Gate Studio GitHub PR writes behind explicit spec approval

[Copilot]

Canonical issue

Canonical issue is linked in PR metadata.

Outcome

Studio can now create/update GitHub PRs through the real write path, but only for specs explicitly approved in the UI. Unapproved specs are hard-excluded from write operations.

Scope

• Included:
  • Server action gate (app/studio/actions.ts)
    • Adds openGitHubPrsForApprovedSpecs(...) ('use server').
    • Fails closed when:
      • no approved specs are selected
      • GitHub integration config is missing (GITHUB_TOKEN, GITHUB_REPOSITORY).
  • GitHub write client (lib/github-pr-client.ts)
    • Adds createOrUpdatePullRequest(...):
      • list open PR by head + base
      • PATCH existing PR when found, else POST create.
    • Adds createOrUpdatePullRequestsForApprovedSpecs(...) with explicit approved filtering.
  • Studio UI gate (components/OneLoopStudio.tsx)
    • Adds per-SOP-step Approved for PR toggle.
    • Adds footer action studio-open-prs-button.
    • Button remains disabled until at least one spec is approved.
  • Focused tests
    • lib/__tests__/github-pr-client.test.ts
    • app/studio/__tests__/actions.test.ts
• Explicitly excluded:
  • Backend pipeline/transcript extraction logic
  • Billing/pro entitlements behavior
  • Any write path for non-approved specs

const approvedSpecs = specs.filter((spec) => spec.approved);
if (approvedSpecs.length === 0) {
  return { ok: false, error: 'Approve at least one spec before opening GitHub pull requests.', pullRequests: [] };
}

Risk

• Risk level: medium
• Failure mode:
  • Misconfigured GitHub env prevents PR writes (fails closed).
  • API failure on list/create/update surfaces as action error; no silent success.
• Rollback:
  • Revert github-pr-client.ts, app/studio/actions.ts, and Studio UI wiring in OneLoopStudio.tsx.

Verification

Head SHA: current branch tip of copilot/open-github-prs-for-approved-specs.

• Focused tests:
  • npm run test --prefix apps/web -- src/lib/__tests__/github-pr-client.test.ts src/app/studio/__tests__/actions.test.ts
  • npm run test --prefix apps/web -- src/lib/__tests__/studio-pipeline-status.test.ts src/lib/__tests__/uvai-surface-unification.test.ts src/lib/__tests__/action-tools.test.ts
• Focused tests
• Required CI
• Review threads resolved

Production evidence

Vercel preview exists for this branch. Production evidence is not applicable here: this change adds UI/server-action gating and GitHub write-path behavior, not a production runtime/data-plane migration.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Open GitHub PRs for approved specs via real integration write path #1637

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:54pm UTC

[vercel]

The openGitHubPrsForApprovedSpecs server action performs privileged GitHub writes with the server's GITHUB_TOKEN but has no authentication/authorization check, so any anonymous visitor to the public /studio page can invoke it.