Remove the App's brain build for assign

[anirudhkumar-nanonets]

Moves: none of the project's metrics. This is cleanup: trail no longer depends on the assign repo or its Agents platform (decided 15 Oct), and this route was the last code that did.

What changes

The GitHub App server had a second job: reading a repository into a Trail brain for assign's "paste a repo URL" onboarding. POST /brain/access said whether the App could see a repo, and POST /brain/build cloned it, built a digest of commits, PR discussion and symbols, and posted it to the Agents platform (agents.nanonets.com by default). Both are removed, along with everything only they used:

• src/app/brain-build.ts, brain-build-process.ts, brain-build-worker.ts, history.ts and sources.ts
• in server.ts: the two routes, their test seams, the bearer-secret check, and the brainBuildSecret, brainBaseUrl, publicToken and publicOwner config
• in main.ts: the GRAFT_BRAIN_BUILD_SECRET, GRAFT_BRAIN_URL, GRAFT_PUBLIC_GITHUB_TOKEN and GRAFT_PUBLIC_INSTALLATION_OWNER settings
• in identity.ts: installationFor, publicReadInstallation, repoAccessGap and ghHeaders
• in checkout.ts: checkoutRepository, the plain-repo clone. The pull-request checkout is untouched.
• in docs/github-app.md: the "Reading a repository into a Trail brain" section, its settings table, and the security note about it

PR review, the review pages and /healthz don't change. The trail CLI isn't touched: it already talks to nothing in assign. GRAFT_BRAIN_URL is still read by the CLI's src/cloud/workspace.ts, as an old alias for TRAIL_URL, which is a separate setting from the App's.

Deploying

Nothing changes on the running App until it's redeployed. After a redeploy, /brain/build and /brain/access answer 404, so anything in assign that still calls them gets a 404 instead of a digest. The four settings above can then come out of the box's environment. No other config change is needed.

Tests

• Removed: app-brain-build-process and app-sources-context, which only covered the removed code.
• Full suite: 1,394 pass, 0 fail, 1 skipped.

🤖 Generated with Claude Code

[trailhq-graft]

🌱 graft blast radius

1 area changed → 1 area can be affected. 3 dependent symbols, depth 2.
Tests: handle has tests the diff did not touch.
Tag: @shhdwi — Review Process

flowchart TB
  A0(("Review Process<br/>3 symbols"))
  classDef reached fill:#D9EDF3,stroke:#3AA7C9,stroke-width:1.5px,color:#0E313C;
  class A0 reached;

Loading

Can be affected	Symbols	Nearest hop	Reached from
Review Process	3	src/app/review-worker.ts:L1-L110 review-worker.ts — imports, depth 1	handle

Who knows this code — 1 person across 2 areas

Area	Who knows it
Review Process · affected	@shhdwi — 1 commit, last yesterday
handle · changed	only you — nobody else has touched these files

Ownership is git history over each area's own files, weighted towards recent work (120-day half-life). Merge commits and bots are dropped, and you are dropped from your own PR. A name with no @ has no GitHub handle in its commit email — tag them by hand, or add a .mailmap entry. A suggestion from history, not a CODEOWNERS rule.

All 3 dependent symbols, grouped by area

Review Process — 3 symbols in 3 files

• src/app/review-worker.ts:L1-L110 — review-worker.ts (imports, depth 1)
  21: import type { Fetch } from "./identity.js";
• src/app/review.ts:L1-L174 — review.ts (imports, depth 1)
  17: import { checkoutPullRequest, redact } from "./checkout.js";
• src/app/review-process.ts:L1-L270 — review-process.ts (imports, depth 2)
  177: * every existing test that injects its own reviewer through `AppSeams.review` keeps

Test signal per changed area — 1 ⚠

Reached = a node under a test path has a resolved edge into the changed symbol. It undercounts anything called indirectly — through a CLI, a spawned process or a dynamic import — so read a low ratio as “look here”, never as a coverage gate.

• ⚠ handle — 0 of 1 reached · 2 test files reach it, none changed here
  • not reached: handle

4 test suites also reference this code

7 symbols, kept out of the diagram and the table so they cannot crowd out the areas a reviewer has to look at.

• test/app-checkout.test.ts
• test/app-identity.test.ts
• test/app-review-process.test.ts
• test/app-server.test.ts

⚠️ 7 deleted files (src/app/brain-build-process.ts, src/app/brain-build-worker.ts, src/app/brain-build.ts, src/app/history.ts, src/app/sources.ts) — their dependents cannot be computed from a graph built at this commit, since the files are gone from it.
⚠️ 2 changed files not in the graph (.github/workflows/codeql.yml, docs/github-app.md) — no parser claims the extension, or the index predates the file.

_{graft blast · origin/main...HEAD · depth 2 · 13 changed files}

Open the interactive graph → — click an area to see its dependent symbols at file:line.