Home / Articles / Attacks rewritten as mandates / Versions / v1.1.0
Attacks rewritten as mandates: what changed in v1.1.0
From v1.0.0 (2026-10-13, e7a80264c) to v1.1.0 (2026-10-18, de821285d), paragraph by paragraph.
0 paragraphs added, 0 removed, 1 changed in place, 52 unchanged. About 0 words added and 3 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
33 unchanged paragraphs, under In short {#in-short}, A ledger of attacks {#ledger}, Every attack is reach beyond mandate {#reach}…
Read as a policy, that post already has three of the four columns. The reach is configured: their Workspaces sessions, a sandboxed place to run coding agents, reach the model, the session's own repository, their registry, and the user's identity "while you're attached and for up to an hour after you detach"; "no long-lived credential enters a session"; anything else asks. The barriers are in code: checks bound to a commit, caps, gates. And the gap was found the way most gaps are, by accident: the label that outlived its commit is a row of reach nobody had listed until it was nearly used. The mandate is there too, in good sentences, but it lives in prompts, bot configuration and a blog post. That is not a criticism; it is thea bestcareful account I have read of giving agents real power over a codebase, and as far as I can see it is the state of most of the industry. It is also the argument of A policy beside the prompt: write the mandate down as a document the agent takes as an input, versioned beside the reach and barriers it constrains, and owned by someone who can be asked.
19 unchanged paragraphs, under One pipeline, three records {#records}, An open source question {#oss}, What this does not claim {#limits}…