feat(policy): control-plane-by-default AGENTOWNERS + pre-worktree preflight - #4
Merged
Conversation
…flight BEFLOW-3 — recommended control-plane AGENTOWNERS: - Ship a compiled-in recommended AGENTOWNERS (require_approval on tests/** and .github/**, which covers CI and the AGENTOWNERS file itself). - `beflow setup` scaffolds it into each configured project repo's .github/AGENTOWNERS, never overwriting an existing file, and prints the one-step activation hint (policy.evaluator = "agentowners") without mutating config. - The shipped default is verified to parse through the real evaluator. BEFLOW-11 — conservative pre-worktree policy preflight: - New fail-fast gate beside the decision/thin-issue gates: derive coarse file paths the issue declares (body + title) and run the SAME resolved policy before any worktree is built. - Short-circuits to Needs Input ONLY on a confident block; require_approval and allow proceed, and an issue declaring no paths proceeds. The post-diff gate over the real diff stays authoritative. - Resolver lifted and shared (one definition, two call points); the agentowners file reader is injectable in both the preflight and post-diff gates for symmetry. bun run check: 1032 pass / 0 fail.
- add append() to the RunStoreFs test-doubles (cli/scaffold/setup) now that the interface requires it on main - derivePreflightPaths: reject schemeless hostname-like tokens (example.com/x.html) so domains aren't mis-derived as repo paths; conservative — a rejected token simply proceeds to the post-diff gate - scope the ambient *.default module declaration to */agentowners.default
corrm
force-pushed
the
feat/agentowners-coverage
branch
from
June 21, 2026 00:23
de62c27 to
b74f23d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two related governance changes (BEFLOW-10 roadmap), both reusing the existing policy engine — no new evaluator, no schema change.
BEFLOW-3 — recommended control-plane AGENTOWNERS
tests/, CI (.github/), and the gate config were treated as ordinary app code, so an agent could edit them within an otherwise-allowed path. Control-plane should be protected by default.require_approvalontests/**and.github/**(which covers CI and the AGENTOWNERS file itself).beflow setupscaffolds it into each configured project repo's.github/AGENTOWNERS, never overwriting an existing file, and prints a one-step activation hint (policy.evaluator = "agentowners") — it never mutates config.require_approvalrules.BEFLOW-11 — conservative pre-worktree preflight
The AGENTOWNERS gate only runs post-diff — after an agent may have spent 30–40 min building in a worktree. Infra tasks are the expensive miss.
block;require_approval/allowproceed, and an issue declaring no paths proceeds. The post-diff gate over the real diff stays authoritative.Tests
bun run check(oxfmt + oxlint + tsc + bun test): 1032 pass / 0 fail. Preflight tests assert: blocks → Needs Input with no worktree created, agent never runs; proceeds on require_approval/allow; proceeds conservatively when no paths are declared even under a block rule; skipped when the evaluator is off or the job isn't an autonomous implement.Honest caveat (BEFLOW-11)
A preflight is only as sharp as the paths the issue declares — it catches a whole infra module/repo cleanly, but file-level precision still needs the real diff. Fail-fast, not a replacement.