[TheGreatAxios]

Summary

• Webhook bridge: a hook loads only for its tenant, an unknown hook is 404, a lookup by name without a tenant misses, and a Bitbucket repository with the GitHub one's name is never treated as it.
• GitHub App setup: the callback refuses with 403 and never exchanges the code when replacement authority is absent.
• GitHub App credentials: installation tokens are cached per repository, and the internal installation selector header never reaches GitHub.
• Sign-in: the caller's address comes only from the header a detected host sets.
• Local sidecars: boot retires every sidecar earlier boots left behind, and each allocation gets its own sidecar whose destroy stops it and removes its files.
• Policy file: without a webhook a merged policy file is read within a minute, and a name both hosts hold is read only for the host asked.
• Manager routes: malformed, non-JSON and oversized bodies are refused before the store is touched, and /openapi.json documents each manager route.

Verification

• bun --conditions=intx-src test on the seven touched files against local Postgres: 51 pass, 0 fail.
• bun run check and bun run lint pass.

Refs CL-12132

[linear-code]

CL-12132

[corbits-triage]

Merged before Triage finished on 3745dc4.