[robgruen]

Summary

Implement the code portion of the exact agreement accepted in #504, separately from completion receipts in #506. #506 has now been merged by the owner and incorporated here without rewriting branch history. The pilot remains disabled; no live coding run, credential probe, budget activation, approval, or merge was performed.

• Generate a copyable owner-only /typechat build <acceptance-comment-id>:<sha256> command from the durable public acceptance and its prior owner approval, independently of draft-artifact expiry.
• Freeze scope, discussion, policy, source, and controls; reject competing contributions; reserve one coding run before inference; reject retry spending and stale/withdrawn authorization.
• Bound generation at 1,000 AI credits and detection at a separate explicit 400 credits. Require native completion, exact-patch scan bindings, relevant deterministic checks, and actual in-budget usage.
• Keep App credentials out of coding, detection, and generated tests. Run tests in a non-root, network-isolated container without host credentials or workspace/socket access.
• Revalidate everything before creating one owned branch/PR through the existing App. Verify the complete resulting tree; never execute generated code with write credentials, force-push, overwrite existing work, auto-close, approve, merge, or release.
• Add offline protocol/workflow tests, a real CI sandbox smoke test using a synthetic TypeScript/Python patch, reproducible compilation, and operator documentation.

Validation

• 313 selected offline tests passed on Node 24.22.1, covering success, authorization, scope/policy freshness, App-token restrictions, isolation contracts, budgets, exact patch/check evidence, and uncertain-write retries.
• Pinned gh-aw v0.93.5 strict compilation: all three workflows succeeded with zero warnings; repeat compilation produced no generated drift.
• 100 local documentation links/anchors and staged whitespace checks passed.
• The contribution-link GraphQL query was verified against GitHub's read-only schema.
• Local selection excludes tests that read policy-restricted publisher source. All 14 GitHub CI checks passed on 2106448, including full repository automation tests and the real Linux TypeScript/Python container smoke test (run 41381584967). The smoke test verified credential/network isolation without any coding-model run.

Credential/action review

Compiler safe-update review covered the new use of the existing DEPENDABOT_APP_PRIVATE_KEY binding. It is referenced only in trusted preflight/publisher steps, not generated execution. DEPENDABOT_APP_ID must identify typeagent-bot; short-lived tokens explicitly request only TypeChat contents/PR rights, validate returned permissions/repository selection, mask credentials, and revoke them. Unrelated vulnerability-alert permissions are rejected. No secret values were accessed locally.

All actions use existing full-commit pins; no existing action-lock/runtime/model pins or redirect destinations changed. The new test container uses the verified immutable Node 24.22.1 image digest. Actual scoped App minting and the first coding run remain unverified and require the separate owner-authorized rollout.

Rollout and boundaries

• TYPECHAT_IMPLEMENTATION_ENABLED remains unset/off. Manual command preparation spends no inference and mints no App token. Activation and a fresh Issue build comment are separate owner decisions after review/merge.
• Supported patches are bounded ordinary text changes in the library/example/site areas and root README. Automation, policy, dependencies/configuration, credentials, agent instructions, binary/executable-mode changes, and unsafe paths are rejected rather than silently omitted.
• Automation: pilot owner-triggered implementation for accepted Issues #504 authorizes development of this workflow; it must not be used to make the future coding agent rewrite its own controls. Automation: support implementation notes with work acceptance #502 remains deferred.
• GOALS, repository/token/PR-approval settings, App configuration, existing Dependabot workflow, and the policy-restricted publisher source are unchanged. Existing library APIs and discussion behavior are preserved.
• The separately authorized first live pilot must record whether normal PR CI and Copilot review actually ran. Those checks, human approval, and merging remain distinct; Automation: pilot owner-triggered implementation for accepted Issues #504 is not auto-closed by this PR.

[Copilot]

🟡 Changes recommended

Critical defects block sandbox execution and workflow validation, while patch collection can corrupt file content or silently mishandle executable-mode changes and renames.

6 open issues

• Grant detection job required read permissions · New
• Separate JSON documents before strict singleton-directory reads · New
• Disable rename detection when collecting changed paths · New
• Reject executable-mode changes during collection · New
• Validate original bytes before UTF-8 decoding · New
• Add Hatch project environment to PATH · New

What changed in this PR

Adds a disabled-by-default, owner-authorized implementation pilot for accepted Issues, separate from the completion receipts in #506. It extends repository automation without changing TypeChat’s library APIs; activation, live verification, and merging remain separate human decisions.

Changes:

• Adds exact acceptance-bound build commands, frozen authorization, spending reservations, and scoped App publication.
• Adds bounded patch collection, threat-detection evidence, and credential-free container checks.
• Adds protocol tests, a CI sandbox smoke test, and rollout/recovery documentation.

File	Description
tools/​tests/​issue-implementation.test.mjs	Tests authorization, patch validation, budgets, publication, and App access.
tools/​tests/​implementation-workflow.test.mjs	Tests workflow guards, permissions, artifacts, and compilation contracts.
tools/​tests/​implementation-sandbox.integration.test.mjs	Adds a real TypeScript/Python isolation smoke test.
tools/​issue-implementation.mjs	Implements build authorization, patch collection, validation, and publication.
tools/​implementation-sandbox.mjs	Runs deterministic checks in an isolated container.
tools/​implementation-app.mjs	Validates, scopes, masks, and revokes App credentials.
tools/​discussion-draft.mjs	Exposes shared control, detection, and intent helpers.
README.md	Updates acceptance status and introduces the disabled pilot.
OWNER-CHEATSHEET.md	Documents owner commands, budgets, and recovery steps.
AUTOMATION.md	Documents implementation safeguards and rollout requirements.
.github/​workflows/​issue-implementation.md	Defines the owner-triggered implementation workflow.
.github/​workflows/​agent-workflow-check.yml	Adds pilot compilation and sandbox smoke-test CI.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Binary deletions can reach publication without their contents being scanned because binary-diff notices are accepted as complete patches.

6 open issues

• Reject binary deletion notices before scanning patches · New
• Validate original bytes before UTF-8 decoding
• Reject executable-mode changes during collection
• Disable rename detection when collecting changed paths
• Grant detection job required read permissions
• Add Hatch project environment to PATH

1 resolved since last review

• Separate JSON documents before strict singleton-directory reads

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The candidate-path filter allows changes to python/hatch.toml that can redefine the sandbox’s test script, undermining the immutable test-configuration boundary and the reliability of check evidence.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Reject alternate Python config and dependency manifests

tools/​issue-implementation.mjs:441

This filter accepts python/hatch.toml and python/Pipfile as ordinary source changes. In particular, Hatch reads hatch.toml as project configuration, and the sandbox applies the candidate before invoking hatch run test, allowing a candidate to redefine the test script while check evidence still lists the expected Hatch command. Reject these alternate configuration/dependency manifests to preserve the immutable test-configuration boundary, and add them to the protected-path regression cases.

Ignore generated dependency and virtual-environment files

.github/​workflows/​issue-implementation.md:484

The sparse checkout omits the root .gitignore, so normal site dependency installation or Python environment creation leaves generated files visible to collectCandidate(). The collector then rejects site/node_modules/ or the root .venv/ as unsupported patch paths, blocking otherwise valid implementations after local checks. Include /.gitignore in this list and regenerate the compiled workflow.

Check Issue eligibility after returning existing results

tools/​issue-implementation.mjs:341

Once a successful implementation's Issue is closed or locked, rerunning its original command fails here before looking up the existing PR. Move this eligibility check after the existing-result return so completed commands return their result while closed or locked Issues still block new work.

7 resolved since last review

• Reject binary deletion notices before scanning patches
• Validate original bytes before UTF-8 decoding
• Reject executable-mode changes during collection
• Disable rename detection when collecting changed paths
• Separate JSON documents before strict singleton-directory reads
• Grant detection job required read permissions
• Add Hatch project environment to PATH

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate detector execution after failed authorization, dependency-collection failures, and acceptance of paths incompatible with Windows checkouts.

No open issues 🎉

_{Review effort: Balanced}

[robgruen]

Follow-up to the broader review note on 5a3c0f8: addressed in 2106448 after integrating merged #506 without rewriting history.

• Detector eligibility now requires successful preparation and successful sole-noop generation. Its only configured inference credential is withheld unless trusted authorization/exact-patch staging succeeded and preceding job steps have not failed or been cancelled. This handles the pinned runtime launcher continuing after a failed custom pre-step without weakening scan or publication gates.
• Regression tests confirm failed Git enumeration, source archival/extraction, and dependency installation cannot produce a partial candidate or passing check evidence.
• Windows validation now rejects trailing-dot path components and directory-case aliases, including collisions against the base tree and between candidate paths.

Validation: 313 selected offline tests pass on Node 24.22.1; all three workflows compile strictly with zero warnings and no repeat-compilation drift; all 14 CI checks pass, including the real isolated TypeScript/Python container test (run 41381584967). Policy-excluded publisher-source cases remain a CI result, not a local inspection claim. No new credentials, runtime/model pin changes, activation, merge, or live coding run were performed. Human review and separately authorized live verification remain required.

[Copilot]

🟡 Changes recommended

The path guard allows python/hatch.toml to redefine required sandbox checks and permits generated site/_site files that the build can overwrite instead of validating.

2 open issues

• Protect hatch.toml from candidate changes · New
• Reject generated _site output from submitted paths · New

_{Review effort: Balanced}