Cross-repository relation core
Closed September 2026. Documentation and code can live in different repositories, but neither repository is allowed to choose the other repository, its credential, the comparison, or where a verdict is published. This phase built the provider-neutral relation lifecycle beneath that rule: four exact snapshots, one symmetric projection transition, durable supersession, and restart-safe status delivery. Cross-repository relations is the live contract; this page records what the core proves and where live assembly still stops.
One operator plan owns four exact snapshots
The immutable two-subject registry in #613 fixes both provider scopes, repositories, branches, credentials, selectors, budgets, trigger ownership, and status destinations atomically. #614 acquires each base/candidate pair into a physically independent Git root under per-subject and aggregate streaming limits; an unavailable or unverifiable subject leaves the complete relation unproven.
The portable audit is split into a plan, four-slot projection evidence, and a replayable equality transition by #615, #616, and #617. It can say aligned, introduced drift, pre-existing drift, resolved drift, or unproven without appointing either repository as truth. The pure tree projector and controller projection path land through #618 and #619, with operator-context binding in #620. Accepted-report decoding is shared in #621, the complete chain is independently replayed in #622, and component derivation plus immutable retention close in #623 and #624.
Coordination is opaque and supersession is fenced
The operator-supplied coordination identity added in #625 may mean a pair, release, or workflow occurrence; Amiss never infers it from timestamps or nearby heads. The pure admission law in #626 preserves an exact retry, rejects identity rebinding, and advances a fence when new coordination supersedes pending work. #627 persists the same law in a bounded hash-chained journal whose committed head makes interrupted appends recoverable and committed mutation visible.
Fresh two-subject heads freeze only configured destinations in #628, and #629 reserves every external status key to one relation. Pure fenced staging arrives in #630; a tagged journal action grammar in #631 lets the durable outbox land in #632. Restart reopening, per-destination durable acknowledgements, and serialized oldest-fence claims follow in #633, #634, and #635. Dropping a claim mutates nothing; unrelated lock shards can still publish in parallel.
Provider boundaries preserve provider semantics
GitHub exact head resolution and idempotent App-owned check runs land in #636 and #637. Gitea-family commit statuses arrive in #638 with their lack of writer-bound merge-gate identity stated rather than hidden. GitLab’s #639 keeps its result synchronous and bound to the authenticated active policy job instead of pretending it has the same asynchronous status model. Gitea-family exact head resolution follows in #640.
Service assembly is likewise provider neutral: strict registry loading in #641, exact credential routing in #642, and authenticated coordination admission in #643. Exact provider heads are retained and frozen in #644 and #645; canonical audit construction and the projection, assessment, retention, and staging pipeline land in #646 and #647. The provider-neutral loop resumes durable claims and acknowledges only reconciled destinations after restart in #648.
The provider binaries still do not construct and install this registry, credential router, snapshot acquisition, and lifecycle as one live lane. That topology needs an operator contract rather than a hidden cross-provider default. Post-publication wiki drift also remains demand gated and would be a separate Git subject observed after publication, never a pre-merge guarantee. Privacy-safe external URL histories, organization-scale routing, and portable signed outcomes remain research until real operators supply their retention, isolation, and trust-root requirements.