quarry RFCs

Numbers are stable: code comments cite them by number, so an RFC is amended in place rather than replaced, and a retired one keeps its number in history. Status lines in each file are kept true; this page is the map.

The spec

RFC	What	Status
0001	quarry itself: a forge for zit that holds no hostage bytes	Living spec; single-node scope implemented
0005	one named event stream that pipelines, webhooks and notifications subscribe to	Implemented
0003	how it was built: technology choices, salvage and provenance rules (§8, formerly RFC 0002), status as built	Historical; §2 and §8 remain in force

Authorization

RFC	What	Status
0004	fossil capability letters as the native model; a hosted fossil repository brings its users with it	Implemented
0008	roles as the interface over the letters; next amendment: the mirror steward, the person who maintains a mirror's credentials on the remote fossil server, so hosting a repository is not owning it	Implemented; amendment pending
0017	the bar for a write scales with how permanent the write is: a companion or the local tier may ask less than the store. Amends 0015	Draft, questions settled; implemented after teams
0018	teams: a user-owned place that holds repositories, carries grants, and gathers their chat and tickets. 0008's deferred team layer	Built except companions following a parent into a team (see its status line); the ticket board is built and the room streams

Landings

docs/landings.md is the base: a landing is a reading of forum posts.

RFC	What	Status
0006	stacked landings, rendered as a chain	Implemented
0007	branch ownership enforced at the sync front	Implemented
0009	verdicts on landings: dagnats runs, checks, logs, premerge	In progress (see its status line)
0019	CI files a person writes in five minutes: Actions-shaped YAML in ci/, on: filters, environments whose secrets only reviewed code can reach. Amends 0009	Built
0020	fossil's unversioned files in zit and quarry: synced to every clone, stored in the repository's bucket, served by quarry's sync front at fossil's paths, imported from mirrored fossils; releases started by tag, deploys separate. Supersedes ticket #19's direction	Built, release workflow included (ci/release.yml, scripts/release.sh); not built: pruning old releases and the "cannot roll back past" mark
0021	agent accounts: a person's agent is its own passwordless account holding scoped named tokens, never more than its operator, everything short of deed acts; forge agents (zeitgeist) for the site; CI runs get run-scoped tokens instead of accounts; a Publisher preset (steward is reserved for mirrors)	Draft; ten decisions settled 2026-10-02

Attention and what arrives

RFC	What	Status
0011	chat that never loses a message, mentions, the inbox, push; notify owns transport, quarry owns policy	Implemented; its live model reaches every surface, the four ticket 82b9615eaf3d named included
0012	0011's delivery plan in five phases	Implemented; kept because code cites its phases
0014	what may write to a forge from outside: reply-by-email first, source keys and external CI later	Phase 1 implemented
0015	a repository's forum in a separate fossil-compatible store, bound by the forge	Phase 1 implemented
0016	files on tickets, wiki, technotes and forum posts: fossil's A card in the DAG, the bytes in the steward's own bucket	Phases 1–3 built; Phase 4 (export, migrate, report, scanner) not built

Sync front

docs/rfcs/0001-quarry-forge.md §7 is the base.

RFC	What	Status

Standalone

RFC	What	Status
0010	quarry ui: one repository, one browser, no accounts	Draft, not built
0013	who touched what, when: the activity page	Implemented

Mirrors

RFC	What	Status
0022	a repository admin mirrors a public repository's trunk to GitHub or any Git host from its settings: a deploy key the forge makes and keeps, a push after each trunk move, fast-forward only, status in words. Replaces the host's mirror-to-github script	Built: rungs 1-3 (the setting and deploy key, a push after each trunk move, the About line); rung 4 done (pikchr-studio moved off the host script). Git mirrors in (#358) are separate
0023	a site admin disables a repository on a notice (its admins keep access to fix it) or puts it on legal hold (nobody reaches it, no writes, kept as evidence): 451 on every surface, the owner told why, an append-only takedown log, delete and stop serving refused meanwhile; with the DMCA, NCMEC and notice-form process	Rung 1 built (disable and legal hold, 451 on every surface, the takedown log); rungs 2-4 not built
0024	horizons: clones that hold history from a check-in forward; the content horizon through the sync front unchanged, the structural horizon's seed, boundary labels and merge-base from the index plane; history below the horizon answered by the API; which consumer gets which tool	Draft; measurement done, structural horizon is the deliverable; decisions settled 2026-10-18; waits on zit
0025	a repository is named within its namespace, a person's or a team's, not across the forge: a permanent ID is its key and namespace/name its address; existing names become their IDs, so nothing is rewritten; forge-held mirrors under zeitforge/ until stewarded; flat names as a deployment option for single-user builds	Draft; decisions settled 2026-10-21; Built (all five rungs)
0026	an agent is personal or dedicated, at site, team or repository scope: a personal agent inherits its owner within its scope (narrowable, never more), a dedicated one holds what its scope grants; existing agents keep their reach; tokens need no upkeep (one revoke-and-reissue per agent, idle lapse at 90 days)	Draft; decisions settled 2026-10-31
0027	an agent refused for want of authority its person holds asks them instead (Quarry-Ask): the person is told by inbox, push and email, approves with one tap, and the exact call runs as them under their own permissions; anything they may do is askable except their own credentials, sign-offs and account; results return to the agent, secrets once; for every user and every agent, nothing to set up	Draft; decisions settled 2026-11-08
0028	an agent's requests get their own page, /me/requests, counted in the header, answered in place with history folded away; each reads as the action it takes; a burst is one email; a whole job can be asked for as one plan, approved with one tap and run in order until a step fails	Draft; decisions settled 2026-11-08
0029	a person or an agent sets up a repository, its pushes, mirror and CI from the forge alone: the first push adopts its project code, agents push with sync-scoped tokens got through their person, generated docs mark session-only ops, check=true says what create and mirror would refuse, worker tokens through the API for people's own runners, authenticated scripts skip the bot check, one guide at /docs/start	Draft; decisions settled 2026-11-08
0030	one request and one approval give a repository its agent and credential, and one command gives it a CI runner: an agent the owner already operates asks for an agent on a repository with a role and a kind of credential, the owner sees scope, repositories, ceiling and expiry and approves once, the forge creates, grants and mints in one act and releases the value once to the holder of a pickup key; a repository admin makes a short-lived install code and quarry runner install builds the users, sudo rule, unit and token on the host; a stopped runner hands its jobs back; a public repository shows check names and states to visitors; a token can see what it is and how much it read	Draft; decisions settled 2026-11-12

Retired

• 0002 — Forgejo salvage plan. The page inventory was delivered; the rules that outlive it (three modes of take, the provenance ledger, the resolver seam, the per-page definition of done) moved to 0003 §8. The document itself is in history at every check-in before 2026-09-10.