This thing writes and runs code against your repos. The guardrails aren’t an afterthought, they’re most of the work.
A budget cap on every task
Checked after every model call, on the main agent and every helper, so a loop that goes sideways costs a number you picked, not whatever it wants.
The agent can't push to git
Its shell has no SSH key, no git credentials and no token, so a push from there has nothing to log in with. Only the gate pushes, after review, using a fine-grained GitHub token you create for just the repositories it should touch, handed to that one push and never to the agent.
Work can come straight from GitHub
The inbox picks up Dependabot PRs, security and code-scanning alerts, review comments and failing checks. Propose sends you an approve link; Auto just starts it. Either way it goes through the review gate and waits for your merge approval.
It asks instead of guessing
When it hits something gated, or it's genuinely unsure, the question shows up in the task stream, and your answer goes right back into the paused run.
The server decides what runs
Projects can only come from folders you allowed, checked after symlinks resolve. The commands the gate runs are the ones the server proposed, so nobody can slip a new one in through a request.
Nothing is a dead end
Escalated, stopped, out of budget or cut off by a restart, the whole state is saved, so resume picks up the same run instead of starting over.