@open-everywhere/provider-github 0.0.0-stage → 0.1.0

package/dist/agent/channels/github-supervisor.js

@@ -0,0 +1,339 @@
+// The GitHub ambient supervisor — the eve-FREE tested core that turns every NON-mention
+// issue/PR-timeline comment on an opted-in repo into a JUDGED wake to a standing per-REPO
+// supervisor session. It is the SECOND non-Slack adopter of the surface-general
+// ambient-supervision pattern (surface-adapter-port.md §"Ambient supervision everywhere"),
+// deliberately THIN — it copies notion-supervisor.ts (the template) with the two GitHub-shaped
+// differences called out below. Linear copies this pair next.
+//
+// WHAT'S REUSED WHOLESALE (zero GitHub-specific logic in any of it):
+//   • renderWake + the channel-watch preamble (the judge) — normalized-wake.ts (containerNoun
+//     "repo"; the engagement tier rides the same field — GitHub PLATFORM-DEFAULTS to `reserved`,
+//     memory/domain.ts engagementTierFor)
+//   • shouldRotate — the pure rotation policy — slack-events.ts
+//   • the (org, surfaceKey) channel_session registry + the :oe-sup:g spend counter — via deps
+//   • githubBotMentioned — the SAME mention gate the native path wakes on — github-identity.ts
+//
+// THE TWO GITHUB-SHAPED DIFFERENCES vs the Notion template:
+//   1. MENTIONS ARE DROPPED, not `direct`. eve's native githubChannel already owns the @mention
+//      path (github.ts onComment → session + checkout + reply); a mention reaching the ambient
+//      leg too would double-handle the comment. classifyGitHubComment reuses githubBotMentioned
+//      — the EXACT gate the native path wakes on — so the two legs partition every comment
+//      between them with no overlap and no gap.
+//   2. DRIVE-BY REPOS ARE DROPPED (fail closed). A repo ambient-wakes only when it is positively
+//      private (every commenter was invited by the org — the Notion/Slack membership analog) OR
+//      the operator has VOUCHED it internal (identity/trust.ts). On a public, un-vouched repo any
+//      drive-by stranger could wake judged turns — an uninvited spend + prompt-injection surface
+//      the design's "GitHub repos in a domain are ~always private" assumption deliberately
+//      excludes. The VOUCH additionally widens ambient to a vouched public repo (the operator's
+//      explicit "this surface is internal" assertion), and — separately — is the SOLE floor for
+//      the cross-surface single WINDOW (see classifyGitHubAmbientComment): a private flag never
+//      admits the shared window, only the vouch does.
+//
+// The repo-session is the container-session's ORCHESTRATION HALF ONLY (surface-adapter-port
+// §"container session"): a repo-scoped standing session aware of the repo's issue/PR
+// conversations, holding repo memory, that judges every comment and replies into the triggering
+// issue. There is NO container-conversation half — a repo has no top-level chat to post to
+// (containerConversation: false), so a judged reply always targets the triggering issue/PR.
+import { renderWake, mkMessageTrigger, shouldRotate, singleWindowMentionPolicy, stampNonMemberChatAuth, seatCatchUpSinceMs, admitContextLines, engagedFollowUpContract, tailAuthorGrain, } from "@open-everywhere/core/agent/adapter-api.js";
+import { githubBotMentioned } from "./github-identity.js";
+/** The catch-up's REACHBACK FLOOR (hours): how far back a seat that has been quiet for a long time
+ *  reads. 7 days, the same floor every other surface's bootstrap window uses, so one number governs
+ *  "how much history is a seat ever worth" across the fleet. */
+const GITHUB_CATCH_UP_REACHBACK_HOURS = 168;
+// --- supervisor token / sentinel (carry the :oe-sup:g infix — load-bearing) ----------
+//
+// hooks/spend.ts isSupervisorToken keys off the `:oe-sup:g` substring to (a) tag the usage-event
+// `kind="supervisor"` and (b) drive the per-generation cumulative-token rotation counter, and
+// model/routing.ts isSupervisorSession keys the cheap `supervisor` model role off the same
+// `oe-sup:g<n>` suffix. Carry the infix and the ENTIRE cost/rotation/model-tier apparatus works
+// for free. The token puts `owner/repo` in the channel-id slot, `github:`-namespaced (eve
+// prefixes the channel name again on send — harmless, mirrors Notion).
+/** The reserved pseudo-thread sentinel for a supervisor generation (mirrors Slack's/Notion's). */
+export function githubSupervisorSentinel(generation) {
+    return `oe-sup:g${generation}`;
+}
+/** The reserved continuation token for a repo's supervisor session at a given generation:
+ *  `github:<owner>/<repo>:oe-sup:g<generation>`. A custom continuation token eve never
+ *  re-anchors, carrying the `:oe-sup:g` infix hooks/spend.ts + model/routing.ts key on. */
+export function githubSupervisorToken(owner, repo, generation) {
+    return `github:${owner}/${repo}:${githubSupervisorSentinel(generation)}`;
+}
+/**
+ * Decide how the ambient leg should treat one issue/PR-timeline comment, in cost order:
+ *  1. NO bot slug configured ⇒ DROP (fail closed) — self-identity is a precondition for the
+ *     loop guard (the same hardening as Notion's unresolved-botUserId drop).
+ *  2. BOT-authored (`user.type === "Bot"`) ⇒ DROP — covers our own `<slug>[bot]` replies AND
+ *     every other bot (prevents bot-to-bot loops).
+ *  3. Our own login (`<slug>[bot]`, belt-and-braces under a mislabelled type) ⇒ DROP.
+ *  4. @mentions the bot (githubBotMentioned — the native path's EXACT gate):
+ *       • DEFAULT (per-repo) ⇒ DROP: the native githubChannel session owns mentions; the two legs
+ *         partition, never overlap.
+ *       • SINGLE-WINDOW (`treatMentionAsDirect`) on a VOUCHED repo ⇒ `direct`: github.ts
+ *         suppresses the native session for exactly this case, so the ambient leg keeps the mention
+ *         and the unified window answers it as an addressed wake. Still DROP on an un-vouched repo —
+ *         the native path is NOT suppressed there (the gate on both sides is
+ *         `singleWindow && vouched`, the OPERATOR VOUCH — NOT the repo-private flag), so letting
+ *         ambient keep it would double-handle.
+ *  5. Repo neither positively private NOR operator-vouched ⇒ DROP (fail closed) — drive-by public
+ *     repos never ambient-wake (strangers must not buy judged turns; see the header).
+ *  6. otherwise ⇒ channel-watch (judged by the standing repo supervisor).
+ *
+ * `opts.vouched` is the OPERATOR-VOUCH fact the caller resolves (github.ts: isVouchedInternal on
+ * `github/<owner>` OR `github/<owner>/<repo>`, or OE_TRUST=internal). It is the SOLE floor for the
+ * cross-surface WINDOW (step 4's `direct` divert) — the repo's own `repoPrivate` flag is a logged
+ * defense-in-depth SIGNAL, never a window gate. `repoPrivate` still enables the per-repo ambient
+ * path (step 5): a private repo is invite-only, so it ambient-wakes even un-vouched; the vouch
+ * WIDENS ambient to a vouched public repo, and never narrows an already-private one.
+ */
+export function classifyGitHubAmbientComment(c, botSlug, opts) {
+    const slug = botSlug?.trim();
+    if (!slug)
+        return { addressing: "drop", reason: "no bot slug configured — fail-closed loop guard" };
+    if (c.authorType === "Bot")
+        return { addressing: "drop", reason: "bot-authored comment (loop guard)" };
+    if (c.authorLogin && c.authorLogin.toLowerCase() === `${slug}[bot]`.toLowerCase()) {
+        return { addressing: "drop", reason: "self-authored comment (our own reply)" };
+    }
+    const vouched = opts?.vouched === true;
+    if (githubBotMentioned(c.body, slug, { login: c.authorLogin, type: c.authorType })) {
+        // Single-window VOUCHED repos: the native session is suppressed (github.ts) so the unified
+        // window owns the mention as an addressed wake. Every other repo → the native path owns it.
+        // The decision is the SHARED seam (unified-window.ts singleWindowMentionPolicy) — the exact
+        // predicate the native suppression consults, so the two legs can never double-handle or gap.
+        // `isMention` is pinned true here (this branch is inside the githubBotMentioned gate); the
+        // privacy floor is the operator VOUCH, NOT the repo-private flag.
+        if (singleWindowMentionPolicy(opts?.treatMentionAsDirect === true, true, vouched).addressing === "direct-mention") {
+            return { addressing: "direct", reason: "bot @mention on a single-window vouched repo — answered by the unified window" };
+        }
+        return { addressing: "drop", reason: "bot @mention — owned by the native githubChannel path" };
+    }
+    // Per-repo ambient enablement: a private repo is invite-only (the existing product rule) OR the
+    // operator vouched it internal (widens to a vouched public repo). repoPrivate is now a SIGNAL —
+    // it enables ambient but is no longer the window floor (the vouch is, above).
+    if (c.repoPrivate !== true && !vouched) {
+        return { addressing: "drop", reason: "repo neither positively private nor operator-vouched — fail-closed (no drive-by ambient)" };
+    }
+    return { addressing: "channel-watch", reason: `ambient comment — judged by the repo supervisor (private=${c.repoPrivate === true}, vouched=${vouched})` };
+}
+/**
+ * Build the NormalizedWake for one repo-supervisor turn: platform "github", containerNoun
+ * "repo", locus.channel = `owner/repo`, locus.thread = `#<issueNumber>` (the conversation the
+ * comment belongs to), the issue title as an untrusted-wrapped context line, and the comment as
+ * the trigger. `channel-watch` (judged) by default; `direct-mention` (addressed, enveloped) when
+ * `directMention` is set — the SINGLE-WINDOW @mention path, which keeps the wake-id envelope but
+ * swaps the silence-biased watch preamble for the addressed one (see the field doc). renderWake
+ * then emits the exact `{message, context}` every OE dispatch sends — the SAME renderer
+ * Slack/Notion use, with NO platform branch.
+ */
+export function buildGitHubSupervisorWake(input) {
+    const directMention = input.directMention === true;
+    // THE SLOT, THEN THE DOMAIN'S ADMISSION POLICY OVER IT ({@link GitHubSupervisorWakeInput.admit} —
+    // OPE-1800). `thread` is the container position: on GitHub the issue/PR IS the conversation
+    // (locus.thread below), and this line describes it. Nothing admitted ⇒ no context block at all,
+    // never an empty one, which is the same `undefined` an absent title produces.
+    const titleLine = input.issueTitle
+        ? [{ senderType: "user", ts: `#${input.issueNumber}`, text: `issue/PR #${input.issueNumber}: ${input.issueTitle}` }]
+        : undefined;
+    const admittedTitle = titleLine && input.admit ? admitContextLines(titleLine, input.admit, "thread") : titleLine;
+    const contextLines = admittedTitle && admittedTitle.length > 0 ? admittedTitle : undefined;
+    return {
+        platform: "github",
+        // A direct @mention is reason "mention" (honest, and rides the envelope); an ambient comment is
+        // "channel-activity". Both keep the full envelope, so the wake-id survives on the single-window path.
+        reason: directMention ? "mention" : "channel-activity",
+        addressing: directMention ? "direct-mention" : "channel-watch",
+        containerNoun: "repo",
+        // engagementTier is the AMBIENT-watch calibration dial (it RAISES the reply bar for a
+        // `reserved` repo); an addressed @mention is owed an answer, so it never applies to a
+        // direct-mention wake — and is byte-identical (input.engagementTier) on the channel-watch path.
+        engagementTier: directMention ? undefined : input.engagementTier,
+        // The ENROLMENT fact ({@link GitHubSupervisorWakeInput.threadEngaged}), through the ONE shared
+        // helper every enveloped surface calls. The helper drops it on a `direct-mention` wake.
+        followUp: engagedFollowUpContract({
+            addressing: directMention ? "direct-mention" : "channel-watch",
+            threadEngaged: input.threadEngaged,
+        }),
+        // Single-window wake id — only the singleWindow dispatch passes it (byte-identical off).
+        wakeId: input.wakeId,
+        locus: {
+            channel: { id: `${input.owner}/${input.repo}` },
+            thread: { ts: `#${input.issueNumber}` },
+        },
+        contextLines,
+        contextSource: contextLines ? "the issue/PR this comment is on" : undefined,
+        backscroll: input.tail && input.tail.length > 0 ? input.tail : undefined,
+        ...(input.catchUpUnavailable !== undefined ? { catchUpUnavailable: input.catchUpUnavailable } : {}),
+        trigger: mkMessageTrigger({
+            from: "human", // self/bot already dropped in classify
+            author: input.trigger.authorLogin ?? "unknown",
+            authorId: input.trigger.authorLogin,
+            id: input.trigger.id,
+            sentAt: input.trigger.sentAt,
+            // The caller's stated per-person tier — no default (OPE-596). Directness is the `mention`
+            // flag below, never a trust tier.
+            trust: input.trigger.trust,
+            // The @mention response-obligation flag (rendered `mention="true"`). Unset on the ambient
+            // path ⇒ no attribute ⇒ byte-identical render.
+            mention: directMention ? true : undefined,
+            body: input.trigger.text,
+        }),
+    };
+}
+/** The taint-clean identity fields on one admitted ambient dispatch audit row. */
+export function githubDispatchAuditDetail(input) {
+    return {
+        addressing: input.addressing,
+        issueNumber: input.issueNumber,
+        ...(input.commentId ? { commentId: input.commentId } : {}),
+        ...(input.wakeId ? { wakeId: input.wakeId } : {}),
+        repoPrivate: input.repoPrivate,
+        vouched: input.vouched,
+    };
+}
+function pick(o, k) {
+    return o && typeof o === "object" ? o[k] : undefined;
+}
+function str(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+function num(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+/**
+ * Extract the ambient-leg facts from one webhook delivery, or null when the delivery is not an
+ * ambient candidate at all: only `issue_comment` + `action: "created"` qualifies (edits/deletes
+ * are not conversational triggers v1; review-thread comments are out of scope v1 — see
+ * {@link GitHubAmbientEvent}). Null is "not for this leg", NOT an error — the native mention
+ * path and the routine fan-out see every delivery regardless.
+ */
+export function extractGitHubAmbientEvent(eventType, payload) {
+    if (eventType !== "issue_comment")
+        return null;
+    if (str(pick(payload, "action")) !== "created")
+        return null;
+    const repository = pick(payload, "repository");
+    const issue = pick(payload, "issue");
+    const comment = pick(payload, "comment");
+    const owner = str(pick(pick(repository, "owner"), "login"));
+    const repo = str(pick(repository, "name"));
+    const issueNumber = num(pick(issue, "number"));
+    if (!owner || !repo || issueNumber === undefined || !comment)
+        return null;
+    const user = pick(comment, "user");
+    const isPrivate = pick(repository, "private");
+    const commentId = num(pick(comment, "id"));
+    return {
+        owner,
+        repo,
+        repositoryFullName: str(pick(repository, "full_name")),
+        repositoryId: num(pick(repository, "id")),
+        repoPrivate: typeof isPrivate === "boolean" ? isPrivate : undefined,
+        installationId: num(pick(pick(payload, "installation"), "id")),
+        issueNumber,
+        issueTitle: str(pick(issue, "title")),
+        isPullRequest: pick(issue, "pull_request") !== undefined,
+        comment: {
+            id: commentId !== undefined ? String(commentId) : undefined,
+            body: str(pick(comment, "body")),
+            authorLogin: str(pick(user, "login")),
+            authorType: str(pick(user, "type")),
+            authorId: num(pick(user, "id")),
+            authorAssociation: str(pick(comment, "author_association")),
+            createdAt: str(pick(comment, "created_at")),
+            repoPrivate: typeof isPrivate === "boolean" ? isPrivate : undefined,
+        },
+    };
+}
+/**
+ * Route one kept comment to the repo supervisor: get-or-create the session, build + render the
+ * wake for that generation, and deliver it.
+ *
+ * A DELIVERY failure (the send itself) propagates to the caller's catch. A session that dies at
+ * TURN time does not: nothing here observes it, so the trigger is lost SILENTLY, and no reactive
+ * arm can exist (OPE-174 removed the inert one; channels/session-resume.ts holds the measurement).
+ * The working remedy is PRE-DISPATCH — the live `getOrCreateSession` claims the OPE-599
+ * runtime-change rotation before this call and hands back a session the running eve build can read.
+ */
+export async function handleGitHubSupervisorDispatch(d, deps) {
+    const atIso = deps.now ? deps.now() : new Date().toISOString();
+    const session = await deps.getOrCreateSession(d.surfaceKey, d.owner, d.repo, atIso);
+    const doWake = async (token, generation, tail, catchUpUnavailable) => {
+        const nw = buildGitHubSupervisorWake({
+            owner: d.owner,
+            repo: d.repo,
+            issueNumber: d.issueNumber,
+            issueTitle: d.issueTitle,
+            admit: d.admit,
+            trigger: d.trigger,
+            engagementTier: d.engagementTier,
+            wakeId: d.window?.wakeId,
+            directMention: d.directMention,
+            threadEngaged: d.threadEngaged,
+            tail,
+            catchUpUnavailable,
+        });
+        const { message, context } = renderWake(nw, deps.now);
+        // OPE-466 CARRIAGE, wired here by OPE-494. The wake renders its envelope in the INGRESS process,
+        // outside any turn, so the taint half of `ingestUntrusted` no-ops and the reading turn would
+        // otherwise run with a CLEAN signal over an outside contributor's bytes. The stamp is the same
+        // host-set, model-unforgeable auth attribute Slack, Discord, Teams and Notion already carry.
+        //
+        // POSITION: inside `doWake`, so BOTH delivery routes get it — this channel's own `send` and the
+        // single-window divert (github.ts hands `deps.wake` the auth for either). The room leg reads the
+        // OPERATOR's trust declaration for the repo; the author leg reads `d.ingested`. On an unmarked
+        // wake the input auth returns BY REFERENCE, so no existing golden moves.
+        const auth = stampNonMemberChatAuth(d.auth, d.ingested, { surfaceKey: d.surfaceKey });
+        await deps.wake({ token, auth, message, context: context ?? [], window: d.window });
+    };
+    // A wake failure PROPAGATES to the caller's catch. (OPE-174 removed a terminal-session-death
+    // force-rotate branch here: it could never fire — a conversation-mode session PARKS at eve's
+    // token bound rather than failing, and a turn-time error cannot reject the awaited enqueue
+    // anyway. The reachable handler is core's agent/channels/session-park.ts.)
+    // 🔴 EVERY WAKE READS THE CONVERSATION SINCE THE SEAT LAST LOOKED (OPE-1695 (b), brought to GitHub
+    // by OPE-1726). A FRESH generation renders its carried tail, as it always did; an ONGOING
+    // generation reads the timeline comments this issue/PR collected since its own `lastWakeAt`,
+    // through the ONE shared catch-up path — same bounds, same admission policy, same cap as Slack's.
+    // FAIL-SOFT: the shared path never throws, and an unregistered fetch comes back as the UNAVAILABLE
+    // note rather than as a silent empty context.
+    const catchUp = session.freshGeneration || !deps.catchUp
+        ? undefined
+        : await deps.catchUp({
+            container: `${d.owner}/${d.repo}#${d.issueNumber}`,
+            sinceMs: seatCatchUpSinceMs(session.lastWakeAt, Date.parse(atIso) || Date.now(), GITHUB_CATCH_UP_REACHBACK_HOURS),
+            untilMs: Date.parse(d.trigger.sentAt) || Date.parse(atIso) || Date.now(),
+            excludeId: d.trigger.id,
+            channelKey: d.surfaceKey,
+        });
+    await doWake(session.token, session.generation, session.freshGeneration ? session.tail : (catchUp?.messages ?? []), catchUp?.unavailable);
+    if (deps.touchSession)
+        await deps.touchSession(d.surfaceKey, atIso);
+    if (deps.recordWake) {
+        // AFTER the wake landed, and only the TRIGGER — never the backscroll rendered beside it. That is
+        // what stops a tail inheriting a tail (channels/session-tail.ts).
+        await deps.recordWake({
+            kind: "wake",
+            at: atIso,
+            from: "human",
+            trust: d.trigger.trust,
+            // THE AUTHOR GRAIN (OPE-1747) — `d.ingested[0]` is the TRIGGER's own facts: GitHub sends one
+            // comment per wake, so the route leg passes exactly one entry (see `ingested`'s own header),
+            // and `stampNonMemberChatAuth` above joins over that same entry. Resolved through the one core
+            // road, so this row and the join cannot disagree. A leg that passed `[]` says so on purpose, and
+            // the row then records `refuted: false` — the SAME answer the live wake acted on, not the
+            // UNKNOWN an absent field means. UNKNOWN is reserved for a row persisted before this field
+            // existed: recording it here would withhold, in the next generation, a body this wake delivered.
+            ...tailAuthorGrain(d.ingested[0] ?? { trust: d.trigger.trust }),
+            author: d.trigger.authorLogin ?? "unknown",
+            ...(d.trigger.authorLogin ? { authorId: d.trigger.authorLogin } : {}),
+            id: d.trigger.id,
+            platform: "github",
+            container: d.surfaceKey,
+            threadRoot: `#${d.issueNumber}`,
+            text: d.trigger.text,
+        }, session.token, d.surfaceKey);
+    }
+}
+// Re-export shouldRotate so the live wiring (github.ts) drives get-or-create/rotate with the
+// SAME pure policy Slack/Notion use, without importing slack-events itself.
+export { shouldRotate };
+//# sourceMappingURL=github-supervisor.js.map

package/dist/agent/channels/github-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-supervisor.js","sourceRoot":"","sources":["../../../agent/channels/github-supervisor.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,0FAA0F;AAC1F,gFAAgF;AAChF,2FAA2F;AAC3F,+FAA+F;AAC/F,8DAA8D;AAC9D,EAAE;AACF,qEAAqE;AACrE,8FAA8F;AAC9F,iGAAiG;AACjG,0CAA0C;AAC1C,gEAAgE;AAChE,8FAA8F;AAC9F,+FAA+F;AAC/F,EAAE;AACF,4DAA4D;AAC5D,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,2FAA2F;AAC3F,gDAAgD;AAChD,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,iGAAiG;AACjG,2FAA2F;AAC3F,gGAAgG;AAChG,gGAAgG;AAChG,gGAAgG;AAChG,sDAAsD;AACtD,EAAE;AACF,4FAA4F;AAC5F,qFAAqF;AACrF,gGAAgG;AAChG,2FAA2F;AAC3F,4FAA4F;AAE5F,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EAWvB,eAAe,GAEhB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAiC,MAAM,sBAAsB,CAAC;AAEzF;;gEAEgE;AAChE,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAE5C,wFAAwF;AACxF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,2FAA2F;AAC3F,gGAAgG;AAChG,0FAA0F;AAC1F,uEAAuE;AAEvE,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,WAAW,UAAU,EAAE,CAAC;AACjC,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,IAAY,EAAE,UAAkB;IACnF,OAAO,UAAU,KAAK,IAAI,IAAI,IAAI,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC3E,CAAC;AA4CD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,4BAA4B,CAC1C,CAAuB,EACvB,OAA2B,EAC3B,IAA4D;IAE5D,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IACpG,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IACvG,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAClF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;QACnF,2FAA2F;QAC3F,4FAA4F;QAC5F,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,kEAAkE;QAClE,IAAI,yBAAyB,CAAC,IAAI,EAAE,oBAAoB,KAAK,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;YAClH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;QAC3H,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACjG,CAAC;IACD,gGAAgG;IAChG,gGAAgG;IAChG,8EAA8E;IAC9E,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,0FAA0F,EAAE,CAAC;IACpI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,4DAA4D,CAAC,CAAC,WAAW,KAAK,IAAI,aAAa,OAAO,GAAG,EAAE,CAAC;AAC5J,CAAC;AAsFD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACxE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;IACnD,kGAAkG;IAClG,4FAA4F;IAC5F,gGAAgG;IAChG,8EAA8E;IAC9E,MAAM,SAAS,GAA8B,KAAK,CAAC,UAAU;QAC3D,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QACpH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,YAAY,GAA8B,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtH,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,gGAAgG;QAChG,sGAAsG;QACtG,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;QACtD,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe;QAC9D,aAAa,EAAE,MAAM;QACrB,sFAAsF;QACtF,sFAAsF;QACtF,gGAAgG;QAChG,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc;QAChE,+FAA+F;QAC/F,wFAAwF;QACxF,QAAQ,EAAE,uBAAuB,CAAC;YAChC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe;YAC9D,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC;QACF,yFAAyF;QACzF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE;YACL,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE;YAC/C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE;SACxC;QACD,YAAY;QACZ,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,SAAS;QAC3E,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACxE,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,OAAO,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,OAAO,EAAE,uCAAuC;YACtD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS;YAC9C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;YACnC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YACpB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,0FAA0F;YAC1F,kCAAkC;YAClC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;YAC1B,0FAA0F;YAC1F,+CAA+C;YAC/C,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;SACzB,CAAC;KACH,CAAC;AACJ,CAAC;AA4BD,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,KAOzC;IACC,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,CAAU,EAAE,CAAS;IACjC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AACD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AACD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,OAAgC;IAC3F,IAAI,SAAS,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK;QACL,IAAI;QACJ,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACtD,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACzC,WAAW,EAAE,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACnE,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,WAAW;QACX,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrC,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,SAAS;QACxD,OAAO,EAAE;YACP,EAAE,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC3D,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC3C,WAAW,EAAE,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACpE;KACF,CAAC;AACJ,CAAC;AA+GD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,CAA2B,EAAE,IAA0B;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,UAAkB,EAAE,IAAiC,EAAE,kBAA2B,EAAE,EAAE;QACzH,MAAM,EAAE,GAAG,yBAAyB,CAAC;YACnC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM;YACxB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,IAAI;YACJ,kBAAkB;SACnB,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,EAAE;QACF,gGAAgG;QAChG,iGAAiG;QACjG,+FAA+F;QAC/F,yEAAyE;QACzE,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC;IAEF,6FAA6F;IAC7F,6FAA6F;IAC7F,2FAA2F;IAC3F,2EAA2E;IAC3E,mGAAmG;IACnG,0FAA0F;IAC1F,6FAA6F;IAC7F,kGAAkG;IAClG,mGAAmG;IACnG,8CAA8C;IAC9C,MAAM,OAAO,GACX,OAAO,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,OAAO;QACtC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,SAAS,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;YAClD,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,+BAA+B,CAAC;YACjH,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YACxE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;YACvB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;IACT,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1I,IAAI,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,iGAAiG;QACjG,kEAAkE;QAClE,MAAM,IAAI,CAAC,UAAU,CACnB;YACE,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;YACtB,6FAA6F;YAC7F,6FAA6F;YAC7F,+FAA+F;YAC/F,iGAAiG;YACjG,0FAA0F;YAC1F,2FAA2F;YAC3F,iGAAiG;YACjG,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS;YAC1C,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;YAChB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,UAAU,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE;YAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;SACrB,EACD,OAAO,CAAC,KAAK,EACb,CAAC,CAAC,UAAU,CACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,4EAA4E;AAC5E,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/agent/channels/github-webhook-verifier.d.ts

@@ -0,0 +1,5 @@
+import { type WebhookVerifier } from "@open-everywhere/core/agent/adapter-api.js";
+/** The registry key — what a generic hook declares as its `source` to be verified as GitHub. */
+export declare const GITHUB_WEBHOOK_SOURCE = "github";
+export declare const githubWebhookVerifier: WebhookVerifier;
+//# sourceMappingURL=github-webhook-verifier.d.ts.map

package/dist/agent/channels/github-webhook-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-webhook-verifier.d.ts","sourceRoot":"","sources":["../../../agent/channels/github-webhook-verifier.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAEzG,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAI9C,eAAO,MAAM,qBAAqB,EAAE,eAyBnC,CAAC"}

package/dist/agent/channels/github-webhook-verifier.js

@@ -0,0 +1,55 @@
+// GitHub's webhook signature scheme, as a registry entry (OPE-164) — what lets a GENERIC hook
+// (`POST /webhooks/<id>`) declare `source: "github"` and be verified exactly the way GitHub signs,
+// instead of GitHub being expected to adopt our scheme (which it never will).
+//
+// ZERO NEW CRYPTO. The digest itself is core's `verifyGithubSignature` (routines/events.ts, through
+// the adapter-api barrel) — the same function the native github webhook route has always used, so
+// there is one implementation of GitHub's scheme in the tree, not two that can drift.
+//
+// THE SCHEME (https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries):
+//   X-Hub-Signature-256: sha256=<hex>   HMAC-SHA256 of the RAW body under the webhook secret.
+// `X-Hub-Signature` (SHA-1) is legacy and deliberately NOT accepted — accepting it would be a
+// downgrade a sender could choose.
+//
+// 🔴 `signedTimestamp: false` — GitHub signs NOTHING but the body. A captured delivery replays
+// forever. That is GitHub's scheme, not a gap we can close in the verifier; it is declared here
+// so it lands on the reviewed UNDEFENDED_REPLAY_SOURCES allowlist (webhook-verifier-test.ts)
+// rather than being an unwritten fact. It is also exactly why resolution is by DECLARED source:
+// with a weaker verifier registered alongside a timestamped one, letting the REQUEST choose the
+// scheme would be a live downgrade primitive.
+//
+// NOTE this entry changes NO existing route. The native github webhook path keeps its own inline
+// gate; registering here only makes the scheme available to the generic ingress.
+import { verifyGithubSignature } from "@open-everywhere/core/agent/adapter-api.js";
+/** The registry key — what a generic hook declares as its `source` to be verified as GitHub. */
+export const GITHUB_WEBHOOK_SOURCE = "github";
+const GITHUB_SIGNATURE_HEADER = "x-hub-signature-256";
+export const githubWebhookVerifier = {
+    source: GITHUB_WEBHOOK_SOURCE,
+    // Provider-owned ⇒ routed through admitProviderRegistration: de-select the github bundle and
+    // this row never lands, so a `source: "github"` hook 401s instead of silently using another
+    // scheme.
+    provider: "github",
+    keyKind: "shared-secret",
+    // `keyOrigin: "receiver-minted"` (OPE-186) — GitHub's webhook secret is a value the person
+    // CREATING the webhook types into GitHub's own form, not one GitHub generates and hands back:
+    // *"Setting a webhook secret allows you to ensure that POST requests sent to the payload URL are
+    // from GitHub … you can create a random string"* (the same docs page linked above). That is what
+    // makes `source: "github"` legal for a CHAT-MINTED hook, whose key is an OE-minted random secret
+    // the approver pastes into that form. Sourced to GitHub's docs, not to anything in this tree.
+    keyOrigin: "receiver-minted",
+    signedTimestamp: false,
+    verify({ rawBody, headers, keys }) {
+        const signature = headers.get(GITHUB_SIGNATURE_HEADER);
+        if (!signature)
+            return { ok: false, failure: "missing-signature" };
+        for (const [i, key] of keys.entries()) {
+            // Ordered, current-first: a match at i>0 is a rotation overlap and the gate audits it.
+            // GitHub documents no overlap window of its own, so `keys[]` is how an operator gets one.
+            if (verifyGithubSignature(key, rawBody, signature))
+                return { ok: true, keyIndex: i };
+        }
+        return { ok: false, failure: "signature-mismatch" };
+    },
+};
+//# sourceMappingURL=github-webhook-verifier.js.map

package/dist/agent/channels/github-webhook-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-webhook-verifier.js","sourceRoot":"","sources":["../../../agent/channels/github-webhook-verifier.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,mGAAmG;AACnG,8EAA8E;AAC9E,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,8FAA8F;AAC9F,mCAAmC;AACnC,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,6FAA6F;AAC7F,gGAAgG;AAChG,gGAAgG;AAChG,8CAA8C;AAC9C,EAAE;AACF,iGAAiG;AACjG,iFAAiF;AAEjF,OAAO,EAAE,qBAAqB,EAAwB,MAAM,4CAA4C,CAAC;AAEzG,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD,MAAM,CAAC,MAAM,qBAAqB,GAAoB;IACpD,MAAM,EAAE,qBAAqB;IAC7B,6FAA6F;IAC7F,4FAA4F;IAC5F,UAAU;IACV,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,eAAe;IACxB,2FAA2F;IAC3F,8FAA8F;IAC9F,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,8FAA8F;IAC9F,SAAS,EAAE,iBAAiB;IAC5B,eAAe,EAAE,KAAK;IACtB,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,uFAAuF;YACvF,0FAA0F;YAC1F,IAAI,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACtD,CAAC;CACF,CAAC"}

package/dist/agent/channels/github.d.ts

@@ -0,0 +1,139 @@
+import type { RouteHandlerArgs } from "eve/channels";
+import { type GitHubChannel, type GitHubChannelState, type GitHubInboundContext, type GitHubComment, type GitHubInboundResult } from "eve/channels/github";
+import { type GitHubEngagementVerdict, type GitHubSeamFacts } from "./github-engagement.js";
+import { type GitHubAmbientEvent, type GitHubSupervisorDeps } from "./github-supervisor.js";
+import { type IngestedChatMessage, type ExternalPolicy } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Does the AMBIENT leg keep this comment — the second half of the two-leg partition (OPE-1695)?
+ * 🔴 THE CHATTINESS FLAG IS BELOW THE CLASSIFIER NOW, AND THAT IS WHAT KEEPS THE LEGS COMPLEMENTARY.
+ * It used to gate the whole leg, which was safe only while a seat REQUIRED `ambientSupervisor`: the
+ * native leg stood down (`shouldSuppressNativeMention`) exactly when this leg was live. Seats are
+ * universal since OPE-1695, so with the flag gating the whole leg a VOUCHED repo whose domain is
+ * addressed-only suppressed the native session AND returned here — and the @mention reached NOBODY.
+ * An ADDRESSED comment is an address, and addressing never depended on the flag; only ambient talk
+ * does, and a refused ambient comment still records its skip row exactly as before.
+ *
+ * 🔴 AN ENGAGED CONTAINER'S PLAIN FOLLOW-UP IS AN ADDRESS TOO (OPE-1740/OPE-1745), AND THAT IS THE
+ * THIRD INPUT. Moving the flag below the classifier fixed the mention and left the follow-up behind:
+ * on the SAME seated, vouched, addressed-only repo the native leg still stands down for every
+ * comment (`shouldSuppressNativeMention` asks `singleWindowMentionPolicy` with `isMention` pinned
+ * true), so the engaged follow-up came here — and a `thread-follow` addressing with the flag off was
+ * refused `domain-refused` before the seam was ever read. Measured on deploy #201: the plain
+ * follow-up in an ENGAGED issue of `oe-e2e-addressed-github` produced
+ * `github.ambient_skipped {reason: "domain-refused"}` three seconds after the mention's reply, and
+ * NO leg answered it. An @mention ENROLLED the container, so the enrolment is what addresses the
+ * comment; the domain opt-in governs UNINVITED talk and has never governed an address.
+ *
+ * Pure, so the partition is a truth table a test can walk: `drop` is the classifier's own refusal
+ * (a bot author, an un-vouched public repo, a mention the native leg owns), and nothing re-opens it.
+ * `engagedFollowUp` is REQUIRED rather than defaulted — a caller that omitted it would silently
+ * restore the refusal this parameter exists to close. {@link githubAmbientLegAdmission} is the one
+ * place that computes it.
+ */
+export declare function githubAmbientLegKeeps(addressing: string, ambientEnabled: boolean, engagedFollowUp: boolean): boolean;
+/**
+ * The AMBIENT leg's whole admission for one comment: read the §2.5 seam, THEN apply the chattiness
+ * gate with the enrolment fact in hand. One call, so the order cannot drift back.
+ *
+ * 🔴 THE ORDER IS THE FIX. `resolveGitHubEngagement` runs FIRST and its verdict feeds the gate, so an
+ * engaged container's plain follow-up is admitted on an addressed-only domain. Before this, the gate
+ * decided alone and the seam below it never got to speak.
+ *
+ * 🔴 THE COST, STATED. Every kept-by-the-classifier comment now pays ONE engagement-registry read
+ * here, where an ambient-off domain used to return on the gate. The read is the seam — a container's
+ * enrolment cannot be known without it — and it is the SAME read the leg already paid on every
+ * ambient-ON domain. `resolveGitHubEngagement` settles a mention with no round-trip at all.
+ *
+ * `engagedFollowUp` is floored on {@link githubEngagedFollowUpReach}, so a public repo and an inline
+ * review comment are refused exactly as they are on the native leg — this seam never widens an
+ * uninvited turn's reach, it only stops the domain flag from closing a door enrolment opened.
+ *
+ * Exported for the wiring test: `ambientDelivery` is module-private and only runs behind the route's
+ * `waitUntil`, so this is the furthest out a test can drive the decision. That the LEG calls it is
+ * covered by the `J-ENGAGED-github` e2e journey and by nothing offline. It takes NO injected deps —
+ * the wiring test drives it over the REAL operational store and a REAL declared domain, which is the
+ * point of that file.
+ */
+export declare function githubAmbientLegAdmission(addressing: string, surfaceKey: string, f: GitHubSeamFacts): Promise<{
+    readonly keep: boolean;
+    readonly seam: GitHubEngagementVerdict;
+    readonly engagedFollowUp: boolean;
+}>;
+/**
+ * Suppress the NATIVE @mention session for a SINGLE-WINDOW VOUCHED repo? On a crossSurfaceWindow repo
+ * a @mention answered by the native per-conversation session would reply WITHOUT the shared
+ * cross-surface context — that session is a separate eve run under a per-conversation token and can
+ * never join the single window. So we
+ * suppress it and let the ambient/unified leg answer the mention as an addressed `direct` wake
+ * instead. Gated on `singleWindow && the operator VOUCHED the repo internal` — the EXACT predicate the
+ * ambient classifier's `treatMentionAsDirect`/`vouched` keys on, so native-suppress and ambient-keep are
+ * perfectly complementary (never a double reply, never a gap): an un-vouched single-window repo keeps
+ * its native mention agent, because the ambient leg still drops mentions there. Pure, so the gate is
+ * unit-testable without a live config.
+ *
+ * A thin GitHub shim over the SHARED seam (unified-window.ts singleWindowMentionPolicy): the
+ * caller (onComment) consults it only AFTER githubBotMentioned confirmed the comment IS a
+ * mention, so `isMention` is pinned true here; `privacyOk` is the operator-VOUCH floor
+ * (isVouchedInternal / OE_TRUST — resolved by the caller), fail-closed on un-vouched/unknown. The
+ * repo's own `repository.private` flag is NOT consulted here — it is a logged defense-in-depth
+ * signal at the call site, not the window gate.
+ */
+export declare function shouldSuppressNativeMention(singleWindow: boolean, vouched: boolean): boolean;
+/**
+ * THE EXTERNAL-PARTICIPANT VERDICT for one GitHub comment — the AUTHOR grain (OPE-533 / OPE-507)
+ * and the ROOM grain (OPE-529 / OPE-504) as one pure decision, so both outcomes are tested without
+ * a webhook, a store or a live repo.
+ *
+ * The two values that are not `proceed` name WHY the agent stays quiet. GitHub owes the same act
+ * for both — see the notice note below — but the audit row must still say which question answered:
+ *   `withheld-author` — the comment's author holds no access grant on the repo.
+ *   `silent-room`     — the room itself is classified external and the operator asked for silence.
+ *
+ * 🔴 THE AUTHOR GRAIN IS TESTED FIRST, mirroring Discord. An excluded author in a silenced room is
+ * an author verdict: the two grains are independent knobs, and a row that named the room would hide
+ * the fact that the person, not the place, decided it.
+ *
+ * THE ROOM LEG NOW READS THE AUTHOR AS EVIDENCE. `ingested` carries the comment's author, so
+ * `roomIsExternalClass`'s GUEST-PRESENT leg answers on GitHub the way it already does on Discord.
+ * `vendorExternal` is still not passed: GitHub's own room signal is `repository.private`, which is
+ * already the window-admission floor read elsewhere (`githubRepoVouched`) — reusing it here would
+ * fold a DIFFERENT question (may this repo join the shared memory window?) into this one (should
+ * the agent stay quiet here?).
+ */
+export type GitHubExternalVerdict = "proceed" | "withheld-author" | "silent-room";
+export declare function githubExternalVerdict(input: {
+    readonly policy: ExternalPolicy;
+    readonly author: IngestedChatMessage;
+    readonly surfaceKey: string;
+}): GitHubExternalVerdict;
+/**
+ * The dispatch shape OE's GitHub ambient/supervisor legs have always used. It was
+ * `SendFn<GitHubChannelState>` until eve 0.31 removed the public `SendFn` (the address moved from
+ * the send options onto `from(address)`); declaring it HERE keeps the whole leg below unchanged and
+ * confines the version-shaped difference to {@link githubSendFrom}.
+ */
+type GitHubSend = (payload: {
+    readonly message: string;
+    readonly context?: readonly string[];
+}, options: {
+    readonly auth: unknown;
+    readonly continuationToken: string;
+    readonly state?: GitHubChannelState;
+}) => Promise<unknown>;
+/**
+ * Live supervisor deps (mirrors notion.ts liveNotionSupervisorDeps): create-or-fetch / rotate /
+ * force-rotate over the channel_session registry with the reserved :oe-sup:g token, and a `wake`
+ * that continues the session under that token with the supervisor seed state. Rotation reuses
+ * shouldRotate AS-IS; a rotation carries the OUTGOING generation's recorded TAIL forward (OPE-794).
+ *
+ * UNIFIED re-key (the Slack reference's exact shape, slack-events.ts liveSupervisorDeps): when the
+ * repo's domain has opted in, the registry ROW is the synthetic `oe-domain::<name>` key and the
+ * token is `oe-dom:<name>:oe-sup:g<gen>` — one row + one token per generation for the WHOLE team,
+ * whichever surface a wake arrives on. Flag-off, `githubGrainFor` returns
+ * `{unified:false, registryKey:surfaceKey}` and the per-repo token below — byte-identical.
+ */
+export declare function liveGitHubSupervisorDeps(send: GitHubSend, ev: GitHubAmbientEvent, to?: RouteHandlerArgs["to"]): GitHubSupervisorDeps;
+export declare const githubOnComment: (ctx: GitHubInboundContext, comment: GitHubComment) => Promise<GitHubInboundResult>;
+declare const channel: GitHubChannel;
+export default channel;
+//# sourceMappingURL=github.d.ts.map

package/dist/agent/channels/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../agent/channels/github.ts"],"names":[],"mappings":"AAuFA,OAAO,KAAK,EAAuB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1K,OAAO,EAOL,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EA4CL,KAAK,mBAAmB,EAIxB,KAAK,cAAc,EASpB,MAAM,4CAA4C,CAAC;AAgFpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,GAAG,OAAO,CAGpH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,CAAC,EAAE,eAAe,GACjB,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAAE,CAAC,CAIhH;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5F;AAUD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAElF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,qBAAqB,CAGxB;AA+ED;;;;;GAKG;AACH,KAAK,UAAU,GAAG,CAChB,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC3E,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAAE,KACzG,OAAO,CAAC,OAAO,CAAC,CAAC;AActB;;;;;;;;;;;GAWG;AAKH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAkHpI;AAgWD,eAAO,MAAM,eAAe,QAAe,oBAAoB,WAAW,aAAa,KAAG,OAAO,CAAC,mBAAmB,CAwKpH,CAAC;AAoSF,QAAA,MAAM,OAAO,EAAE,aAAqC,CAAC;eAEtC,OAAO"}