fix(notion): require explicit local user for gh intake

[miyaontherelay]

Decision

Fail loudly unless the built-in Notion GitHub CLI publisher is selected with exact github.identity: "user". There is no connected-App replacement for repository visibility, label enumeration, source-marker reconciliation, or issue creation. auto and app now block before every read/write process boundary and before any durable claim.

This preserves project-only intake (the publisher is never touched) and injected custom publishers. Explicit user remains the local-host opt-in for machines that actually have authenticated gh.

Evidence

Pre-change policy tests: 3 failed, 8 skipped; auto writes and app/auto reads reached the runner.

Final:

• Notion + identity: 2 files, 45 passed
• CLI selection/project-only: 1 file, 4 passed, 166 skipped
• TypeScript build passed

Ablation matrix

Change reverted individually	auto write gate	app read gate	auto read gate	direct mutation guard	default-auto CLI
none (final)	PASS	PASS	PASS	PASS	PASS
restore auto permission	FAIL	PASS	FAIL	PASS	FAIL
remove read preflights	PASS	FAIL	FAIL	PASS	FAIL
remove direct create/update guards	PASS	PASS	PASS	FAIL	PASS

Observed summaries: first two rows each 3 failed / 2 passed / 176 skipped across two files; direct-mutation row 1 failed / 4 passed / 176 skipped.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a624953-effe-4364-9411-fa4299674e9a

📥 Commits

Reviewing files that changed from the base of the PR and between 0246a15 and 9cf5930.

📒 Files selected for processing (5)

• README.md
• src/cli/fleet.test.ts
• src/github/gh-identity.test.ts
• src/github/gh-identity.ts
• src/intake/notion.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Notion intake now requires exact "user" identity for all GitHub CLI operations. "auto" and "app" identities are rejected before CLI access and durable claim reservation. Tests cover these gates, and the README documents identity resolution and affected operations.

Changes

Notion GitHub identity policy

Layer / File(s)	Summary
Explicit-user guard and policy contract README.md, src/github/gh-identity.ts, src/intake/notion.ts	The Notion GitHub CLI adapter now permits only "user" identity for visibility, labels, reconciliation, creation, and editing. "auto" and "app" are rejected before gh execution.
Identity-gating regression coverage src/github/gh-identity.test.ts, src/cli/fleet.test.ts	Tests verify rejection of "auto" and "app" identities, no GitHub CLI invocation, and no durable claim reservation for default-auto repository intake.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 9cf59

The change makes GitHub-backed Notion intake require an explicit local user identity and reports passing targeted tests plus a successful TypeScript build; no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant FleetIntake
  participant NotionGithub
  participant LocalGh
  participant NotionClaims
  FleetIntake->>NotionGithub: resolve repository operation
  NotionGithub->>NotionGithub: assert explicit user identity
  NotionGithub-->>FleetIntake: block auto or app identity
  FleetIntake--xLocalGh: do not invoke gh
  FleetIntake--xNotionClaims: do not reserve create claim

Loading

Suggested reviewers: khaliqgant

Poem

A rabbit checked the identity gate,
“User,” said the stamp, “the rest must wait.”
No gh was called beneath the moon,
No claim was saved too soon.
The README now records the rule in tune.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the explicit user identity requirement, blocked auto/app behavior, preserved project-only and custom publisher paths, and validation results.
Title check	✅ Passed	The title clearly and concisely identifies the main change: Notion intake now requires an explicit local user identity for GitHub CLI operations.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 4 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/notion-intake-local-gh-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

@coderabbitai review

Requested for exact head 15fd70b6c3f4b541c181b4e338f45357ef7fc1b0.

[cubic-dev-ai]

No issues found across 4 files

_{You’re at about 90% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{Re-trigger cubic}

[github-actions]

@coderabbitai review

Requested for exact head d3a8526ca9b014844879b10ba21d908ecd4bb5dd.

[github-actions]

@coderabbitai review

Requested for exact head 445be68add553a401919d8ab52ecda2a555f5a29.

[github-actions]

@coderabbitai review

Requested for exact head 9cf59308266c76d6189faa30a5308a113794c02f.