Permission Protocol Demo

Merge blocked by default until a human signs the receipt.

---

⚡ Quickstart (3 minutes)

1. Click "Use this template" above
2. Add your PP_API_KEY secret (get one here)
3. Open a PR → Watch it fail → Approve → Merge

You're protected. No setup files. No config. Just works.

---

🎬 See It In Action

┌─────────────────────────────────────────────────────────────┐
│  PR #1: test: Trigger PP deploy gate                        │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ❌ Deploy Gate — FAILED                                    │
│                                                             │
│  ═══════════════════════════════════════════════════════   │
│    🔐 PERMISSION PROTOCOL - Deploy Authorization Required   │
│  ═══════════════════════════════════════════════════════   │
│                                                             │
│  ❌ NO RECEIPT - Approval required                          │
│                                                             │
│  This PR changes protected deployment files.                │
│  A human must approve before merge.                         │
│                                                             │
│  👉 APPROVE HERE: https://app.permissionprotocol.com/...    │
│                                                             │
│  After approval, re-run this workflow.                      │
│  ═══════════════════════════════════════════════════════   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

→ View the actual blocked PR

---

The Problem

Your AI agent just pushed to main.
It passed CI.
It deployed to production.

Who approved it?

Not a human. Not a policy. Nobody.

---

The Solution

No Receipt → No Merge

Every deploy requires a cryptographic receipt. Signed by a human. Auditable forever.

---

How It Works

   PR opened
       │
       ▼
┌──────────────────┐
│  CI runs check   │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐     ┌─────────────────────┐
│ Receipt exists?  │────▶│  ✅ Merge allowed   │
└────────┬─────────┘ YES └─────────────────────┘
         │ NO
         ▼
┌──────────────────┐
│  ❌ CI FAILS     │
│  Shows approval  │
│  link in logs    │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ Human approves   │
│ in PP dashboard  │
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│ Re-run CI        │
│ ✅ Now passes    │
└──────────────────┘

---

Try It Yourself

1. Fork this repo

2. Set up Permission Protocol

See SETUP.md for full instructions.

3. Open a PR touching deploy/

git checkout -b test-gate
echo "# test" >> deploy/config.yml
git commit -am "test: trigger gate"
git push origin test-gate
# Open PR → Watch it fail → Approve → Watch it pass

---

Protected Paths

Any PR touching these paths requires PP approval:

Path	Why
deploy/*	Production configuration
.github/workflows/*	CI/CD pipeline

---

The Receipt

Every approval generates a cryptographic receipt:

{
  "id": "rec_abc123",
  "status": "APPROVED",
  "scope": {
    "repo": "permission-protocol/pp-demo",
    "prNumber": 1,
    "headSha": "abc123",
    "capability": "deploy:production"
  },
  "approver": "you@company.com",
  "signature": "0x...",
  "expiresAt": "2026-02-21T00:00:00Z"
}

Immutable. Auditable. Cryptographically signed.

---

_{Built by Permission Protocol · The Signer of Record for Autonomous Systems}