Follow a change to saved views
1
Establish the exact candidate
Import the candidate’s committed manifest through authenticated discovery. Retain head/base commits, inventory digest and the exact saved workflow definitions. A stale head, missing manifest or unresolved catalog reference is a visible gap.
2
Prepare and inspect a plan
An authorized sampling-capable MCP host can call
plan_pr_suites with repository, PR number and full candidate SHA. Trusted deployment policy defines smoke, dependencies and fallback. PR text and model output are evidence/proposals, never policy or executable commands.plan_and_save_pr_suites explicitly asks the server to recollect current inputs and persist a matching immutable plan. Saving does not authorize CI. Missing sampling or rejected output retains conservative fallback. Required smoke and dependency selections cannot be removed by the model.3
Establish independent execution authority
The CI bridge requires a trusted adapter, current plan/input/catalog identity, a verified environment and independent authorization. A generic new installation has no default CI adapter. Do not copy a pilot’s identity or approval to bypass this boundary.
4
Read the result and its limits
Open the relevant PR run (
/pr-runs/:id). Review selection reasons, smoke/fallback, catalog gaps, exact definitions, immutable identities, CI attempts and artifact links. Compare current projected validity with historical runner-reported status. Missing evidence is not a pass.What is supported today?
The merged code provides candidate discovery, bounded planning, immutable plan storage, CI delivery/receipt contracts and a consolidated suite report. A fixed, narrowly scoped Records pilot adapter supports independently approved dispatch and authenticated artifact collection. Three pilot tests have passed unattended on a real verified preview with normal authentication, a real API, isolated records and cleanup. That result proves those tests under those conditions. Generic automatic label → plan → CI → report operation is not established. Signed broker webhook ingress is implemented with a bounded installation-to-tenant service-binding route; operators must still configure and verify actual delivery. Provider App setup and successful manual CI do not prove that unattended webhook orchestration works. Plans retainexecutionEvidence: not_run, canSkip: false and canAutoMerge: false. The pilot runs its entire three-suite inventory while observing the selected proposal. A label or authorized comment can trigger the existing configured replay/advisory gate; it is not a general suite-dispatch switch.