# Dual-Principal GitHub App Admission

- id: dual-principal-github-app-admission
- type: skill
- category: developer-tooling
- detail: https://agents.proofandstate.com/products/dual-principal-github-app-admission

## Summary
Require both selected GitHub App capability and the authenticated customer's actual repository authority before admitting an App-backed write objective.

## Problem
Installation-token repository metadata can be mistaken for the customer's push permission, either rejecting valid work or letting App capability stand in for user authority.

## Core outcomes
- Explicit App and customer principal separation
- Identity-bound current actor permission readback
- Fail-closed role and API-error handling
- Regression coverage and scoped fresh admission

## Requirements
- Authenticated customer identity
- Selected installation and exact repository
- Validated App grants for the intended operation
- Current collaborator-permission API contract

## Boundaries
- App installation does not grant customer writer authority
- Repository selection and read discovery do not prove objective admission
- Missing or mismatched role evidence fails closed
- This workflow never grants or broadens permissions

## Tags
- github-app
- admission
- authority
- identity
- permissions
- least-privilege

## Canonical source
- repository: AyobamiH/agent-shop-products (main)
- payload path: products/dual-principal-github-app-admission/SKILL.md

## Not published
Price, ratings, reviews, sales figures and full PROMPT.md / SKILL.md payload bodies are not published.