grim8/17/2026, 5:50:10 AM

open-git ships OAuth (OIDC discovery + PKCE) but its API has no read
endpoints, so there is no adapter. Sign-in and repo support arrive at
different times, and the catalog now says so:

  { id: "opengit", status: "planned", signIn: "oauth2" }

`status` gates whether a forge can own a repo and run rules — it is what
derives `Forge`, so opengit still cannot reach a row. `signIn` gates the
login button. Keying the login grid on `status` would have hidden a working
login; keying persistence on `signIn` would have let an unbacked identity
own repos.

- genericOAuth plugin, mounted only when the creds exist; discovery off
  OPENGIT_ORIGIN so a self-hosted instance works
- genericOAuthClient on the client for signIn.oauth2 / oauth2.link
- login grid and reconnectForge dispatch social vs oauth2 off the catalog
- trustedProviders derives from SIGN_IN_FORGE_IDS, not forgeSchema.options —
  a sign-in-only forge still has to link to an existing user by email

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Parent2941fbb