wshobson--agents
tommylauren
7e1aa0f977
Second inhabitant of the `governance` category. Addresses the failure mode
where an AI agent posts PR reviews, comments, merges, or edits CI config
without a human gate. Directly inspired by the Hermes-style incident
pattern where review-bot hallucinations produce account-linked damage.
Components
──────────
- plugin.json, README.md, skills/review-agent-setup/SKILL.md
- agents/review-policy-author.md (sonnet) — Cedar author specialized in
review-surface gating across GitHub / GitLab / protected branches /
CI paths / notification surfaces
- commands/approve-review.md — opens an approval window via ./.review-approved
flag file, records the reason in ./review-receipts/approvals/
- commands/list-pending.md — walks the receipt chain to show recent denials
(the set of actions the agent tried that were blocked)
- hooks/hooks.json — PreToolUse gate + PostToolUse sign
- policies/review-agent-governance.cedar — default Cedar policy with five
forbid rules covering gh/glab review actions, protected-branch pushes,
CI config paths, and WebFetch POSTs to hooks.slack.com / api.github.com
Behavior
────────
By default, the plugin forbids:
- gh pr review|comment|merge|close|edit, gh issue comment|close|edit,
gh release create|edit, gh api repos
- GitLab and Bitbucket equivalents
- git push to main|master|release|production
- Writes to .github/workflows/, .gitlab-ci.yml, .circleci/config.yml,
.github/CODEOWNERS
- WebFetch POSTs to api.github.com / api.gitlab.com / hooks.slack.com /
discord.com
Non-review actions pass through unchanged. Composes with protect-mcp for
general policy enforcement; configure separate receipt directories to
keep the chains distinct.
Approval pattern
────────────────
Human opens an approval window by creating ./.review-approved (or via
/approve-review "<reason>"). The PreToolUse hook short-circuits to
permit while the flag is present. Every action, approved or denied,
still produces an Ed25519 receipt, so the chain records exactly what
happened and under what approval.
Marketplace entry
─────────────────
Added under category: "governance" with seven discovery keywords. The
governance category now has two inhabitants (protect-mcp + this one),
which turns it from a vanity category into a real shelf.
Standards
─────────
- Ed25519 (RFC 8032), JCS (RFC 8785), Cedar (AWS)
- IETF draft-farley-acta-signed-receipts
- Uses protect-mcp as its evaluation/signing runtime