instruction authority
The opening call rewards a tested delegation boundary, not activity volume: Codex carries instruction precedence through fork and resume paths, while Qwen Code's recovery fence, OpenHands' operator controls, and Gemini CLI's caretaker workflow each leave a different question open.
Codex
front runnerThe new multi-agent v2 instruction override has an explicit precedence model and focused coverage across fork modes, compaction, and cold resume. That is a narrow but concrete way for a human-set delegation boundary to remain legible when context changes.
Evidence ›Gemini CLI
watchA caretaker PR-generator gains a structured bug-fix, evaluation, and revision runner alongside dual database locking, but the inspected work lives under a project tool path rather than a demonstrated general operator-control surface.
Evidence ›Qwen Code
contendingA restart-pinned, default-off session-writer lease and its shutdown recovery work give Qwen Code a serious story about preventing concurrent history writers. The opt-in scope and explicit mixed-configuration risk keep it short of the opening edge.
Evidence ›OpenHands
contendingOpenHands adds an opt-in persistent-memory preference and removes the session key from WebSocket URLs in favor of an authentication frame. Both are concrete boundaries, but they are separate changes and do not yet prove a unified recovery or supervision model.
Evidence ›Moves under review
Codex makes subagent instruction precedence explicit
Role instructions, a configured override, inheritance, and explicit clearing now have a tested precedence across several fork and resume paths. The limit is scope: it is multi-agent v2 configuration, not a proof of broad tool-control behavior.
Qwen Code fences concurrent session writers behind an opt-in
The protocol can prevent two cooperating ACP or daemon writers from sharing one persisted session, and shutdown work addresses release and recovery. It remains experimental, default-off, and unsafe across mixed configuration.
OpenHands makes memory opt-in and moves session auth off the URL
The memory preference keeps the default request unchanged and the WebSocket patch authenticates before application traffic, but the sources do not yet connect them into one general supervision system.
The Rules
Evidence before spectacleThis is The Git Reporter's editorial comparison of public repositories. It does not imply that their maintainers entered a contest, share the same incentives, or are personally competing.
- Commit count, lines changed, stars, and contributor count never award points.
- Every provisional or final call must link the public source objects that support it.
- A small consequential diff may outrank a large batch of routine activity.
- A revert, broken test, missing migration, or unresolved safety boundary can earn a yellow flag.
- The finish may produce a winner, a split decision, or no call when the evidence is insufficient.
Finish line: By Friday, name the clearest improvement to supervised coding-agent work, split the decision by dimension, or make an honest no-call.