KlodyAI

The approval flaw. Read/write classification of tools was done on the name. English verbs were covered; French verbs — generer, supprimer — fell into the read bucket and slipped through without validation. The fix was not adding French to the list: a pattern list is a sieve by construction. Effect declaration became mandatory at tool registration — a tool with no declared effect does not register.

A reuse discovery, the right way round. While designing the agent's three actuator arms, two already existed elsewhere in the ecosystem. The useful work was not writing them but wiring them. That is the kind of finding you only make by looking at what exists before coding.

Outbound mail. An agent that can write to the outside is a machine identity with real power. It stayed, but behind a flag that reduces it to read-only — the default power is the smallest one.