openapi: 3.2.0
info:
  title: HiveMorph v0.1 Github App API
  description: 'Polymorphic agent runtime — single shape (Merchant), single supermodel (W2 MERCHANT). Three gates: NEED + YIELD + CLEAN-MONEY.'
  version: 0.1.0
tags:
- name: github-app
paths:
  /v1/github/health:
    get:
      tags:
      - github-app
      summary: Health
      operationId: health_v1_github_health_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Health V1 Github Health Get
  /v1/github/sign-diff:
    post:
      tags:
      - github-app
      summary: Sign Diff Route
      description: 'Manual signing API — no GitHub App install needed.


        Useful for CI pipelines that want to PQ-sign the PR diff and post the

        receipt URL into their own checks/status. Rate-limited on the underlying

        /v1/receipt/free path semantics already.'
      operationId: sign_diff_route_v1_github_sign_diff_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SignDiffRequest'
        required: true
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Sign Diff Route V1 Github Sign Diff Post
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/github/webhook:
    post:
      tags:
      - github-app
      summary: Github Webhook
      description: 'GitHub App webhook receiver.


        Currently handles `pull_request` events with action in {opened, synchronize,

        reopened}. We verify the X-Hub-Signature-256 header, extract the PR diff

        URL, sign the diff via the swarm receipt issuer, and (in v0.1) return the

        comment payload. v0.2 will POST the comment to the PR via the GitHub API

        using an installation access token.'
      operationId: github_webhook_v1_github_webhook_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                additionalProperties: true
                type: object
                title: Response Github Webhook V1 Github Webhook Post
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    SignDiffRequest:
      properties:
        repo:
          type: string
          maxLength: 120
          minLength: 3
          title: Repo
          description: owner/repo, e.g. 'srotzin/hivemorph'
        pr_number:
          type: integer
          minimum: 0.0
          title: Pr Number
          description: 0 if signing a non-PR diff
        diff:
          type: string
          maxLength: 200000
          minLength: 1
          title: Diff
          description: The unified diff content (max 200k chars)
        base_sha:
          anyOf:
          - type: string
            maxLength: 64
          - type: 'null'
          title: Base Sha
          description: Base commit sha
        head_sha:
          anyOf:
          - type: string
            maxLength: 64
          - type: 'null'
          title: Head Sha
          description: Head commit sha
      type: object
      required:
      - repo
      - pr_number
      - diff
      title: SignDiffRequest