fix(server): prefer origin for repository identity

[lukemaj]

What Repository identity now prefers origin, with upstream as its next fallback.
Why A fork with both remotes previously defaulted project operations to upstream.
So what All proof and independent review passed; this PR is ready for the human merge decision.

Closes #155. Changes only the preferred remote tuple and its behavioral tests. All other fallback order, parsing and caching remain unchanged. Existing fork ownership and allowlist entries cover both files, so metadata edits are unnecessary. This keeps Promachos and Drafter work attached to the project's own repository.

Requirements and who asked: User requested origin-first identity, unchanged remaining fallback, mixed-remotes and upstream-only tests, source dependency assessment and exactly one PR.
Deleted: No configuration, abstractions, consumer edits, version bump or metadata changes.
Bottleneck: The resolver preference tuple owns this behavior; exact-head proof and independent review gate delivery.
Checked myself: Inspected the complete two-file diff, real-Git regression results, PR lookup and Issue consumers, and existing fork ownership/allowlisting.

Proof at 0d1b13eeeb3577957fe4bfe5d28db9eb0a6331f5, base 187b86dd86fbc0fce5d3de23f6fb8f4d06a74344:

• pnpm exec vp test run apps/server/src/project/RepositoryIdentityResolver.test.ts: exit 0, 12 passed. With updated tests before the implementation, exit 1, 2 mixed-remotes cases failed and 10 passed because upstream still won.
• pnpm exec vp run --filter t3 typecheck: exit 0. Existing Effect suggestions elsewhere in server code were emitted, with no errors.
• pnpm exec vp lint apps/server/src/project/RepositoryIdentityResolver.ts apps/server/src/project/RepositoryIdentityResolver.test.ts: exit 0.
• git diff --check: exit 0. Commit hook formatting preserved the tested diff exactly (cmp succeeded).

Dependency assessment, source inspected without consumer edits:

• PullRequestService.ts lines 771-855: supported workspace PR repositories derive from identity. requireProject treats hostless references as the project's own repository and rejects mismatches. Origin-first therefore moves default PR enumeration and hostless validation to the fork. Hosted references explicitly route by host/repository, retaining cross-repository routing with existing provider constraints. Previously hostless upstream refs can now fail the own-repository check; explicit hosted refs are the supported route.
• IssueService.ts lines 123-158: workspace enumeration uses project.repositoryIdentity and sourceControlRepositorySelector, deduplicating by host/repository. The fork is now enumerated and deduplicated rather than upstream; GitHub-only support remains unchanged.
• IssueLinks.ts projectContext and descendants and branch-derived lists: implicit repository defaults and branch-derived Issue numbers now resolve against origin; stored links retain explicit host/repository/number keys and are not migrated.
• Resolver cache and refresh invalidation: positive identities remain cached for 15 minutes and null identities for one minute. Ordinary resolves can retain an earlier identity until expiry; { refresh: true } invalidates both root and identity cache entries. This change does not migrate persisted links or force immediate refresh of client snapshots.

Independent review passed on the exact head: findings, no actionable issues, GPT-6-Luna on Codex routed by Prism. The newest review/independent status is success, created by authenticated account lukemaj at 2026-10-04T19:48:32Z and targeting those findings. All source CI checks passed. Agent Observer publication succeeded; measurement remains incomplete with estimated cost unknown, 0 attributed responses, and native session usage/ownership unavailable. This is a measurement gap, not zero usage or publication failure. Durable handoff contains the branch, worktree, proof and remaining state. Website impact: none, server repository selection only. No browser/live-service checks, repo-wide checks, version bump, merge or installation performed.

Implementation: GPT-6.1-Sol (gpt-6.1-sol), medium effort, Codex harness in T3 Code.

[lukemaj]

Agent work on this PR

Estimated cost unknown · 0 responses · 17 sessions · 4.3 h wall time (whole sessions)

Model	Responses	Tokens	Estimated cost

Flags: 4 large tool outputs · 8 permission requests · 16 sessions with usage bound to no task · 1 session without usage records

Details: snapshot, prices, coverage, counters

• Task toolboxmd/chromeria#155: outcome unknown (recorded acceptance only; a finished process never implies it).
• Proof: fix(server): prefer origin for repository identity #155
• Snapshot b3caa3a14debf4d45221be430a44ec81d1d93bc6513410d25574c9bbe5240de8, records up to 2026-10-04 19:43 UTC.
• 17 sessions on claude, codex; AgentsMD 14.6.0.
• Not counted: 500 responses (at least $24.27) in sessions shared with other PRs that worked in no single PR's checkout.
• 17 responses in these sessions worked on other PRs and are counted there.
• Totals reconcile with the measured sessions: yes. Evidence complete: no.
• Prices: list-price estimate from T3 local rate table (path withheld) as of 2026-09-28, schedule 696aae45933d0a684a015d3f08cfb6f1aa2fef02e7d272b4689e3a692ea04fff. Unknown prices stay unknown, never zero.
  • T3 LiteLLM rate table when present; bundled schedule covers the rest.
• Native session usage or worker ownership is unavailable.
• Harness-reported cost: none reported.
• Usage totals are not billing. Subscription spending is separate and is never posted as spend.
• Crashed runs are counted separately: 0.

Token counters by model (native counter semantics; never added across semantics):

Selected rates (USD per million tokens). These rates value the report at the selected schedule date; they do not establish historical prices or subscription spending.

Model	Input tier	Input	Cache read	Cache write	Other output	Reasoning

Other output and reasoning are priced without double counting inclusive native output. Missing rates remain unknown.

_{Local measurement from native records; usage totals are not billing. Updated in place by agent-observer publish.}

[lukemaj]

Agent Observer publication succeeded: #156 (comment). sync and publish --task toolboxmd/chromeria#155 --repo toolboxmd/chromeria --pr 156 both exited 0.

Measurement gap: the published snapshot reports estimated cost unknown, 0 attributed responses, evidence incomplete, and native session usage or worker ownership unavailable. These are measurement limitations, not zero usage or a publication failure. No complete cost estimate is claimed.

[lukemaj]

What Independent review found no actionable issues in the exact two-file diff.
Why Origin-first selection, unchanged fallback, and the tested upstream-only behavior meet Issue #155.
So what This records a clean verdict for head 0d1b13eeeb3577957fe4bfe5d28db9eb0a6331f5.

Review

Verdict: success. Base: 187b86dd86fbc0fce5d3de23f6fb8f4d06a74344. Head: 0d1b13eeeb3577957fe4bfe5d28db9eb0a6331f5. No actionable findings.

The resolver now checks origin, then upstream; its sorted remaining-remote fallback is unchanged. The mixed-remote add/replace tests require origin after refresh. The new upstream-only test initializes a repository and adds only upstream, so it exercises the intended fallback.

Consumer impact checked against the source:

• Pull-request enumeration and hostless-reference validation follow the project’s selected identity. A hostless reference to the former upstream identity can now fail the own-repository check; explicit hosted references retain repository routing subject to existing provider and checkout constraints.
• Issue enumeration follows the selected identity and deduplicates by host/repository.
• Branch-derived Issue links now default to origin. Stored links keep their explicit host/repository/number keys; this change does not migrate them.
• Resolver cache limits remain: positive identities live 15 minutes, negative identities 1 minute. refresh: true invalidates the root and identity cache entries; ordinary resolves may retain the prior identity until expiry or a refresh path runs.

Both resolver files already have fork ownership and allowlist entries. I inspected the supplied exact-head proof artifacts: resolver tests 12/12, targeted typecheck and lint exit 0, and the pre-fix run shows the two mixed-remote assertions failing while the other 10 pass. I did not rerun checks.

The Agent Observer publication succeeded; its existing PR note states attribution is incomplete and cost is unknown, so no completeness claim is made.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+18 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+17 B (+0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.3 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.5 KiB	13.6 KiB	+17 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−8 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+25 B (+0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 187b86d · PR result: 0d1b13e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.7 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.