@volter/twin-github 0.1.2 → 2.0.0

package/dist/src/semantics/users.js

@@ -0,0 +1,255 @@
+// GitHub's users family: a user by login or account id, the authenticated user and their profile,
+// the follow graph, emails, SSH and GPG keys, blocks, and the activity streams scoped to a user.
+// The twin models one follow actor, the authenticated `octocat`.
+import { me } from "./activity.js";
+import { createHash } from 'node:crypto';
+import { githubActivityEvents, githubNotFound, paginate, seedUser, toGithubOrg, toGithubRepo, toGithubUser, toGithubUserEmail, toGithubUserGpgKey, toGithubUserSshKey, toSimpleUser, twinUserId, } from "../github-twin.js";
+import { asView, gh, nextSeq, put, send } from "./shared.js";
+/** GET /users/:login/events[/public] and /users/:login/received_events[/public]: events = activity the
+ *  user PERFORMED (actor); received_events = activity in repos the user OWNS. Both filter the SAME
+ *  modeled stream. */
+const userEvents = (received, only) => async (ctx) => {
+    const { seg, query, state } = gh(ctx);
+    const login = decodeURIComponent(seg[1]);
+    const all = githubActivityEvents(state());
+    let items = !received
+        ? all.filter((e) => e.actor.login === login)
+        : all.filter((e) => String(e.repo.name ?? '').split('/')[0] === login);
+    if (only === 'public')
+        items = items.filter((e) => e.public === true);
+    return ctx.reply(paginate(items, query));
+};
+export function usersSemantics() {
+    const usersGetByUsername = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const login = decodeURIComponent(seg[1]);
+        return ctx.reply(toGithubUser(login === 'octocat' ? { ...seedUser('octocat'), ...state().userProfile, login } : seedUser(login)));
+    };
+    const reposListForAuthenticatedUser = async (ctx) => {
+        const { caller, query, state } = gh(ctx);
+        const me = caller ?? 'octocat';
+        const params = new URLSearchParams(query ?? '');
+        const affiliation = new Set((params.get('affiliation') ?? 'owner,collaborator,organization_member').split(',').map((a) => a.trim()));
+        const visibility = params.get('visibility') ?? 'all';
+        const st = state();
+        const memberOf = new Set(st.orgMembers.filter((m) => m.login === me && (m.state ?? 'active') === 'active').map((m) => m.org));
+        const collaborating = new Set(st.collaborators.filter((c) => c.login === me).map((c) => c.repository));
+        const mine = st.repos.filter((r) => ((affiliation.has('owner') && r.owner === me) || (affiliation.has('collaborator') && collaborating.has(r.full_name)) || (affiliation.has('organization_member') && memberOf.has(r.owner)))
+            && (visibility === 'all' || (visibility === 'private') === (r.private === true)));
+        return ctx.reply(paginate([...mine].sort((a, b) => a.full_name.localeCompare(b.full_name)), query).map((r) => asView('repository', toGithubRepo(r))));
+    };
+    const orgsListForAuthenticatedUser = async (ctx) => {
+        const { caller, query, state } = gh(ctx);
+        const me = caller ?? 'octocat';
+        const st = state();
+        const logins = new Set(st.orgMembers.filter((m) => m.login === me && (m.state ?? 'active') === 'active').map((m) => m.org));
+        const SIMPLE = ['login', 'id', 'node_id', 'url', 'repos_url', 'events_url', 'hooks_url', 'issues_url', 'members_url', 'public_members_url', 'avatar_url', 'description'];
+        const simple = (o) => Object.fromEntries(SIMPLE.filter((k) => k in o).map((k) => [k, o[k]]));
+        return ctx.reply(paginate(st.orgs.filter((o) => logins.has(o.login)), query).map((o) => simple(toGithubOrg(o))));
+    };
+    const reposListForUser = async (ctx) => {
+        const { seg, query, state } = gh(ctx);
+        const login = decodeURIComponent(seg[1]);
+        return ctx.reply(paginate(state().repos.filter((r) => r.owner === login), query).map(toGithubRepo));
+    };
+    const usersListFollowersForUser = async (ctx) => {
+        const { seg, query, state } = gh(ctx);
+        const login = decodeURIComponent(seg[1]);
+        return ctx.reply(paginate(state().followEdges.filter((e) => e.to === login).map((e) => asView('simple-user', toGithubUser(seedUser(e.from)))), query));
+    };
+    const usersListFollowingForUser = async (ctx) => {
+        const { seg, query, state } = gh(ctx);
+        const login = decodeURIComponent(seg[1]);
+        return ctx.reply(paginate(state().followEdges.filter((e) => e.from === login).map((e) => asView('simple-user', toGithubUser(seedUser(e.to)))), query));
+    };
+    const usersCheckFollowingForUser = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const [login, other] = [decodeURIComponent(seg[1]), decodeURIComponent(seg[3])];
+        return send(ctx, state().followEdges.some((e) => e.from === login && e.to === other) ? { status: 204, body: undefined } : githubNotFound());
+    };
+    const usersGetById = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        if (!/^\d+$/.test(seg[1]))
+            return send(ctx, githubNotFound());
+        const st = state();
+        const known = new Set(['octocat', ...st.orgMembers.map((m) => m.login), ...st.oauthGrants.map((g) => g.login), ...st.prs.map((p) => p.user_login ?? '')].filter((l) => !!l));
+        const login = [...known].find((l) => twinUserId(l) === Number(seg[1]));
+        return send(ctx, login ? { status: 200, body: { ...toSimpleUser(login), id: twinUserId(login) } } : githubNotFound());
+    };
+    const usersListFollowedByAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().followEdges.filter((e) => e.from === me(ctx)).map((e) => asView('simple-user', toGithubUser(seedUser(e.to)))), query));
+    };
+    const usersCheckPersonIsFollowedByAuthenticated = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        return send(ctx, state().followEdges.some((e) => e.from === me(ctx) && e.to === decodeURIComponent(seg[2])) ? { status: 204, body: undefined } : githubNotFound());
+    };
+    const usersListFollowersForAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().followEdges.filter((e) => e.to === me(ctx)).map((e) => asView('simple-user', toGithubUser(seedUser(e.from)))), query));
+    };
+    const usersListEmailsForAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().userEmails, query).map(toGithubUserEmail));
+    };
+    const usersListPublicEmailsForAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().userEmails.filter((e) => e.visibility === 'public'), query).map(toGithubUserEmail));
+    };
+    const usersListPublicSshKeysForAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().userSshKeys, query).map(toGithubUserSshKey));
+    };
+    const usersGetPublicSshKeyForAuthenticatedUser = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const k = state().userSshKeys.find((x) => x.id === Number(decodeURIComponent(seg[2])));
+        return send(ctx, k ? { status: 200, body: toGithubUserSshKey(k) } : githubNotFound());
+    };
+    const usersListGpgKeysForAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate(state().userGpgKeys, query).map(toGithubUserGpgKey));
+    };
+    const usersGetGpgKeyForAuthenticatedUser = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const k = state().userGpgKeys.find((x) => x.id === Number(decodeURIComponent(seg[2])));
+        return send(ctx, k ? { status: 200, body: toGithubUserGpgKey(k) } : githubNotFound());
+    };
+    const usersListBlockedByAuthenticatedUser = async (ctx) => {
+        const { query, state } = gh(ctx);
+        return ctx.reply(paginate([...state().blockedUsers].sort().map((l) => asView('simple-user', toGithubUser(seedUser(l)))), query));
+    };
+    const usersCheckBlocked = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        return send(ctx, state().blockedUsers.has(decodeURIComponent(seg[2])) ? { status: 204, body: undefined } : githubNotFound());
+    };
+    const usersGetAuthenticated = async (ctx) => {
+        const { caller, state } = gh(ctx);
+        if (caller)
+            return ctx.reply(toGithubUser(seedUser(caller)));
+        return ctx.reply(toGithubUser({ ...seedUser('octocat'), ...state().userProfile, login: 'octocat' }));
+    };
+    const usersUpdateAuthenticated = async (ctx) => {
+        const { body, state } = gh(ctx);
+        const fields = {};
+        for (const k of ['name', 'bio', 'company', 'blog', 'location', 'email'])
+            if (body[k] !== undefined)
+                fields[k] = body[k];
+        await put(ctx, { operation: 'user_profile.update', subjectType: 'user_profile', subjectId: 'user_profile:octocat', fields });
+        return ctx.reply(toGithubUser({ ...seedUser('octocat'), ...state().userProfile, login: 'octocat' }));
+    };
+    const usersCreatePublicSshKeyForAuthenticatedUser = async (ctx) => {
+        const { body, occurredAt, state } = gh(ctx);
+        if (!body.key)
+            return ctx.reply({ message: 'Validation Failed', errors: [{ resource: 'PublicKey', field: 'key', code: 'missing_field' }] }, 422);
+        const id = nextSeq(ctx, 'sshkey');
+        await put(ctx, { operation: 'user_ssh_key.create', subjectType: 'user_ssh_key', subjectId: `sshkey:${id}`, fields: { key: String(body.key), title: String(body.title ?? ''), created_at: occurredAt } });
+        return ctx.reply(toGithubUserSshKey(state().userSshKeys.find((x) => x.id === id)), 201);
+    };
+    const usersDeletePublicSshKeyForAuthenticatedUser = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const id = Number(decodeURIComponent(seg[2]));
+        if (!state().userSshKeys.find((k) => k.id === id))
+            return send(ctx, githubNotFound());
+        await put(ctx, { operation: 'user_ssh_key.delete', subjectType: 'user_ssh_key', subjectId: `sshkey:${id}`, fields: { deleted: true } });
+        return send(ctx, { status: 204, body: undefined });
+    };
+    const usersCreateGpgKeyForAuthenticatedUser = async (ctx) => {
+        const { body, occurredAt, state } = gh(ctx);
+        if (!body.armored_public_key)
+            return ctx.reply({ message: 'Validation Failed', errors: [{ resource: 'GpgKey', field: 'armored_public_key', code: 'missing_field' }] }, 422);
+        const id = nextSeq(ctx, 'gpgkey');
+        const raw = String(body.armored_public_key);
+        const keyId = createHash('sha256').update(raw).digest('hex').slice(0, 16).toUpperCase();
+        await put(ctx, { operation: 'user_gpg_key.create', subjectType: 'user_gpg_key', subjectId: `gpgkey:${id}`, fields: { key_id: keyId, raw_key: raw, created_at: occurredAt } });
+        return ctx.reply(toGithubUserGpgKey(state().userGpgKeys.find((x) => x.id === id)), 201);
+    };
+    const usersDeleteGpgKeyForAuthenticatedUser = async (ctx) => {
+        const { seg, state } = gh(ctx);
+        const id = Number(decodeURIComponent(seg[2]));
+        if (!state().userGpgKeys.find((k) => k.id === id))
+            return send(ctx, githubNotFound());
+        await put(ctx, { operation: 'user_gpg_key.delete', subjectType: 'user_gpg_key', subjectId: `gpgkey:${id}`, fields: { deleted: true } });
+        return send(ctx, { status: 204, body: undefined });
+    };
+    return {
+        // the twin's own account (octocat) answers with the profile its owner edited (PATCH /user)
+        'users/get-by-username': usersGetByUsername,
+        // the signed-in person's repositories, by GitHub's affiliation (owner, collaborator, organization_member;
+        // all three by default) and visibility (all, public, private), sorted by full_name
+        'repos/list-for-authenticated-user': reposListForAuthenticatedUser,
+        // the organizations the signed-in person is an active member of, in GitHub's simple organization shape
+        'orgs/list-for-authenticated-user': orgsListForAuthenticatedUser,
+        'repos/list-for-user': reposListForUser,
+        // who follows :login, and whom :login follows
+        'users/list-followers-for-user': usersListFollowersForUser,
+        'users/list-following-for-user': usersListFollowingForUser,
+        // 204 if :login follows :other, else 404
+        'users/check-following-for-user': usersCheckFollowingForUser,
+        'activity/list-events-for-authenticated-user': userEvents(false, undefined),
+        'activity/list-public-events-for-user': userEvents(false, 'public'),
+        'activity/list-received-events-for-user': userEvents(true, undefined),
+        'activity/list-received-public-events-for-user': userEvents(true, 'public'),
+        // an account by its id, among the accounts the twin knows (its own octocat, members, token holders, authors)
+        'users/get-by-id': usersGetById,
+        'users/list-followed-by-authenticated-user': usersListFollowedByAuthenticatedUser,
+        'users/check-person-is-followed-by-authenticated': usersCheckPersonIsFollowedByAuthenticated,
+        // the authenticated user's own followers
+        'users/list-followers-for-authenticated-user': usersListFollowersForAuthenticatedUser,
+        'users/list-emails-for-authenticated-user': usersListEmailsForAuthenticatedUser,
+        'users/list-public-emails-for-authenticated-user': usersListPublicEmailsForAuthenticatedUser,
+        'users/list-public-ssh-keys-for-authenticated-user': usersListPublicSshKeysForAuthenticatedUser,
+        'users/get-public-ssh-key-for-authenticated-user': usersGetPublicSshKeyForAuthenticatedUser,
+        'users/list-gpg-keys-for-authenticated-user': usersListGpgKeysForAuthenticatedUser,
+        'users/get-gpg-key-for-authenticated-user': usersGetGpgKeyForAuthenticatedUser,
+        'users/list-blocked-by-authenticated-user': usersListBlockedByAuthenticatedUser,
+        // "Check if a user is blocked by the authenticated user" → 204 blocked / 404 not.
+        'users/check-blocked': usersCheckBlocked,
+        // the token's own user when the twin's user door minted it; else the deterministic octocat
+        'users/get-authenticated': usersGetAuthenticated,
+        'users/update-authenticated': usersUpdateAuthenticated,
+        'users/add-email-for-authenticated-user': async (ctx) => emails(ctx, false),
+        'users/delete-email-for-authenticated-user': async (ctx) => emails(ctx, true),
+        'users/create-public-ssh-key-for-authenticated-user': usersCreatePublicSshKeyForAuthenticatedUser,
+        'users/delete-public-ssh-key-for-authenticated-user': usersDeletePublicSshKeyForAuthenticatedUser,
+        'users/create-gpg-key-for-authenticated-user': usersCreateGpgKeyForAuthenticatedUser,
+        'users/delete-gpg-key-for-authenticated-user': usersDeleteGpgKeyForAuthenticatedUser,
+        // block / unblock answer 204
+        'users/block': async (ctx) => block(ctx, true),
+        'users/unblock': async (ctx) => block(ctx, false),
+        // follow / unfollow answer 204
+        'users/follow': async (ctx) => follow(ctx, true),
+        'users/unfollow': async (ctx) => follow(ctx, false),
+    };
+}
+/** POST /user/emails adds, DELETE removes; both take `{emails}` or a bare array. The first address a
+ *  user adds is primary and public. */
+async function emails(ctx, remove) {
+    const { body, state } = gh(ctx);
+    const list = Array.isArray(body.emails) ? body.emails.map(String) : Array.isArray(body) ? body.map(String) : [];
+    if (!list.length)
+        return ctx.reply({ message: 'Validation Failed', errors: [{ resource: 'Email', field: 'emails', code: 'missing_field' }] }, 422);
+    const st = state();
+    for (const email of list) {
+        const subjectId = `useremail:${email}`;
+        if (remove) {
+            await put(ctx, { operation: 'user_email.delete', subjectType: 'user_email', subjectId, fields: { deleted: true, email } });
+        }
+        else {
+            const isFirst = st.userEmails.length === 0 && email === list[0];
+            await put(ctx, { operation: 'user_email.upsert', subjectType: 'user_email', subjectId, fields: { email, primary: isFirst, verified: true, visibility: isFirst ? 'public' : 'private' } });
+        }
+    }
+    if (remove)
+        return send(ctx, { status: 204, body: undefined });
+    return ctx.reply(state().userEmails.map(toGithubUserEmail), 201);
+}
+async function block(ctx, blocking) {
+    const login = decodeURIComponent(gh(ctx).seg[2]);
+    await put(ctx, { operation: blocking ? 'user_block.create' : 'user_block.delete', subjectType: 'user_block', subjectId: `block:${login}`, fields: blocking ? { login } : { login, deleted: true } });
+    return send(ctx, { status: 204, body: undefined });
+}
+async function follow(ctx, following) {
+    const login = decodeURIComponent(gh(ctx).seg[2]);
+    await put(ctx, { operation: following ? 'user_following.add' : 'user_following.remove', subjectType: 'user_following', subjectId: `following:${me(ctx)}:${login}`, fields: { login, following } });
+    return send(ctx, { status: 204, body: undefined });
+}

package/dist/src/semantics/webhooks.d.ts

@@ -0,0 +1,2 @@
+import type { Semantics } from '@volter/world-core';
+export declare function webhooksSemantics(): Record<string, Semantics>;

package/dist/src/semantics/webhooks.js

@@ -0,0 +1,107 @@
+import { githubNotFound, hookConfigOverlaps, paginate, toGithubWebhook, toGithubWebhookConfig, validateGithubWebhook } from "../github-twin.js";
+import { handleGithubWebhookRequest, hookLastResponse, pingGithubHook } from "../github-events.js";
+import { gh, nextSeq, put, send } from "./shared.js";
+const hookOf = (ctx) => {
+    const { repo, seg, state } = gh(ctx);
+    const id = Number(decodeURIComponent(seg[4]));
+    return { id, hook: state().webhooks.find((h) => h.repository === repo && h.id === id) };
+};
+/** PATCH the hook (events, active, config; an omitted secret is removed) or only its config (a
+ *  secret is kept unless named), refused when the result would duplicate another hook. */
+const updateHook = (configOnly) => async (ctx) => {
+    const { id, hook } = hookOf(ctx);
+    if (!hook)
+        return send(ctx, githubNotFound());
+    const { repo, body, occurredAt, state } = gh(ctx);
+    const error = validateGithubWebhook(body, configOnly, false);
+    if (error)
+        return send(ctx, error);
+    const cfg = (configOnly ? body : (body.config ?? {}));
+    const response = await ctx.atomically(() => {
+        const hooks = state().webhooks;
+        const current = hooks.find((h) => h.repository === repo && h.id === id);
+        if (!current)
+            return { value: githubNotFound() };
+        const fields = { repository: repo, updated_at: occurredAt };
+        if (!configOnly) {
+            if (body.active !== undefined)
+                fields.active = body.active;
+            if (body.events !== undefined || body.add_events !== undefined || body.remove_events !== undefined) {
+                const events = [...(body.events ?? current.events), ...(body.add_events ?? [])];
+                const removed = new Set(body.remove_events ?? []);
+                fields.events = [...new Set(events)].filter((event) => !removed.has(event));
+            }
+            fields.secret = cfg.secret ?? '';
+        }
+        if (cfg.url !== undefined)
+            fields.url = cfg.url;
+        if (cfg.content_type !== undefined)
+            fields.content_type = cfg.content_type;
+        if (cfg.secret !== undefined)
+            fields.secret = cfg.secret;
+        const next = { ...current, ...fields };
+        if (hookConfigOverlaps(hooks, next, id))
+            return { value: { status: 422, body: { message: 'Hook already exists on this repository' } } };
+        return { value: { status: 200, body: configOnly ? toGithubWebhookConfig(next) : toGithubWebhook(next) }, write: { resource: 'webhook', id: `webhook:${id}`, fields, operation: 'webhook.update' } };
+    });
+    return send(ctx, response);
+};
+/** The delivery doors, answered by the delivery pipeline. */
+const deliveries = async (ctx) => (await handleGithubWebhookRequest(ctx.call.request, { ...(ctx.root !== undefined ? { root: ctx.root } : {}) })) ?? send(ctx, githubNotFound());
+export function webhooksSemantics() {
+    const reposListWebhooks = async (ctx) => {
+        const { repo, query, state } = gh(ctx);
+        return ctx.reply(paginate(state().webhooks.filter((h) => h.repository === repo), query).map((h) => ({ ...toGithubWebhook(h), last_response: hookLastResponse(h.repository, h.id, ctx.root) })));
+    };
+    const reposGetWebhook = async (ctx) => {
+        const { hook } = hookOf(ctx);
+        return send(ctx, hook ? { status: 200, body: { ...toGithubWebhook(hook), last_response: hookLastResponse(hook.repository, hook.id, ctx.root) } } : githubNotFound());
+    };
+    const reposGetWebhookConfigForRepo = async (ctx) => {
+        const { hook } = hookOf(ctx);
+        return send(ctx, hook ? { status: 200, body: toGithubWebhookConfig(hook) } : githubNotFound());
+    };
+    const reposCreateWebhook = async (ctx) => {
+        const { repo, body, occurredAt, root, state } = gh(ctx);
+        const error = validateGithubWebhook(body, false, true);
+        if (error)
+            return send(ctx, error);
+        const cfg = (body.config ?? {});
+        const events = body.events ?? ['push'];
+        const fields = { repository: repo, active: body.active !== false, events, url: cfg.url, content_type: cfg.content_type ?? 'form', ...(cfg.secret !== undefined ? { secret: cfg.secret } : {}), created_at: occurredAt, updated_at: occurredAt };
+        const hook = await ctx.atomically(() => {
+            if (hookConfigOverlaps(state().webhooks, fields))
+                return { value: undefined };
+            const id = nextSeq(ctx, 'webhook');
+            return { value: { id, name: 'web', ...fields }, write: { resource: 'webhook', id: `webhook:${id}`, fields, operation: 'webhook.create' } };
+        });
+        if (hook === undefined)
+            return ctx.reply({ message: 'Hook already exists on this repository' }, 422);
+        // GitHub pings a hook it creates; a delivery failure does not undo the hook
+        try {
+            await pingGithubHook(repo, hook.id, { occurredAt, ...(root !== undefined ? { root } : {}) });
+        }
+        catch { /* fire-and-forget */ }
+        return ctx.reply(toGithubWebhook(hook), 201);
+    };
+    const reposDeleteWebhook = async (ctx) => {
+        const { id, hook } = hookOf(ctx);
+        if (!hook)
+            return send(ctx, githubNotFound());
+        await put(ctx, { operation: 'webhook.delete', subjectType: 'webhook', subjectId: `webhook:${id}`, fields: { deleted: true, repository: gh(ctx).repo } });
+        return send(ctx, { status: 204, body: undefined });
+    };
+    return {
+        'repos/list-webhooks': reposListWebhooks,
+        'repos/get-webhook': reposGetWebhook,
+        'repos/get-webhook-config-for-repo': reposGetWebhookConfigForRepo,
+        'repos/create-webhook': reposCreateWebhook,
+        'repos/update-webhook': updateHook(false),
+        'repos/update-webhook-config-for-repo': updateHook(true),
+        'repos/delete-webhook': reposDeleteWebhook,
+        'repos/list-webhook-deliveries': deliveries,
+        'repos/get-webhook-delivery': deliveries,
+        'repos/redeliver-webhook-delivery': deliveries,
+        'repos/ping-webhook': deliveries,
+    };
+}

package/dist/test-fixtures/github-a11y-reference.pr-list.SOURCE.md

@@ -0,0 +1,56 @@
+# github-a11y-reference.pr-list.json — provenance (TWIN-51 / H5, dev/02)
+
+Real github.com accessibility-tree (role/name) reference for the PR-list a11y-congruence
+BONUS check (`packages/world-tooling/src/a11ySnapshot.ts`, `diffA11yShape`). Consumed by
+`packages/twin/github/src/github-a11y-snapshot.uitest.ts`, which diffs it SHAPE-ONLY against a
+live capture of the mirror's own PR-list for the same seeded scenario
+(`github-journey.uitest.ts:58-86`) and PRINTS the result — this check never gates (see
+`a11yBonusOutcome`, hardcoded zero).
+
+## Adjudication — no user-authorized session required
+
+TWIN-51's dev/01 evidence left a tracker comment asserting dev/02 "requires a user-authorized
+session." That premise is FALSE for the scenario actually being compared: a repo-scoped
+**public** pull-request list. `https://github.com/<owner>/<repo>/pulls` is a public page —
+reachable, and its accessibility tree capturable, with **no login at all**. This fixture is
+the proof: it was captured logged out. (Superseding tracker comment recorded on
+`.volter/tracker/markdown/TWIN-51.md`, dated 2026-07-09.)
+
+## Capture facts
+
+- **Source URL:** `https://github.com/microsoft/vscode/pulls` (a large, permanently-public,
+  high-traffic open-source repo's PR list — stable choice of target; overridable via
+  `GITHUB_A11Y_PUBLIC_REPO_URL`)
+- **Capture date:** 2026-07-09
+- **Session:** logged OUT — no auth, no storage-state, no cookies seeded. Verified live at
+  capture time: `GET https://github.com/microsoft/vscode/pulls` → **HTTP 200**, and the
+  response's own `logged_in` cookie read back as `"no"` (github.com's own logged-out/in
+  signal). The script (`scripts/capture/github-a11y.ts`) asserts both of these and refuses
+  to write output otherwise.
+- **Tool:** Playwright `chromium` (headless), `page.locator(selector).ariaSnapshot()`, driven
+  by `scripts/capture/github-a11y.ts` (no-auth default mode).
+- **Captured region:** `[aria-label="Issues"][role="group"]` — the PR-row list region on the
+  repo's `/pulls` page (a real `<div role="group" aria-label="Issues">` wrapping just the PR
+  rows), excluding the repo header/nav/filter-toolbar chrome above it, which is real-github
+  page furniture and not part of the seeded PR-list SCENARIO the mirror side reproduces.
+- **Scrub rule** (same doctrine as `scripts/capture/slack.ts`): every accessible `name` is
+  redacted to the literal string `"x"`; `role` and the tree's shape (`children`) are
+  preserved byte-for-byte. **No real PR titles, usernames, avatars, comment counts, or any
+  other page content is committed** — only the structural role tree, which is all
+  `diffA11yShape` ever compares.
+
+## Shape summary (post-scrub)
+
+265 total nodes: 1 `group` root, 121 `link`, 121 `/url` (Playwright's own href-line
+pseudo-role, one per link), 22 `img` (contributor avatars). 1447 lines of scrubbed JSON.
+
+## Regenerating
+
+```
+bun run scripts/capture/github-a11y.ts \
+  > packages/twin/github/test-fixtures/github-a11y-reference.pr-list.json
+```
+
+(No env var needed — no-auth is the default. `GITHUB_A11Y_PUBLIC_REPO_URL` overrides the
+target repo; `GITHUB_A11Y_STORAGE_STATE` switches to the opt-in authed cross-repo-dashboard
+mode instead, unrelated to this fixture.)