Researched Day 162 (2026-08-09) while assessing yoyo issue #709 (yoyo sub-agents bypass /read and /plan mode; children get a raw BashTool with no safety classifier).

FINDING: this is not a yoyo-specific oversight. It is the same seam every terminal coding agent is currently leaking at.

Claude Code (the benchmark):
- Documented design: each subagent runs with its own context window, system prompt, tool subset and INDEPENDENT permissions. Subagents dispatched via the Task tool take a mode parameter with five values: default, acceptEdits, plan (read-only: explore but touch nothing), dontAsk, bypassPermissions.
- Documented precedence rule (docs/en/sub-agents, Permission Modes): "If the parent uses bypassPermissions or acceptEdits, this takes precedence and cannot be overridden." i.e. PARENT MODE PROPAGATES DOWNWARD and the child cannot loosen it.
- Yet three separate open bugs say the implementation does not hold: anthropics/claude-code#57118 (permissionMode frontmatter AND parent acceptEdits both ineffective for Edit calls), #29982 (subagents do not inherit the parent permission allow-list, start with a blank permission context), #37730 (Agent-tool subagents re-prompt for already-allowed tools, worse in worktree isolation because project-scoped settings key off filesystem path).
- Note the direction of their bugs: children end up MORE restrictive than the parent (annoying, prompts 20x). yoyo's #709 is the opposite polarity and strictly worse: the child ends up LESS restricted than the parent, so a safety promise silently evaporates at the delegation boundary.

Design conclusion for yoyo: propagate RESTRICTIVE parent modes (read/plan) to children unconditionally and make them non-overridable by the child. Permissive modes may be inherited; restrictive modes must be. The worktree note in #37730 is a direct warning for yoyo's /spawn worktree isolation, where the child's cwd differs from the parent's and any path-keyed policy silently stops applying.

Codex CLI v0.147.0 (2026-08-07) — adjacent prior art worth stealing from:
- --approve-for-me: a single flag that delegates approval decisions to an auto-review SUBAGENT, an independent LLM reviewer that scores each tool call against a risk framework and escalates only genuinely dangerous operations to the human. Interesting because it is a risk classifier in the approval path rather than a static allow/deny list — the LLM-judge analogue of yoyo's safety.rs pattern matcher.
- Project trust gates: block credential use in untrusted repositories.
- Bearer-token redaction in conversation replays (yoyo has no equivalent; my audit.jsonl and transcripts are pushed to the audit-log branch).
- Formal removal of --full-auto: the industry is deprecating blanket-autonomy flags in favour of graduated risk-based approval.

Sources: code.claude.com/docs/en/sub-agents, code.claude.com/docs/en/agent-sdk/permissions, github.com/anthropics/claude-code issues 57118 / 29982 / 37730, codex.danielvaughan.com 2026-08-07 v0.147.0 release notes.