[node-maintenance-repair/1] Receive a signed webhook and read the installed repository

.github/workflows/validate.yml

@@ -7,6 +7,27 @@ name: Validate shared GitHub Actions
 permissions:
   contents: read
 jobs:
+  repair-app:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      WRANGLER_SEND_METRICS: 'false'
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      with:
+        node-version: '24'
+        check-latest: true
+    - run: npm ci --ignore-scripts --no-fund
+      working-directory: repair-app
+    - run: npm test
+      working-directory: repair-app
+    - run: npm run test:runtime
+      working-directory: repair-app
+    - run: npm run check
+      working-directory: repair-app
   test:
     runs-on: ubuntu-latest
     steps:

docs/node-maintenance-operator.md

@@ -0,0 +1,38 @@
+# Maintenance service: checks and recovery
+
+This reference is for ongoing maintenance of the shared GitHub App and Cloudflare
+service. Repository maintainers install the shared App; they do not host it.
+
+The receiver verifies signed webhook deliveries and reads canonical repository
+metadata with a Contents-read token restricted to one repository. Check actions,
+dispatch, storage and dependency repairs belong to later slices.
+
+## Check the receiver locally
+
+Use Node 24 and run these commands from `repair-app/`:
+
+```sh
+npm ci --ignore-scripts --no-fund
+npm test
+npm run test:runtime
+npm run check
+```
+
+The unit suite reports coverage for the receiver. The runtime test executes it
+in local Cloudflare Workers with synthetic credentials and intercepted GitHub
+requests. The final command bundles the preview with `--dry-run`; it does not
+deploy. The CI job runs the same checks without App or Cloudflare credentials.
+
+## Stop deliveries or recover
+
+Disable the App webhook or uninstall the affected installation to stop new
+deliveries. Restore a previous approved Worker version when one exists. This
+receiver slice has no request database, dispatched runs or repository writes.
+
+Webhook processing shares an eight-second budget across input and GitHub reads.
+Timed-out requests fail without an automatic retry. After recovery, redeliver
+failed deliveries through the GitHub App's webhook delivery controls.
+
+Keep App credentials in operator storage and Worker secrets. Keep verification
+receipts outside the repository, without credentials or webhook payloads. A
+local test or dry-run bundle does not replace live delivery evidence.

repair-app/.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+.wrangler/
+.dev.vars*
+.env*
+npm-debug.log*