kandev/docs/plans/github-authentication/task-03-workspace-credential-resolver.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
03-workspace-credential-resolver	Workspace PAT and CLI resolver	completed	2	01-persistence-migration	plan.md	../../specs/integrations/requirements/github-authentication.md

Task 03: Workspace PAT And CLI Resolver

Inputs

• Spec: What, Identity And Routing, PAT/CLI failure modes, and first five scenarios.
• ADR 0047: explicit purpose resolution and deterministic named CLI accounts.
• Existing factory.go, gh_client.go, service_tokens.go, and rate/cache helpers.

Acceptance

• Resolver requests require workspace and purpose and return a client, verified principal, capabilities, generation, and expiry without process-global operational state.
• PAT and named CLI replacements validate first and atomically replace only the target workspace; CLI commands select --hostname and --user, strip ambient token variables, and never switch the host account.
• legacy_shared preserves current precedence only for migrated rows; disconnected/new/invalid workspaces never fall through to it or another workspace.

Files Likely Touched

• apps/backend/internal/github/auth_principal.go (new)
• apps/backend/internal/github/auth_resolver.go (new)
• apps/backend/internal/github/auth_resolver_test.go (new)
• apps/backend/internal/github/gh_accounts.go (new)
• apps/backend/internal/github/gh_accounts_test.go (new)
• apps/backend/internal/github/factory.go
• apps/backend/internal/github/factory_test.go
• apps/backend/internal/github/gh_client.go
• apps/backend/internal/github/service_connections.go (new)
• apps/backend/internal/github/service_tokens.go

Verification

cd apps/backend && rtk go test ./internal/github -run 'Test(CredentialResolver|GHAccounts|WorkspaceConnection|LegacyShared)'

Output Contract

Report the resolver interface, exact CLI subprocess environment, replacement/rollback behavior, tests run, files touched, blockers, and risks. Do not migrate domain service call sites in this task.