# I1 Repository-Scoped Trusted Publication Gates — 2026-08-22

Mode: Unlazy solo / tree 3. This slice is incomplete until every gate has command-backed evidence. No owner FactoryRun or account login is part of this gate set.

## Leaf A — repository identity + GitHub transport

- [x] G1: `Project.repositoryUrl` is parsed into one canonical GitHub repository identity and non-GitHub/ambiguous URLs fail closed.
  CHECK: `pnpm vitest run tests/providers/vcs-github/vcs-github-http.test.ts`
  EXPECT: repository identity parser cases pass, including HTTPS/SSH equivalence and wrong-host/path rejection.
  EVIDENCE: debian2, 2026-08-22; `vcs-github-http.test.ts` 4/4 PASS. Parser test proves canonical HTTPS/SSH equivalence plus credential-bearing/wrong-host/ambiguous-path rejection.

- [x] G2: a concrete server-side GitHub client performs repository inspection/publication/merge operations through GitHub APIs without exposing reusable credentials to Agent workspaces.
  CHECK: `pnpm vitest run tests/providers/vcs-github/vcs-github-http.test.ts tests/providers/vcs-github/vcs-github.test.ts`
  EXPECT: HTTP transport and provider contract tests pass for credential-reference auth, read-back, candidate fidelity, moved base/target, and replay.
  EVIDENCE: debian2, 2026-08-22; HTTP client 4/4 PASS and provider adapter 11/11 PASS. Tests cover credential resolver usage, exact candidate publication/read-back, replay reconciliation, exact merge, moved target refusal, candidate fidelity, ambiguous-success reconciliation, and authority rejection.

## Leaf B — authoritative ChangeSet publication/merge state

- [x] G3: ChangeSet publication/merge references and resulting revision are persisted durably and remain candidate-bound.
  CHECK: `pnpm vitest run tests/integration/persistence.test.ts tests/persistence/schema.test.ts`
  EXPECT: persistence round-trip proves publication reference, merge reference, target identity, and resulting revision survive reload.
  EVIDENCE: debian2, 2026-08-22; persistence 5/5 PASS and schema 1/1 PASS. New Drizzle migration `0009_tricky_mandrill.sql` generated on debian2 with matching snapshot/journal.

- [x] G4: trusted publication precedes review; merge derives repository authority from `ChangeSet -> Project.repositoryUrl`, reloads exact provider state, and refuses wrong repository/base/candidate/target.
  CHECK: `pnpm vitest run tests/integration/verification-merge-gate.test.ts tests/application/trusted-merge.test.ts`
  EXPECT: repository rebind, moved target, failed evidence/finding, missing trusted authority, and successful repository-scoped publication+merge are covered.
  EVIDENCE: debian2, 2026-08-22; verification/merge integration 4/4 PASS; trusted-merge 2/2 PASS. Integration proves moved target and Project repository rebind fail closed, and missing trusted authority preserves the workspace for publication retry.

- [x] G5: publication/merge replay is idempotent and single-writer safe; an already published/merged candidate reconciles rather than mutating twice.
  CHECK: `pnpm vitest run tests/providers/vcs-github/vcs-github-http.test.ts tests/providers/vcs-github/vcs-github.test.ts`
  EXPECT: replay produces one logical publication and one logical merge with stable provider references/result revision; conflicting replay fails closed.
  EVIDENCE: debian2, 2026-08-22; HTTP transport tests prove one publication ref and one merge with replay reconciliation; provider tests prove ambiguous-success reconciliation and conflicting-candidate replay refusal.

## Leaf C — product composition + dogfood boundary

- [x] G6: control-plane composition uses the GitHub trusted publisher/merger for Project-scoped publication and no longer uses a local checkout as merge authority. Credential material is server-side only and missing GitHub authority fails closed.
  CHECK: `pnpm vitest run tests/application/security.test.ts tests/security/execution/execution-security.test.ts` plus `rg -n "AWP_TRUSTED_REPOSITORY_PATH|LocalGitTrustedMergeAdapter|ChangeSetMergeAdapter" apps packages infra tests`.
  EXPECT: no Agent credential exposure; no legacy local-checkout merge authority remains; explicit server-side credential-file/reference boundary is required.
  EVIDENCE: debian2 full `pnpm check` includes security suites PASS; repository grep returned no matches. Production composition uses `AWP_SOURCE_REPOSITORY_PATH` only for clean ACP source seeding and optional `AWP_GITHUB_PUBLICATION_TOKEN_FILE` only in control-plane authority.

- [x] G7: the exact repository gate is green on an authorized buildbox at final HEAD, and live debian3 remains healthy with zero FactoryRun/AgentRun/ChangeSet rows and empty account inventory after deployment/config convergence.
  CHECK: `pnpm check` on an authorized buildbox, then live debian3 health/account/DB/deployment inspection.
  EXPECT: full gate PASS; migrations clean; required system pods 1/1; accounts `[]`; execution rows unchanged unless the owner explicitly initiated work.
  EVIDENCE: candidate `138a7d5` PASS. debian2 full gate: typecheck + lint + 142 active tests (5 skipped) + build + architecture (111 modules/195 dependencies, zero violations) + Prettier all PASS. debian3 deployment PASS: health migrations 10/10 with zero drift; postgres/control-plane/web all active; Subrouter/model-gateway/Fabro 1/1 on pinned registry digests; accounts `[]`; FactoryRun/AgentRun/ChangeSet/VerificationEvidence/ReviewFinding counts all zero.

## Integration gate

- [x] G8: all G1-G7 evidence is current at the final candidate revision; no numeric/pass claim is copied from an earlier commit.
  CHECK: re-run final repository gate as needed; re-read this ledger and current `git status`/HEAD after deployment checkpoint.
  EXPECT: 8/8 gates checked with non-pending evidence and a clean checkpointed worktree.
  EVIDENCE: code candidate `138a7d5` was clean, pushed to `origin/ops/i1-dogfood-deploy`, fully checked on debian2, then deployed from that exact clean worktree to debian3 and remeasured live. All G1-G7 evidence above is from the current candidate, not copied from the earlier handoff commit.