On their sandbox, a chair design run from the built-in mech_v1 template had every agent write held as untrusted, so a person had to approve dozens of tool calls on top of the real gates. The fix trusts a run whose recorded flow hash matches the shipped template, while tailored or patched flows stay held.