• No unrestricted shell tool is exposed.
• File writes go through PermissionService and FilesystemService.
• .env, secrets, database, auth, payment, Prisma, and deployment files are blocked or require approval.
• Git commits are blocked on main and master.
• Secret scanning blocks probable tokens before commit.
• Production deployment is disabled by default and requires explicit approval text.
• Audit entries are append-only JSON Lines with redaction.

Known limitation: deterministic visual checks do not replace human visual review.

• Audit mode is read-only and does not write website files.
• Agent results must include evidence from repository inspection, Playwright, axe-core, Lighthouse, browser logs, or deterministic rules.
• Protected-file policy is not weakened by Version 2. Auth, payment, orders, database, environment, and production deployment paths remain blocked or approval-gated.
• finalize_multi_agent_edit commits only after scope validation, secret scanning, validation, re-audit, and screenshot comparison pass critical gates.
• Vercel preview creation is optional and configuration-dependent.
• Production deployment remains stopped by policy and requires explicit separate approval through the existing production tool.