[chubes4]

Closes #15873

What

• GitHub App publication. When github_app is configured (app_id, private_key_path, optional installation_id), Cook creates a short-lived installation token for the target repository at finalize time. The token is limited to contents:write + pull_requests:write on that one repo, and is used for the push and the PR. The PR is authored by the app.
  • New module crates/homeboy-core/src/git/github_app.rs: an RS256 JWT via jsonwebtoken, then GET /repos/{o}/{r}/installation → POST /app/installations/{id}/access_tokens.
  • PublicationCredential deliberately implements neither Debug nor Serialize. Errors carry only a stage name: no HTTP bodies, JWTs, key paths or crypto errors.
• Fails closed. If the app is configured but minting fails, finalization errors. It does not silently fall back to the ambient gh login.
• Fallback when no app is configured: current behavior continues.
• Identity in the evidence: the review dossier records Publication identity: github_app:<id> or ambient_gh, never the token.
• Requester attribution. Homeboy reads the generic HOMEBOY_REQUESTER (an opaque string) next to HOMEBOY_CALLER_CONTEXT. It persists it on the run record (client_context.requester), so it survives lab handoff, and renders "Requested by: …" in the PR body. No bridge names or bridge variables are involved. The integration layer supplies the value (fix(roadie): map chat speaker to HOMEBOY_REQUESTER wp-coding-agents#827, merged).
• Docs: docs/github-app-publication.md and docs/commands/config.md. They note that pull_requests:write + contents:write can merge through the API, so operator-only merging needs branch protection that requires a review.

Verification

• cargo fmt --all -- --check: clean.

• cargo test -p homeboy-core -p homeboy-agents --lib: 2691 passed, 6 failed. The same 6 fail on origin/main (2f10c5d) on this host:

  • agent_task_dispatch_plan::…rotation_unset_without_global_policy
  • 4× agent_task_gate::…cargo_target…
  • orchestration::…reconcile_stale_observation…

  These depend on the environment and aren't touched by this change.

• agent_task_finalization + agent_task_service::cook: 629/629.

• New tests:

  • JWT claims and signature, with a key generated in the test.
  • Installation resolution and token exchange request shape, against a mock HTTP server.
  • The minted token reaches push and PR creation.
  • The no-app fallback.
  • HOMEBOY_REQUESTER persisted and rendered.
  • The token never appears in evidence or output.

Provenance

• The Homeboy cook agent-task-0a9543c7 wrote the change and passed its gates. Promotion was then refused (internal.unexpected, promotion.gate_setup for destination_gate_workspace) because the candidate was based on a checkout 324 commits behind main.
• Extra Chill Bot then did the following by hand, outside Homeboy:
  • committed the candidate and rebased it onto main;
  • resolved four conflicts: Cargo.lock regenerated; Cargo.toml keeps both new deps; in executor tests, kept main's stable_identity_home(), which already holds the env lock, because adding env_lock() on top would deadlock; in finalization, main's verified_base dossier plus this change;
  • fixed one regression the rebase exposed: the publication-identity evidence is now added before preflight, so manual-finalization receipts match their validated intent;
  • ran the gates above and opened this PR.

🤖 AI-assisted