idea: spoof-resistant human-approval gate for agent-authored PR commits — inspired by claude-code-action's agent-approval-check

[github-actions]

Research brief

Landscape survey of comparable OSS agent frameworks (2026-07-22), scoped to:
"agent_mesh roadmap & comparable OSS agent frameworks" (OpenHands, SWE-agent,
Aider, MetaGPT/ChatDev, Renovate, claude-code-action).

Landscape signal — claude-code-action's agent-approval-check

PR #1429
(merged 2026-06-30) ships a required-status-check composite action that
demands N human approvals on any PR containing agent-authored commits.
Agent-authorship detection is multi-signal (committer email ∪ PR-author login
∪ any agent-submitted APPROVED review), not a naive author == bot check.
It's spoof-resistant: approvals are SHA-pinned, deduped, guarded against
sibling-PR-same-SHA reuse, and it fails closed above a commit-count ceiling.
Anthropic calls it "the gate we already run internally on every
agent-authored PR."

Gap (confirmed against this repo, not just landscape-inspired)

Read src/automerge/eligibility.js directly:

if (pr.reviewDecision !== 'APPROVED') return { state: 'blocked', reason: `not-approved:${pr.reviewDecision}` };

reviewDecision is GitHub's native branch-protection field — it is satisfied
by any qualifying approving review, including the Reviewer agent's own
automatic gh pr review --approve (.github/workflows/dev-mesh-review.yml,
fires on every same-repo pull_request unattended). Concretely: a
Coder/autofix builtin opens a PR → the Reviewer agent approves it → the
scheduled dev-mesh-automerge.yml sweep merges it. The full path from
agent-authored diff to merged main can complete with zero
human-attributable approval.

This is distinct from #834 (approval-age cooldown, inspired by Renovate's
minimumReleaseAge): #834 is purely time-based — it makes the PR wait, but
a PR with only bot approval still auto-merges once the cooldown elapses.
Nothing today requires that approval come from a human.

Proposed direction (draft spec attached)

A new disqualifying state in classifyAutomergePr (e.g.
not-human-approved) for PRs with an agent-authorship signal that lack an
APPROVED review from a login other than the Reviewer's own bot identity,
SHA-pinned so a stale approval doesn't cover a later push. Pure predicate
over already-fetched gh pr view --json reviews,... data — no new API
surface, no new tool grant. Composes with #834 rather than replacing it.

Full design (detection rule, SHA-pinning, testing plan, open questions on
canonical bot-identity enumeration) drafted at:
docs/superpowers/specs/2026-07-22-idea-agent-authored-commit-approval-gate-design.md

Note: per this run's scope (propose only), this draft spec file was
written to the working tree but has not been committed/pushed — also
blocked today by #771 (DEV_MESH_PAT secret still not configured, 403 on
spec-push). Carries full design detail for whoever picks this up.

Dedup confirmation

Checked all currently-open issues before filing. Distinct from:

• #834 (approval-age cooldown) — time-based wait, no identity/attestation
  check; this adds the missing "was a human accountable for this diff" gate.
• #831 (subprocess credential scrub) — unrelated surface (worker MCP-stdio
  env), not PR review/merge gating.
• #836 (OIDC/WIF for CI auth) — unrelated to review/merge decisioning.
• #838 (inline line-anchored PR review comments) — review presentation,
  not the merge-eligibility predicate.

Verified the actual gap by reading src/automerge/eligibility.js and both
dev-mesh-review.yml/dev-mesh-automerge.yml directly, not assumed from
docs: reviewDecision is genuinely satisfiable by bot-only approval today.

Sources

• claude-code-action agent-approval-check — Add agent-approval-check composite action anthropics/claude-code-action#1429
• This repo: src/automerge/eligibility.js, .github/workflows/dev-mesh-review.yml, .github/workflows/dev-mesh-automerge.yml

---

Filed by the Analyst's daily landscape-research review. Proposal only — subject to human approval (§5.3). No code written, no PR opened.

[github-actions]

Spec ready — attempt 1 of 3.

Authored the full design at docs/superpowers/specs/2026-07-22-idea-agent-authored-commit-approval-gate-design.md (human-approval gate: a new not-human-approved disqualifying state in classifyAutomergePr for agent-authored PRs lacking an APPROVED review from a non-bot login, SHA-pinned to the current head so a stale approval doesn't cover a later push; composes with #834 rather than replacing it).

Committed on spec/issue-841, git push → same known HTTP 403 (Permission to danabaxia/agent_mesh.git denied to github-actions[bot]) — this repo's spec-push is still blocked pending #771 (DEV_MESH_PAT secret not yet configured; confirmed unchanged again this run via gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false).

Labels already correctly reflect this (spec:draft + blocked + needs-human). Two attempts remain before this issue's own circuit breaker trips.

[github-actions]

Spec ready — attempt 2 of 3 (push blocked, HTTP 403 — same as #771)

Re-authored the spec (content unchanged from attempt 1's draft — it was already
complete) at docs/superpowers/specs/2026-07-22-idea-agent-authored-commit-approval-gate-design.md
(the not-human-approved disqualifying state in classifyAutomergePr, SHA-pinned
against bot-authored PRs approved only by the Reviewer's own bot review).

Committed on branch spec/issue-841, git push → same known HTTP 403
(Permission to danabaxia/agent_mesh.git denied to github-actions[bot]).
Reconfirmed root cause this run: gh api repos/danabaxia/agent_mesh --jq '.permissions.push'
→ false; gh auth status still shows the active token as the
integration/15368 GitHub App installation, not DEV_MESH_PAT. Same gap
tracked centrally at #771 — still open, unresolved as of this run.

Labels already correctly reflect this (spec:draft + blocked + needs-human).
One attempt remains before this issue's own circuit breaker trips.

[github-actions]

Spec ready — attempt 3 of 3 (push blocked, HTTP 403 — same as #771)

Re-authored the spec (content unchanged from attempts 1/2 — the design was
already complete) at
docs/superpowers/specs/2026-07-22-idea-agent-authored-commit-approval-gate-design.md
(new not-human-approved disqualifying state in classifyAutomergePr,
SHA-pinned against agent-authored PRs approved only by the Reviewer's own bot
review; composes with #834's age-cooldown rather than replacing it).

Committed on branch spec/issue-841, git push → same known HTTP 403
(Permission to danabaxia/agent_mesh.git denied to github-actions[bot]).
Reconfirmed root cause this run: gh api repos/danabaxia/agent_mesh --jq '.permissions.push' → false; gh auth status still shows the active token
as the integration/15368 GitHub App installation, not DEV_MESH_PAT. Same
gap tracked centrally at #771 — still open, unresolved as of this run.

This was the last of 3 attempts. Local spec/issue-841 branch deleted after
the failed push (nothing lost — it never reached origin). Labels already
correctly reflect this (spec:draft + blocked + needs-human).

[github-actions]

CIRCUIT BREAKER: spec-push has failed 3+ consecutive times. DEV_MESH_PAT may lack write access or the spec directory is conflicted. Human intervention required. See .github/actions/mesh-retry-backoff for 529.