Autopsy 16 · Change-management override / Comic Strip 01 · Code Freeze

Would Ethosure have caught this?  The code freeze that wasn’t

A composite scenario drawn from the pattern behind the Amazon Q VS Code wiper, the Nx s1ngularity credential harvest, and the Replit database wipe: a manager overrides a change freeze on demo eve, the agent quietly gets a wider write scope, nobody signs the exception, and the deploy ships. Two coding-ethos policies, stacked on the same tool call, close both halves.

The scenario

A director tells an on-call engineer to ship the agent to production the night before a customer demo. The change-freeze window is active. The manager verbally waives it and, in the same breath, grants the agent write access to the production database because “the demo needs live data.” The engineer runs the deploy. The agent’s last attested scope was read-only; the deploy manifest quietly widens it to rw-admin. No second party signs the freeze exception. No approver signs the scope change. Both actions are logged, buried in the deploy console, and forgotten by morning.

The pattern shows up in the public record repeatedly. The Amazon Q VS Code wiper reached production because a rushed release path skipped review. The Nx s1ngularity credential-harvest package shipped because a maintainer merged during a deadline window without a co-signer. The Replit database wipe happened during a live coding session where a permission widening was verbally granted and immediately acted on. In each case the manager approved the exception in words, not signatures, and the widened scope arrived on production without a matching audit event.

• Reuters — Amazon Q Developer supply-chain compromise (August 2026)
• StepSecurity — Nx s1ngularity technical breakdown (August 2026)
• Semafor — Replit AI wipes production database in vibe-coding demo (July 2026)

The applicable coding-ethos policies

Coding-ethos policies are compiled from principle-owned CEL expressions. Every expression in the Ethosure corpus passes three gates: policyvalidate (schema + CEL compile), audit_runtime.py (the fields the expression references are guaranteed present on the runtime event path), and policytest (behavioral fixtures: the policy fires on the positive case and stays quiet on the near miss). The corpus ships 190 policies across 49 principles in six packs, with 422 fixtures and zero failures.

Walkthrough

1. The deploy is issued at 6:47 PM Tuesday. Runtime metadata carries freeze.state = "active" for the Sprint 42 code freeze. No freeze.override record with a signed second-party approval exists in the evidence layer.
2. The change_management.freeze_override_requires_second_party expression fires on PreToolUse, matches on tool_call.category in ["deploy", "migrate", "promote"], evaluates the CEL guard, and returns severity block.
3. In parallel, the deploy manifest widens the agent’s scope from read-only to rw-admin on the production database. Compared against agent.attested_scope from its last successful run, the new set strictly adds a capability. agent.privilege.scope_widening_requires_review fires on the same PreToolUse event and returns severity block.
4. The append-only evidence layer records both blocks with the tool, the freeze window id, the scope delta, and the manifest signer. The manager’s identity is captured on the approver line, not buried in a verbal exception nobody logged.

Policy YAML

# Pack: regulated-enterprise-base (v2)
principles:
  - id: one-path-for-critical-operations
    title: One Path for Critical Operations
    directive: >-
      Every privileged action must traverse a single, inspectable path.
    policy:
      expressions:
        - id: change_management.freeze_override_requires_second_party
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - one-path-for-critical-operations
            - validation-at-the-gate
          skill_id: safe-git-workflow
          when: >
            tool_call.category in ["deploy", "migrate", "promote"]
            && runtime.freeze.state == "active"
            && !runtime.freeze.override.approvals.exists(a,
                 a.role == "second_party" && a.state == "approved")
          message: >-
            Deploy attempted during an active change freeze with no signed second-party exception.
          advice: >-
            Route the exception through the change-management channel. The override record must
            reference the freeze window id, name the requesting party, and carry a signed
            approval from a role != requester. Fixtures cover the active-no-signer, active-with-
            signer, and no-freeze cases.

  - id: validation-at-the-gate
    title: Validation at the Gate
    directive: >-
      An agent's granted scope must not silently exceed its last-attested scope.
    policy:
      expressions:
        - id: agent.privilege.scope_widening_requires_review
          scope: agent_action
          severity: block
          event: PreToolUse
          principle_ids:
            - validation-at-the-gate
            - one-path-for-critical-operations
          when: >
            tool_call.category in ["deploy", "migrate", "promote"]
            && manifest.scope.exists(s,
                 !agent.attested_scope.exists(a, a == s))
          message: >-
            Deploy manifest grants a capability not present in the agent's last attested scope.
          advice: >-
            Attest the widened scope through the review channel with a named approver.
            The evidence layer records the previous scope set, the new scope set, and the
            delta. Fixtures cover the widening, narrowing, and identical-set cases.

Where these policies live in the corpus

The Ethosure importable corpus ships six coding-ethos packs. Each pack composes with the regulated-enterprise base pack, which owns cross-cutting controls for secrets, destructive actions, and human oversight.

• Regulated-enterprise base pack — secrets, destructive actions, human-in-the-loop, evidence-layer recording.
• Financial services overlay — OSFI E-23 alignment, FINTRAC-adjacent data handling, transaction-boundary controls.
• Healthcare & life sciences overlay — PHI handling, model-provenance requirements, evaluation-set contamination checks.
• Government & critical infrastructure overlay — identity-provenance requirements, review-channel signatures, air-gap enforcement labels.
• Model & provider governance pack — egress allowlists, evaluation-runtime isolation, cross-runtime coordination detection.
• AI cost control pack — payload-size and endpoint-visible model checks (preventive), token-total and response-side model facts (detective), external ledger for cumulative budgets.

Published September 4, 2026 · Ethosure · Composite scenario.