REQ 097

REQ-097: Verify the approval before any side effect

Requirement

After approval and before any side effect, the executor shall confirm from the run's review history that an eligible reviewer other than the requester approved this environment for this run, on the first run attempt, within the request's expiry, and with the target precondition unchanged.

Rationale

GitHub creates a referenced environment that does not exist with no protection rules, so an unconfigured fork would otherwise act unreviewed. GitHub Docs do not state whether re-running an approved job needs a fresh approval, and a target can change while a request waits for up to 30 days. Requests expire 72 hours after submission (decision D4 in VITechnologies/projectbuddy#177).

Fit Criterion

No write happens when the environment was missing, a bypass left no approval record, the requester approved, the review history is unreadable, run_attempt exceeds 1, the request is older than its expiry, or the target drifted, for example a changed base SHA or a changed issue-body lastEditedAt.

Verification

Planned, TEST-099; not yet performed live. An offline refusal matrix covers every reason in verify.REASONS, including an unprotected environment, self-approval, unreadable history, a re-run, expiry, and drift; the no-op executor runs exactly once only for a valid approval. Live verification waits for Phase 3 of VITechnologies/projectbuddy#179.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-099

TestArtifact

scripts/tests/test_approval_gate_checks.py refusal matrix and scripts/tests/test_approval_gate_cli.py execute cases

CodeRef

scripts/approval_gate/verify.py, scripts/approval_gate/executors.py, scripts/approval_gate/checks.py, .github/workflows/approval-gate.yml gated job

Status

Planned; offline fixture tests pass, no live proof yet