Part of #10414; the first use is the owner's morning-paper app.
Done:
[ ] On the read-only repo's settings the owner names an app he owns, or a crew member, and grants it read; the grant is scoped to that repo and to reads, listed with a revoke button, and recorded in the decision ledger.
[ ] A granted app's token reads the repo's commits, branches and pulls over the API; an ungranted app gets 404; after revoke it gets 404 again. A granted crew member sees it in its brief; an ungranted one does not.
[ ] No grant ever enables a write; a test asserts a granted app's write is origin_read_only.
[ ] bun test test/origin-read-grant.test.ts passes.
Files: src/actions/origins.ts, src/web/pages/origins.ts, test/origin-read-grant.test.ts
Risks: grants must be checked on every read path the privacy issue closed, not only the API.
Suggested: torque.
Part of #10414; the first use is the owner's morning-paper app.
Done:
origin_read_only.bun test test/origin-read-grant.test.tspasses.Files: src/actions/origins.ts, src/web/pages/origins.ts, test/origin-read-grant.test.ts Risks: grants must be checked on every read path the privacy issue closed, not only the API. Suggested: torque.