GitHub blocks pull_request_target by default in public repositories from
December 2, 2026. The ai-self-review workflow now runs on pull_request.
It still checks out and runs the check script of the base branch and no
other code of the pull request. The workflow file itself now comes from
the pull request, so a pull request that changes it can weaken its own
check. .github/CODEOWNERS therefore makes a maintainer the code owner of
the workflows, CODEOWNERS and the check script; this is enforced once the
branch protection of main requires a review from code owners.
Additional changes
- Record the switch in ADR 0002, which supersedes the pull_request_target
consequence of ADR 0001.
- Skip the comment step for pull requests from forks, whose token is
read-only, and point their error message to the job summary only.
- Describe the trigger, code owners and fork limits in docs/develop/ai.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: Claude Code (claude-opus-5-5)
Additional changes
Agents write a task plan to .scratch/<branch>/plan.md and self-review with code-review
Agents fix hard violations, report judgement calls and rerun the self-review before every push
Agents declare the review in a Self-review section of the pull request body
Add the ai-self-review workflow and scripts/check_pr_self_review.py for pull requests into main
Detect agents by Assisted-by or Anthropic Co-Authored-By trailers, body markers or the AI box
Fail only on a missing Self-review section or a missing, malformed or stale Reviewed SHA
Note an unticked AI-assisted box and malformed optional lines without failing
Comment on the pull request how to fix a failure and update that one comment on later runs
Show the same report in the job summary and accept Windows line endings in the body
Skip dependabot and release pull requests
Run on pull_request_target with the base branch's script, never pull request code
Add the pull request template: the pr skill's sections plus Checklist and Self-review
Require always valid optimization parameters in the energy-domain skill
Require datetimeutil for date and time handling in new and changed code in AGENTS.md
Require the Assisted-by trailer on agent commits in the commit-messages skill
Add tests for the check in tests/test_ai.py
Add GLOSSARY.md and the agent tracker docs in docs/agents/
Add decision record docs/adr/0001 with an ADR index in the docs toctree
Document the workflow in docs/develop/ai.md and CONTRIBUTING.md
Exclude docs/agents from Sphinx and PyMarkdown and ignore .scratch/
Document cz check instead of make gitlint for commit messages in docs/develop/ai.md
Assisted-by: Claude Code (claude-opus-5-5)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Vendor the engineering skills of https://github.com/mattpocock/skills into
ai/skills/engineering, with their MIT license, and list them in AGENTS.md.
The agent-specific metadata (agents/openai.yaml) is kept for other agents.
Additional changes
- Add scripts/update_mattpocock_skills.py to compare the copy with upstream by
git blob hashes from a blobless clone and to update it on request.
- Add tests/test_ai.py; it warns when the copy differs from upstream and caches
the upstream hashes in the pytest cache for a day.
- Document the engineering skills in docs/develop/ai.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The sandbox provides an isolated Docker environment for AI-assisted development
(OpenCode + Claude Code + Qwen Code) against the local AkkudoktorEOS repository.
The sandbox does not protect the repository from harmful changes by the agent.
It limits what a misled agent can reach on the machine, but the agent can still
write any change into the repository.
Primary security defence is to check every change before it is run on the host.
Same holds for opening a pull request or updating one.
Additional changes
- Reduce AGENTS.md to the project summary, baseline rules, completion checklist,
and an index of the skills.
- Add skills for the Python environment and REST API error responses.
- Add the development guide page docs/develop/ai.md: the AI coding
workflow, how agents get the project rules from AGENTS.md and ai/skills,
and how to use the sandbox (start, agent logins, project commands with a
virtual environment outside the workspace, running EOS and EOSdash,
GitHub access, persistent data, security model).
- Add a checklist for reviewing agent changes before pushing, starting with
.git, which stays writable in the sandbox.
- Check out all text files with LF line endings (.gitattributes), also on
Windows with core.autocrlf, so the sandbox scripts run in the container
and git in the container agrees with git on the host. Batch files keep CRLF.
- Publish the ports of ai/compose.yaml on request (AI_SANDBOX_PORTS=1).
docker compose run publishes them only with --service-ports. Off by
default, so that several sandboxes can run in parallel.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Bobby NoelteandClaude Opus 5.5
