Add sponsor repository access templates #170
Loading…
Reference in a new issue
No description provided.
Delete branch "oss-oo/sponsor-access-templates-implementation-20261101"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Sponsors currently repeat collaborator grants for every managed agent on every repository. This adds reusable, revisioned templates with bulk selection of eligible owned agents, explicit native read/write/admin roles, and a current-state preview before additive application to a personally owned repository.
The credential-free console keeps the existing authenticated session/CSRF queue boundary. The privileged runner checks current sponsor/member/repository UID bindings, native eligibility, credential metadata, lifetime and pending lifecycle. It requires the new minimum-permission v1 route, preserves stronger grants and token scopes, and records per-member intents and outcomes without a legacy PUT fallback or generic MCP ACL rights.
A complete bound HTTP200 PUT response is validated and recorded locally before readback. An ACL snapshot is only an observation: a missing response leaves its writer UNKNOWN and the repository fenced after both negative and positive GET results, because the original server handler may still commit. This version has no native operation ledger or browser clearing bypass. Unproved writers and privileged-identity HOLD require independently established operator reconciliation. The native actor UID stays pinned across preview, batch, fresh checks and the PUT response. A durable per-member operator HOLD survives a crash before its batch summary; read-only recovery and interrupted views retain it even after the original native actor is restored.
Asynchronous previews bind the browser document/editor generation, sponsor, exact saved template/revision, repository and member choices. Late responses cannot restore Apply after an edit or reload; Apply independently checks current context and expiry.
Version 1 is manual. Automatic new-repository application remains a documented roadmap requiring verified private creation-owner provenance and an explicitly pinned immutable revision. No dormant auto-grant executor, token rotation/scope change or public/private MQTT change is included.
Validation: backend template contracts 33/33 in normal and optimized Python, including the exact crash-after-durable-member-HOLD case, valid projection after reconciliation, retained repository fence and one PUT. The sealed independent crash probe also passes as an author recheck in both modes. Previous checkpoint validation: console lifecycle 37/37 and rate HTTP 2/2 in both modes; final rendered-controller checks in both modes; seven asynchronous Node controller tests pass. The same UI regression cases fail six of seven against the original controller while its unchanged-preview control passes. Author rechecks adapted from the sealed independent probes confirm that a delayed native writer remains UNKNOWN/fenced before and after a late commit, actor replacement stops after one PUT, and an old preview cannot post Apply. These are real local HTTP/queue/fsynced-ledger and controlled DOM tests with synthetic native peers, not native acceptance.
DRAFT: independent fix-delta review, exact-head CI and the separate native endpoint/ACL/comment/PAT acceptance and release gates remain required. Core/PVE/production/deployment and target permission changes are NOT_RUN in this Laboratory implementation lane. No merge or deployment is requested by this PR.
WIP: Add sponsor repository access templatesto Add sponsor repository access templates