Change Request boundary
Code-changing automation always creates a new branch and a provider-neutral Change Request.
Security
Automation should be inspectable before it becomes autonomous.
xmode keeps risky work visible through explicit objectives, versioned definitions, approval points, isolated execution, repository permission boundaries, and reviewable Change Requests.
Approval pauses
Manual approvals can stop, revise, resume, or reject automation before risky steps execute.
Sandbox evidence
Runs expose files, commands, logs, structured outputs, artifacts, diffs, and cleanup state.
Versioned definitions
Skills, actions, and pipelines execute from frozen snapshots so history stays reviewable.
Provider permissions
GitHub App, GitLab, SSO, and token-backed integrations are designed around explicit workspace controls.
Signed events
Event SDKs can send HMAC-signed production signals into the Event Inbox for matched pipeline handling.
Review posture
The team sees the work before accepting the change.
xmode is designed around evidence, not invisible autonomy. Plans, approvals, messages, sandbox commands, artifacts, run snapshots, and Change Requests remain attached to the work so teams can inspect what happened before accepting changes.