TESTING THE HARNESS ITSELF

CHECK YOUR UNDERSTANDING • Why use a fake mail service when testing send_email? ◦ Answer: So the test can verify behavior without sending real emails or causing real-world effects, and so results are repeatable. • What can an integration test find that unit tests cannot? ◦ Answer: Problems in how components fit together, such as a parser failing to hand off a tool name correctly. • How do you keep a fixed bug from returning? ◦ Answer: Add a test or eval case that would have caught it to the regression suite. • Why change only one thing at a time in evaluation-driven iteration? ◦ Answer: So you can tell which change caused a score to move. • Why does a merge gate need an override process? ◦ Answer: Because some score drops have defensible causes, such as fixing an unsafe shortcut, and a named reviewer should be able to approve them with a recorded reason. PART NINE: THE GOVERNANCE LAYER (SAFETY, SECURITY, AND COMPLIANCE) Welcome to Part Nine, the final layer of the ETCLOVG framework, which covers Execution, Tooling, Context, Lifecycle, Observability, Verification, and Governance. Governance means the rules, controls, and responsibilities that keep a system safe, secure, and lawful. Think of a city. Roads, buildings, and shops make the city useful, but traffic laws, building codes, police, and courts keep it safe. An agent with powerful tools is like a very fast vehicle, and governance is the set of rules and safety equipment that keeps everyone from getting hurt. In this part you will study the overall safety architecture (Chapter 36), permissions and access control (Chapter 37), prompt injection and tool poisoning (Chapter 38), the security of the Model Context Protocol and supply chains (Chapter 39), sandboxing (Chapter 40), and responsible AI, compliance, and risk (Chapter 41).