For anything an agent can persist, split the proposal path from the commit path and put a real trust boundary between them. If a model can save durable facts, untrusted text from one session could influence later sessions. A practical DIY baseline: Store proposed items as append-only JSONL in Git. Record the source, session ID, and originating commit. Treat agent-authored items as candidates. Promote items into the trusted briefing only through a human-controlled credential or ...