| Plans |
|---|
| Plan carries acceptance criteria and verification per task | Enforced A plan defines scope, ordered tasks, acceptance criteria, and verification. A task closes on accepted evidence, not an edited status line. 2 | Advisory Plan mode writes a markdown plan under ~/.claude/plans. Approving it exits plan mode. No criteria, dependency, or completion tracking is documented. Ultraplan was removed. 714 | Advisory /plan toggles plan mode and /goal sets a persistent goal. No acceptance ledger is documented. 20 | Advisory /plan drafts an Implementation Plan artifact with verification checkpoints; you click Proceed. Storage and completion tracking are not documented. 27 | Advisory Plan mode lets you approve, comment on steps, or rewrite the plan. No acceptance criteria tracking is documented. 30 |
|---|
| Edits blocked until the plan is approved | Enforced A plan enters processing only through its start operation, and a task runs only from a published execution packet. 2 | Partly enforced Plan mode blocks edits until approval, except in interactive terminals where bypass permissions are available; there, planning is not enforced. 7 | Partly enforced Plan mode itself is prompt-level per third-party guides. The read-only sandbox is the enforced option. 1922 | Advisory Review happens before code changes; whether the agent pauses is governed by artifact review policies, not documented as a hard gate. 27 | Enforced Vendor states every edit is blocked until you approve the plan. 30 |
|---|
| Work state lives outside the chat (states, transitions, dependencies) | Enforced IDEA, architecture documents, and plans carry lifecycle state in a project database with native transitions. A fresh session reads the record, not the transcript. 2 | Partly enforced Projects track thread states (ready for review, waiting on you, landing, resolved). Agent teams keep a shared task list with dependencies, and the docs note status can lag. No plan lifecycle. 610 | Not offered Chats persist with transcripts and /goal persists a goal. No lifecycle record is documented. 1620 | Not offered Conversations persist and reattach to their project; task groups and artifacts exist per conversation. No lifecycle record is documented. 28 | Not offered Sessions are saved and resumable. No lifecycle record is documented. 32 |
|---|
| Memory and instructions |
|---|
| Are instructions and memory binding or advisory? | Partly enforced Prose guidance is advisory, as it is everywhere. The facts that matter (state, eligibility, ownership, evidence, spend) are checked by the yakkl binary, so the model forgetting them changes nothing. 1 | Advisory Docs: Claude treats CLAUDE.md and auto memory as context, not enforced configuration. Project preferences are instructions Claude keeps to, not enforced settings. 86 | Advisory Memories are generated state, off by default. The docs say to keep required team guidance in AGENTS.md or checked-in documentation. 18 | Advisory Rules, skills, and hooks are documented; project memory is not. 2826 | Advisory AGENTS.md is read; memory is reported as an on/off switch. 3032 |
|---|
| Durable memory shared across people and harnesses | Enforced Project records and memory live in the project, not in one person's home directory, and are harness-neutral. Team and Business plans share them. 3 | Partly enforced Auto memory is per machine and repository; the MEMORY.md index loads only its first 200 lines or 25 KB. A Project's memory belongs to one user and cannot be shared. 86 | Not offered Local store under ~/.codex/memories, per user, off by default. 18 | Unverified Not documented during the research window. 28 | Not offered Local sessions; no shared memory documented. 32 |
|---|
| Coordination |
|---|
| Parallel agents with declared write sets, ownership, and locks | Enforced Tasks declare their files. Ownership and locks are checked before a write; foreign changes are preserved and attributed, never claimed. 1 | Partly enforced Agent teams use file locking for task claims only; docs advise splitting files so teammates do not overwrite each other. Project threads isolate by branch. Teams are experimental and off by default. 106 | Partly enforced Subagents and git worktrees isolate work. No ownership or lock model is documented. 21 | Partly enforced New-worktree mode gives each conversation its own worktree to prevent conflicts. No lock model is documented. 28 | Partly enforced Up to eight subagents in isolated worktrees. No lock model is documented. 3031 |
|---|
| Concurrency and thread limits are enforced caps | Enforced Agent depth, concurrency, spending, and cancellation are controlled by the configured runtime and permissions, not by asking nicely. 4 | Partly enforced Workflows cap concurrent agents (16 by default) and 1,000 agents per run at runtime. A Project thread limit you ask for is a preference rather than a cap. 116 | Unverified Not documented during the research window. | Unverified Third-party reviews cite a parallel-agent limit; not confirmed in vendor docs. 29 | Enforced Eight concurrent subagents maximum. 31 |
|---|
| Verification |
|---|
| Completion requires evidence for every acceptance criterion | Enforced A plan completes after the required evidence is accepted. An exit code or reviewer receipt proves a bounded fact, never production behavior on its own. 2 | Partly enforced Nothing by default: a green scheduled run does not mean the work your prompt describes succeeded. A TaskCompleted hook can block completion if you write one. 910 | Not offered Not documented. | Advisory Agents follow the approved plan, validating each milestone with tests. No evidence ledger is documented. 27 | Not offered Not documented. |
|---|
| Independent audit by a different provider that can block continuation | Enforced Scheduled audits run in a fresh session with a provider different from the implementers. A failed mandatory audit blocks the continuation that needs it. 2 | Model-judged /code-review and ultrareview (research preview) run Claude reviewers against a branch or PR. Same vendor; findings are advisory. 13 | Model-judged /review and auto-review use a reviewer agent on changes and approval requests. Same vendor. 1920 | Advisory Artifact review with comments. No independent audit is documented. 26 | Not offered Not documented. |
|---|
| Spend |
|---|
| Hard spend cap per run | Enforced A spend limit holds the run and asks; work is admitted against an estimate before it starts. 4 | Partly enforced --max-budget-usd stops a print-mode run at an estimated amount. Interactive sessions and Projects rely on plan usage limits, and a thread that hits them waits and continues in the next usage window. 126 | Unverified Plan usage windows apply. A token budget feature is reported in alpha by third parties, not in vendor docs. 23 | Not offered /usage shows credit consumption and quota. No per-run cap is documented. 26 | Not offered Subscription access. No per-run cap is documented. 30 |
|---|
| Cost estimate before a run is admitted | Enforced Estimate an ID, file, or directory before you run it. Estimates gate admission; they are not an invoice guarantee. 4 | Advisory A Large workflow warning appears past 25 agents or 1.5 million projected tokens. It does not pause or limit the run. 11 | Not offered Not documented. | Not offered Not documented. | Not offered Not documented. |
|---|
| Models |
|---|
| Routes work across model vendors | Enforced Native Anthropic, OpenAI, Google, and xAI integrations plus OpenAI-compatible endpoints. Routing picks eligible models per phase; pay with your own keys or Credit Units. 3 | Not offered Anthropic models only, including through Bedrock, Google Cloud, and Microsoft Foundry. 12 | Unverified OpenAI models in the product. The open-source CLI exposes provider configuration, which this review did not test. | Unverified Gemini first. The vendor's Choose a model page lists the current picker. 26 | Not offered xAI Grok models. 30 |
|---|
| Model or provider changes mid-run are recorded and disclosed | Enforced A fallback that changes behavior or spend is disclosed and recorded. No silent substitution of provider, model, or effort during a phase. 2 | Partly enforced A teammate or workflow model blocked by the organization allowlist is substituted by documented rules. The substitution is not surfaced as a run record. 1011 | Unverified Not documented during the research window. | Unverified Not documented during the research window. | Unverified Not documented during the research window. |
|---|
| Consequential actions |
|---|
| Deploy, migrate, delete, publish, and spend need explicit authority | Enforced Deploying, changing infrastructure, or spending requires your authorization. An agent's role, confidence, or passing test never supplies missing permission. 52 | Partly enforced Permission rules and hooks enforce. Auto mode's classifier blocks a documented list (deploys, migrations, force push, IAM grants) by judgment and pauses after repeated blocks. 7 | Partly enforced OS-level sandbox with network off by default enforces; approval policy and a model auto-reviewer decide the rest. Auto-review fails closed. 19 | Partly enforced allow, deny, and ask_user policies in the SDK; the CLI approves file changes with Y; a terminal sandbox is documented. 26 | Unverified Approval before edits is documented; the policy model was not reviewed. 30 |
|---|
| Scope and access |
|---|
| Availability and maturity, October 2026 | Release version 0.120.0. Paid plans only. Closed source. 3 | Core GA. Projects: public beta, Pro and Max, one user, no organization controls. Agent teams: experimental. Scheduled tasks and ultrareview: research preview. 6109 | Included with ChatGPT plans; CLI open source. Maturity is labeled per feature page. 21 | Free for developers; enterprise via Google Cloud. Gemini CLI consumer access ended June 18, 2026. 2425 | SuperGrok and X Premium+. Open source (Apache 2.0) since July 2026. 3031 |
|---|
| Where it runs | Your machine (CLI, Desktop). Dispatches to vendor APIs, or to vendor CLIs you already have. 1 | Local, cloud sessions, and Remote Control to your machine. Project threads are cloud by default. 6 | Local CLI and IDE, Codex Cloud, reusable cloud environments. 16 | Local app and CLI with a server-side harness; managed Chrome for browser tasks. 2425 | Local CLI; headless and ACP for embedding. 30 |
|---|
