Parents and children of check-in [2ee274084f]
|
2026-08-16
| ||
| 19:38 |
webhooks: the standard outbound surface (0001 Principle 6)
Activity events reach third parties over signed HTTP, so an integrator never has to speak NATS. Subscriptions live in forge OLTP; the signing secret is printed once at creation and never readable again. Delivery is durable rather than a fire-and-forget goroutine: each (event, subscription) is one JetStream message, acked on 2xx, NAKed with growing backoff, MaxDeliver as the dead-letter boundary. An endpoint down during a deploy still gets its events — proven live by writing with the receiver stopped and seeing the delivery land when it returned. 0003 §3 names dagnats for this class of work; it runs on the JetStream quarry already embeds, so this uses that directly and leaves dagnats as the upgrade path when v3 brings the engine in for CI. Mentions are not forwarded: they address a person, not a repository. check-in: 550b7af81c user: dmestas tags: trunk | |
| 19:31 |
rfcs: refresh status — accounts, attachments, authored cards
0003's as-built section was five slices behind. Records what shipped and the two findings worth carrying: the JetStream cap silently discarding un-folded events, and the parse failures that fall back to opaque content without surfacing an error. Both were invisible until measured against fossil's own tables, which is the argument for putting that parity check in CI. 0001 §10 no longer lists accounts as remaining; the open v2 items are web sessions, the notify inbox and the webhook dispatcher. check-in: 2ee274084f user: dmestas tags: trunk | |
| 19:27 |
attachments: serve content, gated by the A card
A download route completes the previous slice. The bytes come from 'zit artifact --raw'; the index gates which hashes are servable, so this cannot become read-any-artifact-by-hash, and a deleted attachment stops being reachable by URL. An older revision of a live file still is — fossil keeps attachment history. The route is hostile to its own payload: always a download, never an inline render, octet-stream regardless of what was stored, nosniff, and a deny-all CSP. Reads are capped at 32MiB and refused rather than truncated. check-in: 0a228d956b user: dmestas tags: trunk | |