Public snapshot: 2026-07-21

Author: marmutapp

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: true
 contact_links:
   - name: Ask a question / share an idea
-    url: https://github.com/marmutapp/superbased-observer/discussions
+    url: https://github.com/superbasedapp/observer/discussions
     about: For questions, ideas, and general discussion — not for bug reports.
   - name: Report a security vulnerability
-    url: https://github.com/marmutapp/superbased-observer/security/advisories/new
+    url: https://github.com/superbasedapp/observer/security/advisories/new
     about: Please report vulnerabilities privately, not as a public issue. See SECURITY.md.

.github/workflows/npm-release.yml

@@ -50,7 +50,7 @@
 #                              section as the body. Useful as a
 #                              maintainer-side changelog browser.
 #   5. public_release job    — creates a GitHub Release on the PUBLIC
-#                              repo (marmutapp/superbased-observer)
+#                              repo (superbasedapp/observer)
 #                              with per-platform binary archives +
 #                              SHA256SUMS attached. Runs in parallel
 #                              with publish (only needs build), so
@@ -70,7 +70,7 @@
 #     https://pypi.org/manage/project/superbased-observer/releases/
 #     and use the web UI. See docs/pypi-release-process.md.
 #   - PUBLIC_REPO_TOKEN   fine-grained PAT with `contents: write` on
-#     marmutapp/superbased-observer (the public repo). Used by the
+#     superbasedapp/observer (the public repo). Used by the
 #     public_release job to create the GH Release with binary assets.
 #     Must be set BEFORE the first tag that uses this flow lands —
 #     missing-token failures surface as a 404 from `gh release create`.
@@ -1072,7 +1072,7 @@ jobs:
           # "tag not yet pushed" — the v1.6.19 first-time release hit
           # exactly this misdiagnosis.
           set -euo pipefail
-          URL="https://api.github.com/repos/marmutapp/superbased-observer/git/ref/tags/${GITHUB_REF_NAME}"
+          URL="https://api.github.com/repos/superbasedapp/observer/git/ref/tags/${GITHUB_REF_NAME}"
           for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
             STATUS=$(curl -sS -o /dev/null -w '%{http_code}' "$URL" || echo "000")
             case "$STATUS" in
@@ -1259,13 +1259,13 @@ jobs:
           # the existing release rather than failing with "already
           # exists". `gh release create --notes-file ...` errors on
           # existing tag; switch to view-or-create.
-          if gh release view "${GITHUB_REF_NAME}" --repo marmutapp/superbased-observer >/dev/null 2>&1; then
+          if gh release view "${GITHUB_REF_NAME}" --repo superbasedapp/observer >/dev/null 2>&1; then
             echo "Release ${GITHUB_REF_NAME} already exists on public repo — updating body + re-uploading assets"
             gh release edit "${GITHUB_REF_NAME}" \
-              --repo marmutapp/superbased-observer \
+              --repo superbasedapp/observer \
               --notes-file release-body.md
             gh release upload "${GITHUB_REF_NAME}" \
-              --repo marmutapp/superbased-observer \
+              --repo superbasedapp/observer \
               --clobber \
               release-assets/*.tar.gz \
               release-assets/*.zip \
@@ -1274,7 +1274,7 @@ jobs:
               release-assets/SHA256SUMS
           else
             gh release create "${GITHUB_REF_NAME}" \
-              --repo marmutapp/superbased-observer \
+              --repo superbasedapp/observer \
               --title "${GITHUB_REF_NAME}" \
               --notes-file release-body.md \
               release-assets/*.tar.gz \
@@ -1289,7 +1289,7 @@ jobs:
           {
             echo "## Public release ${GITHUB_REF_NAME} published"
             echo ""
-            echo "[Release page](https://github.com/marmutapp/superbased-observer/releases/tag/${GITHUB_REF_NAME})"
+            echo "[Release page](https://github.com/superbasedapp/observer/releases/tag/${GITHUB_REF_NAME})"
             echo ""
             echo "Assets attached:"
             echo '```'

CHANGELOG.md

@@ -6640,7 +6640,7 @@ realizing the PAT secret was missing.
 **What this ship changes:**
 
 - `Wait for v* tag on public repo` step now uses **unauthenticated
-  curl** against `api.github.com/repos/marmutapp/superbased-observer/git/ref/tags/<tag>`.
+  curl** against `api.github.com/repos/superbasedapp/observer/git/ref/tags/<tag>`.
   The public repo's ref endpoint is readable anonymously, so the wait
   doesn't need a PAT. The step explicitly switches on HTTP status:
   200 → success, 404 → keep polling (expected during the wait
@@ -6673,7 +6673,7 @@ users who don't want to install via npm can `curl` the right archive
 for their architecture. Builds on the existing cross-compile pipeline
 that already produces the 5 platform binaries for npm — same
 artifacts, now also surfaced as tarball/zip downloads on
-`github.com/marmutapp/superbased-observer/releases`.
+`github.com/superbasedapp/observer/releases`.
 
 **What ships per release:**
 
@@ -6699,7 +6699,7 @@ artifacts, now also surfaced as tarball/zip downloads on
   for the v* tag to exist on the public repo (polls up to 2 min),
   bundles each platform's `bin/` folder into a tarball or zip,
   computes `SHA256SUMS`, and calls `gh release create --repo
-  marmutapp/superbased-observer`. Idempotent on retry — uses
+  superbasedapp/observer`. Idempotent on retry — uses
   `gh release edit` + `gh release upload --clobber` if the release
   already exists.
 - New repo secret on the private repo: `PUBLIC_REPO_TOKEN`. Fine-
@@ -8119,14 +8119,14 @@ sweep. Both READMEs reference images under `docs/assets/`:
   244, 259) — 12 relative-path image refs (`docs/assets/...`).
 - `npm/observer/README.md` (lines 14, 168, 250, 268, 290, 308, 322,
   352, 364, 382, 405) — 11 absolute-URL refs
-  (`https://github.com/marmutapp/superbased-observer/raw/main/docs/assets/...`).
+  (`https://github.com/superbasedapp/observer/raw/main/docs/assets/...`).
 
 Both 404 on the public repo because `docs/` doesn't exist there.
 Empirically confirmed:
 
 ```
 $ curl -s -o /dev/null -w "%{http_code}\n" \
-  https://github.com/marmutapp/superbased-observer/raw/main/docs/assets/screenshots/01-overview.png
+  https://github.com/superbasedapp/observer/raw/main/docs/assets/screenshots/01-overview.png
 404
 ```
 

CONTRIBUTING.md

@@ -8,7 +8,7 @@ looking for in a pull request.
 
 For anything beyond a small fix (typo, obvious bug, small doc
 improvement), please open an issue or a
-[Discussion](https://github.com/marmutapp/superbased-observer/discussions)
+[Discussion](https://github.com/superbasedapp/observer/discussions)
 first to align on approach before investing time in a large diff.
 This avoids duplicate work and saves you a rewrite if the design
 needs to go a different direction.
@@ -25,24 +25,71 @@ forward (earlier releases appeared as a single replaced commit — that
 was a pipeline gap, since fixed).
 
 External pull requests are reviewed publicly on GitHub like any other
-project. Once accepted, a maintainer integrates the change into the
-private mainline and it ships in the next sanitized snapshot,
-credited to you in `CHANGELOG.md` and the release notes. Your commit
-history on the PR branch is preserved in the PR itself; it doesn't
-appear byte-for-byte in the mainline history, but the credit does.
+project. When a PR is self-contained and touches only public-safe
+paths, a maintainer can merge it **directly onto public `main`**, where
+it stays — the release snapshot now parents on the public head, so a
+direct-merged commit is carried forward, not overwritten. When a change
+instead has to be integrated with work that lives only on the private
+mainline, the maintainer folds it in there and it ships in the next
+sanitized snapshot. Either way you're credited in `CHANGELOG.md` and the
+release notes; the "How you get credit" section below spells out exactly
+what shows up where.
 
 We think this is worth stating plainly rather than leaving you to
 infer it from a repository that otherwise looks like a normal
 single-history project.
 
+## How you get credit
+
+Because the public repo is a sanitized snapshot authored by the release
+pipeline (not a byte-for-byte copy of the private mainline), we want to
+be upfront about exactly how your work gets attributed. We use a
+three-tier ladder, in order of preference:
+
+1. **Direct-merge (contributors graph).** When your PR is
+   self-contained and touches only public-safe paths, a maintainer
+   merges it **directly onto public `main`**. This is the *only* path
+   that puts you on the repository's GitHub contributors graph — your
+   commits land in the public history under your own name. We prefer
+   this route whenever it's feasible, so keeping a PR focused and clear
+   of private-only paths is the single best thing you can do to be
+   credited this way.
+
+2. **Co-authored-by (provenance trailer).** Some changes can't be
+   merged directly — they touch paths that can't be public, or they
+   have to be integrated with work that lives only on the private
+   mainline. Those flow through the private mainline, and we record your
+   authorship with a `Co-authored-by: Your Name <you@example.com>`
+   trailer on the private commit that carries the change. Here's the
+   honest limit of what that does **today**: the public repo receives a
+   fresh snapshot commit (fixed author, generated message), so the
+   trailer lives on the *private* commit and does **not** appear in the
+   public history. It's durable provenance we keep, and it would surface
+   publicly only if the project ever moves to a public day-to-day
+   mainline. So for a change that takes this route, your guaranteed
+   *public* credit today is the CHANGELOG line below — not a public
+   avatar or a contributors-graph entry (only a direct-merge does that).
+
+3. **CHANGELOG credit (always).** Regardless of which path your change
+   takes, every external contribution gets a named credit line in
+   `CHANGELOG.md` and the release notes. This is the guaranteed-visible
+   floor — you're credited even when neither of the routes above
+   applies.
+
+If you'd like to be credited under a specific name/email or a GitHub
+handle, say so in the PR and we'll match it. The maintainer-side
+mechanics for all three tiers live in the maintainers' internal release
+runbook, so this policy is applied consistently rather than
+case-by-case.
+
 ## Development setup
 
 Requirements: **Go 1.22+**. Observer uses `modernc.org/sqlite` (pure
 Go, no CGO) — no C toolchain needed.
 
 ```bash
-git clone https://github.com/marmutapp/superbased-observer.git
-cd superbased-observer
+git clone https://github.com/superbasedapp/observer.git
+cd observer
 make build     # go build -o bin/observer ./cmd/observer
 make test      # go test -race ./...
 make lint      # golangci-lint run

PRIVACY.md

@@ -160,10 +160,10 @@ default destination.
 
 ## Source-of-truth and verification
 
-- Source code: https://github.com/marmutapp/superbased-observer
+- Source code: https://github.com/superbasedapp/observer
 - npm package: https://www.npmjs.com/package/@superbased/observer
 - SLSA provenance: attached as `multiple.intoto.jsonl` to each
-  [public GitHub release](https://github.com/marmutapp/superbased-observer/releases),
+  [public GitHub release](https://github.com/superbasedapp/observer/releases),
   verifiable with [`slsa-verifier`](https://github.com/slsa-framework/slsa-verifier)
   (`v2.7.0+` required for private-builder support).
 - SBOMs: `observer.cdx.json` + `observer-org.cdx.json` attached to
@@ -174,7 +174,7 @@ default destination.
 If you find behavior that contradicts anything on this page — a
 network call we didn't list, a code path that stores something we
 said it doesn't — file an issue at
-https://github.com/marmutapp/superbased-observer/issues with the
+https://github.com/superbasedapp/observer/issues with the
 tag `privacy`, or email `contact@superbased.app`.
 
 We treat any unintentional collection as a bug, not a feature.

README.md

@@ -173,7 +173,7 @@ observer --version
 ### Via direct download (pre-built per-platform archive)
 
 Each tagged release attaches per-platform archives to the
-[Releases page](https://github.com/marmutapp/superbased-observer/releases),
+[Releases page](https://github.com/superbasedapp/observer/releases),
 verifiable against the published `SHA256SUMS`:
 
 | Asset | Platform | Contents |
@@ -189,8 +189,8 @@ verifiable against the published `SHA256SUMS`:
 # Linux x64 example — substitute your platform + version.
 VERSION=v1.6.21
 PLAT=linux-x64
-curl -L -O https://github.com/marmutapp/superbased-observer/releases/download/$VERSION/observer-$VERSION-$PLAT.tar.gz
-curl -L -O https://github.com/marmutapp/superbased-observer/releases/download/$VERSION/SHA256SUMS
+curl -L -O https://github.com/superbasedapp/observer/releases/download/$VERSION/observer-$VERSION-$PLAT.tar.gz
+curl -L -O https://github.com/superbasedapp/observer/releases/download/$VERSION/SHA256SUMS
 shasum -a 256 -c SHA256SUMS --ignore-missing
 tar -xzf observer-$VERSION-$PLAT.tar.gz
 ./observer --version
@@ -1056,8 +1056,8 @@ on-disk size, so silent data loss has a visible signal.
 ## Build from source
 
 ```bash
-git clone https://github.com/marmutapp/superbased-observer
-cd superbased-observer
+git clone https://github.com/superbasedapp/observer
+cd observer
 make build        # builds bin/observer + bin/antigravity-bridge.exe
 make test         # full test suite (race detector enabled)
 make all          # fmt + vet + lint + test + build

SECURITY.md

@@ -6,7 +6,7 @@
 
 Use GitHub's private vulnerability reporting instead:
 
-1. Go to the [Security tab](https://github.com/marmutapp/superbased-observer/security) on this repository.
+1. Go to the [Security tab](https://github.com/superbasedapp/observer/security) on this repository.
 2. Click **"Report a vulnerability"**.
 
 This opens a private advisory thread visible only to you and the

SUPPORT.md

@@ -4,8 +4,8 @@ Quick routing for where to go depending on what you need:
 
 | I have... | Go here |
 |---|---|
-| A question, or I'm not sure if something is a bug | [GitHub Discussions](https://github.com/marmutapp/superbased-observer/discussions) |
-| A reproducible bug, install problem, adapter request, or cost discrepancy | Open an [issue](https://github.com/marmutapp/superbased-observer/issues/new/choose) — pick the matching form |
+| A question, or I'm not sure if something is a bug | [GitHub Discussions](https://github.com/superbasedapp/observer/discussions) |
+| A reproducible bug, install problem, adapter request, or cost discrepancy | Open an [issue](https://github.com/superbasedapp/observer/issues/new/choose) — pick the matching form |
 | A security vulnerability | **Do not open a public issue.** See [`SECURITY.md`](SECURITY.md) for private reporting |
 | A teams / commercial / partnership question | contact@superbased.app |
 | General docs | [`README.md`](README.md) and [superbased.app](https://superbased.app) |

charts/observer-org/Chart.yaml

@@ -10,9 +10,9 @@ version: 0.1.0
 # appVersion tracks the observer-org image shipped with this chart. The
 # deployment's image tag defaults to this when image.tag is left empty.
 appVersion: "1.7.0"
-home: https://github.com/marmutapp/superbased-observer
+home: https://github.com/superbasedapp/observer
 sources:
-  - https://github.com/marmutapp/superbased-observer
+  - https://github.com/superbasedapp/observer
 maintainers:
   - name: Santosh Kathira
     email: contact@superbased.app

docs/vscode-extension-user-guide.md

@@ -475,7 +475,7 @@ The extension is **strictly local-first**:
 - **No outbound network calls** at runtime. The only network
   traffic the extension ever generates is the first-install
   binary download from
-  `github.com/marmutapp/superbased-observer/releases/…` when no
+  `github.com/superbasedapp/observer/releases/…` when no
   `observer` binary is found on your machine. After that, all
   communication is to `127.0.0.1:<dashboard.port>` on your
   workspace host.
@@ -491,14 +491,14 @@ The extension is **strictly local-first**:
 
 The same guarantees apply to the binary itself — Observer is
 Apache-2.0 and the source for everything captured + computed is in
-the [main repository](https://github.com/marmutapp/superbased-observer).
+the [main repository](https://github.com/superbasedapp/observer).
 
 ---
 
 ## Getting help
 
-- **Issues** — [github.com/marmutapp/superbased-observer/issues](https://github.com/marmutapp/superbased-observer/issues)
-- **Discussions** — [github.com/marmutapp/superbased-observer/discussions](https://github.com/marmutapp/superbased-observer/discussions)
+- **Issues** — [github.com/superbasedapp/observer/issues](https://github.com/superbasedapp/observer/issues)
+- **Discussions** — [github.com/superbasedapp/observer/discussions](https://github.com/superbasedapp/observer/discussions)
 - **Output channel** — `View → Output → Observer` shows everything
   the extension is doing. Include the relevant excerpt when filing
   bugs.