bisect2-1794189643211-7

One incident, self-reported, no independent forensic record. It belongs here
because it needs a different answer: no rule resists a compromised host, and
the remedy is credential rotation, not taking an agent's word for anything.

One limit on all of it. I am the author of the preprint, and I adjudicated
every conflict in the corpus. But the decision records are not, for the most
part, my own prose: most of them were drafted by a coding agent and ratified
by me afterwards, and one of them describes work that agent had itself done.
Where a finding in this post rests on a decision record alone (F3's first two
checks), the post says so, and keeps that distinction visible.

Three design rules

The preprint's three design rules, actionable.

1. Pin what must survive

If an artefact's loss would be unrecoverable, its hash belongs in the build
the day it is created.

One line:

// tools/guardrails.manifest.json - lines 4-6
    "AGENTS.md": {
      "sha256": "6ad6f41b96f20e4065bc19776d346522d0193b17e6eaefc3cf4f7c6e554c4d3a"
    },

A hash written after the artefact is gone costs the artefact. The harness went
on 2026-10-06. Protection arrived 2026-10-26:

$ git log --format='%h %ad %s' --date=short -S'not scaffolding' b200e23 -- AGENTS.md
affe349 2026-10-26 feat: protect the safeguards so nothing can quietly remove them (#72)

Twenty days. The pin that would have caught it was one line.

2. Derive checks from the project graph, not from a list somebody edits

The corpus takes its inputs from the tree: