Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/ai_company/api/controllers/autonomy.py`:
- Around line 73-81: get_autonomy() and update_autonomy() currently ignore
per-agent/department overrides and pending requests by always using
config.autonomy.level and flipping promotion_pending manually; replace this by
routing both handlers through the AutonomyResolver and AutonomyChangeStrategy so
they compute the effective level and validation logic, consult and update the
persistent pending-request store, and emit events only after the strategy
decides (e.g., persist pending vs deny vs apply). Specifically: in
get_autonomy() return AutonomyLevelResponse built from
AutonomyResolver.resolve(agent_id) plus promotion_pending read from the
pending-request store; in update_autonomy() call
AutonomyChangeStrategy.request_change(agent_id, requested_level, actor) (or the
resolver API) to validate/apply/persist the change, persist any pending request
in the store, and return the resulting effective level and promotion_pending
flag instead of echoing config.autonomy.level; ensure AUTONOMY_PROMOTION_DENIED
is emitted only when the strategy denies, not when a request is simply pending.

In `@src/ai_company/core/agent.py`:
- Around line 320-323: The AgentIdentity model currently allows an invalid
combination (level == JUNIOR with autonomy_level == FULL); add a Pydantic
validator (e.g., a root_validator or field validator) on the AgentIdentity class
to detect when level is AutonomyLevel.JUNIOR and autonomy_level is
AutonomyLevel.FULL and raise a ValueError describing the forbidden combination;
reference the autonomy_level and level fields in the check so construction fails
fast and prevents creating AgentIdentity(level=JUNIOR, autonomy_level=FULL).

In `@src/ai_company/core/company.py`:
- Around line 373-383: The before-validator _coerce_autonomy_float should reject
non-finite or out-of-range legacy numeric autonomy values before converting
them; import isfinite from math and, inside _coerce_autonomy_float, when raw is
a numeric (and not bool) first check isfinite(raw) and that raw is within the
valid range (e.g. 0.0 <= raw <= 1.0), and if not raise a ValueError with a clear
message instead of coercing; if it passes, continue to call
_float_to_autonomy_level and return the coerced dict as before.

In `@src/ai_company/engine/prompt_template.py`:
- Around line 144-154: The DEFAULT_TEMPLATE was modified to add autonomy fields
but PROMPT_TEMPLATE_VERSION was not updated; update the PROMPT_TEMPLATE_VERSION
constant (referenced as PROMPT_TEMPLATE_VERSION) to a new semver (e.g., "1.4.0")
so cache/snapshot/telemetry can distinguish the autonomy-aware template, and
ensure any tests or places that import PROMPT_TEMPLATE_VERSION are updated
accordingly; locate the constant near the top of the module and bump it to the
new version to match the DEFAULT_TEMPLATE change.

In `@src/ai_company/engine/prompt.py`:
- Around line 399-404: The projection of EffectiveAutonomy into ctx omits the
security_agent field; update the block that sets ctx["effective_autonomy"] (the
code using effective_autonomy.level, auto_approve_actions,
human_approval_actions) to also include security_agent (e.g., "security_agent":
effective_autonomy.security_agent or its serializable representation) so
templates receive the escalation reviewer info along with level and actions.

In `@src/ai_company/persistence/protocol.py`:
- Around line 114-116: The class docstring for PersistenceBackend is missing the
new public API attribute parked_contexts; update the PersistenceBackend
docstring Attributes section to add an entry for parked_contexts (similar style
to existing entries like collaboration_metrics) describing that it returns a
ParkedContextRepository for ParkedContext persistence and ensure it appears
after collaboration_metrics so generated docs reflect the new property.

In `@src/ai_company/security/autonomy/change_strategy.py`:
- Around line 92-108: The code unconditionally sets current_level =
_DOWNGRADE_MAP[reason], which can raise an agent's autonomy if a later downgrade
maps to a less restrictive level; modify auto_downgrade() logic so when
self._overrides.get(agent_id) exists you do not increase autonomy: compute
new_level = _DOWNGRADE_MAP[reason] but if existing is present set current_level
= the more restrictive of existing.current_level and new_level (i.e., do not
replace an equal-or-more-restrictive level such as LOCKED with a
less-restrictive one); update the AutonomyOverride creation to use that
non-escalating current_level and leave original_level unchanged (use symbols:
_DOWNGRADE_MAP, auto_downgrade(), self._overrides, AutonomyOverride).

In `@src/ai_company/security/autonomy/models.py`:
- Around line 62-135: BUILTIN_PRESETS and AutonomyConfig.presets must be
immutable; change BUILTIN_PRESETS to an immutable Mapping (wrap the literal dict
in types.MappingProxyType) and update AutonomyConfig.presets to use a
Mapping[str, AutonomyPreset] type and a default_factory that returns an
immutable deep-copy of the builtin mapping (e.g., return
types.MappingProxyType(copy.deepcopy(BUILTIN_PRESETS))). Import copy and
types.MappingProxyType and ensure you reference BUILTIN_PRESETS, AutonomyConfig,
and the presets field when making these edits.

In `@src/ai_company/security/autonomy/resolver.py`:
- Around line 50-109: The resolve method and related pattern expansion exceed
the 50-line limit and do multiple responsibilities; refactor by extracting
preset lookup/validation and per-pattern expansion into small helper methods
(e.g., create a _get_preset_or_raise(level) that encapsulates the preset lookup,
warning log and ValueError, and a _expand_pattern_list(patterns) that wraps
_expand_patterns per-item branching), update resolve to call
_get_preset_or_raise and _expand_pattern_list, keep validate_seniority usage and
EffectiveAutonomy construction unchanged, and ensure new helpers are
unit-testable and maintain existing log fields (AUTONOMY_RESOLVED,
resolved_level, agent_override, department_override, counts).

In `@src/ai_company/security/service.py`:
- Around line 148-152: The early return after calling _apply_autonomy_precheck
prevents context from reaching self._rule_engine.evaluate(context); change the
flow so that _apply_autonomy_precheck is used only to short-circuit on an
explicit hard-deny, but otherwise do not return early—always call
self._rule_engine.evaluate(context) when autonomy_result is not a hard-deny, and
then merge or reconcile autonomy_result.risk_level (or related fields) into the
rule engine result so the final decision preserves the full security assessment
(use _apply_autonomy_precheck, _check_autonomy, and self._rule_engine.evaluate
to locate and implement the merge/short-circuit logic).

In `@src/ai_company/security/timeout/config.py`:
- Around line 82-86: The tiers mapping currently typed as dict[str, TierConfig]
allows typos (e.g., "critcal") which silently fall back at runtime; change the
field to use a constrained key type and validate entries explicitly: replace
dict[str, TierConfig] with dict[Literal["low","medium","high","critical"],
TierConfig] (or add a validator on the tiers field) in the model that declares
policy and tiers, and add a pydantic validator that raises a clear
ValidationError if any key is not one of the allowed risk levels
(low/medium/high/critical) so mis-typed config keys fail fast with a helpful
message.
- Around line 57-64: TierConfig.on_timeout and
EscalationChainConfig.on_chain_exhausted currently allow
TimeoutActionType.ESCALATE even though the models don't capture an escalate_to
target, which later causes TimeoutAction(action=ESCALATE, ...) to be constructed
without escalate_to in TieredTimeoutPolicy and EscalationChainPolicy; add
validation on TierConfig and EscalationChainConfig (or their pydantic model
validators) to reject or coerce ESCALATE when no escalate_to is provided: check
the fields TierConfig.on_timeout and EscalationChainConfig.on_chain_exhausted
for TimeoutActionType.ESCALATE and raise a validation error (or change default
to DENY) when escalate target/role is absent so downstream code in
TieredTimeoutPolicy and EscalationChainPolicy will never receive an ESCALATE
action without an escalate_to.

In `@src/ai_company/security/timeout/factory.py`:
- Around line 47-51: When building a TieredTimeoutPolicy from a
TieredTimeoutConfig, validate each tier in config.tiers and reject any tier
whose on_timeout/action is ESCALATE but which lacks an escalate_to target; raise
a clear exception (e.g., ValueError) describing the offending tier so the config
fails fast. Perform this check in the factory branch that returns
TieredTimeoutPolicy (where TieredTimeoutConfig is handled and
DefaultRiskTierClassifier is used) before constructing the TieredTimeoutPolicy.
- Around line 59-63: The logger.warning call in timeout.factory uses a raw event
name string ("timeout.factory.unknown_config"); replace it with a domain event
constant by adding/exporting a timeout event constant (e.g.,
TIMEOUT_FACTORY_UNKNOWN_CONFIG) under ai_company.observability.events.timeout
and then import it into src.ai_company.security.timeout.factory (from
ai_company.observability.events.timeout import TIMEOUT_FACTORY_UNKNOWN_CONFIG)
and use that constant in the logger.warning call (keep the same config_type
kwarg). Also remove the unused msg variable if no longer needed.
- Around line 47-50: TieredTimeoutConfig.tiers is a mutable dict on a frozen
Pydantic model; avoid sharing it directly with the runtime by deep-copying and
making it read-only before constructing the policy. In the branch that returns
TieredTimeoutPolicy, replace passing config.tiers directly with a deep copy
(copy.deepcopy(config.tiers)) and wrap the result with MappingProxyType to
produce an immutable mapping, and ensure you import copy and
types.MappingProxyType; apply this change where TieredTimeoutPolicy(...) is
constructed (referencing TieredTimeoutConfig, TieredTimeoutPolicy,
DefaultRiskTierClassifier, and the tiers field).

In `@src/ai_company/security/timeout/park_service.py`:
- Around line 37-83: After serializing the AgentContext in park(), validate that
the extracted internal identifiers match the outer fields: compare
context.execution_id, context.agent_id, and context.task_id against the values
being stored in ParkedContext (execution_id, agent_id, task_id) and raise
ValueError if any mismatch; when creating ParkedContext ensure you store the
canonical values only after this check. Likewise, in resume() when you
deserialize context_json back to an AgentContext, verify that the deserialized
context.execution_id, context.agent_id, and context.task_id match the
ParkedContext.execution_id, ParkedContext.agent_id, and ParkedContext.task_id
and reject/resist resumption if they differ. Ensure checks reference the
ParkedContext class and the park() and resume() methods and keep metadata
handling unchanged.

In `@src/ai_company/security/timeout/parked_context.py`:
- Around line 29-44: The metadata dict on the frozen Pydantic model
ParkedContext can still be mutated by callers; fix this by deep-copying and
wrapping it with MappingProxyType at creation so it becomes immutable. Add a
field validator for "metadata" (e.g., a `@field_validator`("metadata") on
ParkedContext) that does: metadata = copy.deepcopy(metadata) and return
MappingProxyType(metadata); ensure imports for copy and MappingProxyType are
added and that the validator runs during model instantiation so persisted
snapshots cannot be mutated after creation.

In `@src/ai_company/security/timeout/policies.py`:
- Around line 148-149: determine_action() currently always uses
self._classifier.classify(item.action_type) and ignores TierConfig.actions;
change the logic to first check each TierConfig in self._tiers for a non-empty
actions tuple containing item.action_type and select that tier_config if found,
and only if no TierConfig.actions match fall back to calling
self._classifier.classify(item.action_type) and lookup tier_config by
risk_level.value; update references to tier_config, self._classifier.classify,
and TierConfig.actions accordingly so pinned actions are honored.

In `@src/ai_company/security/timeout/risk_tier_classifier.py`:
- Around line 12-45: Remove the duplicated _DEFAULT_RISK_MAP definition and
instead import and reuse the shared risk map from the existing risk classifier
module (e.g., import DEFAULT_RISK_MAP or the exported map from risk_classifier).
Update references in this file (any uses of _DEFAULT_RISK_MAP, ApprovalRiskLevel
and ActionType lookups) to use the imported map so timeout classification and
security use the single source of truth defined in risk_classifier.py.

In `@src/ai_company/security/timeout/timeout_checker.py`:
- Around line 36-68: Add a guard at the start of check to skip policy evaluation
for items whose ApprovalItem.status is not ApprovalStatus.PENDING: return a
no-op/neutral TimeoutAction (and log the skip) instead of calling
self._policy.determine_action; also ensure check_and_resolve performs the same
status guard before applying any resolution so already-APPROVED/REJECTED/EXPIRED
items cannot be overwritten by timeout logic.

In `@src/ai_company/templates/renderer.py`:
- Around line 526-529: The branch that handles raw_autonomy dicts reuses the
parsed dict instance (raw_autonomy) and assigns it directly to autonomy, causing
aliasing if later normalization/validation mutates it; change the assignment to
make a deep copy (e.g., autonomy = copy.deepcopy(raw_autonomy)) and add an
import for the copy module at the top of the file so the config tree always
receives an isolated dict instance (refer to raw_autonomy and the autonomy
variable in renderer.py).
- Around line 675-678: The code may pass a non-string YAML scalar as preset_name
into get_personality_preset (which calls .strip()), causing AttributeError
instead of the renderer's TemplateRenderError; before calling
get_personality_preset(preset_name) validate that preset_name is an instance of
str and, if not, raise TemplateRenderError with a clear message about invalid
preset type; keep the existing KeyError handling for unknown preset names so the
try/except around get_personality_preset still catches KeyError but the type
check prevents AttributeError from escaping.
- Around line 68-70: The module-level Jinja2 filter "auto" on _JINJA_ENV
incorrectly uses "value or ''" which collapses valid falsy values like 0 or
False; change the filter to only treat None or Jinja2 Undefined as missing —
i.e., import Jinja2's Undefined and update the lambda for
_JINJA_ENV.filters["auto"] to return "" when value is None or isinstance(value,
Undefined), otherwise return the original value (preserving 0, 0.0, False).

In `@tests/unit/api/conftest.py`:
- Around line 198-211: The fake in-memory repo stores and returns the same
ParkedContext instances which share mutable metadata dicts; modify the methods
in the test fake (save, get, get_by_approval, get_by_agent) to deepcopy
ParkedContext objects at the persistence boundary (use import copy at top), i.e.
store copy.deepcopy(context) inside save and return copy.deepcopy(...) from get,
get_by_approval, and get_by_agent so callers receive independent copies
mirroring SQLiteParkedContextRepository serialization behavior.

In `@tests/unit/engine/test_loop_protocol.py`:
- Around line 33-36: Add tests exercising the new PARKED rule: create one
passing test that constructs an ExecutionResult with
termination=TerminationReason.PARKED and asserts that result.error_message is
None (or that validation succeeds), and add one failing test that attempts to
create/validate an ExecutionResult with termination=TerminationReason.PARKED and
a non-None error_message and asserts the operation raises the expected
validation exception (e.g., ValueError or AssertionError); reference
ExecutionResult and TerminationReason.PARKED in the new tests so the
PARKED->error_message=None contract is enforced.

In `@tests/unit/persistence/sqlite/test_migrations.py`:
- Around line 94-115: Update the two tests to validate the parked_contexts
schema, not just names: after run_migrations in
test_v3_creates_parked_contexts_table call "PRAGMA table_info(parked_contexts)"
and assert the returned column names include the repository-required columns
(e.g., "id", "agent_id", "approval_id", plus any expected timestamp or payload
columns your code depends on); in test_v3_creates_parked_context_indexes after
finding index names run "PRAGMA index_info('idx_pc_agent_id')" and "PRAGMA
index_info('idx_pc_approval_id')" and assert those index_info results reference
the proper indexed columns ("agent_id" and "approval_id" respectively); keep
using run_migrations and the same test function names to locate where to add
these assertions.

In `@tests/unit/persistence/sqlite/test_parked_context_repo.py`:
- Around line 7-18: Add a module-level 30-second timeout by defining pytestmark
= pytest.mark.timeout(30) near the top of the test file (after the imports) so
all async tests in this module (which use SQLiteParkedContextRepository and
ParkedContext) get a global timeout; use the pytestmark symbol and
pytest.mark.timeout to implement this.

In `@tests/unit/persistence/test_migrations_v2.py`:
- Around line 31-32: The test test_schema_version_is_three currently only
asserts SCHEMA_VERSION == 3 and therefore misses verifying that v3 artifacts
were actually created; update this test to also query the database schema to
assert the parked_contexts table exists and that the two new indexes
idx_pc_agent_id and idx_pc_approval_id are present (on the upgrade path where
_apply_v3() should run). Locate test_schema_version_is_three and after
confirming SCHEMA_VERSION, run the same connection/PRAGMA or sqlite_master
queries used elsewhere in the suite to verify existence of the parked_contexts
table and that entries for idx_pc_agent_id and idx_pc_approval_id exist; fail
the test if any of those are missing so partial or skipped _apply_v3() is
caught. Ensure you reference the same DB handle/fixture used by other migration
tests so the checks run against the upgraded DB instance.

In `@tests/unit/security/autonomy/test_change_strategy.py`:
- Around line 62-70: Update the test_double_downgrade_preserves_original to
ensure the original_level is preserved: when using HumanOnlyPromotionStrategy
call auto_downgrade the first time with an explicit current_level (e.g.,
AutonomyLevel.HIGH or similar) for agent-1, then call auto_downgrade a second
time with a different DowngradeReason, fetch the override via get_override and
add an assertion that override.original_level equals the explicit level you
seeded; keep the existing assertions for override.current_level and
override.reason to verify the second downgrade replaced only the current state.

In `@tests/unit/security/autonomy/test_models.py`:
- Around line 122-125: The test_config_frozen currently only checks assignment
to the AutonomyConfig.level attribute but misses in-place mutation of the
mutable AutonomyConfig.presets dict; update the test_config_frozen to attempt an
in-place change to config.presets (e.g., mutating an existing key or adding a
key) and assert that this raises an exception or is prevented, and if underlying
model does not yet protect presets, change the AutonomyConfig construction to
deep-copy incoming presets and wrap them with MappingProxyType (using
copy.deepcopy in the AutonomyConfig __init__ or validator) so presets is
read-only; reference AutonomyConfig, presets, test_config_frozen, copy.deepcopy,
and MappingProxyType when making the fixes.

In `@tests/unit/security/autonomy/test_resolver.py`:
- Around line 106-129: Add a test that exercises the public API by calling
resolver.resolve(...) to ensure seniority enforcement is applied there as well:
in TestSeniorityValidation add a case that calls
resolver.resolve(agent_level=AutonomyLevel.FULL,
seniority=SeniorityLevel.JUNIOR) and asserts it raises ValueError (matching
"FULL autonomy"); keep existing validate_seniority() checks but include this
resolve(...) call so the public resolve method is validated for the same JUNIOR
+ FULL rejection.

In `@tests/unit/security/test_service.py`:
- Around line 489-579: Add a new async test (e.g.,
test_auto_approve_blocked_for_high_or_critical_risk) that constructs an
EffectiveAutonomy with the action present in auto_approve_actions, then creates
a context for that action with a HIGH (and/or CRITICAL) risk level (use
_make_context(action_type="...", risk_level=RiskLevel.HIGH) or otherwise mock
the risk classifier), calls service.evaluate_pre_tool(ctx) and asserts the
result is NOT SecurityVerdictType.ALLOW and that auto-approval was not used
(e.g., service._test_rule_engine.evaluate.assert_called_once() or that the
verdict.reason mentions escalation/review); reference EffectiveAutonomy,
auto_approve_actions, evaluate_pre_tool, and SecurityVerdictType.ALLOW when
adding the test.

In `@tests/unit/security/timeout/test_factory.py`:
- Around line 30-47: Update each test to assert behavior/wiring, not just type:
after calling create_timeout_policy with DenyOnTimeoutConfig(timeout_minutes=60)
assert the returned DenyOnTimeoutPolicy has its internal timeout represented as
3600 seconds (verify the concrete attribute on DenyOnTimeoutPolicy that stores
seconds); for TieredTimeoutConfig assert the returned TieredTimeoutPolicy
preserved the provided tier configuration (compare the policy's tiers/config
property to the original TieredTimeoutConfig values); for EscalationChainConfig
assert the returned EscalationChainPolicy preserved the chain and
on_chain_exhausted values (verify the policy.chain contains the
EscalationStep(role="lead", timeout_minutes=30) data and
policy.on_chain_exhausted equals TimeoutActionType.DENY). Ensure you reference
create_timeout_policy, DenyOnTimeoutConfig, DenyOnTimeoutPolicy,
TieredTimeoutConfig, TieredTimeoutPolicy, EscalationChainConfig,
EscalationChainPolicy, EscalationStep, and TimeoutActionType when locating the
fields to assert.

In `@tests/unit/security/timeout/test_park_service.py`:
- Around line 75-92: The test test_resume_restores_context uses
_make_agent_context() which returns an AgentContext with task_execution=None, so
add a real task-bound context before parking: build an AgentContext with a
non-None task_execution containing a Task (with id "task-1" or similar) and use
that context when calling ParkService().park(...); after resume, assert that
restored.task_execution is not None and that restored.task_execution.task.id
equals the original task id to ensure the task survives the round-trip through
ParkService.park and ParkService.resume.

In `@tests/unit/security/timeout/test_parked_context.py`:
- Around line 54-59: Update the frozen-model test and the persistence
deserialization: in the test_frozen() for the ParkedContext model, add an
assertion that an in-place mutation like parked.metadata["key"] = "value" either
raises (or does not change the model when re-fetched) to cover dict mutation on
a frozen Pydantic model; and in the persistence layer method _row_to_model (the
function that converts DB rows into ParkedContext instances) wrap the
deserialized metadata with copy.deepcopy(json.loads(raw_meta)) before
constructing the ParkedContext so the model receives a deep-copied dict and
in-place mutations at call sites cannot mutate shared state.

In `@tests/unit/security/timeout/test_policies.py`:
- Around line 89-141: Add tests that ensure the HIGH and CRITICAL tiers cannot
be auto-approved even if their TierConfig.on_timeout is set to APPROVE: create
TieredTimeoutPolicy instances with tiers like {"high":
TierConfig(timeout_minutes=1, on_timeout=TimeoutActionType.APPROVE)} and
{"critical": TierConfig(...)} and use DefaultRiskTierClassifier plus
_make_item(...) with an action_type that maps to HIGH/CRITICAL (e.g.,
"secrets:write" or another classifier-recognized high/critical action); call
policy.determine_action(item, elapsed_seconds) with elapsed_seconds >
timeout_minutes*60 and assert the returned result.action is
TimeoutActionType.WAIT (repeat or parametrize for both HIGH and CRITICAL to
cover both branches).

In `@tests/unit/security/timeout/test_risk_tier_classifier.py`:
- Around line 1-64: Add the module-level pytest timeout marker by defining
pytestmark = pytest.mark.timeout(30) immediately after the imports in this test
module; update the top of the file (near the imports that include pytest and
DefaultRiskTierClassifier) so the module-level marker applies to all tests (no
changes needed to DefaultRiskTierClassifier or individual test functions).

---

Outside diff comments:
In `@src/ai_company/engine/agent_engine.py`:
- Around line 683-726: The current _make_security_interceptor returns None when
SecurityConfig is missing/disabled which disables autonomy enforcement; change
it to fail-closed by returning an autonomy-only interceptor that implements
SecurityInterceptionStrategy (instead of None) so autonomy rules still apply
even when other security detectors are off: locate _make_security_interceptor
and where it currently returns None for self._security_config is None or not
self._security_config.enabled, and replace that branch with construction/return
of a minimal interceptor (e.g., an AutonomyEnforcementInterceptor or a
SecOpsService instance configured only with effective_autonomy,
self._approval_store, and self._audit_log and no detectors) so
_make_tool_invoker can still rely on this interceptor to park/require approval
according to effective_autonomy.

In `@tests/unit/persistence/test_protocol.py`:
- Around line 126-186: Update the test to explicitly verify that the fake
repository type matches the repository protocol: import ParkedContextRepository
and add a conformance assertion for _FakeParkedContextRepository (e.g., assert
isinstance(_FakeParkedContextRepository(), ParkedContextRepository) or an
equivalent runtime/type-check that your test suite uses) inside
test_fake_backend_is_persistence_backend so that signature drift on
_FakeParkedContextRepository is caught; reference the symbols
_FakeParkedContextRepository and ParkedContextRepository when adding the check.