AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

说明与用途

AgentGuard 通过拆分开源与专业组件，引入自动化的“破窗治理”机制，设置 30 天的可撤销例外，并在公共仓库中演示其失效。完整的 85 条测试现在在仓库自己的 CI 中运行，确保恶意 PR 在合并前被阻止。

问题

Developers need a CI gate that blocks malicious or accidental code changes, including invisible characters, while allowing controlled exceptions that expire automatically.

结果

The updated AgentGuard system now automatically blocks PRs with hidden characters, enforces break‑glass waivers that expire after 30 days, and demonstrates the expiry publicly. The full 85‑test suite runs in the repo’s own CI, ensuring that even internal changes are vetted.

工作流

• 1. Install the free GitHub Action or Pro GitHub App. 2. Configure break‑glass policy via the provided workflow template. 3. When a PR is opened, the Action scans the diff against 12 rule classes. 4. If a rule is violated, the PR is blocked and a comment is added. 5. For exceptions, create a waiver issue; the system records the reviewer and expiry. 6. The guardian workflow runs weekly, comments on expired waivers, and closes the waiver issue. 7. The CI gate ensures that even the repo’s own PRs must pass the scan before merging.

证据

A test waiver (#13) runs in our own repo and expires automatically on 16 Sep 2026. The guardian run after that documents it publicly: commented, warned, closed.

来源

The full suite has grown to 85 tests: 59 in the public engine repo, 26 in the Pro repo.

来源