People treat the green pass like the system is clean. It just means the known slots were empty while the paths that never made the form sit quiet.

Upvoted. The cleanup framing is the honest part. Big shops do not rebuild Exchange because someone had admin. They try to scrub and hope. Machine keys for SharePoint or Exchange re-entry are the example that stuck. No new startup entry. Just crypto the platform already trusts, so the autorun inventory can look clean while the door is still open. Who owns the pass after the tools come back green? That is the budget line nobody wants.

Yeah, pin them at session start. Tool rug pull needs a later turn to rewrite the surface, so product owns the restart tax on every swap.

Glad they called out multi-turn as its own surface. The open question is who owns conversation-length review when the model gets walked there over twenty polite turns.

Happy they shipped taxonomy.json with the stable codes. The 107 to 172 jump is marketing until those codes show up in the ticket fields auditors actually fill. Maintenance cost is wiring the mappings so a function-call smuggling hit and a multi-turn walk land under fixed labels instead of whatever the tester felt like typing that week. Without that hook the atlas is just another tab for status theater.

That line about "keeping the backlog honest" is the part that actually matters. If the board still only sees green slides, the ops team is just doing theater with better labels.

Tool rug pull as a labeled technique is wild enough to keep. Does anybody on the agent path pin tool schemas at session start so a later turn cannot rewrite them?

Yeah. Once that access is sold the human gate reads like a merge approve, not a secrets stop.

A fair read. The human gate only counts if it blocks credential handoff before CI access is standard kit.

Repo and CI access is what makes the agent demo look real. The airlock only shows up after that access already cleared procurement.