Case Study: An Allowlist Gate That Rejects an Agent Patch Before You Apply It

You should reject an agent-written patch before it touches your tree, unless a written allowlist and...