🔒 [security] approval: bind human sign-off to reviewed code by EricTechPro · Pull Request #23 · EricTechPro/super-board

EricTechPro · 2026-10-03T18:03:22Z

You approve the AI’s fix. The AI then changes the code. Super Board now waits for a fresh approval before merging.

Previously, an old approval could still let the changed code merge, even though you had never approved that version.

What changes

Only people with repository write permission or higher can approve. Bot accounts cannot.
You still reply done, but it must answer the current approval request.
Old labels and comments cannot approve changed code. The approval must also cover the current steps a person needs to complete.
If the code and those steps stay the same, repeated checks keep the valid approval. They do not keep asking you again.

Changed code returns for review and a fresh request. Asking again does not grant permission to merge.

Checked

All 34 offline safety test suites passed, including changed-code approval and blocked-task recovery. All eight GitHub checks passed. Independent review found no remaining issues to fix. No live board, worker, or database was used for these tests.

Existing blocked tasks need one fresh approval request and human reply.

Limits

GitHub cannot tell you apart from an AI using your GitHub account. The AI must never write your done reply.

The code is checked at merge time. Approval comments are checked just before that, but GitHub does not lock them against a last-second edit.

Merging manually on GitHub is unchanged.

- Verify trusted request and human reply for the current PR head and steps. - Refresh stale blocked requests without treating them as approved. - Pass 34 offline safety suites and independent review.

EricTechPro

Author explanations in the selected Purpose / What changed / Why it matters format: one overview for each changed file, plus notes beside critical approval logic. These explain the implementation; they are not an independent approval and do not replace tests.

EricTechPro · 2026-10-03T18:38:19Z

+        if request is None or any(request.get(k) != v for k, v in expected.items()):
+            return hold("the latest request does not cover the current code and human steps")
+        if timestamp(request_comment.get("updated_at")) != latest_time:
+            return hold("approval request was edited; post a fresh request")


Author explanation

Purpose
Make sure the human answered the current request.

What changed
The request must match the current code and required steps. An edited request is rejected too.

Why it matters
The question cannot be changed after the human has already answered it.

EricTechPro · 2026-10-03T18:38:19Z

+        for comment in comments:
+            if (not comment.get("id") or not DONE.fullmatch(comment.get("body") or "")
+                    or comment.get("source") != request_comment.get("source")):
+                continue
+            created = timestamp(comment.get("created_at"))
+            if created <= latest_time or timestamp(comment.get("updated_at")) != created:
+                continue
+            author = comment.get("user") or {}
+            if (author.get("type") == "User" and author.get("login")
+                    and permission(author["login"]) in ("write", "maintain", "admin")):
+                return {"approved": True, "why": "trusted human confirmed the current request",
+                        "request": request, "requestId": request_comment.get("id"),
+                        "approvalId": comment.get("id"), "approver": author["login"]}


Author explanation

Purpose
Accept a valid answer from someone allowed to approve.

What changed
Check write access or higher, reply time and the same issue or PR discussion. Ignore edited replies and GitHub bot accounts.

Why it matters
An outsider’s reply or an old done must not unlock the merge. An AI using a person’s GitHub account remains indistinguishable from that person.

EricTechPro · 2026-10-03T18:38:19Z

+APPROVED=false
+approval_check() {
+  APPROVAL=$(python3 "$HERE/super-board-approval.py" --repo "$REPO" --pr "$PR" \
+    --head "$HEAD_SHA" --plan "$PLAN") || APPROVAL='{"approved":false}'
+  APPROVED=$(echo "$APPROVAL" | jq -r '.approved // false')
+}


Author explanation

Purpose
Ask whether this code and its required human steps are approved.

What changed
Call the approval checker instead of trusting the label. A failed checker call leaves approval false.

Why it matters
The merge needs a verified human answer, not just a status label.

EricTechPro · 2026-10-03T18:38:19Z

+if [ -n "$HUMAN" ] && [ "$APPROVED" != true ]; then
  echo "$HUMAN"
-  say "merge policy: a human merges this PR"; exit 7
+  echo "$PLAN" | jq -r '.needs_you[] | "needs-you: " + .'
+  approval_request
+  say "merge policy: waiting for a trusted human to approve this exact head"; exit 7


Author explanation

Purpose
Hold a change that still needs human approval.

What changed
Print the request for the current change and stop when that approval is missing.

Why it matters
Asking for permission never grants permission to merge.

EricTechPro · 2026-10-03T18:38:20Z

+  gh pr view "$PR" ${REPO:+--repo "$REPO"} --json labels,files,additions,deletions,body > "$META" 2>/dev/null || echo '{}' > "$META"
+  PLAN=$(python3 "$HERE/super-board-merge-policy.py" --config "$CONFIG" --meta "$META" --diff "$DIFF") || {
+    say "human approval scope could not be refreshed"; exit 7; }
+  approval_check
+  if [ "$APPROVED" != true ]; then
+    approval_request
+    say "human approval changed during verification; keep the card Blocked"
+    if [ -n "$HUMAN" ]; then exit 7; else exit 8; fi


Author explanation

Purpose
Check that approval is still valid after verification runs.

What changed
Read the current PR details again, recalculate the required human steps, and recheck the reply just before merging.

Why it matters
A new requirement or request can arrive while tests run. The earlier check must not silently cover it. This is a final snapshot; GitHub does not lock comments afterward.

EricTechPro · 2026-10-03T18:38:53Z

Author explanation

Purpose
Guide the reviewer through the final merge decision.

What changed
Require a verified reply to the current request, then rerun the merge checks. Tell the reviewer to link to one request instead of duplicating it.

Why it matters
The reviewer cannot use an old status label to skip the human decision, even when a task has returned to Review.

EricTechPro · 2026-10-03T18:38:55Z

Author explanation

Purpose
Check how task dependencies and human waiting states are reported.

What changed
Change the saved-data checks so a bare done comment or done label must leave approval unconfirmed.

Why it matters
These tests catch the old shortcut returning through the dependency reader. Live approval checking has its own tests.

EricTechPro · 2026-10-03T18:38:57Z

Author explanation

Purpose
Exercise the final merge checks with simulated GitHub responses.

What changed
Cover a valid current reply, stale replies, unreadable permissions, and new requests or human steps appearing while checks run.

Why it matters
The tests check that an invalid approval stops before the merge command, including when the approval becomes outdated during verification.

EricTechPro · 2026-10-03T18:38:59Z

Author explanation

Purpose
Check where the planner sends board tasks.

What changed
Add a case where code changes while its task is Blocked: it must enter the fresh-approval list and stay out of approved resume and ordinary work lists.

Why it matters
This protects the recovery path: asking again must not become permission to build or merge.

EricTechPro · 2026-10-03T18:39:01Z

Author explanation

Purpose
Test the new approval checker without changing a live board or database.

What changed
Cover who may approve, which code and steps were approved, edited or old replies, repeated checks, multiple pages of comments, and planner integration.

Why it matters
The tests check both sides: changed or untrusted answers must be rejected, while a valid answer for unchanged work must continue to count.

qodo-code-review · 2026-10-04T04:08:56Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

🔒 [security] approval: bind human sign-off to reviewed code

ec4a7c2

- Verify trusted request and human reply for the current PR head and steps. - Refresh stale blocked requests without treating them as approved. - Pass 34 offline safety suites and independent review.

EricTechPro mentioned this pull request Oct 3, 2026

🐛 [fix] github: pause runs when required reads fail #24

Merged

6 tasks done

EricTechPro commented Oct 3, 2026

View reviewed changes

EricTechPro marked this pull request as ready for review October 4, 2026 04:08

Merge branch 'main' into codex/approval-freshness

a72a85a

EricTechPro merged commit e8568e6 into main Oct 4, 2026
8 checks passed

Navigation Menu

Repository navigation

🔒 [security] approval: bind human sign-off to reviewed code - #23

🔒 [security] approval: bind human sign-off to reviewed code#23
EricTechPro merged 2 commits into
mainfrom
codex/approval-freshness

EricTechPro commented Oct 3, 2026 •

edited

Loading

Uh oh!

EricTechPro left a comment

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

EricTechPro Oct 3, 2026

Uh oh!

qodo-code-review Bot commented Oct 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

EricTechPro commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

EricTechPro left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qodo-code-review Bot commented Oct 4, 2026

Qodo reviews are paused for this user.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

EricTechPro commented Oct 3, 2026 •

edited

Loading