Apply verified PR proposals with exact publication leases #325
- MA
A trusted application validates a bounded bundle, its authenticated dispatch identity, Git policy, and the exact detector-reviewed diff. It records the proposal before publication, rechecks the PR and base, and pushes only with a lease on the captured head.
Newer human commits reject publication. Recovery revalidates an already-published proposal rather than pushing it again. The agent receives no branch-write credential; GitHub CI still determines readiness.
Validation: real Git tests cover artifact corruption, protected edits, oversized diffs, import failures, CAS failures, crash recovery, and rejection of a stale lease. Independently reviewed.

MaggieAppletonadded-to-stacklast month on GitHub
MaggieAppletonrenamed feat: apply inspected PR proposals with exact publication leases to Apply verified PR proposals with exact publication leaseslast month on GitHub
MaggieAppletonhead-ref-force-pushed c999f3cfa325last month on GitHub
MaggieAppletonhead-ref-force-pushed 31e7378bf20blast month on GitHub
MaggieAppletonbase-ref-force-pushedlast month on GitHub
MaggieAppletonhead-ref-force-pushed 1c2acab6f2b0last month on GitHub
MaggieAppletonmerged 25700de564c4last month on GitHub
MaggieAppletonhead-ref-deletedlast month on GitHub