# quarry RFCs
Numbers are stable: code comments cite them by number, so an RFC is
amended in place rather than replaced, and a retired one keeps its number
in history. Status lines in each file are kept true; this page is the map.
## The spec
| RFC | What | Status |
|---|---|---|
| [0001](0001-quarry-forge.md) | quarry itself: a forge for zit that holds no hostage bytes | Living spec; single-node scope implemented |
| [0005](0005-event-vocabulary.md) | one named event stream that pipelines, webhooks and notifications subscribe to | Implemented |
| [0003](0003-implementation-plan.md) | how it was built: technology choices, salvage and provenance rules (§8, formerly RFC 0002), status as built | Historical; §2 and §8 remain in force |
## Authorization
| RFC | What | Status |
|---|---|---|
| [0004](0004-fossil-capability-compat.md) | fossil capability letters as the native model; a hosted fossil repository brings its users with it | Implemented |
| [0008](0008-roles.md) | roles as the interface over the letters; next amendment: the mirror steward, the person who maintains a mirror's credentials on the remote fossil server, so hosting a repository is not owning it | Implemented; amendment pending |
| [0017](0017-write-tiers.md) | the bar for a write scales with how permanent the write is: a companion or the local tier may ask less than the store. Amends 0015 | Draft, questions settled; implemented after teams |
| [0018](0018-teams.md) | teams: a user-owned place that holds repositories, carries grants, and gathers their chat and tickets. 0008's deferred team layer | Built except companions following a parent into a team (see its status line); the ticket board is built and the room streams |
## Landings
`docs/landings.md` is the base: a landing is a reading of forum posts.
| RFC | What | Status |
|---|---|---|
| [0006](0006-strata.md) | stacked landings, rendered as a chain | Implemented |
| [0007](0007-protected-branches.md) | branch ownership enforced at the sync front | Implemented |
| [0009](0009-ci.md) | verdicts on landings: dagnats runs, checks, logs, premerge | In progress (see its status line) |
| [0019](0019-workflows.md) | CI files a person writes in five minutes: Actions-shaped YAML in `ci/`, `on:` filters, environments whose secrets only reviewed code can reach. Amends 0009 | Built |
| [0020](0020-unversioned-and-releases.md) | fossil's unversioned files in zit and quarry: synced to every clone, stored in the repository's bucket, served by quarry's sync front at fossil's paths, imported from mirrored fossils; releases started by tag, deploys separate. Supersedes ticket #19's direction | Built, release workflow included (ci/release.yml, scripts/release.sh); not built: pruning old releases and the "cannot roll back past" mark |
| [0021](0021-agent-accounts.md) | agent accounts: a person's agent is its own passwordless account holding scoped named tokens, never more than its operator, everything short of deed acts; forge agents (zeitgeist) for the site; CI runs get run-scoped tokens instead of accounts; a Publisher preset (steward is reserved for mirrors) | Draft; ten decisions settled 2026-10-02 |
## Attention and what arrives
| RFC | What | Status |
|---|---|---|
| [0011](0011-attention.md) | chat that never loses a message, mentions, the inbox, push; notify owns transport, quarry owns policy | Implemented; its live model reaches every surface, the four ticket 82b9615eaf3d named included |
| [0012](0012-attention-plan.md) | 0011's delivery plan in five phases | Implemented; kept because code cites its phases |
| [0014](0014-inbound.md) | what may write to a forge from outside: reply-by-email first, source keys and external CI later | Phase 1 implemented |
| [0015](0015-companions.md) | a repository's forum in a separate fossil-compatible store, bound by the forge | Phase 1 implemented |
| [0016](0016-attachments.md) | files on tickets, wiki, technotes and forum posts: fossil's A card in the DAG, the bytes in the steward's own bucket | Phases 1–3 built; Phase 4 (export, migrate, report, scanner) not built |
## Sync front
`docs/rfcs/0001-quarry-forge.md` §7 is the base.
| RFC | What | Status |
|---|---|---|
## Standalone
| RFC | What | Status |
|---|---|---|
| [0010](0010-local-mode.md) | `quarry ui`: one repository, one browser, no accounts | Draft, not built |
| [0013](0013-activity-profile.md) | who touched what, when: the activity page | Implemented |
## Mirrors
| RFC | What | Status |
|---|---|---|
| [0022](0022-git-mirror-out.md) | a repository admin mirrors a public repository's trunk to GitHub or any Git host from its settings: a deploy key the forge makes and keeps, a push after each trunk move, fast-forward only, status in words. Replaces the host's mirror-to-github script | Built: rungs 1-3 (the setting and deploy key, a push after each trunk move, the About line); rung 4 done (pikchr-studio moved off the host script). Git mirrors in (#358) are separate |
| [0023](0023-takedown-and-legal-hold.md) | a site admin disables a repository on a notice (its admins keep access to fix it) or puts it on legal hold (nobody reaches it, no writes, kept as evidence): 451 on every surface, the owner told why, an append-only takedown log, delete and stop serving refused meanwhile; with the DMCA, NCMEC and notice-form process | Rung 1 built (disable and legal hold, 451 on every surface, the takedown log); rungs 2-4 not built |
| [0024](0024-horizons.md) | horizons: clones that hold history from a check-in forward; the content horizon through the sync front unchanged, the structural horizon's seed, boundary labels and merge-base from the index plane; history below the horizon answered by the API; which consumer gets which tool | Draft; measurement done, structural horizon is the deliverable; decisions settled 2026-10-18; waits on zit |
| [0025](0025-namespaced-repositories.md) | a repository is named within its namespace, a person's or a team's, not across the forge: a permanent ID is its key and namespace/name its address; existing names become their IDs, so nothing is rewritten; forge-held mirrors under `zeitforge/` until stewarded; flat names as a deployment option for single-user builds | Draft; decisions settled 2026-10-21; Built (all five rungs) |
| [0026](0026-agents-inherit.md) | an agent is personal or dedicated, at site, team or repository scope: a personal agent inherits its owner within its scope (narrowable, never more), a dedicated one holds what its scope grants; existing agents keep their reach; tokens need no upkeep (one revoke-and-reissue per agent, idle lapse at 90 days) | Draft; decisions settled 2026-10-31 |
| [0027](0027-ask-your-person.md) | an agent refused for want of authority its person holds asks them instead (`Quarry-Ask`): the person is told by inbox, push and email, approves with one tap, and the exact call runs as them under their own permissions; anything they may do is askable except their own credentials, sign-offs and account; results return to the agent, secrets once; for every user and every agent, nothing to set up | Draft; decisions settled 2026-11-08 |
| [0028](0028-requests.md) | an agent's requests get their own page, /me/requests, counted in the header, answered in place with history folded away; each reads as the action it takes; a burst is one email; a whole job can be asked for as one plan, approved with one tap and run in order until a step fails | Draft; decisions settled 2026-11-08 |
| [0029](0029-onboarding.md) | a person or an agent sets up a repository, its pushes, mirror and CI from the forge alone: the first push adopts its project code, agents push with sync-scoped tokens got through their person, generated docs mark session-only ops, check=true says what create and mirror would refuse, worker tokens through the API for people's own runners, authenticated scripts skip the bot check, one guide at /docs/start | Draft; decisions settled 2026-11-08 |
| [0030](0030-setup-by-approval.md) | one request and one approval give a repository its agent and credential, and one command gives it a CI runner: an agent the owner already operates asks for an agent on a repository with a role and a kind of credential, the owner sees scope, repositories, ceiling and expiry and approves once, the forge creates, grants and mints in one act and releases the value once to the holder of a pickup key; a repository admin makes a short-lived install code and `quarry runner install` builds the users, sudo rule, unit and token on the host; a stopped runner hands its jobs back; a public repository shows check names and states to visitors; a token can see what it is and how much it read | Draft; decisions settled 2026-11-12 |
## Retired
- **0002 — Forgejo salvage plan.** The page inventory was delivered; the
rules that outlive it (three modes of take, the provenance ledger, the
resolver seam, the per-page definition of done) moved to 0003 §8. The
document itself is in history at every check-in before 2026-09-10.