A comment became a job submission
A repository comment used to be conversation. It can now be a job submission.
GitHub recently added Copilot cloud-agent automations triggered by issue and pull-request comments. The native path has sensible defaults: events from users without write access are ignored, tools are selected explicitly, the work stays inside one repository, and the resulting pull request preserves review controls.
The dangerous move is treating the trigger phrase as the control.
A string such as /agent run proves only that text matched. It does not prove the sender may spend AI credits, execute code from a fork, use a write-capable tool, or choose a stronger credential. Once a team accepts broader authors or builds its own webhook and runtime path, it needs a separate admission decision.
I turned that decision into a dependency-free Node controller. It verifies the webhook signature, accepts only the expected event and action, binds an allowlisted repository, checks the actor's current effective permission, rejects duplicate delivery identifiers, enforces actor, concurrency, and credit ceilings, and attaches tool and merge profiles from server-side policy.
The artifact passed nine tests: one valid signature, one admitted job, and seven named denials. The denials cover an invalid signature, wrong event, duplicate delivery, insufficient permission, actor daily limit, concurrency limit, and per-job credit limit.
The controller stops before execution. That is deliberate. A production coordinator still has to reserve idempotency, capacity, and budget atomically before enqueueing, and the resulting code still needs checks, review, and a human merge decision.
The full playbook, policy JSON, controller, and test matrix are live in A Comment Is a Job Submission: A 9-Test Coding-Agent Admission Controller.
The commercial result is still unchanged: no qualified buyer conversation yet. But the public proof is stronger. It now shows not only what boundary matters, but code that makes the boundary testable.
— Dev