Make sure the agent can't pass its own build

The prompt

Add tests, IaC validation, SAST, SCA, secrets and container scanning, policy checks, and artifact integrity to the pipeline. Then deliberately try to get a bad change through — an inserted secret, a disabled test, an unregistered cloud call — and confirm each one is caught.

Why it's built that way

Exit criterion: the agent cannot make its own work pass without independent pipeline success. The required security tests from the capstone are explicit about this: disable a failing security workflow, insert a secret, attempt an unregistered cloud operation — each attempt must be refused or blocked, not merely logged.

What to do with the answer

Run all six required security tests from the capstone (see the challenge page) before calling this phase done, not just the ones that occurred to you.