# Choose what Autopilot trusts before it merges

Two files tell Autopilot how much to trust a pull request at merge time. `.ampm/ci-evidence.json` names the checks that count as CI, and `.ampm/diff-risk.json` says which changed paths make a merge riskier.

## Where ampm reads these files

Both files are read from the pull request's **base branch**, never its head, so a pull request can't choose its own evidence or lower its own risk. A pull request that changes either file is always treated as high diff risk.

## Choose which checks count as CI

Autopilot merges on checks only when a check you name has passed at the pull request's head. Passing lint jobs, preview deploys and bots do not count. List the checks that run your tests, each with the GitHub App that produces it:

```json .ampm/ci-evidence.json
{ "checks": [{ "name": "verify", "app": "github-actions" }] }
```

- `name` is the check run's name. For a GitHub Actions job it is the job name (`verify` for a job with `name: verify`, or the job id when no name is set).
- `app` is the GitHub App slug on the check run. `github-actions` is GitHub Actions. A check with the right name from another app is ignored, because any app with `checks: write` can post a run with any name.
- Every listed check must have passed. When a check has run more than once at the head, its latest run decides.
- A conclusive failure of any check at the head, listed or not, still makes the evidence red.

Without the file, with a file that cannot be parsed, or while a listed check has not run (for example because CI only starts after a label), check evidence is **unavailable**. The workspace's "when checks are unavailable" policy then decides: ask a person, run a CI simulation, or merge. A file that cannot be parsed is shown as a repository policy problem on the merge card.

A CI simulation does not run again what ampm already ran on the same commit. When ampm itself runs a check command on a commit and reads its exit code, that result counts for the same command on the same commit: a later simulation skips it and cites the earlier run in its report, and landing treats it as a passing run of that required check. A result from another commit, a different command, a timeout, or a command ampm could not run never counts, and neither does anything an agent only wrote in its report.

When a merge is sent back and the new commit has exactly the same files as one ampm already simulated, for example after a rebase that brought in nothing new or a reworded commit, ampm uses that simulation's report instead of running another. The merge card says which commit the report ran on. A rebase that brings in new commits from the base branch changes the files, so it gets a new simulation.

Autopilot's approval is tied to the checks it saw named. If the base branch changes the list between the approval and the merge, even to checks that also passed, the merge asks again.

## Classify changed paths

ampm classifies a pull request's risk from the paths it changes, with built-in defaults for its own layout. Your repository can replace those defaults with its own rules. The highest class any changed path matches wins.

```json .ampm/diff-risk.json
{ "rules": [{ "pattern": "billing/**", "risk": "high" }, { "pattern": "docs/**", "risk": "low" }] }
```

`risk` is `low`, `medium` or `high`. A pattern with no slash matches a file name anywhere. `*` stays within one path segment and `**` crosses segments. A file that cannot be parsed falls back to the defaults and is shown as a repository policy problem on the merge card.