AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

Description and use

AgentGuard updated its system by separating open‑source and Pro components, adding automated break‑glass governance with 30‑day waivers that expire and are publicly documented. The full 85‑test suite now runs in the repo’s own CI, blocking malicious PRs before merge.

Problem

Developers need a CI gate that blocks malicious or accidental code changes, including invisible characters, while allowing controlled exceptions that expire automatically.

Outcome

The updated AgentGuard system now automatically blocks PRs with hidden characters, enforces break‑glass waivers that expire after 30 days, and demonstrates the expiry publicly. The full 85‑test suite runs in the repo’s own CI, ensuring that even internal changes are vetted.

Workflow

• 1. Install the free GitHub Action or Pro GitHub App. 2. Configure break‑glass policy via the provided workflow template. 3. When a PR is opened, the Action scans the diff against 12 rule classes. 4. If a rule is violated, the PR is blocked and a comment is added. 5. For exceptions, create a waiver issue; the system records the reviewer and expiry. 6. The guardian workflow runs weekly, comments on expired waivers, and closes the waiver issue. 7. The CI gate ensures that even the repo’s own PRs must pass the scan before merging.

Evidence

A test waiver (#13) runs in our own repo and expires automatically on 16 Sep 2026. The guardian run after that documents it publicly: commented, warned, closed.

Source

The full suite has grown to 85 tests: 59 in the public engine repo, 26 in the Pro repo.

Source