# Tangled lexicon and OAuth scope audit

The supplied AT Protocol repository export contained 118 `sh.tangled.*` records across nine collections:

| Collection | Records | App decision |
| --- | ---: | --- |
| `sh.tangled.graph.follow` | 73 | Included: native follow/unfollow and Following view |
| `sh.tangled.feed.star` | 23 | Included: native star/unstar |
| `sh.tangled.repo` | 8 | Read through Bobbin; write permission deferred until native fork/create is complete |
| `sh.tangled.feed.comment` | 4 | Included: issue and pull-request discussions |
| `sh.tangled.graph.vouch` | 4 | Excluded: not part of the everyday repository client |
| `sh.tangled.publicKey` | 3 | Excluded: the app does not manage SSH keys |
| `sh.tangled.repo.collaborator` | 1 | Excluded: the app does not manage repository access |
| `sh.tangled.actor.profile` | 1 | Excluded: the app does not edit Tangled profiles |
| `sh.tangled.feed.reaction` | 1 | Excluded until the discussion UI supports reactions |

Issues, issue-state records, pull requests, and pull-status records exist elsewhere in the network even though they were not present in this one export. The app reads issues and pulls through Bobbin and requests write access only for the actions currently available in its UI.

## Current writable scope

```text
repo:sh.tangled.feed.star?action=create&action=delete
repo:sh.tangled.graph.follow?action=create&action=delete
repo:sh.tangled.feed.comment?action=create&action=delete
repo:sh.tangled.repo.issue?action=create
repo:sh.tangled.repo.issue.state?action=create
repo:sh.tangled.repo.pull.status?action=create
```

`atproto` is also requested for the OAuth session itself. There is no transition scope and no Bluesky collection scope.

## Native fork permission, later

Forking is not only an AT Protocol record write. The complete flow must:

1. Create a `sh.tangled.repo` record whose `source` identifies the upstream repository.
2. Resolve the selected Knot and its service audience.
3. Obtain narrowly delegated service auth from the user’s PDS.
4. Call the Knot’s `sh.tangled.repo.create` procedure and reconcile failures with the record write.

When that flow ships, the smallest expected additions are create-only access to `sh.tangled.repo` and a granular `rpc:sh.tangled.repo.create` permission constrained to the resolved Knot audience. The app must not use a generic transition scope as a shortcut.

## Collections intentionally left out

- `sh.tangled.publicKey` and collaborator records belong in deliberate account/repository administration screens.
- `sh.tangled.actor.profile` belongs in a profile editor.
- `sh.tangled.graph.vouch` is a trust/moderation action, not a routine follow action.
- `sh.tangled.repo.pull` requires constructing and uploading Git patch blobs. This app is intentionally focused on browsing and collaboration rather than authoring code.
- `sh.tangled.feed.reaction` can be added when the UI exposes the matching emoji reactions.

Public Bobbin reads do not need OAuth write permission, so the app can browse the broader Tangled graph without asking for authority to alter it.