content-ingestion-agent/.agents/plans/wf-decompose-b4be4be4fd0c/steps/step-1.md

Step 1 — Implementation Detail

1. Validate owner and repository scope before source access.
2. Resolve the configured token through SecretStore using secret_ref.
3. List the configured Git tree recursively and filter by paths and allowed extensions.
4. Fetch selected files and normalize title, content, MIME type, hash, provenance, and ACL metadata.
5. Implement incremental changed-file retrieval and cursor advancement.
6. Map GitHub webhook payloads into revisioned Change records with event IDs.
7. Add full-ingestion and scope-validation tests.