Implements an idempotency outbox for side effects (e.g., git pushes, PR creation). Records pending/done states, probes and adopts on replay after crashes, and quarantines corrupt entries. Self-contained and extractable for any system needing at-least-once semantics with crash recovery.

The sole allowed git spawn mechanism in the codebase, enforced by source-scan guards with no allowlist. Provides a safe, env-sanitized interface for git operations, preventing token leaks and command injection. Demonstrates a reusable pattern for wrapping dangerous subprocess calls with strict security policies.

Generates signed proof receipts (Ed25519) for agent runs, including event log hashes, verdicts, and cost data. Produces a JSON receipt that can be independently verified offline. The pattern of generating verifiable, tamper-evident receipts is reusable for any system requiring audit trails or attestation.

Implements a static registry pattern for quality gates with lifecycle phases (pre-commit, etc.). Gates are registered, executed, and listed via a simple in-memory map. Demonstrates a clean, extensible plugin architecture that can be extracted for any system needing pluggable validation steps.