bkd-dotcom/Umbra Admission
Govern any coding agent's PR with an admission pipeline and a signed receipt. Never merges.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mission | The bounded task the change claims to perform (used as the agent mission / review context). | no | Review this pull request's change for scope, introduced secrets, and injected repository instructions. |
| min-authority | Minimum earned authority level required to pass (0 observe, 1 analyze, 2 branch-PR). | no | 1 |
| agent | Force a specific executor (codex-cli | claude-code) to re-run the change. Leave blank to govern the existing PR diff without invoking an agent. | no | "" |
| signing-key | Base64 Ed25519 signing key (32+ bytes) for stable receipts. Falls back to an honestly-flagged dev key if unset. | no | "" |
| umbra-version | Version of umbra-core to install from PyPI (e.g. '0.1.0'). Blank installs the latest. | no | "" |
| require-sandbox | If 'true', code-executing checks (npm/pip install, go/cargo build) are refused unless a real filesystem/network sandbox is available (fail closed). | no | false |
| python-version | Python version to run on. | no | 3.12 |
Outputs
| name | description |
|---|---|
| authority-level | The authority level the change earned (0/1/2). |
| receipt-hash | The canonical hash of the signed receipt. |