# HAI GitHub Gate

GitHub-native HAI gate for agent-created pull requests.

The goal is not to build another agent runtime. The goal is to put a small,
deterministic gate between agent output and merge rights.

```text
Agent creates branch/PR
        ↓
GitHub Actions runs HAI Gate
        ↓
Owner Packet appears in the check summary
        ↓
Branch protection blocks risky or unevidenced PRs
```

## What It Blocks

- secret or `.env` file changes without explicit owner approval
- workflow, infra, migration, or deployment-sensitive changes without explicit owner approval
- code changes without concrete test/check evidence in the PR body
- large PR scope without an explicit owner decision
- empty PR bodies

## What It Parks

Follow-up ideas, wishlist items, and nice-to-have notes are summarized as `PARK`.
They do not block merge by themselves, but they should not expand the PR scope.

## Drop-In Install

Copy these files into a target repository:

```text
scripts/hai_gate.py
.github/workflows/hai-gate.yml
.github/pull_request_template.md
AGENTS.md
```

Use the workflow template:

```bash
mkdir -p .github/workflows scripts
cp templates/hai-gate.yml .github/workflows/hai-gate.yml
cp templates/pull_request_template.md .github/pull_request_template.md
cp scripts/hai_gate.py scripts/hai_gate.py
```

Then configure branch protection so `HAI Gate` must pass before merge.

## PR Body Contract

```md
## Goal
...

## Changed files
...

## Verification
- Tests run: `<command>`
- Result: `<passed/failed/not run>`

## Risk
...

## Owner decision
None / Approved-by: Samuel / explicit decision needed
```

## Local Smoke

```bash
python scripts/hai_gate.py \
  --event examples/pr_missing_tests.json \
  --files examples/files_code_change.txt
```

Expected result: exits `1` and prints an `EVIDENCE_REQUIRED` Owner Packet.

## Tests

```bash
python -m pytest -q
```

## Next Step

See [NEXT_STEP.md](NEXT_STEP.md) for the planned harness metadata adapter.

## GitHub Setup Note

This repo is intended to become `smlfg/hai-github-gate` as a private repository.
Current local GitHub auth must be fixed first:

```bash
gh auth login -h github.com
gh repo create smlfg/hai-github-gate --private --source /home/smlflg/Projekte/hai-github-gate
```