Auths × GitHub, live

Approve one patch. Publish only that patch.

The agent creates Git evidence without a GitHub credential. A separate verifier uses a repository-only read token to check the exact issue, base commit, changed paths, and Auths proof before any mutation token can be minted.

  • No agent credential
  • One derived branch
  • One draft PR
Browser ready Native service connecting GitHub not checked release —
01 Choose a test case Result updates immediately

Change one fact.

Each case uses a server-owned candidate. Select a case to see the expected decision, then inspect the actual Git bundle.

Signed workflow constraints
Repository
auths-dev/auths-github-demo
Issue
—
Base
loading
Target
executor derived
Allowed
demo/runs/**
Denied
.github/**
Budget
1 branch · 1 draft PR
Agent token
NONE
02 · Live authorization result AUTH-V1 / GITHUB
starting
Current verdict CHECKING

Connecting to the native service. Experiment controls are available now.

Result code
—
Check stops at
—
Write token requested
—
External mutations
—
Required by workflow —
checking
Loaded by executor —
03 · Inspect and execute

Inspect the exact candidate.

The executor will parse a bounded Git bundle without checking out or running candidate code.

Candidate
not inspected
Changed path
—
Direct agent push
not attempted
Execution timeline

Separate checks and effects

Every row reports one completed boundary.

  1. Candidate inspectedAwaiting inspection
  2. Exact action authorized—
  3. Derived branch published—
  4. Draft pull request opened—
  5. Replay creates no mutation—
View decision and execution receipts 0 
Run the workflow to load receipts.

Credential boundary

The agent submits evidence. The executor holds the GitHub App key.

01Agent

Builds a Git bundle and fails a direct credential-less push.

02Auths

Uses a read-only repository token to check exact action bytes against fresh GitHub and Git evidence.

03Executor

Claims one effect, then mints a scoped mutation token and publishes exact values.