[rd-biz-tam] Add read-only GitHub pull request head lookup

Draft
TE
7d ago
+31-1

Draft from R&D, not for merge yet.

Adds a bounded GitHub integration operation for preview and cloud-build routing. github.pull_request.get validates an owner/repository selector and positive PR number, returns only the PR title/state/draft/URL, head/base refs and SHAs, merge state, and update timestamp, and is classified as a read-only connection operation for CLI/MCP exposure. It does not post, mutate, or move credentials across the app boundary.

Evidence and source references:

  • backend/packages/protocol/src/integrations.ts:261-289 defines the constrained repository and pull-request schemas, result shape, read risk, errors, CLI path, and MCP group.
  • backend/packages/protocol/src/integrations.ts:317-327 registers the operation as a provider read and in integrationOps.
  • docs/cmux-next-preview.md:182-193 requires full source SHA and branch/upstream provenance before a preview is evidence.
  • plans/feat-cloud-vm-public-urls/DESIGN.md:5-34 defines publication ownership and access policy for the preview handoff.

Validation:

  • bun run typecheck (from backend/packages/protocol) ā€” passed after installing the package's declared workspace dependencies.
  • git diff --check ā€” passed.
  • Commit 9b474a67faa; 31 inserted lines, 1 deletion, under the 800-line draft limit.

No GCP resources, secrets, or live GitHub calls were used.

biz-tam: draft from R&D, not for landing yet.

šŸ¤– Generated with Claude Code

Agent session: big-red

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Adds a read-only GitHub pull request lookup operation for preview and cloud-build routing.

github.pull_request.get validates an owner/repo selector and a positive PR number, then returns only the PR title, state, draft flag, URL, head/base refs and SHAs, merge state, and updated timestamp. It is classified as a read risk and exposed via CLI/MCP. It never posts, mutates, or moves credentials across the app boundary, and is registered as a provider read so the gateway can answer it with the stored token.