Timeline

Quiets the Node.js 20 deprecation annotation that surfaced on the auto-release.yml dry-run. v6 of both actions ships on Node.js 24, ahead of the June 2026 forced-upgrade.

No behavior change expected — same API surface. check-in: 0707c5f3d4 user: [email protected] tags: trunk, bridge/v0.0.3

Mechanizes the multi-step release flow that today is hand-driven via: 1. tag leaf submodule, push 2. open chore/bump-leaf PR, merge 3. tag root, push (fires release.yml + bones dispatch)

scripts/release.sh detects which submodules have changes since their last <name>/v* tag, computes next versions (patch by default; --bump= minor|major), tags and pushes them, rewrites the matching require pin in root go.mod, commits straight to main as github-actions[bot], then tags the next root v* and pushes — firing release.yml.

Local invocation prompts before each push so the operator can intervene. Workflow invocation (auto-release.yml) passes --ci to suppress prompts and uses the bot identity. --dry-run reports the plan without touching anything.

Direct-to-main bot commits is the right tradeoff here: the change is deterministic robot work (one-line go.mod edit derived from the just- tagged version) and avoiding a PR round-trip lets a release ship in a single workflow run rather than coordinating across two. If branch protection blocks the github-actions bot, configure RELEASE_PUSH_TOKEN as a fine-grained PAT with contents:write.

Side observation: dry-run flags that bridge/ has unreleased changes since bridge/v0.0.2 (libfossil bump + README), so the next auto-release run will tag bridge/v0.0.3 alongside whatever else changes. check-in: 8414300b13 user: [email protected] tags: trunk

Bumps the root module's leaf pin from `v0.0.9` to `v0.0.10`. `leaf/v0.0.10` is already tagged and pushed.

`leaf/v0.0.10` ships: - **feat(leaf/agent)** Config.CloneFromHubURL + agent.CloneRepo helper (#137 gap A, PR #138). Lets downstream consumers bootstrap a leaf repo against an existing hub without importing libfossil directly.

After this merges, the next root tag (`v0.0.12`) cuts the full release including the matching hub additions (#137 gaps B + C, also PR #138) — that's enough for bones to drop libfossil from go.mod entirely. check-in: ddb923acb9 user: [email protected] tags: trunk, v0.0.12

* feat(leaf/agent): clone-if-absent via Config.CloneFromHubURL (#137 gap A)

Adds agent.Config.CloneFromHubURL — when set and Config.RepoPath does not yet exist on disk, agent.New clones the leaf repo from the hub HTTP URL before opening it. Matching project-codes between leaf and hub are required for downstream NATS sync subjects to align, so callers that need to bootstrap a leaf against an existing hub no longer have to import libfossil directly for the pre-agent clone step.

Also exposes agent.CloneRepo(ctx, repoPath, hubURL) as a standalone helper for callers that need a clone independent of agent construction.

Existing behavior is preserved: when CloneFromHubURL is empty, agent.New errors on missing RepoPath as before (covered by TestAgentNew_RejectsMissingRepoWithoutCloneURL).

Closes part of #137 (gap A — bones internal/coord/leaf.go).

* feat(hub): subscribe to fossil-sync NATS subject in NewHub (#137 gap B)

NewHub now connects a local NATS client to its embedded server and subscribes to "fossil.<project-code>.sync" so peer leaf agents can push xfer requests to the hub over NATS — alongside the existing HTTP path. Previously, achieving this required running a leaf-agent in serve mode on top of the hub (Pull=false, Push=false, Autosync=AutosyncOff, ServeNATSEnabled=true), which transitively pulled libfossil into the consumer's import graph.

The subscriber is enabled by default. Read-only HTTP-only mirrors that shouldn't accept NATS pushes can opt out via Config.DisableFossilSyncOverNATS.

Note on naming: the issue brief proposed Config.ServeFossilSyncOverNATS defaulting to true. Go bool zero-value semantics make default-true awkward without pointers, so the inverted-name shape (DisableX, defaults false = enabled) was used instead.

Closes part of #137 (gap B — bones internal/coord/hub.go).

* feat(hub): FileToCommit.Perm + CommitOpts.Time pass-through (#137 gap C)

Adds two additive fields to the public hub commit surface so consumers no longer need libfossil-direct access to preserve executable bits or seed reproducible commit timestamps:

- hub.FileToCommit.Perm — "x" marks the file executable on the resulting manifest's F-card. Empty preserves prior behavior. Other libfossil perm markers pass through verbatim. - hub.CommitOpts.Time — explicit commit timestamp; zero defaults to time.Now().UTC() at commit time, matching the prior behavior.

Tests cover round-tripping the executable bit via libfossil.Repo.ListFiles, honoring an explicit time via Timeline, and falling back to "now" on the zero value.

Closes part of #137 (gap C — bones internal/hub/hub.go seed path).

* ci: include #137 sim tests in the serve-tests allowlist

Adds TestAgentNew_ and TestHubNATSFossilSync_ to the sim serve-tests regex in both Makefile and test.yml so the new clone-if-absent and hub-NATS-subscriber tests actually run in CI alongside TestHubLeafE2E. check-in: ad1d55f5b9 user: [email protected] tags: trunk, leaf/v0.0.10

Pulls in the Agent.Commit ParentID/MergeParents fix (#125, PR #133). Without it, agent.Commit produces orphan checkins that fragment the timeline. Required so downstream consumers can pin to a root release exposing the fix. check-in: 2945dc8dce user: [email protected] tags: trunk, v0.0.11

Pulls in the Agent.Commit ParentID/MergeParents fix (#125, PR #133). Without it, agent.Commit produces orphan checkins that fragment the timeline. Required so downstream consumers can pin to a root release exposing the fix. leaf check-in: ab5b55e3b0 user: [email protected] tags: trunk, chore/bump-leaf-v0.0.9

Adds Repo.SetUserCaps(login, caps) and a Hub delegate, wrapping libfossil's Repo.SetCaps. Lets consumers grant or change caps on existing users without leaving the hub package — primarily for the common bones case where the libfossil-pre-populated 'nobody' user needs 'gio' to allow unauthenticated clone/pull/push.

Also adds Config.NobodyCaps so the typical setup is one declarative field instead of a manual SetUserCaps call after every NewHub. NobodyCaps is applied at bootstrap by calling SetUserCaps("nobody", v) internally — no method-body duplication. Empty NobodyCaps leaves nobody at whatever libfossil set it to (idempotent re-open path preserves prior caps, doesn't overwrite).

Tests: - TestRepo_SetUserCaps_RoundTrip — set + read back - TestRepo_SetUserCaps_RejectsEmptyLogin - TestNewHub_NobodyCaps_AppliedAtBootstrap — Config field works - TestNewHub_NobodyCaps_Idempotent — re-running with same caps OK - TestNewHub_NobodyCaps_EmptyDoesNotOverwrite — empty doesn't reset

Closes #130 check-in: 93ab4aa0e9 user: [email protected] tags: trunk, leaf/v0.0.9

Adds Repo.SetUserCaps(login, caps) and a Hub delegate, wrapping libfossil's Repo.SetCaps. Lets consumers grant or change caps on existing users without leaving the hub package — primarily for the common bones case where the libfossil-pre-populated 'nobody' user needs 'gio' to allow unauthenticated clone/pull/push.

Also adds Config.NobodyCaps so the typical setup is one declarative field instead of a manual SetUserCaps call after every NewHub. NobodyCaps is applied at bootstrap by calling SetUserCaps("nobody", v) internally — no method-body duplication. Empty NobodyCaps leaves nobody at whatever libfossil set it to (idempotent re-open path preserves prior caps, doesn't overwrite).

Tests: - TestRepo_SetUserCaps_RoundTrip — set + read back - TestRepo_SetUserCaps_RejectsEmptyLogin - TestNewHub_NobodyCaps_AppliedAtBootstrap — Config field works - TestNewHub_NobodyCaps_Idempotent — re-running with same caps OK - TestNewHub_NobodyCaps_EmptyDoesNotOverwrite — empty doesn't reset

Closes #130 leaf check-in: a8e62ce82d user: [email protected] tags: trunk, feat/130-hub-setusercaps

Adds hub.OpenRepo(path) (*Repo, error) — a server-less handle for one-off CLI invocations and short-lived helpers (bones #186 needs this for `bones hub user list`, `bones plan finalize`, and slot-user provisioning, all of which currently drop to direct libfossil.Open because hub.NewHub spins up a redundant NATS server every time).

The new *hub.Repo type holds the libfossil handle and carries every user / commit / read method that *hub.Hub used to define on itself. *hub.Hub now holds a *hub.Repo internally and one-line-delegates each method, so both code paths share method bodies — no duplication.

Adds Hub.Repo() *Repo accessor for sharing the live handle out of a running hub. Documented contract: don't call Close on a *Repo returned by Hub.Repo while the Hub is still serving — Hub.Stop is the right teardown for that case. Repo.Close is idempotent so accidental double- close from teardown ordering is safe.

Tests: - TestOpenRepo_RoundTrip — every *Repo method against a path bootstrapped by NewHub. Same observable state. - TestOpenRepo_RejectsEmptyPath, TestOpenRepo_RejectsMissingPath. - TestRepo_Close_IsIdempotent. - TestHub_Repo_AccessorReturnsLiveHandle — operations on the *Repo accessor are observable via the *Hub.

Closes #131 check-in: 5f025def67 user: [email protected] tags: trunk

Adds ParentID and MergeParents to agent.CommitOpts. When ParentID is 0, Agent.Commit auto-resolves the current trunk tip and uses that as the parent — matching `fossil ci`'s default behavior. On an empty repo (BranchTip returns sql.ErrNoRows), the resolution falls through to 0 and the commit is a legitimate orphan root (the first commit).

Before this fix, agent.Commit always passed ParentID=0 to libfossil, producing P-card-less manifests. Every commit became its own root, fragmenting the timeline and breaking trunk-based development for downstream consumers (notably bones).

Tests added: - TestAgent_Commit_ChainsOntoTrunkTipByDefault — two consecutive Commit calls produce a chained pair with linked Parents. - TestAgent_Commit_ExplicitParentIDOverride — caller-supplied ParentID is used verbatim.

The hub-leaf e2e test (sim/hub_leaf_test.go) was reading by "trunk" tip on the hub; switched to reading by the explicit RevID returned from Agent.Commit so the test exercises the transport contract (file lands on hub) without coupling to branch-tip resolution semantics on the hub side after sync — which appears to be a separate concern worth its own investigation.

Closes #125 check-in: 82e4b0075d user: [email protected] tags: trunk