What area does this improvement affect?
New Feature
What actions does this improvement affect?
Pull Request
Description of the idea or improvement
Implement guarded native PR approvals by the dedicated workflow PAT bot for eligible human-authored same-repository PRs. Require current-head CI and coverage evidence, complete Bugbot reconciliation without blocking findings, effective stale-approval protection, clean human review state, and a final head/rule recheck. A bot-authored PR receives an evidence-backed recommendation instead of self-approval. Provide one bounded PR status card, native review, and distinct observer workflow. Implement the setup and doctor contract in specs/guarded-pull-request-approval.md and specs/guarded-pull-request-approval-setup-and-doctor.md.
Current limitations or challenges
The existing state:ready and Copilot / Review Check indicate readiness for human action but are not a native GitHub approval. CI and Bugbot finish independently, coverage upload may be advisory, current-head evidence can be partial or stale, and the existing workflow has no safe check-completion observer. Setup cannot select exact evidence producers or diagnose branch-rule and bot-identity prerequisites.
Expected impact
Routine eligible PRs gain one explainable approval on the verified head, while pending, partial, unsafe, bot-authored, and ineligible PRs receive a precise next action without bypassing human or code-owner reviews. Fresh setup defaults to a guarded policy; existing installations remain off until explicitly provisioned. Doctor reports read-only readiness. Deliver implementation, tests, workflow contracts, docs, migration, and catalog updates per both SDDs.
Alternatives considered
A simple boolean driven by state:ready or a green generic check is insufficient because it cannot prove coverage, finding completeness, identity, or freshness. The setup PAT must not serve as a second reviewer. A privileged PR-head checkout is excluded.
Version of copilot
3.3.1
Additional context or comments
The two prospective SDDs are already drafted locally; this issue is the single feature workflow for implementation. No merge, deployment, or release action is requested.
What area does this improvement affect?
New Feature
What actions does this improvement affect?
Pull Request
Description of the idea or improvement
Implement guarded native PR approvals by the dedicated workflow PAT bot for eligible human-authored same-repository PRs. Require current-head CI and coverage evidence, complete Bugbot reconciliation without blocking findings, effective stale-approval protection, clean human review state, and a final head/rule recheck. A bot-authored PR receives an evidence-backed recommendation instead of self-approval. Provide one bounded PR status card, native review, and distinct observer workflow. Implement the setup and doctor contract in specs/guarded-pull-request-approval.md and specs/guarded-pull-request-approval-setup-and-doctor.md.
Current limitations or challenges
The existing state:ready and Copilot / Review Check indicate readiness for human action but are not a native GitHub approval. CI and Bugbot finish independently, coverage upload may be advisory, current-head evidence can be partial or stale, and the existing workflow has no safe check-completion observer. Setup cannot select exact evidence producers or diagnose branch-rule and bot-identity prerequisites.
Expected impact
Routine eligible PRs gain one explainable approval on the verified head, while pending, partial, unsafe, bot-authored, and ineligible PRs receive a precise next action without bypassing human or code-owner reviews. Fresh setup defaults to a guarded policy; existing installations remain off until explicitly provisioned. Doctor reports read-only readiness. Deliver implementation, tests, workflow contracts, docs, migration, and catalog updates per both SDDs.
Alternatives considered
A simple boolean driven by state:ready or a green generic check is insufficient because it cannot prove coverage, finding completeness, identity, or freshness. The setup PAT must not serve as a second reviewer. A privileged PR-head checkout is excluded.
Version of copilot
3.3.1
Additional context or comments
The two prospective SDDs are already drafted locally; this issue is the single feature workflow for implementation. No merge, deployment, or release action is requested.