[jaredcatkinson]

User-owned GitHub Apps were always classified as third_party, even when their owner was a collected organization or enterprise member. Organization-only collections also classified unmatched organization owners as unknown because no enterprise ID was available.

Classify user-owned apps as member_owned when the existing organization or enterprise membership inventory contains their owner. Recognized owners without matching internal evidence now default to third_party, including unmatched enterprise owners when no enterprise record is available. Missing owners and unsupported owner types remain unknown. Tenant-owned classification and ownership edges are preserved.

Update the node documentation and schema description to explain all four values, membership requirements, and the dependence on collection completeness. Repository collaborator records alone do not establish member ownership.

Validation: 57 focused tests passed across app models, membership lookups, installation access, enterprise installations, and description documentation. Ruff, schema JSON parsing, and git diff --check passed. The installation tests emitted 20 existing Pydantic deprecation warnings.

Summary by CodeRabbit

• Updates
  • Registration origins now distinguish apps owned by collected organization or enterprise members as member-owned, separately from tenant-owned and third-party apps.
  • Owner classification is more consistent when ownership or inventory information is incomplete. Outside-collaborator status alone does not count as membership.
  • Documentation clarifies that member-owned classification does not imply tenant control or approval.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The app model now classifies collected user owners as member_owned and recognized external owners as third_party. The documentation and tests describe the classification criteria, including the limits of collected membership evidence.

Changes

Registration Origin Classification

Layer / File(s)	Summary
Classification rules and validation src/openhound_github/models/app_installation.py, tests/test_app_model.py, descriptions/nodes/GH_App.md, extension/schema.json	Collected user owners classify as member_owned; other recognized user owners and external organization owners classify as third_party. The descriptions and tests cover the classification criteria and outcomes.

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix

Possibly related PRs

• SpecterOps/openhound-github#94: Added the registration_origin property and the classification logic changed here.

Suggested reviewers: eladshamir

Merge Risk: Minimal · up to 8e7bd

No issue requiring a change before merge is identified; complete normal checks before merging.

Security architecture risk: Low · up to 8e7bd

The change affects ownership reporting rather than installation access or ownership authority. Member-owned apps remain user-controlled. The remaining risk is downstream interpretation of the new category and revised defaults, particularly when collection is incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The existing documented authority boundary is app-wide: the app owner holds the private key capable of generating installation tokens across that app's installations. The PR changes ownership classification, not this authority; member_owned explicitly does not mean tenant control.

Trust Boundaries and Controls

• observed — An owner classified as User becomes member_owned only after its node ID matches organization or enterprise membership inventory. Repository collaborator access alone does not satisfy this check, and the new regression cases explicitly preserve that distinction.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the ticket and the main change: correcting how GitHub App registration origin is classified. The changeset matches this. The schema, node docs, model logic, and tests all address the r…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the ticket and the main change: correcting how GitHub App registration origin is classified. The changeset matches this. The schema, node docs, model logic, and tests all address the registration_origin classification, including the new member_owned value and the third_party defaults. The ticket prefix is a normal project convention and does not reduce clarity.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the owner’s name,
Then sorts the apps into their frame.
Collected members earn their place,
Third-party apps get their label with grace.
The docs and tests record the case.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f6dfca2-1f48-4493-9168-2b40456ba0a0

Commits

Reviewing files that changed from the base of the PR and between 5afe919 and 8e7bd08.

Files selected for processing: 4

• descriptions/nodes/GH_App.md
• extension/schema.json
• src/openhound_github/models/app_installation.py
• tests/test_app_model.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.