feat: PR change gating — pre-incident PR risk review (DEV-1252)

.env.example

@@ -244,6 +244,8 @@ GITHUB_APP_WEBHOOK_URL=
 GITHUB_APP_SETUP_URL=
 # Fallback used when the value is not stored in Vault.
 GITHUB_APP_WEBHOOK_SECRET=
+# Log PR change-gating reviews instead of posting to GitHub (calibration mode)
+CHANGE_GATING_DRY_RUN=false
 
 # GitHub OAuth (only required when GITHUB_AUTH_MODE=oauth or =hybrid).
 # Create at https://github.com/settings/developers > New OAuth App.

.github/workflows/linters.yml

@@ -38,7 +38,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install test dependencies
-        run: pip install pytest==9.0.3 Flask==3.1.3 psycopg2-binary==2.9.12 python-dotenv==1.2.2 pyyaml==6.0.1 pydantic==2.13.3 langchain-core==1.2.31
+        run: pip install pytest==9.0.3 Flask==3.1.3 psycopg2-binary==2.9.12 python-dotenv==1.2.2 pyyaml==6.0.1 pydantic==2.13.3 langchain-core==1.2.31 PyJWT==2.13.0
 
       - name: Run all tests
         working-directory: server

client/src/components/github-provider-integration.tsx

@@ -11,6 +11,7 @@
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
 import { Alert, AlertTitle, AlertDescription } from "@/components/ui/alert";
 import {
   AlertDialog,
@@ -76,6 +77,9 @@
   metadata_status: string;
   repo_data: Repository | null;
   created_at: string | null;
+  // PR change gating (incident prevention) — only settable on App-linked repos.
+  change_gating_enabled?: boolean;
+  installation_id?: number | null;
 }
 
 export interface GitHubAuthConfig {
@@ -188,6 +192,18 @@
     if (!response.ok) throw new Error('Failed to update metadata');
   }
 
+  static async setChangeGating(repoFullName: string, enabled: boolean): Promise<void> {
+    const response = await fetch(`/api/proxy/github/repo-selections/${encodeURIComponent(repoFullName)}/change-gating`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ enabled }),
+    });
+    if (!response.ok) {
+      const data = await response.json().catch(() => null);
+      throw new Error(data?.error || 'Failed to update incident prevention setting');
+    }
+  }
+
   static async generateRepoMetadata(repoFullName: string): Promise<void> {
     const response = await fetch('/api/proxy/github/repo-metadata/generate', {
       method: 'POST',
@@ -230,6 +246,7 @@
   const [savedRepos, setSavedRepos] = useState<ConnectedRepo[]>([]);
   const [savedReposLoaded, setSavedReposLoaded] = useState(false);
   const [editingMetadata, setEditingMetadata] = useState<Record<string, string>>({});
+  const [gatingUpdating, setGatingUpdating] = useState<Set<string>>(new Set());
   const pollingRef = useRef<ReturnType<typeof setInterval> | null>(null);
   const popupCleanupsRef = useRef<Array<() => void>>([]);
 
@@ -526,6 +543,39 @@
     }
   };
 
+  const handleChangeGatingToggle = async (repoFullName: string, enabled: boolean) => {
+    setGatingUpdating(prev => new Set(prev).add(repoFullName));
+    setSavedRepos(prev => prev.map(r =>
+      r.repo_full_name === repoFullName ? { ...r, change_gating_enabled: enabled } : r
+    ));
+    try {
+      await GitHubIntegrationService.setChangeGating(repoFullName, enabled);
+      // Re-assert the confirmed value: a loadSavedRepos poll snapshotted
+      // before the PUT committed can land after the optimistic update and
+      // clobber it with the stale flag.
+      setSavedRepos(prev => prev.map(r =>
+        r.repo_full_name === repoFullName ? { ...r, change_gating_enabled: enabled } : r
+      ));
+      window.dispatchEvent(new CustomEvent('providerStateChanged'));
+    } catch (error: unknown) {
+      const err = error as Error;
+      setSavedRepos(prev => prev.map(r =>
+        r.repo_full_name === repoFullName ? { ...r, change_gating_enabled: !enabled } : r
+      ));
+      toast({
+        title: "Error",
+        description: err.message || "Failed to update incident prevention setting",
+        variant: "destructive",
+      });
+    } finally {
+      setGatingUpdating(prev => {
+        const next = new Set(prev);
+        next.delete(repoFullName);
+        return next;
+      });
+    }
+  };
+
   const handleRegenerate = async (repoFullName: string) => {
     try {
       await GitHubIntegrationService.generateRepoMetadata(repoFullName);
@@ -1135,6 +1185,21 @@
                     {isReady && !isEditing && repo.metadata_summary && (
                       <p className="text-xs text-muted-foreground">{repo.metadata_summary.replace(/\*\*/g, '')}</p>
                     )}
+                    {repo.installation_id != null && (
+                      <div
+                        className="flex items-center justify-between gap-2 pt-1"
+                        title="Incident Prevention — Aurora reviews PRs for incident risk"
+                      >
+                        <span className="text-xs text-muted-foreground">Incident Prevention</span>
+                        <Switch
+                          checked={!!repo.change_gating_enabled}
+                          disabled={gatingUpdating.has(repo.repo_full_name)}
+                          onCheckedChange={(checked) => handleChangeGatingToggle(repo.repo_full_name, checked)}
+                          className="scale-75 origin-right"
+                          data-testid={`repo-change-gating-${repo.repo_full_name}`}
+                        />
+                      </div>
+                    )}
                   </div>
                 );
               })}

docker-compose.airtight.yml

@@ -65,6 +65,8 @@ x-common-env: &common-env
   NEXT_PUBLIC_ENABLE_SHAREPOINT: ${NEXT_PUBLIC_ENABLE_SHAREPOINT}
   NEXT_PUBLIC_ENABLE_NOTION: ${NEXT_PUBLIC_ENABLE_NOTION}
   NEXT_PUBLIC_ENABLE_SPINNAKER: ${NEXT_PUBLIC_ENABLE_SPINNAKER}
+  # Log PR change-gating reviews instead of posting to GitHub (calibration mode)
+  CHANGE_GATING_DRY_RUN: ${CHANGE_GATING_DRY_RUN:-false}
   # Slack OAuth (needed by celery_worker for formatting responses)
   SLACK_CLIENT_ID: ${SLACK_CLIENT_ID}
   SLACK_CLIENT_SECRET: ${SLACK_CLIENT_SECRET}

docker-compose.prod-local.yml

@@ -123,6 +123,8 @@ x-common-env: &common-env
   GITHUB_APP_SETUP_URL: ${GITHUB_APP_SETUP_URL}
   GH_OAUTH_CLIENT_ID: ${GH_OAUTH_CLIENT_ID}
   GH_OAUTH_CLIENT_SECRET: ${GH_OAUTH_CLIENT_SECRET}
+  # Log PR change-gating reviews instead of posting to GitHub (calibration mode)
+  CHANGE_GATING_DRY_RUN: ${CHANGE_GATING_DRY_RUN:-false}
 
   # AI Safety Guardrails
   GUARDRAILS_ENABLED: ${GUARDRAILS_ENABLED:-true}

docker-compose.yaml

@@ -84,6 +84,8 @@ x-common-env: &common-env
   GITHUB_APP_SETUP_URL: ${GITHUB_APP_SETUP_URL}
   GH_OAUTH_CLIENT_ID: ${GH_OAUTH_CLIENT_ID}
   GH_OAUTH_CLIENT_SECRET: ${GH_OAUTH_CLIENT_SECRET}
+  # Log PR change-gating reviews instead of posting to GitHub (calibration mode)
+  CHANGE_GATING_DRY_RUN: ${CHANGE_GATING_DRY_RUN:-false}
 
   # AI Safety Guardrails
   GUARDRAILS_ENABLED: ${GUARDRAILS_ENABLED:-true}

server/celery_config.py

@@ -102,6 +102,7 @@
         'utils.aws.credential_refresh',
         'routes.aws.cloudwatch_tasks',
         'tasks.github_webhook_tasks',
+        'tasks.change_gating',
         'routes.github.github_repo_metadata',
         'utils.repo_metadata',
         'services.actions.scheduler',

server/chat/backend/agent/agent.py

@@ -6,7 +6,7 @@
 from chat.backend.agent.model_mapper import ModelMapper
 from chat.backend.agent.providers import create_chat_model, get_registry
 from chat.backend.agent.weaviate_client import WeaviateClient
-from chat.backend.agent.utils.state import State
+from chat.backend.agent.utils.state import State, filter_denied_tools
 from chat.backend.agent.utils.tool_context_capture import ToolContextCapture
 from langchain_core.tools import StructuredTool
 from langchain_openai import ChatOpenAI
@@ -355,8 +355,10 @@ async def agentic_tool_flow(
             tools = get_cloud_tools()
             if tool_subset is not None:
                 tools = tool_subset
-
-
+            # Drop denylisted tools (returns a new list — get_cloud_tools() result is cached)
+            tools = filter_denied_tools(tools, state.tool_denylist)
+
+
             prompt_text = ''
             if state.messages and hasattr(state.messages[-1], 'content'):
                 # Handle both string and multimodal content

server/chat/backend/agent/orchestrator/dispatcher.py

@@ -274,6 +274,7 @@ def _build_sends(state: State) -> list:
             "parent_user_id": user_id,
             "parent_org_id": org_id,
             "parent_session_id": parent_session_id,
+            "parent_tool_denylist": getattr(state, "tool_denylist", None),
             "wave": wave,
         }
         sends.append(Send("sub_agent", payload))

server/chat/backend/agent/orchestrator/sub_agent.py

@@ -546,6 +546,10 @@ async def _run(input_dict: dict) -> FindingRef:
             is_background=True,
             mode="ask",
             model=sub_agent_model,
+            # A parent run's denylist must survive the sub-agent boundary,
+            # or denied write/exec tools would silently reappear here
+            # (agentic_tool_flow filters by sub_state.tool_denylist).
+            tool_denylist=input_dict.get("parent_tool_denylist"),
         )
 
         postgres_client = PostgreSQLClient()

server/chat/backend/agent/utils/state.py

@@ -4,6 +4,21 @@
 from pydantic import BaseModel, ConfigDict
 
 
+def filter_denied_tools(tools: List[Any], tool_denylist: Optional[List[str]]) -> List[Any]:
+    """Return ``tools`` minus those whose ``.name`` is in ``tool_denylist``.
+
+    For a non-empty denylist, returns a NEW filtered list (the input may be
+    the cached ``get_cloud_tools()`` list, which must never be mutated). For
+    an empty/None denylist, returns the input list object unchanged (callers
+    must not mutate it). Single source of truth for ``State.tool_denylist``
+    semantics — used by ``agentic_tool_flow`` and unit-tested directly.
+    """
+    if not tool_denylist:
+        return tools
+    denied = set(tool_denylist)
+    return [t for t in tools if getattr(t, "name", None) not in denied]
+
+
 class State(BaseModel):
     messages: List[AnyMessage] = []
     question: str
@@ -41,6 +56,7 @@ class State(BaseModel):
     )
     guardrail_blocked: bool = False  # Set by workflow when input rail blocks the message
     permitted_tools: Optional[set] = None
+    tool_denylist: Optional[List[str]] = None  # Tool names removed from the tool set for this run
 
     # --- Multi-agent orchestrator fields (defaults preserve single-agent behavior) ---
     triage_decision: Optional[Dict[str, Any]] = None

server/chat/background/task.py

@@ -422,6 +422,7 @@ def run_background_chat(
     send_notifications: bool = True,
     mode: str = "ask",
     rail_text: Optional[str] = None,
+    tool_denylist: Optional[List[str]] = None,
 ) -> Dict[str, Any]:
     """Run a chat session in the background without WebSocket.
 
@@ -446,6 +447,8 @@ def run_background_chat(
             only the externally-controlled fields should be checked for prompt
             injection; the internal instruction scaffolding should not. When
             omitted, falls back to initial_message (legacy behavior).
+        tool_denylist: Optional list of tool names to remove from the agent's
+            tool set for this run (e.g. write/exec tools for PR change gating).
 
     Returns:
         Dict with session_id, status, and any error information
@@ -663,6 +666,7 @@ def run_background_chat(
                 incident_id=incident_id,
                 mode=mode,
                 rail_text=rail_text,
+                tool_denylist=tool_denylist,
             ))
         except Exception as e:
             logger.error(f"[BackgroundChat] Exception in asyncio.run(_execute_background_chat): {e}", exc_info=True)
@@ -1144,6 +1148,7 @@ async def _run_jira_action(
     mode: str,
     wf,
     background_ws,
+    tool_denylist: Optional[List[str]] = None,
 ) -> None:
     """Run the Jira filing step after the RCA investigation completes.
 
@@ -1194,6 +1199,7 @@ async def _run_jira_action(
         mode=mode,
         is_background=True,
         rca_context=rca_context,
+        tool_denylist=tool_denylist,
     )
     logger.info(f"[JiraAction] Starting Jira step for {session_id} (jira_mode={jira_mode})")
 
@@ -1239,6 +1245,7 @@ async def _execute_background_chat(
     incident_id: Optional[str] = None,
     mode: str = "ask",
     rail_text: Optional[str] = None,
+    tool_denylist: Optional[List[str]] = None,
 ) -> Dict[str, Any]:
     """Execute the background chat workflow asynchronously.
 
@@ -1370,6 +1377,7 @@ async def _execute_background_chat(
             is_postmortem_action=_is_postmortem_action,
             rca_context=rca_context,
             permitted_tools=_resolve_permitted_tools(user_id),
+            tool_denylist=tool_denylist,
         )
         logger.info(
             f"[BackgroundChat] Created state with is_background=True, is_postmortem_action={_is_postmortem_action}, "
@@ -1420,6 +1428,7 @@ async def _execute_background_chat(
                 mode=mode,
                 wf=wf,
                 background_ws=background_ws,
+                tool_denylist=tool_denylist,
             )
 
         if incident_id: