Code integration

Spot uncontracted schema changes and new services at pull request time.

The PR inspector reads pull request metadata and diffs to spot uncontracted schema changes, new third-party services and features that map to no SOW milestone.

Start free trial Explore the sandbox

Last reviewed Nov 2, 2026

Vendor: GitHub, Inc. (Microsoft)
Plan: Agency and Scale plans
Authentication: GitHub App, installed per organization on selected repositories
Setup time: About 3 minutes
Sync: Real time via GitHub App webhooks

Overview

How TWINJAM works with GitHub

Some scope creep only becomes visible in code. A new database table for a feature nobody quoted, a payments SDK added for a flow that was explicitly excluded, a second authentication provider that turns into a week of work. TWINJAM installs as a GitHub App on the repositories you choose and inspects pull requests as they open and update.

The PR inspector looks at structure, not style. It reads the diff summary, migration files, dependency manifests and the PR description, then compares what changed with the contracted milestones and exclusions. A migration that creates tables unrelated to any deliverable, or a dependency that matches an excluded integration, raises a flag to the PM with the file paths and the clause it was measured against.

TWINJAM does not review code quality, assign blame or score individual developers. Flags go to the PM and delivery lead, not to the author, and the goal is to have the commercial conversation before the work is merged rather than after it ships. Source code is processed in memory for inspection and is never stored or used to train any model.

In practice

A payments SDK in PR #412

A pull request titled Add invoice payments adds a payments SDK and two new tables. Clause 7.3 excludes payment processing entirely. TWINJAM flags the PR to the PM with both file paths and a 40 to 56 hour range, before the branch is merged.

The payload on the right is the event TWINJAM emits to your triage feed and to outbound webhooks, so you can route it into your own reporting.

Example event, GitHubapplication/json

{
  "type": "scope.pr.flagged",
  "id": "prf_G2x8Vn5K",
  "workspace": "HFX-APP",
  "source": {
    "tool": "github",
    "repo": "agency/halvorsen-app",
    "pr": 412,
    "title": "Add invoice payments"
  },
  "findings": [
    {
      "kind": "new_dependency",
      "file": "package.json",
      "detail": "stripe@18 added"
    },
    {
      "kind": "schema_change",
      "file": "db/migrations/0042_payments.sql",
      "detail": "creates tables payments, payment_methods"
    }
  ],
  "sow_reference": {
    "clause": "7.3",
    "text": "Payment processing and PCI scope are excluded."
  },
  "classification": {
    "verdict": "out_of_scope",
    "confidence": 0.96
  },
  "impact": {
    "hours_low": 40,
    "hours_high": 56
  }
}

Permissions

Scopes requested, and why.

Scope	Why TWINJAM needs it
Pull requests: read	Read PR titles, descriptions, labels and changed file lists.
Contents: read	Read migration files and dependency manifests referenced in a PR diff.
Metadata: read	Required by GitHub for every app; lists the repositories you selected.
Issues: read	Map GitHub Issues to SOW milestones for teams that plan in GitHub.

Events

What triggers a check.

pull_request (opened, synchronize, edited)
Inspects each PR when opened and on every new push.
issues (opened, edited)
Maps GitHub Issues to contracted milestones.
installation_repositories
Updates the repository list when you add or remove repos.

Setup

Connect GitHub in about 3 minutes.

An admin connects once. PMs never need to re-authenticate, and you can revoke access from TWINJAM or the vendor's admin console at any time.

1Choose Connect GitHub and install the TWINJAM GitHub App on your organization.
2Select only the client repositories you want inspected.
3Map each repository to a contract workspace.
4Optionally list the dependency names that correspond to excluded integrations, such as payment or analytics SDKs.

FAQ

GitHub integration questions

Pull request metadata and changed file paths. Diffs of migration files and dependency manifests (package.json, Gemfile, requirements.txt, go.mod and similar). Issues in repositories you selected. It never reads: repositories you did not select during installation; secrets, environment files or GitHub Actions logs; commit history beyond open pull requests; per-developer contribution or productivity statistics.

Nothing. TWINJAM does not comment on PRs, set statuses or block merges. Every action that could reach a client requires a PM to approve it first.

Agency and Scale plans: Agency ($899/mo billed annually), Scale (from $1,800/mo billed annually). Every plan starts with a 14-day free production trial.

Real time via GitHub App webhooks. Setup takes about 3 minutes.