Timeline

zit#85 landed, so the identity of a store is readable without a checkout. ProjectCode drops the clone handshake — free port, spawn zit serve, poll for readiness, POST a container, scrape the push card — for one subprocess that answers directly.

That handshake was the last thing keeping quarry from serving a BARE store: the read plane was already -R-only with no cmd.Dir anywhere, but zit serve is checkout-only. Verified by serving a directory holding nothing but libfossil's .zit — 3,835 check-ins, and timeline, wiki, ticket, forum and technote all answer 200.

Startup also loses a per-repository 5-second worst case. check-in: d7528db81f user: dmestas tags: trunk

Activity events reach third parties over signed HTTP, so an integrator never has to speak NATS. Subscriptions live in forge OLTP; the signing secret is printed once at creation and never readable again.

Delivery is durable rather than a fire-and-forget goroutine: each (event, subscription) is one JetStream message, acked on 2xx, NAKed with growing backoff, MaxDeliver as the dead-letter boundary. An endpoint down during a deploy still gets its events — proven live by writing with the receiver stopped and seeing the delivery land when it returned.

0003 §3 names dagnats for this class of work; it runs on the JetStream quarry already embeds, so this uses that directly and leaves dagnats as the upgrade path when v3 brings the engine in for CI.

Mentions are not forwarded: they address a person, not a repository. check-in: 550b7af81c user: dmestas tags: trunk

0003's as-built section was five slices behind. Records what shipped and the two findings worth carrying: the JetStream cap silently discarding un-folded events, and the parse failures that fall back to opaque content without surfacing an error. Both were invisible until measured against fossil's own tables, which is the argument for putting that parity check in CI.

0001 §10 no longer lists accounts as remaining; the open v2 items are web sessions, the notify inbox and the webhook dispatcher. check-in: 2ee274084f user: dmestas tags: trunk

A download route completes the previous slice. The bytes come from 'zit artifact --raw'; the index gates which hashes are servable, so this cannot become read-any-artifact-by-hash, and a deleted attachment stops being reachable by URL. An older revision of a live file still is — fossil keeps attachment history.

The route is hostile to its own payload: always a download, never an inline render, octet-stream regardless of what was stored, nosniff, and a deny-all CSP. Reads are capped at 32MiB and refused rather than truncated. check-in: 0a228d956b user: dmestas tags: trunk

The last data delta against fossil. quarry parsed the A card into an Attach and dropped it, so attachments were invisible: sqlite showed none of its 11, tcl none of its 3,333. Both now match fossil's own table exactly.

Fossil models attachments as a log, not a set — the newest card per filename wins and a card with no source is a DELETION — so resolving them wrong resurrects deleted files. Real corpora exercise that: 1 deleted on sqlite, 10 on tcl.

Content is not linkable yet. Serving arbitrary attached bytes needs a decided Content-Disposition and CSP posture, so the page names each file and the raw-artifact route stays its own decision. check-in: 4831e9bef1 user: dmestas tags: trunk

technote gains a Title field: the C card is what a timeline renders as the note's name, and zit refuses to attach it later, so it is write-once at save time. The edit form prefills it.

forum posts and replies now carry an N card. quarry's form invites markdown, but an omitted card is text/x-fossil-wiki by fossil's rule, so a markdown post was rendering as wiki markup — the same default wiki.save and technote.add already applied.

Tags (--tag) stay unadopted: repeatable inputs need a slice field the ops layer does not encode yet. check-in: 89c60b6ca1 user: dmestas tags: trunk

0001 §8's v2 tables. Accounts are the web/API identity (argon2id verifier, site-admin flag, read/write/admin per repo); the RFC §6.3 shared secret stays the sync credential, since the protocol fixes its derivation and the server must recompute it.

ops.Auth becomes the required role, so the Admin level that was already declared now means something. The gate stays open until the first account exists, mirroring the sync-user policy, so existing deployments and local single-user serving are unaffected. check-in: bf5ba9d2fc user: dmestas tags: trunk

Broadens the previous J/T/U fix: fossil's next_token() returns a non-NULL empty string whenever a card ends in a space, on any letter, and each card's own validation decides. C is the common case — 1,009 empty-comment artifacts across sqlite and tcl were rejected and demoted to content. Interior empty tokens stay malformed, and arity still gates the rest. check-in: 5773517bde user: dmestas tags: trunk

ZITEVT is capped with DiscardOld, and watch() published the whole census in one burst — so a repo larger than the cap deleted its own head while the indexer was still folding, then reported itself done. sqlite indexed 41,478 of 131,558 artifacts and lost every ticket, wiki page and forum post. Publishing now yields to folding every 64 MiB. check-in: 44c86387b9 user: dmestas tags: trunk

Real Fossil writes an empty value as a bare trailing space ("J comment ", "T +date <hash> "). The RFC grants this only for the U card, so quarry rejected the artifacts and demoted them to content — costing sqlite all 2,100 ticket changes. Tolerated on J/T/U only, trailing position only. check-in: 03858409ec user: dmestas tags: trunk