Timeline

Three fixes for one screenshot. The icons were CSS masks with inline data: URIs — valid in Chrome, invalid under iOS Safari's stricter parsing, so every icon rendered as a grey block. Now an SVG sprite of six Octicons (MIT, ledgered); no encoding to get wrong.

Alignment needed real table columns. CSS grid aligns within one grid, so a per-row grid gave every row its own widths and nothing lined up. Measured: stat cells now share right edges across rows exactly.

And the description spans the full row instead of sitting in column one, which had made that column as wide as the longest sentence and pushed the numbers off a phone. No horizontal scroll at 320-1280px; the mirror column drops below 30rem. check-in: 60e5e5ebb6 user: dmestas tags: trunk

A sentence of stats is a different width in every row, so nothing lines up and the column is hard to scan. Four fixed slots — check-ins, contributors, mirror freshness, last activity — each an icon and a number, in a grid so the numbers align down the page.

Durations go compact (34m, 12h, 3d) for the same reason; the exact instant stays in the title and datetime. Every badge keeps a title, because an icon alone states nothing. check-in: 7bf20af78a user: dmestas tags: trunk

An aggregator listing showed whatever the last commit happened to say — written for people already in that repo's context, the widest thing in the row, and on a phone one entry filled the screen. GitHub and Forgejo list description and activity and neither shows a commit message.

Replaced with what a stranger can use: last activity, check-ins, contributors, and mirror freshness. The last is there because mirroring created an ambiguity — a repo quiet upstream and a mirror failing for a week look identical if all you see is 'last activity'.

Contributors rides the memoized Counts, so it costs nothing per request. check-in: 012cdff6c9 user: dmestas tags: trunk

Removing a repository's disk space meant going to the shell and doing it without quarry knowing, which is worse than quarry doing it. Deletion now purges the store, the derived index, and every forge row keyed to the repository — grants, sync users, mirror, webhooks, CI records — in one transaction, so a new repository of the same name cannot inherit somebody's credentials.

Two brakes. confirm must equal the name: a yes/no prompt is answered reflexively, typing the name requires having read which repository is about to go. And the store is removed ONLY when it lives under this node's repositories root — quarry serves stores it did not create, and this forge runs on a corpus of exactly those, so deleting one named by --repo would destroy a checkout somebody else manages. Verified: the attempt on pikchr refuses and says to unregister instead. check-in: a8d2831bf4 user: dmestas tags: trunk

A repository with no check-ins has an unborn trunk, so the timeline, the file tree and every clone instruction have nothing to point at. Optional README, license (MIT or BSD-2) and .zitignore give it a born trunk, which is why GitHub offers the same three at creation.

The copyright line is left as <copyright holder> rather than filled with the account name: a copyright naming the wrong person is worse than one that is visibly unfinished, and an account is a login, not a legal entity. Seeding is refused on a clone, which arrives with its own history, and paths are checked against the repository root before anything is written. check-in: c5b6d979e2 user: dmestas tags: trunk

The front page rendered every repository unsorted and unbounded — the same shape that made the timeline unusable, and it is at 23 now. Adds a name filter, sort by name, recent activity or size, and a limit, with Total alongside Count so a page can say '5 of 23'.

Sorting happens BEFORE the limit. The other order gives an arbitrary subset in the right sequence, which reads as correct and is not.

Activity comes from the event table's index — one walk stopping at the first row — so the column that makes a forge listing worth reading costs nothing.

Adds repo.get, so the settings page and the CLI stop scanning the whole listing to read one repository's settings. check-in: 4a3165db34 user: dmestas tags: trunk

repo.update replaces repo.visibility and applies a repository's settings whole — a settings form submits every field it manages, so partial-update semantics would only add a way for the two to disagree about what absent means. The CLI reads current settings before writing, so 'repo private' no longer blanks the description.

A settings page at /r/{repo}/settings, admin-gated, and the description now appears on the repository itself rather than only in the listing: a reader arriving from a link otherwise sees nav and a file tree and no statement of what the project is. check-in: a41b410958 user: dmestas tags: trunk

Visibility on the registry, gated at every read path: pages, API, search, file reads and the sync endpoint all answer 404 for a repository the caller may not see. 404 and not 403 — a 403 confirms the repository exists, which is the one thing a private repository must not confirm.

The listing filters by visibility too. A list that names a private repository has leaked it whatever the page then refuses to show.

The gate lives in Deps.repoFor, where d.repo already resolved the store, so a new op cannot forget it. The API router now resolves identity for ANONYMOUS ops as well: a read op that never looks at credentials cannot tell a repository's own collaborators from strangers, and would lock them out of their own repository.

Two faults found while verifying. Repositories named by --repo had no registry row, so taking one private updated nothing and reported success — a security control that claims to work while doing nothing. They are recorded now, and SetRepoVisibility refuses a name it does not hold. Second, the sync path was ungated: a private repository whose pages refuse anonymous readers while zit clone hands over every artifact is not private.

Verified: anonymous and unprivileged accounts get 404 everywhere and a short list; a collaborator with read sees it; admins see everything. check-in: f88e97a9fd user: dmestas tags: trunk

Six ops (account.list/add/passwd/delete/grant/revoke, admin) plus quarry accounts on top of them. Creating a login or granting someone read on a repository no longer needs shell access on the server.

quarry account still opens OLTP directly and has to: the FIRST account must exist before any server runs or any admin exists to authenticate as. Everything after that is the API, so the CLI has no privileged path.

The verifier never crosses the seam in either direction, and account.add /passwd scrub the password out of any error before it travels — an error is the one value that reaches a log, an HTTP body and a terminal at once.

Verify returns a three-valued Decision instead of a bool. Denied and Insufficient are not the same thing and the wire has separate codes for them: an authenticated client short of a capability was being told 401 with a challenge, which invites it to retry the same password forever. Now 403, and deliberately without a challenge. A harness test pinned the old behaviour and was updated with the reason. check-in: 86880118d5 user: dmestas tags: trunk

Nobody picks a filesystem path when they make a repository on a forge, and requiring one made repo.add usable only by the machine's operator. --repos-root gives the server somewhere to put them; path is now optional and the response says where it landed.

Repositories gain a description — every forge has one and quarry had nowhere to put it, so the listing could only show names and counts.

Three surfaces on one op: quarry repo new|clone|list|remove drives the HTTP API rather than the database, so the CLI has no privileged path and anything it can do a client can; /new is the same three questions a forge always asks; and an empty repository shows how to push to it instead of a bare file table, because it is waiting, not broken.

A rejected form comes back as a form with the reason on it — an error page throws the reader's input away. check-in: 87a492fe4f user: dmestas tags: trunk