Scheduled LLM runs can merge PRs: merge_pull_request has no approval gate #90

Found in the review of #89, which removes the PR auto-merge heartbeat. Pre-existing.

merge_pull_request (web/src/claude-tools/github.ts) calls mergePullRequest with no approval step, and web/src/claude-tools/index.ts adds every GitHub tool to every buildContext() whenever GitHub is enabled — including executors that scheduled jobs reach with no human present (goals.ts dispatch with costCeiling: 'expensive', curiosity.ts, heartbeat.ts). AUTO_LOW_APPROVED_TOOLS in goals.ts is prompt text only; nothing enforces it.

Scenario: a goal run reads issues or PRs (get_repo_issues / get_repo_prs), injected text (or the model's own judgement — the new aegis:ready-to-merge label makes the case look stronger) says a PR is ready, and it calls merge_pull_request. With no branch protection, that lands on main.

Fix: remove merge_pull_request (and other irreversible GitHub writes) from scheduled/internal contexts, or turn it into a proposed action like trigger_worker_deploy, so merging needs an operator in the loop. Enforce tool allowlists in code, not prompts.

🤖 Generated with Claude Code