dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

docs: simplify GitHub credential guidance (#3630)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-09-12 22:51:06 +01:00
committed by GitHub
parent 56bc954001
commit f150dd32d1
6 changed files with 301 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/integrations/requirements/github-authentication.md
+2
View File
@@ -32,6 +32,8 @@ GitHub credentials must not silently cross workspace boundaries. A local workspa
- **AC-INTEGRATIONS-GITHUB-AUTHENTICATION-001.11:** When a Local or Worktree task launches or resumes, the system shall inspect each attached Kandev-managed GitHub checkout before the agent starts. This behavior includes a prepared workspace that the task reuses.
- **AC-INTEGRATIONS-GITHUB-AUTHENTICATION-001.12:** The system shall reconcile each managed checkout to the canonical transport for the current task policy. It shall not rewrite an already-canonical origin or a user-managed local checkout.
- **AC-INTEGRATIONS-GITHUB-AUTHENTICATION-001.13:** The public guide shall explain historical managed defaults, preserved upgrade policies, and recovery through explicit task-access selection. It shall distinguish managed checkouts, user-managed checkouts, and remote executors.
## System design
The migrated technical source is split into [part 1](../system-design/github-authentication-01.md), [part 2](../system-design/github-authentication-02.md), [part 3](../system-design/github-authentication-03.md).
docs/specs/integrations/system-design/github-authentication-03.md
+18
View File
@@ -257,3 +257,21 @@ New-workspace defaults are defined by
[ADR-2026-08-02-new-workspace-github-access-defaults](../../../decisions/2026-08-02-new-workspace-github-access-defaults.md).
The system-service ownership boundary is defined by
[ADR-2026-07-31-system-service-user-continuity](../../../decisions/2026-07-31-system-service-user-continuity.md).
## Upgrade recovery guidance
`AC-INTEGRATIONS-GITHUB-AUTHENTICATION-001.13` uses the existing public integration guide.
The guide distinguishes the historical `managed` schema default from the executor default for new workspaces.
An existing policy does not record whether the user selected it or a migration supplied it.
Recovery therefore uses an explicit task-access selection through the existing workspace connection dialog.
The procedure does not infer consent from an absent App registration or current credential health.
PAT and named CLI connections also support managed task access.
Local and Worktree launches reconcile Kandev-managed origins through the existing repository preparation path.
User-managed origins remain under user control. Remote executors require credentials in their own execution environment.
The guide must not promise that host `gh auth status` proves task Git access.
The current managed admission gate validates repository identity, not inherited transport authentication.
The [upgrade recovery fix package](../../../plans/github-credential-upgrade-recovery/plan.md)
owns delivery of this guidance. It changes no runtime or persistence boundary.