Powerful, fenced in.
A skill that runs agents needs guardrails you can audit. These six ship in the box — condensed from the full security architecture.
Denylisted paths
The skill never reads, writes, or moves .env files, auth/, secrets/, payments/, migrations/, or credentials/ without your explicit approval — no exceptions, including “just to check.”
Enforced at commit time
install.sh adds a pre-commit hook that rejects the denylist outright. An agent that ignores the instructions still cannot commit a secret. The only bypass is git commit --no-verify, which requires explicit human approval.
Parallel-safe by lock, not luck
Fan-out runs one git worktree per file writer, verify --scope fails any diff that escapes the declared contract, and shared-file appends (MEMORY.md, rules) take a portable .vts.lock so concurrent sessions cannot interleave. Two writers touching one file surface as a merge conflict in Reduce — never a silent overwrite.
Human gates
No push, no merge, no deploy without you. Pairing codes are single-use and expire in 10 minutes. CLI keys expire in 90 days and can be revoked anytime.
Real anchors, not claims
Verification means pasting a command and its exit code — tsc, tests, lint. “All tests pass” without a run is rejected by the skeptic on sight.
Bounded blast radius
File writers run in isolated git worktrees. A bad node can ruin its own worktree, never your main checkout. Three failed attempts escalate to you instead of looping forever.