gh-inari 0.14.1 → 0.15.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "inari",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "Governed GitHub Issue/PR/template workflows via the inari CLI. Prefer inari over raw gh for operations it owns; use inari skill for operational playbooks.",
   "skills": "skills/inari"
 }

package/README.md

@@ -37,6 +37,21 @@ npx --yes gh-inari --version --json
 
 Inari uses the current GitHub authentication and repository context. Use `--repository owner/name` when the target is not the current checkout.
 
+To connect a repository Runtime, install the Inari GitHub App, then run the
+repository setup Golden Path:
+
+```bash
+inari setup
+# If setup reports trust-pending, open the printed Runtime Authority record
+# in a governed trust PR and merge it on the protected default branch.
+inari setup
+inari runtime connect
+```
+
+Setup stores only a repository-scoped, secret-free Runtime profile. It never
+commits, pushes, approves, or merges Runtime Authority trust; `ready` is
+reported only after canonical protected-ref readiness succeeds.
+
 ## The governed path
 
 ```text
@@ -58,6 +73,23 @@ inari change abort <number> --json
 
 The normative end-to-end model lives in [Inari Golden Path Architecture](./docs/GOLDEN_PATH_ARCHITECTURE.md).
 
+### Integration routing
+
+Epic work may use three governed integration levels:
+
+```text
+Epic (epic/<number>-<slug>)
+  <- source Issue (issue/<number>-<slug>)
+       <- Implementation (feat|fix|refactor|test|docs|chore/<number>-<slug>)
+```
+
+Implementation PRs target the source-Issue branch, source-Issue integration PRs
+target the parent Epic branch, and Epic integration PRs target the governed
+default branch. The canonical routing projection validates relationships and
+uses branch names only as identity/consistency evidence. Sibling Implementations
+may proceed concurrently; merge order is not a dependency DAG. Standalone
+Issues and explicitly legacy in-flight Epic routes remain compatible.
+
 ## Design principles
 
 | Principle              | Contract                                                                                                                                   |

package/dist/agent-authority/branch-advance.d.ts

@@ -1,10 +1,11 @@
 import { type CapabilityExecutionProvenance } from "./capability-provenance.js";
-import type { AuthenticatedSessionContext } from "./session-authentication.js";
+import type { SessionAdmissionAuthorizationContext } from "./session-authentication.js";
 import type { SessionAgentMetadata } from "./session-bundle.js";
 import { type ImplementationReworkMarker } from "../implementation-rework.js";
+import type { ImplementationScopeOperation } from "../implementation-contract.js";
 import { type GitHubBranchAdvanceCapability } from "../github/git-data-capability.js";
 import type { AdmittedSessionCapability } from "./capability-admission.js";
-import type { RepositoryIdentity } from "../github/effect-authorizer.js";
+import { type RepositoryIdentity } from "../github/effect-authorizer.js";
 export declare const BRANCH_ADVANCE_CONTRACT_VERSION: 1;
 export declare const BRANCH_ADVANCE_OPERATION: "branch.advance";
 export declare const BRANCH_ADVANCE_OUTCOMES: readonly ["advanced", "idempotent", "stale", "failed", "recovery-required"];
@@ -72,11 +73,68 @@ export interface BranchAdvanceCapabilityBroker {
     }, operation: (capability: GitHubBranchAdvanceCapability) => Promise<T>) => Promise<T>;
 }
 export interface ExecuteBranchAdvanceOptions {
-    readonly context: AuthenticatedSessionContext;
+    readonly context: SessionAdmissionAuthorizationContext;
     readonly broker: BranchAdvanceCapabilityBroker;
     readonly admission: AdmittedSessionCapability;
     readonly request?: unknown;
     readonly now?: Date | number | (() => Date | number);
 }
+export type BranchAdvanceAuthorizedPathOperation = Exclude<ImplementationScopeOperation, "READONLY">;
+export interface BranchAdvanceAuthorizedPath {
+    readonly path: string;
+    /** The exact Implementation scope operations admitted for this requested path. */
+    readonly operations: readonly BranchAdvanceAuthorizedPathOperation[];
+}
+/**
+ * Bounded path authorization issued after Session/Implementation Admission.
+ * The request digest binds this evidence to the complete signed semantic
+ * request without carrying the Session request signature or Session context.
+ */
+export interface BranchAdvanceAuthorizationEvidence {
+    readonly version: 1;
+    readonly requestDigest: string;
+    readonly implementation: Readonly<{
+        number: number;
+        governedBodyDigest: string;
+    }>;
+    readonly paths: readonly BranchAdvanceAuthorizedPath[];
+}
+export interface BranchAdvanceAuthorizationOptions {
+    readonly context: SessionAdmissionAuthorizationContext;
+    readonly admission: AdmittedSessionCapability;
+    readonly request?: unknown;
+}
+export type BranchAdvanceAuthorizationResult = Readonly<{
+    readonly valid: true;
+    readonly request: BranchAdvanceSemanticRequest;
+    readonly authorization: BranchAdvanceAuthorizationEvidence;
+}> | Readonly<{
+    readonly valid: false;
+    readonly failure: BranchAdvanceSemanticResult;
+}>;
+export interface ExecuteBranchAdvanceEffectsOptions {
+    readonly repository: RepositoryIdentity;
+    readonly provenance: CapabilityExecutionProvenance;
+    readonly request: unknown;
+    readonly authorization: unknown;
+    readonly broker: BranchAdvanceCapabilityBroker;
+    readonly now?: Date | number | (() => Date | number);
+}
 export declare function validateBranchAdvanceSemanticRequest(input: unknown): BranchAdvanceValidationResult;
+export interface BranchAdvanceAuthorizationValidationResult {
+    readonly valid: boolean;
+    readonly authorization?: BranchAdvanceAuthorizationEvidence;
+    readonly diagnostics: readonly string[];
+}
+/** Validate the bounded Admission evidence against the exact branch request. */
+export declare function validateBranchAdvanceAuthorizationEvidence(input: unknown, requestInput: unknown): BranchAdvanceAuthorizationValidationResult;
+/**
+ * Complete Session, capability, binding, protected-path, and Implementation
+ * scope authorization before the post-admission execution boundary. No Git
+ * provider capability or mutation is acquired here.
+ */
+export declare function authorizeBranchAdvance(options: BranchAdvanceAuthorizationOptions): BranchAdvanceAuthorizationResult;
+/** Execute only provider effects from an Admission-authorized branch request. */
+export declare function executeBranchAdvanceEffects(options: ExecuteBranchAdvanceEffectsOptions): Promise<BranchAdvanceSemanticResult>;
+/** Compatibility composition: authorize first, then share the same provider-effect primitive. */
 export declare function executeBranchAdvance(options: ExecuteBranchAdvanceOptions): Promise<BranchAdvanceSemanticResult>;