A teaching and reference catalogue of agent harness and governance patterns. The code is written to be read, run, and adapted — not to be dropped into production unchanged.
That distinction matters for how you should report things.
In this repository's code: open a private security advisory. Please include a reproduction. Expect an acknowledgement within a few days.
In your own deployment, because you adopted a pattern from here: that is urgent for you and not disclosable by me. Fix it, then — if the root cause is that a pattern here is misleading, or its README overstates what it protects — please open an issue about that. Corrections to the documented limits are as valuable as code fixes.
- A pattern that does not enforce what its README claims it enforces
- A bypass of a guard that the README presents as reliable
- A composition where two patterns produce an unsafe outcome together
- An example, demo, or test that would leak real data if adapted as written
- A dependency vulnerability that affects the offline test path
These are documented limitations, stated in the relevant README, and reporting them as vulnerabilities will get a pointer back to the docs:
| Behaviour | Where it is documented |
|---|---|
read_only_sql can be bypassed with CTEs or stored procedures |
tool_privilege_broker — the credential is the backstop |
| The injection screen misses obfuscated or split payloads | goal_integrity — this is the premise; the capability envelope is the control |
| A regex is not a sandbox; path policy is not isolation | sandboxed_execution — leads with this |
| The audit chain is tamper-evident, not tamper-proof | decision_trace_audit — proof requires an out-of-reach chain head |
| Redaction detectors have false negatives on free text | redaction_boundary — redact structurally at the source |
| Deterministic tokens leak value equality | redaction_boundary — use per-tenant salts if that matters |
| The in-memory ledger/store/vault is not production storage | every pattern that has one |
| Live provider tests are flaky | live/ — bounded deliberately, not hidden |
If you think one of these is under-documented rather than wrong, that is a legitimate issue and I would like to hear it.
No credentials are stored in this repository, and none should ever be committed.
- Everything provider-facing reads from the environment (
NVIDIA_API_KEY,ANTHROPIC_API_KEY, …). - The offline test suite runs with no keys at all — that is enforced by design, not convention.
live/tests skip rather than fail when a key is absent.
If you find a committed secret, report it privately via the advisory link above so it can be rotated before the report is public.
This is a reference catalogue, not a released library. Only main is maintained;
there are no backported fixes.