AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

Описание и применение

AgentGuard обновил свою систему, разделив открытый и приватный код, внедрив автоматическое управление исключениями с истечением срока и демонстрируя это в реальном времени. Теперь PR с невидимыми символами блокируются, а исключения автоматически истекают через 30 дней.

Задача

Developers need a CI gate that blocks malicious or accidental code changes, including invisible characters, while allowing controlled exceptions that expire automatically.

Результат

The updated AgentGuard system now automatically blocks PRs with hidden characters, enforces break‑glass waivers that expire after 30 days, and demonstrates the expiry publicly. The full 85‑test suite runs in the repo’s own CI, ensuring that even internal changes are vetted.

Рабочий процесс

• 1. Install the free GitHub Action or Pro GitHub App. 2. Configure break‑glass policy via the provided workflow template. 3. When a PR is opened, the Action scans the diff against 12 rule classes. 4. If a rule is violated, the PR is blocked and a comment is added. 5. For exceptions, create a waiver issue; the system records the reviewer and expiry. 6. The guardian workflow runs weekly, comments on expired waivers, and closes the waiver issue. 7. The CI gate ensures that even the repo’s own PRs must pass the scan before merging.

Доказательства

A test waiver (#13) runs in our own repo and expires automatically on 16 Sep 2026. The guardian run after that documents it publicly: commented, warned, closed.

Источник

The full suite has grown to 85 tests: 59 in the public engine repo, 26 in the Pro repo.

Источник