[lumirth]

Summary

Repeated public reads and account renewal could amplify GitHub pressure, lose useful reading during temporary failure, and turn temporary OAuth refusal into a reconnect prompt. Shared public observations now survive restart, preserve acquisition age, reconcile known changes and accept confirmed contribution facts. Allowance-scoped actors coordinate provider pressure and recover a single rotating OAuth renewal across repository sessions.

public reading -> bounded durable observation -> coalesced acquisition
                confirmed effects / signed webhook changes
provider work -> installation / user / OAuth-client admission
browser       -> retain readable content during background refresh

Already usable user credentials can acquire shared public reading; anonymous reading uses the installation. Primary user exhaustion or user-specific denial can fall back once; secondary throttling pauses the affected scope. Logs retain bounded redacted provider errors, operation, request correlation and rate state. Workers observability is enabled. Real reloads keep initial loading.

Evidence

• Before: repeated discovery and memory-only reuse disappeared across restart; expired credentials were retired before renewal; refreshed windows failed to discover recent membership.
  After: actual local workerd journeys demonstrate coalesced reads, restart reuse with original age, persistent cooldown, signed external-change reconciliation, scope withdrawal and concurrent recovery after temporary OAuth refusal using single-use rotating credentials.
• Chromium and WebKit native/iframe journeys demonstrate reading, pagination, writing, editor continuity and retained content while a background read is held. Typechecks, example builds and extracted package qualification remain separate checks.
• GitHub is simulated by independent provider state and recorded-schema execution in local journeys. Production App permissions and deployment are separate release checks.

Merge Danger

Door: two-way

Adds disposable observation tables and provider actors in the existing namespace; preserves durable identities, encrypted-session purposes, effect receipts and protocol 7. Preserve SESSION_SECRET. Enable signed webhook delivery after deploying its receiver and secret.

Blast Radius: comments

Release 7.1.0 requires rebuilding browser consumers to adopt refresh behavior. Public cache reuse never supplies private viewer authority.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing