A pull request reviewer that comments freely and merges never

A pull request reviewer runs often, reads a lot of untrusted text and holds credentials to your code. That combination is why it deserves more structure than a script with a personal access token.

How is it set up?

A fleet triggered by a webhook on pull request events. The connector permissions are narrow: read the repository, post review comments. Posting a comment is reversible, so it runs within policy. There is no merge permission to approve, because it was never granted.

What protects the repository?

• Narrow, short-lived credentials. The agent never holds your token. The gateway attaches a scoped credential for the run.
• A sandbox per agent. Code from the pull request runs in the reviewer's sandbox, not on a shared box.
• Effect classes. If you later allow it to push fixes, that can be gated by policy or by a person.
• A per-run cap. A huge diff cannot turn into a huge bill.

What is recorded?

Every comment, tool call and model call goes into the hash-chained audit trail, and each run ends with a receipt. If a review comment was wrong, you can see exactly what the agent read before it wrote it.