Capture GitHub work history as provenance-preserving source bundles

[szmyty]

Outcome

Add a provider-neutral GitHub capture adapter that turns repository work history into immutable, verifiable Mindcap source bundles so meaningful engineering activity can become durable input to Mindgarden instead of disappearing into scattered commits, pull requests, issues, and releases.

This is the capture-side foundation for the broader principle:

work is evidence; knowledge and downstream representations are derived projections.

Mindcap captures and preserves source evidence. It must not infer expertise, résumé claims, or durable knowledge by itself.

Architecture

GitHub repository / organization selection
        ↓
Mindcap GitHub capture strategy
        ↓
provider-normalized activity records
        ↓
verified immutable source bundle
        ↓
Mindgarden normalized source / gardenization
        ↓
reviewed knowledge + evidence-backed projections

Scope

Initial bounded source types

Support a first useful slice around engineering work:

• commits and immutable commit identifiers;
• pull requests and merge state;
• issue references connected to captured pull requests/commits where available;
• releases/tags connected to captured work;
• repository identity and represented default-branch revision;
• timestamps, authorship/actor identifiers, source URLs, and provenance metadata.

The first implementation may intentionally defer unrelated GitHub surfaces, but deferred source types must be explicit rather than silently omitted.

Capture modes

Support explicit scopes such as:

• one repository;
• selected repositories;
• one organization/account inventory followed by reviewed selection;
• bounded time window;
• incremental capture since a previously verified bundle/cursor.

Do not make “capture everything forever” the only usable mode.

Provider/API boundary

• GitHub-specific acquisition belongs under a replaceable Mindcap plugin/strategy.
• Core Mindcap modules must consume provider-normalized records rather than GitHub response objects.
• Authentication/tokens remain outside bundles, logs, fixtures, and generated reports.
• Public repositories should support credential-free or least-privilege capture where GitHub permits it.
• Private repositories require explicit credentials/authorization and produce sensitive bundles by default.
• Network/API failures, pagination gaps, rate limits, inaccessible objects, and partial history remain explicit capture states.

Provenance and identity

Every captured record should retain enough evidence to answer:

• which GitHub host/provider produced it;
• organization/account and repository identity;
• stable object ID plus human-readable number/ref where applicable;
• immutable commit SHA or represented revision;
• source URL/API identity;
• capture time and capture-tool version;
• source-updated/occurred time where available;
• content hash of normalized captured material;
• parent bundle/cursor for incremental captures;
• visibility/sensitivity classification.

Force-pushes, deleted branches, edited PR/issue text, renamed repositories, transfers, and unavailable historical objects must have explicit reconciliation semantics.

Privacy and publication

• Private repository names and activity are sensitive by default.
• Raw GitHub bodies, comments, patches/diffs, and attachments may contain secrets or personal information; include only the source fields required by the selected capture profile and classify them appropriately.
• Captured private data never becomes public merely because it references a public dependency or public platform artifact.
• Bundles are source archives, not public Mindgarden projections.

Mindgarden handoff

Define a stable normalized handoff compatible with existing/future Mindgarden source adapters.

Mindgarden may later propose interpretations such as:

• project worked on;
• technology used;
• capability demonstrated;
• decision made;
• artifact produced;
• learning or achievement.

Those are proposals backed by captured evidence, not fields Mindcap invents.

A commit containing the word Kubernetes, for example, is evidence of activity—not automatic proof of expert proficiency.

Reference proofs

• Synthetic public GitHub fixture with commits, PR, issue link, and release.
• Incremental second capture with no duplication.
• Edited/renamed/unavailable object fixture.
• Ego Hygiene public repository canary.
• Private downstream canary exercised locally without committing captured private content.

Acceptance criteria

• Mindcap exposes a GitHub plugin/strategy behind the existing provider-independent capture boundary.
• One-repository and bounded incremental capture are implemented first.
• Captured bundles are immutable, hash-bound, verifiable, and idempotently identifiable.
• Authentication state and credentials never enter bundles or logs.
• Public and private source classification is explicit.
• Pagination, rate-limit, partial-history, inaccessible-object, rename, and deletion states are represented honestly.
• Provider-normalized records do not expose raw GitHub SDK/API types to Mindcap core.
• A stable handoff exists for Mindgarden normalization/gardenization.
• Re-running an unchanged capture does not manufacture duplicate evidence identities.
• An Ego Hygiene repository can be captured and verified end to end.
• A private downstream capture can run locally without publishing private repository metadata.
• Documentation clearly separates captured evidence from interpreted knowledge or expertise claims.

Dependencies / related

• Mindgarden Harden Suno archive normalization, media semantics, and offline verification guarantees #11 — normalized captured sources
• Mindgarden feat(chatgpt): upgrade archival for official exports, conversation graphs, and corpus-ready archives #13 — reviewable gardenization plans
• Mindgarden Upgrade ChatGPT archival for official exports, complete conversation graphs, multimodal assets, and corpus-ready archives #12 — deterministic graph/search/context projections
• Hygiene #42 — portable organization identity/distribution context
• Existing Mindcap provider/plugin, archive, vault, and verification contracts

Non-goals

• Automatically writing résumé bullets.
• Scoring developer performance.
• Inferring skill proficiency directly from Git events.
• Mirroring all GitHub data or attachments in the first slice.
• Storing GitHub credentials in archive bundles.
• Making private repository activity public.