AgentRoom is intended for teams whose coding agents may see private source code, tickets, logs, prompts, Chatto discussions, and review context. The default posture should be private, least-privilege, and human-supervised.
- Self-host by default.
- Use Chatto as the private collaboration surface.
- GitHub remains the source of truth for code review and merge.
- Agents get the minimum permissions needed for a task.
- Humans approve plans and risky actions.
- Every important event is recorded.
- Evidence is summarized, but raw sensitive logs should not be sprayed into PR comments.
The first approval gates should be:
- Plan approval before code changes.
- Risk approval before touching sensitive files.
- Merge recommendation only after CI and review checks pass.
Sensitive file examples:
- authentication and authorization code
- payment or billing code
- production deployment configuration
- database migrations
- secrets management
- encryption or key-handling code
AgentRoom should record:
- who started the session
- which issue or PR triggered it
- which Chatto room and thread were used
- which agent adapter ran
- which plan was approved
- which branch and commits were produced
- CI status
- review status
- approval decisions
- evidence packet versions
AgentRoom should not store provider API keys, GitHub tokens, Chatto user credentials, or repository secrets in plaintext. The first implementation should document where credentials live and how they are scoped before supporting production use.
Operator API access should be avoided for normal operation. If AgentRoom ever supports bootstrapping Chatto users through the Operator API, that setup step must run on the Chatto host or a trusted sidecar with explicit socket access, because the Operator API is root-equivalent Chatto authority.
- agent goes off-plan
- agent edits sensitive files without approval
- two agents edit the same files
- branch becomes stale
- CI is flaky or incomplete
- webhook delivery is retried
- PR is force-pushed
- evidence packet is outdated
- human approval times out
- untrusted fork opens a PR