phase: 135_git_source_branch

All verification complete. No edits were needed by this pass — the phase work and docs were already consistent and green.

**Phase 135 final verification pass — report**

- Verified all 5 tasks' work present & correct: migration 0024 (reversible), `GitSource.branch` + 4 schema shapes, `validate_branch_name` (full check order per design), `clone_or_pull(…, branch)` (HEAD guard first, `--branch` clone, fetch+ff merge), both call sites pass `row.branch`, UI (add-form field, editor field, row tag), `file://` URL transport.
- Completion criteria: (1) branch-mirrored through Sync + CLI — **pass** (E2E + integration); (2) `branch=None` byte-identical — **pass** (`test_branch_none_argv_is_byte_identical_pre_phase_sequence` green); (3) fixed 422s / local-row 422 / tri-state — **pass**; (4) mismatch fails loudly with remove-and-re-add — **pass** (E2E); (5) coverage 99% >90%, E2E isolated green — **pass**; (6) no regressions — **pass**.
- Tests: `uv run pytest --cov=app --cov-report=term-missing` → 3223 passed, app/ 99%; `uv run pytest tests/e2e/test_git_source_branch.py -v --no-cov` → 4 passed (16.4 s); `uv run ruff check .` clean; `uv run pyright` → 0 errors, 0 warnings.
- Documentation: README.md reviewed in full — phase-135 branch section accurate; the phase's README diff also correctly fixed a pre-existing stale line (shallow `--depth 1` clone vs full-history, phase 107). Routes, env defaults, feature lists verified against code. AGENTS.md — all 10 rules + quick-reference verified (referenced tests, PLAN.md, phases dirs, commands all accurate). **Verified consistent — no changes needed.**
- No live-infrastructure changes (dev DB already running and healthy; no live steps in this phase).
- Next pending phase: `.agents/phases/todo/136_force_push_reset`.

alembic/versions/0024_git_source_branch.py

@@ -0,0 +1,45 @@
+"""git_sources.branch: per-source branch to mirror (phase 135, task 01)
+
+Revision ID: 0024
+Revises: 0023
+Create Date: 2026-09-27
+
+Phase 135 (a git source can pin the branch it mirrors — task 01, storage
+only):
+
+* ``git_sources.branch`` — TEXT NULLABLE, no server default: the branch
+  the owner specifies for a git source (TODO-derived phase). NULL =
+  the repo's DEFAULT branch — every pre-phase-135 row and every
+  env-fallback synthetic row is a default-branch source by definition,
+  so no row is touched and no backfill runs. A non-NULL value is
+  validated at the API boundary
+  (``app.rag.git_sources.validate_branch_name`` — task 02); the column
+  itself is plain ``Text`` (the ``git_sources.token`` (0021)
+  precedent: the column stores, the boundary validates).
+
+One additive, fully reversible migration (A13); no other schema
+change. The branch-aware clone/pull wiring (``clone_or_pull(…, branch)``
+— task 03) and the API tri-state (task 02) are code — this revision
+only carries the column.
+"""
+from __future__ import annotations
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "0024"
+down_revision = "0023"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("git_sources", sa.Column("branch", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    # The branch column is the only 0024 artefact — dropping it leaves
+    # 0023's schema byte-identical (A13, fully reversible). NULL =
+    # default branch, so no data migration in either direction.
+    op.drop_column("git_sources", "branch")