Repository navigation
Guardian asks child agents before PR feedback upkeep #2438
Description
When Junior hands PR review feedback to a child agent, Guardian returns ask for the child's github_updatePullRequestFeedback (:+1:) and github_resolvePullRequestReviewThread calls. The child reports the action as blocked, and the parent then asks the user to confirm in Slack. When the root run does the same work itself, Guardian allows these calls.
- Cause:
CHILD_AGENT_RULES(packages/junior/src/chat/guardian/reviewer.ts) accept authorization only from rootuser:andautomation:lines. The GitHub event that starts the work is anevent:line, and the parent task text is not user intent. So the upkeep exception inpolicy.ts(marking or resolving feedback on a resource that the agent made) does not apply. - Parent turns too: when a child result starts a parent turn, action review uses the child result as the user intent (
currentUserIntentinpackages/junior/src/chat/agent/index.ts). That turn also logsaskordenyfor these tools. - Evidence: Sentry
sentry/juniorspans show 9ask/denydecisions for these two tools between Oct 28 and Oct 30, all inagent:*conversations. Root runs that do this work logallow. - When it started: feat(agents): Claude Code-style child agents with implicit delegation and agent types #2265 (Oct 28) began delegating to child agents implicitly. The child rules come from fix(agents): Never take parent agent text as user approval in a child #2147.
- Coverage gap: no Guardian eval covers feedback upkeep by a child agent, or by a parent after a child result.
Proposed in discussion (two options):
- Parent does the upkeep (preferred). The child fixes the code and lists the comments it addressed. The parent adds 👍 and resolves. This needs a thread rule that treats this upkeep as allowed in a turn that a child result started. The child agent rules stay strict.
- Child does the upkeep. Treat 👍/resolve on feedback that the delegated work addressed, on a PR that Junior made, as upkeep in
CHILD_AGENT_RULES. Keep it narrow, because the child rules block prompt injection from parent task text.
Related: #2258
via @szokeasaurusrex.
--
Activity
dcramer commentedon Oct 30, 2026
in general, we need tools to be allowed-by-default for junior when junior is acted on behalf of its own work units (e.g. if it created the pr)
sentry-junior commentedon Oct 30, 2026
More cases from Oct 30, all upkeep on #2435, a PR that Junior opened. A child agent ran each one:
askwith authorizationunknown. The reason: "changes review feedback status, which the user did not request."ask.The rule that allows upkeep on the agent's own PR needs evidence that the agent made it. The existing Guardian evals pass because the child's own
github_createPullRequestresult is in its evidence. Here, #2435 was opened outside that child's history. So Guardian had no evidence that Junior owned the PR, and it treated routine upkeep as an unrequested write.Lead: the GitHub create tools already write a conversation annotation for the object they create (
githubObjectAnnotation). That could be a trusted record that Junior created the resource.The separate problem, where a later approval did not clear an earlier block, is #2450, with a fix in #2451.
fix(github): Skip review for owned PR feedback upkeep