feat(provider-review): add shared identity and stack checks

[iscekic]

No new behavior — this change prepares GitLab and Bitbucket support without changing the current GitHub experience.

---

Summary

RepositoryIdentity requires authorized lookup data and Bitbucket workspaceUuid; RepositoryAuthorization separates OwnerIntegrationAuthorization from GitHubUserAuthorization, with database-independent Owner identifying Kilo ownership.
RepositoryReference combines LaunchRepositoryReference and GitHubReviewRepositoryReference; requireLaunchRepository rejects user authorization, while existing Owner imports remain valid.
repositoryResourceKey introduces account-scoped provider-repository:v1 keys using instanceUrlSchema, preserving GitHub ledger keys and fingerprints; normalizeLegacyGitHubReviewRepository defaults LegacyGitHubRepository records into resolved references or returns legacy-unresolved.

Files

• packages/app-shared/src/code-review/repository-identity.ts — source, added (+118/−0 lines); defines repository metadata, authorization types, launch checks, resource keys, and legacy normalization. Launch references require owner integrations; GitHub review references require GitHub user authorization. Identities use string repository identifiers, a nullable default branch, and Bitbucket-only workspace identifiers. Key tuples separate accounts, owners, integrations, authorizations, providers, instances, workspaces, repository identifiers, and names without delimiter collisions; mismatched GitHub accounts fail. Instance validation accepts https addresses without credentials, queries, or fragments; keys strip trailing slashes, lowercase GitHub names only, and omit the branch. Address validation does not authorize a host. Legacy resolution requires a repository identifier and matching user authorization with a nonempty authorization identifier, never an installation. Missing legacy fields default to github, https://github.com, and a null branch; unresolved results retain the account and original record. The fallback remains until old clients and records disappear and the 30-day ledger window expires.
• apps/web/src/lib/integrations/core/types.ts — source, modified (+3/−5 lines); re-exports shared Owner through the existing import path while retaining database types and numeric repository validation.

The @kilocode/app-shared export map declares repository-identity, provider-review, and wildcard provider-review subpaths for shared imports.
Existing exports remain available.

Files

• packages/app-shared/package.json — source, modified (+3/−0 lines); declares ./code-review/repository-identity, ./provider-review, and ./provider-review/* exports.

New dependencies prepare GitLab access and typed provider clients without changing request handling.
@gitbeaker/rest 43.8.0, openapi-fetch 0.17.0, and openapi-typescript 7.13.0 provide the client and type-generation tools.
Workflow trigger tests use picomatch 2.3.2 and its type declarations to match the pinned dorny/paths-filter action.

Files

• apps/web/package.json — source, modified (+3/−0 lines); adds @gitbeaker/rest at runtime and picomatch plus @types/picomatch 2.3.4 for development.
• services/git-token-service/package.json — source, modified (+2/−0 lines); adds openapi-fetch at runtime and openapi-typescript for development.

Both continuous integration (CI) workflows extend pull_request.branches to mobile-provider-parity-1d93-s*, retaining main so stacked pull requests can run checks.
kilocode_backend now selects backend tests and builds for workflow edits and mobile review code, while push triggers and mobile path filters stay unchanged.

Files

• .github/workflows/ci.yml — source, modified (+6/−1 lines); adds stack targets and backend filters for both workflows and mobile review components, helpers, and screens. The route pattern escapes literal parentheses.
• .github/workflows/kilo-app-ci.yml — source, modified (+1/−1 lines); extends the pull request branch filter to stacked targets without changing paths or jobs.

Tests: 2 files added — packages/app-shared/src/code-review/repository-identity.test.ts (+209/−0 lines; repository contracts) and apps/web/src/lib/stack-ci-triggers.test.ts (+131/−0 lines; branch/path matching, route escapes, and job prerequisites).
Generated: 1 modified lockfile — pnpm-lock.yaml (+159/−0 lines).

---

Verification

• Manual verification remains pending for the cumulative stack; this level adds no visual surface.

Visual Changes

Visual Changes: N/A

Reviewer Notes

• Scope: level 1 only, origin/main...mobile-provider-parity-1d93-s1.
• Repository: Kilo-Org/cloud.
• Worktree: /Users/igor/Projects/.worktrees/mobile-provider-parity-1d93.
• The clean review passed 45 focused tests and scoped lint, format, and whitespace checks.
• Actual stack CI execution remains pending.

Human steps

No human steps are required before merge or after merge.

Notes

Runtime verification is pending for the cumulative stack; this level adds no visual surface.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. mobile-provider-parity-1d93-s1 — feat(provider-review): add shared identity and stack checks #5663 ← this PR
2. mobile-provider-parity-1d93-s2 — feat(provider-review): define review contracts and vocabulary #5665
3. mobile-provider-parity-1d93-s3 — feat(provider-review): add safe provider SDK boundaries #5689
4. mobile-provider-parity-1d93-s4 — feat(git-token): authorize exact provider review resources #5692
5. mobile-provider-parity-1d93-s5 — feat(cloud-agent): preserve provider identity through checkout #5700
6. mobile-provider-parity-1d93-s6 — feat(provider-review): expose exact repositories and branches #5705
7. mobile-provider-parity-1d93-s7 — feat(mobile): preserve provider launch and recent identity #5711
8. mobile-provider-parity-1d93-s8 — feat(mobile): select exact provider repositories and branches #5729
9. mobile-provider-parity-1d93-s9 — feat(provider-review): add authorized GitLab review reads #5738
10. mobile-provider-parity-1d93-s10 — feat(provider-review): add authorized Bitbucket review reads #5745
11. mobile-provider-parity-1d93-s11 — feat(provider-review): add reconciled GitLab review actions #5748
12. mobile-provider-parity-1d93-s12 — feat(provider-review): add Bitbucket review actions and recovery #5756
13. mobile-provider-parity-1d93-s13 — feat(provider-review): expose the neutral review facade #5763 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• .github/workflows/ci.yml
• .github/workflows/kilo-app-ci.yml
• apps/web/package.json
• apps/web/src/lib/integrations/core/types.ts
• apps/web/src/lib/stack-ci-triggers.test.ts
• packages/app-shared/package.json
• packages/app-shared/src/code-review/repository-identity.test.ts
• packages/app-shared/src/code-review/repository-identity.ts
• pnpm-lock.yaml
• services/git-token-service/package.json

Previous Review Summary (commit 9b2c007)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 9b2c007)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• .github/workflows/ci.yml
• .github/workflows/kilo-app-ci.yml
• apps/web/package.json
• apps/web/src/lib/integrations/core/types.ts
• apps/web/src/lib/stack-ci-triggers.test.ts
• packages/app-shared/package.json
• packages/app-shared/src/code-review/repository-identity.test.ts
• packages/app-shared/src/code-review/repository-identity.ts
• pnpm-lock.yaml
• services/git-token-service/package.json

---

_{Reviewed by grok-4.6 · Input: 114.8K · Output: 6K · Cached: 250.9K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.