feat(github): add Review Provider and CI evidence loop

README.en.md

@@ -97,6 +97,12 @@ Schema v123 `git-advanced.v1` is a default-off Go-owned control plane for conten
 
 The protocol accepts no raw argv, shell, host path, arbitrary ref/pathspec, or bisect command. Git runs with hooks, credential helpers, external diff, executable filter/merge drivers, and interactive entry points disabled. Protected branches, shared-upstream rebase, detached history mutation, force push, reset-hard, clean-force, and dirty/external-worktree deletion cannot be expressed. Restart observes and terminalizes a `running` operation without replay; a provably exact worktree created before registry persistence may be conservatively registered, but the old operation remains `interrupted`. Desktop, `cyberagent git-advanced`, and authenticated OpenAPI use the same Application service. See [Advanced Git Workflows](docs/git-advanced.md) and [ADR 0122](docs/adr/0122-go-owned-advanced-git-lifecycle.md).
 
+### GitHub App review integration
+
+Schema v124 `github-review-provider.v1` persists immutable, sanitized, untrusted snapshots of PR metadata, complete bounded changed-file pagination, reviews/threads/comments, checks/jobs, failed-log excerpts, and Artifact metadata. It binds them to the exact local merge-base/HEAD, complete diff, stable hunks, file hashes, conflicts, and optional LSP facts as `verified`, `partial`, `stale`, `unavailable`, or `not_run`. Code/root models receive only Run-bound local `github_review_evidence_list/read`; they cannot fetch or write GitHub.
+
+The preferred authentication is a Device-Flow-enabled GitHub App. Device codes remain in memory and access/refresh tokens live only in the OS credential store. Connections are read-only by default; reply, resolve/unresolve, submit-review, and request-reviewer operations additionally require an explicit connection write-back gate, exact preview, and one-time Approval, then recheck Code/Deliver, network permission, installation/SSO, capability generation, and PR/base/head/merge-base identity. OAuth/PAT remains a read-only migration path in v1 and cannot expand into write-back. Startup recovery only observes idempotency markers and never guesses or replays a mutation. API/Desktop require explicit `--enable-github-review`. See [GitHub Review Provider](docs/github-review.md) and [ADR 0123](docs/adr/0123-go-owned-github-review-provider.md).
+
 ### Deliverable children and isolated merge
 
 Schema v118 `batch-delivery.v1` materializes an already approved and admitted core-child DAG into at most two independent Git worktrees and branches. Each child receives a closed tool profile bound to its Agent, generation, expiry, and one-time owner token: list/read/glob/grep within owned scope, reviewed change/apply, and fixed status/diff/commit. Delete/rename, Shell, arbitrary process execution, network, credentials, Debug, approvals, and child spawning remain false. The existing Specialist runtime remains no-tool and is not implicitly widened by this protocol.

README.md

@@ -61,7 +61,7 @@ CLI / TUI / React / Windows Desktop / CI
 | 模型与上下文 | Mock、Anthropic-compatible、OpenAI-compatible 与 loopback-only Ollama Provider、模型路由、资格校验、能力探测、流式响应、上下文压缩、层级项目指令、显式 user/project 长期记忆与 Session 恢复树 |
 | 计划与协作 | Plan/Delivery、工作项、备注、最多两个核心 child、`batch-delivery.v1` 独立 Worktree/分支/邮箱/交付复核/顺序合并，以及 1/2/4/6 档只读 Fan-out |
 | 工具与权限 | Tool Gateway、JSON Schema 校验、Policy、Scope、人工审批、四档宿主权限、受控固定命令、普通模式 Run-owned 命令运行时、逐条审批 PowerShell/Git Bash，以及限时 Debug 终端输入 |
-| 代码工作流 | 系统目录选择与 Workspace 导入、工作区浏览、仓库状态、提交历史、Diff 审阅、文件编辑提案、只读 `code-intel-lsp.v1` 语义工具、事务化 Workspace Checkpoint、稳定 hunk、stash/rebase/cherry-pick/bisect、受管 worktree、Undo/Redo/Rewind、独立 Fork、验证计划、Code Journey 与 Handoff |
+| 代码工作流 | 系统目录选择与 Workspace 导入、工作区浏览、仓库状态、提交历史、Diff 审阅、文件编辑提案、只读 `code-intel-lsp.v1` 语义工具、事务化 Workspace Checkpoint、稳定 hunk、stash/rebase/cherry-pick/bisect、受管 worktree、GitHub App PR/CI 证据与审批回写、Undo/Redo/Rewind、独立 Fork、验证计划、Code Journey 与 Handoff |
 | 可观测性 | 追加式 Run 事件、Live Activity、公开模型进度、Harness 事实、Artifact、Finding/Evidence/Report、SARIF、持久化有界计划任务与脱敏结构化诊断包 |
 | 扩展 | 模式感知的惰性 Skill 包、生成候选人工审查、两阶段 MCP Client、签名 `plugin.v1`、受限生命周期 Hooks、Provider/Tool 接口、Go/Rust JSON 协议、内嵌 WASI Analyzer、Sandbox 合同与默认关闭的 network-none Docker 产品执行 |
 | 客户端 | `cyberagent` CLI、Bubble Tea TUI、认证 HTTP/OpenAPI、React/Vite、Windows/macOS Desktop 便携预览 |
@@ -72,7 +72,7 @@ Schema v115 引入 `agent-code-tools.v1`，让 root Supervisor 能在真实 Work
 
 | 模式 | 可用工具 |
 |---|---|
-| Code / Plan / root | `workspace_list`、`workspace_read`、`workspace_glob`、`workspace_grep` |
+| Code / Plan / root | `workspace_list`、`workspace_read`、`workspace_glob`、`workspace_grep`；存在当前 Run 的 GitHub 证据时还可用 `github_review_evidence_list/read` |
 | Code / Deliver / root（Code 或 Script Profile） | 上述只读工具，加 `workspace_change`、`workspace_apply`、`workspace_delete` |
 | Code / Deliver / root（Review 或 Learn Profile） | 仅上述只读工具 |
 | Cyber Surface 或 Specialist | 不公开任何 `agent-code-tools.v1` 工具，并在 capability 快照中说明拒绝原因 |
@@ -97,6 +97,12 @@ Schema v123 的 `git-advanced.v1` 以默认关闭的 Go-owned 控制面提供稳
 
 高级 Git 不接受 raw argv、Shell、host path、任意 ref/pathspec 或 bisect 命令；Git 运行时关闭 hook、credential helper、外部 diff、filter/merge driver 和交互入口。保护分支、配置 upstream 的共享 rebase、detached 历史改写、force push、reset-hard、clean-force、脏/外部 worktree 删除都不能表达。重启只观察并终结 `running` 操作，不重放；已精确创建但尚未登记的 worktree 可在全量身份匹配后保守纳入注册表，但原操作仍标记 `interrupted`。Desktop、`cyberagent git-advanced` 与认证 OpenAPI 共用同一 Application 服务；完整命令、限制和恢复流程见[高级 Git 工作流](docs/git-advanced.md)，设计见 [ADR 0122](docs/adr/0122-go-owned-advanced-git-lifecycle.md)。
 
+### GitHub App 审阅集成
+
+Schema v124 的 `github-review-provider.v1` 把 GitHub PR 元数据、完整有界 changed-file 分页、reviews/threads/comments、checks/jobs、失败日志摘录和 Artifact 元数据保存为不可变、已清洗的不可信快照，再与本地精确 merge-base/HEAD、完整 diff、稳定 hunk、文件哈希、冲突及可选 LSP 证据组成 `verified/partial/stale/unavailable/not_run` 证据图。Code/root 模型只获得绑定当前 Run 的本地只读 `github_review_evidence_list/read`；它不能自行联网或回写。
+
+产品优先使用开启 Device Flow 的 GitHub App，device code 仅驻留内存，access/refresh token 只进入操作系统凭据库。连接默认只读；Reply、Resolve/Unresolve、Submit Review 与 Request Reviewer 还需显式连接级写回开关、精确预览和一次性 Approval，执行前重查 Code/Deliver、网络权限、App installation/SSO、能力 generation 与 PR/base/head/merge-base。OAuth/PAT 在 v1 只作为无法扩大到写回的只读迁移路径；重启恢复只观察幂等 marker，绝不猜测重放。API/Desktop 必须显式启用 `--enable-github-review`。配置、最小权限、CLI/OpenAPI、真实联调和 GitHub Developer Program 申请门见 [GitHub Review Provider](docs/github-review.md)，设计见 [ADR 0123](docs/adr/0123-go-owned-github-review-provider.md)。
+
 ### 可交付 child 与隔离合并
 
 Schema v118 的 `batch-delivery.v1` 将一个已经审批并 admission 的核心 child DAG 物化为最多两个独立 Git worktree/branch。每个 child 只获得绑定 Agent、generation、过期时间与一次性 owner token 的关闭工具集：owned Scope 内的 list/read/glob/grep、人工提案式 change/apply，以及固定 status/diff/commit；delete/rename、Shell、任意 process、network、credential、Debug、审批和继续派生 child 始终为 false。旧 Specialist 运行时仍保持 no-tool；它不会因为存在此协议而隐式扩权。
@@ -506,6 +512,7 @@ Get-AuthenticodeSignature .\PrayuDesktop.msix | Format-List Status, StatusMessag
 | v121 | 增加签名 plugin.v1 安装、publisher 信任/撤销、回滚与受限 Hook 审计 | add signed plugin.v1 installs, publisher trust/revocation, rollback, and restricted-Hook audits |
 | v122 | 增加 scheduled-job.v1、单实例租约/fencing、轮次与通知账本 | add scheduled-job.v1, singleton lease/fencing, round, and notification ledgers |
 | v123 | 增加 git-advanced.v1 操作/序列审计与产品受管 worktree 注册表 | add git-advanced.v1 operation/sequence audits and the product-managed worktree registry |
+| v124 | 增加 GitHub connection、PR/CI 快照、本地证据图及审批回写/恢复账本 | add GitHub connections, PR/CI snapshots, local evidence graphs, and approved write/recovery ledgers |
 
 </details>
 

cmd/cyberagent-desktop/main.go

@@ -72,6 +72,7 @@ type desktopOptions struct {
 	dockerExecution        bool
 	codeIntelConfig        string
 	gitAdvanced            bool
+	githubReview           bool
 	gitWorktreeRoot        string
 	version                bool
 }
@@ -295,6 +296,8 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		"absolute operator-reviewed code-intel config")
 	gitAdvanced := fs.Bool("enable-git-advanced", false,
 		"enable approval-gated git-advanced.v1 mutations")
+	githubReview := fs.Bool("enable-github-review", false,
+		"enable GitHub App review evidence and approval-gated write-back")
 	gitWorktreeRoot := fs.String("git-worktree-root", "",
 		"product-managed Git worktree root; defaults below CYBERAGENT_HOME")
 	version := fs.Bool("version", false, "print version and exit")
@@ -332,6 +335,7 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		*embeddedAnalyzer = true
 		*batchDeliveryControl = true
 		*gitAdvanced = true
+		*githubReview = true
 	}
 	capabilities := domain.ExecutionPermissionRuntimeCapabilities{
 		OperatorApprovalEnabled:   *permissionControl,
@@ -357,9 +361,13 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		return desktopOptions{}, errors.New(
 			"Git advanced control requires --enable-permission-control")
 	}
-	if strings.TrimSpace(*gitWorktreeRoot) != "" && !*gitAdvanced {
+	if *githubReview && !*permissionControl {
 		return desktopOptions{}, errors.New(
-			"--git-worktree-root requires --enable-git-advanced")
+			"GitHub review control requires --enable-permission-control")
+	}
+	if strings.TrimSpace(*gitWorktreeRoot) != "" && !*gitAdvanced && !*githubReview {
+		return desktopOptions{}, errors.New(
+			"--git-worktree-root requires --enable-git-advanced or --enable-github-review")
 	}
 	if *batchValidation && (!*batchDeliveryControl || !*permissionControl || !*dangerFullAccess) {
 		return desktopOptions{}, errors.New(
@@ -412,6 +420,7 @@ func parseDesktopOptions(args []string) (desktopOptions, error) {
 		dockerExecution:        *dockerExecution,
 		codeIntelConfig:        strings.TrimSpace(*codeIntelConfig),
 		gitAdvanced:            *gitAdvanced,
+		githubReview:           *githubReview,
 		gitWorktreeRoot:        strings.TrimSpace(*gitWorktreeRoot),
 		version:                *version}, nil
 }
@@ -443,7 +452,7 @@ func runDesktop(config desktopOptions) error {
 		config.skillInstallation || config.evidenceAttachment ||
 		config.verificationEvidence || config.embeddedAnalyzer || config.userTerminal ||
 		config.dockerExecution || config.batchDeliveryControl || config.batchValidation ||
-		config.uiEvidence || config.gitAdvanced {
+		config.uiEvidence || config.gitAdvanced || config.githubReview {
 		controlToken, err = httpapi.GenerateAccessToken()
 		if err != nil {
 			return err
@@ -496,12 +505,13 @@ func runDesktop(config desktopOptions) error {
 			SafeWebStartEnabled: true, DisposableProfileEnabled: true,
 			NetworkContainmentEnabled: true, RestrictedCDPEnabled: true,
 		},
-		UserTerminalEnabled:       config.userTerminal,
-		DockerExecutionEnabled:    config.dockerExecution,
-		CodeIntelConfigPath:       config.codeIntelConfig,
-		GitAdvancedControlEnabled: config.gitAdvanced,
-		GitManagedWorktreeRoot:    config.gitWorktreeRoot,
-		AppVersion:                app.Version, UIHandler: bundle,
+		UserTerminalEnabled:        config.userTerminal,
+		DockerExecutionEnabled:     config.dockerExecution,
+		CodeIntelConfigPath:        config.codeIntelConfig,
+		GitAdvancedControlEnabled:  config.gitAdvanced,
+		GitHubReviewControlEnabled: config.githubReview,
+		GitManagedWorktreeRoot:     config.gitWorktreeRoot,
+		AppVersion:                 app.Version, UIHandler: bundle,
 		OnWakeWorkerError: func(runErr error) {
 			fmt.Fprintln(os.Stderr, "wake-worker:", runErr)
 		},
@@ -569,6 +579,7 @@ func runDesktop(config desktopOptions) error {
 		DockerExecutionEnabled:                  dockerExecutionEnabled,
 		CodeIntelEnabled:                        controlPlane.CodeIntelEnabled(),
 		GitAdvancedControlEnabled:               config.gitAdvanced,
+		GitHubReviewControlEnabled:              config.githubReview,
 		AppVersion:                              app.Version, UIDigest: bundle.Digest(), Selector: selector,
 		PreviewBridge: preview, SkillInstaller: controlPlane.SkillInstaller(),
 		WorkspaceResolver: controlPlane, WorkspaceLauncher: newNativeWorkspaceLauncher(),

docs/PROGRESS_BOOK.md

@@ -6,6 +6,28 @@
 
 ## 一、当前阶段
 
+2026-08-21 单切片 `GitHub Review Provider、CI 证据与修复闭环（Issue #118）` 推进到 SQLite
+v124。`github-review-provider.v1` 首选 GitHub App Device Flow，token 仅驻 OS credential store；
+qualification 逐页确认 App installation 中的 exact repository 与 permissions，并固定 GitHub API
+版本、host、SSO/rate-limit/network diagnostics。PR/files/reviews/threads/comments/checks/jobs/失败
+日志/Artifact metadata 经严格界限和清洗后持久化，再与本地 merge-base/HEAD、diff、hunk、
+worktree/conflict 及可选 LSP 组成 Run/Workspace 隔离 evidence graph。Code/root 模型仅获得本地
+只读 evidence list/read。
+
+远端 reply、resolve/unresolve、COMMENT/APPROVE/REQUEST_CHANGES 和 reviewer request 均使用 exact
+preview、一次性 Approval、Code/Deliver 网络权限与 capability/PR identity 再验证；启动恢复只
+观察 idempotency marker/state，不重放 mutation。CLI、OpenAPI、Desktop Repository 面板、
+`review@1.5.0` 与 `focused-checks@1.2.0` 已接同一服务；操作、权限、真实 smoke 与 GitHub
+Developer Program/Marketplace 区分见 `docs/github-review.md` 和 ADR 0123。
+
+最终拆分门已通过：Store/Application/HTTP/CLI App 全量分别为 994.677/565.790/188.155/
+128.640 秒；GitHub Review、migration/ledger/race、Desktop-tag、vet 与 module verify 通过；Web
+66 files/289 tests、typecheck、production build 和 production npm audit 通过。OpenAPI/TypeScript
+确定性结果为 155 paths / 172 operations / 469 schemas，hash 为
+`d876d249996d3f296a12fd768eb9ed5fb9c253a781131455c9eed82f0545cf20` /
+`313de1b90dd4c586d8b3711442f9dc1b3cf5be6047911b417d310c2374b83ca2`。专用测试 GitHub App
+与一次性仓库的真实外部 smoke 尚未执行，保持为发布门，不用 mock/fixture 结果替代。
+
 2026-08-20—21 单切片 `高级 Git 恢复与受管 Worktree（Issue #117）` 推进到 SQLite v123。
 `git-advanced.v1` 以严格字段 union 和 Go-owned command templates 覆盖稳定 hunk、stash、
 rebase/cherry-pick/bisect sequence 与受管 worktree；raw argv/Shell/host path/任意 ref 或 recipe

docs/PROJECT_MEMORY.md

@@ -2,9 +2,27 @@
 
 > Scope checkpoint (2026-08-13): continue only the general-purpose Agent Harness and Code workflow. CTF-specific solving/offensive automation is an optional add-on with no active slices; retain generic extension seams only. Historical Cyber percentages are not current planning metrics. See [PRODUCT_SCOPE.md](PRODUCT_SCOPE.md).
 
-Last updated: 2026-08-20
-
-## Current Single-Slice Checkpoint: Advanced Git Recovery and Managed Worktrees / Issue #117
+Last updated: 2026-08-21
+
+## Current Single-Slice Checkpoint: GitHub Review Provider / Issue #118
+
+2026-08-21 的 issue #118 推进到 `github-review-provider.v1`（ADR 0123，schema v124）。
+GitHub App Device Flow 是首选生产路径：公开 client ID 可持久化，device code 仅在进程内，
+access/refresh token 只进入 OS credential store。qualification 精确验证 account、App
+installation 内的目标 repository、细粒度权限、SSO、rate limit、固定 API 版本与网络范围；
+REST/GraphQL 只连接 `github.com`/`api.github.com`，Actions 日志跳转还需逐 host allowlist。
+
+PR metadata、完整有界 changed files、reviews、threads/comments、checks、jobs、失败日志摘录与
+Artifact metadata 以不可变、已清洗、不可信快照保存，再绑定本地 exact merge-base/HEAD、完整
+diff、stable hunk、index/worktree/status/file hashes、冲突与可选 LSP 证据。相同内容的 evidence
+仍按 Run/Workspace 单独登记，避免跨 Run authority 混淆；Code/root 模型只可读取当前 Run 已落库
+的 evidence，不能自行联网。reply、resolve/unresolve、submit review、request reviewer 各自需要
+精确 preview、一次性 Approval、当前 Code/Deliver 网络权限与执行前 capability/PR drift 复核；
+重启恢复只观察 marker/state，绝不重放不确定写入。CLI、认证 OpenAPI、Desktop Repository 面板
+与 Skill `review@1.5.0` / `focused-checks@1.2.0` 共用该 Application 服务。操作边界见
+`docs/github-review.md`，不得在后续压缩中把 GitHub token、通用 HTTP 或远端 mutation 暴露给模型。
+
+## Previous Single-Slice Checkpoint: Advanced Git Recovery and Managed Worktrees / Issue #117
 
 2026-08-20 的 issue #117 落地 `git-advanced.v1`（ADR 0122，schema v123）。严格 union 只允许
 hunk stage/unstage/revert、stash、rebase/cherry-pick/bisect 和受管 worktree 的 Go-owned