Qwen Code 0.23.3 can delegate to Claude Code over ACP: verify which agent actually ran

Quick answer

Qwen Code 0.23.3 adds an external-subagent path: a .qwen/agents/*.md definition can declare an executor that starts an Agent Client Protocol (ACP) adapter, with Claude Code as the first and currently only wired external agent. Qwen remains the parent session and owns the task, transcript, permissions, todos, and artifacts; only the delegated turn runs in the external process.

Do not treat a successful file change as proof that Claude ran. Before promotion, pin and authenticate the adapter, use a trusted disposable workspace, delegate one harmless task, and require three independent receipts: the external process started, subagent metadata reports an external-acp:* model label, and the transcript contains the external agent's tool vocabulary rather than Qwen's in-process tools. Also test malformed definitions and unsupported constraints: 0.23.3 is designed to reject them instead of silently falling back to a Qwen model.

The release does not make two agents interchangeable. External delegation does not inherit Qwen tools, skills, MCP servers, hooks, model settings, full token accounting, or every workflow constraint.

Who this is for

This guide is for teams that want Qwen Code to orchestrate a bounded Claude Code subtask without moving the whole workspace to another backend. It is especially useful when provider identity, permissions, billing attribution, or audit evidence matters.

This is different from Qwen Code Remote Serve, which exposes Qwen sessions over HTTP and SSE. It also differs from named-session owner isolation: an external subagent remains a child task inside the parent Qwen session, not a peer workspace runtime.

What changed in 0.23.3

An agent definition can now include an executor block whose only supported kind is acp. The command names the ACP adapter executable and optional arguments. The official implementation strictly parses this block because ignoring a typo would change provider identity while still producing a seemingly successful result.

---
name: claude-worker
description: "Delegate one bounded implementation task to Claude Code."
executor:
  kind: acp
  command: claude-agent-acp
  args: []
permissionMode: default
---

Complete the delegated task and report the result and limitations.

Install and pin the adapter through your normal dependency process, put the resolved executable on PATH, and complete Claude authentication before this canary. Do not turn npx ...@latest into a production trust boundary: the executable named in a project file is local code with the workspace identity's authority.

Delegation boundary matrix

Surface	Verified 0.23.3 behavior	Do not assume
Ownership	Qwen keeps the parent session, task, transcript, permissions, todos, and artifacts	Claude becomes a peer backend or owns the workspace
Provider identity	External runs expose an external-acp: model label	A completed task proves which provider ran
Permission mode	The host maps its effective policy to a mode advertised by the peer and refuses when no compatible mode exists	Claude's local default can safely override the parent policy
Explicit constraints	Tools, disallowed tools, MCP servers, hooks, maxTurns, and other unsupported controls are rejected before dispatch	Those Qwen fields automatically constrain Claude
Accounting	External token statistics are not fully available	Zero reported external tokens means zero cost
Portability	Claude Code is the first and only wired external agent in this release	Codex, Gemini, or arbitrary ACP agents have the same contract

A six-stage rollout

1. Freeze identities before execution

Record the Qwen Code version, v0.23.3 tag commit, adapter package and version, resolved executable path, Claude Code version, workspace root, and agent-definition hash. Keep credentials out of the record. The tag resolves to b695664b8df06d06c625db3e30b97045d82092c7; a moving branch or unpinned adapter is not the same artifact.

2. Use a disposable, trusted workspace

Create a temporary repository containing only the agent definition and a harmless target file. Mark trust through the normal Qwen flow before invoking the agent. The external executor is refused in an untrusted project, but environment filtering is not a process sandbox; use a low-privilege OS identity and no production secrets.

3. Run one identity canary

Ask claude-worker to create agent-proof.txt containing a unique harmless marker. After the turn, verify:

• the adapter appeared in the process evidence;
• the output file has the expected content;
• subagent metadata reports an external-acp:* model label;
• the transcript has external tool names and no Qwen-only write-tool event for that task;
• the parent session records one terminal outcome.

The file alone is insufficient: both the intended external path and an accidental in-process fallback could create it.

4. Prove fail-closed parsing

Duplicate the definition and change one field at a time: use kind: ACP, a blank command, or a non-string argument. Each invalid definition must be skipped with a visible error and must produce no child process, model call, or file change. Then declare a valid executor together with an unsupported field such as tools, mcpServers, or maxTurns; dispatch must fail with does not support ... rather than dropping the constraint.

5. Exercise permission and cancellation paths

Use one harmless read, one harmless write that requires approval, and one denied action. Confirm approval is shown in the parent session, the decision applies only to the offered option, and denial leaves no side effect. Cancel an active canary and verify both the ACP turn and owned process settle. The release's approval display may not render a rich file diff, so review the actual changed file separately.

6. Promote with explicit limits

Start with one repository and one task class. Keep writes reversible, require tests or diffs from the parent workflow, and cap concurrency outside token accounting. Do not place external-agent definitions inside workflow paths that depend on Qwen token-budget or schema enforcement until those controls are explicitly supported.

Copyable acceptance record

date / owner / host:
qwen_version / tag_commit:
adapter_package / pinned_version / resolved_command:
claude_version / auth_check:
workspace_trusted / definition_hash:
task_marker / output_hash:
external_process_observed:
metadata_model_label:
external_tool_names / qwen_write_tool_count:
malformed_definition_result / side_effect_absent:
unsupported_constraint / refusal_message:
approval_case / denial_case / cancel_terminal_state:
token_usage_state: unavailable | measured-outside-qwen
decision: hold | limited-rollout | promote | rollback

Common mistakes

• Verifying only the final file and never verifying the provider identity.
• Letting a project definition execute an unpinned package download.
• Calling filtered environment variables a sandbox.
• Assuming Qwen tool allowlists, MCP servers, hooks, or turn limits automatically transfer to the external agent.
• Reading a zero token statistic as a free external run.
• Treating the Web Shell subagent panel as a separate recoverable Claude conversation.

Building something? Turn your product page into a show people want to watch with PromoFast—hosted, embeddable, and ready to export.

FAQ

Can I use Codex or Gemini instead of Claude Code?

Not under the verified 0.23.3 contract. The release and implementation describe Claude Code as the first and only external agent wired up. Treat other ACP adapters as unverified until Qwen documents and ships their support.

Why does Qwen reject tools or maxTurns on an external definition?

Because silently ignoring an unenforceable restriction would create a wider execution boundary than the definition promises. The refusal is evidence that the requested control was not applied; redesign the task or keep it on the in-process path.

Does external-acp:* prove the entire result came from Claude?

It proves the executor identity recorded for that child run. Combine it with process, transcript, output, and terminal-state evidence, especially when the parent may perform work before or after delegation.

Is external token use included in Qwen workflow budgets?

Not reliably. The official implementation notes that the adapter exposes a context-window gauge rather than per-turn token deltas, so external statistics may report zero and do not advance Qwen's workflow token budget. Measure cost at the provider and enforce separate operational limits.

Sources

• Qwen Code v0.23.3 release
• Official external Claude Code ACP pull request
• Tagged external-agent design boundary
• Tagged executor schema
• Tagged external executor implementation

Originally published on IndieSeek.