FM-403: the Git source adapter and GitHub bootstrap

Cargo.toml

@@ -19,6 +19,7 @@ members = [
     "crates/providers/fleet-provider-tailscale",
     "crates/providers/fleet-provider-docker",
     "crates/providers/fleet-provider-proxmox",
+    "crates/providers/fleet-provider-git",
     "crates/providers/fleet-provider-github",
     "crates/providers/fleet-provider-skills-manager",
     "crates/providers/fleet-provider-frogenv",

crates/fleet-application/src/authz.rs

@@ -123,6 +123,12 @@ pub enum Permission {
     /// Execute an authorized apply plan on a machine. A mutation: it
     /// composes every mutation the plan may run.
     ApplyExecute,
+    /// Fetch and inspect candidates from the desired-state Git source. A
+    /// read, but a topology-revealing one.
+    SourceFetch,
+    /// Activate a validated candidate as the desired revision. A
+    /// mutation: it changes what Fleet converges machines toward.
+    SourceActivate,
 }
 
 impl Permission {
@@ -164,6 +170,8 @@ impl Permission {
         Permission::MiseOperate,
         Permission::ProjectsReady,
         Permission::ApplyExecute,
+        Permission::SourceFetch,
+        Permission::SourceActivate,
     ];
 
     /// The stable action id, as recorded in decisions and audit events.
@@ -204,6 +212,8 @@ impl Permission {
             Permission::MiseOperate => "mise.operate",
             Permission::ProjectsReady => "projects.ready",
             Permission::ApplyExecute => "apply.execute",
+            Permission::SourceFetch => "source.fetch",
+            Permission::SourceActivate => "source.activate",
         }
     }
 
@@ -246,7 +256,9 @@ impl Permission {
             | Permission::ToolsRead
             | Permission::MiseOperate
             | Permission::ProjectsReady
-            | Permission::ApplyExecute => true,
+            | Permission::ApplyExecute
+            | Permission::SourceFetch
+            | Permission::SourceActivate => true,
         }
     }
 
@@ -267,7 +279,9 @@ impl Permission {
             | Permission::TailnetRead
             | Permission::TailnetConfig
             | Permission::ProjectsRead
-            | Permission::ProjectsCreate => false,
+            | Permission::ProjectsCreate
+            | Permission::SourceFetch
+            | Permission::SourceActivate => false,
             Permission::MachineReadSensitive
             | Permission::OperationCancel
             | Permission::SecretRead

crates/fleet-application/src/lib.rs

@@ -16,5 +16,6 @@ pub mod operation;
 pub mod planner;
 pub mod project;
 pub mod ready;
+pub mod source;
 pub mod tailnet;
 pub mod worker;

crates/fleet-application/src/operation.rs

@@ -41,8 +41,9 @@ use crate::authz::{AccessRequest, Authorizer, Decision, Permission, ReasonId, au
 /// (FM-304); the ready workflow carries the machine-scoped shape plus
 /// `projectId` and `dryRun` (FM-305); the apply workflow carries the
 /// machine-scoped shape plus the plan and its approval identities
-/// (FM-402).
-pub const CREATABLE_KINDS: [&str; 29] = [
+/// (FM-402); the source kinds carry the remote/commit payloads and are
+/// catalog-level (FM-403).
+pub const CREATABLE_KINDS: [&str; 31] = [
     "noop",
     "ssh.exec",
     "agentless.inventory",
@@ -72,6 +73,8 @@ pub const CREATABLE_KINDS: [&str; 29] = [
     "mise.exec",
     "ready.workflow",
     "apply.workflow",
+    "source.fetch",
+    "source.activate",
 ];
 
 /// The machine-scoped permission a kind's creation requires, when any.
@@ -80,6 +83,16 @@ pub const CREATABLE_KINDS: [&str; 29] = [
 /// governs both the dedicated endpoint and the generic one.
 #[must_use]
 fn machine_scoped_kind_permission(kind: &str, payload: Option<&str>) -> Option<Permission> {
+    // The source kinds are catalog-level: their permission is enforced
+    // here with `resource: None`, never a machine id.
+    match kind {
+        "source.fetch" => Some(Permission::SourceFetch),
+        "source.activate" => Some(Permission::SourceActivate),
+        _ => machine_scoped_kind_permission_inner(kind, payload),
+    }
+}
+
+fn machine_scoped_kind_permission_inner(kind: &str, payload: Option<&str>) -> Option<Permission> {
     match kind {
         "projects.discover" => Some(Permission::ProjectsDiscover),
         "projects.clone" | "projects.pull" | "projects.status" => {
@@ -109,6 +122,7 @@ fn machine_scoped_kind_permission(kind: &str, payload: Option<&str>) -> Option<P
         "mise.install" | "mise.exec" => Some(Permission::MiseOperate),
         "ready.workflow" => Some(Permission::ProjectsReady),
         "apply.workflow" => Some(Permission::ApplyExecute),
+
         _ => None,
     }
 }