feat(provider-review): add authorized GitLab review reads

[iscekic]

No new behavior — This change prepares GitLab reviews without changing the app's screens or available actions.

---

Summary

GitLabReviewAuthorization binds personal and organization reads to the exact owner, integration, instance, project, and current actor through the existing credential broker.
GitLabUserSchema, GitLabPathSchema, and GitLabProjectSchema validate provider data and canonical locations; project tokens keep unknown scopes instead of inheriting integration grants.
Old integration records retain the default instance and stored authentication type; inactive integrations require reconnection, and mismatched identities fail.

Files

• apps/web/src/lib/provider-review/gitlab-authorization.ts — Added source, +227/−0 lines. Adds OAuth, personal access token, and exact project-token selection, plus current-actor lookup and project resolution. Preserves nested paths and configured instance subpaths, validates canonical links, and restricts avatars to https. Delegates membership, blocked-user, ownership, and expiry checks to the interactive client.
• apps/web/src/lib/provider-review/gitlab-authorization.test.ts — Added tests, +253/−0 lines. Adds the focused authorization suite.

The read-only GitLab adapter populates the existing ReviewInbox, ReviewOverview, ReviewPage, ReviewFile, ReviewFileContext, ReviewThread, ReviewRevision, ReviewCursor, and ReviewCapability contracts.
These reads cover scoped inboxes, overviews, checks, files, diff versions, immutable context, and discussions without public routes, provider writes, or mobile rendering.
Legacy automatic-merge metadata remains supported; callers must handle scoped cursors, revision conflicts, unfinished versions, response limits, inherited nullable counts, and uncertain capabilities.

Files

• apps/web/src/lib/provider-review/gitlab-read.ts — Added source, +1,251/−0 lines. Defaults personal inboxes to reviewer assignments, supports author filtering, and requires repository scopes for organization and project-token inboxes. Validates exact review identities and canonical links, including closed reviews. Binds 25-item pages to the actor, credential, authorization, query, and revision, with a 100-page limit and bounded responses. Normalizes current pipelines, commit statuses, approvals, requested changes, merge methods, squash policy, restrictions, and evidence-based permissions and recovery. Preserves pre-17.11 automatic-merge metadata and keeps absent version, license, or permission evidence unknown. Validates current and historical diff completion, version identity, and revision consistency. Unfinished versions return temporarily_unavailable; overflow returns response_too_large, and stale revisions return conflict. Completed empty versions retain empty pages and numeric zero totals. Preserves old/new paths, file status, binary/truncated/unavailable content, and unknown additions/deletions through the existing nullable totals. Verifies diff membership and fork access before fetching immutable context; validates path, commit, base64, size, and text, with a 500-line limit. Maps comments, reaction counts, multiline anchors, file discussions, resolution, outdatedness, and per-thread resolve/reopen capabilities. Rechecks revisions after composite reads, rejects incomplete pagination, and limits discussion pages to 100 notes.
• apps/web/src/lib/provider-review/gitlab-read.test.ts — Added tests, +1,446/−0 lines. Adds read fixtures and regressions for unfinished/completed versions, overflow, stale revisions, excluded patches, and inherited nullable counts.

Tests: 2 files added — gitlab-authorization.test.ts and gitlab-read.test.ts, totaling 1,699 added lines.
Generated: 0 files changed.

---

Visual Changes

Visual Changes: N/A

Verification

• Manual and live end-to-end (E2E) verification did not run because public integration and mobile rendering belong to later section levels.
• Cumulative runtime verification remains pending until the remaining section levels land.

Reviewer Notes

Human steps

• No human verification step is delegated; the dispatcher owns CI validation and cumulative live provider evidence before human-ready.
• No manual setup, new secret, environment value, migration, or rollout step is required.

Automated evidence

• The handoff reports 161 passing tests across both GitLab suites, after ten new regressions failed before the repair.
• The handoff reports successful scoped lint, formatting, and whitespace checks.

Scope and inventory

• Repository: Kilo-Org/cloud; worktree: /Users/igor/Projects/.worktrees/mobile-provider-parity-1d93.
• Review range: mobile-provider-parity-1d93-s8...mobile-provider-parity-1d93-s9.
• Inventory: 4 added files, with 3,177 added lines and no removed lines; 2 source files, 2 test files, and no generated files.

Notes

E2E: bot-e2e — cumulative runtime verification is pending until the remaining section levels land.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. mobile-provider-parity-1d93-s1 — feat(provider-review): add shared identity and stack checks #5663
2. mobile-provider-parity-1d93-s2 — feat(provider-review): define review contracts and vocabulary #5665
3. mobile-provider-parity-1d93-s3 — feat(provider-review): add safe provider SDK boundaries #5689
4. mobile-provider-parity-1d93-s4 — feat(git-token): authorize exact provider review resources #5692
5. mobile-provider-parity-1d93-s5 — feat(cloud-agent): preserve provider identity through checkout #5700
6. mobile-provider-parity-1d93-s6 — feat(provider-review): expose exact repositories and branches #5705
7. mobile-provider-parity-1d93-s7 — feat(mobile): preserve provider launch and recent identity #5711
8. mobile-provider-parity-1d93-s8 — feat(mobile): select exact provider repositories and branches #5729
9. mobile-provider-parity-1d93-s9 — feat(provider-review): add authorized GitLab review reads #5738 ← this PR
10. mobile-provider-parity-1d93-s10 — feat(provider-review): add authorized Bitbucket review reads #5745
11. mobile-provider-parity-1d93-s11 — feat(provider-review): add reconciled GitLab review actions #5748
12. mobile-provider-parity-1d93-s12 — feat(provider-review): add Bitbucket review actions and recovery #5756
13. mobile-provider-parity-1d93-s13 — feat(provider-review): expose the neutral review facade #5763 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/provider-review/gitlab-read.ts
• apps/web/src/lib/provider-review/gitlab-read.test.ts

Previous Review Summary (commit 567a597)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 567a597)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• apps/web/src/lib/provider-review/gitlab-authorization.ts
• apps/web/src/lib/provider-review/gitlab-authorization.test.ts
• apps/web/src/lib/provider-review/gitlab-read.ts
• apps/web/src/lib/provider-review/gitlab-read.test.ts

---

_{Reviewed by grok-4.6 · Input: 136K · Output: 15.7K · Cached: 616.4K}

_{Review guidance: REVIEW.md from base branch mobile-provider-parity-1d93-s8}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.