Hard filters
- Runs locally from repo-native inputs.
- Uses deterministic parsing, rules, patch synthesis, and confidence scoring first.
- Produces an autonomous artifact: patch set, report, CI gate, dossier, or risk summary.
- Avoids source upload, production credentials, paid APIs, and human delivery.
- Fails closed when a safe fix is uncertain.