AgentGuard更新：开源核心、突破玻璃治理与首批真实发现

When I posted the launch here on dev.to, the pitch was simple: I attacked my own repo — and my own PR bot blocked the attack before merge. A lot has moved since then. Here's the honest update, including the uncomfortable parts. 1. Open-Core Split: The Line Is Now Public AgentGuard has been two clearly separated parts since this week: Public (MIT): the deterministic engine with 12 rule classes and the free GitHub Action — 59 tests, every one of them publicly traceable. Private: the Pro components — GitHub App server with check-run gate, multi-tenant, rules editor, re-sharpening, and billing — 26 more tests. Why the split? Because a CI gate for coding agents is either a hobby or a product. I chose the latter. The community loses nothing: the engine stays MIT, the Action stays free for public repos. The line is documented in LICENSING.md — in plain text, not fine print. 2. Break-Glass Governance: Exceptions That Can't Hide Every honest security policy needs exceptions. The naive version is the permanent bypass: switch it off once, it stays off forever. Our answer in v0.2.2: A waiver is an issue — an immutable record of who exempted what, and when. Mandatory reviewer, max. 30 days lifetime, automatic expiry. A guardian workflow runs weekly, comments on expired exceptions, and files a warning issue. And here's the part that matters to me: we don't claim the expiry works — we demonstrate it publicly. A test waiver (#13) runs in our own repo and expires automatically on 16 Sep 2026. The guardian run after that documents it publicly: commented, warned, closed. That's the difference between a policy on paper and one that proves itself. For your own repo: break-glass policy, ADR-002, workflow template. 3. 85 Tests, Self-Scan in Our Own CI The full suite has grown to 85 tests: 59 in the public engine repo, 26 in the Pro repo. Still deterministic, still no LLM in the scan path. And still dogfooding: the scan of our own repo runs in our own CI — every landing page change has to pass our own gate first. That exact setup has already blocked one of our own PRs. Working as designed; it's all in the changelog. 4. The First Real-World Finds Two active open-source repos, two invisible characters: A zero-width space (U+200B) directly before a bash block in an agent-facing spec. A U+200B in the middle of a skill spec. Invisible in every diff and every review — but a different file for the model than for the human reading it. That's the documented invisibility trick, not a theoretical scenario. Both finds are byte-verified and were responsibly disclosed to the maintainers — with no public naming. If the maintainers want, there will be an update here. 5. What Pro Does — and What It Costs App server: PR comment + check-run gate per repo, multi-tenant. Rules editor: your own rules as a file, fail-closed. Re-sharpening: generate new rules from real findings. Billing: Stripe checkout, fully wired. Prices unchanged: Free, Pro $19/repo/month, Audit $499 (one-time), RedTeam $499/quarter. Try It 🛒 Free Action on the Marketplace 🔴 Live demo: planted attack, red check, no merge 🌐 Landing page 📝 Free first scan / Pro trial 📦 Code