feat(atlas): surface the user's own Gitea repos on stage 05 (#10)

Adds the repos panel from #4's "Not yet shipped" list, following the shipped
issues slice (b2761a4) structurally rather than inventing a second approach:

- internal/atlas/repos.go — RepoNodes(), a pure parser over an already-decoded
  /user/repos response. Archived repos are dropped: the atlas shows where work
  happens, and an archived repo is by definition somewhere it does not.
- internal/gitea/client.go — MyRepos(), same PAT and same contract as MyIssues:
  errors when GITEA_TOKEN is unset so the caller skips the overlay rather than
  issuing an unauthenticated request. That unset path is the one running in
  prod today (#4), so it is tested, not assumed.
- internal/web/handler.go — wired into liveOverlay().

Stage 05 is the right home — repos are what the execution stage acts on — but
#11 had just claimed its `generate` key for stuck-badges, and a stage could
only name one source. So `generate` now accepts either spelling:

    "generate": "ci-jobs"
    "generate": ["stuck-badges", "gitea-repos"]

The bare string stays valid and marshals back as a bare string, so no authored
stage is rewritten and the frontend contract is unchanged. Stages 04 and 08
already share stuck-badges between them; this is the same growth one level in.

The overlay merge also moves out of the handler into atlas.PrependGenerated,
which is unit-testable where the inline loop was not — it sat behind a network
call. It covers the issues path too, and fixes a latent aliasing bug there: the
old `append(liveNodes, authored...)` wrote into the live slice's backing array,
so two stages sharing a key would corrupt each other. That shape is no longer
hypothetical now that stuck-badges spans three stages.

Verified end-to-end both ways: without GITEA_TOKEN the atlas returns 200 with
stage 05's authored nodes intact; with a real token stage 05 serves both
overlays at once — stuck badges, then eight live repos, then the authored
nodes — and a repo with no language emits one tag rather than an empty pill.

task check green (golangci-lint 0 issues, vet, -race).

Closes #10.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/atlas/atlas.json

@@ -34,7 +34,7 @@
       {"t":"Human triggers execution","plain_t":"The go button","plain":"A person confirms the plan and its risk level, then releases the work — nothing runs until they do.","cls":"gateway","pill":"var(--amber)","d":"Ratify proposed-plan + risk tier, then dispatch.","gate":true},
       {"t":"Session-Dispatch bridge","plain_t":"Hand-off to agents","plain":"The approval flips a switch that hands the signed work order over to the agents to start execution.","cls":"bridge","pill":"var(--blue)","d":"claude.ai MCP → gitea:workflow_run_trigger → cad-dispatch.yml → agentsquad. The final design→execution bridge.","tags":["workflow_dispatch"]}
     ]},
-    {"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":"stuck-badges",
+    {"no":"STAGE 05","short":"Build","cls":"exec","title":"Execute · agentsquad + dispatch","plain_title":"Agents do the work","plain":"AI agents actually build the thing — one writes, a second independent one reviews it to avoid marking its own homework — and every step is logged for the audit trail. Two execution paths run today: agentsquad for orchestrated multi-agent jobs, and dispatch for headless single-issue work.","path":"koala · agentsquad-serve + dispatch CronJob","generate":["stuck-badges","gitea-repos"],
      "trans_label":"Change proposed","trans":"Advances when the agents finish and open a proposed change (a PR) with its audit log attached. Until there's a concrete change to test, nothing moves.","nodes":[
       {"t":"Task API","plain_t":"Start a job","plain":"A request kicks off a job and hands back an id you can poll for progress.","pill":"var(--coral)","d":"POST /tasks → job id · GET /tasks/{id}. taskqueue + serve (v0.12+).","tags":["single agentsquad.yaml"]},
       {"t":"Executor + reviewer loop","plain_t":"Build + independent review","plain":"One agent does the work; a second, independent agent on a different model reviews it — so nothing marks its own homework.","cls":"win","pill":"var(--coral)","d":"ADK Go + LiteLLM. Frontier models (local qwen spirals). Reviewer on distinct tier — echo-chamber prevention.","risk":true},

internal/atlas/build_test.go

@@ -53,7 +53,7 @@ func TestDefault_HasPlainLayerAndTransitions(t *testing.T) {
 		if s.TransLabel == "" {
 			t.Fatalf("stage %s missing trans_label", s.No)
 		}
-		if s.Generate == "ci-jobs" {
+		if s.Generate.Has("ci-jobs") {
 			continue // nodes are generated live, no authored plain
 		}
 		for _, n := range s.Nodes {

internal/atlas/generate.go

@@ -0,0 +1,63 @@
+package atlas
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+)
+
+// GenerateKeys names the live sources a stage draws nodes from. A stage grew
+// past one source once stuck-badges landed alongside the existing overlays, so
+// this accepts either spelling in atlas.json:
+//
+//	"generate": "ci-jobs"
+//	"generate": ["stuck-badges", "gitea-repos"]
+//
+// The bare string is kept rather than migrated: most stages have exactly one
+// source, and a one-element list reads worse for no benefit.
+type GenerateKeys []string
+
+// Has reports whether the stage draws from the named source. The empty key
+// never matches, so a stage with no `generate` is inert.
+func (g GenerateKeys) Has(key string) bool {
+	if key == "" {
+		return false
+	}
+	for _, k := range g {
+		if k == key {
+			return true
+		}
+	}
+	return false
+}
+
+func (g *GenerateKeys) UnmarshalJSON(b []byte) error {
+	b = bytes.TrimSpace(b)
+	if len(b) == 0 || string(b) == "null" {
+		*g = nil
+		return nil
+	}
+	if b[0] == '"' {
+		var one string
+		if err := json.Unmarshal(b, &one); err != nil {
+			return fmt.Errorf("parse generate: %w", err)
+		}
+		*g = GenerateKeys{one}
+		return nil
+	}
+	var many []string
+	if err := json.Unmarshal(b, &many); err != nil {
+		return fmt.Errorf("parse generate: %w", err)
+	}
+	*g = many
+	return nil
+}
+
+// MarshalJSON writes a lone key back as a bare string, so a round-trip through
+// the API does not rewrite every authored stage into list form.
+func (g GenerateKeys) MarshalJSON() ([]byte, error) {
+	if len(g) == 1 {
+		return json.Marshal(g[0])
+	}
+	return json.Marshal([]string(g))
+}

internal/atlas/generate_test.go

@@ -0,0 +1,66 @@
+package atlas_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
+)
+
+// Every stage authored before this type existed spells `generate` as a bare
+// string. That spelling stays valid — this is additive, not a migration.
+func TestGenerateKeys_UnmarshalsBareString(t *testing.T) {
+	var s atlas.Stage
+	if err := json.Unmarshal([]byte(`{"no":"06","generate":"ci-jobs"}`), &s); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if !s.Generate.Has("ci-jobs") {
+		t.Fatalf("Has(ci-jobs) false for %+v", s.Generate)
+	}
+	if s.Generate.Has("gitea-repos") {
+		t.Fatal("Has matched a key that is not present")
+	}
+}
+
+func TestGenerateKeys_UnmarshalsList(t *testing.T) {
+	var s atlas.Stage
+	if err := json.Unmarshal([]byte(`{"no":"05","generate":["stuck-badges","gitea-repos"]}`), &s); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if !s.Generate.Has("stuck-badges") || !s.Generate.Has("gitea-repos") {
+		t.Fatalf("both keys should match, got %+v", s.Generate)
+	}
+}
+
+func TestGenerateKeys_AbsentMatchesNothing(t *testing.T) {
+	var s atlas.Stage
+	if err := json.Unmarshal([]byte(`{"no":"00"}`), &s); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if s.Generate.Has("") || s.Generate.Has("ci-jobs") {
+		t.Fatalf("absent generate matched something: %+v", s.Generate)
+	}
+}
+
+// The frontend reads this JSON, so the round-trip must stay stable.
+func TestGenerateKeys_RoundTrips(t *testing.T) {
+	for _, raw := range []string{`{"generate":"ci-jobs"}`, `{"generate":["a","b"]}`} {
+		var s atlas.Stage
+		if err := json.Unmarshal([]byte(raw), &s); err != nil {
+			t.Fatalf("unmarshal %s: %v", raw, err)
+		}
+		out, err := json.Marshal(s)
+		if err != nil {
+			t.Fatalf("marshal: %v", err)
+		}
+		var back atlas.Stage
+		if err := json.Unmarshal(out, &back); err != nil {
+			t.Fatalf("re-unmarshal %s: %v", out, err)
+		}
+		for _, k := range []string{"ci-jobs", "a", "b"} {
+			if s.Generate.Has(k) != back.Generate.Has(k) {
+				t.Fatalf("round-trip lost %q: %s -> %s", k, raw, out)
+			}
+		}
+	}
+}

internal/atlas/model.go

@@ -39,7 +39,7 @@ type Stage struct {
 	Plain      string       `json:"plain,omitempty"`
 	Path       string       `json:"path,omitempty"`
 	Cls        string       `json:"cls,omitempty"`
-	Generate   string `json:"generate,omitempty"`
+	Generate   GenerateKeys `json:"generate,omitempty"`
 	TransLabel string       `json:"trans_label,omitempty"`
 	Trans      string       `json:"trans,omitempty"`
 	// StuckCount/AwaitingCount are set by ApplyStuckOverlay (cad-atlas#11) on
@@ -71,7 +71,7 @@ func Build(atlasJSON, workflow []byte) (Atlas, error) {
 		return Atlas{}, fmt.Errorf("parse atlas data: %w", err)
 	}
 	for i := range a.Stages {
-		if a.Stages[i].Generate != "ci-jobs" {
+		if !a.Stages[i].Generate.Has("ci-jobs") {
 			continue
 		}
 		jobs, err := JobsFromWorkflow(workflow)

internal/atlas/overlay.go

@@ -0,0 +1,17 @@
+package atlas
+
+// PrependGenerated puts live nodes ahead of the authored ones on every stage
+// carrying the given `generate` key. Authored nodes are kept, never replaced:
+// they are the graceful-degradation path, and a live source that is
+// unavailable (no token, no network) must leave the atlas rendering exactly as
+// authored. Passing no nodes is therefore a no-op, not an erasure.
+func PrependGenerated(a *Atlas, generate string, nodes []Node) {
+	if a == nil || len(nodes) == 0 {
+		return
+	}
+	for i := range a.Stages {
+		if a.Stages[i].Generate.Has(generate) {
+			a.Stages[i].Nodes = append(append([]Node{}, nodes...), a.Stages[i].Nodes...)
+		}
+	}
+}

internal/atlas/overlay_test.go

@@ -0,0 +1,66 @@
+package atlas_test
+
+import (
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
+)
+
+func stagedAtlas() *atlas.Atlas {
+	return &atlas.Atlas{Stages: []atlas.Stage{
+		{No: "STAGE 03", Generate: atlas.GenerateKeys{"gitea-issues"}, Nodes: []atlas.Node{{Title: "authored issue node"}}},
+		{No: "STAGE 05", Generate: atlas.GenerateKeys{"gitea-repos"}, Nodes: []atlas.Node{{Title: "authored repo node"}}},
+		{No: "STAGE 08", Nodes: []atlas.Node{{Title: "untouched"}}},
+	}}
+}
+
+func TestPrependGenerated_LiveNodesComeFirstAndAuthoredSurvive(t *testing.T) {
+	a := stagedAtlas()
+
+	atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
+
+	got := a.Stages[1].Nodes
+	if len(got) != 2 {
+		t.Fatalf("want 2 nodes, got %d: %+v", len(got), got)
+	}
+	if got[0].Title != "live repo" || got[1].Title != "authored repo node" {
+		t.Fatalf("order wrong: %+v", got)
+	}
+}
+
+func TestPrependGenerated_OnlyTouchesMatchingStage(t *testing.T) {
+	a := stagedAtlas()
+
+	atlas.PrependGenerated(a, "gitea-repos", []atlas.Node{{Title: "live repo"}})
+
+	if len(a.Stages[0].Nodes) != 1 || a.Stages[0].Nodes[0].Title != "authored issue node" {
+		t.Fatalf("stage 03 disturbed: %+v", a.Stages[0].Nodes)
+	}
+	if len(a.Stages[2].Nodes) != 1 || a.Stages[2].Nodes[0].Title != "untouched" {
+		t.Fatalf("stage 08 disturbed: %+v", a.Stages[2].Nodes)
+	}
+}
+
+// The graceful-skip contract: with GITEA_TOKEN unset the overlay yields no
+// nodes, and the atlas must still render its authored placeholders unchanged.
+func TestPrependGenerated_NoLiveNodesLeavesAuthoredIntact(t *testing.T) {
+	a := stagedAtlas()
+
+	atlas.PrependGenerated(a, "gitea-repos", nil)
+
+	if len(a.Stages[1].Nodes) != 1 || a.Stages[1].Nodes[0].Title != "authored repo node" {
+		t.Fatalf("authored nodes lost on empty overlay: %+v", a.Stages[1].Nodes)
+	}
+}
+
+func TestPrependGenerated_UnknownKeyIsANoop(t *testing.T) {
+	a := stagedAtlas()
+
+	atlas.PrependGenerated(a, "no-such-key", []atlas.Node{{Title: "live"}})
+
+	for i, s := range a.Stages {
+		if len(s.Nodes) != 1 {
+			t.Fatalf("stage %d changed: %+v", i, s.Nodes)
+		}
+	}
+}

internal/atlas/repos.go

@@ -0,0 +1,40 @@
+package atlas
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// RepoNodes parses a Gitea `/user/repos` response (the token owner's own
+// repositories) into one node per repo, linking out to the repo. Archived
+// repos are dropped: the atlas shows where work happens, and an archived repo
+// is by definition somewhere it does not.
+func RepoNodes(listJSON []byte) ([]Node, error) {
+	var repos []struct {
+		Name        string `json:"name"`
+		Description string `json:"description"`
+		HTMLURL     string `json:"html_url"`
+		Archived    bool   `json:"archived"`
+		Language    string `json:"language"`
+	}
+	if err := json.Unmarshal(listJSON, &repos); err != nil {
+		return nil, fmt.Errorf("parse repos: %w", err)
+	}
+	nodes := make([]Node, 0, len(repos))
+	for _, r := range repos {
+		if r.Archived {
+			continue
+		}
+		tags := []string{"live · Gitea"}
+		if r.Language != "" {
+			tags = append(tags, r.Language)
+		}
+		nodes = append(nodes, Node{
+			Title: r.Name,
+			Desc:  r.Description,
+			Tags:  tags,
+			URL:   r.HTMLURL,
+		})
+	}
+	return nodes, nil
+}

internal/atlas/repos_test.go

@@ -0,0 +1,80 @@
+package atlas_test
+
+import (
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
+)
+
+// A Gitea /user/repos response, trimmed to the fields RepoNodes reads.
+const repoList = `[
+  {"name":"cad-atlas","full_name":"mathias/cad-atlas","description":"Visualising the CAD workflow","html_url":"https://git.d-ma.be/mathias/cad-atlas","archived":false,"language":"Go"},
+  {"name":"dispatch","full_name":"mathias/dispatch","description":"","html_url":"https://git.d-ma.be/mathias/dispatch","archived":false,"language":""},
+  {"name":"old-thing","full_name":"mathias/old-thing","description":"retired","html_url":"https://git.d-ma.be/mathias/old-thing","archived":true,"language":"Go"}
+]`
+
+func TestRepoNodes_OneNodePerRepoWithDescriptionAndURL(t *testing.T) {
+	nodes, err := atlas.RepoNodes([]byte(repoList))
+	if err != nil {
+		t.Fatalf("RepoNodes: %v", err)
+	}
+	if len(nodes) != 2 {
+		t.Fatalf("want 2 nodes (archived excluded), got %d", len(nodes))
+	}
+	if nodes[0].Title != "cad-atlas" {
+		t.Fatalf("title = %q, want %q", nodes[0].Title, "cad-atlas")
+	}
+	if nodes[0].URL != "https://git.d-ma.be/mathias/cad-atlas" {
+		t.Fatalf("url = %q", nodes[0].URL)
+	}
+	if nodes[0].Desc != "Visualising the CAD workflow" {
+		t.Fatalf("desc = %q", nodes[0].Desc)
+	}
+}
+
+// Mirrors IssueNodes' tagging so the two live slices read identically on stage.
+func TestRepoNodes_TagsCarryLiveMarkerAndLanguage(t *testing.T) {
+	nodes, err := atlas.RepoNodes([]byte(repoList))
+	if err != nil {
+		t.Fatalf("RepoNodes: %v", err)
+	}
+	if len(nodes) < 2 {
+		t.Fatalf("want at least 2 nodes, got %d", len(nodes))
+	}
+	if len(nodes[0].Tags) != 2 || nodes[0].Tags[0] != "live · Gitea" || nodes[0].Tags[1] != "Go" {
+		t.Fatalf("tags = %v, want [live · Gitea Go]", nodes[0].Tags)
+	}
+	// A repo with no language must not emit an empty tag pill.
+	if len(nodes[1].Tags) != 1 || nodes[1].Tags[0] != "live · Gitea" {
+		t.Fatalf("tags = %v, want [live · Gitea]", nodes[1].Tags)
+	}
+}
+
+// Load-bearing: archived repos are explicitly out of scope per the issue.
+func TestRepoNodes_ExcludesArchived(t *testing.T) {
+	nodes, err := atlas.RepoNodes([]byte(repoList))
+	if err != nil {
+		t.Fatalf("RepoNodes: %v", err)
+	}
+	for _, n := range nodes {
+		if n.Title == "old-thing" {
+			t.Fatalf("archived repo surfaced: %+v", n)
+		}
+	}
+}
+
+func TestRepoNodes_EmptyListReturnsEmptyNotNil(t *testing.T) {
+	nodes, err := atlas.RepoNodes([]byte(`[]`))
+	if err != nil {
+		t.Fatalf("RepoNodes: %v", err)
+	}
+	if nodes == nil || len(nodes) != 0 {
+		t.Fatalf("nodes = %+v, want empty non-nil slice", nodes)
+	}
+}
+
+func TestRepoNodes_MalformedJSONErrors(t *testing.T) {
+	if _, err := atlas.RepoNodes([]byte(`{`)); err == nil {
+		t.Fatal("want an error for malformed JSON, got nil")
+	}
+}

internal/atlas/stuck.go

@@ -66,7 +66,7 @@ func ApplyStuckOverlay(stages []Stage, findings []caddomain.StuckFinding) []Stag
 	out := make([]Stage, len(stages))
 	copy(out, stages)
 	for i := range out {
-		if out[i].Generate != "stuck-badges" {
+		if !out[i].Generate.Has("stuck-badges") {
 			continue
 		}
 		assigned := byStage[out[i].No]

internal/atlas/stuck_test.go

@@ -8,7 +8,11 @@ import (
 )
 
 func stage(no, generate string) atlas.Stage {
-	return atlas.Stage{No: no, Title: "example", Generate: generate}
+	s := atlas.Stage{No: no, Title: "example"}
+	if generate != "" {
+		s.Generate = atlas.GenerateKeys{generate}
+	}
+	return s
 }
 
 func finding(repo string, issue int, cat caddomain.StuckCategory, class caddomain.StuckClass) caddomain.StuckFinding {

internal/gitea/client.go

@@ -40,6 +40,20 @@ func MyIssues() ([]byte, error) {
 	return get(url, token)
 }
 
+// MyRepos returns the raw /user/repos JSON for the token owner's own
+// repositories. Same PAT and same contract as MyIssues: returns an error if
+// GITEA_TOKEN is unset so callers can skip the overlay gracefully rather than
+// issue an unauthenticated request. Gitea's own visibility rules scope the
+// result, so no additional filtering is applied here.
+func MyRepos() ([]byte, error) {
+	token := os.Getenv("GITEA_TOKEN")
+	if token == "" {
+		return nil, fmt.Errorf("GITEA_TOKEN not set")
+	}
+	url := base() + "/api/v1/user/repos?limit=8"
+	return get(url, token)
+}
+
 // get performs a short-lived GET, optionally with a bearer token, and returns
 // the response body.
 func get(url, token string) ([]byte, error) {

internal/gitea/client_test.go

@@ -0,0 +1,23 @@
+package gitea_test
+
+import (
+	"testing"
+
+	"git.d-ma.be/mathias/cad-atlas/internal/gitea"
+)
+
+// The unset path is the one that runs live right now: GITEA_TOKEN is still not
+// provisioned in prod (#4), so MyRepos must fail cleanly rather than issue an
+// unauthenticated request, letting liveOverlay skip and keep the authored
+// placeholder nodes.
+func TestMyRepos_ErrorsWhenTokenUnset(t *testing.T) {
+	t.Setenv("GITEA_TOKEN", "")
+
+	body, err := gitea.MyRepos()
+	if err == nil {
+		t.Fatal("want an error when GITEA_TOKEN is unset, got nil")
+	}
+	if body != nil {
+		t.Fatalf("want nil body on error, got %d bytes", len(body))
+	}
+}

internal/web/handler.go

@@ -58,19 +58,14 @@ func NewHandler() http.Handler {
 		if ld.run != nil {
 			nodes := atlas.RunNodes(*ld.run)
 			for i := range a.Stages {
-				if a.Stages[i].Generate == "ci-jobs" {
+				if a.Stages[i].Generate.Has("ci-jobs") {
 					a.Stages[i].Nodes = nodes
 				}
 			}
 			a.CIDurationS, a.CDDurationS = atlas.StageSeconds(*ld.run)
 		}
-		if ld.issues != nil {
-			for i := range a.Stages {
-				if a.Stages[i].Generate == "gitea-issues" {
-					a.Stages[i].Nodes = append(ld.issues, a.Stages[i].Nodes...)
-				}
-			}
-		}
+		atlas.PrependGenerated(&a, "gitea-issues", ld.issues)
+		atlas.PrependGenerated(&a, "gitea-repos", ld.repos)
 		// cad-atlas#11: overlay mathias/cad#14's cad-stuck findings as
 		// per-stage badges. Read-only — ApplyStuckOverlay only adds Nodes
 		// with a link out; it never writes anything back to Gitea.
@@ -84,7 +79,7 @@ func NewHandler() http.Handler {
 				live = append(live, atlas.FluxNode(*ld.flux))
 			}
 			for i := range a.Stages {
-				if a.Stages[i].Generate == "deploy-state" {
+				if a.Stages[i].Generate.Has("deploy-state") {
 					a.Stages[i].Nodes = append(live, a.Stages[i].Nodes...)
 				}
 			}
@@ -104,6 +99,7 @@ type liveOverlayData struct {
 	flux     *atlas.Flux
 	timeline []atlas.RunDot
 	issues   []atlas.Node
+	repos    []atlas.Node
 	stuck    []caddomain.StuckFinding
 }
 
@@ -172,6 +168,11 @@ func liveOverlay() liveOverlayData {
 			d.issues = nodes
 		}
 	}
+	if raw, err := gitea.MyRepos(); err == nil {
+		if nodes, err := atlas.RepoNodes(raw); err == nil {
+			d.repos = nodes
+		}
+	}
 	if raw, err := cluster.Deployment(); err == nil {
 		if dep, err := atlas.DeployState(raw); err == nil {
 			d.deploy = &dep