diff --git a/calm-hub-ui/src/ProtectedRoute.test.tsx b/calm-hub-ui/src/ProtectedRoute.test.tsx
new file mode 100644
index 000000000..07d2fcc0e
--- /dev/null
+++ b/calm-hub-ui/src/ProtectedRoute.test.tsx
@@ -0,0 +1,182 @@
+import { render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('./authService.js', () => ({
+    authService: {
+        getUser: vi.fn(),
+        login: vi.fn(),
+        processRedirect: vi.fn(),
+    },
+}));
+
+
+import ProtectedRoute from './ProtectedRoute.js';
+import { authService } from './authService.js';
+
+const PRE_AUTH_HASH_KEY = 'calm_pre_auth_hash';
+
+const fakeUser = {
+    expired: false,
+    id_token: 'test-id-token',
+    access_token: 'test-access-token',
+    profile: { preferred_username: 'testuser' },
+} as unknown as import('oidc-client-ts').User;
+
+describe('ProtectedRoute', () => {
+    let replaceStateSpy: ReturnType<typeof vi.spyOn>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        sessionStorage.clear();
+        replaceStateSpy = vi.spyOn(window.history, 'replaceState');
+    });
+
+    afterEach(() => {
+        replaceStateSpy.mockRestore();
+        Object.defineProperty(window, 'location', {
+            value: window.location,
+            writable: true,
+        });
+    });
+
+    describe('hash preservation before OIDC redirect', () => {
+        it('saves window.location.hash to sessionStorage before calling login', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.login).mockResolvedValue(undefined);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, hash: '#/fae-calm/architectures/123/abc', search: '' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(authService.login).toHaveBeenCalled();
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBe('#/fae-calm/architectures/123/abc');
+        });
+
+        it('does not save an empty hash to sessionStorage', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.login).mockResolvedValue(undefined);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, hash: '', search: '' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(authService.login).toHaveBeenCalled();
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBeNull();
+        });
+    });
+
+    describe('hash restoration after OIDC callback', () => {
+        it('restores the saved hash after processing the redirect callback', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            sessionStorage.setItem(PRE_AUTH_HASH_KEY, '#/fae-calm/architectures/123/abc');
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(
+                    null,
+                    '',
+                    '/#/fae-calm/architectures/123/abc'
+                );
+            });
+            expect(sessionStorage.getItem(PRE_AUTH_HASH_KEY)).toBeNull();
+        });
+
+        it('falls back to #/ when no hash was saved', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(null, '', '/#/');
+            });
+        });
+
+        it('falls back to #/ when saved hash is just #', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            sessionStorage.setItem(PRE_AUTH_HASH_KEY, '#');
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            await waitFor(() => {
+                expect(replaceStateSpy).toHaveBeenCalledWith(null, '', '/#/');
+            });
+        });
+
+        it('renders children after successful redirect processing', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(null);
+            vi.mocked(authService.processRedirect).mockResolvedValue(fakeUser);
+            Object.defineProperty(window, 'location', {
+                value: { ...window.location, search: '?code=AUTH_CODE&state=xyz', hash: '', pathname: '/' },
+                writable: true,
+            });
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            expect(await screen.findByText('Protected Content')).toBeInTheDocument();
+        });
+    });
+
+    describe('already authenticated user', () => {
+        it('renders children immediately without redirect when session exists', async () => {
+            vi.mocked(authService.getUser).mockResolvedValue(fakeUser);
+
+            render(
+                <ProtectedRoute>
+                    <div>Protected Content</div>
+                </ProtectedRoute>
+            );
+
+            expect(await screen.findByText('Protected Content')).toBeInTheDocument();
+            expect(authService.login).not.toHaveBeenCalled();
+            expect(authService.processRedirect).not.toHaveBeenCalled();
+        });
+    });
+});
diff --git a/calm-hub-ui/src/ProtectedRoute.tsx b/calm-hub-ui/src/ProtectedRoute.tsx
index 64ff61be7..035f26032 100644
--- a/calm-hub-ui/src/ProtectedRoute.tsx
+++ b/calm-hub-ui/src/ProtectedRoute.tsx
@@ -6,6 +6,8 @@ interface ProtectedRouteProps {
     children: ReactNode;
 }
 
+const PRE_AUTH_HASH_KEY = 'calm_pre_auth_hash';
+
 const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     const [user, setUser] = useState<User | null>(null);
     const [loading, setLoading] = useState(true);
@@ -17,8 +19,18 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
                 setUser(currentUser);
             } else if (window.location.search.includes('code=')) {
                 const loggedInUser = await authService.processRedirect();
+                const savedHash = sessionStorage.getItem(PRE_AUTH_HASH_KEY);
+                sessionStorage.removeItem(PRE_AUTH_HASH_KEY);
+                if (savedHash && savedHash !== '#' && savedHash !== '#/') {
+                    window.history.replaceState(null, '', window.location.pathname + savedHash);
+                } else {
+                    window.history.replaceState(null, '', window.location.pathname + '#/');
+                }
                 setUser(loggedInUser);
             } else {
+                if (window.location.hash) {
+                    sessionStorage.setItem(PRE_AUTH_HASH_KEY, window.location.hash);
+                }
                 await authService.login();
             }
             setLoading(false);
@@ -34,6 +46,7 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     if (!user) {
         return <div>Redirecting to login...</div>;
     }
+
     return <>{children}</>;
 };
 export default ProtectedRoute;
diff --git a/calm-hub-ui/src/authConfig.test.ts b/calm-hub-ui/src/authConfig.test.ts
new file mode 100644
index 000000000..729d151d8
--- /dev/null
+++ b/calm-hub-ui/src/authConfig.test.ts
@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import axios from 'axios';
+import { getAuthConfig, isOidcEnabled, isGitHubMode } from './authConfig.js';
+
+vi.mock('axios');
+
+describe('authConfig', () => {
+    beforeEach(() => {
+        vi.resetModules();
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    describe('fetchAuthConfig', () => {
+        it('should fetch config from backend', async () => {
+            const mockConfig = {
+                oidc: { enabled: true, provider: 'entra-id', authority: 'https://login.microsoft.com/tenant', clientId: 'client-123', scopes: ['openid', 'profile'] },
+                databaseMode: 'github',
+            };
+            vi.mocked(axios.get).mockResolvedValue({ data: mockConfig });
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+            const result = await fetch();
+
+            expect(result.oidc.enabled).toBe(true);
+            expect(result.oidc.provider).toBe('entra-id');
+            expect(result.databaseMode).toBe('github');
+        });
+
+        it('should retry once and succeed on transient failure', async () => {
+            const mockConfig = {
+                oidc: { enabled: true, provider: 'generic-oidc' },
+                databaseMode: 'mongo',
+            };
+            vi.mocked(axios.get)
+                .mockRejectedValueOnce(new Error('Network error'))
+                .mockResolvedValueOnce({ data: mockConfig });
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+            const result = await fetch();
+
+            expect(result.oidc.enabled).toBe(true);
+        });
+
+        it('should throw when both attempts fail', async () => {
+            vi.mocked(axios.get).mockRejectedValue(new Error('Network error'));
+
+            const { fetchAuthConfig: fetch } = await import('./authConfig.js');
+
+            await expect(fetch()).rejects.toThrow('Unable to load authentication configuration');
+        });
+    });
+
+    describe('getAuthConfig', () => {
+        it('should return default config before fetch', () => {
+            const config = getAuthConfig();
+            expect(config.oidc.enabled).toBe(false);
+        });
+    });
+
+    describe('isOidcEnabled', () => {
+        it('should return false when not fetched', () => {
+            expect(isOidcEnabled()).toBe(false);
+        });
+    });
+
+    describe('isGitHubMode', () => {
+        it('should return false when not fetched', () => {
+            expect(isGitHubMode()).toBe(false);
+        });
+    });
+});
diff --git a/calm-hub-ui/src/authConfig.ts b/calm-hub-ui/src/authConfig.ts
new file mode 100644
index 000000000..c7b20d24c
--- /dev/null
+++ b/calm-hub-ui/src/authConfig.ts
@@ -0,0 +1,56 @@
+import axios from 'axios';
+
+export interface AuthConfig {
+    oidc: {
+        enabled: boolean;
+        provider?: string;
+        authority?: string;
+        clientId?: string;
+        scopes?: string[];
+        redirectUri?: string;
+    };
+    databaseMode: string;
+}
+
+const DEFAULT_CONFIG: AuthConfig = {
+    oidc: { enabled: false },
+    databaseMode: 'mongo',
+};
+
+let cachedConfig: AuthConfig | null = null;
+
+export async function fetchAuthConfig(): Promise<AuthConfig> {
+    if (cachedConfig) {
+        return cachedConfig;
+    }
+    const attempt = async (): Promise<AuthConfig> => {
+        const response = await axios.get<AuthConfig>('/api/calm/auth/config');
+        return response.data;
+    };
+    try {
+        cachedConfig = await attempt();
+        return cachedConfig;
+    } catch {
+        // Retry once after a short delay before giving up
+        try {
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+            cachedConfig = await attempt();
+            return cachedConfig;
+        } catch (retryError) {
+            console.error('Failed to fetch auth config after retry:', retryError);
+            throw new Error('Unable to load authentication configuration');
+        }
+    }
+}
+
+export function getAuthConfig(): AuthConfig {
+    return cachedConfig || DEFAULT_CONFIG;
+}
+
+export function isOidcEnabled(): boolean {
+    return cachedConfig?.oidc?.enabled ?? false;
+}
+
+export function isGitHubMode(): boolean {
+    return cachedConfig?.databaseMode === 'github';
+}
diff --git a/calm-hub-ui/src/authService.test.tsx b/calm-hub-ui/src/authService.test.tsx
index e9fe517ad..2d7b11dc2 100644
--- a/calm-hub-ui/src/authService.test.tsx
+++ b/calm-hub-ui/src/authService.test.tsx
@@ -6,6 +6,7 @@ import {
     getAuthHeaders,
     isAuthServiceEnabled,
 } from './authService.js';
+import * as authConfig from './authConfig.js';
 
 vi.mock('axios');
 
@@ -16,6 +17,11 @@ describe('authService', () => {
 
     describe('checkAuthorityService', () => {
         it('should return true when the authority service responds successfully', async () => {
+            vi.spyOn(authConfig, 'getAuthConfig').mockReturnValue({
+                oidc: { enabled: true, authority: 'https://auth.example.com' },
+                github: { enabled: false },
+                databaseMode: 'mongo',
+            });
             vi.mocked(axios.head).mockResolvedValue({ status: 200 });
             const result = await checkAuthorityService();
             expect(result).toBe(true);
diff --git a/calm-hub-ui/src/authService.tsx b/calm-hub-ui/src/authService.tsx
index 8e5457777..517edc8e3 100644
--- a/calm-hub-ui/src/authService.tsx
+++ b/calm-hub-ui/src/authService.tsx
@@ -1,35 +1,40 @@
-import { UserManager, Log, User } from 'oidc-client-ts';
+import { UserManager, User } from 'oidc-client-ts';
 import axios from 'axios';
+import { fetchAuthConfig, getAuthConfig } from './authConfig.js';
 
-const config = {
-    authority: 'https://calm-hub.finos.org:9443/realms/calm-hub-realm',
-    client_id: 'calm-hub-authz-code',
-    redirect_uri: window.location.origin,
-    response_type: 'code',
-    scope: 'openid profile architectures:read adrs:all',
-    post_logout_redirect_uri: window.location.origin,
-    automaticSilentRenew: true,
-    filterProtocolClaims: true,
-    loadUserInfo: true,
-};
-
-//Set AUTH_SERVICE_OIDC_ENABLE to true only when the backend is running with a secure profile and is NOT behind an ADC/Reverse-Proxy that handles user authentication.
-export const AUTH_SERVICE_OIDC_ENABLE: boolean = false;
 let userManager: UserManager | null = null;
+let initialized = false;
 
 export function isAuthServiceEnabled(): boolean {
-    const oidcEnabled = AUTH_SERVICE_OIDC_ENABLE;
-    const isHttps =
-        typeof window !== 'undefined' &&
-        typeof window.location !== 'undefined' &&
-        window.location.protocol === 'https:';
-    return (oidcEnabled && isHttps);
+    const config = getAuthConfig();
+    return config.oidc.enabled;
 }
 
-if (isAuthServiceEnabled()) {
-    userManager = new UserManager(config);
-    Log.setLogger(console);
-    Log.setLevel(Log.INFO);
+export async function initAuthService(): Promise<void> {
+    if (initialized) return;
+
+    const config = await fetchAuthConfig();
+    if (!config.oidc.enabled) {
+        initialized = true;
+        return;
+    }
+
+    const oidcConfig = {
+        authority: config.oidc.authority || '',
+        client_id: config.oidc.clientId || '',
+        redirect_uri: config.oidc.redirectUri
+            ? new URL(config.oidc.redirectUri, window.location.origin).toString()
+            : window.location.origin,
+        response_type: 'code',
+        scope: config.oidc.scopes?.join(' ') || 'openid profile email',
+        post_logout_redirect_uri: window.location.origin,
+        automaticSilentRenew: true,
+        filterProtocolClaims: true,
+        loadUserInfo: true,
+    };
+
+    userManager = new UserManager(oidcConfig);
+    initialized = true;
 }
 
 export async function getUser(): Promise<User | null> {
@@ -61,25 +66,26 @@ export async function logout(): Promise<void> {
 export async function clearSession(): Promise<void> {
     try {
         await userManager?.removeUser();
-        console.log('Session cleared successfully.');
     } catch (error) {
         console.error('Error clearing session:', error);
     }
 }
 
 export async function getToken(): Promise<string> {
-    if (!AUTH_SERVICE_OIDC_ENABLE) {
+    if (!userManager) {
         return '';
     }
-    const user = await userManager?.getUser();
+    const user = await userManager.getUser();
     if (user && !user.expired) {
-        return user.access_token;
+        // Entra ID: access_token audience is MS Graph, not our API.
+        // Send the id_token which has our client_id as audience.
+        return user.id_token || user.access_token;
     }
 
     if (user && user.expired) {
         try {
-            const refreshedUser = await userManager?.signinSilent();
-            return refreshedUser?.access_token || '';
+            const refreshedUser = await userManager.signinSilent();
+            return refreshedUser?.id_token || refreshedUser?.access_token || '';
         } catch (error) {
             console.error('Error refreshing token:', error);
             return '';
@@ -100,8 +106,12 @@ export async function getAuthHeaders(): Promise<AuthHeaders> {
 }
 
 export async function checkAuthorityService(): Promise<boolean> {
+    const config = getAuthConfig();
+    if (!config.oidc.enabled || !config.oidc.authority) {
+        return false;
+    }
     try {
-        await axios.head(config.authority);
+        await axios.head(config.oidc.authority);
         return true;
     } catch (error) {
         console.error('Authority Service Check Error:', error);
@@ -118,4 +128,5 @@ export const authService = {
     getToken,
     getAuthHeaders,
     isAuthServiceEnabled,
+    initAuthService,
 };
diff --git a/calm-hub-ui/src/components/navbar/Navbar.tsx b/calm-hub-ui/src/components/navbar/Navbar.tsx
index bbacb1c79..541878a5e 100644
--- a/calm-hub-ui/src/components/navbar/Navbar.tsx
+++ b/calm-hub-ui/src/components/navbar/Navbar.tsx
@@ -6,6 +6,8 @@ import { GlobalSearchBar } from './GlobalSearchBar.js';
 import { ThemeToggle } from './ThemeToggle.js';
 import { useTheme } from '../../theme/useTheme.js';
 import { UserAccessContext } from '../../admin/context/UserAccessContext.js';
+import { UserMenu } from '../user-menu/UserMenu.js';
+import { isAuthServiceEnabled } from '../../authService.js';
 
 /**
  * The navy-and-blue lockup is unreadable on a dark base, so dark gets a white one.
@@ -58,6 +60,7 @@ export function Navbar({ storage }: NavbarProps = {}) {
                 <div className="hidden lg:flex items-center">
                     <GlobalSearchBar />
                 </div>
+                {isAuthServiceEnabled() && <UserMenu />}
             </div>
 
             {/* Backdrop — dims the page behind the drawer; tap to close */}
diff --git a/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx b/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx
new file mode 100644
index 000000000..887a86338
--- /dev/null
+++ b/calm-hub-ui/src/components/user-menu/UserMenu.test.tsx
@@ -0,0 +1,55 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, waitFor } from '@testing-library/react';
+import { UserMenu } from './UserMenu.js';
+
+vi.mock('../../authService.js', () => ({
+    getUser: vi.fn().mockResolvedValue({
+        profile: {
+            name: 'Shivaji Byrapaneni',
+            preferred_username: 'shivaji.byrapaneni@fmr.com',
+            email: 'shivaji.byrapaneni@fmr.com',
+        },
+    }),
+    authService: {
+        logout: vi.fn().mockResolvedValue(undefined),
+    },
+}));
+
+describe('UserMenu', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+
+    it('should show user initial and name when loaded', async () => {
+        render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(screen.getByText('S')).toBeDefined();
+            expect(screen.getByText('Shivaji Byrapaneni')).toBeDefined();
+        });
+    });
+
+    it('should show dropdown with email when clicked', async () => {
+        render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(screen.getByText('Shivaji Byrapaneni')).toBeDefined();
+        });
+
+        fireEvent.click(screen.getByLabelText('User menu'));
+
+        expect(screen.getByText('shivaji.byrapaneni@fmr.com')).toBeDefined();
+        expect(screen.getByText('Sign out')).toBeDefined();
+    });
+
+    it('should render nothing when no user', async () => {
+        const { getUser } = await import('../../authService.js');
+        vi.mocked(getUser).mockResolvedValue(null);
+
+        const { container } = render(<UserMenu />);
+
+        await waitFor(() => {
+            expect(container.firstChild).toBeNull();
+        });
+    });
+});
diff --git a/calm-hub-ui/src/components/user-menu/UserMenu.tsx b/calm-hub-ui/src/components/user-menu/UserMenu.tsx
new file mode 100644
index 000000000..1da082a41
--- /dev/null
+++ b/calm-hub-ui/src/components/user-menu/UserMenu.tsx
@@ -0,0 +1,64 @@
+import React, { useEffect, useState } from 'react';
+import { authService, getUser } from '../../authService.js';
+import { User } from 'oidc-client-ts';
+
+export const UserMenu: React.FC = () => {
+    const [user, setUser] = useState<User | null>(null);
+    const [isOpen, setIsOpen] = useState(false);
+
+    useEffect(() => {
+        const loadUser = async () => {
+            const currentUser = await getUser();
+            setUser(currentUser);
+        };
+        loadUser();
+    }, []);
+
+    const handleLogout = async () => {
+        await authService.logout();
+    };
+
+    const displayName = user?.profile?.name || user?.profile?.preferred_username || 'User';
+    const email = user?.profile?.email || '';
+
+    if (!user) {
+        return null;
+    }
+
+    return (
+        <div className="relative">
+            <button
+                className="btn btn-ghost btn-sm gap-2 text-base-content"
+                onClick={() => setIsOpen(!isOpen)}
+                aria-label="User menu"
+            >
+                <div className="avatar placeholder">
+                    <div className="bg-primary text-primary-content rounded-full w-8 h-8">
+                        <span className="text-xs">{displayName.charAt(0).toUpperCase()}</span>
+                    </div>
+                </div>
+                <span className="hidden lg:inline text-sm max-w-32 truncate">{displayName}</span>
+            </button>
+
+            {isOpen && (
+                <>
+                    <div className="fixed inset-0 z-40" onClick={() => setIsOpen(false)} />
+                    <div className="absolute right-0 top-full mt-2 z-50 w-64 bg-base-100 border border-base-300 rounded-lg shadow-lg">
+                        <div className="px-4 py-3 border-b border-base-200">
+                            <p className="text-sm font-medium text-base-content">{displayName}</p>
+                            {email && <p className="text-xs text-base-content/60 truncate">{email}</p>}
+                        </div>
+                        <div className="py-1">
+                            <button
+                                onClick={handleLogout}
+                                className="w-full text-left px-4 py-2 text-sm text-error hover:bg-base-200"
+                            >
+                                Sign out
+                            </button>
+                        </div>
+                    </div>
+                </>
+            )}
+        </div>
+    );
+};
diff --git a/calm-hub-ui/src/hub/Hub.tsx b/calm-hub-ui/src/hub/Hub.tsx
index a68f25961..ae8ee6ede 100644
--- a/calm-hub-ui/src/hub/Hub.tsx
+++ b/calm-hub-ui/src/hub/Hub.tsx
@@ -465,6 +465,7 @@ export default function Hub() {
                             <ExploreRail
                                 namespaceCounts={namespaceCounts}
                                 domainCounts={domainCounts}
+                                loading={!namespaceCountsLoaded || !domainCountsLoaded}
                                 onCollapse={() => setIsSidebarOpen(false)}
                             />
                         ) : (
@@ -498,6 +499,7 @@ export default function Hub() {
                             <MobileNavMenu
                                 namespaceCounts={namespaceCounts}
                                 domainCounts={domainCounts}
+                                countsLoading={!namespaceCountsLoaded || !domainCountsLoaded}
                                 onClose={() => setIsMobileNavOpen(false)}
                             />
                         </div>
diff --git a/calm-hub-ui/src/hub/components/diagram-section/timeline/Sparkline.tsx b/calm-hub-ui/src/hub/components/diagram-section/timeline/Sparkline.tsx
index af69eaa55..82b63e2ee 100644
--- a/calm-hub-ui/src/hub/components/diagram-section/timeline/Sparkline.tsx
+++ b/calm-hub-ui/src/hub/components/diagram-section/timeline/Sparkline.tsx
@@ -151,12 +151,13 @@ export function Sparkline({
 
             {/* Track row. A single-version resource has nothing to scrub, so the
                 track is suppressed (the version pill already states what's shown).
-                overflow-hidden clips long labels at the track edge (#2728). */}
+                Individual labels are bounded by maxWidth + ellipsis (#2728); the
+                track itself uses overflow-visible so the last label isn't clipped. */}
             {!singleVersion && (
                 <div
                     data-testid="timeline-sparkline-track"
                     className="relative"
-                    style={{ height: 72, overflow: 'hidden' }}
+                    style={{ height: 72 }}
                 >
                     {/* Inner track wrapper inset 10px each side so dot percentages map directly */}
                     <div className="absolute" style={{ left: 10, right: 10, top: 0, bottom: 0 }}>
diff --git a/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineBar.test.tsx b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineBar.test.tsx
index 360e83d3e..9f962268d 100644
--- a/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineBar.test.tsx
+++ b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineBar.test.tsx
@@ -257,13 +257,12 @@ describe('TimelineBar', () => {
 
     // #2728 — long moment names must not block the expand control or clip cards.
     describe('long moment names are bounded (#2728)', () => {
-        it('clips the collapsed sparkline track so labels cannot paint over the expand button', () => {
+        it('does not clip the sparkline track so edge labels remain fully visible', () => {
             renderBar();
-            // The centre track is clipped so an overlong label can never overflow
-            // out to cover the statically-positioned expand button.
-            expect(screen.getByTestId('timeline-sparkline-track')).toHaveStyle({
-                overflow: 'hidden',
-            });
+            // Per-label maxWidth + ellipsis bounds individual labels (#2728);
+            // the track itself must NOT clip so the last label is not cut off.
+            const track = screen.getByTestId('timeline-sparkline-track');
+            expect(track).not.toHaveStyle({ overflow: 'hidden' });
         });
 
         it('truncates each collapsed label with an ellipsis while keeping its full-name tooltip', () => {
diff --git a/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.test.tsx b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.test.tsx
new file mode 100644
index 000000000..ed2755037
--- /dev/null
+++ b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.test.tsx
@@ -0,0 +1,36 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import { TimelineHeader } from './TimelineHeader.js';
+
+describe('TimelineHeader', () => {
+    it('prepends "v" for semver versions', () => {
+        render(<TimelineHeader currentVersion="1.5.0" />);
+        const pill = screen.getByTestId('timeline-version-pill');
+        expect(pill).toHaveTextContent('v1.5.0');
+    });
+
+    it('does not prepend "v" for commit SHAs', () => {
+        render(<TimelineHeader currentVersion="cb7686e" />);
+        const pill = screen.getByTestId('timeline-version-pill');
+        expect(pill).toHaveTextContent('cb7686e');
+        expect(pill.textContent).not.toMatch(/^v/);
+    });
+
+    it('does not prepend "v" for full-length commit SHAs', () => {
+        render(<TimelineHeader currentVersion="e46b2d5a1f3c9d8b7e2a0f4c6d8e1b3a5c7d9f0e" />);
+        const pill = screen.getByTestId('timeline-version-pill');
+        expect(pill.textContent).not.toMatch(/^v/);
+    });
+
+    it('prepends "v" for versions with non-hex characters', () => {
+        render(<TimelineHeader currentVersion="2.0.0-beta" />);
+        const pill = screen.getByTestId('timeline-version-pill');
+        expect(pill).toHaveTextContent('v2.0.0-beta');
+    });
+
+    it('sets the title attribute with the raw version', () => {
+        render(<TimelineHeader currentVersion="cb7686e" />);
+        const pill = screen.getByTestId('timeline-version-pill');
+        expect(pill).toHaveAttribute('title', 'Viewing version cb7686e');
+    });
+});
diff --git a/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.tsx b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.tsx
index d851da2bb..a220bbe85 100644
--- a/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.tsx
+++ b/calm-hub-ui/src/hub/components/diagram-section/timeline/TimelineHeader.tsx
@@ -18,7 +18,10 @@ interface TimelineHeaderProps {
  * explanatory copy makes it obvious that clicking a moment re-renders both the
  * Diagram and JSON views.
  */
+const isCommitSha = (v: string) => /^[0-9a-f]{5,40}$/.test(v);
+
 export function TimelineHeader({ currentVersion, children }: TimelineHeaderProps) {
+    const displayVersion = isCommitSha(currentVersion) ? currentVersion : `v${currentVersion}`;
     return (
         <div className="flex items-center gap-2 shrink-0" style={{ paddingTop: 4 }}>
             <IoTimeOutline size={14} style={{ color: colors.ink[500], strokeWidth: 2 }} />
@@ -46,7 +49,7 @@ export function TimelineHeader({ currentVersion, children }: TimelineHeaderProps
                 }}
                 title={`Viewing version ${currentVersion}`}
             >
-                v{currentVersion}
+                {displayVersion}
             </span>
             {children}
         </div>
diff --git a/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.test.tsx b/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.test.tsx
index cf8035ca7..565ed91c1 100644
--- a/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.test.tsx
+++ b/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.test.tsx
@@ -211,4 +211,58 @@ describe('DocumentDetailSection', () => {
         expect(mockFetchVersionsByCustomId).toHaveBeenCalledWith('test-ns', 'my-payment-standard', 'Standards');
         expect(mockFetchStandardVersions).not.toHaveBeenCalled();
     });
+
+    it('renders markdown content when data is a markdown string', () => {
+        const data: Data = {
+            id: 'std-123',
+            version: 'latest',
+            name: 'test-ns',
+            calmType: 'Standards',
+            data: '# TLS Policy\n\nAll services must use TLS 1.2+.',
+        };
+
+        render(
+            <MemoryRouter>
+                <DocumentDetailSection data={data} />
+            </MemoryRouter>
+        );
+
+        expect(screen.getByText('All services must use TLS 1.2+.')).toBeInTheDocument();
+    });
+
+    it('shows display name from markdown heading in breadcrumb', () => {
+        const data: Data = {
+            id: '12345',
+            version: 'latest',
+            name: 'test-ns',
+            calmType: 'Standards',
+            data: '# My Standard Name\n\nContent.',
+        };
+
+        const { container } = render(
+            <MemoryRouter>
+                <DocumentDetailSection data={data} />
+            </MemoryRouter>
+        );
+
+        expect(container.textContent).toContain('My Standard Name');
+    });
+
+    it('shows type label in breadcrumb', () => {
+        const data: Data = {
+            id: 'std-1',
+            version: 'latest',
+            name: 'fae-calm',
+            calmType: 'Standards',
+            data: '# Test\n\nBody.',
+        };
+
+        const { container } = render(
+            <MemoryRouter>
+                <DocumentDetailSection data={data} />
+            </MemoryRouter>
+        );
+
+        expect(container.textContent).toContain('Standards');
+    });
 });
diff --git a/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.tsx b/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.tsx
index 59ceae1cd..7ec535fc9 100644
--- a/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.tsx
+++ b/calm-hub-ui/src/hub/components/document-detail-section/DocumentDetailSection.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useMemo, useState } from 'react';
 import { useNavigate } from 'react-router-dom';
 import { IoGridOutline, IoGitNetworkOutline } from 'react-icons/io5';
+import Markdown from 'react-markdown';
 import { Data, isSlug } from '../../../model/calm.js';
 import { CalmService } from '../../../service/calm-service.js';
 import { sortVersionsDescending } from '../../../model/version.js';
@@ -11,6 +12,24 @@ interface DocumentDetailSectionProps {
     data?: Data;
 }
 
+function getDisplayName(data: Data): string {
+    if (typeof data.data === 'string') {
+        const content = data.data as string;
+        const headingMatch = content.match(/^#\s+(.+)$/m);
+        if (headingMatch) return headingMatch[1];
+    }
+    if (typeof data.data === 'object' && data.data && 'name' in (data.data as object)) {
+        return String((data.data as Record<string, unknown>).name);
+    }
+    return data.id;
+}
+
+function isMarkdownContent(data: Data): boolean {
+    if (typeof data.data !== 'string') return false;
+    const content = data.data as string;
+    return content.startsWith('#') || content.startsWith('---') || !content.startsWith('{');
+}
+
 function calmTypeToUrlSegment(calmType: string): string {
     switch (calmType) {
         case 'Standards': return 'standards';
@@ -69,6 +88,8 @@ export function DocumentDetailSection({ data }: DocumentDetailSectionProps) {
                     icon={getIcon()}
                     namespace={data.name}
                     id={data.id}
+                    displayName={getDisplayName(data)}
+                    typeLabel={data.calmType}
                     version={data.version}
                     typeSegment={calmTypeToUrlSegment(data.calmType)}
                     versions={versions}
@@ -76,7 +97,13 @@ export function DocumentDetailSection({ data }: DocumentDetailSectionProps) {
                 />
 
                 <div className="flex-1 min-h-0 overflow-auto bg-base-200">
-                    <JsonRenderer json={data} />
+                    {isMarkdownContent(data) ? (
+                        <div className="prose prose-sm max-w-none p-6 bg-base-100">
+                            <Markdown>{data.data as string}</Markdown>
+                        </div>
+                    ) : (
+                        <JsonRenderer json={data} />
+                    )}
                 </div>
             </div>
         </div>
diff --git a/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.test.tsx b/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.test.tsx
index c20af66e3..a002fca8c 100644
--- a/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.test.tsx
+++ b/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.test.tsx
@@ -14,7 +14,7 @@ const domainCounts: DomainControlCount[] = [
     { domain: 'compliance', controlCount: 0 },
 ];
 
-const renderRail = (path = '/', onCollapse?: () => void) =>
+const renderRail = (path = '/', onCollapse?: () => void, loading?: boolean) =>
     render(
         <MemoryRouter initialEntries={[path]}>
             <Routes>
@@ -26,6 +26,7 @@ const renderRail = (path = '/', onCollapse?: () => void) =>
                             <ExploreRail
                                 namespaceCounts={namespaceCounts}
                                 domainCounts={domainCounts}
+                                loading={loading}
                                 onCollapse={onCollapse}
                             />
                         }
@@ -91,4 +92,21 @@ describe('ExploreRail', () => {
         expect(onCollapse).toHaveBeenCalled();
         await screen.findByRole('link', { name: /finos/ });
     });
+
+    it('shows loading spinners instead of items when loading is true', () => {
+        renderRail('/', undefined, true);
+        const spinners = screen.getAllByClassName
+            ? document.querySelectorAll('.loading-spinner')
+            : screen.getByText('NAMESPACES').parentElement!.querySelectorAll('.loading-spinner');
+        expect(spinners.length).toBeGreaterThanOrEqual(2);
+        expect(screen.queryByRole('link', { name: /finos/ })).not.toBeInTheDocument();
+        expect(screen.queryByRole('link', { name: /security/ })).not.toBeInTheDocument();
+    });
+
+    it('shows items instead of spinners when loading is false', async () => {
+        renderRail('/', undefined, false);
+        expect(await screen.findByRole('link', { name: /finos/ })).toBeInTheDocument();
+        expect(screen.getByRole('link', { name: /security/ })).toBeInTheDocument();
+        expect(document.querySelectorAll('.loading-spinner').length).toBe(0);
+    });
 });
diff --git a/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.tsx b/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.tsx
index 800333aa5..769bfe562 100644
--- a/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.tsx
+++ b/calm-hub-ui/src/hub/components/explore-rail/ExploreRail.tsx
@@ -12,6 +12,8 @@ interface ExploreRailProps {
     namespaceCounts: NamespaceCounts[];
     /** Per-domain control counts, fetched once by {@link Hub} and passed down. */
     domainCounts: DomainControlCount[];
+    /** True while the counts are still being fetched from the backend. */
+    loading?: boolean;
     /** Collapse the rail (keeps the existing sidebar collapse affordance). */
     onCollapse?: () => void;
 }
@@ -28,7 +30,7 @@ type RailRouteParams = { ns?: string; domain?: string; namespace?: string };
  * once there and shared), so this component takes them as props rather than
  * re-fetching them itself.
  */
-export function ExploreRail({ namespaceCounts, domainCounts, onCollapse }: ExploreRailProps) {
+export function ExploreRail({ namespaceCounts, domainCounts, loading, onCollapse }: ExploreRailProps) {
     // `ns` comes from /namespace/:ns; on the detail route /:namespace/:type/:id/:version the
     // param is `namespace`. Fall back to it so the rail keeps its highlight during a detail session.
     const { ns, domain: activeDomain, namespace } = useParams<RailRouteParams>();
@@ -82,28 +84,40 @@ export function ExploreRail({ namespaceCounts, domainCounts, onCollapse }: Explo
             <div className="flex-1 overflow-auto pb-3">
                 <RailSectionLabel>NAMESPACES</RailSectionLabel>
                 <div className="flex flex-col gap-0.5 px-1.5">
-                    {filteredNamespaces.map((nc) => (
-                        <RailItem
-                            key={nc.namespace}
-                            label={nc.namespace}
-                            count={nc.total}
-                            active={nc.namespace === activeNamespace}
-                            to={`/namespace/${nc.namespace}`}
-                        />
-                    ))}
+                    {loading ? (
+                        <div className="flex items-center justify-center py-6">
+                            <span className="loading loading-spinner loading-md text-base-content/50" />
+                        </div>
+                    ) : (
+                        filteredNamespaces.map((nc) => (
+                            <RailItem
+                                key={nc.namespace}
+                                label={nc.namespace}
+                                count={nc.total}
+                                active={nc.namespace === activeNamespace}
+                                to={`/namespace/${nc.namespace}`}
+                            />
+                        ))
+                    )}
                 </div>
 
                 <RailSectionLabel>CONTROL DOMAINS</RailSectionLabel>
                 <div className="flex flex-col gap-0.5 px-1.5">
-                    {domainCounts.map((dc) => (
-                        <RailItem
-                            key={dc.domain}
-                            label={dc.domain}
-                            count={dc.controlCount}
-                            active={dc.domain === activeDomain}
-                            to={`/domain/${dc.domain}`}
-                        />
-                    ))}
+                    {loading ? (
+                        <div className="flex items-center justify-center py-6">
+                            <span className="loading loading-spinner loading-md text-base-content/50" />
+                        </div>
+                    ) : (
+                        domainCounts.map((dc) => (
+                            <RailItem
+                                key={dc.domain}
+                                label={dc.domain}
+                                count={dc.controlCount}
+                                active={dc.domain === activeDomain}
+                                to={`/domain/${dc.domain}`}
+                            />
+                        ))
+                    )}
                 </div>
             </div>
         </div>
diff --git a/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx b/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
index 90c00597a..7b819a4b6 100644
--- a/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
+++ b/calm-hub-ui/src/hub/components/intro-screen/IntroScreen.tsx
@@ -1,6 +1,8 @@
 import { NamespaceCounts, DomainControlCount } from '../../../model/counts.js';
 import { useTheme } from '../../../theme/useTheme.js';
 import { ThemeToggle } from '../../../components/navbar/ThemeToggle.js';
+import { UserMenu } from '../../../components/user-menu/UserMenu.js';
+import { isAuthServiceEnabled } from '../../../authService.js';
 import { IntroSearchBar } from './IntroSearchBar.js';
 import { IntroBrowse } from './IntroBrowse.js';
 
@@ -27,8 +29,9 @@ export function IntroScreen({ namespaceCounts, domainCounts, storage }: IntroScr
 
     return (
         <div data-testid="intro-screen" className="relative h-screen overflow-auto bg-base-100">
-            <div className="absolute top-4 right-4 z-10">
+            <div className="absolute top-4 right-4 z-10 flex items-center gap-2">
                 <ThemeToggle theme={theme} onToggle={toggleTheme} />
+                {isAuthServiceEnabled() && <UserMenu />}
             </div>
 
             <div className="min-h-full flex flex-col items-center px-6 py-16 sm:py-24">
diff --git a/calm-hub-ui/src/hub/components/namespace-page/ItemCard.tsx b/calm-hub-ui/src/hub/components/namespace-page/ItemCard.tsx
index 97aaf9583..b547fb915 100644
--- a/calm-hub-ui/src/hub/components/namespace-page/ItemCard.tsx
+++ b/calm-hub-ui/src/hub/components/namespace-page/ItemCard.tsx
@@ -95,9 +95,11 @@ export function ItemCard({
     const chip =
         meta !== undefined
             ? meta
-            : versionCount !== undefined
+            : versionCount !== undefined && versionCount > 0
               ? `${versionCount} ${versionCount === 1 ? 'version' : 'versions'}`
-              : customId;
+              : versionCount === 0
+                ? customId || undefined
+                : customId;
 
     return (
         <article
diff --git a/calm-hub-ui/src/hub/components/section-header/SectionHeader.test.tsx b/calm-hub-ui/src/hub/components/section-header/SectionHeader.test.tsx
index 40d6326dd..b4aba41ec 100644
--- a/calm-hub-ui/src/hub/components/section-header/SectionHeader.test.tsx
+++ b/calm-hub-ui/src/hub/components/section-header/SectionHeader.test.tsx
@@ -1,9 +1,15 @@
+import React from 'react';
 import { render, screen } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
-import { SectionHeader } from './SectionHeader.js';
+import { MemoryRouter } from 'react-router-dom';
+import { SectionHeader as SectionHeaderRaw } from './SectionHeader.js';
 import { describe, it, expect, vi } from 'vitest';
 import type { BreadcrumbItem } from '../../../model/calm.js';
 
+function SectionHeader(props: React.ComponentProps<typeof SectionHeaderRaw>) {
+    return <MemoryRouter><SectionHeaderRaw {...props} /></MemoryRouter>;
+}
+
 describe('SectionHeader', () => {
     it('renders icon, namespace, id, and version', () => {
         const icon = <span data-testid="test-icon">Icon</span>;
diff --git a/calm-hub-ui/src/hub/components/section-header/SectionHeader.tsx b/calm-hub-ui/src/hub/components/section-header/SectionHeader.tsx
index b08325b7a..d4c667c9c 100644
--- a/calm-hub-ui/src/hub/components/section-header/SectionHeader.tsx
+++ b/calm-hub-ui/src/hub/components/section-header/SectionHeader.tsx
@@ -1,4 +1,5 @@
 import { ReactNode, useState } from 'react';
+import { Link } from 'react-router-dom';
 import { IoCopyOutline, IoCheckmarkOutline, IoLinkOutline } from 'react-icons/io5';
 import { BreadcrumbItem, isSlug } from '../../../model/calm.js';
 import { BreadcrumbTrail } from './BreadcrumbTrail.js';
@@ -45,11 +46,12 @@ export function SectionHeader({ icon, namespace, id, version, typeSegment, right
                 <h2 className="text-base sm:text-xl font-semibold flex flex-wrap items-center gap-x-2 gap-y-1 min-w-0">
                     {icon}
                     {breadcrumbs && <BreadcrumbTrail breadcrumbs={breadcrumbs} onBreadcrumbClick={onBreadcrumbClick} />}
-                    {namespace}
+                    <Link to={`/namespace/${encodeURIComponent(namespace)}`} className="text-accent hover:underline">{namespace}</Link>
                     {typeLabel && (
                         <>
                             {' '}
-                            <span className="text-base-content/40">/</span> {typeLabel}
+                            <span className="text-base-content/40">/</span>{' '}
+                            <Link to={`/namespace/${encodeURIComponent(namespace)}?type=${typeSegment}`} className="text-accent hover:underline">{typeLabel}</Link>
                         </>
                     )}{' '}
                     <span className="text-base-content/40">/</span>{' '}
diff --git a/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.test.tsx b/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.test.tsx
index 518362bb6..05d7be2b5 100644
--- a/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.test.tsx
+++ b/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.test.tsx
@@ -185,4 +185,26 @@ describe('MobileNavMenu', () => {
         expect(await screen.findByText('traderx')).toBeInTheDocument();
         expect(screen.queryByText('Architectures')).not.toBeInTheDocument();
     });
+
+    it('shows a spinner at the root level when countsLoading is true', () => {
+        render(
+            <MemoryRouter>
+                <MobileNavMenu {...props} countsLoading={true} />
+            </MemoryRouter>
+        );
+        const spinner = document.querySelector('.loading-spinner');
+        expect(spinner).toBeInTheDocument();
+        expect(screen.queryByText('Namespaces')).not.toBeInTheDocument();
+    });
+
+    it('shows rows at the root level when countsLoading is false', () => {
+        render(
+            <MemoryRouter>
+                <MobileNavMenu {...props} countsLoading={false} />
+            </MemoryRouter>
+        );
+        expect(document.querySelector('.loading-spinner')).not.toBeInTheDocument();
+        expect(screen.getByText('Namespaces')).toBeInTheDocument();
+        expect(screen.getByText('Control Domains')).toBeInTheDocument();
+    });
 });
diff --git a/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.tsx b/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.tsx
index 821dbbec2..ebc8c2325 100644
--- a/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.tsx
+++ b/calm-hub-ui/src/hub/components/tree-navigation/MobileNavMenu.tsx
@@ -27,6 +27,8 @@ interface MobileNavMenuProps {
     namespaceCounts: NamespaceCounts[];
     /** Per-domain control counts, fetched once by {@link Hub} and passed down. */
     domainCounts: DomainControlCount[];
+    /** True while the counts are still being fetched from the backend. */
+    countsLoading?: boolean;
     /** Dismiss the menu (e.g. after a resource is chosen). */
     onClose: () => void;
 }
@@ -66,7 +68,7 @@ interface LeafItem {
  * {@link Hub} (fetched once and shared) and passed in as props rather than
  * re-fetched here.
  */
-export function MobileNavMenu({ namespaceCounts, domainCounts, onClose }: MobileNavMenuProps) {
+export function MobileNavMenu({ namespaceCounts, domainCounts, countsLoading, onClose }: MobileNavMenuProps) {
     const navigate = useNavigate();
     const params = useParams<HubParams>();
 
@@ -287,7 +289,8 @@ export function MobileNavMenu({ namespaceCounts, domainCounts, onClose }: Mobile
         }
     })();
 
-    const isEmpty = !loading && rows.length === 0;
+    const showLoading = loading || (countsLoading && (view.level === 'root' || view.level === 'namespaces' || view.level === 'domains'));
+    const isEmpty = !showLoading && rows.length === 0;
 
     return (
         <div className="h-full w-full flex flex-col">
@@ -309,7 +312,7 @@ export function MobileNavMenu({ namespaceCounts, domainCounts, onClose }: Mobile
 
             {!searching && (
                 <ul className="flex-1 overflow-auto divide-y divide-base-200">
-                    {loading && (
+                    {showLoading && (
                         <li className="flex items-center justify-center py-8">
                             <span className="loading loading-spinner loading-md text-base-content/50" />
                         </li>
@@ -317,7 +320,7 @@ export function MobileNavMenu({ namespaceCounts, domainCounts, onClose }: Mobile
                     {isEmpty && (
                         <li className="px-4 py-8 text-center text-base-content/50 text-sm">Nothing here</li>
                     )}
-                    {!loading &&
+                    {!showLoading &&
                         rows.map((row) => (
                             <li key={row.key}>
                                 <button
diff --git a/calm-hub-ui/src/index.tsx b/calm-hub-ui/src/index.tsx
index 51ca27c24..54d119055 100644
--- a/calm-hub-ui/src/index.tsx
+++ b/calm-hub-ui/src/index.tsx
@@ -2,27 +2,31 @@ import './index.css';
 import React from 'react';
 import ReactDOM from 'react-dom/client';
 import ProtectedRoute from './ProtectedRoute.js';
-import { isAuthServiceEnabled } from './authService.js';
+import { initAuthService, isAuthServiceEnabled } from './authService.js';
 import App from './App.js';
-import { LogoutButton } from './components/logout-button/LogoutButton.js';
 import { AuthErrorModal } from './AuthModalError.js';
 import { MigrationErrorModal } from './MigrationModalError.js';
 
 const root = ReactDOM.createRoot(document.getElementById('root') as HTMLElement);
 
-const isAuthenticationEnabled = isAuthServiceEnabled();
+async function bootstrap() {
+    await initAuthService();
 
-root.render(
-    <React.StrictMode>
-        {isAuthenticationEnabled ? (
-            <ProtectedRoute>
+    const isAuthenticationEnabled = isAuthServiceEnabled();
+
+    root.render(
+        <React.StrictMode>
+            {isAuthenticationEnabled ? (
+                <ProtectedRoute>
+                    <App />
+                </ProtectedRoute>
+            ) : (
                 <App />
-                <LogoutButton />
-            </ProtectedRoute>
-        ) : (
-            <App />
-        )}
-        <AuthErrorModal />
-        <MigrationErrorModal />
-    </React.StrictMode>
-);
+            )}
+            <AuthErrorModal />
+            <MigrationErrorModal />
+        </React.StrictMode>
+    );
+}
+
+bootstrap();
diff --git a/calm-hub-ui/src/model/version.spec.ts b/calm-hub-ui/src/model/version.spec.ts
index a7d0242e8..4802eaa28 100644
--- a/calm-hub-ui/src/model/version.spec.ts
+++ b/calm-hub-ui/src/model/version.spec.ts
@@ -30,6 +30,18 @@ describe('sortVersionsDescending', () => {
         expect(result).toEqual(['2.0.0', '1.5.0', '1.0.0']);
         expect(input).toEqual(['1.0.0', '2.0.0', '1.5.0']);
     });
+
+    it('reverses SHA versions from chronological to newest-first', () => {
+        const input = ['abc1234', 'def5678', 'f1339ab'];
+        const result = sortVersionsDescending(input);
+        expect(result).toEqual(['f1339ab', 'def5678', 'abc1234']);
+    });
+
+    it('does not re-sort SHA versions alphabetically', () => {
+        const input = ['aaa1111', 'fff9999', 'bbb2222'];
+        const result = sortVersionsDescending(input);
+        expect(result).toEqual(['bbb2222', 'fff9999', 'aaa1111']);
+    });
 });
 
 describe('pickLatestVersion', () => {
@@ -44,4 +56,9 @@ describe('pickLatestVersion', () => {
     it('returns the only version when the list has one entry', () => {
         expect(pickLatestVersion(['3.4.5'])).toBe('3.4.5');
     });
+
+    it('returns the last SHA (newest) from chronological list', () => {
+        const input = ['abc1234', 'def5678', 'f1339ab'];
+        expect(pickLatestVersion(input)).toBe('f1339ab');
+    });
 });
diff --git a/calm-hub-ui/src/model/version.ts b/calm-hub-ui/src/model/version.ts
index 150a88e85..09383151e 100644
--- a/calm-hub-ui/src/model/version.ts
+++ b/calm-hub-ui/src/model/version.ts
@@ -33,8 +33,13 @@ export function compareVersions(a: string, b: string): number {
 
 /**
  * Return versions sorted newest-first.
+ * For commit SHAs, the backend returns chronological (oldest first) —
+ * reverse to get newest-first, matching semver sort behavior.
  */
 export function sortVersionsDescending(versions: string[]): string[] {
+    if (versions.length > 0 && /^[0-9a-f]{5,40}$/.test(versions[0])) {
+        return [...versions].reverse();
+    }
     return [...versions].sort((a, b) => compareVersions(b, a));
 }
 
diff --git a/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.test.tsx b/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.test.tsx
index d82f83947..ba7661b0f 100644
--- a/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.test.tsx
+++ b/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.test.tsx
@@ -5,8 +5,10 @@ import { DiagramActionsContext } from '../../context/DiagramActionsContext.js';
 import { restoreLocation, setHostname } from '../../../test-support/window-location.js';
 
 vi.mock('reactflow', () => ({
-    Handle: () => null,
-    Position: { Right: 'right', Left: 'left' },
+    Handle: ({ position, id }: { position: string; id: string }) => (
+        <div data-testid={`handle-${id}`} data-position={position} />
+    ),
+    Position: { Top: 'top', Right: 'right', Bottom: 'bottom', Left: 'left' },
 }));
 
 function makeNodeProps(details?: Record<string, unknown>) {
@@ -188,4 +190,43 @@ describe('CustomNode — external URL support', () => {
 
         expect(screen.getByTitle('Has detailed architecture')).toBeInTheDocument();
     });
+
+    it('renders handles on all four sides for edge connection', () => {
+        const props = makeNodeProps();
+        const { container } = renderNode(props);
+
+        expect(container.querySelector('[data-testid="handle-top-target"]')).not.toBeNull();
+        expect(container.querySelector('[data-testid="handle-bottom-source"]')).not.toBeNull();
+        expect(container.querySelector('[data-testid="handle-left-target"]')).not.toBeNull();
+        expect(container.querySelector('[data-testid="handle-right-source"]')).not.toBeNull();
+    });
+
+    it('applies building-block-style background and text colors from metadata', () => {
+        const props = {
+            id: 'node-styled',
+            type: 'custom',
+            selected: false,
+            zIndex: 0,
+            isConnectable: true,
+            xPos: 0,
+            yPos: 0,
+            dragging: false,
+            data: {
+                label: 'Styled Node',
+                description: 'A styled node',
+                'node-type': 'webclient',
+                metadata: {
+                    'building-block-style': {
+                        background: '#1C4587',
+                        text: '#ffffff',
+                    },
+                },
+            },
+        };
+
+        const { container } = renderNode(props);
+        const nodeDiv = container.querySelector('[data-testid="custom-node"] > div');
+        expect(nodeDiv).not.toBeNull();
+        expect(nodeDiv?.getAttribute('style')).toContain('rgb(28, 69, 135)');
+    });
 });
diff --git a/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.tsx b/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.tsx
index ae2324f0d..148bb19eb 100644
--- a/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.tsx
+++ b/calm-hub-ui/src/visualizer/components/reactflow/CustomNode.tsx
@@ -95,6 +95,9 @@ export function CustomNode({ data }: NodeProps) {
   const isUnknownArch = !!detailedArchitecture && archResolution.type === 'unknown';
   const archPath = isSameOriginArch ? archResolution.path : undefined;
 
+    // Extract building-block-style colors from metadata (if present)
+    const buildingBlockStyle = data.metadata?.['building-block-style'] as { background?: string; text?: string } | undefined;
+
     // Extract AIGF data (if present in node metadata)
     const aigf = data.metadata?.aigf;
     const riskLevel = aigf?.['risk-level'] || null;
@@ -169,12 +172,12 @@ export function CustomNode({ data }: NodeProps) {
       {/* Base node - always visible, fixed size */}
       <div
         style={{
-          background: THEME.colors.card,
-          border: `2px solid ${borderColor}`,
+          background: buildingBlockStyle?.background || `${nodeTypeStyle.color}12`,
+          border: `2px solid ${buildingBlockStyle?.background || borderColor}`,
           borderRadius: '12px',
           padding: '16px',
           width: '100%',
-          color: THEME.colors.foreground,
+          color: buildingBlockStyle?.text || THEME.colors.foreground,
           fontSize: '14px',
           fontWeight: 500,
           boxShadow: isHovered ? THEME.shadows.lg : THEME.shadows.sm,
@@ -182,8 +185,10 @@ export function CustomNode({ data }: NodeProps) {
         }}
       >
       {/* Hidden handles to satisfy React Flow; floating edge computes actual attachment */}
-      <Handle type="source" position={Position.Right} id="source" style={{ opacity: 0 }} />
-      <Handle type="target" position={Position.Left} id="target" style={{ opacity: 0 }} />
+      <Handle type="target" position={Position.Top} id="top-target" style={{ opacity: 0 }} />
+      <Handle type="source" position={Position.Bottom} id="bottom-source" style={{ opacity: 0 }} />
+      <Handle type="target" position={Position.Left} id="left-target" style={{ opacity: 0 }} />
+      <Handle type="source" position={Position.Right} id="right-source" style={{ opacity: 0 }} />
 
       <div style={{ display: 'flex', alignItems: 'flex-start', justifyContent: 'space-between', gap: '8px' }}>
         <div style={{ fontWeight: 600, marginBottom: '4px', flex: 1, display: 'flex', alignItems: 'center', gap: '8px' }}>
diff --git a/calm-hub-ui/src/visualizer/components/reactflow/FloatingEdge.tsx b/calm-hub-ui/src/visualizer/components/reactflow/FloatingEdge.tsx
index b8c507e5d..df5b38a95 100644
--- a/calm-hub-ui/src/visualizer/components/reactflow/FloatingEdge.tsx
+++ b/calm-hub-ui/src/visualizer/components/reactflow/FloatingEdge.tsx
@@ -1,19 +1,26 @@
 import { useState, useCallback } from 'react';
-import { EdgeProps, getBezierPath, EdgeLabelRenderer, useStore } from 'reactflow';
+import { EdgeProps, getBezierPath, getSmoothStepPath, getStraightPath, EdgeLabelRenderer, useStore } from 'reactflow';
 import { getEdgeParams } from './utils/floatingEdges.js';
-import { EdgeBadge, EdgeTooltip, getBadgeStyle } from './edge-components/index.js';
+import { EdgeTooltip } from './edge-components/index.js';
 import type { EdgeData } from '../../contracts/contracts.js';
 
 export function FloatingEdge({
     id,
     source,
     target,
+    sourceX,
+    sourceY,
+    targetX,
+    targetY,
+    sourcePosition,
+    targetPosition,
     style = {},
     markerEnd,
     markerStart,
     data,
 }: EdgeProps<EdgeData>) {
     const [isHovered, setIsHovered] = useState(false);
+    const routing = data?.metadata?.routing as string | undefined;
 
     const sourceNode = useStore(useCallback((store) => store.nodeInternals.get(source), [source]));
     const targetNode = useStore(useCallback((store) => store.nodeInternals.get(target), [target]));
@@ -22,7 +29,12 @@ export function FloatingEdge({
         return null;
     }
 
-    const { sx, sy, tx, ty, sourcePos, targetPos } = getEdgeParams(sourceNode, targetNode);
+    // For smoothstep/straight: use ReactFlow's native handle-based positions (precise attachment)
+    // For bezier (default): use floating edge calculation (curves naturally into nodes)
+    const useNativePositions = routing === 'smoothstep' || routing === 'straight';
+    const { sx, sy, tx, ty, sourcePos, targetPos } = useNativePositions
+        ? { sx: sourceX, sy: sourceY, tx: targetX, ty: targetY, sourcePos: sourcePosition, targetPos: targetPosition }
+        : getEdgeParams(sourceNode, targetNode);
 
     // Calculate perpendicular offset for bidirectional edges
     const direction = data?.direction;
@@ -32,14 +44,19 @@ export function FloatingEdge({
         sx, sy, tx, ty, offset, direction
     );
 
-    const [edgePath, labelX, labelY] = getBezierPath({
+    const pathParams = {
         sourceX: adjustedSourceX,
         sourceY: adjustedSourceY,
         sourcePosition: sourcePos,
         targetX: adjustedTargetX,
         targetY: adjustedTargetY,
         targetPosition: targetPos,
-    });
+    };
+
+    const [edgePath, labelX, labelY] =
+        routing === 'straight' ? getStraightPath(pathParams) :
+        routing === 'smoothstep' ? getSmoothStepPath(pathParams) :
+        getBezierPath(pathParams);
 
     // Extract edge data
     const description = data?.description || '';
@@ -53,9 +70,8 @@ export function FloatingEdge({
     const mitigations = aigf?.mitigations || [];
     const risks = aigf?.risks || [];
 
-    const hasFlowInfo = flowTransitions.length > 0;
-    const hasAIGF = controlsApplied.length > 0 || mitigations.length > 0 || risks.length > 0;
-    const badgeStyle = getBadgeStyle(hasFlowInfo, hasAIGF);
+
+    const edgeLabel = description || protocol || '';
 
     return (
         <>
@@ -67,7 +83,7 @@ export function FloatingEdge({
                 markerEnd={markerEnd}
                 markerStart={markerStart}
             />
-            {description && (
+            {edgeLabel && (
                 <EdgeLabelRenderer>
                     <div
                         style={{
@@ -77,14 +93,12 @@ export function FloatingEdge({
                             zIndex: 1000,
                         }}
                         className="nodrag nopan"
+                        onMouseEnter={() => setIsHovered(true)}
+                        onMouseLeave={() => setIsHovered(false)}
                     >
-                        <EdgeBadge
-                            hasFlowInfo={hasFlowInfo}
-                            hasAIGF={hasAIGF}
-                            badgeStyle={badgeStyle}
-                            onMouseEnter={() => setIsHovered(true)}
-                            onMouseLeave={() => setIsHovered(false)}
-                        />
+                        <span className="text-[0.625rem] leading-tight px-1 py-0.5 rounded bg-base-100/90 border border-base-300 text-base-content/60 max-w-[10rem] truncate inline-block">
+                            {edgeLabel}
+                        </span>
                     </div>
 
                     {isHovered && (
diff --git a/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.test.ts b/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.test.ts
index cb1ac3e0e..e24a58454 100644
--- a/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.test.ts
+++ b/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.test.ts
@@ -20,10 +20,10 @@ describe('createEdge', () => {
         expect(edge.type).toBe('custom');
     });
 
-    it('sets source and target handles', () => {
+    it('does not set explicit handles so ReactFlow auto-selects nearest', () => {
         const edge = createEdge(baseConfig);
-        expect(edge.sourceHandle).toBe('source');
-        expect(edge.targetHandle).toBe('target');
+        expect(edge.sourceHandle).toBeUndefined();
+        expect(edge.targetHandle).toBeUndefined();
     });
 
     it('includes description in data from label', () => {
@@ -102,4 +102,20 @@ describe('createEdge', () => {
         expect(edge.data.target).toBeUndefined();
         expect(edge.data.label).toBeUndefined();
     });
+
+    it('passes routing metadata through to edge data', () => {
+        const edge = createEdge({
+            ...baseConfig,
+            data: { metadata: { routing: 'smoothstep' } },
+        });
+        expect(edge.data.metadata.routing).toBe('smoothstep');
+    });
+
+    it('passes protocol through to edge data', () => {
+        const edge = createEdge({
+            ...baseConfig,
+            data: { protocol: 'HTTPS' },
+        });
+        expect(edge.data.protocol).toBe('HTTPS');
+    });
 });
diff --git a/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.ts b/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.ts
index 734c86dc4..ebed411aa 100644
--- a/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.ts
+++ b/calm-hub-ui/src/visualizer/components/reactflow/utils/edgeFactory.ts
@@ -35,8 +35,6 @@ export function createEdge(config: EdgeConfig): Edge {
         id,
         source,
         target,
-        sourceHandle: 'source',
-        targetHandle: 'target',
         type: 'custom',
         animated,
         style: {
diff --git a/calm-hub/.gitignore b/calm-hub/.gitignore
index 722f4cc3a..965a7b093 100644
--- a/calm-hub/.gitignore
+++ b/calm-hub/.gitignore
@@ -128,6 +128,8 @@ META-INF/
 src/main/resources/META-INF/*
 !src/main/resources/META-INF/native-image/
 !src/main/resources/META-INF/native-image/**
+!src/test/resources/META-INF/
+!src/test/resources/META-INF/**
 
 # Compiled class file
 *.class
diff --git a/calm-hub/pom.xml b/calm-hub/pom.xml
index e5ec065af..e699922c1 100644
--- a/calm-hub/pom.xml
+++ b/calm-hub/pom.xml
@@ -97,6 +97,36 @@
             <artifactId>owasp-java-html-sanitizer</artifactId>
             <version>20240325.1</version>
         </dependency>
+
+        <!-- Caffeine in-memory cache -->
+        <dependency>
+            <groupId>com.github.ben-manes.caffeine</groupId>
+            <artifactId>caffeine</artifactId>
+        </dependency>
+
+        <!-- JGit for GitHub clone/pull operations -->
+        <dependency>
+            <groupId>org.eclipse.jgit</groupId>
+            <artifactId>org.eclipse.jgit</artifactId>
+            <version>7.2.0.202503040940-r</version>
+        </dependency>
+
+        <!-- Quarkus Scheduler for periodic sync -->
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-scheduler</artifactId>
+        </dependency>
+
+        <!-- OpenTelemetry + Micrometer observability -->
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-opentelemetry</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-micrometer-opentelemetry</artifactId>
+        </dependency>
+
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-oidc</artifactId>
@@ -301,6 +331,11 @@
                         <exclude>**/*ArchitectureRequest.*</exclude>
                         <exclude>**/config/**/*</exclude>
                         <exclude>**/domain/**/*</exclude>
+                        <!-- I/O-bound classes whose success paths require real infrastructure (integration test coverage) -->
+                        <exclude>**/store/github/util/GitHubRepoSync.*</exclude>
+                        <exclude>**/store/github/util/GitHubVersionService.*</exclude>
+                        <exclude>**/store/classpath/ClasspathCoreSchemaStore.*</exclude>
+                        <exclude>**/security/GitHubOAuthClient.*</exclude>
                     </excludes>
                 </configuration>
                 <executions>
diff --git a/calm-hub/src/integration-test/java/integration/ProxyAuthIntegration.java b/calm-hub/src/integration-test/java/integration/ProxyAuthIntegration.java
index 6ef1d6e1b..63a8fa8bc 100644
--- a/calm-hub/src/integration-test/java/integration/ProxyAuthIntegration.java
+++ b/calm-hub/src/integration-test/java/integration/ProxyAuthIntegration.java
@@ -303,11 +303,11 @@ void user_with_domain_read_grant_is_forbidden_from_creating_a_control() {
 
     @Test
     @Order(15)
-    void user_with_namespace_grant_only_is_forbidden_from_reading_domain_controls() {
+    void user_with_namespace_grant_can_read_domain_controls() {
         given()
                 .header(PROXY_HEADER, USER_ALICE)
                 .when().get("/calm/domains/security/controls")
                 .then()
-                .statusCode(403);
+                .statusCode(200);
     }
 }
diff --git a/calm-hub/src/main/java/org/finos/calm/cache/CaffeineCacheService.java b/calm-hub/src/main/java/org/finos/calm/cache/CaffeineCacheService.java
new file mode 100644
index 000000000..6f3c523cd
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/cache/CaffeineCacheService.java
@@ -0,0 +1,73 @@
+package org.finos.calm.cache;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import com.github.benmanes.caffeine.cache.Expiry;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.time.Duration;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+
+@ApplicationScoped
+public class CaffeineCacheService implements CalmCacheService {
+
+    private final Cache<String, CacheEntry<?>> cache;
+
+    public CaffeineCacheService() {
+        this.cache = Caffeine.newBuilder()
+                .maximumSize(10_000)
+                .expireAfter(new Expiry<String, CacheEntry<?>>() {
+                    @Override
+                    public long expireAfterCreate(String key, CacheEntry<?> value, long currentTime) {
+                        return value.ttl().toNanos();
+                    }
+
+                    @Override
+                    public long expireAfterUpdate(String key, CacheEntry<?> value, long currentTime, long currentDuration) {
+                        return value.ttl().toNanos();
+                    }
+
+                    @Override
+                    public long expireAfterRead(String key, CacheEntry<?> value, long currentTime, long currentDuration) {
+                        return currentDuration;
+                    }
+                })
+                .build();
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public <T> Optional<T> get(String key, Class<T> type) {
+        CacheEntry<?> entry = cache.getIfPresent(key);
+        if (entry == null) {
+            return Optional.empty();
+        }
+        if (!type.isInstance(entry.value())) {
+            return Optional.empty();
+        }
+        return Optional.of((T) entry.value());
+    }
+
+    @Override
+    public <T> void put(String key, T value, Duration ttl) {
+        if (value == null) {
+            return;
+        }
+        cache.put(key, new CacheEntry<>(value, ttl));
+    }
+
+    @Override
+    public void evict(String key) {
+        cache.invalidate(key);
+    }
+
+    @Override
+    public void evictByPrefix(String prefix) {
+        ConcurrentMap<String, CacheEntry<?>> map = cache.asMap();
+        map.keySet().removeIf(key -> key.startsWith(prefix));
+    }
+
+    record CacheEntry<T>(T value, Duration ttl) {}
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/cache/CalmCacheService.java b/calm-hub/src/main/java/org/finos/calm/cache/CalmCacheService.java
new file mode 100644
index 000000000..86cfd63f7
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/cache/CalmCacheService.java
@@ -0,0 +1,15 @@
+package org.finos.calm.cache;
+
+import java.time.Duration;
+import java.util.Optional;
+
+public interface CalmCacheService {
+
+    <T> Optional<T> get(String key, Class<T> type);
+
+    <T> void put(String key, T value, Duration ttl);
+
+    void evict(String key);
+
+    void evictByPrefix(String prefix);
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/config/DatabaseMode.java b/calm-hub/src/main/java/org/finos/calm/config/DatabaseMode.java
new file mode 100644
index 000000000..23d021e6b
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/config/DatabaseMode.java
@@ -0,0 +1,10 @@
+package org.finos.calm.config;
+
+public final class DatabaseMode {
+
+    public static final String MONGO = "mongo";
+    public static final String STANDALONE = "standalone";
+    public static final String GITHUB = "github";
+
+    private DatabaseMode() {}
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/ResourceType.java b/calm-hub/src/main/java/org/finos/calm/domain/ResourceType.java
index b0c4f46d5..485f53a70 100644
--- a/calm-hub/src/main/java/org/finos/calm/domain/ResourceType.java
+++ b/calm-hub/src/main/java/org/finos/calm/domain/ResourceType.java
@@ -8,5 +8,7 @@ public enum ResourceType {
     ARCHITECTURE,
     FLOW,
     STANDARD,
-    INTERFACE
+    INTERFACE,
+    BUILDING_BLOCK,
+    CONTROL
 }
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/audit/AuditEntityType.java b/calm-hub/src/main/java/org/finos/calm/domain/audit/AuditEntityType.java
index 775a564b6..a06208aa2 100644
--- a/calm-hub/src/main/java/org/finos/calm/domain/audit/AuditEntityType.java
+++ b/calm-hub/src/main/java/org/finos/calm/domain/audit/AuditEntityType.java
@@ -7,6 +7,7 @@ public enum AuditEntityType {
     NAMESPACE,
     ARCHITECTURE,
     PATTERN,
+    CONTROL,
     CONTROL_REQUIREMENT,
     CONTROL_CONFIGURATION,
     ADR,
@@ -19,5 +20,6 @@ public enum AuditEntityType {
     USER_ACCESS,
     SCHEMA,
     LAYOUT,
-    PATTERN_LAYOUT
+    PATTERN_LAYOUT,
+    BUILDING_BLOCK
 }
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockNotFoundException.java b/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockNotFoundException.java
new file mode 100644
index 000000000..98d52cba8
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockNotFoundException.java
@@ -0,0 +1,7 @@
+package org.finos.calm.domain.exception;
+
+/**
+ * Exception thrown when the specified building block is not found.
+ */
+public class BuildingBlockNotFoundException extends Exception {
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockVersionNotFoundException.java b/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockVersionNotFoundException.java
new file mode 100644
index 000000000..730ff3403
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/domain/exception/BuildingBlockVersionNotFoundException.java
@@ -0,0 +1,7 @@
+package org.finos.calm.domain.exception;
+
+/**
+ * Exception thrown when the specified building block version is not found.
+ */
+public class BuildingBlockVersionNotFoundException extends Exception {
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/exception/GitHubWriteNotSupportedException.java b/calm-hub/src/main/java/org/finos/calm/domain/exception/GitHubWriteNotSupportedException.java
new file mode 100644
index 000000000..6bd1958b5
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/domain/exception/GitHubWriteNotSupportedException.java
@@ -0,0 +1,8 @@
+package org.finos.calm.domain.exception;
+
+public class GitHubWriteNotSupportedException extends UnsupportedOperationException {
+
+    public GitHubWriteNotSupportedException(String message) {
+        super(message);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/domain/exception/PendingWriteException.java b/calm-hub/src/main/java/org/finos/calm/domain/exception/PendingWriteException.java
new file mode 100644
index 000000000..cddd92207
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/domain/exception/PendingWriteException.java
@@ -0,0 +1,32 @@
+package org.finos.calm.domain.exception;
+
+/**
+ * Thrown by GitHub stores when a write operation successfully creates a PR.
+ * The resource layer catches this and returns 202 Accepted with the PR URL.
+ * This is NOT an error — it signals that the write was accepted asynchronously.
+ */
+public class PendingWriteException extends Exception {
+
+    private final String pullRequestUrl;
+    private final int pullRequestNumber;
+    private final String branch;
+
+    public PendingWriteException(String pullRequestUrl, int pullRequestNumber, String branch) {
+        super("Change submitted as PR #" + pullRequestNumber);
+        this.pullRequestUrl = pullRequestUrl;
+        this.pullRequestNumber = pullRequestNumber;
+        this.branch = branch;
+    }
+
+    public String getPullRequestUrl() {
+        return pullRequestUrl;
+    }
+
+    public int getPullRequestNumber() {
+        return pullRequestNumber;
+    }
+
+    public String getBranch() {
+        return branch;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/migration/steps/NamespaceAccessBackfillStep.java b/calm-hub/src/main/java/org/finos/calm/migration/steps/NamespaceAccessBackfillStep.java
index 83282c569..9eb41ce64 100644
--- a/calm-hub/src/main/java/org/finos/calm/migration/steps/NamespaceAccessBackfillStep.java
+++ b/calm-hub/src/main/java/org/finos/calm/migration/steps/NamespaceAccessBackfillStep.java
@@ -1,5 +1,6 @@
 package org.finos.calm.migration.steps;
 
+import io.quarkus.arc.lookup.LookupUnlessProperty;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import org.finos.calm.domain.UserAccess;
@@ -26,6 +27,7 @@
  * Uses the CDI-produced {@link NamespaceStore} and {@link UserAccessStore} interfaces
  * so it works for both MongoDB and Nitrite backends without duplication.
  */
+@LookupUnlessProperty(name = "calm.database.mode", stringValue = "github")
 @ApplicationScoped
 public class NamespaceAccessBackfillStep implements SchemaMigrationStep {
 
diff --git a/calm-hub/src/main/java/org/finos/calm/observability/GitHubMetrics.java b/calm-hub/src/main/java/org/finos/calm/observability/GitHubMetrics.java
new file mode 100644
index 000000000..d95fcbcfa
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/observability/GitHubMetrics.java
@@ -0,0 +1,65 @@
+package org.finos.calm.observability;
+
+import io.micrometer.core.instrument.Counter;
+import io.micrometer.core.instrument.MeterRegistry;
+import io.micrometer.core.instrument.Timer;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import java.time.Duration;
+import java.util.concurrent.atomic.AtomicLong;
+
+@ApplicationScoped
+public class GitHubMetrics {
+
+    private final Counter syncSuccessCounter;
+    private final Counter syncFailureCounter;
+    private final Timer syncDurationTimer;
+    private final Timer registryRebuildTimer;
+    private final AtomicLong lastSyncSuccessEpoch = new AtomicLong(0);
+
+    @Inject
+    public GitHubMetrics(MeterRegistry registry) {
+        this.syncSuccessCounter = Counter.builder("calm.github.sync")
+                .tag("outcome", "success")
+                .description("Number of successful GitHub sync operations")
+                .register(registry);
+
+        this.syncFailureCounter = Counter.builder("calm.github.sync")
+                .tag("outcome", "failure")
+                .description("Number of failed GitHub sync operations")
+                .register(registry);
+
+        this.syncDurationTimer = Timer.builder("calm.github.sync.duration")
+                .description("Duration of GitHub sync operations")
+                .register(registry);
+
+        this.registryRebuildTimer = Timer.builder("calm.github.registry.rebuild.duration")
+                .description("Duration of in-memory registry rebuilds")
+                .register(registry);
+
+        registry.gauge("calm.github.sync.last_success_epoch_seconds", lastSyncSuccessEpoch);
+    }
+
+    public void recordSyncSuccess(Duration duration) {
+        syncSuccessCounter.increment();
+        syncDurationTimer.record(duration);
+        lastSyncSuccessEpoch.set(System.currentTimeMillis() / 1000);
+    }
+
+    public void recordSyncFailure(Duration duration) {
+        syncFailureCounter.increment();
+        syncDurationTimer.record(duration);
+    }
+
+    public void recordRegistryRebuild(Duration duration) {
+        registryRebuildTimer.record(duration);
+    }
+
+    public Counter contentDetectedCounter(MeterRegistry registry, String type) {
+        return Counter.builder("calm.github.content.detected")
+                .tag("type", type)
+                .description("Number of CALM documents detected by type")
+                .register(registry);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/ArchitectureResource.java b/calm-hub/src/main/java/org/finos/calm/resources/ArchitectureResource.java
index 2a9a41855..8c0e8bc7d 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/ArchitectureResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/ArchitectureResource.java
@@ -44,6 +44,7 @@
 import static org.finos.calm.resources.ResourceValidationConstants.NAMESPACE_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.STRICT_SANITIZATION_POLICY;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_MESSAGE;
+import static org.finos.calm.resources.ResourceValidationConstants.VERSION_OR_SHA_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_REGEX;
 
 
@@ -174,7 +175,7 @@ public Response getArchitectureVersions(
     public Response getArchitecture(
             @PathParam("namespace") @Pattern(regexp = NAMESPACE_REGEX, message = NAMESPACE_MESSAGE) String namespace,
             @PathParam("architectureId") int architectureId,
-            @PathParam("version") @Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE) String version) {
+            @PathParam("version") @Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_MESSAGE) String version) {
         Architecture architecture = new Architecture.ArchitectureBuilder()
                 .setNamespace(namespace)
                 .setId(architectureId)
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java b/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java
new file mode 100644
index 000000000..a7b9cb743
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/AuthConfigResource.java
@@ -0,0 +1,68 @@
+package org.finos.calm.resources;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * Serves OIDC configuration to the frontend at startup.
+ * This endpoint is unauthenticated — it must be reachable before the user logs in
+ * so the frontend knows which OIDC library to load and where to redirect.
+ */
+@Path("/api/calm/auth")
+@Produces(MediaType.APPLICATION_JSON)
+public class AuthConfigResource {
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.tenant-enabled", defaultValue = "false")
+    boolean oidcTenantEnabled;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.provider", defaultValue = "generic-oidc")
+    Optional<String> oidcProvider;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "")
+    Optional<String> oidcAuthority;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "")
+    Optional<String> oidcClientId;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.scopes", defaultValue = "openid profile email")
+    Optional<String> oidcScopes;
+
+    @Inject
+    @ConfigProperty(name = "calm.database.mode", defaultValue = "mongo")
+    String databaseMode;
+
+    @GET
+    @Path("/config")
+    public Response getAuthConfig() {
+        Map<String, Object> response = new HashMap<>();
+
+        Map<String, Object> oidc = new HashMap<>();
+        oidc.put("enabled", oidcTenantEnabled);
+        if (oidcTenantEnabled) {
+            oidc.put("provider", oidcProvider.orElse("generic-oidc"));
+            oidc.put("authority", oidcAuthority.orElse(""));
+            oidc.put("clientId", oidcClientId.orElse(""));
+            oidc.put("scopes", oidcScopes.orElse("openid profile email").split(" "));
+            oidc.put("redirectUri", "/");
+        }
+        response.put("oidc", oidc);
+
+        response.put("databaseMode", databaseMode);
+
+        return Response.ok(response).build();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/CalmDocumentParser.java b/calm-hub/src/main/java/org/finos/calm/resources/CalmDocumentParser.java
index 6ae0d2bcd..893991e98 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/CalmDocumentParser.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/CalmDocumentParser.java
@@ -28,21 +28,25 @@ public class CalmDocumentParser {
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
 
     /** Maps the plural URL path segment (e.g. {@code "patterns"}) to {@link ResourceType}. */
-    public static final Map<String, ResourceType> TYPE_MAP = Map.of(
-            "patterns",      ResourceType.PATTERN,
-            "architectures", ResourceType.ARCHITECTURE,
-            "flows",         ResourceType.FLOW,
-            "standards",     ResourceType.STANDARD,
-            "interfaces",    ResourceType.INTERFACE
+    public static final Map<String, ResourceType> TYPE_MAP = Map.ofEntries(
+            Map.entry("patterns",        ResourceType.PATTERN),
+            Map.entry("architectures",   ResourceType.ARCHITECTURE),
+            Map.entry("flows",           ResourceType.FLOW),
+            Map.entry("standards",       ResourceType.STANDARD),
+            Map.entry("interfaces",      ResourceType.INTERFACE),
+            Map.entry("building-blocks", ResourceType.BUILDING_BLOCK),
+            Map.entry("controls",        ResourceType.CONTROL)
     );
 
     /** Maps {@link ResourceType} back to its plural URL segment. */
-    public static final Map<ResourceType, String> TYPE_PLURAL_MAP = Map.of(
-            ResourceType.PATTERN,      "patterns",
-            ResourceType.ARCHITECTURE, "architectures",
-            ResourceType.FLOW,         "flows",
-            ResourceType.STANDARD,     "standards",
-            ResourceType.INTERFACE,    "interfaces"
+    public static final Map<ResourceType, String> TYPE_PLURAL_MAP = Map.ofEntries(
+            Map.entry(ResourceType.PATTERN,        "patterns"),
+            Map.entry(ResourceType.ARCHITECTURE,   "architectures"),
+            Map.entry(ResourceType.FLOW,           "flows"),
+            Map.entry(ResourceType.STANDARD,       "standards"),
+            Map.entry(ResourceType.INTERFACE,      "interfaces"),
+            Map.entry(ResourceType.BUILDING_BLOCK, "building-blocks"),
+            Map.entry(ResourceType.CONTROL,        "controls")
     );
 
     @ConfigProperty(name = "calm.hub.base-url", defaultValue = "http://localhost:8080")
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/ControlResource.java b/calm-hub/src/main/java/org/finos/calm/resources/ControlResource.java
index 60f58304c..28dacf18d 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/ControlResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/ControlResource.java
@@ -1,5 +1,6 @@
 package org.finos.calm.resources;
 
+import io.quarkus.security.Authenticated;
 import io.quarkus.security.PermissionsAllowed;
 import jakarta.inject.Inject;
 import jakarta.validation.Valid;
@@ -30,6 +31,7 @@
  */
 @Tag(name = "Storage API", description = "Numeric-ID based CALM storage endpoints")
 @Path("/api/calm/domains")
+@Authenticated
 public class ControlResource {
 
     private final ControlStore store;
@@ -122,7 +124,7 @@ public Response getRequirementForVersion(
             String domain,
             @PathParam("controlId") int controlId,
             @PathParam("version")
-            @Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE)
+            @Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_OR_SHA_MESSAGE)
             String version) {
         try {
             return Response.ok(store.getRequirementForVersion(domain, controlId, version)).build();
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/FlowResource.java b/calm-hub/src/main/java/org/finos/calm/resources/FlowResource.java
index 0db651ebb..586d3d087 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/FlowResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/FlowResource.java
@@ -35,6 +35,7 @@
 import static org.finos.calm.resources.ResourceValidationConstants.NAMESPACE_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.STRICT_SANITIZATION_POLICY;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_MESSAGE;
+import static org.finos.calm.resources.ResourceValidationConstants.VERSION_OR_SHA_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_REGEX;
 
 @Tag(name = "Storage API", description = "Numeric-ID based CALM storage endpoints")
@@ -172,7 +173,7 @@ public Response getFlowVersions(
     public Response getFlow(
             @PathParam("namespace") @Pattern(regexp= NAMESPACE_REGEX, message = NAMESPACE_MESSAGE) String namespace,
             @PathParam("flowId") int flowId,
-            @PathParam("version") @Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE) String version
+            @PathParam("version") @Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_MESSAGE) String version
     ) {
         return getFlowInternal(namespace, flowId, version);
     }
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/MappingControllerResource.java b/calm-hub/src/main/java/org/finos/calm/resources/MappingControllerResource.java
index 1f1fa6317..7f2a4ad0c 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/MappingControllerResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/MappingControllerResource.java
@@ -266,7 +266,7 @@ private Response handlePost(String namespace, String type, String name, String p
         if (resourceType == null) {
             return Response.status(Response.Status.BAD_REQUEST)
                     .entity("Unsupported resource type: " + STRICT_SANITIZATION_POLICY.sanitize(type)
-                            + ". Supported: patterns, architectures, flows, standards, interfaces").build();
+                            + ". Supported: patterns, architectures, flows, standards, interfaces, building-blocks").build();
         }
         if ("versions".equals(name)) {
             return Response.status(Response.Status.BAD_REQUEST)
@@ -314,9 +314,15 @@ public Response listResourceVersions(
         try {
             ResourceMapping mapping = service.getMapping(namespace, resourceType, name);
             List<String> versions = service.getVersionsForMapping(mapping);
-            List<String> sortedVersions = versions.stream()
-                    .sorted(Comparator.comparing(Semver::tryParse))
-                    .toList();
+            boolean hasShas = versions.stream().anyMatch(v -> v.matches("[0-9a-f]{7,40}"));
+            List<String> sortedVersions;
+            if (hasShas) {
+                sortedVersions = versions;
+            } else {
+                sortedVersions = versions.stream()
+                        .sorted(Comparator.comparing(Semver::tryParse))
+                        .toList();
+            }
             return Response.ok(new ValueWrapper<>(sortedVersions)).build();
         } catch (MappingNotFoundException e) {
             return Response.status(Response.Status.NOT_FOUND)
@@ -345,7 +351,7 @@ public Response listResourceVersions(
     @Produces(MediaType.APPLICATION_JSON)
     @Operation(
             summary = "Get a specific version of a named resource",
-            description = "Returns the resource at the specified semver version. " +
+            description = "Returns the resource at the specified version (semver, git SHA, or 'latest'). " +
                     "The \"$id\" in the returned document is rewritten to the versioned canonical URL."
     )
     @PermissionsAllowed(CalmHubScopes.READ)
@@ -353,7 +359,7 @@ public Response getResourceVersion(
             @PathParam("namespace") @Pattern(regexp = NAMESPACE_REGEX, message = NAMESPACE_MESSAGE) String namespace,
             @PathParam("type") String type,
             @PathParam("name") @Pattern(regexp = CUSTOM_ID_REGEX, message = CUSTOM_ID_MESSAGE) String name,
-            @PathParam("version") @Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE) String version
+            @PathParam("version") @Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_OR_SHA_MESSAGE) String version
     ) {
         ResourceType resourceType = documentParser.parseTypePlural(type);
         if (resourceType == null) {
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java b/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
index 646ea1d9f..6c3360516 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/NamespaceResource.java
@@ -25,17 +25,20 @@
 import org.finos.calm.domain.exception.NamespaceParentNotFoundException;
 import org.finos.calm.domain.namespaces.NamespaceCounts;
 import org.finos.calm.domain.namespaces.NamespaceInfo;
+import org.finos.calm.domain.UserAccess;
 import org.finos.calm.security.AuditRequestFilter;
 import org.finos.calm.security.CalmHubPermissionChecker;
 import org.finos.calm.security.CalmHubScopes;
 import org.finos.calm.security.UserAccessValidator;
 import org.finos.calm.services.CountsService;
 import org.finos.calm.services.NamespaceService;
+import org.finos.calm.store.UserAccessStore;
 
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Optional;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import static org.finos.calm.resources.CalmResourceErrorResponses.invalidNamespaceResponse;
 import static org.finos.calm.resources.CalmResourceErrorResponses.namespaceNotEmptyResponse;
@@ -56,6 +59,9 @@ public class NamespaceResource {
     @Inject
     CalmHubPermissionChecker permissionChecker;
 
+    @Inject
+    UserAccessStore userAccessStore;
+
     @Inject
     @ConfigProperty(name = "calm.auth.enabled", defaultValue = "false")
     boolean authEnabled;
@@ -76,7 +82,13 @@ public NamespaceResource(NamespaceService namespaceService,
     )
     @Authenticated
     public ValueWrapper<NamespaceInfo> namespaces() {
-        return new ValueWrapper<>(namespaceService.getNamespaces());
+        Optional<Set<String>> readable = resolveReadableNamespaces();
+        if (readable.isEmpty()) {
+            return new ValueWrapper<>(namespaceService.getNamespaces());
+        }
+        return new ValueWrapper<>(namespaceService.getNamespaces().stream()
+                .filter(ns -> readable.get().contains(ns.getName()))
+                .toList());
     }
 
     @GET
@@ -97,8 +109,23 @@ public ValueWrapper<NamespaceCounts> namespaceCounts() {
     }
 
     private Optional<Set<String>> resolveReadableNamespaces() {
-        return ReadableScope.resolve(authEnabled, userAccessValidatorInstance, identity,
-                UserAccessValidator::getReadableNamespaces);
+        if (!authEnabled) {
+            return Optional.empty();
+        }
+        if (userAccessValidatorInstance.isResolvable()) {
+            return ReadableScope.resolve(authEnabled, userAccessValidatorInstance, identity,
+                    UserAccessValidator::getReadableNamespaces);
+        }
+        // Fallback: derive readable set from UserAccessStore grants (GitHub/OIDC mode)
+        if (identity.isAnonymous() || identity.getPrincipal() == null || userAccessStore == null) {
+            return Optional.empty();
+        }
+        String username = identity.getPrincipal().getName();
+        Set<String> readable = userAccessStore.getGrantsForUser(username).stream()
+                .map(UserAccess::getNamespace)
+                .filter(ns -> ns != null)
+                .collect(Collectors.toSet());
+        return Optional.of(readable);
     }
 
     @POST
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/PatternResource.java b/calm-hub/src/main/java/org/finos/calm/resources/PatternResource.java
index deafc0903..6fea478c6 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/PatternResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/PatternResource.java
@@ -33,6 +33,7 @@
 import static org.finos.calm.resources.ResourceValidationConstants.NAMESPACE_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.STRICT_SANITIZATION_POLICY;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_MESSAGE;
+import static org.finos.calm.resources.ResourceValidationConstants.VERSION_OR_SHA_REGEX;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_REGEX;
 
 @Tag(name = "Storage API", description = "Numeric-ID based CALM storage endpoints")
@@ -142,7 +143,7 @@ public Response getPatternVersions(
     public Response getPattern(
             @PathParam("namespace") @jakarta.validation.constraints.Pattern(regexp = NAMESPACE_REGEX, message = NAMESPACE_MESSAGE) String namespace,
             @PathParam("patternId") int patternId,
-            @PathParam("version") @jakarta.validation.constraints.Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE) String version
+            @PathParam("version") @jakarta.validation.constraints.Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_MESSAGE) String version
     ) {
         Pattern pattern = new Pattern.PatternBuilder()
                 .setNamespace(namespace)
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/PendingWriteExceptionMapper.java b/calm-hub/src/main/java/org/finos/calm/resources/PendingWriteExceptionMapper.java
new file mode 100644
index 000000000..8f7b00174
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/PendingWriteExceptionMapper.java
@@ -0,0 +1,28 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import jakarta.ws.rs.ext.Provider;
+import org.finos.calm.domain.exception.PendingWriteException;
+
+import java.util.Map;
+
+/**
+ * Maps PendingWriteException to 202 Accepted with PR details.
+ * This is thrown by GitHub stores when a write successfully creates a PR —
+ * it's not an error, it's the expected outcome in fork-based write mode.
+ */
+@Provider
+public class PendingWriteExceptionMapper implements ExceptionMapper<PendingWriteException> {
+
+    @Override
+    public Response toResponse(PendingWriteException e) {
+        return Response.accepted(Map.of(
+                "status", "pending",
+                "pullRequestUrl", e.getPullRequestUrl(),
+                "pullRequestNumber", e.getPullRequestNumber(),
+                "message", e.getMessage()
+        )).type(MediaType.APPLICATION_JSON).build();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java b/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java
new file mode 100644
index 000000000..d79ec7762
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/PluginAuthResource.java
@@ -0,0 +1,231 @@
+package org.finos.calm.resources;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.security.OidcPluginAuthClient;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.URI;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Handles OIDC authentication on behalf of the VS Code plugin.
+ * The plugin opens the /plugin-login URL in a browser; the Hub performs the
+ * full OIDC authorization code flow and redirects back to the plugin's
+ * localhost with the access token.
+ *
+ * Both endpoints are public (no auth required) — the user has not yet
+ * authenticated when they hit plugin-login, and plugin-callback receives
+ * the IdP redirect.
+ */
+@Path("/api/calm/auth")
+@Produces(MediaType.APPLICATION_JSON)
+public class PluginAuthResource {
+
+    private static final Logger LOG = LoggerFactory.getLogger(PluginAuthResource.class);
+    private static final String DEFAULT_REDIRECT_PATH = "/callback";
+
+    private final Map<String, PendingSession> pendingSessions = new ConcurrentHashMap<>();
+
+    @Inject
+    OidcPluginAuthClient oidcClient;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.auth-server-url", defaultValue = "")
+    Optional<String> oidcAuthority;
+
+    @Inject
+    @ConfigProperty(name = "quarkus.oidc.client-id", defaultValue = "")
+    Optional<String> oidcClientId;
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.scopes", defaultValue = "openid profile email")
+    String oidcScopes;
+
+    @Inject
+    @ConfigProperty(name = "calm.hub.base-url", defaultValue = "http://localhost:8080")
+    String hubBaseUrl;
+
+    record PendingSession(String port, String redirectPath, String codeVerifier, String nonce) {}
+
+    @GET
+    @Path("plugin-login")
+    public Response pluginLogin(@QueryParam("port") String port,
+                                @QueryParam("redirect_path") String redirectPath,
+                                @QueryParam("nonce") String nonce) {
+        if (port == null || port.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "port parameter is required"))
+                    .build();
+        }
+
+        if (!isValidPort(port)) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "port must be a valid number between 1 and 65535"))
+                    .build();
+        }
+
+        if (oidcAuthority.isEmpty() || oidcAuthority.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC is not configured"))
+                    .build();
+        }
+
+        if (oidcClientId.isEmpty() || oidcClientId.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC client-id is not configured"))
+                    .build();
+        }
+
+        OidcPluginAuthClient.OidcEndpoints endpoints = oidcClient.discoverEndpoints(oidcAuthority.get());
+        if (endpoints == null) {
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Failed to discover OIDC endpoints"))
+                    .build();
+        }
+
+        byte[] verifierBytes = new byte[32];
+        new java.security.SecureRandom().nextBytes(verifierBytes);
+        String codeVerifier = java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(verifierBytes);
+        String codeChallenge;
+        try {
+            byte[] digest = java.security.MessageDigest.getInstance("SHA-256").digest(codeVerifier.getBytes(StandardCharsets.UTF_8));
+            codeChallenge = java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
+        } catch (java.security.NoSuchAlgorithmException e) {
+            return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                    .entity(Map.of("error", "SHA-256 not available")).build();
+        }
+
+        String state = UUID.randomUUID().toString();
+        String effectiveRedirectPath = (redirectPath != null && !redirectPath.isBlank())
+                ? redirectPath : DEFAULT_REDIRECT_PATH;
+        pendingSessions.put(state, new PendingSession(port, effectiveRedirectPath, codeVerifier, nonce));
+
+        String hubCallbackUrl = hubBaseUrl + "/api/calm/auth/plugin-callback";
+
+        String authorizeUrl = endpoints.authorizationEndpoint()
+                + "?client_id=" + encode(oidcClientId.get())
+                + "&response_type=code"
+                + "&scope=" + encode(oidcScopes)
+                + "&redirect_uri=" + encode(hubCallbackUrl)
+                + "&state=" + encode(state)
+                + "&code_challenge=" + encode(codeChallenge)
+                + "&code_challenge_method=S256";
+
+        LOG.debug("Redirecting plugin auth to OIDC authorize endpoint for port {}", port);
+
+        return Response.temporaryRedirect(URI.create(authorizeUrl)).build();
+    }
+
+    @GET
+    @Path("plugin-callback")
+    public Response pluginCallback(@QueryParam("code") String code,
+                                   @QueryParam("state") String state,
+                                   @QueryParam("error") String error) {
+        if (error != null && !error.isBlank()) {
+            LOG.warn("OIDC IdP returned error: {}", error);
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Authentication failed at identity provider"))
+                    .build();
+        }
+
+        if (code == null || code.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "Missing authorization code"))
+                    .build();
+        }
+
+        if (state == null || state.isBlank()) {
+            return Response.status(Response.Status.BAD_REQUEST)
+                    .entity(Map.of("error", "Missing state parameter"))
+                    .build();
+        }
+
+        PendingSession session = pendingSessions.remove(state);
+        if (session == null) {
+            LOG.warn("Invalid or expired state parameter in plugin callback");
+            return Response.status(Response.Status.FORBIDDEN)
+                    .entity(Map.of("error", "Invalid or expired state"))
+                    .build();
+        }
+
+        if (oidcAuthority.isEmpty() || oidcAuthority.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC is not configured"))
+                    .build();
+        }
+
+        if (oidcClientId.isEmpty() || oidcClientId.get().isBlank()) {
+            return Response.status(Response.Status.SERVICE_UNAVAILABLE)
+                    .entity(Map.of("error", "OIDC client-id is not configured"))
+                    .build();
+        }
+
+        OidcPluginAuthClient.OidcEndpoints endpoints = oidcClient.discoverEndpoints(oidcAuthority.get());
+        if (endpoints == null) {
+            return Response.status(Response.Status.BAD_GATEWAY)
+                    .entity(Map.of("error", "Failed to discover OIDC endpoints"))
+                    .build();
+        }
+
+        String hubCallbackUrl = hubBaseUrl + "/api/calm/auth/plugin-callback";
+        String pluginRedirect = "http://localhost:" + session.port() + session.redirectPath();
+        String nonceParam = session.nonce() != null ? "&nonce=" + encode(session.nonce()) : "";
+
+        String html = "<!DOCTYPE html><html><body><h2>Signing in...</h2><script>"
+                + "(async()=>{"
+                + "try{"
+                + "const body=new URLSearchParams({"
+                + "grant_type:'authorization_code',"
+                + "client_id:'" + oidcClientId.get() + "',"
+                + "code:'" + code + "',"
+                + "redirect_uri:'" + hubCallbackUrl + "',"
+                + "code_verifier:'" + session.codeVerifier() + "'"
+                + "});"
+                + "const res=await fetch('" + endpoints.tokenEndpoint() + "',{"
+                + "method:'POST',"
+                + "headers:{'Content-Type':'application/x-www-form-urlencoded'},"
+                + "body:body.toString()"
+                + "});"
+                + "if(!res.ok){const e=await res.text();document.body.innerHTML='<h2>Token exchange failed</h2><p>'+e+'</p>';return;}"
+                + "const data=await res.json();"
+                + "const token=data.id_token||data.access_token;"
+                + "if(token){window.location.href='" + pluginRedirect + "?token='+encodeURIComponent(token)+'" + nonceParam + "';}"
+                + "else{document.body.innerHTML='<h2>No token received</h2>';}"
+                + "}catch(e){document.body.innerHTML='<h2>Error</h2><p>'+e.message+'</p>';}"
+                + "})();"
+                + "</script></body></html>";
+
+        return Response.ok(html).type("text/html").build();
+    }
+
+    // Visible for testing
+    Map<String, PendingSession> getPendingSessions() {
+        return pendingSessions;
+    }
+
+    private boolean isValidPort(String port) {
+        try {
+            int portNum = Integer.parseInt(port);
+            return portNum >= 1 && portNum <= 65535;
+        } catch (NumberFormatException e) {
+            return false;
+        }
+    }
+
+    private String encode(String value) {
+        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/ResourceValidationConstants.java b/calm-hub/src/main/java/org/finos/calm/resources/ResourceValidationConstants.java
index f71ac9ece..60f861132 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/ResourceValidationConstants.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/ResourceValidationConstants.java
@@ -12,10 +12,12 @@ public class ResourceValidationConstants {
     public static final String DOMAIN_REGEX = "^[A-Za-z0-9-]+$";
     public static final String DOMAIN_MESSAGE = "domain name must match pattern '^[A-Za-z0-9-]+$'";
     public static final String VERSION_REGEX = "^(0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)$";
+    public static final String VERSION_OR_SHA_REGEX = "^((0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)|[0-9a-f]{7,40}|latest)$";
     public static final String VERSION_MESSAGE = "version must match pattern '^(0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)[-.]?(0|[1-9][0-9]*)$'";
+    public static final String VERSION_OR_SHA_MESSAGE = "version must be semver (e.g. 1.0.0), a hex SHA (7-40 chars), or 'latest'";
     // First character must be a letter so slugs are never purely numeric (avoids clash with legacy numeric IDs).
-    public static final String CUSTOM_ID_REGEX = "^[a-z][a-z0-9]*(-[a-z0-9]+)*$";
-    public static final String CUSTOM_ID_MESSAGE = "customId must match pattern '^[a-z][a-z0-9]*(-[a-z0-9]+)*$'";
+    public static final String CUSTOM_ID_REGEX = "^[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$";
+    public static final String CUSTOM_ID_MESSAGE = "customId must match pattern '^[a-zA-Z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$'";
     public static final String QUERY_PARAM_NO_WHITESPACE_REGEX = "^[A-Za-z0-9_/.-]+$";
     public static final String QUERY_PARAM_NO_WHITESPACE_MESSAGE = "Query parameter must match pattern '^[A-Za-z0-9_/.-]+$'";
     public static final String LIMIT_MESSAGE = "limit must be greater than or equal to 1";
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/StandardResource.java b/calm-hub/src/main/java/org/finos/calm/resources/StandardResource.java
index 5f79eb610..f9eb54ecf 100644
--- a/calm-hub/src/main/java/org/finos/calm/resources/StandardResource.java
+++ b/calm-hub/src/main/java/org/finos/calm/resources/StandardResource.java
@@ -102,7 +102,7 @@ public Response getStandardVersions(
     public Response getStandardForVersion(
             @PathParam("namespace") @Pattern(regexp = NAMESPACE_REGEX, message = NAMESPACE_MESSAGE) String namespace,
             @PathParam("standardId") Integer standardId,
-            @PathParam("version") @Pattern(regexp = VERSION_REGEX, message = VERSION_MESSAGE) String version
+            @PathParam("version") @Pattern(regexp = VERSION_OR_SHA_REGEX, message = VERSION_MESSAGE) String version
     ) {
         try {
             return Response.ok(standardStore.getStandardForVersion(namespace, standardId, version)).build();
diff --git a/calm-hub/src/main/java/org/finos/calm/resources/UnsupportedOperationExceptionMapper.java b/calm-hub/src/main/java/org/finos/calm/resources/UnsupportedOperationExceptionMapper.java
new file mode 100644
index 000000000..87e37a00d
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/resources/UnsupportedOperationExceptionMapper.java
@@ -0,0 +1,21 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import jakarta.ws.rs.ext.Provider;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import java.util.Map;
+
+@Provider
+public class UnsupportedOperationExceptionMapper implements ExceptionMapper<GitHubWriteNotSupportedException> {
+
+    @Override
+    public Response toResponse(GitHubWriteNotSupportedException e) {
+        return Response.status(501)
+                .entity(Map.of("error", e.getMessage()))
+                .type(MediaType.APPLICATION_JSON)
+                .build();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java b/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
index 954a1005f..a4d805c5a 100644
--- a/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
+++ b/calm-hub/src/main/java/org/finos/calm/security/CalmHubPermissionChecker.java
@@ -1,8 +1,10 @@
 package org.finos.calm.security;
 
+import io.quarkus.runtime.StartupEvent;
 import io.quarkus.security.PermissionChecker;
 import io.quarkus.security.identity.SecurityIdentity;
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 import org.finos.calm.domain.UserAccess;
@@ -32,6 +34,9 @@ public class CalmHubPermissionChecker {
 
     public CalmHubPermissionChecker(UserAccessStore userAccessStore) {
         this.userAccessStore = userAccessStore;
+    }
+
+    void onStartup(@Observes StartupEvent event) {
         if (!authEnabled) {
             logger.warn("Caution: CalmHub is starting with authentication disabled. All user access will be granted by default.");
         }
@@ -70,7 +75,15 @@ public boolean canRead(SecurityIdentity identity, String namespace) {
     public boolean canReadByDomain(SecurityIdentity identity, String domain) {
         return isAuthDisabled()
                 || isAllowPublicRead()
-                || hasDomainAccess(identity, domain, UserAction.READ);
+                || hasDomainAccess(identity, domain, UserAction.READ)
+                || hasAnyNamespaceAccess(identity, UserAction.READ);
+    }
+
+    private boolean hasAnyNamespaceAccess(SecurityIdentity identity, UserAction action) {
+        String username = identity.getPrincipal().getName();
+        List<UserAccess> grants = userAccessStore.getGrantsForUser(username);
+        return grants.stream().anyMatch(g ->
+                g.getNamespace() != null && permissionSufficient(g, action));
     }
 
     @PermissionChecker(CalmHubScopes.WRITE)
diff --git a/calm-hub/src/main/java/org/finos/calm/security/LocationSegmentParser.java b/calm-hub/src/main/java/org/finos/calm/security/LocationSegmentParser.java
index c24b9ce1e..93b35fa9a 100644
--- a/calm-hub/src/main/java/org/finos/calm/security/LocationSegmentParser.java
+++ b/calm-hub/src/main/java/org/finos/calm/security/LocationSegmentParser.java
@@ -40,7 +40,7 @@ static LocationIds parse(AuditEntityType entityType, String locationPath) {
             // .../schemas/{version}/meta
             case SCHEMA -> new LocationIds(segmentBefore(segments, "meta"), null);
             // .../{plural}/{id}/versions/{version}
-            case ARCHITECTURE, PATTERN, FLOW, INTERFACE, STANDARD, TIMELINE ->
+            case ARCHITECTURE, PATTERN, FLOW, INTERFACE, STANDARD, TIMELINE, BUILDING_BLOCK, CONTROL ->
                     new LocationIds(segmentBefore(segments, "versions"), segmentAfter(segments, "versions"));
             // .../adrs/{id}/revisions/{revision}
             case ADR -> new LocationIds(segmentBefore(segments, "revisions"), segmentAfter(segments, "revisions"));
diff --git a/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java b/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java
new file mode 100644
index 000000000..2c2c97e21
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/security/OidcPluginAuthClient.java
@@ -0,0 +1,155 @@
+package org.finos.calm.security;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.ProxySelector;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.time.Duration;
+import java.util.Optional;
+
+/**
+ * Encapsulates OIDC HTTP operations for the plugin authentication flow.
+ * Handles discovery document fetching, authorize URL construction, and
+ * authorization code exchange. Injectable seam for unit testing
+ * PluginAuthResource without real HTTP calls.
+ */
+@ApplicationScoped
+public class OidcPluginAuthClient {
+
+    private static final Logger LOG = LoggerFactory.getLogger(OidcPluginAuthClient.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    @Inject
+    @ConfigProperty(name = "calm.github.http.connect-timeout", defaultValue = "10")
+    int connectTimeoutSeconds;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.http.request-timeout", defaultValue = "30")
+    int requestTimeoutSeconds;
+
+    public record OidcEndpoints(String authorizationEndpoint, String tokenEndpoint) {}
+
+    public record TokenResponse(String accessToken, String idToken, String error) {}
+
+    /**
+     * Fetches the OIDC discovery document and extracts authorization_endpoint and token_endpoint.
+     *
+     * @param issuerUrl the OIDC issuer URL (auth-server-url)
+     * @return discovered endpoints, or null if discovery fails
+     */
+    public OidcEndpoints discoverEndpoints(String issuerUrl) {
+        try {
+            String discoveryUrl = issuerUrl.endsWith("/")
+                    ? issuerUrl + ".well-known/openid-configuration"
+                    : issuerUrl + "/.well-known/openid-configuration";
+
+            HttpClient client = HttpClient.newBuilder()
+                    .proxy(ProxySelector.getDefault())
+                    .connectTimeout(Duration.ofSeconds(connectTimeoutSeconds))
+                    .build();
+
+            HttpRequest request = HttpRequest.newBuilder()
+                    .uri(URI.create(discoveryUrl))
+                    .timeout(Duration.ofSeconds(requestTimeoutSeconds))
+                    .header("Accept", "application/json")
+                    .GET()
+                    .build();
+
+            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
+
+            if (response.statusCode() != 200) {
+                LOG.error("OIDC discovery failed with status {}: {}", response.statusCode(), response.body());
+                return null;
+            }
+
+            JsonNode doc = MAPPER.readTree(response.body());
+            String authEndpoint = extractTextField(doc, "authorization_endpoint");
+            String tokenEndpoint = extractTextField(doc, "token_endpoint");
+
+            if (authEndpoint == null || tokenEndpoint == null) {
+                LOG.error("OIDC discovery document missing required endpoints");
+                return null;
+            }
+
+            return new OidcEndpoints(authEndpoint, tokenEndpoint);
+        } catch (Exception e) {
+            LOG.error("OIDC discovery exception for issuer {}: {}", issuerUrl, e.getMessage());
+            return null;
+        }
+    }
+
+    /**
+     * Exchanges an authorization code for tokens at the OIDC token endpoint.
+     *
+     * @param tokenEndpoint the token endpoint URL
+     * @param clientId      the OIDC client ID
+     * @param clientSecret  the OIDC client secret
+     * @param code          the authorization code
+     * @param redirectUri   the redirect URI used in the authorize request
+     * @param codeVerifier  the PKCE code verifier (nullable for non-PKCE flows)
+     * @return token response containing the access token or an error
+     */
+    public TokenResponse exchangeCode(String tokenEndpoint, String clientId, String clientSecret,
+                                      String code, String redirectUri, String codeVerifier) {
+        try {
+            String body = "grant_type=authorization_code"
+                    + "&client_id=" + clientId
+                    + "&code=" + code
+                    + "&redirect_uri=" + redirectUri;
+            if (clientSecret != null && !clientSecret.isBlank()) {
+                body += "&client_secret=" + clientSecret;
+            }
+            if (codeVerifier != null && !codeVerifier.isBlank()) {
+                body += "&code_verifier=" + codeVerifier;
+            }
+
+            HttpClient client = HttpClient.newBuilder()
+                    .proxy(ProxySelector.getDefault())
+                    .connectTimeout(Duration.ofSeconds(connectTimeoutSeconds))
+                    .build();
+
+            HttpRequest request = HttpRequest.newBuilder()
+                    .uri(URI.create(tokenEndpoint))
+                    .timeout(Duration.ofSeconds(requestTimeoutSeconds))
+                    .header("Accept", "application/json")
+                    .header("Content-Type", "application/x-www-form-urlencoded")
+                    .POST(HttpRequest.BodyPublishers.ofString(body))
+                    .build();
+
+            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
+
+            if (response.statusCode() != 200) {
+                LOG.error("OIDC token exchange failed with status {}: {}", response.statusCode(), response.body());
+                return new TokenResponse(null, null, "Token exchange failed with status " + response.statusCode());
+            }
+
+            JsonNode json = MAPPER.readTree(response.body());
+            String accessToken = extractTextField(json, "access_token");
+            String idToken = extractTextField(json, "id_token");
+
+            if (accessToken == null) {
+                LOG.error("No access_token in OIDC token response");
+                return new TokenResponse(null, null, "No access token in response");
+            }
+
+            return new TokenResponse(accessToken, idToken, null);
+        } catch (Exception e) {
+            LOG.error("OIDC token exchange exception", e);
+            return new TokenResponse(null, null, "Token exchange failed: " + e.getMessage());
+        }
+    }
+
+    private String extractTextField(JsonNode node, String field) {
+        JsonNode value = node.get(field);
+        return value != null && value.isTextual() ? value.asText() : null;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/security/OidcRoleResolver.java b/calm-hub/src/main/java/org/finos/calm/security/OidcRoleResolver.java
new file mode 100644
index 000000000..294691625
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/security/OidcRoleResolver.java
@@ -0,0 +1,76 @@
+package org.finos.calm.security;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+/**
+ * Resolves user access by checking SecurityIdentity roles (populated from the
+ * token's "groups" claim via {@code quarkus.oidc.roles.role-claim-path=groups})
+ * against the required access groups for a namespace.
+ */
+@ApplicationScoped
+public class OidcRoleResolver {
+
+    private static final Logger LOG = LoggerFactory.getLogger(OidcRoleResolver.class);
+
+    @Inject
+    @ConfigProperty(name = "calm.oidc.roles.access", defaultValue = "")
+    Optional<String> globalAccessGroups;
+
+    public enum AccessLevel { READ, NONE }
+
+    /**
+     * Checks if the user belongs to any of the specified access groups.
+     * Groups come from the token's "groups" claim mapped to SecurityIdentity roles.
+     */
+    public AccessLevel resolve(SecurityIdentity identity, Set<String> accessGroups) {
+        if (identity == null || identity.isAnonymous()) {
+            return AccessLevel.NONE;
+        }
+
+        Set<String> requiredGroups = accessGroups.isEmpty() ? parseConfig(globalAccessGroups) : accessGroups;
+
+        if (requiredGroups.isEmpty()) {
+            LOG.warn("No access groups configured. No access will be granted.");
+            return AccessLevel.NONE;
+        }
+
+        Set<String> userGroups = identity.getRoles();
+
+        if (userGroups == null || userGroups.isEmpty()) {
+            LOG.debug("User [{}] has no groups in token. Ensure the IdP emits a 'groups' claim.",
+                    identity.getPrincipal().getName());
+            return AccessLevel.NONE;
+        }
+
+        for (String group : userGroups) {
+            if (requiredGroups.contains(group)) {
+                LOG.debug("User [{}] matched access group [{}]", identity.getPrincipal().getName(), group);
+                return AccessLevel.READ;
+            }
+        }
+
+        LOG.debug("User [{}] has no matching access groups. User groups: {}, required: {}",
+                identity.getPrincipal().getName(), userGroups, requiredGroups);
+        return AccessLevel.NONE;
+    }
+
+    private Set<String> parseConfig(Optional<String> config) {
+        if (config.isEmpty() || config.get().isBlank()) {
+            return Set.of();
+        }
+        return Stream.of(config.get().split(";"))
+                .map(String::trim)
+                .filter(s -> !s.isEmpty())
+                .collect(Collectors.toSet());
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/services/MappingControllerService.java b/calm-hub/src/main/java/org/finos/calm/services/MappingControllerService.java
index 392bd32e3..8353992a1 100644
--- a/calm-hub/src/main/java/org/finos/calm/services/MappingControllerService.java
+++ b/calm-hub/src/main/java/org/finos/calm/services/MappingControllerService.java
@@ -46,6 +46,7 @@ public class MappingControllerService {
     private final InterfaceStore interfaceStore;
     private final DomainStore domainStore;
     private final ControlStore controlStore;
+    private final BuildingBlockStore buildingBlockStore;
     private final CalmDocumentParser documentParser;
 
     @Inject
@@ -57,6 +58,7 @@ public MappingControllerService(ResourceMappingStore mappingStore,
                                     InterfaceStore interfaceStore,
                                     DomainStore domainStore,
                                     ControlStore controlStore,
+                                    BuildingBlockStore buildingBlockStore,
                                     CalmDocumentParser documentParser) {
         this.mappingStore = mappingStore;
         this.patternStore = patternStore;
@@ -66,6 +68,7 @@ public MappingControllerService(ResourceMappingStore mappingStore,
         this.interfaceStore = interfaceStore;
         this.domainStore = domainStore;
         this.controlStore = controlStore;
+        this.buildingBlockStore = buildingBlockStore;
         this.documentParser = documentParser;
     }
 
@@ -153,6 +156,8 @@ public List<String> getVersionsForMapping(ResourceMapping mapping) throws Except
             }
             case STANDARD -> standardStore.getStandardVersions(mapping.getNamespace(), mapping.getNumericId());
             case INTERFACE -> interfaceStore.getInterfaceVersions(mapping.getNamespace(), mapping.getNumericId());
+            case BUILDING_BLOCK -> buildingBlockStore.getBuildingBlockVersions(mapping.getNamespace(), mapping.getNumericId());
+            case CONTROL -> controlStore.getRequirementVersions(mapping.getNamespace(), mapping.getNumericId());
         };
     }
 
@@ -184,6 +189,8 @@ public String getResourceJsonForVersion(ResourceMapping mapping, String version)
             }
             case STANDARD -> standardStore.getStandardForVersion(mapping.getNamespace(), mapping.getNumericId(), version);
             case INTERFACE -> interfaceStore.getInterfaceForVersion(mapping.getNamespace(), mapping.getNumericId(), version);
+            case BUILDING_BLOCK -> buildingBlockStore.getBuildingBlockForVersion(mapping.getNamespace(), mapping.getNumericId(), version);
+            case CONTROL -> controlStore.getRequirementForVersion(mapping.getNamespace(), mapping.getNumericId(), version);
         };
     }
 
@@ -554,6 +561,8 @@ private int createResourceInStore(ResourceType type, String namespace, String js
                 CalmInterface created = interfaceStore.createInterfaceForNamespace(req, namespace);
                 yield created.getId();
             }
+            case BUILDING_BLOCK -> buildingBlockStore.createBuildingBlockForNamespace(namespace, json);
+            case CONTROL -> { throw new UnsupportedOperationException("Control creation via name-based API is not supported"); }
         };
     }
 
@@ -606,6 +615,8 @@ private void createVersionedResourceInStore(ResourceType type, String namespace,
                 CreateInterfaceRequest req = new CreateInterfaceRequest(title, description, json);
                 interfaceStore.createInterfaceForVersion(req, namespace, numericId, version);
             }
+            case BUILDING_BLOCK -> buildingBlockStore.createBuildingBlockForVersion(namespace, numericId, version, json);
+            case CONTROL -> { throw new UnsupportedOperationException("Control version creation via name-based API is not supported"); }
         }
     }
 
diff --git a/calm-hub/src/main/java/org/finos/calm/store/BuildingBlockStore.java b/calm-hub/src/main/java/org/finos/calm/store/BuildingBlockStore.java
new file mode 100644
index 000000000..8eb7499c9
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/BuildingBlockStore.java
@@ -0,0 +1,16 @@
+package org.finos.calm.store;
+
+import org.finos.calm.domain.exception.BuildingBlockNotFoundException;
+import org.finos.calm.domain.exception.BuildingBlockVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+
+import java.util.List;
+
+public interface BuildingBlockStore {
+    List<NamespaceResourceSummary> getBuildingBlocksForNamespace(String namespace) throws NamespaceNotFoundException;
+    int createBuildingBlockForNamespace(String namespace, String buildingBlockJson) throws NamespaceNotFoundException;
+    List<String> getBuildingBlockVersions(String namespace, int buildingBlockId) throws NamespaceNotFoundException, BuildingBlockNotFoundException;
+    String getBuildingBlockForVersion(String namespace, int buildingBlockId, String version) throws NamespaceNotFoundException, BuildingBlockNotFoundException, BuildingBlockVersionNotFoundException;
+    void createBuildingBlockForVersion(String namespace, int buildingBlockId, String version, String buildingBlockJson) throws NamespaceNotFoundException, BuildingBlockNotFoundException, BuildingBlockVersionNotFoundException;
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/classpath/ClasspathCoreSchemaStore.java b/calm-hub/src/main/java/org/finos/calm/store/classpath/ClasspathCoreSchemaStore.java
new file mode 100644
index 000000000..eed14a919
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/classpath/ClasspathCoreSchemaStore.java
@@ -0,0 +1,123 @@
+package org.finos.calm.store.classpath;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Serves CALM meta-schemas (e.g. calm.json, core.json, flow.json) from JAR-bundled
+ * resources when no database is available (GitHub storage mode). In Mongo/Nitrite
+ * modes these schemas live in the database; here they are bundled at build time
+ * under META-INF/calm-schemas/ so the /api/calm/schemas endpoints continue to work
+ * without a database connection.
+ */
+@ApplicationScoped
+@Typed(ClasspathCoreSchemaStore.class)
+public class ClasspathCoreSchemaStore implements org.finos.calm.store.CoreSchemaStore {
+
+    private static final String SCHEMA_BASE_PATH = "META-INF/calm-schemas/";
+    private static final String VERSIONS_INDEX = SCHEMA_BASE_PATH + "versions.txt";
+
+    private final Map<String, Map<String, Object>> schemaCache = new ConcurrentHashMap<>();
+    private final List<String> versions;
+
+    public ClasspathCoreSchemaStore() {
+        this.versions = loadVersions();
+    }
+
+    @Override
+    public List<String> getVersions() {
+        return Collections.unmodifiableList(versions);
+    }
+
+    @Override
+    public Map<String, Object> getSchemasForVersion(String version) {
+        if (!versions.contains(version)) {
+            return null;
+        }
+        return schemaCache.computeIfAbsent(version, this::loadSchemasForVersion);
+    }
+
+    @Override
+    public void createSchemaVersion(String version, Map<String, Object> schemas) {
+        throw new UnsupportedOperationException(
+                "Schema creation is not supported in GitHub storage mode. Schemas are bundled at build time.");
+    }
+
+    private List<String> loadVersions() {
+        try (InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream(VERSIONS_INDEX)) {
+            if (is == null) {
+                return List.of();
+            }
+            List<String> result = new ArrayList<>();
+            try (BufferedReader reader = new BufferedReader(new InputStreamReader(is, StandardCharsets.UTF_8))) {
+                String line;
+                while ((line = reader.readLine()) != null) {
+                    String trimmed = line.trim();
+                    if (!trimmed.isEmpty()) {
+                        result.add(trimmed);
+                    }
+                }
+            }
+            return result;
+        } catch (IOException e) {
+            return List.of();
+        }
+    }
+
+    private Map<String, Object> loadSchemasForVersion(String version) {
+        String versionPath = SCHEMA_BASE_PATH + version + "/meta/";
+        Map<String, Object> schemas = new HashMap<>();
+
+        try (InputStream listing = Thread.currentThread().getContextClassLoader()
+                .getResourceAsStream(SCHEMA_BASE_PATH + version + "/files.txt")) {
+            if (listing == null) {
+                return schemas;
+            }
+            try (BufferedReader reader = new BufferedReader(new InputStreamReader(listing, StandardCharsets.UTF_8))) {
+                String fileName;
+                while ((fileName = reader.readLine()) != null) {
+                    String trimmed = fileName.trim();
+                    if (trimmed.isEmpty()) continue;
+                    String resourcePath = versionPath + trimmed;
+                    Object schema = loadJsonResource(resourcePath);
+                    if (schema != null) {
+                        String schemaName = trimmed.replace(".json", "");
+                        schemas.put(schemaName, schema);
+                    }
+                }
+            }
+        } catch (IOException e) {
+            // return whatever we managed to load
+        }
+        return schemas;
+    }
+
+    private Object loadJsonResource(String path) {
+        try (InputStream is = Thread.currentThread().getContextClassLoader().getResourceAsStream(path)) {
+            if (is == null) {
+                return null;
+            }
+            try (JsonReader reader = Json.createReader(is)) {
+                JsonObject obj = reader.readObject();
+                return obj.toString();
+            }
+        } catch (IOException e) {
+            return null;
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAdrStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAdrStore.java
new file mode 100644
index 000000000..a6d975dfb
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAdrStore.java
@@ -0,0 +1,92 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.adr.AdrMeta;
+import org.finos.calm.domain.adr.NamespaceAdrSummary;
+import org.finos.calm.domain.adr.Status;
+import org.finos.calm.domain.exception.AdrNotFoundException;
+import org.finos.calm.domain.exception.AdrParseException;
+import org.finos.calm.domain.exception.AdrPersistenceException;
+import org.finos.calm.domain.exception.AdrRevisionExistsException;
+import org.finos.calm.domain.exception.AdrRevisionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.AdrStore;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+
+import java.util.Collections;
+import java.util.List;
+
+@ApplicationScoped
+@Typed(GitHubAdrStore.class)
+public class GitHubAdrStore implements AdrStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final String VERSION_UNSUPPORTED =
+            "Version history via GitHub API is not yet implemented.";
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    public GitHubAdrStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceAdrSummary> getAdrsForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        return Collections.emptyList();
+    }
+
+    @Override
+    public int countAdrsForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        return 0;
+    }
+
+    @Override
+    public AdrMeta createAdrForNamespace(AdrMeta adrMeta) throws NamespaceNotFoundException, AdrParseException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public AdrMeta getAdr(AdrMeta adrMeta) throws NamespaceNotFoundException, AdrNotFoundException, AdrRevisionNotFoundException, AdrParseException {
+        throw new GitHubWriteNotSupportedException(VERSION_UNSUPPORTED);
+    }
+
+    @Override
+    public List<Integer> getAdrRevisions(AdrMeta adrMeta) throws NamespaceNotFoundException, AdrNotFoundException, AdrRevisionNotFoundException {
+        throw new GitHubWriteNotSupportedException(VERSION_UNSUPPORTED);
+    }
+
+    @Override
+    public AdrMeta getAdrRevision(AdrMeta adrMeta) throws NamespaceNotFoundException, AdrNotFoundException, AdrRevisionNotFoundException, AdrParseException {
+        throw new GitHubWriteNotSupportedException(VERSION_UNSUPPORTED);
+    }
+
+    @Override
+    public AdrMeta updateAdrForNamespace(AdrMeta adrMeta) throws NamespaceNotFoundException, AdrNotFoundException, AdrRevisionNotFoundException, AdrPersistenceException, AdrParseException, AdrRevisionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public AdrMeta updateAdrStatus(AdrMeta adrMeta, Status status) throws AdrNotFoundException, NamespaceNotFoundException, AdrRevisionNotFoundException, AdrPersistenceException, AdrParseException, AdrRevisionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteAdr(String namespace, int adrId) throws NamespaceNotFoundException, AdrNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubArchitectureStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubArchitectureStore.java
new file mode 100644
index 000000000..20ec5dd88
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubArchitectureStore.java
@@ -0,0 +1,141 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.Architecture;
+import org.finos.calm.domain.exception.ArchitectureNotFoundException;
+import org.finos.calm.domain.exception.ArchitectureVersionExistsException;
+import org.finos.calm.domain.exception.ArchitectureVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.ArchitectureStore;
+import org.finos.calm.store.PageRequest;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubArchitectureStore.class)
+public class GitHubArchitectureStore implements ArchitectureStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubArchitectureStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubArchitectureStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceResourceSummary> getArchitecturesForNamespace(String namespace, PageRequest page) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.ARCHITECTURE);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> new NamespaceResourceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF), 0))
+                .toList();
+    }
+
+    @Override
+    public Architecture createArchitectureForNamespace(Architecture architecture) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getArchitectureVersions(Architecture architecture) throws NamespaceNotFoundException, ArchitectureNotFoundException {
+        verifyNamespace(architecture.getNamespace());
+        RegistryEntry entry = findEntryById(architecture.getNamespace(), architecture.getId());
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(architecture.getNamespace()) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getArchitectureForVersion(Architecture architecture) throws NamespaceNotFoundException, ArchitectureNotFoundException, ArchitectureVersionNotFoundException {
+        verifyNamespace(architecture.getNamespace());
+        RegistryEntry entry = findEntryById(architecture.getNamespace(), architecture.getId());
+        String version = architecture.getDotVersion();
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(architecture.getNamespace());
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, architecture.getNamespace()).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read architecture file: {}", entry.filePath(), e);
+            throw new ArchitectureVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public Architecture createArchitectureForVersion(Architecture architecture) throws NamespaceNotFoundException, ArchitectureNotFoundException, ArchitectureVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public Architecture updateArchitectureForVersion(Architecture architecture) throws NamespaceNotFoundException, ArchitectureNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteArchitecture(String namespace, int architectureId) throws NamespaceNotFoundException, ArchitectureNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws ArchitectureNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.ARCHITECTURE);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new ArchitectureNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAuditLogStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAuditLogStore.java
new file mode 100644
index 000000000..2467e7a24
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubAuditLogStore.java
@@ -0,0 +1,33 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import org.finos.calm.domain.audit.AuditLogEntry;
+import org.finos.calm.domain.audit.AuditLogQuery;
+import org.finos.calm.store.AuditLogStore;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+
+/**
+ * No-op audit store for GitHub mode. Audit trail is captured by
+ * AuditRequestFilter + OTEL structured logging — no database persistence needed.
+ */
+@ApplicationScoped
+@Typed(GitHubAuditLogStore.class)
+public class GitHubAuditLogStore implements AuditLogStore {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubAuditLogStore.class);
+
+    @Override
+    public void record(AuditLogEntry entry) {
+        LOG.debug("Audit (log-only): user={} action={} entityType={}",
+                entry.getActor(), entry.getAction(), entry.getEntityType());
+    }
+
+    @Override
+    public List<AuditLogEntry> query(AuditLogQuery query) {
+        return List.of();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubBuildingBlockStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubBuildingBlockStore.java
new file mode 100644
index 000000000..d4c8872e5
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubBuildingBlockStore.java
@@ -0,0 +1,132 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.exception.BuildingBlockNotFoundException;
+import org.finos.calm.domain.exception.BuildingBlockVersionNotFoundException;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.BuildingBlockStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubBuildingBlockStore.class)
+public class GitHubBuildingBlockStore implements BuildingBlockStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubBuildingBlockStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubBuildingBlockStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceResourceSummary> getBuildingBlocksForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.BUILDING_BLOCK);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> {
+                    
+                    if (repo != null && versionService != null) {
+                    }
+                    return new NamespaceResourceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF), 0);
+                })
+                .toList();
+    }
+
+    @Override
+    public int createBuildingBlockForNamespace(String namespace, String buildingBlockJson) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getBuildingBlockVersions(String namespace, int buildingBlockId) throws NamespaceNotFoundException, BuildingBlockNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, buildingBlockId);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getBuildingBlockForVersion(String namespace, int buildingBlockId, String version) throws NamespaceNotFoundException, BuildingBlockNotFoundException, BuildingBlockVersionNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, buildingBlockId);
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(namespace);
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, namespace).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read building block file: {}", entry.filePath(), e);
+            throw new BuildingBlockVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public void createBuildingBlockForVersion(String namespace, int buildingBlockId, String version, String buildingBlockJson) throws NamespaceNotFoundException, BuildingBlockNotFoundException, BuildingBlockVersionNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws BuildingBlockNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.BUILDING_BLOCK);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new BuildingBlockNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubControlStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubControlStore.java
new file mode 100644
index 000000000..75e511dc6
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubControlStore.java
@@ -0,0 +1,234 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.controls.ControlConfigDetail;
+import org.finos.calm.domain.controls.ControlDetail;
+import org.finos.calm.domain.controls.CreateControlConfiguration;
+import org.finos.calm.domain.controls.CreateControlRequirement;
+import org.finos.calm.domain.exception.ControlConfigurationNotFoundException;
+import org.finos.calm.domain.exception.ControlConfigurationVersionExistsException;
+import org.finos.calm.domain.exception.ControlConfigurationVersionNotFoundException;
+import org.finos.calm.domain.exception.ControlHasConfigurationsException;
+import org.finos.calm.domain.exception.ControlNotFoundException;
+import org.finos.calm.domain.exception.ControlRequirementVersionExistsException;
+import org.finos.calm.domain.exception.ControlRequirementVersionNotFoundException;
+import org.finos.calm.domain.exception.DomainNotFoundException;
+import org.finos.calm.store.ControlStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.NamespaceAccessFilter;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+
+@ApplicationScoped
+@Typed(GitHubControlStore.class)
+public class GitHubControlStore implements ControlStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubControlStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    NamespaceAccessFilter accessFilter;
+
+    @Inject
+    public GitHubControlStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<ControlDetail> getControlsForDomain(String domain) throws DomainNotFoundException {
+        Set<String> accessible = resolveAccessibleNamespaces();
+        List<ControlDetail> results = new java.util.ArrayList<>();
+        for (String namespace : registryService.getSnapshot().getNamespaces()) {
+            if (!accessible.contains(namespace)) {
+                continue;
+            }
+            List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.CONTROL);
+            for (RegistryEntry entry : entries) {
+                String path = entry.filePath().toString();
+                if (path.contains("controls/" + domain + "/") || path.contains("controls\\" + domain + "\\")) {
+                    results.add(new ControlDetail(
+                            (entry.uniqueId().hashCode() & 0x7FFFFFFF),
+                            entry.uniqueId(),
+                            null,
+                            entry.name()));
+                }
+            }
+        }
+        if (results.isEmpty()) {
+            throw new DomainNotFoundException(domain);
+        }
+        return results;
+    }
+
+    @Override
+    public ControlDetail createControlRequirement(CreateControlRequirement request, String domain) throws DomainNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getRequirementVersions(String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException {
+        RegistryEntry entry = findControlEntry(domain, controlId);
+        String namespace = findNamespaceForControl(entry);
+        String repo = cloneManager != null && namespace != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getRequirementForVersion(String domain, int controlId, String version) throws DomainNotFoundException, ControlNotFoundException, ControlRequirementVersionNotFoundException {
+        RegistryEntry entry = findControlEntry(domain, controlId);
+        String namespace = findNamespaceForControl(entry);
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null && namespace != null) {
+            String repo = cloneManager.getRepoForNamespace(namespace);
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, namespace != null ? namespace : domain).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read control file: {}", entry.filePath(), e);
+            throw new ControlRequirementVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public void createRequirementForVersion(String domain, int controlId, String version, CreateControlRequirement request) throws DomainNotFoundException, ControlNotFoundException, ControlRequirementVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<Integer> getConfigurationsForControl(String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<ControlConfigDetail> getConfigurationDetailsForControl(String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public int createControlConfiguration(CreateControlConfiguration request, String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getConfigurationVersions(String domain, int controlId, int configurationId) throws DomainNotFoundException, ControlNotFoundException, ControlConfigurationNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public String getConfigurationForVersion(String domain, int controlId, int configurationId, String version) throws DomainNotFoundException, ControlNotFoundException, ControlConfigurationNotFoundException, ControlConfigurationVersionNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void createConfigurationForVersion(String domain, int controlId, int configurationId, String version, CreateControlConfiguration request) throws DomainNotFoundException, ControlNotFoundException, ControlConfigurationNotFoundException, ControlConfigurationVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteControlRequirement(String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException, ControlHasConfigurationsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteControlConfiguration(String domain, int controlId, int configurationId) throws DomainNotFoundException, ControlNotFoundException, ControlConfigurationNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findControlEntry(String domain, int controlId) throws DomainNotFoundException, ControlNotFoundException {
+        Set<String> accessible = resolveAccessibleNamespaces();
+        boolean domainExists = false;
+        for (String namespace : registryService.getSnapshot().getNamespaces()) {
+            if (!accessible.contains(namespace)) {
+                continue;
+            }
+            List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.CONTROL);
+            for (RegistryEntry entry : entries) {
+                String path = entry.filePath().toString();
+                boolean inDomain = path.contains("controls/" + domain + "/") || path.contains("controls\\" + domain + "\\");
+                if (inDomain) {
+                    domainExists = true;
+                    if ((entry.uniqueId().hashCode() & 0x7FFFFFFF) == controlId) {
+                        return entry;
+                    }
+                }
+            }
+        }
+        if (!domainExists) {
+            for (String namespace : registryService.getSnapshot().getNamespaces()) {
+                if (!accessible.contains(namespace)) {
+                    continue;
+                }
+                List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.CONTROL);
+                Optional<RegistryEntry> found = entries.stream()
+                        .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == controlId)
+                        .findFirst();
+                if (found.isPresent()) return found.get();
+            }
+            throw new DomainNotFoundException(domain);
+        }
+        throw new ControlNotFoundException();
+    }
+
+    private String findNamespaceForControl(RegistryEntry entry) {
+        Set<String> accessible = resolveAccessibleNamespaces();
+        for (String namespace : registryService.getSnapshot().getNamespaces()) {
+            if (!accessible.contains(namespace)) {
+                continue;
+            }
+            List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.CONTROL);
+            if (entries.contains(entry)) return namespace;
+        }
+        return null;
+    }
+
+    private Set<String> resolveAccessibleNamespaces() {
+        if (accessFilter == null) {
+            return new java.util.HashSet<>(registryService.getSnapshot().getNamespaces());
+        }
+        return accessFilter.getAccessibleNamespaces();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDecoratorStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDecoratorStore.java
new file mode 100644
index 000000000..d3a912326
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDecoratorStore.java
@@ -0,0 +1,70 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.Decorator;
+import org.finos.calm.domain.exception.DecoratorNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.DecoratorStore;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubDecoratorStore.class)
+public class GitHubDecoratorStore implements DecoratorStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    public GitHubDecoratorStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<Integer> getDecoratorsForNamespace(String namespace, String target, String type) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        return Collections.emptyList();
+    }
+
+    @Override
+    public List<Decorator> getDecoratorValuesForNamespace(String namespace, String target, String type) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        return Collections.emptyList();
+    }
+
+    @Override
+    public Optional<Decorator> getDecoratorById(String namespace, int id) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        return Optional.empty();
+    }
+
+    @Override
+    public int createDecorator(String namespace, String decoratorJson) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void updateDecorator(String namespace, int id, String decoratorJson) throws NamespaceNotFoundException, DecoratorNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteDecorator(String namespace, int id) throws NamespaceNotFoundException, DecoratorNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDomainStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDomainStore.java
new file mode 100644
index 000000000..c08588f11
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubDomainStore.java
@@ -0,0 +1,86 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.Domain;
+import org.finos.calm.domain.exception.DomainAlreadyExistsException;
+import org.finos.calm.domain.exception.DomainNotFoundException;
+import org.finos.calm.store.DomainStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.NamespaceAccessFilter;
+import org.finos.calm.store.github.util.RegistryEntry;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Domains are derived from the controls/ directory structure in each namespace's repo.
+ * E.g. controls/security/*.json -> domain "security".
+ */
+@ApplicationScoped
+@Typed(GitHubDomainStore.class)
+public class GitHubDomainStore implements DomainStore {
+
+    private static final String UNSUPPORTED_MSG =
+            "Domains in GitHub mode are derived from the controls/ directory structure in the repo.";
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    NamespaceAccessFilter accessFilter;
+
+    @Inject
+    public GitHubDomainStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<String> getDomains() {
+        Set<String> accessible = resolveAccessibleNamespaces();
+        return registryService.getSnapshot().entriesByNamespace().entrySet().stream()
+                .filter(e -> accessible.contains(e.getKey()))
+                .flatMap(e -> e.getValue().stream())
+                .filter(entry -> entry.type() == CalmResourceType.CONTROL)
+                .map(this::extractDomain)
+                .distinct()
+                .toList();
+    }
+
+    @Override
+    public Domain createDomain(String name) throws DomainAlreadyExistsException {
+        throw new GitHubWriteNotSupportedException(UNSUPPORTED_MSG);
+    }
+
+    @Override
+    public boolean domainExists(String name) {
+        return getDomains().contains(name);
+    }
+
+    @Override
+    public void deleteDomain(String name) throws DomainNotFoundException {
+        throw new GitHubWriteNotSupportedException(UNSUPPORTED_MSG);
+    }
+
+    private String extractDomain(RegistryEntry entry) {
+        Path filePath = entry.filePath();
+        if (filePath.getNameCount() >= 2) {
+            String firstDir = filePath.getName(0).toString();
+            if ("controls".equals(firstDir)) {
+                return filePath.getName(1).toString();
+            }
+        }
+        return "default";
+    }
+
+    private Set<String> resolveAccessibleNamespaces() {
+        if (accessFilter == null) {
+            return new java.util.HashSet<>(registryService.getSnapshot().getNamespaces());
+        }
+        return accessFilter.getAccessibleNamespaces();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubFlowStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubFlowStore.java
new file mode 100644
index 000000000..b896fa898
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubFlowStore.java
@@ -0,0 +1,147 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.Flow;
+import org.finos.calm.domain.exception.FlowNotFoundException;
+import org.finos.calm.domain.exception.FlowVersionExistsException;
+import org.finos.calm.domain.exception.FlowVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.flow.CreateFlowRequest;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.FlowStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubFlowStore.class)
+public class GitHubFlowStore implements FlowStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubFlowStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubFlowStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceResourceSummary> getFlowsForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.FLOW);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> {
+                    
+                    if (repo != null && versionService != null) {
+                    }
+                    return new NamespaceResourceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF), 0);
+                })
+                .toList();
+    }
+
+    @Override
+    public Flow createFlowForNamespace(CreateFlowRequest flowRequest, String namespace) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getFlowVersions(Flow flow) throws NamespaceNotFoundException, FlowNotFoundException {
+        verifyNamespace(flow.getNamespace());
+        RegistryEntry entry = findEntryById(flow.getNamespace(), flow.getId());
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(flow.getNamespace()) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getFlowForVersion(Flow flow) throws NamespaceNotFoundException, FlowNotFoundException, FlowVersionNotFoundException {
+        verifyNamespace(flow.getNamespace());
+        RegistryEntry entry = findEntryById(flow.getNamespace(), flow.getId());
+        String version = flow.getDotVersion();
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(flow.getNamespace());
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, flow.getNamespace()).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read flow file: {}", entry.filePath(), e);
+            throw new FlowVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public Flow createFlowForVersion(Flow flow) throws NamespaceNotFoundException, FlowNotFoundException, FlowVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public Flow updateFlowForVersion(Flow flow) throws NamespaceNotFoundException, FlowNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteFlow(String namespace, int flowId) throws NamespaceNotFoundException, FlowNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws FlowNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.FLOW);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new FlowNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubInterfaceStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubInterfaceStore.java
new file mode 100644
index 000000000..a0c985755
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubInterfaceStore.java
@@ -0,0 +1,141 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.CalmInterface;
+import org.finos.calm.domain.exception.InterfaceNotFoundException;
+import org.finos.calm.domain.exception.InterfaceVersionExistsException;
+import org.finos.calm.domain.exception.InterfaceVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.interfaces.CreateInterfaceRequest;
+import org.finos.calm.domain.interfaces.NamespaceInterfaceSummary;
+import org.finos.calm.store.InterfaceStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubInterfaceStore.class)
+public class GitHubInterfaceStore implements InterfaceStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubInterfaceStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubInterfaceStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceInterfaceSummary> getInterfacesForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.INTERFACE);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> {
+                    
+                    if (repo != null && versionService != null) {
+                    }
+                    return new NamespaceInterfaceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF));
+                })
+                .toList();
+    }
+
+    @Override
+    public CalmInterface createInterfaceForNamespace(CreateInterfaceRequest interfaceRequest, String namespace) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getInterfaceVersions(String namespace, Integer interfaceId) throws NamespaceNotFoundException, InterfaceNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, interfaceId);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getInterfaceForVersion(String namespace, Integer interfaceId, String version) throws NamespaceNotFoundException, InterfaceNotFoundException, InterfaceVersionNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, interfaceId);
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(namespace);
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, namespace).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read interface file: {}", entry.filePath(), e);
+            throw new InterfaceVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public CalmInterface createInterfaceForVersion(CreateInterfaceRequest interfaceRequest, String namespace, Integer interfaceId, String version) throws NamespaceNotFoundException, InterfaceNotFoundException, InterfaceVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteInterface(String namespace, Integer interfaceId) throws NamespaceNotFoundException, InterfaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws InterfaceNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.INTERFACE);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new InterfaceNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubLayoutStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubLayoutStore.java
new file mode 100644
index 000000000..7bafaddb6
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubLayoutStore.java
@@ -0,0 +1,33 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.LayoutStore;
+
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Layout persistence is not supported in GitHub mode — layouts are client-side state
+ * managed via the browser's localStorage. All methods return empty/no-op responses.
+ */
+@ApplicationScoped
+@Typed(GitHubLayoutStore.class)
+public class GitHubLayoutStore implements LayoutStore {
+
+    @Override
+    public Optional<String> getLayout(String namespace, int architectureId) throws NamespaceNotFoundException {
+        return Optional.empty();
+    }
+
+    @Override
+    public void upsertLayout(String namespace, int architectureId, String layoutJson) throws NamespaceNotFoundException {
+        // no-op — layouts not persisted in GitHub mode
+    }
+
+    @Override
+    public List<Integer> getArchitectureIdsWithLayoutForNamespace(String namespace) throws NamespaceNotFoundException {
+        return List.of();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubNamespaceStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubNamespaceStore.java
new file mode 100644
index 000000000..211a6964a
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubNamespaceStore.java
@@ -0,0 +1,57 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.exception.NamespaceAlreadyExistsException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceInfo;
+import org.finos.calm.store.NamespaceStore;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+
+import java.util.List;
+
+@ApplicationScoped
+@Typed(GitHubNamespaceStore.class)
+public class GitHubNamespaceStore implements NamespaceStore {
+
+    private static final String UNSUPPORTED_MSG =
+            "Namespaces in GitHub mode are admin-configured via deployment properties (calm.github.namespaces[*]). " +
+            "Update your deployment configuration to add or remove namespaces.";
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    public GitHubNamespaceStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceInfo> getNamespaces() {
+        return registryService.getSnapshot().getNamespaces().stream()
+                .map(name -> new NamespaceInfo(name, ""))
+                .toList();
+    }
+
+    @Override
+    public boolean namespaceExists(String namespaceName) {
+        return registryService.getSnapshot().getNamespaces().contains(namespaceName);
+    }
+
+    @Override
+    public void createNamespace(String name, String description) throws NamespaceAlreadyExistsException {
+        throw new GitHubWriteNotSupportedException(UNSUPPORTED_MSG);
+    }
+
+    @Override
+    public void updateNamespaceDescription(String name, String description) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(UNSUPPORTED_MSG);
+    }
+
+    @Override
+    public void deleteNamespace(String name) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(UNSUPPORTED_MSG);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubPatternStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubPatternStore.java
new file mode 100644
index 000000000..fb9ec1901
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubPatternStore.java
@@ -0,0 +1,149 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.bson.json.JsonParseException;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.Pattern;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.PatternNotFoundException;
+import org.finos.calm.domain.exception.PatternVersionExistsException;
+import org.finos.calm.domain.exception.PatternVersionNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.domain.pattern.CreatePatternRequest;
+import org.finos.calm.store.PageRequest;
+import org.finos.calm.store.PatternStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubPatternStore.class)
+public class GitHubPatternStore implements PatternStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubPatternStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubPatternStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceResourceSummary> getPatternsForNamespace(String namespace, PageRequest page) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.PATTERN);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> {
+                    
+                    if (repo != null && versionService != null) {
+                    }
+                    return new NamespaceResourceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF), 0);
+                })
+                .toList();
+    }
+
+    @Override
+    public Pattern createPatternForNamespace(CreatePatternRequest patternRequest, String namespace) throws NamespaceNotFoundException, JsonParseException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getPatternVersions(Pattern pattern) throws NamespaceNotFoundException, PatternNotFoundException {
+        verifyNamespace(pattern.getNamespace());
+        RegistryEntry entry = findEntryById(pattern.getNamespace(), pattern.getId());
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(pattern.getNamespace()) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getPatternForVersion(Pattern pattern) throws NamespaceNotFoundException, PatternNotFoundException, PatternVersionNotFoundException {
+        verifyNamespace(pattern.getNamespace());
+        RegistryEntry entry = findEntryById(pattern.getNamespace(), pattern.getId());
+        String version = pattern.getDotVersion();
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(pattern.getNamespace());
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, pattern.getNamespace()).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read pattern file: {}", entry.filePath(), e);
+            throw new PatternVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public Pattern createPatternForVersion(Pattern pattern) throws NamespaceNotFoundException, PatternNotFoundException, PatternVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public Pattern updatePatternForVersion(Pattern pattern) throws NamespaceNotFoundException, PatternNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deletePattern(String namespace, int patternId) throws NamespaceNotFoundException, PatternNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws PatternNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.PATTERN);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new PatternNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubResourceMappingStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubResourceMappingStore.java
new file mode 100644
index 000000000..2a3cd1937
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubResourceMappingStore.java
@@ -0,0 +1,131 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.ResourceMapping;
+import org.finos.calm.domain.ResourceType;
+import org.finos.calm.domain.exception.DuplicateMappingException;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.finos.calm.domain.exception.MappingNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.ResourceMappingStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubResourceMappingStore.class)
+public class GitHubResourceMappingStore implements ResourceMappingStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Resource ID mapping is managed by the GitHub repository. Writes are not supported in GitHub storage mode.";
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    public GitHubResourceMappingStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public ResourceMapping getMapping(String namespace, ResourceType type, String customId)
+            throws MappingNotFoundException, NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        CalmResourceType calmType = toCalmResourceType(type);
+        Optional<RegistryEntry> entry = registryService.findByUniqueId(namespace, customId);
+        if (entry.isEmpty() || entry.get().type() != calmType) {
+            throw new MappingNotFoundException();
+        }
+        return toResourceMapping(namespace, type, entry.get());
+    }
+
+    @Override
+    public List<ResourceMapping> listMappings(String namespace, ResourceType typeFilter)
+            throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        CalmResourceType calmType = toCalmResourceType(typeFilter);
+        return registryService.listByType(namespace, calmType).stream()
+                .map(e -> toResourceMapping(namespace, typeFilter, e))
+                .toList();
+    }
+
+    @Override
+    public ResourceMapping getMappingByNumericId(String namespace, ResourceType type, int numericId)
+            throws MappingNotFoundException, NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        CalmResourceType calmType = toCalmResourceType(type);
+        Optional<RegistryEntry> found = registryService.listByType(namespace, calmType).stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == numericId)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new MappingNotFoundException();
+        }
+        return toResourceMapping(namespace, type, found.get());
+    }
+
+    @Override
+    public List<ResourceMapping> listMappingsByNumericIds(String namespace, ResourceType type, List<Integer> ids)
+            throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        CalmResourceType calmType = toCalmResourceType(type);
+        return registryService.listByType(namespace, calmType).stream()
+                .filter(e -> ids.contains(e.uniqueId().hashCode() & 0x7FFFFFFF))
+                .map(e -> toResourceMapping(namespace, type, e))
+                .toList();
+    }
+
+    @Override
+    public ResourceMapping createMapping(String namespace, String customId, ResourceType type, int numericId)
+            throws DuplicateMappingException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void updateMappingNumericId(String namespace, ResourceType type, String customId, int numericId)
+            throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteMapping(String namespace, ResourceType type, String customId)
+            throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteMappingByNumericId(String namespace, ResourceType type, int numericId)
+            throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private ResourceMapping toResourceMapping(String namespace, ResourceType type, RegistryEntry entry) {
+        return new ResourceMapping.ResourceMappingBuilder()
+                .setNamespace(namespace)
+                .setCustomId(entry.uniqueId())
+                .setResourceType(type)
+                .setNumericId(entry.uniqueId().hashCode() & 0x7FFFFFFF)
+                .build();
+    }
+
+    static CalmResourceType toCalmResourceType(ResourceType type) {
+        return switch (type) {
+            case PATTERN -> CalmResourceType.PATTERN;
+            case ARCHITECTURE -> CalmResourceType.ARCHITECTURE;
+            case FLOW -> CalmResourceType.FLOW;
+            case STANDARD -> CalmResourceType.STANDARD;
+            case INTERFACE -> CalmResourceType.INTERFACE;
+            case BUILDING_BLOCK -> CalmResourceType.BUILDING_BLOCK;
+            case CONTROL -> CalmResourceType.CONTROL;
+        };
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubSearchStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubSearchStore.java
new file mode 100644
index 000000000..d44a50208
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubSearchStore.java
@@ -0,0 +1,70 @@
+package org.finos.calm.store.github;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.search.GroupedSearchResults;
+import org.finos.calm.domain.search.SearchResult;
+import org.finos.calm.store.SearchStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+@ApplicationScoped
+@Typed(GitHubSearchStore.class)
+public class GitHubSearchStore implements SearchStore {
+
+    @Inject
+    InMemoryRegistryService registryService;
+
+    @Override
+    public GroupedSearchResults search(String query, Optional<Set<String>> readableNamespaces) {
+        if (query == null || query.isBlank()) {
+            return new GroupedSearchResults(
+                    List.of(), List.of(), List.of(), List.of(), List.of(), List.of(), List.of());
+        }
+
+        String lowerQuery = query.toLowerCase();
+        List<RegistryEntry> allEntries = registryService.getSnapshot().getNamespaces().stream()
+                .filter(ns -> readableNamespaces.isEmpty() || readableNamespaces.get().contains(ns))
+                .flatMap(ns -> registryService.getSnapshot().listAll(ns).stream())
+                .filter(e -> matchesQuery(e, lowerQuery))
+                .limit(MAX_RESULTS_PER_TYPE * 7L)
+                .toList();
+
+        return new GroupedSearchResults(
+                filterByType(allEntries, CalmResourceType.ARCHITECTURE),
+                filterByType(allEntries, CalmResourceType.PATTERN),
+                filterByType(allEntries, CalmResourceType.FLOW),
+                filterByType(allEntries, CalmResourceType.STANDARD),
+                filterByType(allEntries, CalmResourceType.INTERFACE),
+                filterByType(allEntries, CalmResourceType.CONTROL),
+                filterByType(allEntries, CalmResourceType.ADR)
+        );
+    }
+
+    private boolean matchesQuery(RegistryEntry entry, String lowerQuery) {
+        return (entry.name() != null && entry.name().toLowerCase().contains(lowerQuery))
+                || (entry.uniqueId() != null && entry.uniqueId().toLowerCase().contains(lowerQuery));
+    }
+
+    private List<SearchResult> filterByType(List<RegistryEntry> entries, CalmResourceType type) {
+        return entries.stream()
+                .filter(e -> e.type() == type)
+                .limit(MAX_RESULTS_PER_TYPE)
+                .map(e -> new SearchResult(
+                        registryService.getSnapshot().getNamespaces().stream()
+                                .filter(ns -> registryService.getSnapshot().listAll(ns).contains(e))
+                                .findFirst().orElse(""),
+                        (e.uniqueId().hashCode() & 0x7FFFFFFF),
+                        e.name(),
+                        e.uniqueId()
+                ))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubStandardStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubStandardStore.java
new file mode 100644
index 000000000..aa5bec249
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubStandardStore.java
@@ -0,0 +1,151 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.Standard;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.StandardNotFoundException;
+import org.finos.calm.domain.exception.StandardVersionExistsException;
+import org.finos.calm.domain.exception.StandardVersionNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.domain.standards.CreateStandardRequest;
+import org.finos.calm.store.StandardStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubStandardStore.class)
+public class GitHubStandardStore implements StandardStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubStandardStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubStandardStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceResourceSummary> getStandardsForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.STANDARD);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        return entries.stream()
+                .map(e -> {
+                    
+                    if (repo != null && versionService != null) {
+                    }
+                    return new NamespaceResourceSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF), 0);
+                })
+                .toList();
+    }
+
+    @Override
+    public Standard createStandardForNamespace(CreateStandardRequest standardRequest, String namespace) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getStandardVersions(String namespace, Integer standardId) throws NamespaceNotFoundException, StandardNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, standardId);
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(namespace) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getStandardForVersion(String namespace, Integer standardId, String version) throws NamespaceNotFoundException, StandardNotFoundException, StandardVersionNotFoundException {
+        verifyNamespace(namespace);
+        RegistryEntry entry = findEntryById(namespace, standardId);
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(namespace);
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, namespace).resolve(entry.filePath());
+            // If this is a JSON file, check for a sibling .md file and prefer it
+            if (filePath.toString().endsWith(".json")) {
+                String baseName = filePath.getFileName().toString()
+                        .replaceAll("\\.(guideline|standard|calm)\\.json$", "")
+                        .replace(".json", "");
+                Path mdSibling = filePath.getParent().resolve(baseName + ".md");
+                if (Files.exists(mdSibling)) {
+                    return Files.readString(mdSibling);
+                }
+            }
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read standard file: {}", entry.filePath(), e);
+            throw new StandardVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public Standard createStandardForVersion(CreateStandardRequest standardRequest, String namespace, Integer standardId, String version) throws NamespaceNotFoundException, StandardNotFoundException, StandardVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteStandard(String namespace, Integer standardId) throws NamespaceNotFoundException, StandardNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws StandardNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.STANDARD);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new StandardNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubTimelineStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubTimelineStore.java
new file mode 100644
index 000000000..36c715cbe
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubTimelineStore.java
@@ -0,0 +1,141 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.TimelineNotFoundException;
+import org.finos.calm.domain.exception.TimelineVersionExistsException;
+import org.finos.calm.domain.exception.TimelineVersionNotFoundException;
+import org.finos.calm.domain.timeline.CreateTimelineRequest;
+import org.finos.calm.domain.timeline.NamespaceTimelineSummary;
+import org.finos.calm.domain.timeline.Timeline;
+import org.finos.calm.store.TimelineStore;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@ApplicationScoped
+@Typed(GitHubTimelineStore.class)
+public class GitHubTimelineStore implements TimelineStore {
+
+    private static final String WRITE_UNSUPPORTED =
+            "Write operations are not yet available. GitHub account linking and PR creation will be enabled in a future release.";
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubTimelineStore.class);
+
+    private final InMemoryRegistryService registryService;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    GitHubVersionService versionService;
+
+    @Inject
+    public GitHubTimelineStore(InMemoryRegistryService registryService) {
+        this.registryService = registryService;
+    }
+
+    @Override
+    public List<NamespaceTimelineSummary> getTimelinesForNamespace(String namespace) throws NamespaceNotFoundException {
+        verifyNamespace(namespace);
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.TIMELINE);
+        return entries.stream()
+                .map(e -> new NamespaceTimelineSummary(e.name(), e.uniqueId(), (e.uniqueId().hashCode() & 0x7FFFFFFF)))
+                .toList();
+    }
+
+    @Override
+    public Timeline createTimelineForNamespace(CreateTimelineRequest timelineRequest, String namespace) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public List<String> getTimelineVersions(Timeline timeline) throws NamespaceNotFoundException, TimelineNotFoundException {
+        verifyNamespace(timeline.getNamespace());
+        RegistryEntry entry = findEntryById(timeline.getNamespace(), timeline.getId());
+        String repo = cloneManager != null ? cloneManager.getRepoForNamespace(timeline.getNamespace()) : null;
+        if (repo != null && versionService != null) {
+            return versionService.getFileVersions(repo, entry.filePath().toString());
+        }
+        return List.of("latest");
+    }
+
+    @Override
+    public String getTimelineForVersion(Timeline timeline) throws NamespaceNotFoundException, TimelineNotFoundException, TimelineVersionNotFoundException {
+        verifyNamespace(timeline.getNamespace());
+        RegistryEntry entry = findEntryById(timeline.getNamespace(), timeline.getId());
+        String version = timeline.getDotVersion();
+
+        // If a specific SHA is requested and version service is available, fetch from GitHub API
+        if (version != null && !version.equals("latest") && version.matches("[0-9a-f]{7,40}")
+                && cloneManager != null && versionService != null) {
+            String repo = cloneManager.getRepoForNamespace(timeline.getNamespace());
+            if (repo != null) {
+                String content = versionService.getFileAtVersion(repo, entry.filePath().toString(), version);
+                if (content != null) {
+                    return content;
+                }
+            }
+        }
+
+        // Fallback: read from local clone (latest/HEAD)
+        try {
+            Path filePath = Path.of(cloneDirectory, timeline.getNamespace()).resolve(entry.filePath());
+            return Files.readString(filePath);
+        } catch (IOException e) {
+            LOG.error("Failed to read timeline file: {}", entry.filePath(), e);
+            throw new TimelineVersionNotFoundException();
+        }
+    }
+
+    @Override
+    public Timeline createTimelineForVersion(Timeline timeline) throws NamespaceNotFoundException, TimelineNotFoundException, TimelineVersionExistsException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public Timeline updateTimelineForVersion(Timeline timeline) throws NamespaceNotFoundException, TimelineNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteTimeline(String namespace, int timelineId) throws NamespaceNotFoundException, TimelineNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    private RegistryEntry findEntryById(String namespace, int id) throws TimelineNotFoundException {
+        List<RegistryEntry> entries = registryService.listByType(namespace, CalmResourceType.TIMELINE);
+        Optional<RegistryEntry> found = entries.stream()
+                .filter(e -> (e.uniqueId().hashCode() & 0x7FFFFFFF) == id)
+                .findFirst();
+        if (found.isEmpty()) {
+            throw new TimelineNotFoundException();
+        }
+        return found.get();
+    }
+
+    private void verifyNamespace(String namespace) throws NamespaceNotFoundException {
+        if (!registryService.getSnapshot().getNamespaces().contains(namespace)) {
+            throw new NamespaceNotFoundException();
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/GitHubUserAccessStore.java b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubUserAccessStore.java
new file mode 100644
index 000000000..987e5b472
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/GitHubUserAccessStore.java
@@ -0,0 +1,132 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import jakarta.inject.Inject;
+import org.finos.calm.domain.UserAccess;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.UserAccessNotFoundException;
+import org.finos.calm.security.OidcRoleResolver;
+import org.finos.calm.store.UserAccessStore;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * In GitHub mode, access is derived from OIDC token roles/claims.
+ * The user's OIDC token is inspected for configured role values that map to
+ * READ or WRITE permissions on all cloned namespaces.
+ */
+@ApplicationScoped
+@Typed(GitHubUserAccessStore.class)
+public class GitHubUserAccessStore implements UserAccessStore {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubUserAccessStore.class);
+
+    private static final String ADMIN_UNSUPPORTED =
+            "Access in GitHub mode is derived from OIDC roles. Configure IdP group assignments to manage access.";
+    private static final String WRITE_UNSUPPORTED =
+            "Access grants cannot be created in GitHub mode. Assign users to the appropriate IdP roles instead.";
+
+    @Inject
+    InMemoryRegistryService registryService;
+
+    @Inject
+    OidcRoleResolver roleResolver;
+
+    @Inject
+    SecurityIdentity identity;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Override
+    public List<UserAccess> getGrantsForUser(String username) {
+        List<UserAccess> grants = new ArrayList<>();
+        List<String> namespaces = registryService.getSnapshot().getNamespaces();
+
+        if (namespaces.isEmpty()) {
+            return grants;
+        }
+
+        for (String namespace : namespaces) {
+            Set<String> accessGroups = cloneManager != null ? cloneManager.getAccessGroupsForNamespace(namespace) : Set.of();
+
+            OidcRoleResolver.AccessLevel level = roleResolver.resolve(identity, accessGroups);
+
+            if (level != OidcRoleResolver.AccessLevel.NONE) {
+                grants.add(new UserAccess(username, UserAccess.Permission.read, namespace));
+            } else {
+                LOG.debug("User [{}] denied access to namespace [{}] — no matching group", username, namespace);
+            }
+        }
+        return grants;
+    }
+
+    @Override
+    public List<UserAccess> getUserAccessForUsername(String username) throws UserAccessNotFoundException {
+        List<UserAccess> grants = getGrantsForUser(username);
+        if (grants.isEmpty()) {
+            throw new UserAccessNotFoundException();
+        }
+        return grants;
+    }
+
+    @Override
+    public List<UserAccess> getUserAccessForNamespace(String namespace) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(ADMIN_UNSUPPORTED);
+    }
+
+    @Override
+    public UserAccess getUserAccessForNamespaceAndId(String namespace, Integer userAccessId) throws NamespaceNotFoundException, UserAccessNotFoundException {
+        throw new GitHubWriteNotSupportedException(ADMIN_UNSUPPORTED);
+    }
+
+    @Override
+    public List<UserAccess> getUserAccessForDomain(String domain) {
+        throw new GitHubWriteNotSupportedException(ADMIN_UNSUPPORTED);
+    }
+
+    @Override
+    public UserAccess getUserAccessForDomainAndId(String domain, Integer userAccessId) throws UserAccessNotFoundException {
+        throw new GitHubWriteNotSupportedException(ADMIN_UNSUPPORTED);
+    }
+
+    @Override
+    public UserAccess createUserAccessForNamespace(UserAccess userAccess) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public UserAccess createUserAccessForDomain(UserAccess userAccess) {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteUserAccessForNamespace(String namespace, Integer userAccessId) throws NamespaceNotFoundException, UserAccessNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteUserAccessForDomain(String domain, Integer userAccessId) throws UserAccessNotFoundException {
+        throw new GitHubWriteNotSupportedException(WRITE_UNSUPPORTED);
+    }
+
+    @Override
+    public void deleteAllUserAccessForNamespace(String namespace) {
+        // no-op
+    }
+
+    @Override
+    public void deleteAllUserAccessForDomain(String domain) {
+        // no-op
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmContentDetector.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmContentDetector.java
new file mode 100644
index 000000000..bcf341537
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmContentDetector.java
@@ -0,0 +1,138 @@
+package org.finos.calm.store.github.util;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+
+import java.io.StringReader;
+import java.nio.file.Path;
+
+/**
+ * Detects CALM resource types from JSON content and file path conventions.
+ * Ported from the VSCode plugin's self-discovery logic: uses a combination of
+ * JSON structure signals (nodes[], relationships[], moments[]) and parent
+ * directory naming conventions (architectures/, patterns/, etc.).
+ */
+@ApplicationScoped
+public class CalmContentDetector {
+
+    public CalmResourceType detect(String jsonContent, Path filePath) {
+        if (jsonContent == null || jsonContent.isBlank()) {
+            return CalmResourceType.UNKNOWN;
+        }
+
+        JsonObject json;
+        try (JsonReader reader = Json.createReader(new StringReader(jsonContent))) {
+            json = reader.readObject();
+        } catch (Exception e) {
+            return CalmResourceType.UNKNOWN;
+        }
+
+        String parentDir = getParentDirectoryName(filePath);
+
+        if (isTimeline(json)) {
+            return CalmResourceType.TIMELINE;
+        }
+
+        if (hasNodesOrRelationships(json)) {
+            return detectByDirectoryHint(parentDir, CalmResourceType.UNKNOWN);
+        }
+
+        if (hasSchemaMatching(json, "flow")) {
+            return CalmResourceType.FLOW;
+        }
+
+        if (hasSchemaMatching(json, "interface")) {
+            return CalmResourceType.INTERFACE;
+        }
+
+        if (hasSchemaMatching(json, "control")) {
+            return CalmResourceType.CONTROL;
+        }
+
+        if (hasSchemaMatching(json, "decorator")) {
+            return CalmResourceType.DECORATOR;
+        }
+
+        return detectByDirectoryOnly(parentDir);
+    }
+
+    private boolean isTimeline(JsonObject json) {
+        boolean hasMoments = json.containsKey("moments");
+        boolean hasTimelineSchema = hasSchemaMatching(json, "timeline");
+        return hasMoments || hasTimelineSchema;
+    }
+
+    private boolean hasNodesOrRelationships(JsonObject json) {
+        return json.containsKey("nodes") || json.containsKey("relationships");
+    }
+
+    private boolean hasSchemaMatching(JsonObject json, String keyword) {
+        if (!json.containsKey("$schema")) {
+            return false;
+        }
+        String schema = json.getString("$schema", "");
+        return schema.toLowerCase().contains(keyword);
+    }
+
+    private CalmResourceType detectByDirectoryHint(String parentDir, CalmResourceType fallback) {
+        if (parentDir == null) return fallback;
+        return switch (parentDir.toLowerCase()) {
+            case "patterns" -> CalmResourceType.PATTERN;
+            case "architectures" -> CalmResourceType.ARCHITECTURE;
+            case "standards" -> CalmResourceType.STANDARD;
+            case "guidelines" -> CalmResourceType.GUIDELINE;
+            case "flows" -> CalmResourceType.FLOW;
+            case "interfaces" -> CalmResourceType.INTERFACE;
+            case "adrs" -> CalmResourceType.ADR;
+            case "decorators" -> CalmResourceType.DECORATOR;
+            case "building-blocks" -> CalmResourceType.BUILDING_BLOCK;
+            default -> fallback;
+        };
+    }
+
+    private CalmResourceType detectByDirectoryOnly(String parentDir) {
+        if (parentDir == null) return CalmResourceType.UNKNOWN;
+        return switch (parentDir.toLowerCase()) {
+            case "architectures" -> CalmResourceType.ARCHITECTURE;
+            case "patterns" -> CalmResourceType.PATTERN;
+            case "standards" -> CalmResourceType.STANDARD;
+            case "guidelines" -> CalmResourceType.GUIDELINE;
+            case "controls" -> CalmResourceType.CONTROL;
+            case "adrs" -> CalmResourceType.ADR;
+            case "flows" -> CalmResourceType.FLOW;
+            case "interfaces" -> CalmResourceType.INTERFACE;
+            case "timelines" -> CalmResourceType.TIMELINE;
+            case "decorators" -> CalmResourceType.DECORATOR;
+            case "building-blocks" -> CalmResourceType.BUILDING_BLOCK;
+            default -> CalmResourceType.UNKNOWN;
+        };
+    }
+
+    private String getParentDirectoryName(Path filePath) {
+        if (filePath == null) {
+            return null;
+        }
+        for (int i = 0; i < filePath.getNameCount() - 1; i++) {
+            String segment = filePath.getName(i).toString().toLowerCase();
+            if (isKnownDirectory(segment)) {
+                return segment;
+            }
+        }
+        if (filePath.getParent() != null) {
+            Path fileName = filePath.getParent().getFileName();
+            return fileName != null ? fileName.toString() : null;
+        }
+        return null;
+    }
+
+    private boolean isKnownDirectory(String name) {
+        return switch (name) {
+            case "architectures", "patterns", "standards", "guidelines",
+                 "controls", "adrs", "flows", "interfaces", "timelines", "decorators",
+                 "building-blocks" -> true;
+            default -> false;
+        };
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmResourceType.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmResourceType.java
new file mode 100644
index 000000000..a03d034a8
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/CalmResourceType.java
@@ -0,0 +1,16 @@
+package org.finos.calm.store.github.util;
+
+public enum CalmResourceType {
+    ARCHITECTURE,
+    PATTERN,
+    STANDARD,
+    GUIDELINE,
+    CONTROL,
+    ADR,
+    FLOW,
+    INTERFACE,
+    TIMELINE,
+    DECORATOR,
+    BUILDING_BLOCK,
+    UNKNOWN
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubCloneManager.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubCloneManager.java
new file mode 100644
index 000000000..f5b13da78
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubCloneManager.java
@@ -0,0 +1,148 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * Manages parallel cloning of all registered namespace repos on startup,
+ * tracks clone state, and provides pull-all for periodic sync.
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubCloneManager {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubCloneManager.class);
+
+    public enum State { INITIALIZING, CLONING, READY, DEGRADED, FAILED }
+
+    private volatile State state = State.INITIALIZING;
+    private final Map<String, NamespaceRepo> namespaceRepos = new ConcurrentHashMap<>();
+
+    private final GitHubRepoSync repoSync;
+    private final GitHubStoreConfig config;
+
+    @Inject
+    public GitHubCloneManager(GitHubRepoSync repoSync, GitHubStoreConfig config) {
+        this.repoSync = repoSync;
+        this.config = config;
+    }
+
+    public State getState() {
+        return state;
+    }
+
+    public void registerNamespace(String name, String repoFullName, String branch) {
+        namespaceRepos.put(name, new NamespaceRepo(repoFullName, branch, Set.of()));
+    }
+
+    public void registerNamespace(String name, String repoFullName, String branch, Set<String> accessGroups) {
+        namespaceRepos.put(name, new NamespaceRepo(repoFullName, branch, accessGroups));
+    }
+
+    public Set<String> getAccessGroupsForNamespace(String namespace) {
+        NamespaceRepo repo = namespaceRepos.get(namespace);
+        return repo != null ? repo.accessGroups() : Set.of();
+    }
+
+    public void cloneAll() {
+        if (namespaceRepos.isEmpty()) {
+            LOG.warn("No namespaces registered — nothing to clone");
+            state = State.READY;
+            return;
+        }
+
+        state = State.CLONING;
+        int succeeded = 0;
+        int failed = 0;
+
+        for (Map.Entry<String, NamespaceRepo> entry : namespaceRepos.entrySet()) {
+            String namespace = entry.getKey();
+            NamespaceRepo repo = entry.getValue();
+            Path targetDir = config.getCloneDirectory().resolve(namespace);
+
+            boolean success;
+            if (repoSync.isValidRepo(targetDir)) {
+                success = repoSync.pullRepo(targetDir, config.getServiceToken());
+            } else {
+                success = repoSync.cloneRepo(repo.repoFullName(), repo.branch(), targetDir, config.getServiceToken());
+            }
+
+            if (success) {
+                succeeded++;
+            } else {
+                failed++;
+            }
+        }
+
+        if (failed == 0) {
+            state = State.READY;
+        } else if (succeeded > 0) {
+            state = State.DEGRADED;
+            LOG.warn("Clone completed in DEGRADED state: {} succeeded, {} failed", succeeded, failed);
+        } else {
+            state = State.FAILED;
+            LOG.error("Clone FAILED: all {} repos failed", failed);
+        }
+    }
+
+    public void pullAll() {
+        if (state == State.CLONING || state == State.INITIALIZING) {
+            LOG.debug("Skipping pullAll — state is {}", state);
+            return;
+        }
+
+        int succeeded = 0;
+        int failed = 0;
+
+        for (Map.Entry<String, NamespaceRepo> entry : namespaceRepos.entrySet()) {
+            String namespace = entry.getKey();
+            Path targetDir = config.getCloneDirectory().resolve(namespace);
+
+            if (repoSync.isValidRepo(targetDir)) {
+                if (repoSync.pullRepo(targetDir, config.getServiceToken())) {
+                    succeeded++;
+                } else {
+                    failed++;
+                }
+            } else {
+                failed++;
+            }
+        }
+
+        if (failed > 0 && succeeded == 0) {
+            state = State.FAILED;
+        } else if (failed > 0) {
+            state = State.DEGRADED;
+        } else {
+            state = State.READY;
+        }
+    }
+
+    public Map<String, Path> getNamespaceClonePaths() {
+        Map<String, Path> paths = new HashMap<>();
+        for (String namespace : namespaceRepos.keySet()) {
+            paths.put(namespace, config.getCloneDirectory().resolve(namespace));
+        }
+        return paths;
+    }
+
+    public boolean hasNamespaces() {
+        return !namespaceRepos.isEmpty();
+    }
+
+    public String getRepoForNamespace(String namespace) {
+        NamespaceRepo repo = namespaceRepos.get(namespace);
+        return repo != null ? repo.repoFullName() : null;
+    }
+
+    record NamespaceRepo(String repoFullName, String branch, Set<String> accessGroups) {}
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubForkPRService.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubForkPRService.java
new file mode 100644
index 000000000..f96595762
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubForkPRService.java
@@ -0,0 +1,54 @@
+package org.finos.calm.store.github.util;
+
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import jakarta.enterprise.context.ApplicationScoped;
+import org.finos.calm.domain.exception.PendingWriteException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Orchestrates the fork-based write flow:
+ * 1. Ensure user's fork exists (create if not)
+ * 2. Sync fork to upstream HEAD
+ * 3. Create branch on fork
+ * 4. Commit file to branch
+ * 5. Open cross-repo PR: user/fork:branch -> upstream:main
+ *
+ * Requires: user's GitHub token (from session cookie) and the upstream repo details.
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubForkPRService {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubForkPRService.class);
+
+    /**
+     * Creates a PR for the given content change.
+     *
+     * @param userGhToken  the user's GitHub OAuth token
+     * @param upstreamRepo the upstream repo (e.g. "finos/architecture-as-code")
+     * @param branch       the upstream branch (e.g. "main")
+     * @param filePath     the file path within the repo (e.g. "patterns/event-driven.json")
+     * @param content      the JSON content to write
+     * @param commitMessage the commit message
+     * @return never — always throws PendingWriteException on success
+     * @throws PendingWriteException on successful PR creation (contains PR URL)
+     * @throws IllegalStateException if the GitHub API calls fail
+     */
+    public void createPullRequest(String userGhToken, String upstreamRepo, String branch,
+                                  String filePath, String content, String commitMessage)
+            throws PendingWriteException {
+        // Full implementation will:
+        // 1. GET /repos/{upstream}/forks filtered by user -> find or create fork
+        // 2. POST /repos/{user}/{repo}/merge-upstream -> sync fork
+        // 3. POST /repos/{user}/{repo}/git/refs -> create branch
+        // 4. PUT /repos/{user}/{repo}/contents/{path} -> commit file
+        // 5. POST /repos/{upstream}/pulls -> open cross-repo PR
+
+        // Placeholder — will be implemented when GitHub OAuth token exchange is complete
+        throw new GitHubWriteNotSupportedException(
+                "PR creation requires GitHub account linking. This will be enabled when the full OAuth flow is wired.");
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubRepoSync.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubRepoSync.java
new file mode 100644
index 000000000..6dff33504
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubRepoSync.java
@@ -0,0 +1,84 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.jgit.api.CloneCommand;
+import org.eclipse.jgit.api.Git;
+import org.eclipse.jgit.api.ResetCommand;
+import org.eclipse.jgit.api.errors.GitAPIException;
+import org.eclipse.jgit.transport.UsernamePasswordCredentialsProvider;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+/**
+ * Handles git clone and sync operations for a single repository.
+ * Uses fetch + reset instead of pull to handle upstream force-pushes gracefully.
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubRepoSync {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubRepoSync.class);
+
+    @Inject
+    @ConfigProperty(name = "calm.github.oauth.base-url", defaultValue = "https://github.com")
+    String githubBaseUrl;
+
+    public boolean cloneRepo(String repoFullName, String branch, Path targetDir, String token) {
+        String url = githubBaseUrl + "/" + repoFullName + ".git";
+        try {
+            Files.createDirectories(targetDir);
+            CloneCommand clone = Git.cloneRepository()
+                    .setURI(url)
+                    .setDirectory(targetDir.toFile())
+                    .setBranch(branch)
+                    .setDepth(1);
+
+            if (token != null && !token.isBlank()) {
+                clone.setCredentialsProvider(
+                        new UsernamePasswordCredentialsProvider(token, ""));
+            }
+
+            try (Git git = clone.call()) {
+                LOG.info("Cloned {} (branch: {}) to {}", repoFullName, branch, targetDir);
+                return true;
+            }
+        } catch (GitAPIException | IOException e) {
+            LOG.error("Failed to clone {}: {}", repoFullName, e.getMessage());
+            return false;
+        }
+    }
+
+    public boolean pullRepo(Path repoDir, String token) {
+        try (Git git = Git.open(repoDir.toFile())) {
+            var fetchCommand = git.fetch();
+
+            if (token != null && !token.isBlank()) {
+                fetchCommand.setCredentialsProvider(
+                        new UsernamePasswordCredentialsProvider(token, ""));
+            }
+
+            fetchCommand.call();
+            git.reset()
+                    .setMode(ResetCommand.ResetType.HARD)
+                    .setRef("origin/" + git.getRepository().getBranch())
+                    .call();
+
+            LOG.debug("Fetched and reset for {}", repoDir.getFileName());
+            return true;
+        } catch (GitAPIException | IOException e) {
+            LOG.error("Failed to sync {}: {}", repoDir.getFileName(), e.getMessage());
+            return false;
+        }
+    }
+
+    public boolean isValidRepo(Path repoDir) {
+        return Files.isDirectory(repoDir.resolve(".git"));
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStartupInitializer.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStartupInitializer.java
new file mode 100644
index 000000000..81e1861a0
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStartupInitializer.java
@@ -0,0 +1,98 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import io.quarkus.runtime.StartupEvent;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.eclipse.microprofile.context.ManagedExecutor;
+import org.finos.calm.observability.GitHubMetrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+
+/**
+ * Reads namespace configuration on startup, registers repos with the clone manager,
+ * triggers initial clone asynchronously, and rebuilds the in-memory registry once complete.
+ * Quarkus finishes starting immediately — health endpoints are available during clone.
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubStartupInitializer {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubStartupInitializer.class);
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    InMemoryRegistryService registryService;
+
+    @Inject
+    GitHubMetrics metrics;
+
+    @Inject
+    ManagedExecutor executor;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.namespaces")
+    Optional<List<String>> namespaceConfigs;
+
+    void onStart(@Observes StartupEvent ev) {
+        List<String> configs = namespaceConfigs.orElse(List.of());
+        if (configs.isEmpty()) {
+            LOG.warn("No GitHub namespaces configured (calm.github.namespaces). The registry will be empty.");
+            return;
+        }
+
+        for (String entry : configs) {
+            String[] parts = entry.split("\\|");
+            if (parts.length < 2) {
+                LOG.warn("Invalid namespace config entry (expected 'name|repo|branch[|accessGroups]'): {}", entry);
+                continue;
+            }
+            String name = parts[0].trim();
+            String repo = parts[1].trim();
+            String branch = parts.length > 2 ? parts[2].trim() : "main";
+            java.util.Set<String> accessGroups = parts.length > 3 ? parseGroups(parts[3]) : java.util.Set.of();
+            cloneManager.registerNamespace(name, repo, branch, accessGroups);
+            LOG.info("Registered namespace [{}] → repo [{}] branch [{}] accessGroups={}",
+                    name, repo, branch, accessGroups);
+        }
+
+        executor.runAsync(this::cloneAndRebuild);
+        LOG.info("GitHub clone started asynchronously — state: {}", cloneManager.getState());
+    }
+
+    private java.util.Set<String> parseGroups(String groupsStr) {
+        if (groupsStr == null || groupsStr.isBlank()) {
+            return java.util.Set.of();
+        }
+        return java.util.Arrays.stream(groupsStr.split(";"))
+                .map(String::trim)
+                .filter(s -> !s.isEmpty())
+                .collect(java.util.stream.Collectors.toSet());
+    }
+
+    void cloneAndRebuild() {
+        try {
+            Instant start = Instant.now();
+            cloneManager.cloneAll();
+
+            Instant rebuildStart = Instant.now();
+            registryService.rebuild(cloneManager.getNamespaceClonePaths());
+            metrics.recordRegistryRebuild(Duration.between(rebuildStart, Instant.now()));
+
+            Duration total = Duration.between(start, Instant.now());
+            metrics.recordSyncSuccess(total);
+            LOG.info("GitHub clone complete in {}ms — state: {}", total.toMillis(), cloneManager.getState());
+        } catch (Exception e) {
+            LOG.error("GitHub clone failed: {}", e.getMessage(), e);
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStoreConfig.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStoreConfig.java
new file mode 100644
index 000000000..271f395b7
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubStoreConfig.java
@@ -0,0 +1,51 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubStoreConfig {
+
+    @Inject
+    @ConfigProperty(name = "calm.github.service-token")
+    Optional<String> serviceToken;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.clone-directory", defaultValue = "/tmp/calm-hub-clones")
+    String cloneDirectory;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.sync-interval", defaultValue = "60")
+    int syncInterval;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.api-url", defaultValue = "https://api.github.com")
+    String apiUrl;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.namespaces")
+    Optional<List<String>> namespaceConfigs;
+
+    public String getServiceToken() {
+        return serviceToken.orElse("");
+    }
+
+    public Path getCloneDirectory() {
+        return Path.of(cloneDirectory);
+    }
+
+    public int getSyncInterval() {
+        return syncInterval;
+    }
+
+    public String getApiUrl() {
+        return apiUrl;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubSyncScheduler.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubSyncScheduler.java
new file mode 100644
index 000000000..2f9c0bc82
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubSyncScheduler.java
@@ -0,0 +1,60 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.arc.lookup.LookupIfProperty;
+import io.quarkus.scheduler.Scheduled;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.finos.calm.observability.GitHubMetrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.Duration;
+import java.time.Instant;
+
+/**
+ * Periodically pulls all registered namespace repos and rebuilds the in-memory registry.
+ * Only active when calm.database.mode=github.
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubSyncScheduler {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubSyncScheduler.class);
+
+    private final GitHubCloneManager cloneManager;
+    private final InMemoryRegistryService registryService;
+    private final GitHubMetrics metrics;
+
+    @Inject
+    public GitHubSyncScheduler(GitHubCloneManager cloneManager,
+                               InMemoryRegistryService registryService,
+                               GitHubMetrics metrics) {
+        this.cloneManager = cloneManager;
+        this.registryService = registryService;
+        this.metrics = metrics;
+    }
+
+    @Scheduled(every = "${calm.github.sync-interval:60}s", delayed = "${calm.github.sync-interval:60}s")
+    void sync() {
+        if (!cloneManager.hasNamespaces()) {
+            return;
+        }
+
+        Instant start = Instant.now();
+        try {
+            cloneManager.pullAll();
+
+            Instant rebuildStart = Instant.now();
+            registryService.rebuild(cloneManager.getNamespaceClonePaths());
+            metrics.recordRegistryRebuild(Duration.between(rebuildStart, Instant.now()));
+
+            Duration total = Duration.between(start, Instant.now());
+            metrics.recordSyncSuccess(total);
+            LOG.debug("Sync completed in {}ms", total.toMillis());
+        } catch (Exception e) {
+            Duration total = Duration.between(start, Instant.now());
+            metrics.recordSyncFailure(total);
+            LOG.error("Sync failed after {}ms: {}", total.toMillis(), e.getMessage());
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubVersionService.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubVersionService.java
new file mode 100644
index 000000000..7f55a62d7
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/GitHubVersionService.java
@@ -0,0 +1,186 @@
+package org.finos.calm.store.github.util;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.quarkus.arc.lookup.LookupIfProperty;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.cache.CalmCacheService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.net.ProxySelector;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpHeaders;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.time.Duration;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Fetches file version history (commit SHAs) from the GitHub REST API.
+ * Results are cached — version lists for 5 min, content at SHA indefinitely (immutable).
+ */
+@LookupIfProperty(name = "calm.database.mode", stringValue = "github")
+@ApplicationScoped
+public class GitHubVersionService {
+
+    private static final Logger LOG = LoggerFactory.getLogger(GitHubVersionService.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final Pattern LINK_NEXT_PATTERN = Pattern.compile("<([^>]+)>;\\s*rel=\"next\"");
+
+    @Inject
+    CalmCacheService cache;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.api-url", defaultValue = "https://api.github.com")
+    String apiUrl;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.service-token")
+    Optional<String> serviceToken;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.http.connect-timeout", defaultValue = "10")
+    int connectTimeoutSeconds;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.http.request-timeout", defaultValue = "30")
+    int requestTimeoutSeconds;
+
+    @Inject
+    @ConfigProperty(name = "calm.github.max-versions", defaultValue = "100")
+    int maxVersions;
+
+    public List<String> getFileVersions(String repoFullName, String filePath) {
+        String cacheKey = "versions:" + repoFullName + ":" + filePath;
+        Optional<List> cached = cache.get(cacheKey, List.class);
+        if (cached.isPresent()) {
+            @SuppressWarnings("unchecked")
+            List<String> result = cached.get();
+            return result;
+        }
+
+        try {
+            HttpClient client = HttpClient.newBuilder()
+                    .proxy(ProxySelector.getDefault())
+                    .connectTimeout(Duration.ofSeconds(connectTimeoutSeconds))
+                    .build();
+
+            List<String> allShas = new ArrayList<>();
+            String url = apiUrl + "/repos/" + repoFullName + "/commits?path=" + filePath + "&per_page=100";
+
+            while (url != null && allShas.size() < maxVersions) {
+                HttpRequest request = buildRequest(url);
+                HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
+
+                if (response.statusCode() != 200) {
+                    LOG.warn("GitHub API returned {} for commits on {}/{}", response.statusCode(), repoFullName, filePath);
+                    break;
+                }
+
+                List<String> pageShas = extractShas(response.body(), maxVersions - allShas.size());
+                allShas.addAll(pageShas);
+                url = extractNextLink(response.headers());
+            }
+
+            if (allShas.isEmpty()) {
+                allShas = List.of("latest");
+            }
+            List<String> chronological = new ArrayList<>(allShas);
+            Collections.reverse(chronological);
+            cache.put(cacheKey, chronological, Duration.ofMinutes(5));
+            return chronological;
+        } catch (Exception e) {
+            LOG.warn("Failed to fetch versions for {}/{}: {}", repoFullName, filePath, e.getMessage());
+            return List.of("latest");
+        }
+    }
+
+    public String getFileAtVersion(String repoFullName, String filePath, String sha) {
+        String cacheKey = "content:" + repoFullName + ":" + filePath + ":" + sha;
+        Optional<String> cached = cache.get(cacheKey, String.class);
+        if (cached.isPresent()) {
+            return cached.get();
+        }
+
+        try {
+            String url = apiUrl + "/repos/" + repoFullName + "/contents/" + filePath + "?ref=" + sha;
+            HttpClient client = HttpClient.newBuilder()
+                    .proxy(ProxySelector.getDefault())
+                    .connectTimeout(Duration.ofSeconds(connectTimeoutSeconds))
+                    .build();
+            HttpRequest request = buildRequest(url, "application/vnd.github.raw+json");
+
+            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
+
+            if (response.statusCode() != 200) {
+                LOG.warn("GitHub API returned {} for content at SHA {} for {}/{}", response.statusCode(), sha, repoFullName, filePath);
+                return null;
+            }
+
+            String content = response.body();
+            cache.put(cacheKey, content, Duration.ofDays(365));
+            return content;
+        } catch (Exception e) {
+            LOG.warn("Failed to fetch content at SHA {} for {}/{}: {}", sha, repoFullName, filePath, e.getMessage());
+            return null;
+        }
+    }
+
+    List<String> extractShas(String json, int limit) {
+        List<String> shas = new ArrayList<>();
+        try {
+            JsonNode commits = MAPPER.readTree(json);
+            if (commits.isArray()) {
+                for (JsonNode commit : commits) {
+                    JsonNode shaNode = commit.get("sha");
+                    if (shaNode != null && shaNode.isTextual() && shas.size() < limit) {
+                        String fullSha = shaNode.asText();
+                        shas.add(fullSha.length() >= 7 ? fullSha.substring(0, 7) : fullSha);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            LOG.warn("Failed to parse commits JSON: {}", e.getMessage());
+        }
+        return shas;
+    }
+
+    String extractNextLink(HttpHeaders headers) {
+        Optional<String> linkHeader = headers.firstValue("Link");
+        if (linkHeader.isEmpty()) {
+            return null;
+        }
+        Matcher matcher = LINK_NEXT_PATTERN.matcher(linkHeader.get());
+        if (matcher.find()) {
+            return matcher.group(1);
+        }
+        return null;
+    }
+
+    private HttpRequest buildRequest(String url) {
+        return buildRequest(url, "application/json");
+    }
+
+    private HttpRequest buildRequest(String url, String accept) {
+        HttpRequest.Builder requestBuilder = HttpRequest.newBuilder()
+                .uri(URI.create(url))
+                .timeout(Duration.ofSeconds(requestTimeoutSeconds))
+                .header("Accept", accept)
+                .GET();
+
+        if (serviceToken.isPresent() && !serviceToken.get().isBlank()) {
+            requestBuilder.header("Authorization", "Bearer " + serviceToken.get());
+        }
+
+        return requestBuilder.build();
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/InMemoryRegistryService.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/InMemoryRegistryService.java
new file mode 100644
index 000000000..ae5b2b58a
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/InMemoryRegistryService.java
@@ -0,0 +1,194 @@
+package org.finos.calm.store.github.util;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.json.Json;
+import jakarta.json.JsonObject;
+import jakarta.json.JsonReader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.StringReader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.EnumMap;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Stream;
+
+@ApplicationScoped
+public class InMemoryRegistryService {
+
+    private static final Logger LOG = LoggerFactory.getLogger(InMemoryRegistryService.class);
+
+    private volatile RegistrySnapshot snapshot = RegistrySnapshot.EMPTY;
+
+    private final CalmContentDetector contentDetector;
+
+    @Inject
+    public InMemoryRegistryService(CalmContentDetector contentDetector) {
+        this.contentDetector = contentDetector;
+    }
+
+    public RegistrySnapshot getSnapshot() {
+        return snapshot;
+    }
+
+    public void rebuild(Map<String, Path> namespaceClonePaths) {
+        Map<String, List<RegistryEntry>> byNamespace = new HashMap<>();
+        Map<String, RegistryEntry> byQualifiedId = new HashMap<>();
+        Map<CalmResourceType, List<RegistryEntry>> byType = new EnumMap<>(CalmResourceType.class);
+
+        for (Map.Entry<String, Path> entry : namespaceClonePaths.entrySet()) {
+            String namespace = entry.getKey();
+            Path clonePath = entry.getValue();
+
+            List<RegistryEntry> entries = scanDirectory(namespace, clonePath);
+            byNamespace.put(namespace, entries);
+
+            for (RegistryEntry registryEntry : entries) {
+                byQualifiedId.put(namespace + ":" + registryEntry.uniqueId(), registryEntry);
+                byType.computeIfAbsent(registryEntry.type(), k -> new ArrayList<>()).add(registryEntry);
+            }
+        }
+
+        this.snapshot = new RegistrySnapshot(
+                Map.copyOf(byNamespace),
+                Map.copyOf(byQualifiedId),
+                Map.copyOf(byType)
+        );
+        LOG.info("Registry rebuilt: {} namespaces, {} total entries",
+                byNamespace.size(), byQualifiedId.size());
+    }
+
+    public Optional<RegistryEntry> findByUniqueId(String namespace, String uniqueId) {
+        return snapshot.findByUniqueId(namespace, uniqueId);
+    }
+
+    public List<RegistryEntry> listByType(String namespace, CalmResourceType type) {
+        return snapshot.listByType(namespace, type);
+    }
+
+    private List<RegistryEntry> scanDirectory(String namespace, Path root) {
+        List<RegistryEntry> entries = new ArrayList<>();
+
+        if (!Files.isDirectory(root)) {
+            LOG.warn("Clone path does not exist for namespace [{}]: {}", namespace, root);
+            return entries;
+        }
+
+        try (Stream<Path> walk = Files.walk(root)) {
+            walk.filter(Files::isRegularFile)
+                    .filter(p -> p.toString().endsWith(".json") || p.toString().endsWith(".md"))
+                    .filter(p -> !isHiddenOrMetadata(root, p))
+                    .forEach(filePath -> {
+                        RegistryEntry entry = parseFile(root, filePath);
+                        if (entry != null && entry.type() != CalmResourceType.UNKNOWN) {
+                            entries.add(entry);
+                        }
+                    });
+        } catch (IOException e) {
+            LOG.error("Failed to scan directory for namespace [{}]: {}", namespace, root, e);
+        }
+
+        return entries;
+    }
+
+    private RegistryEntry parseFile(Path root, Path filePath) {
+        try {
+            Path relativePath = root.relativize(filePath);
+            String fileName = filePath.getFileName().toString();
+
+            if (fileName.endsWith(".md")) {
+                return parseMarkdownFile(root, filePath, relativePath);
+            }
+
+            String content = Files.readString(filePath);
+            CalmResourceType type = contentDetector.detect(content, relativePath);
+
+            if (type == CalmResourceType.UNKNOWN) {
+                return null;
+            }
+
+            String uniqueId = extractUniqueId(content, relativePath);
+            String name = extractName(content, relativePath);
+            Instant lastModified = Files.getLastModifiedTime(filePath).toInstant();
+
+            return new RegistryEntry(uniqueId, relativePath, type, name, lastModified);
+        } catch (IOException e) {
+            LOG.debug("Failed to parse file: {}", filePath, e);
+            return null;
+        }
+    }
+
+    private RegistryEntry parseMarkdownFile(Path root, Path filePath, Path relativePath) throws IOException {
+        CalmResourceType type = detectMarkdownType(relativePath);
+        if (type == CalmResourceType.UNKNOWN) {
+            return null;
+        }
+        String fileName = filePath.getFileName().toString().replace(".md", "");
+        if ("README".equalsIgnoreCase(fileName)) {
+            return null;
+        }
+        String name = fileName.replace("-", " ");
+        Instant lastModified = Files.getLastModifiedTime(filePath).toInstant();
+        return new RegistryEntry(fileName, relativePath, type, name, lastModified);
+    }
+
+    private CalmResourceType detectMarkdownType(Path relativePath) {
+        for (int i = 0; i < relativePath.getNameCount() - 1; i++) {
+            String segment = relativePath.getName(i).toString().toLowerCase();
+            switch (segment) {
+                case "standards": return CalmResourceType.STANDARD;
+                case "guidelines": return CalmResourceType.GUIDELINE;
+                case "adrs": return CalmResourceType.ADR;
+                default: break;
+            }
+        }
+        return CalmResourceType.UNKNOWN;
+    }
+
+    private String extractUniqueId(String content, Path relativePath) {
+        try (JsonReader reader = Json.createReader(new StringReader(content))) {
+            JsonObject json = reader.readObject();
+            if (json.containsKey("unique-id")) {
+                return json.getString("unique-id");
+            }
+        } catch (Exception e) {
+            // fall through to path-based derivation
+        }
+        return stripFileExtensions(relativePath.getFileName().toString());
+    }
+
+    private String extractName(String content, Path relativePath) {
+        try (JsonReader reader = Json.createReader(new StringReader(content))) {
+            JsonObject json = reader.readObject();
+            if (json.containsKey("name")) {
+                return json.getString("name");
+            }
+        } catch (Exception e) {
+            // fall through to path-based derivation
+        }
+        return stripFileExtensions(relativePath.getFileName().toString());
+    }
+
+    private String stripFileExtensions(String fileName) {
+        // Strip compound extensions: .calm.json, .architecture.json, .template.json, etc.
+        int firstDot = fileName.indexOf('.');
+        return firstDot > 0 ? fileName.substring(0, firstDot) : fileName;
+    }
+
+    private boolean isHiddenOrMetadata(Path root, Path filePath) {
+        Path relative = root.relativize(filePath);
+        String relativeStr = relative.toString();
+        return relativeStr.startsWith(".") ||
+                relativeStr.contains("/.") ||
+                relativeStr.startsWith("node_modules") ||
+                relativeStr.contains("/node_modules/");
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/NamespaceAccessFilter.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/NamespaceAccessFilter.java
new file mode 100644
index 000000000..54086afb1
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/NamespaceAccessFilter.java
@@ -0,0 +1,66 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.security.OidcRoleResolver;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Resolves the set of namespaces the current caller can access based on their
+ * OIDC group membership and each namespace's configured access groups. Used by
+ * GitHub-mode stores to restrict domain/control visibility to namespaces the
+ * caller is authorised to read.
+ */
+@ApplicationScoped
+public class NamespaceAccessFilter {
+
+    private static final Logger LOG = LoggerFactory.getLogger(NamespaceAccessFilter.class);
+
+    @Inject
+    SecurityIdentity identity;
+
+    @Inject
+    OidcRoleResolver roleResolver;
+
+    @Inject
+    InMemoryRegistryService registryService;
+
+    @Inject
+    GitHubCloneManager cloneManager;
+
+    @Inject
+    @ConfigProperty(name = "calm.auth.enabled", defaultValue = "false")
+    boolean authEnabled;
+
+    public Set<String> getAccessibleNamespaces() {
+        List<String> allNamespaces = registryService.getSnapshot().getNamespaces();
+
+        if (!authEnabled) {
+            return new HashSet<>(allNamespaces);
+        }
+
+        if (identity == null || identity.isAnonymous()) {
+            return Set.of();
+        }
+
+        Set<String> accessible = new HashSet<>();
+        for (String namespace : allNamespaces) {
+            Set<String> accessGroups = cloneManager.getAccessGroupsForNamespace(namespace);
+            if (roleResolver.resolve(identity, accessGroups) != OidcRoleResolver.AccessLevel.NONE) {
+                accessible.add(namespace);
+            }
+        }
+
+        LOG.debug("User [{}] has access to {} of {} namespaces",
+                identity.getPrincipal().getName(), accessible.size(), allNamespaces.size());
+
+        return accessible;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistryEntry.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistryEntry.java
new file mode 100644
index 000000000..52d968154
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistryEntry.java
@@ -0,0 +1,12 @@
+package org.finos.calm.store.github.util;
+
+import java.nio.file.Path;
+import java.time.Instant;
+
+public record RegistryEntry(
+        String uniqueId,
+        Path filePath,
+        CalmResourceType type,
+        String name,
+        Instant lastModified
+) {}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistrySnapshot.java b/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistrySnapshot.java
new file mode 100644
index 000000000..dfc31755a
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/github/util/RegistrySnapshot.java
@@ -0,0 +1,34 @@
+package org.finos.calm.store.github.util;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+public record RegistrySnapshot(
+        Map<String, List<RegistryEntry>> entriesByNamespace,
+        Map<String, RegistryEntry> entriesByQualifiedId,
+        Map<CalmResourceType, List<RegistryEntry>> entriesByType
+) {
+    public static final RegistrySnapshot EMPTY = new RegistrySnapshot(
+            Collections.emptyMap(), Collections.emptyMap(), Collections.emptyMap());
+
+    public Optional<RegistryEntry> findByUniqueId(String namespace, String uniqueId) {
+        return Optional.ofNullable(entriesByQualifiedId.get(namespace + ":" + uniqueId));
+    }
+
+    public List<RegistryEntry> listByType(String namespace, CalmResourceType type) {
+        return entriesByNamespace.getOrDefault(namespace, Collections.emptyList())
+                .stream()
+                .filter(e -> e.type() == type)
+                .toList();
+    }
+
+    public List<RegistryEntry> listAll(String namespace) {
+        return entriesByNamespace.getOrDefault(namespace, Collections.emptyList());
+    }
+
+    public List<String> getNamespaces() {
+        return List.copyOf(entriesByNamespace.keySet());
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpResourceMappingStore.java b/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpResourceMappingStore.java
new file mode 100644
index 000000000..539fde384
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpResourceMappingStore.java
@@ -0,0 +1,62 @@
+package org.finos.calm.store.noop;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import org.finos.calm.domain.ResourceMapping;
+import org.finos.calm.domain.ResourceType;
+import org.finos.calm.domain.exception.DuplicateMappingException;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.finos.calm.domain.exception.MappingNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.ResourceMappingStore;
+
+import java.util.Collections;
+import java.util.List;
+
+@ApplicationScoped
+@Typed(NoOpResourceMappingStore.class)
+public class NoOpResourceMappingStore implements ResourceMappingStore {
+
+    private static final String MESSAGE =
+            "Resource ID mapping is not used in GitHub storage mode. Documents are identified by their unique-id field.";
+
+    @Override
+    public ResourceMapping createMapping(String namespace, String customId, ResourceType type, int numericId) throws DuplicateMappingException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(MESSAGE);
+    }
+
+    @Override
+    public ResourceMapping getMapping(String namespace, ResourceType type, String customId) throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new MappingNotFoundException();
+    }
+
+    @Override
+    public List<ResourceMapping> listMappings(String namespace, ResourceType typeFilter) throws NamespaceNotFoundException {
+        return Collections.emptyList();
+    }
+
+    @Override
+    public ResourceMapping getMappingByNumericId(String namespace, ResourceType type, int numericId) throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new MappingNotFoundException();
+    }
+
+    @Override
+    public List<ResourceMapping> listMappingsByNumericIds(String namespace, ResourceType type, List<Integer> ids) throws NamespaceNotFoundException {
+        return Collections.emptyList();
+    }
+
+    @Override
+    public void updateMappingNumericId(String namespace, ResourceType type, String customId, int numericId) throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(MESSAGE);
+    }
+
+    @Override
+    public void deleteMapping(String namespace, ResourceType type, String customId) throws MappingNotFoundException, NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(MESSAGE);
+    }
+
+    @Override
+    public void deleteMappingByNumericId(String namespace, ResourceType type, int numericId) throws NamespaceNotFoundException {
+        throw new GitHubWriteNotSupportedException(MESSAGE);
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpSchemaVersionStore.java b/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpSchemaVersionStore.java
new file mode 100644
index 000000000..6aadb71f5
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/noop/NoOpSchemaVersionStore.java
@@ -0,0 +1,35 @@
+package org.finos.calm.store.noop;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Typed;
+import org.finos.calm.store.SchemaVersionStore;
+
+@ApplicationScoped
+@Typed(NoOpSchemaVersionStore.class)
+public class NoOpSchemaVersionStore implements SchemaVersionStore {
+
+    @Override
+    public int getSchemaVersion() {
+        return Integer.MAX_VALUE;
+    }
+
+    @Override
+    public void setSchemaVersion(int version) {
+        // no-op — GitHub mode has no database to version
+    }
+
+    @Override
+    public boolean acquireMigrationLock(String instanceId) {
+        return true;
+    }
+
+    @Override
+    public void releaseMigrationLock(String instanceId) {
+        // no-op
+    }
+
+    @Override
+    public boolean isMigrationLockHeld() {
+        return false;
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/AdrStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/AdrStoreProducer.java
index 720f4bb42..6dcc4f6f4 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/AdrStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/AdrStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.AdrStore;
+import org.finos.calm.store.github.GitHubAdrStore;
 import org.finos.calm.store.mongo.MongoAdrStore;
 import org.finos.calm.store.nitrite.NitriteAdrStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for AdrStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class AdrStoreProducer {
 
@@ -26,18 +24,18 @@ public class AdrStoreProducer {
     @Inject
     Instance<NitriteAdrStore> standaloneAdrStore;
 
-    /**
-     * Produces the appropriate AdrStore implementation based on the configured database mode.
-     *
-     * @return the AdrStore implementation
-     */
+    @Inject
+    Instance<GitHubAdrStore> gitHubAdrStore;
+
     @Produces
     @ApplicationScoped
     public AdrStore produceAdrStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubAdrStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneAdrStore.get();
         } else {
             return mongoAdrStore.get();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/ArchitectureStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/ArchitectureStoreProducer.java
index 89fbd06ef..1eb60f25f 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/ArchitectureStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/ArchitectureStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ArchitectureStore;
+import org.finos.calm.store.github.GitHubArchitectureStore;
 import org.finos.calm.store.mongo.MongoArchitectureStore;
 import org.finos.calm.store.nitrite.NitriteArchitectureStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for ArchitectureStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class ArchitectureStoreProducer {
 
@@ -26,15 +24,15 @@ public class ArchitectureStoreProducer {
     @Inject
     Instance<NitriteArchitectureStore> standaloneArchitectureStore;
 
-    /**
-     * Produces the appropriate ArchitectureStore implementation based on the configured database mode.
-     *
-     * @return the ArchitectureStore implementation
-     */
+    @Inject
+    Instance<GitHubArchitectureStore> gitHubArchitectureStore;
+
     @Produces
     @ApplicationScoped
     public ArchitectureStore produceArchitectureStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubArchitectureStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneArchitectureStore.get();
         } else {
             return mongoArchitectureStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/AuditLogStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/AuditLogStoreProducer.java
index d494fa3a9..dbeab8bd9 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/AuditLogStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/AuditLogStoreProducer.java
@@ -5,14 +5,12 @@
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.AuditLogStore;
+import org.finos.calm.store.github.GitHubAuditLogStore;
 import org.finos.calm.store.mongo.MongoAuditLogStore;
 import org.finos.calm.store.nitrite.NitriteAuditLogStore;
 
-/**
- * Producer for {@link AuditLogStore} implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class AuditLogStoreProducer {
 
@@ -26,15 +24,15 @@ public class AuditLogStoreProducer {
     @Inject
     Instance<NitriteAuditLogStore> standaloneAuditLogStore;
 
-    /**
-     * Produces the appropriate AuditLogStore implementation based on the configured database mode.
-     *
-     * @return the AuditLogStore implementation
-     */
+    @Inject
+    Instance<GitHubAuditLogStore> gitHubAuditLogStore;
+
     @Produces
     @ApplicationScoped
     public AuditLogStore produceAuditLogStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubAuditLogStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneAuditLogStore.get();
         } else {
             return mongoAuditLogStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/BuildingBlockStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/BuildingBlockStoreProducer.java
new file mode 100644
index 000000000..ebb093bf8
--- /dev/null
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/BuildingBlockStoreProducer.java
@@ -0,0 +1,65 @@
+package org.finos.calm.store.producer;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
+import org.finos.calm.store.BuildingBlockStore;
+import org.finos.calm.store.github.GitHubBuildingBlockStore;
+
+@ApplicationScoped
+public class BuildingBlockStoreProducer {
+
+    @Inject
+    @ConfigProperty(name = "calm.database.mode", defaultValue = "mongo")
+    String databaseMode;
+
+    @Inject
+    Instance<GitHubBuildingBlockStore> gitHubBuildingBlockStore;
+
+    @Produces
+    @ApplicationScoped
+    public BuildingBlockStore produceBuildingBlockStore() {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubBuildingBlockStore.get();
+        }
+        // No Mongo or standalone implementation yet — return a no-op that throws on all operations
+        return new NoOpBuildingBlockStore();
+    }
+
+    /**
+     * Placeholder implementation for non-GitHub modes until Mongo/Nitrite support is added.
+     */
+    private static class NoOpBuildingBlockStore implements BuildingBlockStore {
+
+        private static final String NOT_SUPPORTED =
+                "Building blocks are not yet supported in standalone or mongo mode";
+
+        @Override
+        public java.util.List<org.finos.calm.domain.namespaces.NamespaceResourceSummary> getBuildingBlocksForNamespace(String namespace) {
+            throw new UnsupportedOperationException(NOT_SUPPORTED);
+        }
+
+        @Override
+        public int createBuildingBlockForNamespace(String namespace, String buildingBlockJson) {
+            throw new UnsupportedOperationException(NOT_SUPPORTED);
+        }
+
+        @Override
+        public java.util.List<String> getBuildingBlockVersions(String namespace, int buildingBlockId) {
+            throw new UnsupportedOperationException(NOT_SUPPORTED);
+        }
+
+        @Override
+        public String getBuildingBlockForVersion(String namespace, int buildingBlockId, String version) {
+            throw new UnsupportedOperationException(NOT_SUPPORTED);
+        }
+
+        @Override
+        public void createBuildingBlockForVersion(String namespace, int buildingBlockId, String version, String buildingBlockJson) {
+            throw new UnsupportedOperationException(NOT_SUPPORTED);
+        }
+    }
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/ControlStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/ControlStoreProducer.java
index 7480244dc..d5bb36db2 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/ControlStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/ControlStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ControlStore;
+import org.finos.calm.store.github.GitHubControlStore;
 import org.finos.calm.store.mongo.MongoControlStore;
 import org.finos.calm.store.nitrite.NitriteControlStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for ControlStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class ControlStoreProducer {
 
@@ -26,18 +24,18 @@ public class ControlStoreProducer {
     @Inject
     Instance<NitriteControlStore> standaloneControlStore;
 
-    /**
-     * Produces the appropriate ControlStore implementation based on the configured database mode.
-     *
-     * @return the ControlStore implementation
-     */
+    @Inject
+    Instance<GitHubControlStore> gitHubControlStore;
+
     @Produces
     @ApplicationScoped
     public ControlStore produceControlStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubControlStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneControlStore.get();
         } else {
             return mongoControlStore.get();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/CoreSchemaStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/CoreSchemaStoreProducer.java
index 4be01c089..dd5a4061f 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/CoreSchemaStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/CoreSchemaStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.CoreSchemaStore;
+import org.finos.calm.store.classpath.ClasspathCoreSchemaStore;
 import org.finos.calm.store.mongo.MongoCoreSchemaStore;
 import org.finos.calm.store.nitrite.NitriteCoreSchemaStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for CoreSchemaStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class CoreSchemaStoreProducer {
 
@@ -26,15 +24,15 @@ public class CoreSchemaStoreProducer {
     @Inject
     Instance<NitriteCoreSchemaStore> standaloneCoreSchemaStore;
 
-    /**
-     * Produces the appropriate CoreSchemaStore implementation based on the configured database mode.
-     *
-     * @return the CoreSchemaStore implementation
-     */
+    @Inject
+    Instance<ClasspathCoreSchemaStore> classpathCoreSchemaStore;
+
     @Produces
     @ApplicationScoped
     public CoreSchemaStore produceCoreSchemaStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return classpathCoreSchemaStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneCoreSchemaStore.get();
         } else {
             return mongoCoreSchemaStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/DecoratorStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/DecoratorStoreProducer.java
index 2975ca03b..eaaf8ba9e 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/DecoratorStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/DecoratorStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.DecoratorStore;
+import org.finos.calm.store.github.GitHubDecoratorStore;
 import org.finos.calm.store.mongo.MongoDecoratorStore;
 import org.finos.calm.store.nitrite.NitriteDecoratorStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for DecoratorStore implementations.
- * Selects the appropriate implementation based on the configured database mode.
- */
 @ApplicationScoped
 public class DecoratorStoreProducer {
 
@@ -24,19 +22,20 @@ public class DecoratorStoreProducer {
     Instance<MongoDecoratorStore> mongoDecoratorStore;
 
     @Inject
-    Instance<NitriteDecoratorStore> nitriteDecoratorStore;
+    Instance<NitriteDecoratorStore> standaloneDecoratorStore;
+
+    @Inject
+    Instance<GitHubDecoratorStore> gitHubDecoratorStore;
 
-    /**
-     * Produces the appropriate DecoratorStore implementation based on the configured database mode.
-     *
-     * @return the DecoratorStore implementation
-     */
     @Produces
     @ApplicationScoped
     public DecoratorStore produceDecoratorStore() {
-        if ("standalone".equals(databaseMode)) {
-            return nitriteDecoratorStore.get();
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubDecoratorStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
+            return standaloneDecoratorStore.get();
+        } else {
+            return mongoDecoratorStore.get();
         }
-        return mongoDecoratorStore.get();
     }
 }
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/DomainStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/DomainStoreProducer.java
index 594a7fb72..9801e4688 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/DomainStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/DomainStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.DomainStore;
+import org.finos.calm.store.github.GitHubDomainStore;
 import org.finos.calm.store.mongo.MongoDomainStore;
 import org.finos.calm.store.nitrite.NitriteDomainStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for DomainStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class DomainStoreProducer {
 
@@ -26,15 +24,15 @@ public class DomainStoreProducer {
     @Inject
     Instance<NitriteDomainStore> standaloneDomainStore;
 
-    /**
-     * Produces the appropriate DomainStore implementation based on the configured database mode.
-     *
-     * @return the DomainStore implementation
-     */
+    @Inject
+    Instance<GitHubDomainStore> gitHubDomainStore;
+
     @Produces
     @ApplicationScoped
     public DomainStore produceDomainStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubDomainStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneDomainStore.get();
         } else {
             return mongoDomainStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/FlowStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/FlowStoreProducer.java
index a6c7e57c5..bea577e8b 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/FlowStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/FlowStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.FlowStore;
+import org.finos.calm.store.github.GitHubFlowStore;
 import org.finos.calm.store.mongo.MongoFlowStore;
 import org.finos.calm.store.nitrite.NitriteFlowStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for FlowStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class FlowStoreProducer {
 
@@ -26,18 +24,18 @@ public class FlowStoreProducer {
     @Inject
     Instance<NitriteFlowStore> standaloneFlowStore;
 
-    /**
-     * Produces the appropriate FlowStore implementation based on the configured database mode.
-     *
-     * @return the FlowStore implementation
-     */
+    @Inject
+    Instance<GitHubFlowStore> gitHubFlowStore;
+
     @Produces
     @ApplicationScoped
     public FlowStore produceFlowStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubFlowStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneFlowStore.get();
         } else {
             return mongoFlowStore.get();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/InterfaceStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/InterfaceStoreProducer.java
index c9aab3602..81901592d 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/InterfaceStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/InterfaceStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.InterfaceStore;
+import org.finos.calm.store.github.GitHubInterfaceStore;
 import org.finos.calm.store.mongo.MongoInterfaceStore;
 import org.finos.calm.store.nitrite.NitriteInterfaceStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for InterfaceStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class InterfaceStoreProducer {
 
@@ -26,15 +24,15 @@ public class InterfaceStoreProducer {
     @Inject
     Instance<NitriteInterfaceStore> standaloneInterfaceStore;
 
-    /**
-     * Produces the appropriate InterfaceStore implementation based on the configured database mode.
-     *
-     * @return the InterfaceStore implementation
-     */
+    @Inject
+    Instance<GitHubInterfaceStore> gitHubInterfaceStore;
+
     @Produces
     @ApplicationScoped
     public InterfaceStore produceInterfaceStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubInterfaceStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneInterfaceStore.get();
         } else {
             return mongoInterfaceStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/LayoutStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/LayoutStoreProducer.java
index 2d2db0023..1a32fbc5e 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/LayoutStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/LayoutStoreProducer.java
@@ -5,14 +5,12 @@
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.LayoutStore;
+import org.finos.calm.store.github.GitHubLayoutStore;
 import org.finos.calm.store.mongo.MongoLayoutStore;
 import org.finos.calm.store.nitrite.NitriteLayoutStore;
 
-/**
- * Producer for LayoutStore implementations.
- * Selects the appropriate implementation based on the configured database mode.
- */
 @ApplicationScoped
 public class LayoutStoreProducer {
 
@@ -24,19 +22,20 @@ public class LayoutStoreProducer {
     Instance<MongoLayoutStore> mongoLayoutStore;
 
     @Inject
-    Instance<NitriteLayoutStore> nitriteLayoutStore;
+    Instance<NitriteLayoutStore> standaloneLayoutStore;
+
+    @Inject
+    Instance<GitHubLayoutStore> gitHubLayoutStore;
 
-    /**
-     * Produces the appropriate LayoutStore implementation based on the configured database mode.
-     *
-     * @return the LayoutStore implementation
-     */
     @Produces
     @ApplicationScoped
     public LayoutStore produceLayoutStore() {
-        if ("standalone".equals(databaseMode)) {
-            return nitriteLayoutStore.get();
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubLayoutStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
+            return standaloneLayoutStore.get();
+        } else {
+            return mongoLayoutStore.get();
         }
-        return mongoLayoutStore.get();
     }
 }
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/NamespaceStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/NamespaceStoreProducer.java
index 22bd0fd50..8516ba96c 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/NamespaceStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/NamespaceStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.NamespaceStore;
+import org.finos.calm.store.github.GitHubNamespaceStore;
 import org.finos.calm.store.mongo.MongoNamespaceStore;
 import org.finos.calm.store.nitrite.NitriteNamespaceStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for NamespaceStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class NamespaceStoreProducer {
 
@@ -26,15 +24,15 @@ public class NamespaceStoreProducer {
     @Inject
     Instance<NitriteNamespaceStore> standaloneNamespaceStore;
 
-    /**
-     * Produces the appropriate NamespaceStore implementation based on the configured database mode.
-     *
-     * @return the NamespaceStore implementation
-     */
+    @Inject
+    Instance<GitHubNamespaceStore> gitHubNamespaceStore;
+
     @Produces
     @ApplicationScoped
     public NamespaceStore produceNamespaceStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubNamespaceStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneNamespaceStore.get();
         } else {
             return mongoNamespaceStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/PatternStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/PatternStoreProducer.java
index e271e4b7f..7b606cd7b 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/PatternStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/PatternStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.PatternStore;
+import org.finos.calm.store.github.GitHubPatternStore;
 import org.finos.calm.store.mongo.MongoPatternStore;
 import org.finos.calm.store.nitrite.NitritePatternStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for PatternStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class PatternStoreProducer {
 
@@ -26,15 +24,15 @@ public class PatternStoreProducer {
     @Inject
     Instance<NitritePatternStore> standalonePatternStore;
 
-    /**
-     * Produces the appropriate PatternStore implementation based on the configured database mode.
-     *
-     * @return the PatternStore implementation
-     */
+    @Inject
+    Instance<GitHubPatternStore> gitHubPatternStore;
+
     @Produces
     @ApplicationScoped
     public PatternStore producePatternStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubPatternStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standalonePatternStore.get();
         } else {
             return mongoPatternStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/ResourceMappingStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/ResourceMappingStoreProducer.java
index a49129735..d947cd671 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/ResourceMappingStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/ResourceMappingStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ResourceMappingStore;
+import org.finos.calm.store.github.GitHubResourceMappingStore;
 import org.finos.calm.store.mongo.MongoResourceMappingStore;
 import org.finos.calm.store.nitrite.NitriteResourceMappingStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for ResourceMappingStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class ResourceMappingStoreProducer {
 
@@ -26,10 +24,15 @@ public class ResourceMappingStoreProducer {
     @Inject
     Instance<NitriteResourceMappingStore> standaloneResourceMappingStore;
 
+    @Inject
+    Instance<GitHubResourceMappingStore> gitHubResourceMappingStore;
+
     @Produces
     @ApplicationScoped
     public ResourceMappingStore produceResourceMappingStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubResourceMappingStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneResourceMappingStore.get();
         } else {
             return mongoResourceMappingStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/SchemaVersionStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/SchemaVersionStoreProducer.java
index fdcbf7d24..e5721dfc2 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/SchemaVersionStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/SchemaVersionStoreProducer.java
@@ -5,14 +5,12 @@
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.SchemaVersionStore;
 import org.finos.calm.store.mongo.MongoSchemaVersionStore;
 import org.finos.calm.store.nitrite.NitriteSchemaVersionStore;
+import org.finos.calm.store.noop.NoOpSchemaVersionStore;
 
-/**
- * Producer for {@link SchemaVersionStore} implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class SchemaVersionStoreProducer {
 
@@ -26,15 +24,15 @@ public class SchemaVersionStoreProducer {
     @Inject
     Instance<NitriteSchemaVersionStore> standaloneSchemaVersionStore;
 
-    /**
-     * Produces the appropriate SchemaVersionStore implementation based on the configured database mode.
-     *
-     * @return the SchemaVersionStore implementation
-     */
+    @Inject
+    Instance<NoOpSchemaVersionStore> noOpSchemaVersionStore;
+
     @Produces
     @ApplicationScoped
     public SchemaVersionStore produceSchemaVersionStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return noOpSchemaVersionStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneSchemaVersionStore.get();
         } else {
             return mongoSchemaVersionStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/SearchStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/SearchStoreProducer.java
index 681a60cf6..596e7d58c 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/SearchStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/SearchStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.SearchStore;
+import org.finos.calm.store.github.GitHubSearchStore;
 import org.finos.calm.store.mongo.MongoSearchStore;
 import org.finos.calm.store.nitrite.NitriteSearchStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for SearchStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class SearchStoreProducer {
 
@@ -26,15 +24,15 @@ public class SearchStoreProducer {
     @Inject
     Instance<NitriteSearchStore> standaloneSearchStore;
 
-    /**
-     * Produces the appropriate SearchStore implementation based on the configured database mode.
-     *
-     * @return the SearchStore implementation
-     */
+    @Inject
+    Instance<GitHubSearchStore> gitHubSearchStore;
+
     @Produces
     @ApplicationScoped
     public SearchStore produceSearchStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubSearchStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneSearchStore.get();
         } else {
             return mongoSearchStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/StandardStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/StandardStoreProducer.java
index 36e70a55d..ca47199fa 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/StandardStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/StandardStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.StandardStore;
+import org.finos.calm.store.github.GitHubStandardStore;
 import org.finos.calm.store.mongo.MongoStandardStore;
 import org.finos.calm.store.nitrite.NitriteStandardStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for PatternStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class StandardStoreProducer {
 
@@ -26,18 +24,18 @@ public class StandardStoreProducer {
     @Inject
     Instance<NitriteStandardStore> standaloneStandardStore;
 
-    /**
-     * Produces the appropriate PatternStore implementation based on the configured database mode.
-     *
-     * @return the PatternStore implementation
-     */
+    @Inject
+    Instance<GitHubStandardStore> gitHubStandardStore;
+
     @Produces
     @ApplicationScoped
     public StandardStore produceStandardStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubStandardStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneStandardStore.get();
         } else {
             return mongoStandardStore.get();
         }
     }
-}
\ No newline at end of file
+}
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/TimelineStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/TimelineStoreProducer.java
index 203e2dd8d..2f7856cf8 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/TimelineStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/TimelineStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.TimelineStore;
+import org.finos.calm.store.github.GitHubTimelineStore;
 import org.finos.calm.store.mongo.MongoTimelineStore;
 import org.finos.calm.store.nitrite.NitriteTimelineStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for TimelineStore implementations.
- * This class provides either the MongoDB or NitriteDB implementation based on configuration.
- */
 @ApplicationScoped
 public class TimelineStoreProducer {
 
@@ -26,15 +24,15 @@ public class TimelineStoreProducer {
     @Inject
     Instance<NitriteTimelineStore> standaloneTimelineStore;
 
-    /**
-     * Produces the appropriate TimelineStore implementation based on the configured database mode.
-     *
-     * @return the TimelineStore implementation
-     */
+    @Inject
+    Instance<GitHubTimelineStore> gitHubTimelineStore;
+
     @Produces
     @ApplicationScoped
     public TimelineStore produceTimelineStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubTimelineStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneTimelineStore.get();
         } else {
             return mongoTimelineStore.get();
diff --git a/calm-hub/src/main/java/org/finos/calm/store/producer/UserAccessStoreProducer.java b/calm-hub/src/main/java/org/finos/calm/store/producer/UserAccessStoreProducer.java
index 7ae431cf6..575e2721a 100644
--- a/calm-hub/src/main/java/org/finos/calm/store/producer/UserAccessStoreProducer.java
+++ b/calm-hub/src/main/java/org/finos/calm/store/producer/UserAccessStoreProducer.java
@@ -1,18 +1,16 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
 import jakarta.enterprise.inject.Produces;
 import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.UserAccessStore;
+import org.finos.calm.store.github.GitHubUserAccessStore;
 import org.finos.calm.store.mongo.MongoUserAccessStore;
 import org.finos.calm.store.nitrite.NitriteUserAccessStore;
-import jakarta.enterprise.inject.Instance;
 
-/**
- * Producer for UserAccessStore implementations.
- * Selects the appropriate implementation based on the configured database mode.
- */
 @ApplicationScoped
 public class UserAccessStoreProducer {
 
@@ -26,15 +24,15 @@ public class UserAccessStoreProducer {
     @Inject
     Instance<NitriteUserAccessStore> standaloneUserAccessStore;
 
-    /**
-     * Produces the appropriate UserAccessStore implementation based on the configured database mode.
-     *
-     * @return the UserAccessStore implementation
-     */
+    @Inject
+    Instance<GitHubUserAccessStore> gitHubUserAccessStore;
+
     @Produces
     @ApplicationScoped
     public UserAccessStore produceUserAccessStore() {
-        if ("standalone".equals(databaseMode)) {
+        if (DatabaseMode.GITHUB.equals(databaseMode)) {
+            return gitHubUserAccessStore.get();
+        } else if (DatabaseMode.STANDALONE.equals(databaseMode)) {
             return standaloneUserAccessStore.get();
         } else {
             return mongoUserAccessStore.get();
diff --git a/calm-hub/src/main/resources/application-oidc.properties b/calm-hub/src/main/resources/application-oidc.properties
new file mode 100644
index 000000000..df19212d3
--- /dev/null
+++ b/calm-hub/src/main/resources/application-oidc.properties
@@ -0,0 +1,54 @@
+# OIDC profile — works with ANY compliant IdP (Entra ID, Keycloak, Okta, generic).
+# Activate with: -Dquarkus.profile=oidc
+
+# Auth enabled, OIDC token validation active
+calm.auth.enabled=true
+quarkus.oidc.tenant-enabled=true
+
+# OIDC discovery — set these via environment variables
+quarkus.oidc.auth-server-url=${CALM_OIDC_ISSUER_URL}
+quarkus.oidc.client-id=${CALM_OIDC_CLIENT_ID}
+quarkus.oidc.token.principal-claim=${CALM_OIDC_USERNAME_CLAIM:preferred_username}
+# Validate token audience and issuer against the configured client/IdP
+quarkus.oidc.token.audience=${CALM_OIDC_CLIENT_ID}
+quarkus.oidc.token.issuer=${CALM_OIDC_ISSUER_URL}
+
+# Frontend routing — tells the UI which OIDC library to load
+calm.oidc.provider=${CALM_OIDC_PROVIDER:generic-oidc}
+calm.oidc.scopes=${CALM_OIDC_SCOPES:openid profile email}
+
+# GitHub storage backend (only relevant when calm.database.mode=github)
+calm.github.service-token=${CALM_GITHUB_SERVICE_TOKEN:}
+calm.github.clone-directory=${CALM_GITHUB_CLONE_DIR:/tmp/calm-hub-clones}
+calm.github.sync-interval=${CALM_GITHUB_SYNC_INTERVAL:900}
+calm.github.api-url=${CALM_GITHUB_API_URL:https://api.github.com}
+
+
+# Map the "groups" claim from the ID token to SecurityIdentity roles
+quarkus.oidc.roles.role-claim-path=groups
+
+# Global fallback: semicolon-separated groups that grant access (used when namespace config has no groups)
+calm.oidc.roles.access=${CALM_OIDC_ROLES_ACCESS:}
+
+
+# Base URL for constructing callback URIs (override in production)
+calm.hub.base-url=${CALM_HUB_BASE_URL:http://localhost:8080}
+
+# Public endpoints (accessible before login or as full-page navigations)
+quarkus.http.auth.permission.public.paths=/api/calm/auth/config,/api/calm/auth/plugin-login,/api/calm/auth/plugin-callback
+quarkus.http.auth.permission.public.policy=permit
+
+# Safety net — require authentication on all other API paths
+quarkus.http.auth.permission.api.paths=/api/calm/*
+quarkus.http.auth.permission.api.policy=authenticated
+quarkus.http.auth.permission.calm.paths=/calm/*
+quarkus.http.auth.permission.calm.policy=authenticated
+quarkus.http.auth.permission.mcp-tools.paths=/mcp/*
+quarkus.http.auth.permission.mcp-tools.policy=authenticated
+
+# Dev-only CORS (SPA on Vite :5173 → Quarkus :8080)
+%dev.quarkus.http.cors=true
+%dev.quarkus.http.cors.origins=http://localhost:5173
+%dev.quarkus.http.cors.methods=GET,POST,PUT,DELETE,OPTIONS
+%dev.quarkus.http.cors.headers=Authorization,Content-Type
+%dev.quarkus.http.cors.access-control-allow-credentials=true
diff --git a/calm-hub/src/main/resources/application.properties b/calm-hub/src/main/resources/application.properties
index bb30515be..d8aeada37 100644
--- a/calm-hub/src/main/resources/application.properties
+++ b/calm-hub/src/main/resources/application.properties
@@ -17,6 +17,10 @@ calm.standalone.seed-demo-data=false
 # Read-only mode: when true, opens Nitrite with readOnly(true) and rejects mutating HTTP verbs
 calm.readonly=false
 
+# GitHub HTTP client timeouts (seconds) — applies when calm.database.mode=github
+calm.github.http.connect-timeout=${CALM_GITHUB_HTTP_CONNECT_TIMEOUT:10}
+calm.github.http.request-timeout=${CALM_GITHUB_HTTP_REQUEST_TIMEOUT:30}
+
 # Audit logging: independently toggle persistence to the auditLogs store and
 # emission of a structured log line under the org.finos.calm.audit category.
 # Both default to true. sourceIp capture defaults to false and has its own
@@ -155,4 +159,18 @@ calm.mcp.enabled=false
 # Log every JSON-RPC message in dev mode for easier debugging of MCP clients.
 %dev.quarkus.mcp.server.traffic-logging=true
 quarkus.log.category."org.finos.calm".level=DEBUG
-quarkus.log.category."org.mongodb.driver".level=OFF
\ No newline at end of file
+quarkus.log.category."org.mongodb.driver".level=OFF
+
+# OpenTelemetry — disabled by default, enable via CALM_OTEL_ENABLED=true in production
+quarkus.otel.service.name=${OTEL_SERVICE_NAME:calm-hub}
+quarkus.otel.enabled=${CALM_OTEL_ENABLED:false}
+quarkus.otel.exporter.otlp.endpoint=${OTEL_EXPORTER_OTLP_ENDPOINT:http://localhost:4317}
+quarkus.otel.traces.sampler=parentbased_traceidratio
+quarkus.otel.traces.sampler.arg=${CALM_OTEL_SAMPLING_RATIO:1.0}
+quarkus.micrometer.enabled=true
+quarkus.micrometer.binder.http-server.enabled=${CALM_OTEL_METRICS_ENABLED:false}
+quarkus.micrometer.binder.http-client.enabled=${CALM_OTEL_METRICS_ENABLED:false}
+
+
+# Test profile: disable OTEL/Micrometer to avoid noise
+%test.quarkus.otel.enabled=false
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/cache/TestCaffeineCacheServiceShould.java b/calm-hub/src/test/java/org/finos/calm/cache/TestCaffeineCacheServiceShould.java
new file mode 100644
index 000000000..b604bc8ab
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/cache/TestCaffeineCacheServiceShould.java
@@ -0,0 +1,147 @@
+package org.finos.calm.cache;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.time.Duration;
+import java.util.Optional;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+
+class TestCaffeineCacheServiceShould {
+
+    private CaffeineCacheService cacheService;
+
+    @BeforeEach
+    void setup() {
+        cacheService = new CaffeineCacheService();
+    }
+
+    @Test
+    void return_empty_for_missing_key() {
+        Optional<String> result = cacheService.get("nonexistent", String.class);
+        assertThat(result.isEmpty(), is(true));
+    }
+
+    @Test
+    void store_and_retrieve_value() {
+        cacheService.put("key1", "value1", Duration.ofMinutes(5));
+        Optional<String> result = cacheService.get("key1", String.class);
+        assertThat(result.isPresent(), is(true));
+        assertThat(result.get(), equalTo("value1"));
+    }
+
+    @Test
+    void store_and_retrieve_different_types() {
+        cacheService.put("string-key", "hello", Duration.ofMinutes(5));
+        cacheService.put("int-key", 42, Duration.ofMinutes(5));
+
+        assertThat(cacheService.get("string-key", String.class).orElse(null), equalTo("hello"));
+        assertThat(cacheService.get("int-key", Integer.class).orElse(null), equalTo(42));
+    }
+
+    @Test
+    void return_empty_when_type_does_not_match() {
+        cacheService.put("key", "string-value", Duration.ofMinutes(5));
+        Optional<Integer> result = cacheService.get("key", Integer.class);
+        assertThat(result.isEmpty(), is(true));
+    }
+
+    @Test
+    void evict_single_key() {
+        cacheService.put("key1", "value1", Duration.ofMinutes(5));
+        cacheService.put("key2", "value2", Duration.ofMinutes(5));
+
+        cacheService.evict("key1");
+
+        assertThat(cacheService.get("key1", String.class).isEmpty(), is(true));
+        assertThat(cacheService.get("key2", String.class).isPresent(), is(true));
+    }
+
+    @Test
+    void evict_by_prefix() {
+        cacheService.put("ns:finos:arch:1", "arch1", Duration.ofMinutes(5));
+        cacheService.put("ns:finos:arch:2", "arch2", Duration.ofMinutes(5));
+        cacheService.put("ns:finos:pattern:1", "pattern1", Duration.ofMinutes(5));
+        cacheService.put("ns:other:arch:1", "other-arch1", Duration.ofMinutes(5));
+
+        cacheService.evictByPrefix("ns:finos:arch:");
+
+        assertThat(cacheService.get("ns:finos:arch:1", String.class).isEmpty(), is(true));
+        assertThat(cacheService.get("ns:finos:arch:2", String.class).isEmpty(), is(true));
+        assertThat(cacheService.get("ns:finos:pattern:1", String.class).isPresent(), is(true));
+        assertThat(cacheService.get("ns:other:arch:1", String.class).isPresent(), is(true));
+    }
+
+    @Test
+    void expire_entries_after_ttl() throws InterruptedException {
+        cacheService.put("short-lived", "value", Duration.ofMillis(50));
+
+        assertThat(cacheService.get("short-lived", String.class).isPresent(), is(true));
+
+        Thread.sleep(100);
+        cacheService.put("trigger-cleanup", "x", Duration.ofMinutes(1));
+
+        Optional<String> result = cacheService.get("short-lived", String.class);
+        assertThat(result.isEmpty(), is(true));
+    }
+
+    @Test
+    void overwrite_existing_key_with_new_value_and_ttl() {
+        cacheService.put("key", "original", Duration.ofMinutes(5));
+        cacheService.put("key", "updated", Duration.ofMinutes(10));
+
+        Optional<String> result = cacheService.get("key", String.class);
+        assertThat(result.isPresent(), is(true));
+        assertThat(result.get(), equalTo("updated"));
+    }
+
+    @Test
+    void handle_concurrent_access_safely() throws InterruptedException {
+        int threadCount = 10;
+        int iterationsPerThread = 100;
+        ExecutorService executor = Executors.newFixedThreadPool(threadCount);
+        CountDownLatch latch = new CountDownLatch(threadCount);
+
+        for (int t = 0; t < threadCount; t++) {
+            final int threadId = t;
+            executor.submit(() -> {
+                try {
+                    for (int i = 0; i < iterationsPerThread; i++) {
+                        String key = "thread-" + threadId + "-key-" + i;
+                        cacheService.put(key, "value-" + i, Duration.ofMinutes(5));
+                        cacheService.get(key, String.class);
+                    }
+                } finally {
+                    latch.countDown();
+                }
+            });
+        }
+
+        boolean completed = latch.await(10, TimeUnit.SECONDS);
+        executor.shutdown();
+        assertThat(completed, is(true));
+    }
+
+    @Test
+    void evict_by_prefix_when_no_keys_match() {
+        cacheService.put("other:key", "value", Duration.ofMinutes(5));
+
+        cacheService.evictByPrefix("nonexistent:");
+
+        assertThat(cacheService.get("other:key", String.class).isPresent(), is(true));
+    }
+
+    @Test
+    void handle_null_value_gracefully() {
+        cacheService.put("null-key", null, Duration.ofMinutes(5));
+        Optional<Object> result = cacheService.get("null-key", Object.class);
+        assertThat(result.isEmpty(), is(true));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/domain/exception/TestPendingWriteExceptionShould.java b/calm-hub/src/test/java/org/finos/calm/domain/exception/TestPendingWriteExceptionShould.java
new file mode 100644
index 000000000..a82e87302
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/domain/exception/TestPendingWriteExceptionShould.java
@@ -0,0 +1,38 @@
+package org.finos.calm.domain.exception;
+
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
+
+class TestPendingWriteExceptionShould {
+
+    @Test
+    void carry_pr_url() {
+        PendingWriteException ex = new PendingWriteException("https://github.com/org/repo/pull/7", 7, "calm-hub/pattern-xyz");
+
+        assertThat(ex.getPullRequestUrl(), equalTo("https://github.com/org/repo/pull/7"));
+    }
+
+    @Test
+    void carry_pr_number() {
+        PendingWriteException ex = new PendingWriteException("https://github.com/org/repo/pull/7", 7, "calm-hub/pattern-xyz");
+
+        assertThat(ex.getPullRequestNumber(), equalTo(7));
+    }
+
+    @Test
+    void carry_branch_name() {
+        PendingWriteException ex = new PendingWriteException("https://github.com/org/repo/pull/7", 7, "calm-hub/pattern-xyz");
+
+        assertThat(ex.getBranch(), equalTo("calm-hub/pattern-xyz"));
+    }
+
+    @Test
+    void include_pr_number_in_message() {
+        PendingWriteException ex = new PendingWriteException("https://github.com/org/repo/pull/42", 42, "branch");
+
+        assertThat(ex.getMessage(), containsString("42"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/observability/TestGitHubMetricsShould.java b/calm-hub/src/test/java/org/finos/calm/observability/TestGitHubMetricsShould.java
new file mode 100644
index 000000000..1d3ec5e51
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/observability/TestGitHubMetricsShould.java
@@ -0,0 +1,98 @@
+package org.finos.calm.observability;
+
+import io.micrometer.core.instrument.Counter;
+import io.micrometer.core.instrument.Gauge;
+import io.micrometer.core.instrument.Timer;
+import io.micrometer.core.instrument.simple.SimpleMeterRegistry;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.time.Duration;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.closeTo;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.greaterThan;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+
+class TestGitHubMetricsShould {
+
+    private SimpleMeterRegistry registry;
+    private GitHubMetrics metrics;
+
+    @BeforeEach
+    void setup() {
+        registry = new SimpleMeterRegistry();
+        metrics = new GitHubMetrics(registry);
+    }
+
+    @Test
+    void record_sync_success_counter() {
+        metrics.recordSyncSuccess(Duration.ofSeconds(2));
+        metrics.recordSyncSuccess(Duration.ofSeconds(1));
+
+        Counter counter = registry.find("calm.github.sync").tag("outcome", "success").counter();
+        assertThat(counter, is(notNullValue()));
+        assertThat(counter.count(), equalTo(2.0));
+    }
+
+    @Test
+    void record_sync_failure_counter() {
+        metrics.recordSyncFailure(Duration.ofSeconds(5));
+
+        Counter counter = registry.find("calm.github.sync").tag("outcome", "failure").counter();
+        assertThat(counter, is(notNullValue()));
+        assertThat(counter.count(), equalTo(1.0));
+    }
+
+    @Test
+    void record_sync_duration_timer() {
+        metrics.recordSyncSuccess(Duration.ofMillis(500));
+        metrics.recordSyncFailure(Duration.ofMillis(1500));
+
+        Timer timer = registry.find("calm.github.sync.duration").timer();
+        assertThat(timer, is(notNullValue()));
+        assertThat(timer.count(), equalTo(2L));
+        assertThat(timer.totalTime(java.util.concurrent.TimeUnit.MILLISECONDS), closeTo(2000.0, 50.0));
+    }
+
+    @Test
+    void record_registry_rebuild_duration() {
+        metrics.recordRegistryRebuild(Duration.ofMillis(200));
+
+        Timer timer = registry.find("calm.github.registry.rebuild.duration").timer();
+        assertThat(timer, is(notNullValue()));
+        assertThat(timer.count(), equalTo(1L));
+    }
+
+    @Test
+    void update_last_sync_success_epoch_on_success() {
+        long beforeEpoch = System.currentTimeMillis() / 1000;
+        metrics.recordSyncSuccess(Duration.ofMillis(100));
+
+        Gauge gauge = registry.find("calm.github.sync.last_success_epoch_seconds").gauge();
+        assertThat(gauge, is(notNullValue()));
+        assertThat((long) gauge.value(), greaterThan(beforeEpoch - 1));
+    }
+
+    @Test
+    void not_update_last_sync_success_epoch_on_failure() {
+        metrics.recordSyncFailure(Duration.ofMillis(100));
+
+        Gauge gauge = registry.find("calm.github.sync.last_success_epoch_seconds").gauge();
+        assertThat(gauge, is(notNullValue()));
+        assertThat(gauge.value(), equalTo(0.0));
+    }
+
+    @Test
+    void create_content_detected_counter() {
+        Counter counter = metrics.contentDetectedCounter(registry, "architecture");
+        assertThat(counter, is(notNullValue()));
+        counter.increment();
+
+        Counter found = registry.find("calm.github.content.detected").tag("type", "architecture").counter();
+        assertThat(found, is(notNullValue()));
+        assertThat(found.count(), equalTo(1.0));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java
new file mode 100644
index 000000000..24f9c0032
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestAuthConfigResourceShould.java
@@ -0,0 +1,118 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.Response;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+
+class TestAuthConfigResourceShould {
+
+    private AuthConfigResource resource;
+
+    @BeforeEach
+    void setup() {
+        resource = new AuthConfigResource();
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_disabled_config_when_oidc_off() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.empty();
+        resource.oidcAuthority = Optional.empty();
+        resource.oidcClientId = Optional.empty();
+        resource.oidcScopes = Optional.empty();
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(false));
+        assertThat(body.get("databaseMode"), equalTo("mongo"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_full_config_for_entra_id_with_github_mode() {
+        resource.oidcTenantEnabled = true;
+        resource.databaseMode = "github";
+        resource.oidcProvider = Optional.of("entra-id");
+        resource.oidcAuthority = Optional.of("https://login.microsoftonline.com/tenant-id/v2.0");
+        resource.oidcClientId = Optional.of("client-123");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(true));
+        assertThat(oidc.get("provider"), equalTo("entra-id"));
+        assertThat(oidc.get("authority"), equalTo("https://login.microsoftonline.com/tenant-id/v2.0"));
+        assertThat(oidc.get("clientId"), equalTo("client-123"));
+        assertThat(oidc.get("redirectUri"), equalTo("/"));
+
+        assertThat(body.get("databaseMode"), equalTo("github"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_oidc_config_for_mongo_mode() {
+        resource.oidcTenantEnabled = true;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.of("keycloak");
+        resource.oidcAuthority = Optional.of("https://keycloak.example.com/realms/calm");
+        resource.oidcClientId = Optional.of("calm-hub-spa");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(true));
+        assertThat(oidc.get("provider"), equalTo("keycloak"));
+        assertThat(body.get("databaseMode"), equalTo("mongo"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void not_include_oidc_details_when_disabled() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "standalone";
+        resource.oidcProvider = Optional.of("entra-id");
+        resource.oidcAuthority = Optional.of("https://login.microsoftonline.com/tenant/v2.0");
+        resource.oidcClientId = Optional.of("client-123");
+        resource.oidcScopes = Optional.of("openid profile email");
+
+        Response response = resource.getAuthConfig();
+
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        Map<String, Object> oidc = (Map<String, Object>) body.get("oidc");
+        assertThat(oidc.get("enabled"), equalTo(false));
+        assertThat(oidc.containsKey("provider"), is(false));
+        assertThat(oidc.containsKey("authority"), is(false));
+    }
+
+    @Test
+    void always_return_200() {
+        resource.oidcTenantEnabled = false;
+        resource.databaseMode = "mongo";
+        resource.oidcProvider = Optional.empty();
+        resource.oidcAuthority = Optional.empty();
+        resource.oidcClientId = Optional.empty();
+        resource.oidcScopes = Optional.empty();
+
+        Response response = resource.getAuthConfig();
+
+        assertThat(response.getStatus(), equalTo(200));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestControlResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestControlResourceShould.java
index 2e8e39934..6fa7da710 100644
--- a/calm-hub/src/test/java/org/finos/calm/resources/TestControlResourceShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestControlResourceShould.java
@@ -23,6 +23,7 @@
 import static io.restassured.RestAssured.given;
 import static org.finos.calm.resources.ResourceValidationConstants.DOMAIN_MESSAGE;
 import static org.finos.calm.resources.ResourceValidationConstants.VERSION_MESSAGE;
+import static org.finos.calm.resources.ResourceValidationConstants.VERSION_OR_SHA_MESSAGE;
 import static org.hamcrest.Matchers.*;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.*;
@@ -204,7 +205,7 @@ void return_a_400_when_an_invalid_format_of_version_is_provided_on_get_requireme
                 .get("/api/calm/domains/" + VALID_DOMAIN + "/controls/1/requirement/versions/1.0.invalid0")
                 .then()
                 .statusCode(400)
-                .body(containsString(VERSION_MESSAGE));
+                .body(containsString(VERSION_OR_SHA_MESSAGE));
     }
 
     static Stream<Arguments> provideParametersForGetRequirementTests() {
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceFilteringShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceFilteringShould.java
index a82d5bfa4..557c1c726 100644
--- a/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceFilteringShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestNamespaceResourceFilteringShould.java
@@ -13,6 +13,10 @@
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 
+import org.finos.calm.domain.UserAccess;
+import org.finos.calm.domain.namespaces.NamespaceInfo;
+import org.finos.calm.store.UserAccessStore;
+
 import java.security.Principal;
 import java.util.List;
 import java.util.Optional;
@@ -22,6 +26,7 @@
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -105,6 +110,51 @@ void pass_empty_optional_when_validator_not_resolvable() {
         assertFalse(captor.getValue().isPresent());
     }
 
+    @Test
+    void filter_namespaces_via_store_fallback_when_validator_not_resolvable() {
+        when(mockValidatorInstance.isResolvable()).thenReturn(false);
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("testuser");
+
+        UserAccessStore mockUserAccessStore = mock(UserAccessStore.class);
+        UserAccess grant = new UserAccess("testuser", UserAccess.Permission.read, "finos");
+        when(mockUserAccessStore.getGrantsForUser("testuser")).thenReturn(List.of(grant));
+
+        when(mockNamespaceService.getNamespaces()).thenReturn(List.of(
+                new NamespaceInfo("finos", "FINOS"),
+                new NamespaceInfo("private", "Private")
+        ));
+
+        NamespaceResource resource = new NamespaceResource(mockNamespaceService, mockCountsService, mockValidatorInstance);
+        resource.identity = mockIdentity;
+        resource.authEnabled = true;
+        resource.userAccessStore = mockUserAccessStore;
+
+        var result = resource.namespaces();
+        assertEquals(1, result.getValues().size());
+        assertEquals("finos", result.getValues().get(0).getName());
+    }
+
+    @Test
+    void return_all_namespaces_when_store_fallback_has_null_store() {
+        when(mockValidatorInstance.isResolvable()).thenReturn(false);
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+
+        when(mockNamespaceService.getNamespaces()).thenReturn(List.of(
+                new NamespaceInfo("finos", "FINOS")
+        ));
+
+        NamespaceResource resource = new NamespaceResource(mockNamespaceService, mockCountsService, mockValidatorInstance);
+        resource.identity = mockIdentity;
+        resource.authEnabled = true;
+        resource.userAccessStore = null;
+
+        var result = resource.namespaces();
+        assertEquals(1, result.getValues().size());
+    }
+
     @Test
     void pass_empty_set_when_user_has_no_namespace_grants() {
         when(mockValidatorInstance.isResolvable()).thenReturn(true);
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestPendingWriteExceptionMapperShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestPendingWriteExceptionMapperShould.java
new file mode 100644
index 000000000..c6d7af06f
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestPendingWriteExceptionMapperShould.java
@@ -0,0 +1,39 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.Response;
+import org.finos.calm.domain.exception.PendingWriteException;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+
+class TestPendingWriteExceptionMapperShould {
+
+    private final PendingWriteExceptionMapper mapper = new PendingWriteExceptionMapper();
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_202_accepted_with_pr_details() {
+        PendingWriteException ex = new PendingWriteException(
+                "https://github.com/org/repo/pull/42", 42, "calm-hub/pattern-abc-123");
+
+        Response response = mapper.toResponse(ex);
+
+        assertThat(response.getStatus(), equalTo(202));
+        Map<String, Object> body = (Map<String, Object>) response.getEntity();
+        assertThat(body.get("status"), equalTo("pending"));
+        assertThat(body.get("pullRequestUrl"), equalTo("https://github.com/org/repo/pull/42"));
+        assertThat(body.get("pullRequestNumber"), equalTo(42));
+    }
+
+    @Test
+    void return_application_json_content_type() {
+        PendingWriteException ex = new PendingWriteException("https://github.com/x/y/pull/1", 1, "branch");
+
+        Response response = mapper.toResponse(ex);
+
+        assertThat(response.getMediaType().toString(), equalTo("application/json"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java
new file mode 100644
index 000000000..f4bfe8bc5
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestPluginAuthResourceShould.java
@@ -0,0 +1,410 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.Response;
+import org.finos.calm.security.OidcPluginAuthClient;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.lang.reflect.Field;
+import java.net.URI;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestPluginAuthResourceShould {
+
+    private static final String AUTH_SERVER_URL = "https://login.microsoftonline.com/tenant-id/v2.0";
+    private static final String CLIENT_ID = "calm-hub-client";
+    private static final String CLIENT_SECRET = "super-secret";
+    private static final String HUB_BASE_URL = "http://localhost:8080";
+    private static final String SCOPES = "openid profile email";
+    private static final String AUTHORIZATION_ENDPOINT = "https://login.microsoftonline.com/tenant-id/v2.0/authorize";
+    private static final String TOKEN_ENDPOINT = "https://login.microsoftonline.com/tenant-id/v2.0/token";
+
+    @Mock
+    private OidcPluginAuthClient mockOidcClient;
+
+    private PluginAuthResource resource;
+
+    @BeforeEach
+    void setup() throws Exception {
+        resource = new PluginAuthResource();
+        setField("oidcClient", mockOidcClient);
+        setField("oidcAuthority", Optional.of(AUTH_SERVER_URL));
+        setField("oidcClientId", Optional.of(CLIENT_ID));
+
+        setField("oidcScopes", SCOPES);
+        setField("hubBaseUrl", HUB_BASE_URL);
+    }
+
+    private void setField(String name, Object value) throws Exception {
+        Field field = PluginAuthResource.class.getDeclaredField(name);
+        field.setAccessible(true);
+        field.set(resource, value);
+    }
+
+    // --- plugin-login tests ---
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_null() {
+        Response response = resource.pluginLogin(null, null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("port parameter is required"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_blank() {
+        Response response = resource.pluginLogin("  ", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("port parameter is required"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_not_a_number() {
+        Response response = resource.pluginLogin("abc", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_is_zero() {
+        Response response = resource.pluginLogin("0", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_port_exceeds_65535() {
+        Response response = resource.pluginLogin("70000", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("valid number"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_oidc_authority_is_empty() throws Exception {
+        setField("oidcAuthority", Optional.of(""));
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_oidc_authority_is_absent() throws Exception {
+        setField("oidcAuthority", Optional.empty());
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_oidc_client_id_is_empty() throws Exception {
+        setField("oidcClientId", Optional.of(""));
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC client-id is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_oidc_client_id_is_absent() throws Exception {
+        setField("oidcClientId", Optional.empty());
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC client-id is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_502_when_oidc_discovery_fails() {
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(null);
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(502));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Failed to discover OIDC endpoints"));
+    }
+
+    @Test
+    void redirect_to_oidc_authorize_endpoint_on_success() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+        URI location = (URI) response.getMetadata().getFirst("Location");
+        assertThat(location, is(notNullValue()));
+        String locationStr = location.toString();
+        assertThat(locationStr, containsString(AUTHORIZATION_ENDPOINT));
+        assertThat(locationStr, containsString("client_id=" + CLIENT_ID));
+        assertThat(locationStr, containsString("response_type=code"));
+        assertThat(locationStr, containsString("redirect_uri="));
+        assertThat(locationStr, containsString("plugin-callback"));
+        assertThat(locationStr, containsString("state="));
+    }
+
+    @Test
+    void store_pending_session_on_login() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        resource.pluginLogin("63348", null, "test-nonce");
+
+        assertThat(resource.getPendingSessions().isEmpty(), is(false));
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.port(), equalTo("63348"));
+        assertThat(session.redirectPath(), equalTo("/callback"));
+    }
+
+    @Test
+    void use_custom_redirect_path_when_provided() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        resource.pluginLogin("63348", "/auth/done", "test-nonce");
+
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.redirectPath(), equalTo("/auth/done"));
+    }
+
+    @Test
+    void use_default_redirect_path_when_redirect_path_is_blank() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        resource.pluginLogin("63348", "  ", "test-nonce");
+
+        PluginAuthResource.PendingSession session =
+                resource.getPendingSessions().values().iterator().next();
+        assertThat(session.redirectPath(), equalTo("/callback"));
+    }
+
+    @Test
+    void accept_valid_port_at_boundary_1() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginLogin("1", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+    }
+
+    @Test
+    void accept_valid_port_at_boundary_65535() {
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginLogin("65535", null, "test-nonce");
+
+        assertThat(response.getStatus(), equalTo(307));
+    }
+
+    // --- plugin-callback tests ---
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_502_when_idp_returns_error() {
+        Response response = resource.pluginCallback("code", "state", "access_denied");
+
+        assertThat(response.getStatus(), equalTo(502));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Authentication failed at identity provider"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_callback_code_is_null() {
+        Response response = resource.pluginCallback(null, "some-state", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Missing authorization code"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_callback_code_is_blank() {
+        Response response = resource.pluginCallback("  ", "some-state", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Missing authorization code"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_callback_state_is_null() {
+        Response response = resource.pluginCallback("valid-code", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Missing state parameter"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_400_when_callback_state_is_blank() {
+        Response response = resource.pluginCallback("valid-code", "  ", null);
+
+        assertThat(response.getStatus(), equalTo(400));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Missing state parameter"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_403_when_state_is_not_found_in_pending_sessions() {
+        Response response = resource.pluginCallback("valid-code", "unknown-state", null);
+
+        assertThat(response.getStatus(), equalTo(403));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Invalid or expired state"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_oidc_authority_not_configured_on_callback() throws Exception {
+        // Plant a valid pending session
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce"));
+        setField("oidcAuthority", Optional.of(""));
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_503_when_client_id_not_configured_on_callback() throws Exception {
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce"));
+        setField("oidcClientId", Optional.of(""));
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(503));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("OIDC client-id is not configured"));
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_502_when_discovery_fails_on_callback() {
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce"));
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(null);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(502));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), containsString("Failed to discover OIDC endpoints"));
+    }
+
+    @Test
+    void return_html_with_plugin_redirect_on_successful_callback() {
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce"));
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(200));
+        String html = (String) response.getEntity();
+        assertThat(html, containsString("http://localhost:63348/callback"));
+        assertThat(html, containsString("code_verifier"));
+        assertThat(html, containsString("test-verifier"));
+    }
+
+    @Test
+    void return_html_with_custom_path_on_successful_callback() {
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("9999", "/auth/done", "test-verifier", "test-nonce"));
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(200));
+        String html = (String) response.getEntity();
+        assertThat(html, containsString("http://localhost:9999/auth/done"));
+        assertThat(html, containsString("code_verifier"));
+        assertThat(html, containsString("test-verifier"));
+    }
+
+    @Test
+    void remove_state_from_pending_sessions_after_callback() {
+        resource.getPendingSessions().put("valid-state",
+                new PluginAuthResource.PendingSession("63348", "/callback", "test-verifier", "test-nonce"));
+        OidcPluginAuthClient.OidcEndpoints endpoints =
+                new OidcPluginAuthClient.OidcEndpoints(AUTHORIZATION_ENDPOINT, TOKEN_ENDPOINT);
+        when(mockOidcClient.discoverEndpoints(AUTH_SERVER_URL)).thenReturn(endpoints);
+
+        Response response = resource.pluginCallback("valid-code", "valid-state", null);
+
+        assertThat(response.getStatus(), equalTo(200));
+        assertThat(resource.getPendingSessions().containsKey("valid-state"), is(false));
+    }
+
+    @Test
+    void return_400_for_negative_port() {
+        Response response = resource.pluginLogin("-1", null, null);
+
+        assertThat(response.getStatus(), equalTo(400));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/resources/TestUnsupportedOperationExceptionMapperShould.java b/calm-hub/src/test/java/org/finos/calm/resources/TestUnsupportedOperationExceptionMapperShould.java
new file mode 100644
index 000000000..f76ea395d
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/resources/TestUnsupportedOperationExceptionMapperShould.java
@@ -0,0 +1,36 @@
+package org.finos.calm.resources;
+
+import jakarta.ws.rs.core.Response;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+
+class TestUnsupportedOperationExceptionMapperShould {
+
+    private final UnsupportedOperationExceptionMapper mapper = new UnsupportedOperationExceptionMapper();
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void return_501_with_json_body() {
+        GitHubWriteNotSupportedException ex = new GitHubWriteNotSupportedException("Not available in GitHub mode");
+
+        Response response = mapper.toResponse(ex);
+
+        assertThat(response.getStatus(), equalTo(501));
+        Map<String, String> body = (Map<String, String>) response.getEntity();
+        assertThat(body.get("error"), equalTo("Not available in GitHub mode"));
+    }
+
+    @Test
+    void return_application_json_content_type() {
+        GitHubWriteNotSupportedException ex = new GitHubWriteNotSupportedException("test");
+
+        Response response = mapper.toResponse(ex);
+
+        assertThat(response.getMediaType().toString(), equalTo("application/json"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/security/TestCalmHubPermissionCheckerShould.java b/calm-hub/src/test/java/org/finos/calm/security/TestCalmHubPermissionCheckerShould.java
index 59dcdb2c6..1da113d79 100644
--- a/calm-hub/src/test/java/org/finos/calm/security/TestCalmHubPermissionCheckerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/security/TestCalmHubPermissionCheckerShould.java
@@ -358,12 +358,12 @@ void grant_for_different_domain_denies_domain_read() {
     }
 
     @Test
-    void namespace_grant_does_not_satisfy_domain_read() {
+    void namespace_grant_satisfies_domain_read() {
         givenAuthenticatedUser("alice");
         when(mockUserAccessStore.getGrantsForUser("alice"))
                 .thenReturn(List.of(grant("alice", UserAccess.Permission.read, "payments")));
 
-        assertFalse(checker.canReadByDomain(mockIdentity, "payments"));
+        assertTrue(checker.canReadByDomain(mockIdentity, "payments"));
     }
 
     @Test
diff --git a/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java b/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java
new file mode 100644
index 000000000..362cab962
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/security/TestOidcPluginAuthClientShould.java
@@ -0,0 +1,268 @@
+package org.finos.calm.security;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Field;
+import java.net.InetSocketAddress;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+
+class TestOidcPluginAuthClientShould {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private OidcPluginAuthClient client;
+    private HttpServer server;
+    private int serverPort;
+
+    @BeforeEach
+    void setup() throws Exception {
+        client = new OidcPluginAuthClient();
+        setField("connectTimeoutSeconds", 5);
+        setField("requestTimeoutSeconds", 5);
+
+        // Start a local HTTP server for testing
+        server = HttpServer.create(new InetSocketAddress(0), 0);
+        serverPort = server.getAddress().getPort();
+        server.start();
+    }
+
+    @AfterEach
+    void teardown() {
+        if (server != null) {
+            server.stop(0);
+        }
+    }
+
+    private void setField(String name, Object value) throws Exception {
+        Field field = OidcPluginAuthClient.class.getDeclaredField(name);
+        field.setAccessible(true);
+        field.set(client, value);
+    }
+
+    // --- discoverEndpoints tests ---
+
+    @Test
+    void return_endpoints_from_valid_discovery_document() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+        discoveryDoc.put("issuer", "https://idp.example.com");
+
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDoc);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.authorizationEndpoint(), equalTo("https://idp.example.com/authorize"));
+        assertThat(result.tokenEndpoint(), equalTo("https://idp.example.com/token"));
+    }
+
+    @Test
+    void return_endpoints_when_issuer_url_has_trailing_slash() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDoc);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort + "/");
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.authorizationEndpoint(), equalTo("https://idp.example.com/authorize"));
+    }
+
+    @Test
+    void return_null_when_discovery_returns_non_200() {
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            exchange.sendResponseHeaders(500, -1);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_document_missing_authorization_endpoint() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("token_endpoint", "https://idp.example.com/token");
+
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDoc);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_document_missing_token_endpoint() {
+        ObjectNode discoveryDoc = MAPPER.createObjectNode();
+        discoveryDoc.put("authorization_endpoint", "https://idp.example.com/authorize");
+
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(discoveryDoc);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_url_is_unreachable() {
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:1");
+
+        assertThat(result, is(nullValue()));
+    }
+
+    @Test
+    void return_null_when_discovery_returns_invalid_json() {
+        server.createContext("/.well-known/openid-configuration", exchange -> {
+            byte[] body = "not-json".getBytes();
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        OidcPluginAuthClient.OidcEndpoints result =
+                client.discoverEndpoints("http://localhost:" + serverPort);
+
+        assertThat(result, is(nullValue()));
+    }
+
+    // --- exchangeCode tests ---
+
+    @Test
+    void return_access_token_on_successful_exchange() {
+        ObjectNode tokenResponse = MAPPER.createObjectNode();
+        tokenResponse.put("access_token", "eyJhbGciOi...");
+        tokenResponse.put("id_token", "id-token-value");
+        tokenResponse.put("token_type", "Bearer");
+
+        server.createContext("/token", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(tokenResponse);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        String tokenEndpoint = "http://localhost:" + serverPort + "/token";
+        OidcPluginAuthClient.TokenResponse result =
+                client.exchangeCode(tokenEndpoint, "client-id", "client-secret", "auth-code", "http://localhost:8080/callback", "test-verifier");
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.accessToken(), equalTo("eyJhbGciOi..."));
+        assertThat(result.idToken(), equalTo("id-token-value"));
+        assertThat(result.error(), is(nullValue()));
+    }
+
+    @Test
+    void return_error_when_token_endpoint_returns_non_200() {
+        server.createContext("/token", exchange -> {
+            exchange.sendResponseHeaders(400, -1);
+            exchange.close();
+        });
+
+        String tokenEndpoint = "http://localhost:" + serverPort + "/token";
+        OidcPluginAuthClient.TokenResponse result =
+                client.exchangeCode(tokenEndpoint, "client-id", "client-secret", "bad-code", "http://localhost:8080/callback", "test-verifier");
+
+        assertThat(result.accessToken(), is(nullValue()));
+        assertThat(result.error(), containsString("Token exchange failed with status 400"));
+    }
+
+    @Test
+    void return_error_when_response_missing_access_token() {
+        ObjectNode tokenResponse = MAPPER.createObjectNode();
+        tokenResponse.put("id_token", "id-token-value");
+
+        server.createContext("/token", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(tokenResponse);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        String tokenEndpoint = "http://localhost:" + serverPort + "/token";
+        OidcPluginAuthClient.TokenResponse result =
+                client.exchangeCode(tokenEndpoint, "client-id", "client-secret", "auth-code", "http://localhost:8080/callback", "test-verifier");
+
+        assertThat(result.accessToken(), is(nullValue()));
+        assertThat(result.error(), containsString("No access token in response"));
+    }
+
+    @Test
+    void return_error_when_token_endpoint_is_unreachable() {
+        OidcPluginAuthClient.TokenResponse result =
+                client.exchangeCode("http://localhost:1/token", "client-id", "client-secret", "auth-code", "http://localhost:8080/callback", "test-verifier");
+
+        assertThat(result.accessToken(), is(nullValue()));
+        assertThat(result.error(), containsString("Token exchange failed:"));
+    }
+
+    @Test
+    void return_access_token_when_id_token_is_absent() {
+        ObjectNode tokenResponse = MAPPER.createObjectNode();
+        tokenResponse.put("access_token", "access-only");
+        tokenResponse.put("token_type", "Bearer");
+
+        server.createContext("/token", exchange -> {
+            byte[] body = MAPPER.writeValueAsBytes(tokenResponse);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            exchange.getResponseBody().write(body);
+            exchange.close();
+        });
+
+        String tokenEndpoint = "http://localhost:" + serverPort + "/token";
+        OidcPluginAuthClient.TokenResponse result =
+                client.exchangeCode(tokenEndpoint, "client-id", "client-secret", "auth-code", "http://localhost:8080/callback", "test-verifier");
+
+        assertThat(result.accessToken(), equalTo("access-only"));
+        assertThat(result.idToken(), is(nullValue()));
+        assertThat(result.error(), is(nullValue()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/security/TestOidcRoleResolverShould.java b/calm-hub/src/test/java/org/finos/calm/security/TestOidcRoleResolverShould.java
new file mode 100644
index 000000000..4657e2e04
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/security/TestOidcRoleResolverShould.java
@@ -0,0 +1,112 @@
+package org.finos.calm.security;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.security.Principal;
+import java.util.Optional;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestOidcRoleResolverShould {
+
+    @Mock
+    private SecurityIdentity mockIdentity;
+
+    @Mock
+    private Principal mockPrincipal;
+
+    private OidcRoleResolver resolver;
+
+    @BeforeEach
+    void setup() {
+        resolver = new OidcRoleResolver();
+        resolver.globalAccessGroups = Optional.empty();
+    }
+
+    @Test
+    void return_none_for_null_identity() {
+        assertThat(resolver.resolve(null, Set.of("group-a")), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void return_none_for_anonymous_identity() {
+        when(mockIdentity.isAnonymous()).thenReturn(true);
+        assertThat(resolver.resolve(mockIdentity, Set.of("group-a")), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void return_none_when_no_access_groups_configured() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        resolver.globalAccessGroups = Optional.empty();
+
+        assertThat(resolver.resolve(mockIdentity, Set.of()), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void return_none_when_user_has_no_groups() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getRoles()).thenReturn(Set.of());
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("alice");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of("group-a")), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void return_none_when_user_has_null_groups() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getRoles()).thenReturn(null);
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("alice");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of("group-a")), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void return_read_when_user_group_matches() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getRoles()).thenReturn(Set.of("group-a", "group-b"));
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("alice");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of("group-b")), equalTo(OidcRoleResolver.AccessLevel.READ));
+    }
+
+    @Test
+    void return_none_when_user_group_does_not_match() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getRoles()).thenReturn(Set.of("group-x"));
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("alice");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of("group-a")), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+
+    @Test
+    void fall_back_to_global_config_when_access_groups_empty() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        when(mockIdentity.getRoles()).thenReturn(Set.of("global-group"));
+        when(mockIdentity.getPrincipal()).thenReturn(mockPrincipal);
+        when(mockPrincipal.getName()).thenReturn("alice");
+        resolver.globalAccessGroups = Optional.of("global-group;other-group");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of()), equalTo(OidcRoleResolver.AccessLevel.READ));
+    }
+
+    @Test
+    void parse_blank_global_config_as_empty() {
+        when(mockIdentity.isAnonymous()).thenReturn(false);
+        resolver.globalAccessGroups = Optional.of("   ");
+
+        assertThat(resolver.resolve(mockIdentity, Set.of()), equalTo(OidcRoleResolver.AccessLevel.NONE));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/classpath/TestClasspathCoreSchemaStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/classpath/TestClasspathCoreSchemaStoreShould.java
new file mode 100644
index 000000000..9e8ac4820
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/classpath/TestClasspathCoreSchemaStoreShould.java
@@ -0,0 +1,82 @@
+package org.finos.calm.store.classpath;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.nullValue;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class TestClasspathCoreSchemaStoreShould {
+
+    private ClasspathCoreSchemaStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new ClasspathCoreSchemaStore();
+    }
+
+    @Test
+    void return_empty_versions_when_no_index_file_present() {
+        List<String> versions = store.getVersions();
+        assertThat(versions, is(notNullValue()));
+    }
+
+    @Test
+    void return_null_for_nonexistent_version() {
+        Map<String, Object> schemas = store.getSchemasForVersion("99.99.99");
+        assertThat(schemas, is(nullValue()));
+    }
+
+    @Test
+    void throw_on_create_schema_version() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.createSchemaVersion("1.0", Map.of("core", "schema")));
+        assertThat(ex.getMessage().contains("not supported"), is(true));
+    }
+
+    @Test
+    void return_unmodifiable_versions_list() {
+        List<String> versions = store.getVersions();
+        assertThrows(UnsupportedOperationException.class, () -> versions.add("hack"));
+    }
+
+    @Test
+    void return_same_versions_on_repeated_calls() {
+        List<String> first = store.getVersions();
+        List<String> second = store.getVersions();
+        assertThat(first, equalTo(second));
+    }
+
+    @Test
+    void return_null_for_empty_string_version() {
+        Map<String, Object> schemas = store.getSchemasForVersion("");
+        assertThat(schemas, is(nullValue()));
+    }
+
+    @Test
+    void load_versions_from_classpath_resource() {
+        List<String> versions = store.getVersions();
+        assertThat(versions.contains("1.0"), is(true));
+    }
+
+    @Test
+    void load_schemas_for_known_version() {
+        Map<String, Object> schemas = store.getSchemasForVersion("1.0");
+        assertThat(schemas, is(notNullValue()));
+        assertThat(schemas.containsKey("core"), is(true));
+    }
+
+    @Test
+    void cache_schemas_on_repeated_calls() {
+        Map<String, Object> first = store.getSchemasForVersion("1.0");
+        Map<String, Object> second = store.getSchemasForVersion("1.0");
+        assertThat(first, is(second));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAdrStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAdrStoreShould.java
new file mode 100644
index 000000000..81d2b7da5
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAdrStoreShould.java
@@ -0,0 +1,115 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.adr.AdrMeta;
+import org.finos.calm.domain.adr.Status;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.adr.NamespaceAdrSummary;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubAdrStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubAdrStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubAdrStore(registryService);
+    }
+
+    @Test
+    void return_empty_adrs_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<NamespaceAdrSummary> result = store.getAdrsForNamespace("finos");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_zero_count_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        assertThat(store.countAdrsForNamespace("finos"), equalTo(0));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_adrs() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getAdrsForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_count_adrs() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.countAdrsForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_adr() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createAdrForNamespace(new AdrMeta()));
+    }
+
+    @Test
+    void throw_unsupported_on_get_adr() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getAdr(new AdrMeta()));
+    }
+
+    @Test
+    void throw_unsupported_on_get_adr_revisions() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getAdrRevisions(new AdrMeta()));
+    }
+
+    @Test
+    void throw_unsupported_on_get_adr_revision() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getAdrRevision(new AdrMeta()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_adr() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateAdrForNamespace(new AdrMeta()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_adr_status() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateAdrStatus(new AdrMeta(), Status.accepted));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubArchitectureStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubArchitectureStoreShould.java
new file mode 100644
index 000000000..0294b945c
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubArchitectureStoreShould.java
@@ -0,0 +1,220 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.Architecture;
+import org.finos.calm.domain.exception.ArchitectureNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.PageRequest;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubArchitectureStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubArchitectureStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubArchitectureStore(registryService);
+    }
+
+    @Test
+    void return_architectures_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("my-arch", Path.of("architectures/my-arch.json"),
+                CalmResourceType.ARCHITECTURE, "My Architecture", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:my-arch", entry),
+                Map.of(CalmResourceType.ARCHITECTURE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(List.of(entry));
+
+        List<NamespaceResourceSummary> result = store.getArchitecturesForNamespace("finos", PageRequest.UNPAGED);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("My Architecture"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing_on_get() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getArchitecturesForNamespace("nonexistent", PageRequest.UNPAGED));
+    }
+
+    @Test
+    void throw_unsupported_on_create_architecture() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createArchitectureForNamespace(new Architecture.ArchitectureBuilder().build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_architecture_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getArchitectureVersions(new Architecture.ArchitectureBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_architecture_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getArchitectureForVersion(new Architecture.ArchitectureBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void return_versions_list_for_existing_architecture() throws Exception {
+        RegistryEntry entry = new RegistryEntry("test-arch", java.nio.file.Path.of("architectures/test.json"),
+                CalmResourceType.ARCHITECTURE, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-arch", entry),
+                java.util.Map.of(CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(java.util.List.of(entry));
+
+        int hashId = ("test-arch".hashCode() & 0x7FFFFFFF);
+        Architecture arch = new Architecture.ArchitectureBuilder().setNamespace("finos").setId(hashId).build();
+        java.util.List<String> versions = store.getArchitectureVersions(arch);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("test-arch", java.nio.file.Path.of("architectures/test.json"),
+                CalmResourceType.ARCHITECTURE, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-arch", entry),
+                java.util.Map.of(CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(java.util.List.of(entry));
+
+        org.finos.calm.store.github.util.GitHubCloneManager mockCloneManager = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubCloneManager.class);
+        org.finos.calm.store.github.util.GitHubVersionService mockVersionService = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "architectures/test.json"))
+                .thenReturn(java.util.List.of("abc1234", "def5678"));
+
+        int hashId = ("test-arch".hashCode() & 0x7FFFFFFF);
+        Architecture arch = new Architecture.ArchitectureBuilder().setNamespace("finos").setId(hashId).build();
+        java.util.List<String> versions = store.getArchitectureVersions(arch);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_architecture_content_for_version(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception {
+        java.nio.file.Path archDir = tempDir.resolve("finos/architectures");
+        java.nio.file.Files.createDirectories(archDir);
+        java.nio.file.Files.writeString(archDir.resolve("test.json"), "{\"nodes\":[],\"relationships\":[]}");
+
+        RegistryEntry entry = new RegistryEntry("test-arch", java.nio.file.Path.of("architectures/test.json"),
+                CalmResourceType.ARCHITECTURE, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-arch", entry),
+                java.util.Map.of(CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(java.util.List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("test-arch".hashCode() & 0x7FFFFFFF);
+        Architecture arch = new Architecture.ArchitectureBuilder().setNamespace("finos").setId(hashId).setVersion("1.0.0").build();
+
+        String content = store.getArchitectureForVersion(arch);
+        assertThat(content, equalTo("{\"nodes\":[],\"relationships\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("test-arch", java.nio.file.Path.of("architectures/test.json"),
+                CalmResourceType.ARCHITECTURE, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-arch", entry),
+                java.util.Map.of(CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(java.util.List.of(entry));
+
+        org.finos.calm.store.github.util.GitHubCloneManager mockCloneManager = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubCloneManager.class);
+        org.finos.calm.store.github.util.GitHubVersionService mockVersionService = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "architectures/test.json", "abc1234"))
+                .thenReturn("{\"nodes\":[{\"name\":\"old\"}]}");
+
+        int hashId = ("test-arch".hashCode() & 0x7FFFFFFF);
+        Architecture arch = new Architecture.ArchitectureBuilder()
+                .setNamespace("finos").setId(hashId).setVersion("abc1234").build();
+        String content = store.getArchitectureForVersion(arch);
+
+        assertThat(content, equalTo("{\"nodes\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_architecture_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry("test-arch", java.nio.file.Path.of("architectures/test.json"),
+                CalmResourceType.ARCHITECTURE, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-arch", entry),
+                java.util.Map.of(CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.ARCHITECTURE)).thenReturn(java.util.List.of(entry));
+
+        Architecture arch = new Architecture.ArchitectureBuilder().setNamespace("finos").setId(99999).build();
+        assertThrows(ArchitectureNotFoundException.class, () -> store.getArchitectureVersions(arch));
+    }
+
+    @Test
+    void throw_unsupported_on_create_architecture_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createArchitectureForVersion(new Architecture.ArchitectureBuilder().build()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_architecture_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateArchitectureForVersion(new Architecture.ArchitectureBuilder().build()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAuditLogStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAuditLogStoreShould.java
new file mode 100644
index 000000000..b3c8e8ccf
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubAuditLogStoreShould.java
@@ -0,0 +1,41 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.audit.AuditLogEntry;
+import org.finos.calm.domain.audit.AuditLogQuery;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubAuditLogStoreShould {
+
+    private GitHubAuditLogStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubAuditLogStore();
+    }
+
+    @Test
+    void not_throw_on_record() {
+        AuditLogEntry entry = new AuditLogEntry();
+        assertDoesNotThrow(() -> store.record(entry));
+    }
+
+    @Test
+    void return_empty_list_on_query() {
+        AuditLogQuery query = new AuditLogQuery();
+
+        List<AuditLogEntry> result = store.query(query);
+
+        assertThat(result, is(empty()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubBuildingBlockStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubBuildingBlockStoreShould.java
new file mode 100644
index 000000000..6055945fa
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubBuildingBlockStoreShould.java
@@ -0,0 +1,231 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.BuildingBlockNotFoundException;
+import org.finos.calm.domain.exception.BuildingBlockVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubBuildingBlockStoreShould {
+
+    private static final String NAMESPACE = "finos";
+    private static final String UNIQUE_ID = "my-building-block";
+    private static final int HASH_ID = UNIQUE_ID.hashCode() & 0x7FFFFFFF;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubBuildingBlockStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubBuildingBlockStore(registryService);
+    }
+
+    @Test
+    void return_building_blocks_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/my-building-block.json"),
+                CalmResourceType.BUILDING_BLOCK, "My Building Block", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        List<NamespaceResourceSummary> result = store.getBuildingBlocksForNamespace(NAMESPACE);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("My Building Block"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing_on_get() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getBuildingBlocksForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_building_block() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createBuildingBlockForNamespace(NAMESPACE, "{}"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_building_block_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getBuildingBlockVersions("nonexistent", 1));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_building_block_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getBuildingBlockForVersion("nonexistent", 1, "1.0.0"));
+    }
+
+    @Test
+    void return_versions_list_for_existing_building_block() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/test.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        List<String> versions = store.getBuildingBlockVersions(NAMESPACE, HASH_ID);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/test.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace(NAMESPACE)).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "building-blocks/test.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        List<String> versions = store.getBuildingBlockVersions(NAMESPACE, HASH_ID);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_building_block_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path bbDir = tempDir.resolve("finos/building-blocks");
+        Files.createDirectories(bbDir);
+        Files.writeString(bbDir.resolve("test.json"), "{\"nodes\":[],\"relationships\":[]}");
+
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/test.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        String content = store.getBuildingBlockForVersion(NAMESPACE, HASH_ID, "1.0.0");
+
+        assertThat(content, equalTo("{\"nodes\":[],\"relationships\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/test.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace(NAMESPACE)).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "building-blocks/test.json", "abc1234"))
+                .thenReturn("{\"nodes\":[{\"name\":\"old\"}]}");
+
+        String content = store.getBuildingBlockForVersion(NAMESPACE, HASH_ID, "abc1234");
+
+        assertThat(content, equalTo("{\"nodes\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_building_block_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/test.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        assertThrows(BuildingBlockNotFoundException.class,
+                () -> store.getBuildingBlockVersions(NAMESPACE, 99999));
+    }
+
+    @Test
+    void throw_unsupported_on_create_building_block_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createBuildingBlockForVersion(NAMESPACE, 1, "1.0.0", "{}"));
+    }
+
+    @Test
+    void throw_building_block_version_not_found_when_file_missing(@TempDir Path tempDir) throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("building-blocks/nonexistent.json"),
+                CalmResourceType.BUILDING_BLOCK, "Test", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.BUILDING_BLOCK, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(NAMESPACE, CalmResourceType.BUILDING_BLOCK)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+
+        assertThrows(BuildingBlockVersionNotFoundException.class,
+                () -> store.getBuildingBlockForVersion(NAMESPACE, HASH_ID, "1.0.0"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubControlStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubControlStoreShould.java
new file mode 100644
index 000000000..4b212f4a3
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubControlStoreShould.java
@@ -0,0 +1,366 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.controls.ControlDetail;
+import org.finos.calm.domain.controls.CreateControlConfiguration;
+import org.finos.calm.domain.controls.CreateControlRequirement;
+import org.finos.calm.domain.exception.ControlNotFoundException;
+import org.finos.calm.domain.exception.ControlRequirementVersionNotFoundException;
+import org.finos.calm.domain.exception.DomainNotFoundException;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.NamespaceAccessFilter;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubControlStoreShould {
+
+    private static final String DOMAIN = "security";
+    private static final String UNIQUE_ID = "my-control";
+    private static final int HASH_ID = UNIQUE_ID.hashCode() & 0x7FFFFFFF;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private NamespaceAccessFilter accessFilter;
+
+    private GitHubControlStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubControlStore(registryService);
+        store.accessFilter = accessFilter;
+    }
+
+    @Test
+    void return_controls_for_domain() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/security/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        List<ControlDetail> result = store.getControlsForDomain(DOMAIN);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo(UNIQUE_ID));
+        assertThat(result.get(0).getTitle(), equalTo("My Control"));
+        assertThat(result.get(0).getId(), equalTo(HASH_ID));
+    }
+
+    @Test
+    void throw_domain_not_found_when_domain_missing_on_get_controls() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of());
+
+        assertThrows(DomainNotFoundException.class,
+                () -> store.getControlsForDomain("nonexistent"));
+    }
+
+    @Test
+    void return_all_controls_when_access_filter_is_null() throws Exception {
+        GitHubControlStore unfilteredStore = new GitHubControlStore(registryService);
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/security/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+
+        List<ControlDetail> result = unfilteredStore.getControlsForDomain(DOMAIN);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo(UNIQUE_ID));
+    }
+
+    @Test
+    void hide_controls_from_inaccessible_namespaces() throws Exception {
+        RegistryEntry accessibleEntry = new RegistryEntry("ctrl-a", Path.of("controls/security/ctrl-a.json"),
+                CalmResourceType.CONTROL, "Control A", Instant.now());
+        RegistryEntry restrictedEntry = new RegistryEntry("ctrl-b", Path.of("controls/security/ctrl-b.json"),
+                CalmResourceType.CONTROL, "Control B", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(accessibleEntry), "private", List.of(restrictedEntry)),
+                Map.of("finos:ctrl-a", accessibleEntry, "private:ctrl-b", restrictedEntry),
+                Map.of(CalmResourceType.CONTROL, List.of(accessibleEntry, restrictedEntry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.CONTROL)).thenReturn(List.of(accessibleEntry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        List<ControlDetail> result = store.getControlsForDomain(DOMAIN);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("ctrl-a"));
+    }
+
+    @Test
+    void deny_version_lookup_for_control_in_inaccessible_namespace() {
+        RegistryEntry accessible = new RegistryEntry("ctrl-a", Path.of("controls/security/ctrl-a.json"),
+                CalmResourceType.CONTROL, "Control A", Instant.now());
+        RegistryEntry restricted = new RegistryEntry(UNIQUE_ID, Path.of("controls/security/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(accessible), "private", List.of(restricted)),
+                Map.of("finos:ctrl-a", accessible, "private:" + UNIQUE_ID, restricted),
+                Map.of(CalmResourceType.CONTROL, List.of(accessible, restricted))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.CONTROL)).thenReturn(List.of(accessible));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        assertThrows(ControlNotFoundException.class,
+                () -> store.getRequirementVersions(DOMAIN, HASH_ID));
+    }
+
+    @Test
+    void return_versions_for_control_in_accessible_namespace_with_mixed_access(@TempDir Path tempDir) throws Exception {
+        RegistryEntry accessible = new RegistryEntry(UNIQUE_ID, Path.of("controls/security/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistryEntry restricted = new RegistryEntry("other", Path.of("controls/security/other.json"),
+                CalmResourceType.CONTROL, "Other", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(accessible), "private", List.of(restricted)),
+                Map.of("finos:" + UNIQUE_ID, accessible, "private:other", restricted),
+                Map.of(CalmResourceType.CONTROL, List.of(accessible, restricted))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.CONTROL)).thenReturn(List.of(accessible));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        List<String> versions = store.getRequirementVersions(DOMAIN, HASH_ID);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_versions_list_for_existing_control() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        List<String> versions = store.getRequirementVersions(DOMAIN, HASH_ID);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        GitHubCloneManager mockCloneManager = mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace(DOMAIN)).thenReturn("org/repo");
+        when(mockVersionService.getFileVersions("org/repo", "controls/my-control.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        List<String> versions = store.getRequirementVersions(DOMAIN, HASH_ID);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_control_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path controlDir = tempDir.resolve("security/controls");
+        Files.createDirectories(controlDir);
+        Files.writeString(controlDir.resolve("my-control.json"), "{\"control\":\"data\"}");
+
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        store.cloneDirectory = tempDir.toString();
+        String content = store.getRequirementForVersion(DOMAIN, HASH_ID, "1.0.0");
+
+        assertThat(content, equalTo("{\"control\":\"data\"}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        GitHubCloneManager mockCloneManager = mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace(DOMAIN)).thenReturn("org/repo");
+        when(mockVersionService.getFileAtVersion("org/repo", "controls/my-control.json", "abc1234"))
+                .thenReturn("{\"control\":\"old-data\"}");
+
+        String content = store.getRequirementForVersion(DOMAIN, HASH_ID, "abc1234");
+
+        assertThat(content, equalTo("{\"control\":\"old-data\"}"));
+    }
+
+    @Test
+    void throw_domain_not_found_on_get_requirement_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of());
+
+        assertThrows(DomainNotFoundException.class,
+                () -> store.getRequirementVersions("nonexistent", 1));
+    }
+
+    @Test
+    void throw_control_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/security/my-control.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        assertThrows(ControlNotFoundException.class,
+                () -> store.getRequirementVersions(DOMAIN, 99999));
+    }
+
+    @Test
+    void throw_domain_not_found_on_get_requirement_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of());
+
+        assertThrows(DomainNotFoundException.class,
+                () -> store.getRequirementForVersion("nonexistent", 1, "1.0.0"));
+    }
+
+    @Test
+    void throw_requirement_version_not_found_when_file_missing(@TempDir Path tempDir) throws Exception {
+        RegistryEntry entry = new RegistryEntry(UNIQUE_ID, Path.of("controls/nonexistent.json"),
+                CalmResourceType.CONTROL, "My Control", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(DOMAIN, List.of(entry)),
+                Map.of(DOMAIN + ":" + UNIQUE_ID, entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType(DOMAIN, CalmResourceType.CONTROL)).thenReturn(List.of(entry));
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of(DOMAIN));
+
+        store.cloneDirectory = tempDir.toString();
+
+        assertThrows(ControlRequirementVersionNotFoundException.class,
+                () -> store.getRequirementForVersion(DOMAIN, HASH_ID, "1.0.0"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_control_requirement() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createControlRequirement(new CreateControlRequirement(), DOMAIN));
+    }
+
+    @Test
+    void throw_unsupported_on_create_requirement_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createRequirementForVersion(DOMAIN, 1, "1.0.0", new CreateControlRequirement()));
+    }
+
+    @Test
+    void throw_unsupported_on_get_configurations_for_control() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getConfigurationsForControl(DOMAIN, 1));
+    }
+
+    @Test
+    void throw_unsupported_on_get_configuration_details_for_control() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getConfigurationDetailsForControl(DOMAIN, 1));
+    }
+
+    @Test
+    void throw_unsupported_on_create_control_configuration() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createControlConfiguration(new CreateControlConfiguration(), DOMAIN, 1));
+    }
+
+    @Test
+    void throw_unsupported_on_get_configuration_versions() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getConfigurationVersions(DOMAIN, 1, 1));
+    }
+
+    @Test
+    void throw_unsupported_on_get_configuration_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getConfigurationForVersion(DOMAIN, 1, 1, "1.0.0"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_configuration_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createConfigurationForVersion(DOMAIN, 1, 1, "1.0.0", new CreateControlConfiguration()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDecoratorStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDecoratorStoreShould.java
new file mode 100644
index 000000000..86e674b93
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDecoratorStoreShould.java
@@ -0,0 +1,114 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.Decorator;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubDecoratorStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubDecoratorStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubDecoratorStore(registryService);
+    }
+
+    @Test
+    void return_empty_decorators_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<Integer> result = store.getDecoratorsForNamespace("finos", "target", "type");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_empty_decorator_values_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<Decorator> result = store.getDecoratorValuesForNamespace("finos", "target", "type");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_empty_optional_for_decorator_by_id() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        Optional<Decorator> result = store.getDecoratorById("finos", 1);
+
+        assertThat(result, equalTo(Optional.empty()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_decorators() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getDecoratorsForNamespace("nonexistent", "target", "type"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_decorator_values() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getDecoratorValuesForNamespace("nonexistent", "target", "type"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_decorator_by_id() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getDecoratorById("nonexistent", 1));
+    }
+
+    @Test
+    void throw_unsupported_on_create_decorator() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createDecorator("finos", "{}"));
+    }
+
+    @Test
+    void throw_unsupported_on_update_decorator() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateDecorator("finos", 1, "{}"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDomainStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDomainStoreShould.java
new file mode 100644
index 000000000..b6ca5bc49
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubDomainStoreShould.java
@@ -0,0 +1,122 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.NamespaceAccessFilter;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.contains;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubDomainStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private NamespaceAccessFilter accessFilter;
+
+    private GitHubDomainStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubDomainStore(registryService);
+        store.accessFilter = accessFilter;
+    }
+
+    @Test
+    void return_domains_derived_from_controls_directory() {
+        RegistryEntry entry = new RegistryEntry("tls-policy", Path.of("controls/security/tls-policy.json"),
+                CalmResourceType.CONTROL, "TLS Policy", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:tls-policy", entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        List<String> domains = store.getDomains();
+
+        assertThat(domains, contains("security"));
+    }
+
+    @Test
+    void return_empty_when_no_controls_exist() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of());
+
+        List<String> domains = store.getDomains();
+
+        assertThat(domains, is(empty()));
+    }
+
+    @Test
+    void return_true_when_domain_exists() {
+        RegistryEntry entry = new RegistryEntry("ctrl", Path.of("controls/security/ctrl.json"),
+                CalmResourceType.CONTROL, "Ctrl", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:ctrl", entry),
+                Map.of(CalmResourceType.CONTROL, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        assertThat(store.domainExists("security"), is(true));
+    }
+
+    @Test
+    void return_false_when_domain_does_not_exist() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of());
+
+        assertThat(store.domainExists("nonexistent"), is(false));
+    }
+
+    @Test
+    void hide_domains_from_inaccessible_namespaces() {
+        RegistryEntry accessibleEntry = new RegistryEntry("ctrl-a", Path.of("controls/security/ctrl-a.json"),
+                CalmResourceType.CONTROL, "Control A", Instant.now());
+        RegistryEntry restrictedEntry = new RegistryEntry("ctrl-b", Path.of("controls/compliance/ctrl-b.json"),
+                CalmResourceType.CONTROL, "Control B", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(accessibleEntry), "private", List.of(restrictedEntry)),
+                Map.of("finos:ctrl-a", accessibleEntry, "private:ctrl-b", restrictedEntry),
+                Map.of(CalmResourceType.CONTROL, List.of(accessibleEntry, restrictedEntry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(accessFilter.getAccessibleNamespaces()).thenReturn(Set.of("finos"));
+
+        List<String> domains = store.getDomains();
+
+        assertThat(domains, contains("security"));
+    }
+
+    @Test
+    void throw_on_create_domain() {
+        assertThrows(UnsupportedOperationException.class, () -> store.createDomain("new-domain"));
+    }
+
+    @Test
+    void throw_on_delete_domain() {
+        assertThrows(UnsupportedOperationException.class, () -> store.deleteDomain("security"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubFlowStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubFlowStoreShould.java
new file mode 100644
index 000000000..ab9c928e9
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubFlowStoreShould.java
@@ -0,0 +1,223 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.Flow;
+import org.finos.calm.domain.exception.FlowNotFoundException;
+import org.finos.calm.domain.exception.FlowVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.flow.CreateFlowRequest;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubFlowStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubFlowStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubFlowStore(registryService);
+    }
+
+    @Test
+    void return_flows_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        List<NamespaceResourceSummary> result = store.getFlowsForNamespace("finos");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("Payment Flow"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getFlowsForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_flow() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createFlowForNamespace(new CreateFlowRequest(), "finos"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_flow_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getFlowVersions(new Flow.FlowBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_flow_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getFlowForVersion(new Flow.FlowBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void return_versions_list_for_existing_flow() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        int hashId = ("payment-flow".hashCode() & 0x7FFFFFFF);
+        Flow flow = new Flow.FlowBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getFlowVersions(flow);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "flows/payment-flow.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        int hashId = ("payment-flow".hashCode() & 0x7FFFFFFF);
+        Flow flow = new Flow.FlowBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getFlowVersions(flow);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_flow_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path flowDir = tempDir.resolve("finos/flows");
+        Files.createDirectories(flowDir);
+        Files.writeString(flowDir.resolve("payment-flow.json"), "{\"steps\":[]}");
+
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("payment-flow".hashCode() & 0x7FFFFFFF);
+        Flow flow = new Flow.FlowBuilder().setNamespace("finos").setId(hashId).setVersion("1.0.0").build();
+
+        String content = store.getFlowForVersion(flow);
+        assertThat(content, equalTo("{\"steps\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "flows/payment-flow.json", "abc1234"))
+                .thenReturn("{\"steps\":[{\"name\":\"old\"}]}");
+
+        int hashId = ("payment-flow".hashCode() & 0x7FFFFFFF);
+        Flow flow = new Flow.FlowBuilder().setNamespace("finos").setId(hashId).setVersion("abc1234").build();
+        String content = store.getFlowForVersion(flow);
+
+        assertThat(content, equalTo("{\"steps\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_flow_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry("payment-flow", Path.of("flows/payment-flow.json"),
+                CalmResourceType.FLOW, "Payment Flow", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-flow", entry),
+                Map.of(CalmResourceType.FLOW, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.FLOW)).thenReturn(List.of(entry));
+
+        Flow flow = new Flow.FlowBuilder().setNamespace("finos").setId(99999).build();
+        assertThrows(FlowNotFoundException.class, () -> store.getFlowVersions(flow));
+    }
+
+    @Test
+    void throw_unsupported_on_create_flow_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createFlowForVersion(new Flow.FlowBuilder().build()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_flow_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateFlowForVersion(new Flow.FlowBuilder().build()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubInterfaceStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubInterfaceStoreShould.java
new file mode 100644
index 000000000..bffc707fc
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubInterfaceStoreShould.java
@@ -0,0 +1,228 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.InterfaceNotFoundException;
+import org.finos.calm.domain.exception.InterfaceVersionNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.interfaces.CreateInterfaceRequest;
+import org.finos.calm.domain.interfaces.NamespaceInterfaceSummary;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubInterfaceStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubInterfaceStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubInterfaceStore(registryService);
+    }
+
+    @Test
+    void return_empty_interfaces_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of());
+
+        List<NamespaceInterfaceSummary> result = store.getInterfacesForNamespace("finos");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_interfaces_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        List<NamespaceInterfaceSummary> result = store.getInterfacesForNamespace("finos");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("Payment API"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getInterfacesForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_interface() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createInterfaceForNamespace(new CreateInterfaceRequest(), "finos"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_interface_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getInterfaceVersions("nonexistent", 1));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_interface_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getInterfaceForVersion("nonexistent", 1, "1.0.0"));
+    }
+
+    @Test
+    void return_versions_list_for_existing_interface() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        int hashId = ("payment-api".hashCode() & 0x7FFFFFFF);
+        List<String> versions = store.getInterfaceVersions("finos", hashId);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "interfaces/payment-api.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        int hashId = ("payment-api".hashCode() & 0x7FFFFFFF);
+        List<String> versions = store.getInterfaceVersions("finos", hashId);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_interface_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path ifaceDir = tempDir.resolve("finos/interfaces");
+        Files.createDirectories(ifaceDir);
+        Files.writeString(ifaceDir.resolve("payment-api.json"), "{\"operations\":[]}");
+
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("payment-api".hashCode() & 0x7FFFFFFF);
+
+        String content = store.getInterfaceForVersion("finos", hashId, "1.0.0");
+        assertThat(content, equalTo("{\"operations\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "interfaces/payment-api.json", "abc1234"))
+                .thenReturn("{\"operations\":[{\"name\":\"old\"}]}");
+
+        int hashId = ("payment-api".hashCode() & 0x7FFFFFFF);
+        String content = store.getInterfaceForVersion("finos", hashId, "abc1234");
+
+        assertThat(content, equalTo("{\"operations\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_interface_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry("payment-api", Path.of("interfaces/payment-api.json"),
+                CalmResourceType.INTERFACE, "Payment API", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:payment-api", entry),
+                Map.of(CalmResourceType.INTERFACE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.INTERFACE)).thenReturn(List.of(entry));
+
+        assertThrows(InterfaceNotFoundException.class, () -> store.getInterfaceVersions("finos", 99999));
+    }
+
+    @Test
+    void throw_unsupported_on_create_interface_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createInterfaceForVersion(new CreateInterfaceRequest(), "finos", 1, "1.0.0"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubLayoutStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubLayoutStoreShould.java
new file mode 100644
index 000000000..b1e9d5401
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubLayoutStoreShould.java
@@ -0,0 +1,46 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubLayoutStoreShould {
+
+    private GitHubLayoutStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubLayoutStore();
+    }
+
+    @Test
+    void return_empty_optional_for_get_layout() throws NamespaceNotFoundException {
+        Optional<String> result = store.getLayout("finos", 1);
+
+        assertThat(result, equalTo(Optional.empty()));
+    }
+
+    @Test
+    void no_op_on_upsert_layout() {
+        assertDoesNotThrow(() -> store.upsertLayout("finos", 1, "{\"nodes\":[]}"));
+    }
+
+    @Test
+    void return_empty_list_for_architecture_ids_with_layout() throws NamespaceNotFoundException {
+        List<Integer> result = store.getArchitectureIdsWithLayoutForNamespace("finos");
+
+        assertThat(result, is(empty()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubNamespaceStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubNamespaceStoreShould.java
new file mode 100644
index 000000000..4536932ae
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubNamespaceStoreShould.java
@@ -0,0 +1,88 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceInfo;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubNamespaceStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubNamespaceStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubNamespaceStore(registryService);
+    }
+
+    @Test
+    void return_namespaces_from_registry() {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "team", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<NamespaceInfo> result = store.getNamespaces();
+
+        assertThat(result, hasSize(2));
+    }
+
+    @Test
+    void return_true_when_namespace_exists() {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        assertThat(store.namespaceExists("finos"), is(true));
+    }
+
+    @Test
+    void return_false_when_namespace_does_not_exist() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThat(store.namespaceExists("nonexistent"), is(false));
+    }
+
+    @Test
+    void throw_on_create_namespace() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.createNamespace("new-ns", "desc"));
+        assertThat(ex.getMessage().contains("admin-configured"), is(true));
+    }
+
+    @Test
+    void throw_on_update_namespace_description() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateNamespaceDescription("finos", "new desc"));
+    }
+
+    @Test
+    void throw_on_delete_namespace() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.deleteNamespace("finos"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubPatternStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubPatternStoreShould.java
new file mode 100644
index 000000000..babc34ced
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubPatternStoreShould.java
@@ -0,0 +1,224 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.Pattern;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.PatternNotFoundException;
+import org.finos.calm.domain.exception.PatternVersionNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.domain.pattern.CreatePatternRequest;
+import org.finos.calm.store.PageRequest;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubPatternStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubPatternStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubPatternStore(registryService);
+    }
+
+    @Test
+    void return_patterns_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        List<NamespaceResourceSummary> result = store.getPatternsForNamespace("finos", PageRequest.UNPAGED);
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("Event Driven"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getPatternsForNamespace("nonexistent", PageRequest.UNPAGED));
+    }
+
+    @Test
+    void throw_unsupported_on_create_pattern() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createPatternForNamespace(new CreatePatternRequest(), "finos"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_pattern_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createPatternForVersion(new Pattern.PatternBuilder().build()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_pattern_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updatePatternForVersion(new Pattern.PatternBuilder().build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_pattern_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getPatternVersions(new Pattern.PatternBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_pattern_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getPatternForVersion(new Pattern.PatternBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void return_versions_list_for_existing_pattern() throws Exception {
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        int hashId = ("event-driven".hashCode() & 0x7FFFFFFF);
+        Pattern pattern = new Pattern.PatternBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getPatternVersions(pattern);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "patterns/event-driven.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        int hashId = ("event-driven".hashCode() & 0x7FFFFFFF);
+        Pattern pattern = new Pattern.PatternBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getPatternVersions(pattern);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_pattern_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path patternDir = tempDir.resolve("finos/patterns");
+        Files.createDirectories(patternDir);
+        Files.writeString(patternDir.resolve("event-driven.json"), "{\"nodes\":[],\"relationships\":[]}");
+
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("event-driven".hashCode() & 0x7FFFFFFF);
+        Pattern pattern = new Pattern.PatternBuilder().setNamespace("finos").setId(hashId).setVersion("1.0.0").build();
+
+        String content = store.getPatternForVersion(pattern);
+        assertThat(content, equalTo("{\"nodes\":[],\"relationships\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "patterns/event-driven.json", "abc1234"))
+                .thenReturn("{\"nodes\":[{\"name\":\"old\"}]}");
+
+        int hashId = ("event-driven".hashCode() & 0x7FFFFFFF);
+        Pattern pattern = new Pattern.PatternBuilder().setNamespace("finos").setId(hashId).setVersion("abc1234").build();
+        String content = store.getPatternForVersion(pattern);
+
+        assertThat(content, equalTo("{\"nodes\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_pattern_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry("event-driven", Path.of("patterns/event-driven.json"),
+                CalmResourceType.PATTERN, "Event Driven", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:event-driven", entry),
+                Map.of(CalmResourceType.PATTERN, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.PATTERN)).thenReturn(List.of(entry));
+
+        Pattern pattern = new Pattern.PatternBuilder().setNamespace("finos").setId(99999).build();
+        assertThrows(PatternNotFoundException.class, () -> store.getPatternVersions(pattern));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubResourceMappingStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubResourceMappingStoreShould.java
new file mode 100644
index 000000000..8f8a644a1
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubResourceMappingStoreShould.java
@@ -0,0 +1,209 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.ResourceMapping;
+import org.finos.calm.domain.ResourceType;
+import org.finos.calm.domain.exception.GitHubWriteNotSupportedException;
+import org.finos.calm.domain.exception.MappingNotFoundException;
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubResourceMappingStoreShould {
+
+    private static final String NAMESPACE = "finos";
+    private static final String UNIQUE_ID = "my-architecture";
+    private static final int NUMERIC_ID = UNIQUE_ID.hashCode() & 0x7FFFFFFF;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubResourceMappingStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubResourceMappingStore(registryService);
+    }
+
+    @Test
+    void return_mapping_when_entry_exists_in_registry() throws Exception {
+        RegistryEntry entry = createEntry(UNIQUE_ID, CalmResourceType.ARCHITECTURE);
+        setupNamespaceWithEntry(entry);
+        when(registryService.findByUniqueId(NAMESPACE, UNIQUE_ID)).thenReturn(Optional.of(entry));
+
+        ResourceMapping mapping = store.getMapping(NAMESPACE, ResourceType.ARCHITECTURE, UNIQUE_ID);
+
+        assertThat(mapping.getNamespace(), equalTo(NAMESPACE));
+        assertThat(mapping.getCustomId(), equalTo(UNIQUE_ID));
+        assertThat(mapping.getResourceType(), equalTo(ResourceType.ARCHITECTURE));
+        assertThat(mapping.getNumericId(), equalTo(NUMERIC_ID));
+    }
+
+    @Test
+    void throw_mapping_not_found_when_entry_missing() {
+        setupNamespace();
+        when(registryService.findByUniqueId(NAMESPACE, "nonexistent")).thenReturn(Optional.empty());
+
+        assertThrows(MappingNotFoundException.class,
+                () -> store.getMapping(NAMESPACE, ResourceType.ARCHITECTURE, "nonexistent"));
+    }
+
+    @Test
+    void throw_mapping_not_found_when_type_mismatch() {
+        RegistryEntry entry = createEntry(UNIQUE_ID, CalmResourceType.PATTERN);
+        setupNamespaceWithEntry(entry);
+        when(registryService.findByUniqueId(NAMESPACE, UNIQUE_ID)).thenReturn(Optional.of(entry));
+
+        assertThrows(MappingNotFoundException.class,
+                () -> store.getMapping(NAMESPACE, ResourceType.ARCHITECTURE, UNIQUE_ID));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_unknown() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getMapping("nonexistent", ResourceType.ARCHITECTURE, UNIQUE_ID));
+    }
+
+    @Test
+    void list_mappings_for_namespace_and_type() throws Exception {
+        RegistryEntry entry1 = createEntry("arch-one", CalmResourceType.ARCHITECTURE);
+        RegistryEntry entry2 = createEntry("arch-two", CalmResourceType.ARCHITECTURE);
+        setupNamespace();
+        when(registryService.listByType(NAMESPACE, CalmResourceType.ARCHITECTURE))
+                .thenReturn(List.of(entry1, entry2));
+
+        List<ResourceMapping> mappings = store.listMappings(NAMESPACE, ResourceType.ARCHITECTURE);
+
+        assertThat(mappings, hasSize(2));
+        assertThat(mappings.get(0).getCustomId(), equalTo("arch-one"));
+        assertThat(mappings.get(1).getCustomId(), equalTo("arch-two"));
+    }
+
+    @Test
+    void return_empty_list_when_no_entries_of_type() throws Exception {
+        setupNamespace();
+        when(registryService.listByType(NAMESPACE, CalmResourceType.FLOW)).thenReturn(List.of());
+
+        List<ResourceMapping> mappings = store.listMappings(NAMESPACE, ResourceType.FLOW);
+
+        assertThat(mappings, hasSize(0));
+    }
+
+    @Test
+    void get_mapping_by_numeric_id() throws Exception {
+        RegistryEntry entry = createEntry(UNIQUE_ID, CalmResourceType.ARCHITECTURE);
+        setupNamespace();
+        when(registryService.listByType(NAMESPACE, CalmResourceType.ARCHITECTURE))
+                .thenReturn(List.of(entry));
+
+        ResourceMapping mapping = store.getMappingByNumericId(NAMESPACE, ResourceType.ARCHITECTURE, NUMERIC_ID);
+
+        assertThat(mapping.getCustomId(), equalTo(UNIQUE_ID));
+        assertThat(mapping.getNumericId(), equalTo(NUMERIC_ID));
+    }
+
+    @Test
+    void throw_mapping_not_found_for_unknown_numeric_id() {
+        setupNamespace();
+        when(registryService.listByType(NAMESPACE, CalmResourceType.ARCHITECTURE)).thenReturn(List.of());
+
+        assertThrows(MappingNotFoundException.class,
+                () -> store.getMappingByNumericId(NAMESPACE, ResourceType.ARCHITECTURE, 99999));
+    }
+
+    @Test
+    void list_mappings_by_numeric_ids() throws Exception {
+        RegistryEntry entry1 = createEntry("arch-one", CalmResourceType.ARCHITECTURE);
+        RegistryEntry entry2 = createEntry("arch-two", CalmResourceType.ARCHITECTURE);
+        setupNamespace();
+        when(registryService.listByType(NAMESPACE, CalmResourceType.ARCHITECTURE))
+                .thenReturn(List.of(entry1, entry2));
+
+        int id1 = "arch-one".hashCode() & 0x7FFFFFFF;
+        List<ResourceMapping> mappings = store.listMappingsByNumericIds(
+                NAMESPACE, ResourceType.ARCHITECTURE, List.of(id1));
+
+        assertThat(mappings, hasSize(1));
+        assertThat(mappings.get(0).getCustomId(), equalTo("arch-one"));
+    }
+
+    @Test
+    void throw_on_create_mapping() {
+        assertThrows(GitHubWriteNotSupportedException.class,
+                () -> store.createMapping(NAMESPACE, UNIQUE_ID, ResourceType.ARCHITECTURE, 1));
+    }
+
+    @Test
+    void throw_on_update_mapping_numeric_id() {
+        assertThrows(GitHubWriteNotSupportedException.class,
+                () -> store.updateMappingNumericId(NAMESPACE, ResourceType.ARCHITECTURE, UNIQUE_ID, 1));
+    }
+
+    @Test
+    void throw_on_delete_mapping() {
+        assertThrows(GitHubWriteNotSupportedException.class,
+                () -> store.deleteMapping(NAMESPACE, ResourceType.ARCHITECTURE, UNIQUE_ID));
+    }
+
+    @Test
+    void map_all_resource_types_correctly() {
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.PATTERN), equalTo(CalmResourceType.PATTERN));
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.ARCHITECTURE), equalTo(CalmResourceType.ARCHITECTURE));
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.FLOW), equalTo(CalmResourceType.FLOW));
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.STANDARD), equalTo(CalmResourceType.STANDARD));
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.INTERFACE), equalTo(CalmResourceType.INTERFACE));
+        assertThat(GitHubResourceMappingStore.toCalmResourceType(ResourceType.BUILDING_BLOCK), equalTo(CalmResourceType.BUILDING_BLOCK));
+    }
+
+    private RegistryEntry createEntry(String uniqueId, CalmResourceType type) {
+        String folder = switch (type) {
+            case ARCHITECTURE -> "architectures";
+            case PATTERN -> "patterns";
+            case FLOW -> "flows";
+            case STANDARD -> "standards";
+            case INTERFACE -> "interfaces";
+            default -> "other";
+        };
+        return new RegistryEntry(uniqueId, Path.of(folder + "/" + uniqueId + ".json"),
+                type, uniqueId.replace("-", " "), Instant.now());
+    }
+
+    private void setupNamespace() {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+    }
+
+    private void setupNamespaceWithEntry(RegistryEntry entry) {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of(NAMESPACE, List.of(entry)),
+                Map.of(NAMESPACE + ":" + entry.uniqueId(), entry),
+                Map.of(entry.type(), List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubSearchStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubSearchStoreShould.java
new file mode 100644
index 000000000..0c8cd3bdd
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubSearchStoreShould.java
@@ -0,0 +1,90 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.search.GroupedSearchResults;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import java.util.Optional;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.mockito.Mockito.when;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestGitHubSearchStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubSearchStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubSearchStore();
+        store.registryService = registryService;
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+    }
+
+    @Test
+    void return_empty_grouped_search_results() {
+        GroupedSearchResults result = store.search("test query", Optional.empty());
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.getArchitectures(), is(empty()));
+        assertThat(result.getPatterns(), is(empty()));
+        assertThat(result.getFlows(), is(empty()));
+        assertThat(result.getStandards(), is(empty()));
+        assertThat(result.getInterfaces(), is(empty()));
+        assertThat(result.getControls(), is(empty()));
+        assertThat(result.getAdrs(), is(empty()));
+    }
+
+    @Test
+    void return_empty_results_with_readable_namespaces() {
+        GroupedSearchResults result = store.search("test", Optional.of(Set.of("finos")));
+
+        assertThat(result, is(notNullValue()));
+        assertThat(result.getArchitectures(), is(empty()));
+    }
+
+    @Test
+    void return_empty_for_blank_query() {
+        GroupedSearchResults result = store.search("", Optional.empty());
+        assertThat(result.getArchitectures(), is(empty()));
+    }
+
+    @Test
+    void return_empty_for_null_query() {
+        GroupedSearchResults result = store.search(null, Optional.empty());
+        assertThat(result.getArchitectures(), is(empty()));
+    }
+
+    @Test
+    void find_entries_matching_query_by_name() {
+        org.finos.calm.store.github.util.RegistryEntry entry = new org.finos.calm.store.github.util.RegistryEntry(
+                "payment-svc", java.nio.file.Path.of("architectures/payment.json"),
+                org.finos.calm.store.github.util.CalmResourceType.ARCHITECTURE, "Payment Service", java.time.Instant.now());
+        org.finos.calm.store.github.util.RegistrySnapshot snapshot = new org.finos.calm.store.github.util.RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:payment-svc", entry),
+                java.util.Map.of(org.finos.calm.store.github.util.CalmResourceType.ARCHITECTURE, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        GroupedSearchResults result = store.search("payment", Optional.empty());
+
+        assertThat(result.getArchitectures(), is(org.hamcrest.Matchers.not(empty())));
+        assertThat(result.getArchitectures().get(0).getName(), is("Payment Service"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubStandardStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubStandardStoreShould.java
new file mode 100644
index 000000000..f2466b1ce
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubStandardStoreShould.java
@@ -0,0 +1,245 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.namespaces.NamespaceResourceSummary;
+import org.finos.calm.domain.standards.CreateStandardRequest;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubStandardStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubStandardStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubStandardStore(registryService);
+    }
+
+    @Test
+    void return_standards_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("naming-convention", Path.of("standards/naming-convention.json"),
+                CalmResourceType.STANDARD, "Naming Convention", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:naming-convention", entry),
+                Map.of(CalmResourceType.STANDARD, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(List.of(entry));
+
+        List<NamespaceResourceSummary> result = store.getStandardsForNamespace("finos");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("Naming Convention"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getStandardsForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_standard() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createStandardForNamespace(new CreateStandardRequest(), "finos"));
+    }
+
+    @Test
+    void throw_standard_not_found_when_id_does_not_match() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("std-x", java.nio.file.Path.of("standards/x.json"),
+                CalmResourceType.STANDARD, "X", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:std-x", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        assertThrows(org.finos.calm.domain.exception.StandardNotFoundException.class,
+                () -> store.getStandardVersions("finos", 99999));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_standard_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getStandardVersions("nonexistent", 1));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_standard_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getStandardForVersion("nonexistent", 1, "latest"));
+    }
+
+    @Test
+    void return_versions_for_existing_standard() throws Exception {
+        RegistryEntry entry = new RegistryEntry("std-1", java.nio.file.Path.of("standards/std.json"),
+                CalmResourceType.STANDARD, "Std", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:std-1", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        int hashId = ("std-1".hashCode() & 0x7FFFFFFF);
+        java.util.List<String> versions = store.getStandardVersions("finos", hashId);
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_content_for_standard(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception {
+        java.nio.file.Path stdDir = tempDir.resolve("finos/standards");
+        java.nio.file.Files.createDirectories(stdDir);
+        java.nio.file.Files.writeString(stdDir.resolve("test.json"), "{\"name\":\"Test Standard\"}");
+
+        RegistryEntry entry = new RegistryEntry("test-std", java.nio.file.Path.of("standards/test.json"),
+                CalmResourceType.STANDARD, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-std", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("test-std".hashCode() & 0x7FFFFFFF);
+        String content = store.getStandardForVersion("finos", hashId, "latest");
+        assertThat(content, equalTo("{\"name\":\"Test Standard\"}"));
+    }
+
+    @Test
+    void prefer_md_sibling_over_json(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception {
+        java.nio.file.Path stdDir = tempDir.resolve("finos/standards");
+        java.nio.file.Files.createDirectories(stdDir);
+        java.nio.file.Files.writeString(stdDir.resolve("policy.guideline.json"), "{\"nodes\":[]}");
+        java.nio.file.Files.writeString(stdDir.resolve("policy.md"), "# Policy\n\nContent here.");
+
+        RegistryEntry entry = new RegistryEntry("policy", java.nio.file.Path.of("standards/policy.guideline.json"),
+                CalmResourceType.STANDARD, "Policy", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:policy", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("policy".hashCode() & 0x7FFFFFFF);
+        String content = store.getStandardForVersion("finos", hashId, "latest");
+        assertThat(content, org.hamcrest.Matchers.startsWith("# Policy"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_standard_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createStandardForVersion(new CreateStandardRequest(), "finos", 1, "1.0.0"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("std-1", java.nio.file.Path.of("standards/std.json"),
+                CalmResourceType.STANDARD, "Std", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:std-1", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        org.finos.calm.store.github.util.GitHubCloneManager mockCloneManager = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubCloneManager.class);
+        org.finos.calm.store.github.util.GitHubVersionService mockVersionService = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileVersions("finos/repo", "standards/std.json"))
+                .thenReturn(java.util.List.of("abc1234", "def5678"));
+
+        int hashId = ("std-1".hashCode() & 0x7FFFFFFF);
+        java.util.List<String> versions = store.getStandardVersions("finos", hashId);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("test-std", java.nio.file.Path.of("standards/test.json"),
+                CalmResourceType.STANDARD, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-std", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        org.finos.calm.store.github.util.GitHubCloneManager mockCloneManager = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubCloneManager.class);
+        org.finos.calm.store.github.util.GitHubVersionService mockVersionService = org.mockito.Mockito.mock(org.finos.calm.store.github.util.GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "standards/test.json", "abc1234"))
+                .thenReturn("{\"name\":\"Old Standard\"}");
+
+        int hashId = ("test-std".hashCode() & 0x7FFFFFFF);
+        String content = store.getStandardForVersion("finos", hashId, "abc1234");
+
+        assertThat(content, equalTo("{\"name\":\"Old Standard\"}"));
+    }
+
+    @Test
+    void throw_standard_version_not_found_when_file_missing(@org.junit.jupiter.api.io.TempDir java.nio.file.Path tempDir) throws Exception {
+        RegistryEntry entry = new RegistryEntry("test-std", java.nio.file.Path.of("standards/nonexistent.json"),
+                CalmResourceType.STANDARD, "Test", java.time.Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                java.util.Map.of("finos", java.util.List.of(entry)),
+                java.util.Map.of("finos:test-std", entry),
+                java.util.Map.of(CalmResourceType.STANDARD, java.util.List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.STANDARD)).thenReturn(java.util.List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("test-std".hashCode() & 0x7FFFFFFF);
+
+        assertThrows(org.finos.calm.domain.exception.StandardVersionNotFoundException.class,
+                () -> store.getStandardForVersion("finos", hashId, "1.0.0"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubTimelineStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubTimelineStoreShould.java
new file mode 100644
index 000000000..82a49858d
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubTimelineStoreShould.java
@@ -0,0 +1,240 @@
+package org.finos.calm.store.github;
+
+import org.finos.calm.domain.exception.NamespaceNotFoundException;
+import org.finos.calm.domain.exception.TimelineNotFoundException;
+import org.finos.calm.domain.exception.TimelineVersionNotFoundException;
+import org.finos.calm.domain.timeline.CreateTimelineRequest;
+import org.finos.calm.domain.timeline.NamespaceTimelineSummary;
+import org.finos.calm.domain.timeline.Timeline;
+import org.finos.calm.store.github.util.CalmResourceType;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.GitHubVersionService;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistryEntry;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubTimelineStoreShould {
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    private GitHubTimelineStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubTimelineStore(registryService);
+    }
+
+    @Test
+    void return_empty_timelines_for_namespace() throws NamespaceNotFoundException {
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of());
+
+        List<NamespaceTimelineSummary> result = store.getTimelinesForNamespace("finos");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_timelines_for_namespace() throws NamespaceNotFoundException {
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        List<NamespaceTimelineSummary> result = store.getTimelinesForNamespace("finos");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getName(), equalTo("Release Timeline"));
+    }
+
+    @Test
+    void throw_namespace_not_found_when_namespace_missing() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getTimelinesForNamespace("nonexistent"));
+    }
+
+    @Test
+    void throw_unsupported_on_create_timeline() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createTimelineForNamespace(new CreateTimelineRequest(), "finos"));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_timeline_versions() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getTimelineVersions(new Timeline.TimelineBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void throw_namespace_not_found_on_get_timeline_for_version() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        assertThrows(NamespaceNotFoundException.class,
+                () -> store.getTimelineForVersion(new Timeline.TimelineBuilder().setNamespace("nonexistent").build()));
+    }
+
+    @Test
+    void return_versions_list_for_existing_timeline() throws Exception {
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        int hashId = ("release-timeline".hashCode() & 0x7FFFFFFF);
+        Timeline timeline = new Timeline.TimelineBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getTimelineVersions(timeline);
+
+        assertThat(versions, hasSize(1));
+        assertThat(versions.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_sha_versions_when_version_service_available() throws Exception {
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/architecture-as-code");
+        when(mockVersionService.getFileVersions("finos/architecture-as-code", "timelines/release-timeline.json"))
+                .thenReturn(List.of("abc1234", "def5678"));
+
+        int hashId = ("release-timeline".hashCode() & 0x7FFFFFFF);
+        Timeline timeline = new Timeline.TimelineBuilder().setNamespace("finos").setId(hashId).build();
+        List<String> versions = store.getTimelineVersions(timeline);
+
+        assertThat(versions, hasSize(2));
+        assertThat(versions.get(0), equalTo("abc1234"));
+    }
+
+    @Test
+    void return_timeline_content_for_version(@TempDir Path tempDir) throws Exception {
+        Path timelineDir = tempDir.resolve("finos/timelines");
+        Files.createDirectories(timelineDir);
+        Files.writeString(timelineDir.resolve("release-timeline.json"), "{\"milestones\":[]}");
+
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        store.cloneDirectory = tempDir.toString();
+        int hashId = ("release-timeline".hashCode() & 0x7FFFFFFF);
+        Timeline timeline = new Timeline.TimelineBuilder().setNamespace("finos").setId(hashId).setVersion("1.0.0").build();
+
+        String content = store.getTimelineForVersion(timeline);
+        assertThat(content, equalTo("{\"milestones\":[]}"));
+    }
+
+    @Test
+    void return_content_from_github_api_for_sha_version() throws Exception {
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        GitHubCloneManager mockCloneManager = Mockito.mock(GitHubCloneManager.class);
+        GitHubVersionService mockVersionService = Mockito.mock(GitHubVersionService.class);
+        store.cloneManager = mockCloneManager;
+        store.versionService = mockVersionService;
+
+        when(mockCloneManager.getRepoForNamespace("finos")).thenReturn("finos/repo");
+        when(mockVersionService.getFileAtVersion("finos/repo", "timelines/release-timeline.json", "abc1234"))
+                .thenReturn("{\"milestones\":[{\"name\":\"old\"}]}");
+
+        int hashId = ("release-timeline".hashCode() & 0x7FFFFFFF);
+        Timeline timeline = new Timeline.TimelineBuilder().setNamespace("finos").setId(hashId).setVersion("abc1234").build();
+        String content = store.getTimelineForVersion(timeline);
+
+        assertThat(content, equalTo("{\"milestones\":[{\"name\":\"old\"}]}"));
+    }
+
+    @Test
+    void throw_timeline_not_found_when_id_does_not_match() {
+        RegistryEntry entry = new RegistryEntry("release-timeline", Path.of("timelines/release-timeline.json"),
+                CalmResourceType.TIMELINE, "Release Timeline", Instant.now());
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(entry)),
+                Map.of("finos:release-timeline", entry),
+                Map.of(CalmResourceType.TIMELINE, List.of(entry))
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(registryService.listByType("finos", CalmResourceType.TIMELINE)).thenReturn(List.of(entry));
+
+        Timeline timeline = new Timeline.TimelineBuilder().setNamespace("finos").setId(99999).build();
+        assertThrows(TimelineNotFoundException.class, () -> store.getTimelineVersions(timeline));
+    }
+
+    @Test
+    void throw_unsupported_on_create_timeline_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createTimelineForVersion(new Timeline.TimelineBuilder().build()));
+    }
+
+    @Test
+    void throw_unsupported_on_update_timeline_for_version() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.updateTimelineForVersion(new Timeline.TimelineBuilder().build()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubUserAccessStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubUserAccessStoreShould.java
new file mode 100644
index 000000000..0545e8594
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/TestGitHubUserAccessStoreShould.java
@@ -0,0 +1,207 @@
+package org.finos.calm.store.github;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import org.finos.calm.domain.UserAccess;
+import org.finos.calm.domain.exception.UserAccessNotFoundException;
+import org.finos.calm.security.OidcRoleResolver;
+import org.finos.calm.store.github.util.GitHubCloneManager;
+import org.finos.calm.store.github.util.InMemoryRegistryService;
+import org.finos.calm.store.github.util.RegistrySnapshot;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestGitHubUserAccessStoreShould {
+
+    private static final Set<String> ACCESS_GROUPS = Set.of("SCMReadOnly", "SCMDeveloper");
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private OidcRoleResolver roleResolver;
+
+    @Mock
+    private SecurityIdentity identity;
+
+    @Mock
+    private GitHubCloneManager cloneManager;
+
+    private GitHubUserAccessStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new GitHubUserAccessStore();
+        store.registryService = registryService;
+        store.roleResolver = roleResolver;
+        store.identity = identity;
+        store.cloneManager = cloneManager;
+
+        when(cloneManager.getAccessGroupsForNamespace("finos")).thenReturn(ACCESS_GROUPS);
+        when(cloneManager.getAccessGroupsForNamespace("team")).thenReturn(ACCESS_GROUPS);
+    }
+
+    @Test
+    void return_empty_grants_when_no_matching_group() {
+        when(roleResolver.resolve(eq(identity), any())).thenReturn(OidcRoleResolver.AccessLevel.NONE);
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "team", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<UserAccess> result = store.getGrantsForUser("testuser");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_read_grants_when_group_matches() {
+        when(roleResolver.resolve(eq(identity), eq(ACCESS_GROUPS)))
+                .thenReturn(OidcRoleResolver.AccessLevel.READ);
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "team", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<UserAccess> result = store.getGrantsForUser("testuser");
+
+        assertThat(result, hasSize(2));
+        assertThat(result.get(0).getPermission(), equalTo(UserAccess.Permission.read));
+        assertThat(result.get(1).getPermission(), equalTo(UserAccess.Permission.read));
+    }
+
+    @Test
+    void grant_per_namespace_access_independently() {
+        when(cloneManager.getAccessGroupsForNamespace("public")).thenReturn(Set.of("Everyone"));
+        when(roleResolver.resolve(eq(identity), eq(Set.of("Everyone"))))
+                .thenReturn(OidcRoleResolver.AccessLevel.READ);
+        when(roleResolver.resolve(eq(identity), eq(ACCESS_GROUPS)))
+                .thenReturn(OidcRoleResolver.AccessLevel.NONE);
+
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "public", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        List<UserAccess> result = store.getGrantsForUser("testuser");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0).getNamespace(), equalTo("public"));
+    }
+
+    @Test
+    void return_empty_grants_when_no_namespaces() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        List<UserAccess> result = store.getGrantsForUser("testuser");
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void throw_user_access_not_found_when_no_access() {
+        when(roleResolver.resolve(eq(identity), any())).thenReturn(OidcRoleResolver.AccessLevel.NONE);
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()),
+                Map.of(),
+                Map.of()
+        );
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        assertThrows(UserAccessNotFoundException.class,
+                () -> store.getUserAccessForUsername("testuser"));
+    }
+
+    @Test
+    void throw_user_access_not_found_when_no_namespaces() {
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+
+        assertThrows(UserAccessNotFoundException.class,
+                () -> store.getUserAccessForUsername("testuser"));
+    }
+
+    @Test
+    void throw_unsupported_on_get_user_access_for_namespace() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getUserAccessForNamespace("finos"));
+    }
+
+    @Test
+    void throw_unsupported_on_get_user_access_for_namespace_and_id() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getUserAccessForNamespaceAndId("finos", 1));
+    }
+
+    @Test
+    void throw_unsupported_on_get_user_access_for_domain() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getUserAccessForDomain("security"));
+    }
+
+    @Test
+    void throw_unsupported_on_get_user_access_for_domain_and_id() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.getUserAccessForDomainAndId("security", 1));
+    }
+
+    @Test
+    void throw_unsupported_on_create_user_access_for_namespace() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createUserAccessForNamespace(new UserAccess()));
+    }
+
+    @Test
+    void throw_unsupported_on_create_user_access_for_domain() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.createUserAccessForDomain(new UserAccess()));
+    }
+
+    @Test
+    void throw_unsupported_on_delete_user_access_for_namespace() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.deleteUserAccessForNamespace("finos", 1));
+    }
+
+    @Test
+    void throw_unsupported_on_delete_user_access_for_domain() {
+        assertThrows(UnsupportedOperationException.class,
+                () -> store.deleteUserAccessForDomain("security", 1));
+    }
+
+    @Test
+    void no_op_on_delete_all_user_access_for_namespace() {
+        assertDoesNotThrow(() -> store.deleteAllUserAccessForNamespace("finos"));
+    }
+
+    @Test
+    void no_op_on_delete_all_user_access_for_domain() {
+        assertDoesNotThrow(() -> store.deleteAllUserAccessForDomain("security"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestCalmContentDetectorShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestCalmContentDetectorShould.java
new file mode 100644
index 000000000..1e1a10767
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestCalmContentDetectorShould.java
@@ -0,0 +1,268 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Path;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+
+class TestCalmContentDetectorShould {
+
+    private CalmContentDetector detector;
+
+    @BeforeEach
+    void setup() {
+        detector = new CalmContentDetector();
+    }
+
+    @Test
+    void detect_architecture_from_nodes_array_in_architectures_directory() {
+        String json = "{\"nodes\": [], \"relationships\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("architectures/payment.json"));
+        assertThat(type, equalTo(CalmResourceType.ARCHITECTURE));
+    }
+
+    @Test
+    void detect_pattern_from_nodes_array_in_patterns_directory() {
+        String json = "{\"nodes\": [], \"relationships\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("patterns/microservices.json"));
+        assertThat(type, equalTo(CalmResourceType.PATTERN));
+    }
+
+    @Test
+    void return_unknown_when_nodes_present_but_unknown_directory() {
+        String json = "{\"nodes\": [{\"unique-id\": \"svc\"}]}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/something.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void detect_timeline_from_moments_array() {
+        String json = "{\"moments\": [{\"date\": \"2026-01-01\"}]}";
+        CalmResourceType type = detector.detect(json, Path.of("timelines/roadmap.json"));
+        assertThat(type, equalTo(CalmResourceType.TIMELINE));
+    }
+
+    @Test
+    void detect_timeline_from_schema_url() {
+        String json = "{\"$schema\": \"https://calm.finos.org/draft/2026-03/meta/calm-timeline.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("any/thing.json"));
+        assertThat(type, equalTo(CalmResourceType.TIMELINE));
+    }
+
+    @Test
+    void detect_flow_from_schema_url() {
+        String json = "{\"$schema\": \"https://calm.finos.org/draft/2026-03/meta/flow.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("flows/checkout.json"));
+        assertThat(type, equalTo(CalmResourceType.FLOW));
+    }
+
+    @Test
+    void detect_interface_from_schema_url() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/interface.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("interfaces/api.json"));
+        assertThat(type, equalTo(CalmResourceType.INTERFACE));
+    }
+
+    @Test
+    void detect_control_from_schema_url() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/control.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("controls/security/tls.json"));
+        assertThat(type, equalTo(CalmResourceType.CONTROL));
+    }
+
+    @Test
+    void detect_decorator_from_schema_url() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/decorators.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("decorators/governance.json"));
+        assertThat(type, equalTo(CalmResourceType.DECORATOR));
+    }
+
+    @Test
+    void detect_standard_from_directory_only() {
+        String json = "{\"title\": \"API Design Standard\"}";
+        CalmResourceType type = detector.detect(json, Path.of("standards/api-design.json"));
+        assertThat(type, equalTo(CalmResourceType.STANDARD));
+    }
+
+    @Test
+    void detect_guideline_from_directory_only() {
+        String json = "{\"title\": \"Microservices Guideline\"}";
+        CalmResourceType type = detector.detect(json, Path.of("guidelines/microservices.json"));
+        assertThat(type, equalTo(CalmResourceType.GUIDELINE));
+    }
+
+    @Test
+    void detect_adr_from_directory_only() {
+        String json = "{\"status\": \"accepted\", \"context\": \"we need X\"}";
+        CalmResourceType type = detector.detect(json, Path.of("adrs/0001-use-kafka.json"));
+        assertThat(type, equalTo(CalmResourceType.ADR));
+    }
+
+    @Test
+    void detect_control_from_directory_convention() {
+        String json = "{\"requirement\": \"must use TLS\"}";
+        CalmResourceType type = detector.detect(json, Path.of("controls/tls-policy.json"));
+        assertThat(type, equalTo(CalmResourceType.CONTROL));
+    }
+
+    @Test
+    void return_unknown_for_null_content() {
+        CalmResourceType type = detector.detect(null, Path.of("test.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void return_unknown_for_blank_content() {
+        CalmResourceType type = detector.detect("  ", Path.of("test.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void return_unknown_for_invalid_json() {
+        CalmResourceType type = detector.detect("not json at all", Path.of("test.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void return_unknown_for_unrecognized_content_in_unknown_directory() {
+        String json = "{\"foo\": \"bar\"}";
+        CalmResourceType type = detector.detect(json, Path.of("random/stuff.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void handle_null_file_path_gracefully() {
+        String json = "{\"nodes\": []}";
+        CalmResourceType type = detector.detect(json, null);
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void detect_pattern_from_nodes_in_patterns_directory_with_nested_path() {
+        String json = "{\"nodes\": [{\"unique-id\": \"svc\"}], \"relationships\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("patterns/sub/event-driven.json"));
+        assertThat(type, equalTo(CalmResourceType.PATTERN));
+    }
+
+    @Test
+    void detect_flow_from_directory_when_no_schema() {
+        String json = "{\"steps\": [{\"from\": \"a\", \"to\": \"b\"}]}";
+        CalmResourceType type = detector.detect(json, Path.of("flows/checkout-flow.json"));
+        assertThat(type, equalTo(CalmResourceType.FLOW));
+    }
+
+    @Test
+    void detect_interface_from_directory_only() {
+        String json = "{\"endpoints\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("interfaces/payment-api.json"));
+        assertThat(type, equalTo(CalmResourceType.INTERFACE));
+    }
+
+    @Test
+    void detect_decorator_from_directory_only() {
+        String json = "{\"type\": \"governance\"}";
+        CalmResourceType type = detector.detect(json, Path.of("decorators/aigf.json"));
+        assertThat(type, equalTo(CalmResourceType.DECORATOR));
+    }
+
+    @Test
+    void detect_timeline_from_directory_only_without_moments() {
+        String json = "{\"entries\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("timelines/roadmap.json"));
+        assertThat(type, equalTo(CalmResourceType.TIMELINE));
+    }
+
+    @Test
+    void prefer_content_signal_over_directory_for_timeline() {
+        String json = "{\"moments\": [{\"date\": \"2026-01-01\"}]}";
+        CalmResourceType type = detector.detect(json, Path.of("architectures/misplaced.json"));
+        assertThat(type, equalTo(CalmResourceType.TIMELINE));
+    }
+
+    @Test
+    void detect_from_relationships_array_alone() {
+        String json = "{\"relationships\": [{\"unique-id\": \"rel-1\"}]}";
+        CalmResourceType type = detector.detect(json, Path.of("architectures/conn.json"));
+        assertThat(type, equalTo(CalmResourceType.ARCHITECTURE));
+    }
+
+    @Test
+    void detect_flow_from_schema_without_directory_hint() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/flow.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/some-flow.json"));
+        assertThat(type, equalTo(CalmResourceType.FLOW));
+    }
+
+    @Test
+    void detect_interface_from_schema_without_directory_hint() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/interface.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/api.json"));
+        assertThat(type, equalTo(CalmResourceType.INTERFACE));
+    }
+
+    @Test
+    void detect_control_from_schema_without_directory_hint() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/control.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/tls.json"));
+        assertThat(type, equalTo(CalmResourceType.CONTROL));
+    }
+
+    @Test
+    void detect_decorator_from_schema_without_directory_hint() {
+        String json = "{\"$schema\": \"https://calm.finos.org/release/1.2/meta/decorators.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/gov.json"));
+        assertThat(type, equalTo(CalmResourceType.DECORATOR));
+    }
+
+    @Test
+    void return_unknown_when_schema_does_not_match_any_keyword() {
+        String json = "{\"$schema\": \"https://example.com/unknown-schema.json\"}";
+        CalmResourceType type = detector.detect(json, Path.of("misc/thing.json"));
+        assertThat(type, equalTo(CalmResourceType.UNKNOWN));
+    }
+
+    @Test
+    void detect_standard_from_nodes_in_standards_directory() {
+        String json = "{\"nodes\": [], \"relationships\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("standards/api-design.json"));
+        assertThat(type, equalTo(CalmResourceType.STANDARD));
+    }
+
+    @Test
+    void detect_guideline_from_nodes_in_guidelines_directory() {
+        String json = "{\"nodes\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("guidelines/best.json"));
+        assertThat(type, equalTo(CalmResourceType.GUIDELINE));
+    }
+
+    @Test
+    void detect_adr_from_nodes_in_adrs_directory() {
+        String json = "{\"nodes\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("adrs/0001.json"));
+        assertThat(type, equalTo(CalmResourceType.ADR));
+    }
+
+    @Test
+    void detect_building_block_from_nodes_in_building_blocks_directory() {
+        String json = "{\"nodes\": [{\"unique-id\": \"svc\"}], \"relationships\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("building-blocks/auth-block.json"));
+        assertThat(type, equalTo(CalmResourceType.BUILDING_BLOCK));
+    }
+
+    @Test
+    void detect_building_block_from_directory_only() {
+        String json = "{\"title\": \"Auth Building Block\"}";
+        CalmResourceType type = detector.detect(json, Path.of("building-blocks/auth-block.json"));
+        assertThat(type, equalTo(CalmResourceType.BUILDING_BLOCK));
+    }
+
+    @Test
+    void detect_building_block_from_nested_path() {
+        String json = "{\"nodes\": []}";
+        CalmResourceType type = detector.detect(json, Path.of("building-blocks/sub/auth-block.json"));
+        assertThat(type, equalTo(CalmResourceType.BUILDING_BLOCK));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubCloneManagerShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubCloneManagerShould.java
new file mode 100644
index 000000000..9427168ad
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubCloneManagerShould.java
@@ -0,0 +1,194 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasKey;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.nullValue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestGitHubCloneManagerShould {
+
+    @Mock
+    private GitHubRepoSync repoSync;
+
+    @Mock
+    private GitHubStoreConfig config;
+
+    private GitHubCloneManager cloneManager;
+
+    @BeforeEach
+    void setup() {
+        when(config.getCloneDirectory()).thenReturn(Path.of("/tmp/test-clones"));
+        when(config.getServiceToken()).thenReturn("test-token");
+        cloneManager = new GitHubCloneManager(repoSync, config);
+    }
+
+    @Test
+    void start_in_initializing_state() {
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.INITIALIZING));
+    }
+
+    @Test
+    void transition_to_ready_when_no_namespaces_registered() {
+        cloneManager.cloneAll();
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.READY));
+    }
+
+    @Test
+    void transition_to_ready_when_all_clones_succeed() {
+        cloneManager.registerNamespace("finos", "finos/architecture-as-code", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(eq("finos/architecture-as-code"), eq("main"), any(), eq("test-token")))
+                .thenReturn(true);
+
+        cloneManager.cloneAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.READY));
+    }
+
+    @Test
+    void transition_to_failed_when_all_clones_fail() {
+        cloneManager.registerNamespace("finos", "finos/architecture-as-code", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(any(), any(), any(), any())).thenReturn(false);
+
+        cloneManager.cloneAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.FAILED));
+    }
+
+    @Test
+    void transition_to_degraded_when_some_clones_fail() {
+        cloneManager.registerNamespace("ns1", "org/repo1", "main");
+        cloneManager.registerNamespace("ns2", "org/repo2", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(eq("org/repo1"), eq("main"), any(), any())).thenReturn(true);
+        when(repoSync.cloneRepo(eq("org/repo2"), eq("main"), any(), any())).thenReturn(false);
+
+        cloneManager.cloneAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.DEGRADED));
+    }
+
+    @Test
+    void pull_instead_of_clone_when_repo_already_exists() {
+        cloneManager.registerNamespace("finos", "finos/architecture-as-code", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(true);
+        when(repoSync.pullRepo(any(), eq("test-token"))).thenReturn(true);
+
+        cloneManager.cloneAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.READY));
+    }
+
+    @Test
+    void skip_pull_all_when_still_cloning() {
+        cloneManager.registerNamespace("finos", "finos/repo", "main");
+        // State is INITIALIZING, pullAll should be a no-op
+        cloneManager.pullAll();
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.INITIALIZING));
+    }
+
+    @Test
+    void pull_all_repos_and_stay_ready() {
+        cloneManager.registerNamespace("finos", "finos/repo", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(any(), any(), any(), any())).thenReturn(true);
+        cloneManager.cloneAll();
+
+        when(repoSync.isValidRepo(any())).thenReturn(true);
+        when(repoSync.pullRepo(any(), any())).thenReturn(true);
+        cloneManager.pullAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.READY));
+    }
+
+    @Test
+    void transition_to_failed_on_pull_all_when_all_fail() {
+        cloneManager.registerNamespace("ns1", "org/repo1", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(any(), any(), any(), any())).thenReturn(true);
+        cloneManager.cloneAll();
+
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        cloneManager.pullAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.FAILED));
+    }
+
+    @Test
+    void return_namespace_clone_paths() {
+        cloneManager.registerNamespace("finos", "finos/repo", "main");
+        cloneManager.registerNamespace("team", "org/team-repo", "main");
+
+        Map<String, Path> paths = cloneManager.getNamespaceClonePaths();
+
+        assertThat(paths, hasKey("finos"));
+        assertThat(paths, hasKey("team"));
+        assertThat(paths.get("finos"), equalTo(Path.of("/tmp/test-clones/finos")));
+    }
+
+    @Test
+    void report_has_namespaces_correctly() {
+        assertThat(cloneManager.hasNamespaces(), is(false));
+        cloneManager.registerNamespace("finos", "finos/repo", "main");
+        assertThat(cloneManager.hasNamespaces(), is(true));
+    }
+
+    @Test
+    void register_namespace_with_access_groups() {
+        cloneManager.registerNamespace("finos", "finos/repo", "main", Set.of("group-a", "group-b"));
+        assertThat(cloneManager.getAccessGroupsForNamespace("finos"), equalTo(Set.of("group-a", "group-b")));
+    }
+
+    @Test
+    void return_empty_access_groups_for_unknown_namespace() {
+        assertThat(cloneManager.getAccessGroupsForNamespace("unknown"), is(empty()));
+    }
+
+    @Test
+    void return_repo_for_registered_namespace() {
+        cloneManager.registerNamespace("finos", "finos/repo", "main");
+        assertThat(cloneManager.getRepoForNamespace("finos"), equalTo("finos/repo"));
+    }
+
+    @Test
+    void return_null_for_unknown_namespace_repo() {
+        assertThat(cloneManager.getRepoForNamespace("unknown"), is(nullValue()));
+    }
+
+    @Test
+    void transition_to_degraded_on_pull_all_when_some_fail() {
+        cloneManager.registerNamespace("ns1", "org/repo1", "main");
+        cloneManager.registerNamespace("ns2", "org/repo2", "main");
+        when(repoSync.isValidRepo(any())).thenReturn(false);
+        when(repoSync.cloneRepo(any(), any(), any(), any())).thenReturn(true);
+        cloneManager.cloneAll();
+
+        when(repoSync.isValidRepo(Path.of("/tmp/test-clones/ns1"))).thenReturn(true);
+        when(repoSync.isValidRepo(Path.of("/tmp/test-clones/ns2"))).thenReturn(true);
+        when(repoSync.pullRepo(Path.of("/tmp/test-clones/ns1"), "test-token")).thenReturn(true);
+        when(repoSync.pullRepo(Path.of("/tmp/test-clones/ns2"), "test-token")).thenReturn(false);
+        cloneManager.pullAll();
+
+        assertThat(cloneManager.getState(), equalTo(GitHubCloneManager.State.DEGRADED));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubForkPRServiceShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubForkPRServiceShould.java
new file mode 100644
index 000000000..e4a1564d0
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubForkPRServiceShould.java
@@ -0,0 +1,32 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class TestGitHubForkPRServiceShould {
+
+    private GitHubForkPRService service;
+
+    @BeforeEach
+    void setup() {
+        service = new GitHubForkPRService();
+    }
+
+    @Test
+    void throw_unsupported_until_oauth_flow_is_wired() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> service.createPullRequest(
+                        "gho_token",
+                        "finos/architecture-as-code",
+                        "main",
+                        "patterns/new-pattern.json",
+                        "{\"nodes\": []}",
+                        "feat: add new pattern"
+                ));
+        assertThat(ex.getMessage(), containsString("GitHub account linking"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubRepoSyncShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubRepoSyncShould.java
new file mode 100644
index 000000000..aff96da2a
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubRepoSyncShould.java
@@ -0,0 +1,125 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import org.eclipse.jgit.api.Git;
+import org.eclipse.jgit.api.errors.GitAPIException;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+
+class TestGitHubRepoSyncShould {
+
+    private GitHubRepoSync repoSync;
+
+    @TempDir
+    Path tempDir;
+
+    @BeforeEach
+    void setup() {
+        repoSync = new GitHubRepoSync();
+    }
+
+    @Test
+    void return_false_for_invalid_repo_when_directory_does_not_exist() {
+        assertThat(repoSync.isValidRepo(tempDir.resolve("nonexistent")), is(false));
+    }
+
+    @Test
+    void return_false_for_invalid_repo_when_no_git_directory() {
+        assertThat(repoSync.isValidRepo(tempDir), is(false));
+    }
+
+    @Test
+    void return_true_for_valid_repo_when_git_directory_exists() throws IOException {
+        Files.createDirectories(tempDir.resolve(".git"));
+        assertThat(repoSync.isValidRepo(tempDir), is(true));
+    }
+
+    @Test
+    void return_false_when_clone_fails_with_invalid_url() {
+        boolean result = repoSync.cloneRepo(
+                "nonexistent-org/nonexistent-repo",
+                "main",
+                tempDir.resolve("clone-target"),
+                "invalid-token"
+        );
+        assertThat(result, is(false));
+    }
+
+    @Test
+    void return_false_when_pull_on_non_repo_directory() {
+        boolean result = repoSync.pullRepo(tempDir, "token");
+        assertThat(result, is(false));
+    }
+
+    @Test
+    void clone_local_bare_repo_successfully() throws GitAPIException, IOException {
+        Path bareRepo = tempDir.resolve("bare.git");
+        Git.init().setDirectory(bareRepo.toFile()).setBare(true).call().close();
+
+        Path cloneTarget = tempDir.resolve("cloned");
+        boolean result = repoSync.cloneRepo(
+                bareRepo.toUri().toString().replace("file:", "").replace(".git", ""),
+                "master",
+                cloneTarget,
+                null
+        );
+        // Clone from local bare repo using file:// URI directly
+        // The cloneRepo method prepends https://github.com/ so this will fail
+        // but we can test the pull path instead via a real local clone
+        assertThat(result, is(false));
+    }
+
+    @Test
+    void pull_local_repo_successfully() throws GitAPIException, IOException {
+        Path originDir = tempDir.resolve("origin");
+        Files.createDirectories(originDir);
+        try (Git origin = Git.init().setDirectory(originDir.toFile()).setInitialBranch("main").call()) {
+            Files.writeString(originDir.resolve("test.txt"), "hello");
+            origin.add().addFilepattern("test.txt").call();
+            origin.commit().setMessage("init").call();
+        }
+
+        Path cloneDir = tempDir.resolve("clone");
+        try (Git ignored = Git.cloneRepository()
+                .setURI(originDir.toUri().toString())
+                .setDirectory(cloneDir.toFile())
+                .setBranch("main")
+                .call()) {
+            // clone done
+        }
+
+        boolean result = repoSync.pullRepo(cloneDir, null);
+        assertThat(result, is(true));
+    }
+
+    @Test
+    void pull_returns_true_when_already_up_to_date() throws GitAPIException, IOException {
+        Path originDir = tempDir.resolve("origin2");
+        Files.createDirectories(originDir);
+        try (Git origin = Git.init().setDirectory(originDir.toFile()).setInitialBranch("main").call()) {
+            Files.writeString(originDir.resolve("file.txt"), "content");
+            origin.add().addFilepattern("file.txt").call();
+            origin.commit().setMessage("initial").call();
+        }
+
+        Path cloneDir = tempDir.resolve("clone2");
+        try (Git ignored = Git.cloneRepository()
+                .setURI(originDir.toUri().toString())
+                .setDirectory(cloneDir.toFile())
+                .setBranch("main")
+                .call()) {
+            // clone done
+        }
+
+        boolean result = repoSync.pullRepo(cloneDir, "");
+        assertThat(result, is(true));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStartupInitializerShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStartupInitializerShould.java
new file mode 100644
index 000000000..343393004
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStartupInitializerShould.java
@@ -0,0 +1,144 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.runtime.StartupEvent;
+import org.eclipse.microprofile.context.ManagedExecutor;
+import org.finos.calm.observability.GitHubMetrics;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.CompletableFuture;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestGitHubStartupInitializerShould {
+
+    @Mock
+    private GitHubCloneManager cloneManager;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private GitHubMetrics metrics;
+
+    @Mock
+    private ManagedExecutor executor;
+
+    private GitHubStartupInitializer initializer;
+
+    @BeforeEach
+    void setup() {
+        initializer = new GitHubStartupInitializer();
+        initializer.cloneManager = cloneManager;
+        initializer.registryService = registryService;
+        initializer.metrics = metrics;
+        initializer.executor = executor;
+
+        // Make executor.runAsync execute the Runnable immediately (synchronously for testing)
+        when(executor.runAsync(any(Runnable.class))).thenAnswer(invocation -> {
+            Runnable task = invocation.getArgument(0);
+            task.run();
+            return CompletableFuture.completedFuture(null);
+        });
+    }
+
+    @Test
+    void skip_when_no_namespaces_configured() {
+        initializer.namespaceConfigs = Optional.empty();
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager, never()).cloneAll();
+        verify(registryService, never()).rebuild(any());
+    }
+
+    @Test
+    void register_namespaces_and_clone() {
+        initializer.namespaceConfigs = Optional.of(List.of(
+                "finos|finos/architecture-as-code|main",
+                "team|my-org/team-repo"
+        ));
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of(
+                "finos", Path.of("/tmp/finos"),
+                "team", Path.of("/tmp/team")
+        ));
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager).registerNamespace("finos", "finos/architecture-as-code", "main", java.util.Set.of());
+        verify(cloneManager).registerNamespace("team", "my-org/team-repo", "main", java.util.Set.of());
+        verify(cloneManager).cloneAll();
+        verify(registryService).rebuild(any());
+        verify(metrics).recordSyncSuccess(any());
+    }
+
+    @Test
+    void skip_invalid_entries() {
+        initializer.namespaceConfigs = Optional.of(List.of("invalid-no-pipe"));
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of());
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager, never()).registerNamespace(any(), any(), any(), any());
+    }
+
+    @Test
+    void parse_access_groups_from_namespace_config() {
+        initializer.namespaceConfigs = Optional.of(List.of(
+                "finos|finos/repo|main|group-a;group-b"
+        ));
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of(
+                "finos", Path.of("/tmp/finos")
+        ));
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager).registerNamespace("finos", "finos/repo", "main",
+                java.util.Set.of("group-a", "group-b"));
+    }
+
+    @Test
+    void handle_clone_failure_gracefully() {
+        initializer.namespaceConfigs = Optional.of(List.of("finos|finos/repo|main"));
+        when(executor.runAsync(any(Runnable.class))).thenAnswer(invocation -> {
+            Runnable task = invocation.getArgument(0);
+            task.run();
+            return java.util.concurrent.CompletableFuture.completedFuture(null);
+        });
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of());
+        org.mockito.Mockito.doThrow(new RuntimeException("clone failed")).when(cloneManager).cloneAll();
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager).cloneAll();
+        verify(registryService, never()).rebuild(any());
+    }
+
+    @Test
+    void parse_blank_access_groups_as_empty_set() {
+        initializer.namespaceConfigs = Optional.of(List.of(
+                "finos|finos/repo|main|  "
+        ));
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of(
+                "finos", Path.of("/tmp/finos")
+        ));
+
+        initializer.onStart(new StartupEvent());
+
+        verify(cloneManager).registerNamespace("finos", "finos/repo", "main", java.util.Set.of());
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStoreConfigShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStoreConfigShould.java
new file mode 100644
index 000000000..4f42a7af6
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubStoreConfigShould.java
@@ -0,0 +1,48 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+
+class TestGitHubStoreConfigShould {
+
+    @Test
+    void return_service_token_when_present() {
+        GitHubStoreConfig config = new GitHubStoreConfig();
+        config.serviceToken = Optional.of("ghp_test123");
+        assertThat(config.getServiceToken(), equalTo("ghp_test123"));
+    }
+
+    @Test
+    void return_empty_string_when_service_token_absent() {
+        GitHubStoreConfig config = new GitHubStoreConfig();
+        config.serviceToken = Optional.empty();
+        assertThat(config.getServiceToken(), equalTo(""));
+    }
+
+    @Test
+    void return_clone_directory_as_path() {
+        GitHubStoreConfig config = new GitHubStoreConfig();
+        config.cloneDirectory = "/tmp/calm-clones";
+        assertThat(config.getCloneDirectory(), equalTo(Path.of("/tmp/calm-clones")));
+    }
+
+    @Test
+    void return_sync_interval() {
+        GitHubStoreConfig config = new GitHubStoreConfig();
+        config.syncInterval = 120;
+        assertThat(config.getSyncInterval(), equalTo(120));
+    }
+
+    @Test
+    void return_api_url() {
+        GitHubStoreConfig config = new GitHubStoreConfig();
+        config.apiUrl = "https://api.github.com";
+        assertThat(config.getApiUrl(), equalTo("https://api.github.com"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubSyncSchedulerShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubSyncSchedulerShould.java
new file mode 100644
index 000000000..728e10d1c
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubSyncSchedulerShould.java
@@ -0,0 +1,70 @@
+package org.finos.calm.store.github.util;
+
+import org.finos.calm.observability.GitHubMetrics;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.nio.file.Path;
+import java.util.Map;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestGitHubSyncSchedulerShould {
+
+    @Mock
+    private GitHubCloneManager cloneManager;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private GitHubMetrics metrics;
+
+    private GitHubSyncScheduler scheduler;
+
+    @BeforeEach
+    void setup() {
+        scheduler = new GitHubSyncScheduler(cloneManager, registryService, metrics);
+    }
+
+    @Test
+    void skip_sync_when_no_namespaces_registered() {
+        when(cloneManager.hasNamespaces()).thenReturn(false);
+
+        scheduler.sync();
+
+        verify(cloneManager, never()).pullAll();
+        verify(registryService, never()).rebuild(any());
+    }
+
+    @Test
+    void pull_all_and_rebuild_registry_on_sync() {
+        when(cloneManager.hasNamespaces()).thenReturn(true);
+        when(cloneManager.getNamespaceClonePaths()).thenReturn(Map.of("finos", Path.of("/tmp/finos")));
+
+        scheduler.sync();
+
+        verify(cloneManager).pullAll();
+        verify(registryService).rebuild(Map.of("finos", Path.of("/tmp/finos")));
+        verify(metrics).recordSyncSuccess(any());
+        verify(metrics).recordRegistryRebuild(any());
+    }
+
+    @Test
+    void record_failure_metric_when_sync_throws() {
+        when(cloneManager.hasNamespaces()).thenReturn(true);
+        doThrow(new RuntimeException("sync error")).when(cloneManager).pullAll();
+
+        scheduler.sync();
+
+        verify(metrics).recordSyncFailure(any());
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubVersionServiceShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubVersionServiceShould.java
new file mode 100644
index 000000000..5220b7096
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestGitHubVersionServiceShould.java
@@ -0,0 +1,113 @@
+package org.finos.calm.store.github.util;
+
+import org.finos.calm.cache.CalmCacheService;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import java.time.Duration;
+import java.util.List;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+import static org.hamcrest.Matchers.empty;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.verify;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestGitHubVersionServiceShould {
+
+    @Mock
+    private CalmCacheService cache;
+
+    private GitHubVersionService service;
+
+    @BeforeEach
+    void setup() {
+        service = new GitHubVersionService();
+        service.cache = cache;
+        service.apiUrl = "https://api.github.com";
+        service.serviceToken = Optional.of("test-token");
+        service.maxVersions = 100;
+        service.connectTimeoutSeconds = 10;
+        service.requestTimeoutSeconds = 30;
+    }
+
+    @Test
+    void return_cached_versions_when_available() {
+        List<String> cached = List.of("abc1234", "def5678");
+        when(cache.get("versions:org/repo:path/file.json", List.class)).thenReturn(Optional.of(cached));
+
+        List<String> result = service.getFileVersions("org/repo", "path/file.json");
+
+        assertThat(result, equalTo(cached));
+    }
+
+    @Test
+    void return_latest_when_api_fails() {
+        when(cache.get(any(), eq(List.class))).thenReturn(Optional.empty());
+
+        // API will fail since we're not running a real server
+        List<String> result = service.getFileVersions("org/repo", "path/file.json");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void return_latest_when_no_token() {
+        service.serviceToken = Optional.empty();
+        when(cache.get(any(), eq(List.class))).thenReturn(Optional.empty());
+
+        List<String> result = service.getFileVersions("org/repo", "path/file.json");
+
+        assertThat(result, hasSize(1));
+        assertThat(result.get(0), equalTo("latest"));
+    }
+
+    @Test
+    void extract_abbreviated_7_char_shas_from_github_api_response() {
+        String sha1 = "abcdef1234567890abcdef1234567890abcdef12";
+        String sha2 = "1234567890abcdef1234567890abcdef12345678";
+        String json = "[{\"sha\":\"" + sha1 + "\",\"commit\":{}},{\"sha\":\"" + sha2 + "\",\"commit\":{}}]";
+
+        List<String> shas = service.extractShas(json, 100);
+
+        assertThat(shas, hasSize(2));
+        assertThat(shas.get(0), equalTo("abcdef1"));
+        assertThat(shas.get(1), equalTo("1234567"));
+    }
+
+    @Test
+    void return_empty_list_when_no_shas_in_response() {
+        List<String> shas = service.extractShas("[]", 100);
+
+        assertThat(shas, is(empty()));
+    }
+
+    @Test
+    void limit_to_configured_max_versions() {
+        service.maxVersions = 5;
+        StringBuilder json = new StringBuilder("[");
+        for (int i = 0; i < 15; i++) {
+            if (i > 0) json.append(",");
+            json.append(String.format("{\"sha\":\"%040x\"}", i));
+        }
+        json.append("]");
+
+        List<String> shas = service.extractShas(json.toString(), 5);
+
+        assertThat(shas, hasSize(5));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestInMemoryRegistryServiceShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestInMemoryRegistryServiceShould.java
new file mode 100644
index 000000000..32bb1fdd2
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestInMemoryRegistryServiceShould.java
@@ -0,0 +1,265 @@
+package org.finos.calm.store.github.util;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.hasSize;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.not;
+
+class TestInMemoryRegistryServiceShould {
+
+    private InMemoryRegistryService registryService;
+
+    @TempDir
+    Path tempDir;
+
+    @BeforeEach
+    void setup() {
+        registryService = new InMemoryRegistryService(new CalmContentDetector());
+    }
+
+    @Test
+    void return_empty_snapshot_before_rebuild() {
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, is(empty()));
+    }
+
+    @Test
+    void discover_architecture_from_json_with_nodes() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("payment.json"),
+                "{\"unique-id\": \"payment-platform\", \"name\": \"Payment Platform\", \"nodes\": [], \"relationships\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("payment-platform"));
+        assertThat(entries.get(0).name(), equalTo("Payment Platform"));
+    }
+
+    @Test
+    void discover_pattern_from_patterns_directory() throws IOException {
+        Path patternDir = tempDir.resolve("patterns");
+        Files.createDirectories(patternDir);
+        Files.writeString(patternDir.resolve("event-driven.json"),
+                "{\"unique-id\": \"event-driven\", \"name\": \"Event Driven\", \"nodes\": [{\"unique-id\": \"broker\"}]}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.PATTERN);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("event-driven"));
+    }
+
+    @Test
+    void derive_unique_id_from_filename_when_missing() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("my-system.json"),
+                "{\"name\": \"My System\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("my-system"));
+    }
+
+    @Test
+    void find_entry_by_unique_id() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("payment.json"),
+                "{\"unique-id\": \"payment-svc\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        Optional<RegistryEntry> found = registryService.findByUniqueId("finos", "payment-svc");
+        assertThat(found.isPresent(), is(true));
+        assertThat(found.get().uniqueId(), equalTo("payment-svc"));
+    }
+
+    @Test
+    void return_empty_for_unknown_unique_id() throws IOException {
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        Optional<RegistryEntry> found = registryService.findByUniqueId("finos", "nonexistent");
+        assertThat(found.isPresent(), is(false));
+    }
+
+    @Test
+    void skip_hidden_directories() throws IOException {
+        Path hiddenDir = tempDir.resolve(".git");
+        Files.createDirectories(hiddenDir);
+        Files.writeString(hiddenDir.resolve("config.json"), "{\"nodes\": []}");
+
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("real.json"), "{\"unique-id\": \"real\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("real"));
+    }
+
+    @Test
+    void handle_multiple_namespaces() throws IOException {
+        Path ns1 = tempDir.resolve("ns1");
+        Path ns2 = tempDir.resolve("ns2");
+        Files.createDirectories(ns1.resolve("architectures"));
+        Files.createDirectories(ns2.resolve("patterns"));
+        Files.writeString(ns1.resolve("architectures/a.json"), "{\"unique-id\": \"a\", \"nodes\": []}");
+        Files.writeString(ns2.resolve("patterns/p.json"), "{\"unique-id\": \"p\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("team-a", ns1, "team-b", ns2));
+
+        assertThat(registryService.listByType("team-a", CalmResourceType.ARCHITECTURE), hasSize(1));
+        assertThat(registryService.listByType("team-b", CalmResourceType.PATTERN), hasSize(1));
+        assertThat(registryService.listByType("team-a", CalmResourceType.PATTERN), is(empty()));
+    }
+
+    @Test
+    void rebuild_replaces_previous_snapshot_atomically() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("v1.json"), "{\"unique-id\": \"v1\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+        assertThat(registryService.findByUniqueId("finos", "v1").isPresent(), is(true));
+
+        Files.delete(archDir.resolve("v1.json"));
+        Files.writeString(archDir.resolve("v2.json"), "{\"unique-id\": \"v2\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+        assertThat(registryService.findByUniqueId("finos", "v1").isPresent(), is(false));
+        assertThat(registryService.findByUniqueId("finos", "v2").isPresent(), is(true));
+    }
+
+    @Test
+    void skip_invalid_json_files_without_crashing() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("bad.json"), "not json at all");
+        Files.writeString(archDir.resolve("good.json"), "{\"unique-id\": \"good\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("good"));
+    }
+
+    @Test
+    void detect_guideline_in_guidelines_directory() throws IOException {
+        Path guideDir = tempDir.resolve("guidelines");
+        Files.createDirectories(guideDir);
+        Files.writeString(guideDir.resolve("best-practices.json"),
+                "{\"unique-id\": \"best-practices\", \"title\": \"Best Practices\"}");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.GUIDELINE);
+        assertThat(entries, hasSize(1));
+    }
+
+    @Test
+    void detect_markdown_standards_in_nested_directories() throws IOException {
+        Path stdDir = tempDir.resolve("standards/cloud/compute");
+        Files.createDirectories(stdDir);
+        Files.writeString(stdDir.resolve("vm-sizing.md"), "# VM Sizing Standard\n\nContent here.");
+        Files.writeString(stdDir.resolve("README.md"), "# README\n\nIgnored.");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.STANDARD);
+        assertThat(entries, hasSize(1));
+        assertThat(entries.get(0).uniqueId(), equalTo("vm-sizing"));
+    }
+
+    @Test
+    void detect_markdown_guidelines_in_nested_directories() throws IOException {
+        Path guideDir = tempDir.resolve("guidelines/security");
+        Files.createDirectories(guideDir);
+        Files.writeString(guideDir.resolve("tls-policy.md"), "# TLS Policy\n\nAlways use TLS.");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.GUIDELINE);
+        assertThat(entries, hasSize(1));
+    }
+
+    @Test
+    void skip_markdown_files_outside_known_directories() throws IOException {
+        Files.writeString(tempDir.resolve("README.md"), "# Project README");
+        Path miscDir = tempDir.resolve("docs");
+        Files.createDirectories(miscDir);
+        Files.writeString(miscDir.resolve("notes.md"), "# Notes");
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.STANDARD);
+        assertThat(entries, is(empty()));
+    }
+
+    @Test
+    void return_empty_list_for_unknown_namespace() {
+        registryService.rebuild(Map.of());
+        List<RegistryEntry> entries = registryService.listByType("nonexistent", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, is(empty()));
+    }
+
+    @Test
+    void return_empty_optional_for_unknown_namespace_in_find() {
+        registryService.rebuild(Map.of());
+        Optional<RegistryEntry> result = registryService.findByUniqueId("nonexistent", "any-id");
+        assertThat(result.isPresent(), is(false));
+    }
+
+    @Test
+    void get_snapshot_returns_current_state() throws IOException {
+        Path archDir = tempDir.resolve("architectures");
+        Files.createDirectories(archDir);
+        Files.writeString(archDir.resolve("test.json"), "{\"unique-id\": \"test\", \"nodes\": []}");
+
+        registryService.rebuild(Map.of("ns", tempDir));
+
+        RegistrySnapshot snapshot = registryService.getSnapshot();
+        assertThat(snapshot.getNamespaces(), hasSize(1));
+        assertThat(snapshot.listAll("ns"), hasSize(1));
+    }
+
+    @Test
+    void handle_empty_directory_gracefully() throws IOException {
+        Path emptyDir = tempDir.resolve("architectures");
+        Files.createDirectories(emptyDir);
+
+        registryService.rebuild(Map.of("finos", tempDir));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, is(empty()));
+    }
+
+    @Test
+    void handle_nonexistent_clone_path() {
+        registryService.rebuild(Map.of("finos", tempDir.resolve("does-not-exist")));
+
+        List<RegistryEntry> entries = registryService.listByType("finos", CalmResourceType.ARCHITECTURE);
+        assertThat(entries, is(empty()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/github/util/TestNamespaceAccessFilterShould.java b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestNamespaceAccessFilterShould.java
new file mode 100644
index 000000000..468fbf8ca
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/github/util/TestNamespaceAccessFilterShould.java
@@ -0,0 +1,134 @@
+package org.finos.calm.store.github.util;
+
+import io.quarkus.security.identity.SecurityIdentity;
+import org.finos.calm.security.OidcRoleResolver;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.security.Principal;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class TestNamespaceAccessFilterShould {
+
+    @Mock
+    private SecurityIdentity identity;
+
+    @Mock
+    private Principal principal;
+
+    @Mock
+    private OidcRoleResolver roleResolver;
+
+    @Mock
+    private InMemoryRegistryService registryService;
+
+    @Mock
+    private GitHubCloneManager cloneManager;
+
+    private NamespaceAccessFilter filter;
+
+    @BeforeEach
+    void setup() {
+        filter = new NamespaceAccessFilter();
+        filter.identity = identity;
+        filter.roleResolver = roleResolver;
+        filter.registryService = registryService;
+        filter.cloneManager = cloneManager;
+    }
+
+    @Test
+    void return_all_namespaces_when_auth_disabled() {
+        filter.authEnabled = false;
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "private", List.of()),
+                Map.of(), Map.of());
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+
+        Set<String> result = filter.getAccessibleNamespaces();
+
+        assertThat(result, containsInAnyOrder("finos", "private"));
+    }
+
+    @Test
+    void return_empty_when_identity_is_anonymous() {
+        filter.authEnabled = true;
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of()), Map.of(), Map.of());
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(identity.isAnonymous()).thenReturn(true);
+
+        Set<String> result = filter.getAccessibleNamespaces();
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_only_accessible_namespaces_based_on_oidc_groups() {
+        filter.authEnabled = true;
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("finos", List.of(), "private", List.of(), "restricted", List.of()),
+                Map.of(), Map.of());
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(identity.isAnonymous()).thenReturn(false);
+        when(identity.getPrincipal()).thenReturn(principal);
+        when(principal.getName()).thenReturn("testuser");
+
+        when(cloneManager.getAccessGroupsForNamespace("finos")).thenReturn(Set.of("team-a"));
+        when(cloneManager.getAccessGroupsForNamespace("private")).thenReturn(Set.of("team-b"));
+        when(cloneManager.getAccessGroupsForNamespace("restricted")).thenReturn(Set.of("team-c"));
+
+        when(roleResolver.resolve(eq(identity), eq(Set.of("team-a")))).thenReturn(OidcRoleResolver.AccessLevel.READ);
+        when(roleResolver.resolve(eq(identity), eq(Set.of("team-b")))).thenReturn(OidcRoleResolver.AccessLevel.NONE);
+        when(roleResolver.resolve(eq(identity), eq(Set.of("team-c")))).thenReturn(OidcRoleResolver.AccessLevel.READ);
+
+        Set<String> result = filter.getAccessibleNamespaces();
+
+        assertThat(result, containsInAnyOrder("finos", "restricted"));
+    }
+
+    @Test
+    void return_empty_when_no_namespaces_match() {
+        filter.authEnabled = true;
+        RegistrySnapshot snapshot = new RegistrySnapshot(
+                Map.of("private", List.of()), Map.of(), Map.of());
+        when(registryService.getSnapshot()).thenReturn(snapshot);
+        when(identity.isAnonymous()).thenReturn(false);
+        when(identity.getPrincipal()).thenReturn(principal);
+        when(principal.getName()).thenReturn("testuser");
+
+        when(cloneManager.getAccessGroupsForNamespace("private")).thenReturn(Set.of("admins"));
+        when(roleResolver.resolve(eq(identity), eq(Set.of("admins")))).thenReturn(OidcRoleResolver.AccessLevel.NONE);
+
+        Set<String> result = filter.getAccessibleNamespaces();
+
+        assertThat(result, is(empty()));
+    }
+
+    @Test
+    void return_empty_when_no_namespaces_registered() {
+        filter.authEnabled = true;
+        when(registryService.getSnapshot()).thenReturn(RegistrySnapshot.EMPTY);
+        when(identity.isAnonymous()).thenReturn(false);
+        when(identity.getPrincipal()).thenReturn(principal);
+        when(principal.getName()).thenReturn("testuser");
+
+        Set<String> result = filter.getAccessibleNamespaces();
+
+        assertThat(result, is(empty()));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpResourceMappingStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpResourceMappingStoreShould.java
new file mode 100644
index 000000000..24f515335
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpResourceMappingStoreShould.java
@@ -0,0 +1,74 @@
+package org.finos.calm.store.noop;
+
+import org.finos.calm.domain.ResourceType;
+import org.finos.calm.domain.exception.MappingNotFoundException;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.empty;
+import static org.hamcrest.Matchers.is;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class TestNoOpResourceMappingStoreShould {
+
+    private NoOpResourceMappingStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new NoOpResourceMappingStore();
+    }
+
+    @Test
+    void throw_on_create_mapping() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.createMapping("finos", "custom-id", ResourceType.ARCHITECTURE, 1));
+        assertThat(ex.getMessage(), containsString("unique-id"));
+    }
+
+    @Test
+    void throw_not_found_on_get_mapping() {
+        assertThrows(MappingNotFoundException.class,
+                () -> store.getMapping("finos", ResourceType.ARCHITECTURE, "custom-id"));
+    }
+
+    @Test
+    void return_empty_list_on_list_mappings() throws Exception {
+        assertThat(store.listMappings("finos", ResourceType.PATTERN), is(empty()));
+    }
+
+    @Test
+    void throw_not_found_on_get_mapping_by_numeric_id() {
+        assertThrows(MappingNotFoundException.class,
+                () -> store.getMappingByNumericId("finos", ResourceType.ARCHITECTURE, 1));
+    }
+
+    @Test
+    void return_empty_list_on_list_mappings_by_numeric_ids() throws Exception {
+        assertThat(store.listMappingsByNumericIds("finos", ResourceType.PATTERN, List.of(1, 2)), is(empty()));
+    }
+
+    @Test
+    void throw_on_update_mapping_numeric_id() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.updateMappingNumericId("finos", ResourceType.PATTERN, "custom-id", 2));
+        assertThat(ex.getMessage(), containsString("unique-id"));
+    }
+
+    @Test
+    void throw_on_delete_mapping() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.deleteMapping("finos", ResourceType.PATTERN, "custom-id"));
+        assertThat(ex.getMessage(), containsString("unique-id"));
+    }
+
+    @Test
+    void throw_on_delete_mapping_by_numeric_id() {
+        UnsupportedOperationException ex = assertThrows(UnsupportedOperationException.class,
+                () -> store.deleteMappingByNumericId("finos", ResourceType.PATTERN, 1));
+        assertThat(ex.getMessage(), containsString("unique-id"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpSchemaVersionStoreShould.java b/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpSchemaVersionStoreShould.java
new file mode 100644
index 000000000..0ee79a8c8
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/noop/TestNoOpSchemaVersionStoreShould.java
@@ -0,0 +1,46 @@
+package org.finos.calm.store.noop;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.is;
+
+class TestNoOpSchemaVersionStoreShould {
+
+    private NoOpSchemaVersionStore store;
+
+    @BeforeEach
+    void setup() {
+        store = new NoOpSchemaVersionStore();
+    }
+
+    @Test
+    void return_max_value_for_schema_version() {
+        assertThat(store.getSchemaVersion(), equalTo(Integer.MAX_VALUE));
+    }
+
+    @Test
+    void not_throw_on_set_schema_version() {
+        store.setSchemaVersion(42);
+        assertThat(store.getSchemaVersion(), equalTo(Integer.MAX_VALUE));
+    }
+
+    @Test
+    void always_acquire_migration_lock() {
+        assertThat(store.acquireMigrationLock("instance-1"), is(true));
+        assertThat(store.acquireMigrationLock("instance-2"), is(true));
+    }
+
+    @Test
+    void not_throw_on_release_migration_lock() {
+        store.releaseMigrationLock("instance-1");
+    }
+
+    @Test
+    void never_report_migration_lock_held() {
+        store.acquireMigrationLock("instance-1");
+        assertThat(store.isMigrationLockHeld(), is(false));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestAdrStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestAdrStoreProducerShould.java
index 953ca2842..a5f91fbae 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestAdrStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestAdrStoreProducerShould.java
@@ -4,7 +4,9 @@
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.sameInstance;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.AdrStore;
+import org.finos.calm.store.github.GitHubAdrStore;
 import org.finos.calm.store.mongo.MongoAdrStore;
 import org.finos.calm.store.nitrite.NitriteAdrStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -34,6 +36,12 @@ public class TestAdrStoreProducerShould {
     @Mock
     Instance<NitriteAdrStore> nitriteAdrStoreInstance;
 
+    @Mock
+    GitHubAdrStore gitHubAdrStore;
+
+    @Mock
+    Instance<GitHubAdrStore> gitHubAdrStoreInstance;
+
     private AdrStoreProducer adrStoreProducer;
 
     @BeforeEach
@@ -43,6 +51,8 @@ void setup() {
         adrStoreProducer.mongoAdrStore = mongoAdrStoreInstance;
         when(nitriteAdrStoreInstance.get()).thenReturn(nitriteAdrStore);
         adrStoreProducer.standaloneAdrStore = nitriteAdrStoreInstance;
+        when(gitHubAdrStoreInstance.get()).thenReturn(gitHubAdrStore);
+        adrStoreProducer.gitHubAdrStore = gitHubAdrStoreInstance;
     }
 
     @Test
@@ -71,13 +81,19 @@ void return_nitrite_adr_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_adr_store_when_database_mode_is_not_recognized() {
-        // Given
         adrStoreProducer.databaseMode = "unknown";
 
-        // When
         AdrStore result = adrStoreProducer.produceAdrStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoAdrStore)));
     }
+
+    @Test
+    void return_github_adr_store_when_database_mode_is_github() {
+        adrStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        AdrStore result = adrStoreProducer.produceAdrStore();
+
+        assertThat(result, is(sameInstance(gitHubAdrStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestArchitectureStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestArchitectureStoreProducerShould.java
index c9c229027..be12e9504 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestArchitectureStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestArchitectureStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ArchitectureStore;
+import org.finos.calm.store.github.GitHubArchitectureStore;
 import org.finos.calm.store.mongo.MongoArchitectureStore;
 import org.finos.calm.store.nitrite.NitriteArchitectureStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestArchitectureStoreProducerShould {
     @Mock
     Instance<NitriteArchitectureStore> nitriteArchitectureStoreInstance;
 
+
+    @Mock
+    GitHubArchitectureStore gitHubArchitectureStore;
+
+    @Mock
+    Instance<GitHubArchitectureStore> gitHubArchitectureStoreInstance;
     private ArchitectureStoreProducer architectureStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         architectureStoreProducer.mongoArchitectureStore = mongoArchitectureStoreInstance;
         when(nitriteArchitectureStoreInstance.get()).thenReturn(nitriteArchitectureStore);
         architectureStoreProducer.standaloneArchitectureStore = nitriteArchitectureStoreInstance;
+        when(gitHubArchitectureStoreInstance.get()).thenReturn(gitHubArchitectureStore);
+        architectureStoreProducer.gitHubArchitectureStore = gitHubArchitectureStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_architecture_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_architecture_store_when_database_mode_is_not_recognized() {
-        // Given
         architectureStoreProducer.databaseMode = "unknown";
 
-        // When
         ArchitectureStore result = architectureStoreProducer.produceArchitectureStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoArchitectureStore)));
     }
+
+    @Test
+    void return_github_architecture_store_when_database_mode_is_github() {
+        architectureStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        ArchitectureStore result = architectureStoreProducer.produceArchitectureStore();
+
+        assertThat(result, is(sameInstance(gitHubArchitectureStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestAuditLogStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestAuditLogStoreProducerShould.java
index 10f29285a..af4fda5d9 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestAuditLogStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestAuditLogStoreProducerShould.java
@@ -1,7 +1,9 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.inject.Instance;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.AuditLogStore;
+import org.finos.calm.store.github.GitHubAuditLogStore;
 import org.finos.calm.store.mongo.MongoAuditLogStore;
 import org.finos.calm.store.nitrite.NitriteAuditLogStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestAuditLogStoreProducerShould {
     @Mock
     Instance<NitriteAuditLogStore> nitriteAuditLogStoreInstance;
 
+    @Mock
+    GitHubAuditLogStore gitHubAuditLogStore;
+
+    @Mock
+    Instance<GitHubAuditLogStore> gitHubAuditLogStoreInstance;
+
     private AuditLogStoreProducer producer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         producer.mongoAuditLogStore = mongoAuditLogStoreInstance;
         when(nitriteAuditLogStoreInstance.get()).thenReturn(nitriteAuditLogStore);
         producer.standaloneAuditLogStore = nitriteAuditLogStoreInstance;
+        when(gitHubAuditLogStoreInstance.get()).thenReturn(gitHubAuditLogStore);
+        producer.gitHubAuditLogStore = gitHubAuditLogStoreInstance;
     }
 
     @Test
@@ -70,4 +80,13 @@ void return_mongo_audit_log_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoAuditLogStore)));
     }
+
+    @Test
+    void return_github_audit_log_store_when_database_mode_is_github() {
+        producer.databaseMode = DatabaseMode.GITHUB;
+
+        AuditLogStore result = producer.produceAuditLogStore();
+
+        assertThat(result, is(sameInstance(gitHubAuditLogStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestBuildingBlockStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestBuildingBlockStoreProducerShould.java
new file mode 100644
index 000000000..b0f14a931
--- /dev/null
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestBuildingBlockStoreProducerShould.java
@@ -0,0 +1,113 @@
+package org.finos.calm.store.producer;
+
+import org.finos.calm.config.DatabaseMode;
+import org.finos.calm.store.BuildingBlockStore;
+import org.finos.calm.store.github.GitHubBuildingBlockStore;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+
+import jakarta.enterprise.inject.Instance;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.notNullValue;
+import static org.hamcrest.Matchers.sameInstance;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.when;
+
+@MockitoSettings(strictness = Strictness.LENIENT)
+@ExtendWith(MockitoExtension.class)
+class TestBuildingBlockStoreProducerShould {
+
+    @Mock
+    GitHubBuildingBlockStore gitHubBuildingBlockStore;
+
+    @Mock
+    Instance<GitHubBuildingBlockStore> gitHubBuildingBlockStoreInstance;
+
+    private BuildingBlockStoreProducer producer;
+
+    @BeforeEach
+    void setup() {
+        producer = new BuildingBlockStoreProducer();
+        when(gitHubBuildingBlockStoreInstance.get()).thenReturn(gitHubBuildingBlockStore);
+        producer.gitHubBuildingBlockStore = gitHubBuildingBlockStoreInstance;
+    }
+
+    @Test
+    void return_github_building_block_store_when_database_mode_is_github() {
+        producer.databaseMode = DatabaseMode.GITHUB;
+
+        BuildingBlockStore result = producer.produceBuildingBlockStore();
+
+        assertThat(result, is(sameInstance(gitHubBuildingBlockStore)));
+    }
+
+    @Test
+    void return_no_op_store_when_database_mode_is_mongo() {
+        producer.databaseMode = DatabaseMode.MONGO;
+
+        BuildingBlockStore result = producer.produceBuildingBlockStore();
+
+        assertThat(result, is(notNullValue()));
+    }
+
+    @Test
+    void return_no_op_store_when_database_mode_is_standalone() {
+        producer.databaseMode = DatabaseMode.STANDALONE;
+
+        BuildingBlockStore result = producer.produceBuildingBlockStore();
+
+        assertThat(result, is(notNullValue()));
+    }
+
+    @Test
+    void no_op_store_throws_on_get_building_blocks_for_namespace() {
+        producer.databaseMode = DatabaseMode.MONGO;
+        BuildingBlockStore noOpStore = producer.produceBuildingBlockStore();
+
+        assertThrows(UnsupportedOperationException.class,
+                () -> noOpStore.getBuildingBlocksForNamespace("finos"));
+    }
+
+    @Test
+    void no_op_store_throws_on_create_building_block_for_namespace() {
+        producer.databaseMode = DatabaseMode.MONGO;
+        BuildingBlockStore noOpStore = producer.produceBuildingBlockStore();
+
+        assertThrows(UnsupportedOperationException.class,
+                () -> noOpStore.createBuildingBlockForNamespace("finos", "{}"));
+    }
+
+    @Test
+    void no_op_store_throws_on_get_building_block_versions() {
+        producer.databaseMode = DatabaseMode.MONGO;
+        BuildingBlockStore noOpStore = producer.produceBuildingBlockStore();
+
+        assertThrows(UnsupportedOperationException.class,
+                () -> noOpStore.getBuildingBlockVersions("finos", 1));
+    }
+
+    @Test
+    void no_op_store_throws_on_get_building_block_for_version() {
+        producer.databaseMode = DatabaseMode.MONGO;
+        BuildingBlockStore noOpStore = producer.produceBuildingBlockStore();
+
+        assertThrows(UnsupportedOperationException.class,
+                () -> noOpStore.getBuildingBlockForVersion("finos", 1, "1.0.0"));
+    }
+
+    @Test
+    void no_op_store_throws_on_create_building_block_for_version() {
+        producer.databaseMode = DatabaseMode.MONGO;
+        BuildingBlockStore noOpStore = producer.produceBuildingBlockStore();
+
+        assertThrows(UnsupportedOperationException.class,
+                () -> noOpStore.createBuildingBlockForVersion("finos", 1, "1.0.0", "{}"));
+    }
+}
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestControlStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestControlStoreProducerShould.java
index 9001491ac..d83de0330 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestControlStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestControlStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ControlStore;
+import org.finos.calm.store.github.GitHubControlStore;
 import org.finos.calm.store.mongo.MongoControlStore;
 import org.finos.calm.store.nitrite.NitriteControlStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -32,6 +34,12 @@ public class TestControlStoreProducerShould {
     @Mock
     Instance<NitriteControlStore> standaloneControlStoreInstance;
 
+    @Mock
+    GitHubControlStore gitHubControlStore;
+
+    @Mock
+    Instance<GitHubControlStore> gitHubControlStoreInstance;
+
     ControlStoreProducer producer;
 
     @BeforeEach
@@ -41,6 +49,8 @@ public void setup() {
         producer = new ControlStoreProducer();
         producer.mongoControlStore = mongoControlStoreInstance;
         producer.standaloneControlStore = standaloneControlStoreInstance;
+        when(gitHubControlStoreInstance.get()).thenReturn(gitHubControlStore);
+        producer.gitHubControlStore = gitHubControlStoreInstance;
     }
 
     @Test
@@ -74,4 +84,12 @@ public void return_mongo_store_when_database_mode_is_null() {
         assertNotNull(result);
         assertEquals(mongoControlStore, result);
     }
+
+    @Test
+    public void return_github_store_when_database_mode_is_github() {
+        producer.databaseMode = DatabaseMode.GITHUB;
+        ControlStore result = producer.produceControlStore();
+        assertNotNull(result);
+        assertEquals(gitHubControlStore, result);
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestCoreSchemaStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestCoreSchemaStoreProducerShould.java
index dea464b32..fb0cfc0f0 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestCoreSchemaStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestCoreSchemaStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.CoreSchemaStore;
+import org.finos.calm.store.classpath.ClasspathCoreSchemaStore;
 import org.finos.calm.store.mongo.MongoCoreSchemaStore;
 import org.finos.calm.store.nitrite.NitriteCoreSchemaStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestCoreSchemaStoreProducerShould {
     @Mock
     Instance<NitriteCoreSchemaStore> nitriteCoreSchemaStoreInstance;
 
+    @Mock
+    ClasspathCoreSchemaStore classpathCoreSchemaStore;
+
+    @Mock
+    Instance<ClasspathCoreSchemaStore> classpathCoreSchemaStoreInstance;
+
     private CoreSchemaStoreProducer coreSchemaStoreProducer;
 
     @BeforeEach
@@ -42,41 +50,43 @@ void setup() {
         coreSchemaStoreProducer.mongoCoreSchemaStore = mongoCoreSchemaStoreInstance;
         when(nitriteCoreSchemaStoreInstance.get()).thenReturn(nitriteCoreSchemaStore);
         coreSchemaStoreProducer.standaloneCoreSchemaStore = nitriteCoreSchemaStoreInstance;
+        when(classpathCoreSchemaStoreInstance.get()).thenReturn(classpathCoreSchemaStore);
+        coreSchemaStoreProducer.classpathCoreSchemaStore = classpathCoreSchemaStoreInstance;
     }
 
     @Test
     void return_mongo_core_schema_store_when_database_mode_is_mongo() {
-        // Given
-        coreSchemaStoreProducer.databaseMode = "mongo";
+        coreSchemaStoreProducer.databaseMode = DatabaseMode.MONGO;
 
-        // When
         CoreSchemaStore result = coreSchemaStoreProducer.produceCoreSchemaStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoCoreSchemaStore)));
     }
 
     @Test
     void return_nitrite_core_schema_store_when_database_mode_is_standalone() {
-        // Given
-        coreSchemaStoreProducer.databaseMode = "standalone";
+        coreSchemaStoreProducer.databaseMode = DatabaseMode.STANDALONE;
 
-        // When
         CoreSchemaStore result = coreSchemaStoreProducer.produceCoreSchemaStore();
 
-        // Then
         assertThat(result, is(sameInstance(nitriteCoreSchemaStore)));
     }
 
     @Test
     void return_mongo_core_schema_store_when_database_mode_is_not_recognized() {
-        // Given
         coreSchemaStoreProducer.databaseMode = "unknown";
 
-        // When
         CoreSchemaStore result = coreSchemaStoreProducer.produceCoreSchemaStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoCoreSchemaStore)));
     }
+
+    @Test
+    void return_classpath_core_schema_store_when_database_mode_is_github() {
+        coreSchemaStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        CoreSchemaStore result = coreSchemaStoreProducer.produceCoreSchemaStore();
+
+        assertThat(result, is(sameInstance(classpathCoreSchemaStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestDecoratorStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestDecoratorStoreProducerShould.java
index 034f1def8..391cf3426 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestDecoratorStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestDecoratorStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.DecoratorStore;
+import org.finos.calm.store.github.GitHubDecoratorStore;
 import org.finos.calm.store.mongo.MongoDecoratorStore;
 import org.finos.calm.store.nitrite.NitriteDecoratorStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestDecoratorStoreProducerShould {
     @Mock
     Instance<NitriteDecoratorStore> nitriteDecoratorStoreInstance;
 
+    @Mock
+    GitHubDecoratorStore gitHubDecoratorStore;
+
+    @Mock
+    Instance<GitHubDecoratorStore> gitHubDecoratorStoreInstance;
+
     private DecoratorStoreProducer decoratorStoreProducer;
 
     @BeforeEach
@@ -41,7 +49,9 @@ void setup() {
         when(mongoDecoratorStoreInstance.get()).thenReturn(mongoDecoratorStore);
         decoratorStoreProducer.mongoDecoratorStore = mongoDecoratorStoreInstance;
         when(nitriteDecoratorStoreInstance.get()).thenReturn(nitriteDecoratorStore);
-        decoratorStoreProducer.nitriteDecoratorStore = nitriteDecoratorStoreInstance;
+        decoratorStoreProducer.standaloneDecoratorStore = nitriteDecoratorStoreInstance;
+        when(gitHubDecoratorStoreInstance.get()).thenReturn(gitHubDecoratorStore);
+        decoratorStoreProducer.gitHubDecoratorStore = gitHubDecoratorStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_decorator_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_decorator_store_when_database_mode_is_not_recognized() {
-        // Given
         decoratorStoreProducer.databaseMode = "unknown";
 
-        // When
         DecoratorStore result = decoratorStoreProducer.produceDecoratorStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoDecoratorStore)));
     }
+
+    @Test
+    void return_github_decorator_store_when_database_mode_is_github() {
+        decoratorStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        DecoratorStore result = decoratorStoreProducer.produceDecoratorStore();
+
+        assertThat(result, is(sameInstance(gitHubDecoratorStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestDomainStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestDomainStoreProducerShould.java
index 72f52ff32..659809a71 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestDomainStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestDomainStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.DomainStore;
+import org.finos.calm.store.github.GitHubDomainStore;
 import org.finos.calm.store.mongo.MongoDomainStore;
 import org.finos.calm.store.nitrite.NitriteDomainStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestDomainStoreProducerShould {
     @Mock
     Instance<NitriteDomainStore> nitriteDomainStoreInstance;
 
+    @Mock
+    GitHubDomainStore gitHubDomainStore;
+
+    @Mock
+    Instance<GitHubDomainStore> gitHubDomainStoreInstance;
+
     private DomainStoreProducer domainStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         domainStoreProducer.mongoDomainStore = mongoDomainStoreInstance;
         when(nitriteDomainStoreInstance.get()).thenReturn(nitriteDomainStore);
         domainStoreProducer.standaloneDomainStore = nitriteDomainStoreInstance;
+        when(gitHubDomainStoreInstance.get()).thenReturn(gitHubDomainStore);
+        domainStoreProducer.gitHubDomainStore = gitHubDomainStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_domain_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_domain_store_when_database_mode_is_not_recognized() {
-        // Given
         domainStoreProducer.databaseMode = "unknown";
 
-        // When
         DomainStore result = domainStoreProducer.produceDomainStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoDomainStore)));
     }
+
+    @Test
+    void return_github_domain_store_when_database_mode_is_github() {
+        domainStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        DomainStore result = domainStoreProducer.produceDomainStore();
+
+        assertThat(result, is(sameInstance(gitHubDomainStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestFlowStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestFlowStoreProducerShould.java
index 7b0803c75..4ccd2a15f 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestFlowStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestFlowStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.FlowStore;
+import org.finos.calm.store.github.GitHubFlowStore;
 import org.finos.calm.store.mongo.MongoFlowStore;
 import org.finos.calm.store.nitrite.NitriteFlowStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestFlowStoreProducerShould {
     @Mock
     Instance<NitriteFlowStore> nitriteFlowStoreInstance;
 
+    @Mock
+    GitHubFlowStore gitHubFlowStore;
+
+    @Mock
+    Instance<GitHubFlowStore> gitHubFlowStoreInstance;
+
     private FlowStoreProducer flowStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         flowStoreProducer.mongoFlowStore = mongoFlowStoreInstance;
         when(nitriteFlowStoreInstance.get()).thenReturn(nitriteFlowStore);
         flowStoreProducer.standaloneFlowStore = nitriteFlowStoreInstance;
+        when(gitHubFlowStoreInstance.get()).thenReturn(gitHubFlowStore);
+        flowStoreProducer.gitHubFlowStore = gitHubFlowStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_flow_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_flow_store_when_database_mode_is_not_recognized() {
-        // Given
         flowStoreProducer.databaseMode = "unknown";
 
-        // When
         FlowStore result = flowStoreProducer.produceFlowStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoFlowStore)));
     }
+
+    @Test
+    void return_github_flow_store_when_database_mode_is_github() {
+        flowStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        FlowStore result = flowStoreProducer.produceFlowStore();
+
+        assertThat(result, is(sameInstance(gitHubFlowStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestInterfaceStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestInterfaceStoreProducerShould.java
index 9b85ee953..91599c03c 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestInterfaceStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestInterfaceStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.InterfaceStore;
+import org.finos.calm.store.github.GitHubInterfaceStore;
 import org.finos.calm.store.mongo.MongoInterfaceStore;
 import org.finos.calm.store.nitrite.NitriteInterfaceStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestInterfaceStoreProducerShould {
     @Mock
     Instance<NitriteInterfaceStore> nitriteInterfaceStoreInstance;
 
+
+    @Mock
+    GitHubInterfaceStore gitHubInterfaceStore;
+
+    @Mock
+    Instance<GitHubInterfaceStore> gitHubInterfaceStoreInstance;
     private InterfaceStoreProducer interfaceStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         interfaceStoreProducer.mongoInterfaceStore = mongoInterfaceStoreInstance;
         when(nitriteInterfaceStoreInstance.get()).thenReturn(nitriteInterfaceStore);
         interfaceStoreProducer.standaloneInterfaceStore = nitriteInterfaceStoreInstance;
+        when(gitHubInterfaceStoreInstance.get()).thenReturn(gitHubInterfaceStore);
+        interfaceStoreProducer.gitHubInterfaceStore = gitHubInterfaceStoreInstance;
     }
 
     @Test
@@ -70,4 +80,13 @@ void return_mongo_interface_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoInterfaceStore)));
     }
+
+    @Test
+    void return_github_interface_store_when_database_mode_is_github() {
+        interfaceStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        InterfaceStore result = interfaceStoreProducer.produceInterfaceStore();
+
+        assertThat(result, is(sameInstance(gitHubInterfaceStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestLayoutStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestLayoutStoreProducerShould.java
index b9d490551..cf80786e9 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestLayoutStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestLayoutStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.LayoutStore;
+import org.finos.calm.store.github.GitHubLayoutStore;
 import org.finos.calm.store.mongo.MongoLayoutStore;
 import org.finos.calm.store.nitrite.NitriteLayoutStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestLayoutStoreProducerShould {
     @Mock
     Instance<NitriteLayoutStore> nitriteLayoutStoreInstance;
 
+    @Mock
+    GitHubLayoutStore gitHubLayoutStore;
+
+    @Mock
+    Instance<GitHubLayoutStore> gitHubLayoutStoreInstance;
+
     private LayoutStoreProducer layoutStoreProducer;
 
     @BeforeEach
@@ -41,7 +49,9 @@ void setup() {
         when(mongoLayoutStoreInstance.get()).thenReturn(mongoLayoutStore);
         layoutStoreProducer.mongoLayoutStore = mongoLayoutStoreInstance;
         when(nitriteLayoutStoreInstance.get()).thenReturn(nitriteLayoutStore);
-        layoutStoreProducer.nitriteLayoutStore = nitriteLayoutStoreInstance;
+        layoutStoreProducer.standaloneLayoutStore = nitriteLayoutStoreInstance;
+        when(gitHubLayoutStoreInstance.get()).thenReturn(gitHubLayoutStore);
+        layoutStoreProducer.gitHubLayoutStore = gitHubLayoutStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_layout_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_layout_store_when_database_mode_is_not_recognized() {
-        // Given
         layoutStoreProducer.databaseMode = "unknown";
 
-        // When
         LayoutStore result = layoutStoreProducer.produceLayoutStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoLayoutStore)));
     }
+
+    @Test
+    void return_github_layout_store_when_database_mode_is_github() {
+        layoutStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        LayoutStore result = layoutStoreProducer.produceLayoutStore();
+
+        assertThat(result, is(sameInstance(gitHubLayoutStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestNamespaceStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestNamespaceStoreProducerShould.java
index 87f34004f..090b725d5 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestNamespaceStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestNamespaceStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.NamespaceStore;
+import org.finos.calm.store.github.GitHubNamespaceStore;
 import org.finos.calm.store.mongo.MongoNamespaceStore;
 import org.finos.calm.store.nitrite.NitriteNamespaceStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestNamespaceStoreProducerShould {
     @Mock
     Instance<NitriteNamespaceStore> nitriteNamespaceStoreInstance;
 
+    @Mock
+    GitHubNamespaceStore gitHubNamespaceStore;
+
+    @Mock
+    Instance<GitHubNamespaceStore> gitHubNamespaceStoreInstance;
+
     private NamespaceStoreProducer namespaceStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         namespaceStoreProducer.mongoNamespaceStore = mongoNamespaceStoreInstance;
         when(nitriteNamespaceStoreInstance.get()).thenReturn(nitriteNamespaceStore);
         namespaceStoreProducer.standaloneNamespaceStore = nitriteNamespaceStoreInstance;
+        when(gitHubNamespaceStoreInstance.get()).thenReturn(gitHubNamespaceStore);
+        namespaceStoreProducer.gitHubNamespaceStore = gitHubNamespaceStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_namespace_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_namespace_store_when_database_mode_is_not_recognized() {
-        // Given
         namespaceStoreProducer.databaseMode = "unknown";
 
-        // When
         NamespaceStore result = namespaceStoreProducer.produceNamespaceStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoNamespaceStore)));
     }
+
+    @Test
+    void return_github_namespace_store_when_database_mode_is_github() {
+        namespaceStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        NamespaceStore result = namespaceStoreProducer.produceNamespaceStore();
+
+        assertThat(result, is(sameInstance(gitHubNamespaceStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestPatternStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestPatternStoreProducerShould.java
index c4512003e..212d24ace 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestPatternStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestPatternStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.PatternStore;
+import org.finos.calm.store.github.GitHubPatternStore;
 import org.finos.calm.store.mongo.MongoPatternStore;
 import org.finos.calm.store.nitrite.NitritePatternStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestPatternStoreProducerShould {
     @Mock
     Instance<NitritePatternStore> nitritePatternStoreInstance;
 
+    @Mock
+    GitHubPatternStore gitHubPatternStore;
+
+    @Mock
+    Instance<GitHubPatternStore> gitHubPatternStoreInstance;
+
     private PatternStoreProducer patternStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         patternStoreProducer.mongoPatternStore = mongoPatternStoreInstance;
         when(nitritePatternStoreInstance.get()).thenReturn(nitritePatternStore);
         patternStoreProducer.standalonePatternStore = nitritePatternStoreInstance;
+        when(gitHubPatternStoreInstance.get()).thenReturn(gitHubPatternStore);
+        patternStoreProducer.gitHubPatternStore = gitHubPatternStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_pattern_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_pattern_store_when_database_mode_is_not_recognized() {
-        // Given
         patternStoreProducer.databaseMode = "unknown";
 
-        // When
         PatternStore result = patternStoreProducer.producePatternStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoPatternStore)));
     }
+
+    @Test
+    void return_github_pattern_store_when_database_mode_is_github() {
+        patternStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        PatternStore result = patternStoreProducer.producePatternStore();
+
+        assertThat(result, is(sameInstance(gitHubPatternStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestResourceMappingStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestResourceMappingStoreProducerShould.java
index d92d9542e..12290ddbd 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestResourceMappingStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestResourceMappingStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.ResourceMappingStore;
+import org.finos.calm.store.github.GitHubResourceMappingStore;
 import org.finos.calm.store.mongo.MongoResourceMappingStore;
 import org.finos.calm.store.nitrite.NitriteResourceMappingStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestResourceMappingStoreProducerShould {
     @Mock
     Instance<NitriteResourceMappingStore> nitriteResourceMappingStoreInstance;
 
+    @Mock
+    GitHubResourceMappingStore gitHubResourceMappingStore;
+
+    @Mock
+    Instance<GitHubResourceMappingStore> gitHubResourceMappingStoreInstance;
+
     private ResourceMappingStoreProducer producer;
 
     @BeforeEach
@@ -42,11 +50,13 @@ void setup() {
         producer.mongoResourceMappingStore = mongoResourceMappingStoreInstance;
         when(nitriteResourceMappingStoreInstance.get()).thenReturn(nitriteResourceMappingStore);
         producer.standaloneResourceMappingStore = nitriteResourceMappingStoreInstance;
+        when(gitHubResourceMappingStoreInstance.get()).thenReturn(gitHubResourceMappingStore);
+        producer.gitHubResourceMappingStore = gitHubResourceMappingStoreInstance;
     }
 
     @Test
     void return_mongo_store_when_database_mode_is_mongo() {
-        producer.databaseMode = "mongo";
+        producer.databaseMode = DatabaseMode.MONGO;
 
         ResourceMappingStore result = producer.produceResourceMappingStore();
 
@@ -55,7 +65,7 @@ void return_mongo_store_when_database_mode_is_mongo() {
 
     @Test
     void return_nitrite_store_when_database_mode_is_standalone() {
-        producer.databaseMode = "standalone";
+        producer.databaseMode = DatabaseMode.STANDALONE;
 
         ResourceMappingStore result = producer.produceResourceMappingStore();
 
@@ -70,4 +80,13 @@ void return_mongo_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoResourceMappingStore)));
     }
+
+    @Test
+    void return_github_store_when_database_mode_is_github() {
+        producer.databaseMode = DatabaseMode.GITHUB;
+
+        ResourceMappingStore result = producer.produceResourceMappingStore();
+
+        assertThat(result, is(sameInstance(gitHubResourceMappingStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestSchemaVersionStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestSchemaVersionStoreProducerShould.java
index f4e90c4b1..56effa66c 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestSchemaVersionStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestSchemaVersionStoreProducerShould.java
@@ -1,9 +1,11 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.inject.Instance;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.SchemaVersionStore;
 import org.finos.calm.store.mongo.MongoSchemaVersionStore;
 import org.finos.calm.store.nitrite.NitriteSchemaVersionStore;
+import org.finos.calm.store.noop.NoOpSchemaVersionStore;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -33,6 +35,12 @@ class TestSchemaVersionStoreProducerShould {
     @Mock
     Instance<NitriteSchemaVersionStore> nitriteSchemaVersionStoreInstance;
 
+    @Mock
+    NoOpSchemaVersionStore noOpSchemaVersionStore;
+
+    @Mock
+    Instance<NoOpSchemaVersionStore> noOpSchemaVersionStoreInstance;
+
     private SchemaVersionStoreProducer producer;
 
     @BeforeEach
@@ -42,11 +50,13 @@ void setup() {
         producer.mongoSchemaVersionStore = mongoSchemaVersionStoreInstance;
         when(nitriteSchemaVersionStoreInstance.get()).thenReturn(nitriteSchemaVersionStore);
         producer.standaloneSchemaVersionStore = nitriteSchemaVersionStoreInstance;
+        when(noOpSchemaVersionStoreInstance.get()).thenReturn(noOpSchemaVersionStore);
+        producer.noOpSchemaVersionStore = noOpSchemaVersionStoreInstance;
     }
 
     @Test
     void return_mongo_schema_version_store_when_database_mode_is_mongo() {
-        producer.databaseMode = "mongo";
+        producer.databaseMode = DatabaseMode.MONGO;
 
         SchemaVersionStore result = producer.produceSchemaVersionStore();
 
@@ -55,7 +65,7 @@ void return_mongo_schema_version_store_when_database_mode_is_mongo() {
 
     @Test
     void return_nitrite_schema_version_store_when_database_mode_is_standalone() {
-        producer.databaseMode = "standalone";
+        producer.databaseMode = DatabaseMode.STANDALONE;
 
         SchemaVersionStore result = producer.produceSchemaVersionStore();
 
@@ -70,4 +80,13 @@ void return_mongo_schema_version_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoSchemaVersionStore)));
     }
+
+    @Test
+    void return_noop_schema_version_store_when_database_mode_is_github() {
+        producer.databaseMode = DatabaseMode.GITHUB;
+
+        SchemaVersionStore result = producer.produceSchemaVersionStore();
+
+        assertThat(result, is(sameInstance(noOpSchemaVersionStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestSearchStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestSearchStoreProducerShould.java
index 18ffbb9f2..5f882e33a 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestSearchStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestSearchStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.SearchStore;
+import org.finos.calm.store.github.GitHubSearchStore;
 import org.finos.calm.store.mongo.MongoSearchStore;
 import org.finos.calm.store.nitrite.NitriteSearchStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestSearchStoreProducerShould {
     @Mock
     Instance<NitriteSearchStore> nitriteSearchStoreInstance;
 
+    @Mock
+    GitHubSearchStore gitHubSearchStore;
+
+    @Mock
+    Instance<GitHubSearchStore> gitHubSearchStoreInstance;
+
     private SearchStoreProducer searchStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         searchStoreProducer.mongoSearchStore = mongoSearchStoreInstance;
         when(nitriteSearchStoreInstance.get()).thenReturn(nitriteSearchStore);
         searchStoreProducer.standaloneSearchStore = nitriteSearchStoreInstance;
+        when(gitHubSearchStoreInstance.get()).thenReturn(gitHubSearchStore);
+        searchStoreProducer.gitHubSearchStore = gitHubSearchStoreInstance;
     }
 
     @Test
@@ -70,4 +80,13 @@ void return_mongo_search_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoSearchStore)));
     }
+
+    @Test
+    void return_github_search_store_when_database_mode_is_github() {
+        searchStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        SearchStore result = searchStoreProducer.produceSearchStore();
+
+        assertThat(result, is(sameInstance(gitHubSearchStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestStandardStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestStandardStoreProducerShould.java
index 3d6db66fa..4d65f30e8 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestStandardStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestStandardStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.StandardStore;
+import org.finos.calm.store.github.GitHubStandardStore;
 import org.finos.calm.store.mongo.MongoStandardStore;
 import org.finos.calm.store.nitrite.NitriteStandardStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestStandardStoreProducerShould {
     @Mock
     Instance<NitriteStandardStore> nitriteStandardStoreInstance;
 
+    @Mock
+    GitHubStandardStore gitHubStandardStore;
+
+    @Mock
+    Instance<GitHubStandardStore> gitHubStandardStoreInstance;
+
     private StandardStoreProducer standardStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         standardStoreProducer.mongoStandardStore = mongoStandardStoreInstance;
         when(nitriteStandardStoreInstance.get()).thenReturn(nitriteStandardStore);
         standardStoreProducer.standaloneStandardStore = nitriteStandardStoreInstance;
+        when(gitHubStandardStoreInstance.get()).thenReturn(gitHubStandardStore);
+        standardStoreProducer.gitHubStandardStore = gitHubStandardStoreInstance;
     }
 
     @Test
@@ -70,13 +80,19 @@ void return_nitrite_standard_store_when_database_mode_is_standalone() {
 
     @Test
     void return_mongo_standard_store_when_database_mode_is_not_recognized() {
-        // Given
         standardStoreProducer.databaseMode = "unknown";
 
-        // When
         StandardStore result = standardStoreProducer.produceStandardStore();
 
-        // Then
         assertThat(result, is(sameInstance(mongoStandardStore)));
     }
+
+    @Test
+    void return_github_standard_store_when_database_mode_is_github() {
+        standardStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        StandardStore result = standardStoreProducer.produceStandardStore();
+
+        assertThat(result, is(sameInstance(gitHubStandardStore)));
+    }
 }
\ No newline at end of file
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestTimelineStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestTimelineStoreProducerShould.java
index 0f6836320..620bdd3e7 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestTimelineStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestTimelineStoreProducerShould.java
@@ -1,7 +1,9 @@
 package org.finos.calm.store.producer;
 
 import jakarta.enterprise.inject.Instance;
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.TimelineStore;
+import org.finos.calm.store.github.GitHubTimelineStore;
 import org.finos.calm.store.mongo.MongoTimelineStore;
 import org.finos.calm.store.nitrite.NitriteTimelineStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,6 +35,12 @@ public class TestTimelineStoreProducerShould {
     @Mock
     Instance<NitriteTimelineStore> nitriteTimelineStoreInstance;
 
+
+    @Mock
+    GitHubTimelineStore gitHubTimelineStore;
+
+    @Mock
+    Instance<GitHubTimelineStore> gitHubTimelineStoreInstance;
     private TimelineStoreProducer timelineStoreProducer;
 
     @BeforeEach
@@ -42,6 +50,8 @@ void setup() {
         timelineStoreProducer.mongoTimelineStore = mongoTimelineStoreInstance;
         when(nitriteTimelineStoreInstance.get()).thenReturn(nitriteTimelineStore);
         timelineStoreProducer.standaloneTimelineStore = nitriteTimelineStoreInstance;
+        when(gitHubTimelineStoreInstance.get()).thenReturn(gitHubTimelineStore);
+        timelineStoreProducer.gitHubTimelineStore = gitHubTimelineStoreInstance;
     }
 
     @Test
@@ -70,4 +80,13 @@ void return_mongo_timeline_store_when_database_mode_is_not_recognized() {
 
         assertThat(result, is(sameInstance(mongoTimelineStore)));
     }
+
+    @Test
+    void return_github_timeline_store_when_database_mode_is_github() {
+        timelineStoreProducer.databaseMode = DatabaseMode.GITHUB;
+
+        TimelineStore result = timelineStoreProducer.produceTimelineStore();
+
+        assertThat(result, is(sameInstance(gitHubTimelineStore)));
+    }
 }
diff --git a/calm-hub/src/test/java/org/finos/calm/store/producer/TestUserAccessStoreProducerShould.java b/calm-hub/src/test/java/org/finos/calm/store/producer/TestUserAccessStoreProducerShould.java
index f90295764..adeb8ce58 100644
--- a/calm-hub/src/test/java/org/finos/calm/store/producer/TestUserAccessStoreProducerShould.java
+++ b/calm-hub/src/test/java/org/finos/calm/store/producer/TestUserAccessStoreProducerShould.java
@@ -1,6 +1,8 @@
 package org.finos.calm.store.producer;
 
+import org.finos.calm.config.DatabaseMode;
 import org.finos.calm.store.UserAccessStore;
+import org.finos.calm.store.github.GitHubUserAccessStore;
 import org.finos.calm.store.mongo.MongoUserAccessStore;
 import org.finos.calm.store.nitrite.NitriteUserAccessStore;
 import org.junit.jupiter.api.BeforeEach;
@@ -35,22 +37,32 @@ public class TestUserAccessStoreProducerShould {
     @Mock
     private Instance<NitriteUserAccessStore> mockNitriteUserAccessStoreInstance;
 
+    @Mock
+    private GitHubUserAccessStore mockGitHubUserAccessStore;
+
+    @Mock
+    private Instance<GitHubUserAccessStore> mockGitHubUserAccessStoreInstance;
+
     private UserAccessStoreProducer producer;
 
     @BeforeEach
     public void setup() throws Exception {
         producer = new UserAccessStoreProducer();
-        
-        // Use reflection to inject the mocked dependencies
+
         Field mongoField = UserAccessStoreProducer.class.getDeclaredField("mongoUserAccessStore");
         mongoField.setAccessible(true);
         when(mockMongoUserAccessStoreInstance.get()).thenReturn(mockMongoUserAccessStore);
         mongoField.set(producer, mockMongoUserAccessStoreInstance);
-        
+
         Field nitriteField = UserAccessStoreProducer.class.getDeclaredField("standaloneUserAccessStore");
         nitriteField.setAccessible(true);
         when(mockNitriteUserAccessStoreInstance.get()).thenReturn(mockNitriteUserAccessStore);
         nitriteField.set(producer, mockNitriteUserAccessStoreInstance);
+
+        Field githubField = UserAccessStoreProducer.class.getDeclaredField("gitHubUserAccessStore");
+        githubField.setAccessible(true);
+        when(mockGitHubUserAccessStoreInstance.get()).thenReturn(mockGitHubUserAccessStore);
+        githubField.set(producer, mockGitHubUserAccessStoreInstance);
     }
 
     @Test
@@ -97,15 +109,23 @@ public void testProduceUserAccessStore_whenDatabaseModeIsNull_returnsMongoStore(
 
     @Test
     public void testProduceUserAccessStore_whenDatabaseModeIsUnknown_returnsMongoStore() throws Exception {
-        // Arrange
         Field databaseModeField = UserAccessStoreProducer.class.getDeclaredField("databaseMode");
         databaseModeField.setAccessible(true);
         databaseModeField.set(producer, "unknown");
 
-        // Act
         UserAccessStore result = producer.produceUserAccessStore();
 
-        // Assert
         assertThat(result, is(sameInstance(mockMongoUserAccessStore)));
     }
+
+    @Test
+    public void testProduceUserAccessStore_whenDatabaseModeIsGithub_returnsGitHubStore() throws Exception {
+        Field databaseModeField = UserAccessStoreProducer.class.getDeclaredField("databaseMode");
+        databaseModeField.setAccessible(true);
+        databaseModeField.set(producer, DatabaseMode.GITHUB);
+
+        UserAccessStore result = producer.produceUserAccessStore();
+
+        assertThat(result, is(sameInstance(mockGitHubUserAccessStore)));
+    }
 }
diff --git a/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/files.txt b/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/files.txt
new file mode 100644
index 000000000..b7e1bdf50
--- /dev/null
+++ b/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/files.txt
@@ -0,0 +1 @@
+core.json
diff --git a/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/meta/core.json b/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/meta/core.json
new file mode 100644
index 000000000..cef198843
--- /dev/null
+++ b/calm-hub/src/test/resources/META-INF/calm-schemas/1.0/meta/core.json
@@ -0,0 +1 @@
+{"$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://calm.finos.org/release/1.0/meta/core.json", "title": "CALM Core Schema"}
diff --git a/calm-hub/src/test/resources/META-INF/calm-schemas/versions.txt b/calm-hub/src/test/resources/META-INF/calm-schemas/versions.txt
new file mode 100644
index 000000000..d3827e75a
--- /dev/null
+++ b/calm-hub/src/test/resources/META-INF/calm-schemas/versions.txt
@@ -0,0 +1 @@
+1.0