Multi-agent coding / authority map / 29 SEP 2026

A crew chart is not a fuse box.

Owner, builder, and checker are useful names. They do not limit files, commands, network access, or release authority. Wire each seat to a boundary you can test.

The signal worth reading

Agent teams are becoming ordinary

OpenRig 0.6.1 puts Claude Code and Codex seats in one persistent team. Its starter rig uses an outcome owner and an independent checker. The guide asks the owner to record a bounded task, keep work local, verify it, send the exact candidate for review, and return the result.

Claude Code and Codex now document their own subagent systems. Both products use separate contexts to keep exploration and logs out of the main thread. Both also warn, in different ways, that parallel work needs limits. Claude gives each subagent its own tools and permissions. Codex recommends read-heavy parallel work first because simultaneous edits create conflicts and coordination cost.

The garage take is simple. A team diagram explains who should do the work. Runtime controls decide what each process can do. Keep both.

Role names guide behavior. Workspaces, tool rules, network policy, credentials, and a release gate constrain behavior.

01 / ROLE

Name one job

Give each seat one atomic purpose. The checker checks the exact candidate. It does not quietly become a second builder.

02 / WORKSPACE

Separate collisions

Use a read-only view or an isolated worktree. Name the patch owner before two agents touch the same file.

03 / CAPABILITY

Wire real limits

List writable paths, commands, network destinations, credential routes, and the stop control for each seat.

04 / HANDOFF

Pass one candidate

Record the revision, checks, objections, unresolved limits, and the human or system allowed to release it.

Interactive makeover / crew wiring loom

Wire one seat before adding another

A role picker usually changes a prompt and calls the job done. This control builds a seat contract across four ordered boundaries. The receipt is a review template. It does not configure a harness or prove that a runtime enforces the selected limits.

NAME ROLEPIN WORKSPACEBOUND CAPABILITYLOCK HANDOFF

Seat selector

Pick the seat, then select the contract sections you will fill and test.

Choose one seat

Outcome ownerOwns the task and candidate. BuilderChanges one bounded area. CheckerTests the exact candidate.

Include seat contract sections

Role recordPurpose, inputs, outputs, and forbidden substitutions.Selected Workspace recordRepository, revision, writable paths, and isolation method.Open Capability recordTools, commands, network, credentials, lease, and stop.Open Handoff recordExact candidate, checks, objections, and release owner.Open

1 of 4 contract sections selectedOutcome owner seat

The seat has a name. Its reach is still open.

The role section is selected. Workspace, capability, and handoff evidence still need real values and tests.

CREW WIRING LOOM / SEAT CONTRACT

SEAT=OUTCOME_OWNER

[x] ROLE_RECORD
PURPOSE=[REQUIRED]
INPUTS=[REQUIRED]
OUTPUTS=[REQUIRED]
FORBIDDEN_SUBSTITUTIONS=[REQUIRED]

[ ] WORKSPACE_RECORD
REPOSITORY_AND_REVISION=[REQUIRED]
ISOLATION_METHOD=[REQUIRED]
WRITABLE_PATHS=[REQUIRED]
PATCH_OWNER=[REQUIRED]

[ ] CAPABILITY_RECORD
TOOLS_AND_COMMANDS=[REQUIRED]
NETWORK_DESTINATIONS=[REQUIRED]
CREDENTIAL_ROUTES=[REQUIRED]
LEASE_AND_STOP=[REQUIRED]
NEGATIVE_TESTS=[REQUIRED]

[ ] HANDOFF_RECORD
EXACT_CANDIDATE=[REQUIRED]
CHECK_OUTPUT=[REQUIRED]
OBJECTIONS=[REQUIRED]
RELEASE_OWNER=[REQUIRED]

STATUS=1 OF 4 CONTRACT SECTIONS SELECTED
ENFORCEMENT=NOT VERIFIED
RELEASE_AUTHORITY=NOT GRANTED

Where the boundary lives

Put enforcement outside the prompt

A checker told to stay read-only may still inherit write tools. A builder told to avoid production may still hold a credential that reaches it. A lead told to stop after one patch may still leave child processes running. These are mismatches between the written role and the running boundary.

OpenShell 0.1.2 is useful here because its architecture separates the workload from a trusted supervisor. The workload sends file, process, and network requests across a protected channel. Policy decides what can pass. Credentials stay on the trusted side and are added only to approved requests. That is a runtime design, not a promise in a seat description.

You do not need one specific product to apply the pattern. Give every seat a narrow job. Put it in an isolated workspace. Restrict its real capabilities. Require an exact-candidate handoff. Let one named authority release. More agents can make work faster, but only these controls make the crew legible.

Source log / read 29 SEP 2026

What was read and what it supports

OpenRig repository and READMEPersistent mixed-provider teams, owner and checker seats, task queue, machine changes, provider hooks, workspace trust, and permission posture.github.com/mvschwarz/openrig OpenRig getting-started guideThe bounded first task, exact-candidate review, provider selection, readiness checks, and recorded result path.github.com/mvschwarz/openrig/blob/main/docs/reference/getting-started.md Claude Code subagent documentationSeparate contexts, custom prompts, tool limits, independent permissions, parallel research, persistent memory, and context costs.code.claude.com/docs/en/sub-agents Codex subagent documentationParallel subagent workflows, inspectable threads, token cost, read-heavy starting points, write-conflict warning, and sandbox controls.learn.chatgpt.com/docs/agent-configuration/subagents NVIDIA OpenShell architectureThe workload and supervisor split, outer network fence, policy checks, provider credentials, gateway duties, and protected channel.docs.nvidia.com/openshell/latest/about/architecture NVIDIA OpenShell repositoryInstallable project, supported runtimes, policy model, SDKs, telemetry statement, and public Apache 2.0 source.github.com/NVIDIA/OpenShell

Artifact check: npm reported @openrig/cli version 0.6.1 with a Node.js 22 or newer requirement. GitHub reported OpenRig v0.6.1 and OpenShell v0.1.2 as their latest releases. This pass inspected package metadata, release records, source, and setup documentation. It did not run either multi-agent runtime, so this dispatch makes no operational or isolation claim about a local installation.