A trusted source on this same forge folds in like one on another forge #9552

A trusted account on this forge now folds in like a trusted source from another forge. The new tests pass, and tsc and scripts/gate.ts are clean.

I couldn't get a clean full run. test/guest-contribute.test.ts has one failure ("a person's own agent attaches by OAuth…", a git push that exits 128). It fails the same way on the parent commit without my change, so I left it alone. I only ran the trust-related test files, not the whole suite.

What changed

• foldsIn in src/core/trusted_sources.ts has a second way to say yes. A pull with no pull_source row folds in if it was opened from the author's own fork of the repository (not a mirror's), and the author's account is trusted for this forge's own host.
• Trust is read at the moment of the question, so a lapse or a removal makes the next pull wait for approval again. The existing stop switch applies the same way.
• foldsIn only has the database, so createApp now records this forge's host per database with setOwnHost. The same host name is used for the trust list entry.
• pullMayRun, the landing sweep, landsOnItsOwn, the guest-approval gate and the walls all go through foldsIn. No other call site changed.

Unchanged

• The walls still apply: foldWall runs the same path checks on these pulls, so secrets, credentials, permissions, the contract and release machinery still wait for a person.
• A pull whose head is on another forge still goes through pull_source as before.

Tests (test/trusted-fold.test.ts, new block "a trusted account working on this same forge (#9450)"):

• A trusted account's fork pull may run and lands by true merge, with two parents.
• A pull touching a wall stays open.
• A guest's pull (an untrusted account) cannot run and does not land.
• Stopping fold-in holds the pull until fold-in resumes.
• A lapsed trust holds the pull.

Not done

• I didn't persist this forge's host in a table or add a migration. The host is set in memory on every boot.
• I didn't record a pull_source row for local pulls. So no Landed-from trailer is added to these merges, and the pull page doesn't show a source label.

To try it: trust an account for this forge's host on the trusted-sources page, then open a pull from that account's fork of an autonomous repository.

🤖 Generated with Claude Code

Closes #9450

A trusted account on this forge now folds in like a trusted source from another forge. The new tests pass, and tsc and scripts/gate.ts are clean.

I couldn't get a clean full run. test/guest-contribute.test.ts has one failure ("a person's own agent attaches by OAuth…", a git push that exits 128). It fails the same way on the parent commit without my change, so I left it alone. I only ran the trust-related test files, not the whole suite.

What changed

• foldsIn in src/core/trusted_sources.ts has a second way to say yes. A pull with no pull_source row folds in if it was opened from the author's own fork of the repository (not a mirror's), and the author's account is trusted for this forge's own host.
• Trust is read at the moment of the question, so a lapse or a removal makes the next pull wait for approval again. The existing stop switch applies the same way.
• foldsIn only has the database, so createApp now records this forge's host per database with setOwnHost. The same host name is used for the trust list entry.
• pullMayRun, the landing sweep, landsOnItsOwn, the guest-approval gate and the walls all go through foldsIn. No other call site changed.

Unchanged

• The walls still apply: foldWall runs the same path checks on these pulls, so secrets, credentials, permissions, the contract and release machinery still wait for a person.
• A pull whose head is on another forge still goes through pull_source as before.

Tests (test/trusted-fold.test.ts, new block "a trusted account working on this same forge (#9450)"):

• A trusted account's fork pull may run and lands by true merge, with two parents.
• A pull touching a wall stays open.
• A guest's pull (an untrusted account) cannot run and does not land.
• Stopping fold-in holds the pull until fold-in resumes.
• A lapsed trust holds the pull.

Not done

• I didn't persist this forge's host in a table or add a migration. The host is set in memory on every boot.
• I didn't record a pull_source row for local pulls. So no Landed-from trailer is added to these merges, and the pull page doesn't show a source label.

To try it: trust an account for this forge's host on the trusted-sources page, then open a pull from that account's fork of an autonomous repository.

🤖 Generated with Claude Code