0.8.0

gitd 0.8.0: what platforms ask for before they hand repositories to agents — GitHub
connected without a file, publishing rules and pull requests from a bot, what each agent
changed, workspaces with their dependencies ready, and OpenHands working on it with no
token in its sandbox.

GitHub, without editing a file

• Connections through the API (ConnectionService): the organisation's own GitHub App,
  created from a manifest in one click; signing in with gitd's public App by device flow; a
  platform's App; or a token. Kept under gitd's state, readable only by its user, encrypted
  with secrets_key_file when set, applied without a restart. gitd connect github,
  gitd connect github-app, gitd connections.
• Tokens per repository and purpose: an App's installation token reads, writes or
  opens pull requests on one repository, for an hour, kept in memory only.

Publishing rules and pull requests

• Publishing settings per prefix (PublishingService): protected and kept paths, at
  most N files, a branch prefix, presets as data (recommended protects the CI, CODEOWNERS
  and .gitmodules, keeps tests). Checked in the pool commit by commit before any push,
  merges counted for what they bring; POLICY_REFUSED otherwise. gitd publishing.
• Pull requests opened from the App's bot after the push: a draft and labelled as the
  settings say, the person who asked for the work asked to review, its body saying what gitd
  checked. End to end against GitHub on every push.
• Provenance: a publish says which agent, model, session and task did the work, kept in
  the audit log and written in the pull request, never in a commit.

What agents changed

• Changes, Diff, Compare (two workspaces or branches), Conflicts (pair by pair,
  git merge-tree in the pool) and Watch (events as they happen). On an overlay workspace
  the changes are read from the agent's own layer, with no git in the workspace: one file
  changed in kubernetes read in 0.012 s, against 0.130 s for git status.
• MCP: list_changes and show_diff, for an agent to review its own work.

Dependencies ready: warm layers

• gitd seal PATH NAME turns a workspace where the platform installed dependencies into a
  warm layer; gitd prepare --warm NAME stacks it between the template and the new
  workspace's own layer. Ten workspaces of socket.io in 0.17 s each with its 561 MB of
  node_modules, 1.9 MB in all plus the layer once, against 28 s and 561 MB each with
  npm ci; npm reads the same tree in both. gitd never runs the install, never carries the
  sealed workspace's .git, and refuses to seal while a sandbox still mounts it.

OpenHands

• examples/openhands: OpenHands' own agent works in a workspace gitd made, in a sandbox
  with no credential and no network, and gitd publishes its commit as a pull request from a
  GitHub App's bot. The same agent taken over by a prompt injection finds no token, cannot
  push, and its commit adding a workflow is refused before anything is pushed. Both run in
  CI on every push.

Upgrading

The contract only grew (buf breaking against 0.7.0). Clients: pip install gitd==0.8.0,
npm install gitd-client@0.8.0. Overlay workspaces on a warm layer need the gitd-mount of
this release, which takes two lower layers; an older one refuses them.