A coding agent can change a repository long before anyone has a useful story about what it changed, where it got authority, or whether a later edit has made its patch unsafe to land. Shepherd's answer is unusually literal: do not make the patch the first-class result. Make the proposal the result.
In the project's July 8 v0.3.0 documentation sweep, Shepherd recut its quickstart and roadmap around that premise. A retained run keeps its world output to one side of the working files. A reviewer reads a per-binding changeset, then settles it once: select, apply, release, or discard. The useful part is the delay between an agent writing and a repository changing.
Authority and custody are meant to be visible
Shepherd puts authority in a task signature rather than in a second policy file. Its permissions documentation says a bare GitRepo parameter grants a writable bound repository, while May[GitRepo, ReadOnly] and May[GitRepo, ReadWrite] make the boundary explicit. Under the project's jailed placement, it says those grants are compiled to writable roots and enforced at the operating-system boundary. Which binding was allowed to change, and which output did it produce, becomes a reviewable question.
The custody boundary appears again in the code's refusal tests. The runtime suite expects a provider-facing return slot containing a repository handle to fail closed, instead of being represented as a value a model could fabricate. A handle can come into a task as an authority-bearing grant; the roadmap says returned handles are still ahead.
“Apply” is the revealing verb
Selection is fast-forward-only: if the workspace moved after a candidate was forked, it fails closed. The public apply example shows the narrower exception: after one reviewed candidate advances the workspace, a second can be three-way applied only when the two change sets touch disjoint paths. Overlap is refused; the project describes no content synthesis at that boundary.
The project may let an agent do work, but it still asks for a durable trace, an inspectable delta, an authority surface, and a decision point that has not been silently consumed. Its executed-evidence helper takes the same approach to release checks: named tests must have been collected and passed, while designated jailed checks must also be skip-free.
The important word is still “project”
The public source demonstrates an implemented v0.3.0 design and substantial tests and documentation. It does not establish an independent security audit, broad production use, or that every host has the native enforcement the project documents. The roadmap also labels returned handles, typed projection, durable children, and task-as-value delegation as future work—not surfaces a reader should assume exist today.
The next useful signal is narrower than a popularity graph: can Shepherd publish an executable, public receipt for one of those deferred composition features without weakening the retained-output and one-time-settlement boundary? If it can, the project will have shown that agent software can add composability without making custody disappear.