From a305d8a8c562965342febe2c63885ecbc6b1b84f Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 00:35:49 +0000
Subject: [PATCH 01/41] move gitapp-callback to argocd ns

---
 .../templates/32-gitapp-callback.yaml         | 35 ++++++++++++++++++-
 helm/argo-stack/values.yaml                   |  4 +--
 2 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 9302b05c..81607b5c 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -3,7 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: gitapp-callback
-  namespace: {{ .Values.namespaces.security }}
+  namespace: {{ .Values.namespaces.argocd }}
   labels:
     app: gitapp-callback
     app.kubernetes.io/name: gitapp-callback
@@ -12,6 +12,9 @@ metadata:
   annotations:
     meta.helm.sh/release-name: {{ .Release.Name }}
     meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+    # Run with Deployment after ExternalSecrets
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "5"    
 spec:
   replicas: {{ .Values.gitappCallback.replicas }}
   selector:
@@ -22,6 +25,26 @@ spec:
       labels:
         app: gitapp-callback
     spec:
+      # Init container to wait for the secret to be created
+      # This is useful when the secret is managed by external-secrets/vault
+      initContainers:
+      - name: gitapp-callback-wait-for-secret
+        image: busybox:1.36
+        command:
+        - sh
+        - -c
+        - |
+          echo "Waiting for secret {{ .Values.githubStatusProxy.privateKeySecret.name }} to be available..."
+          until [ -f /etc/github/private-key.pem ]; do
+            echo "Secret not found, waiting..."
+            sleep 2
+          done
+          echo "Secret found, proceeding with startup"
+        volumeMounts:
+        - name: github-app-key
+          mountPath: /etc/github
+          readOnly: true
+      
       containers:
       - name: gitapp-callback
         image: "{{ .Values.gitappCallback.image.repository }}:{{ .Values.gitappCallback.image.tag }}"
@@ -38,6 +61,9 @@ spec:
         volumeMounts:
         - name: registrations-data
           mountPath: /var/registrations
+        - name: github-app-key
+          mountPath: /etc/github
+          readOnly: true          
         livenessProbe:
           httpGet:
             path: /healthz
@@ -64,6 +90,13 @@ spec:
         {{- else }}
         emptyDir: {}
         {{- end }}
+      - name: github-app-key
+        secret:
+          secretName: {{ .Values.githubStatusProxy.privateKeySecret.name }}
+          items:
+          - key: {{ .Values.githubStatusProxy.privateKeySecret.key }}
+            path: private-key.pem
+          optional: false        
 ---
 apiVersion: v1
 kind: Service
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index 94b8573e..ba3147ae 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -274,7 +274,7 @@ gitappCallback:
     tag: v1.0.0
     pullPolicy: IfNotPresent
   # Number of replicas
-  replicas: 2
+  replicas: 1
   # Flask secret key for session management
   # IMPORTANT: Override this in production with a secure random value
   # Recommended: Use Vault with External Secrets Operator
@@ -313,7 +313,7 @@ githubStatusProxy:
     repository: github-status-proxy
     tag: latest
     pullPolicy: IfNotPresent  
-  replicas: 2
+  replicas: 1
   namespace: argocd
   # GitHub App configuration
   # The App ID can be found in your GitHub App settings

From c137b01c8c3a15f618454ad1f08e80eddb643eae Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 01:20:46 +0000
Subject: [PATCH 02/41] improves gitapp-callback

---
 gitapp-callback/README.md                     |   4 +
 gitapp-callback/app.py                        | 176 +++++++++++++++++-
 gitapp-callback/requirements.txt              |   3 +
 .../ingress-authz-overlay/values.yaml         |   4 +-
 .../templates/32-gitapp-callback.yaml         |   6 +-
 5 files changed, 186 insertions(+), 7 deletions(-)

diff --git a/gitapp-callback/README.md b/gitapp-callback/README.md
index 9cd5f9b1..3ad30bea 100644
--- a/gitapp-callback/README.md
+++ b/gitapp-callback/README.md
@@ -210,6 +210,10 @@ spec:
     app: gitapp-callback
 ```
 
+## References
+https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/about-the-user-authorization-callback-url
+
+
 ### GitHub App Configuration
 
 1. Go to your GitHub App settings
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 29953424..31658ff2 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -20,6 +20,10 @@
 from pathlib import Path
 from flask import Flask, request, render_template, jsonify, redirect, url_for
 import logging
+import jwt
+import time
+import requests
+from typing import List, Dict, Optional
 
 # Configure logging
 logging.basicConfig(
@@ -32,12 +36,120 @@
 
 # Configuration
 GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME", "calypr-workflows")
+GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")
+GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH", "/var/secrets/github-app-key.pem")
+
 
 # Default to /tmp in development/test, /var/registrations in production
 DEFAULT_DB_PATH = "/tmp/registrations.sqlite" if os.environ.get("FLASK_ENV") == "development" or os.environ.get("TESTING") else "/var/registrations/registrations.sqlite"
 DB_PATH = os.environ.get("DB_PATH", DEFAULT_DB_PATH)
 
 
+def get_github_app_jwt() -> str:
+    """
+    Generate a JWT for GitHub App authentication.
+
+    Returns:
+        JWT token string for authenticating as the GitHub App
+
+    Raises:
+        ValueError: If GITHUB_APP_ID is not set
+        FileNotFoundError: If private key file doesn't exist
+    """
+    if not GITHUB_APP_ID:
+        raise ValueError("GITHUB_APP_ID environment variable not set")
+
+    # Read private key
+    with open(GITHUB_PRIVATE_KEY_PATH, 'rb') as key_file:
+        private_key = key_file.read()
+
+    # Create JWT payload
+    payload = {
+        'iat': int(time.time()),
+        'exp': int(time.time()) + 600,  # 10 minutes
+        'iss': GITHUB_APP_ID
+    }
+
+    # Generate JWT
+    token = jwt.encode(payload, private_key, algorithm='RS256')
+    return token
+
+
+def get_installation_access_token(installation_id: str) -> str:
+    """
+    Get an installation access token for API calls.
+
+    Args:
+        installation_id: GitHub installation ID
+
+    Returns:
+        Access token for the installation
+
+    Raises:
+        requests.HTTPError: If GitHub API request fails
+    """
+    jwt_token = get_github_app_jwt()
+
+    url = f"https://api.github.com/app/installations/{installation_id}/access_tokens"
+    headers = {
+        "Authorization": f"Bearer {jwt_token}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+
+    response = requests.post(url, headers=headers)
+    response.raise_for_status()
+
+    return response.json()['token']
+
+
+def get_installation_repositories(installation_id: str) -> List[Dict[str, any]]:
+    """
+    Retrieve repositories for a GitHub App installation.
+
+    Args:
+        installation_id: GitHub installation ID
+
+    Returns:
+        List of repository dictionaries with keys like:
+        - 'id': Repository ID
+        - 'name': Repository name
+        - 'full_name': Owner/repo format
+        - 'private': Boolean for private/public
+        - 'html_url': Repository URL
+
+    Raises:
+        requests.HTTPError: If GitHub API request fails
+    """
+    access_token = get_installation_access_token(installation_id)
+
+    url = "https://api.github.com/installation/repositories"
+    headers = {
+        "Authorization": f"token {access_token}",
+        "Accept": "application/vnd.github.v3+json"
+    }
+
+    repositories = []
+    page = 1
+
+    while True:
+        response = requests.get(
+            url,
+            headers=headers,
+            params={"per_page": 100, "page": page}
+        )
+        response.raise_for_status()
+
+        data = response.json()
+        repositories.extend(data.get('repositories', []))
+
+        # Check if there are more pages
+        if len(data.get('repositories', [])) < 100:
+            break
+        page += 1
+
+    return repositories
+
+
 def init_db():
     """
     Initialize the SQLite database.
@@ -96,13 +208,14 @@ def get_registration(installation_id):
     return None
 
 
-def save_registration(installation_id, registration_data):
+def save_registration(installation_id, registration_data, repositories):
     """
     Save or update a registration in the database.
     
     Args:
         installation_id: The GitHub installation ID
         registration_data: The RepoRegistration configuration dict
+        repositories: List of repositories associated with the installation
     """
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
@@ -158,6 +271,10 @@ def registrations_form():
     installation_id = request.args.get("installation_id")
     setup_action = request.args.get("setup_action", "install")
 
+    # retrieve the repository this installation is for
+    # installation_id is required
+
+
     # Validate installation_id is present
     if not installation_id:
         logger.warning("Missing installation_id in callback")
@@ -183,7 +300,32 @@ def registrations_form():
             ),
             400,
         )
-    
+
+    # Retrieve repositories for this installation
+    try:
+        repositories = get_installation_repositories(installation_id)
+        logger.info(f"Retrieved {len(repositories)} repositories for installation {installation_id}")
+    except requests.HTTPError as e:
+        logger.error(f"Failed to retrieve repositories: {e}")
+        return (
+            render_template(
+                "error.html",
+                error_message="Failed to retrieve repository information from GitHub. Please try again.",
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+    except Exception as e:
+        logger.exception("Unexpected error retrieving repositories")
+        return (
+            render_template(
+                "error.html",
+                error_message="An unexpected error occurred. Please try again.",
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+
     # Validate setup_action is valid
     if setup_action not in ["install", "update"]:
         logger.warning(f"Invalid setup_action: {setup_action[:50]}")
@@ -381,10 +523,35 @@ def parse_bucket_config(prefix):
             "readUsers": read_users,
         }
 
-        logger.info(f"Repository registration submitted: installation_id={installation_id}")
+        # Retrieve repositories for this installation
+        try:
+            repositories = get_installation_repositories(installation_id)
+            logger.info(f"Retrieved {len(repositories)} repositories for installation {installation_id}")
+        except requests.HTTPError as e:
+            logger.error(f"Failed to retrieve repositories: {e}")
+            return (
+                render_template(
+                    "error.html",
+                    error_message="Failed to retrieve repository information from GitHub. Please try again.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                500,
+            )
+        except Exception as e:
+            logger.exception("Unexpected error retrieving repositories")
+            return (
+                render_template(
+                    "error.html",
+                    error_message="An unexpected error occurred. Please try again.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                500,
+            )
+
+        logger.info(f"Repository registration submitted: installation_id={installation_id} repositories={repositories}")
 
         # Save configuration to database
-        save_registration(installation_id, registration_config)
+        save_registration(installation_id, registration_config, repositories)
 
         # Return success response
         if request.headers.get("Accept") == "application/json":
@@ -418,3 +585,4 @@ def parse_bucket_config(prefix):
         GITHUB_APP_NAME: Name of the GitHub App (default: calypr-workflows)
     """
     app.run(host="0.0.0.0", port=8080, debug=True)
+
diff --git a/gitapp-callback/requirements.txt b/gitapp-callback/requirements.txt
index 53ea1040..57ca26bf 100644
--- a/gitapp-callback/requirements.txt
+++ b/gitapp-callback/requirements.txt
@@ -1,2 +1,5 @@
 Flask==3.0.0
 Werkzeug==3.0.1
+PyJWT==2.8.0
+cryptography==41.0.7
+requests==2.31.0
diff --git a/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml b/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
index 3e89c6c6..20f1be43 100644
--- a/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
+++ b/helm/argo-stack/overlays/ingress-authz-overlay/values.yaml
@@ -168,10 +168,10 @@ ingressAuthzOverlay:
     # GitHubb Callback for Repository Registrations
     registrations:
       enabled: true
-      namespace: security
+      namespace: argocd
       service: gitapp-callback
       # Service is in same namespace as ingress
-      serviceNamespace: security
+      serviceNamespace: argocd
       port: 8080
       pathPrefix: /registrations
         
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 81607b5c..d36339d4 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -56,6 +56,10 @@ spec:
           value: {{ .Values.gitappCallback.githubAppName | quote }}
         - name: DB_PATH
           value: "/var/registrations/registrations.sqlite"
+        - name: GITHUB_APP_ID
+          value: {{ .Values.githubApp.appId | quote }}
+        - name: GITHUB_PRIVATE_KEY_PATH
+          value: /etc/github/private-key.pem          
         ports:
         - containerPort: 8080
         volumeMounts:
@@ -102,7 +106,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: gitapp-callback
-  namespace: {{ .Values.namespaces.security }}
+  namespace: {{ .Values.namespaces.argocd }}
   labels:
     app: gitapp-callback
     app.kubernetes.io/name: gitapp-callback

From b7e294c6185fbcfb610d9eb1529b21e430393ae8 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Mon, 29 Dec 2025 21:10:14 -0800
Subject: [PATCH 03/41] adds vault to callback

---
 Makefile                                      |  4 ++
 gitapp-callback/app.py                        | 60 ++++++++++++++++++-
 gitapp-callback/requirements.txt              |  1 +
 .../templates/32-gitapp-callback.yaml         |  9 ++-
 helm/argo-stack/values.yaml                   |  6 +-
 5 files changed, 75 insertions(+), 5 deletions(-)

diff --git a/Makefile b/Makefile
index 832af432..c1e8ddaf 100644
--- a/Makefile
+++ b/Makefile
@@ -225,6 +225,10 @@ ports:
 	kubectl create secret tls ${TLS_SECRET_NAME}  -n calypr-api     --cert=/tmp/fullchain.pem --key=/tmp/privkey.pem || true
 	kubectl create secret tls ${TLS_SECRET_NAME}  -n calypr-tenants --cert=/tmp/fullchain.pem --key=/tmp/privkey.pem || true
 	sudo rm /tmp/fullchain.pem /tmp/privkey.pem
+	#
+	kubectl create secret generic gitapp-vault-token \
+  		--from-literal=token=$(VAULT_TOKEN) \
+  		-n argocd
 	# install ingress
 	helm upgrade --install ingress-authz-overlay \
 	  helm/argo-stack/overlays/ingress-authz-overlay \
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 31658ff2..2b4df735 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -24,6 +24,8 @@
 import time
 import requests
 from typing import List, Dict, Optional
+import hvac
+
 
 # Configure logging
 logging.basicConfig(
@@ -35,9 +37,12 @@
 app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-key-change-in-production")
 
 # Configuration
-GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME", "calypr-workflows")
+GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME")
 GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")
-GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH", "/var/secrets/github-app-key.pem")
+GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH")
+VAULT_ADDR = os.environ.get("VAULT_ADDR")
+VAULT_TOKEN = os.environ.get("VAULT_TOKEN")
+
 
 
 # Default to /tmp in development/test, /var/registrations in production
@@ -217,9 +222,47 @@ def save_registration(installation_id, registration_data, repositories):
         registration_data: The RepoRegistration configuration dict
         repositories: List of repositories associated with the installation
     """
+
+    if len(repositories) > 1:
+        logging.warning("Multiple repositories found for installation; using the first one.")
+
+    full_name = repositories[0]['full_name']
+    owner, repo_name = full_name.split('/')
+
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
-    
+
+    data_bucket = registration_data.get("dataBucket", None)
+    artifact_bucket = registration_data.get("artifactBucket", None)
+    if "dataBucket" in registration_data:
+        del registration_data["dataBucket"]
+    if "artifactBucket" in registration_data:
+        del registration_data["artifactBucket"]
+
+    # Save bucket configurations to Vault
+    try:
+        client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+
+        if data_bucket:
+            data_vault_path = f"kv/argo/apps/{owner}/{repo_name}/dataBucket"
+            client.secrets.kv.v2.create_or_update_secret(
+                path=data_vault_path,
+                secret_data=data_bucket
+            )
+            logger.info(f"Saved dataBucket to Vault at {data_vault_path}")
+
+        if artifact_bucket:
+            artifact_vault_path = f"kv/argo/apps/{owner}/{repo_name}/artifactBucket"
+            client.secrets.kv.v2.create_or_update_secret(
+                path=artifact_vault_path,
+                secret_data=artifact_bucket
+            )
+            logger.info(f"Saved artifactBucket to Vault at {artifact_vault_path}")
+
+    except Exception as e:
+        logger.error(f"Failed to save bucket configurations to Vault: {e}")
+        raise
+
     data_json = json.dumps(registration_data)
     
     cursor.execute("""
@@ -548,6 +591,17 @@ def parse_bucket_config(prefix):
                 500,
             )
 
+        if not repositories or len(repositories) == 0:
+            return (
+                jsonify(
+                    {
+                        "success": False,
+                        "error": "No repositories found for this installation",
+                    }
+                ),
+                500,
+            )
+
         logger.info(f"Repository registration submitted: installation_id={installation_id} repositories={repositories}")
 
         # Save configuration to database
diff --git a/gitapp-callback/requirements.txt b/gitapp-callback/requirements.txt
index 57ca26bf..63c3a2a0 100644
--- a/gitapp-callback/requirements.txt
+++ b/gitapp-callback/requirements.txt
@@ -3,3 +3,4 @@ Werkzeug==3.0.1
 PyJWT==2.8.0
 cryptography==41.0.7
 requests==2.31.0
+hvac==1.2.1
\ No newline at end of file
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index d36339d4..f4267de9 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -59,7 +59,14 @@ spec:
         - name: GITHUB_APP_ID
           value: {{ .Values.githubApp.appId | quote }}
         - name: GITHUB_PRIVATE_KEY_PATH
-          value: /etc/github/private-key.pem          
+          value: /etc/github/private-key.pem
+        - name: VAULT_ADDR
+          value: {{ .Values.gitappCallback.vault.addr | quote }}
+        - name: VAULT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.vault.tokenSecret.name }}
+              key: {{ .Values.gitappCallback.vault.tokenSecret.key }}
         ports:
         - containerPort: 8080
         volumeMounts:
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index ba3147ae..b81a278e 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -302,7 +302,11 @@ gitappCallback:
     storageClass: ""
     # Storage size
     size: "10Mi" # Requests 10 Megabytes of storage
-
+  vault:
+    addr: "http://vault.vault.svc.cluster.local:8200"
+    tokenSecret:
+      name: "gitapp-vault-token"
+      key: "token"
 # ============================================================================
 # GitHub Status Proxy Settings
 # ============================================================================

From 7b0d6a4b445d0df32d4638208154325c5fb4436a Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 05:11:35 +0000
Subject: [PATCH 04/41] increase probe time

---
 helm/argo-stack/templates/32-gitapp-callback.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index f4267de9..207d6f14 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -80,13 +80,13 @@ spec:
             path: /healthz
             port: 8080
           initialDelaySeconds: 5
-          periodSeconds: 10
+          periodSeconds: 30
         readinessProbe:
           httpGet:
             path: /healthz
             port: 8080
           initialDelaySeconds: 2
-          periodSeconds: 5
+          periodSeconds: 30
       volumes:
       - name: registrations-data
         {{- if and .Values.gitappCallback.persistence.enabled .Values.gitappCallback.persistence.useExtraMounts }}

From 82ad90809f77d8a110f0fa0f51afa161b1245b9f Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 13:43:34 +0000
Subject: [PATCH 05/41] fix mountpoint

---
 gitapp-callback/app.py | 41 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 34 insertions(+), 7 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 2b4df735..280562e2 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -187,16 +187,18 @@ def init_db():
     logger.info(f"Database initialized at {DB_PATH}")
 
 
-def get_registration(installation_id):
+def get_registration(installation_id, repositories):
     """
     Get a registration from the database.
     
     Args:
         installation_id: The GitHub installation ID
+        repositories: List of repositories associated with the installation
         
     Returns:
         dict: The registration data or None if not found
     """
+
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
     
@@ -209,7 +211,30 @@ def get_registration(installation_id):
     conn.close()
     
     if row:
-        return json.loads(row[0])
+        registration_data = json.loads(row[0])
+
+        if len(repositories) > 1:
+            logging.warning("Multiple repositories found for installation; using the first one.")
+
+        full_name = repositories[0]['full_name']
+        owner, repo_name = full_name.split('/')
+        data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
+        artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
+        try:
+            client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+            dataBucket = client.secrets.kv.v2.read_secret_version(path=data_vault_path, mount_point="kv")
+            artifactBucket = client.secrets.kv.v2.read_secret_version(path=artifact_vault_path, mount_point="kv")
+            registration_data["dataBucket"] = {}
+            registration_data["artifactBucket"] = {}
+            if dataBucket:
+                registration_data["dataBucket"] = dataBucket['data']['data']
+            if artifactBucket:
+                registration_data["artifactBucket"] = artifactBucket['data']['data']
+        except Exception as e:
+            logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
+
+        return registration_data
+    
     return None
 
 
@@ -244,18 +269,20 @@ def save_registration(installation_id, registration_data, repositories):
         client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
 
         if data_bucket:
-            data_vault_path = f"kv/argo/apps/{owner}/{repo_name}/dataBucket"
+            data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
             client.secrets.kv.v2.create_or_update_secret(
                 path=data_vault_path,
-                secret_data=data_bucket
+                secret=data_bucket,
+                mount_point="kv"
             )
             logger.info(f"Saved dataBucket to Vault at {data_vault_path}")
 
         if artifact_bucket:
-            artifact_vault_path = f"kv/argo/apps/{owner}/{repo_name}/artifactBucket"
+            artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
             client.secrets.kv.v2.create_or_update_secret(
                 path=artifact_vault_path,
-                secret_data=artifact_bucket
+                secret=artifact_bucket,
+                mount_point="kv"
             )
             logger.info(f"Saved artifactBucket to Vault at {artifact_vault_path}")
 
@@ -392,7 +419,7 @@ def registrations_form():
     )
 
     # Check if registration exists
-    existing_registration = get_registration(installation_id)
+    existing_registration = get_registration(installation_id, repositories)
     
     # Handle install action
     if setup_action == "install":

From 4abf95cd939b3e5a8e9e36446976950d6a796b38 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 05:59:01 -0800
Subject: [PATCH 06/41] adds secrets ux

---
 .../0006-ux-secrets-mgt-on-registration.md    | 451 ++++++++++++++++++
 1 file changed, 451 insertions(+)
 create mode 100644 docs/adr/0006-ux-secrets-mgt-on-registration.md

diff --git a/docs/adr/0006-ux-secrets-mgt-on-registration.md b/docs/adr/0006-ux-secrets-mgt-on-registration.md
new file mode 100644
index 00000000..077b0e7c
--- /dev/null
+++ b/docs/adr/0006-ux-secrets-mgt-on-registration.md
@@ -0,0 +1,451 @@
+Below is a **concise, implementation-ready Architecture Decision Record (ADR)** you can drop into a repo (e.g., `docs/adr/ADR-00X-ui-secret-handling.md`). It is written to stand up to security review and UX critique and maps cleanly to GitOps / CRD-backed systems.
+
+---
+
+# ADR-00X: UI Handling of Secrets on CREATE and UPDATE
+
+**Status:** Accepted
+**Date:** 2025-01-XX
+**Decision Makers:** Platform, Security, UX
+**Context:** Web UI, API-backed resources, GitOps-managed systems
+
+---
+
+## Context
+
+The platform requires users to provide **secrets** (e.g., API keys, client secrets, tokens) through a user interface during resource creation (**CREATE**) and later management (**UPDATE**).
+
+Secrets are highly sensitive and must be handled in a way that:
+
+* Minimizes exposure
+* Prevents accidental disclosure
+* Avoids unintended secret rotation
+* Aligns with industry-standard security and UX practices
+
+This ADR defines how secrets are collected, stored, and managed via the UI.
+
+---
+
+## Problem Statement
+
+How should secrets entered during **CREATE** be handled during **UPDATE**?
+
+Specifically:
+
+* Should secrets be re-displayed (masked or otherwise)?
+* Should users be required to re-enter secrets during UPDATE?
+* How should secret rotation be performed safely and intentionally?
+
+---
+
+## Decision
+
+### 1. Secrets Are Write-Only from the UI
+
+Once submitted, secrets:
+
+* **MUST NOT be re-displayed** in the UI
+* **MUST NOT be pre-filled** on UPDATE
+* **MUST NOT be retrievable** via the UI or API
+
+The UI treats secrets as **write-only values**.
+
+---
+
+### 2. CREATE Behavior
+
+On CREATE:
+
+* Users explicitly enter the secret
+* The UI may provide:
+
+  * Client-side validation (length, format)
+  * Optional “show/hide while typing”
+* After submission:
+
+  * The plaintext secret is immediately discarded
+  * Only a secure backend representation is retained (e.g., Vault, KMS-encrypted storage)
+
+**Optional UX enhancement:**
+
+* One-time confirmation message:
+  *“This secret will not be shown again. Please store it securely.”*
+
+---
+
+### 3. UPDATE Behavior (Default)
+
+On UPDATE:
+
+* Secrets are **not shown**
+* Secret input fields are **not rendered**
+* The UI displays non-sensitive metadata only, such as:
+
+  * “Secret: Configured”
+  * “Last updated: <timestamp>”
+
+**No re-entry is required** unless the user explicitly chooses to change the secret.
+
+---
+
+### 4. Secret Rotation / Replacement
+
+Secret changes are performed via an **explicit user action**, such as:
+
+* “Replace secret”
+* “Rotate credentials”
+
+When invoked:
+
+* A new, empty secret input field is displayed
+* The user must re-enter the full secret from scratch
+* Submitting the form replaces the existing stored secret
+
+This action is intentional, auditable, and irreversible.
+
+---
+## Sequence Diagrams
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor U as User
+    participant UI as Web UI
+    participant API as Platform API
+    participant VAULT as Secret Store (Vault/KMS)
+    participant DB as Resource DB
+    participant AUDIT as Audit Log
+
+    rect rgb(235, 248, 255)
+    note over U,DB: CREATE (secret collected once, write-only)
+    U->>UI: Fill form (includes secret)
+    UI->>API: POST /resources {config, secret}
+    API->>VAULT: Store secret (encrypt/unwrap/wrap)
+    VAULT-->>API: secret_ref (write-only handle)
+    API->>DB: Persist resource {config, secret_ref}
+    API->>AUDIT: Record "resource_created" (no secret value)
+    API-->>UI: 201 Created (secret never returned)
+    UI-->>U: Success + "Secret will not be shown again"
+    end
+
+    rect rgb(237, 255, 237)
+    note over U,DB: UPDATE (no secret change,secret not re-displayed)
+    U->>UI: Open resource settings
+    UI->>API: GET /resources/{id}
+    API->>DB: Load resource {config, secret_ref}
+    DB-->>API: {config, secret_ref}
+    API-->>UI: {config, secret_configured=true, secret_last_updated_at}
+    UI-->>U: Show config + "Secret: Configured" (no field by default)
+    U->>UI: Edit config (non-secret)
+    UI->>API: PATCH /resources/{id} {config_changes}
+    API->>DB: Update config only
+    API->>AUDIT: Record "resource_updated" (no secret value)
+    API-->>UI: 200 OK
+    UI-->>U: Success
+    end
+
+    rect rgb(255, 245, 235)
+    note over U,DB: ROTATE / REPLACE SECRET (explicit action)
+    U->>UI: Click "Replace/Rotate secret"
+    UI-->>U: Show empty secret input + warning
+    U->>UI: Enter new secret
+    UI->>API: POST /resources/{id}/secret:rotate {new_secret}
+    API->>VAULT: Store new secret (new version / overwrite)
+    VAULT-->>API: new_secret_ref (or new version id)
+    API->>DB: Update resource secret_ref + secret_last_updated_at
+    API->>AUDIT: Record "secret_rotated" (no secret value)
+    API-->>UI: 200 OK (secret not returned)
+    UI-->>U: Success + "Secret updated"
+    end
+
+```
+---
+
+## Alternatives Considered
+
+### A. Re-display masked secrets on UPDATE
+
+**Rejected**
+
+* Implies secrets are retrievable
+* Creates false confidence
+* Encourages unsafe behavior (screenshots, copying)
+
+---
+
+### B. Always require secret re-entry on UPDATE
+
+**Rejected**
+
+* Increases friction
+* Causes accidental secret rotation
+* Leads to outages and misconfiguration
+
+---
+
+### C. Empty secret field on UPDATE with “leave blank to keep existing”
+
+**Partially acceptable, but not preferred**
+
+* Increases risk of accidental replacement
+* Ambiguous UX semantics
+* Allowed only in low-risk internal tooling
+
+---
+
+## Rationale
+
+This decision aligns with:
+
+* Principle of least exposure
+* Zero-trust UI assumptions
+* Industry standards (cloud providers, payment platforms, developer tooling)
+
+Security considerations:
+
+* UI surfaces are high-risk (logs, extensions, screenshots)
+* Secrets should be non-recoverable once stored
+* Rotation must be deliberate, not incidental
+
+UX considerations:
+
+* Reduces accidental outages
+* Sets clear user expectations
+* Improves trust through explicit, predictable behavior
+
+---
+
+## Consequences
+
+### Positive
+
+* Reduced secret leakage risk
+* Clear separation between configuration and rotation
+* Safer UPDATE workflows
+* Easier security audits
+
+### Trade-offs
+
+* Users cannot “recover” lost secrets
+* Requires clear UX copy and documentation
+* Slightly more UI complexity (explicit rotate action)
+
+---
+
+## Implementation Notes
+
+* Backend APIs must treat secret fields as **write-only**
+* Update handlers must distinguish between:
+
+  * “no secret change”
+  * “explicit secret replacement”
+* Audit logs should record:
+
+  * Secret creation
+  * Secret replacement
+  * Actor and timestamp (but never the value)
+
+---
+
+## UX Copy Guidelines (Normative)
+
+Recommended language:
+
+* “For security reasons, this secret is not visible after creation.”
+* “To change the secret, replace it below.”
+* “Secrets are write-only and cannot be recovered.”
+
+Avoid:
+
+* Masked secret placeholders
+* Copyable secret values
+* Inline secret editing without intent
+
+---
+
+## Related Decisions
+
+🚧 TODO: Create other ADRs as needed and link here.
+
+* ADR-00Y: Secure Secret Storage (Vault / KMS)
+* ADR-00Z: Audit Logging for Credential Changes
+
+---
+
+
+
+---
+Below is the **conventional UX + security guidance** most teams converge on for handling secrets in a UI, especially when secrets are collected at **CREATE** time and later managed via **UPDATE**.
+
+---
+
+## Core Principle
+
+**Secrets are write-only from the UI’s perspective.**
+Once collected, they should **never be re-displayed**—not even masked—on subsequent views or edits.
+
+This applies to:
+
+* API keys
+* Client secrets
+* Passwords
+* Private keys
+* Tokens
+* Webhook signing secrets
+
+---
+
+## On CREATE
+
+**What’s conventional:**
+
+* User enters the secret explicitly.
+* The UI may:
+
+  * Validate format (length, prefix, checksum)
+  * Offer “show / hide while typing”
+* After submit:
+
+  * The plaintext secret is immediately discarded by the UI
+  * Only a securely stored representation remains (vault, KMS-wrapped value, etc.)
+
+**Optional UX enhancements (safe):**
+
+* One-time “copy this now” confirmation screen
+* Explicit warning: *“This secret will not be shown again.”*
+
+---
+
+## On UPDATE
+
+### 🔐 Are secrets re-displayed?
+
+**No. Never.**
+
+Conventional wisdom is:
+
+* Secrets are **not re-displayed**
+* Secrets are **not pre-filled**
+* Secrets are **not retrievable**
+
+Even masked placeholders like `••••••••` are generally discouraged unless they are **clearly synthetic** (i.e., not implying reversibility).
+
+---
+
+### 🔁 Do secrets need to be re-entered?
+
+**Only if the user is changing them.**
+
+There are two accepted patterns:
+
+---
+
+## Pattern 1: Explicit “Rotate / Replace Secret” (Best Practice)
+
+**UI behavior:**
+
+* On UPDATE, the secret field is **absent**
+* Instead, show:
+
+  * “Secret: Configured”
+  * “Last updated: <timestamp>”
+* Provide a deliberate action:
+
+  * “Replace secret”
+  * “Rotate credentials”
+
+**If user chooses to replace:**
+
+* Reveal an empty secret input
+* Require full re-entry
+* Overwrite stored secret
+
+**Why this is preferred:**
+
+* Prevents accidental secret invalidation
+* Makes rotation intentional
+* Communicates immutability clearly
+
+This is the pattern used by:
+
+* GitHub
+* AWS
+* GCP
+* Stripe
+* HashiCorp Vault UIs
+
+---
+
+## Pattern 2: Optional Re-entry on Save (Acceptable, but Riskier)
+
+**UI behavior:**
+
+* Secret field appears empty on UPDATE
+* Label clearly indicates:
+
+  * “Leave blank to keep existing secret”
+* Backend logic:
+
+  * Empty → no change
+  * Non-empty → replace
+
+**Risks:**
+
+* Users accidentally paste whitespace or wrong value
+* Ambiguous save semantics
+* Easier to misconfigure
+
+This pattern is common in internal tools but less favored in security-sensitive systems.
+
+---
+
+## 🚫 Anti-Patterns (Avoid These)
+
+| Anti-Pattern                        | Why It’s Bad                  |
+| ----------------------------------- | ----------------------------- |
+| Re-displaying secret (even masked)  | Implies reversibility         |
+| Pre-filling secret field            | High risk of leakage          |
+| Auto-reusing secret on edit         | Breaks zero-trust assumptions |
+| “Edit secret inline” without intent | Easy to accidentally rotate   |
+| Copyable secret after creation      | Violates least exposure       |
+
+---
+
+## UX Language That Works Well
+
+Use **explicit, confidence-building copy**:
+
+* “For security reasons, this secret is not visible after creation.”
+* “To change the secret, replace it below.”
+* “Leaving this field empty will keep the existing secret.”
+* “Secrets are write-only and cannot be recovered.”
+
+This reduces support tickets and increases trust.
+
+---
+
+## Security Rationale (Why This Is the Norm)
+
+1. **UI is a high-risk surface**
+
+   * Screenshots, browser extensions, logs, shoulder-surfing
+2. **Secrets should be non-recoverable**
+
+   * If you can show it, you can leak it
+3. **Principle of least exposure**
+
+   * No value in showing a secret after initial confirmation
+4. **Rotation should be intentional**
+
+   * Accidental rotation causes outages
+
+---
+
+## Bottom Line
+
+**Conventional wisdom is clear and consistent:**
+
+* **Secrets are collected only at CREATE or explicit ROTATE**
+* **Secrets are never re-displayed on UPDATE**
+* **Secrets are re-entered from scratch only if the user chooses to change them**
+* **Default UPDATE does not require re-entry**

From 704a082b7df3a71eb4468226fc4358340b82ac47 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 09:01:43 -0800
Subject: [PATCH 07/41] adds secrets ux

---
 docs/adr/0006-ux-secrets-mgt-on-registration.md | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/docs/adr/0006-ux-secrets-mgt-on-registration.md b/docs/adr/0006-ux-secrets-mgt-on-registration.md
index 077b0e7c..210042f3 100644
--- a/docs/adr/0006-ux-secrets-mgt-on-registration.md
+++ b/docs/adr/0006-ux-secrets-mgt-on-registration.md
@@ -1,6 +1,3 @@
-Below is a **concise, implementation-ready Architecture Decision Record (ADR)** you can drop into a repo (e.g., `docs/adr/ADR-00X-ui-secret-handling.md`). It is written to stand up to security review and UX critique and maps cleanly to GitOps / CRD-backed systems.
-
----
 
 # ADR-00X: UI Handling of Secrets on CREATE and UPDATE
 

From 0aa50cb95823d81c5ca91475f88a89a17faf1093 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 10:23:41 -0800
Subject: [PATCH 08/41] improve update form

---
 gitapp-callback/.dockerignore                 |   1 +
 gitapp-callback/.gitignore                    |   1 +
 gitapp-callback/.python-version               |   1 +
 gitapp-callback/app.py                        | 118 +++---
 .../templates/registration_form.html          | 387 ++++++++++--------
 gitapp-callback/tests/test_app.py             |   8 +-
 6 files changed, 291 insertions(+), 225 deletions(-)
 create mode 100644 gitapp-callback/.dockerignore
 create mode 100644 gitapp-callback/.gitignore
 create mode 100644 gitapp-callback/.python-version

diff --git a/gitapp-callback/.dockerignore b/gitapp-callback/.dockerignore
new file mode 100644
index 00000000..f7275bbb
--- /dev/null
+++ b/gitapp-callback/.dockerignore
@@ -0,0 +1 @@
+venv/
diff --git a/gitapp-callback/.gitignore b/gitapp-callback/.gitignore
new file mode 100644
index 00000000..f7275bbb
--- /dev/null
+++ b/gitapp-callback/.gitignore
@@ -0,0 +1 @@
+venv/
diff --git a/gitapp-callback/.python-version b/gitapp-callback/.python-version
new file mode 100644
index 00000000..e4fba218
--- /dev/null
+++ b/gitapp-callback/.python-version
@@ -0,0 +1 @@
+3.12
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 280562e2..3c5ec2b0 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -187,13 +187,13 @@ def init_db():
     logger.info(f"Database initialized at {DB_PATH}")
 
 
-def get_registration(installation_id, repositories):
+def get_registration(installation_id, repositories=None):
     """
     Get a registration from the database.
     
     Args:
         installation_id: The GitHub installation ID
-        repositories: List of repositories associated with the installation
+        repositories: Optional list of repositories associated with the installation
         
     Returns:
         dict: The registration data or None if not found
@@ -213,47 +213,60 @@ def get_registration(installation_id, repositories):
     if row:
         registration_data = json.loads(row[0])
 
-        if len(repositories) > 1:
-            logging.warning("Multiple repositories found for installation; using the first one.")
+        if repositories and VAULT_ADDR and VAULT_TOKEN:
+            if len(repositories) > 1:
+                logging.warning("Multiple repositories found for installation; using the first one.")
 
-        full_name = repositories[0]['full_name']
-        owner, repo_name = full_name.split('/')
-        data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
-        artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
-        try:
-            client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
-            dataBucket = client.secrets.kv.v2.read_secret_version(path=data_vault_path, mount_point="kv")
-            artifactBucket = client.secrets.kv.v2.read_secret_version(path=artifact_vault_path, mount_point="kv")
-            registration_data["dataBucket"] = {}
-            registration_data["artifactBucket"] = {}
-            if dataBucket:
-                registration_data["dataBucket"] = dataBucket['data']['data']
-            if artifactBucket:
-                registration_data["artifactBucket"] = artifactBucket['data']['data']
-        except Exception as e:
-            logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
+            full_name = repositories[0]['full_name']
+            owner, repo_name = full_name.split('/')
+            data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
+            artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
+            try:
+                client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+                data_bucket_response = client.secrets.kv.v2.read_secret_version(
+                    path=data_vault_path,
+                    mount_point="kv"
+                )
+                artifact_bucket_response = client.secrets.kv.v2.read_secret_version(
+                    path=artifact_vault_path,
+                    mount_point="kv"
+                )
+                if data_bucket_response:
+                    created_time = (
+                        data_bucket_response
+                        .get("data", {})
+                        .get("metadata", {})
+                        .get("created_time")
+                    )
+                    if created_time:
+                        registration_data["dataBucketCreatedTime"] = created_time
+                if artifact_bucket_response:
+                    created_time = (
+                        artifact_bucket_response
+                        .get("data", {})
+                        .get("metadata", {})
+                        .get("created_time")
+                    )
+                    if created_time:
+                        registration_data["artifactBucketCreatedTime"] = created_time
+            except Exception as e:
+                logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
 
         return registration_data
     
     return None
 
 
-def save_registration(installation_id, registration_data, repositories):
+def save_registration(installation_id, registration_data, repositories=None):
     """
     Save or update a registration in the database.
     
     Args:
         installation_id: The GitHub installation ID
         registration_data: The RepoRegistration configuration dict
-        repositories: List of repositories associated with the installation
+        repositories: Optional list of repositories associated with the installation
     """
 
-    if len(repositories) > 1:
-        logging.warning("Multiple repositories found for installation; using the first one.")
-
-    full_name = repositories[0]['full_name']
-    owner, repo_name = full_name.split('/')
-
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
 
@@ -265,30 +278,36 @@ def save_registration(installation_id, registration_data, repositories):
         del registration_data["artifactBucket"]
 
     # Save bucket configurations to Vault
-    try:
-        client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
+    if repositories:
+        if len(repositories) > 1:
+            logging.warning("Multiple repositories found for installation; using the first one.")
 
-        if data_bucket:
-            data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
-            client.secrets.kv.v2.create_or_update_secret(
-                path=data_vault_path,
-                secret=data_bucket,
-                mount_point="kv"
-            )
-            logger.info(f"Saved dataBucket to Vault at {data_vault_path}")
+        full_name = repositories[0]['full_name']
+        owner, repo_name = full_name.split('/')
+        try:
+            client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
 
-        if artifact_bucket:
-            artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
-            client.secrets.kv.v2.create_or_update_secret(
-                path=artifact_vault_path,
-                secret=artifact_bucket,
-                mount_point="kv"
-            )
-            logger.info(f"Saved artifactBucket to Vault at {artifact_vault_path}")
+            if data_bucket:
+                data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
+                client.secrets.kv.v2.create_or_update_secret(
+                    path=data_vault_path,
+                    secret=data_bucket,
+                    mount_point="kv"
+                )
+                logger.info(f"Saved dataBucket to Vault at {data_vault_path}")
+
+            if artifact_bucket:
+                artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
+                client.secrets.kv.v2.create_or_update_secret(
+                    path=artifact_vault_path,
+                    secret=artifact_bucket,
+                    mount_point="kv"
+                )
+                logger.info(f"Saved artifactBucket to Vault at {artifact_vault_path}")
 
-    except Exception as e:
-        logger.error(f"Failed to save bucket configurations to Vault: {e}")
-        raise
+        except Exception as e:
+            logger.error(f"Failed to save bucket configurations to Vault: {e}")
+            raise
 
     data_json = json.dumps(registration_data)
     
@@ -666,4 +685,3 @@ def parse_bucket_config(prefix):
         GITHUB_APP_NAME: Name of the GitHub App (default: calypr-workflows)
     """
     app.run(host="0.0.0.0", port=8080, debug=True)
-
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index f3515397..b22bd802 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -225,6 +225,21 @@
             text-decoration: underline;
         }
 
+        .link-button {
+            background: none;
+            border: none;
+            color: #2563eb;
+            cursor: pointer;
+            font-size: 0.9rem;
+            font-weight: 500;
+            padding: 0;
+            text-decoration: underline;
+        }
+
+        .link-button:hover {
+            color: #1d4ed8;
+        }
+
         /* Alert Messages */
         .alert {
             padding: 1rem;
@@ -340,110 +355,121 @@ <h3>Repository Configuration</h3>
                     <h3>Data Bucket Configuration</h3>
                     <p class="help-text" style="margin-bottom: 1.5rem;">S3-compatible bucket for storing workflow data (optional)</p>
 
-                    <div class="form-group">
-                        <label for="dataBucket_bucket">
-                            Bucket Name
-                        </label>
-                        <input
-                            type="text"
-                            id="dataBucket_bucket"
-                            name="dataBucket_bucket"
-                            placeholder="my-data-bucket"
-                            value="{{ initial_data.dataBucket.bucket if initial_data and initial_data.dataBucket else '' }}"
-                        >
+                    {% set data_bucket_has_secret = initial_data and initial_data.dataBucketCreatedTime %}
+                    {% if data_bucket_has_secret %}
+                    <div class="alert alert-info show bucket-notice">
+                        This bucket information was saved on {{ initial_data.dataBucketCreatedTime }}.
+                        <button type="button" class="link-button bucket-reentry-toggle" data-target="dataBucketForm">
+                            Click here to re-enter.
+                        </button>
                     </div>
+                    {% endif %}
 
-                    <div id="dataBucketFields" style="display: none;">
+                    <div id="dataBucketForm" {% if data_bucket_has_secret %}style="display: none;"{% endif %}>
                         <div class="form-group">
-                            <label for="dataBucket_accessKey">
-                                Access Key <span class="required">*</span>
+                            <label for="dataBucket_bucket">
+                                Bucket Name
                             </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="dataBucket_accessKey"
-                                    name="dataBucket_accessKey"
-                                    placeholder="AKIAIOSFODNN7EXAMPLE"
-                                    value="{{ initial_data.dataBucket.accessKey if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="dataBucket_accessKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
+                            <input
+                                type="text"
+                                id="dataBucket_bucket"
+                                name="dataBucket_bucket"
+                                placeholder="my-data-bucket"
+                                value=""
+                            >
                         </div>
 
-                        <div class="form-group">
-                            <label for="dataBucket_secretKey">
-                                Secret Key <span class="required">*</span>
-                            </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="dataBucket_secretKey"
-                                    name="dataBucket_secretKey"
-                                    placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-                                    value="{{ initial_data.dataBucket.secretKey if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="dataBucket_secretKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
-                        </div>
-
-                        <div class="form-group">
-                            <label>
-                                <input
-                                    type="checkbox"
-                                    id="dataBucket_is_aws"
-                                    name="dataBucket_is_aws"
-                                    {% if not initial_data or not initial_data.dataBucket or initial_data.dataBucket.is_aws %}checked{% endif %}
-                                >
-                                Is AWS S3
-                            </label>
-                            <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
-                        </div>
-
-                        <div id="dataBucketNonAwsFields" style="display: none;">
+                        <div id="dataBucketFields" style="display: none;">
                             <div class="form-group">
-                                <label for="dataBucket_hostname">
-                                    Hostname <span class="required">*</span>
+                                <label for="dataBucket_accessKey">
+                                    Access Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="url"
-                                    id="dataBucket_hostname"
-                                    name="dataBucket_hostname"
-                                    placeholder="https://minio.example.org:9000"
-                                    value="{{ initial_data.dataBucket.hostname if initial_data and initial_data.dataBucket else '' }}"
-                                >
-                                <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="dataBucket_accessKey"
+                                        name="dataBucket_accessKey"
+                                        placeholder="AKIAIOSFODNN7EXAMPLE"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="dataBucket_accessKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
-                                <label for="dataBucket_region">
-                                    Region <span class="required">*</span>
+                                <label for="dataBucket_secretKey">
+                                    Secret Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="text"
-                                    id="dataBucket_region"
-                                    name="dataBucket_region"
-                                    placeholder="us-west-2"
-                                    value="{{ initial_data.dataBucket.region if initial_data and initial_data.dataBucket else '' }}"
-                                >
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="dataBucket_secretKey"
+                                        name="dataBucket_secretKey"
+                                        placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="dataBucket_secretKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
                                 <label>
                                     <input
                                         type="checkbox"
-                                        id="dataBucket_pathStyle"
-                                        name="dataBucket_pathStyle"
-                                        {% if initial_data and initial_data.dataBucket and initial_data.dataBucket.pathStyle %}checked{% endif %}
+                                        id="dataBucket_is_aws"
+                                        name="dataBucket_is_aws"
+                                        checked
                                     >
-                                    Use Path-Style Requests
+                                    Is AWS S3
                                 </label>
-                                <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
+                            </div>
+
+                            <div id="dataBucketNonAwsFields" style="display: none;">
+                                <div class="form-group">
+                                    <label for="dataBucket_hostname">
+                                        Hostname <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="url"
+                                        id="dataBucket_hostname"
+                                        name="dataBucket_hostname"
+                                        placeholder="https://minio.example.org:9000"
+                                        value=""
+                                    >
+                                    <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                </div>
+
+                                <div class="form-group">
+                                    <label for="dataBucket_region">
+                                        Region <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="text"
+                                        id="dataBucket_region"
+                                        name="dataBucket_region"
+                                        placeholder="us-west-2"
+                                        value=""
+                                    >
+                                </div>
+
+                                <div class="form-group">
+                                    <label>
+                                        <input
+                                            type="checkbox"
+                                            id="dataBucket_pathStyle"
+                                            name="dataBucket_pathStyle"
+                                        >
+                                        Use Path-Style Requests
+                                    </label>
+                                    <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                </div>
                             </div>
                         </div>
                     </div>
@@ -453,110 +479,121 @@ <h3>Data Bucket Configuration</h3>
                     <h3>Artifact Bucket Configuration</h3>
                     <p class="help-text" style="margin-bottom: 1.5rem;">S3-compatible bucket for storing workflow artifacts (optional)</p>
 
-                    <div class="form-group">
-                        <label for="artifactBucket_bucket">
-                            Bucket Name
-                        </label>
-                        <input
-                            type="text"
-                            id="artifactBucket_bucket"
-                            name="artifactBucket_bucket"
-                            placeholder="my-artifact-bucket"
-                            value="{{ initial_data.artifactBucket.bucket if initial_data and initial_data.artifactBucket else '' }}"
-                        >
+                    {% set artifact_bucket_has_secret = initial_data and initial_data.artifactBucketCreatedTime %}
+                    {% if artifact_bucket_has_secret %}
+                    <div class="alert alert-info show bucket-notice">
+                        This bucket information was saved on {{ initial_data.artifactBucketCreatedTime }}.
+                        <button type="button" class="link-button bucket-reentry-toggle" data-target="artifactBucketForm">
+                            Click here to re-enter.
+                        </button>
                     </div>
+                    {% endif %}
 
-                    <div id="artifactBucketFields" style="display: none;">
-                        <div class="form-group">
-                            <label for="artifactBucket_accessKey">
-                                Access Key <span class="required">*</span>
-                            </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="artifactBucket_accessKey"
-                                    name="artifactBucket_accessKey"
-                                    placeholder="AKIAIOSFODNN7EXAMPLE"
-                                    value="{{ initial_data.artifactBucket.accessKey if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="artifactBucket_accessKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
-                        </div>
-
+                    <div id="artifactBucketForm" {% if artifact_bucket_has_secret %}style="display: none;"{% endif %}>
                         <div class="form-group">
-                            <label for="artifactBucket_secretKey">
-                                Secret Key <span class="required">*</span>
+                            <label for="artifactBucket_bucket">
+                                Bucket Name
                             </label>
-                            <div class="password-field">
-                                <input
-                                    type="password"
-                                    id="artifactBucket_secretKey"
-                                    name="artifactBucket_secretKey"
-                                    placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-                                    value="{{ initial_data.artifactBucket.secretKey if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <button type="button" class="toggle-password" data-target="artifactBucket_secretKey">
-                                    <span class="show-text">Show</span>
-                                    <span class="hide-text" style="display: none;">Hide</span>
-                                </button>
-                            </div>
+                            <input
+                                type="text"
+                                id="artifactBucket_bucket"
+                                name="artifactBucket_bucket"
+                                placeholder="my-artifact-bucket"
+                                value=""
+                            >
                         </div>
 
-                        <div class="form-group">
-                            <label>
-                                <input
-                                    type="checkbox"
-                                    id="artifactBucket_is_aws"
-                                    name="artifactBucket_is_aws"
-                                    {% if not initial_data or not initial_data.artifactBucket or initial_data.artifactBucket.is_aws %}checked{% endif %}
-                                >
-                                Is AWS S3
-                            </label>
-                            <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
-                        </div>
-
-                        <div id="artifactBucketNonAwsFields" style="display: none;">
+                        <div id="artifactBucketFields" style="display: none;">
                             <div class="form-group">
-                                <label for="artifactBucket_hostname">
-                                    Hostname <span class="required">*</span>
+                                <label for="artifactBucket_accessKey">
+                                    Access Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="url"
-                                    id="artifactBucket_hostname"
-                                    name="artifactBucket_hostname"
-                                    placeholder="https://minio.example.org:9000"
-                                    value="{{ initial_data.artifactBucket.hostname if initial_data and initial_data.artifactBucket else '' }}"
-                                >
-                                <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="artifactBucket_accessKey"
+                                        name="artifactBucket_accessKey"
+                                        placeholder="AKIAIOSFODNN7EXAMPLE"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="artifactBucket_accessKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
-                                <label for="artifactBucket_region">
-                                    Region <span class="required">*</span>
+                                <label for="artifactBucket_secretKey">
+                                    Secret Key <span class="required">*</span>
                                 </label>
-                                <input
-                                    type="text"
-                                    id="artifactBucket_region"
-                                    name="artifactBucket_region"
-                                    placeholder="us-west-2"
-                                    value="{{ initial_data.artifactBucket.region if initial_data and initial_data.artifactBucket else '' }}"
-                                >
+                                <div class="password-field">
+                                    <input
+                                        type="password"
+                                        id="artifactBucket_secretKey"
+                                        name="artifactBucket_secretKey"
+                                        placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+                                        value=""
+                                    >
+                                    <button type="button" class="toggle-password" data-target="artifactBucket_secretKey">
+                                        <span class="show-text">Show</span>
+                                        <span class="hide-text" style="display: none;">Hide</span>
+                                    </button>
+                                </div>
                             </div>
 
                             <div class="form-group">
                                 <label>
                                     <input
                                         type="checkbox"
-                                        id="artifactBucket_pathStyle"
-                                        name="artifactBucket_pathStyle"
-                                        {% if initial_data and initial_data.artifactBucket and initial_data.artifactBucket.pathStyle %}checked{% endif %}
+                                        id="artifactBucket_is_aws"
+                                        name="artifactBucket_is_aws"
+                                        checked
                                     >
-                                    Use Path-Style Requests
+                                    Is AWS S3
                                 </label>
-                                <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                <p class="help-text">Uncheck if using a non-AWS S3-compatible service (e.g., MinIO)</p>
+                            </div>
+
+                            <div id="artifactBucketNonAwsFields" style="display: none;">
+                                <div class="form-group">
+                                    <label for="artifactBucket_hostname">
+                                        Hostname <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="url"
+                                        id="artifactBucket_hostname"
+                                        name="artifactBucket_hostname"
+                                        placeholder="https://minio.example.org:9000"
+                                        value=""
+                                    >
+                                    <p class="help-text">S3 endpoint URL (must start with https://)</p>
+                                </div>
+
+                                <div class="form-group">
+                                    <label for="artifactBucket_region">
+                                        Region <span class="required">*</span>
+                                    </label>
+                                    <input
+                                        type="text"
+                                        id="artifactBucket_region"
+                                        name="artifactBucket_region"
+                                        placeholder="us-west-2"
+                                        value=""
+                                    >
+                                </div>
+
+                                <div class="form-group">
+                                    <label>
+                                        <input
+                                            type="checkbox"
+                                            id="artifactBucket_pathStyle"
+                                            name="artifactBucket_pathStyle"
+                                        >
+                                        Use Path-Style Requests
+                                    </label>
+                                    <p class="help-text">Forces path-style requests (e.g., s3.amazonaws.com/bucket)</p>
+                                </div>
                             </div>
                         </div>
                     </div>
@@ -624,6 +661,20 @@ <h3>Access Control</h3>
             });
         });
 
+        document.querySelectorAll('.bucket-reentry-toggle').forEach(button => {
+            button.addEventListener('click', function() {
+                const targetId = this.getAttribute('data-target');
+                const target = document.getElementById(targetId);
+                if (target) {
+                    target.style.display = 'block';
+                }
+                const notice = this.closest('.bucket-notice');
+                if (notice) {
+                    notice.style.display = 'none';
+                }
+            });
+        });
+
         // Show/hide bucket credential fields when bucket name is entered
         function setupBucketFieldToggle(bucketPrefix) {
             const bucketInput = document.getElementById(`${bucketPrefix}_bucket`);
diff --git a/gitapp-callback/tests/test_app.py b/gitapp-callback/tests/test_app.py
index f4daa0f1..13f92a6a 100644
--- a/gitapp-callback/tests/test_app.py
+++ b/gitapp-callback/tests/test_app.py
@@ -390,12 +390,7 @@ def test_update_form_prepopulates_data(client):
     existing_data = {
         'installation_id': '11100001',
         'defaultBranch': 'staging',
-        'dataBucket': {
-            'bucket': 'my-data',
-            'accessKey': 'AKIATEST',
-            'secretKey': 'secretTest123',
-            'is_aws': True
-        },
+        'dataBucket': None,
         'artifactBucket': None,
         'adminUsers': ['user1@example.com', 'user2@example.com'],
         'readUsers': ['viewer@example.com']
@@ -407,7 +402,6 @@ def test_update_form_prepopulates_data(client):
     
     assert response.status_code == 200
     assert b'staging' in response.data
-    assert b'my-data' in response.data
     assert b'user1@example.com' in response.data
     assert b'user2@example.com' in response.data
     assert b'viewer@example.com' in response.data

From 8b749d79bb197c82af1ecd5d80f235d3590bfcde Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 10:37:31 -0800
Subject: [PATCH 09/41] improve sidebar

---
 gitapp-callback/templates/error.html             | 6 ++----
 gitapp-callback/templates/registration_form.html | 4 +---
 gitapp-callback/templates/success.html           | 6 ++----
 3 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/gitapp-callback/templates/error.html b/gitapp-callback/templates/error.html
index 0317807e..c7303cdd 100644
--- a/gitapp-callback/templates/error.html
+++ b/gitapp-callback/templates/error.html
@@ -160,10 +160,8 @@
         <h1>{{ github_app_name }}</h1>
         <nav>
             <ul>
-                <li><a href="/registrations">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index b22bd802..db96be99 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -302,9 +302,7 @@ <h1>{{ github_app_name }}</h1>
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>
diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index 9feb3d49..566aaa92 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -198,10 +198,8 @@
         <h1>{{ github_app_name }}</h1>
         <nav>
             <ul>
-                <li><a href="/registrations">Repository Registration</a></li>
-                <li><a href="#">My Repositories</a></li>
-                <li><a href="#">Settings</a></li>
-                <li><a href="#">Documentation</a></li>
+                <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
     </aside>

From c68fd1e2829507a8f2f0b526df27a6ae7e17656e Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 10:41:08 -0800
Subject: [PATCH 10/41] githubAppName

---
 helm/argo-stack/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index b81a278e..74b4f791 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -281,7 +281,7 @@ gitappCallback:
   # Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'
   secretKey: "REPLACE_ME_WITH_SECURE_RANDOM_VALUE"
   # GitHub App name (displayed in the UI)
-  githubAppName: "calypr-workflows"
+  githubAppName: "calypr"
   # Persistence configuration for registration database
   persistence:
     # Enable persistent storage for SQLite database (uses PVC or host mount based on useExtraMounts)

From 4661b0878978d659f5d638f5a1d98ec30114fffd Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 11:48:57 -0800
Subject: [PATCH 11/41] create PR

---
 gitapp-callback/app.py                        | 228 +++++++++++++++++-
 .../templates/32-gitapp-callback.yaml         |  19 +-
 .../eso/externalsecret-github-app.yaml        |  37 ++-
 helm/argo-stack/values.yaml                   |   7 +
 4 files changed, 284 insertions(+), 7 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 3c5ec2b0..9d0bfa39 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -17,13 +17,14 @@
 import re
 import sqlite3
 import json
+import subprocess
 from pathlib import Path
 from flask import Flask, request, render_template, jsonify, redirect, url_for
 import logging
 import jwt
 import time
 import requests
-from typing import List, Dict, Optional
+from typing import List, Dict, Optional, Tuple
 import hvac
 
 
@@ -40,6 +41,8 @@
 GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME")
 GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")
 GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH")
+GITHUB_PAT = os.environ.get("GITHUB_PAT")
+REPO_REGISTRATION = os.environ.get("REPO_REGISTRATION")
 VAULT_ADDR = os.environ.get("VAULT_ADDR")
 VAULT_TOKEN = os.environ.get("VAULT_TOKEN")
 
@@ -48,6 +51,203 @@
 # Default to /tmp in development/test, /var/registrations in production
 DEFAULT_DB_PATH = "/tmp/registrations.sqlite" if os.environ.get("FLASK_ENV") == "development" or os.environ.get("TESTING") else "/var/registrations/registrations.sqlite"
 DB_PATH = os.environ.get("DB_PATH", DEFAULT_DB_PATH)
+REPO_ROOT = Path(__file__).resolve().parents[1]
+REGISTRATIONS_PATH = REPO_ROOT / "registrations"
+
+
+def run_git_command(args: List[str], repo_dir: Path, use_auth: bool = False) -> str:
+    """
+    Run a git command and return stdout.
+
+    Args:
+        args: List of git arguments (without the leading 'git')
+        repo_dir: Working directory to run git in
+        use_auth: Whether to attach the PAT to git HTTP requests
+    """
+    cmd = ["git"]
+    if use_auth:
+        if not GITHUB_PAT:
+            raise ValueError("GITHUB_PAT environment variable not set")
+        cmd.extend(["-c", f"http.extraheader=Authorization: Bearer {GITHUB_PAT}"])
+    cmd.extend(args)
+    result = subprocess.run(
+        cmd,
+        cwd=repo_dir,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return result.stdout.strip()
+
+
+def parse_repo_owner_name(repo_url: str) -> Tuple[str, str]:
+    """
+    Parse a GitHub repository URL into owner and repo name.
+    """
+    if repo_url.startswith("git@"):
+        path = repo_url.split(":", 1)[1]
+    elif "github.com/" in repo_url:
+        path = repo_url.split("github.com/", 1)[1]
+    else:
+        path = repo_url
+    path = path.strip("/")
+    if path.endswith(".git"):
+        path = path[:-4]
+    owner, repo = path.split("/", 1)
+    return owner, repo
+
+
+def ensure_repo_registration_submodule() -> None:
+    """
+    Ensure the REPO_REGISTRATION repository is checked out as a submodule.
+    """
+    if not REPO_REGISTRATION:
+        logger.info("REPO_REGISTRATION not set; skipping submodule initialization.")
+        return
+    if not GITHUB_PAT:
+        raise ValueError("GITHUB_PAT environment variable not set")
+
+    gitmodules_path = REPO_ROOT / ".gitmodules"
+    submodule_declared = False
+    if gitmodules_path.exists():
+        submodule_declared = f"path = {REGISTRATIONS_PATH.name}" in gitmodules_path.read_text()
+
+    if not submodule_declared:
+        if REGISTRATIONS_PATH.exists() and any(REGISTRATIONS_PATH.iterdir()):
+            logger.warning(
+                "Registrations path exists and is not a submodule; skipping submodule add."
+            )
+            return
+        logger.info("Adding registrations repository as a git submodule.")
+        run_git_command(
+            ["submodule", "add", REPO_REGISTRATION, REGISTRATIONS_PATH.name],
+            REPO_ROOT,
+            use_auth=True,
+        )
+    else:
+        logger.info("Updating registrations git submodule.")
+        run_git_command(
+            ["submodule", "update", "--init", "--recursive", REGISTRATIONS_PATH.name],
+            REPO_ROOT,
+            use_auth=True,
+        )
+
+
+def get_default_branch(repo_dir: Path) -> str:
+    """
+    Determine the default branch for a repo, falling back to main.
+    """
+    try:
+        ref = run_git_command(
+            ["symbolic-ref", "refs/remotes/origin/HEAD"],
+            repo_dir,
+        )
+        return ref.split("/")[-1]
+    except subprocess.CalledProcessError:
+        return "main"
+
+
+def create_registration_pull_request(
+    installation_id: str, registration_config: Dict[str, any], repositories: List[Dict[str, any]]
+) -> None:
+    """
+    Create or update a RepoRegistration file and open a PR in the registrations repo.
+    """
+    if not REPO_REGISTRATION:
+        logger.info("REPO_REGISTRATION not set; skipping registration PR creation.")
+        return
+    if not GITHUB_PAT:
+        raise ValueError("GITHUB_PAT environment variable not set")
+    if not repositories:
+        raise ValueError("No repositories available to generate registration file.")
+
+    ensure_repo_registration_submodule()
+
+    if len(repositories) > 1:
+        logging.warning("Multiple repositories found for installation; using the first one.")
+
+    full_name = repositories[0]["full_name"]
+    owner, repo_name = full_name.split("/")
+
+    registration_repo_owner, registration_repo_name = parse_repo_owner_name(REPO_REGISTRATION)
+
+    registration_file = REGISTRATIONS_PATH / owner / f"{repo_name}.yaml"
+    branch_action = "update" if registration_file.exists() else "create"
+    branch_name = f"chore/{branch_action}-{owner}-{repo_name}"
+
+    run_git_command(["fetch", "origin", "--prune"], REGISTRATIONS_PATH, use_auth=True)
+    default_branch = get_default_branch(REGISTRATIONS_PATH)
+    run_git_command(
+        ["checkout", "-B", branch_name, f"origin/{default_branch}"],
+        REGISTRATIONS_PATH,
+    )
+
+    registration_file.parent.mkdir(parents=True, exist_ok=True)
+    registration_payload = {
+        "installation_id": installation_id,
+        "registration_config": registration_config,
+    }
+    registration_file.write_text(
+        json.dumps(registration_payload, indent=2, sort_keys=True) + "\n"
+    )
+
+    run_git_command(
+        ["add", str(registration_file.relative_to(REGISTRATIONS_PATH))],
+        REGISTRATIONS_PATH,
+    )
+    run_git_command(
+        ["commit", "--allow-empty", "-m", branch_name],
+        REGISTRATIONS_PATH,
+    )
+
+    run_git_command(["push", "-u", "origin", branch_name], REGISTRATIONS_PATH, use_auth=True)
+
+    pr_body = (
+        f"Automated repo registration for `{owner}/{repo_name}`.\n\n"
+        f"Installation ID: `{installation_id}`."
+    )
+    pr_url = f"https://api.github.com/repos/{registration_repo_owner}/{registration_repo_name}/pulls"
+    headers = {
+        "Authorization": f"token {GITHUB_PAT}",
+        "Accept": "application/vnd.github+json",
+    }
+    response = requests.post(
+        pr_url,
+        headers=headers,
+        json={
+            "title": branch_name,
+            "head": branch_name,
+            "base": default_branch,
+            "body": pr_body,
+        },
+    )
+
+    if response.status_code == 422:
+        existing_response = requests.get(
+            pr_url,
+            headers=headers,
+            params={"state": "open", "head": f"{registration_repo_owner}:{branch_name}"},
+        )
+        existing_response.raise_for_status()
+        pulls = existing_response.json()
+        if pulls:
+            pr_number = pulls[0]["number"]
+        else:
+            response.raise_for_status()
+    else:
+        response.raise_for_status()
+        pr_number = response.json()["number"]
+
+    reviewers_url = (
+        f"https://api.github.com/repos/{registration_repo_owner}/"
+        f"{registration_repo_name}/pulls/{pr_number}/requested_reviewers"
+    )
+    reviewers_response = requests.post(
+        reviewers_url,
+        headers=headers,
+        json={"reviewers": ["co-pilot"]},
+    )
+    reviewers_response.raise_for_status()
 
 
 def get_github_app_jwt() -> str:
@@ -325,7 +525,8 @@ def save_registration(installation_id, registration_data, repositories=None):
     logger.info(f"Registration saved for installation_id={installation_id}")
 
 
-# Initialize database on startup
+# Initialize submodule and database on startup
+ensure_repo_registration_submodule()
 init_db()
 
 
@@ -511,6 +712,18 @@ def registrations_submit():
     Returns:
         JSON response with success/error status or redirect to success page
     """
+    def registration_pr_error(message: str):
+        if request.headers.get("Accept") == "application/json":
+            return jsonify({"success": False, "error": message}), 500
+        return (
+            render_template(
+                "error.html",
+                error_message=message,
+                github_app_name=GITHUB_APP_NAME,
+            ),
+            500,
+        )
+
     try:
         # Extract form data
         installation_id = request.form.get("installation_id", "").strip()
@@ -653,6 +866,17 @@ def parse_bucket_config(prefix):
         # Save configuration to database
         save_registration(installation_id, registration_config, repositories)
 
+        try:
+            create_registration_pull_request(
+                installation_id, registration_config, repositories
+            )
+        except Exception:
+            logger.exception("Failed to create registration pull request")
+            return registration_pr_error(
+                "Registration saved, but failed to create a pull request in the "
+                "registrations repository."
+            )
+
         # Return success response
         if request.headers.get("Accept") == "application/json":
             return (
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 207d6f14..4efd9a50 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -50,16 +50,19 @@ spec:
         image: "{{ .Values.gitappCallback.image.repository }}:{{ .Values.gitappCallback.image.tag }}"
         imagePullPolicy: "{{ .Values.gitappCallback.image.pullPolicy }}"
         env:
+        # Environment variables for GitApp Callback
+        - name: GITHUB_APP_ID
+          value: {{ .Values.githubApp.appId | quote }}
+        - name: GITHUB_PRIVATE_KEY_PATH
+          value: /etc/github/private-key.pem
         - name: SECRET_KEY
           value: {{ .Values.gitappCallback.secretKey | quote }}
+        # for UI
         - name: GITHUB_APP_NAME
           value: {{ .Values.gitappCallback.githubAppName | quote }}
+        # for persistence
         - name: DB_PATH
           value: "/var/registrations/registrations.sqlite"
-        - name: GITHUB_APP_ID
-          value: {{ .Values.githubApp.appId | quote }}
-        - name: GITHUB_PRIVATE_KEY_PATH
-          value: /etc/github/private-key.pem
         - name: VAULT_ADDR
           value: {{ .Values.gitappCallback.vault.addr | quote }}
         - name: VAULT_TOKEN
@@ -67,6 +70,14 @@ spec:
             secretKeyRef:
               name: {{ .Values.gitappCallback.vault.tokenSecret.name }}
               key: {{ .Values.gitappCallback.vault.tokenSecret.key }}
+        - name: GITHUB_PAT
+        - valueFrom:
+          secretKeyRef:
+            name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+            key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+        - name: REPO_REGISTRATION
+          value: {{ .Values.gitappCallback.githubRepoUrl | quote }}
+
         ports:
         - containerPort: 8080
         volumeMounts:
diff --git a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
index 57c16aa8..4d41c231 100644
--- a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
+++ b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
@@ -1,7 +1,7 @@
 {{- if and (include "argo-stack.vault.enabled" .) .Values.githubApp.enabled .Values.githubApp.privateKeyVaultPath }}
 {{- if .Capabilities.APIVersions.Has "external-secrets.io/v1/ClusterSecretStore" }}
 ---
-# ExternalSecret for GitHub App private key
+# ExternalSecret for GitHub App private key, issued by GitHub, stored in Vault
 # This secret is used by Argo CD for repository authentication via GitHub App
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
@@ -35,6 +35,41 @@ spec:
       remoteRef:
         key: {{ include "argo-stack.vault.extractKey" .Values.githubApp.privateKeyVaultPath }}
         property: {{ include "argo-stack.vault.extractProperty" .Values.githubApp.privateKeyVaultPath }}
+---
+# ExternalSecret for GitHub token used by GitApp Callback, to post RepoRegistration PR
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ .Values.githubApp.githubTokenSecret.name }}
+  namespace: {{ .Values.namespaces.argocd }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-weight": "1"
+  labels:
+    app.kubernetes.io/name: {{ .Chart.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/component: argocd
+    app.kubernetes.io/part-of: github-app-auth
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: {{ include "argo-stack.secretStore.kind" . }}
+    name: {{ include "argo-stack.secretStore.name" . }}
+  target:
+    name: {{ .Values.githubApp.githubTokenSecret.name }}
+    creationPolicy: Owner
+    template:
+      type: Opaque
+      metadata:
+        labels:
+          app.kubernetes.io/part-of: argocd
+  data:
+    - secretKey: privateKey
+      remoteRef:
+        key: {{ include "argo-stack.vault.extractKey" .Values.githubApp.githubTokenSecret.vaultPath }}
+        property: {{ include "argo-stack.vault.extractProperty" .Values.githubApp.githubTokenSecret.vaultPath  }}
+
 {{- end }}
 {{- end }}
 
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index 74b4f791..a9cde98e 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -268,6 +268,13 @@ landingPage:
 gitappCallback:
   # Enable the GitHub App callback service deployment
   enabled: true
+  # Git repository URL for storing repo registration data
+  # This repository contains declarative YAML files for each RepoRegistration
+  githubRepoUrl: https://github.com/calypr/registrations-test
+  githubTokenSecret:
+    vaultPath: argo/events/github#token
+    name: github-reg-repo-token
+    key: token
   # Container image configuration
   image:
     repository: gitapp-callback

From 63dde7a946085ab1d3e714d828d9adf3337c9d0d Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 20:46:29 +0000
Subject: [PATCH 12/41] adds git

---
 gitapp-callback/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gitapp-callback/Dockerfile b/gitapp-callback/Dockerfile
index 5698b6a0..976b095b 100644
--- a/gitapp-callback/Dockerfile
+++ b/gitapp-callback/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.12-slim
 
 WORKDIR /app
 
@@ -10,7 +10,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 # Install curl for health checks
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends curl && \
+    apt-get install -y --no-install-recommends curl git && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

From 6b3cbfb28708e53f189d887f69a25799efb7540c Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 20:46:49 +0000
Subject: [PATCH 13/41] fix secret config

---
 helm/argo-stack/templates/32-gitapp-callback.yaml     |  8 ++++----
 .../templates/eso/externalsecret-github-app.yaml      | 11 ++++++-----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 4efd9a50..a92662cc 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -71,10 +71,10 @@ spec:
               name: {{ .Values.gitappCallback.vault.tokenSecret.name }}
               key: {{ .Values.gitappCallback.vault.tokenSecret.key }}
         - name: GITHUB_PAT
-        - valueFrom:
-          secretKeyRef:
-            name: {{ .Values.gitappCallback.githubTokenSecret.name }}
-            key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+              key: {{ .Values.gitappCallback.githubTokenSecret.key }}
         - name: REPO_REGISTRATION
           value: {{ .Values.gitappCallback.githubRepoUrl | quote }}
 
diff --git a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
index 4d41c231..f4740423 100644
--- a/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
+++ b/helm/argo-stack/templates/eso/externalsecret-github-app.yaml
@@ -40,7 +40,7 @@ spec:
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: {{ .Values.githubApp.githubTokenSecret.name }}
+  name: {{ .Values.gitappCallback.githubTokenSecret.name }}
   namespace: {{ .Values.namespaces.argocd }}
   annotations:
     "helm.sh/hook": post-install,post-upgrade
@@ -57,7 +57,7 @@ spec:
     kind: {{ include "argo-stack.secretStore.kind" . }}
     name: {{ include "argo-stack.secretStore.name" . }}
   target:
-    name: {{ .Values.githubApp.githubTokenSecret.name }}
+    name: {{ .Values.gitappCallback.githubTokenSecret.name }}
     creationPolicy: Owner
     template:
       type: Opaque
@@ -65,11 +65,12 @@ spec:
         labels:
           app.kubernetes.io/part-of: argocd
   data:
-    - secretKey: privateKey
+    - secretKey: token
       remoteRef:
-        key: {{ include "argo-stack.vault.extractKey" .Values.githubApp.githubTokenSecret.vaultPath }}
-        property: {{ include "argo-stack.vault.extractProperty" .Values.githubApp.githubTokenSecret.vaultPath  }}
+        key: {{ include "argo-stack.vault.extractKey" .Values.gitappCallback.githubTokenSecret.vaultPath }}
+        property: {{ include "argo-stack.vault.extractProperty" .Values.gitappCallback.githubTokenSecret.vaultPath  }}
 
 {{- end }}
 {{- end }}
 
+

From b4bb4167e0357a7f9e273ad0d8410e87281a5e8d Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 13:05:40 -0800
Subject: [PATCH 14/41] deprecate submodule

---
 gitapp-callback/app.py | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 9d0bfa39..22c36139 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -97,16 +97,45 @@ def parse_repo_owner_name(repo_url: str) -> Tuple[str, str]:
     return owner, repo
 
 
-def ensure_repo_registration_submodule() -> None:
+def ensure_repo_registration() -> None:
     """
-    Ensure the REPO_REGISTRATION repository is checked out as a submodule.
+    Ensure the REPO_REGISTRATION repository is checked out.
     """
     if not REPO_REGISTRATION:
-        logger.info("REPO_REGISTRATION not set; skipping submodule initialization.")
+        logger.info("REPO_REGISTRATION not set; skipping registrations checkout.")
         return
     if not GITHUB_PAT:
         raise ValueError("GITHUB_PAT environment variable not set")
 
+    if not (REPO_ROOT / ".git").exists():
+        if not REGISTRATIONS_PATH.exists():
+            logger.info("Cloning registrations repository without submodule.")
+            run_git_command(
+                ["clone", REPO_REGISTRATION, str(REGISTRATIONS_PATH)],
+                REPO_ROOT,
+                use_auth=True,
+            )
+            return
+        if (REGISTRATIONS_PATH / ".git").exists():
+            logger.info("Updating registrations repository checkout.")
+            run_git_command(
+                ["fetch", "origin", "--prune"],
+                REGISTRATIONS_PATH,
+                use_auth=True,
+            )
+            default_branch = get_default_branch(REGISTRATIONS_PATH)
+            run_git_command(["checkout", default_branch], REGISTRATIONS_PATH)
+            run_git_command(
+                ["reset", "--hard", f"origin/{default_branch}"],
+                REGISTRATIONS_PATH,
+            )
+            return
+        if any(REGISTRATIONS_PATH.iterdir()):
+            logger.warning(
+                "Registrations path exists and is not a git repo; skipping checkout."
+            )
+        return
+
     gitmodules_path = REPO_ROOT / ".gitmodules"
     submodule_declared = False
     if gitmodules_path.exists():
@@ -161,7 +190,7 @@ def create_registration_pull_request(
     if not repositories:
         raise ValueError("No repositories available to generate registration file.")
 
-    ensure_repo_registration_submodule()
+    ensure_repo_registration()
 
     if len(repositories) > 1:
         logging.warning("Multiple repositories found for installation; using the first one.")

From f3bd4daca31742083785d2cec5d26f5472d8c54e Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 21:35:21 +0000
Subject: [PATCH 15/41] improve git clone

---
 gitapp-callback/app.py                            | 4 ++--
 helm/argo-stack/templates/32-gitapp-callback.yaml | 2 ++
 helm/argo-stack/values.yaml                       | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 22c36139..56544694 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -554,8 +554,8 @@ def save_registration(installation_id, registration_data, repositories=None):
     logger.info(f"Registration saved for installation_id={installation_id}")
 
 
-# Initialize submodule and database on startup
-ensure_repo_registration_submodule()
+# Initialize module and database on startup
+ensure_repo_registration()
 init_db()
 
 
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index a92662cc..c1d22d74 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -75,6 +75,8 @@ spec:
             secretKeyRef:
               name: {{ .Values.gitappCallback.githubTokenSecret.name }}
               key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+        - name: GIT_USERNAME
+          value: {{ .Values.gitappCallback.githubUserName }}
         - name: REPO_REGISTRATION
           value: {{ .Values.gitappCallback.githubRepoUrl | quote }}
 
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index a9cde98e..f4601ed6 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -271,6 +271,7 @@ gitappCallback:
   # Git repository URL for storing repo registration data
   # This repository contains declarative YAML files for each RepoRegistration
   githubRepoUrl: https://github.com/calypr/registrations-test
+  githubUserName: brian@bwalsh.com
   githubTokenSecret:
     vaultPath: argo/events/github#token
     name: github-reg-repo-token

From b8bddfd3cedfa184a7d0a629202cd1f17a7cf6da Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 13:46:43 -0800
Subject: [PATCH 16/41] adds git cred init

---
 .../templates/32-gitapp-callback.yaml         | 37 ++++++++++++++++++-
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index c1d22d74..18299dc5 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -44,7 +44,35 @@ spec:
         - name: github-app-key
           mountPath: /etc/github
           readOnly: true
-      
+      # Init container to configure git credentials securely
+      - name: gitapp-callback-git-credentials
+        image: alpine/git:2.44.0
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          if [ -z "$GIT_USERNAME" ] || [ -z "$GIT_PAT" ]; then
+            echo "GIT_USERNAME or GIT_PAT not set"
+            exit 1
+          fi
+          mkdir -p /gitcreds
+          cat <<EOF > /gitcreds/.git-credentials
+https://$GIT_USERNAME:$GIT_PAT@github.com
+EOF
+        env:
+        - name: GIT_USERNAME
+          value: {{ .Values.gitappCallback.githubUserName }}
+        - name: GIT_PAT
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Values.gitappCallback.githubTokenSecret.name }}
+              key: {{ .Values.gitappCallback.githubTokenSecret.key }}
+        volumeMounts:
+        - name: git-credentials
+          mountPath: /gitcreds
+
+
       containers:
       - name: gitapp-callback
         image: "{{ .Values.gitappCallback.image.repository }}:{{ .Values.gitappCallback.image.tag }}"
@@ -79,6 +107,8 @@ spec:
           value: {{ .Values.gitappCallback.githubUserName }}
         - name: REPO_REGISTRATION
           value: {{ .Values.gitappCallback.githubRepoUrl | quote }}
+        - name: GIT_CREDENTIALS_FILE
+          value: /root/.git-credentials
 
         ports:
         - containerPort: 8080
@@ -87,7 +117,10 @@ spec:
           mountPath: /var/registrations
         - name: github-app-key
           mountPath: /etc/github
-          readOnly: true          
+          readOnly: true
+        - name: git-credentials
+          mountPath: /root
+
         livenessProbe:
           httpGet:
             path: /healthz

From 482a860e75096d0151d8bd784d972da4d1e3a629 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Tue, 30 Dec 2025 13:49:12 -0800
Subject: [PATCH 17/41] adds git cred init

---
 helm/argo-stack/templates/32-gitapp-callback.yaml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 18299dc5..3cf7b9f9 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -57,9 +57,8 @@ spec:
             exit 1
           fi
           mkdir -p /gitcreds
-          cat <<EOF > /gitcreds/.git-credentials
-https://$GIT_USERNAME:$GIT_PAT@github.com
-EOF
+          CRED_STRING="https://${GIT_USERNAME}:${GIT_PAT}@github.com"
+          printf "%s\n" "${CRED_STRING}" | git credential-store store
         env:
         - name: GIT_USERNAME
           value: {{ .Values.gitappCallback.githubUserName }}

From 0235a2549fa7a4a727f85844498f5d8b2a7d60d2 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Wed, 31 Dec 2025 00:48:37 +0000
Subject: [PATCH 18/41] adds to deploy volume

---
 helm/argo-stack/templates/32-gitapp-callback.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 3cf7b9f9..5d88084b 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -152,7 +152,10 @@ spec:
           items:
           - key: {{ .Values.githubStatusProxy.privateKeySecret.key }}
             path: private-key.pem
-          optional: false        
+          optional: false
+      - name: git-credentials
+        emptyDir: {}
+          
 ---
 apiVersion: v1
 kind: Service

From 5c63be35eaed707b2cb5939bfd0efe3727a56a56 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Wed, 31 Dec 2025 01:27:01 +0000
Subject: [PATCH 19/41] init git credentials

---
 Makefile                                       |  4 ++++
 gitapp-callback/app.py                         | 18 +++++-------------
 .../templates/32-gitapp-callback.yaml          |  4 ++--
 helm/argo-stack/values.yaml                    |  6 +++---
 4 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/Makefile b/Makefile
index c1e8ddaf..9f4965d7 100644
--- a/Makefile
+++ b/Makefile
@@ -49,6 +49,7 @@ check-vars:
 	@test -f "$(GITHUBHAPP_PRIVATE_KEY_FILE_PATH)" || (echo "Error: GITHUBHAPP_PRIVATE_KEY_FILE_PATH file '$(GITHUBHAPP_PRIVATE_KEY_FILE_PATH)' not found. Create the file before installing" && exit 1)
 	@test -n "$(GITHUBHAPP_PRIVATE_KEY_VAULT_PATH)" || (echo "Error: GITHUBHAPP_PRIVATE_KEY_VAULT_PATH is undefined. Run 'export GITHUBHAPP_PRIVATE_KEY_VAULT_PATH=...' before installing" && exit 1)
 	@test -n "$(GITHUBHAPP_INSTALLATION_ID)" || (echo "Error: GITHUBHAPP_INSTALLATION_ID is undefined. Run 'export GITHUBHAPP_INSTALLATION_ID=...' before installing" && exit 1)
+	@test -n "$(GITHUBHAPP_CALLBACK_FLASK_KEY)" || (echo "Error: GITHUBHAPP_CALLBACK_FLASK_KEY is undefined. Run 'export GITHUBHAPP_CALLBACK_FLASK_KEY=...' before installing" && exit 1)
 	@echo "✅ All GITHUBHAPP environment variables are set."
 
 
@@ -205,6 +206,9 @@ argo-stack:
 		--set githubStatusProxy.privateKeySecret.name="${GITHUBHAPP_PRIVATE_KEY_SECRET_NAME}" \
 		--set githubStatusProxy.privateKeySecret.key=privateKey \
 		--set githubStatusProxy.logLevel="DEBUG" \
+		--set-string gitappCallback.githubRepoUrl=https://github.com/calypr/registrations-test \
+		--set-string gitappCallback.githubUserName=bwalsh \
+		--set-string gitappCallback.secretKey="${GITHUBHAPP_CALLBACK_FLASK_KEY}"\
 		-f helm/argo-stack/admin-values.yaml \
 		-f -
 
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 56544694..c0f7bcd8 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -51,11 +51,11 @@
 # Default to /tmp in development/test, /var/registrations in production
 DEFAULT_DB_PATH = "/tmp/registrations.sqlite" if os.environ.get("FLASK_ENV") == "development" or os.environ.get("TESTING") else "/var/registrations/registrations.sqlite"
 DB_PATH = os.environ.get("DB_PATH", DEFAULT_DB_PATH)
-REPO_ROOT = Path(__file__).resolve().parents[1]
-REGISTRATIONS_PATH = REPO_ROOT / "registrations"
+# ??? REPO_ROOT = Path(__file__).resolve().parents[1]
+REGISTRATIONS_PATH = Path("/tmp") / "registrations"
 
 
-def run_git_command(args: List[str], repo_dir: Path, use_auth: bool = False) -> str:
+def run_git_command(args: List[str], repo_dir: Path) -> str:
     """
     Run a git command and return stdout.
 
@@ -65,10 +65,6 @@ def run_git_command(args: List[str], repo_dir: Path, use_auth: bool = False) ->
         use_auth: Whether to attach the PAT to git HTTP requests
     """
     cmd = ["git"]
-    if use_auth:
-        if not GITHUB_PAT:
-            raise ValueError("GITHUB_PAT environment variable not set")
-        cmd.extend(["-c", f"http.extraheader=Authorization: Bearer {GITHUB_PAT}"])
     cmd.extend(args)
     result = subprocess.run(
         cmd,
@@ -113,7 +109,6 @@ def ensure_repo_registration() -> None:
             run_git_command(
                 ["clone", REPO_REGISTRATION, str(REGISTRATIONS_PATH)],
                 REPO_ROOT,
-                use_auth=True,
             )
             return
         if (REGISTRATIONS_PATH / ".git").exists():
@@ -121,7 +116,6 @@ def ensure_repo_registration() -> None:
             run_git_command(
                 ["fetch", "origin", "--prune"],
                 REGISTRATIONS_PATH,
-                use_auth=True,
             )
             default_branch = get_default_branch(REGISTRATIONS_PATH)
             run_git_command(["checkout", default_branch], REGISTRATIONS_PATH)
@@ -151,14 +145,12 @@ def ensure_repo_registration() -> None:
         run_git_command(
             ["submodule", "add", REPO_REGISTRATION, REGISTRATIONS_PATH.name],
             REPO_ROOT,
-            use_auth=True,
         )
     else:
         logger.info("Updating registrations git submodule.")
         run_git_command(
             ["submodule", "update", "--init", "--recursive", REGISTRATIONS_PATH.name],
             REPO_ROOT,
-            use_auth=True,
         )
 
 
@@ -204,7 +196,7 @@ def create_registration_pull_request(
     branch_action = "update" if registration_file.exists() else "create"
     branch_name = f"chore/{branch_action}-{owner}-{repo_name}"
 
-    run_git_command(["fetch", "origin", "--prune"], REGISTRATIONS_PATH, use_auth=True)
+    run_git_command(["fetch", "origin", "--prune"], REGISTRATIONS_PATH)
     default_branch = get_default_branch(REGISTRATIONS_PATH)
     run_git_command(
         ["checkout", "-B", branch_name, f"origin/{default_branch}"],
@@ -229,7 +221,7 @@ def create_registration_pull_request(
         REGISTRATIONS_PATH,
     )
 
-    run_git_command(["push", "-u", "origin", branch_name], REGISTRATIONS_PATH, use_auth=True)
+    run_git_command(["push", "-u", "origin", branch_name], REGISTRATIONS_PATH)
 
     pr_body = (
         f"Automated repo registration for `{owner}/{repo_name}`.\n\n"
diff --git a/helm/argo-stack/templates/32-gitapp-callback.yaml b/helm/argo-stack/templates/32-gitapp-callback.yaml
index 5d88084b..e1bccc16 100644
--- a/helm/argo-stack/templates/32-gitapp-callback.yaml
+++ b/helm/argo-stack/templates/32-gitapp-callback.yaml
@@ -46,7 +46,7 @@ spec:
           readOnly: true
       # Init container to configure git credentials securely
       - name: gitapp-callback-git-credentials
-        image: alpine/git:2.44.0
+        image: alpine/git:2.43.0
         command:
         - sh
         - -c
@@ -58,7 +58,7 @@ spec:
           fi
           mkdir -p /gitcreds
           CRED_STRING="https://${GIT_USERNAME}:${GIT_PAT}@github.com"
-          printf "%s\n" "${CRED_STRING}" | git credential-store store
+          echo "${CRED_STRING}" > /gitcreds/.git-credentials
         env:
         - name: GIT_USERNAME
           value: {{ .Values.gitappCallback.githubUserName }}
diff --git a/helm/argo-stack/values.yaml b/helm/argo-stack/values.yaml
index f4601ed6..ea61b852 100644
--- a/helm/argo-stack/values.yaml
+++ b/helm/argo-stack/values.yaml
@@ -270,8 +270,8 @@ gitappCallback:
   enabled: true
   # Git repository URL for storing repo registration data
   # This repository contains declarative YAML files for each RepoRegistration
-  githubRepoUrl: https://github.com/calypr/registrations-test
-  githubUserName: brian@bwalsh.com
+  githubRepoUrl: "" 
+  githubUserName: ""
   githubTokenSecret:
     vaultPath: argo/events/github#token
     name: github-reg-repo-token
@@ -287,7 +287,7 @@ gitappCallback:
   # IMPORTANT: Override this in production with a secure random value
   # Recommended: Use Vault with External Secrets Operator
   # Generate with: python3 -c 'import secrets; print(secrets.token_hex(32))'
-  secretKey: "REPLACE_ME_WITH_SECURE_RANDOM_VALUE"
+  secretKey: ""
   # GitHub App name (displayed in the UI)
   githubAppName: "calypr"
   # Persistence configuration for registration database

From 350d0334c910ab8092395bcb9255d9cd38619a58 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 17:50:02 +0000
Subject: [PATCH 20/41] fix git config

---
 gitapp-callback/app.py | 38 +++++++++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index c0f7bcd8..0d625728 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -45,14 +45,16 @@
 REPO_REGISTRATION = os.environ.get("REPO_REGISTRATION")
 VAULT_ADDR = os.environ.get("VAULT_ADDR")
 VAULT_TOKEN = os.environ.get("VAULT_TOKEN")
+GIT_CREDENTIALS_FILE = os.environ.get("GIT_CREDENTIALS_FILE")
 
 
 
 # Default to /tmp in development/test, /var/registrations in production
 DEFAULT_DB_PATH = "/tmp/registrations.sqlite" if os.environ.get("FLASK_ENV") == "development" or os.environ.get("TESTING") else "/var/registrations/registrations.sqlite"
 DB_PATH = os.environ.get("DB_PATH", DEFAULT_DB_PATH)
-# ??? REPO_ROOT = Path(__file__).resolve().parents[1]
-REGISTRATIONS_PATH = Path("/tmp") / "registrations"
+# get current directory
+REPO_ROOT = Path(__file__).resolve().parents[0]
+REGISTRATIONS_PATH = Path("registrations")
 
 
 def run_git_command(args: List[str], repo_dir: Path) -> str:
@@ -66,13 +68,27 @@ def run_git_command(args: List[str], repo_dir: Path) -> str:
     """
     cmd = ["git"]
     cmd.extend(args)
-    result = subprocess.run(
-        cmd,
-        cwd=repo_dir,
-        check=True,
-        capture_output=True,
-        text=True,
-    )
+    try:
+        logging.info(" ".join(cmd))
+        result = subprocess.run(
+            cmd,
+            cwd=repo_dir,
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+        return result.stdout.strip()
+    except subprocess.CalledProcessError as e:
+        logging.error(
+                "Git command failed: %s\nReturn code: %s\nStdout: %s\nStderr: %s\ncwd: %s",
+            " ".join(cmd),
+            e.returncode,
+            e.stdout,
+            e.stderr,
+            repo_dir,
+        )
+        return "FAILED"    
+    
     return result.stdout.strip()
 
 
@@ -103,6 +119,10 @@ def ensure_repo_registration() -> None:
     if not GITHUB_PAT:
         raise ValueError("GITHUB_PAT environment variable not set")
 
+    logger.info(f"Setting git credential.helper to {GIT_CREDENTIALS_FILE}")
+    result = run_git_command(["config", "--global", "credential.helper", f'store --file={GIT_CREDENTIALS_FILE}'], REPO_ROOT) 
+    logger.info(f"result from setting git credential.helper {result}")
+
     if not (REPO_ROOT / ".git").exists():
         if not REGISTRATIONS_PATH.exists():
             logger.info("Cloning registrations repository without submodule.")

From 4ab967e8164eed6a7c25129a4ae01524c1b277e1 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 10:31:11 -0800
Subject: [PATCH 21/41] adds diagrams

---
 gitapp-callback/README.md | 192 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 192 insertions(+)

diff --git a/gitapp-callback/README.md b/gitapp-callback/README.md
index 3ad30bea..d761bb56 100644
--- a/gitapp-callback/README.md
+++ b/gitapp-callback/README.md
@@ -220,8 +220,200 @@ https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/ab
 2. Set "Post-installation redirect URL" to: `https://your-domain.com/registrations`
 3. GitHub will append `?installation_id=XXX&setup_action=install` automatically
 
+## Overview
+### initialize app
+```mermaid
+graph TD
+    Start["🚀 App Startup"] --> InitDB["Initialize SQLite Database"]
+    InitDB --> CreateTable["Create registrations table<br/>installation_id, data, timestamps"]
+    CreateTable --> EnsureRepo["ensure_repo_registration"]
+
+    EnsureRepo --> CheckRepo{REPO_REGISTRATION<br/>configured?}
+    CheckRepo -->|No| SkipRepo["⊘ Skip registrations checkout"]
+    CheckRepo -->|Yes| SetupGit["Configure git credentials<br/>GIT_CREDENTIALS_FILE"]
+    SetupGit --> ConfigHelper["git config --global<br/>credential.helper store"]
+    ConfigHelper --> CheckPath{REGISTRATIONS_PATH<br/>exists?}
+
+    CheckPath -->|No| CloneRepo["Clone registrations repo<br/>git clone REPO_REGISTRATION"]
+    CloneRepo --> ReadyApp["✓ App Ready"]
+
+    CheckPath -->|Yes| CheckGit{.git directory<br/>exists?}
+    CheckGit -->|Yes| FetchOrigin["Fetch and update repo<br/>git fetch origin --prune"]
+    FetchOrigin --> GetBranch["Get default branch<br/>git symbolic-ref refs/remotes/origin/HEAD"]
+    GetBranch --> Checkout["git checkout default_branch"]
+    Checkout --> Reset["git reset --hard<br/>origin/default_branch"]
+    Reset --> ReadyApp
+
+    CheckGit -->|No| CheckEmpty{Directory<br/>not empty?}
+    CheckEmpty -->|Yes| WarnEmpty["⚠️ Warn: skip if dir not empty"]
+    CheckEmpty -->|No| ReadyApp
+
+    SkipRepo --> ReadyApp
+    WarnEmpty --> ReadyApp
+
+    ReadyApp --> InitComplete["✓ Initialization Complete<br/>Ready for HTTP requests"]
+
+    style Start fill:#e1f5ff
+    style ReadyApp fill:#c8e6c9
+    style InitComplete fill:#c8e6c9,stroke:#4caf50,stroke-width:2px
+
+```
+
+### Get registration flow
+```mermaid
+graph TD
+    GetReq["GET /registrations"] --> ExtractParams["Extract installation_id<br/>and setup_action params"]
+    ExtractParams --> ValInstallID{installation_id<br/>present?}
+
+    ValInstallID -->|No| Err400A["❌ Return 400<br/>Missing installation_id"]
+    ValInstallID -->|Yes| ValInteger{installation_id<br/>is integer?}
+
+    ValInteger -->|No| Err400B["❌ Return 400<br/>Invalid format"]
+    ValInteger -->|Yes| FetchRepos["Fetch repositories from<br/>GitHub API<br/>get_installation_repositories"]
+    FetchRepos --> ValFetch{Fetch<br/>success?}
+
+    ValFetch -->|No| Err500A["❌ Return 500<br/>GitHub API error"]
+    ValFetch -->|Yes| ValAction{setup_action<br/>valid?}
+
+    ValAction -->|No| Err400C["❌ Return 400<br/>Invalid setup_action"]
+    ValAction -->|Yes| CheckAction{setup_action<br/>== install?}
+
+    CheckAction -->|Yes| CheckExists{Registration<br/>exists?}
+    CheckExists -->|Yes| Redirect["⤴️ Redirect to update<br/>with setup_action=update"]
+    CheckExists -->|No| DisplayForm["✓ Display registration form<br/>initial_data = null"]
+
+    CheckAction -->|No| CheckExistsUpdate{Registration<br/>exists?}
+    CheckExistsUpdate -->|No| Err404["❌ Return 404<br/>Not found for update"]
+    CheckExistsUpdate -->|Yes| LoadForm["✓ Load existing data<br/>from database<br/>and display form"]
+
+    Redirect --> Done["Return HTML response"]
+    DisplayForm --> Done
+    LoadForm --> Done
+    Err400A --> Done
+    Err400B --> Done
+    Err400C --> Done
+    Err500A --> Done
+    Err404 --> Done
+
+    style GetReq fill:#e1f5ff
+    style DisplayForm fill:#fff9c4
+    style LoadForm fill:#fff9c4
+    style Done fill:#c8e6c9
+    style Err400A fill:#ffccbc
+    style Err400B fill:#ffccbc
+    style Err400C fill:#ffccbc
+    style Err500A fill:#ffccbc
+    style Err404 fill:#ffccbc
+
+```
+
+### Validate registration
+```mermaid
+graph TD
+    PostReq["POST /registrations"] --> ExtractForm["Extract form data<br/>installation_id, defaultBranch,<br/>admin/readUsers, buckets"]
+    ExtractForm --> ValInstall{installation_id<br/>present?}
+
+    ValInstall -->|No| FormErr400A["❌ Return 400"]
+    ValInstall -->|Yes| ValAdmin{Admin users<br/>present?}
+
+    ValAdmin -->|No| FormErr400B["❌ Return 400"]
+    ValAdmin -->|Yes| ParseEmails["Parse email lists<br/>admin_users, read_users"]
+    ParseEmails --> ValEmails{All emails<br/>valid format?}
+
+    ValEmails -->|No| FormErr400C["❌ Return 400<br/>Invalid email"]
+    ValEmails -->|Yes| ParseBuckets["Parse S3 bucket configs<br/>dataBucket & artifactBucket"]
+    ParseBuckets --> ValBuckets{Bucket config<br/>valid?}
+
+    ValBuckets -->|No| FormErr400D["❌ Return 400<br/>Invalid bucket config"]
+    ValBuckets -->|Yes| CreateConfig["Create registration_config dict"]
+    CreateConfig --> FetchReposForm["Fetch repositories<br/>from GitHub API"]
+    FetchReposForm --> ValFetchForm{Fetch<br/>success?}
+
+    ValFetchForm -->|No| FormErr500A["❌ Return 500"]
+    ValFetchForm -->|Yes| CheckReposExist{Repositories<br/>found?}
+
+    CheckReposExist -->|No| FormErr500B["❌ Return 500<br/>No repos found"]
+    CheckReposExist -->|Yes| SaveDB["save_registration"]
+    
+```
+
+
+### Upsert registration flow
+```mermaid
+graph TD
+    PostReq["POST /registrations"] --> ExtractForm["Extract form data<br/>installation_id, defaultBranch,<br/>admin/readUsers, buckets"]
+    ExtractForm --> ValAll{validate all form fields}
+
+    ValAll -->|No| FormErr400A["❌ Return 400"]
+    ValAll -->|Yes| SaveDB
+
+    SaveDB --> RemoveBuckets["Remove buckets from config<br/>del dataBucket, artifactBucket"]
+    RemoveBuckets --> CheckVault{VAULT_ADDR &<br/>VAULT_TOKEN set?}
+
+    CheckVault -->|Yes| SaveDataVault["Save dataBucket to Vault<br/>argo/apps/owner/repo/dataBucket"]
+    SaveDataVault --> SaveArtifactVault["Save artifactBucket to Vault<br/>argo/apps/owner/repo/artifactBucket"]
+    SaveArtifactVault --> ValVaultSave{Save<br/>success?}
+
+    CheckVault -->|No| SkipVault["⊘ Skip Vault save"]
+    ValVaultSave -->|No| FormErr500C["❌ Return 500<br/>Vault save failed"]
+    ValVaultSave -->|Yes| InsertDB
+    SkipVault --> InsertDB["INSERT/UPDATE registrations<br/>table in SQLite<br/>ON CONFLICT DO UPDATE"]
+
+    InsertDB --> CreatePR["create_registration_pull_request"]
+    CreatePR --> EnsureRepoPR["ensure_repo_registration"]
+    EnsureRepoPR --> FetchOriginPR["git fetch origin --prune"]
+    FetchOriginPR --> GetDefaultBranch["Get default branch<br/>from origin/HEAD"]
+    GetDefaultBranch --> CreateBranch["Create feature branch<br/>chore/create-owner-repo<br/>or chore/update-owner-repo"]
+    CreateBranch --> CreateFile["Create registration file<br/>registrations/owner/repo_name.yaml"]
+    CreateFile --> WritePayload["Write JSON payload<br/>{installation_id, registration_config}"]
+    WritePayload --> GitAdd["git add file"]
+    GitAdd --> GitCommit["git commit --allow-empty<br/>-m branch_name"]
+    GitCommit --> GitPush["git push -u origin branch"]
+    GitPush --> ValPush{Push<br/>success?}
+
+    ValPush -->|No| PRErr["❌ Git command returned FAILED"]
+    ValPush -->|Yes| CreateGHPR["Create GitHub PR via API<br/>POST /repos/owner/repo/pulls"]
+    CreateGHPR --> ValPRCreate{PR created<br/>success?}
+
+    ValPRCreate -->|No| CheckExistingPR{PR already<br/>exists?}
+    CheckExistingPR -->|Yes| GetExistingPR["Get existing PR"]
+    CheckExistingPR -->|No| PRErr500["❌ Return 500<br/>PR creation failed"]
+
+    ValPRCreate -->|Yes| AddReviewer["Add co-pilot<br/>as PR reviewer"]
+    GetExistingPR --> AddReviewer
+    AddReviewer --> ValReviewer{Reviewer<br/>added?}
+
+    ValReviewer -->|Yes| SuccessResp["✓ Return success<br/>JSON or HTML page<br/>with registration_config"]
+    ValReviewer -->|No| PRErr500
+
+    PRErr --> PRErrorResp["⚠️ Return 500<br/>Registration saved but<br/>git/PR creation failed"]
+    PRErr500 --> PRErrorResp
+
+    FormErr400A --> FormErrResp["❌ Return 400"]
+    FormErr400B --> FormErrResp
+    FormErr400C --> FormErrResp
+    FormErr400D --> FormErrResp
+    FormErr500A --> FormErrResp
+    FormErr500B --> FormErrResp
+    FormErr500C --> FormErrResp
+
+    PRErrorResp --> Done["Return response"]
+    FormErrResp --> Done
+    SuccessResp --> Done
+
+    style PostReq fill:#e1f5ff
+    style SaveDB fill:#e1f5ff,stroke:#f57c00,stroke-width:2px
+    style CreatePR fill:#e1f5ff,stroke:#f57c00,stroke-width:2px
+    style SuccessResp fill:#c8e6c9
+    style PRErrorResp fill:#fff9c4
+    style FormErrResp fill:#ffccbc
+
+```
+
+
 ## Future Enhancements
 
+- [ ] refactor tests to use pytest fixtures/mocks
 - [ ] Persist configuration to Kubernetes CRD (RepoRegistration)
 - [ ] Integrate with GitHub API to fetch repository details
 - [ ] Validate installation_id with GitHub API

From 12e7de45ccb8b76d2c1cc80410aaeb757c3716da Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 10:32:40 -0800
Subject: [PATCH 22/41] remove unnecessary check for current git dir

---
 gitapp-callback/app.py | 67 ++++++++++++++----------------------------
 1 file changed, 22 insertions(+), 45 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 0d625728..bb5c2ed6 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -26,6 +26,7 @@
 import requests
 from typing import List, Dict, Optional, Tuple
 import hvac
+import yaml
 
 
 # Configure logging
@@ -123,55 +124,31 @@ def ensure_repo_registration() -> None:
     result = run_git_command(["config", "--global", "credential.helper", f'store --file={GIT_CREDENTIALS_FILE}'], REPO_ROOT) 
     logger.info(f"result from setting git credential.helper {result}")
 
-    if not (REPO_ROOT / ".git").exists():
-        if not REGISTRATIONS_PATH.exists():
-            logger.info("Cloning registrations repository without submodule.")
-            run_git_command(
-                ["clone", REPO_REGISTRATION, str(REGISTRATIONS_PATH)],
-                REPO_ROOT,
-            )
-            return
-        if (REGISTRATIONS_PATH / ".git").exists():
-            logger.info("Updating registrations repository checkout.")
-            run_git_command(
-                ["fetch", "origin", "--prune"],
-                REGISTRATIONS_PATH,
-            )
-            default_branch = get_default_branch(REGISTRATIONS_PATH)
-            run_git_command(["checkout", default_branch], REGISTRATIONS_PATH)
-            run_git_command(
-                ["reset", "--hard", f"origin/{default_branch}"],
-                REGISTRATIONS_PATH,
-            )
-            return
-        if any(REGISTRATIONS_PATH.iterdir()):
-            logger.warning(
-                "Registrations path exists and is not a git repo; skipping checkout."
-            )
-        return
-
-    gitmodules_path = REPO_ROOT / ".gitmodules"
-    submodule_declared = False
-    if gitmodules_path.exists():
-        submodule_declared = f"path = {REGISTRATIONS_PATH.name}" in gitmodules_path.read_text()
-
-    if not submodule_declared:
-        if REGISTRATIONS_PATH.exists() and any(REGISTRATIONS_PATH.iterdir()):
-            logger.warning(
-                "Registrations path exists and is not a submodule; skipping submodule add."
-            )
-            return
-        logger.info("Adding registrations repository as a git submodule.")
+    if not REGISTRATIONS_PATH.exists():
+        logger.info("Cloning registrations repository.")
         run_git_command(
-            ["submodule", "add", REPO_REGISTRATION, REGISTRATIONS_PATH.name],
+            ["clone", REPO_REGISTRATION, str(REGISTRATIONS_PATH)],
             REPO_ROOT,
         )
-    else:
-        logger.info("Updating registrations git submodule.")
+        return
+    if (REGISTRATIONS_PATH / ".git").exists():
+        logger.info("Updating registrations repository checkout.")
         run_git_command(
-            ["submodule", "update", "--init", "--recursive", REGISTRATIONS_PATH.name],
-            REPO_ROOT,
+            ["fetch", "origin", "--prune"],
+            REGISTRATIONS_PATH,
+        )
+        default_branch = get_default_branch(REGISTRATIONS_PATH)
+        run_git_command(["checkout", default_branch], REGISTRATIONS_PATH)
+        run_git_command(
+            ["reset", "--hard", f"origin/{default_branch}"],
+            REGISTRATIONS_PATH,
+        )
+        return
+    if any(REGISTRATIONS_PATH.iterdir()):
+        logger.warning(
+            "Registrations path exists and is not a git repo; skipping checkout."
         )
+    return
 
 
 def get_default_branch(repo_dir: Path) -> str:
@@ -229,7 +206,7 @@ def create_registration_pull_request(
         "registration_config": registration_config,
     }
     registration_file.write_text(
-        json.dumps(registration_payload, indent=2, sort_keys=True) + "\n"
+        yaml.dump(registration_payload, sort_keys=True, default_flow_style=False)
     )
 
     run_git_command(

From 61fa5ea1556ff540495407954b5a6ba8d20ecf27 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 18:41:03 +0000
Subject: [PATCH 23/41] adds yaml

---
 gitapp-callback/requirements.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/gitapp-callback/requirements.txt b/gitapp-callback/requirements.txt
index 63c3a2a0..24ca734a 100644
--- a/gitapp-callback/requirements.txt
+++ b/gitapp-callback/requirements.txt
@@ -3,4 +3,6 @@ Werkzeug==3.0.1
 PyJWT==2.8.0
 cryptography==41.0.7
 requests==2.31.0
-hvac==1.2.1
\ No newline at end of file
+hvac==1.2.1
+PyYAML==6.0.3
+

From 40b101879d402837c60249b37204f47eb249422f Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 10:48:45 -0800
Subject: [PATCH 24/41] adds author name and email

---
 gitapp-callback/app.py | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index bb5c2ed6..0c32854f 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -39,15 +39,21 @@
 app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-key-change-in-production")
 
 # Configuration
-GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME")
-GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")
-GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH")
-GITHUB_PAT = os.environ.get("GITHUB_PAT")
-REPO_REGISTRATION = os.environ.get("REPO_REGISTRATION")
-VAULT_ADDR = os.environ.get("VAULT_ADDR")
-VAULT_TOKEN = os.environ.get("VAULT_TOKEN")
-GIT_CREDENTIALS_FILE = os.environ.get("GIT_CREDENTIALS_FILE")
+# GitHub App Configuration
+GITHUB_APP_NAME = os.environ.get("GITHUB_APP_NAME")  # Display name of the GitHub App (e.g., "calypr-workflows")
+GITHUB_APP_ID = os.environ.get("GITHUB_APP_ID")  # GitHub App ID for JWT authentication
+GITHUB_PRIVATE_KEY_PATH = os.environ.get("GITHUB_PRIVATE_KEY_PATH")  # Path to GitHub App private key file for signing JWTs
+GITHUB_PAT = os.environ.get("GITHUB_PAT")  # Personal Access Token for git operations (clone, push) in registrations repo
 
+# Repository Configuration
+REPO_REGISTRATION = os.environ.get("REPO_REGISTRATION")  # Git URL of the registrations repository where registration files are stored
+
+# Vault Configuration
+VAULT_ADDR = os.environ.get("VAULT_ADDR")  # HashiCorp Vault address (e.g., "https://vault.example.com")
+VAULT_TOKEN = os.environ.get("VAULT_TOKEN")  # Vault authentication token for storing S3 bucket credentials
+
+# Git Authentication
+GIT_CREDENTIALS_FILE = os.environ.get("GIT_CREDENTIALS_FILE")  # Path to git credentials file (e.g., /root/.git-credentials) for git credential.helper
 
 
 # Default to /tmp in development/test, /var/registrations in production
@@ -120,9 +126,14 @@ def ensure_repo_registration() -> None:
     if not GITHUB_PAT:
         raise ValueError("GITHUB_PAT environment variable not set")
 
+    # Configure git to use the credentials file
     logger.info(f"Setting git credential.helper to {GIT_CREDENTIALS_FILE}")
     result = run_git_command(["config", "--global", "credential.helper", f'store --file={GIT_CREDENTIALS_FILE}'], REPO_ROOT) 
     logger.info(f"result from setting git credential.helper {result}")
+    # Configure author name and email
+    # TODO make name and email configurable
+    run_git_command(["config", "--global", "user.name", GITHUB_APP_NAME or "GitHub App"], REPO_ROOT)
+    run_git_command(["config", "--global", "user.email", f"calyr@example.com"], REPO_ROOT)
 
     if not REGISTRATIONS_PATH.exists():
         logger.info("Cloning registrations repository.")

From be62a63447b5370ca3ead23c13d1333d1b60c85e Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 10:56:06 -0800
Subject: [PATCH 25/41] improve reviewers

---
 gitapp-callback/app.py | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 0c32854f..3f9cb5ff 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -271,12 +271,21 @@ def create_registration_pull_request(
         f"https://api.github.com/repos/{registration_repo_owner}/"
         f"{registration_repo_name}/pulls/{pr_number}/requested_reviewers"
     )
-    reviewers_response = requests.post(
-        reviewers_url,
-        headers=headers,
-        json={"reviewers": ["co-pilot"]},
-    )
-    reviewers_response.raise_for_status()
+    try:
+        reviewers_response = requests.post(
+            reviewers_url,
+            headers=headers,
+            json={"reviewers": ["Copilot"]},
+        )
+        reviewers_response.raise_for_status()
+        logger.info(f"Successfully added co-pilot as reviewer to PR #{pr_number}")
+    except requests.HTTPError as e:
+        # Log warning but don't fail the entire operation
+        logger.warning(reviewers_url)
+        logger.warning(
+            f"Failed to add reviewer to PR #{pr_number}: {e.response.status_code} - {e.response.text}"
+        )
+        raise
 
 
 def get_github_app_jwt() -> str:

From cf26555e3579f023d5bf7b56af4003859dbbf23b Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 11:11:34 -0800
Subject: [PATCH 26/41] rm 'Argo Workflows'

---
 gitapp-callback/templates/success.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index 566aaa92..cb0ddfd2 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -215,7 +215,7 @@ <h1>{{ github_app_name }}</h1>
                 </div>
 
                 <h2>Registration Complete!</h2>
-                <p>Your repository has been successfully registered with Argo Workflows.</p>
+                <p>Your repository has been successfully registered.</p>
 
                 <div class="config-summary">
                     <h3>Configuration Summary</h3>

From a4c86e2ef4ceeed98a1ffff5280bcd7b995f4e2d Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 11:12:02 -0800
Subject: [PATCH 27/41] check if branch exists

---
 gitapp-callback/app.py | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 3f9cb5ff..7f7d73b7 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -206,10 +206,27 @@ def create_registration_pull_request(
 
     run_git_command(["fetch", "origin", "--prune"], REGISTRATIONS_PATH)
     default_branch = get_default_branch(REGISTRATIONS_PATH)
-    run_git_command(
-        ["checkout", "-B", branch_name, f"origin/{default_branch}"],
+
+    # Check if branch exists locally
+    branch_exists = run_git_command(
+        ["rev-parse", "--verify", branch_name],
         REGISTRATIONS_PATH,
-    )
+    ) != "FAILED"
+
+    if branch_exists:
+        # Switch to existing branch and fetch latest
+        logger.info(f"Branch {branch_name} already exists; switching to it and fetching latest.")
+        run_git_command(["checkout", branch_name], REGISTRATIONS_PATH)
+        run_git_command(["fetch", "origin", branch_name], REGISTRATIONS_PATH)
+        run_git_command(["reset", "--hard", f"origin/{branch_name}"], REGISTRATIONS_PATH)
+    else:
+        # Create new branch from default branch
+        logger.info(f"Creating new branch {branch_name} from {default_branch}.")
+        run_git_command(
+            ["checkout", "-B", branch_name, f"origin/{default_branch}"],
+            REGISTRATIONS_PATH,
+        )
+
 
     registration_file.parent.mkdir(parents=True, exist_ok=True)
     registration_payload = {

From e9e9306d81082dc6a637fcf8ee4d306f7f1f5ec3 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 19:37:05 +0000
Subject: [PATCH 28/41] improve existing branch update

---
 gitapp-callback/app.py | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 7f7d73b7..e095faf6 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -145,7 +145,7 @@ def ensure_repo_registration() -> None:
     if (REGISTRATIONS_PATH / ".git").exists():
         logger.info("Updating registrations repository checkout.")
         run_git_command(
-            ["fetch", "origin", "--prune"],
+            ["fetch", "--all", "--prune"],
             REGISTRATIONS_PATH,
         )
         default_branch = get_default_branch(REGISTRATIONS_PATH)
@@ -204,16 +204,25 @@ def create_registration_pull_request(
     branch_action = "update" if registration_file.exists() else "create"
     branch_name = f"chore/{branch_action}-{owner}-{repo_name}"
 
-    run_git_command(["fetch", "origin", "--prune"], REGISTRATIONS_PATH)
+    run_git_command(["fetch", "--all", "--prune"], REGISTRATIONS_PATH)
     default_branch = get_default_branch(REGISTRATIONS_PATH)
 
-    # Check if branch exists locally
-    branch_exists = run_git_command(
-        ["rev-parse", "--verify", branch_name],
+    # python
+    local_exists = run_git_command(
+        ["show-ref", "--verify", "--quiet", f"refs/heads/{branch_name}"],
         REGISTRATIONS_PATH,
     ) != "FAILED"
 
-    if branch_exists:
+    remote_exists = False
+    if not local_exists:
+        remote_exists = run_git_command(
+            ["ls-remote", "--exit-code", "--heads", "origin", branch_name],
+            REGISTRATIONS_PATH,
+        ) != "FAILED"
+    else:
+        remote_exists = True
+
+    if remote_exists:
         # Switch to existing branch and fetch latest
         logger.info(f"Branch {branch_name} already exists; switching to it and fetching latest.")
         run_git_command(["checkout", branch_name], REGISTRATIONS_PATH)

From 36fc3312b259d60a09eae38a00ec46ade39ee97c Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 11:40:03 -0800
Subject: [PATCH 29/41] update doc

---
 gitapp-callback/README.md | 89 +++++++++++++--------------------------
 1 file changed, 30 insertions(+), 59 deletions(-)

diff --git a/gitapp-callback/README.md b/gitapp-callback/README.md
index d761bb56..6f2a4f49 100644
--- a/gitapp-callback/README.md
+++ b/gitapp-callback/README.md
@@ -342,71 +342,42 @@ graph TD
 ```mermaid
 graph TD
     PostReq["POST /registrations"] --> ExtractForm["Extract form data<br/>installation_id, defaultBranch,<br/>admin/readUsers, buckets"]
-    ExtractForm --> ValAll{validate all form fields}
-
-    ValAll -->|No| FormErr400A["❌ Return 400"]
-    ValAll -->|Yes| SaveDB
-
-    SaveDB --> RemoveBuckets["Remove buckets from config<br/>del dataBucket, artifactBucket"]
-    RemoveBuckets --> CheckVault{VAULT_ADDR &<br/>VAULT_TOKEN set?}
-
-    CheckVault -->|Yes| SaveDataVault["Save dataBucket to Vault<br/>argo/apps/owner/repo/dataBucket"]
-    SaveDataVault --> SaveArtifactVault["Save artifactBucket to Vault<br/>argo/apps/owner/repo/artifactBucket"]
-    SaveArtifactVault --> ValVaultSave{Save<br/>success?}
-
-    CheckVault -->|No| SkipVault["⊘ Skip Vault save"]
-    ValVaultSave -->|No| FormErr500C["❌ Return 500<br/>Vault save failed"]
-    ValVaultSave -->|Yes| InsertDB
-    SkipVault --> InsertDB["INSERT/UPDATE registrations<br/>table in SQLite<br/>ON CONFLICT DO UPDATE"]
-
-    InsertDB --> CreatePR["create_registration_pull_request"]
-    CreatePR --> EnsureRepoPR["ensure_repo_registration"]
-    EnsureRepoPR --> FetchOriginPR["git fetch origin --prune"]
-    FetchOriginPR --> GetDefaultBranch["Get default branch<br/>from origin/HEAD"]
-    GetDefaultBranch --> CreateBranch["Create feature branch<br/>chore/create-owner-repo<br/>or chore/update-owner-repo"]
-    CreateBranch --> CreateFile["Create registration file<br/>registrations/owner/repo_name.yaml"]
-    CreateFile --> WritePayload["Write JSON payload<br/>{installation_id, registration_config}"]
-    WritePayload --> GitAdd["git add file"]
+    ExtractForm --> ValidateForm["Validate required fields<br/>emails, bucket config"]
+    ValidateForm -->|Error| FormErr["❌ Return 400/500 with error"]
+    ValidateForm --> FetchReposForm["Fetch installation repos<br/>GitHub API"]
+    FetchReposForm -->|Error| FormErr
+    FetchReposForm --> SaveDB["save_registration<br/>SQLite + optional Vault"]
+    SaveDB --> EnsureRepo["ensure_repo_registration<br/>configure git, fetch default"]
+    EnsureRepo --> FetchOriginPR["git fetch --all --prune"]
+    FetchOriginPR --> GetDefaultBranch["Get origin/HEAD default branch"]
+    GetDefaultBranch --> CheckLocalBranch{"Local branch exists?"}
+    CheckLocalBranch -->|Yes| CheckoutLocal["git checkout branch"]
+    CheckLocalBranch -->|No| CheckRemoteBranch{"Remote branch exists?"}
+    CheckRemoteBranch -->|Yes| CheckoutRemote["git checkout branch"]
+    CheckRemoteBranch -->|No| CreateBranch["git checkout -B branch<br/>origin/default"]
+    CheckoutLocal --> SyncRemote["git fetch origin branch<br/>git reset --hard origin/branch"]
+    CheckoutRemote --> SyncRemote
+    CreateBranch --> WriteFile
+    SyncRemote --> WriteFile["Write registration YAML<br/>registrations/owner/repo.yaml"]
+    WriteFile --> GitAdd["git add file"]
     GitAdd --> GitCommit["git commit --allow-empty<br/>-m branch_name"]
     GitCommit --> GitPush["git push -u origin branch"]
-    GitPush --> ValPush{Push<br/>success?}
-
-    ValPush -->|No| PRErr["❌ Git command returned FAILED"]
-    ValPush -->|Yes| CreateGHPR["Create GitHub PR via API<br/>POST /repos/owner/repo/pulls"]
-    CreateGHPR --> ValPRCreate{PR created<br/>success?}
-
-    ValPRCreate -->|No| CheckExistingPR{PR already<br/>exists?}
-    CheckExistingPR -->|Yes| GetExistingPR["Get existing PR"]
-    CheckExistingPR -->|No| PRErr500["❌ Return 500<br/>PR creation failed"]
-
-    ValPRCreate -->|Yes| AddReviewer["Add co-pilot<br/>as PR reviewer"]
-    GetExistingPR --> AddReviewer
-    AddReviewer --> ValReviewer{Reviewer<br/>added?}
-
-    ValReviewer -->|Yes| SuccessResp["✓ Return success<br/>JSON or HTML page<br/>with registration_config"]
-    ValReviewer -->|No| PRErr500
-
-    PRErr --> PRErrorResp["⚠️ Return 500<br/>Registration saved but<br/>git/PR creation failed"]
-    PRErr500 --> PRErrorResp
-
-    FormErr400A --> FormErrResp["❌ Return 400"]
-    FormErr400B --> FormErrResp
-    FormErr400C --> FormErrResp
-    FormErr400D --> FormErrResp
-    FormErr500A --> FormErrResp
-    FormErr500B --> FormErrResp
-    FormErr500C --> FormErrResp
-
-    PRErrorResp --> Done["Return response"]
-    FormErrResp --> Done
+    GitPush -->|Error| PRErr["❌ Return 500<br/>registration saved but PR failed"]
+    GitPush --> CreateGHPR["Create/lookup PR via GitHub API"]
+    CreateGHPR -->|Error| PRErr
+    CreateGHPR --> AddReviewer["Request reviewer\n(Copilot)"]
+    AddReviewer -->|Error| PRErr
+    AddReviewer --> SuccessResp["✓ Return success<br/>JSON or HTML summary"]
+    FormErr --> Done["Respond"]
+    PRErr --> Done
     SuccessResp --> Done
 
     style PostReq fill:#e1f5ff
-    style SaveDB fill:#e1f5ff,stroke:#f57c00,stroke-width:2px
-    style CreatePR fill:#e1f5ff,stroke:#f57c00,stroke-width:2px
+    style SaveDB stroke:#f57c00,stroke-width:2px
+    style EnsureRepo stroke:#f57c00,stroke-width:2px
     style SuccessResp fill:#c8e6c9
-    style PRErrorResp fill:#fff9c4
-    style FormErrResp fill:#ffccbc
+    style FormErr fill:#ffccbc
+    style PRErr fill:#fff9c4
 
 ```
 

From cc9ac1d85a4bdb558dac2c1d20dbf4d34888450c Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 15:07:18 -0800
Subject: [PATCH 30/41] select repository

---
 gitapp-callback/app.py                        | 13 ++++++++++
 .../templates/registration_form.html          | 24 +++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index e095faf6..79f96c99 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -753,6 +753,7 @@ def registrations_form():
         installation_id=installation_id,
         setup_action=setup_action,
         initial_data=initial_data,
+        repositories=repositories,
         github_app_name=GITHUB_APP_NAME,
     )
 
@@ -791,6 +792,7 @@ def registration_pr_error(message: str):
     try:
         # Extract form data
         installation_id = request.form.get("installation_id", "").strip()
+        selected_repository = request.form.get("selected_repository", "").strip()
         default_branch = request.form.get("defaultBranch", "main").strip()
         admin_users_raw = request.form.get("adminUsers", "").strip()
         read_users_raw = request.form.get("readUsers", "").strip()
@@ -925,6 +927,17 @@ def parse_bucket_config(prefix):
                 500,
             )
 
+        # Validate selected_repository if multiple repos exist
+        if len(repositories) > 1:
+            if not selected_repository:
+                return jsonify({"success": False, "error": "Repository selection is required"}), 400
+
+            selected_repos = [r for r in repositories if r["full_name"] == selected_repository]
+            if not selected_repos:
+                return jsonify({"success": False, "error": "Invalid repository selection"}), 400
+
+            repositories = selected_repos
+
         logger.info(f"Repository registration submitted: installation_id={installation_id} repositories={repositories}")
 
         # Save configuration to database
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index db96be99..329eb99a 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -331,6 +331,30 @@ <h2>Complete Repository Registration</h2>
             <form id="registrationForm" method="POST" action="/registrations">
                 <input type="hidden" name="installation_id" value="{{ installation_id }}">
 
+                {% if repositories|length > 1 %}
+                <div class="form-group">
+                    <label for="selected_repository">Repository *</label>
+                    <select id="selected_repository" name="selected_repository" required>
+                        <option value="">Select a repository...</option>
+                        {% for repo in repositories %}
+                        <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
+                        {% endfor %}
+                    </select>
+                    <small>You must select which repository this registration applies to.</small>
+                </div>
+                {% elif repositories|length == 1 %}
+                <!-- Single repo: store it as hidden field -->
+                <input type="hidden" name="selected_repository" value="{{ repositories[0].full_name }}">
+                <div class="form-group">
+                    <p><strong>Repository:</strong> {{ repositories[0].full_name }}</p>
+                </div>
+                {% else %}
+                <div class="alert alert-error">
+                    <p>No repositories found for this installation.</p>
+                </div>
+                {% endif %}
+
+
                 <div class="card">
                     <h3>Repository Configuration</h3>
 

From af49aa3c49084460dee499dff97681938b8a4946 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 16:08:53 -0800
Subject: [PATCH 31/41] adds select repo

---
 gitapp-callback/app.py                        |  40 ++++-
 .../templates/select_repository.html          | 170 ++++++++++++++++++
 2 files changed, 202 insertions(+), 8 deletions(-)
 create mode 100644 gitapp-callback/templates/select_repository.html

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 79f96c99..11a44208 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -451,13 +451,13 @@ def init_db():
     logger.info(f"Database initialized at {DB_PATH}")
 
 
-def get_registration(installation_id, repositories=None):
+def get_registration(installation_id, repository=None):
     """
     Get a registration from the database.
     
     Args:
         installation_id: The GitHub installation ID
-        repositories: Optional list of repositories associated with the installation
+        repository: Optional repository associated with the installation
         
     Returns:
         dict: The registration data or None if not found
@@ -477,11 +477,8 @@ def get_registration(installation_id, repositories=None):
     if row:
         registration_data = json.loads(row[0])
 
-        if repositories and VAULT_ADDR and VAULT_TOKEN:
-            if len(repositories) > 1:
-                logging.warning("Multiple repositories found for installation; using the first one.")
-
-            full_name = repositories[0]['full_name']
+        if repository and VAULT_ADDR and VAULT_TOKEN:
+            full_name = repository['full_name']
             owner, repo_name = full_name.split('/')
             data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
             artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
@@ -703,7 +700,34 @@ def registrations_form():
     )
 
     # Check if registration exists
-    existing_registration = get_registration(installation_id, repositories)
+    selected_repository = request.args.get("selected_repository")
+    if setup_action == "update" and len(repositories) > 1:
+        if not selected_repository:
+            return render_template(
+                "select_repository.html",
+                installation_id=installation_id,
+                setup_action=setup_action,
+                repositories=repositories,
+                github_app_name=GITHUB_APP_NAME,
+            )
+        selected_repos = [r for r in repositories if r["full_name"] == selected_repository]
+        if not selected_repos:
+            logger.warning(
+                "Invalid repository selection for installation %s",
+                safe_installation_id,
+            )
+            return (
+                render_template(
+                    "error.html",
+                    error_message="Invalid repository selection.",
+                    github_app_name=GITHUB_APP_NAME,
+                ),
+                400,
+            )
+        repositories = selected_repos
+
+    repository = repositories[0] if repositories else None
+    existing_registration = get_registration(installation_id, repository)
     
     # Handle install action
     if setup_action == "install":
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
new file mode 100644
index 00000000..af3c133f
--- /dev/null
+++ b/gitapp-callback/templates/select_repository.html
@@ -0,0 +1,170 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Select Repository - {{ github_app_name }}</title>
+    <style>
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+            background-color: #f5f7fa;
+            color: #475569;
+            min-height: 100vh;
+            display: flex;
+        }
+
+        .sidebar {
+            width: 250px;
+            background-color: #1e293b;
+            color: #e2e8f0;
+            padding: 2rem 0;
+            position: fixed;
+            height: 100vh;
+            overflow-y: auto;
+        }
+
+        .sidebar h1 {
+            color: #ffffff;
+            font-size: 1.5rem;
+            padding: 0 1.5rem;
+            margin-bottom: 2rem;
+            font-weight: 600;
+        }
+
+        .sidebar nav ul {
+            list-style: none;
+        }
+
+        .sidebar nav li {
+            margin: 0.25rem 0;
+        }
+
+        .sidebar nav a {
+            display: block;
+            padding: 0.75rem 1.5rem;
+            color: #cbd5e1;
+            text-decoration: none;
+            transition: background-color 0.2s, color 0.2s;
+        }
+
+        .sidebar nav a:hover,
+        .sidebar nav a.active {
+            background-color: #334155;
+            color: #ffffff;
+        }
+
+        .main-content {
+            margin-left: 250px;
+            flex: 1;
+            padding: 2rem;
+        }
+
+        .container {
+            max-width: 800px;
+            margin: 0 auto;
+        }
+
+        .header {
+            margin-bottom: 2rem;
+        }
+
+        .header h2 {
+            color: #1e293b;
+            font-size: 1.75rem;
+            font-weight: 600;
+            margin-bottom: 0.5rem;
+        }
+
+        .card {
+            background-color: #ffffff;
+            border-radius: 0.75rem;
+            padding: 2rem;
+            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
+        }
+
+        .form-group {
+            margin-bottom: 1.5rem;
+        }
+
+        label {
+            display: block;
+            margin-bottom: 0.5rem;
+            font-weight: 500;
+            color: #1e293b;
+        }
+
+        select {
+            width: 100%;
+            padding: 0.75rem 1rem;
+            border: 1px solid #cbd5e1;
+            border-radius: 0.5rem;
+            font-size: 0.95rem;
+            color: #1e293b;
+            background-color: #ffffff;
+        }
+
+        .button {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            padding: 0.75rem 1.5rem;
+            border-radius: 0.5rem;
+            border: none;
+            font-weight: 600;
+            cursor: pointer;
+            transition: background-color 0.2s, transform 0.1s;
+            background-color: #2563eb;
+            color: #ffffff;
+        }
+
+        .button:hover {
+            background-color: #1d4ed8;
+        }
+    </style>
+</head>
+<body>
+    <aside class="sidebar">
+        <h1>{{ github_app_name }}</h1>
+        <nav>
+            <ul>
+                <li><a href="#" class="active">Repository Registration</a></li>
+                <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
+            </ul>
+        </nav>
+    </aside>
+
+    <main class="main-content">
+        <div class="container">
+            <div class="header">
+                <h2>Select Repository</h2>
+                <p>Choose the repository you want to update before continuing.</p>
+            </div>
+
+            <div class="card">
+                <form method="GET" action="/registrations">
+                    <input type="hidden" name="installation_id" value="{{ installation_id }}">
+                    <input type="hidden" name="setup_action" value="{{ setup_action }}">
+
+                    <div class="form-group">
+                        <label for="selected_repository">Repository *</label>
+                        <select id="selected_repository" name="selected_repository" required>
+                            <option value="">Select a repository...</option>
+                            {% for repo in repositories %}
+                            <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
+                            {% endfor %}
+                        </select>
+                    </div>
+
+                    <button type="submit" class="button">Continue</button>
+                </form>
+            </div>
+        </div>
+    </main>
+</body>
+</html>

From 990999209ddb815e2cbb3b770f7515ba10520664 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Thu, 1 Jan 2026 16:47:35 -0800
Subject: [PATCH 32/41] changes PK

---
 gitapp-callback/app.py            | 188 +++++++++++++++++++++++++-----
 gitapp-callback/tests/test_app.py |  23 +++-
 2 files changed, 178 insertions(+), 33 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 11a44208..375fe5b2 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -27,6 +27,7 @@
 from typing import List, Dict, Optional, Tuple
 import hvac
 import yaml
+from urllib.parse import urlparse
 
 
 # Configure logging
@@ -425,7 +426,9 @@ def init_db():
     
     Creates the registrations table if it doesn't exist.
     Table schema:
-        - installation_id: TEXT PRIMARY KEY
+        - git_host: TEXT
+        - full_name: TEXT
+        - installation_id: TEXT
         - data: TEXT (JSON serialized RepoRegistration)
         - created_at: TIMESTAMP
         - updated_at: TIMESTAMP
@@ -437,38 +440,137 @@ def init_db():
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
     
-    cursor.execute("""
-        CREATE TABLE IF NOT EXISTS registrations (
-            installation_id TEXT PRIMARY KEY,
-            data TEXT NOT NULL,
-            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-            updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+    def create_registrations_table():
+        cursor.execute("""
+            CREATE TABLE IF NOT EXISTS registrations (
+                git_host TEXT NOT NULL,
+                full_name TEXT NOT NULL,
+                installation_id TEXT NOT NULL,
+                data TEXT NOT NULL,
+                created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+                PRIMARY KEY (git_host, full_name)
+            )
+        """)
+
+    cursor.execute("PRAGMA table_info(registrations)")
+    columns = {row[1] for row in cursor.fetchall()}
+
+    if not columns:
+        create_registrations_table()
+    elif "git_host" not in columns or "full_name" not in columns:
+        logger.info("Migrating legacy registrations table to git_host/full_name primary key.")
+        cursor.execute("ALTER TABLE registrations RENAME TO registrations_legacy")
+        create_registrations_table()
+        cursor.execute(
+            "SELECT installation_id, data, created_at, updated_at FROM registrations_legacy"
         )
-    """)
+        rows = cursor.fetchall()
+        for installation_id, data, created_at, updated_at in rows:
+            try:
+                registration_data = json.loads(data)
+            except json.JSONDecodeError:
+                logger.warning("Skipping legacy registration with invalid JSON payload.")
+                continue
+            full_name = registration_data.get("full_name")
+            if not full_name:
+                logger.warning(
+                    "Skipping legacy registration without full_name for installation_id=%s.",
+                    installation_id,
+                )
+                continue
+            git_host = registration_data.get("git_host") or "github.com"
+            cursor.execute(
+                """
+                INSERT INTO registrations (
+                    git_host,
+                    full_name,
+                    installation_id,
+                    data,
+                    created_at,
+                    updated_at
+                )
+                VALUES (?, ?, ?, ?, ?, ?)
+                """,
+                (git_host, full_name, installation_id, data, created_at, updated_at),
+            )
+        logger.info(
+            "Legacy registrations migrated where possible; "
+            "legacy table preserved as registrations_legacy."
+        )
+    else:
+        create_registrations_table()
     
     conn.commit()
     conn.close()
     logger.info(f"Database initialized at {DB_PATH}")
 
 
-def get_registration(installation_id, repository=None):
+def extract_git_host(repository: Dict[str, any]) -> str:
+    """
+    Extract git host from repository metadata, defaulting to github.com.
+    """
+    if not repository:
+        return "github.com"
+    for key in ("html_url", "git_url", "ssh_url", "clone_url"):
+        url = repository.get(key)
+        if not url:
+            continue
+        if url.startswith("git@"):
+            host_part = url.split("@", 1)[1].split(":", 1)[0]
+            if host_part:
+                return host_part
+        parsed = urlparse(url)
+        if parsed.netloc:
+            return parsed.netloc
+    return "github.com"
+
+
+def resolve_registration_identity(
+    repository: Optional[Dict[str, any]] = None,
+    git_host: Optional[str] = None,
+    full_name: Optional[str] = None,
+) -> Tuple[str, str]:
+    if repository:
+        full_name = repository.get("full_name") or full_name
+        git_host = repository.get("git_host") or git_host or extract_git_host(repository)
+
+    if not full_name:
+        raise ValueError("full_name is required to locate the registration.")
+
+    return git_host or "github.com", full_name
+
+
+def get_registration(installation_id, repository=None, git_host=None, full_name=None):
     """
     Get a registration from the database.
     
     Args:
         installation_id: The GitHub installation ID
         repository: Optional repository associated with the installation
+        git_host: Optional git host override
+        full_name: Optional repository full name override
         
     Returns:
         dict: The registration data or None if not found
     """
 
+    try:
+        resolved_git_host, resolved_full_name = resolve_registration_identity(
+            repository=repository,
+            git_host=git_host,
+            full_name=full_name,
+        )
+    except ValueError as e:
+        logger.warning("Unable to resolve registration identity: %s", e)
+        return None
+
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
     
     cursor.execute(
-        "SELECT data FROM registrations WHERE installation_id = ?",
-        (installation_id,)
+        "SELECT data FROM registrations WHERE git_host = ? AND full_name = ?",
+        (resolved_git_host, resolved_full_name)
     )
     
     row = cursor.fetchone()
@@ -518,7 +620,7 @@ def get_registration(installation_id, repository=None):
     return None
 
 
-def save_registration(installation_id, registration_data, repositories=None):
+def save_registration(installation_id, registration_data, repositories=None, git_host=None, full_name=None):
     """
     Save or update a registration in the database.
     
@@ -526,8 +628,21 @@ def save_registration(installation_id, registration_data, repositories=None):
         installation_id: The GitHub installation ID
         registration_data: The RepoRegistration configuration dict
         repositories: Optional list of repositories associated with the installation
+        git_host: Optional git host override
+        full_name: Optional repository full name override
     """
 
+    repository = repositories[0] if repositories else None
+    resolved_git_host, resolved_full_name = resolve_registration_identity(
+        repository=repository,
+        git_host=git_host,
+        full_name=full_name or registration_data.get("full_name"),
+    )
+
+    registration_data["git_host"] = resolved_git_host
+    registration_data["full_name"] = resolved_full_name
+    registration_data["installation_id"] = installation_id
+
     conn = sqlite3.connect(DB_PATH)
     cursor = conn.cursor()
 
@@ -573,17 +688,30 @@ def save_registration(installation_id, registration_data, repositories=None):
     data_json = json.dumps(registration_data)
     
     cursor.execute("""
-        INSERT INTO registrations (installation_id, data, created_at, updated_at)
-        VALUES (?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
-        ON CONFLICT(installation_id) 
+        INSERT INTO registrations (
+            git_host,
+            full_name,
+            installation_id,
+            data,
+            created_at,
+            updated_at
+        )
+        VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+        ON CONFLICT(git_host, full_name) 
         DO UPDATE SET 
+            installation_id = excluded.installation_id,
             data = excluded.data,
             updated_at = CURRENT_TIMESTAMP
-    """, (installation_id, data_json))
+    """, (resolved_git_host, resolved_full_name, installation_id, data_json))
     
     conn.commit()
     conn.close()
-    logger.info(f"Registration saved for installation_id={installation_id}")
+    logger.info(
+        "Registration saved for git_host=%s full_name=%s installation_id=%s",
+        resolved_git_host,
+        resolved_full_name,
+        installation_id,
+    )
 
 
 # Initialize module and database on startup
@@ -905,16 +1033,6 @@ def parse_bucket_config(prefix):
         except ValueError as e:
             return jsonify({"success": False, "error": str(e)}), 400
 
-        # Create registration configuration
-        registration_config = {
-            "installation_id": installation_id,
-            "defaultBranch": default_branch,
-            "dataBucket": data_bucket,
-            "artifactBucket": artifact_bucket,
-            "adminUsers": admin_users,
-            "readUsers": read_users,
-        }
-
         # Retrieve repositories for this installation
         try:
             repositories = get_installation_repositories(installation_id)
@@ -964,6 +1082,22 @@ def parse_bucket_config(prefix):
 
         logger.info(f"Repository registration submitted: installation_id={installation_id} repositories={repositories}")
 
+        resolved_git_host, resolved_full_name = resolve_registration_identity(
+            repository=repositories[0]
+        )
+
+        # Create registration configuration
+        registration_config = {
+            "installation_id": installation_id,
+            "git_host": resolved_git_host,
+            "full_name": resolved_full_name,
+            "defaultBranch": default_branch,
+            "dataBucket": data_bucket,
+            "artifactBucket": artifact_bucket,
+            "adminUsers": admin_users,
+            "readUsers": read_users,
+        }
+
         # Save configuration to database
         save_registration(installation_id, registration_config, repositories)
 
diff --git a/gitapp-callback/tests/test_app.py b/gitapp-callback/tests/test_app.py
index 13f92a6a..47851a88 100644
--- a/gitapp-callback/tests/test_app.py
+++ b/gitapp-callback/tests/test_app.py
@@ -16,6 +16,9 @@
 
 from app import app, init_db
 
+TEST_REPO = {"full_name": "octo/widgets", "html_url": "https://github.com/octo/widgets"}
+TEST_REPO_ALT = {"full_name": "octo/alternate", "html_url": "https://github.com/octo/alternate"}
+
 
 @pytest.fixture
 def client():
@@ -73,13 +76,15 @@ def test_registrations_form_with_update_action(client):
     # Create existing registration first
     existing_data = {
         'installation_id': '12345678',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('12345678', existing_data)
+    save_registration('12345678', existing_data, repositories=[TEST_REPO])
     
     # Now access update form
     response = client.get('/registrations?installation_id=12345678&setup_action=update')
@@ -310,7 +315,7 @@ def test_database_persistence_install(client):
     assert json_data['success'] is True
     
     # Verify it was saved to database
-    saved_data = get_registration('test-install-123')
+    saved_data = get_registration('test-install-123', repository=TEST_REPO)
     assert saved_data is not None
     assert saved_data['installation_id'] == 'test-install-123'
     assert saved_data['defaultBranch'] == 'develop'
@@ -324,13 +329,15 @@ def test_database_persistence_update(client):
     # Create initial registration
     initial_data = {
         'installation_id': 'test-update-456',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('test-update-456', initial_data)
+    save_registration('test-update-456', initial_data, repositories=[TEST_REPO])
     
     # Update the registration
     response = client.post('/registrations', data={
@@ -344,7 +351,7 @@ def test_database_persistence_update(client):
     assert json_data['success'] is True
     
     # Verify the update
-    updated_data = get_registration('test-update-456')
+    updated_data = get_registration('test-update-456', repository=TEST_REPO)
     assert updated_data is not None
     assert updated_data['defaultBranch'] == 'production'
     assert len(updated_data['adminUsers']) == 2
@@ -357,13 +364,15 @@ def test_install_with_existing_registration_redirects(client):
     # Create existing registration
     existing_data = {
         'installation_id': '78900001',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO['full_name'],
         'defaultBranch': 'main',
         'adminUsers': ['admin@example.com'],
         'readUsers': [],
         'dataBucket': None,
         'artifactBucket': None
     }
-    save_registration('78900001', existing_data)
+    save_registration('78900001', existing_data, repositories=[TEST_REPO])
     
     # Try to access install form (should get error/redirect)
     response = client.get('/registrations?installation_id=78900001&setup_action=install')
@@ -389,13 +398,15 @@ def test_update_form_prepopulates_data(client):
     # Create existing registration with bucket data
     existing_data = {
         'installation_id': '11100001',
+        'git_host': 'github.com',
+        'full_name': TEST_REPO_ALT['full_name'],
         'defaultBranch': 'staging',
         'dataBucket': None,
         'artifactBucket': None,
         'adminUsers': ['user1@example.com', 'user2@example.com'],
         'readUsers': ['viewer@example.com']
     }
-    save_registration('11100001', existing_data)
+    save_registration('11100001', existing_data, repositories=[TEST_REPO_ALT])
     
     # Access update form
     response = client.get('/registrations?installation_id=11100001&setup_action=update')

From dc91157baaf413e4ce9660f0875c4b5ea599fb8f Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 03:37:11 +0000
Subject: [PATCH 33/41] improve not found error msg

---
 gitapp-callback/app.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 375fe5b2..eb084b12 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -616,7 +616,7 @@ def get_registration(installation_id, repository=None, git_host=None, full_name=
                 logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
 
         return registration_data
-    
+    logger.error(f"Did not find: resolved_git_host: {resolved_git_host}, resolved_full_name: {resolved_full_name:}") 
     return None
 
 
@@ -862,12 +862,12 @@ def registrations_form():
         if existing_registration:
             # Installation already exists, warn user and redirect to update
             logger.warning(
-                f"Installation {safe_installation_id} already exists, redirecting to update"
+                f"Installation {safe_installation_id} {selected_repository}  already exists, redirecting to update"
             )
             return render_template(
                 "error.html",
                 error_message=(
-                    f"Installation {installation_id} is already registered. "
+                    f"Installation {installation_id} {selected_repository} is already registered. "
                     "Redirecting you to update the existing registration..."
                 ),
                 redirect_url=url_for(
@@ -883,13 +883,13 @@ def registrations_form():
         if not existing_registration:
             # No existing registration for update
             logger.error(
-                f"Installation {safe_installation_id} not found for update"
+                f"Installation {safe_installation_id} {selected_repository}  not found for update"
             )
             return (
                 render_template(
                     "error.html",
                     error_message=(
-                        f"Installation {installation_id} not found. "
+                        f"Installation {installation_id} {selected_repository} not found. "
                         "Please install the GitHub App first."
                     ),
                     github_app_name=GITHUB_APP_NAME,

From 2b4c6ca9f26f4a0ddf9506571bcae42a1dddfe64 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 04:50:08 +0000
Subject: [PATCH 34/41] adds repo full_name

---
 gitapp-callback/templates/success.html | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index cb0ddfd2..d51a3668 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -225,6 +225,11 @@ <h3>Configuration Summary</h3>
                         <span class="config-value"><code>{{ config.installation_id }}</code></span>
                     </div>
 
+                    <div class="config-item">
+                        <span class="config-label">Repository:</span>
+                        <span class="config-value"><code>{{ config.full_name }}</code></span>
+                    </div>
+
                     <div class="config-item">
                         <span class="config-label">Default Branch:</span>
                         <span class="config-value"><code>{{ config.defaultBranch }}</code></span>

From 604bb27769d671630aacb7368942badf076a3b39 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 04:50:31 +0000
Subject: [PATCH 35/41] improve 1..N installation..repo

---
 gitapp-callback/app.py                        | 48 +++++++++----------
 .../templates/registration_form.html          | 34 +++++++------
 .../templates/select_repository.html          |  4 ++
 3 files changed, 46 insertions(+), 40 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index eb084b12..08708845 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -827,17 +827,17 @@ def registrations_form():
         f"action={safe_setup_action}"
     )
 
-    # Check if registration exists
     selected_repository = request.args.get("selected_repository")
-    if setup_action == "update" and len(repositories) > 1:
-        if not selected_repository:
-            return render_template(
-                "select_repository.html",
-                installation_id=installation_id,
-                setup_action=setup_action,
-                repositories=repositories,
-                github_app_name=GITHUB_APP_NAME,
-            )
+    total_repositories = len(repositories)
+    if len(repositories) > 1 and not selected_repository:
+        return render_template(
+            "select_repository.html",
+            installation_id=installation_id,
+            setup_action=setup_action,
+            repositories=repositories,
+            github_app_name=GITHUB_APP_NAME,
+        )
+    if selected_repository:
         selected_repos = [r for r in repositories if r["full_name"] == selected_repository]
         if not selected_repos:
             logger.warning(
@@ -853,9 +853,12 @@ def registrations_form():
                 400,
             )
         repositories = selected_repos
+    elif len(repositories) == 1:
+        selected_repository = repositories[0]["full_name"]
 
     repository = repositories[0] if repositories else None
     existing_registration = get_registration(installation_id, repository)
+    creating_missing_registration = False
     
     # Handle install action
     if setup_action == "install":
@@ -873,7 +876,8 @@ def registrations_form():
                 redirect_url=url_for(
                     "registrations_form",
                     installation_id=installation_id,
-                    setup_action="update"
+                    setup_action="update",
+                    selected_repository=selected_repository,
                 ),
                 github_app_name=GITHUB_APP_NAME,
             )
@@ -881,21 +885,12 @@ def registrations_form():
     # Handle update action
     elif setup_action == "update":
         if not existing_registration:
-            # No existing registration for update
-            logger.error(
-                f"Installation {safe_installation_id} {selected_repository}  not found for update"
-            )
-            return (
-                render_template(
-                    "error.html",
-                    error_message=(
-                        f"Installation {installation_id} {selected_repository} not found. "
-                        "Please install the GitHub App first."
-                    ),
-                    github_app_name=GITHUB_APP_NAME,
-                ),
-                404,
+            logger.info(
+                "No existing registration for installation %s %s; proceeding to create one.",
+                safe_installation_id,
+                selected_repository,
             )
+            creating_missing_registration = True
 
     # Load existing data for update mode
     initial_data = existing_registration if setup_action == "update" else None
@@ -906,6 +901,9 @@ def registrations_form():
         setup_action=setup_action,
         initial_data=initial_data,
         repositories=repositories,
+        selected_repository=selected_repository,
+        creating_missing_registration=creating_missing_registration,
+        multiple_repositories=total_repositories > 1,
         github_app_name=GITHUB_APP_NAME,
     )
 
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index 329eb99a..dcb55b08 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -325,28 +325,32 @@ <h2>Complete Repository Registration</h2>
                 You are updating an existing installation. Review and update your settings below.
             </div>
             {% endif %}
+            {% if setup_action == 'update' and creating_missing_registration %}
+            <div class="alert alert-info show">
+                No existing registration was found for this repository. Submitting this form will create it.
+            </div>
+            {% endif %}
+            {% if setup_action == 'install' and multiple_repositories %}
+            <div class="alert alert-info show">
+                This installation has multiple repositories. Each repository must be registered separately.
+            </div>
+            {% endif %}
 
             <div id="alertContainer"></div>
 
             <form id="registrationForm" method="POST" action="/registrations">
                 <input type="hidden" name="installation_id" value="{{ installation_id }}">
 
-                {% if repositories|length > 1 %}
-                <div class="form-group">
-                    <label for="selected_repository">Repository *</label>
-                    <select id="selected_repository" name="selected_repository" required>
-                        <option value="">Select a repository...</option>
-                        {% for repo in repositories %}
-                        <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
-                        {% endfor %}
-                    </select>
-                    <small>You must select which repository this registration applies to.</small>
-                </div>
-                {% elif repositories|length == 1 %}
-                <!-- Single repo: store it as hidden field -->
-                <input type="hidden" name="selected_repository" value="{{ repositories[0].full_name }}">
+                {% if selected_repository %}
+                <input type="hidden" name="selected_repository" value="{{ selected_repository }}">
                 <div class="form-group">
-                    <p><strong>Repository:</strong> {{ repositories[0].full_name }}</p>
+                    <label for="selected_repository_display">Repository</label>
+                    <input
+                        type="text"
+                        id="selected_repository_display"
+                        value="{{ selected_repository }}"
+                        readonly
+                    >
                 </div>
                 {% else %}
                 <div class="alert alert-error">
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
index af3c133f..0a273a2e 100644
--- a/gitapp-callback/templates/select_repository.html
+++ b/gitapp-callback/templates/select_repository.html
@@ -143,7 +143,11 @@ <h1>{{ github_app_name }}</h1>
         <div class="container">
             <div class="header">
                 <h2>Select Repository</h2>
+                {% if setup_action == "install" %}
+                <p>Select a repository to register. You'll need to repeat this for each repository.</p>
+                {% else %}
                 <p>Choose the repository you want to update before continuing.</p>
+                {% endif %}
             </div>
 
             <div class="card">

From 57e3ba6708a123ce804e2f7373da39e10a2dca89 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 14:05:06 +0000
Subject: [PATCH 36/41] improve UX

---
 gitapp-callback/app.py                        |   1 +
 .../templates/registration_form.html          | 130 ++++++++++++++---
 .../templates/select_repository.html          | 135 +++++++++++++++---
 gitapp-callback/templates/success.html        |  38 ++++-
 4 files changed, 265 insertions(+), 39 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 08708845..2dcb51f1 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -904,6 +904,7 @@ def registrations_form():
         selected_repository=selected_repository,
         creating_missing_registration=creating_missing_registration,
         multiple_repositories=total_repositories > 1,
+        repository_count=total_repositories,
         github_app_name=GITHUB_APP_NAME,
     )
 
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index dcb55b08..704a5fc7 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -270,29 +270,94 @@
             color: #1e40af;
         }
 
-        /* Installation ID Badge */
-        .installation-badge {
-            display: inline-flex;
-            align-items: center;
-            padding: 0.5rem 1rem;
-            background-color: #eff6ff;
-            border: 1px solid #bfdbfe;
+        /* Installation Summary */
+        .summary-card {
+            background: #ffffff;
+            border-radius: 12px;
+            box-shadow: 0 1px 3px rgba(0, 0, 0, 0.08);
+            padding: 1.5rem;
+            margin-bottom: 1.5rem;
+            border: 1px solid #e2e8f0;
+        }
+
+        .summary-card h3 {
+            color: #1e293b;
+            font-size: 1.1rem;
+            font-weight: 600;
+            margin-bottom: 0.75rem;
+        }
+
+        .summary-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+            gap: 1rem;
+        }
+
+        .summary-item {
+            background: #f8fafc;
             border-radius: 8px;
-            margin-bottom: 1rem;
+            padding: 0.75rem 1rem;
+            border: 1px solid #e2e8f0;
         }
 
-        .installation-badge strong {
-            margin-right: 0.5rem;
-            color: #1e40af;
+        .summary-item span {
+            display: block;
+            font-size: 0.8rem;
+            text-transform: uppercase;
+            letter-spacing: 0.04em;
+            color: #64748b;
+            margin-bottom: 0.35rem;
         }
 
-        .installation-badge code {
-            background-color: #dbeafe;
-            padding: 0.25rem 0.5rem;
+        .summary-item strong {
+            color: #0f172a;
+            font-weight: 600;
+        }
+
+        .summary-item code {
+            background-color: #e2e8f0;
+            padding: 0.15rem 0.4rem;
             border-radius: 4px;
             font-family: 'Courier New', monospace;
             font-size: 0.9rem;
         }
+
+        .summary-actions {
+            margin-top: 1rem;
+            display: flex;
+            flex-wrap: wrap;
+            gap: 0.75rem;
+            align-items: center;
+        }
+
+        .pill {
+            display: inline-flex;
+            align-items: center;
+            gap: 0.35rem;
+            font-size: 0.85rem;
+            color: #1e40af;
+            background-color: #eff6ff;
+            border: 1px solid #bfdbfe;
+            padding: 0.35rem 0.7rem;
+            border-radius: 999px;
+        }
+
+        .subtle-link {
+            color: #2563eb;
+            text-decoration: none;
+            font-weight: 500;
+        }
+
+        .subtle-link:hover {
+            text-decoration: underline;
+        }
+
+        .step-list {
+            margin-top: 0.75rem;
+            padding-left: 1.25rem;
+            color: #475569;
+            line-height: 1.6;
+        }
     </style>
 </head>
 <body>
@@ -312,12 +377,41 @@ <h1>{{ github_app_name }}</h1>
         <div class="container">
             <div class="header">
                 <h2>Complete Repository Registration</h2>
-                <p>Configure your repository settings to get started with Argo Workflows.</p>
+                <p>Configure one repository at a time. The GitHub App installation can include multiple repositories.</p>
             </div>
 
-            <div class="installation-badge">
-                <strong>Installation ID:</strong>
-                <code>{{ installation_id }}</code>
+            <div class="summary-card">
+                <h3>Installation Overview</h3>
+                <div class="summary-grid">
+                    <div class="summary-item">
+                        <span>Installation</span>
+                        <strong><code>{{ installation_id }}</code></strong>
+                    </div>
+                    <div class="summary-item">
+                        <span>Repository Count</span>
+                        <strong>{{ repository_count }}</strong>
+                    </div>
+                    <div class="summary-item">
+                        <span>Current Repository</span>
+                        <strong>{{ selected_repository or "Not selected" }}</strong>
+                    </div>
+                </div>
+                <div class="summary-actions">
+                    <span class="pill">Changes to repo access happen in GitHub</span>
+                    <a class="subtle-link" href="https://github.com/settings/installations" target="_blank" rel="noopener noreferrer">
+                        Manage app installation
+                    </a>
+                    {% if multiple_repositories %}
+                    <a class="subtle-link" href="/registrations?installation_id={{ installation_id }}&setup_action={{ setup_action }}">
+                        Change repository
+                    </a>
+                    {% endif %}
+                </div>
+                <ol class="step-list">
+                    <li>Select the repository you want to configure.</li>
+                    <li>Provide bucket and access settings for this repository.</li>
+                    <li>Repeat for any additional repositories in this installation.</li>
+                </ol>
             </div>
 
             {% if setup_action == 'update' %}
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
index 0a273a2e..bed49d3c 100644
--- a/gitapp-callback/templates/select_repository.html
+++ b/gitapp-callback/templates/select_repository.html
@@ -88,6 +88,52 @@
             box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
         }
 
+        .summary {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+            gap: 1rem;
+            margin-bottom: 1.5rem;
+        }
+
+        .summary-item {
+            background: #f8fafc;
+            border-radius: 0.5rem;
+            border: 1px solid #e2e8f0;
+            padding: 0.75rem 1rem;
+        }
+
+        .summary-item span {
+            display: block;
+            font-size: 0.8rem;
+            text-transform: uppercase;
+            color: #64748b;
+            letter-spacing: 0.04em;
+            margin-bottom: 0.35rem;
+        }
+
+        .summary-item strong {
+            color: #0f172a;
+        }
+
+        .callout {
+            padding: 1rem;
+            border-radius: 0.75rem;
+            border: 1px solid #bfdbfe;
+            background-color: #eff6ff;
+            color: #1e3a8a;
+            margin-bottom: 1.5rem;
+        }
+
+        .callout a {
+            color: #1d4ed8;
+            font-weight: 600;
+            text-decoration: none;
+        }
+
+        .callout a:hover {
+            text-decoration: underline;
+        }
+
         .form-group {
             margin-bottom: 1.5rem;
         }
@@ -109,6 +155,15 @@
             background-color: #ffffff;
         }
 
+        .search-input {
+            width: 100%;
+            padding: 0.65rem 0.9rem;
+            border: 1px solid #cbd5e1;
+            border-radius: 0.5rem;
+            font-size: 0.95rem;
+            margin-bottom: 0.75rem;
+        }
+
         .button {
             display: inline-flex;
             align-items: center;
@@ -145,30 +200,72 @@ <h1>{{ github_app_name }}</h1>
                 <h2>Select Repository</h2>
                 {% if setup_action == "install" %}
                 <p>Select a repository to register. You'll need to repeat this for each repository.</p>
-                {% else %}
-                <p>Choose the repository you want to update before continuing.</p>
-                {% endif %}
+            {% else %}
+            <p>Choose the repository you want to update before continuing.</p>
+            {% endif %}
+        </div>
+
+        <div class="card">
+            <div class="summary">
+                <div class="summary-item">
+                    <span>Installation ID</span>
+                    <strong>{{ installation_id }}</strong>
+                </div>
+                <div class="summary-item">
+                    <span>Repositories Available</span>
+                    <strong>{{ repositories | length }}</strong>
+                </div>
             </div>
 
-            <div class="card">
-                <form method="GET" action="/registrations">
-                    <input type="hidden" name="installation_id" value="{{ installation_id }}">
-                    <input type="hidden" name="setup_action" value="{{ setup_action }}">
-
-                    <div class="form-group">
-                        <label for="selected_repository">Repository *</label>
-                        <select id="selected_repository" name="selected_repository" required>
-                            <option value="">Select a repository...</option>
-                            {% for repo in repositories %}
-                            <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
+            <div class="callout">
+                Add or remove repositories for this installation in GitHub.
+                <a href="https://github.com/settings/installations" target="_blank" rel="noopener noreferrer">
+                    Manage app installation
+                </a>
+            </div>
+
+            <form method="GET" action="/registrations">
+                <input type="hidden" name="installation_id" value="{{ installation_id }}">
+                <input type="hidden" name="setup_action" value="{{ setup_action }}">
+
+                <div class="form-group">
+                    <label for="selected_repository">Repository *</label>
+                    <input
+                        type="text"
+                        class="search-input"
+                        id="repoSearch"
+                        placeholder="Filter repositories..."
+                        aria-label="Filter repositories"
+                    >
+                    <select id="selected_repository" name="selected_repository" required>
+                        <option value="">Select a repository...</option>
+                        {% for repo in repositories %}
+                        <option value="{{ repo.full_name }}">{{ repo.full_name }}</option>
                             {% endfor %}
                         </select>
                     </div>
 
-                    <button type="submit" class="button">Continue</button>
-                </form>
-            </div>
-        </div>
-    </main>
+            <button type="submit" class="button">Continue</button>
+        </form>
+    </div>
+</div>
+</main>
+
+<script>
+    const repoSearch = document.getElementById('repoSearch');
+    const repoSelect = document.getElementById('selected_repository');
+
+    repoSearch.addEventListener('input', function() {
+        const query = this.value.toLowerCase();
+        Array.from(repoSelect.options).forEach(option => {
+            if (!option.value) {
+                option.hidden = false;
+                return;
+            }
+            const matches = option.value.toLowerCase().includes(query);
+            option.hidden = !matches;
+        });
+    });
+</script>
 </body>
 </html>
diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index d51a3668..9d14593b 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -122,6 +122,27 @@
             margin: 2rem 0;
         }
 
+        .next-steps {
+            background-color: #eff6ff;
+            border: 1px solid #bfdbfe;
+            color: #1e3a8a;
+            border-radius: 8px;
+            padding: 1.25rem;
+            margin-bottom: 1.5rem;
+            text-align: left;
+        }
+
+        .next-steps h3 {
+            font-size: 1rem;
+            margin-bottom: 0.5rem;
+            color: #1e3a8a;
+        }
+
+        .next-steps ul {
+            padding-left: 1.25rem;
+            line-height: 1.6;
+        }
+
         .config-summary h3 {
             color: #334155;
             font-size: 1rem;
@@ -198,7 +219,7 @@
         <h1>{{ github_app_name }}</h1>
         <nav>
             <ul>
-                <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
+                <li><a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update">Repository Registration</a></li>
                 <li><a href="https://calypr-demo.ddns.net" target="_blank" rel="noopener noreferrer">Documentation</a></li>
             </ul>
         </nav>
@@ -217,6 +238,14 @@ <h1>{{ github_app_name }}</h1>
                 <h2>Registration Complete!</h2>
                 <p>Your repository has been successfully registered.</p>
 
+                <div class="next-steps">
+                    <h3>What’s next</h3>
+                    <ul>
+                        <li>Repeat the registration flow for any other repositories in this installation.</li>
+                        <li>When you add or remove repositories in GitHub, return here to update the configuration.</li>
+                    </ul>
+                </div>
+
                 <div class="config-summary">
                     <h3>Configuration Summary</h3>
                     
@@ -277,7 +306,12 @@ <h3>Configuration Summary</h3>
                 </div>
 
                 <div>
-                    <a href="https://github.com" class="btn btn-primary">Go to GitHub</a>
+                    <a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update" class="btn btn-primary">
+                        Register another repository
+                    </a>
+                    <a href="https://github.com/settings/installations" class="btn btn-secondary" target="_blank" rel="noopener noreferrer">
+                        Manage app installation
+                    </a>
                 </div>
             </div>
         </div>

From a2a311971dc282a198fcb4ab17d5f53d330f34eb Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 16:53:38 +0000
Subject: [PATCH 37/41] improve readability

---
 gitapp-callback/app.py | 248 +++++++++++++++++++++--------------------
 1 file changed, 129 insertions(+), 119 deletions(-)

diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 2dcb51f1..75c73a2b 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -29,6 +29,8 @@
 import yaml
 from urllib.parse import urlparse
 
+EMAIL_PATTERN = re.compile(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$")
+
 
 # Configure logging
 logging.basicConfig(
@@ -96,7 +98,6 @@ def run_git_command(args: List[str], repo_dir: Path) -> str:
             repo_dir,
         )
         return "FAILED"    
-    
     return result.stdout.strip()
 
 
@@ -117,6 +118,78 @@ def parse_repo_owner_name(repo_url: str) -> Tuple[str, str]:
     return owner, repo
 
 
+def sanitize_log_value(value: Optional[str], max_length: int) -> str:
+    if not value:
+        return ""
+    safe_value = "".join(c for c in value[:max_length] if c.isalnum() or c in "-_")
+    return safe_value
+
+
+def parse_installation_id(raw_installation_id: Optional[str]) -> Optional[int]:
+    if not raw_installation_id:
+        return None
+    try:
+        return int(raw_installation_id)
+    except ValueError:
+        return None
+
+
+def parse_email_list(raw_value: str) -> List[str]:
+    return [email.strip() for email in raw_value.split(",") if email.strip()]
+
+
+def validate_email_list(emails: List[str]) -> Optional[str]:
+    for email in emails:
+        if not EMAIL_PATTERN.match(email):
+            return f"Invalid email address: {email}"
+    return None
+
+
+def parse_bucket_config(prefix: str, form: Dict[str, str]) -> Optional[Dict[str, any]]:
+    """Parse S3 bucket configuration from form data."""
+    bucket_name = form.get(f"{prefix}_bucket", "").strip()
+    if not bucket_name:
+        return None
+
+    access_key = form.get(f"{prefix}_accessKey", "").strip()
+    secret_key = form.get(f"{prefix}_secretKey", "").strip()
+
+    if not access_key or not secret_key:
+        raise ValueError(
+            f"{prefix.replace('_', ' ').title()} requires both access key and secret key"
+        )
+
+    is_aws = form.get(f"{prefix}_is_aws") == "on"
+
+    config = {
+        "bucket": bucket_name,
+        "accessKey": access_key,
+        "secretKey": secret_key,
+        "is_aws": is_aws,
+    }
+
+    if not is_aws:
+        hostname = form.get(f"{prefix}_hostname", "").strip()
+        region = form.get(f"{prefix}_region", "").strip()
+        path_style = form.get(f"{prefix}_pathStyle") == "on"
+
+        if not hostname or not region:
+            raise ValueError(
+                f"{prefix.replace('_', ' ').title()} (non-AWS) requires hostname and region"
+            )
+
+        if not hostname.startswith("https://"):
+            raise ValueError(
+                f"{prefix.replace('_', ' ').title()} hostname must start with https://"
+            )
+
+        config["hostname"] = hostname
+        config["region"] = region
+        config["pathStyle"] = path_style
+
+    return config
+
+
 def ensure_repo_registration() -> None:
     """
     Ensure the REPO_REGISTRATION repository is checked out.
@@ -565,34 +638,31 @@ def get_registration(installation_id, repository=None, git_host=None, full_name=
         logger.warning("Unable to resolve registration identity: %s", e)
         return None
 
-    conn = sqlite3.connect(DB_PATH)
-    cursor = conn.cursor()
-    
-    cursor.execute(
-        "SELECT data FROM registrations WHERE git_host = ? AND full_name = ?",
-        (resolved_git_host, resolved_full_name)
-    )
-    
-    row = cursor.fetchone()
-    conn.close()
-    
+    with sqlite3.connect(DB_PATH) as conn:
+        cursor = conn.cursor()
+        cursor.execute(
+            "SELECT data FROM registrations WHERE git_host = ? AND full_name = ?",
+            (resolved_git_host, resolved_full_name),
+        )
+        row = cursor.fetchone()
+
     if row:
         registration_data = json.loads(row[0])
 
         if repository and VAULT_ADDR and VAULT_TOKEN:
-            full_name = repository['full_name']
-            owner, repo_name = full_name.split('/')
+            full_name = repository["full_name"]
+            owner, repo_name = full_name.split("/")
             data_vault_path = f"argo/apps/{owner}/{repo_name}/dataBucket"
             artifact_vault_path = f"argo/apps/{owner}/{repo_name}/artifactBucket"
             try:
                 client = hvac.Client(url=VAULT_ADDR, token=VAULT_TOKEN)
                 data_bucket_response = client.secrets.kv.v2.read_secret_version(
                     path=data_vault_path,
-                    mount_point="kv"
+                    mount_point="kv",
                 )
                 artifact_bucket_response = client.secrets.kv.v2.read_secret_version(
                     path=artifact_vault_path,
-                    mount_point="kv"
+                    mount_point="kv",
                 )
                 if data_bucket_response:
                     created_time = (
@@ -616,7 +686,11 @@ def get_registration(installation_id, repository=None, git_host=None, full_name=
                 logger.warning(f"Failed to retrieve bucket configurations from Vault: {e}")
 
         return registration_data
-    logger.error(f"Did not find: resolved_git_host: {resolved_git_host}, resolved_full_name: {resolved_full_name:}") 
+    logger.error(
+        "Did not find registration for git_host=%s full_name=%s",
+        resolved_git_host,
+        resolved_full_name,
+    )
     return None
 
 
@@ -639,19 +713,13 @@ def save_registration(installation_id, registration_data, repositories=None, git
         full_name=full_name or registration_data.get("full_name"),
     )
 
-    registration_data["git_host"] = resolved_git_host
-    registration_data["full_name"] = resolved_full_name
-    registration_data["installation_id"] = installation_id
+    registration_payload = dict(registration_data)
+    registration_payload["git_host"] = resolved_git_host
+    registration_payload["full_name"] = resolved_full_name
+    registration_payload["installation_id"] = installation_id
 
-    conn = sqlite3.connect(DB_PATH)
-    cursor = conn.cursor()
-
-    data_bucket = registration_data.get("dataBucket", None)
-    artifact_bucket = registration_data.get("artifactBucket", None)
-    if "dataBucket" in registration_data:
-        del registration_data["dataBucket"]
-    if "artifactBucket" in registration_data:
-        del registration_data["artifactBucket"]
+    data_bucket = registration_payload.pop("dataBucket", None)
+    artifact_bucket = registration_payload.pop("artifactBucket", None)
 
     # Save bucket configurations to Vault
     if repositories:
@@ -685,27 +753,26 @@ def save_registration(installation_id, registration_data, repositories=None, git
             logger.error(f"Failed to save bucket configurations to Vault: {e}")
             raise
 
-    data_json = json.dumps(registration_data)
-    
-    cursor.execute("""
-        INSERT INTO registrations (
-            git_host,
-            full_name,
-            installation_id,
-            data,
-            created_at,
-            updated_at
-        )
-        VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
-        ON CONFLICT(git_host, full_name) 
-        DO UPDATE SET 
-            installation_id = excluded.installation_id,
-            data = excluded.data,
-            updated_at = CURRENT_TIMESTAMP
-    """, (resolved_git_host, resolved_full_name, installation_id, data_json))
-    
-    conn.commit()
-    conn.close()
+    data_json = json.dumps(registration_payload)
+
+    with sqlite3.connect(DB_PATH) as conn:
+        cursor = conn.cursor()
+        cursor.execute("""
+            INSERT INTO registrations (
+                git_host,
+                full_name,
+                installation_id,
+                data,
+                created_at,
+                updated_at
+            )
+            VALUES (?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
+            ON CONFLICT(git_host, full_name) 
+            DO UPDATE SET 
+                installation_id = excluded.installation_id,
+                data = excluded.data,
+                updated_at = CURRENT_TIMESTAMP
+        """, (resolved_git_host, resolved_full_name, installation_id, data_json))
     logger.info(
         "Registration saved for git_host=%s full_name=%s installation_id=%s",
         resolved_git_host,
@@ -766,11 +833,9 @@ def registrations_form():
             400,
         )
     
-    # Validate installation_id is an integer
-    try:
-        int(installation_id)
-    except ValueError:
-        logger.warning(f"Invalid installation_id (not an integer): {installation_id[:50]}")
+    parsed_installation_id = parse_installation_id(installation_id)
+    if parsed_installation_id is None:
+        logger.warning("Invalid installation_id (not an integer): %s", installation_id[:50])
         return (
             render_template(
                 "error.html",
@@ -818,10 +883,8 @@ def registrations_form():
         )
 
     # Sanitize values for logging (only alphanumeric and basic chars)
-    safe_installation_id = "".join(
-        c for c in (installation_id or "")[:50] if c.isalnum() or c in "-_"
-    )
-    safe_setup_action = "".join(c for c in (setup_action or "")[:20] if c.isalnum() or c in "-_")
+    safe_installation_id = sanitize_log_value(installation_id, 50)
+    safe_setup_action = sanitize_log_value(setup_action, 20)
     logger.info(
         f"Registration form requested: installation_id={safe_installation_id}, "
         f"action={safe_setup_action}"
@@ -959,12 +1022,8 @@ def registration_pr_error(message: str):
             )
 
         # Parse email lists
-        admin_users = [email.strip() for email in admin_users_raw.split(",") if email.strip()]
-        read_users = (
-            [email.strip() for email in read_users_raw.split(",") if email.strip()]
-            if read_users_raw
-            else []
-        )
+        admin_users = parse_email_list(admin_users_raw)
+        read_users = parse_email_list(read_users_raw)
 
         # Validate admin users
         if not admin_users:
@@ -973,62 +1032,13 @@ def registration_pr_error(message: str):
                 400,
             )
 
-        # Basic email validation
-        email_pattern = r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"
-        for email in admin_users + read_users:
-            if not re.match(email_pattern, email):
-                return jsonify({"success": False, "error": f"Invalid email address: {email}"}), 400
-
-        # Parse bucket configurations
-        def parse_bucket_config(prefix):
-            """Parse S3 bucket configuration from form data."""
-            bucket_name = request.form.get(f"{prefix}_bucket", "").strip()
-            if not bucket_name:
-                return None
-
-            access_key = request.form.get(f"{prefix}_accessKey", "").strip()
-            secret_key = request.form.get(f"{prefix}_secretKey", "").strip()
-
-            # If bucket is set, accessKey and secretKey must exist
-            if not access_key or not secret_key:
-                raise ValueError(
-                    f"{prefix.replace('_', ' ').title()} requires both access key and secret key"
-                )
-
-            is_aws = request.form.get(f"{prefix}_is_aws") == "on"
-
-            config = {
-                "bucket": bucket_name,
-                "accessKey": access_key,
-                "secretKey": secret_key,
-                "is_aws": is_aws,
-            }
-
-            # If not AWS, hostname, region, and pathStyle should be complete
-            if not is_aws:
-                hostname = request.form.get(f"{prefix}_hostname", "").strip()
-                region = request.form.get(f"{prefix}_region", "").strip()
-                path_style = request.form.get(f"{prefix}_pathStyle") == "on"
-
-                if not hostname or not region:
-                    raise ValueError(
-                        f"{prefix.replace('_', ' ').title()} (non-AWS) requires hostname and region"
-                    )
-
-                if not hostname.startswith("https://"):
-                    raise ValueError(
-                        f"{prefix.replace('_', ' ').title()} hostname must start with https://"
-                    )
-
-                config["hostname"] = hostname
-                config["region"] = region
-                config["pathStyle"] = path_style
-
-            return config
+        email_error = validate_email_list(admin_users + read_users)
+        if email_error:
+            return jsonify({"success": False, "error": email_error}), 400
 
         try:
-            data_bucket = parse_bucket_config("dataBucket")
-            artifact_bucket = parse_bucket_config("artifactBucket")
+            data_bucket = parse_bucket_config("dataBucket", request.form)
+            artifact_bucket = parse_bucket_config("artifactBucket", request.form)
         except ValueError as e:
             return jsonify({"success": False, "error": str(e)}), 400
 

From da8c1e1323561dbd0319b18bce6660acb9634fb1 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 17:25:24 +0000
Subject: [PATCH 38/41] adds avatar

---
 gitapp-callback/Dockerfile                    |  1 +
 gitapp-callback/app.py                        |  2 +-
 gitapp-callback/static/avatar.svg             | 26 +++++++++++++++++++
 gitapp-callback/templates/error.html          | 11 ++++++++
 .../templates/registration_form.html          | 11 ++++++++
 .../templates/select_repository.html          | 11 ++++++++
 gitapp-callback/templates/success.html        | 11 ++++++++
 7 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 gitapp-callback/static/avatar.svg

diff --git a/gitapp-callback/Dockerfile b/gitapp-callback/Dockerfile
index 976b095b..c872431a 100644
--- a/gitapp-callback/Dockerfile
+++ b/gitapp-callback/Dockerfile
@@ -21,6 +21,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 # Copy application code
 COPY app.py .
 COPY templates/ templates/
+COPY static/ static/
 
 # Health check
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
diff --git a/gitapp-callback/app.py b/gitapp-callback/app.py
index 75c73a2b..c0fd7ced 100644
--- a/gitapp-callback/app.py
+++ b/gitapp-callback/app.py
@@ -38,7 +38,7 @@
 )
 logger = logging.getLogger(__name__)
 
-app = Flask(__name__)
+app = Flask(__name__, static_url_path="/registrations/static")
 app.secret_key = os.environ.get("SECRET_KEY", "dev-secret-key-change-in-production")
 
 # Configuration
diff --git a/gitapp-callback/static/avatar.svg b/gitapp-callback/static/avatar.svg
new file mode 100644
index 00000000..abe26560
--- /dev/null
+++ b/gitapp-callback/static/avatar.svg
@@ -0,0 +1,26 @@
+<svg width="200" height="200" viewBox="0 0 200 200" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Avatar icon">
+  <rect width="200" height="200" fill="white"/>
+  <g stroke="#1F2933" stroke-width="4" stroke-linecap="round" stroke-linejoin="round">
+    <line x1="36" y1="50" x2="100" y2="90"/>
+    <line x1="164" y1="50" x2="100" y2="90"/>
+    <line x1="36" y1="150" x2="100" y2="90"/>
+    <line x1="164" y1="150" x2="100" y2="90"/>
+    <line x1="36" y1="50" x2="36" y2="150"/>
+    <line x1="164" y1="50" x2="164" y2="150"/>
+  </g>
+  <g>
+    <polygon points="100,40 50,70 100,100 150,70" fill="#3B4148"/>
+    <polygon points="50,70 50,130 100,160 100,100" fill="#F59E0B"/>
+    <polygon points="150,70 150,130 100,160 100,100" fill="#374151"/>
+    <polygon points="100,40 50,70 100,100 150,70" stroke="#1F2933" stroke-width="3" fill="none"/>
+    <polygon points="50,70 50,130 100,160 100,100" stroke="#1F2933" stroke-width="3" fill="none"/>
+    <polygon points="150,70 150,130 100,160 100,100" stroke="#1F2933" stroke-width="3" fill="none"/>
+  </g>
+  <g fill="#1F2933">
+    <circle cx="36" cy="50" r="6"/>
+    <circle cx="164" cy="50" r="6"/>
+    <circle cx="36" cy="150" r="6"/>
+    <circle cx="164" cy="150" r="6"/>
+    <circle cx="100" cy="90" r="7"/>
+  </g>
+</svg>
diff --git a/gitapp-callback/templates/error.html b/gitapp-callback/templates/error.html
index c7303cdd..768bede9 100644
--- a/gitapp-callback/templates/error.html
+++ b/gitapp-callback/templates/error.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -158,6 +168,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index 704a5fc7..1ecf5e96 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -364,6 +374,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
index bed49d3c..85f2f944 100644
--- a/gitapp-callback/templates/select_repository.html
+++ b/gitapp-callback/templates/select_repository.html
@@ -37,6 +37,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -186,6 +196,7 @@
 <body>
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index 9d14593b..1e78ffb3 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -38,6 +38,16 @@
             font-weight: 600;
         }
 
+        .sidebar-avatar {
+            display: block;
+            width: 120px;
+            height: 120px;
+            margin: 0 1.5rem 2rem;
+            padding: 0.5rem;
+            border-radius: 16px;
+            background: #ffffff;
+        }
+
         .sidebar nav ul {
             list-style: none;
         }
@@ -217,6 +227,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update">Repository Registration</a></li>

From a3adf81698e1a10a277810a5de27ba9a5d55a165 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 09:27:54 -0800
Subject: [PATCH 39/41] use png

---
 gitapp-callback/templates/error.html             | 2 +-
 gitapp-callback/templates/registration_form.html | 2 +-
 gitapp-callback/templates/select_repository.html | 2 +-
 gitapp-callback/templates/success.html           | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gitapp-callback/templates/error.html b/gitapp-callback/templates/error.html
index 768bede9..ce7443c9 100644
--- a/gitapp-callback/templates/error.html
+++ b/gitapp-callback/templates/error.html
@@ -168,7 +168,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
-        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="/registrations?installation_id={{ installation_id }}&setup_action=update">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/registration_form.html b/gitapp-callback/templates/registration_form.html
index 1ecf5e96..8fd923dc 100644
--- a/gitapp-callback/templates/registration_form.html
+++ b/gitapp-callback/templates/registration_form.html
@@ -374,7 +374,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
-        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/select_repository.html b/gitapp-callback/templates/select_repository.html
index 85f2f944..fdc78117 100644
--- a/gitapp-callback/templates/select_repository.html
+++ b/gitapp-callback/templates/select_repository.html
@@ -196,7 +196,7 @@
 <body>
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
-        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="#" class="active">Repository Registration</a></li>
diff --git a/gitapp-callback/templates/success.html b/gitapp-callback/templates/success.html
index 1e78ffb3..f5a6cfb8 100644
--- a/gitapp-callback/templates/success.html
+++ b/gitapp-callback/templates/success.html
@@ -227,7 +227,7 @@
     <!-- Left Navigation -->
     <aside class="sidebar">
         <h1>{{ github_app_name }}</h1>
-        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.svg') }}" alt="App avatar">
+        <img class="sidebar-avatar" src="{{ url_for('static', filename='avatar.png') }}" alt="App avatar">
         <nav>
             <ul>
                 <li><a href="/registrations?installation_id={{ config.installation_id }}&setup_action=update">Repository Registration</a></li>

From e6c35bcd22f02818db4c27c32913ca3fd09a8467 Mon Sep 17 00:00:00 2001
From: Brian Walsh <brian@bwalsh.com>
Date: Fri, 2 Jan 2026 09:28:09 -0800
Subject: [PATCH 40/41] use png

---
 gitapp-callback/static/avatar.png | Bin 0 -> 20161 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 gitapp-callback/static/avatar.png

diff --git a/gitapp-callback/static/avatar.png b/gitapp-callback/static/avatar.png
new file mode 100644
index 0000000000000000000000000000000000000000..a57cb8da4e8b770f58f50be94f68cd5c018aef0c
GIT binary patch
literal 20161
zcmb?i<98+9(~WauI}>MOdt%$R&53Q>wr$(Eu_w+v!JT*}H|Cq)|M0F}-TkFM^r~}C
z?OnTe#i%GrqaYF@LO?*E$jV5leZ8mucLSilo)ka$W*{JxqGcsSHN5jL4dL^#CsuCG
z3-<;fypE}4u{A_uLdnQtkICS$<EzPNrC?UAHy-C8Rair!V@+_eAw?zG5mUn`R8xn)
zWjT9Q_6;7mFU~DoU!53^x?Svz4GioR78ahLBYxJdpr?$}DJ_5ZEu}%P`c#bN(8@Ox
z`#Bk_u0Xq>^D`D<f`CDZt%TQng6=!Ebv^Gy_<!*@RoN=}E&pL-{Xc)KgffX)!ZHz)
zKN~}aP0kZQZxK35m(g5{i+8*@6tmQ8F5q$fwwA0@;*NL~PKyp~paT4^O0V8fx`UCE
zOU<JNYTs#Wby`xDaQ7#B6?k&KUwQ4n`YcnxT&~otexsDuXfTK<yo36^#*5g4elTAk
z>~-zG$GYIWWA&FSOf5A{>8{*NT8>p!G<w13M(DlMX$KM_J*ThsdCPk7<J3N(;L`5`
z+k{cV-~7LwMWM&gDG((LRAA77kRZ(v$65J7yXALgO*$a#R<n<KQegn6GX*4Kut@k4
z^g$q4@j?q!@JAL`ylQxr&y(?JKIY~LGZnxJvm`Lc=N6~~e$}(3qjQtZS38$(89yeN
zCcue8C7~FG$^HRRDx!{j_!0Ix%ZU8fyQZ3k-<&)Zg^1h2(vrLc1_A*cqS7`Fk0m1r
z-Uo^1)i6Ewm_V$@r0w+0<x%jFZ4w_HQ3f3{Mb$U34?HXI^s}v6`9T^=#BQy+q_ftH
z5<)Jx!Jvo!NC!^TIz#D!h%SFL0svLN(|rQ8ZyY%3+)1*u!YENco<^ZS7EBg)_|>pp
ztHm_c5sQ1Jie+6DoG1zCxt`PyGHB0cM@;|v)xE=B=`wNW-hcak*RqN=E~PX&B$#rE
z)z*XF|59Vp_Ko`8dmzx^goiw4tqXnoJqvyy;WEwvf&GV}4@~-<;jPY;Cq|W!K_>rF
zE9^HLS5eBA&rtmCFH>@J&HA`X+a#4CCow~bW%+;HotiReHBhAI|MV@Jw9bD9FADn!
zkdS-7_j=GM=KiYpX-nHzid9haVW(~~jixE`eR)R{Dvw8C79b4x6VlSP=gCl}QDEE%
z3RkIwRs;r2PXqg{{(2B`J6YvQ56;$U)v$Y<AA@swXlQlP1qi<4jv%^LKnUe^vlSN3
zS*@+?B6KyDG?f%|^fzV9NKsr2&e-jK3{6m_Lhb}h@IVcVhD!M0^SAUWjgs%{(r?Oe
zHS%WZu100S2br=+l(l*OBtlgPS|<z3?o2W&mV=-x51zM9E2fe;5`0KLbpIfrAD-8h
zTINs6<(UN?$>hch4y!r;>xrzD6^`H)xf(k0sC{qnQeHYD#il~O#y?Wg@caz-KnilQ
z*0#0-|BC@S^-8@BgpiOdL(hXf%0;^sUfeX?aDm%DN2@})sB7Yo(f)U#GXH2K#$G(|
z-Z_n5vt;T^WzlaJe~*>j1euJ4Mi><(6<2G}-FIjk_Z+9jiINFE3*6C`1)Qe9G@o}J
z-1LJBhaRu8oTJy$V_Al7&5HI1%&bpNPhRu7Y|b`eA+5G0ZJY!+9UWJXIia3s1E0_0
zrBKRT8`RgcTOY#ExoWkGxbNR*(heF_2YN*mgfo4{62zScEq@J$!7Ed2;_AT>$lZJ2
ze7tuh^t%lYi~2o&hQZKl*Ssu+q1Eek^gG`e5n`aXHGCzr!h$r)ikLUU)^ti;d`rK_
z>x7LCCC8Ww88#J9rR%BHs-gQ0{wOq3IJp6%gG2kqLG$D2A0Bq{EE5QYrBL4;UfgEO
zWp5U8-va`NMW8fmHGEy>2E-c)j_-YKE*CH7@^>re^)Z1eFDBpeM6yrA$P7Nu!8unu
z9SOjW4?O%?a#JT@yfmrb<!sa7t#^O)I0&qm^X8PbfTu=xEaEenNUF<=mnZ@8Y;qoz
zB=iqPt^y9>Y^!Z5=o9RImAk&aYr{zMebI<D8JW<34`{3ny$;B=Zgr&3O^t(e((C$B
zVdn17Q+2M29|J>OYIm~6bAbPOuWigN2qI?gKDZhB9Z4j;%k4V5(O@IAa>Up@M`KO)
z?7C6!B<L&r_UlN7lWM8nXLZpkkn?0f*27MVC*vErfdNh$G%>{O?d|vYAoGh2M-fEg
z&RYp$@2y}&)&FWgxnfSf@3G>3Jb`DM5_bB1(!P=jyZ7HiRj>GJ?Jj1y!-VZ|OOm0(
zO~(U@tfp)cv*K(vFc`sku)}SW1js27Xd0zeCbb`^n#F8{%hV^dvRfaNlG_%t+uyHj
z<<EWA;D!3;7OtwOhZYKyMg!0;fy{Xfcq}fn{TL+BIBth#bk1v##M}!GgstYRi-La3
z%ZNybZ<6A>eeQYf!MYlX=Ik!xnn#O4@VRonH~L9^J{?g2Io0z@EG~b&-VB00YqkKm
z?`>iPfVF4Im_cax&z^@~qOOmg0ydPnoZwwFs2+5&r~X2u?V``)qa<#p-Dusw*6zL%
z7%COA(Up@~<G}m-3<ho6Tr2z+T}8sAZyc4zMMf>Wcqz%|Il4^=q{1HO?fw2r0ADW8
ztK_<y?f{8_m#UEWLvymG{OmGVOoiF${D<FnT?YXyl$3Go^T*cB0<6)*$;Tkjf$+;U
z+vA>ijjgftET}PB@cB4RmH66%5~5t>VzbHXem$%kedz5Lse)5b@cqJhaA9WQY^5Sj
zL%7s~>lhH1#WZxfeG&BG6XQgN=&;j!0xAk%{{x(@E3Z^j536ExQ`a@9uvjMzau~Xd
ztphPVEwl1MP@X33xU+T88*cV_^;HM-ZB&XPs&?jmW~Dzy!=QGaj<l3zG3mPNeh%gn
z<(~S02I#)^xxZVSR^@}M4QwxpcAAFHG8r04T5pEQ7kuUk*Nc2!T3Cj%mzzZmdw}@*
zRq$%*#j69aXhJXJ90BkKK2LvC!B5b3sRkjT`qN|mbNLzItm+)p&m-xQxO4^t-jJcr
z8}G9WZR?;%K~}iXE}^EgueIH4(C3*1w$3LfYcgmn=HG4fN5mmhLA4m|t&#-({g`FB
zU`c?ZqNN>I(e$cp@w*x1p&5AJ0vSJhpvKEWOUig6(i@qOMo5?#8SR4?g*<i|czPqB
zc}j>VF!0pmpTSMvnudf-k4_b1WM>9^?*}dapx~ro<@jgHRnT6(%1qA@aFF`{A*Tw~
z5D$C2UbP>+XriX_p1-MWQjbB)1PXQt<~K6Jqlce9zkdc?S9t9gC<K#Z#E(Rqb|v=Q
z6vpCUmS@odd+0lRq^plMsVYsS0dw!B%U5OBY{<-u4@+r^fhbh%x)bmji5Yo$ue(8o
z#DTMlEzwnlzVXydLJEu1KGzX=!ns0YhfuVVWTEB}<Kxn#Bz_l)JWv^s2mj$-E|rKM
zO%DBArr|&+9q}n!RUUf1=7&f9!?JhC$-&^a(RJ{C2QK{<bOi&IKv)p??jhdmeg>0j
z>FVlMrSyK-;I+^1N`(@Fu)uQe`Wq`rc)R^<3sag=>?eXMjcKfjU15NIpz$lPu8CQ%
zKh@5tYg9+YM?x*Qr7*ztsp01&MJ6v^w6>Akduzr}C=`RfA7+h+Da>_`{Td}&5-ho-
z;%}ty;l*pmA@@YwgSXokUl5NSP6+4xbHB$~F+bUp(foLt|Kl0d>|+2`aVp8j6Q9Yn
z;CJ0)Z9ShW=yMML?DKs3lhS24_`_>gs8kYM*)kMhx>si+Gu=4gH#Nj&J85mKq6m$!
z$BkF+@|hpk0)s)p!osqk6B~XfyuxL_@$ii`T8=8S!K<{@oz{#@*m*0pXu;0kYG&#r
z)L%I0!;w<@tQRu9vQmQ`S)9k6PoM)|qgoz)0VOT39IM_e;`m?FkndSVR(93*?HJ&4
zpxg#Ya_M${7+vC4_fO}+JD|M=nA}qC2aZJ*>vwgqc$yh=ixOYm(i+w&%aiI4t8~7w
zU`&kSB}s_6i&xv_|5oB>2yg;??{)fZe&27RJovWf?;7l}DhN)jtf)kWQLU-B5>nKt
zb^t#G?}nQgGL5#c%qr7KCW6>l-^w+uTLCm{WS5`{hDLn%tGK3wDkD-Lff)H>3qV`0
z9u`QKhH#Z^`*Hca!v~?cD{mHu?Mh5b`T9Ug+u$P}W3yI#&A=kC*=OC97nPKX*gPXw
zd??q-4o`a@n;iGU>*epem!OeiBxw&5>#T)lX0*Z%`S8CgW89=5^ObWhdl7K(6oXqP
zHb>TiB6@#K_Oo#5s1EE6JuX8$@HHx2Lq;h%Nf(Yh{oR37)Rj`qRgL{O&_g{ng~>Sh
zhhjg;cV*(_5fVG|6>18|jBu(PUER4lgbOKx$;(2VpJME-V5$9|H;Y4zD*_0)nN-V|
zmjABwLV>$18o7xravMp&X3jg0_)5gY%%w^XhA%GR7O>>H5M04RLD)N_n5Wf_U8Uw?
zPFA{kfg|>7h)w|k=97_*h9+*i3z6FTuvN{;De&_{o6)dy^a31`@EJ3$X`=p9d^=P~
ziX)K(ONCr;NR_bR@2t%8@{luW(`IVN1_e|$uw%x)Uv=!IfZv0vU1MFh-oTDZr9+Pk
zb6m6399QPVFh-_cw@fNK7gK$5#l!sZS`fm-RiL_mFBu8<xV)54A=ZRe4}pP3@;B{q
zxWiVf$96kfm&1Oh9$kg`6e^EVP=K1NS-cWFicAFJ%%{(3&9XU3`5cvI=%he-_i}UK
z9>J=x!e1L#BWfy-X(&94lUmKD1R|CU2J(9buWcOqMzQg8F1zECS1c_52jlP~fdtr@
z;`qpM({#Wa`a@<bJkt8oa^@sk*=;Wo4EYg_g8#pYEI}huNP2S0$+P>5pog>gbFSJ6
zjjN}lq@l@#B397r4fysJVd>@m+{ohuhtjF9Le9>vMhuH~4`o)1G3Zoy@w3ya;d{=y
zMgcywN#X=Eo5G43$iRh?kMC@oJnRemEE;mT%6a5P=IoFxEkK1k|3QIwtqp4Z5HH2!
zGI?N&>YF*$LMz?1$qQ)2#DA!kxw2)VQ*ki#NnUKE`-F>#(!$zixRrU#;uZz{vz<$o
zQLR9wO#R{t@2_ay1B2Th7p#c6Ct{2>+hO6C{4Re#TF@3gP04MHiWOGd5t@ej%_d@P
zSA}k$F=;Jbosnh?DERn#tQW62gmOf=SY%LMPVkCI1-w-hG9KeEcfop|=pxCHteG$N
zB_KnLcxvT`{{DVYp^yJ~bDkL+=(au*LJpV3ka3`!_6n()Bj04AX~^l*UV5%}_*XV8
z8BQu@UjA0K>HDgHRykhmG`0Ku)Y`DCo7)%j-b=)L%pP*VV4bgPscY)Kta?5$WGlXj
zTNLEDUdLM$YAY!$ssLFNg$N}4r>Sl5aD?V&6m$~tSk>?Ka(2%Lf^oToMnfSDoa*%;
zy8OMD#PP#A;UuTSD5O>On<UVRO!W|c?-B=SJqj#MHeLS8%<hb7S4qS|4#Jk|L77M<
zN}A>lpanz41&8C8?l&GQy~Y8_*jBh2!&OEGnxI`G=YiM#^!i-`C~R5-q2dGcBq4*x
z_8$w6@MwgbPv@d%w$fhL+eh*WyaT3V<>eB|xN<i}dwvh+LKk^kM>PHarbvU{nq5Zn
zdk(yMo5whmh1bhv%@Oj%^$7dg@muZqt0hr4D~S2WOk2$;B0EKGa{6279Q8<IU`1@^
z3AtcEE6%j#anix*T?T*c*6Sh|uMiewGxKy}S38Kh3|3xSwGX`ccbp-XIL?c>Kl_~b
z3pq<ZY&~d2;SWpA_%v&^99Jtf!IdB?8fr`lB*r8e*q*o64<x*~*P%~82_EG6Bi-Kr
zy1t07vj6KI1YUS(bfJ|4gU@eD`bJlsDW-h6+TY^}0W4_dIr^>YRZ3q3Pwe;>1`oK+
z8eXl}@KO|X#oFz%S4^8wflG~9sn;M^4-ngQ_~j0c=J&fBaF}Wogpst17>AcSX!{#=
zqu(X4_#mGXm2gz%>Q_rkjvNY~>|2Dv?mGT=t8HlTDYenSh3fBR+vhj$=Zp&;C$*lM
z7G{L1a%??QU~>^!#J?P{{^c&p$vUq(y;k<qY53Y2wjmmTDpCZpU1{J2WzpewnWku8
z;J?HzHxPU`>j6*FefH7bs7$b}s*Bi$^Dp;j&9J`5L5GL@XEBqEbi_qr@UO}PZ9(3b
z>)4r@PHmpsj|_X`U_k?E=L=lWz~??c_;k)`y%m<+Vr)_|;02}scctl2<A<SyEUn4!
zsf??p*eCVz;9HS+g31o!cuSW12s}@N7XLHxuhO>7vjM1CSGZU2GrwI$z77CaTAwKR
zdfjq-29Wd9z=x24#I}K4MHy+YK}kYeZI8j03_;N67`xr|&WjVm3q*md_c21wHtTJp
z{eSSaS{2B(*Me#o#b*J0O<R1%LC<I4#dmG6H^Nd89!t+#Y~6m)C-mkckfz_P+1HXG
zN~1KT?1UOC{O#{iDMH#lG=n*6IO1+@WK`kdy%Bfu0Z!Iq(;*n=$xg#vy4`LR(Z@qw
z9#1UU*(&I@=u>D2bn|Ya7ceL!*q1~c=$5y^BtKLn_d`~6x=_&Xt91JpA^Z`Zix*+D
zS3B|kxW9T|%8U&BBR4-i?-*$0=Ocq8QYj)(q07M_&IQQBsO-)8;%@)BDWmnBOr{ZX
zizEE=9iV+ixa@^MT!2hJfxpWs3Su)`6D$f6WZ<CLtgw@mhh|$8pu(;}#|C>G70i&f
z4;HURt3F=uc|kzD-klFVP4(O;5PAh(WLnnts;*>Ig>%*$J8!SifkA<rWm6T=W_#Nn
zn+Lq@&YvM|pt&?lyV;)8iid3Jmwue^M8kI0+8PVY_|rh?-;fZr8N74x@pE*f{{EW*
z<`1NAQxp2jy*%_=xgP<C!<w7OK6f*pm%`o>=+y_sBlS&#`M3M})|}PyNIFMs6c9EW
z^;^eXG=qP4+r+FO8}x@hGEKV#|1N#PA}@#|=cZyx-805>kuZF}HY0*DSuaQiMu+QQ
z#^!>SQtteulHL!Glvmi<D_XRSR%LbbzIfZ7ABp#$&uy=6o9Ei~=u)#(=Q~3$#{5^q
zKJX3%oe&(RA=DXF|G!>)?M5B;KeY@IB9rZCRY5B)tCFkMbF2=aw1jfnZ>9*xT7T)n
z2X!N7GeSydbW&(gxa(oduVB+zGl`ajKX3C=ybk(K7Oz5ey2Dpeo8JK8@&V@)Sw`0`
zrXX8V<xLb(734pg7hM_hqy+pwD#TKujfAeLXvy!D_^;NpjP<%r_6ZUQp+=zLQR4#+
zOH#U$fYZR!a0~z*n7VXy2qUG4xOIf=p@~g>zYM5zYg!h!8<eVaM5ZGGF+aUP^g3<c
zlt?t>{3(>RtU0PFh470yB>3a1tL=-7J-u|tU{=L3>2n1I-R|5d<m>QpMX0GOV33!$
zc)jV)qJmUc?k>N(4dn$)O{W+&MX9~)<=^ahbpM@~b-sWM$~mzi;AOvLfIu%}!aFHL
zcku6a$uQ9lLjSXtlD0CdVLpOxF;ZI5b>R2O(4_pU&v{6N6y+W=`*zw#mKRf<;^(v7
zM*g#5-#wuZD8Qb_sgmr6@siW&)avQ{N2PI7AqinWkFS^?A)PQib-7tY`4owd%h=7(
zp5J2uNrI)7mEhwW(%#EM;lF3==fI((F#x5#B2}c^V2J7TxXf*hj&mk(7QN+S2wgLV
z8snGear3Z~8mQ!?HS=DZ7TQFFOMEyfE_2uC=1&EK7J=PXFfR}uC1f$wooJ*}xbyKW
zXsh`*rRUYYJm5*7u<QH4zX@v&ma~-z9A9l3QCT%?oYb_bM3VQbdgt?XL6nGJE#`{@
zWm6Al!X~c^1-o*aE&;pu&KTITry+Z;<eZJTv7d1T3j~(mX7vE>16Z;K{5&+DT#v{q
zig?Fcct*Z&XP*w+of%jmiR!;1R<UIg%dLezN9DgVu1;Sdw0XUl>*x|u<Gbxh|Hu2w
zH|3Ldhhu?FtNGmbTX52%z`MpoIX2YxWWx^grSEbWnqdCVOPy)ZI@aiP3|d4{Nkp-D
zSRC|3f{IbBXJ(=!a^wKszcxgBh6Jwf7<ut3Is;Bexg8h2?tRDGBiftQdJ{FZOaNlR
z+=tt`qsqnX8Y1G9CxJoHutt2p&w!3vZMP(X6aH9s-Boju>P@$cc^*Tbi4*mzfT#U*
zx~L?Qf`{dJXX|+aq07uXXA->{SL$<!G6XsWNyg(qCNHP){!vVSK}2lD7}yc_`BbIN
zK{jNw_W7{`j+>|==U$)j&4UFtz;6*`F{>c{D*MO6)ykkz*iv-EA07sS?#pqDpH-DJ
znl!2b$Ej(lQkrV&*8}!zNnp_Z`M#k`VPOt<<>H9td?R4>v>_CNCxWvBeWd~fNee^h
zOx;x=hB<3%6dz5U(>m^g&|&jk8i7cJxlc&R-|zMor*6S<-~V)upf1Q*J{Uptt3;ce
z{@rB|u$~dGngbKL;UqL8scFIPoP()WXV+14GuUP`lNv=DaM|>&5AB=m#h&wUF$2rc
z#R5MOXEja9ipnUppe!vA4zkuw8K;Xer}v0{fy%g+KC!hH&Su|(s7v7e(#?LOkwzq!
zOVIwMolcnL>7&;k&d1`N50SgJqF>(W)kbx|HLM1El3nTvPj_|ljXZvI!tlpu>)$AZ
zrU8GcG2dR2?B^{!Jg*xrr~mi?8mr|%U1WQlD0>limznc3>>ZT)Ic&vASGiC6*Cq?S
z_OvXg6E;eO*noBgqI!cbH8sol#c5*`&v>l|;<mECE7%S_9X9rOwd^zxjwW!F!!_yZ
z12imz6U_*Uh@~bQ2mM1Pa6bw4IWS(ir!d@n5BvnP^slvP7X_0v6EL_^2$$|)GJdGB
zFIf@pb{ew*A2H|EQv5#lhrG`alh-G)%`+YVU1)(jCG>oCreQBdi*HYF8x7@d6nbeW
zm~afKHRuqqs1T5ITPZy!d3$w2H$oP3h40dNT=qsKW)Vk6=;rY#_}*Jv)<px3I~(m~
z(n*!yGBOHtZ1I*$O{OMN6C_U}O#vg1S9|JxTJw|Eg%}=^6tzHp5e;I>=n*gmhW%!Z
zdWRY{Js=^0CIt8fGiJd+udG#YDE!P1D*wFgx4x;5{jYfGo}ehe$2Q4m=%e$y-ta(a
zjOw|igUFB&7_{&|f*0AyUy}VdS?X+;A(Mal=JCQ8Le*ib_o}j_tKJCgw{}DSoquVe
zmhm45>9v~E2){$KI{Qx}?V@ohhNvidN<&qHQ0qB$z*su=M_1C5pb2&S>FG1PvETc&
zs#n8KcMO(V=i$#8*{yg4qeUX;_}4#WwumO*tbipA92xlo=&+z&CuM6>^3T`ZxQA`2
ztIARboNX@HVqUJcY0=?-fZW>Pj0@sAaX_$(m^;PWOUistPykv~kTN*|W+QEqBw7U`
z9wb@vTtS!1LO*O6ydmGieqXJ2lToV}LIo9kvJ;8_X+W3V)(SAPBXJbqpm7@r5ObOJ
z@6teh**WKe!_(7<JCV5mxiv8)S1XDuhJS~Yb#RCj!`~~u=P89GJ&I6y^1;Pm{d^Jg
z$tXL_SxF`|+P)58Ek2h=^c|yJ7ka;(O)Ox}{o1)J(wL5}JD#rYQgrHPHDvYGNrC|`
zCtebR9y=;oTg=t)?&6yT7uCWv)YQKWa1;-%HD<m=(q+v-b(Ek-i>RIwBcJgeUT>)~
zysCd+E*6z=`q(d8#T_VjF3eF#gaAM&YEHn)Mc8sfPDf*@R6-T7AI>0;l6XJ0d}JB&
zIq!$+6vTGk)3D7SraJ*32eDHS9C0{OsC`uMBd-@1k0QzKKWjPG{6oYHeomaI7Wug+
zi8UjJ;Pk{%;?@CVJKZyWjoe0j(wdTM3NjYeE2x8XL&k=zo%5P18tP=+0O<6z=!Y6P
zZJw<in%@h;>3PB-$_V$GeJ+|)%6=IBGQA6UY<FA-;xKiwo6ib>Wv~ZZC5r-DL2)&K
zXO+o_GN1I+G8&i0B+*pMpgyN*t|Xyb7Y&eX>733(psQ@dC`V@OVMB4M<?K`I%Q_0U
znv%py*hUmG#)Pv7|FgX5Q|+Lwn_|X91HETu+=2<_(3FVM%n=V^2@67mtJh(oNf@R7
z{FJCM;320<qs5yHJ4IUgmHxNL=)F(+Z|&cYuVJ2W!B&`9P;{mrZ~aw;fnOgtWn4E^
zYkF&ATgF(%*sAO=w8|6qeJ^VuPxrt#Wy-9Nl}8XQAeeGRtDoNc2&1vLm&E*A9f@l4
zk*!6J*u484NUA%Ig_Eh01|V}5`!A}<|K;@s#p{6Ue8nltn==xht4Y87RvWg#$(_0h
z*ltQ`f*%RA<U(_n;+khbsz!vWyc2^G6D2F@R<FFncC1^fVG14*XDc1~uU?G&b~nM1
zu`Oaoqa;9-Hh2UI-tDmoxbvYdcAAKNM|o6v&IC(A*=s_kl8Hk%GC{`KHsacEJE*wx
z(d#i@ZDq~l^A(2$;UPr=Ys0^;#kG;OdVvrrjBwKXvu(;=FWnHVbQS#~#Fk<7^@1`T
zs{71Iy(~2JD`?9~g`4=SajN0>Yd}GF+m!;w&kBZScy@`jgdU=#M*OO#y!`wD)v})S
z83EsQYyyoIRqGwKnj4@LYJ@RS==BdgjKALgL2o@rwRKSfcYlv^w)jMOg)<FlCFH_T
zQ9+(ra8Ms_ZvvYCg3&GJj=<F3oJH$zEBCzBj8<?O^k!_qDVagMb>h<thJHd%hhu_$
zo+N_))7usl<5Y<<7(c&}JFC(r$R^cVLgVD;)-S{WqWkxB^{uSl*oDXg455zco6?J;
zvFmp^`OQr9^~r^0C?c`)n=5C3h@1A@1go8XsqWT$zIO%pSC6}>4q038HW|bjr!@()
zt>hWEhghSWFSoa@DB@Y@L85f`zF7W)5@$6K3|X);&EJcO#ijnuhELNa0)wz~cYM!U
zEjJHb)J5>bv~*=<1=sq0+!&et$Q2^Ar_87Z1}y@GOOf5kUk_O2pr~AUoo{aY9otf&
zUa_LjdlmMqbr9T<7@uKAxe?5_M}k(ayY27fn+5|91ies+e;KFS_l#)02Y0_sKuByt
zN0!W%B~%kDDS}mMBLetJFB1&8Mciw@3qK8uL++^<661%&n-kbdua>g0$NX|Bsa~wh
zl%&|<?f-8&RU7)EN)!3AZ0<0gK^HSNmN~!aG7)Bi!~|nr-yVWYW7YHO`E}v-dg!gz
z-s|dlhq|?!{zGf!6;b`7oF?3@u&Ai&0@C&|=ke;Fcfg>8lpwH8r5iC0mcdpst8`dr
zYio<&>pD}&^@7YC=Bq<0DcgQ1!)(6Euk<bBzZgtWSeidHJ$|m-3)8wER<0Yqr1Ln4
z-Ihwq5I^XdVASmjNcnvxJXX^878y>W+J|Uua=qqnE`0BM-U?=J;LDAe7&|I0k~;ts
ztKkPlG=>Pb-y!h9R8&;#r$0{(QeD)W%eA(gT3up8HM0-pWn^ULz!xU#v7Dg1>|~YE
zUw$RrWp;;2GV(fh@F=4k>^z^%H(50v_G(Q@9O_moRG~A0cKNk7oi5C#J68`7FniYK
zPeF105z|T`#oQLarrrMhsUm-0P~+a?o}br!t!6j6h&)LV5~|Z5DUnC4x*{&tN*@6d
zymH!G*B)hYk5ahTuM)qMtVO`+YKDdcOQ0AvNJ&P`H3FzvYcgZE-4p!l8VBJt4cll8
z!Ew4u)Z6O1vB)#%+56?~ADz!@z@ardSvrThznUg-!Axv7x?DKAw2`RIXlU4uDm6~S
zQ`9>a8y(LdzqY^%8|jOB0inuovclZpIF`-&gKG2RAMWII84J_X2&E)|<CBvYkD=BK
zMWT@lO&srvy{bS&2^rPo<bLGM4r1uKX=@F**wAq(vB-UQ!z;b@!XV4H!LX=QhRTg<
z!zuO?c|K!l{uWef^@B=<`_b=eo9U5V@epcO%<2%{P7nKBQ(8ex4{y2QKhTA(;h?c4
z#Mc+K_}Ch(q%y%v0o!VQs&W`!_=9gL24MVnQNAMgL2E8QinV@>f}=(G%tnKOUXQv=
z$2^`@PW4W9FH((Hb|_e=6Jiwc&3glDLArbI0U^1tb=qbZ=SGxkaZt2IWPDA<1o9ge
z7rbp!p<oS*&n^)bMs{=jFZNhn4-!7(N{tdEg#yKM$JFJyq$hIF@HOlWA%9k-33pnF
zR`GWpis0ta%!!LC*ads{TG<Rw%B;gb@Ydk3FfkeSI=pT)4ER0PrspDhYKp=yk|$FP
zCmQxi@BXwl3M473oYPc`Wm6u9X%e%t?9)M-Q<AOMq5Z3B&Zus^$r)0e{**cvhWKs4
z(o8*FQG*WAZO;R|*b`LcsGB@+-B%tz5dTDn5nBTRfIoS)z$p2>5rlZ7^<TN9nXGz(
zoSQznf61xKADb6=(g0VdHn;6A$2>LioNXw1^w!7Wks0;<AZOsKkB<+;DV#Y;lY_lU
zVRL$<A9_A>b|R8cwREJcrF2ldZlJS9*wR`pL4$@aP7p2Fq?5#vCE+eieKaPeu=6?U
z4u=EN4Nc>F<nEE0Hrpp66l4w49ROE@BF<1wIw(o?w4l#|R?o<Jx83q$qhTkP$KF@;
z)f2(!=6cVs@cjmSFjt6z-EF#7t;@i{5vPi>UKo=;bvcLI;yu(Z-ZC~KmDXZ#Qe39B
zEtxQbV24gdl^o<Ub^zX&<L&HVKUFV9ki&PCXc9%BjFcA?t>Z-xPr%KPl`OQFnMAdO
z&55-vym!TN`qh6wTr$Sr_4)k3fAj1Srt;MwZs0)+xUH$uZ+B>buUGQ9Z97S;csTtj
z7OPrS&7O%a+9gA0uz?}fnr;H2IirE~V}{?w`>Km?D9A9T$}f3VDzvxe7gQN-Ke0;0
zKz%w}MN-D$?VrSC9fkj7W{cBkymP~Mi-@8zOfLZus>D5|6m%N*VQNod!k=&8FQb#7
z|KDW7uLa?L+!y>GtRKT8Ye%4&as6cq&lm4Zj_9ze6q<o$!939Lj6GMCDUXy4E``|I
zNJy7mP2I<l1K^S2hgbyO{bg~sa5759e5zt+Q_1M3P>}g79i=4m(0mnL=Zut!C69Wu
z<DqO13m47Hrz6Ftg_j($j9S8=+%vOC>TmWhTZwL?*G44YXwdKTf4;rDbGM^UYqwo>
z>-9X_y}N8%;Cpq@rz{4@1<?zs0?0;T9AKz_STUEXxD4s2xF?PNVHE-n$Imc@W643i
zZk#&n<x#BAao}ZyGGnhzNSd~=;_={pAm?K;kFZ1r=%CY59uEQ(mEi6zBBLE(`yF>W
zx7w`b?{~|A84SiA_r<wf_G;r}wzkHLxqH7uk#f216Dw|fu-Js~jlLhJtL!s{$3?VK
zNOqUU5ljiJh9_f~Bd#HhMpe^oA|YbVv7r2yEgPKy-}s&F;Z?2+CBfv^kLH&oKo3sW
zZ;eVRDGbsQ{Wc-*KTE09^4yNw<wBX+*}obM`x3wL+ZiQkU{)+@t!ll!TvR#+$yi30
z+B?d#hhX|wBYSC4#9ph)u(toFx7Avf%o=Or$Bi<AuNIao_k(O1T?H%BXIJ#N84}mU
zIu**-&(sM(#7Qp}lwjh9Bah*1FffCk2Y&aG&tlZR7~^x^YPB2+d>0@|vS&7NBntk5
zSEob?Y)f(KZp20m%|*i5JXKBFiQ2e<m5|v7!x)d!%t^R>Ox<gvS|>FUHB;rj;IbO*
z(;RTdk^@o~V_QCrQq(M_tETB*`Wj!i8)yNCA@fSOS(%I2VXazqv(fPD&|Ludn)AOU
zzQDD%+N-$HKN~T5(&W=$M;=0xSA_R<BLHYl$FOPbJy@AJPh5Gl)5~hs^doGEDN&g!
z#i%*1hUFwGSmJTQkdI*!LdeJ@Ew}4bP`0gYQ{bF=jr$xFA<Xb24@h<TJR2k~TVC!j
zyw2Co<~WG@a=WFhpg>Iz2r98;^?6;a?q;px5xlVVVs*t#IxnnD0rg81w#>3OwXC0L
z$QeW<p(o+#6E1>iNN6P{`4N_;5++{Ko!evRlP8)Lnc~ZA1XuJwQi_Js3r9HCHXayH
zIE00j0f{mM=0;7P&nH<$9viyAgk#h(>AAdUo%3!7i+==~d@gK^RNwB^QkFST_sSv<
z0Ted!)GTSnZ>mt?VQ|QFn306oe{{5-o+%6_V<%LgA{sAtS*Z}A=_(X+InQ>wlwDmh
zLAwpZlKIv?l;#m>S8IaQ?)9zBLE$%Ky+}JdYD5|I-v$Aq+^BIuTQ!X-gKF^&wLg6@
zXAjXw024D7EB4{jF%xR7-%HR#FM3T~G@=+Wlcr`l4+yODQ}Xlcv+KzYx<R;BGMPDu
z*DzgGJW|;2cTFqG>)$ZkhpbV~Sn=p4wIj7S+SGK9VE>!5(GE`g%ZS0M(6Nw!zz}X2
zQ!imdO$rYMxq$Kt7mS{poozxG9L*l9kUzJJsmzsI%8*@whh-~MO3E<4!Vsz@u+d?+
z`@0QFAr_Vxp1jwUle_DvgqwEOyr!-T1iC0D3IsvNv)SQ|BH_TDB8jJ};M=4TWKSKL
zDzvFGND&CY;zsuhn52v*-l$8OVekl${YM(cGOFRC_Nz(Gt0i%Cl!rj7b4rGM`2!tk
zh7PZ!^%=I}xqbBQ{<&%1p!JCLPkU+rq1;>+tFoLTIQXa|t99kDxA7uWzW|0#Wj?RC
zrni0LTb^1oOgzr0)X4PU2_aJxiZy!<?RFg=Y^;!Z$ZRj-;2FLUwLlHTRc@tCiTved
z?`Svfx1pj82I9eaBwEf5TdEMKR;B1vO`AWAmK)AJN&WBoLUrG>PuI8rLJs72BEuK=
z^#8tx|9yRjL580K{d?k^Kl;^V@;i*F%i?Eb0Z=!5NisofqC6P`lEUJr)Z#yMO)uze
z8qMFK6($Bku444vdyAr10{<2N9(L0o#9?eE(se}pK~y~#V`cwvh~?ZgXT8p+A^|=`
z;?JnKWp)=V_Td!g`GoI0if5~|)zi@{@`LJJAo+KbGPCiYIGJCCAc1(X-a;PR1;RJO
zx}{oMhJOhWGMUBU+NbUGbC}=d!>{&XKx2(~re?d2!l4nc;@Vw$7kZg~tDV2Y+@#EC
z%w{NrA#>S(uX;?ipVJ2@j{W`M9v}S<2oXSEico>A2AJncgJlL|9HR8Fm`&g!hs<Sp
zUjwpGt;KzTwEBp4dTT(6XrT$QDcAKAX5w&yH}&XqboX$5UPpe_nqRXNk!6?UcY4>4
zyHVwD46x`c)#hi<gT`GI7<%fO*eMgS$f2-!K>D7lYfADFc(Rh!5o=O+*>06l6KfId
zrpQzP*z3TV?{Zuv-GPy|_r7JANd)obG1LSGKFq{=0p>HZlNqNHy#%^~#ST>_R{1}`
z>`IG7eJX1D$GulCDHdHxaA??EJ+2<4i2yGKT!L!Sl)OxIbcYk00Oj-#M0uNdShPDC
zI72?4(FHq(MSMxsbo=BVHrJy~@aOOVcFkj`=yi2%Ad?H(o>Q}22-cD$#z1rg3x1@m
z2-O1=gVn+&3KU@#<Z~u^%I{n!c@6{OUSqsekRgmR_Jnw2TYZ1(<n2hLA+zr-gB_+k
zIs<EbNviQXm-i1CoS*HC5}Wfn)tLHcne^Go%#^0Gg!*vUYmb&4P?}sa53`&@AQ$9c
zy|GNfRAwrHilxs0ar6}zEIK*_i6_W3l;Ye&<On4uQta@ZY>Djg2v$zTv<3Q!_)*M8
z?9n;c9EYP{tcmx;Rtn*J*<k(-WtW~`u;F5|DuNr<mu|^K`4R)!MY;Ca@M7(b?-aX=
zPV|k8(BabdjAA@c0u++5CfK}&>jw}jGRlzbX`4P_zM5(M#3A<8@;r3p!+S^FQj&`1
zu>-g7U+x_~C=@eISZG=ZJS4B;C~XD$m(1A5^sG@~2Q*4xxG5t-MpR4lu(ArZ`)FN@
zI+{G^5V{*X)QoRZF*zG83}=#Y-QCn61Xu&Y^gM7E+a_1Pkw54De6Zih*vzc7wj}~{
z6#egO*hF@6ciavyZv=aT>|8r})&*OvMqwFisA|KdPY9J7oLJ0^>ayc?{8PzjR}<78
zFMgpI3q_KlIt4*GA(hVr>c@xIMUdXBvXF+^u<8efMc4vVS+;dqWsSSVSBbXfVaRhk
zUxFM4CT`lC!WZvzfrg!uC>d#A!4#g4?kn{lh6f<cNxjoD@|)8U<Q8QWrKG5~n8~TR
zmezNWsUHLBszVC_8I|XUf8vAyy9ZIxe!GIvz9S(|wh{9|aWidQb07CI5SaMhMC*XN
zp{ID~Q|JAxd2}`RV@_gFeD0~Kf*VOsJvfIL@Wcm_kr)(?QafG7w3y!VkYoU$z=kPJ
zDYo}Hx?P0FjA#O<b!4WuJ&25b?$@d1GrtUm9FuyTb{?i#%&m;de|J4kwzI@G=!J{J
zP*7?*b=|4T{{|Nek^+9r001UFI%h+x+yUJ#RVFyR-T@R<$~$_C3FkT~Bo~{#;IJcH
zM}8N8V1{OH4q+JjowtCRK?KUem*TK+AAFrf6ao+R9B*sXv?!S40vC(!5#3G}5%@w?
zp~jI(_MeOI<dO2n<5x2(ZE@;I@eZBpg4@Bc>!<y?-PhH4b^i=-)mEu@pEZRPsc^R<
zAF;!PsSv9!gA6tDtl`?J#KWv@?JgHK(xD@ar<}#CanmAwcDZIDdL)80rbb)5S>rX;
z`2_cJD#}v$(b6c^efNL4t8mjIA>wy56wz?m&5LIP>U4YU;X=pTB4~hL-`Vlj4nskw
zu>B-Sr~iQZ7-X|1`aQ^)<D{pi+H5T{yi6E(r(`9T6G63w#6V>vwu@06yGh{8OrO=?
zj-AhKaZ4{ld9sj82uLa>rmL?e6e!;<k!M7kdn-{i-)PA<v{|9yKPW<6IY>uC<^PJ0
zB_bf0^2(VFvi`kP$$ODVHa_DM;&GODJvgqHNycg)v;K?^E)Mk`Rz52s0ci)={g|&n
zc$l8Zy*usv+JcAqL{h_tl>=vJPwyeYQ%5B$1!&x!AH4e9=%J%tK<0^Xxhb8{WHjLq
zi`OE4Ixx0EuKG^2+o0FY{-k1VI<Xs`P$GDH1~P4*ZpuxsJda{Ju@=5rA-)*1|9ZJ(
z<z?*eT>8m{Ct+wM#C(Go2Pwf%(IK$9zrbvrH8emRL3T@1I*`GD7YE5ogQ4skS6%!O
z{uYNH4yw{K=<jeyBnlyb+(DP9#0EL$ZoF(dJaL(%0|QBAh9C}U6gi}5?rHa1FUz!%
z$l+I<Acqbv?n~>=MRh%`S>Nz>jZ6)2a1Sz~P`3Z!lG}#?zGo|?Z4loE3VbG!2J$Cc
zKB4<-VzIN_sCoURMp=}>7)}a~rB*!~!BHqqMuk5PcLQMeZ<ShI-Tq{)r2bBI9?6Vk
z$szG?&+Fi7udmB`u@JMEINwL~Psj-(>SRRdcU28uiprJN<9JJ<M#nGR@4d;8MBNZ@
zU_pKn>izWhcdy4qWTmc@O2ys~uJ5?WpV?xv@aE7JrEX{qunAl!bk)9t@rg3tRnX6u
z7Y7+~iV=oeJsuhFk3#v2N{iQcgZZ@q4H_HuQB`{$2zA5Kn0hi%S>3Lv8vN&ep`=q3
z7$^f62$T1h`<+flB3>7h)k;OpJC&0?yo9jmUjG=wz<?V3+5B;!<`70PhG?m1QL+0E
z3o9#J{`>y~0f`j$j#}`ddSq?L`RJ^_CUmMp^a{0pUf<-XpEBwXX-licnC|zW^o#p-
z{@Li2LR4Jse&(I0)Uv^bts*03uT|rkBg|sk*=IaS6M-_AR|i0e43HE#0g@_DPEXH2
zhQIu-3qlu{A6Y0aagEK?D29#Ix4331B?*uji7o6LZP+@9W0cPlkrLst>p#VyAbtGP
zO~@&tu9>PyU0n!sx`iqcn`obcEkzL!U~yJJwum|AD$gJ;X<@x)*9p|bagb<Gl-r-?
zeaCGcSw$1wcw)8;pHgzwh~F6_(OP>N=)nq>{}{TYF&ZmJahM@SmnPC>l2sj-itWGb
zs-T5;W_}vb;#E*0sqmm;9``qX&w7=TP`{czA;PrZ4RDEv!?cK0A=pE|Mpc<LoWHA0
zwqjG4sL|et$b1bpz=AZ!qN|lnkD?>op|^8pBz-<(f3YdW`aoLOU8;*A*DR_-V$XTt
zNvw}bmWFvX4Q&iGeY8F_y+KexSJeD>IKb0R<oeUGC`ERf4es<T@>Csu_N8+fMQNCH
zltqVI7t*vV2F88NCeR5yskrb}?KN>b?<+*;w3toY41Ml584tNF3T_sRp5NB5K>0vg
z<|c9=R7j#PT{+dMR;m5b2~Sq~#{VR+22^AI3u%huFGlWNA(ycWxnPD<Kgt{vL5sJ7
zC!qo2M%Y?|2^JNUjz>Ir^SxWe5x$w(5RsRQ?7v`k@(x&3x~D&8Kf+flNv+3`CwGzN
z)GNca4b0+;H6!UBJ-=ZJ?}6_(T09&H>vBF2vR=rKk4GM39elf;^|;u$zuM`N%K(}}
zt<<<TnHgG6x44Bk4reZux}E^Pf=xSil^!m)pc9X&HlUYL*Vz9CW*LN=hb~!vxZ?D3
z10onHU+Hl{@Ud7}N8G8S1ekaVp&~${L<VXTy2R^2rC^=^6JKEt8pWGM^Y63s%Pq7K
z5wpx(e+=#AxwrGz>VOz#Yfj{~I`IsFh|z^;_vOqeFV>B@6GKi~?;eb3^!G_yU*J88
z=fCN98;eAV!({@_&FyyBZ|XY_tbd7fNG$!V)YKC_#z^k5t-<Y#8Cnul+-9<v3?jDQ
zg8IeORvNlc2Q2?A(PyZ~4xF^Ap1tXaOlL1Y2K-xRBu`cq!KhzmxROAH@EsODoA1(U
zGHNqBK|GgtJ*dd@+m%ug4VzY6^I#61NLSNR6)|%;pTA#!dQR#GS=TG9G61wh%bu;Z
zfPp82@_8F#^V2IDZt~c<Cbhd!nq`Ze5IH`vK)Yb(>ZIA!j+@@#Qxe$n?xSnFubTbq
z{C}DIXN5nW!~y?yoQE2Whdz2Q8ts>gLpq?+BMXx%Ho7y`V`#fEY}|dv&Q`0|`5Tn#
z<yz(FJ3s?kSGi3CFDrjuNm-G{G|CNvxkgYH5|$tLcIvbr_Xm2Lj0R4_2#TB!KC&FR
zpvDvAQDtG7Z5&JbL>Y7rP=sXVL{$!Hk(o}i4F5ZtAkx0Md$q+09zLsihUQ-*T<Meb
zP;Q*$QzKUi%tasjk3r=df+fUu008q5$)g<0WMh4-=FQ-wS08L~hf2V1F`L-{KAoQj
z0@pm=!_b6mmP;kOoc7ez)iskTy9p!In&m~N^=l0fKpl3Pq-<{+BVq8GtXC?`aR$;u
z>LsOW9JtgLCSQITgEgORY0}STlaZnzr^WgCWzGhv1i}EnhwigVqA%5<&T6|+@oPv$
zugM7fTHduU=za_c{a!DCq&<M!?kCl~A@A!U0MT1KH#Tw%F9(@Zv#ZJ+4DAcn1p);>
z&g35$_b`@hOX0nD^j<XaxG!C;)S%|8YrmyY+Ye`Y?LGw8SmKFXI$?;`Sg^HgV$Sr(
z7T3lMA{+GTpzYDwkAP9@Qz(k{3$`!Vl|cCJYP8!GJt_Gf4}8}7Ti#<Y_p_Nyv%Hxt
zfqRwnd0qFHTWy-NTH}f0(?4y>8%I4C>GX4fYU#n#kUg7Yk*EXDAAUD-N^-5jq(+xi
zy&8H4@#_|<+##&iO&7jON{O2nigI$LDeO5g<Xe0_P0HSG&$k)FoIY(LVYdRQBM}lR
z6&dQqAM)qKz1Q&yMJZ7tDTt_r?$!6BRTp?4DFqj@rV>=JD@|8AkEinI-!IOLMxYfm
zYPAcpDOKwJIF?^K!amdx)kSOdL5;4o=uNTB-rB4uYf`E#y^>mFK?zt7Ns0fRWhPo`
zw^i3YT%*4bxr}HwypnKX3wXIR?DJ%s3`ei2so~?}b3MsUm4!`{Gl;DEhNkXOAF({>
zm?xXIU#(iESMQ4@Rk|Y2xU<@TU+5z+D3?)BkphbaZ{c4d=K5b5T7qG}#a3V1fv`U#
zw8aIg^<r3Brg@sbv8Ql)82jokDY1~S$7Got@M}p^X2Whl+O%K>CR^914-UNX(&?Ps
zAFf0loE};r{r>Wq9I<K<-8eI|e|qYbk#sZLWaH4sO9BzkN9$9TyDWR(c3H7O#CkPC
zWF}6T+rZcO)Q&T$&+I&p&p_c3;WaY{2?JHl?7g#SY9>2ioVnmfr{kXQZ<e^B7vGH%
z@hFYj#IRa~nIQ=EF|CBQ>i8BHrZYgz+kCA!DWjg>xQs|@F0i$iOR@JQ)EA_ILy`h(
zfKE~EfG+dJWU&Y-@GH!krbXtbNvU=42k9~Cyu_=aoNypr2Cq8JscIuR`MZ3+ELfRe
z!;k)3t-JZVB4iNQUwWP`)el!X9SfBhHVJY-tQ=j9`SlQJn_Sy(z{n4`Wjcp8-AprV
z?YsWMY|;35_~1aVv8yTw&)D~5^I#*`iqKN0__*V(SwaAk?8%Mnq{?vX$eMZoris=@
zQYwBDhl6yebB`~>4NC%-0$2}U3k@izPo{8)QY@i{{l;iY9>m<^YvgK+P4S8NuQJ@!
z0J8WCiLJSRfD63#wX6ybimGgLwZS=kGFt9h0UP15{blGBF0z|(#=if0wz=%d^lIaX
zZ@de`PfY4VXLZNRRG7Y(=PagSVUYyg{XSvPnt!`%E9iSHE|b<L<??DR-qmOZ%+Jri
zzJUy-AFft)xnP!?&Gt3%)-HmKGVCsC0frTMC3ccBRL4LKEj~y?bggz;I+Zwu?r>@E
zy4_pt4J7AaM{8L;#=^sBX85(kuZHb_5hs`4P;DzQdSJ%F&98t;iT|X&{Hg~*p8;8(
zec^C7p}pD9PpVr4b?t5KK2da%4eC)3-?lpf?mIT|n2ms(O)DL=ut;DEEOb<2fxn={
zt8kT~Q^iBwy*zCK!Nc8is<Aj}MqX;2WYuJ5W%YwhAt-w7)!MVGmAd5`6C$cUU1(lG
zDx8H7dgO#TK1LORGK<6c;(qMTD>{}?IX7+U{aE;ZO0ah@TLOF2R9;ch6f7PTbO=O+
z#)DP{*8ucK6bZf?sCp-iBZI|E>%I&>_Fh$oRu!Vw)_iLB;Q7C}FYrkF#_uJcorNj*
zpU(F00Kdl*3u_KJK`E=QHuW#%v0GD70bLrxU3WP<vb2yXsQ(*OYjPPm$ztklSX?Qp
z=1(#*Scl%wm+m8;OjXE<h|$qXxHmDEg$VR~wLeS0Ltn3Z`plyqXrkjNmJrMtC9#Xe
zcQUW^It&KSyKG4V{r~<=iJzMr@bk2^sGK3GEwx*({YJPESgXChHf(C;665->`r}4N
zpq-~YvSr6qQw%B^9hwC?Vr^V1UPtMNSqN`MVcp--crr3X3wFmaqTT~i5o|b`JRZmW
zmZPSxsXXUc{|nrtx>}=TrQ;6Gf}dpJ?0;NDUuj5!+%Gofzc4{@aqci2p_a=w@R|?Q
zS)F@+Z$cvT$VV-P%YnPmf+PA9m0ntj#o7{8!m~vBN$4jw9(L(maCdaDd7Y5zPlWl*
z1&fg^O+5<f5lw45^100zgh84j@4Ma8d3@@rmDS1kZ+;*{uM-eR|9(%2v%qAsG~E^I
zD<$9bzZw+{zN3)}%~jV#a0!+D%!*^K)oV+v`9lUw{Urvm88Ukv5z&}0pA!owx;&WP
zsy<?LaxEOuQ>o(8A#G6uFvWkN#`AhN{n*`!M0-80W0BhD-W{v1v~9Br+Gz}kdaP2o
zhj;%eR&<GA#R$d8Bp9$ul(yY|^E7R)eEIG-w0SXbdR`Y~IC$4%U07>4KwoN-`ODM<
zNMAtVs=i*Vl?*$U*H(5?>j45|S3|3qwMJ+m!v;6gG5QEAxa+=6BwS~C=Dogq-3+{H
zz4ul@rXH7%Pm%b!&z~PS4LoZhZnv0kDGNNiPa*aBvj<pR62@eOCuSvDGVmHmHp4(r
z6LC8dx{f8hqQ05udZcgEs+vzut>*GLO98m6^&kIRz*BnuzfR7=t*QV0!$USnNkIuI
z2}d(PIweJhFj6T=nM?#6-5-z+sUe-CkrqLukx~#C6Hq#*gp3aNJ=gX74}O2ax!&h`
z&Uv2aoY#Ht|2ONsK}ewFeVaQ3eg<QsPoaJnM2;0t&W8S=q~P^WoVz7T>yH?Fq~UxT
z_AnVk9{Da6QW(alija)uiV*0IU_8=e6yt~hv&!Tc^R)pzr4Mf#TxK@P3jb+xR(>x9
zC^uE&^eV>s=TVZ9j<fS7mvWHPAvwL+<ykr2E>KoMiV6g63#R+>U_b(0Q~$G{DqJk|
zQg-=ktX+tTh?+g9CtJ3Pp4(^CP|n(-%tQcJWP6?;Rd{&P^5Ry|{l9V99WPdR1!?Q6
z6(1t<9-^YipE0Q+VL3c}-Sr1<E%M~mYr0Z5wOoJfUWd%4&p^Xp8+VRoIV&_j`QaPq
zEb3eBwP|D>W7`>+k1zh{mCFJXcx6Xste1R^EnxL1_A|K3<SWf~Q0CirvLU@W2rT@@
z)*FUTUS;V(L3Hi3E~^$8y;({s(BXbDNS*CK!0p;}EN02O%_XqCG38*Nu9YJkFXOFM
z?kPZHBiu+sM#e4g<#`ic@m=~~Sa4tMaJ0KR^QpP`jv5y_^`?+V@LtWCw#Qtf70EMa
zW-|+4SmD(Ef@xp~JR*47(#-yV$*4`<urr^GE8h24M$I+5``gkOIzIp68oxhNwXPH(
zvy)+AM|yt#+FRkV%=5>j{EoeL_ij)D-utI%fu(e2iah1E=S}&Sy^%l*y0aes{B}T>
zt%{Ig*5e|F#@{b9Yz%EKMi?S_mlHPEb}hYLEzeV(T?F&vUm)+W7qO>+7|N<)R%XUv
znHuYI?1bj+>Q@WG`3;JTT{6+;H1uhhjD~jKy_qUA8h(vIYWz$s0j-nAjtlhZYW6C7
zSO(*cM57z+my=6&KN%dqEW5r5>@)?iv%HZ?=(Fq=%7xT3`uIr&wx@KNZboC0rvQ+v
zX1|m%-gO#R_=snFx~LB$t#)RA&;ey(e*Pl}z$*=iU`?4G6XtJ!%t-_iQtZ03ztI$x
zHYLw>aM7Cxvbl`5*n9l1tlM~5(ZVaj;@%P!`O)3Xk+xE^_zv9@Ah=s)T4~aQ71d7D
z+I=?&A2*P&>O>AyD7|#Oshr&!a75rz3Fx}oU90)S=^7O|#jQG5Wif`XxvM+%W<l8<
zN5Gj1oJa<(6-DbLa>B)aAYxv7=^d{LvKyBjn%c5y3(E?>^|);E9MApxWTSvZyH)Vs
zlQ2ric|VBRj4%WIo7ChtA3{+K7*X-h044btcQsHfU@m_sVd{YX?c<qqzji_xOYyAD
z@8-(S4MRor))vt}<0LV4lAx1xWq`{Fy+R+=&+7n*WbEa?qu+S|FJ?r*R~vwZ(#y(R
zMW43PGS25Owz_;}|DG!I-AOcjZR>kUJgdZabZ2mfPlgFXFjNvnn5IwSQlSQa%HBNZ
zsOwlwVr+SV^K!8R$93Bplt1#7+}BAV=3cqwY^>M4Gm|>;;JKawwWg-!E-dxBBJ@6B
zbbhLuL)ELimt^c=q}}G9IC9L-sn>2?OZ>s&-~5D9xhpbZ{c<>@2jcU4rUl5RnwWy-
z43(U>g=(xi12FJgGqs57tg5$V<pA2{yAZtB;<<WFkwO!J5TWPr@dns@c;4~yiT5V(
z6@)P&`^!{UC`qbh4`taUF3{Te)I3hm(eP@&M3+0%M9?y9Nyn>LLZa|)&qFBm!F77B
zfW8~$xLW4g8{yck1L9Be=vzi79{HGvFIf{%YBHHcr<x~P2nKeF`(~1*%-4FsN>+wQ
zc}*CrG{|s}y@@Y5L)%|M9wpvCaLX5k|6J=HSBVvfTmm?RTHqu{MoNh$F?XE&Hg{E4
z7yXFw<6Rrqpe34=BUwtEyyUzNgf(A@j}=Xa&gq?<>eIJH7WX_B8V&30bUSvScp}+S
zvAE4bmSi2U*CRu|JBYrd8xV+4mIxiM`j5C+^~#;*t|GO=WAieN8%~-l9M)ET5cL%S
zry97U`5NX;L!6~aQn3N%+Z`p_?kMp)!u-aLz|`+HS=yj@P#C0rKVDG0{2xGp(Q$dL
zem|6XN5iZY^E4r<SbtS|V>}N57gI%!TmbJY7_7;8*vHH&fwHvZCHL9i=&73)+7;Y3
zbPh266dsnxQbih=^9QyJsO#naNH8UHF9_Ie!afG&E_3<uIKLXeL})s|#5*)Hw{=n?
zs`OWN<ZJ^Crvwvam23pxe0{xMEXCuRhdb?|_%b9nElmbO9(l{T>Hy<IBQUIb*@__Z
zPvTfaBC7i8+U$5V7AhTe#UgWxHwu|Y_C!0)usWti&k_v=O;K{ELviCtb!Y9Vppow{
z18Dh8vb$`~i{yo?LC`GG%HFwqv~g==gRZSW*djeWeFA&yOW#*5s@V@7$&qr^uzq`%
z^=9cP4PwoF{ogU2atu-UdyyiVkc(fjR#D@I2$>Y;<4T9M^OT^UqEVaLiSDEh1sS32
z%I9fX6%%b61HSpPudQ{Eqd}>9f707w2H{@j+hW~jF}a9qzuJ9vzVA#vWI<3jo5ZRN
zv-vCM_g)P$p+`nUJc~bSFXYQVvnMT7#^yUobXH73JPbLF-W?Pno=)oe>qeN_07)ht
zr;o;&w6b$EpAMf*o*p<hW8pGzc}#23BZhPavL(GX2jAu<`U%e{D+e=urDfQ?U-(4M
zUv$JY1xijga%%pS!58mCh({QJcZ_*!FH*hw@E{ww?fsIkUkUiNkL2)DhkTng9HHup
z{mg9uA@pFk=xkGekCyWAWa%E9xT5k#ea8&=W^a;%vudWpa*J!|G*MVaVS8GQ4`~XX
z4^t3&o3e@vUHk<z_l|p`%uwoU5ybd*AGY8{mCX<CWX3zY*7rwfzyZgEChtw#5#?T4
z<1@`>k42Y_gyd1^b%%8xv_LecTxtxvrc63p0WE|vdk9Z|72tPtNd50uZ14M&oyj@|
zlecB?RB82zUu7oeP*8aa*5dbTQe%*L=jkYg1+1c`gn|9;`%jm>85Xq7@O|cb*m6JB
zS>WCx#%C{&TauIXMsp9uNZbesoKY~eJmYk0XzydL_lZfML~0A&W=UtFFNfyO-J03{
z%P-R@KKc}ajiQ1>SeShO>zS$C;u`V_8+PCu*y)svAD^7~%1x*B)2}aOeU#M>J)l0t
zhuCfw%C4TK##LMR0;ig9K{;-n5h$WUJn`RvYtA3$3O@PxtLY2(eP)D7p)w74Ni<0k
zT>~0E7r97|I$szVz6=|-R3~#{WaSWGKOFcEaS(oo%5+EB#Y#P%ry*jOy!s&H05#O!
zmVWqq>H=uq?!d#m<LWuS15O)5H=SNQpKAc(GsX{%)UFN*xa!K@aN~-AgRVYHY-TA^
zSE>UUIo51(X5I~EXCKBTyDK)j1UT$w^1m%-6n4UCiR9d@QFezMA`;N|x(){DYxZve
z@(zo#bMI&TLPGF7#g8@}tz0G(7CtKj89+Yv0XdeAPSk6>eR7iO+hnY`hMptSyKcQm
zLbF>{aUo-BA?~?N$2^;r(uOPQqDpfqMzpa<1CUi9<{7GHg_&F?`bCR&zJcg^b_H95
zm|)aU5wZ$DZXOn8sMPWtFa8F%&x@V879RPuG$H6HFYE3!&F4bncl)H2eqlyWj!-tq
zNql+j`8_FbZ`fC+A<B$j0hPl}*O;30k3P7dF8-9OO%a)CJ<M<h(NfW#5VF}9%x1AJ
zJvUZsq~Qg}J?R1H-;IUkBz~vLRV~u}!N!tftZFH<a#rW+W_RX$;r$X?a$1>h;ONM8
zC1oS{S+FZMxrtw$9-}Z?RYj4(Po}0RJFmNT1h4j<NA=aUAH)Hat-Stp1+yVZaga}=
zJ{25Tw4@N~;*mohm?@Ad(=(KPHT>c8Cm3_JL0-JcGs@ZWxz5K`!)(;HQVMSUs6HLq
z4q2%l-w0_fBiOmGR3`C{K(=j$iYq6rj@PwlJom*;@Qva6TOrm*A9NolQX{6Ara@Cf
zB`;BV#*&BK-QiaSp}VsHE$SH}tVcqO1U8h)t6Lt^XQ=x2#OP>2jE-8(I;Qjf{_B_R
zxZ$KfrYz!|nLSZ~bLP<t;F0`ygn8fQ#bfEbg6k$B%Y+mD*(8(=kzG)iv(h-LGx@J<
zuew~a+e0VsO3?Iz=wpxMzd@*@r|9Md3+~phShJLd*4`|Kc&G{qxt`<)t8>;T5=5Ag
znE6M?_@q1Q-P4zQQ(c)2d?`zB%>3>$MLADDZ@he&TT5Lc?+Ag)mO0e2<H)obtsF+S
z!!%_)=EgdGNPILEPJph=KAR2_fXg6{l8gggTJG?J0;~g|T6M%bLQJlra%2#%`Tb>m
zeSOGCS}}*6K;#w>TT3M1RvoG+0kv67zG;(A%To`o5y%Hbq8`IVTt70CFM;Aq5>|%a
zoWr8E7civpf+K&T@jGJQUbt+9RELNwX7XP1>OB(T3U0HSYJwj=GV(e1^<Rh=q_E1^
zqaVBcL!`$Bw>gjA$7wuxwM_IsKl$xF{>xWRwaGY0iPZoQuW3zU#8dvvbq21#?{ao>
znyv*XuL~c5dNvj#nM$=XtBj^)0}i%W>)F${$lLvWUk4EXCu7_DM0s-&xn3^ss9o50
yY#Q?awX<!VN@v!KXb(UMubIUDkSIVP5^2BoQ+hjPmmi>}1L<qSwdyqOBmM^*QE8F@

literal 0
HcmV?d00001


From 7059d7b9437c59a352220c27be65888211f1014b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 2 Jan 2026 18:59:40 +0000
Subject: [PATCH 41/41] Initial plan