feat(github): harden activity ingestion

[f0rr0]

Summary

• Add durable five-minute Events intake, staggered branch/tag reconciliation, sparse PR signals, and bounded restart-safe workers.
• Replace lossy historical queueing with direct current-ref and retained-PR backfill, including authored PRs in unaffiliated repositories, GraphQL membership beyond REST caps, and authoritative merge evidence.
• Make aliases causal and reversible, harden webhook/provider validation, retry and deadline behavior, and preserve private repository grouping without revealing identity.
• Apply migrations and transactionally reconcile Supabase Cron on any Vercel production build; retain an auditable evidence-recovery workflow.

Correctness guarantees

• Every inventory token is verified against /user before scanning.
• Backfill reports incomplete rather than claiming success on deadlines, provider gaps, pagination drift, or lost access.
• Current refs and complete PR memberships deduplicate by repository ID and SHA; unchanged memberships are not rewritten.
• Only explicit PR-version, parent, or cherry-pick evidence can hide a duplicate commit.

Validation

• bun run lint
• bun run typecheck
• bun test — 190 tests, 1,247 assertions
• PostgreSQL race and evidence-recovery tests
• bun run db:generate — no schema drift, 14 tables
• bun run build
• actionlint .github/workflows/*.yml
• tracked-source credential scan

Rollout

After merge, the Vercel production build applies migration 0011, installs the four Supabase jobs, and the first authenticated worker completes the one-time evidence repair. Then dispatch Backfill GitHub activity for the required inclusive UTC range; reruns are idempotent and repository IDs can shard large inventories.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
f0rr0-github-io	Ready	Preview	Aug 30, 2026 11:50am