gitea serves the registry's public root; the lab trusts a tarball only there or at the forge's own origin (issue 624, ADR 0346) #280

Merged

mesh-admin merged 2 commits from fix/624-the-forge-serves-its-public-root into main

2026-10-13 19:52:06 +00:00

Author	SHA1	Message	Date
jochen	1faee6e279	lab: a forge setting that is not http(s) is never a trusted origin (hq issue 624, review 222) mesh/merge-gate head 1faee6e27976 merged into trunk faebc3569acf — pass: builds gitea, lab → novox, shanks; no bus step; every machine composes with the ch… Details mesh/repo-check head 1faee6e27976 merged into trunk faebc3569acf — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-… Details mesh/delivery delivered Details	2026-10-13 20:33:13 +02:00
jochen	6f7d06726c	gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624) The forge writes every tarball at its public name and the lab reaches it at a private address, so npm 12 refused every locked @novox package. The public name now comes from the mesh's own composition of the forge's route, through the lab's binding, and the lab compares scheme, host and port.	2026-10-13 20:33:02 +02:00