메뉴
GitHub PR attestation comment service for Latch Enclave. Posts session receipts as Markdown comments on GitHub PRs via the REST API. Use when working on PR annotations, attestation comments, or GitHub integration for session receipts.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | enclave-pr-annotator |
| description | GitHub PR attestation comment service for Latch Enclave. Posts session receipts as Markdown comments on GitHub PRs via the REST API. Use when working on PR annotations, attestation comments, or GitHub integration for session receipts. |
File: src/main/services/pr-annotator.ts
Posts Latch attestation session receipts as structured Markdown comments on GitHub pull requests. Uses the GitHub REST API directly (no SDK dependency).
parsePrUrl(url: string): PrUrlParts | nullExtracts owner, repo, and prNumber from a GitHub PR URL of the form https://github.com/{owner}/{repo}/pull/{number}. Returns null for non-GitHub URLs or malformed paths.
formatReceiptComment(receipt: SessionReceipt): stringFormats a SessionReceipt as a Markdown PR comment body containing:
<details> section with cryptographic proof (Merkle root, audit event count, truncated signature and public key)annotatePR(receipt: SessionReceipt, prUrl: string, githubToken: string): Promise<{ ok, commentUrl?, error? }>Posts the formatted receipt comment on a GitHub PR. Steps:
parsePrUrlformatReceiptCommenthttps://api.github.com/repos/{owner}/{repo}/issues/{prNumber}/commentshtml_url of the created comment on successHeaders sent: Authorization: Bearer {token}, Accept: application/vnd.github+json, X-GitHub-Api-Version: 2022-11-28.
The IPC handler (latch:attestation-annotate-pr in src/main/index.ts) resolves the GitHub token from the secrets store under the key service:github. It attempts to parse the stored value as JSON (extracting .token or .apiKey) and falls back to the raw string value.
The generated Markdown comment has this structure:
## Latch Attestation
Policy and tier summary line.
| Metric | Value |
|--------|-------|
| Network requests | ... |
| Blocked requests | ... |
| ... | ... |
<details>
<summary>Cryptographic proof</summary>
- Merkle root, audit event count, signature, public key
</details>
---
*Generated by Latch Desktop*
src/main/services/pr-annotator.test.tsnpx vitest run src/main/services/pr-annotator.test.tsTests cover: URL parsing (valid and invalid), policy ID inclusion, activity metrics inclusion, Merkle root inclusion, and sandbox type inclusion in the formatted comment.
Credential lifecycle management for the Latch Enclave. Tracks expiry, validates credentials against upstream services, records usage metadata. Use when working on credential health checks, token rotation, or service authentication status.
LLM-assisted data classification for the Latch Enclave proxy. Covers prompt building, response parsing, tier validation, and the DataClassifier class. Use when working on data classification, sensitivity tiers, content analysis, or LLM-driven data labeling in the enclave pipeline.
Domain-based egress filtering for the Latch Enclave proxy. Matches outbound requests to registered services, enforces data tier access, injects credentials into headers, scans for credential leaks, and enforces path/method scoping with glob patterns. Use when working on proxy request evaluation, network policy enforcement, or fine-grained service access control.
Per-session HTTP proxy for the Latch Enclave. Gates outbound requests by domain/service, injects credentials, enforces path/method scoping, scans for credential leaks, logs all traffic for audit. Use when working on proxy lifecycle, network gating, leak prevention, or enclave session setup.
Audit logging and session attestation for the Latch Enclave. Covers hash-chained proxy audit events, Merkle tree proofs, session receipts, PR annotations, and tamper-evident logging. Use when working on audit trails, session receipts, compliance proofs, inclusion proofs, PR annotation, or the attestation engine.
Binary Merkle tree utility with domain-separated hashing for the Latch Enclave attestation system. Provides O(log n) inclusion proofs and consistency proofs for tamper-evident audit logging. Use when working on Merkle roots, audit event proofs, log consistency verification, or attestation store Merkle integration.