Who dismissed it is now logged. What changed the model was not.
GitHub now audits every human dismissal of a machine's code quality finding, and a managed search model changed under every team using it with only a line in Google's release notes as the record.
How we Build
GitHub now logs who overruled a machine’s code quality finding, and when
GitHub has added two events to the organisation and enterprise audit log. They are generally available on GitHub Team and Enterprise Cloud. A dismissal of one or more Code Quality findings is recorded as repo.code_quality_findings_dismissed, and a reopening as repo.code_quality_findings_reopened. Each event carries who made the request, when, the repository, the rule, and the identifiers and count of the findings affected. CodeQL and AI Scan alerts are not covered yet.
We hold that a person’s correction belongs in the record with its provenance. Not in a ticket.
Every human correction enters the eval set with its provenance rather than a ticket.
The record now ships as default infrastructure. A team does not have to instrument the logging; it has to decide to read what is already there. But the log only says who dismissed a finding, not whether they were right to. And for now it stops at Code Quality: dismiss a security finding and no such trail exists.
How we Assure
A managed model changed under every team using it. The only record is a release note.
Google’s Cloud release notes record a change under Vertex AI Search on 16 October: the stable model for answer generation in Agent Search moved from gemini-2.5-flash to gemini-3.5-flash. Every team consuming the stable alias had the model its agent reasons with replaced that day. Google documents model versions and their lifecycle elsewhere. Nothing stops pinning a version instead.
Nothing that can change an agent’s behaviour changes without a recorded review, the model, the prompt, the tools, the corpus and the identities the supply chain brings with it.
A team on the stable alias reviewed nothing, and it recorded nothing. The change happened on the vendor’s side of the contract, and its own registers had nothing to check it against. Google does not say how many consumers use the stable alias rather than a pinned one. It does publish the versions plainly enough for a team that looks. Maybe pinning a version is where the obligation already sits, and the release note is exactly the record our practice asks for, one level up. Tell us where this reading is wrong: transform@dromologue.ai.