[fengchen122123-sudo]

Scope

Scope boundary: read-only Git inspection for the Web UI workbench — nothing in this PR writes to a repository.

• Backend: two new Gateway RPC methods, git.status and git.diff (src/opensquilla/gateway/rpc_git.py, src/opensquilla/gateway/adapters/git_contract.py).
• Guardrails: owner-only (_require_owner, error "Git inspection requires a locally proven owner."), a 5 s subprocess budget (_GIT_TIMEOUT_SECONDS = 5.0), a 200,000-character diff ceiling (_MAX_DIFF_CHARACTERS = 200_000) and binary-diff detection (Binary files / GIT binary patch markers set binary: true).
• Scopes: both methods use the read scope in src/opensquilla/gateway/scopes.py.
• Frontend: opensquilla-webui/src/components/workbench/GitChangesPanel.vue (workbench panel), opensquilla-webui/src/components/chat/GitBranchChip.vue (top-bar branch badge), opensquilla-webui/src/composables/useGitStatus.ts, opensquilla-webui/src/adapters/gateway/gitV4.ts.
• Contracts: new contracts/gateway/v4/git/git-status.schema.json and contracts/gateway/v4/git/git-diff.schema.json, regenerated v4 artifacts (methodCount 213 → 215, schemaCount 223 → 225 in contracts/gateway/v4/compatibility-manifest.generated.json) plus the generated Python modules under src/opensquilla/contracts/generated/v4/.
• Guard test: the hard-coded RPC method-count assertion moves 285 → 287 in tests/test_gateway/test_sandbox_runtime_contract_registration.py, tests/test_gateway/test_turn_admission_composition.py and tests/test_ci/test_rpc_architecture_contracts.py (the last one pins git.status / git.diff explicitly so the historical method digest keeps its meaning).

Non-goals: no staging, commit, checkout, pull/push, merge, rebase or any other mutating Git operation; no new provider/browser/channel behaviour; no RPC surface change beyond the two read methods.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: no upstream issue covers this work; the read-only Git surface was implemented directly on a topic branch.

Release Note

Release note: Web UI gains a read-only Git changes workbench (top-bar branch chip plus a workbench panel listing changed files and their diffs), backed by two new owner-only Gateway methods git.status and git.diff.

Tests

Ruff: python -m ruff check on the three changed test files — All checks passed!

Pytest: the RPC-surface guard tests that pin the registry size pass after the count bump — tests/test_gateway/test_sandbox_runtime_contract_registration.py + tests/test_gateway/test_turn_admission_composition.py: 10 passed; tests/test_ci/test_rpc_architecture_contracts.py: 33 passed. The full backend suite was not re-run end to end for this branch; the only backend failures observed were the three hard-coded method-count guards fixed here (285 → 287).

Build: npm run typecheck:vue passed; npm run check:architecture passed (13 checks); vitest 5 files / 26 tests passed.

Regression tests: added

Notes: new frontend coverage lives in opensquilla-webui/src/components/workbench/GitChangesPanel.test.ts and opensquilla-webui/src/composables/useGitStatus.test.ts. opensquilla.generate_gateway_contracts --check was not executed for this branch: the local environment does not provide datamodel-code-generator, so the generated v4 artifacts were produced by the generator and inspected by hand rather than re-verified with its --check mode.

Maintainer Live Check

Maintainer live check: no

Surface: N/A

Maintainer-only note: contributors are not expected to provide secrets or run credentialed live checks. Maintainers may run Live Release E2E for provider, browser, gateway, channel, or release smoke coverage.

Safety

Secrets, local-only artifacts, private prompts/transcripts, channel identifiers, AI session artifacts, non-public fixtures, and tests/_private/ contents must not be committed.

This branch contains none of those: the only tracked changes are source, contract, test and notice files.

Third-Party Origin

Third-party origin: adapted/ported

Details if non-none: the gitBranch glyph is GitHub Octicon git-branch-16, upstream https://github.com/primer/octicons, MIT licensed. Its path data was adapted into opensquilla-webui/src/utils/icons.ts (scaled from the 16-unit Octicon grid to the 24-unit icon grid and drawn as a solid glyph) and the provenance is declared in THIRD_PARTY_NOTICES.md under "GitHub Octicons". No other third-party code, fixtures or text is copied by this PR.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

No documentation pages, links, code fences or examples are added by this PR; the only prose change is the THIRD_PARTY_NOTICES.md entry described above.