Approved implementation
Turn an approved issue plan into a validated pull request.
Implementation starts only after Tasuku resolves a valid approval against a plan for the same repository and issue.
Approve a plan
Use the App-derived handle:
@acme-reviewer implementTasuku acknowledges an accepted command, resolves the latest applicable plan for the same repository and subject, persists a new workflow, and binds the implementation to that plan. If the plan is stale, cancelled, already active, or missing, implementation does not start.
The commanding GitHub user must have write access to the repository—the admin, maintain, write, or push collaborator permission. Unauthorized implement commands are dropped silently.
Workspace and credentials
The worker prepares the primary repository and gives the agent a catalog of approved supporting repositories. The trusted runtime loads a supporting repository read-only at its pinned commit only when the agent requests it. Repository credentials stay in the trusted runtime and are not placed in the untrusted agent process environment.
The agent changes files inside a bounded workspace. It cannot push a branch, create a pull request, or call GitHub as the App.
Artifact validation
After the agent exits, Tasuku collects a bounded artifact and validates paths before using it. The trusted worker creates the commit and branch through GitHub's Git Data API, then opens the implementation pull request.
This boundary rejects attempts to write outside the primary workspace or publish arbitrary agent-controlled GitHub operations.
Draft or ready status
Repository settings select whether implementation pull requests open as:
DRAFT— a human decides when the result is ready for normal review;READY_FOR_REVIEW— GitHub review can begin immediately.
The choice applies when Tasuku creates the pull request; it does not change the earlier plan-approval requirement. When the agent reports its verification status as BLOCKED, the pull request opens as a draft regardless of the configured mode.
Retry behavior
Transient worker or provider failures can retry with a new attempt. Publication is recorded as workflow state so recovery does not silently create an unrelated second result. If a failure occurs after an external GitHub effect, inspect events before manually replaying the command.
What remains visible
Tasuku retains the command interaction, approved plan, task attempts, agent artifact, rendered GitHub content, commit and pull request identifiers, and ordered workflow events for operator diagnosis.