Rework outrider into two paths: engine/App init + no-App setup-local

Replaces the single gh-only `outrider init` with two flows that both end in
the same Outrider Action but differ in who provisions it:

- `outrider init` — thin client over the engine's provision-action endpoints
  (REMYX-60 / remyx#337). The Remyx GitHub App provisions the workflow,
  secrets, and a bot-authored setup PR server-side; --mode auto|review|off.
  New API clients (remyxai/api/github_app.py, integrations.py, and
  provision_action/poll/status in interests.py), with App-install and
  model-provider preflights.

- `outrider setup-local` — self-provisions with the customer's own gh (no
  third-party App, for orgs under security review): sets the repo secrets,
  writes the workflow, opens (auto: merges + dispatches) the setup PR, and
  enables the repo's Actions-can-create-PRs setting so the built-in
  GITHUB_TOKEN opens recommendation PRs. Reversible-first ordering with
  branch/PR rollback; Contents-API sha handled on update.

Neither path stores a GitHub token as a repo secret — only REMYX_API_KEY and
ANTHROPIC_API_KEY.

Also: drop the bundled workflow template + package_data (both paths render
inline now); log_api_response treats all 2xx as success (provision-action
returns 202).

Validated live end-to-end against salma-remyx/FFMPerative-test: engine path ->
remyx-ai[bot] recommendation PR; setup-local -> github-actions[bot]
recommendation PR. 50 unit tests across tests/cli/test_outrider_actions.py,
tests/cli/test_outrider_local.py, tests/api/test_outrider_api.py.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: salma-remyx

README.md

@@ -179,26 +179,67 @@ result, time_elapsed = run_inference(model_name, prompt, server_url="localhost:8
 print(result)
 ```
 
-### Outrider
-Install [Outrider](https://github.com/remyxai/outrider) — the recommendation-driven implementation agent — into a GitHub repository. The command opens a PR that adds `.github/workflows/outrider.yml`, then writes `REMYX_API_KEY` and `ANTHROPIC_API_KEY` to the repo's Actions secrets.
+### Outrider — weekly arXiv → draft PR for your repo
+
+[Outrider](https://github.com/remyxai/outrider) is a GitHub Action that, on a weekly schedule, finds the most implementable recent paper for your repository and opens a draft PR wiring it into a real call site. `remyxai outrider` sets it up for you.
+
+There are two ways to install it — both end with the same Action running in your repo; they differ in **who provisions it**:
+
+|  | `outrider init` | `outrider setup-local` |
+|---|---|---|
+| **Best for** | Most users | Teams that can't grant a third-party GitHub App yet (e.g. a pending security review) |
+| **How it works** | The **Remyx GitHub App** provisions it server-side; PRs are authored by `remyx-ai[bot]` | The CLI uses **your own `gh`** to provision it; PRs authored by `github-actions[bot]` |
+| **You provide** | The Remyx App installed on the repo (the command links you to it) | An authenticated `gh` with admin on the repo |
+
+Either way you'll need a **Remyx API key** (from engine.remyx.ai → Settings) and an **Anthropic API key** (from console.anthropic.com). Set the Remyx key once:
 
-* cli command:
 ```bash
-# Auto-detect repo from the current git remote
-$ remyxai outrider init --auto-interest
+export REMYXAI_API_KEY=...   # from engine.remyx.ai → Settings
+```
 
-# Or target a specific repo + interest
-$ remyxai outrider init --repo owner/repo --interest <uuid>
+#### Option A — `outrider init` (via the Remyx GitHub App) — recommended
 
-# Preview without making any changes
-$ remyxai outrider init --auto-interest --dry-run
+```bash
+# Set up on a repo, auto-creating a research interest from it:
+$ remyxai outrider init --repo owner/name --auto-interest
+
+# …or use an existing research interest (UUID from engine.remyx.ai):
+$ remyxai outrider init --repo owner/name --interest <uuid>
 ```
 
-Requirements:
-- `gh` (GitHub CLI), authenticated with `repo` + `admin:repo_hook` scopes (the latter is what GitHub requires for writing Actions secrets)
-- `REMYXAI_API_KEY` and `ANTHROPIC_API_KEY` in the local environment — these are read once and written to the target repo's Actions secrets via `gh secret set`
+If the Remyx App isn't installed on the repo yet, the command prints an install link and waits. Then the engine provisions the workflow, repo secrets, and a setup PR, and — in the default `auto` mode — merges it and starts the first run. Connect your Anthropic key once on the engine's Integrations page, or pass `--anthropic-key` (or set `ANTHROPIC_API_KEY`) and the CLI connects it for you.
+
+`--mode`: `auto` (default — set it up and start the first run), `review` (open the setup PR for you to merge), `off` (just create the research interest).
+
+#### Option B — `outrider setup-local` (no GitHub App)
+
+For teams that can't install a third-party App yet. The CLI uses your own authenticated `gh` to do everything — nothing new to security-review.
+
+```bash
+$ export ANTHROPIC_API_KEY=...   # stored as a repo secret by the CLI
+
+$ remyxai outrider setup-local --repo owner/name --auto-interest
+```
+
+Using your `gh` credentials, the CLI sets the `REMYX_API_KEY` + `ANTHROPIC_API_KEY` repo secrets, writes `.github/workflows/outrider.yml`, opens a setup PR, and — in `auto` mode — merges it and dispatches the first run. So the Action can open its recommendation PRs, the CLI enables the repo's *"Allow GitHub Actions to create and approve pull requests"* setting; the Action then uses the repo's built-in `GITHUB_TOKEN` (no GitHub token is stored as a secret — only `REMYX_API_KEY` and `ANTHROPIC_API_KEY`).
+
+Requires `gh` authenticated (`gh auth login`, or `$GITHUB_TOKEN` with `repo` + `workflow` scopes) and admin on the target repo.
+
+#### Common options
+
+- `--repo owner/name` — target repo (or a GitHub URL); defaults to the current directory's git remote.
+- `--interest <uuid>` / `--auto-interest` — use an existing research interest, or create one from the repo.
+- `--mode auto|review` (`init` also has `off`) — how far to take setup.
+- `--dry-run` — print the plan (and, for `setup-local`, the rendered workflow) and exit without making changes.
+- `-y` / `--yes` — skip the confirmation prompt.
+
+Preview either path safely before committing to it:
+
+```bash
+$ remyxai outrider setup-local --repo owner/name --auto-interest --dry-run
+```
 
-**Credential model (v1):** the operator's own `REMYXAI_API_KEY` is copied into the target repo's Actions secrets. Anyone with write access to the repo's workflows can therefore consume Remyx credits attributed to that key. This is acceptable for repos you control end-to-end; for shared or third-party repos, prefer provisioning a scoped key in the Remyx dashboard before running `outrider init`. A first-class scoped-token flow is tracked in REMYX-76.
+**A note on credentials:** with `setup-local`, your `REMYXAI_API_KEY` is stored as the repo's `REMYX_API_KEY` secret so the Action can fetch recommendations — anyone with write access to the repo's workflows can consume Remyx credits on that key, so use it on repos you control. With `outrider init`, the Remyx App provisions a scoped key for you. In both paths your Anthropic key is stored as a repo secret to run the agent.
 
 ### User
 

remyxai/api/__init__.py

@@ -67,7 +67,7 @@ def get_headers(api_key=None):
 
 def log_api_response(response):
     """Log the response from the API based on the status code."""
-    if response.status_code in [200, 201]:
+    if 200 <= response.status_code < 300:
         logging.debug(
             f"API call successful: {response.url}, Status: {response.status_code}"
         )

remyxai/api/github_app.py

@@ -0,0 +1,59 @@
+"""
+remyxai/api/github_app.py
+
+Client calls for the Remyx GitHub App (remyx-ai[bot]) endpoints.
+Wraps /api/v1.0/github/app/* in engine/app/api/github_app_api.py.
+
+The App is what lets the engine provision the Outrider recommendation
+workflow, set repo secrets, and open bot-authored PRs without the user
+granting a personal token. Installing the App is an interactive browser
+step; these endpoints let the CLI surface the install link and poll for
+completion.
+"""
+from __future__ import annotations
+
+import logging
+import requests
+from typing import Any, Dict, Optional
+
+from . import BASE_URL, HEADERS, get_headers, log_api_response
+
+logger = logging.getLogger(__name__)
+
+
+def _h(api_key: Optional[str] = None) -> dict:
+    return get_headers(api_key) if api_key else HEADERS
+
+
+def get_app_install_url(api_key: Optional[str] = None) -> Dict[str, Any]:
+    """Return the Remyx GitHub App install URL for the current user.
+
+    Calls GET /api/v1.0/github/app/install-url
+
+    Returns { install_url, state, app_slug, configured }. When the App
+    isn't configured on the server, returns { configured: False, error }.
+    """
+    r = requests.get(
+        f"{BASE_URL}/github/app/install-url", headers=_h(api_key), timeout=30
+    )
+    log_api_response(r)
+    if r.status_code == 503:
+        return r.json()  # {configured: False, error}
+    r.raise_for_status()
+    return r.json()
+
+
+def is_app_installed(repo: str, api_key: Optional[str] = None) -> bool:
+    """Whether the Remyx App is installed on `repo` (owner/name).
+
+    Calls GET /api/v1.0/github/app/installation?repo=owner/name
+    """
+    r = requests.get(
+        f"{BASE_URL}/github/app/installation",
+        params={"repo": repo},
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return bool(r.json().get("installed"))

remyxai/api/integrations.py

@@ -0,0 +1,64 @@
+"""
+remyxai/api/integrations.py
+
+Client calls for the JWT integrations API.
+Wraps /api/v1.0/integrations/* in engine/app/api/integrations.py.
+
+Used by the CLI to connect/check credential-based providers — notably
+the model provider (`claude_code` → Anthropic key) that Outrider needs
+the engine to push to the repo as a secret.
+"""
+from __future__ import annotations
+
+import logging
+import requests
+from typing import Any, Dict, Optional
+
+from . import BASE_URL, HEADERS, get_headers, log_api_response
+
+logger = logging.getLogger(__name__)
+
+
+def _h(api_key: Optional[str] = None) -> dict:
+    return get_headers(api_key) if api_key else HEADERS
+
+
+def get_integration_status(
+    provider: str, api_key: Optional[str] = None
+) -> Dict[str, Any]:
+    """Connection status for a provider.
+
+    Calls GET /api/v1.0/integrations/<provider>/status
+    Returns { connected: bool, connection?: {...} }.
+    """
+    r = requests.get(
+        f"{BASE_URL}/integrations/{provider}/status",
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return r.json()
+
+
+def connect_credential(
+    provider: str,
+    credentials: Dict[str, Any],
+    api_key: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Connect a credential-based provider (e.g. claude_code).
+
+    Calls POST /api/v1.0/integrations/<provider>/connect
+    Body is the provider's credential dict, e.g. {"api_key": "sk-ant-..."}.
+    The engine validates the key against the provider before storing it
+    encrypted. Returns { connection, user_info } on success.
+    """
+    r = requests.post(
+        f"{BASE_URL}/integrations/{provider}/connect",
+        json=credentials,
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return r.json()

remyxai/api/interests.py

@@ -164,3 +164,93 @@ def toggle_interest(
     log_api_response(r)
     r.raise_for_status()
     return r.json()
+
+
+# ─── Outrider provisioning (REMYX-60) ──────────────────────────────────────
+
+def provision_action(
+    interest_id: str,
+    repo_url: Optional[str] = None,
+    auto_merge: bool = True,
+    branch: Optional[str] = None,
+    workflow_filename: Optional[str] = None,
+    api_key: Optional[str] = None,
+) -> Dict[str, Any]:
+    """
+    Provision the Outrider recommendation Action on a repo, server-side
+    (the Remyx GitHub App sets secrets, writes the workflow, opens a
+    bot-authored setup PR, and — when auto_merge — merges it and fires
+    the first run).
+
+    Calls POST /api/v1.0/interests/<id>/provision-action
+
+    Args:
+        repo_url:   GitHub URL; defaults to the interest's source repo.
+        auto_merge: merge the setup PR + dispatch the first run ("set it
+                    up for me"). False opens the PR for the user to review.
+
+    Returns 202 { task_id, status_url }. Poll with poll_provision_action.
+    """
+    payload: Dict[str, Any] = {"auto_merge": auto_merge}
+    if repo_url:
+        payload["repo_url"] = repo_url
+    if branch:
+        payload["branch"] = branch
+    if workflow_filename:
+        payload["workflow_filename"] = workflow_filename
+
+    r = requests.post(
+        f"{BASE_URL}/interests/{interest_id}/provision-action",
+        json=payload,
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return r.json()
+
+
+def poll_provision_action(
+    interest_id: str,
+    task_id: str,
+    api_key: Optional[str] = None,
+) -> Dict[str, Any]:
+    """
+    Poll a provision-action task.
+
+    Calls GET /api/v1.0/interests/<id>/provision-action/<task_id>
+
+    Returns the task dict: { status, progress, message, result, error }.
+    On completion, `result` carries pr_url, secret_set, merged, dispatched,
+    model_key_missing, key_label, repo.
+    """
+    r = requests.get(
+        f"{BASE_URL}/interests/{interest_id}/provision-action/{task_id}",
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return r.json()
+
+
+def get_provision_status(
+    interest_id: str,
+    api_key: Optional[str] = None,
+) -> Dict[str, Any]:
+    """
+    Latest provisioning state for an interest.
+
+    Calls GET /api/v1.0/interests/<id>/provision-action
+
+    Returns { provisioned: False } if none, else the provisioned-action
+    record with provisioned: True.
+    """
+    r = requests.get(
+        f"{BASE_URL}/interests/{interest_id}/provision-action",
+        headers=_h(api_key),
+        timeout=30,
+    )
+    log_api_response(r)
+    r.raise_for_status()
+    return r.json()