github_grid_assets 0.2.0-dev.5

GitHub App identity and authenticated REST transport for grid extensions.

0.2.0-dev.5

• REFACTOR(assets): retire the two hand-kept generation counters for the supersession scope (pow-jz93) (#360).
• FEAT(filing): refuse corrupting bead text - the eleventh FilingContract row refuses the NUL byte only (pow-2bkw) (#362).

0.2.0-dev.4

• Changed: floors grid_assets at ^0.7.0-dev.4, the ten-row viability FilingContract (#323) and the bounded explore-decision gather (#355, #356); no public API of this package breaks.
• Fixed: workflow-run intake auto-approval binds the SAME live filing evidence the approve verb binds. GitHubReconcilerBindingAssets now hands its ApproveService the seat's own SubstationScope, its ambient GridRoot path and a new nullable decisionInvocation — the composing station's configured verb, threaded from SubstationSeed.assetRenderArguments['runner'] and never defaulted to a literal executable. Without it the ten-row preflight had no owning scope and no index to ask, so every decision-citing bead the reconciler filed was refused on evidence nobody had gathered. attachedScopes stays empty: this path receives no station roster, and its approval runner serves the owning work-store root alone.

Commits:

• FIX(github_grid_assets): fence proxied-store temp workspace teardown in ci_rework_mint_acceptance_test (#352).
• FIX(committee): route from persisted critic verdicts (#346).
• BREAKING FEAT(filing): check that bead text is viable, not merely present (#323).

0.2.0-dev.3

Note: This release has breaking changes.

• Breaking: CiFeedbackProjection takes workBd and scope and no longer takes substation. Its landing-ready bd update ran through the grid STATE store runner it correlates sessions against, where no substation's work bead has ever lived, so a merged pull request resolved to sql: no rows in result set for every armed substation and THREW — wedging the reconciler before its poll and re-flaring the same observation every tick. bd now carries the session read and the state-store cap gate only; workBd carries the work-bead mutation to the store that mints that id, and substation is derived from scope.name. Migration: pass workBd: (the seat's own work-store runner) and scope: (the enclosing SubstationScope) and drop substation:. The only production call site is this package's GitHubReconcilerBindingAssets, which pairs the runner and scope it already watches.

• Changed: a work bead the scoped store cannot resolve — absent, or carrying a prefix that scope does not own — now reports the new kCiFeedbackLandingUnresolvedFlare and returns instead of throwing. The flare names the bead, the attempted work-store root and the store's own stderr, and fires once per decision idempotency key rather than once per cycle, so the observation is acknowledged and the cycle reaches its poll.

• Breaking: SubstationSeed.arming is replaced by SubstationSeed.seatSeeds, a List<SingleChildSeed> of the provider seeds the seats themselves vend, authored outermost-first and copied at construction so the seat owns its own rung. grid_assets retired AgentArming and TypedEnvironmentProvider, and this seed enumerates no seat type at all now. The seeds still nest ahead of everything else, so a seat mounted here shadows the station BY EXACT TYPE and a type it does not mount keeps resolving through the station; the selected-definition, Git, GitHub and mount-gate order is unchanged. Migration: replace arming: AgentArming(build: BuildAgentEnvironment([…])) with seatSeeds: [const BuildAgentEnvironment([…]).provider()] — one seat.provider() entry per preference, outermost first.

• BREAKING REFACTOR(agent): retire agent arming shim; mount seat provider seeds (#342).

• BREAKING FIX(github): route landing-ready updates to work stores (#344).

0.2.0-dev.2

• Breaking: BdGitHubIntakeStore drops its stateRoot argument and the reconciler binding's approval runner resolves the WORK store only. The grid state store it opened held the cross-store link beads the filing preflight read, and grid_engine 0.4.0-dev.3 deleted that surface (the_grid#447); self-approval now reads and stamps in one store.
• Migration: drop stateRoot: from every BdGitHubIntakeStore(...) construction and stop passing a state-store root to its approvals; the only call sites in this org are this package's own GitHubReconcilerBindingAssets.buildChild and its intake tests, both migrated here. GitHubReconcilerBindingAssets' own constructor is unchanged — stateRunnerFor still serves the feedback half — and a cross-store blocker is re-proved as a bd external:<project>:<capability> dependency row instead.
• Changed: adopts the 2026-09-13 the_grid dev.3 wave — genesis_tree ^0.4.0, grid_engine ^0.4.0-dev.3, grid_sdk ^0.4.0-dev.3, grid_runtime ^0.2.1-dev.2, grid_trajectory ^0.2.1-dev.2 and beads_dart ^0.3.0-dev.2, plus grid_cli ^0.6.0-dev.3 (pow-abaw).
• Changed: the seat's SourceControl fixtures implement SourceControl.baseShaFor (grid_engine 0.4.0-dev.2, the_grid#436).
• Note: this seat supplies NO station roster to the approve verb, so a self-authored record carrying an external:<project>:<capability> dependency row refuses its filing preflight fail-closed and is filed UNSTAMPED with the refusal in its notes, rather than stamped over a blocker nothing resolved (pow-f6pc; grid_assets power_station#the-dependencies-row-is-a-projection-of-bd-dependency-rows).

0.2.0-dev.1

• Breaking: GitHubReconcilerRuntime.start(), GitHubReconcilerRuntime.stop(), and GitHubReconcilerConfig.interval are removed; reconciliation is now owned by the station tick, and live GitHubReconcilerAssets throws StateError at build unless ambient TrajectoryConfig.obligationQueryExtensions contains exactly one GitHubReconciliationQuery.
• Migration: A station constructs one GitHubReconciliationQuery, registers that exact instance in TrajectoryConfig.obligationQueryExtensions, and provides that TrajectoryConfig above every live GitHubReconcilerAssets seat.

0.1.1-dev.1

• Floors grid_assets at ^0.7.0-dev.1 (sibling coherence for the seat-mechanism wave, pow-3xae).
• No source change of its own; rides the wave for sibling coherence.

0.1.0

• PROMOTED from 0.1.0-rc.16. This is the stable release of the 0.1.0 line; the code is the candidate's, unchanged. Every family dependency constraint is rewritten from its prerelease form to the stable one, because pub refuses a stable package that depends on a prerelease.
• Consumers on a ^0.1.0-rc.N constraint resolve this automatically: a caret range admits the release above its own prereleases, so no downstream pubspec edit is required to pick it up.

0.1.0-rc.16

• Changed: the grid_assets floor is ^0.6.0-rc.16 — the intake store tests reference kFilingApprovalRevisionPrefix, first exported there; the release scrub gate analyzes the package at its declared floors and caught the rc.13 floor.
• Added: the station keeps watching an OUTBOUND issue after it opens one. A seat declares GitHubIssueWatch(originatingBeadId:, owner:, repository:, issueNumber:) values on GitHubReconcilerConfig.issueWatches, and the reconciler observes each watched issue's resource and its Link-paginated timeline, emitting NormalizedGitHubEvent.issueCommented and NormalizedGitHubEvent.watchedIssueStateChanged (pow-1rn.8).
• Added: TWO read lanes, split by what a GitHub App can actually reach. A watch naming the seat's own repository rides the existing GitHubAppClient and its installation token. Every other repository is FOREIGN — an App cannot be installed on a third party's, for reading or writing — and rides the new GET-only GitHubReadClient over the same GitHubHttpTransport seam, token-less by default (Authorization omitted entirely) with an optional personal token named by GitHubReconcilerConfig.foreignReadTokenVariable. Writing to a foreign repository stays out of scope and human-authored.
• Added: the foreign lane has its OWN rate budget — a separate GitHubPollCoordinator keyed foreign/issue-watch, spaced by GitHubReconcilerConfig.foreignMinimumSpacing and clamped up to a 65-second floor whenever no token is configured, which keeps a four-request reserve inside GitHub's 60-per-hour unauthenticated allowance. An installed-repository start neither waits on that budget nor spends it.
• Added: the watch covers every terminal and near-terminal state, not just comments — closed as completed, closed as not planned, reopened, lock changes, transferred, deleted, converted to a discussion, and unreadable (private or 404). Closed, reopened, locked and unreadable watches keep polling; transferred, deleted and converted stop.
• Added: GitHubReconcilerCursor.issueWatches — per-coordinate issue identity, comment/timeline marks, state, reason, lock and update time, plus two conditional tags in the EXISTING etags map, written and evicted with their record. ADDITIVE at cursor version: 1: absence decodes empty, so a live seat upgrades in place; a present-but-wrong shape throws. Watch observations ride the existing pending queue with per-leg acknowledgement.
• Added: GitHubIssueWatchProjection, registered as the durable issue-watch delivery leg beside ci-feedback. It asks the EXISTING GitHubSelfTrust about the issue's AUTHOR — the only identity with an answer — and reopens the ORIGINATING bead with a deterministic note and github.watch.* metadata. It never approves anything: an external maintainer's reply lands the bead OPEN and unstamped, and the same update removes all three approval-stamp keys. GitHubReconcilerBindingAssets shares one trust and one bd store between both projections.
• Added: githubRestHeaders and githubFailureCause — one home each for the REST header contract and for the type-led, 300-character-bounded cause every GitHub failure escalates with; GitHubAppPrOpener now renders through the shared formatter unchanged.
• Changed: GitHubPollCoordinator.schedule is generic and returns its request's result, so a single scheduled GET can ride a budget. GitHubReconcilerRuntimeFactory and createGitHubReconcilerRuntime take a nullable foreignClient.
• Compatibility: every new configuration value is optional and defaults to the feature-off value. An empty issueWatches constructs no foreign transport, reads no environment variable and makes no watch request, so SpaceDelegate.substations and LunarDelegate.substations need no edit.

0.1.0-rc.15

• Added: the station reacts to a red workflow run that is not a station pull request. A seat declares WorkflowRunIntakeRules on GitHubReconcilerConfig.workflowRuns (workflow path + events + branches + conclusions + priority + validation plan + approve); the reconciler gains a /actions/runs?status=completed leg that emits NormalizedGitHubEvent.workflowRunConcluded — with each failed job and its first failed step — for matching runs only, and intake files the failure as an OPEN bug carrying the run metadata, its validation plan and one falsifiable acceptance checkbox. An empty rule list is the default and makes the leg spend no request at all (pow-1rn.7).
• Added: GitHubSelfTrust admits the seat's OWN github-workflow OWNER/REPOSITORY identity as TrustLevel.self beside the human login; every other repository — a fork's run above all — stays external, and the poll leg drops a foreign head_repository before it costs a jobs request.
• Added: a rule with approve: true self-approves its SELF-authority filing by CALLING grid_assets' ApproveService as github-workflow. The four-row filing preflight is unchanged and is still the only route to the grid.approved_* stamp; a refused preflight leaves the bead OPEN, unstamped, with the failing rows in its notes. See power_station#own-workflow-failures-are-self-approved.
• Added: GitHubReconcilerCursor.workflow_runs_since — ADDITIVE at cursor version: 1, so a cursor already on disk still loads.

0.1.0-rc.14

• Fixed: the CI feedback leg no longer runs bd export --all, which every proxied-server store refuses; one head-of-line CheckConcluded observation wedged a seat's GitHub poll forever and the failure never reached the station log (5 of 8 lunar seats were dark from 2026-09-03). CiFeedbackProjection composes one typed BdCliService.listScope session read, ignores-with-a-flare zero, many, or id-less matching sessions, gains a CiFeedbackReporter seam bound onto the binding-provided value, and the reconciler subscribes to the station transport above the substation git bundle; a source fence keeps bd export out of lib/ (pow-2xmo, #261).
• Fixed: approval receipts bind to the filing basis (#232).

0.1.0-rc.13

• Changed: SubstationSeed builds through grid_assets' single availability resolution — the seat mounts the selected generated definition Seeds from the resolved SubstationFactsSnapshot, and every seat keeps building without facts (the pre-resolution path) instead of failing closed (pow-4peu, #216).
• Floors tightened to grid_assets ^0.6.0-rc.13.

0.1.0-rc.12

• Fixed: deliver REUSES an open pull request for the branch (one GET, PATCH when the title/body changed, step.delivered with reused: true) instead of racing a create into HTTP 422 and stranding a reworked round held (pow-r4eo, #211).
• Floors tightened to grid_assets ^0.6.0-rc.12.

0.1.0-rc.11

• Fixed: the App transport encodes its body as UTF-8 at the SINK (ioRequest.add(utf8.encode(body))) and sends Content-Type: application/json; charset=utf-8. An IOSink falls back to iso-8859-1 when the content type carries no charset, and latin1 THROWS on the first code unit above U+00FF — so a single em dash in a PR body killed delivery before the request was ever sent. Encoding at the sink covers every caller, the /pulls POST and the installation-token exchange alike.
• Fixed: a THROWN PR-open error escalates type-first — generic advice leads and the cause trails as Cause (<runtimeType>): …, capped at 300 CHARACTERS (never a first-line cap: safeToString escapes newlines, so a serialized request renders as one multi-kilobyte line). Delivery passes the reason through landReasonTail, which keeps the TAIL, so the type and message now survive the cut instead of whatever an SDK error had embedded (pow-b14a, #201).
• Changed: the grid_assets floor is ^0.6.0-rc.11 — the in-set coherence floor for this wave.

0.1.0-rc.10

• Adopts the the_grid wave 2 and grid_assets 0.6.0-rc.10: floors grid_assets ^0.6.0-rc.10, grid_cli ^0.5.0-rc.12, grid_engine ^0.3.0-rc.12, grid_runtime ^0.2.0-rc.10, grid_sdk ^0.3.0-rc.10 (power_station#195). No API change.

0.1.0-rc.9

• Added: SubstationSeed, the COMPOSED per-seat stack, plus its SubstationAppIdentity delivery identity and the MountedSubstationSeed offline projection. A downstream station now composes a full GitHub-delivering seat from the_grid + power_station alone: the seed mounts the seat's TypedEnvironmentProvider rung, the mounted projection, grid_assets' GitGridAssets, the live-arm reconciler binding, GitHubReconcilerAssets, GitHubGridAssets and MountEligibilityAssets, and wraps the App client and PR opener on a live poll arm. SubstationAppIdentity.installationId is an int, so a malformed installation id fails where the seat is authored rather than during mount; the pre-existing GitHubAppConfig is untouched.
• Changed: the grid_assets floor is ^0.6.0-rc.9 — the seed consumes the arming mechanism vended there.

0.1.0-rc.8

• Breaking: GitHubSelfTrust.fromEnvironment takes an injected EnvironmentReader; nothing under lib/ reads Platform.environment ambiently any more, and the App-key asset tests are hermetic against an operator's exported GRID_GITHUB_APP_KEY_* variables (pow-vw38, #184).
• Breaking: the reconciler poll reads every Link page before advancing, and since moves only to the last examined update. Issue-shaped pull rows fetch the full pull resource; GitHubReconcilerCursor caches pullHeads beside their conditional tags (intake/pull/<nodeId>) and evicts the two together. nextGitHubPageUri is the one home for the Link parse (pow-40a4, #182).
• Added: a durable pending/delivered outbox on the cursor document. An observation is persisted pending before its sink runs, acknowledged per delivery leg (addObserver/removeObserver, kSinkDeliveryLeg), and replayed as a step of the next poll after a restart, so an event between a fetch and a crash is delivered exactly once. The document stays version 1 (pow-oe97, #183).
• Changed: GitHub intake bead writes (correlate, create, update) ride BdCliService, inheriting the shared compatibility and runner behaviour; requires dart_grid_assets at the rc that ships create(defer:, externalRef:, setMetadata:) and listScope (pow-0nvg, #174).
• Changed: the decision lane's lookup rides the composing station's roster-mode decisions index --surface, so a decision in a sibling register is reachable (#178).
• Breaking: GitHubIntakeStore.upsertDeferred is renamed upsert, and admitted GitHub intake beads are filed OPEN — the 9999-12-31 parking date is dropped (pow-5wo). The store writes no approval marker of any kind; absence of the approve verb's grid.approved_* stamp is the pending state (power_station#github-intake-files-open-and-unstamped).

0.1.0-rc.7

• Breaking: the reconciler tolerates pull rows and flare polling failures (pow-2s1, #143) — the polling loop no longer throws on a failed poll.
• Closed intake rows are filtered from reconciliation (#144).
• Model environments route through typed seats (pow-n6n.2, #168).
• Requires grid_cli ^0.5.0-rc.10 (the rc.8/rc.9 cap is lifted now that the hosted chain resolves) and grid_assets ^0.6.0-rc.7.

0.1.0-rc.6

• GitHubReconcilerBindingAssets: provides each live seat a durable GitHubCursorStore and SELF-only deferred-intake GitHubEventSink, completing the ambient seams required by GitHubReconcilerAssets to construct its polling runtime (#139).

0.1.0-rc.5

• GitHubAppClientAssets: per-seat GitHub App client construction with per-app key resolution — the key path comes from the env var each seat's privateKeyVar names (inert when unset, loud on a bad path or mode), replacing the single fixed GC_GITHUB_APP_KEY_PATH (#134).
• Committee fakes adopt the declared-tests-present lane; floors grid_assets ^0.6.0-rc.5 (#133).

0.1.0-rc.4

• The seat's ServiceBundle derivation uses ServiceBundle.derive — field drops are now compile errors (#126).

0.1.0-rc.3

• Landing postures as sibling DeliveryMethods: GitHubDeliveryPolicy values select GitHubPrDelivery (default), GitHubAutoMergeDelivery (native auto-merge only when validation rc == 0 and every committee grade is B or better), or GitHubDirectMergeDelivery (protected-aware); refused enables fall back loudly with named flares (#121).
• CI-feedback path: GitHubGridAssets observes GitHubReconcilerRuntime/CiFeedbackProjection from the tree; a failed CheckConcluded routes exactly one fenced grid/rework through the chokepoint, with the ratified attempt budget and cap gate (#122).
• GitHubReconcilerAssets: the provider that constructs a live GitHubReconcilerRuntime from a GitHubReconcilerConfig value and mounts it for the seat; config-absent and dry/offline compositions construct nothing (#123).

0.1.0-rc.2

• Requires grid_assets ^0.6.0-rc.1. This is the load-bearing change: 0.1.0-rc.1 could resolve alongside grid_assets 0.5.0-rc.1, which still exported GitHubPrDelivery, so a hosted resolve saw the same symbol from two packages and failed to compile ("'GitHubPrDelivery' is imported from both ..."). Local path overrides masked it; only a no-override resolve hit it. The tightened constraint makes that pairing unrepresentable.

Changelog

0.1.0-rc.1

• Initial release: GitHub App identity and authenticated REST transport.
• Home of the org's GitHub grid-asset implementations: GitHubAppPrOpener, GitHubPrDelivery, the GitHubGridAssets seed, and the reconciler/cursor surface, relocated out of grid_assets by pow-2ua (power_station #109). grid_assets holds the generic assets and the abstractions; the dependency runs implementation -> abstraction, so this package depends on grid_assets and never the reverse.
• Published as a pre-release because it depends on pre-release siblings (grid_assets ^0.5.0-rc.1, grid_engine ^0.3.0-rc.3, grid_runtime).