{
  "format": "agent-article-v0",
  "article_id": "EA-116",
  "canonical_url": "/tools/ea-116-coding-agent",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-116-URL-EBC17186B3D4",
    "EVD-EA-116-URL-408ACEE9ECE3",
    "EA-116-R11-RESEARCH",
    "EA-116-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-116-UNKNOWN-01",
    "EA-116-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-040-EA0116",
    "SRC-EA-116-URL-EBC17186B3D4",
    "SRC-EA-116-URL-408ACEE9ECE3",
    "WEBBODY-EA0116-R8-983B86A1"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-116-URL-EBC17186B3D4",
      "evidence_class": "RESEARCH",
      "title": "source class: official product documentation; exact title: About GitHub Copilot cloud agent; author/org: GitHub; canonical URL:",
      "href": "https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-116-URL-EBC17186B3D4"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "- source class: official product documentation; exact title: About GitHub Copilot cloud agent; author/org: GitHub; canonical URL: https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-116-URL-408ACEE9ECE3",
      "evidence_class": "RESEARCH",
      "title": "source class: official security product documentation; exact title: About code scanning; author/org: GitHub; canonical URL:",
      "href": "https://docs.github.com/en/code-security/concepts/code-scanning/code-scanning",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-116-URL-408ACEE9ECE3"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "- source class: official security product documentation; exact title: About code scanning; author/org: GitHub; canonical URL: https://docs.github.com/en/code-security/concepts/code-scanning/code-scanning"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-116-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-116 監査済みresearch / canonical revision binding",
      "supports": [
        "GitHub Docsはcloud agentをissue/taskから作業させ、PRを作成・外部toolからinvokeし、enterprise/org ownerがPR lifecycle metricsを見られることを記載する。Business/Enterpriseではadmin policy enableが必要で、repository opt-out、Actions minutes、AI creditsもavailability/cost gateになる。Code scanningは脆弱性・error検出、CodeQLまたはSARIF結果を扱う補助層である。これらは運用接続点の証拠だが、agent patchの正しさ、secure-by-default、license compliance、rollback成功、全repositoryへの可用性を保証しない。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-040-EA0116"
      ],
      "supporting_locators": [
        "COMM-040-EA0116",
        "EA-116-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-116.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-116-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-116 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0116-R8-983B86A1"
      ],
      "supporting_locators": [
        "WEBBODY-EA0116-R8-983B86A1",
        "content/staging/EA-116.md",
        "EA-116-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "coding agentはrepository、branch、CI、secrets、dependency、PR、rollbackに作用するため、能力存在とenterpriseでの許可・監査・費用・品質を切り分ける必要がある。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "coding / provider mapping / organization overlay / implementation / security / audit / cost"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "GitHub Copilot cloud agentの現行Docsが示すtask/PR/metrics/availability gateと、GitHub code scanningの補助的役割は何か。coding agent自体の正しさや安全性を確定できるか。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "- source class: official product documentation; exact title: About GitHub Copilot cloud agent; author/org: GitHub; canonical URL: https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent; publication/update/access: current page accessed 2026-09-13 JST; version/release/tag/commit/API revision/model ID: Copilot cloud agent current docs; supporting locator: lines 81-85（issue/task assignment、research/plan、custom agents）、86-99（PR lifecycle metrics、external invocation）、102-108（paid plan、admin enable、repository opt-out）、125-129（GitHub Actions minutes and AI credits）; evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE; relation: support / limit.\n- source class: official security product documentation; exact title: About code scanning; author/org: GitHub; canonical URL: https://docs.github.com/en/code-security/concepts/code-scanning/code-scanning; publication/update/access: current page accessed 2026-09-13 JST; version/release/tag/commit/API revision/model ID: GitHub code scanning/CodeQL current docs; supporting locator: page sections on finding vulnerabilities/errors, schedule/event triggers, SARIF/API, CodeQL and third-party tools; private repository license gate as stated on page; evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE; relation: context / limit."
    },
    {
      "heading": "FINDINGS",
      "text": "GitHub Docsはcloud agentをissue/taskから作業させ、PRを作成・外部toolからinvokeし、enterprise/org ownerがPR lifecycle metricsを見られることを記載する。Business/Enterpriseではadmin policy enableが必要で、repository opt-out、Actions minutes、AI creditsもavailability/cost gateになる。Code scanningは脆弱性・error検出、CodeQLまたはSARIF結果を扱う補助層である。これらは運用接続点の証拠だが、agent patchの正しさ、secure-by-default、license compliance、rollback成功、全repositoryへの可用性を保証しない。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "PRが作成・mergeされたことはコード品質の証明ではない。code scanningのalertは検出範囲とrule/configに依存し、未検出を安全の証拠にできない。branch protection、required review、CI、secret scanning、dependency pinning、license/OSS policy、runner networkは別設定。pageの機能・料金・モデル選択はPRODUCT_VOLATILE。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "paid Copilot plan、Business/Enterprise admin policy、repository opt-out、GitHub Actions/AI credits、branch permissions、secret/network restrictions、code scanning license、CI statusを確認する必要がある。実repositoryへのagent起動・PR作成・CI実行は未実施。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "read-only repo discovery→isolated branch/worktree→tests/scanning→human review→protected merge→rollback/revertのcontrol plane設計候補。実装・安全性試験未実施。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "fixture repository群で patch correctness、test pass、static alerts、dependency/license diff、secret exposure、PR review completeness、revert time、agent action traceを別scoreにする。merge率を品質scoreに代用しない。"
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "SECURITY/PRIVACY: least privilege token、no production secrets、network egress allowlist、sandbox runner。AUDIT: issue/branch/commit/PR/CI/scanner/model/config/approver。COST: Actions minutes、AI credits、review/rollback工数。OPERABILITY: protected branch、required checks、kill switch、revert playbook。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「GitHub Copilot cloud agentはtaskからrepository作業・PR作成へ接続でき、管理者有効化、repository opt-out、Actions minutes/AI credits等のgateを伴う。Code scanningは別の検出・SARIF/CodeQL層であり、agent生成コードの正しさ・安全性・license適合・merge可否を自動保証するものではない。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "本文ではagent capability、repository/IAM gate、CI/review gate、scanner coverage、cost、rollbackを分離して記載する。次回はGitHub branch protection・secret scanning・dependency/OSS controlsの一次Docsと、isolated test repositoryのTEST_PROFILEを追加する。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "agentの実際のtool permission境界、model/version pinning、network/secret access default、failure/rollback rate、各plan/regionの差、code scanning false-negative/false-positive。"
    },
    {
      "heading": "STOP_CONDITION",
      "text": "agentがPRを出したこと・CIが通ったこと・scannerが無alertであることを、総合的な安全・品質保証へ変換しない。\nUNIT_CLOSE_STATUS: INDIVIDUAL_BOUNDED_CLOSE / EVIDENCE_RECORDED / UNKNOWN_PRESERVED\n\n---"
    }
  ],
  "human_url": "/tools/ea-116-coding-agent",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-116-coding-agent",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-116-coding-agent"
}