Tangled lexicon and OAuth scope audit #

The supplied AT Protocol repository export contained 118 sh.tangled.* records across nine collections:

Collection	Records	App decision
sh.tangled.graph.follow	73	Included: native follow/unfollow and Following view
sh.tangled.feed.star	23	Included: native star/unstar
sh.tangled.repo	8	Read through Bobbin; write permission deferred until native fork/create is complete
sh.tangled.feed.comment	4	Included: issue and pull-request discussions
sh.tangled.graph.vouch	4	Excluded: not part of the everyday repository client
sh.tangled.publicKey	3	Excluded: the app does not manage SSH keys
sh.tangled.repo.collaborator	1	Excluded: the app does not manage repository access
sh.tangled.actor.profile	1	Excluded: the app does not edit Tangled profiles
sh.tangled.feed.reaction	1	Excluded until the discussion UI supports reactions

Issues, issue-state records, pull requests, and pull-status records exist elsewhere in the network even though they were not present in this one export. The app reads issues and pulls through Bobbin and requests write access only for the actions currently available in its UI.

Current writable scope #

repo:sh.tangled.feed.star?action=create&action=delete
repo:sh.tangled.graph.follow?action=create&action=delete
repo:sh.tangled.feed.comment?action=create&action=delete
repo:sh.tangled.repo.issue?action=create
repo:sh.tangled.repo.issue.state?action=create
repo:sh.tangled.repo.pull.status?action=create

atproto is also requested for the OAuth session itself. There is no transition scope and no Bluesky collection scope.

Native fork permission, later #

Forking is not only an AT Protocol record write. The complete flow must:

1. Create a sh.tangled.repo record whose source identifies the upstream repository.
2. Resolve the selected Knot and its service audience.
3. Obtain narrowly delegated service auth from the user’s PDS.
4. Call the Knot’s sh.tangled.repo.create procedure and reconcile failures with the record write.

When that flow ships, the smallest expected additions are create-only access to sh.tangled.repo and a granular rpc:sh.tangled.repo.create permission constrained to the resolved Knot audience. The app must not use a generic transition scope as a shortcut.

Collections intentionally left out #

• sh.tangled.publicKey and collaborator records belong in deliberate account/repository administration screens.
• sh.tangled.actor.profile belongs in a profile editor.
• sh.tangled.graph.vouch is a trust/moderation action, not a routine follow action.
• sh.tangled.repo.pull requires constructing and uploading Git patch blobs. This app is intentionally focused on browsing and collaboration rather than authoring code.
• sh.tangled.feed.reaction can be added when the UI exposes the matching emoji reactions.

Public Bobbin reads do not need OAuth write permission, so the app can browse the broader Tangled graph without asking for authority to alter it.