kandev/docs/plans/new-workspace-github-access-defaults/task-02-workspace-github-defaults.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
02-workspace-github-defaults	Workspace GitHub defaults	completed	2	01-default-behavior-regressions	plan.md	../../specs/integrations/github-authentication.md

Task 02: Workspace GitHub defaults

• Acceptance: Every newly created workspace and the initial workspace on a genuinely fresh database persist executor task access before they can launch a task; existing installations are not backfilled or rewritten.
• Acceptance: Internal/synthetic-admin/real-admin creation stores a validated active CLI host/login without a token, while member creation and absent/invalid CLI state remain disconnected and still succeed.
• Acceptance: All Task 01 backend, desktop, and mobile regressions pass, and executor mode issues no managed credential lease.
• Verification: Run the targeted backend and managed desktop/mobile E2E commands exactly as listed below after the final production edit.

cd apps/backend && go test -tags fts5 ./internal/github ./internal/task/service ./internal/backendapp ./internal/orchestrator/executor -run 'Test.*Workspace.*Defaults|Test.*Workspace.*Initializ|TestTaskGitCredentialModeDefaultsManaged|TestApplyGitCredentialSnapshotUsesExecutorSources' -count=1
cd apps && pnpm --filter @kandev/web run e2e:run -- tests/integrations/github-authentication.spec.ts tests/integrations/github-workspace-settings.spec.ts
cd apps && pnpm --filter @kandev/web run e2e:run -- --project mobile-chrome tests/integrations/mobile-github-workspace-settings.spec.ts

• Files likely touched:
  • apps/backend/internal/github/store.go
  • apps/backend/internal/github/workspace_defaults.go
  • apps/backend/internal/github/workspace_defaults_test.go
  • apps/backend/internal/github/workspace_settings_test.go
  • apps/backend/internal/task/service/service.go
  • apps/backend/internal/task/service/service_resources.go
  • apps/backend/internal/task/service/service_resources_test.go
  • apps/backend/internal/backendapp/services.go
  • apps/backend/internal/backendapp/services_github_defaults_test.go
  • apps/web/e2e/tests/integrations/github-authentication.spec.ts
  • apps/web/e2e/tests/integrations/github-workspace-settings.spec.ts
  • apps/web/e2e/tests/integrations/mobile-github-workspace-settings.spec.ts
• Dependencies: Task 01.
• Parallelism: sequential; it changes the shared service-composition and GitHub workspace persistence path.
• Inputs: Task 01 RED evidence; ADR-2026-08-02-new-workspace-github-access-defaults; existing GitHub connection validation/commit functions, mock account injection, workspace authorization, and task-service workspace creation ordering.
• Risks: Do not use ambient host gh in E2E, do not auto-bind members, do not reinterpret legacy missing settings as executor, and do not make CLI unavailability fail workspace creation.
• Output contract: Summarize implementation, actual files changed, exact GREEN command results and Playwright artifact paths, security/external-side-effect boundaries, and remaining risks; update this task and plan.md statuses/results.

Results

• Added Store.EnsureWorkspaceExecutorDefaults and fresh-schema detection; existing missing or invalid rows still resolve through the managed compatibility fallback.
• Added the GitHub workspace-default initializer, operator/admin boundary, injectable CLI account discovery, token-free named connection commit, soft CLI degradation, and one-shot seeded-workspace bootstrap.
• Added the task-service initializer seam and wired it before workspace.created; backend composition wires the GitHub service and invokes fresh-install bootstrap after authorization/secret setup.
• Focused Go suite: 12 passed in 4 packages.
• Scoped Go suite: 2402 passed in 4 packages.
• Desktop GitHub authentication/settings E2E: 9 passed in the combined run after the fixture correction; focused settings rerun 4 passed.
• Mobile GitHub settings E2E: 2 passed.
• No CLI bearer token is persisted; member-created workspaces never list or bind operator accounts.