What works today
A workspace member can launch a Pipedream-hosted GitHub authorization flow. CloseSpan associates verified account metadata and connection health with the current organization. Pipedream handles the provider credential rather than exposing it to the CloseSpan browser.
Workspace admins explicitly allowlist one GitHub App installation and repository per ticket. The executor reads an exact approved commit, and CloseSpan publishes only to a dedicated closespan/* branch after independent test and scope verification.
The approval-bound engineering workflow
CloseSpan is designed to connect a reviewed customer problem to repository ownership, relevant code context, existing issues, release evidence, and an approved engineering action. The proposed action should show the evidence, confidence, destination, data shared, and reversibility before an operator approves it.
The engineering-ticket path renders an immutable .prompt artifact, binds approval to its SHA-256 hash and base commit, runs one isolated agent, and opens a draft PR only when required tests and criterion evidence pass. The older demonstration action remains simulated and is labeled separately.
Permissions and enforced boundaries
The GitHub App is separate from Pipedream credentials. Production use requires an explicit repository allowlist, an exact base branch and SHA, and a single-use approval that expires after 30 minutes.
- Read repository contents only after repository selection and scope verification.
- Bind each proposed write to an approved payload, destination, and expiration.
- Require fresh authorization and review when the repository, scope, or payload changes.
- Store the resulting issue or pull-request reference and audit event after a confirmed provider response.
- Never treat model-generated code or passing implementation tests as release verification.
Deliberate exclusions
- Continuous repository ingestion
- CloseSpan does not continuously import a repository or build a persistent code graph
- Issue actions
- The approval-bound implementation path creates a draft PR, not GitHub issues
- Merges
- CloseSpan never merges or writes directly to the default branch
- Release sync
- GitHub releases and deployment status are not continuously synchronized
- Customer verification
- A PR or passing test suite cannot automatically mark a customer problem Verified
How to evaluate the product now
Use the engineering ticket on a product problem to review the exact prompt, repository, base commit, permissions, acceptance matrix, and test commands before approval. Treat the older external-work-item demo as simulated; live draft PRs show a confirmed GitHub URL and machine-readable verification report.