Add the DevFlow PR repair entrypoint - #8622

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 0b4146185a4b
Model: gpt-5.6-sol-fast

Overview

The repair pipeline has strong request binding, authorization, artifact-digest checks, credential separation, and container isolation. However, verification still executes PR-controlled build configuration, does not require replacement files to be covered by the selected verification targets, and cannot publish to the fork branches that request capture explicitly accepts. These gaps can produce falsely verified candidates or make an entire supported PR class fail only at publication.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (2 high, 1 medium) across 3 files. Details are attached to the affected lines below.

Affected areas: .github/scripts/pr_repair_worker/python_verify.py, .github/scripts/verify_pr_repair.py, .github/workflows/devflow-repair-publish.yml

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 5a57d8501062
Model: gpt-5.6-sol-fast

Overview

This increment moves repair execution out of the repository and leaves a compact gateway that freezes the PR and command, verifies the snapshot digest and event identity, authorizes the frozen requester, and dispatches a pinned DevFlow controller revision. Its strongest guardrails are the trusted helper checkout, App-only membership token, fail-closed team check, bounded snapshot, and SHA-pinned actions. The reviewers identified concurrency and retry limitations, but the concrete local forms predate this review range, while the external ordering concern lacks evidence of a violated DevFlow contract.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.