Use Realmroot only for human and machine authentication, authorize AMA through the browser user's multi-resource grant, and restore AK-managed Ed25519 Agent sessions.
Preserve Better Auth source tables while removing the mistaken Realmroot Agent binding and machine M2M paths.
BREAKING CHANGE: AK no longer accepts Realmroot Agent tokens or AMA machine credentials; active browser users must sign in again to authorize the AMA resource.
Replace Better Auth user, machine, and agent authentication with Realmroot native flows, migrate tenant ownership, and route AMA access through the cutover adapter. Preserve this deployed migration state as the baseline for the narrower user-auth-only redesign.
Add heartbeat_enabled persistence and enforce a 1 hour minimum heartbeat interval.
Keep webhook triggers active when scheduled heartbeat is disabled, and expose the toggle through the UI and CLI.
Connect repo onboarding to the GitHub App and complete the installation
webhook, so per-repo App coverage is tracked and surfaced end to end.
- migration 0027: github_installations + github_installation_repositories
- githubInstallations.ts: owner-scoped install tracking; repoAppStatus
coverage computed on read (single source of truth, no denormalization)
- webhook: handle installation + installation_repositories events (was
pull_request only); githubApp.ts gains getInstallation /
listInstallationRepositories / recordInstallationFromSetup
- routes: new /api/github-app config|setup|repositories endpoints; repo
create/list/get return app_status; the authenticated config reports the
owner install status + accounts
- UI: install/connected state on Repositories + Account pages, dual-tab
Add dialog (browse-and-import from GitHub | manual URL), status badges
- drop the GITHUB_AGENT_TOKEN push-credential fallback: the App
installation token is the sole credential; an uninstalled repo fails
dispatch loudly instead of using a shared long-lived PAT
- env: add GITHUB_APP_SLUG; vite allowedHosts for a stable dev tunnel
saltbo