Checklist

Before you ship what the agent wrote

Twenty-six checks. Most take seconds. All of them are cheaper than the incident. Print it, tick it, or just read it once before you press merge.

Before you accept the diff

• You read every line of the diff, not the summary of it. Why
• No test was deleted, skipped, or loosened. Why
• No new catch returns null, an empty value, or nothing. Why
• Every new dependency exists, is maintained, and was asked for. Why
• No key, token or password appears in the diff. Why
• No new ignore, disable, skip or --force appears. Why
• The change does what you asked, and nothing you did not. Why
• You can explain every line you are about to accept.

Before you merge

• The tests ran on this commit, and you saw the output yourself. Why
• The number of tests went up or stayed the same. Why
• The lockfile changed only where the manifest did. Why
• Every destructive command in the agent’s log was one you approved: reset --hard, rm -rf, push --force. Why
• The agent’s summary matches the diff, not the other way round. Why
• What you asked for at the start of the session is still true at the end. Why
• Someone read it who did not write it, and asked at least one question. Why

Before you deploy

• The build has no suppressed errors and no ignored type checks. Why
• Secrets live in the environment, and nothing secret is shipped to the browser. Why
• npm audit (or your ecosystem’s equivalent) was read, not “fixed” with --force. Why
• Errors are logged somewhere a human will see them. Why
• You opened the deployed page yourself, as a user would. Why
• You know how to roll back, and you have done it at least once.

Before you publish generated media

• You looked at the whole output, including the corners, the lettering inside it and the last second.
• You counted the fingers, the wheels, the shadows and the reflections.
• You know where the provenance mark is, and you know a screenshot or a re-encode removes it.
• Every voice, face and likeness in it is used with that person’s consent.
• You said it is generated, wherever the audience would otherwise assume it is not.

Most items come from the field guide, which explains why agents get it wrong.