Evidence Trail

Subagents Aren’t Just Getting Smarter. They’re Getting Contained.

March 27, 2026 / Daily Edition / 8 source signals.

repo openai/codex main
8 source signals 2 repos 5fa14db
> 5fa14db / March 27, 2026 / Daily Edition
Read Story Open Edition

Reporter Notes

Daily article notes — 2026-03-27

Selected angle

**Subagents Aren’t Just Getting Smarter. They’re Getting Contained.**

Core thesis: the interesting shift is no longer just that terminal agents can spawn helpers. Both Gemini CLI and Codex are increasingly treating those helpers like bounded workloads that need isolation, guardrails, cleanup, and less human interruption.

Why this angle is new versus prior articles

  • Not yesterday's routing/interoperability story.
  • Not the March 24 forensics piece: this is about containment and operational safety, not post-hoc traceability.
  • Not the March 23 execution-context story: this is about how delegated work is boxed in.
  • Not the March 18 “subagents grow up” piece: this is specifically about production-style boundaries and cleanup.

Candidate angles considered

1. Delegation is getting governors, not just horsepower.

2. Subagents are becoming operations-safe. **Chosen.**

3. Agent loops are centralizing runtime context.

Fresh signals scanned

Gemini CLI

  • PR #23903: subagent isolation and cleanup hardening
  • PR #22951 / commit 5fa14dbe4: resilient subagent tool rejection with contextual feedback
  • PR #22196 / commit d44615ac2: default max turns 15→30, max time 5→10
  • PR #22115: full migration to AgentLoopContext

Codex

  • PR #13460 / commit bda3c49dc: disable request input on sub agent
  • PR #13404 / commit 932ff2818: better multi-agent prompt with explicit ownership and non-revert guidance
  • PR #13456 / commit e07eaff0d: per-turn tool-call metrics
  • PR #15906: remove skill metadata from command approval payloads

Article structure

1. Hook: AI helpers are moving from “more interns” to “badge-controlled side rooms.”

2. Gemini evidence: isolation directories, cleanup hardening, rejection recovery, larger but bounded defaults.

3. Codex evidence: no request_user_input in subagents, explicit ownership prompts, metrics and slimmer approval payloads.

4. Synthesis: delegation is being operationalized.

5. Close with open question + CTA.

Sources — 2026-03-27

Prior state and prior articles

  • daily edition corpus/_state.json
  • Daily article archive titles reviewed under daily edition corpus/

Repo truth / code evidence

Gemini CLI local repo

Repo: https://github.com/google-gemini/gemini-cli

Local clone: repo source/gemini-cli

  • Commit d44615ac2f8c6e1cef2ffec3c997354375df4a20
  • File: packages/core/src/agents/types.ts
  • Evidence: DEFAULT_MAX_TURNS changed 15 -> 30; DEFAULT_MAX_TIME_MINUTES changed 5 -> 10.
  • PR #23903 — feat(core): subagent isolation and cleanup hardening
  • URL: https://github.com/google-gemini/gemini-cli/pull/23903
  • Evidence from PR body: subagent session files move into parent-session subdirectories; cleanup logic centralized; path traversal / file leak hardening.
  • Commit 5fa14dbe4283a9cb6b9c49825db9b6395065ca7c
  • Title: feat(core): resilient subagent tool rejection with contextual feedback
  • Files: packages/core/src/agents/local-executor.ts, tests.
  • Evidence: rejected tool calls return direct instructions so the subagent can acknowledge rejection and rethink instead of collapsing blindly.
  • PR #22115 — feat(core): Fully migrate packages/core to AgentLoopContext.
  • URL: https://github.com/google-gemini/gemini-cli/pull/22115
  • Evidence: broad migration across scheduling, prompts, safety, shell, web-search/web-fetch, loop detection.

Codex local repo

Repo: https://github.com/openai/codex

Local clone: repo source/codex

  • Commit bda3c49dc4a4ea052ed55faf9c4310e6875ca41e
  • File: codex-rs/core/src/tools/spec.rs
  • Evidence: request_user_input tool registration disabled for SessionSource::SubAgent(_).
  • Commit 932ff2818320e7c5181a28316db75e53620aeabc
  • Files: codex-rs/core/src/agent/role.rs, codex-rs/core/src/tools/spec.rs
  • Evidence: spawn-agent prompt now explicitly says assign ownership, avoid conflicting writes, accommodate changes from others.
  • Commit e07eaff0d32caaec47cc4b0616d1b32c086e904f
  • Files: codex-rs/core/src/state/turn.rs, codex-rs/core/src/tasks/mod.rs, codex-rs/core/src/tools/registry.rs
  • Evidence: per-turn tool-call histogram codex.turn.tool.call; turn state increments tool calls; metrics tagged by memory mode.
  • PR #15906 — chore: remove skill metadata from command approval payloads
  • URL: https://github.com/openai/codex/pull/15906
  • Evidence: approval contract slimmed by removing dead metadata across app-server / TUI / MCP boundaries.

Trend / web checks