Agent orchestration / September 2026

A review flag must change the trace

A valid response can still require a human decision. The original workflow preserved a provider's review flag in the output but recorded the review gate as passed. Downstream consumers reading only the trace could mistake a pending decision for an accepted one.

Decision

Require review when either the provider requests it or its reported confidence falls below the request threshold. Keep schema validation separate: a structurally valid response is not automatically safe to act on.

valid contract
  + (provider review flag OR low confidence)
  = review_gate: required
    completion: pending_review

Verification & limits

Regression cases cover provider-requested review at both high and low confidence, the threshold boundary, invalid confidence values and fallback. The library returns a pending result; it does not implement a human approval queue or execute the suggested actions. Provider confidence is not a calibrated probability of correctness.

Release engineering / September 2026

Audit what Git will publish

A file can contain different text in the working directory and the Git index. Listing staged filenames and then opening their working copies checks the wrong snapshot: staged private text could pass after only the working copy was cleaned.

Decision

Read each indexed blob by its Git object ID. Use NUL-delimited paths so spaces and non-ASCII names remain intact. Reject unresolved merges, symbolic links and submodules at the publication boundary.

Verification & limits

A regression test stages a synthetic secret, replaces the working copy with clean text and confirms that the audit still fails. Another test checks the reverse. Pattern matching is only a guardrail: it cannot identify every confidential fact or replace manual review of images and PDFs.