Agent CI/CD
CI/CD for AI-authored code
No single identity can both write code and merge it. Edit agents only propose; branch protection and a separate merge actor decide what ships.
Edit agent
proposes; never merges
Policy
decides eligibility
Merge actor
squash-merge when green
Problem → outcome
Problem
AI-authored code is unsafe when the same identity can propose a change and decide that it ships.
Outcome
No single identity can both write code and merge it. Edit agents only propose. Branch protection and a separate merge actor decide what ships.
The trust boundary
The figures trace the boundary in practice: who may propose a change, what decides its eligibility, and who performs the merge, then the gates a single change passes through on its way in.
Edit agent
feature branch + draft change
proposes; never merges
Edit zoneAgents author changes but can only ever open a draft pull request. They hold no merge rights.
Policy
checks · branch rules · ownership
decides eligibility
Policy zoneBranch protection, ownership rules, pinned workflows, and edit-time hooks decide eligibility deterministically.
Merge actor
automation or human
squash-merge when green
Merge zoneA distinct automation identity (or a human) performs the merge, and only after every check is green.
Every decision emits a schema-validated telemetry event, so the pipeline’s behavior stays auditable after the fact.
An edit agent can only propose. A policy layer decides what's eligible. A separate actor performs the merge, so no single identity can both write and ship code.
How a change moves through
A draft change is reviewed, remediated if needed, held at readiness gates until checks settle, then merged only when every gate is green.
Checks
Automated review and remediation run along the way, and every decision emits schema-validated telemetry so the whole thing stays observable.
Every decision emits a schema-validated telemetry event, so the pipeline’s behavior stays auditable after the fact.
- CI/CDCentral workflow resolution: lint, test, security, and merge bots share one policy surface.
- AI governanceEdit agents may only propose; eligibility and merge are owned by policy and a different identity.
- SecurityCredential and merge-path mistakes are assumed; edit agents never hold merge rights.
- TypeScriptWhere Agent CI/CD surfaces are typed, contract drift fails at build time.
- Policy as codeEligibility rules for Agent CI/CD live as reviewable policy code, not slide decks.
- GitHub ActionsWorkflows enforce draft-only edit agents and green-check merge conditions.
- AgenticAgents open fix PRs; deterministic checks still own merge authority.
- Platform engineeringSeparation of write vs merge is the paved path other agent workflows inherit.
- SchemasEvery gate decision emits schema-validated telemetry.
- MonitoringSchema-validated telemetry makes every gate decision observable.
- Cursor SDKDispatches Cursor SDK agents for autofix and async cloud runs behind the edit-only trust zone.
Field notes
I built this around separation of authority. Edit agents can only propose. A policy layer (branch protection, CODEOWNERS, pinned workflows) decides what is eligible. A different actor performs the merge. Automated review and remediation run along the way, and every decision emits schema-validated telemetry so the pipeline stays observable. Tightrope draws the same boundary at the contract level: deterministic checks judge, an agent drafts the fix, a human applies it. Orchestration engineering is how that separation becomes a reusable engine instead of a one-repo sermon.
Portfolio graph
Maps how the work here connects. Open the Portfolio graph →
- Professional
- Personal
- Skill
- Writing