diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 000000000..f030d327c
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-06-20 - Prevent HTML Comment Breakout in JSON Serialization
+**Vulnerability:** Markdown Injection / HTML Comment Breakout
+**Learning:** JSON serialized into HTML comments (like `<!-- json -->`) can contain `-->` in string values, causing GitHub's Markdown parser to close the comment prematurely and render the remaining JSON as attacker-controlled text or Markdown.
+**Prevention:** Always escape `<` and `>` as `\u003c` and `\u003e` (and `&` as `\u0026`) when embedding JSON in HTML contexts (even Markdown comments) to prevent breakout.
diff --git a/scripts/ci/opencode_review_normalize_output.py b/scripts/ci/opencode_review_normalize_output.py
index 2a850c646..711fd1ef3 100755
--- a/scripts/ci/opencode_review_normalize_output.py
+++ b/scripts/ci/opencode_review_normalize_output.py
@@ -123,6 +123,7 @@ def main(argv: list[str]) -> int:
             continue
 
         normalized_json = json.dumps(control, separators=(",", ":"), ensure_ascii=False)
+        normalized_json = normalized_json.replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")
         output_file.write_text(
             "\n".join(
                 [