From f9f2adb0aae084140d98f4754335b0c02ecda535 Mon Sep 17 00:00:00 2001 From: Renn F Date: Tue, 16 Jun 2026 09:41:44 +0200 Subject: [PATCH] feat(config): add dormant external-PR review settings (default-off) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the configuration contract for inbound external-PR review, mirroring the strategy-engine block: external_pr_enabled (master switch, off), external_pr_poll_interval_seconds (>=60), external_pr_author_allowlist, and external_pr_require_human_confirm (default true). All inert by default — no inbound GitHub call and no untrusted-code execution until the CEO opts in and a human confirms an ingested PR. --- roboco/config.py | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/roboco/config.py b/roboco/config.py index 49d8df22..a8201db6 100644 --- a/roboco/config.py +++ b/roboco/config.py @@ -307,6 +307,41 @@ class Settings(BaseSettings): ), ) + # ========================================================================== + # External-PR review ("engine 3") — DORMANT by default + # ========================================================================== + # An inbound path: a background loop that lists open PRs per active project, + # flags ones from external/fork authors, and creates a one-shot review task + # for the dedicated reviewer agent. Default OFF — the loop never starts and + # no inbound GitHub call is made until the CEO opts in. Untrusted contributor + # code is never fetched or executed until ``confirmed_by_human`` is set. + external_pr_enabled: bool = Field( + default=False, + description=( + "Master switch for inbound external-PR review. OFF by default; " + "when off the poll loop does not run at all." + ), + ) + external_pr_poll_interval_seconds: int = Field( + default=300, + ge=60, + description="Seconds between inbound external-PR discovery passes.", + ) + external_pr_author_allowlist: list[str] = Field( + default_factory=list, + description=( + "GitHub usernames trusted as known contributors. Empty means no " + "author is auto-trusted; every external PR needs human confirmation." + ), + ) + external_pr_require_human_confirm: bool = Field( + default=True, + description=( + "Require an explicit human confirmation before any agent fetches, " + "checks out, or executes external contributor code." + ), + ) + # ========================================================================== # Workspaces (Multi-Agent Git) # ==========================================================================