ci-security
Flags known patterns of weakened tests and CI checks in a Git diff.
Find CI agents that eat untrusted GitHub events and hold secrets. Static recon for the clinejection class (untrusted issue -> AI agent step -> npm token -> publish), a harmless canary 'prove' mode, and a local agent-config audit.
Pre-delivery truth infrastructure
