I audited my own agent for "a guard that exists and doesn't cover the default path". I found nine in one codebase.

Two weeks ago I posted here about a default that let my agent report success for a run that changed zero files. Several of you took it apart in ways that were more useful than the fix — the sharpest being that an empty diff is not evidence that nothing happened, once the run holds a tool that causes effects outside the checkout. That thread made me go looking for the shape of the bug rather than the instance. The shape is: a rule written in one place, and not applied to the thing next to it. I found nine. A sample, all from the same codebase: A tool allowlist documented as "applied on every surface" had three call sites, and none of them was the one the cron daemon uses. The config option was accepted, validated, and ignored. The governance fence could not be switched on at all: turning it on killed the CLI at import. Nobody had ever run with it enabled, so nobody found out. Five JSON stores did read-modify-write with no lock. Two processes, and the second silently erased the first's work. One of them was the skill store, so a run that learned something could be erased by the run that learned it. One environment variable was read to mean two different things, which broke all six of its legal values. What they have in common is that none of them fails. Every one passes tests, passes review, and produces a green run. The allowlist with three call sites doesn't throw, it just doesn't fence. The unlocked store doesn't corrupt, it loses. The fix that generalised, and the only part of this worth stealing: A build gate must list the EXEMPTIONS, not the obligations. A check that enumerates the things it should cover fails open the moment somebody adds a tenth thing. A check that enumerates the things allowed to be uncovered fails closed: the new thing is not on the exemption list, so the build breaks and whoever added it has to either wire it up or write down why not, in a diff someone reviews. I have four of those now. One refuses any agent constructed with a registry that didn't pass through the governed profile. One refuses a write outside the declared region. One refuses a skill card with no category. They are each about fifteen lines and they are the only reason I believe the next instance gets caught. The thing I'm still unsure about, and would genuinely like opinions on: an exemption list is a place to write "not yet" and forget. Mine are documented in comments but there is no expiry. Has anyone made stale exemptions cost something, without inventing a process nobody follows?