Agents Get a Constitution

If You Only Read One Thing

Two files can now govern an agent without appearing in the repository it edits. Codex Makes Plugins Policy because a workspace manifest binds reusable instructions to live apps and inherited permissions. Cline Makes Summaries History because a generated synopsis replaces the session it describes. Codex 0.146 and Cline's compaction default turn setup and recollection into mutable operating state.

Codex Makes Plugins Policy

An agent plugin is no longer just a prompt folder with a better install command. It is becoming the unit through which a workspace distributes both behavior and authority.

Until now, the reusable-instruction layer and the connected-system layer were mostly separate. A skill taught an agent how to perform a workflow; an app granted access to a repository, data warehouse or messaging system. Codex 0.146 joins them through Agent Plugin manifests, workspace publishing and additional marketplace support. A plugin can package skills, required apps and app templates as one installable capability.

That packaging matters because the manifest is a policy map, not a new master key. OpenAI's Codex plugin documentation says administrators retain control of underlying app permissions; the workspace contract specifies role assignments, read/write controls, confirmation requirements, sync limits, domain restrictions and source boundaries. Source-system permissions still apply. In plain English, the plugin describes a job, while the underlying apps continue to decide which doors that job may open.

Why it matters: Distribution is moving above the individual agent session. An administrator can assign a plugin by role, publish a workspace version and make the same workflow appear across Codex surfaces without copying instruction files or reconnecting tools by hand. That is useful standardization, but it also makes the manifest the place where instruction provenance, integration dependencies and permission assumptions meet. Two days ago, Vercel made framework guidance a versioned agent skill; Codex now supplies the organizational channel that can distribute such packages with live app access attached. The security consequence is concrete: one study of 3,984 public agent skills found 76 confirmed malicious payloads and critical-level issues in 13.4% of the sample. Codex inherits app controls, which limits blast radius, but skill-only plugins remain available by default and imported plugins require an explicit refresh to receive upstream changes. The signal is confirmed if install and refresh flows make version, provenance and permission deltas reviewable as one change; without that, governance remains split across the manifest, the app settings and the source system.

Room for disagreement: Composing existing controls is safer than inventing a second permission system for plugins. A malicious instruction still cannot grant a user access that the app and source system deny. The weaker point is reviewability: several individually correct controls can still produce a capability no one evaluated as a whole.

Cline Makes Summaries History

A long-running coding agent eventually runs out of conversation window. Cline has changed the default response from trimming old state to letting another model-written artifact replace it.

Cline SDK 0.0.66 makes agentic compaction the default context strategy. It also fixes three failures that show why the change is more than a preference toggle: OpenAI-compatible providers could silently fall back to basic compaction because the summarizer lost the custom base URL; manual compaction budgeted against a generic 64,000-token window instead of the model's real limit; and tool-heavy transcripts could contain no acceptable cut point, causing endless “auto-compaction skipped” messages while context kept growing.

Think of compaction as replacing a meeting recording with minutes before the next meeting begins. Cline asks a model to summarize the technical decisions, edits and remaining work, then substitutes that summary for the older transcript. Its Auto Compact documentation says the call reuses cached input, so the incremental cost is mainly summary output. Unsupported models still fall back to rule-based truncation.

Why it matters: Once compaction is the default, the summary becomes part of program state. A missed constraint does not merely make the transcript less complete; it changes what every later tool call treats as established history. The new cut-point logic fixes an availability bug, but it also broadens the set of sessions that will cross this lossy boundary automatically. Provider routing matters for the same reason: a custom endpoint that accidentally invokes a different summarizer can change both cost and what survives. Cline offers checkpoints to restore pre-compaction state, yet the continuing agent reasons from the summary unless someone rolls back and compares. Codex governs what an agent may do before execution; Cline now governs which evidence remains salient midway through it. The default is vindicated if long-session task completion improves without a corresponding rise in post-compaction reversals, repeated work or contradicted decisions.

Room for disagreement: The old alternative was not perfect recall. It was often blunt truncation or a failed run, both worse than a structured summary. The honest claim is therefore not that compaction loses information, but that Cline has promoted a probabilistic recovery mechanism into the normal execution path without yet publishing a measure of what it forgets.

The Contrarian Take

Everyone says: Plugins make agents extensible, while automatic compaction lets them work longer.

Here's why that's incomplete: Both features reduce visible friction by inserting a mutable intermediary. A plugin hides several instruction and app dependencies behind one capability name; a compaction summary hides thousands of prior tokens behind one generated account of them. The relevant reliability question is no longer whether the feature works once. It is whether changes to authority and memory remain inspectable after installation, refresh, compaction and resume. Convenience is the surface effect. The structural change is that agent behavior increasingly depends on artifacts that are neither ordinary source code nor raw conversation history.

Under the Radar

• Codex can separate the interface from the machine. Version 0.146 lets app-server connect to remote Code Mode hosts over WebSocket. That makes a local or embedded client capable of controlling execution elsewhere, but it also puts authentication, proxy behavior, disconnect recovery and host identity on the correctness path. The same release fixes proxy handling across all four. (Details)
• Pydantic is preserving invisible continuation state. Pydantic AI 2.20 defaults OpenAI's reasoning.context to all turns and replays tool-search history across provider boundaries instead of dropping it. Provider portability now includes hidden reasoning and tool-discovery state, not merely compatible message text.

Quick Takes

Cline Fixed the Geography

Cline Desktop had been ignoring China/international endpoint toggles for Qwen, Moonshot, Z.ai and MiniMax, silently sending regional users to the wrong host. A provider name is not a routing guarantee; endpoint selection affects residency, latency and sometimes model behavior. The fix turns geography back into explicit configuration rather than accidental infrastructure state. (Source)

Vercel Stopped Polluting Stdout

Vercel AI SDK 7.0.41 routes its warning-system banner to standard error instead of standard output. That sounds cosmetic until an agent or pipeline expects stdout to contain valid JSON, generated code or another machine-readable artifact. Framework diagnostics sharing the data channel can corrupt a successful result without any model failure. (Source)

Retry Timing Becomes Data

Pydantic AI 2.19 adds response headers and retry_after to ModelHTTPError across provider SDKs. Rate-limit recovery can now consume structured server timing instead of parsing error strings or applying one generic backoff. The small API change makes provider throttling part of portable runtime state, where routing and observability layers can reason about it. (Source)

The Thread

An agent is acquiring two kinds of institutional memory. The plugin manifest says which procedures and outside systems belong to a role; the compaction summary says which prior decisions still count inside a run. One governs authority prospectively, the other governs evidence retrospectively. Remote hosts, regional endpoints, provider reasoning state and retry headers all become consequential because they sit between those declarations and execution. The next reliability frontier is not a larger context window or a longer tool list. It is change control for the artifacts that define what the agent can do and what it believes has already happened.

Predictions

New predictions:

• I predict: By September 30, 2026, at least two of Codex, Claude Code, Cursor and Cline will show a user-visible version, provenance or permission diff before a marketplace plugin or skill is installed or refreshed. If fewer than two expose such a diff by that date, the prediction is wrong. (Confidence: medium; Check by: 2026-09-30)

Issue date: 2026-07-29 · Generated: 2026-07-29 03:59 EDT