Skip to main content

Security gates

passo.build tasks are not suggestions. They are gated work items. An agent can implement them, but the master/controller decides whether evidence is sufficient.

Required worktree contract​

One task, one branch, one isolated worktree. The primary checkout remains the coordination base. A task is complete only after tests, screenshots/logs, PR links, or deploy job ids are attached as evidence.

Operations that require explicit human approval​

Always gated​

  • Terraform apply or destroy
  • SSO realm/client changes
  • Billing/payment settings
  • Secret reads or token handling
  • Production deploy or destructive cleanup

Evidence required​

  • Diff and PR URL
  • Unit/integration/build output
  • Browser screenshot for UI changes
  • Cloud job id for releases
  • Smoke checks for live surfaces