Only the latest commit on the default branch is supported during the initial development phase.

SREBrain currently executes read-only diagnostics selected from a fixed backend catalog. It does not accept arbitrary commands and does not implement mutation.

Diagnostic output is untrusted data. A successful exit code or a matching hash must not be treated as proof that an interpretation is correct.

Every mutating action must:

• use a stable allowlisted identifier;
• require explicit authenticated authorization and operator reasoning;
• avoid shell construction from untrusted text;
• target only the exact process or resource created or selected;
• define a postcondition verifier;
• fail closed when the verifier is absent or fails;
• define and test rollback;
• emit an append-only receipt without credentials or secret material.

Do not open a public issue for a vulnerability that could expose credentials or enable unauthorized execution. Use GitHub's private vulnerability reporting for this repository. Include the affected revision, reproduction steps, expected boundary, and observed behavior. Never include real credentials, tokens, or production host data.