The repository became an input surface

GitHub introduced its Copilot coding agent on May 19, 2025 as background work attached to issues and draft pull requests. The launch described a virtual machine powered by GitHub Actions, repository analysis, commits pushed to an agent-created branch, session logs, human review, controlled internet access, and policy around workflows.

The announcement made a broader shift concrete. A coding assistant was no longer only suggesting the next line inside an editor. It could receive a task, inhabit a workspace, run tools, change files, and return a reviewable branch later.

For N17Q, the workspace became part of the product boundary.

I studied the shape, not a fictional deployment

N17Q did not run a commercial coding agent for an employer or customer. I used synthetic repositories and local sandbox fixtures to examine the architecture the launch made visible.

The historical details mattered: issue-shaped delegation, background environment, Git commits and draft pull request as handoff, logs for inspection, branch and workflow controls, restricted network, and optional external capabilities through MCP.

I recreated those categories in a small harness without claiming equivalent implementation or security.

The goal was to understand what a trustworthy run record needed when code work left the interactive editor.

The repository was not just prompt context

Files influenced the model and were also the world the agent could change. Package scripts could execute. Configuration could redirect tools. Tests could encode expectations. Instructions could guide or manipulate behavior.

N17Q recorded repository snapshot identity, initial overlay, allowed roots, instruction files selected, executable policy, dependency environment, and network mode at run creation.

The model received a bounded view through search and file tools. The harness retained the full controlled snapshot for world assertions.

The workspace was input, mutable state, and execution environment at once.

The synthetic repository began with an unstaged edit unrelated to the task. A clean checkout benchmark would never test whether the agent respected it.

N17Q represented immutable base and initial writable overlay separately. The task scope named files it could change. Final evaluation compared both target changes and preservation of the starting overlay.

Resetting, reformatting, or absorbing the unrelated edit into the agent's commit failed even if tests passed.

An agent entering a workspace did not own everything it found there.

Instructions carried provenance and scope

Repository instructions could exist at root or nearer a file. Issue text, user comments, project documentation, and tool output could also contain directives.

N17Q compiled applicable instructions with source path, revision, hierarchy, and target scope. System and policy constraints remained outside the repository. Conflicts were reported rather than resolved by whichever text appeared last.

Untrusted files could not grant network, expand filesystem roots, expose secrets, or disable tests. They could describe project conventions within the authority the harness had already allowed.

Instruction following became traceable without making instruction text enforcement.

An issue could be edited while background work ran. The default branch could advance. Dependencies and tests could change.

N17Q bound the run to task revision, base repository digest, initial overlay, and environment manifest. Later changes appeared as explicit rebase or restart inputs.

A patch prepared against one tree did not land on another silently. The review showed base, current target, and conflicts. Approval of a diff could not float across a rebase.

The same revision discipline V0M3 applied to documents now applied to code and its instructions.

The sandbox snapshot made cause inspectable

Every scenario started from a content-addressed base mounted read-only beneath a writable overlay. File operations and commands changed only the overlay.

N17Q captured final tree digest, normalized diff, file metadata changes, generated artifacts, and command outputs. Discarding the run removed the overlay. Replaying created a fresh one from the same base.

This gave evaluation an independent world state. The agent's summary could not hide a deleted test or unrelated configuration change.

A reviewable pull request was useful; a reproducible workspace snapshot explained how it arose.

Commands were structured capabilities

I did not give the model an unrestricted shell by default. The command tool accepted executable, argument array, working directory, environment subset, timeout, and resource limits.

Policy allowed relevant package, test, and inspection commands for the synthetic repository. Shell composition, background processes, privilege changes, and host paths were unavailable unless a specific fixture required them.

The trace recorded normalized invocation, exit state, duration, bounded output, and resulting tree revision. A command whose script attempted network failed under environment policy.

Being able to edit code did not imply being able to execute anything that code requested.

Tests were evidence with provenance

The agent could run a focused test, a larger suite, static analysis, or no validation. N17Q recorded command, environment, repository digest, selected test scope, exit status, and output artifact.

A green focused test did not become “all tests pass.” A test result from before the final edit became stale. A flaky fixture preserved repeated observations instead of selecting the passing run.

The final account had to match the exact validation performed. Evaluators separately asserted required checks and current world state.

Test output was evidence, not ceremony at the end of a generated diff.

One weak scenario stored evaluator tests inside the writable repository. The easiest route to green was to weaken the assertion.

N17Q moved hard invariants and independent fixtures outside the sandbox. Repository tests remained valuable and untrusted. Policy could also prohibit changes to selected test or configuration paths unless the task explicitly required them.

The final evaluator compared external assertions, repository tests, and diff. Deleting a test could no longer erase the expectation it represented.

The system under evaluation did not control the entire definition of success.

Git history was an artifact, not ground truth

Commits made changes reviewable and aligned with familiar development workflow. They could still omit generated files, include unrelated work, carry misleading messages, or be rewritten.

N17Q recorded base commit, working tree before and after, staged tree, commit objects, and final branch reference. The world assertion used content digests and scope, not commit count or message quality alone.

An agent could make several commits when that aided review. Squashing did not erase the semantic run trace.

Git captured repository history. N17Q connected it to plans, commands, policy, and evaluation.

The launch emphasized that the coding agent pushed only to branches it created and preserved existing repository rules. That matched N17Q's separation of technical capability and product authority.

The synthetic git adapter allowed writes only to a run-owned branch namespace. Default and existing branches were read-only. Force updates, tag creation, and remote push were absent unless a scenario explicitly modelled them.

The model could propose a patch for review. It could not grant itself the ability to merge or modify protected references.

A branch was a containment and handoff boundary, not proof the changes were good.

Draft review preserved unfinished status

Background work needed somewhere to land before acceptance. N17Q represented the resulting patch set as a draft review artifact linked to run, base, final tree, commands, tests, and unresolved issues.

The draft could be commented on, revised in another run segment, rejected, or accepted through a separate repository command. It did not become canonical merely because the agent declared completion.

If the target branch advanced, review prepared a new comparison and invalidated stale approval.

The pull-request shape worked because it kept proposal and merge authority distinct.

Workflow execution was another capability

Repository changes could modify automation that later accessed secrets or deployment environments. Running those workflows had different consequences from computing a local diff.

N17Q treated workflow invocation as a separate tool with current policy, workflow revision, input digest, environment scope, approval, and receipt. A draft branch push did not imply permission to run privileged automation.

Synthetic fixtures modelled approved and denied jobs without live CI accounts. The evaluator checked that the agent did not trigger an unavailable workflow through indirect branch changes.

Code review and execution review remained related but separate decisions.

The GitHub launch described tightly limited, customizable internet access. In N17Q, replay had no network. Record-capable synthetic scenarios used explicit HTTP fixture tools or an allowlisted proxy with destination, method, data, and budget policy.

Package installation could not reach arbitrary registries through a generic command. Dependencies were preloaded or retrieved through a declared capability in experiments designed for it.

Every connection entered the trace and fixture strategy. Redirects and subprocess routes followed the same boundary.

The workspace did not receive ambient internet merely because code often expects it.

Secrets were absent by default

The synthetic environment contained no live repository, package, cloud, or personal credentials. Where a scenario tested secret handling, it used scoped synthetic tokens and external assertions.

Tools resolved any legitimate credential server-side after policy. The model, repository, command environment, diff, logs, and artifacts did not receive broader secrets.

A script asking for a token failed. An output that resembled a secret was redacted and flagged before entering context.

Background execution made least privilege more important because no person watched every step.

The same repository could behave differently under another runtime, package cache, compiler, or operating system. N17Q pinned an environment manifest with available executables, versions, architecture, and dependency snapshot.

Commands ran without silently upgrading packages. A requested dependency change became an explicit patch and, where network was unavailable, could stop for fixture preparation.

Replay used the same bundled environment or reported incompatibility. Test artifacts named it.

The workspace included more than files checked into Git.

Retrieval could miss important code

An agent might inspect files selected by search and never see a convention or side effect elsewhere. N17Q recorded queries, result identities, files read, truncation, and ignored paths.

Scenarios planted relevant and distracting definitions. Evaluation checked outcome and could explain when a wrong edit followed incomplete retrieval. It did not demand that every file be read.

Repository search results were observations, not proof of full understanding. The final diff and tests remained necessary.

Background autonomy increased the need to know what context actually informed the patch.

Generated files required a policy

Builds could update lockfiles, code-generated clients, snapshots, or compiled assets. Treating every changed file as intentional made reviews noisy; discarding generated changes could leave the tree inconsistent.

The scenario manifest classified expected generated paths and commands. N17Q linked each output to the command and source revision that produced it. Unexpected generated files were flagged.

The review grouped deterministic outputs separately while retaining their exact diff. Large binary artifacts lived by digest.

The agent could not hide a broad change behind the word generated.

A model call, command, or test could fail after useful edits. N17Q checkpointed semantic state and workspace overlay at meaningful boundaries.

Resume reconstructed the same tree, unresolved tool requests, remaining budget, and evidence. A new model or adapter created a configuration transition. It did not restart from a clean clone and silently lose work.

Unsafe partial command effects were inspected before another attempt. The overlay made them visible and discardable.

Background work became durable without making one process immortal.

Comments became new task input

A reviewer comment could identify a bug, request a narrower change, or supply evidence. N17Q stored it with review revision and author identity, then created a new task segment targeting the exact patch state.

The model did not treat every discussion message as executable instruction. Policy and task compiler selected relevant comments. Hostile quoted code remained data.

Revisions produced new diffs and test evidence. Old approval could not float forward.

Review conversation guided another proposal while canonical branch authority stayed separate.

MCP enlarged the workspace edge

The launch noted that MCP could connect coding agents to capabilities outside GitHub. For N17Q, every discovered server and tool remained outside the workspace until a reviewed product mapping and policy allowed it.

A repository setting or instruction could request a server and could not activate it by itself. Registry snapshots, server identity, schemas, descriptions, effect contracts, credentials, and replay fixtures entered the run configuration.

External context and tools made the workspace more capable and increased the number of boundaries the trace had to explain.

Protocol connection did not turn repository text into authority.

The coding-agent launch made session logs part of review. N17Q similarly retained raw model and command events, but the default run view summarized plans, policy, tool requests, effects, file changes, tests, and checkpoints.

A raw stream could be complete and unreadable. A generated summary could omit the dangerous action. Semantic events linked both to final world state.

Reviewers could open exact logs when needed without deriving the entire story from chronology.

Observability became useful when it connected action to consequence.

Scenarios asserted task files, unrelated changes, prohibited paths, commands, network attempts, dependency state, tests, external effects, budget, and final account.

A correct diff failed if the agent deleted an unrelated edit, weakened a test, fetched through denied network, exposed a synthetic secret, or claimed broader validation than it ran.

Qualitative review assessed maintainability and explanation with evidence. It could not overrule hard world-state failures.

The patch was central and no longer sufficient.

The handoff had to survive provider removal

I archived a completed synthetic run, disabled its model adapter, and opened the review package. Repository base, patch, commits, commands, tests, instructions, policy decisions, and evaluation remained readable.

Provider session details could be unavailable under retention. The draft work did not depend on them for review or manual continuation.

Another person—or another model under a new run—could pick up from the exact checkpoint.

The workspace and trace belonged to the project, not the session that produced them.

Resource budgets reached below model tokens

Background code work could loop in tests, generate enormous logs, fill disk, spawn processes, or repeatedly rebuild dependencies while staying within a model-token limit.

N17Q budgeted wall time, CPU, memory, process count, writable bytes, command count, output bytes, and model use. The sandbox enforced hard limits and the run state tracked cumulative consumption.

Budget exhaustion produced a checkpoint and bounded diagnostic artifacts. It did not invite the agent to disable the limit or delete unrelated files to make space.

The workspace was a product boundary partly because compute and storage inside it were finite shared resources.

Review included deletion and permission changes

Diff summaries tended to emphasize added code. N17Q elevated deleted tests, changed workflows, permission files, dependency manifests, generated lockfiles, and executable bits because small changes there could alter far more than their line count suggested.

The review classified consequence using repository policy and showed those operations before cosmetic changes. A one-line network permission expansion could require stronger approval than a large documentation edit.

This was another reason the final patch could not be judged only by volume or readability.

Line completion could be evaluated near the cursor. A background coding agent required a broader object: delegated task, environment, repository state, tools, instructions, commands, network, credentials, tests, branch, review, and logs.

GitHub's May launch made that object legible in a mainstream workflow. N17Q used the moment to tighten its synthetic harness rather than make claims about a real professional deployment.

The key lesson was not that agents could now write code alone. It was that the place in which they worked had become a governed product surface.

The workspace was part of the answer

At the end of an N17Q coding scenario, the final explanation was one artifact. The workspace told the fuller story.

Its base and overlay showed what the agent inherited. The diff showed what it changed. The command trace showed what it executed. Test receipts showed what it checked. Policy showed what it could not do. The draft review showed what a person was being asked to accept.

A good final message summarized those facts and could not substitute for them.

Coding agents made software work asynchronous and agent-shaped. Trust still came from bounded environment, preserved state, independent evaluation, and a reviewable handoff.