stack/docs/plans/2026-10-23_github-consumer-brief.md

Brief: a GitHub consumer for row 297's protected token callback

Sage, 2026-10-23, filed for Mos (mos-1525). Post-10-27.

Brief: a GitHub consumer for Broker.githubWithToken

Row 297 builds the GitHub grant method and stops at the trusted host API Broker.githubWithToken(business, agent, fn) in packages/bus/src/broker.mjs. Nothing calls it yet: no git helper, mirror push or publication uses a GitHub token (violet BUILD.md, "Consumer gap for Sage's follow-up row").

This row adds the first consumer.

• It gets the token only through githubWithToken. It never reads the protected generation files, and never routes GitHub through the generic Gitea Credentials path, which has calendar-day dates and fork-specific identity.
• It honors the callback's cancellation signal. The signal aborts on revoke and at the token safety deadline, so the consumer stops work and drops the token when it fires. No operation is retried with a token past its expiry.
• No socket verb returns a token, and no consumer output, log or run record holds one.

Design comes first, with the consumer named (a git helper or mirror push), for Dewey's review. Tests cover: a revoke mid-call aborts the consumer; a call straddling the safety deadline aborts; an expired grant refuses before any network call; and no token text appears in output or the store.

Gate: Dewey approves the design and the manifest. The touched suites and every scripts/test-*.sh are green on Sage's gate, and mutants that drop the signal check or the expiry check are killed. Starts after row 297 is done.