From 7d40d68400fd4cb1d9abc9e5ce76e1ecef2c01b5 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Wed, 29 Jul 2026 04:17:58 -0700
Subject: [PATCH] chore(superagent): add Superagent config with
 contributor-trust disabled

This repo had no .github/superagent.yml, so the app was running on Superagent's
own defaults -- including contributor-trust scoring, with no way to configure it
from the repo.

Add the config explicitly, matching JSONbored/loopover and JSONbored/metagraphed:
prScan enabled (it gates CI and is the protection worth having), contributorTrust
disabled.

Contributor trust does not discriminate here -- established repeat contributors
with dozens of merged PRs were scored 'dangerous' (10/100) on volume alone -- and
the trustedAuthors allowlist meant to fix that provably does not work: a listed
author was still flagged action_required. It is omitted rather than carried along
inert and misleading. The verdict also has no consumer: LoopOver lists this check
under gate.ignoredCheckRuns on all three gate repos, so a non-passing result no
longer gates, pends, or holds anything.
---
 .github/superagent.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/superagent.yml

diff --git a/.github/superagent.yml b/.github/superagent.yml
new file mode 100644
index 0000000000..bd917361b5
--- /dev/null
+++ b/.github/superagent.yml
@@ -0,0 +1,24 @@
+# Superagent (https://superagent.sh) GitHub App configuration — PR security scanning + contributor trust
+# scoring. All fields are optional; anything omitted falls back to Superagent's own defaults.
+prScan:
+  enabled: true
+
+# Contributor-trust scoring is DISABLED (2026-07-29), matching JSONbored/loopover and JSONbored/metagraphed.
+#
+# It does not discriminate on these repos: established repeat contributors with dozens of merged PRs were
+# scored "dangerous" (10/100) on volume and velocity alone. The `trustedAuthors` allowlist that used to sit
+# here was meant to fix exactly that and did NOT work -- a listed author was still flagged
+# `action_required` -- so it has been dropped rather than carried along inert and misleading.
+#
+# The verdict also has no consumer any more: LoopOver lists this check under `gate.ignoredCheckRuns`
+# (loopover#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds
+# anything. Leaving it enabled would only produce a permanently red check on contributor PRs that nothing
+# acts on -- noise that makes good contributors think they have failed something.
+#
+# The SECURITY SCAN above stays enabled and still gates CI normally: that is the protection worth having,
+# and it is a different check from the same app.
+contributorTrust:
+  enabled: false
+
+comments:
+  mode: detailed