diff --git a/blogs/human-authorization-in-agentic-workflows.md b/blogs/human-authorization-in-agentic-workflows.md index f3d99236..73a526c1 100644 --- a/blogs/human-authorization-in-agentic-workflows.md +++ b/blogs/human-authorization-in-agentic-workflows.md @@ -34,7 +34,7 @@ Finally, the system needed to integrate with existing gates. For pull requests, The solution has two pieces: a server and a macOS client that runs as a background LaunchAgent on each user's laptop. -![Voight-Kampff connects GitHub to a user's laptop over a persistent WebSocket connection](/blog/voight-kampff/architecture.png) +![Voight-Kampff connects GitHub to a user's laptop over a persistent WebSocket connection](/blog/voight-kampff/architecture.webp) During registration, the client creates a P-256 signing key in the Mac's Secure Enclave. The private key cannot be exported, and the key is protected with macOS `biometryCurrentSet`, which requires Touch ID and invalidates the key if the enrolled fingerprints change. The server stores the public key and binds it to the user's identity. @@ -63,24 +63,24 @@ The normal flow looks like this: 1. A PR is blocked from being merged until it is reviewed. - ![A GitHub pull request blocked pending review and the Voight-Kampff status check](/blog/voight-kampff/review-required.png) + ![A GitHub pull request blocked pending review and the Voight-Kampff status check](/blog/voight-kampff/review-required.webp) 2. A reviewer approves the PR in GitHub. - ![GitHub's approve review option](/blog/voight-kampff/github-approve-review.png) + ![GitHub's approve review option](/blog/voight-kampff/github-approve-review.webp) 3. GitHub sends a `pull_request_review` webhook to the VK server. 4. The VK server verifies the GitHub webhook signature, checks that the review applies to the current PR head, and creates an approval request for the reviewer. 5. The request is pushed over a WebSocket to the reviewer's local agent running on their laptop. 6. The agent shows the Touch ID prompt with context about the PR. - ![A Voight-Kampff Touch ID prompt showing the repository, pull request, and commit being approved](/blog/voight-kampff/touch-id-review-approval.png) + ![A Voight-Kampff Touch ID prompt showing the repository, pull request, and commit being approved](/blog/voight-kampff/touch-id-review-approval.webp) 7. After confirming the request is for the review they just left, the reviewer confirms with Touch ID. 8. The agent signs the approval payload with the Secure Enclave key and posts it back to the server. 9. The server verifies the signature, records the result, and updates the GitHub status check. - ![A GitHub pull request with the Voight-Kampff review check passed](/blog/voight-kampff/review-check-passed.png) + ![A GitHub pull request with the Voight-Kampff review check passed](/blog/voight-kampff/review-check-passed.webp) From the reviewer's perspective, this is still just approving a PR plus a quick Touch ID tap. From GitHub's perspective it is still a required status check, but the check now depends on a real physical action by the reviewer, not just possession of GitHub credentials. diff --git a/public/blog/voight-kampff/architecture.png b/public/blog/voight-kampff/architecture.png deleted file mode 100644 index 69ef04f8..00000000 Binary files a/public/blog/voight-kampff/architecture.png and /dev/null differ diff --git a/public/blog/voight-kampff/architecture.webp b/public/blog/voight-kampff/architecture.webp new file mode 100644 index 00000000..a16e9cff Binary files /dev/null and b/public/blog/voight-kampff/architecture.webp differ diff --git a/public/blog/voight-kampff/github-actions-workflow.mp4 b/public/blog/voight-kampff/github-actions-workflow.mp4 index 0da727e5..0bf04aa0 100644 Binary files a/public/blog/voight-kampff/github-actions-workflow.mp4 and b/public/blog/voight-kampff/github-actions-workflow.mp4 differ diff --git a/public/blog/voight-kampff/github-approve-review.png b/public/blog/voight-kampff/github-approve-review.png deleted file mode 100644 index 32f2fe5a..00000000 Binary files a/public/blog/voight-kampff/github-approve-review.png and /dev/null differ diff --git a/public/blog/voight-kampff/github-approve-review.webp b/public/blog/voight-kampff/github-approve-review.webp new file mode 100644 index 00000000..c39309b2 Binary files /dev/null and b/public/blog/voight-kampff/github-approve-review.webp differ diff --git a/public/blog/voight-kampff/pr-workflow.mp4 b/public/blog/voight-kampff/pr-workflow.mp4 index c4fd89b8..eb32e3a3 100644 Binary files a/public/blog/voight-kampff/pr-workflow.mp4 and b/public/blog/voight-kampff/pr-workflow.mp4 differ diff --git a/public/blog/voight-kampff/review-check-passed.png b/public/blog/voight-kampff/review-check-passed.png deleted file mode 100644 index 3bac5ab3..00000000 Binary files a/public/blog/voight-kampff/review-check-passed.png and /dev/null differ diff --git a/public/blog/voight-kampff/review-check-passed.webp b/public/blog/voight-kampff/review-check-passed.webp new file mode 100644 index 00000000..84f31d24 Binary files /dev/null and b/public/blog/voight-kampff/review-check-passed.webp differ diff --git a/public/blog/voight-kampff/review-required.png b/public/blog/voight-kampff/review-required.png deleted file mode 100644 index 266d9e0d..00000000 Binary files a/public/blog/voight-kampff/review-required.png and /dev/null differ diff --git a/public/blog/voight-kampff/review-required.webp b/public/blog/voight-kampff/review-required.webp new file mode 100644 index 00000000..966fdd32 Binary files /dev/null and b/public/blog/voight-kampff/review-required.webp differ diff --git a/public/blog/voight-kampff/slack-workflow.mp4 b/public/blog/voight-kampff/slack-workflow.mp4 index 731b6ea5..c0063ebf 100644 Binary files a/public/blog/voight-kampff/slack-workflow.mp4 and b/public/blog/voight-kampff/slack-workflow.mp4 differ diff --git a/public/blog/voight-kampff/touch-id-review-approval.png b/public/blog/voight-kampff/touch-id-review-approval.png deleted file mode 100644 index e6fd739b..00000000 Binary files a/public/blog/voight-kampff/touch-id-review-approval.png and /dev/null differ diff --git a/public/blog/voight-kampff/touch-id-review-approval.webp b/public/blog/voight-kampff/touch-id-review-approval.webp new file mode 100644 index 00000000..6263e1e8 Binary files /dev/null and b/public/blog/voight-kampff/touch-id-review-approval.webp differ