Review agent-authored pull requests

Review pull requests that coding agents write more deeply, and hold them to a stricter merge gate. An organization administrator turns the policy on for each repository and declares the accounts, GitHub Apps and commit trailer addresses the organization's agents use.

Before you start#

Saving the policy or an agent identity needs an organization administrator who signed in within the last 24 hours. If the save is refused, sign in again and retry.

How Proofline recognizes agent work#

Proofline classifies each reviewed pull request head from fixed signals:

• An agent identity opened the pull request, authored or committed one of its commits, or is named in a commit's Co-authored-by, Generated-by or Assisted-by trailer.
• Proofline opened the pull request for a fix proposal, or a coding agent session opened it.

A pull request is agent-authored when an agent account or GitHub App opened it, when Proofline or an agent session opened it, or when every commit carries an agent signal. It is agent-assisted when only some commits carry one, or when a coding agent requested a local review of the change. A pull request with no signal has undetermined authorship and is covered by the policy too, including one a person wrote.

Logins, display names, branch names and pull request text never count as signals.

Declare an agent identity#

Settings → Review policy → Agent identities lists the identities Proofline recognizes. Built-in identities link to their Documentation. Declare the others your agents use:

1. Select Declare identity.
2. Choose the Kind: GitHub account, GitHub App or Commit trailer address.
3. Enter the GitHub user id, GitHub App id or Email address. For a GitHub account, you can instead choose a Bot account that opened a pull request here.
4. Enter a Label.
5. Select Declare identity.

Proofline matches accounts and Apps by their numeric GitHub id, so renaming an account does not change the match.

To stop recognizing a declared identity, select Retire, then Retire identity. New reviews stop recognizing it. Pull request heads already classified keep their record. Built-in identities cannot be retired.

Turn on the policy for a repository#

1. Open Repositories and select the repository.
2. Open Settings → Automation.
3. Under Agent-authored pull requests, choose a Policy.
4. Select Also cover agent-assisted pull requests to include pull requests where some commits carry an agent signal.
5. Select Save policy.

The policy covers agent-authored pull requests and those with undetermined authorship. Also cover agent-assisted pull requests adds agent-assisted ones.

• Off is the default. Reviews do not classify authorship.
• Shadow records each review's authorship and what the policy would have changed, and changes nothing. Use it to see which pull requests the policy would cover before you turn it on. This setting is separate from the repository's Shadow mode, which keeps review results off GitHub.
• On reviews every file of a covered pull request at standard depth or deeper and sensitive files in depth. If the repository's merge gate is enabled, every open supported finding blocks a covered pull request, whatever blocking severity the gate sets. Pull requests the policy does not cover keep the gate's severity.

A review follows the policy saved when it started. Saving a change does not alter reviews or gate decisions already recorded.

See a review's authorship#

When the repository's policy is Shadow or On, the review page, the Proofline Check on GitHub and the review's row in Reviews → Review requests carry one sentence about authorship. It names the policy and the signal that decided the class, or the reason authorship stayed undetermined. In Shadow, the sentence says that the policy changed nothing and what it would have applied.

The policy depends on signals that agents leave. An agent that uses an undeclared account and adds no trailer produces a pull request with undetermined authorship, which the policy still covers.