# AI Agent PR CI Firewall Checklist

**Brand:** OperatorForge AI  
**Updated:** 2026-06-14  
**Format:** free checklist + CI policy template + evidence packet  
**Use when:** a founder, engineering lead, agency, or AI-automation consultant lets Claude Code, Codex, Cursor, Copilot, OpenCode, Devin-style agents, or background coding agents open pull requests or push code toward main.

## Why this matters now

The 2026-06-14 scan found a fresh cluster around **AI-generated PRs needing deterministic gates instead of trust-by-summary**:

- Hacker News surfaced **"Show HN: Agent Gate - a deterministic CI firewall for AI-generated PRs"** on 2026-06-14.
- HN also surfaced **"Superpowers for Claude, Codex etc."**, **"Hi HN: Loopy agent"**, **"Double your Codex / Claude Code productivity and output"**, and discussion about coding agents running continuously.
- GitHub search found fresh repositories for agent security monitoring, MCP threat scanners, Claude Code heartbeat/autonomy hooks, AGENTS.md prompt-injection resistance, and portable CLI-agent security harnesses.
- Reddit JSON checks for r/n8n, r/ClaudeAI, and r/LocalLLaMA returned HTTP 403 in this cron profile, so public HN/GitHub sources drove selection.

The monetizable gap: teams are adopting autonomous coding agents faster than they are adding a hard PR firewall. A convincing agent summary is not a control. The buyer wants a deterministic, auditable CI gate that blocks risky PRs before merge.

## The 15-minute PR firewall rule

Every AI-authored pull request must pass a deterministic gate that is independent of the agent that wrote the code.

| PR surface | Failure mode | Required gate | Evidence to keep |
|---|---|---|---|
| Generated code diff | hidden auth/payment/permission changes | sensitive-path review required | touched-path report |
| Tests | agent skipped or weakened tests | targeted + baseline tests required | command output with run ID |
| Dependencies | slopsquatted or unnecessary packages | dependency diff review | package/version/rationale |
| Secrets | env/log/token exposure | secret scan + redaction check | scanner output |
| Instructions | AGENTS.md / workflow rule drift | instruction-file diff gate | reviewer approval |
| Deployment | agent tries to ship directly | no auto-deploy from agent PR | release owner signoff |

## AI Agent PR CI Firewall Checklist

### 1. Label agent-authored work

- [ ] Require agent PRs to include an `ai-authored` or `agent-assisted` label.
- [ ] Require a run ID, agent/tool name, model/provider if known, and human owner.
- [ ] Require a short scope statement: what the agent was allowed to change.
- [ ] Reject PRs with vague summaries such as "misc fixes" or "cleanup" when generated by an agent.

### 2. Gate sensitive paths

- [ ] Require human approval if the diff touches auth, authorization, billing, payments, refunds, email delivery, production deploy, database migrations, secrets, logging, telemetry, CI/CD, prompts, AGENTS.md, CLAUDE.md, Cursor rules, MCP config, or workflow automation files.
- [ ] Block merge when a sensitive path is touched without a named reviewer.
- [ ] Require a rollback note for any production-risk file.
- [ ] Require a before/after diff summary tied to the original issue or requirement.

### 3. Prove tests were not skipped or weakened

- [ ] Capture targeted failing evidence before the fix when possible.
- [ ] Capture targeted passing evidence after the fix.
- [ ] Run the project baseline test/lint/typecheck command.
- [ ] Fail the PR if tests were deleted, weakened, renamed away from CI, or marked as skipped without human explanation.

### 4. Scan dependencies and commands

- [ ] Review package-lock, pnpm-lock, uv.lock, requirements, Dockerfile, shell scripts, GitHub Actions, and CI config changes.
- [ ] Require rationale for each new dependency.
- [ ] Block curl-to-shell, postinstall scripts, broad permission grants, unknown binary downloads, and network calls in tests unless explicitly approved.
- [ ] Run a secret scan before merge.

### 5. Enforce evidence packet before merge

- [ ] PR includes run ID and owner.
- [ ] PR includes allowed scope and actual touched files.
- [ ] PR includes test commands and outputs.
- [ ] PR includes sensitive-path result.
- [ ] PR includes dependency diff result.
- [ ] PR includes rollback note or "not production-risk" rationale.
- [ ] Human reviewer checks the evidence; the agent cannot self-approve.

## Minimal GitHub Actions policy sketch

```yaml
name: ai-pr-firewall
on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled]
jobs:
  firewall:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Require agent label evidence
        run: |
          echo "Check labels, run ID, owner, scope, and evidence packet here."
      - name: Sensitive path gate
        run: |
          git diff --name-only origin/main...HEAD > changed-files.txt
          grep -E '(^|/)(auth|billing|payments|migrations|\.github|AGENTS.md|CLAUDE.md|mcp|secrets|deploy)' changed-files.txt &&             echo "Sensitive path touched: require human review" && exit 1 || true
      - name: Run baseline checks
        run: |
          echo "Replace with npm test, uv run pytest, go test, etc."
```

## PR evidence packet template

```text
Run ID:
Agent/tool/model:
Human owner:
Original requirement / ticket:
Allowed scope:
Touched files:
Sensitive paths touched: yes / no
Reviewer required:
Dependency changes:
Secret scan result:
Targeted failing evidence:
Targeted passing evidence:
Baseline CI commands:
Tests deleted/skipped/modified:
Rollback note:
Ready-to-merge owner signoff:
```

## Consultant packaging angle

Sell this as a fast engineering-control product for teams adopting coding agents:

- **$250-$500 AI PR firewall audit:** inspect one repo, map sensitive paths, and define the minimum agent PR evidence packet.
- **$750-$1,500 CI firewall implementation sprint:** add labels, path gates, test-evidence rules, dependency review, and secret scanning to GitHub Actions/GitLab CI.
- **$2,000-$4,000 agentic engineering control pack:** combine PR firewalling with local firewalls, sandbox threat models, secret boundaries, observability, rollback ledgers, instruction governance, and cost controls.

## OperatorForge AI upsell

This checklist pairs with the OperatorForge AI Pro Pack bonuses for bug-report injection triage, secret-leak controls, sandboxing, local firewalls, MCP security, authorization boundaries, observability, rollback, verification, instruction governance, skill security, and coding-agent spend controls.