diff --git a/appview/config/config.exs b/appview/config/config.exs
index 1da3f37..adf4227 100644
--- a/appview/config/config.exs
+++ b/appview/config/config.exs
@@ -25,6 +25,11 @@ for repo <- all_repos do
     pool_size: 1
 end
 
+config :atvouch, :tangled,
+  url: "https://tangled.org",
+  bot_handle: nil,
+  bot_password: nil
+
 config :tesla, adapter: Tesla.Adapter.Mint
 
 import_config "#{config_env()}.exs"
diff --git a/appview/config/runtime.exs b/appview/config/runtime.exs
index 7708265..735086f 100644
--- a/appview/config/runtime.exs
+++ b/appview/config/runtime.exs
@@ -6,6 +6,13 @@ if tap_uri = System.get_env("TAP_URI") do
     password: System.get_env("TAP_PASSWORD")
 end
 
+if tangled_handle = System.get_env("TANGLED_BOT_HANDLE") do
+  config :atvouch, :tangled,
+    url: System.get_env("TANGLED_URL", "https://tangled.org"),
+    bot_handle: tangled_handle,
+    bot_password: System.get_env("TANGLED_BOT_PASSWORD")
+end
+
 if config_env() == :prod do
   config :atvouch,
     port: System.fetch_env!("PORT"),
diff --git a/appview/config/test.exs b/appview/config/test.exs
index a3a2907..2581d14 100644
--- a/appview/config/test.exs
+++ b/appview/config/test.exs
@@ -13,5 +13,10 @@ config :atvouch, :tap,
   uri: "ws://localhost:123/channel",
   password: "123"
 
+config :atvouch, :tangled,
+  url: "http://localhost:0",
+  bot_handle: nil,
+  bot_password: nil
+
 config :logger,
   level: :warning
diff --git a/appview/lib/atvouch/application.ex b/appview/lib/atvouch/application.ex
index 67e42f7..1d5cb5b 100644
--- a/appview/lib/atvouch/application.ex
+++ b/appview/lib/atvouch/application.ex
@@ -12,7 +12,7 @@ defmodule Atvouch.Application do
         [
           {Bandit, plug: Atvouch.Router, port: port, ip: {127, 0, 0, 1}},
           Atvouch.Tinycron.new(Atvouch.CounterTask, every: 60, jitter: -5..5)
-        ] ++ tap_children()
+        ] ++ tangled_children() ++ tap_children()
 
     opts = [strategy: :one_for_one, name: Atvouch.Supervisor]
     Supervisor.start_link(children, opts)
@@ -29,6 +29,23 @@ defmodule Atvouch.Application do
       end
   end
 
+  defp tangled_children do
+    config = Application.get_env(:atvouch, :tangled, [])
+    handle = Keyword.get(config, :bot_handle)
+    password = Keyword.get(config, :bot_password)
+
+    if handle && password do
+      [
+        {Atvouch.Tangled.Session,
+         handle: handle,
+         password: password,
+         tangled_url: Keyword.get(config, :url, "https://tangled.sh")}
+      ]
+    else
+      []
+    end
+  end
+
   defp tap_children do
     case Application.get_env(:atvouch, :tap) do
       nil ->
diff --git a/appview/lib/atvouch/bot_comment.ex b/appview/lib/atvouch/bot_comment.ex
new file mode 100644
index 0000000..2add0e8
--- /dev/null
+++ b/appview/lib/atvouch/bot_comment.ex
@@ -0,0 +1,40 @@
+defmodule Atvouch.BotComment do
+  use Ecto.Schema
+  import Ecto.Changeset
+  import Ecto.Query
+
+  schema "bot_comments" do
+    field(:repo_at_uri, :string)
+    field(:pull_number, :integer)
+    field(:author_did, :string)
+    field(:commented_at, :string)
+  end
+
+  def changeset(comment, attrs) do
+    comment
+    |> cast(attrs, [:repo_at_uri, :pull_number, :author_did, :commented_at])
+    |> validate_required([:repo_at_uri, :pull_number, :author_did, :commented_at])
+    |> unique_constraint([:repo_at_uri, :pull_number], name: :bot_comments_repo_pull)
+  end
+
+  def create(attrs) do
+    %__MODULE__{}
+    |> changeset(attrs)
+    |> Atvouch.Repo.insert()
+  end
+
+  def exists?(repo_at_uri, pull_number) do
+    from(c in __MODULE__,
+      where: c.repo_at_uri == ^repo_at_uri and c.pull_number == ^pull_number
+    )
+    |> Atvouch.Repo.replica().exists?()
+  end
+
+  def last_pull_number(repo_at_uri) do
+    from(c in __MODULE__,
+      where: c.repo_at_uri == ^repo_at_uri,
+      select: max(c.pull_number)
+    )
+    |> Atvouch.Repo.replica().one()
+  end
+end
diff --git a/appview/lib/atvouch/tangled/client.ex b/appview/lib/atvouch/tangled/client.ex
new file mode 100644
index 0000000..443b464
--- /dev/null
+++ b/appview/lib/atvouch/tangled/client.ex
@@ -0,0 +1,64 @@
+defmodule Atvouch.Tangled.Client do
+  @moduledoc """
+  HTTP client for posting comments to Tangled pull requests.
+  """
+
+  require Logger
+
+  @doc """
+  Post a comment on a Tangled pull request.
+
+  Uses the session cookies from `Atvouch.Tangled.Session` for authentication.
+  If a 401 is returned, invalidates the session and retries once.
+  """
+  def post_comment(repo_handle, repo_rkey, pull_number, body, opts \\ []) do
+    session = Keyword.get(opts, :session, Atvouch.Tangled.Session)
+    retry = Keyword.get(opts, :retry, true)
+    tangled_url = Atvouch.Tangled.Session.get_url(session)
+
+    case Atvouch.Tangled.Session.get_cookies(session) do
+      {:ok, cookies} ->
+        url = "#{tangled_url}/#{repo_handle}/#{repo_rkey}/pulls/#{pull_number}/round/0/comment"
+        form_body = URI.encode_query(%{"body" => body})
+
+        headers = [
+          {"content-type", "application/x-www-form-urlencoded"},
+          {"hx-request", "true"},
+          {"cookie", cookies}
+        ]
+
+        case do_post(url, form_body, headers) do
+          {:ok, status} when status in 200..299 ->
+            :ok
+
+          {:ok, 401} when retry ->
+            Logger.info("Tangled returned 401, invalidating session and retrying")
+            Atvouch.Tangled.Session.invalidate(session)
+            post_comment(repo_handle, repo_rkey, pull_number, body, Keyword.put(opts, :retry, false))
+
+          {:ok, status} ->
+            {:error, {:http_error, status}}
+
+          {:error, reason} ->
+            {:error, reason}
+        end
+
+      {:error, reason} ->
+        {:error, {:session_error, reason}}
+    end
+  end
+
+  defp do_post(url, body, headers) do
+    request = %Tesla.Env{
+      method: :post,
+      url: url,
+      body: body,
+      headers: headers
+    }
+
+    case Tesla.Adapter.Mint.call(request, []) do
+      {:ok, %Tesla.Env{status: status}} -> {:ok, status}
+      {:error, reason} -> {:error, reason}
+    end
+  end
+end
diff --git a/appview/lib/atvouch/tangled/comment_builder.ex b/appview/lib/atvouch/tangled/comment_builder.ex
new file mode 100644
index 0000000..0d58a81
--- /dev/null
+++ b/appview/lib/atvouch/tangled/comment_builder.ex
@@ -0,0 +1,52 @@
+defmodule Atvouch.Tangled.CommentBuilder do
+  @moduledoc """
+  Builds markdown comment text showing vouch routes between
+  maintainers and a PR author.
+  """
+
+  @doc """
+  Build a comment string showing vouch routes from maintainers to a PR author.
+
+  `maintainer_routes` is a list of `{maintainer_did, maintainer_handle, route_result}`
+  where `route_result` is the output of `Graph.find_routes/2`.
+  """
+  def build_comment(author_did, author_handle, maintainer_routes) do
+    author_display = display_name(author_did, author_handle)
+    header = "## atvouch routes for #{author_display}\n"
+
+    body =
+      maintainer_routes
+      |> Enum.map(fn {maintainer_did, maintainer_handle, route_result} ->
+        format_maintainer_routes(maintainer_did, maintainer_handle, route_result)
+      end)
+      |> Enum.join("\n")
+
+    header <> "\n" <> body <> "\n\n---\n*generated by [atvouch](https://atvouch.dev)*"
+  end
+
+  defp format_maintainer_routes(maintainer_did, maintainer_handle, {:direct, _target_did}) do
+    maintainer = display_name(maintainer_did, maintainer_handle)
+    "**#{maintainer}**: direct vouch"
+  end
+
+  defp format_maintainer_routes(maintainer_did, maintainer_handle, {:routes, _target_did, []}) do
+    maintainer = display_name(maintainer_did, maintainer_handle)
+    "**#{maintainer}**: no routes found"
+  end
+
+  defp format_maintainer_routes(maintainer_did, maintainer_handle, {:routes, _target_did, paths}) do
+    maintainer = display_name(maintainer_did, maintainer_handle)
+    route_lines = Enum.map(paths, &format_path/1)
+    "**#{maintainer}**:\n" <> Enum.join(route_lines, "\n")
+  end
+
+  defp format_path(path) do
+    path
+    |> Enum.map(fn did -> "`#{did}`" end)
+    |> Enum.join(" -> ")
+    |> then(&"- #{&1}")
+  end
+
+  defp display_name(_did, handle) when is_binary(handle) and handle != "", do: "@#{handle}"
+  defp display_name(did, _handle), do: "`#{did}`"
+end
diff --git a/appview/lib/atvouch/tangled/scraper.ex b/appview/lib/atvouch/tangled/scraper.ex
new file mode 100644
index 0000000..487a089
--- /dev/null
+++ b/appview/lib/atvouch/tangled/scraper.ex
@@ -0,0 +1,95 @@
+defmodule Atvouch.Tangled.Scraper do
+  @moduledoc """
+  Scrapes the Tangled pulls page HTML to extract PR listings.
+  """
+
+  require Logger
+
+  @doc """
+  Parse a Tangled pulls page HTML to extract pull request info.
+
+  Returns a list of `{pull_number, title, created_at}` tuples,
+  where `created_at` is the ISO8601 datetime string from the `<time>` element,
+  or `nil` if no timestamp is present (e.g. for merged/closed PRs in collapsed sections).
+  """
+  def parse_pulls_page(html) do
+    {:ok, doc} = Floki.parse_document(html)
+
+    # Find all links whose href matches /*/pulls/NUMBER
+    doc
+    |> Floki.find("a[href]")
+    |> Enum.flat_map(fn element ->
+      href = Floki.attribute(element, "href") |> List.first("")
+
+      case Regex.run(~r{/[^/]+/[^/]+/pulls/(\d+)$}, href) do
+        [_, number_str] ->
+          number = String.to_integer(number_str)
+          title = element |> Floki.text() |> String.replace(~r/\s+/, " ") |> String.trim()
+          created_at = find_time_near(element, doc, href)
+          [{number, title, created_at}]
+
+        _ ->
+          []
+      end
+    end)
+    |> Enum.uniq_by(fn {number, _, _} -> number end)
+    |> Enum.sort_by(fn {number, _, _} -> number end, :desc)
+  end
+
+  # Find the <time datetime="..."> element within the same PR entry container
+  # as the PR link. We find the smallest div ancestor that contains both
+  # the link and a <time> element.
+  defp find_time_near(_link_element, doc, href) do
+    doc
+    |> Floki.find("div")
+    |> Enum.filter(fn div ->
+      has_link = div |> Floki.find("a[href='#{href}']") |> Enum.any?()
+      has_time = div |> Floki.find("time[datetime]") |> Enum.any?()
+      has_link and has_time
+    end)
+    |> Enum.min_by(&Floki.raw_html(&1, encode: false) |> String.length(), fn -> nil end)
+    |> case do
+      nil ->
+        nil
+
+      div ->
+        div
+        |> Floki.find("time[datetime]")
+        |> List.first()
+        |> Floki.attribute("datetime")
+        |> List.first()
+        |> decode_html_entities()
+    end
+  end
+
+  defp decode_html_entities(nil), do: nil
+
+  defp decode_html_entities(str) do
+    str
+    |> String.replace("&#43;", "+")
+    |> String.replace("&amp;", "&")
+  end
+
+  @doc """
+  Fetch the pulls page for a repository from Tangled.
+
+  Returns `{:ok, pulls}` where pulls is the result of `parse_pulls_page/1`,
+  or `{:error, reason}`.
+  """
+  def fetch_pulls(tangled_url, repo_handle, repo_rkey) do
+    url = "#{tangled_url}/#{repo_handle}/#{repo_rkey}/pulls"
+
+    case Tesla.get(url) do
+      {:ok, %Tesla.Env{status: 200, body: body}} ->
+        {:ok, parse_pulls_page(body)}
+
+      {:ok, %Tesla.Env{status: status}} ->
+        Logger.warning("Tangled pulls page returned #{status} for #{url}")
+        {:error, {:http_error, status}}
+
+      {:error, reason} ->
+        Logger.warning("Failed to fetch Tangled pulls page #{url}: #{inspect(reason)}")
+        {:error, reason}
+    end
+  end
+end
diff --git a/appview/lib/atvouch/tangled/session.ex b/appview/lib/atvouch/tangled/session.ex
new file mode 100644
index 0000000..41ab081
--- /dev/null
+++ b/appview/lib/atvouch/tangled/session.ex
@@ -0,0 +1,264 @@
+defmodule Atvouch.Tangled.Session do
+  @moduledoc """
+  GenServer that manages an authenticated Tangled session.
+
+  Performs the OAuth login flow against a PDS and caches
+  the resulting session cookies. Cookies are refreshed
+  when they expire (23h TTL) or when explicitly invalidated.
+  """
+
+  use GenServer
+  require Logger
+
+  @cookie_ttl_seconds 23 * 60 * 60
+
+  # Public API
+
+  def start_link(opts) do
+    name = Keyword.get(opts, :name, __MODULE__)
+    GenServer.start_link(__MODULE__, opts, name: name)
+  end
+
+  def get_cookies(server \\ __MODULE__) do
+    GenServer.call(server, :get_cookies, 30_000)
+  end
+
+  def get_url(server \\ __MODULE__) do
+    GenServer.call(server, :get_url)
+  end
+
+  def invalidate(server \\ __MODULE__) do
+    GenServer.cast(server, :invalidate)
+  end
+
+  # GenServer callbacks
+
+  @impl true
+  def init(opts) do
+    state = %{
+      cookies: nil,
+      expires_at: nil,
+      handle: Keyword.fetch!(opts, :handle),
+      password: Keyword.fetch!(opts, :password),
+      tangled_url: Keyword.fetch!(opts, :tangled_url)
+    }
+
+    {:ok, state}
+  end
+
+  @impl true
+  def handle_call(:get_cookies, _from, state) do
+    if state.cookies && state.expires_at && DateTime.compare(DateTime.utc_now(), state.expires_at) == :lt do
+      {:reply, {:ok, state.cookies}, state}
+    else
+      case do_login(state) do
+        {:ok, cookies} ->
+          expires_at = DateTime.utc_now() |> DateTime.add(@cookie_ttl_seconds)
+          new_state = %{state | cookies: cookies, expires_at: expires_at}
+          {:reply, {:ok, cookies}, new_state}
+
+        {:error, reason} ->
+          {:reply, {:error, reason}, state}
+      end
+    end
+  end
+
+  @impl true
+  def handle_call(:get_url, _from, state) do
+    {:reply, state.tangled_url, state}
+  end
+
+  @impl true
+  def handle_cast(:invalidate, state) do
+    {:noreply, %{state | cookies: nil, expires_at: nil}}
+  end
+
+  # Login flow implementation
+
+  defp do_login(state) do
+    with {:ok, authorize_url} <- step1_post_login(state),
+         {:ok, csrf_token, pds_cookies} <- step2_get_authorize(authorize_url),
+         {:ok, callback_url} <- step3_sign_in(authorize_url, csrf_token, pds_cookies, state),
+         {:ok, cookies} <- step4_oauth_callback(callback_url) do
+      {:ok, cookies}
+    end
+  end
+
+  # Step 1: POST /login to Tangled with HX-Request header
+  defp step1_post_login(state) do
+    url = "#{state.tangled_url}/login"
+    body = URI.encode_query(%{"handle" => state.handle})
+
+    headers = [
+      {"content-type", "application/x-www-form-urlencoded"},
+      {"hx-request", "true"}
+    ]
+
+    case http_request(:post, url, body, headers) do
+      {:ok, status, resp_headers, _body} when status in [200, 302] ->
+        case get_header(resp_headers, "hx-redirect") do
+          nil ->
+            # Try location header as fallback
+            case get_header(resp_headers, "location") do
+              nil -> {:error, :no_redirect_in_login_response}
+              url -> {:ok, url}
+            end
+
+          url ->
+            {:ok, url}
+        end
+
+      {:ok, status, _headers, body} ->
+        Logger.warning("Tangled login returned #{status}: #{inspect(body)}")
+        {:error, {:login_failed, status}}
+
+      {:error, reason} ->
+        {:error, {:login_request_failed, reason}}
+    end
+  end
+
+  # Step 2: GET the PDS authorize URL, capture csrf-token cookie
+  defp step2_get_authorize(authorize_url) do
+    case http_request(:get, authorize_url, "", []) do
+      {:ok, status, resp_headers, _body} when status in [200, 302] ->
+        csrf_token = extract_cookie_value(resp_headers, "csrf-token")
+        pds_cookies = extract_set_cookies(resp_headers)
+
+        if csrf_token do
+          {:ok, csrf_token, pds_cookies}
+        else
+          {:error, :no_csrf_token}
+        end
+
+      {:ok, status, _headers, _body} ->
+        {:error, {:authorize_failed, status}}
+
+      {:error, reason} ->
+        {:error, {:authorize_request_failed, reason}}
+    end
+  end
+
+  # Step 3: POST sign-in to PDS with credentials
+  defp step3_sign_in(authorize_url, csrf_token, pds_cookies, state) do
+    # Derive the PDS base URL from the authorize URL
+    uri = URI.parse(authorize_url)
+    sign_in_url = "#{uri.scheme}://#{uri.authority}/@atproto/oauth-provider/~api/sign-in"
+
+    body = Jason.encode!(%{
+      "username" => state.handle,
+      "password" => state.password,
+      "remember" => false
+    })
+
+    cookie_string = format_cookies(pds_cookies, csrf_token)
+
+    headers = [
+      {"content-type", "application/json"},
+      {"cookie", cookie_string}
+    ]
+
+    case http_request(:post, sign_in_url, body, headers) do
+      {:ok, 200, _headers, resp_body} ->
+        case Jason.decode(resp_body) do
+          {:ok, %{"url" => url}} ->
+            {:ok, url}
+
+          {:ok, %{"consentRequired" => true}} ->
+            # TODO: handle consent flow if needed
+            {:error, :consent_required}
+
+          _ ->
+            {:error, :unexpected_sign_in_response}
+        end
+
+      {:ok, status, _headers, _body} ->
+        {:error, {:sign_in_failed, status}}
+
+      {:error, reason} ->
+        {:error, {:sign_in_request_failed, reason}}
+    end
+  end
+
+  # Step 4: Follow the callback URL to Tangled to get session cookies
+  defp step4_oauth_callback(callback_url) do
+    case http_request(:get, callback_url, "", []) do
+      {:ok, status, resp_headers, _body} when status in [200, 302] ->
+        session_cookie = extract_cookie_value(resp_headers, "appview-session-v2")
+        accounts_cookie = extract_cookie_value(resp_headers, "appview-accounts-v2")
+
+        if session_cookie do
+          cookie_parts = ["appview-session-v2=#{session_cookie}"]
+          cookie_parts = if accounts_cookie do
+            cookie_parts ++ ["appview-accounts-v2=#{accounts_cookie}"]
+          else
+            cookie_parts
+          end
+
+          {:ok, Enum.join(cookie_parts, "; ")}
+        else
+          {:error, :no_session_cookie}
+        end
+
+      {:ok, status, _headers, _body} ->
+        {:error, {:callback_failed, status}}
+
+      {:error, reason} ->
+        {:error, {:callback_request_failed, reason}}
+    end
+  end
+
+  # HTTP helpers - uses Tesla without redirect following
+
+  defp http_request(method, url, body, headers) do
+    request = %Tesla.Env{
+      method: method,
+      url: url,
+      body: body,
+      headers: headers
+    }
+
+    # Use Tesla.Adapter.Mint directly to avoid middleware redirect following
+    case Tesla.Adapter.Mint.call(request, []) do
+      {:ok, %Tesla.Env{status: status, headers: resp_headers, body: resp_body}} ->
+        {:ok, status, resp_headers, resp_body || ""}
+
+      {:error, reason} ->
+        {:error, reason}
+    end
+  end
+
+  defp get_header(headers, name) do
+    name_lower = String.downcase(name)
+
+    Enum.find_value(headers, fn {k, v} ->
+      if String.downcase(k) == name_lower, do: v
+    end)
+  end
+
+  defp extract_set_cookies(headers) do
+    headers
+    |> Enum.filter(fn {k, _v} -> String.downcase(k) == "set-cookie" end)
+    |> Enum.map(fn {_k, v} ->
+      [cookie_part | _] = String.split(v, ";")
+      cookie_part
+    end)
+  end
+
+  defp extract_cookie_value(headers, cookie_name) do
+    headers
+    |> Enum.filter(fn {k, _v} -> String.downcase(k) == "set-cookie" end)
+    |> Enum.find_value(fn {_k, v} ->
+      [cookie_part | _] = String.split(v, ";")
+
+      case String.split(cookie_part, "=", parts: 2) do
+        [^cookie_name, value] -> value
+        _ -> nil
+      end
+    end)
+  end
+
+  defp format_cookies(pds_cookies, csrf_token) do
+    cookies = pds_cookies ++ ["csrf-token=#{csrf_token}"]
+    Enum.join(cookies, "; ")
+  end
+end
diff --git a/appview/lib/atvouch/tap_handler.ex b/appview/lib/atvouch/tap_handler.ex
index ae998a3..0f07fe7 100644
--- a/appview/lib/atvouch/tap_handler.ex
+++ b/appview/lib/atvouch/tap_handler.ex
@@ -4,6 +4,7 @@ defmodule Atvouch.TapHandler do
 
   @vouch_collection "dev.atvouch.graph.vouch"
   @membership_collection "dev.atvouch.bot.membership"
+  @pull_collection "sh.tangled.repo.pull"
 
   @impl true
   def handle_record(%{collection: @vouch_collection, action: :create} = event) do
@@ -73,6 +74,13 @@ defmodule Atvouch.TapHandler do
     end
   end
 
+  def handle_record(%{collection: @pull_collection, action: :create} = event) do
+    process_pull(event)
+  end
+
+  # Ignore update/delete for pull records
+  def handle_record(%{collection: @pull_collection, action: _}), do: :ok
+
   def handle_record(event) do
     Logger.debug(
       "explicit skip for record event #{inspect(event)}, not handled by others. is tap misconfigured?"
@@ -220,4 +228,142 @@ defmodule Atvouch.TapHandler do
   defp extract_did_from_at_uri("at://" <> rest) do
     rest |> String.split("/") |> List.first()
   end
+
+  defp extract_rkey_from_at_uri(at_uri) do
+    at_uri |> String.split("/") |> List.last()
+  end
+
+  defp process_pull(event) do
+    repo_at_uri = event.record["target"]["repo"]
+    author_did = event.did
+
+    case Atvouch.Membership.one(repo_at_uri) do
+      nil ->
+        Logger.debug("No membership for repo #{repo_at_uri}, skipping pull")
+        :ok
+
+      membership ->
+        process_pull_for_membership(membership, author_did)
+    end
+  end
+
+  defp process_pull_for_membership(membership, author_did) do
+    repo_did = membership.repo_did
+    repo_rkey = extract_rkey_from_at_uri(membership.repo_at_uri)
+
+    # Resolve repo owner handle for Tangled URL construction
+    case Atvouch.Identity.one(repo_did) do
+      nil ->
+        Logger.warning("Cannot resolve handle for repo DID #{repo_did}, skipping pull")
+        :ok
+
+      %{handle: nil} ->
+        Logger.warning("No handle for repo DID #{repo_did}, skipping pull")
+        :ok
+
+      identity ->
+        process_pull_with_identity(membership, identity.handle, repo_rkey, author_did)
+    end
+  end
+
+  defp process_pull_with_identity(membership, repo_handle, repo_rkey, author_did) do
+    tangled_url = Atvouch.Tangled.Session.get_url()
+
+    case Atvouch.Tangled.Scraper.fetch_pulls(tangled_url, repo_handle, repo_rkey) do
+      {:ok, pulls} ->
+        process_new_pulls(membership, repo_handle, repo_rkey, pulls, author_did)
+
+      {:error, reason} ->
+        Logger.warning("Failed to fetch pulls for #{repo_handle}/#{repo_rkey}: #{inspect(reason)}")
+        :ok
+    end
+  end
+
+  defp process_new_pulls(membership, repo_handle, repo_rkey, pulls, author_did) do
+    maintainer_dids = Atvouch.Membership.maintainers(membership.repo_at_uri)
+    membership_received_at = membership.received_at
+
+    Enum.each(pulls, fn {pull_number, _title, created_at} ->
+      cond do
+        Atvouch.BotComment.exists?(membership.repo_at_uri, pull_number) ->
+          :skip
+
+        not pull_newer_than_membership?(created_at, membership_received_at) ->
+          Logger.debug("Pull ##{pull_number} created at #{created_at} is not newer than membership #{membership_received_at}, skipping")
+          :skip
+
+        true ->
+          comment_on_pull(
+            membership.repo_at_uri,
+            repo_handle,
+            repo_rkey,
+            pull_number,
+            author_did,
+            maintainer_dids
+          )
+      end
+    end)
+
+    :ok
+  end
+
+  defp pull_newer_than_membership?(pull_created_at, membership_received_at)
+       when is_binary(pull_created_at) and is_binary(membership_received_at) do
+    case {DateTime.from_iso8601(pull_created_at), DateTime.from_iso8601(membership_received_at)} do
+      {{:ok, pull_dt, _}, {:ok, membership_dt, _}} ->
+        DateTime.compare(pull_dt, membership_dt) == :gt
+
+      _ ->
+        Logger.warning("Could not parse timestamps for pull age check: pull=#{pull_created_at} membership=#{membership_received_at}")
+        false
+    end
+  end
+
+  # If the scraper couldn't extract a timestamp, skip to be safe
+  defp pull_newer_than_membership?(_pull_created_at, _membership_received_at), do: false
+
+  defp comment_on_pull(repo_at_uri, repo_handle, repo_rkey, pull_number, author_did, maintainer_dids) do
+    # Resolve author handle
+    author_handle =
+      case Atvouch.Identity.one(author_did) do
+        %{handle: h} when is_binary(h) -> h
+        _ -> nil
+      end
+
+    # Compute routes for each maintainer
+    maintainer_routes =
+      Enum.map(maintainer_dids, fn maintainer_did ->
+        route_result = Atvouch.Graph.find_routes(maintainer_did, author_did)
+
+        maintainer_handle =
+          case Atvouch.Identity.one(maintainer_did) do
+            %{handle: h} when is_binary(h) -> h
+            _ -> nil
+          end
+
+        {maintainer_did, maintainer_handle, route_result}
+      end)
+
+    comment = Atvouch.Tangled.CommentBuilder.build_comment(author_did, author_handle, maintainer_routes)
+
+    case Atvouch.Tangled.Client.post_comment(repo_handle, repo_rkey, pull_number, comment) do
+      :ok ->
+        now = DateTime.utc_now() |> DateTime.to_iso8601()
+
+        Atvouch.BotComment.create(%{
+          repo_at_uri: repo_at_uri,
+          pull_number: pull_number,
+          author_did: author_did,
+          commented_at: now
+        })
+
+        Logger.info("Posted vouch comment on #{repo_handle}/#{repo_rkey}##{pull_number}")
+        :ok
+
+      {:error, reason} ->
+        Logger.warning("Failed to post comment on #{repo_handle}/#{repo_rkey}##{pull_number}: #{inspect(reason)}")
+        :ok
+    end
+  end
+
 end
diff --git a/appview/mix.exs b/appview/mix.exs
index 5ba766a..b071371 100644
--- a/appview/mix.exs
+++ b/appview/mix.exs
@@ -36,7 +36,8 @@ defmodule Atvouch.MixProject do
       {:prometheus_ex, "~> 5.0"},
       {:gun, "~> 2.0"},
       {:cowlib, "~> 2.12", override: true},
-      {:atex, "~> 0.7", app: false}
+      {:atex, "~> 0.7", app: false},
+      {:floki, "~> 0.38.0"}
     ]
   end
 
diff --git a/appview/mix.lock b/appview/mix.lock
index e9d065b..bcd0edd 100644
--- a/appview/mix.lock
+++ b/appview/mix.lock
@@ -16,6 +16,7 @@
   "ex_cldr": {:hex, :ex_cldr, "2.47.1", "2dd2f0da2d5720bf413e0320cfd0ea7f0259a888c33e727c5f0db6bab3380252", [:mix], [{:cldr_utils, "~> 2.28", [hex: :cldr_utils, repo: "hexpm", optional: false]}, {:decimal, "~> 1.6 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: false]}, {:gettext, "~> 0.19 or ~> 1.0", [hex: :gettext, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: true]}, {:nimble_parsec, "~> 0.5 or ~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: true]}], "hexpm", "2555d6599d16311a096d8cb2d02e9dc3011ca02abbae446817d4f445a286c758"},
   "exqlite": {:hex, :exqlite, "0.35.0", "90741471945db42b66cd8ca3149af317f00c22c769cc6b06e8b0a08c5924aae5", [:make, :mix], [{:cc_precompiler, "~> 0.1", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:db_connection, "~> 2.1", [hex: :db_connection, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.8", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:table, "~> 0.1.0", [hex: :table, repo: "hexpm", optional: true]}], "hexpm", "a009e303767a28443e546ac8aab2539429f605e9acdc38bd43f3b13f1568bca9"},
   "finch": {:hex, :finch, "0.21.0", "b1c3b2d48af02d0c66d2a9ebfb5622be5c5ecd62937cf79a88a7f98d48a8290c", [:mix], [{:mime, "~> 1.0 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:mint, "~> 1.6.2 or ~> 1.7", [hex: :mint, repo: "hexpm", optional: false]}, {:nimble_options, "~> 0.4 or ~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}, {:telemetry, "~> 0.4 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "87dc6e169794cb2570f75841a19da99cfde834249568f2a5b121b809588a4377"},
+  "floki": {:hex, :floki, "0.38.1", "f002ccac94b3bcb21d40d9b34cc2cc9fd88a8311879120330075b5dde657ebee", [:mix], [], "hexpm", "e744bf0db7ee34b2c8b62767f04071107af0516a81144b9a2f73fe0494200e5b"},
   "gun": {:hex, :gun, "2.2.0", "b8f6b7d417e277d4c2b0dc3c07dfdf892447b087f1cc1caff9c0f556b884e33d", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "76022700c64287feb4df93a1795cff6741b83fb37415c40c34c38d2a4645261a"},
   "hpax": {:hex, :hpax, "1.0.3", "ed67ef51ad4df91e75cc6a1494f851850c0bd98ebc0be6e81b026e765ee535aa", [:mix], [], "hexpm", "8eab6e1cfa8d5918c2ce4ba43588e894af35dbd8e91e6e55c817bca5847df34a"},
   "jason": {:hex, :jason, "1.4.4", "b9226785a9aa77b6857ca22832cffa5d5011a667207eb2a0ad56adb5db443b8a", [:mix], [{:decimal, "~> 1.0 or ~> 2.0", [hex: :decimal, repo: "hexpm", optional: true]}], "hexpm", "c5eb0cab91f094599f94d55bc63409236a8ec69a21a67814529e8d5f6cc90b3b"},
diff --git a/appview/priv/repo/migrations/20260319000000_add_bot_comments.exs b/appview/priv/repo/migrations/20260319000000_add_bot_comments.exs
new file mode 100644
index 0000000..2b59679
--- /dev/null
+++ b/appview/priv/repo/migrations/20260319000000_add_bot_comments.exs
@@ -0,0 +1,15 @@
+defmodule Atvouch.Repo.Migrations.AddBotComments do
+  use Ecto.Migration
+
+  def change do
+    create table(:bot_comments) do
+      add(:repo_at_uri, :string, null: false)
+      add(:pull_number, :integer, null: false)
+      add(:author_did, :string, null: false)
+      add(:commented_at, :string, null: false)
+    end
+
+    create unique_index(:bot_comments, [:repo_at_uri, :pull_number], name: :bot_comments_repo_pull)
+    create index(:bot_comments, [:repo_at_uri])
+  end
+end
diff --git a/appview/test/atvouch/pull_handler_test.exs b/appview/test/atvouch/pull_handler_test.exs
new file mode 100644
index 0000000..518cba0
--- /dev/null
+++ b/appview/test/atvouch/pull_handler_test.exs
@@ -0,0 +1,442 @@
+defmodule Atvouch.PullHandlerTest do
+  use ExUnit.Case
+
+  setup do
+    :ok = Ecto.Adapters.SQL.Sandbox.checkout(Atvouch.Repo)
+    Ecto.Adapters.SQL.Sandbox.mode(Atvouch.Repo, {:shared, self()})
+
+    # Start fake Tangled server
+    {tangled_pid, tangled_port, state_agent} =
+      Atvouch.Test.FakeTangledServer.start(self())
+
+    # Start fake PDS server
+    {pds_pid, pds_port} =
+      Atvouch.Test.FakePdsServer.start(self(),
+        expected_username: "bot.test",
+        expected_password: "test-password",
+        callback_url: "http://127.0.0.1:#{tangled_port}/oauth/callback?code=test&state=test"
+      )
+
+    # Wire them together
+    Atvouch.Test.FakeTangledServer.set_pds_url(state_agent, "http://127.0.0.1:#{pds_port}")
+
+    tangled_url = "http://127.0.0.1:#{tangled_port}"
+
+    # Ensure no leftover session from previous test
+    case GenServer.whereis(Atvouch.Tangled.Session) do
+      nil -> :ok
+      old_pid ->
+        GenServer.stop(old_pid, :normal, 1_000)
+        Process.sleep(10)
+    end
+
+    # Start Session GenServer with the global name so TapHandler can find it
+    {:ok, session_pid} =
+      Atvouch.Tangled.Session.start_link(
+        handle: "bot.test",
+        password: "test-password",
+        tangled_url: tangled_url,
+        name: Atvouch.Tangled.Session
+      )
+
+    # Configure tangled settings in app env
+    prev_tangled = Application.get_env(:atvouch, :tangled)
+
+    Application.put_env(:atvouch, :tangled,
+      url: tangled_url,
+      bot_handle: "bot.test",
+      bot_password: "test-password"
+    )
+
+    # Start fake TAP server
+    {tap_pid, tap_port} = Atvouch.Test.FakeTapServer.start(self())
+
+    on_exit(fn ->
+      Application.put_env(:atvouch, :tangled, prev_tangled)
+
+      for pid <- [pds_pid, tangled_pid, tap_pid] do
+        try do
+          Supervisor.stop(pid, :normal, 1_000)
+        catch
+          :exit, _ -> :ok
+        end
+      end
+
+      try do
+        GenServer.stop(session_pid, :normal, 1_000)
+      catch
+        :exit, _ -> :ok
+      end
+    end)
+
+    {:ok,
+     tap_port: tap_port,
+     tangled_port: tangled_port,
+     state_agent: state_agent}
+  end
+
+  defp setup_vouch_graph do
+    # Create identities
+    {:ok, _} = Atvouch.Identity.create(%{did: "did:plc:maintainer1", handle: "maintainer1.test"})
+    {:ok, _} = Atvouch.Identity.create(%{did: "did:plc:maintainer2", handle: "maintainer2.test"})
+    {:ok, _} = Atvouch.Identity.create(%{did: "did:plc:author", handle: "author.test"})
+    {:ok, _} = Atvouch.Identity.create(%{did: "did:plc:middle", handle: "middle.test"})
+    {:ok, _} = Atvouch.Identity.create(%{did: "did:plc:repoowner", handle: "repoowner.test"})
+
+    # Create vouches: maintainer1 -> author (direct), maintainer2 -> middle -> author (2-hop)
+    {:ok, _} =
+      Atvouch.Vouch.create(%{
+        at_uri: "at://did:plc:maintainer1/dev.atvouch.graph.vouch/did:plc:author",
+        creator_did: "did:plc:maintainer1",
+        target_did: "did:plc:author",
+        original_created_at: "2026-03-01T00:00:00Z",
+        remote_created_at: "2026-03-01T00:00:00Z",
+        at_cid: "bafytest1",
+        live: true
+      })
+
+    {:ok, _} =
+      Atvouch.Vouch.create(%{
+        at_uri: "at://did:plc:maintainer2/dev.atvouch.graph.vouch/did:plc:middle",
+        creator_did: "did:plc:maintainer2",
+        target_did: "did:plc:middle",
+        original_created_at: "2026-03-01T00:00:00Z",
+        remote_created_at: "2026-03-01T00:00:00Z",
+        at_cid: "bafytest2",
+        live: true
+      })
+
+    {:ok, _} =
+      Atvouch.Vouch.create(%{
+        at_uri: "at://did:plc:middle/dev.atvouch.graph.vouch/did:plc:author",
+        creator_did: "did:plc:middle",
+        target_did: "did:plc:author",
+        original_created_at: "2026-03-01T00:00:00Z",
+        remote_created_at: "2026-03-01T00:00:00Z",
+        at_cid: "bafytest3",
+        live: true
+      })
+
+    # Create membership for the repo
+    repo_at_uri = "at://did:plc:repoowner/sh.tangled.repo/3abc123"
+
+    {:ok, _} =
+      Atvouch.Membership.create(
+        %{
+          repo_at_uri: repo_at_uri,
+          source_did: "did:plc:repoowner",
+          repo_did: "did:plc:repoowner",
+          remote_created_at: "2026-03-01T00:00:00Z",
+          received_at: "2026-03-01T00:00:00Z"
+        },
+        ["did:plc:maintainer1", "did:plc:maintainer2"]
+      )
+
+    repo_at_uri
+  end
+
+  defp pulls_html(handle, rkey, opts \\ []) do
+    datetime = Keyword.get(opts, :datetime, "2026-03-19T10:00:00+00:00")
+
+    """
+    <html><body>
+      <div class="flex flex-col gap-2 mt-2">
+        <div class="rounded bg-white dark:bg-gray-800">
+          <div class="px-6 py-4">
+            <div class="pb-2">
+              <a href="/#{handle}/#{rkey}/pulls/1" class="dark:text-white">
+                Fix tests <span class="text-gray-500">#1</span>
+              </a>
+            </div>
+            <div class="text-sm text-gray-500">
+              <span><time datetime="#{datetime}">some time ago</time></span>
+            </div>
+          </div>
+        </div>
+      </div>
+    </body></html>
+    """
+  end
+
+  test "processes pull event, computes routes, and posts comment", %{
+    tap_port: tap_port,
+    state_agent: state_agent
+  } do
+    repo_at_uri = setup_vouch_graph()
+
+    # Set up pulls page to show PR #1
+    Atvouch.Test.FakeTangledServer.set_pulls_html(
+      state_agent,
+      "repoowner.test",
+      "3abc123",
+      pulls_html("repoowner.test", "3abc123")
+    )
+
+    # Start TAP socket
+    {:ok, _pid} =
+      Atvouch.Tap.Socket.start_link(
+        uri: "ws://localhost:#{tap_port}/channel",
+        handler: Atvouch.TapHandler,
+        password: "123",
+        name: :"pull_handler_test_#{tap_port}"
+      )
+
+    assert_receive {:ws_connected, ws_pid}, 5_000
+
+    # Send a pull create event
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, %{
+      "id" => 700,
+      "type" => "record",
+      "record" => %{
+        "action" => "create",
+        "did" => "did:plc:author",
+        "rev" => "3mgmqjki6sz2n",
+        "collection" => "sh.tangled.repo.pull",
+        "rkey" => "3pull123",
+        "record" => %{
+          "$type" => "sh.tangled.repo.pull",
+          "title" => "Fix tests",
+          "createdAt" => "2026-03-19T10:00:00Z",
+          "target" => %{
+            "repo" => repo_at_uri,
+            "branch" => "main"
+          }
+        },
+        "cid" => "bafypull1",
+        "live" => true
+      }
+    })
+
+    # Wait for ack
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 700}}, 10_000
+
+    # Verify comment was posted to Tangled
+    assert_receive {:tangled_comment, comment}, 10_000
+    assert comment.handle == "repoowner.test"
+    assert comment.rkey == "3abc123"
+    assert comment.number == 1
+    assert comment.body =~ "atvouch routes for @author.test"
+    assert comment.body =~ "@maintainer1.test"
+    assert comment.body =~ "direct vouch"
+    assert comment.body =~ "@maintainer2.test"
+
+    # Verify dedup record was created
+    assert Atvouch.BotComment.exists?(repo_at_uri, 1)
+  end
+
+  test "skips pull for repo without membership", %{tap_port: tap_port} do
+    {:ok, _pid} =
+      Atvouch.Tap.Socket.start_link(
+        uri: "ws://localhost:#{tap_port}/channel",
+        handler: Atvouch.TapHandler,
+        password: "123",
+        name: :"pull_no_membership_test_#{tap_port}"
+      )
+
+    assert_receive {:ws_connected, ws_pid}, 5_000
+
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, %{
+      "id" => 701,
+      "type" => "record",
+      "record" => %{
+        "action" => "create",
+        "did" => "did:plc:someone",
+        "rev" => "3mgmqjki6sz2n",
+        "collection" => "sh.tangled.repo.pull",
+        "rkey" => "3pull456",
+        "record" => %{
+          "$type" => "sh.tangled.repo.pull",
+          "title" => "Some PR",
+          "createdAt" => "2026-03-19T10:00:00Z",
+          "target" => %{
+            "repo" => "at://did:plc:nobody/sh.tangled.repo/3xyz999",
+            "branch" => "main"
+          }
+        },
+        "cid" => "bafypull2",
+        "live" => true
+      }
+    })
+
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 701}}, 5_000
+
+    # No comment should be posted
+    refute_receive {:tangled_comment, _}, 500
+  end
+
+  test "skips pull older than membership timestamp", %{
+    tap_port: tap_port,
+    state_agent: state_agent
+  } do
+    repo_at_uri = setup_vouch_graph()
+
+    # Set pulls HTML with a timestamp BEFORE membership received_at (2026-03-01)
+    Atvouch.Test.FakeTangledServer.set_pulls_html(
+      state_agent,
+      "repoowner.test",
+      "3abc123",
+      pulls_html("repoowner.test", "3abc123", datetime: "2026-02-15T10:00:00+00:00")
+    )
+
+    {:ok, _pid} =
+      Atvouch.Tap.Socket.start_link(
+        uri: "ws://localhost:#{tap_port}/channel",
+        handler: Atvouch.TapHandler,
+        password: "123",
+        name: :"pull_old_pr_test_#{tap_port}"
+      )
+
+    assert_receive {:ws_connected, ws_pid}, 5_000
+
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, %{
+      "id" => 710,
+      "type" => "record",
+      "record" => %{
+        "action" => "create",
+        "did" => "did:plc:author",
+        "rev" => "3mgmqjki6sz2n",
+        "collection" => "sh.tangled.repo.pull",
+        "rkey" => "3pullold",
+        "record" => %{
+          "$type" => "sh.tangled.repo.pull",
+          "title" => "Old PR before membership",
+          "createdAt" => "2026-03-19T10:00:00Z",
+          "target" => %{
+            "repo" => repo_at_uri,
+            "branch" => "main"
+          }
+        },
+        "cid" => "bafypullold",
+        "live" => true
+      }
+    })
+
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 710}}, 5_000
+
+    # No comment - the scraped PR timestamp is older than membership
+    refute_receive {:tangled_comment, _}, 500
+    refute Atvouch.BotComment.exists?(repo_at_uri, 1)
+  end
+
+  test "skips pull with same timestamp as membership", %{
+    tap_port: tap_port,
+    state_agent: state_agent
+  } do
+    repo_at_uri = setup_vouch_graph()
+
+    # Set pulls HTML with timestamp EQUAL to membership received_at
+    Atvouch.Test.FakeTangledServer.set_pulls_html(
+      state_agent,
+      "repoowner.test",
+      "3abc123",
+      pulls_html("repoowner.test", "3abc123", datetime: "2026-03-01T00:00:00+00:00")
+    )
+
+    {:ok, _pid} =
+      Atvouch.Tap.Socket.start_link(
+        uri: "ws://localhost:#{tap_port}/channel",
+        handler: Atvouch.TapHandler,
+        password: "123",
+        name: :"pull_same_ts_test_#{tap_port}"
+      )
+
+    assert_receive {:ws_connected, ws_pid}, 5_000
+
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, %{
+      "id" => 711,
+      "type" => "record",
+      "record" => %{
+        "action" => "create",
+        "did" => "did:plc:author",
+        "rev" => "3mgmqjki6sz2n",
+        "collection" => "sh.tangled.repo.pull",
+        "rkey" => "3pullsame",
+        "record" => %{
+          "$type" => "sh.tangled.repo.pull",
+          "title" => "PR at exact membership time",
+          "createdAt" => "2026-03-19T10:00:00Z",
+          "target" => %{
+            "repo" => repo_at_uri,
+            "branch" => "main"
+          }
+        },
+        "cid" => "bafypullsame",
+        "live" => true
+      }
+    })
+
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 711}}, 5_000
+
+    # No comment - equal timestamp is NOT greater than, so skip
+    refute_receive {:tangled_comment, _}, 500
+  end
+
+  test "duplicate pull event does not post again", %{
+    tap_port: tap_port,
+    state_agent: state_agent
+  } do
+    repo_at_uri = setup_vouch_graph()
+
+    Atvouch.Test.FakeTangledServer.set_pulls_html(
+      state_agent,
+      "repoowner.test",
+      "3abc123",
+      pulls_html("repoowner.test", "3abc123")
+    )
+
+    {:ok, _pid} =
+      Atvouch.Tap.Socket.start_link(
+        uri: "ws://localhost:#{tap_port}/channel",
+        handler: Atvouch.TapHandler,
+        password: "123",
+        name: :"pull_dedup_test_#{tap_port}"
+      )
+
+    assert_receive {:ws_connected, ws_pid}, 5_000
+
+    pull_event = %{
+      "type" => "record",
+      "record" => %{
+        "action" => "create",
+        "did" => "did:plc:author",
+        "rev" => "3mgmqjki6sz2n",
+        "collection" => "sh.tangled.repo.pull",
+        "rkey" => "3pull789",
+        "record" => %{
+          "$type" => "sh.tangled.repo.pull",
+          "title" => "Fix tests",
+          "createdAt" => "2026-03-19T10:00:00Z",
+          "target" => %{
+            "repo" => repo_at_uri,
+            "branch" => "main"
+          }
+        },
+        "cid" => "bafypull3",
+        "live" => true
+      }
+    }
+
+    # First event
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, Map.put(pull_event, "id", 702))
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 702}}, 10_000
+    assert_receive {:tangled_comment, _}, 10_000
+
+    # Drain remaining messages
+    drain_messages()
+
+    # Second event for same repo
+    Atvouch.Test.FakeTapServer.send_event(ws_pid, Map.put(pull_event, "id", 703))
+    assert_receive {:ws_message, %{"type" => "ack", "id" => 703}}, 10_000
+
+    # Should NOT post another comment
+    refute_receive {:tangled_comment, _}, 1_000
+  end
+
+  defp drain_messages do
+    receive do
+      _ -> drain_messages()
+    after
+      100 -> :ok
+    end
+  end
+end
diff --git a/appview/test/atvouch/tangled/client_test.exs b/appview/test/atvouch/tangled/client_test.exs
new file mode 100644
index 0000000..d4a4b93
--- /dev/null
+++ b/appview/test/atvouch/tangled/client_test.exs
@@ -0,0 +1,68 @@
+defmodule Atvouch.Tangled.ClientTest do
+  use ExUnit.Case
+
+  alias Atvouch.Tangled.Client
+
+  setup do
+    # Start Tangled server
+    {tangled_pid, tangled_port, state_agent} =
+      Atvouch.Test.FakeTangledServer.start(self())
+
+    # Start PDS server with callback pointing to tangled
+    {pds_pid, pds_port} =
+      Atvouch.Test.FakePdsServer.start(self(),
+        expected_username: "bot.test",
+        expected_password: "test-password",
+        callback_url: "http://127.0.0.1:#{tangled_port}/oauth/callback?code=test&state=test"
+      )
+
+    # Set PDS URL on tangled
+    Atvouch.Test.FakeTangledServer.set_pds_url(state_agent, "http://127.0.0.1:#{pds_port}")
+
+    # Start session GenServer
+    {:ok, session_pid} =
+      Atvouch.Tangled.Session.start_link(
+        handle: "bot.test",
+        password: "test-password",
+        tangled_url: "http://127.0.0.1:#{tangled_port}",
+        name: :"client_test_session_#{tangled_port}"
+      )
+
+    on_exit(fn ->
+      for pid <- [pds_pid, tangled_pid] do
+        try do
+          Supervisor.stop(pid, :normal, 1_000)
+        catch
+          :exit, _ -> :ok
+        end
+      end
+
+      try do
+        GenServer.stop(session_pid, :normal, 1_000)
+      catch
+        :exit, _ -> :ok
+      end
+    end)
+
+    {:ok,
+     tangled_port: tangled_port,
+     session: session_pid,
+     state_agent: state_agent}
+  end
+
+  test "successfully posts a comment", %{session: session} do
+    result =
+      Client.post_comment("alice.test", "3abc123", 1, "Hello from bot!",
+        session: session
+      )
+
+    assert result == :ok
+
+    assert_receive {:tangled_comment, comment}, 5_000
+    assert comment.handle == "alice.test"
+    assert comment.rkey == "3abc123"
+    assert comment.number == 1
+    assert comment.body == "Hello from bot!"
+    assert String.contains?(comment.cookies, "appview-session-v2=")
+  end
+end
diff --git a/appview/test/atvouch/tangled/comment_builder_test.exs b/appview/test/atvouch/tangled/comment_builder_test.exs
new file mode 100644
index 0000000..f73afa8
--- /dev/null
+++ b/appview/test/atvouch/tangled/comment_builder_test.exs
@@ -0,0 +1,99 @@
+defmodule Atvouch.Tangled.CommentBuilderTest do
+  use ExUnit.Case, async: true
+
+  alias Atvouch.Tangled.CommentBuilder
+
+  @alice_did "did:plc:alice"
+  @bob_did "did:plc:bob"
+  @carol_did "did:plc:carol"
+  @dave_did "did:plc:dave"
+  @author_did "did:plc:author"
+
+  test "formats direct vouch" do
+    routes = [{@alice_did, "alice.test", {:direct, @author_did}}]
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~ "## atvouch routes for @author.test"
+    assert result =~ "**@alice.test**: direct vouch"
+    assert result =~ "generated by [atvouch]"
+  end
+
+  test "formats multi-hop routes" do
+    routes = [
+      {@alice_did, "alice.test",
+       {:routes, @author_did, [[@alice_did, @bob_did, @author_did]]}}
+    ]
+
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~ "**@alice.test**:"
+    assert result =~ "- `#{@alice_did}` -> `#{@bob_did}` -> `#{@author_did}`"
+  end
+
+  test "formats no routes found" do
+    routes = [{@alice_did, "alice.test", {:routes, @author_did, []}}]
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~ "**@alice.test**: no routes found"
+  end
+
+  test "formats multiple maintainers with mixed results" do
+    routes = [
+      {@alice_did, "alice.test", {:direct, @author_did}},
+      {@bob_did, "bob.test",
+       {:routes, @author_did, [[@bob_did, @carol_did, @author_did]]}},
+      {@dave_did, "dave.test", {:routes, @author_did, []}}
+    ]
+
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~ "**@alice.test**: direct vouch"
+    assert result =~ "**@bob.test**:"
+    assert result =~ "- `#{@bob_did}` -> `#{@carol_did}` -> `#{@author_did}`"
+    assert result =~ "**@dave.test**: no routes found"
+  end
+
+  test "falls back to DID when handle is nil" do
+    routes = [{@alice_did, nil, {:direct, @author_did}}]
+    result = CommentBuilder.build_comment(@author_did, nil, routes)
+
+    assert result =~ "## atvouch routes for `#{@author_did}`"
+    assert result =~ "**`#{@alice_did}`**: direct vouch"
+  end
+
+  test "falls back to DID when handle is empty string" do
+    routes = [{@alice_did, "", {:direct, @author_did}}]
+    result = CommentBuilder.build_comment(@author_did, "", routes)
+
+    assert result =~ "## atvouch routes for `#{@author_did}`"
+    assert result =~ "**`#{@alice_did}`**: direct vouch"
+  end
+
+  test "formats three-hop path" do
+    routes = [
+      {@alice_did, "alice.test",
+       {:routes, @author_did, [[@alice_did, @bob_did, @carol_did, @author_did]]}}
+    ]
+
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~
+             "- `#{@alice_did}` -> `#{@bob_did}` -> `#{@carol_did}` -> `#{@author_did}`"
+  end
+
+  test "formats multiple routes for one maintainer" do
+    routes = [
+      {@alice_did, "alice.test",
+       {:routes, @author_did,
+        [
+          [@alice_did, @bob_did, @author_did],
+          [@alice_did, @carol_did, @author_did]
+        ]}}
+    ]
+
+    result = CommentBuilder.build_comment(@author_did, "author.test", routes)
+
+    assert result =~ "- `#{@alice_did}` -> `#{@bob_did}` -> `#{@author_did}`"
+    assert result =~ "- `#{@alice_did}` -> `#{@carol_did}` -> `#{@author_did}`"
+  end
+end
diff --git a/appview/test/atvouch/tangled/scraper_test.exs b/appview/test/atvouch/tangled/scraper_test.exs
new file mode 100644
index 0000000..f7816a0
--- /dev/null
+++ b/appview/test/atvouch/tangled/scraper_test.exs
@@ -0,0 +1,145 @@
+defmodule Atvouch.Tangled.ScraperTest do
+  use ExUnit.Case, async: true
+
+  alias Atvouch.Tangled.Scraper
+
+  # Realistic Tangled pulls page structure
+  defp pr_entry(handle, rkey, number, title, datetime) do
+    """
+    <div class="rounded bg-white dark:bg-gray-800">
+      <div class="px-6 py-4">
+        <div class="pb-2">
+          <a href="/#{handle}/#{rkey}/pulls/#{number}" class="dark:text-white">
+            #{title}
+            <span class="text-gray-500">##{number}</span>
+          </a>
+        </div>
+        <div class="text-sm text-gray-500">
+          <span class="inline-flex items-center"><span class="text-white">open</span></span>
+          <span><time datetime="#{datetime}">some time ago</time></span>
+        </div>
+      </div>
+    </div>
+    """
+  end
+
+  defp pr_entry_no_time(handle, rkey, number, title) do
+    """
+    <div class="rounded bg-white dark:bg-gray-800">
+      <div class="px-6 py-4">
+        <div class="pb-2">
+          <a href="/#{handle}/#{rkey}/pulls/#{number}" class="dark:text-white">
+            #{title}
+            <span class="text-gray-500">##{number}</span>
+          </a>
+        </div>
+      </div>
+    </div>
+    """
+  end
+
+  defp wrap_page(entries) do
+    """
+    <html><body>
+      <div class="flex flex-col gap-2 mt-2">
+        #{entries}
+      </div>
+    </body></html>
+    """
+  end
+
+  test "parses pulls page HTML to extract PR list with timestamps" do
+    html =
+      wrap_page(
+        pr_entry("alice.test", "3abc123", 3, "Fix broken tests", "2026-03-19T14:37:19+00:00") <>
+          pr_entry("alice.test", "3abc123", 2, "Add new feature", "2026-03-10T16:25:26+00:00") <>
+          pr_entry("alice.test", "3abc123", 1, "Initial setup", "2026-02-15T10:00:00+00:00")
+      )
+
+    pulls = Scraper.parse_pulls_page(html)
+
+    assert length(pulls) == 3
+    {3, title3, ts3} = Enum.at(pulls, 0)
+    assert title3 =~ "Fix broken tests"
+    assert ts3 == "2026-03-19T14:37:19+00:00"
+
+    {2, title2, ts2} = Enum.at(pulls, 1)
+    assert title2 =~ "Add new feature"
+    assert ts2 == "2026-03-10T16:25:26+00:00"
+
+    {1, title1, ts1} = Enum.at(pulls, 2)
+    assert title1 =~ "Initial setup"
+    assert ts1 == "2026-02-15T10:00:00+00:00"
+  end
+
+  test "handles empty pulls page" do
+    html = wrap_page("<p>No pull requests found.</p>")
+    pulls = Scraper.parse_pulls_page(html)
+    assert pulls == []
+  end
+
+  test "returns pulls sorted by number descending" do
+    html =
+      wrap_page(
+        pr_entry("alice.test", "3abc123", 1, "First", "2026-03-01T00:00:00+00:00") <>
+          pr_entry("alice.test", "3abc123", 5, "Fifth", "2026-03-15T00:00:00+00:00") <>
+          pr_entry("alice.test", "3abc123", 3, "Third", "2026-03-10T00:00:00+00:00")
+      )
+
+    pulls = Scraper.parse_pulls_page(html)
+    numbers = Enum.map(pulls, fn {n, _, _} -> n end)
+    assert numbers == [5, 3, 1]
+  end
+
+  test "returns nil created_at when no time element in PR entry" do
+    html = wrap_page(pr_entry_no_time("alice.test", "3abc123", 1, "No timestamp PR"))
+    pulls = Scraper.parse_pulls_page(html)
+    assert [{1, _, nil}] = pulls
+  end
+
+  test "decodes HTML entities in datetime attribute" do
+    # Floki decodes &#43; automatically, but test that the full pipeline works
+    html =
+      wrap_page(
+        pr_entry("alice.test", "3abc123", 1, "PR", "2026-03-20T22:16:41&#43;00:00")
+      )
+
+    [{1, _, created_at}] = Scraper.parse_pulls_page(html)
+    assert created_at == "2026-03-20T22:16:41+00:00"
+  end
+
+  test "parses real Tangled HTML structure" do
+    # Snippet matching actual Tangled HTML from tangled.org/core/pulls
+    html = """
+    <html><body>
+    <div class="flex flex-col gap-2 mt-2">
+      <div class="rounded bg-white dark:bg-gray-800">
+        <div class="px-6 py-4 z-5">
+          <div class="pb-2">
+            <a href="/tangled.org/core/pulls/1189" class="dark:text-white">
+              spindled/engine: store workflow logs in s3
+              <span class="text-gray-500 dark:text-gray-400">#1189</span>
+            </a>
+          </div>
+          <div class="text-sm text-gray-500 dark:text-gray-400 flex flex-wrap items-center gap-1">
+            <span class="inline-flex items-center rounded px-2 py-[5px] bg-green-600 dark:bg-green-700 text-sm">
+              <span class="text-white">open</span>
+            </span>
+            <span class="ml-1">
+              <a href="/jobala.tngl.sh">jobala.tngl.sh</a>
+            </span>
+            <span class="before:content-['·']">
+              <time datetime="2026-03-20T22:16:41+00:00" title="Mar 20, 2026, 10:16 PM UTC">2 hours ago</time>
+            </span>
+          </div>
+        </div>
+      </div>
+    </div>
+    </body></html>
+    """
+
+    pulls = Scraper.parse_pulls_page(html)
+    assert [{1189, title, "2026-03-20T22:16:41+00:00"}] = pulls
+    assert title =~ "spindled/engine: store workflow logs in s3"
+  end
+end
diff --git a/appview/test/atvouch/tangled/session_test.exs b/appview/test/atvouch/tangled/session_test.exs
new file mode 100644
index 0000000..a9ef5f6
--- /dev/null
+++ b/appview/test/atvouch/tangled/session_test.exs
@@ -0,0 +1,117 @@
+defmodule Atvouch.Tangled.SessionTest do
+  use ExUnit.Case
+
+  alias Atvouch.Tangled.Session
+
+  setup do
+    # Start Tangled server (PDS URL will be set after PDS starts)
+    {tangled_pid, tangled_port, state_agent} =
+      Atvouch.Test.FakeTangledServer.start(self())
+
+    # Start PDS server with callback URL pointing to tangled
+    {pds_pid, pds_port} =
+      Atvouch.Test.FakePdsServer.start(self(),
+        expected_username: "bot.test",
+        expected_password: "test-password",
+        callback_url: "http://127.0.0.1:#{tangled_port}/oauth/callback?code=test-code&state=test-state"
+      )
+
+    # Now set the PDS URL on the tangled server
+    Atvouch.Test.FakeTangledServer.set_pds_url(state_agent, "http://127.0.0.1:#{pds_port}")
+
+    on_exit(fn ->
+      for pid <- [pds_pid, tangled_pid] do
+        try do
+          Supervisor.stop(pid, :normal, 1_000)
+        catch
+          :exit, _ -> :ok
+        end
+      end
+    end)
+
+    {:ok, tangled_port: tangled_port}
+  end
+
+  test "successful login returns cookies", %{tangled_port: tangled_port} do
+    {:ok, pid} =
+      Session.start_link(
+        handle: "bot.test",
+        password: "test-password",
+        tangled_url: "http://127.0.0.1:#{tangled_port}",
+        name: :"session_test_#{tangled_port}"
+      )
+
+    result = Session.get_cookies(pid)
+    assert {:ok, cookies} = result
+    assert String.contains?(cookies, "appview-session-v2=")
+  end
+
+  test "cookies are cached on second call", %{tangled_port: tangled_port} do
+    {:ok, pid} =
+      Session.start_link(
+        handle: "bot.test",
+        password: "test-password",
+        tangled_url: "http://127.0.0.1:#{tangled_port}",
+        name: :"session_cache_test_#{tangled_port}"
+      )
+
+    {:ok, cookies1} = Session.get_cookies(pid)
+
+    # Drain messages from first login
+    drain_messages()
+
+    {:ok, cookies2} = Session.get_cookies(pid)
+
+    assert cookies1 == cookies2
+
+    # Should NOT have received another login attempt
+    refute_received {:tangled_login, _}
+  end
+
+  test "invalidate forces re-login", %{tangled_port: tangled_port} do
+    {:ok, pid} =
+      Session.start_link(
+        handle: "bot.test",
+        password: "test-password",
+        tangled_url: "http://127.0.0.1:#{tangled_port}",
+        name: :"session_invalidate_test_#{tangled_port}"
+      )
+
+    {:ok, _cookies1} = Session.get_cookies(pid)
+
+    # Drain messages from first login
+    drain_messages()
+
+    Session.invalidate(pid)
+    Process.sleep(50)
+
+    {:ok, _cookies2} = Session.get_cookies(pid)
+
+    # Should have received a second login
+    assert_received {:tangled_login, _}
+  end
+
+  test "failed login returns error without crashing", %{tangled_port: tangled_port} do
+    {:ok, pid} =
+      Session.start_link(
+        handle: "bot.test",
+        password: "wrong-password",
+        tangled_url: "http://127.0.0.1:#{tangled_port}",
+        name: :"session_fail_test_#{tangled_port}"
+      )
+
+    result = Session.get_cookies(pid)
+    assert {:error, _reason} = result
+
+    # GenServer should still be alive
+    assert Process.alive?(pid)
+  end
+
+  defp drain_messages do
+    receive do
+      _ -> drain_messages()
+    after
+      50 -> :ok
+    end
+  end
+end
diff --git a/appview/test/support/fake_pds_server.ex b/appview/test/support/fake_pds_server.ex
new file mode 100644
index 0000000..3d42ede
--- /dev/null
+++ b/appview/test/support/fake_pds_server.ex
@@ -0,0 +1,88 @@
+defmodule Atvouch.Test.FakePdsServer do
+  @moduledoc """
+  Fake PDS server for testing the AT Protocol OAuth sign-in flow.
+  """
+
+  defmodule Router do
+    use Plug.Router
+
+    plug(:match)
+    plug(:dispatch)
+
+    # OAuth authorize page - sets CSRF cookie and returns 200
+    get "/@atproto/oauth-provider/authorize" do
+      test_pid = conn.private[:test_pid]
+      send(test_pid, {:pds_authorize, conn.query_string})
+
+      conn
+      |> put_resp_header("set-cookie", "csrf-token=test-csrf-token; Path=/; HttpOnly")
+      |> put_resp_content_type("text/html")
+      |> send_resp(200, "<html><body>Authorize</body></html>")
+    end
+
+    # Sign-in API endpoint
+    post "/@atproto/oauth-provider/~api/sign-in" do
+      test_pid = conn.private[:test_pid]
+      callback_url = conn.private[:callback_url]
+      {:ok, body, conn} = Plug.Conn.read_body(conn)
+      params = Jason.decode!(body)
+
+      send(test_pid, {:pds_sign_in, params})
+
+      valid_username = conn.private[:expected_username]
+      valid_password = conn.private[:expected_password]
+
+      if params["username"] == valid_username and params["password"] == valid_password do
+        conn
+        |> put_resp_content_type("application/json")
+        |> send_resp(200, Jason.encode!(%{
+          "consentRequired" => false,
+          "url" => callback_url
+        }))
+      else
+        conn
+        |> put_resp_content_type("application/json")
+        |> send_resp(401, Jason.encode!(%{"error" => "invalid_credentials"}))
+      end
+    end
+
+    match _ do
+      send_resp(conn, 404, "not found")
+    end
+  end
+
+  defmodule PlugWithState do
+    @behaviour Plug
+
+    def init(opts), do: opts
+
+    def call(conn, opts) do
+      conn
+      |> Plug.Conn.put_private(:test_pid, opts[:test_pid])
+      |> Plug.Conn.put_private(:callback_url, opts[:callback_url])
+      |> Plug.Conn.put_private(:expected_username, opts[:expected_username])
+      |> Plug.Conn.put_private(:expected_password, opts[:expected_password])
+      |> Router.call(Router.init([]))
+    end
+  end
+
+  def start(test_pid, opts \\ []) do
+    callback_url = Keyword.get(opts, :callback_url, "http://localhost:0/oauth/callback")
+    expected_username = Keyword.get(opts, :expected_username, "bot.test")
+    expected_password = Keyword.get(opts, :expected_password, "test-password")
+
+    {:ok, server_pid} =
+      Bandit.start_link(
+        plug: {PlugWithState,
+          test_pid: test_pid,
+          callback_url: callback_url,
+          expected_username: expected_username,
+          expected_password: expected_password},
+        port: 0,
+        ip: {127, 0, 0, 1}
+      )
+
+    {:ok, {_ip, port}} = ThousandIsland.listener_info(server_pid)
+    {server_pid, port}
+  end
+end
diff --git a/appview/test/support/fake_tangled_server.ex b/appview/test/support/fake_tangled_server.ex
new file mode 100644
index 0000000..c54805c
--- /dev/null
+++ b/appview/test/support/fake_tangled_server.ex
@@ -0,0 +1,129 @@
+defmodule Atvouch.Test.FakeTangledServer do
+  @moduledoc """
+  Fake Tangled HTTP server for testing the OAuth login flow and comment posting.
+  """
+
+  defmodule Router do
+    use Plug.Router
+
+    plug(:match)
+    plug(:dispatch)
+
+    # Login endpoint - returns HX-Redirect to PDS authorize URL
+    post "/login" do
+      {:ok, body, conn} = Plug.Conn.read_body(conn)
+      params = URI.decode_query(body)
+      test_pid = conn.private[:test_pid]
+      state_agent = conn.private[:state_agent]
+
+      pds_url = Agent.get(state_agent, fn state -> Map.get(state, :pds_url, "http://localhost:0") end)
+
+      send(test_pid, {:tangled_login, params})
+
+      authorize_url = "#{pds_url}/@atproto/oauth-provider/authorize?client_id=tangled&state=test-state"
+
+      conn
+      |> put_resp_header("hx-redirect", authorize_url)
+      |> send_resp(200, "")
+    end
+
+    # OAuth callback - sets session cookies
+    get "/oauth/callback" do
+      test_pid = conn.private[:test_pid]
+      send(test_pid, {:tangled_oauth_callback, conn.query_string})
+
+      conn
+      |> put_resp_header("set-cookie", "appview-session-v2=test-session-cookie; Path=/; HttpOnly")
+      |> prepend_resp_headers([{"set-cookie", "appview-accounts-v2=test-accounts-cookie; Path=/; HttpOnly"}])
+      |> put_resp_header("location", "/")
+      |> send_resp(302, "")
+    end
+
+    # Pulls listing page
+    get "/:handle/:rkey/pulls" do
+      test_pid = conn.private[:test_pid]
+      send(test_pid, {:tangled_pulls_page, handle, rkey})
+
+      pulls_html = Agent.get(conn.private[:state_agent], fn state ->
+        Map.get(state, {:pulls_html, handle, rkey}, default_pulls_html(handle, rkey))
+      end)
+
+      conn
+      |> put_resp_content_type("text/html")
+      |> send_resp(200, pulls_html)
+    end
+
+    # Comment posting endpoint
+    post "/:handle/:rkey/pulls/:number/round/0/comment" do
+      test_pid = conn.private[:test_pid]
+      {:ok, body, conn} = Plug.Conn.read_body(conn)
+      params = URI.decode_query(body)
+      number = String.to_integer(number)
+
+      cookies = Plug.Conn.get_req_header(conn, "cookie") |> List.first("")
+
+      send(test_pid, {:tangled_comment, %{
+        handle: handle,
+        rkey: rkey,
+        number: number,
+        body: params["body"],
+        cookies: cookies
+      }})
+
+      if String.contains?(cookies, "appview-session-v2=") do
+        conn
+        |> send_resp(200, "ok")
+      else
+        conn
+        |> send_resp(401, "unauthorized")
+      end
+    end
+
+    match _ do
+      send_resp(conn, 404, "not found")
+    end
+
+    defp default_pulls_html(_handle, _rkey) do
+      "<html><body><p>No pull requests.</p></body></html>"
+    end
+  end
+
+  defmodule PlugWithState do
+    @behaviour Plug
+
+    def init(opts), do: opts
+
+    def call(conn, opts) do
+      conn
+      |> Plug.Conn.put_private(:test_pid, opts[:test_pid])
+      |> Plug.Conn.put_private(:state_agent, opts[:state_agent])
+      |> Router.call(Router.init([]))
+    end
+  end
+
+  def start(test_pid, opts \\ []) do
+    {:ok, state_agent} = Agent.start_link(fn ->
+      %{pds_url: Keyword.get(opts, :pds_url, "http://localhost:0")}
+    end)
+
+    {:ok, server_pid} =
+      Bandit.start_link(
+        plug: {PlugWithState, test_pid: test_pid, state_agent: state_agent},
+        port: 0,
+        ip: {127, 0, 0, 1}
+      )
+
+    {:ok, {_ip, port}} = ThousandIsland.listener_info(server_pid)
+    {server_pid, port, state_agent}
+  end
+
+  def set_pds_url(state_agent, pds_url) do
+    Agent.update(state_agent, fn state -> Map.put(state, :pds_url, pds_url) end)
+  end
+
+  def set_pulls_html(state_agent, handle, rkey, html) do
+    Agent.update(state_agent, fn state ->
+      Map.put(state, {:pulls_html, handle, rkey}, html)
+    end)
+  end
+end