Patches & governance

ContextMint enforces human gates: evidence before inference (Context Lens), diffs before apply (patch preview). Governance signals inform — and optionally gate — high-risk changes.

Gate 1 — Context Lens

See Context Lens & packs. You approve retrieved context before the model answers.

Gate 2 — Patch preview

In Agent mode, proposed edits appear as a unified diff:

  • Review added/removed lines per file
  • Accept applies to workspace (or sandbox worktree when enabled)
  • Reject discards the proposal — no silent writes

Assisted actions

Structured action cards (refactors, test scaffolding, etc.) include risk level and reasoning references. Confirm or cancel explicitly; telemetry mirrors audit metadata (no file contents in telemetry POST).

Quality map

Engine → Quality runs scans for clones, near-duplicates, and structure signals. Findings appear in the governance drawer during Context Lens. In Repo lane, governed chat may apply DRY shortcuts when high-confidence duplicate patterns match your question.

Governed chat scope

Quality-map shortcuts apply in Repo context lane only. Work and Hybrid lanes use standard assembly without governed duplicate routing.

ARGUS findings → patch preview

ARGUS visual audit returns structured UI findings — it does not modify your repo. If you choose to fix an issue, ContextMint can hand off to an assisted action and the same patch preview flow (gate 2). You still review unified diffs before apply. See Image evidence & ARGUS.

Audit & telemetry

  • Server writes audit JSONL per workspace (chat streams, actions, indexing events) under ~/.contextmint/audit/ — persisted on disk; Engine Knowledge → Activity only displays a configurable time window (default 1 h, max 24 h in UI)
  • Engine Knowledge tab — verify structural registries and export activity audit for governance reviews — Knowledge & governance guide
  • Optional POST /api/v1/telemetry/action for sampled client mirrors
  • Lane metrics on GET /api/observability/metrics for operators

Enterprise posture

Regulated teams pair local-first defaults with shared on-prem API, OIDC, and BYOK cloud routing. See Trust & Security and BYOK & enterprise.

Problems: Troubleshooting → Patches & actions.