# AGS guardrails

Executable checks for the embedded canonical Agent Git Service boundary.

- [`check-upstream-provenance.sh`](./check-upstream-provenance.sh) verifies the
  canonical GitHub source and immutable pinned commit used by
  `scripts/update-agent-git-service.sh`.
- [`check-internal-identity-boundary.sh`](./check-internal-identity-boundary.sh)
  verifies that MeshX-owned AGS requests use the shared workload identity and
  that Automation actor attribution cannot be remapped into an AGS login.
- [`check-repository-mutation-boundary.sh`](./check-repository-mutation-boundary.sh)
  keeps production Git writes behind the private mutation owner, rejects
  repository-level filesystem locks, and verifies that migration seal/proof
  compatibility methods fail explicitly while distributed fencing is absent.
- [`check-content-store-tree-contract.sh`](./check-content-store-tree-contract.sh)
  inventories the active Content Store API/runtime contract and rejects
  document/model selection, a non-Git tree backend, an enabled-by-default
  rollout switch, dormant-route fallthrough to AGS, startup/request-path
  migration work, missing maintenance bounds, or workspace/root enumeration.
  During the dormant tree-platform stage this executable source inventory is
  the only diagnostic: no generic HTTP capability, product/test binding, GC
  owner, or backfill/mapping worker is active. Exact bindings are constructed
  only by tests until an owning product domain registers one.

The mutation inventory classifies the private owner's Git and child-process
surfaces. Central mutation ownership, push recovery/outbox, and webhook
durability remain active; repository-level serialization and migration
freeze/proof are not provided.