The security check that never ran — shipping agentic-framework v4.1

This week the framework caught one of its own security checks doing absolutely nothing.

The private-key scanner had been reporting “No private keys detected” on every single run. It looked healthy. It was green in CI. And it was completely broken.

That’s the kind of quiet failure that only shows up when the review chain is willing to dig past the green checkmark. It became the headline of v4.1.1. But the story actually started a few days earlier with a more ordinary kind of drift.

text