[gustavonline]

Reviewers were sometimes told to change no files while being asked to run builds or tests that generate files. AgentOps now specifies permitted check outputs and scratch space; Review preserves product sources and holds unsafe or unauthorized cleanup.

For example, a source-only review holds a staging command. A review authorized to use a fresh task-owned directory can run that same command and verify the output.

Validation: independent Astra review PASS; both affected bundles staged and verified with all 45 source files unchanged. Package checker: 8 skills, 0 errors. CI verifies the unit suite before merge.

Evidence and boundaries

• Opus 5.5 Medium implementation: 2dcdb293b47c633df387d89da018be0e39398e4a. Full-index patch SHA256: 5b04ad0c708a09d42a77b92e0826c87de6029d968389745c030b325d14fb65bc; matches the frozen independent review exactly.
• Source-only exercise: reviewer inspected the staging script and held its write operation, identifying missing evidence and the bounded handoff. This was an instruction decision, not an OS-denial test.
• Authorized-output exercise: both stage commands actually returned 0. All 17 staged files, manifests, licenses and local links matched. No installation or deletion.
• Cleanup exercise: shared/unknown-owner, active and previously refused targets were each held. No destructive operation was attempted.
• Native commit approval was accepted once; an already-aborted check was declined without replay. Both requests are resolved, the commit exists and the worktree is clean. The writer then hit its provider quota.
• Four files only; no access, model defaults, runtime or Foundation changes. The originating application incident remains operator-reported. The five unchecked acceptance criteria in issue Prove Agent Ops across idea research, assignments and accepted backlog #3 remain unproved. Unattended operation, installation and native reload are separate checks.