DEFERRED — do this only when a SECOND git-host warden (gitlab-warden / forgejo-warden) actually exists. Until then it's reuse-for-nobody (warden's vendored copy works).
The provider-agnostic reconcile core — src/reconcile/diff.ts (genericized collection diff with selective-by-omission + ownership-gated deletes), src/reconcile/guardrails.ts, src/reconcile/runner.ts (Cycle interface + runReconcile) — is not GitHub-specific. When a second warden appears, extract these into a chant primitive (e.g. @intentius/chant ./reconcile subpath, like the audit engine) so both wardens consume it instead of vendoring. The GitHub App auth + cycles + CLI stay app-specific.
Trigger: a second git-host warden is greenlit. Not before.
DEFERRED — do this only when a SECOND git-host warden (gitlab-warden / forgejo-warden) actually exists. Until then it's reuse-for-nobody (warden's vendored copy works).
The provider-agnostic reconcile core —
src/reconcile/diff.ts(genericized collection diff with selective-by-omission + ownership-gated deletes),src/reconcile/guardrails.ts,src/reconcile/runner.ts(Cycle interface + runReconcile) — is not GitHub-specific. When a second warden appears, extract these into a chant primitive (e.g.@intentius/chant./reconcilesubpath, like the audit engine) so both wardens consume it instead of vendoring. The GitHub App auth + cycles + CLI stay app-specific.Trigger: a second git-host warden is greenlit. Not before.