grim8/17/2026, 6:24:38 AM

Adds the inbound half of the open-git adapter and turns the webhook route
into one param route over a compiler-enforced registry.

- packages/forge-opengit: signature verification (own copy of the sha256
  scheme — adapters never import siblings) and normalization
- POST /webhooks/:forge over Record<Forge, ForgeWebhook>. A param route
  invites two holes; both are shut by construction: :forge is parsed with
  forgeSchema so an unknown value 404s before the body is read, and the
  Record fails to compile until a new forge has a verifier and headers
- an unset per-forge secret returns 503, never "accept everything"
- insertRawEvent's forge is typed from the catalog instead of a hand-written
  union that silently rejected a newly live forge
- opengit is status: live for INGEST — it can store events, not read repos

THE ACTOR GAP: open-git's pull_request payload carries no author. Verified
against the sender (create-pull-request.ts calls emitPullRequestWebhooks
without one, though actorProfileId is in scope). Those events normalize to
null rather than inventing a contributor; comments carry comment.author and
normalize for real. 8 of 9 rules are declared unusable on opengit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Parentf95f0c8