| # HAI GitHub Gate |
|
|
| GitHub-native HAI gate for agent-created pull requests. |
|
|
| The goal is not to build another agent runtime. The goal is to put a small, |
| deterministic gate between agent output and merge rights. |
|
|
| ```text |
| Agent creates branch/PR |
| ↓ |
| GitHub Actions runs HAI Gate |
| ↓ |
| Owner Packet appears in the check summary |
| ↓ |
| Branch protection blocks risky or unevidenced PRs |
| ``` |
|
|
| ## What It Blocks |
|
|
| - secret or `.env` file changes without explicit owner approval |
| - workflow, infra, migration, or deployment-sensitive changes without explicit owner approval |
| - code changes without concrete test/check evidence in the PR body |
| - large PR scope without an explicit owner decision |
| - empty PR bodies |
|
|
| ## What It Parks |
|
|
| Follow-up ideas, wishlist items, and nice-to-have notes are summarized as `PARK`. |
| They do not block merge by themselves, but they should not expand the PR scope. |
|
|
| ## Drop-In Install |
|
|
| Copy these files into a target repository: |
|
|
| ```text |
| scripts/hai_gate.py |
| .github/workflows/hai-gate.yml |
| .github/pull_request_template.md |
| AGENTS.md |
| ``` |
|
|
| Use the workflow template: |
|
|
| ```bash |
| mkdir -p .github/workflows scripts |
| cp templates/hai-gate.yml .github/workflows/hai-gate.yml |
| cp templates/pull_request_template.md .github/pull_request_template.md |
| cp scripts/hai_gate.py scripts/hai_gate.py |
| ``` |
|
|
| Then configure branch protection so `HAI Gate` must pass before merge. |
|
|
| ## PR Body Contract |
|
|
| ```md |
| ## Goal |
| ... |
| |
| ## Changed files |
| ... |
| |
| ## Verification |
| - Tests run: `<command>` |
| - Result: `<passed/failed/not run>` |
| |
| ## Risk |
| ... |
| |
| ## Owner decision |
| None / Approved-by: Samuel / explicit decision needed |
| ``` |
|
|
| ## Local Smoke |
|
|
| ```bash |
| python scripts/hai_gate.py \ |
| --event examples/pr_missing_tests.json \ |
| --files examples/files_code_change.txt |
| ``` |
|
|
| Expected result: exits `1` and prints an `EVIDENCE_REQUIRED` Owner Packet. |
|
|
| ## Tests |
|
|
| ```bash |
| python -m pytest -q |
| ``` |
|
|
| ## Next Step |
|
|
| See [NEXT_STEP.md](NEXT_STEP.md) for the planned harness metadata adapter. |
|
|
| ## GitHub Setup Note |
|
|
| This repo is intended to become `smlfg/hai-github-gate` as a private repository. |
| Current local GitHub auth must be fixed first: |
|
|
| ```bash |
| gh auth login -h github.com |
| gh repo create smlfg/hai-github-gate --private --source /home/smlflg/Projekte/hai-github-gate |
| ``` |
|
|
