Managed Git source

Status: the controlled Shared step 6 profile is validated with Forgejo 17.0.1 in this private source checkpoint. See the module record, deployment guide and validation ledger.

The Go API/controller owns scoped repository lifecycle and configured native collaborator permissions. Forgejo owns Git data and permission enforcement. Consumer requests cannot select an arbitrary administrator, native authority or permission outside installed policy. Repository identifiers remain provider-issued identities; display names and mutable branches are insufficient source proofs.

GitHub and Forgejo adapters freeze an exact repository, revision, registered target and required trusted check publisher, then request the same release/deployment owner. They do not implement separate rollout processes. A signed event or branch name cannot select Production or confer tenant authority. Duplicate/retried events preserve the logical operation and require successful checks before publication. Forgejo Actions is not required for this chain.

Managed repository operations currently use the server-only management SDK/API. Source/webhook credentials belong in the installation's secret lifecycle, never app manifests, build arguments, Git remote URLs in logs or browser configuration. Archive download redirects cannot forward credentials to arbitrary origins.

Native organization byte quotas are soft: one tested write can overshoot before later writes are denied. Do not advertise a hard byte ceiling or delete Git history on quota exhaustion. The actual profile/evidence must distinguish this engine limitation from technical envelope and reservation constraints.

The native history recovery helper uses Git bundles, verifies complete branch/tag references, rejects a nonempty destination and pushes with atomic expected-empty leases. It does not mirror-delete unrelated refs. A history bundle excludes accounts, access policy, shared keys, LFS and uncommitted workspaces. Restore the permitted policy and independently issued destination credentials separately. Validate a new target's private access, exact revisions and check-publisher policy before using it for deployment.

Changes follow the pinned engine/client manifests, upstream notices and module maintenance. Customer-operated Git replacement and full independent installation remain step 7 gates.