novox/mesh-catalog
13
0
Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity
1,613 Commits 11 Branches 0 Tags
b159efd65673c5c8a8c609f9b4534fb304b8e671
Commit Graph
5 Commits
Author SHA1 Message Date
jschoubben c346bba34e Add the forge-account provider: an agent account, its team and its machine key per consumer (issue 955 F3) 2026-10-16 22:45:51 +02:00
jschoubben 8131c13634 Register and prune an agent account's mesh SSH keys through the forge API (issue 955 F2) 2026-10-16 22:42:04 +02:00
jschoubben c8dfbdc813 Lift the agent account code into internal/forgeaccount for the forge-account provider (issue 955 F1) 2026-10-16 22:41:11 +02:00
mesh-adminandClaude Opus 5.5 48f0662fde Make the forge's tools act as an account of their own, not the administrator (issue 469, ADR 0365 clause 2)
mesh/merge-gate head 48f0662fdea2 merged into trunk 5ce2d07c7f47 — pass: builds gitea → novox; no bus step; every machine composes with the change as it di…
Details
mesh/repo-check head 48f0662fdea2 merged into trunk 5ce2d07c7f47 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
Details
mesh/delivery delivered
Details 
The tools' token reached everything the administrator may do, so their boundary rested on their own guards.
The gitea module now makes a plain account, mesh-tools, with the admin login, gives it write on code, issues
and pull requests of every novox repository through one team, and mints the tools' token for it; the admin's
old token goes only after the new one is kept. The Go forge bundle sends that token, never the admin login.
The forge shows protection rules only to a repository administrator, so every check reads a branch's
protection from the branch. mesh-admin stays a ready author, so marks made before the move keep counting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-14 22:28:25 +00:00
jochen f2d765320a gitea forge bundle: name the parent the forge used, match protection rules as the forge does, bound a commit's size and a search's time (issue 539) 
The forge's contents and diffpatch endpoints take a branch, never a commit to
build on, so the parent is read from the commit the forge made, and a branch
that moved under the commit is said. Blobs are read at the commit read first,
not at the branch name. Protection rules match as Gitea 1.27 matches them
([...], {a,b}, escapes, a plain name in any case), in the Go bundle and in
guard.ts alike. One commit carries at most 4 MiB per file or patch and 16 MiB
together; code search stops at its deadline and says so. The HTTP client the
two Go bundles copied is one package, internal/forgehttp.
 2026-10-12 12:51:22 +02:00