AgentGuard Update: Open Core, Break-Glass Governance — and the First Real-World Finds

AgentGuard, an open-source security tool for coding agents, has been split into an MIT-licensed engine and a commercial Pro tier, with the CI gate remaining free for public repositories. Version 0.2.2 introduces break-glass governance with time-limited waivers, demonstrated by a test waiver that expires automatically in September 2026. The project has expanded to 85 deterministic tests and reports two real-world finds of invisible characters that differ between model and human views, responsibly disclosed without public naming.

When I posted the launch here on dev.to, the pitch was simple: I attacked my own repo — and my own PR bot blocked the attack before merge. A lot has moved since then. Here's the honest update, including the uncomfortable parts. AgentGuard has been two clearly separated parts since this week: Why the split? Because a CI gate for coding agents is either a hobby or a product. I chose the latter. The community loses nothing: the engine stays MIT, the Action stays free for public repos. The line is documented in LICENSING.md https://github.com/agentguard-dev/agentguard/blob/main/LICENSING.md — in plain text, not fine print. Every honest security policy needs exceptions. The naive version is the permanent bypass: switch it off once, it stays off forever. Our answer in v0.2.2: And here's the part that matters to me: we don't claim the expiry works — we demonstrate it publicly. A test waiver 13 https://github.com/agentguard-dev/agentguard/issues/13 runs in our own repo and expires automatically on 16 Sep 2026 . The guardian run after that documents it publicly: commented, warned, closed. That's the difference between a policy on paper and one that proves itself. For your own repo: break-glass policy https://github.com/agentguard-dev/agentguard/blob/main/docs/BREAK-GLASS.md , ADR-002 https://github.com/agentguard-dev/agentguard/blob/main/docs/ADR-002-break-glass-governance.md , workflow template https://github.com/agentguard-dev/agentguard/blob/main/workflow-templates/break-glass-guard.yml . The full suite has grown to 85 tests : 59 in the public engine repo, 26 in the Pro repo. Still deterministic, still no LLM in the scan path. And still dogfooding: the scan of our own repo runs in our own CI — every landing page change has to pass our own gate first. That exact setup has already blocked one of our own PRs. Working as designed; it's all in the changelog https://github.com/agentguard-dev/agentguard/blob/main/CHANGELOG.md . Two active open-source repos, two invisible characters: Invisible in every diff and every review — but a different file for the model than for the human reading it. That's the documented invisibility trick, not a theoretical scenario. Both finds are byte-verified and were responsibly disclosed to the maintainers — with no public naming . If the maintainers want, there will be an update here. Prices unchanged: Free , Pro $19/repo/month , Audit $499 one-time , RedTeam $499/quarter .