Framework Watch: Agno 3.1.4 Runs Claude Code and Codex Inside Checkpointed Sandboxes, Goose 1.55 Binds Subagents to Their Parent's Approvals, and Claude Code's Team Caps Review at Three Rounds

Agno 3.1.4 (October 16): the harness goes inside the sandbox

Agno's ClaudeAgent and CodexAgent now take a sandbox= parameter and "run the whole harness process inside an isolated, per-session computer instead of on the host". Each turn claims the session through a lease row in Postgres, restores the workspace and the harness's own conversation files from the last committed checkpoint, runs, then captures and verifies a new checkpoint. "A cancelled or failed turn publishes nothing and the previous checkpoint stays the recovery point." If the restored state has lost the Claude session id or Codex thread id, the turn fails with native_state_missing "before the model runs instead of silently starting a new conversation."

The DockerSandbox defaults are strict: UID 1000, a read-only image filesystem, dropped capabilities, no Docker socket mounts, and networking set to none by default. An AgentCore provider runs each sandbox generation in a Firecracker microVM. Keeping a container warm for the next turn cut a Claude turn from 8.2 s cold to 4.6 s on Docker. The release also stops attachments from overflowing buffers: images and PDFs up to 4 MiB now go to Claude Code inline as content blocks, instead of being read back as base64 that could exceed the SDK's 1 MiB message buffer.

Goose 1.55.0 (October 16): subagents inherit the leash

Goose's release notes, now published from the aaif-goose GitHub organisation, include "Bind subagents by their parent's hooks, mode and approvals", "Not infer or steer while a tool approval is pending", and "Finish pending tools before enforcing max turns". It removes background subagents and the orchestrator, and deletes the legacy agent loop. For observability, Goose now propagates "W3C trace context from ACP prompts to MCP tool calls" and surfaces the provider's x-request-id on responses and errors, so one trace can follow a request from the editor through the agent to a tool server and back to the model vendor. Auto-compaction is capped at 225k tokens by default.

How the Claude Code team reviews agent-written code

Anthropic's October 15 engineering post (Addy Osmani, Morgan Westlee Lunt and Qing Wang) reports that from June to September, merged pull requests to Claude Code "more than doubled while the share that had to be reverted fell by more than 40 percent." The new detail is about when review stops paying off. "One CLI PR went through more than fifty rounds of review and fixes overnight before its author stopped it." When the team ran git blame on what the reviewer kept flagging, "about 59% of it was code that had been there since the reviewer's first pass." The fixes: "After three rounds, the reviewer asks the author to step back and reconsider the approach," and findings name the class of bug so the author fixes every instance at once. Risk tier is set by a classifier reading the change, "not the author", and "An agent's approval never counts as a person's".

What remains uncertain. Agno's warm-versus-cold timings are single measurements from its own setup. Goose's subagent binding changes behaviour for anyone who relied on background subagents, so expect migration work. Anthropic's revert and throughput figures are internal and unaudited.

Analysis: All three items treat the coding harness as something to contain and govern, not just a tool to invoke. Agno makes the harness process disposable and its state verifiable. Goose makes delegated agents obey the same approvals as their parent. Anthropic shows that an agent reviewer and an agent author can loop without converging. If you run agents in CI, the cheapest lessons here are a hard cap on review rounds, a sandbox with networking off by default, and a trace id that survives every hop.