kandev/docs/plans/github-authentication/task-05-service-routing.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
05-service-routing	Workspace-aware GitHub service routing	completed	4	02-app-token-primitives 03-workspace-credential-resolver 04-app-oauth-webhooks	plan.md	../../specs/integrations/requirements/github-authentication.md

Task 05: Workspace-Aware GitHub Service Routing

Inputs

• Spec: Identity And Routing, repository boundary, failure modes, and background/personal scenarios.
• ADR 0047: no process-global operational client and principal-scoped cache/rate state.
• Resolver contract from Tasks 02-04.

Acceptance

• All GitHub domain operations resolve an explicit workspace/purpose; direct production use of the singleton Service.client and Service.authMethod is removed.
• Task, PR, issue, watch, cleanup, and CI paths derive and verify workspace ownership and fail closed when absent or contradictory; concurrent workspaces cannot share client, cache, rate, or singleflight state.
• Personal reads/mutations follow the specified fallback/attribution rules and enforce the automation-visible plus configured repository intersection before provider calls.
• App-backed review watches use a persisted verified target login rather than @me; migrated watches without one are disabled without a provider call.

Files Likely Touched

• apps/backend/internal/github/service.go
• apps/backend/internal/github/service_pr.go
• apps/backend/internal/github/service_pr_status.go
• apps/backend/internal/github/service_reviews.go
• apps/backend/internal/github/service_issues.go
• apps/backend/internal/github/service_accessible_repos.go
• apps/backend/internal/github/workspace_settings_service.go
• apps/backend/internal/github/service_pr_watch.go
• apps/backend/internal/github/service_pr_watch_batched.go
• apps/backend/internal/github/service_cleanup.go
• apps/backend/internal/github/poller.go
• apps/backend/internal/github/service_ci_automation.go
• apps/backend/internal/github/service_task_issue.go
• apps/backend/internal/orchestrator/event_handlers_github*.go
• apps/backend/internal/automation/evaluator.go
• apps/backend/internal/workflowsync/service.go
• apps/backend/internal/task/share/ GitHub Gist call sites

Verification

cd apps/backend && rtk go test ./internal/github
cd apps/backend && rtk go test ./internal/orchestrator ./internal/automation -run 'Test.*GitHub'
cd apps/backend && rtk rg 's\.client|s\.authMethod' internal/github

The final search may find only constructor/test compatibility code with an explicit justification; it must find no operational service path.

Output Contract

Report migrated call families, ownership derivation, actor routing, cache/rate keys, tests run, files touched, blockers, and remaining compatibility references.