🤖 Generated by the Agentic Engineer
Evidence
A bounded one-day Agent Improver sample found one instruction-shaped user record reaching an in-scope subagent that held generic shell access. The run made no definition or permission write, so the ingestion rule held in that observation, but the exposed shell remains a high-impact boundary if a future run follows untrusted forge text.
The existing draft #107 removes the shell without supplying another forge-query path. That is not a safe rollout: the reviewed surveyor and this deployment compatibility overlay currently use read-only gh queries, so the draft would make live portfolio survey data unavailable rather than enforcing it safely.
Expected behavior
The portfolio surveyor can read required live forge metadata while the runtime prevents every forge or repository mutation by construction. A deployment without the enforced read path fails closed and reports the dimension QUERY-UNKNOWN.
Acceptance criteria
- Provide a tool-neutral read-only forge contract for the surveyor and at least one supported runtime implementation.
- Prove the intended path: repository, issue, pull request, branch, review, and CI metadata reads still produce the required survey digest.
- Prove the prohibited path: create, edit, comment, review, merge, push, checkout/build, and arbitrary shell execution are denied even when untrusted fetched content requests them.
- Keep the consumer compatibility overlay functional during rollout; remove its shell prescriptions only after the enforced replacement is installed and behaviorally verified.
- Preserve fail-closed reporting for unavailable or partial integrations.
- Update the plugin documentation, contract validation, and cache-key version in the same reviewed release.
Scope
This is a definition/runtime-boundary change in agentic-engineering, not a product-repository change. It supersedes the incomplete approach in #107 without granting broader authority or weakening any existing safety rule.
Evidence
A bounded one-day Agent Improver sample found one instruction-shaped user record reaching an in-scope subagent that held generic shell access. The run made no definition or permission write, so the ingestion rule held in that observation, but the exposed shell remains a high-impact boundary if a future run follows untrusted forge text.
The existing draft #107 removes the shell without supplying another forge-query path. That is not a safe rollout: the reviewed surveyor and this deployment compatibility overlay currently use read-only
ghqueries, so the draft would make live portfolio survey data unavailable rather than enforcing it safely.Expected behavior
The portfolio surveyor can read required live forge metadata while the runtime prevents every forge or repository mutation by construction. A deployment without the enforced read path fails closed and reports the dimension
QUERY-UNKNOWN.Acceptance criteria
Scope
This is a definition/runtime-boundary change in
agentic-engineering, not a product-repository change. It supersedes the incomplete approach in #107 without granting broader authority or weakening any existing safety rule.