Security fixes are applied to the latest release on the default branch.

Do not open a public issue for a vulnerability that could cause an external action, approval bypass, event-log corruption, future-event leakage, or credential exposure.

Use GitHub private vulnerability reporting when it is enabled for the repository.

The reference runtime treats parser output, model output, webhook payloads, imported event logs, and semantic matches as untrusted.

Only deterministic lifecycle guards may authorize a proposal. A proposal does not authorize execution. Execution repeats the lifecycle, version, trigger, precondition, expiry, and idempotency checks.

The included executor is sandbox-only. Connecting real tools requires a separate adapter, explicit approval policy, secret isolation, audit logging, and integration-specific tests.

See docs/threat-model.md for the complete model.