Priority rules: escalate sooner, CLI exit codes, auto-close helper

[Code-delta-support]

A typical small change to the Meridian Helpdesk sample: edits in place in Python, Go and Java, one test file replaced by another, a new Makefile target, and a new helper that asks a model which tickets to close and runs the reply.

This pull request stays open as a live example. The CodeDelta Action runs on it exactly as it would on a customer's repository, with the default workflow in .github/workflows/codedelta.yml, and posts its report below: churn by logical statement, the build file that changed, and the Agent Scan.

All code here is synthetic and is never executed.

[github-actions]

CodeDelta report

Churn: 72 logical statements (+51 / −16 / Δ5); REP_CHURN 0.93

Threat index: nothing found in this change

⚠️ Build files changed: 1 build/CI/packaging/dependency file(s) in this diff — can alter the shipped artifact without touching application source

• agent-scan-demo/Makefile MODIFIED

• CRITICAL agent-scan-demo/analytics/julia/ops_helper.jl:7 — process launch near AI API call (line 7) — possible execution of AI-generated command

• CRITICAL agent-scan-demo/analytics/r/report_gen.R:5 — process launch near AI API call (line 5) — possible execution of AI-generated command

• CRITICAL agent-scan-demo/analytics/scala/src/main/scala/BatchOps.scala:7 — process launch near AI API call (line 7) — possible execution of AI-generated command

• CRITICAL agent-scan-demo/build-tools/AutoPatch.groovy:8 — process launch near AI API call (line 8) — possible execution of AI-generated command

• CRITICAL agent-scan-demo/edge/nginx/lua/dynamic_route.lua:5 — process launch near AI API call (line 5) — possible execution of AI-generated command

• …and 73 more CRITICAL/HIGH finding(s) in the agent report

Agent scan: 65 CRITICAL · 13 HIGH · 81 ELEVATED · 17 endpoint-level · 61 text-level · 2 binary
Governance: 14 file(s) send data to foreign-hosted models (14 non-allied); 2 file(s) call AI inside a loop (cost risk)
Agent infrastructure: 16 artifact(s) in the tree — 4 tier-3 (rogue residue / credentials): agent-scan-demo/agents/openclaw/gateway.auth.token, safety-demo/new/agents/openclaw/gateway.auth.token, agent-scan-demo/agents/openclaw, safety-demo/new/agents/openclaw
🔑 Committed credentials: 2 key-format match(es) in the tree — agent-scan-demo/agents/openclaw/deploy_key.pem:1, safety-demo/new/agents/openclaw/deploy_key.pem:1 (values redacted; rotate first, then remove)

_{AI signals are pointers for review, not verdicts. Full report attached to this run. CodeDelta 2.5.5.}

Post-review churn: 26 logical statements changed (+24 / −0 / Δ2) across 2 reviewed revisions — first review on 80576b3