phase: 145_git_source_links

**Phase 145 final verification pass — all green, no code changes needed**

- **Verified (no defects found):** resolver `origin_for_source` + `_url_basename` (scp/`.git`/trailing-slash, sanitize, ambiguity WARNING); `origin:`/`branch:` lines in all four read shapes via shared `_origin_lines`; HIGH `<tools>` origin rule (verbatim + only-byte-change pins); `DocContent.origin_url/origin_branch` (absent-never-null serializer); `renderDocument` "Original" anchor (copyable verbatim URL, `_blank`/`noopener`, branch in title); mock scripted origin-link flow (disjoint trigger — grep-verified vs all other E2E files)
- **Tests:** `uv run pytest --cov=app --cov-report=term-missing` → 3402 passed, `app/` coverage **99%** (>90% gate); `uv run pytest tests/e2e/test_git_source_links.py -v --no-cov` → **4 passed** in isolation; `uv run ruff check .` → clean; `uv run pyright` → 0 errors, 0 warnings
- **Completion criteria:** (1) git read results carry origin/branch, local byte-identical — ✅ (unit pins + E2E control); (2) HIGH `<tools>` rule pinned, LOW byte-identical — ✅; (3) modal AND /document.html show Original link, branch in label when pinned, nothing for local — ✅; (4) full suite green + coverage + E2E + lint/types — ✅; (5) no completed-phase behavior change (read header line 1, mock prefix, done frame/SourceRef untouched, LOW sha) — ✅
- **Extra regression check:** re-ran shared-mock E2E suites `test_read_line_ranges.py` (2 passed) and `test_document_viewer.py` (8 passed) — no cross-suite regressions from the `mock_llm.py` addition
- **Documentation:** README.md reviewed in full (env table ⊇ `.env.example`, pages/routes, config defaults, scripts, 17-color palette, 300 s guard, 2 s sync poll, phase-145 provenance section matches implementation) and AGENTS.md (72rem container, no-CDN test, smoke test, gitignore, gates) — **verified consistent, no changes needed**
- **Notable:** phase-116 screenshot PNG was regenerated during this phase's E2E runs (byte re-encode only, visually identical, correct no-anchor local-source meta row) — left in tree for the harness commit
- **Next pending phase:** `146_search_tool_scope` (then 147, 148, 149)

app/api/docs.py

@@ -69,6 +69,7 @@ from app.models import Chunk, Document, FolderSummary
 from app.rag.agent import list_source_names
 from app.rag.doc_dates import normalize_doc_date
 from app.rag.folder_summaries import MIN_DOCS_PER_FOLDER, folder_of
+from app.rag.git_sources import origin_for_source
 from app.rag.importer import match_extension
 from app.rag.llm import EmbeddingError, LLMClient
 from app.rag.summarizer import IMAGE_FALLBACK_MIME, IMAGE_MIMES
@@ -181,6 +182,16 @@ def get_document_content(
     documents and a signed-in user (admin or token holder) opens a cited
     document by direct URL. The ONLY anonymous content left is the
     shared chats.
+
+    Phase 145 (task 03): the payload carries the document's git origin
+    when one resolves — ``origin_url`` (the sanitized repository URL)
+    + ``origin_branch`` (only when the row pins one), computed by the
+    SAME :func:`app.rag.git_sources.origin_for_source` resolver the
+    agent's read branch uses (one mapping for the whole app: the
+    source's directory basename → the ``kind='git'`` row whose URL
+    basename matches). ``None`` — a non-git source, no row, or an
+    ambiguous basename — keeps the payload byte-identical to pre-phase
+    (both fields are dropped by the serializer, never ``null``).
     """
     row = db.execute(
         select(Document, func.count(Chunk.id).label("chunks"))
@@ -191,6 +202,11 @@ def get_document_content(
     if row is None:
         raise HTTPException(status_code=404, detail="document not found")
     doc, chunks = row
+    # Phase 145 (task 03): the document's git origin — the SAME resolver
+    # the read branch uses (one mapping for the whole app). ``None``
+    # (non-git source, no row, ambiguous basename) → both fields are
+    # dropped on serialization, never ``null``.
+    origin = origin_for_source(db, doc.source)
     # Phase 122 (task 04): the image affordance — ``is_image`` is ALWAYS
     # present on the wire (text docs: false — the one new key); for an
     # image doc, ``image_url`` is the bytes route's path (absent for
@@ -210,6 +226,8 @@ def get_document_content(
         image_url=(
             f"/api/documents/{doc.id}/image" if doc.is_image and doc.image_path else None
         ),
+        origin_url=origin[0] if origin else None,
+        origin_branch=origin[1] if origin else None,
     )