feat: project repository keys across public clients

crates/protocol/src/subscription.rs

@@ -568,6 +568,10 @@ pub struct SubscriptionWorker {
     pub profile: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub repository_id: Option<String>,
+    /// Workspace-facing Repository key. Runtime producers leave this unset and
+    /// Workspace Server projections replace `repository_id` with this field.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repository_key: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub working_directory_id: Option<SubscriptionWorkdirId>,
 }
@@ -811,6 +815,7 @@ mod tests {
             display_name: Some(format!("Worker {value}")),
             profile: Some("builtin:coder".to_string()),
             repository_id: None,
+            repository_key: None,
             working_directory_id: None,
         }
     }

crates/ticket/src/lib.rs

@@ -489,6 +489,7 @@ pub struct NewTicket {
     pub workflow_state: Option<TicketWorkflowState>,
     pub queued_by: Option<String>,
     pub queued_at: Option<String>,
+    #[serde(rename = "repository_key")]
     pub repository_id: Option<String>,
     pub ref_selector: Option<String>,
 }
@@ -519,6 +520,7 @@ impl NewTicket {
 #[serde(tag = "action", rename_all = "snake_case")]
 pub enum TicketTargetEdit {
     Set {
+        #[serde(rename = "repository_key")]
         repository_id: String,
         ref_selector: Option<String>,
     },
@@ -1610,6 +1612,7 @@ pub struct TicketMeta {
     pub workflow_state_explicit: bool,
     pub queued_by: Option<String>,
     pub queued_at: Option<String>,
+    #[serde(rename = "repository_key")]
     pub repository_id: Option<String>,
     pub ref_selector: Option<String>,
     pub raw: BTreeMap<String, String>,

crates/ticket/src/tool.rs

@@ -402,8 +402,8 @@ struct TicketCreateParams {
     queued_at: Option<String>,
     /// Optional target Workspace repository id.
     #[serde(default)]
-    repository_id: Option<String>,
-    /// Optional target Git ref selector. Requires `repository_id`.
+    repository_key: Option<String>,
+    /// Optional target Git ref selector. Requires `repository_key`.
     #[serde(default)]
     ref_selector: Option<String>,
 }
@@ -944,7 +944,7 @@ impl Tool for TicketCreateTool {
         input.workflow_state = params.state.map(TicketWorkflowStateParam::into_state);
         input.queued_by = None;
         input.queued_at = params.queued_at;
-        input.repository_id = params.repository_id;
+        input.repository_id = params.repository_key;
         input.ref_selector = params.ref_selector;
 
         let created = self
@@ -1173,7 +1173,7 @@ impl Tool for TicketMarkReadyTool {
             json!({
                 "ticket": ticket.meta.id,
                 "state": ticket.meta.workflow_state.as_str(),
-                "repository_id": ticket.meta.repository_id,
+                "repository_key": ticket.meta.repository_id,
                 "ref_selector": ticket.meta.ref_selector,
                 "ok": true
             }),
@@ -1206,7 +1206,7 @@ impl Tool for TicketIntakeReadyTool {
             json!({
                 "ticket": ticket.meta.id,
                 "state": ticket.meta.workflow_state.as_str(),
-                "repository_id": ticket.meta.repository_id,
+                "repository_key": ticket.meta.repository_id,
                 "ref_selector": ticket.meta.ref_selector,
                 "ok": true
             }),
@@ -1940,11 +1940,11 @@ mod tests {
         fn resolve_target(
             &self,
             _workspace_id: &str,
-            repository_id: Option<&str>,
+            repository_key: Option<&str>,
             ref_selector: Option<&str>,
         ) -> crate::Result<crate::ResolvedTicketTarget> {
             Ok(crate::ResolvedTicketTarget {
-                repository_id: repository_id.unwrap_or("main").to_owned(),
+                repository_id: repository_key.unwrap_or("main").to_owned(),
                 ref_selector: ref_selector.unwrap_or("develop").to_owned(),
             })
         }

crates/tui/src/backend_worker_picker.rs

@@ -370,7 +370,7 @@ fn working_directory_text(worker: &BackendWorkerSummary) -> String {
     let cleanliness = wd.cleanliness.as_deref().unwrap_or("unknown");
     format!(
         "wd:{}:{} {} {}",
-        wd.repository_id, wd.working_directory_id, wd.status, cleanliness
+        wd.repository_key, wd.working_directory_id, wd.status, cleanliness
     )
 }
 

crates/workdir/src/workspace.rs

@@ -8,6 +8,7 @@
 use serde::{Deserialize, Serialize};
 
 pub use workspace_api::{
+    RuntimeWorkingDirectoryCleanupTarget, RuntimeWorkingDirectorySummary,
     WorkingDirectoryCleanupTarget, WorkingDirectoryMaterializerKind as MaterializerKind,
     WorkingDirectoryOccupancy, WorkingDirectoryStatusKind, WorkingDirectorySummary,
 };

crates/worker-runtime/src/catalog.rs

@@ -92,9 +92,9 @@ pub struct WorkingDirectoryRepository {
 }
 
 pub use workdir::workspace::{
-    MaterializerKind, WorkingDirectoryCleanupTarget, WorkingDirectoryCurrentObservation,
+    MaterializerKind, RuntimeWorkingDirectoryCleanupTarget as WorkingDirectoryCleanupTarget,
+    RuntimeWorkingDirectorySummary as WorkingDirectorySummary, WorkingDirectoryCurrentObservation,
     WorkingDirectoryOccupancy, WorkingDirectoryProvenance, WorkingDirectoryStatusKind,
-    WorkingDirectorySummary,
 };
 
 #[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]

crates/worker-runtime/src/runtime.rs

@@ -2402,6 +2402,7 @@ impl RuntimeState {
             display_name: worker.request.display_name.clone(),
             profile,
             repository_id,
+            repository_key: None,
             working_directory_id,
         })
     }

crates/worker/src/feature/builtin/manage_workdir.rs

@@ -423,12 +423,13 @@ impl WorkspaceHttpWorkdirBackend {
             .as_deref()
             .map(|value| validate_identity(value, CREATE_TOOL, "runtime_id"))
             .transpose()?;
-        let repository_id = validate_identity(&input.repository_id, CREATE_TOOL, "repository_id")?;
+        let repository_key =
+            validate_identity(&input.repository_key, CREATE_TOOL, "repository_key")?;
         let selector = validate_optional_selector(input.selector)?;
         let workspace_id = encode_path_segment(self.workspace_id()?);
         let request = WorkdirCreateRequest {
             runtime_id: runtime_id.map(str::to_string),
-            repository_id: repository_id.to_string(),
+            repository_key: repository_key.to_string(),
             selector,
             operation_id: Some(operation_id),
         };
@@ -682,10 +683,10 @@ fn create_schema() -> serde_json::Value {
     json!({
         "type": "object",
         "additionalProperties": false,
-        "required": ["repository_id"],
+        "required": ["repository_key"],
         "properties": {
             "runtime_id": {"type": ["string", "null"], "minLength": 1},
-            "repository_id": {"type": "string", "minLength": 1},
+            "repository_key": {"type": "string", "minLength": 1},
             "selector": {"type": ["string", "null"], "minLength": 1}
         }
     })
@@ -727,7 +728,7 @@ struct WorkdirListInput {}
 struct WorkdirCreateInput {
     #[serde(default)]
     runtime_id: Option<String>,
-    repository_id: String,
+    repository_key: String,
     #[serde(default)]
     selector: Option<String>,
 }
@@ -840,14 +841,14 @@ mod tests {
     fn workdir_json(id: &str) -> serde_json::Value {
         json!({
             "working_directory_id": id,
-            "repository_id": "main",
+            "repository_key": "main",
             "creation_selector": "refs/heads/main",
             "creation_ref": "0123456789abcdef",
             "materializer_kind": "local_git_worktree",
             "cleanup_target": {
                 "kind": "git_worktree",
                 "working_directory_id": id,
-                "repository_id": "main"
+                "repository_key": "main"
             },
             "status": "active",
             "cleanliness": "clean",
@@ -973,7 +974,7 @@ mod tests {
     #[test]
     fn schemas_expose_identities_without_paths_or_session_handles() {
         let create = create_schema();
-        assert_eq!(create["required"], json!(["repository_id"]));
+        assert_eq!(create["required"], json!(["repository_key"]));
         assert_eq!(
             create["properties"]["runtime_id"]["type"],
             json!(["string", "null"])
@@ -1048,7 +1049,7 @@ mod tests {
             .create(
                 WorkdirCreateInput {
                     runtime_id: Some("runtime/one".to_string()),
-                    repository_id: "main".to_string(),
+                    repository_key: "main".to_string(),
                     selector: Some("refs/heads/topic".to_string()),
                 },
                 "call-create-1".to_string(),
@@ -1089,7 +1090,7 @@ mod tests {
         assert_eq!(requests[1].method, WorkspaceRequestMethod::Post);
         let body: serde_json::Value =
             serde_json::from_str(requests[1].body.as_deref().unwrap()).unwrap();
-        assert_eq!(body["repository_id"], "main");
+        assert_eq!(body["repository_key"], "main");
         assert_eq!(body["runtime_id"], "runtime/one");
         assert_eq!(body["operation_id"], "call-create-1");
         assert_eq!(body["selector"], "refs/heads/topic");
@@ -1380,7 +1381,7 @@ mod tests {
             .create(
                 WorkdirCreateInput {
                     runtime_id: None,
-                    repository_id: "main".to_string(),
+                    repository_key: "main".to_string(),
                     selector: None,
                 },
                 "call-default".to_string(),
@@ -1405,7 +1406,7 @@ mod tests {
             .create(
                 WorkdirCreateInput {
                     runtime_id: Some(" ".to_string()),
-                    repository_id: "main".to_string(),
+                    repository_key: "main".to_string(),
                     selector: None,
                 },
                 "call-invalid".to_string(),

crates/worker/src/feature/builtin/merge_request.rs

@@ -56,7 +56,7 @@ struct TicketInput {
 #[derive(Debug, Deserialize, JsonSchema)]
 struct OpenMergeRequestInput {
     ticket: String,
-    repository_id: String,
+    repository_key: String,
     selector_from: String,
     selector_to: String,
     #[serde(default)]
@@ -178,7 +178,7 @@ impl Tool for MergeRequestTool {
                     WorkspaceRequestMethod::Post,
                     format!("/api/w/{ws}/tickets/{}/merge-request", v.ticket),
                     Some(
-                        json!({"repository_id":v.repository_id,"selector_from":v.selector_from,"selector_to":v.selector_to,"summary":v.summary}),
+                        json!({"repository_key":v.repository_key,"selector_from":v.selector_from,"selector_to":v.selector_to,"summary":v.summary}),
                     ),
                 )
             }

crates/workspace-api/src/lib.rs

@@ -533,7 +533,7 @@ impl std::fmt::Display for WorkingDirectoryStatusKind {
 pub struct WorkingDirectoryCleanupTarget {
     pub kind: String,
     pub working_directory_id: String,
-    pub repository_id: String,
+    pub repository_key: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -575,6 +575,51 @@ pub struct WorkingDirectoryOccupancy {
     pub linked_at: String,
 }
 
+/// Runtime-internal Workdir cleanup authority. This transport intentionally
+/// retains the Backend-generated Repository id and is never a Workspace public
+/// projection.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeWorkingDirectoryCleanupTarget {
+    pub kind: String,
+    pub working_directory_id: String,
+    pub repository_id: String,
+}
+
+/// Runtime-internal Workdir inventory transport. Workspace REST and model-facing
+/// surfaces must project this through [`WorkingDirectorySummary`] so the UUID is
+/// replaced with `repository_key`.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeWorkingDirectorySummary {
+    pub working_directory_id: String,
+    pub repository_id: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creation_selector: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creation_ref: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub creation_tree: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_selector: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_ref: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub current_tree: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub observed_at_epoch_seconds: Option<u64>,
+    pub materializer_kind: WorkingDirectoryMaterializerKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cleanup_target: Option<RuntimeWorkingDirectoryCleanupTarget>,
+    pub status: WorkingDirectoryStatusKind,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cleanliness: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub primary_worker_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub occupied_by: Option<WorkingDirectoryOccupancy>,
+}
+
 /// Public, provider-neutral Workdir inventory projection.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
@@ -582,7 +627,7 @@ pub struct WorkingDirectoryOccupancy {
 #[serde(deny_unknown_fields)]
 pub struct WorkingDirectorySummary {
     pub working_directory_id: String,
-    pub repository_id: String,
+    pub repository_key: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub creation_selector: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -629,7 +674,7 @@ impl WorkingDirectorySummary {
 pub struct WorkingDirectoryCreateRequest {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub runtime_id: Option<String>,
-    pub repository_id: String,
+    pub repository_key: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub selector: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -1228,7 +1273,7 @@ pub enum RepositoryAccessMode {
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 #[serde(deny_unknown_fields)]
 pub struct RepositorySshAccessBinding {
-    pub repository_id: String,
+    pub repository_key: String,
     pub credential_id: String,
     pub host_trust_id: String,
     pub access: RepositoryAccessMode,
@@ -1438,8 +1483,7 @@ mod tests {
         let repositories = serde_json::json!({
             "workspace_id": "workspace-test",
             "items": [{
-                "id": "main",
-                "display_name": "main",
+                "repository_key": "main",
                 "kind": "git",
                 "provider": "git",
                 "source": {"kind": "local_path", "uri": "/srv/project"},
@@ -1460,7 +1504,7 @@ mod tests {
         let stale = serde_json::json!({
             "workspace_id": "workspace-test",
             "items": [{
-                "repository_id": "main",
+                "repository_key": "main",
                 "display_name": "main",
                 "kind": "git",
                 "provider": "git",
@@ -1497,7 +1541,7 @@ mod tests {
         assert!(output.contains(
             "export type WorkspaceProfileSourceProvenance = \"project_profile_source_tree\""
         ));
-        assert!(!output.contains("repository_id: string, display_name"));
+        assert!(!output.contains("repository_key: string, display_name"));
     }
 
     #[test]
@@ -1754,7 +1798,7 @@ mod tests {
 
     #[test]
     fn workdir_create_request_preserves_optional_operation_fields() {
-        let payload = serde_json::json!({"repository_id": "main"});
+        let payload = serde_json::json!({"repository_key": "main"});
         let request = serde_json::from_value::<WorkingDirectoryCreateRequest>(payload)
             .expect("optional create fields may be absent");
 
@@ -1763,13 +1807,13 @@ mod tests {
         assert_eq!(request.operation_id, None);
 
         let serialized = serde_json::to_value(request).expect("serialize create request");
-        assert_eq!(serialized, serde_json::json!({"repository_id": "main"}));
+        assert_eq!(serialized, serde_json::json!({"repository_key": "main"}));
     }
 
     #[test]
     fn workdir_create_request_rejects_stale_or_incomplete_json() {
         let stale = serde_json::json!({
-            "repository_id": "main",
+            "repository_key": "main",
             "selector": "develop",
             "path": "/tmp/workdir"
         });
@@ -1786,7 +1830,7 @@ mod tests {
     fn workdir_summary_omits_absent_optional_fields_on_the_wire() {
         let value = serde_json::to_value(WorkingDirectorySummary {
             working_directory_id: "workdir-1".into(),
-            repository_id: "main".into(),
+            repository_key: "main".into(),
             creation_selector: None,
             creation_ref: None,
             creation_tree: None,
@@ -1830,7 +1874,7 @@ mod tests {
             "workspace_id": "workspace-test",
             "items": [{
                 "working_directory_id": "workdir-1",
-                "repository_id": "main",
+                "repository_key": "main",
                 "materializer_kind": "runtime_git_cache",
                 "status": "active",
                 "occupied_by": {

crates/workspace-server/src/authority.rs

@@ -918,13 +918,33 @@ impl SqliteWorkspaceAuthority {
                     self.merge_revision_source
                         .resolve_subject_ref(&request.repository_id, selector)
                 });
-                Some(merge_request_summary(request, current_subject_ref))
+                let repository_key = self
+                    .store
+                    .get_repository(&self.workspace_id, &request.repository_id)?
+                    .map(|repository| repository.repository_key)
+                    .ok_or_else(|| Error::UnknownRepository(request.repository_id.clone()))?;
+                Some(merge_request_summary(
+                    request,
+                    repository_key,
+                    current_subject_ref,
+                ))
             }
             Err(MergeRequestError::NotFound) => None,
             Err(error) => return Err(Error::Store(error.to_string())),
         };
+        let repository_key = ticket
+            .meta
+            .repository_id
+            .as_deref()
+            .map(|repository_id| {
+                self.store
+                    .get_repository(&self.workspace_id, repository_id)?
+                    .map(|repository| repository.repository_key)
+                    .ok_or_else(|| Error::UnknownRepository(repository_id.to_string()))
+            })
+            .transpose()?;
         let evidence = ticket_evidence_summary(
-            ticket.meta.repository_id.as_deref(),
+            repository_key.as_deref(),
             &ticket.events,
             merge_request.as_ref(),
         );
@@ -980,7 +1000,7 @@ impl SqliteWorkspaceAuthority {
             item_revision,
             queued_by: ticket.meta.queued_by,
             queued_at: ticket.meta.queued_at,
-            repository_id: ticket.meta.repository_id,
+            repository_key,
             ref_selector: ticket.meta.ref_selector,
             risk_flags: ticket.meta.risk_flags,
             body,
@@ -1742,6 +1762,7 @@ fn ticket_evidence_event(sequence: usize, event: &TicketEvent) -> TicketEvidence
 
 pub(crate) fn merge_request_summary(
     request: MergeRequest,
+    repository_key: String,
     current_subject_ref: Option<String>,
 ) -> TicketMergeRequestSummary {
     let latest_review_request = request.thread.iter().rev().find_map(|event| match event {
@@ -1790,7 +1811,7 @@ pub(crate) fn merge_request_summary(
 
     TicketMergeRequestSummary {
         merge_request_id: request.merge_request_id.clone(),
-        repository_id: request.repository_id.clone(),
+        repository_key,
         state,
         review_status,
         selector_from: request.selector_from.clone(),
@@ -1835,7 +1856,7 @@ fn ticket_evidence_summary(
     let linked_merge_request = merge_request.filter(|request| {
         request.state == "open"
             && ticket_repository_id
-                .is_some_and(|repository_id| repository_id == request.repository_id)
+                .is_some_and(|repository_id| repository_id == request.repository_key)
     });
     let has_merge_request = linked_merge_request.is_some();
     let has_current_subject_ref = linked_merge_request.is_some_and(|request| {
@@ -1886,7 +1907,7 @@ fn ticket_evidence_summary(
         Some(request) if request.state != "open" => missing.push("open_merge_request".to_string()),
         Some(request)
             if ticket_repository_id
-                .is_none_or(|repository_id| repository_id != request.repository_id) =>
+                .is_none_or(|repository_id| repository_id != request.repository_key) =>
         {
             missing.push("merge_request_repository".to_string())
         }
@@ -2823,6 +2844,7 @@ mod tests {
     fn merge_request_summary_uses_the_provider_resolved_current_subject() {
         let approved = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         assert_eq!(approved.review_status, "approved");
@@ -2834,6 +2856,7 @@ mod tests {
 
         let moved = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-2".to_string()),
         );
         assert_eq!(moved.review_status, "pending");
@@ -2846,6 +2869,7 @@ mod tests {
     fn ticket_readiness_requires_current_unrevoked_approval_without_a_report() {
         let approved = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         let evidence = ticket_evidence_summary(Some("main"), &[], Some(&approved));
@@ -2866,6 +2890,7 @@ mod tests {
 
         let revoked = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, true),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         let evidence = ticket_evidence_summary(Some("main"), &[], Some(&revoked));
@@ -2874,6 +2899,7 @@ mod tests {
 
         let changes = merge_request_summary(
             reviewed_merge_request(ReviewDecision::RequestChanges, false),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         let evidence = ticket_evidence_summary(Some("main"), &[], Some(&changes));
@@ -2883,8 +2909,11 @@ mod tests {
 
     #[test]
     fn ticket_readiness_fails_closed_for_missing_or_closed_current_merge_request() {
-        let unresolved =
-            merge_request_summary(reviewed_merge_request(ReviewDecision::Approve, false), None);
+        let unresolved = merge_request_summary(
+            reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
+            None,
+        );
         let evidence = ticket_evidence_summary(Some("main"), &[], Some(&unresolved));
         assert!(!evidence.has_current_subject_ref);
         assert!(!evidence.has_commit);
@@ -2892,7 +2921,11 @@ mod tests {
 
         let mut closed_request = reviewed_merge_request(ReviewDecision::Approve, false);
         closed_request.state = MergeRequestState::Closed;
-        let closed = merge_request_summary(closed_request, Some("commit-1".to_string()));
+        let closed = merge_request_summary(
+            closed_request,
+            "main".to_string(),
+            Some("commit-1".to_string()),
+        );
         let evidence = ticket_evidence_summary(Some("main"), &[], Some(&closed));
         assert!(!evidence.has_merge_request);
         assert!(!evidence.complete_for_integration);
@@ -2903,6 +2936,7 @@ mod tests {
     fn ticket_readiness_requires_request_and_approval_after_substantive_rescope() {
         let approved = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         let fresh = ticket_evidence_summary(
@@ -2946,6 +2980,7 @@ mod tests {
     fn ticket_query_filters_map_to_current_merge_request_evidence() {
         let approved_summary = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-1".to_string()),
         );
         let approved = ticket_evidence_summary(Some("main"), &[], Some(&approved_summary));
@@ -2962,6 +2997,7 @@ mod tests {
 
         let pending_summary = merge_request_summary(
             reviewed_merge_request(ReviewDecision::Approve, false),
+            "main".to_string(),
             Some("commit-2".to_string()),
         );
         let pending = ticket_evidence_summary(Some("main"), &[], Some(&pending_summary));

crates/workspace-server/src/hosts.rs

@@ -313,6 +313,7 @@ impl From<RuntimeSummary> for workspace_api::RuntimeSummary {
 pub(crate) fn workspace_worker_summary(
     summary: WorkerSummary,
     resource_key: String,
+    working_directory: Option<workspace_api::WorkingDirectorySummary>,
 ) -> workspace_api::WorkerSummary {
     workspace_api::WorkerSummary {
         runtime_id: summary.worker.runtime_id,
@@ -341,7 +342,7 @@ pub(crate) fn workspace_worker_summary(
             can_stop: summary.capabilities.can_stop,
             can_spawn_followup: summary.capabilities.can_spawn_followup,
         },
-        working_directory: summary.working_directory,
+        working_directory,
         diagnostics: summary.diagnostics.into_iter().map(Into::into).collect(),
     }
 }
@@ -402,10 +403,10 @@ pub struct RuntimeWorkingDirectoryResult {
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(deny_unknown_fields)]
 pub struct WorkerSpawnWorkingDirectoryRequest {
-    /// Safe configured Repository id. The host resolves this id to repository
-    /// authority from server-side config; browser callers cannot provide raw
-    /// source paths or runtime-internal storage paths.
-    pub repository_id: String,
+    /// Safe configured Repository key. The host resolves this key to internal
+    /// Repository authority; browser callers cannot provide Backend UUIDs, raw
+    /// source paths, or Runtime-internal storage paths.
+    pub repository_key: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub selector: Option<String>,
 }

crates/workspace-server/src/records.rs

@@ -78,7 +78,7 @@ pub struct TicketDetail {
     pub item_revision: String,
     pub queued_by: Option<String>,
     pub queued_at: Option<String>,
-    pub repository_id: Option<String>,
+    pub repository_key: Option<String>,
     pub ref_selector: Option<String>,
     pub risk_flags: Vec<String>,
     pub body: String,
@@ -301,7 +301,7 @@ pub struct TicketActionEligibility {
 #[cfg_attr(feature = "typescript", derive(ts_rs::TS))]
 pub struct TicketMergeRequestSummary {
     pub merge_request_id: String,
-    pub repository_id: String,
+    pub repository_key: String,
     pub state: String,
     pub review_status: String,
     pub selector_from: Option<String>,

crates/workspace-server/src/repositories.rs

@@ -97,7 +97,14 @@ impl RepositoryRegistryReader {
         }
     }
 
-    pub fn summary(
+    pub fn summary(&self, id: &str) -> Result<RepositorySummary, RepositoryLookupError> {
+        let repository = self
+            .find(id)
+            .ok_or_else(|| RepositoryLookupError::UnknownRepository { id: id.to_string() })?;
+        Ok(self.summary_for_config(repository))
+    }
+
+    pub fn summary_by_key(
         &self,
         repository_key: &str,
     ) -> Result<RepositorySummary, RepositoryLookupError> {

crates/workspace-server/src/repository_access.rs

@@ -146,16 +146,17 @@ fn project_repository_access_evaluation(
             Error::InvalidInput(format!("invalid Repository access config: {error}"))
         })?;
     let mut bindings = Vec::with_capacity(config.repository_access.len());
-    for (repository_id, access) in config.repository_access {
-        validate_identifier("repository_id", &repository_id)?;
+    for (repository_key, access) in config.repository_access {
+        workspace_api::validate_repository_key(&repository_key)
+            .map_err(|error| Error::InvalidInput(format!("invalid Repository key: {error}")))?;
         validate_identifier("credential_id", &access.ssh.credential)?;
         validate_identifier("host_trust_id", &access.ssh.host_trust)?;
         let repository = store
-            .get_repository(workspace_id, &repository_id)?
-            .ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_id}`")))?;
+            .get_repository_by_key(workspace_id, &repository_key)?
+            .ok_or_else(|| Error::InvalidInput(format!("unknown Repository `{repository_key}`")))?;
         if repository.source.kind != workspace_api::RepositorySourceKind::Ssh {
             return Err(Error::InvalidInput(format!(
-                "Repository `{repository_id}` is not an ssh:// Repository"
+                "Repository `{repository_key}` is not an ssh:// Repository"
             )));
         }
         let credential = secrets
@@ -182,34 +183,34 @@ fn project_repository_access_evaluation(
             })?;
         let uri = url::Url::parse(&repository.source.uri).map_err(|_| {
             Error::InvalidInput(format!(
-                "Repository `{repository_id}` has an invalid SSH URI"
+                "Repository `{repository_key}` has an invalid SSH URI"
             ))
         })?;
         if uri.scheme() != "ssh" || uri.username().is_empty() || uri.password().is_some() {
             return Err(Error::InvalidInput(format!(
-                "Repository `{repository_id}` must use ssh://user@host[:port]/path without credentials"
+                "Repository `{repository_key}` must use ssh://user@host[:port]/path without credentials"
             )));
         }
         let hostname = uri.host_str().ok_or_else(|| {
             Error::InvalidInput(format!(
-                "Repository `{repository_id}` SSH URI has no hostname"
+                "Repository `{repository_key}` SSH URI has no hostname"
             ))
         })?;
         let port = uri.port().unwrap_or(22);
         if hostname != host_trust.hostname || port != host_trust.port {
             return Err(Error::InvalidInput(format!(
-                "Repository `{repository_id}` SSH host does not match host trust `{}`",
+                "Repository `{repository_key}` SSH host does not match host trust `{}`",
                 access.ssh.host_trust
             )));
         }
         bindings.push(RepositorySshAccessBinding {
-            repository_id,
+            repository_key,
             credential_id: access.ssh.credential,
             host_trust_id: access.ssh.host_trust,
             access: access.ssh.access,
         });
     }
-    bindings.sort_by(|left, right| left.repository_id.cmp(&right.repository_id));
+    bindings.sort_by(|left, right| left.repository_key.cmp(&right.repository_key));
     Ok(RepositoryAccessProjection {
         workspace_id: workspace_id.to_string(),
         config_revision,
@@ -1441,7 +1442,7 @@ fn credential_references(
         .bindings
         .iter()
         .filter(|binding| binding.credential_id == credential_id)
-        .map(|binding| binding.repository_id.clone())
+        .map(|binding| binding.repository_key.clone())
         .collect()
 }
 
@@ -1453,7 +1454,7 @@ fn host_trust_references(
         .bindings
         .iter()
         .filter(|binding| binding.host_trust_id == host_trust_id)
-        .map(|binding| binding.repository_id.clone())
+        .map(|binding| binding.repository_key.clone())
         .collect()
 }
 
@@ -1912,7 +1913,7 @@ mod tests {
         let projection =
             project_repository_access_state(&*store, &service, "workspace-a", &state).unwrap();
         assert_eq!(projection.bindings.len(), 1);
-        assert_eq!(projection.bindings[0].repository_id, "remote");
+        assert_eq!(projection.bindings[0].repository_key, "remote");
         assert_eq!(
             projection.bindings[0].access,
             RepositoryAccessMode::ReadOnly
@@ -1999,7 +2000,7 @@ mod tests {
             config_revision: 3,
             projection_digest: "sha256:test".to_string(),
             bindings: vec![RepositorySshAccessBinding {
-                repository_id: "main".to_string(),
+                repository_key: "main".to_string(),
                 credential_id: "deploy".to_string(),
                 host_trust_id: "host".to_string(),
                 access: RepositoryAccessMode::ReadOnly,

crates/workspace-server/src/store.rs

@@ -1298,6 +1298,16 @@ impl SqliteWorkspaceStore {
             repairs.push("create missing worker_diagnostics_archives table".to_string());
         }
 
+        if current_schema_version < 50 && table_exists(&source, "repositories")? {
+            let repository_count: i64 =
+                source.query_row("SELECT COUNT(*) FROM repositories", [], |row| row.get(0))?;
+            if repository_count > 0 {
+                repairs.push(format!(
+                    "replace {repository_count} legacy public Repository id(s) with UUIDv7 internal ids, retain each prior id as repository_key, and retire free-form Repository names"
+                ));
+            }
+        }
+
         let mut candidate = Connection::open_in_memory()?;
         {
             let backup = Backup::new(&source, &mut candidate)?;
@@ -12568,6 +12578,18 @@ INSERT INTO worker_registry (
                  '1', '1', 'local_path', '/repo-a', 1, 'sha256:a', 'unverified'),
                 ('workspace-b', 'main', 'Legacy B', 'git', 'git', '/repo-b', 'develop',
                  '1', '1', 'local_path', '/repo-b', 1, 'sha256:b', 'unverified');
+            INSERT INTO typed_tickets (
+                workspace_id, ticket_id, slug, title, status, kind, priority, body,
+                workflow_state, workflow_state_explicit, repository_id
+            ) VALUES
+                ('workspace-a', 'ticket-a', 'ticket-a', 'Ticket A', 'open', 'task', 'normal', '', 'planning', 1, 'main'),
+                ('workspace-b', 'ticket-b', 'ticket-b', 'Ticket B', 'open', 'task', 'normal', '', 'planning', 1, 'main');
+            INSERT INTO merge_requests (
+                workspace_id, merge_request_id, repository_id, state,
+                selector_from, selector_to, created_at, updated_at
+            ) VALUES
+                ('workspace-a', 'mr-a', 'main', 'open', 'work/a', 'develop', '1', '1'),
+                ('workspace-b', 'mr-b', 'main', 'open', 'work/b', 'develop', '1', '1');
             INSERT INTO artifacts (
                 workspace_id, artifact_id, kind, uri, created_at,
                 created_by_kind, created_by_key, created_by_display, repository_id
@@ -12628,8 +12650,24 @@ INSERT INTO worker_registry (
                     |row| row.get(0),
                 )
                 .unwrap();
+            let ticket_repository_id: String = conn
+                .query_row(
+                    "SELECT repository_id FROM typed_tickets WHERE workspace_id = ?1",
+                    params![workspace_id],
+                    |row| row.get(0),
+                )
+                .unwrap();
+            let merge_request_repository_id: String = conn
+                .query_row(
+                    "SELECT repository_id FROM merge_requests WHERE workspace_id = ?1",
+                    params![workspace_id],
+                    |row| row.get(0),
+                )
+                .unwrap();
             assert_eq!(&artifact_repository_id, repository_id);
             assert_eq!(&workdir_repository_id, repository_id);
+            assert_eq!(&ticket_repository_id, repository_id);
+            assert_eq!(&merge_request_repository_id, repository_id);
         }
         assert!(
             table_columns(&conn, "repositories")

crates/workspace-server/src/workspace_subscription.rs

@@ -408,6 +408,9 @@ async fn run_workspace_workers(
                         continue;
                     };
                     worker.resource_key = Some(resource_key);
+                    if !project_repository_key(&api, &mut worker) {
+                        continue;
+                    }
                     let worker_ref = RuntimeWorkerRef::new(&runtime_id, worker.worker_id.as_str());
                     let revision = next_revision(&mut revisions, &worker_ref);
                     worker.subject_revision = revision;
@@ -507,11 +510,28 @@ fn install_snapshot(
             continue;
         };
         worker.resource_key = Some(resource_key);
+        if !project_repository_key(api, &mut worker) {
+            continue;
+        }
         projected.insert(worker.worker_id.to_string(), worker);
     }
     workers.insert(runtime_id.to_string(), projected);
 }
 
+fn project_repository_key(api: &WorkspaceApi, worker: &mut SubscriptionWorker) -> bool {
+    let Some(repository_id) = worker.repository_id.take() else {
+        return true;
+    };
+    let Ok(Some(repository)) = api
+        .store
+        .get_repository(&api.config.workspace_id, &repository_id)
+    else {
+        return false;
+    };
+    worker.repository_key = Some(repository.repository_key);
+    true
+}
+
 async fn send_event(
     outbound: &mpsc::Sender<WsMessage>,
     subscription_id: &SubscriptionId,

web/workspace/src/lib/generated/protocol.ts

@@ -192,7 +192,12 @@ resource_key?: string | null,
 /**
  * Producer-owned monotonic revision for this Worker subject.
  */
-subject_revision: number, state: SubscriptionWorkerState, has_running_internal_workers: boolean, workspace_id?: string | null, display_name?: string | null, profile?: string | null, repository_id?: string | null, working_directory_id?: SubscriptionWorkdirId | null, };
+subject_revision: number, state: SubscriptionWorkerState, has_running_internal_workers: boolean, workspace_id?: string | null, display_name?: string | null, profile?: string | null, repository_id?: string | null,
+/**
+ * Workspace-facing Repository key. Runtime producers leave this unset and
+ * Workspace Server projections replace `repository_id` with this field.
+ */
+repository_key?: string | null, working_directory_id?: SubscriptionWorkdirId | null, };
 
 export type SubscriptionWorkdir = { working_directory_id: SubscriptionWorkdirId, repository_id: string, state: string, primary_worker_id?: SubscriptionWorkerId | null, };
 

web/workspace/src/lib/generated/repository-access-api.ts

@@ -65,7 +65,7 @@ export type DeleteRepositorySshHostTrustRequest = {
 export type RepositoryAccessMode = "read_only" | "read_write";
 
 export type RepositorySshAccessBinding = {
-  repository_id: string;
+  repository_key: string;
   credential_id: string;
   host_trust_id: string;
   access: RepositoryAccessMode;

web/workspace/src/lib/generated/ticket-api.ts

@@ -23,7 +23,7 @@ export type TicketAssignmentPrincipalSummary = { "kind": "user", account_id: str
 
 export type TicketActionEligibility = { can_assign_orchestrator: boolean, can_unassign_orchestrator: boolean, can_queue: boolean, can_start_manual_coder: boolean, queue_tickets: Array<string>, blockers: Array<string>, };
 
-export type TicketMergeRequestSummary = { merge_request_id: string, repository_id: string, state: string, review_status: string, selector_from: string | null, selector_to: string, updated_at: string, current_subject_ref: string | null, review_subject_ref: string | null, review_requested_at: string | null, review_submitted_at: string | null, review_excerpt: string | null, };
+export type TicketMergeRequestSummary = { merge_request_id: string, repository_key: string, state: string, review_status: string, selector_from: string | null, selector_to: string, updated_at: string, current_subject_ref: string | null, review_subject_ref: string | null, review_requested_at: string | null, review_submitted_at: string | null, review_excerpt: string | null, };
 
 export type MergeRequestListItem = { summary: TicketMergeRequestSummary, ticket_ids: Array<string>, thread_event_count: number, };
 
@@ -49,4 +49,4 @@ export type TicketRelationNotice = { related_ticket: string, kind: string, messa
 
 export type TicketRelationView = { outgoing: Array<TicketRelation>, incoming: Array<DerivedTicketRelation>, blockers: Array<TicketRelationBlocker>, notices: Array<TicketRelationNotice>, };
 
-export type TicketDetail = { id: string, resource_key: string, title: string, state: string, readiness: string | null, priority: string, created_at: string | null, updated_at: string | null, item_revision: string, queued_by: string | null, queued_at: string | null, repository_id: string | null, ref_selector: string | null, risk_flags: Array<string>, body: string, body_truncated: boolean, event_count: number, events: Array<TicketEventDetail>, event_page: QueryPage, artifact_count: number, artifacts: Array<string>, relations: TicketRelationView, linked_objectives: Array<ObjectiveLinkSummary>, implementation_reports: Array<TicketEvidenceEvent>, assignments: Array<TicketRoleAssignmentSummary>, current_coder: TicketAssignmentSummary | null, assignment_diagnostics: Array<string>, action_eligibility: TicketActionEligibility, merge_request: TicketMergeRequestSummary | null, evidence: TicketEvidenceSummary, resolution: string | null, record_source: string, };
+export type TicketDetail = { id: string, resource_key: string, title: string, state: string, readiness: string | null, priority: string, created_at: string | null, updated_at: string | null, item_revision: string, queued_by: string | null, queued_at: string | null, repository_key: string | null, ref_selector: string | null, risk_flags: Array<string>, body: string, body_truncated: boolean, event_count: number, events: Array<TicketEventDetail>, event_page: QueryPage, artifact_count: number, artifacts: Array<string>, relations: TicketRelationView, linked_objectives: Array<ObjectiveLinkSummary>, implementation_reports: Array<TicketEvidenceEvent>, assignments: Array<TicketRoleAssignmentSummary>, current_coder: TicketAssignmentSummary | null, assignment_diagnostics: Array<string>, action_eligibility: TicketActionEligibility, merge_request: TicketMergeRequestSummary | null, evidence: TicketEvidenceSummary, resolution: string | null, record_source: string, };

web/workspace/src/lib/generated/workdir-api.ts

@@ -3,22 +3,77 @@
 
 export type DiagnosticSeverity = "info" | "warning" | "error";
 
-export type Diagnostic = { code: string, severity: DiagnosticSeverity, message: string, };
+export type Diagnostic = {
+  code: string;
+  severity: DiagnosticSeverity;
+  message: string;
+};
 
-export type WorkingDirectoryMaterializerKind = "runtime_git_cache" | "local_git_worktree";
+export type WorkingDirectoryMaterializerKind =
+  | "runtime_git_cache"
+  | "local_git_worktree";
 
-export type WorkingDirectoryStatusKind = "active" | "cleanup_pending" | "corrupted" | "not_found" | "unknown";
+export type WorkingDirectoryStatusKind =
+  | "active"
+  | "cleanup_pending"
+  | "corrupted"
+  | "not_found"
+  | "unknown";
 
-export type WorkingDirectoryCleanupTarget = { kind: string, working_directory_id: string, repository_id: string, };
+export type WorkingDirectoryCleanupTarget = {
+  kind: string;
+  working_directory_id: string;
+  repository_key: string;
+};
 
-export type WorkingDirectoryOccupancy = { runtime_id: string, worker_id: string, display_name: string, linked_at: string, };
+export type WorkingDirectoryOccupancy = {
+  runtime_id: string;
+  worker_id: string;
+  display_name: string;
+  linked_at: string;
+};
 
-export type WorkingDirectorySummary = { working_directory_id: string, repository_id: string, creation_selector?: string | null, creation_ref?: string | null, creation_tree?: string | null, current_selector?: string | null, current_ref?: string | null, current_tree?: string | null, observed_at_epoch_seconds?: number | null, materializer_kind: WorkingDirectoryMaterializerKind, cleanup_target?: WorkingDirectoryCleanupTarget | null, status: WorkingDirectoryStatusKind, cleanliness?: string | null, primary_worker_id?: string | null, occupied_by?: WorkingDirectoryOccupancy | null, };
+export type WorkingDirectorySummary = {
+  working_directory_id: string;
+  repository_key: string;
+  creation_selector?: string | null;
+  creation_ref?: string | null;
+  creation_tree?: string | null;
+  current_selector?: string | null;
+  current_ref?: string | null;
+  current_tree?: string | null;
+  observed_at_epoch_seconds?: number | null;
+  materializer_kind: WorkingDirectoryMaterializerKind;
+  cleanup_target?: WorkingDirectoryCleanupTarget | null;
+  status: WorkingDirectoryStatusKind;
+  cleanliness?: string | null;
+  primary_worker_id?: string | null;
+  occupied_by?: WorkingDirectoryOccupancy | null;
+};
 
-export type WorkingDirectoryCreateRequest = { runtime_id?: string | null, repository_id: string, selector?: string | null, operation_id?: string | null, };
+export type WorkingDirectoryCreateRequest = {
+  runtime_id?: string | null;
+  repository_key: string;
+  selector?: string | null;
+  operation_id?: string | null;
+};
 
-export type WorkingDirectoryListResponse = { workspace_id: string, items: Array<WorkingDirectorySummary>, diagnostics: Array<Diagnostic>, };
+export type WorkingDirectoryListResponse = {
+  workspace_id: string;
+  items: Array<WorkingDirectorySummary>;
+  diagnostics: Array<Diagnostic>;
+};
 
-export type WorkingDirectoryDetailResponse = { workspace_id: string, runtime_id: string, item: WorkingDirectorySummary, diagnostics: Array<Diagnostic>, };
+export type WorkingDirectoryDetailResponse = {
+  workspace_id: string;
+  runtime_id: string;
+  item: WorkingDirectorySummary;
+  diagnostics: Array<Diagnostic>;
+};
 
-export type WorkingDirectoryCreateResponse = { workspace_id: string, runtime_id: string, item: WorkingDirectorySummary, diagnostics: Array<Diagnostic>, };
+export type WorkingDirectoryCreateResponse = {
+  workspace_id: string;
+  runtime_id: string;
+  item: WorkingDirectorySummary;
+  diagnostics: Array<Diagnostic>;
+};

web/workspace/src/lib/generated/workspace-api.ts

@@ -14,8 +14,7 @@ export type WorkspaceCatalogListResponse = Array<WorkspaceSummary>;
 
 export type WorkspaceRepositoryRecord = {
   workspace_id: string;
-  repository_id: string;
-  name: string;
+  repository_key: string;
   kind: string;
   provider: string | null;
   source: RepositorySource;
@@ -175,8 +174,7 @@ export type GitRepositorySummary = {
 };
 
 export type RepositorySummary = {
-  id: string;
-  display_name: string;
+  repository_key: string;
   kind: string;
   provider: string;
   source: RepositorySource;
@@ -216,7 +214,7 @@ export type RepositoryDetailResponse = {
 
 export type RepositoryLogResponse = {
   workspace_id: string;
-  repository_id: string;
+  repository_key: string;
   default_selector?: string | null;
   limit: number;
   items: Array<GitCommitSummary>;

web/workspace/src/lib/workspace/api/merge-requests.ts

@@ -19,7 +19,7 @@ export type MergeRequestThreadEvent = {
 export type MergeRequestRecord = {
   merge_request_id: string;
   workspace_id: string;
-  repository_id: string;
+  repository_key: string;
   selector_from: string | null;
   selector_to: string;
   ticket_ids: string[];

web/workspace/src/lib/workspace/api/repository-access.ts

@@ -112,12 +112,12 @@ export function parseRepositoryAccessProjection(
   bindings.forEach((binding, index) => {
     const bindingPath = `${path}.bindings[${index}]`;
     const bindingRecord = readRecord(binding, bindingPath, [
-      "repository_id",
+      "repository_key",
       "credential_id",
       "host_trust_id",
       "access",
     ]);
-    readString(bindingRecord, "repository_id", bindingPath);
+    readString(bindingRecord, "repository_key", bindingPath);
     readString(bindingRecord, "credential_id", bindingPath);
     readString(bindingRecord, "host_trust_id", bindingPath);
     const access = readString(bindingRecord, "access", bindingPath);

web/workspace/src/lib/workspace/api/workdirs.ts

@@ -11,7 +11,7 @@ import type {
 
 const SUMMARY_KEYS = new Set([
   "working_directory_id",
-  "repository_id",
+  "repository_key",
   "creation_selector",
   "creation_ref",
   "creation_tree",
@@ -28,7 +28,7 @@ const SUMMARY_KEYS = new Set([
 ]);
 const CREATE_REQUEST_KEYS = new Set([
   "runtime_id",
-  "repository_id",
+  "repository_key",
   "selector",
   "operation_id",
 ]);
@@ -36,7 +36,7 @@ const DIAGNOSTIC_KEYS = new Set(["code", "severity", "message"]);
 const CLEANUP_TARGET_KEYS = new Set([
   "kind",
   "working_directory_id",
-  "repository_id",
+  "repository_key",
 ]);
 const OCCUPANCY_KEYS = new Set([
   "runtime_id",
@@ -81,7 +81,7 @@ export function validateWorkingDirectoryCreateRequest(
     "Workdir create request",
   );
   const request: WorkingDirectoryCreateRequest = {
-    repository_id: stringField(record, "repository_id"),
+    repository_key: stringField(record, "repository_key"),
   };
   assignOptionalString(request, record, "runtime_id");
   assignOptionalString(request, record, "selector");
@@ -110,7 +110,7 @@ function parseSummary(value: unknown): WorkingDirectorySummary {
   const record = exactRecord(value, SUMMARY_KEYS, "Workdir summary");
   const summary: WorkingDirectorySummary = {
     working_directory_id: stringField(record, "working_directory_id"),
-    repository_id: stringField(record, "repository_id"),
+    repository_key: stringField(record, "repository_key"),
     materializer_kind: enumField(record, "materializer_kind", [
       "runtime_git_cache",
       "local_git_worktree",
@@ -166,7 +166,7 @@ function parseCleanupTarget(value: unknown): WorkingDirectoryCleanupTarget {
   return {
     kind: stringField(record, "kind"),
     working_directory_id: stringField(record, "working_directory_id"),
-    repository_id: stringField(record, "repository_id"),
+    repository_key: stringField(record, "repository_key"),
   };
 }
 

web/workspace/src/lib/workspace/api/workspace-catalog.ts

@@ -18,8 +18,8 @@ export type CreateWorkspaceRequest = {
   operation_key: string;
   display_name: string;
   repository: {
+    repository_key: string;
     uri: string;
-    display_name: string | null;
     default_ref: string | null;
   };
 };

web/workspace/src/lib/workspace/api/workspace-model.ts

@@ -170,8 +170,7 @@ function repositorySummary(value: unknown, path: string): RepositorySummary {
   exactKeys(
     item,
     [
-      "id",
-      "display_name",
+      "repository_key",
       "kind",
       "provider",
       "source",
@@ -200,8 +199,7 @@ function repositorySummary(value: unknown, path: string): RepositorySummary {
         repositoryDiagnostic(entry, `${path}.diagnostics[${index}]`)
       );
   return {
-    id: string(item.id, `${path}.id`),
-    display_name: string(item.display_name, `${path}.display_name`),
+    repository_key: string(item.repository_key, `${path}.repository_key`),
     kind: string(item.kind, `${path}.kind`),
     provider: string(item.provider, `${path}.provider`),
     source: repositorySource(item.source, `${path}.source`),
@@ -263,8 +261,7 @@ function workspaceRepositoryRecord(
     item,
     [
       "workspace_id",
-      "repository_id",
-      "name",
+      "repository_key",
       "kind",
       "provider",
       "source",
@@ -287,8 +284,7 @@ function workspaceRepositoryRecord(
   }
   return {
     workspace_id: string(item.workspace_id, `${path}.workspace_id`),
-    repository_id: string(item.repository_id, `${path}.repository_id`),
-    name: string(item.name, `${path}.name`),
+    repository_key: string(item.repository_key, `${path}.repository_key`),
     kind: string(item.kind, `${path}.kind`),
     provider: nullableString(item.provider, `${path}.provider`),
     source: repositorySource(item.source, `${path}.source`),
@@ -573,7 +569,7 @@ export function parseRepositoryLogResponse(
     response,
     [
       "workspace_id",
-      "repository_id",
+      "repository_key",
       "default_selector",
       "limit",
       "items",
@@ -586,9 +582,9 @@ export function parseRepositoryLogResponse(
       response.workspace_id,
       "repository log response.workspace_id",
     ),
-    repository_id: string(
-      response.repository_id,
-      "repository log response.repository_id",
+    repository_key: string(
+      response.repository_key,
+      "repository log response.repository_key",
     ),
     default_selector: optionalNullableString(
       response.default_selector,

web/workspace/src/lib/workspace/console/worker-console.ui.test.ts

@@ -128,7 +128,7 @@ Deno.test("workspace Worker list lives on the dedicated Workers page", async ()
       workersNav.includes("worker.display_name || worker.label") &&
       workersNav.includes("worker-status-dot") &&
       workersNav.includes("worker-status-spinner") &&
-      workersNav.includes("worker.repository_id ?? '—'") &&
+      workersNav.includes("worker.repository_key ?? '—'") &&
       workersNav.includes("worker.working_directory_id ?? '—'") &&
       !workersNav.includes('aria-disabled="true"'),
     "Workers sidebar should link to the Worker list page and show state indicators with repository/workdir metadata",
@@ -207,13 +207,13 @@ Deno.test("workspace Tickets surface provides Kanban and lifecycle controls", as
   );
   const repositoryLoad = await Deno.readTextFile(
     new URL(
-      "./../../../routes/w/[workspaceId]/repositories/[repositoryId]/+page.ts",
+      "./../../../routes/w/[workspaceId]/repositories/[repositoryKey]/+page.ts",
       import.meta.url,
     ),
   );
   const repositoryPage = await Deno.readTextFile(
     new URL(
-      "./../../../routes/w/[workspaceId]/repositories/[repositoryId]/+page.svelte",
+      "./../../../routes/w/[workspaceId]/repositories/[repositoryKey]/+page.svelte",
       import.meta.url,
     ),
   );

web/workspace/src/lib/workspace/settings/workdir-revision.test.ts

@@ -17,7 +17,7 @@ function workdir(
 ): WorkingDirectorySummary {
   return {
     working_directory_id: "workdir-1",
-    repository_id: "repository-1",
+    repository_key: "repository-1",
     current_selector,
     current_ref,
     materializer_kind: "local_git_worktree",
@@ -25,7 +25,7 @@ function workdir(
     cleanup_target: {
       kind: "local_git_worktree",
       working_directory_id: "workdir-1",
-      repository_id: "repository-1",
+      repository_key: "repository-1",
     },
   };
 }

web/workspace/src/lib/workspace/sidebar/WorkersNavSection.svelte

@@ -88,7 +88,7 @@
             </span>
             <span class="worker-nav-label">{worker.display_name || worker.label}</span>
             <small class="worker-nav-meta">
-              {worker.repository_id ?? '—'}・{worker.working_directory_id ?? '—'}
+              {worker.repository_key ?? '—'}・{worker.working_directory_id ?? '—'}
             </small>
           </a>
         </li>

web/workspace/src/lib/workspace/sidebar/types.ts

@@ -118,8 +118,7 @@ export type WorkerLaunchProfileCandidate = {
 };
 
 export type WorkingDirectoryRepositoryOption = {
-  id: string;
-  display_name: string;
+  repository_key: string;
   default_selector?: string | null;
 };
 
@@ -149,7 +148,7 @@ export type CleanupWorkdirCandidate = {
   action: CleanupTargetKind;
   workdir_id: string;
   runtime_id: string;
-  repository_id: string;
+  repository_key: string;
   reason: string;
   blocking_reason?: string | null;
   linked_worker_ids: string[];

web/workspace/src/lib/workspace/sidebar/worker-launch.test.ts

@@ -44,12 +44,12 @@ const options: WorkerLaunchOptionsResponse = {
     { id: "builtin:coder", label: "Coder", description: "code" },
   ],
   repositories: [
-    { id: "repo", display_name: "Repo", default_selector: "HEAD" },
+    { repository_key: "repo", default_selector: "HEAD" },
   ],
   working_directories: [
     {
       working_directory_id: "wd-1-repo",
-      repository_id: "repo",
+      repository_key: "repo",
       creation_selector: "HEAD",
       creation_ref: "0123456789abcdef",
       current_selector: null,
@@ -61,7 +61,7 @@ const options: WorkerLaunchOptionsResponse = {
       cleanup_target: {
         kind: "git_worktree",
         working_directory_id: "wd-1-repo",
-        repository_id: "repo",
+        repository_key: "repo",
       },
     },
   ],
@@ -75,7 +75,7 @@ Deno.test("defaultWorkerLaunchForm uses the Backend-published Workspace default
     profile: "",
     initial_text: "hello",
     working_directory_id: "",
-    working_directory_repository_id: "",
+    working_directory_repository_key: "",
     working_directory_selector: "",
     relative_cwd: "",
   });
@@ -85,7 +85,7 @@ Deno.test("defaultWorkerLaunchForm uses the Backend-published Workspace default
   assertEquals(form.profile, "builtin:coder");
   assertEquals(form.initial_text, "hello");
   assertEquals(form.working_directory_id, "wd-1-repo");
-  assertEquals(form.working_directory_repository_id, "repo");
+  assertEquals(form.working_directory_repository_key, "repo");
   assertEquals(form.working_directory_selector, "HEAD");
 });
 
@@ -103,7 +103,7 @@ Deno.test("defaultWorkerLaunchForm preserves an available Ticket role profile",
     profile: "builtin:reviewer",
     initial_text: "Review the ticket.",
     working_directory_id: "",
-    working_directory_repository_id: "repo",
+    working_directory_repository_key: "repo",
     working_directory_selector: "HEAD",
     relative_cwd: "",
   });
@@ -133,7 +133,7 @@ Deno.test("defaultWorkerLaunchForm skips occupied working directories", () => {
       profile: "",
       initial_text: "hello",
       working_directory_id: "",
-      working_directory_repository_id: "",
+      working_directory_repository_key: "",
       working_directory_selector: "",
       relative_cwd: "",
     },
@@ -149,8 +149,7 @@ Deno.test("defaultWorkerLaunchForm preserves a Ticket repository target", () =>
       repositories: [
         ...options.repositories,
         {
-          id: "ticket-repo",
-          display_name: "Ticket repo",
+          repository_key: "ticket-repo",
           default_selector: "main",
         },
       ],
@@ -159,7 +158,7 @@ Deno.test("defaultWorkerLaunchForm preserves a Ticket repository target", () =>
         {
           ...options.working_directories[0],
           working_directory_id: "ticket-workdir",
-          repository_id: "ticket-repo",
+          repository_key: "ticket-repo",
           creation_selector: "work/ticket",
         },
       ],
@@ -170,14 +169,14 @@ Deno.test("defaultWorkerLaunchForm preserves a Ticket repository target", () =>
       profile: "builtin:coder",
       initial_text: "Work on a ticket.",
       working_directory_id: "",
-      working_directory_repository_id: "ticket-repo",
+      working_directory_repository_key: "ticket-repo",
       working_directory_selector: "work/ticket",
       relative_cwd: "",
     },
   );
 
   assertEquals(form.working_directory_id, "ticket-workdir");
-  assertEquals(form.working_directory_repository_id, "ticket-repo");
+  assertEquals(form.working_directory_repository_key, "ticket-repo");
   assertEquals(form.working_directory_selector, "work/ticket");
 });
 
@@ -188,7 +187,7 @@ Deno.test("buildCreateWorkspaceWorkerRequest sends working_directory id and rela
     profile: "builtin:coder",
     initial_text: "go",
     working_directory_id: "wd-1-repo",
-    working_directory_repository_id: "repo",
+    working_directory_repository_key: "repo",
     working_directory_selector: "main",
     relative_cwd: "crates/yoi",
   });
@@ -212,7 +211,7 @@ Deno.test("buildCreateWorkspaceWorkerRequest sends no initial segments for an em
     profile: "builtin:companion",
     initial_text: "   ",
     working_directory_id: "",
-    working_directory_repository_id: "",
+    working_directory_repository_key: "",
     working_directory_selector: "",
     relative_cwd: "",
   });
@@ -227,7 +226,7 @@ Deno.test("buildCreateWorkspaceWorkerRequest omits working_directory for embedde
     profile: "builtin:companion",
     initial_text: "chat",
     working_directory_id: "",
-    working_directory_repository_id: "",
+    working_directory_repository_key: "",
     working_directory_selector: "",
     relative_cwd: "",
   });

web/workspace/src/lib/workspace/sidebar/worker-launch.ts

@@ -11,7 +11,7 @@ export type WorkerLaunchFormState = {
   profile: string;
   initial_text: string;
   working_directory_id: string;
-  working_directory_repository_id: string;
+  working_directory_repository_key: string;
   working_directory_selector: string;
   relative_cwd: string;
 };
@@ -54,20 +54,20 @@ export function defaultWorkerLaunchForm(
   const preferredWorkingDirectory = workdirlessRuntime
     ? undefined
     : availableWorkingDirectories.find((directory) =>
-      Boolean(current.working_directory_repository_id) &&
-      directory.repository_id === current.working_directory_repository_id &&
+      Boolean(current.working_directory_repository_key) &&
+      directory.repository_key === current.working_directory_repository_key &&
       (!current.working_directory_selector ||
         (directory.current_selector ?? directory.creation_selector) ===
           current.working_directory_selector)
     ) ?? availableWorkingDirectories.find((directory) =>
-      Boolean(current.working_directory_repository_id) &&
-      directory.repository_id === current.working_directory_repository_id
-    ) ?? (current.working_directory_repository_id
+      Boolean(current.working_directory_repository_key) &&
+      directory.repository_key === current.working_directory_repository_key
+    ) ?? (current.working_directory_repository_key
       ? undefined
       : availableWorkingDirectories[0]);
   const preferredRepository =
     options?.repositories.find((repository) =>
-      repository.id === current.working_directory_repository_id
+      repository.repository_key === current.working_directory_repository_key
     ) ??
       options?.repositories[0];
 
@@ -86,8 +86,8 @@ export function defaultWorkerLaunchForm(
         )
         ? current.working_directory_id
         : preferredWorkingDirectory?.working_directory_id || "",
-    working_directory_repository_id: current.working_directory_repository_id ||
-      preferredRepository?.id || "",
+    working_directory_repository_key: current.working_directory_repository_key ||
+      preferredRepository?.repository_key || "",
     working_directory_selector: current.working_directory_selector ||
       preferredRepository?.default_selector || "HEAD",
     relative_cwd: current.relative_cwd,

web/workspace/src/lib/workspace/sidebar/worker-subscription.ts

@@ -9,7 +9,7 @@ import { compareWorkersForSidebar } from './workers';
 import type { Worker } from './types';
 
 export type SidebarWorker = Worker & {
-  repository_id: string | null;
+  repository_key: string | null;
   working_directory_id: string | null;
   has_running_internal_workers: boolean;
 };
@@ -97,7 +97,7 @@ function projectWorker(worker: SubscriptionWorker): SidebarWorker {
       can_stop: worker.state !== 'stopped' && worker.state !== 'cancelled',
       can_spawn_followup: false,
     },
-    repository_id: worker.repository_id ?? null,
+    repository_key: worker.repository_key ?? null,
     working_directory_id: worker.working_directory_id ?? null,
     has_running_internal_workers: worker.has_running_internal_workers,
     working_directory: null,

web/workspace/src/lib/workspace/tickets/ticket-panel.test.ts

@@ -88,7 +88,7 @@ Deno.test("ticket worker launch uses the common Worker route and bounded Ticket
   const ticket = {
     id: "00001KYRRDVH9",
     title: "Ticket panel API",
-    repository_id: "main repo",
+    repository_key: "main repo",
     ref_selector: "work/ticket",
   } as TicketDetail;
 
@@ -102,7 +102,7 @@ Deno.test("ticket worker launch uses the common Worker route and bounded Ticket
   assertEquals(url.pathname, "/w/workspace%20one/workers/new");
   assertEquals(url.searchParams.get("ticketId"), ticket.id);
   assertEquals(url.searchParams.get("ticketRole"), "reviewer");
-  assertEquals(url.searchParams.get("repositoryId"), "main repo");
+  assertEquals(url.searchParams.get("repositoryKey"), "main repo");
   assertEquals(url.searchParams.get("refSelector"), "work/ticket");
   assertEquals(
     url.searchParams.get("initialInput"),

web/workspace/src/lib/workspace/tickets/ticket-panel.ts

@@ -120,7 +120,7 @@ export function ticketWorkerLaunchHref(
   workspaceId: string,
   ticket: Pick<
     TicketDetail,
-    "id" | "title" | "repository_id" | "ref_selector"
+    "id" | "title" | "repository_key" | "ref_selector"
   >,
   role: TicketWorkerRole,
 ): string {
@@ -130,8 +130,8 @@ export function ticketWorkerLaunchHref(
     ticketRole: role,
     initialInput: ticketWorkerMessage(ticket.id, role),
   });
-  if (ticket.repository_id) {
-    params.set("repositoryId", ticket.repository_id);
+  if (ticket.repository_key) {
+    params.set("repositoryKey", ticket.repository_key);
   }
   if (ticket.ref_selector) {
     params.set("refSelector", ticket.ref_selector);

web/workspace/src/routes/+page.svelte

@@ -17,8 +17,8 @@
   let creating = $state(false);
   let creationError = $state<string | null>(null);
   let displayName = $state("");
+  let repositoryKey = $state("");
   let repositoryUri = $state("");
-  let repositoryName = $state("Main");
   let defaultRef = $state("");
   let lastSubmission = $state<{
     signature: string;
@@ -48,7 +48,7 @@
     const normalized = {
       displayName: displayName.trim(),
       repositoryUri: repositoryUri.trim(),
-      repositoryName: repositoryName.trim(),
+      repositoryKey: repositoryKey.trim(),
       defaultRef: defaultRef.trim(),
     };
     const signature = JSON.stringify(normalized);
@@ -58,8 +58,8 @@
         operation_key: createOperationKey(),
         display_name: normalized.displayName,
         repository: {
+          repository_key: normalized.repositoryKey,
           uri: normalized.repositoryUri,
-          display_name: normalized.repositoryName || null,
           default_ref: normalized.defaultRef || null,
         },
       };
@@ -132,7 +132,7 @@
             <code>{workspace.workspace_id}</code>
             {#if workspace.repositories[0]}
               <span class="workspace-repository-summary">
-                {workspace.repositories[0].display_name}
+                {workspace.repositories[0].repository_key}
                 <small>
                   {workspace.repositories[0].default_selector ?? "repository default"} ·
                   {workspace.repositories[0].kind}
@@ -169,8 +169,8 @@
       </label>
       <div class="workspace-create-row">
         <label>
-          Repository display name
-          <input bind:value={repositoryName} autocomplete="off" />
+          Repository key
+          <input bind:value={repositoryKey} required pattern="[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9]" maxlength="64" autocomplete="off" />
         </label>
         <label>
           Default ref

web/workspace/src/routes/w/[workspaceId]/merge-requests/+page.svelte

@@ -40,7 +40,7 @@
               </strong>
             </div>
             <p class="ticket-summary">
-              Repository {mergeRequest.repository_id} · {item.ticket_ids.length} linked Ticket{item.ticket_ids.length === 1 ? "" : "s"} · review {mergeRequest.review_status}
+              Repository {mergeRequest.repository_key} · {item.ticket_ids.length} linked Ticket{item.ticket_ids.length === 1 ? "" : "s"} · review {mergeRequest.review_status}
             </p>
           </div>
           <div class="ticket-meta">

web/workspace/src/routes/w/[workspaceId]/merge-requests/[mergeRequestId]/+page.svelte

@@ -48,7 +48,7 @@
         <section class="ticket-detail-section">
           <div class="ticket-section-heading"><h2>Selectors</h2></div>
           <dl class="ticket-facts">
-            <div><dt>Repository</dt><dd>{mergeRequest.repository_id}</dd></div>
+            <div><dt>Repository</dt><dd>{mergeRequest.repository_key}</dd></div>
             <div><dt>State</dt><dd>{mergeRequest.state}</dd></div>
             <div><dt>Source selector</dt><dd><code>{mergeRequest.selector_from ?? "requires repair"}</code></dd></div>
             <div><dt>Source revision</dt><dd>{mergeRequest.source.status}{mergeRequest.source.ref ? ` · ${mergeRequest.source.ref}` : ""}</dd></div>

web/workspace/src/routes/w/[workspaceId]/repositories/[repositoryKey]/+page.svelte

@@ -6,7 +6,7 @@
 </script>
 
 <svelte:head>
-  <title>{data.repository?.item.display_name ?? data.repositoryId} · Repository</title>
+  <title>{data.repository?.item.repository_key ?? data.repositoryKey} · Repository</title>
 </svelte:head>
 
 <section class="card repository-detail-card">
@@ -14,7 +14,7 @@
   {#if data.repository}
     <div class="repository-detail-heading">
       <div>
-        <h3>{data.repository.item.display_name}</h3>
+        <h3>{data.repository.item.repository_key}</h3>
       </div>
       <span class="status-pill" class:warn={data.repository.item.observed_status !== 'ready'}>{data.repository.item.observed_status}</span>
     </div>

web/workspace/src/routes/w/[workspaceId]/repositories/[repositoryKey]/+page.ts

@@ -7,20 +7,20 @@ import type { PageLoad } from "./$types";
 
 export const load: PageLoad = async ({ fetch, params }) => {
   const workspaceId = params.workspaceId;
-  const repositoryId = params.repositoryId;
+  const repositoryKey = params.repositoryKey;
   const [repositoryResult, logResult] = await Promise.all([
     loadJson<unknown>(
       fetch,
       workspaceApiPath(
         workspaceId,
-        `/repositories/${encodeURIComponent(repositoryId)}`,
+        `/repositories/${encodeURIComponent(repositoryKey)}`,
       ),
     ),
     loadJson<unknown>(
       fetch,
       workspaceApiPath(
         workspaceId,
-        `/repositories/${encodeURIComponent(repositoryId)}/log`,
+        `/repositories/${encodeURIComponent(repositoryKey)}/log`,
       ),
     ),
   ]);
@@ -50,7 +50,7 @@ export const load: PageLoad = async ({ fetch, params }) => {
   }
 
   return {
-    repositoryId,
+    repositoryKey,
     repository,
     repositoryError,
     repositoryLog: log,

web/workspace/src/routes/w/[workspaceId]/settings/repositories/+page.svelte

@@ -16,8 +16,7 @@
     return kind === 'ssh' || kind === 'http' || kind === 'https';
   }
   let showAddRepository = $state(false);
-  let repositoryId = $state('');
-  let displayName = $state('');
+  let repositoryKey = $state('');
   let source = $state('');
   let defaultRef = $state('');
   let pending = $state(false);
@@ -39,15 +38,13 @@
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({
-          repository_id: repositoryId,
-          display_name: displayName,
+          repository_key: repositoryKey,
           source,
           default_ref: defaultRef || null,
         }),
       });
       if (!response.ok) throw new Error(await responseError(response));
-      repositoryId = '';
-      displayName = '';
+      repositoryKey = '';
       source = '';
       defaultRef = '';
       showAddRepository = false;
@@ -82,12 +79,9 @@
       <h2>Add Repository</h2>
       <div class="settings-form-grid">
         <label>
-          Repository ID
-          <input bind:value={repositoryId} required pattern="[A-Za-z0-9_.-]+" maxlength="128" autocomplete="off" />
-        </label>
-        <label>
-          Display name
-          <input bind:value={displayName} required maxlength="256" autocomplete="off" />
+          Repository key
+          <input bind:value={repositoryKey} required pattern="[a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9]" maxlength="64" autocomplete="off" />
+          <small>1–64 lowercase letters, digits, or hyphens; no leading or trailing hyphen.</small>
         </label>
         <label class="settings-form-field-wide">
           Source
@@ -133,13 +127,12 @@
           </tr>
         </thead>
         <tbody>
-          {#each data.repositories.items as repository (repository.id)}
+          {#each data.repositories.items as repository (repository.repository_key)}
             <tr>
               <td>
-                <a class="inline-link" href={workspaceRoute(data.workspaceId, `/repositories/${encodeURIComponent(repository.id)}`)}>
-                  <strong>{repository.display_name}</strong>
+                <a class="inline-link" href={workspaceRoute(data.workspaceId, `/repositories/${encodeURIComponent(repository.repository_key)}`)}>
+                  <strong><code>{repository.repository_key}</code></strong>
                 </a>
-                <small><code>{repository.id}</code></small>
               </td>
               <td>
                 <span>{sourceLabel(repository.source.kind)}</span>

web/workspace/src/routes/w/[workspaceId]/settings/repository-access/+page.svelte

@@ -234,9 +234,9 @@
     <h3>Active access projection</h3>
     <p>Config revision {accessProjection.config_revision} · <code>{accessProjection.projection_digest}</code></p>
     {#if accessProjection.bindings.length === 0}<p>No repository access bindings are active.</p>{/if}
-    {#each accessProjection.bindings as binding (binding.repository_id)}
+    {#each accessProjection.bindings as binding (binding.repository_key)}
       <div class="card">
-        <strong>{binding.repository_id}</strong>
+        <strong>{binding.repository_key}</strong>
         <p>{binding.access} · credential <code>{binding.credential_id}</code> · host trust <code>{binding.host_trust_id}</code></p>
       </div>
     {/each}

web/workspace/src/routes/w/[workspaceId]/settings/runtimes/[runtimeId]/workdirs/+page.svelte

@@ -25,7 +25,7 @@
   });
 
   function repositoryProvider(workdir: WorkingDirectorySummary): string | null {
-    return data.repositories?.items.find((repository) => repository.id === workdir.repository_id)
+    return data.repositories?.items.find((repository) => repository.repository_key === workdir.repository_key)
       ?.provider ?? null;
   }
 
@@ -139,7 +139,7 @@
             {@const cleanup = cleanupCandidate(workdir)}
             <tr>
               <td><code>{workdir.working_directory_id}</code></td>
-              <td>{workdir.repository_id}</td>
+              <td>{workdir.repository_key}</td>
               <td><code>{currentRevision(workdir)}</code></td>
               <td>{workdir.status}</td>
               <td>{workdir.cleanliness ?? 'unknown'}</td>

web/workspace/src/routes/w/[workspaceId]/tickets/[ticketId]/+page.svelte

@@ -48,7 +48,7 @@
   let editing = $state(false);
   let editTitle = $state(loadedTicket.title);
   let editBody = $state(loadedTicket.body);
-  let repositoryId = $state(loadedTicket.repository_id ?? "");
+  let repositoryKey = $state(loadedTicket.repository_key ?? "");
   let refSelector = $state(loadedTicket.ref_selector ?? "");
   let nextState = $state(loadedTicket.state);
   let transitionReason = $state("");
@@ -68,7 +68,7 @@
     ticket.assignments.find((assignment) => assignment.role === "coder") ?? null,
   );
   const selectedRepository = $derived(
-    (loadedRepositories?.items ?? []).find((repository: RepositorySummary) => repository.id === repositoryId) ?? null,
+    (loadedRepositories?.items ?? []).find((repository: RepositorySummary) => repository.repository_key === repositoryKey) ?? null,
   );
   const effectiveRefSelector = $derived(refSelector.trim() || selectedRepository?.default_ref || "");
   const targetCandidateValid = $derived(
@@ -78,10 +78,10 @@
       effectiveRefSelector.length > 0,
   );
   const persistedTargetValid = $derived(
-    ticket.repository_id !== null &&
+    ticket.repository_key !== null &&
       ticket.ref_selector !== null &&
       (loadedRepositories?.items ?? []).some((repository: RepositorySummary) =>
-        repository.id === ticket.repository_id && (repository.diagnostics ?? []).length === 0
+        repository.repository_key === ticket.repository_key && (repository.diagnostics ?? []).length === 0
       ),
   );
   const implementationStartEligible = $derived(
@@ -99,7 +99,7 @@
     ticket = updatedTicket;
     editTitle = updatedTicket.title;
     editBody = updatedTicket.body;
-    repositoryId = updatedTicket.repository_id ?? "";
+    repositoryKey = updatedTicket.repository_key ?? "";
     refSelector = updatedTicket.ref_selector ?? "";
     nextState = updatedTicket.state;
   }
@@ -266,10 +266,10 @@
   async function saveTarget(event: SubmitEvent) {
     event.preventDefault();
     await mutate("target", "", {
-      target: repositoryId
+      target: repositoryKey
         ? {
           action: "set",
-          repository_id: repositoryId,
+          repository_key: repositoryKey,
           ref_selector: refSelector.trim() || null,
         }
         : { action: "clear" },
@@ -279,13 +279,13 @@
   async function markReady() {
     if (!targetCandidateValid || busy) return;
     if (
-      ticket.repository_id !== repositoryId ||
+      ticket.repository_key !== repositoryKey ||
       (ticket.ref_selector ?? "") !== refSelector.trim()
     ) {
       const saved = await mutate("target", "", {
         target: {
           action: "set",
-          repository_id: repositoryId,
+          repository_key: repositoryKey,
           ref_selector: refSelector.trim() || null,
         },
       }, "PATCH");
@@ -540,10 +540,10 @@
         <header><h2>Repository target</h2></header>
         <form class="ticket-control-form" onsubmit={saveTarget}>
           <label>Repository
-            <select bind:value={repositoryId} disabled={ticket.state !== "planning"}>
+            <select bind:value={repositoryKey} disabled={ticket.state !== "planning"}>
               <option value="">Not assigned</option>
               {#each loadedRepositories?.items ?? [] as repository}
-                <option value={repository.id}>{repository.display_name}</option>
+                <option value={repository.repository_key}>{repository.repository_key}</option>
               {/each}
             </select>
           </label>

web/workspace/src/routes/w/[workspaceId]/workers/+page.svelte

@@ -146,9 +146,9 @@
   function workerDirectory(worker: Worker): string {
     const directory = worker.working_directory;
     if (!directory) return '—';
-    const provider = data.repositories?.items.find((repository) => repository.id === directory.repository_id)
+    const provider = data.repositories?.items.find((repository) => repository.repository_key === directory.repository_key)
       ?.provider;
-    return `${directory.repository_id} · ${formatCurrentWorkdirRevision(directory, provider)}`;
+    return `${directory.repository_key} · ${formatCurrentWorkdirRevision(directory, provider)}`;
   }
 </script>
 

web/workspace/src/routes/w/[workspaceId]/workers/new/+page.svelte

@@ -28,9 +28,9 @@
   };
 
   function workdirOptionLabel(directory: WorkingDirectorySummary): string {
-    const provider = data.repositories?.items.find((repository) => repository.id === directory.repository_id)
+    const provider = data.repositories?.items.find((repository) => repository.repository_key === directory.repository_key)
       ?.provider;
-    return `${directory.repository_id} · ${formatCurrentWorkdirRevision(directory, provider)}`;
+    return `${directory.repository_key} · ${formatCurrentWorkdirRevision(directory, provider)}`;
   }
 
   let { data }: PageProps = $props();
@@ -59,7 +59,7 @@
   );
   let initialText = $state(ticketContext?.initialInput ?? '');
   let workingDirectoryId = $state('');
-  let workingDirectoryRepositoryId = $state(ticketContext?.repositoryId ?? '');
+  let workingDirectoryRepositoryKey = $state(ticketContext?.repositoryKey ?? '');
   let workingDirectorySelector = $state(ticketContext?.refSelector ?? 'HEAD');
   let relativeCwd = $state('');
   let creatingWorkingDirectory = $state(false);
@@ -123,7 +123,7 @@
         profile,
         initial_text: initialText,
         working_directory_id: workingDirectoryId,
-        working_directory_repository_id: workingDirectoryRepositoryId,
+        working_directory_repository_key: workingDirectoryRepositoryKey,
         working_directory_selector: workingDirectorySelector,
         relative_cwd: relativeCwd,
       });
@@ -131,8 +131,8 @@
       displayName = form.display_name;
       profile = form.profile;
       workingDirectoryId = form.working_directory_id ||
-        (ticketContext?.repositoryId ? NEW_WORKING_DIRECTORY_VALUE : '');
-      workingDirectoryRepositoryId = form.working_directory_repository_id;
+        (ticketContext?.repositoryKey ? NEW_WORKING_DIRECTORY_VALUE : '');
+      workingDirectoryRepositoryKey = form.working_directory_repository_key;
       workingDirectorySelector = form.working_directory_selector;
       relativeCwd = form.relative_cwd;
     } catch (err) {
@@ -156,7 +156,7 @@
       submitError = { message: 'embedded Runtime does not create workdirs', diagnostics: [] };
       return;
     }
-    if (!workingDirectoryRepositoryId) {
+    if (!workingDirectoryRepositoryKey) {
       submitError = { message: 'select a repository before creating a workdir', diagnostics: [] };
       return;
     }
@@ -165,7 +165,7 @@
     try {
       const request = validateWorkingDirectoryCreateRequest({
         runtime_id: runtimeId,
-        repository_id: workingDirectoryRepositoryId,
+        repository_key: workingDirectoryRepositoryKey,
         ...(workingDirectorySelector ? { selector: workingDirectorySelector } : {}),
       });
       const response = await fetch(
@@ -220,7 +220,7 @@
           profile,
           initial_text: initialText,
           working_directory_id: workingDirectoryId,
-          working_directory_repository_id: workingDirectoryRepositoryId,
+          working_directory_repository_key: workingDirectoryRepositoryKey,
           working_directory_selector: workingDirectorySelector,
           relative_cwd: relativeCwd,
         })),
@@ -339,10 +339,10 @@
             <div class="new-working-directory-fields">
               <label>
                 <span>Repository</span>
-                <select bind:value={workingDirectoryRepositoryId}>
+                <select bind:value={workingDirectoryRepositoryKey}>
                   {#if options?.repositories.length}
                     {#each options.repositories as repository}
-                      <option value={repository.id}>{repository.display_name}</option>
+                      <option value={repository.repository_key}>{repository.repository_key}</option>
                     {/each}
                   {:else}
                     <option value="" disabled>No configured repositories</option>
@@ -354,7 +354,7 @@
                 <input bind:value={workingDirectorySelector} autocomplete="off" placeholder="HEAD" />
               </label>
             </div>
-            <button type="button" disabled={creatingWorkingDirectory || !runtimeId || !workingDirectoryRepositoryId} onclick={() => void createWorkingDirectory()}>
+            <button type="button" disabled={creatingWorkingDirectory || !runtimeId || !workingDirectoryRepositoryKey} onclick={() => void createWorkingDirectory()}>
               {creatingWorkingDirectory ? 'Creating…' : 'Create workdir'}
             </button>
           </div>

web/workspace/src/routes/w/[workspaceId]/workers/new/+page.ts

@@ -11,7 +11,7 @@ export function load(
         ticketTitle: url.searchParams.get("ticketTitle") ?? ticketId,
         ticketRole,
         initialInput: url.searchParams.get("initialInput") ?? "",
-        repositoryId: url.searchParams.get("repositoryId") ?? "",
+        repositoryKey: url.searchParams.get("repositoryKey") ?? "",
         refSelector: url.searchParams.get("refSelector") ?? "HEAD",
       }
       : null,

web/workspace/test/merge-request-status.test.ts

@@ -25,7 +25,7 @@ function detail(thread: MergeRequestThreadEvent[]): MergeRequestDetail {
   return {
     merge_request_id: "MR-1",
     workspace_id: "W",
-    repository_id: "main",
+    repository_key: "main",
     ticket_ids: ["T-1"],
     selector_from: "work/ticket",
     selector_to: "develop",

web/workspace/test/repositories/ui.test.ts

@@ -25,8 +25,7 @@ test("Repository settings use the scoped list and typed create collection", () =
     "workspaceApiPath(params.workspaceId, \"/repositories\")",
     "workspaceApiPath(data.workspaceId, '/repositories')",
     "method: 'POST'",
-    "repository_id: repositoryId",
-    "display_name: displayName",
+    "repository_key: repositoryKey",
     "default_ref: defaultRef || null",
     "await invalidateAll()",
   ]) {

web/workspace/test/repository-access/api.test.ts

@@ -66,7 +66,7 @@ Deno.test("Repository Access parsers accept generated response contracts", () =>
       config_revision: 4,
       projection_digest: "sha256:projection",
       bindings: [{
-        repository_id: "main",
+        repository_key: "main",
         credential_id: "deploy-key",
         host_trust_id: "gitea",
         access: "read_only",
@@ -77,7 +77,7 @@ Deno.test("Repository Access parsers accept generated response contracts", () =>
       config_revision: 4,
       projection_digest: "sha256:projection",
       bindings: [{
-        repository_id: "main",
+        repository_key: "main",
         credential_id: "deploy-key",
         host_trust_id: "gitea",
         access: "read_only",
@@ -114,7 +114,7 @@ Deno.test("Repository Access parsers reject missing and wrong-typed fields", ()
         config_revision: 4,
         projection_digest: "sha256:projection",
         bindings: [{
-          repository_id: "main",
+          repository_key: "main",
           credential_id: "deploy-key",
           host_trust_id: "gitea",
           access: "admin",

web/workspace/test/repository-access/ui.test.ts

@@ -56,7 +56,7 @@ test("Repository Access renders the shared access projection fields", () => {
       "accessProjection.config_revision",
       "accessProjection.projection_digest",
       "accessProjection.bindings",
-      "binding.repository_id",
+      "binding.repository_key",
       "binding.credential_id",
       "binding.host_trust_id",
       "binding.access",

web/workspace/tests/workdir-api.test.ts

@@ -10,7 +10,7 @@ import {
 
 const summary = {
   working_directory_id: "workdir-1",
-  repository_id: "main",
+  repository_key: "main",
   materializer_kind: "runtime_git_cache",
   status: "active",
   occupied_by: {
@@ -60,7 +60,7 @@ Deno.test("Workdir REST validation rejects stale response JSON", () => {
 Deno.test("Workdir REST validation enforces create operation fields", () => {
   const request = validateWorkingDirectoryCreateRequest({
     runtime_id: "arcadia",
-    repository_id: "main",
+    repository_key: "main",
     selector: "develop",
     operation_id: "operation-1",
   });
@@ -71,7 +71,7 @@ Deno.test("Workdir REST validation enforces create operation fields", () => {
   for (
     const invalid of [
       { runtime_id: "arcadia", operation_id: "operation-1" },
-      { repository_id: "main", operation_key: "operation-1" },
+      { repository_key: "main", operation_key: "operation-1" },
     ]
   ) {
     let rejected = false;

web/workspace/tests/workspace-catalog.test.ts

@@ -58,8 +58,7 @@ Deno.test("workspace catalog enriches each visible workspace without dropping si
       return Promise.resolve(Response.json({
         workspace_id: "w-a",
         items: [{
-          id: "main",
-          display_name: "Main",
+          repository_key: "main",
           kind: "git",
           provider: "git",
           source: { kind: "local_path", uri: "/srv/alpha" },
@@ -78,7 +77,7 @@ Deno.test("workspace catalog enriches each visible workspace without dropping si
 
   const items = await loadWorkspaceCatalog(fetcher as typeof fetch);
   assertEquals(items.length, 2);
-  assertEquals(items[0].repositories[0].id, "main");
+  assertEquals(items[0].repositories[0].repository_key, "main");
   assertEquals(items[1].repositories, []);
   assertEquals(typeof items[1].repository_error, "string");
 });
@@ -89,8 +88,8 @@ Deno.test("workspace creation preserves caller-owned operation key across retry"
     operation_key: "web-create-1",
     display_name: "Alpha",
     repository: {
+      repository_key: "main",
       uri: "/srv/alpha",
-      display_name: "Main",
       default_ref: "develop",
     },
   };

web/workspace/tests/workspace-model.test.ts

@@ -22,8 +22,7 @@ function assertThrows(operation: () => unknown, expected: string): void {
 const repositoryList = {
   workspace_id: "w-a",
   items: [{
-    id: "main",
-    display_name: "Main",
+    repository_key: "main",
     kind: "git",
     provider: "git",
     source: { kind: "local_path", uri: "/srv/alpha" },
@@ -38,8 +37,8 @@ const repositoryList = {
 
 Deno.test("generated repository wrapper validates current Backend JSON", () => {
   const parsed = parseRepositoryListResponse(repositoryList);
-  if (parsed.items[0]?.id !== "main") {
-    throw new Error("repository id was not preserved");
+  if (parsed.items[0]?.repository_key !== "main") {
+    throw new Error("repository key was not preserved");
   }
   if (parsed.items[0]?.source.kind !== "local_path") {
     throw new Error("repository source kind was not preserved");
@@ -49,11 +48,11 @@ Deno.test("generated repository wrapper validates current Backend JSON", () => {
 Deno.test("stale repository aliases fail closed at the JSON boundary", () => {
   const stale = structuredClone(repositoryList) as Record<string, unknown>;
   const items = stale.items as Array<Record<string, unknown>>;
-  items[0].repository_id = items[0].id;
-  delete items[0].id;
+  items[0].id = items[0].repository_key;
+  delete items[0].repository_key;
   assertThrows(
     () => parseRepositoryListResponse(stale),
-    ".repository_id is not part",
+    ".id is not part",
   );
 });
 
@@ -129,7 +128,7 @@ Deno.test("Repository settings consume the validated shared wire shape", async (
   for (
     const token of [
       "parseRepositoryListResponse",
-      "repository.id",
+      "repository.repository_key",
       "repository.observed_status",
       "sourceLabel(repository.source.kind)",
       "supportsRepositoryAccess(repository.source.kind)",
@@ -141,8 +140,8 @@ Deno.test("Repository settings consume the validated shared wire shape", async (
   }
   for (
     const staleToken of [
-      "repository.repository_id",
-      "repository.observed.status",
+      "repository.id",
+      "repository.display_name",
       "repository.source.kind === 'remote_git'",
     ]
   ) {