| Anthropic Claude CodeClaude Code CLI2.1.282local CLI processConfig: Documentation-backed review of Claude Code 2.1.282 and current first-party docs; live Harness Operations tests pending. | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- This observation is for the terminal CLI, not Claude Desktop or IDE-specific UX.
Evidence | AvailableNativePrimary docs + Live test (pass) · Sep 25, 2026Evidence & scopePrerequisites- Use Claude Code non-interactive/print mode for scripting and automation.
Limitations- Agent SDK provides a richer programmatic surface but is deliberately out of scope for this CLI row.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Session identity is native Claude Code state and should not be renamed to a Harness Operations Run.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Resume semantics depend on persisted Claude Code session state.
Evidence | AvailableNativeRelease note · Sep 25, 2026Evidence & scopeLimitations- Interrupting the current turn does not imply rollback of already completed tool side effects.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Subagents are available natively; agent teams are experimental and require explicit enablement.
Limitations- Agent teams are experimental; this finding does not claim identical semantics between subagents and agent teams.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- This finding covers Claude Code-native delegation to subagents; it does not establish cross-vendor handoff or A2A interoperability.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Use permission rules and/or PreToolUse hooks rather than bypassPermissions when a protected gate is required.
Limitations- Prompt instructions such as CLAUDE.md are not equivalent to this technical gate.
Evidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Session/hook context can identify the session and decision path, but the reviewed CLI docs do not establish durable named-human Principal attribution for every approval decision.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Enable supported sandbox mode and do not use bypass permissions when an isolation boundary is required.
Limitations- Sandbox availability and enforcement depend on platform/configuration; permission prompts alone are not an OS isolation boundary.
Evidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Claude Code supports managed authentication, helpers, gateways, and environment configuration, but this review has not established the stronger matrix definition that credentials are consistently brokered/withheld from model context and tools.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Enable/configure Claude Code monitoring or use the built-in usage/status surfaces as appropriate.
Limitations- Exact exported metrics depend on telemetry configuration and privacy settings.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Configure one of the documented hard bounds such as tool/subagent concurrency or output-token limits.
Limitations- This does not imply a universal monetary budget or all-resource quota system.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Persist session transcripts and/or enable OpenTelemetry export.
Limitations- Raw prompt/tool content is redacted or disabled by default in several telemetry paths; enabling raw content has privacy implications.
Evidence | Partial / conditionalConfigured nativePrimary docs + Release note · Sep 25, 2026Evidence & scopeLimitations- Session transcripts, version/session IDs, hook data, managed-settings telemetry, and OTel signals retain material facts, but this review has not established a complete durable record of every resolved policy, credential, environment, approval identity, and side-effect fact.
Evidence |
|---|
| CursorCursor CLIhosted docs observed 2026-09-25local CLI processConfig: Rolling first-party docs; exact installed CLI build not independently pinned in this observation. | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Rolling hosted interface; not an immutable binary-version claim.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- No generic cancel/interrupt contract is claimed from this review.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Configure blocking hooks/permissions for the protected operation.
Evidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Not every permission/approval decision is shown to produce a durable named-Principal audit record.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Sandbox must be enabled/configured for the intended boundary.
Evidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- This establishes one mediated credential path, not general secret brokering for all tools/services.
Evidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Does not establish a complete immutable record of every policy, credential, sandbox, approval, and side-effect fact.
Evidence |
|---|
| OpenAI CodexCodex App Server0.157.0local App Server processConfig: Documentation-backed review of rust-v0.157.0; live Harness Operations tests pending. | Not applicableNot applicablePrimary docs · Sep 25, 2026Evidence & scopeLimitations- App Server is a machine-facing interface; interactive Codex UI surfaces are deliberately out of scope for this observation.
Evidence | AvailableNativePrimary docs + Live test (pass) · Sep 25, 2026Evidence & scopePrerequisites- Launch Codex App Server and speak its bidirectional JSON-RPC-lite protocol over the supported transport.
Limitations- This observation does not imply equivalence with Codex Web or Agents API.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Codex calls the durable native identity a thread, not a Harness Operations Run.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Resume semantics are thread-native and should not be generalized to every Codex surface.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Interrupting an active turn is not proof that already completed side effects were rolled back.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Concurrency limits and scheduling policy are not established by this documentation-backed observation.
Evidence | UnknownNativeRelease note · Sep 25, 2026Evidence & scopeLimitations- Current Codex releases contain multi-agent functionality, but this review has not yet established a stable App Server delegation/handoff contract for this capability definition.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Approval policy/configuration must require client review for the protected action.
Limitations- Approval requests cover specific Codex actions under configured policy; this is not a universal organizational approval system.
Evidence | Partial / conditionalNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- The reviewed App Server approval flow is scoped to thread/turn/client interaction, but the sources reviewed do not establish that every approval response carries a durable named human Principal identity suitable for Harness Operations accountability.
Evidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Use read_only or workspace_write sandbox rather than full_access when an isolation boundary is required.
Limitations- Specific enforcement details vary by sandbox mode/platform; full_access intentionally removes filesystem access restrictions.
Evidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Codex manages authentication and credential state, but this review has not yet established the stronger matrix definition that raw secrets can be brokered or withheld from model context across the scoped interface.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- The reviewed SDK exposes token usage; this observation does not claim cost/compute/storage reporting.
Evidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Sandbox and network policy are access controls, not evidence of generic token/cost/duration/compute/concurrency limits under this capability definition.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Retention and downstream audit guarantees remain the responsibility of the integrating client/operator.
Evidence | Partial / conditionalNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Thread/turn metadata, usage, items, settings, and persisted history provide material evidence, but this review has not established preservation of every resolved policy, credential, environment, and authority fact needed for a complete Harness Operations Audit Record.
Evidence |
|---|
| OpenCodeOpenCode CLI / headless server1.18.32local CLI/server processConfig: Documentation-backed review of v1.18.32 and current first-party docs. | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableConfigured nativePrimary docs · Sep 25, 2026Evidence & scopePrerequisites- Configure ask/deny rules; auto mode changes ask behavior but explicit deny remains enforced.
Evidence | Partial / conditionalNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Reviewed docs do not establish durable named-human Principal attribution for every response.
Evidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- This review does not establish an OS-level sandbox equivalent to AX/Cursor sandboxing.
Evidence | UnknownNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | Partial / conditionalConfigured nativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Does not establish generic token/cost/duration/compute budgets.
Evidence | AvailableNativePrimary docs · Sep 25, 2026Evidence & scopeEvidence | Partial / conditionalNativePrimary docs · Sep 25, 2026Evidence & scopeLimitations- Complete historical policy/credential/environment resolution is not established.
Evidence |
|---|