Automation

Companion to GitHub tokens for agent fleets and the agent production system series. A lot of people hear “receipt-gated landing” and “GitHub App bot” as one package. They are not. Human mode is the default — and it is enough to stop agents from treating “please review before merge” as optional prose. The instruction that kept not working Every agent setup eventually writes some version of: Before merging, run the review step. ...

Most agent demos treat GitHub as “paste a PAT in the env and hope.” That works until the token shows up in a transcript, the rate limit collides with the work you are doing by hand, or the bot opens a PR and GitHub refuses to let it approve its own change. I use two identities on purpose: you for creating the PR, a short-lived App token for approve/merge after the gates. Agents call a broker. They do not each own a secret. ...