Repository navigation
pr-pipeline: agents push and label as the GitHub App identity #7558
Description
Parent
Refs #7555. Source: PLAN Phase 0, topic poteto-review. Thread: Agent App identity (deferred).
Depends on
- none (parked: opens on the reopen trigger below, not on an edge)
Reopen trigger
The parked agent-only distro plan (the plan that makes "owner identity = human" provable on a WSL
host) is taken up.
Outcome
When reopened: agents push and label as the GitHub App identity rather than the owner's account.
Decisions
- Deferred: agents push and label as the GitHub App identity (Q11, D57a). Origin: ours.
- Interim, in force now: pr-merge ignores owner-account labels and body edits and trusts CI
identities and content signals (D57a). - Options on record: App identity now (D57) versus an agent-only distro with 9 phases to make
"owner identity = human" provable on WSL (D57a).
Key interfaces
None (the design's module layout lists "Agent App identity" under deferred, no module change yet).
Done when
- The reopen trigger has fired and is cited in a comment.
- Slices are filed under this item from that plan.
- Before any agent session or function signs as the agent App, ci-status's trust-path hold applies to pull requests the agent App authors or pushes to, through the shared trust-path hold (ci-workflows
pr-require-checks-trust-paths.yml, configured by.github/trust-path-hold.json), in every repository the App can write (each has that caller on main), exactly as it applies to exempt authors today. A test shows an App-pushed resolve-config change is held.
Out of scope
- Changing the interim pr-merge trust rule.
Related
- fix(work-items): loop-lane identity follow-ups (app-slug config, telemetry issue capture, marker rule conflict) #7207 loop-lane identity follow-ups (sub-issue of this item).
Activity
github-actions commentedon Oct 16, 2026
Proposed work class: none
Size: Small
Complexity: Low
Uncertainty: Knowable
Flags: none
Blocked by: none
Understood: this is a parked Feature. Agents would push and label as the GitHub App identity instead of the owner's account. It opens only when the agent-only distro plan is taken up. The interim pr-merge trust rule stays as it is. I found no sign that the reopen trigger has fired, so the done-when items (cite the trigger, then file slices) are not ready to work. I found no likely duplicates in the open issues. #7207 is already linked as a sub-issue.
Automated triage. A maintainer reviews it.
kyle-sexton commentedon Oct 24, 2026
Released for re-triage under the owner's 2026-10-24 rule: an issue stops for a person only for an intent or vision question, a security call, a host or attended run, or spend outside prepaid credit. The hold label came off and intake triage runs again now; it re-applies a hold, with a numbered question, when one of those applies.
To hold this issue again, add
needs-human(orstatus: needs-decision) and say why in a comment.melodic-automation-lanes commentedon Oct 24, 2026
Not admitted to the issue lane: a criterion names .github/workflows/pr-require-checks-trust-paths.yml, which the issue lane cannot push (patch-protected-path); a builder session takes it. Admission takes the issue once each of those is met, when intake triages it again (
.github/actions/resolve-config/admission-rules.json).kyle-sexton commentedon Oct 26, 2026
Released for re-triage under the owner's 2026-10-24 rule: an issue stops for a person only for an intent or vision question, a security call, a host or attended run, or spend outside prepaid credit. The hold label came off and intake triage runs again now; it re-applies a hold, with a numbered question, when one of those applies.
To hold this issue again, add
needs-human(orstatus: needs-decision) and say why in a comment.[-]pr-pipeline: agents push and label as the GitHub App identity[/-][+]pr-pipeline: agents push and label as the GitHub App identity (hardening deferred)[/+]kyle-sexton commentedon Oct 31, 2026
Closing under the standing direction. This parked item's reopen trigger (the agent-only distro plan being taken up) has not fired: no comment cites it, and intake's admission note (edited 2026-10-30) parks it only because its third criterion names the ci-workflows trust-path hold caller, which the issue lane cannot push. That criterion asks for a trust-path hold on pull requests the agent App authors or pushes; holds against our own actors are friction under the standing direction and come off, so it is dropped. What is left, agents pushing and labeling as the App identity instead of the owner's account, is identity hardening, which is deferred until open issues and pull requests reach zero (hardening deferred, §10). The interim pr-merge trust rule the body records stays as it is. Refile from this issue if the distro plan is taken up.
kyle-sexton commentedon Oct 31, 2026
Closed as hardening deferred under standing direction §10; the comment above has the evidence. Trigger to refile: open issues = 0 and open PRs = 0.
kyle-sexton commentedon Oct 31, 2026
Reopening into the After zero milestone. Remaining value: keep agent identity distinct from the owner so owner identity stops carrying agent acts. Closed as deferred; the owner rule of 2026-10-31 keeps work with value open and cordoned.
[-]pr-pipeline: agents push and label as the GitHub App identity (hardening deferred)[/-][+]pr-pipeline: agents push and label as the GitHub App identity[/+]