Research
Technical work on policy-gated agent execution, human authorization, provenance, attestation, and reconciliation. We publish working papers, experiments, architecture notes, and implementation reports — including limitations and negative results.
2 publications · Clear filters
CI job logs are third-party-influenced text that flowed unfiltered into a privileged planning prompt. We routed them through a zero-tool-access reader restricted to schema-validated output, and tested it against a real injection.
Approving a change and executing a change are separate events, and nothing structural forces them to match. We recompute the diff from the provider's own API at merge time and block on mismatch — and the first honest run failed.