Inspect the evidence, policy, decision, and next controlled action.

A read-only AI Work Ledger v2 foundation record for one GitHub webhook review. This page shows safe metadata only and intentionally omits raw diffs, raw repo rules, webhook payloads, prompts, tokens, keys, provider errors, and stack traces.

acme-ai-checkout/acme-checkout-web

PR #42: Add AI refund assistant prompt and checkout webhook changes

Review status: Needs manual reviewHIGHneeds human reviewSimulated demo data

acme-ai-checkout/acme-checkout-web PR #42 is needs manual review with HIGH risk. Evidence is needs review. Human approval is required before merge. Source context: MergeGuard, PromptForge, AgentOS, Agent Work Records. PR #42 in acme-ai-checkout/acme-checkout-web is needs manual review with high control risk. Complete human review before merge.

Source: MergeGuard + PromptForge + AgentOS + Agent Work RecordsVerification: Needs reviewCurrent authority: Awaiting human approval

Overview

Complete human review before merge

MergeGuard report generated; RepoBrain rules fetched; 6 repo rules summarized; 5 policy checks triggered; 2 protected / 2 sensitive path matches; GitHub Check Preview: failure; PR Comment Preview v2 available; 3 safe warning labels

Risk level: High control risk
Merge recommendation: Needs human review
Human review required: yes

Review Status

Review needs human attention before the work should be trusted or merged.

Risk & Merge Recommendation

High control risk. Recommendation: Needs human review. Complete human review before merge.

Review status: Needs manual review
Status detail: Review needs human attention before the work should be trusted or merged.
Created: Jul 9, 09:00 AM
Mode: openai
Origin: github pr webhook
Work type: feature build
Scope status: sensitive paths touched
Agent identity: Codex
Action: opened
Sender: demo-reviewer
Policy checks: 5
Policy violations: 1
Required follow-ups: 3
Recommended follow-ups: 2
Repo rules: fetched
Repo rules source: simulated:acme-checkout-web:forgelayer.yml
Report: generated
Comment: dry-run
Protected matches: 2
Sensitive matches: 2
RepoBrain rules: 6
Test commands: 2

RepoBrain policy definition / changed files context

Refund assistant and checkout webhook changes touch payment, prompt, and auth/session surfaces. Security and prompt review are required before merge.

Evidence & Human Review

Evidence checklist

Observed evidence: report generated.
Repository policy: loaded.
Policy checks: 5; violations: 1.
Relevant test commands: 2.
Warnings requiring inspection: 3.

Verification & test/build evidence

Verification state: Needs review. Test/build evidence is represented by safe counts and labels only and may be draft or simulated in private beta.

Review findings are separate from runner outcomes. Repository commands were not run, and no test or security pass is inferred.

Open Verification State

Human approval authority

Generic Review Run recommendation: Human review required (check preview requires review; required reviews: security, prompt, code-owner; 3 required follow-ups; 1 policy violations).

Awaiting human approval. A system recommendation never grants human approval.

Ledger / Work Record connection

Linked Agent Work Record & Ledger record

This Review Run can be inspected alongside the draft Agent Work Record and derived AI Work Ledger foundations. These are contextual links, not fake record deep links.

Open Agent Work Records View in Ledger

Demo record metadata is simulated and uses persisted: false.

Decision boundaries

Observed evidence: Safe summary and counts
System recommendation: Needs human review
Current instruction: Complete human review before merge
Current authority: Awaiting human approval
Future execution: disabled

Next controlled action

Complete human review before merge. No automatic merge, posting, repository write, or agent execution follows from this recommendation.

GitHub Check Preview

ForgeLayer preview: merge blocked

Preview-only GitHub check status: completed/failure. Risk: HIGH. Recommendation: needs_human_review. ForgeLayer is not creating GitHub check runs yet.

Preview-only policy artifact, not current approval authority. ForgeLayer is not creating GitHub check runs yet.

Conclusion: failure
Status: completed
Would block merge: yes
Check-preview policy flag: required

PR Comment Preview v2

ForgeLayer Review

ForgeLayer reviewed acme-ai-checkout/acme-checkout-web#42. Risk is HIGH; merge recommendation is needs human review.

Copy-ready deterministic preview artifact, not current approval authority. GitHub posting is disabled by default. This is a copy-ready preview only. ForgeLayer is not calling GitHub APIs from this view.

Preview onlyPosting disabled by defaultCopy-ready preview

Safe to post: no
Posting enabled: no
Risk: Risk: HIGH
Recommendation: Merge recommendation: needs human review

Action items

Keep this as a preview while GitHub posting is disabled by default.
Review the copy-ready markdown before using it in GitHub.
Complete required human checks before merge.
Confirm tests, evidence, and policy follow-ups are satisfied.
Treat safe_to_post as false until the blocked reason is resolved.
Resolve warning: GitHub posting is disabled.

Comment sections

headline

Headline

ForgeLayer Review

status

Status

GitHub posting is disabled by default. This is a copy-ready preview only.

risk summary

Risk Summary

HIGH

merge recommendation

Merge Recommendation

needs human review

required human checks

Required Human Checks

* security * prompt * code-owner

evidence needed

Evidence Needed

* Prompt injection risk * Payment webhook touched * Auth/session touched

changed files context

Changed Files / Context

Refund assistant and checkout webhook changes touch payment, prompt, and auth/session surfaces. Security and prompt review are required before merge.

next steps

Next Steps

* Resolve blocking findings. * Regenerate the ForgeLayer review before merge.

safety note

Safety Note

GitHub posting is disabled by default. Preview only unless GitHub posting is explicitly enabled. ForgeLayer does not call GitHub APIs from this preview surface. ForgeLayer does not execute agents, merge code, or grant repo access. Generic Platform Guidance: Human approval remains required before production merge.

Copy-ready markdown preview

## ForgeLayer Review

### Summary

ForgeLayer reviewed acme-ai-checkout/acme-checkout-web#42. Risk is HIGH; merge recommendation is needs human review.

### Review Status

* Status: needs manual review
* Generated: 2026-07-09T09:00:00.000Z

### GitHub Check Preview

* Title: ForgeLayer preview: merge blocked
* Status: completed
* Conclusion: failure
* Preview only: true
* Would block merge: yes
* Required human review: yes

### Risk / Merge Recommendation

* Risk: HIGH
* Merge recommendation: needs human review

### Key Findings

* Prompt injection risk
* Payment webhook touched
* Auth/session touched

### Required Human Checks

* security
* prompt
* code-owner

### AI Work Record

Work type: feature_build. Scope: sensitive_paths_touched.

### RepoBrain

Refund assistant and checkout webhook changes touch payment, prompt, and auth/session surfaces. Security and prompt review are required before merge.

### Next Steps

* Resolve blocking findings.
* Regenerate the ForgeLayer review before merge.

### Safety note

Preview only unless GitHub posting is explicitly enabled. ForgeLayer does not execute agents, merge code, or grant repo access.
Posting enabled: no. Safe to post: no.

GitHub PR link is safe metadata.Open PR

ForgeLayer

Operational review workspace

Loading Review Runs

Fetching the latest safe review-run summaries. Raw diffs, raw repo rules, secrets, tokens, and webhook payloads are not loaded into this view.

Read-only

Safe summaries

Preparing the capped private beta ledger view.

Inspect the evidence, policy, decision, and next controlled action.

## ForgeLayer Review ### Summary ForgeLayer reviewed acme-ai-checkout/acme-checkout-web#42. Risk is HIGH; merge recommendation is needs human review. ### Review Status * Status: needs manual review * Generated: 2026-07-09T09:00:00.000Z ### GitHub Check Preview * Title: ForgeLayer preview: merge blocked * Status: completed * Conclusion: failure * Preview only: true * Would block merge: yes * Required human review: yes ### Risk / Merge Recommendation * Risk: HIGH * Merge recommendation: needs human review ### Key Findings * Prompt injection risk * Payment webhook touched * Auth/session touched ### Required Human Checks * security * prompt * code-owner ### AI Work Record Work type: feature_build. Scope: sensitive_paths_touched. ### RepoBrain Refund assistant and checkout webhook changes touch payment, prompt, and auth/session surfaces. Security and prompt review are required before merge. ### Next Steps * Resolve blocking findings. * Regenerate the ForgeLayer review before merge. ### Safety note Preview only unless GitHub posting is explicitly enabled. ForgeLayer does not execute agents, merge code, or grant repo access. Posting enabled: no. Safe to post: no.

Inspect the evidence, policy, decision, and next controlled action.

Early ledger detail

PR #42: Add AI refund assistant prompt and checkout webhook changes

Complete human review before merge

Review Status

Risk & Merge Recommendation

RepoBrain policy definition / changed files context

Evidence & Human Review

Evidence checklist

Verification & test/build evidence

Human approval authority

Ledger / Work Record connection

Linked Agent Work Record & Ledger record

Decision boundaries

Next controlled action

ForgeLayer preview: merge blocked

ForgeLayer Review

Action items

Comment sections

Headline

Status

Risk Summary

Merge Recommendation

Required Human Checks

Evidence Needed

Changed Files / Context

Next Steps

Safety Note

Copy-ready markdown preview

Loading Review Runs

Safe summaries

Inspect the evidence, policy, decision, and next controlled action.

Early ledger detail

PR #42: Add AI refund assistant prompt and checkout webhook changes

Complete human review before merge

Review Status

Risk & Merge Recommendation

RepoBrain policy definition / changed files context

Evidence & Human Review

Evidence checklist

Verification & test/build evidence

Human approval authority

Ledger / Work Record connection

Linked Agent Work Record & Ledger record

Decision boundaries

Next controlled action

ForgeLayer preview: merge blocked

ForgeLayer Review

Action items

Comment sections

Headline

Status

Risk Summary

Merge Recommendation

Required Human Checks

Evidence Needed

Changed Files / Context

Next Steps

Safety Note

Copy-ready markdown preview