fix(node): satisfy clippy on stale-local download test path join

Under-lock GET failures now always shed as RepoUnavailable, even when a local
copy exists, so a transient download error cannot publish over a newer stored
generation. PublishDurabilitySlot only synthesizes UploadUnknowable after
release starts, and receive-pack marks that boundary before spawning the tail.

Adds regression tests for both paths; inv22 F4 gate accepts the release wrapper.

.cargo/audit.toml

@@ -8,9 +8,24 @@
 # The audit job stays hard-fail: only the advisories explicitly listed below are
 # suppressed, so any NEW advisory still breaks CI. Each entry below has no
 # available upstream fix; everything fixable is fixed in Cargo.lock instead.
+#
+# Tracking: the hickory ignores are reachable accepted risk. A scheduled re-check
+# (.github/workflows/audit-schedule.yml) runs without these ignores and fails if
+# the lockfile moves off the pinned vulnerable versions while the ignores remain.
 
 [advisories]
 ignore = [
+    # hickory-proto 0.25.2 (pulled by libp2p-dns 0.44 -> hickory-resolver 0.25).
+    # REACHABLE: the node wraps its QUIC transport in the system DNS resolver
+    # (crates/gitlawb-node/src/p2p/mod.rs:238), so a malicious DNS response can
+    # trigger these DoS paths. No fix is available: the latest libp2p-dns on
+    # crates.io is 0.44 and pins hickory 0.25; the fix requires hickory >=0.26.1.
+    # REMOVE both once libp2p-dns ships a release using hickory 0.26 (verified
+    # 2026-06-21: cargo update -p hickory-proto locks 0 packages; still 0.25.2).
+    # Tracking: https://github.com/Gitlawb/node/issues/76
+    "RUSTSEC-2026-0118", # hickory NSEC3 closest-encloser unbounded loop
+    "RUSTSEC-2026-0119", # hickory O(n^2) name-compression CPU exhaustion
+
     # rsa 0.9.10 (Marvin timing sidechannel). Present in Cargo.lock because sqlx
     # resolves sqlx-mysql unconditionally, and sqlx-mysql depends on rsa. cargo
     # audit scans the lockfile, so it flags rsa even though it is NOT linked into
@@ -20,23 +35,4 @@ ignore = [
     # ever built with the `mysql` feature, or any other consumer of rsa enters
     # the build, at which point it becomes a real reachable advisory.
     "RUSTSEC-2023-0071", # rsa Marvin attack (no fix; not linked in our build)
-
-    # crypto-bigint 0.5.5 (secret-dependent branches in operations meant
-    # to be constant-time). REACHABLE accepted risk, on two paths:
-    # - alloy-signer -> elliptic-curve 0.13 -> crypto-bigint 0.5: the k256
-    #   PrivateKeySigner that signs transactions in `gl name`
-    #   (crates/gl/src/name.rs) and the node operator
-    #   (crates/gitlawb-node/src/operator.rs).
-    # - aws-sigv4 (`sigv4a` feature, crates/gitlawb-node/Cargo.toml) ->
-    #   crypto-bigint 0.5 (directly and via p256 0.13): SigV4a key
-    #   derivation, used only for requests to endpoints that require SigV4a
-    #   (e.g. S3 Multi-Region Access Points).
-    # Exploiting it needs local timing observation of those signing operations.
-    # The fix is crypto-bigint >=0.7.6, and no compatible dependent uses it:
-    # every alloy-signer release (through 2.5.0) requires elliptic-curve ^0.13,
-    # and aws-sigv4 1.6.4 is the first release on crypto-bigint 0.7 (1.5.x -
-    # 1.6.3 still require ^0.5.4), but it needs Rust 1.94.1, above our 1.91 MSRV
-    # (verified 2026-11-03). REMOVE only when Cargo.lock has no crypto-bigint
-    # below 0.7.6: `grep -A1 'name = "crypto-bigint"' Cargo.lock`.
-    "RUSTSEC-2026-0387", # crypto-bigint timing variability (no compatible fix)
 ]

.env.example

@@ -1,41 +1,12 @@
-# Twigpine node — environment variables
+# gitlawb node — environment variables
 # Copy to .env and fill in your values.
 # All variables are optional unless marked REQUIRED.
 
 # ── Node identity ─────────────────────────────────────────────────────────
-# Path to the node's Ed25519 keypair PEM file. Must name a key file, not a
-# directory: a trailing slash, a final `.` or `..`, and `..` traversal are
-# refused so the path cannot retarget a parent. A `~/` value must stay under
-# home after expansion. Bare `identity.pem` is still legal.
+# Path to the node's Ed25519 keypair PEM file.
 # Generate with: gl identity new
 GITLAWB_KEY=/data/keys/identity.pem
 
-# Path to the node's persistent libp2p identity key file. Must include a
-# directory, because the node will not keep its p2p identity key in the working
-# directory. A value that cannot name a securable key file (a bare filename,
-# `..` traversal, a trailing slash, the filesystem root, or a `~/` path that
-# escapes home) is refused before the node binds, so the process exits.
-# Anything wrong with the storage itself (a symlinked or non-directory parent,
-# an unsafe cwd or ancestor, an unreadable or malformed key) leaves p2p off
-# while HTTP keeps serving, logged at error as p2p_identity_key_load_failed and
-# counted by the gitlawb_p2p_identity_key_load_failed metric. /health still
-# reports healthy in that state, so alert on the event or the metric. Fixing
-# the storage and restarting restores the same PeerId.
-# On Unix it is created 0600 inside a 0700 directory. A key directory that
-# grants access beyond its owner is tightened to 0700 on start; one closed too
-# far is refused with a chmod 700 remedy rather than widened. On other
-# platforms no permissions are enforced.
-# If the node logs that it tightened a key directory that was GROUP OR WORLD
-# WRITABLE, treat the key that was sitting there as possibly exposed: delete
-# it so a fresh identity is generated on the next start. An ordinary 0755
-# directory is tightened too, but others could not read a 0600 key or replace
-# its directory entry, so do not rotate for that case. A directory that was
-# merely closed too far is refused, not tightened, and no key in it was ever
-# exposed.
-# Keep it on a persistent volume so the PeerId survives redeploys.
-# Default: ~/.gitlawb/p2p.key
-#GITLAWB_P2P_KEY=/data/keys/p2p.key
-
 # Publicly reachable URL of this node (used in peer announcements)
 GITLAWB_PUBLIC_URL=https://your-node.example.com
 
@@ -132,12 +103,8 @@ GITLAWB_P2P_PORT=7546
 # GITLAWB_BOOTSTRAP_DISABLE_SEEDS=true for isolated dev/test networks.
 GITLAWB_BOOTSTRAP_PEERS=
 GITLAWB_BOOTSTRAP_DISABLE_SEEDS=false
-# Require a peer write to prove its DID on every transport: RFC 9421 signatures
-# on the announce/sync routes, and an Ed25519 payload signature on gossip
-# ref-update events. Keep false during rolling upgrades so existing live nodes
-# can still communicate. Upgrade every gossip-publishing peer to a build that
-# signs events before setting this true, or their updates are dropped on
-# arrival with no error visible on their side.
+# Require signatures on peer announce/sync write routes. Keep false during
+# rolling upgrades so existing live nodes can still communicate.
 GITLAWB_REQUIRE_SIGNED_PEER_WRITES=false
 
 # Require the authenticated pusher to be the repo owner on git-receive-pack.
@@ -156,8 +123,8 @@ GITLAWB_ENFORCE_OWNER_PUSH=true
 GITLAWB_P2P_BOOTSTRAP=
 
 # ── Access control ────────────────────────────────────────────────────────
-# Reserved and currently inert. Repo reads are gated per repository by
-# is_public and path-scoped visibility rules; this flag changes nothing.
+# Reserved for private-read mode. Public/private repo read enforcement is not
+# wired in the current live release; do not rely on this for private repositories.
 GITLAWB_PUBLIC_READ=true
 
 # Maximum git smart-HTTP pack request size, in bytes.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,5 +1,5 @@
 name: Bug report
-description: Report a defect in a Twigpine crate or node behavior
+description: Report a defect in a Gitlawb crate or node behavior
 labels: ["bug"]
 body:
   - type: markdown

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/Twigpine/node/blob/main/SECURITY.md
+    url: https://github.com/Gitlawb/node/blob/main/SECURITY.md
     about: Please report security issues privately per our security policy, not as a public issue.
   - name: Questions & discussion
-    url: https://github.com/Twigpine/node/discussions
+    url: https://github.com/Gitlawb/node/discussions
     about: For usage questions and open-ended discussion.

.github/pull_request_template.md

@@ -1,5 +1,5 @@
 <!--
-  Thanks for contributing to Twigpine. Keep PRs focused on one change.
+  Thanks for contributing to Gitlawb. Keep PRs focused on one change.
   Protocol-level changes (identity, signatures, wire format) should start
   as an issue before code — see CONTRIBUTING.md.
 -->

.github/workflows/pr-checks.yml

@@ -68,22 +68,6 @@ jobs:
       - name: Test release tag resolver
         run: scripts/test-resolve-release-tag.sh
 
-  triage-detector:
-    name: triage detector matrix
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      # pr-triage.yml runs on pull_request_target and never checks out PR
-      # code, so its inline detector can only be exercised here, where the
-      # proposed workflow body IS the checked-out one.
-      - name: Test inline-test detector
-        run: node scripts/test-pr-triage-detect.mjs
-
   test:
     name: test (${{ matrix.toolchain }})
     runs-on: ubuntu-latest

.github/workflows/pr-triage.yml

@@ -76,221 +76,9 @@ jobs:
             // line after horizontal whitespace, covering bare, cfg(test), namespaced,
             // optional leading ::, and raw-identifier (r#test) forms. No head-file fetch
             // or lexer: needs-tests is advisory, not a merge gate.
-            //
-            // The final path component may also carry `test` as an underscore-delimited
-            // segment, so third-party harnesses land without enumerating them one by one
-            // (#[test_case(1)], #[wasm_bindgen_test]). It is deliberately a segment and
-            // not a substring: a substring would also match #[contest] / #[latest], and a
-            // false positive here SUPPRESSES needs-tests rather than adding it. This
-            // heuristic has to fail loud, because a wrongly labeled PR gets corrected by
-            // the author while a wrongly cleared one is invisible. That trade costs the
-            // no-underscore harness names (#[rstest]), which stay unmatched on purpose.
-            //
-            // The segment classes are [A-Za-z0-9]+ rather than \w+ on purpose, so that `_`
-            // is only ever the literal delimiter. \w+ contains `_`, which makes the repeat
-            // ambiguous and backtracks exponentially: on this workflow's pull_request_target
-            // trigger f.patch is fork-controlled, so `#[test` followed by a long `_a` run is
-            // a permissionless stall of the triage job.
-            // Rust allows whitespace, line breaks, and comments between the
-            // attribute path and ] or (. A flat regex cannot decide that
-            // boundary: `//` runs to end of line, and block comments NEST, which
-            // is beyond regular languages — every enumeration of comment
-            // spellings so far has either dropped a legal separator (regressing
-            // real tests into needs-tests) or let unrelated patch records
-            // complete each other (clearing needs-tests from a testless PR, the
-            // invisible direction). So the closer is found by a token-aware
-            // scan instead: it consumes horizontal whitespace, `//`-to-newline,
-            // and depth-counted `/* */` runs, and accepts only when the first
-            // real token after the attribute path is `]` or `(`.
-            //
-            // Association is positional: the scan starts on the attribute's own
-            // added line and may continue ONLY through the immediately following
-            // added lines (a context line, hunk header, or removal breaks the
-            // chain). Unrelated `]`/`(` lines elsewhere in the patch can never
-            // complete a path they do not adjoin. The continuation is bounded;
-            // past the bound the scan gives up and reports NO inline test, which
-            // fails toward the loud label rather than the silent clearance.
-            //
-            // The detector body is fenced by the TRIAGE_DETECTOR markers so
-            // scripts/test-pr-triage-detect.mjs can extract and run it against
-            // the committed case matrix. Keep the fenced block self-contained.
-            // TRIAGE_DETECTOR_BEGIN
-            const TEST_ATTR_PATH =
-              "(?:cfg[ \\t]*\\([ \\t]*test[ \\t]*\\)|(?:::[ \\t]*)?(?:[\\w-]+[ \\t]*::[ \\t]*)*(?:r#)?(?:[A-Za-z0-9]+_)*test(?:_[A-Za-z0-9]+)*)";
-            // Anchored to the start of one added line; group 1 is whatever
-            // follows the path on that line, handed to the separator scan.
-            const TEST_ATTR_LINE = new RegExp(
-              "^[ \\t]*#\\[[ \\t]*" + TEST_ATTR_PATH + "([\\s\\S]*)$"
-            );
-            // An attribute split across more added lines than this is not a
-            // spelling anyone writes; refusing to scan further keeps the walk
-            // linear in the patch and fails toward the loud label.
-            const MAX_ATTR_CONTINUATION_LINES = 16;
-            // segs[0] is the remainder of the attribute's own line; each later
-            // entry is the text of one immediately following added line. True
-            // only when the first non-separator token across them is ] or (.
-            // Single forward pass, no backtracking: fork-controlled input.
-            function attrCloserFollows(segs) {
-              let depth = 0; // open block-comment nesting carried across lines
-              for (const seg of segs) {
-                let i = 0;
-                while (i < seg.length) {
-                  if (depth > 0) {
-                    if (seg.startsWith("/*", i)) { depth += 1; i += 2; }
-                    else if (seg.startsWith("*/", i)) { depth -= 1; i += 2; }
-                    else { i += 1; }
-                    continue;
-                  }
-                  const c = seg[i];
-                  if (c === " " || c === "\t") { i += 1; continue; }
-                  if (seg.startsWith("//", i)) break; // comment to end of line
-                  if (seg.startsWith("/*", i)) { depth = 1; i += 2; continue; }
-                  return c === "]" || c === "(";
-                }
-                // Line exhausted inside separators; the newline is itself a
-                // separator, so continue on the next added line.
-              }
-              return false; // out of adjoined lines (or bound hit): stay loud
-            }
-            // Before the candidate scan, a pre-pass walks added patch lines
-            // tracking Rust lexical state: raw strings (r#*", br#*", cr#*"),
-            // block comments (/* */ with nesting), regular strings ("...",
-            // which can span newlines), and line comments (//). An added line
-            // that starts inside any of these is skipped as a candidate,
-            // because a #[test_case] appearing there is lexical non-code, not
-            // a real test attribute. State is only tracked across consecutive
-            // added lines and reset at any break (context line, removal,
-            // hunk header): context lines carry a partial view of the file,
-            // so a " or r#" or /* there might be inside a string that opened
-            // before the hunk's visible window, and treating it as an opener
-            // would mark every later added line as non-code (a false negative
-            // on a real #[test]). The tradeoff is that a non-code region
-            // opened by a context line is invisible: an added #[test] inside
-            // an existing raw string or block comment is scanned as code and
-            // may match (a false positive, silent direction). This is accepted
-            // because (1) the old detector had the same behavior, (2) the
-            // pattern is rare, and (3) needs-tests is advisory, not a merge
-            // gate. Scanning context lines to close this gap would re-introduce
-            // the false negative, which affects the far more common case of a
-            // context line carrying a stray " from a string that opened before
-            // the visible window. Single forward pass, O(n) in patch length.
-            function patchAddsInlineTest(patch) {
-              const lines = patch.split("\n");
-              const nonCodeStart = new Set();
-              let rawHashes = -1; // -1 = not in raw string; >=0 = # count
-              let blockDepth = 0;
-              let inString = false;
-              for (let i = 0; i < lines.length; i++) {
-                const line = lines[i];
-                if (!line) continue;
-                const prefix = line[0];
-                // Only scan added lines. Context and removal lines carry
-                // a partial view of the file: a " or r#" or /* on a context
-                // line might be inside a string that opened before the
-                // hunk's visible window, and treating it as an opener would
-                // mark every later added line as non-code (a false negative
-                // on a real #[test]). So lexical state is only tracked across
-                // consecutive added lines and reset at any break. A non-code
-                // region opened by a context line is invisible; the candidate
-                // is still scanned, which fails toward the loud label.
-                if (prefix !== "+") {
-                  rawHashes = -1; blockDepth = 0; inString = false;
-                  continue;
-                }
-                const text = line.slice(1);
-                if (rawHashes >= 0 || blockDepth > 0 || inString)
-                  nonCodeStart.add(i);
-                let j = 0;
-                while (j < text.length) {
-                  if (rawHashes >= 0) {
-                    if (text[j] === '"') {
-                      let h = 1;
-                      while (h <= rawHashes && text[j + h] === "#") h++;
-                      if (h > rawHashes) { rawHashes = -1; j += h; continue; }
-                    }
-                    j += 1; continue;
-                  }
-                  if (blockDepth > 0) {
-                    if (text.startsWith("/*", j)) { blockDepth += 1; j += 2; }
-                    else if (text.startsWith("*/", j)) { blockDepth -= 1; j += 2; }
-                    else { j += 1; }
-                    continue;
-                  }
-                  if (inString) {
-                    if (text[j] === "\\") { j += 2; continue; }
-                    if (text[j] === '"') { inString = false; j += 1; continue; }
-                    j += 1; continue;
-                  }
-                  // Recognize Rust char and byte-char literals ('X', '\X',
-                  // '\u{...}', b'X') so their contents never open string or
-                  // comment state. A char literal has a closing ' within a
-                  // bounded distance; a lifetime or label ('a, 'static,
-                  // 'label:) does not, so it falls through as a regular char.
-                  // This is not a skip-to-next-' rule: the lookahead is 2-4
-                  // chars, or bounded to 20 for \u escapes (at most 6 hex
-                  // digits), never unbounded.
-                  if (text[j] === "'") {
-                    let k = j + 1;
-                    if (text[k] === "\\") {
-                      k += 1;
-                      if (text[k] === "u" && text[k + 1] === "{") {
-                        const uBound = k + 20;
-                        while (k < uBound && text[k] && text[k] !== "}") k++;
-                        if (text[k] === "}") k++;
-                      } else {
-                        k += 1;
-                      }
-                    } else {
-                      k += 1;
-                    }
-                    if (text[k] === "'") { j = k + 1; continue; }
-                    // lifetime or label: just skip the apostrophe
-                  }
-                  if (text[j] === '"') { inString = true; j += 1; continue; }
-                  if (text.startsWith("//", j)) break;
-                  if (text.startsWith("/*", j)) { blockDepth = 1; j += 2; continue; }
-                  const prev = j > 0 ? text[j - 1] : "";
-                  const isIdent = /[A-Za-z0-9_]/.test(prev);
-                  if (!isIdent && text[j] === "r") {
-                    let k = j + 1, h = 0;
-                    while (text[k + h] === "#") h++;
-                    if (text[k + h] === '"') {
-                      rawHashes = h; j = k + h + 1; continue;
-                    }
-                  }
-                  if (!isIdent && (text[j] === "b" || text[j] === "c") && text[j + 1] === "r") {
-                    let k = j + 2, h = 0;
-                    while (text[k + h] === "#") h++;
-                    if (text[k + h] === '"') {
-                      rawHashes = h; j = k + h + 1; continue;
-                    }
-                  }
-                  j += 1;
-                }
-              }
-              for (let i = 0; i < lines.length; i++) {
-                if (lines[i][0] !== "+") continue;
-                if (nonCodeStart.has(i)) continue;
-                const m = TEST_ATTR_LINE.exec(lines[i].slice(1));
-                if (m === null) continue;
-                const segs = [m[1]];
-                for (
-                  let j = i + 1;
-                  j < lines.length &&
-                  lines[j][0] === "+" &&
-                  segs.length <= MAX_ATTR_CONTINUATION_LINES;
-                  j++
-                ) {
-                  segs.push(lines[j].slice(1));
-                }
-                if (attrCloserFollows(segs)) return true;
-              }
-              return false;
-            }
-            // TRIAGE_DETECTOR_END
-            const addsInlineTest = files.some(
-              f => f.filename.endsWith(".rs") && !!f.patch && patchAddsInlineTest(f.patch)
-            );
+            const addsInlineTest = files.some(f =>
+              f.filename.endsWith(".rs") && f.patch &&
+              /^\+[ \t]*#\[[ \t]*(?:cfg[ \t]*\([ \t]*test[ \t]*\)|(?:::[ \t]*)?(?:[\w-]+[ \t]*::[ \t]*)*(?:r#)?test\b)/m.test(f.patch));
             const touchedTests =
               names.some(n => n.includes("/tests/") || n.endsWith("_test.rs")) || addsInlineTest;
             if (changedRust && !touchedTests) want.add("needs-tests");
@@ -336,7 +124,7 @@ jobs:
               "",
               lines,
               "",
-              "See [CONTRIBUTING.md](https://github.com/Twigpine/node/blob/main/CONTRIBUTING.md). Update the PR and these notes will clear automatically.",
+              "See [CONTRIBUTING.md](https://github.com/Gitlawb/node/blob/main/CONTRIBUTING.md). Update the PR and these notes will clear automatically.",
             ].join("\n");
 
             await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body: comment });

.github/workflows/release.yml

@@ -20,15 +20,7 @@ on:
         type: string
 
 concurrency:
-  # Not keyed on the ref: two runs racing `imagetools create` on the same
-  # moving tags could interleave, so runs of this workflow serialize outright.
-  # GitHub keeps at most one running and one pending run per group; a newer
-  # queued run replaces the pending one, and cancel-in-progress: false
-  # protects only the run already executing. So a backfill dispatched while a
-  # release is running, followed by a push to main, is replaced silently: the
-  # remedy is to re-dispatch it once the running release completes, which the
-  # push-only gate on the moving-tag step makes safe in any ordering.
-  group: release
+  group: release-${{ github.ref }}
   cancel-in-progress: false
 
 # Least privilege by default; every job opts in to exactly what it needs.
@@ -39,13 +31,12 @@ jobs:
     # Skipped on manual dispatch: a backfill must never create or advance a
     # release PR as a side effect (npm-publish tolerates the skipped need via
     # !cancelled(), and every other job gates on release_created == 'true').
-    if: ${{ github.repository == 'Twigpine/node' && github.event_name != 'workflow_dispatch' }}
+    if: ${{ github.repository == 'Gitlawb/node' && github.event_name != 'workflow_dispatch' }}
     name: Release Please
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
-    environment: release
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -73,7 +64,7 @@ jobs:
   sync-release-lock:
     name: Sync Cargo.lock on the release PR
     needs: release-please
-    if: ${{ !cancelled() && github.repository == 'Twigpine/node' && github.event_name != 'workflow_dispatch' }}
+    if: ${{ !cancelled() && github.repository == 'Gitlawb/node' && github.event_name != 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -87,7 +78,6 @@ jobs:
       # dispatch the release PR's head carries no check runs and the --locked
       # gate never validates it.
       actions: write
-    environment: release
     steps:
       # Prefer the fresh `pr` output when this run just created/updated the
       # release PR; otherwise fall back to querying for an open release-please
@@ -225,7 +215,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -237,7 +226,6 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
@@ -249,9 +237,7 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # Pin the commit the resolver verified; a tag ref re-resolved here
-          # could have been moved between resolve and checkout.
-          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
+          ref: ${{ steps.rel.outputs.tag }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -326,7 +312,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -338,14 +323,9 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-          # ghcr requires a lowercase repository path, and unlike metadata-action,
-          # buildx's `--output name=` does no lowercasing, so a mixed-case owner
-          # makes the digest push fail with "invalid reference format".
-          echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
 
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -365,80 +345,24 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create and push multi-arch manifest
-        id: manifest
         env:
           VERSION: ${{ steps.rel.outputs.version }}
-          IMAGE: ${{ steps.rel.outputs.image }}
         run: |
           set -euo pipefail
-          # The docker matrix pushes one digest per arch leg; anything else is
-          # a broken set, not a smaller multi-arch image.
-          count="$(find /tmp/digests -maxdepth 1 -type f | wc -l)"
-          if [ "$count" -ne 2 ]; then
-            echo "::error::expected 2 arch digests in /tmp/digests, found $count"
-            exit 1
-          fi
+          # ghcr requires a lowercase repository path.
+          IMAGE="ghcr.io/${GITHUB_REPOSITORY,,}"
+          MAJOR_MINOR="${VERSION%.*}"
           digests=""
           for f in /tmp/digests/*; do
-            d="$(basename "$f")"
-            case "$d" in
-              *[!0-9a-f]*)
-                echo "::error::digest filename is not lowercase sha256 hex: $d"
-                exit 1
-                ;;
-            esac
-            if [ "${#d}" -ne 64 ]; then
-              echo "::error::digest is not 64 hex chars: $d"
-              exit 1
-            fi
-            digests="$digests $IMAGE@sha256:$d"
+            digests="$digests $IMAGE@sha256:$(basename "$f")"
           done
-          # The immutable tag always publishes. The moving tags are applied by
-          # the gated step below, which never runs on workflow_dispatch.
           # shellcheck disable=SC2086
-          docker buildx imagetools create -t "$IMAGE:$VERSION" $digests
+          docker buildx imagetools create \
+            -t "$IMAGE:$VERSION" \
+            -t "$IMAGE:$MAJOR_MINOR" \
+            -t "$IMAGE:latest" \
+            $digests
           docker buildx imagetools inspect "$IMAGE:$VERSION"
-          echo "digests=${digests# }" >> "$GITHUB_OUTPUT"
-
-      - name: Move floating tags
-        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-        env:
-          VERSION: ${{ steps.rel.outputs.version }}
-          IMAGE: ${{ steps.rel.outputs.image }}
-          DIGESTS: ${{ steps.manifest.outputs.digests }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          MAJOR_MINOR="${VERSION%.*}"
-          # :latest and :X.Y track the newest release. Only a push to main
-          # carries a release-please-cut version, and release-please versions
-          # are monotonic, so on this path the tags only ever advance. A
-          # workflow_dispatch backfill republishes an existing tag and must
-          # never move a pointer, so this step skips on dispatch. After a
-          # backfill that is genuinely newest in its minor line, advance :X.Y
-          # by hand: docker buildx imagetools create -t "$IMAGE:X.Y" <digests>.
-          # The event gate alone does not bound a stale run: re-running an
-          # older push run replays its stored needs outputs under the
-          # original event and ref, and would move the pointers backward to
-          # that run's version. Floor against live state instead: this run's
-          # release already exists by now, so VERSION must be the newest
-          # published release or the run is stale and the tags stay put. The
-          # releases list is ordered by creation, not semver, so read every
-          # page and take the semver maximum, not the first page's.
-          tags="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
-            -q '.[] | select(.draft == false) | .tag_name')" || {
-            echo "::error::could not list releases to bound the moving tags"
-            exit 1
-          }
-          floor="$(printf '%s\n' "$tags" \
-            | { grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' || true; } \
-            | sed 's/^v//' | sort -V | tail -n 1)"
-          if [ -n "$floor" ] && [ "$floor" != "$VERSION" ]; then
-            echo "::error::release v$floor is newer than this run's v$VERSION; refusing to move the moving tags backward (stale re-run?)"
-            exit 1
-          fi
-          # shellcheck disable=SC2086
-          docker buildx imagetools create -t "$IMAGE:latest" -t "$IMAGE:$MAJOR_MINOR" $DIGESTS
 
       - name: Release summary
         env:
@@ -462,7 +386,6 @@ jobs:
     continue-on-error: ${{ startsWith(matrix.target, 'x86_64-pc-windows') }}
     permissions:
       contents: write
-    environment: release
     strategy:
       fail-fast: false
       matrix:
@@ -482,27 +405,10 @@ jobs:
           - target: x86_64-pc-windows-msvc
             os: windows-latest
     steps:
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        id: rel
-        env:
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        shell: bash # matrix includes windows-latest, where run: defaults to pwsh
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "$RELEASE_TAG"
-
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # Pin the commit the resolver verified; a tag ref re-resolved here
-          # could have been moved between resolve and checkout.
-          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
+          ref: ${{ needs.release-please.outputs.tag_name }}
           persist-credentials: false
 
       - name: Set up Rust toolchain
@@ -548,7 +454,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="${{ steps.rel.outputs.version }}"
+          VERSION="${{ needs.release-please.outputs.version }}"
           BIN_DIR="target/${{ matrix.target }}/release"
           EXE=""
           case "${{ matrix.target }}" in *windows*) EXE=".exe" ;; esac
@@ -568,7 +474,7 @@ jobs:
         run: |
           set -euo pipefail
           TARGET="${{ matrix.target }}"
-          NAME="gitlawb-node-${{ steps.rel.outputs.version }}-${TARGET}"
+          NAME="gitlawb-node-${{ needs.release-please.outputs.version }}-${TARGET}"
           BIN_DIR="target/${TARGET}/release"
           EXE=""
           case "$TARGET" in *windows*) EXE=".exe" ;; esac
@@ -609,7 +515,7 @@ jobs:
       - name: Attach to release
         uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
-          tag_name: ${{ steps.rel.outputs.tag }}
+          tag_name: ${{ needs.release-please.outputs.tag_name }}
           files: |
             dist/*.tar.gz
             dist/*.zip
@@ -622,9 +528,7 @@ jobs:
     # (release-binaries is skipped on dispatch, hence !cancelled()). Publishing
     # auth is npm Trusted Publishing (GitHub OIDC) — no NPM_TOKEN. Each
     # @gitlawb package must have this repo + workflow (release.yml) configured
-    # as its trusted publisher on npmjs.com, scoped to the release environment
-    # so a dispatched copy of this file on another ref cannot mint a token, or
-    # publish fails loudly here —
+    # as its trusted publisher on npmjs.com, or publish fails loudly here —
     # deliberately loud: the silent secret-guard skip is how 0.4.x–0.6.0
     # never reached npm.
     if: >-
@@ -636,7 +540,6 @@ jobs:
     permissions:
       contents: read
       id-token: write # npm trusted publishing (OIDC) + provenance
-    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -648,7 +551,6 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.npm_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
@@ -656,9 +558,7 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # Pin the commit the resolver verified; a tag ref re-resolved here
-          # could have been moved between resolve and checkout.
-          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
+          ref: ${{ steps.rel.outputs.tag }}
           persist-credentials: false
 
       # npm >= 11.5.1 performs the OIDC token exchange automatically when the
@@ -671,23 +571,14 @@ jobs:
       - name: Ensure npm supports trusted publishing
         run: |
           set -euo pipefail
-          npm install -g npm@11.19.1
-          # Assert the pin took, so an accidental unpin or a drift off 11.19.1
-          # fails loudly here instead of silently running a different npm on
-          # the OIDC path.
-          installed="$(npm --version)"
-          echo "npm installed: $installed"
-          if [ "$installed" != "11.19.1" ]; then
-            echo "::error::npm is not the pinned 11.19.1 (got: $installed)"
-            exit 1
-          fi
+          npm install -g npm@^11.5.1
+          npm --version
 
       - name: Lay in release binaries
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ steps.rel.outputs.version }}
           TAG: ${{ steps.rel.outputs.tag }}
-          ASSETS: ${{ steps.rel.outputs.assets }}
         run: |
           set -euo pipefail
           # npm platform package -> Rust target triple (unix only; Windows is not
@@ -704,18 +595,8 @@ jobs:
             target="${entry#*:}"
             archive="gitlawb-node-${VERSION}-${target}.tar.gz"
             echo "==> $pkg <- $archive"
-            # Download by the asset id the resolver captured and uploader-
-            # checked, not by name: release assets are mutable, and an id can
-            # only ever point at the exact blob captured at resolve time.
-            # The map keys are base64-encoded asset names.
-            want="$(printf '%s' "$archive" | base64 -w0)"
-            asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
-            if [ -z "$asset_id" ]; then
-              echo "::error::release $TAG has no asset $archive captured at resolve time"
-              exit 1
-            fi
-            gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
-              -H 'Accept: application/octet-stream' > "_dl/$archive"
+            gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
+              --pattern "$archive" --dir _dl --clobber
             tar -xzf "_dl/$archive" -C _dl
             src="_dl/gitlawb-node-${VERSION}-${target}"
             cp "$src/gl" "npm/packages/$pkg/gl"
@@ -754,39 +635,14 @@ jobs:
           # Platform packages first, then the wrapper (so its optionalDependencies resolve).
           # Skip versions already on the registry so a rerun after a partial publish
           # is idempotent instead of erroring on the first existing package.
-          # npm publish moves the latest dist-tag to whatever it publishes, so a
-          # backfilled older version would hand :latest to stale code. Decide
-          # the dist-tag per package from that package's own registry latest:
-          # a partial publish can leave the platform packages ahead of the
-          # wrapper. E404 means the package has never been published, so this
-          # release gets latest; any other lookup failure must fail closed
-          # rather than guess at the dist-tag and risk moving latest backward.
-          # stderr goes to a file so a warning on a successful lookup cannot
-          # leak into registry_latest; it is read only when the lookup fails.
-          npm_err="$(mktemp)"
-          trap 'rm -f -- "$npm_err"' EXIT
           for pkg in gl-darwin-arm64 gl-darwin-x64 gl-linux-arm64 gl-linux-x64 gl; do
             name="@gitlawb/$pkg"
             if npm view "$name@$VERSION" version >/dev/null 2>&1; then
               echo "==> $name@$VERSION already published, skipping"
               continue
             fi
-            registry_latest="$(npm view "$name" dist-tags.latest 2>"$npm_err")" || {
-              if ! grep -q E404 "$npm_err"; then
-                cat "$npm_err" >&2
-                echo "::error::npm dist-tags lookup failed for $name; not guessing the dist-tag"
-                exit 1
-              fi
-              registry_latest=""
-            }
-            dist_tag="latest"
-            if [ -n "$registry_latest" ] && \
-               [ "$VERSION" != "$(printf '%s\n%s\n' "$registry_latest" "$VERSION" | sort -V | tail -1)" ]; then
-              dist_tag="backfill"
-              echo "::notice::$VERSION is older than $name@$registry_latest; publishing under dist-tag backfill"
-            fi
-            echo "==> npm publish $name@$VERSION (dist-tag $dist_tag)"
-            npm publish "npm/packages/$pkg" --provenance --access public --tag "$dist_tag"
+            echo "==> npm publish $name@$VERSION"
+            npm publish "npm/packages/$pkg" --provenance --access public
           done
 
   homebrew-bump:
@@ -796,7 +652,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read # GITHUB_TOKEN downloads release assets; the tap push uses HOMEBREW_TAP_PAT
-    environment: release
     steps:
       - name: Guard on secret
         id: guard
@@ -810,27 +665,11 @@ jobs:
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check out workflow scripts
-        if: ${{ steps.guard.outputs.enabled == 'true' }}
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        if: ${{ steps.guard.outputs.enabled == 'true' }}
-        id: rel
-        env:
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "$RELEASE_TAG"
-
       - name: Checkout tap repo
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          repository: Twigpine/homebrew-tap
+          repository: Gitlawb/homebrew-tap
           token: ${{ secrets.HOMEBREW_TAP_PAT }}
           path: tap
           persist-credentials: false
@@ -839,32 +678,15 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.rel.outputs.version }}
-          TAG: ${{ steps.rel.outputs.tag }}
-          ASSETS: ${{ steps.rel.outputs.assets }}
+          VERSION: ${{ needs.release-please.outputs.version }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
         run: |
           set -euo pipefail
           base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
           mkdir -p _sums
-          # Hash the tarballs themselves, fetched by the asset id the resolver
-          # captured and uploader-checked. The *.sha256 sidecars are mutable
-          # release assets too; trusting them would trust the same surface.
-          sha() {
-            archive="gitlawb-node-${VERSION}-$1.tar.gz"
-            want="$(printf '%s' "$archive" | base64 -w0)"
-            asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
-            if [ -z "$asset_id" ]; then
-              echo "::error::release $TAG has no asset $archive captured at resolve time" >&2
-              exit 1
-            fi
-            # errexit is off inside the $(...) this runs under, so a failed
-            # download must exit the function itself instead of hashing a
-            # truncated file.
-            gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
-              -H 'Accept: application/octet-stream' > "_sums/$archive" \
-              || exit 1
-            sha256sum "_sums/$archive" | awk '{print $1}'
-          }
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
+            --pattern '*.tar.gz.sha256' --dir _sums --clobber
+          sha() { awk '{print $1}' "_sums/gitlawb-node-${VERSION}-$1.tar.gz.sha256"; }
           SHA_MAC_ARM="$(sha aarch64-apple-darwin)"
           SHA_MAC_X64="$(sha x86_64-apple-darwin)"
           SHA_LNX_ARM="$(sha aarch64-unknown-linux-musl)"
@@ -873,8 +695,8 @@ jobs:
           mkdir -p tap/Formula
           cat > tap/Formula/gl.rb <<EOF
           class Gl < Formula
-            desc "Twigpine CLI — decentralized git for AI agents and developers"
-            homepage "https://twigpine.com"
+            desc "Gitlawb CLI — decentralized git for AI agents and developers"
+            homepage "https://gitlawb.com"
             version "${VERSION}"
             license "MIT OR Apache-2.0"
 
@@ -925,7 +747,7 @@ jobs:
         working-directory: tap
         env:
           HOMEBREW_TAP_PAT: ${{ secrets.HOMEBREW_TAP_PAT }}
-          VERSION: ${{ steps.rel.outputs.version }}
+          VERSION: ${{ needs.release-please.outputs.version }}
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
@@ -938,7 +760,7 @@ jobs:
           fi
           git commit -m "gl ${VERSION}"
           # Credentials are not persisted in .git/config; supply the token only for the push.
-          git push "https://x-access-token:${HOMEBREW_TAP_PAT}@github.com/Twigpine/homebrew-tap.git" HEAD:main
+          git push "https://x-access-token:${HOMEBREW_TAP_PAT}@github.com/Gitlawb/homebrew-tap.git" HEAD:main
 
   web-sync:
     name: Sync web (install scripts + version)
@@ -947,7 +769,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read # GITHUB_TOKEN checks out node; the web PR uses WEB_SYNC_PAT
-    environment: release
     steps:
       - name: Guard on secret
         id: guard
@@ -961,29 +782,11 @@ jobs:
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Check out workflow scripts
-        if: ${{ steps.guard.outputs.enabled == 'true' }}
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        if: ${{ steps.guard.outputs.enabled == 'true' }}
-        id: rel
-        env:
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "$RELEASE_TAG"
-
       - name: Checkout node (release tag)
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          # Pin the commit the resolver verified; a tag ref re-resolved here
-          # could have been moved between resolve and checkout.
-          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
+          ref: ${{ needs.release-please.outputs.tag_name }}
           path: node
           persist-credentials: false
 
@@ -991,7 +794,7 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          repository: Twigpine/web
+          repository: Gitlawb/web
           token: ${{ secrets.WEB_SYNC_PAT }}
           path: web
           persist-credentials: false
@@ -1003,8 +806,8 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.rel.outputs.version }}
-          TAG: ${{ steps.rel.outputs.tag }}
+          VERSION: ${{ needs.release-please.outputs.version }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
         run: |
           set -euo pipefail
           gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets \
@@ -1022,8 +825,8 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.WEB_SYNC_PAT }}
-          VERSION: ${{ steps.rel.outputs.version }}
-          TAG: ${{ steps.rel.outputs.tag }}
+          VERSION: ${{ needs.release-please.outputs.version }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
         run: |
           set -euo pipefail
           # Canonical install scripts (source of truth lives in the node repo).
@@ -1034,7 +837,7 @@ jobs:
           # One-time, idempotent drift fixes: drop orphaned binaries, fix stale link.
           rm -rf web/public/bin
           if [ -f web/public/skill.md ]; then
-            sed -i 's#github.com/gitlawb/releases#github.com/Twigpine/node/releases#g' web/public/skill.md
+            sed -i 's#github.com/gitlawb/releases#github.com/Gitlawb/node/releases#g' web/public/skill.md
           fi
 
           cd web
@@ -1048,16 +851,16 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "$branch"
-          git commit -m "chore: sync Twigpine ${TAG} (install scripts + version)"
+          git commit -m "chore: sync gitlawb ${TAG} (install scripts + version)"
           # Credentials are not persisted in .git/config; supply the token only for the push.
-          git push --force "https://x-access-token:${GH_TOKEN}@github.com/Twigpine/web.git" "HEAD:$branch"
-          gh pr create --repo Twigpine/web --head "$branch" \
-            --title "Sync Twigpine ${TAG}" \
-            --body "Automated sync from Twigpine/node ${TAG}: install.sh, install.ps1, public/version.json, and one-time drift fixes (removed orphaned public/bin, fixed skill.md releases link). Review and merge to deploy via Vercel." \
+          git push --force "https://x-access-token:${GH_TOKEN}@github.com/Gitlawb/web.git" "HEAD:$branch"
+          gh pr create --repo Gitlawb/web --head "$branch" \
+            --title "Sync gitlawb ${TAG}" \
+            --body "Automated sync from Gitlawb/node ${TAG}: install.sh, install.ps1, public/version.json, and one-time drift fixes (removed orphaned public/bin, fixed skill.md releases link). Review and merge to deploy via Vercel." \
             || {
               # Only swallow the "PR already exists" case; surface auth/API failures
               # (a failed gh pr list must not be misread as "PR exists").
-              pr_count="$(gh pr list --repo Twigpine/web --head "$branch" --state open --json number --jq 'length')" || exit 1
+              pr_count="$(gh pr list --repo Gitlawb/web --head "$branch" --state open --json number --jq 'length')" || exit 1
               if [ "$pr_count" != "0" ]; then
                 echo "PR for $branch already exists; branch was updated."
               else

CONTRIBUTING.md

@@ -1,12 +1,12 @@
-# Contributing to Twigpine
+# Contributing to gitlawb
 
-Thanks for your interest in contributing. Twigpine is an open protocol — agents and humans welcome.
+Thanks for your interest in contributing. gitlawb is an open protocol — agents and humans welcome.
 
 ## Quick start for contributors
 
 ```sh
 # Clone and build
-git clone https://github.com/Twigpine/node
+git clone https://github.com/Gitlawb/node
 cd node
 
 # Build everything
@@ -38,7 +38,7 @@ docs/                   Operator guides
 scripts/                Build helpers
 ```
 
-Smart contracts live in a separate repo: [github.com/Twigpine/contracts](https://github.com/Twigpine/contracts).
+Smart contracts live in a separate repo: [github.com/Gitlawb/contracts](https://github.com/Gitlawb/contracts).
 
 ## Ways to contribute
 

Cargo.toml

@@ -20,8 +20,8 @@ members = [
 edition = "2021"
 rust-version = "1.91"
 license = "MIT OR Apache-2.0"
-authors = ["Twigpine contributors"]
-repository = "https://github.com/Twigpine/node"
+authors = ["gitlawb contributors"]
+repository = "https://github.com/gitlawb/node"
 
 [workspace.dependencies]
 # async

Dockerfile

@@ -75,7 +75,6 @@ WORKDIR /data
 
 ENV GITLAWB_REPOS_DIR=/data/repos \
     GITLAWB_KEY=/data/keys/identity.pem \
-    GITLAWB_P2P_KEY=/data/keys/p2p.key \
     GITLAWB_HOST=0.0.0.0 \
     GITLAWB_PORT=7545 \
     GITLAWB_P2P_PORT=7546

LICENSE-APACHE

@@ -169,7 +169,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2026 Twigpine contributors
+   Copyright 2026 gitlawb contributors
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

LICENSE-MIT

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Twigpine contributors
+Copyright (c) 2026 gitlawb contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,10 +1,10 @@
-# Twigpine Node
+# Gitlawb Node
 
 **Decentralized git infrastructure for developers, AI agents, and app delivery.**
 
-Twigpine Node is the open-source node software behind the Twigpine network. It lets anyone run a self-hosted node, publish repositories under a DID, sign writes with Ed25519 HTTP signatures, replicate git activity across peers, and move toward a resilient app-delivery network where code and build assets can be served closer to users.
+Gitlawb Node is the open-source node software behind the Gitlawb network. It lets anyone run a self-hosted node, publish repositories under a DID, sign writes with Ed25519 HTTP signatures, replicate git activity across peers, and move toward a resilient app-delivery network where code and build assets can be served closer to users.
 
-Twigpine is not trying to be only "another git host." The long-term direction is:
+Gitlawb is not trying to be only "another git host." The long-term direction is:
 
 ```txt
 Decentralized GitHub
@@ -24,17 +24,17 @@ This is a Rust workspace with six crates:
 | Crate | Purpose |
 |---|---|
 | `gitlawb-node` | The node daemon: Axum HTTP server, git smart-HTTP, Postgres metadata, libp2p gossip, optional S3/Tigris/IPFS/Arweave/Base PoS hooks. |
-| `gl` | The Twigpine CLI for identity, repos, issues, PRs, bounties, tasks, peers, node status, MCP, and setup flows. |
-| `git-remote-gitlawb` | Git remote helper for `gitlawb://` URLs, so normal `git clone`, `git fetch`, and `git push` can talk to Twigpine nodes. |
+| `gl` | The Gitlawb CLI for identity, repos, issues, PRs, bounties, tasks, peers, node status, MCP, and setup flows. |
+| `git-remote-gitlawb` | Git remote helper for `gitlawb://` URLs, so normal `git clone`, `git fetch`, and `git push` can talk to Gitlawb nodes. |
 | `gitlawb-core` | Shared primitives: Ed25519 identities, `did:key`, CIDs, RFC 9421 HTTP signatures, certificates, and UCAN tokens. |
 | `gitlawb-attest` | Pluggable external provenance attestations for ref-update certificates. |
 | `icaptcha-client` | Client for the iCaptcha proof-of-intelligence flow used to protect spam-prone writes. |
 
 ---
 
-## Why Twigpine Nodes?
+## Why Gitlawb Nodes?
 
-Most git hosting today depends on a small number of centralized platforms. Twigpine Nodes are designed for a different model:
+Most git hosting today depends on a small number of centralized platforms. Gitlawb Nodes are designed for a different model:
 
 - **Own your identity**: every user, agent, and node is an Ed25519 keypair represented as `did:key:z6Mk...`.
 - **Signed writes by default**: write requests use RFC 9421 HTTP Signatures instead of passwords.
@@ -47,7 +47,7 @@ Most git hosting today depends on a small number of centralized platforms. Twigp
 
 ## Current status
 
-Twigpine Node is live early infrastructure. It is useful today, but some security and reliability features are intentionally staged for compatibility with existing nodes.
+Gitlawb Node is live early infrastructure. It is useful today, but some security and reliability features are intentionally staged for compatibility with existing nodes.
 
 Good today:
 
@@ -71,7 +71,7 @@ Known limitations:
 - Agent lifecycle revocation is not enforced by HTTP Signature authorization; do not rely on removing or revoking an agent record to block a compromised signer.
 - Read visibility is not a blanket data-classification boundary: task, IPFS-pin, and Arweave-anchor listings are not repository-gated; withheld path names can be visible to a root reader; and later visibility changes cannot retract content already announced or externally anchored.
 - Peer writes are signed by upgraded nodes, but strict signed-peer enforcement is opt-in during rolling upgrades.
-- GraphQL mutations require a signed identity (a verified signer bound to the acting DID), are limited to the agent-task queue, and are covered by a CI completeness fence that requires signer acquisition and actor binding on every registered mutation; repo writes are not exposed over GraphQL and remain REST-only.
+- Current GraphQL mutations require an authenticated signer, but there is no mutation-specific guardrail that prevents a future mutation from omitting that check.
 - Pull-request review comments do not yet have threaded line-level anchors, and merges do not enforce approval requirements.
 
 See:
@@ -87,7 +87,7 @@ See:
 The fastest path is Docker Compose. It starts a node and Postgres.
 
 ```bash
-git clone https://github.com/Twigpine/node.git
+git clone https://github.com/Gitlawb/node.git
 cd node
 cp .env.example .env
 docker compose up -d
@@ -132,10 +132,10 @@ npm install -g @gitlawb/gl
 brew install gitlawb/tap/gl
 
 # curl (macOS / Linux)
-curl -fsSL https://twigpine.com/install.sh | sh
+curl -fsSL https://gitlawb.com/install.sh | sh
 
 # PowerShell (Windows)
-irm https://twigpine.com/install.ps1 | iex
+irm https://gitlawb.com/install.ps1 | iex
 ```
 
 Or build from source:
@@ -178,7 +178,7 @@ gl register --node http://localhost:7545
 Create a repo:
 
 ```bash
-gl repo create my-repo --description "My first Twigpine repo" --node http://localhost:7545
+gl repo create my-repo --description "My first Gitlawb repo" --node http://localhost:7545
 ```
 
 Use the git remote helper:
@@ -192,7 +192,7 @@ For public-network use, make sure `GITLAWB_NODE` points to the node you want. Th
 
 ### Full lifecycle against an iCaptcha-enforcing node
 
-Public nodes (e.g. `node.twigpine.com`) require two things on writes:
+Public nodes (e.g. `node.gitlawb.com`) require two things on writes:
 
 1. **RFC 9421 HTTP Signatures**: every write is signed by your identity key. `gl`
    and the `git-remote-gitlawb` helper do this automatically. An old/unsigned CLI
@@ -205,8 +205,8 @@ Public nodes (e.g. `node.twigpine.com`) require two things on writes:
 
 ```bash
 gl identity new                                   # create did:key identity
-gl register      --node https://node.twigpine.com  # signed + auto-solves iCaptcha
-gl repo create memlawb --node https://node.twigpine.com   # signed + auto-solves iCaptcha
+gl register      --node https://node.gitlawb.com  # signed + auto-solves iCaptcha
+gl repo create memlawb --node https://node.gitlawb.com   # signed + auto-solves iCaptcha
 git push  origin2 main                            # origin2 = gitlawb://<your-did>/memlawb (signed)
 git clone gitlawb://<your-did>/memlawb            # public read, no proof needed
 gl doctor                                         # preflight: identity, node, version, iCaptcha
@@ -369,12 +369,6 @@ GITLAWB_REQUIRE_SIGNED_PEER_WRITES=true
 
 `POST /api/v1/sync/trigger` is not part of the staged rollout: it always requires a signature in both config modes and returns 401 without one, because each call drives an O(peers) outbound fan-out.
 
-The flag is not HTTP-only. It also gates inbound gossip ref-update events on the libp2p mesh, which carry an Ed25519 payload signature rather than RFC 9421 headers because there are no HTTP headers to sign. Set to `true`, an unsigned gossip event is dropped. Set to `false`, an unsigned event is accepted with a warning during the rolling-upgrade window, and the write budget it consumes is charged to the forwarding peer rather than to the DID it claims, since an unsigned event's claimed DID is asserted and not proven. A present-but-invalid signature is refused in both modes; that is forgery, not an un-upgraded peer.
-
-Because the flag now spans both transports, the rollout order matters in one direction: **upgrade every gossip-publishing peer to a build that signs events before you set this to `true`.** Enabling it while an old publisher is still live drops that publisher's ref-updates on arrival, and the publisher sees no error, because gossip has no response to carry one. Upgrading the HTTP peers alone is not sufficient.
-
-There is a second precondition on gossip ingest that the flag does not control. A publisher's `node_did` must already exist in the receiving node's peers table, or the event is dropped as an unknown peer DID. This holds in both modes, signed and unsigned alike: a valid signature proves key possession, not membership. Rows reach that table over HTTP, either from `GITLAWB_BOOTSTRAP_PEERS` when this node contacts a bootstrap peer and records the DID it reports, or from a prior `POST /api/v1/peers/announce`. So a peer that only ever joined the libp2p mesh, with no HTTP announce and no bootstrap contact in either direction, will have its ref-updates dropped even with a good signature and the flag off. If gossip is silently not landing from a peer you can see on the mesh, check that its DID is in `GET /api/v1/peers` on the receiving side first.
-
 ---
 
 ## Configuration
@@ -397,9 +391,8 @@ Important node settings:
 | `GITLAWB_P2P_PORT` | libp2p QUIC/UDP port. Use `0` to disable. |
 | `GITLAWB_BOOTSTRAP_PEERS` | Comma-separated HTTP peer URLs. |
 | `GITLAWB_P2P_BOOTSTRAP` | Comma-separated libp2p multiaddrs. |
-| `GITLAWB_P2P_KEY` | Path to the node's persistent libp2p identity key file, which fixes the PeerId across restarts. Must name a key file inside a directory, such as `/data/keys/p2p.key` or `./keys/p2p.key`. Two kinds of problem are handled differently. A value that cannot name a securable key file at all (a bare filename, `..` traversal, a trailing `/`, the filesystem root, or a `~/` path that escapes home) is refused before the node binds, so the process exits. Anything wrong with the storage itself (a symlinked or non-directory parent, an unsafe ancestor or working directory, an unreadable or malformed key) leaves p2p off while HTTP keeps serving; the node logs it at error level as `p2p_identity_key_load_failed` and sets the `gitlawb_p2p_identity_key_load_failed` metric to 1. Note that `/health` still reports healthy in that state, so alert on the log event or the metric rather than on the health check. Correcting the storage and restarting restores the same PeerId. On Unix a new key is created `0600` inside a `0700` directory. A key directory that grants access beyond its owner is tightened to `0700` on start; one that is closed too far is refused with a `chmod 700` remedy rather than widened, since a directory locked down on purpose is an operator decision. Rotate the key only when the node logs that the directory was group- or world-writable (or the key file itself was group- or world-readable). An ordinary `0755` directory is tightened too, but others could not read a `0600` key or replace its directory entry. An existing key file is never modified: one with group or other bits set is rejected (`chmod 600`), and so is one this node cannot read. On other platforms no permissions are enforced. Default `~/.gitlawb/p2p.key`; point it at a persistent volume when running in a container. |
 | `GITLAWB_BOOTSTRAP_DISABLE_SEEDS` | Disable embedded seed peers for isolated dev/test networks. |
-| `GITLAWB_REQUIRE_SIGNED_PEER_WRITES` | Require peer writes to prove their DID on every transport: RFC 9421 signatures on the announce/sync routes, and an Ed25519 payload signature on gossip ref-update events. Defaults to `false` during the staged rollout below. Upgrade every gossip publisher before enabling, or their updates are dropped with no error on their side. |
+| `GITLAWB_REQUIRE_SIGNED_PEER_WRITES` | Require signed peer announce/sync writes. Defaults to `false` during the staged rollout below. |
 | `GITLAWB_ENFORCE_OWNER_PUSH` | Require the authenticated pusher to be the repo owner on `git-receive-pack`. **Defaults to `true`.** A `did:key` signature is authentication, not authorization — anyone can mint a key and sign — so with this off every signed caller may push to every repository, private ones included. Delegated and CI keys count as non-owners: a UCAN `git/push` capability is verified but not yet honored for authorization, so they cannot push while this is on. Set `false` only for a rolling upgrade; see [`docs/RUN-A-NODE.md`](docs/RUN-A-NODE.md). |
 | `GITLAWB_AUTO_SYNC` | Enable automatic sync from known peers. |
 | `GITLAWB_MAX_PACK_BYTES` | Max git pack body size for smart-HTTP routes. |
@@ -427,33 +420,11 @@ Production note: change the default Postgres password before exposing a node pub
 
 Legacy-pin window: releases before the CID-resolver work stored the provider CID (Kubo dag-pb / Pinata) as a pinned object's resolver key. The `/ipfs/{cid}` resolver now recomputes the raw-content CID from the object bytes and refuses to serve a key that does not match, so `GET /api/v1/ipfs/pins` can still advertise an unrepaired legacy CID that 404s. Such a row is repaired opportunistically the next time a push carries the object again (its key is rewritten to the raw CID, the old value kept in `legacy_provider_cid`), but git negotiation omits objects the node already has, so most legacy rows never re-enter a push delta. A deferred one-shot startup sweep, not this opportunistic path, is what fully retires the advertise-then-404 window. Rows whose object bytes are gone stay withheld.
 
-### Upgrading: the PeerId rotates once
-
-This node's libp2p identity is now a keypair generated on first start and kept
-at `GITLAWB_P2P_KEY`, rather than one derived from the node DID. Every node
-therefore gets a new PeerId once, on the first start after upgrading, and keeps
-it from then on as long as that key file survives (put it on a persistent volume
-in a container).
-
-Two things to check before upgrading:
-
-- Any `GITLAWB_P2P_BOOTSTRAP` multiaddr that pins a peer's old PeerId with a
-  `/p2p/<PeerId>` suffix stops matching once that peer upgrades. Update the
-  suffix, or drop it and let identify supply the current one. Addresses without
-  the suffix keep working untouched.
-- `GITLAWB_P2P_KEY` must name a key file inside a directory, such as
-  `/data/keys/p2p.key` or `./keys/p2p.key`. A bare filename is refused at
-  startup, since the node will not keep its identity key in the working
-  directory.
-
-Peers found over `GITLAWB_BOOTSTRAP_PEERS` and the embedded seed list are
-unaffected, since those are HTTP URLs and carry no PeerId.
-
 ---
 
 ## Optional node staking
 
-Twigpine Node includes optional Base L2 node-operator hooks. Operators can register a node DID, stake `$GITLAWB`, and post heartbeats.
+Gitlawb Node includes optional Base L2 node-operator hooks. Operators can register a node DID, stake `$GITLAWB`, and post heartbeats.
 
 PoS is disabled unless these are configured:
 
@@ -523,8 +494,8 @@ Build:
 Output:
 
 ```txt
-dist/Twigpine Node.app
-dist/GitlawbNode-macOS.dmg
+dist/Gitlawb Node.app
+dist/Gitlawb Node.dmg
 ```
 
 Features:
@@ -538,7 +509,7 @@ Features:
 Unsigned local build:
 
 ```bash
-xattr -cr "dist/Twigpine Node.app"
+xattr -cr "dist/Gitlawb Node.app"
 ```
 
 ---

SECURITY.md

@@ -2,9 +2,9 @@
 
 ## Reporting a Vulnerability
 
-If you discover a security vulnerability in Twigpine, please **do not open a public issue**.
+If you discover a security vulnerability in gitlawb, please **do not open a public issue**.
 
-Report it privately by emailing **security@twigpine.com** with:
+Report it privately by emailing **security@gitlawb.com** with:
 - A description of the vulnerability
 - Steps to reproduce
 - Potential impact assessment
@@ -118,13 +118,13 @@ These are documented limitations of the current live release. They should be pri
 
 ## Threat Model
 
-Twigpine is designed to be secure against:
+gitlawb is designed to be secure against:
 - **Unauthenticated writes** — HTTP Signature auth on protected write endpoints; see Known Limitations for owner and capability authorization gaps
 - **Tampered git objects** — CIDv1 content addressing detects modification
 - **Identity spoofing** — DIDs derived from public keys, unforgeable without the private key
 - **Centralized takedown** — no single point of control; data on IPFS + Arweave
 
-Twigpine is **not yet** designed to defend against:
+gitlawb is **not yet** designed to defend against:
 - A compromised node operator (node operators are trusted for their own node)
 - Sybil attacks on the DHT (trust score system mitigates, not eliminates)
 - Timing attacks on signature verification (not constant-time compared in v0.1)

bootstrap-peers.json

@@ -1,11 +1,11 @@
 {
-  "$comment": "Canonical seed list for the Twigpine network. Merged with GITLAWB_BOOTSTRAP_PEERS at startup. PRs to add public nodes welcome.",
+  "$comment": "Canonical seed list for the Gitlawb network. Merged with GITLAWB_BOOTSTRAP_PEERS at startup. PRs to add public nodes welcome.",
   "version": 1,
   "updated": "2026-06-30",
   "peers": [
     {
       "name": "gitlawb",
-      "operator": "Twigpine",
+      "operator": "Gitlawb",
       "did": "did:key:z6MkqDnb7Siv3Cwj7pGJq4T5EsUisECqR8KpnDLwcaZq5TPr",
       "http_url": "https://node.gitlawb.com",
       "p2p_multiaddr": null,
@@ -13,7 +13,7 @@
     },
     {
       "name": "gitlawb-node2",
-      "operator": "Twigpine",
+      "operator": "Gitlawb",
       "did": null,
       "http_url": "https://node2.gitlawb.com",
       "p2p_multiaddr": null,
@@ -21,7 +21,7 @@
     },
     {
       "name": "gitlawb-node3",
-      "operator": "Twigpine",
+      "operator": "Gitlawb",
       "did": null,
       "http_url": "https://node3.gitlawb.com",
       "p2p_multiaddr": null,
@@ -29,7 +29,7 @@
     },
     {
       "name": "gitlawb-manila",
-      "operator": "Twigpine",
+      "operator": "Gitlawb",
       "did": null,
       "http_url": "https://manila.gitlawb.com",
       "p2p_multiaddr": null,

crates/git-remote-gitlawb/src/main.rs

@@ -287,10 +287,8 @@ fn handle_connect<R: Read>(
     //    this into one POST deadlocks a multi-round fetch (#117).
     //
     //  git-receive-pack (push):
-    //    Git sends the ref-update command list (pkt-lines ending in a flush),
-    //    then the complete PACK blob only when a command has a non-zero new-oid.
-    //    A delete-only push sends no pack, and git holds its write pipe open for
-    //    the report-status response, so EOF cannot delimit the request (#369).
+    //    Git sends ref-update commands + the complete PACK blob, then closes its
+    //    write pipe. read_to_end is safe and correct here, a single POST.
 
     let post_url = format!("{}/{}", repo_base, service);
 
@@ -298,7 +296,10 @@ fn handle_connect<R: Read>(
         return negotiate_upload_pack(&client, &post_url, service, signing_key, stdin, &mut stdout);
     }
 
-    let request_body = read_receive_pack_request(stdin)?;
+    let mut request_body = Vec::new();
+    stdin
+        .read_to_end(&mut request_body)
+        .context("reading receive-pack request")?;
     tracing::debug!("pack request: {} bytes from git", request_body.len());
 
     if request_body.is_empty() {
@@ -534,108 +535,6 @@ fn read_upload_pack_round<R: Read>(stdin: &mut R) -> Result<(Vec<u8>, RoundEnd)>
     }
 }
 
-/// Read one git-receive-pack request: optional `shallow` lines, then EITHER a
-/// command list (pkt-lines terminated by a flush) or a push-cert block
-/// (pkt-lines terminated by a "push-cert-end" line), then the negotiated
-/// push-options block, then the pack ONLY when a command carries a non-zero
-/// new-oid.
-///
-/// A delete-only push sends no pack, and git holds its write pipe open waiting
-/// for the report-status response, so a plain read_to_end deadlocks the two
-/// (#369). A signed push is the other trap: when the client sends a push-cert
-/// it sends NO command list at all (the commands live inside the cert), so the
-/// request starts with a "push-cert" line and no flush ever arrives. The
-/// negotiated capability list is on the push-cert line, or on the first
-/// command line after its NUL when there is no cert. EOF at any point also
-/// ends the read, covering git versions that close the pipe early.
-fn read_receive_pack_request<R: Read>(stdin: &mut R) -> Result<Vec<u8>> {
-    /// Read one pkt-line into `body` (length prefix + data), returning its data
-    /// or `None` on flush or EOF. Malformed lengths bail rather than collapse
-    /// into a synthesized flush (#192 F5).
-    fn read_pkt<R: Read>(stdin: &mut R, body: &mut Vec<u8>) -> Result<Option<Vec<u8>>> {
-        let mut len_bytes = [0u8; 4];
-        match stdin.read_exact(&mut len_bytes) {
-            Ok(()) => {}
-            Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(None),
-            Err(e) => return Err(e.into()),
-        }
-        let Ok(len_hex) = std::str::from_utf8(&len_bytes) else {
-            bail!("malformed pkt-line length prefix: non-UTF-8 bytes {len_bytes:02x?}");
-        };
-        let Ok(pkt_len) = usize::from_str_radix(len_hex, 16) else {
-            bail!("malformed pkt-line length prefix: non-hex {len_hex:?}");
-        };
-        body.extend_from_slice(&len_bytes);
-        if pkt_len == 0 {
-            return Ok(None);
-        }
-        if pkt_len < 4 {
-            bail!("invalid pkt-line length: {pkt_len}");
-        }
-        let mut data = vec![0u8; pkt_len - 4];
-        stdin
-            .read_exact(&mut data)
-            .context("reading pkt-line data")?;
-        body.extend_from_slice(&data);
-        Ok(Some(data))
-    }
-
-    /// "<40-hex old> <40-hex new> <refname>" — the command shape, whether it
-    /// appears in a command list or inside a push-cert.
-    fn is_command(data: &[u8]) -> bool {
-        data.len() >= 82
-            && data[..40].iter().all(|b| b.is_ascii_hexdigit())
-            && data[40] == b' '
-            && data[41..81].iter().all(|b| b.is_ascii_hexdigit())
-            && data[81] == b' '
-    }
-
-    let mut body = Vec::new();
-    let mut caps = String::new();
-    let mut pack_expected = false;
-    let mut in_cert = false;
-    loop {
-        let Some(data) = read_pkt(stdin, &mut body)? else {
-            // Flush ends a command list; EOF ends anything. A cert has no
-            // legal flush inside it, so the same break covers malformed
-            // input without hanging.
-            break;
-        };
-        if !in_cert && data.starts_with(b"push-cert") {
-            in_cert = true;
-            if let Some(nul) = data.iter().position(|&b| b == 0) {
-                caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
-            }
-            continue;
-        }
-        if in_cert && data == b"push-cert-end\n" {
-            break;
-        }
-        if is_command(&data) {
-            if caps.is_empty() {
-                if let Some(nul) = data.iter().position(|&b| b == 0) {
-                    caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
-                }
-            }
-            if data[41..81].iter().any(|&b| b != b'0') {
-                pack_expected = true;
-            }
-        }
-    }
-    // When both are negotiated the push-options block follows the cert; when
-    // only options are negotiated it follows the command flush. Either way it
-    // is pkt-lines to a flush.
-    if caps.split(' ').any(|c| c.starts_with("push-options")) {
-        while read_pkt(stdin, &mut body)?.is_some() {}
-    }
-    if pack_expected {
-        stdin
-            .read_to_end(&mut body)
-            .context("reading receive-pack pack")?;
-    }
-    Ok(body)
-}
-
 /// POST one self-contained stateless-RPC request body and stream the response to
 /// `stdout`. Signs the request when `signing_key` is present, so every round of a
 /// private-repo fetch carries the caller's signature (the node visibility-gates
@@ -2118,184 +2017,6 @@ mod tests {
         assert!(help.ends_with('\n'));
     }
 
-    // ── #369 delete-only push deadlock ───────────────────────────────────────
-
-    /// A delete-only receive-pack request ends at the command flush; git then
-    /// holds the write pipe open for the report and sends no pack. A reader that
-    /// blocks after the command list reproduces the hang that a Cursor (EOF)
-    /// hides. The read must return at the flush, inside the timeout.
-    #[test]
-    fn delete_only_receive_pack_request_returns_at_command_flush() {
-        let old = "a".repeat(40);
-        let zero = "0".repeat(40);
-        let mut seed = Vec::new();
-        seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
-        seed.extend_from_slice(b"0000"); // command-list flush; git then blocks
-
-        let (tx, rx) = std::sync::mpsc::channel::<()>();
-        let mut reader = BlockAfterSeed {
-            seed: io::Cursor::new(seed),
-            gate: rx,
-        };
-
-        let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
-        let handle = std::thread::spawn(move || {
-            let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
-        });
-
-        let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
-        let _ = tx.send(()); // unblock the reader so the thread can exit
-        let _ = handle.join();
-
-        let body = got.expect(
-            "read_receive_pack_request blocked past the command flush waiting for \
-             a pack a delete-only push never sends (#369)",
-        );
-        assert!(
-            body.ends_with(b"0000"),
-            "the request body keeps the command list and its flush terminator"
-        );
-    }
-
-    /// A push carrying objects still reads the pack through to EOF, and the
-    /// command flush sits between the commands and the pack in the body.
-    #[test]
-    fn receive_pack_request_with_pack_reads_through_eof() {
-        let old = "a".repeat(40);
-        let new = "b".repeat(40);
-        let mut stream = Vec::new();
-        stream.extend_from_slice(&pkt(&format!(
-            "{old} {new} refs/heads/main\0 report-status-v2\n"
-        )));
-        stream.extend_from_slice(b"0000");
-        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
-
-        let mut stdin = io::Cursor::new(stream);
-        let body = read_receive_pack_request(&mut stdin).unwrap();
-        let pos = body.windows(4).position(|w| w == b"0000").unwrap();
-        assert_eq!(
-            &body[pos + 4..],
-            b"PACK\x00\x00\x00\x02fakepack",
-            "a non-zero new-oid means the pack follows the flush"
-        );
-    }
-
-    /// A signed delete-only push sends NO command list: the request starts
-    /// with the "push-cert" line, the commands live inside the cert, and the
-    /// cert ends with a "push-cert-end" pkt-line (not a flush). The reader
-    /// must return after push-cert-end without waiting on the pipe.
-    #[test]
-    fn signed_delete_only_push_returns_after_push_cert_end() {
-        let old = "a".repeat(40);
-        let zero = "0".repeat(40);
-        let mut seed = Vec::new();
-        seed.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
-        seed.extend_from_slice(&pkt("certificate version 0.1\n"));
-        seed.extend_from_slice(&pkt("pusher did:key:z6Mk\n"));
-        seed.extend_from_slice(&pkt("\n")); // empty line ends the headers
-        seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
-        seed.extend_from_slice(&pkt("sig-line\n"));
-        seed.extend_from_slice(&pkt("push-cert-end\n"));
-        // git now blocks for the report; the pipe stays open.
-
-        let (tx, rx) = std::sync::mpsc::channel::<()>();
-        let mut reader = BlockAfterSeed {
-            seed: io::Cursor::new(seed),
-            gate: rx,
-        };
-
-        let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
-        let handle = std::thread::spawn(move || {
-            let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
-        });
-        let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
-        let _ = tx.send(());
-        let _ = handle.join();
-
-        let body = got.expect(
-            "read_receive_pack_request blocked past push-cert-end on a signed \
-             delete-only push (#369)",
-        );
-        assert!(
-            body.windows(6).any(|w| w == b"pusher"),
-            "the cert block is part of the request body"
-        );
-    }
-
-    /// A signed pack-bearing push: cert with the commands inside, then the
-    /// pack. Everything must land in the body.
-    #[test]
-    fn signed_pack_push_keeps_cert_and_pack() {
-        let old = "a".repeat(40);
-        let new = "b".repeat(40);
-        let mut stream = Vec::new();
-        stream.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
-        stream.extend_from_slice(&pkt("certificate version 0.1\n"));
-        stream.extend_from_slice(&pkt("\n"));
-        stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
-        stream.extend_from_slice(&pkt("push-cert-end\n"));
-        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
-
-        let mut stdin = io::Cursor::new(stream);
-        let body = read_receive_pack_request(&mut stdin).unwrap();
-        assert!(
-            body.windows(5).any(|w| w == b"PACK\x00"),
-            "the pack follows the cert into the body"
-        );
-    }
-
-    /// A negotiated push-options block is pkt-lines ending in its own flush.
-    /// With no cert it follows the command flush; with a cert it follows
-    /// push-cert-end.
-    #[test]
-    fn receive_pack_request_consumes_a_push_options_block() {
-        let old = "a".repeat(40);
-        let new = "b".repeat(40);
-        let mut stream = Vec::new();
-        stream.extend_from_slice(&pkt(&format!(
-            "{old} {new} refs/heads/main\0 report-status-v2 push-options\n"
-        )));
-        stream.extend_from_slice(b"0000"); // command flush
-        stream.extend_from_slice(&pkt("ci.skip\n"));
-        stream.extend_from_slice(b"0000"); // options flush
-        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
-
-        let mut stdin = io::Cursor::new(stream);
-        let body = read_receive_pack_request(&mut stdin).unwrap();
-        assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
-        assert!(
-            body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
-            "the pack lands after the options block"
-        );
-    }
-
-    /// Cert and options together: the cert comes first and the options block
-    /// sits between push-cert-end and the pack.
-    #[test]
-    fn signed_push_with_options_reads_cert_then_options_then_pack() {
-        let old = "a".repeat(40);
-        let new = "b".repeat(40);
-        let mut stream = Vec::new();
-        stream.extend_from_slice(&pkt(
-            "push-cert\0 report-status-v2 push-cert push-options\n",
-        ));
-        stream.extend_from_slice(&pkt("certificate version 0.1\n"));
-        stream.extend_from_slice(&pkt("\n"));
-        stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
-        stream.extend_from_slice(&pkt("push-cert-end\n"));
-        stream.extend_from_slice(&pkt("ci.skip\n"));
-        stream.extend_from_slice(b"0000"); // options flush
-        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
-
-        let mut stdin = io::Cursor::new(stream);
-        let body = read_receive_pack_request(&mut stdin).unwrap();
-        assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
-        assert!(
-            body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
-            "the pack lands after the options block"
-        );
-    }
-
     // ── #117 multi-round fetch negotiation ───────────────────────────────────
 
     /// Encode a git pkt-line: 4-byte hex length (incl. the 4 bytes) + data.

crates/git-remote-gitlawb/tests/real_git_fetch.rs

@@ -95,36 +95,6 @@ fn upload_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
     out.stdout
 }
 
-/// Run `git receive-pack --stateless-rpc [--advertise-refs] <repo>`, optionally
-/// feeding `input` on stdin. Returns raw stdout (the wire bytes). The receive
-/// half of `upload_pack`, used so the shim can serve a real push.
-fn receive_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
-    let mut cmd = Command::new("git");
-    cmd.arg("receive-pack").arg("--stateless-rpc");
-    if advertise {
-        cmd.arg("--advertise-refs");
-    }
-    cmd.arg(repo)
-        .stdin(Stdio::piped())
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-    let mut child = cmd.spawn().expect("spawn git receive-pack");
-    let mut stdin = child.stdin.take().unwrap();
-    let input = input.to_vec();
-    let writer = std::thread::spawn(move || {
-        let _ = stdin.write_all(&input);
-        // drop closes stdin
-    });
-    let out = child.wait_with_output().expect("wait receive-pack");
-    writer.join().ok();
-    assert!(
-        out.status.success(),
-        "git receive-pack failed: {}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    out.stdout
-}
-
 #[derive(Clone, Copy)]
 enum ShimMode {
     /// Faithful v0 serving: pipe each POST to `git upload-pack --stateless-rpc`.
@@ -248,21 +218,7 @@ fn handle_conn(stream: TcpStream, repo: &Path, mode: ShimMode, posts: &AtomicUsi
         reader.read_exact(&mut body).ok();
     }
 
-    let (content_type, payload) = if method == "GET" && target.contains("service=git-receive-pack")
-    {
-        // Receive-pack advertisement, same wrapper shape as upload-pack.
-        let adv = receive_pack(repo, true, b"");
-        let mut wrapped = pkt(b"# service=git-receive-pack\n");
-        wrapped.extend_from_slice(b"0000");
-        wrapped.extend_from_slice(&adv);
-        ("application/x-git-receive-pack-advertisement", wrapped)
-    } else if method == "POST" && target.ends_with("/git-receive-pack") {
-        posts.fetch_add(1, Ordering::SeqCst);
-        (
-            "application/x-git-receive-pack-result",
-            receive_pack(repo, false, &body),
-        )
-    } else if method == "GET" && target.contains("/info/refs") {
+    let (content_type, payload) = if method == "GET" && target.contains("/info/refs") {
         // v0 advertisement, wrapped exactly as the node's info_refs does.
         let adv = upload_pack(repo, true, b"");
         let mut wrapped = pkt(b"# service=git-upload-pack\n");
@@ -337,34 +293,6 @@ fn fetch_with_helper(clone: &Path, node_url: &str) -> (bool, std::process::Outpu
     run_bounded(cmd, Duration::from_secs(30))
 }
 
-/// Run `git push` in `local` through the helper, same wiring and hard timeout as
-/// [`fetch_with_helper`]. `args` carries the push spec, e.g.
-/// `["--delete", "doomed"]`.
-fn push_with_helper(local: &Path, node_url: &str, args: &[&str]) -> (bool, std::process::Output) {
-    let helper_bin = PathBuf::from(env!("CARGO_BIN_EXE_git-remote-gitlawb"));
-    let helper_dir = helper_bin.parent().unwrap().to_path_buf();
-    let path_env = match std::env::var_os("PATH") {
-        Some(p) => {
-            let mut dirs = vec![helper_dir.clone()];
-            dirs.extend(std::env::split_paths(&p));
-            std::env::join_paths(dirs).unwrap()
-        }
-        None => helper_dir.clone().into_os_string(),
-    };
-
-    let mut cmd = Command::new("git");
-    cmd.arg("-C")
-        .arg(local)
-        .arg("push")
-        .arg("origin")
-        .args(args)
-        .env("PATH", path_env)
-        .env("LC_ALL", "C")
-        .env("GITLAWB_NODE", node_url)
-        .env("GITLAWB_KEY", "/nonexistent-key-for-anon-push");
-    run_bounded(cmd, Duration::from_secs(30))
-}
-
 /// A synthetic non-success `ExitStatus` used only on the unix timeout path, where
 /// `reap_group` has already consumed the child and the later `wait` returns ECHILD.
 /// The timeout branch already reports `completed == false`, so the exact status is
@@ -1314,77 +1242,3 @@ fn run_bounded_bounds_join_when_leader_exits_leaving_a_pipe_holder() {
          held pipes do not stall the joins)"
     );
 }
-
-/// #369 end-to-end: a real `git push --delete` through the helper completes.
-/// The receive-pack request for a delete-only push is commands + flush with NO
-/// pack, and git holds its write pipe open for the report — so a helper that
-/// reads stdin to EOF deadlocks against it. The shim pipes the POST to a real
-/// `git receive-pack --stateless-rpc`, so the branch actually has to be deleted
-/// server-side for the assertions to pass.
-#[test]
-fn real_git_push_delete_completes() {
-    let dir = tempfile::tempdir().unwrap();
-    let server = dir.path().join("server.git");
-    let local = dir.path().join("local");
-
-    // A bare repo holding the doomed branch, plus a live one.
-    git(
-        dir.path(),
-        &[
-            "init",
-            "--bare",
-            server.to_str().unwrap(),
-            "--initial-branch=main",
-        ],
-    );
-    let work = dir.path().join("work");
-    git(
-        dir.path(),
-        &["init", work.to_str().unwrap(), "--initial-branch=main"],
-    );
-    git(&work, &["config", "user.email", "t@t"]);
-    git(&work, &["config", "user.name", "t"]);
-    std::fs::write(work.join("f"), "x").unwrap();
-    git(&work, &["add", "f"]);
-    git(&work, &["commit", "-m", "c"]);
-    git(&work, &["branch", "doomed"]);
-    git(&work, &["push", server.to_str().unwrap(), "main", "doomed"]);
-
-    // The pusher: a local repo whose origin is the gitlawb remote pointing at
-    // the shim. Nothing needs to be fetched first; git takes the old-oid from
-    // the receive-pack advertisement.
-    git(
-        dir.path(),
-        &["init", local.to_str().unwrap(), "--initial-branch=main"],
-    );
-    git(
-        &local,
-        &["remote", "add", "origin", "gitlawb://did:key:z6MkTest/repo"],
-    );
-
-    let shim = start_shim(server.clone(), ShimMode::Normal);
-    let (completed, out) = push_with_helper(&local, &shim.base_url, &["--delete", "doomed"]);
-    let posts = shim.posts.load(Ordering::SeqCst);
-
-    assert!(
-        completed,
-        "git push --delete did not complete within the timeout (deadlock signature). stderr:\n{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    assert!(
-        out.status.success(),
-        "git push --delete failed. stderr:\n{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    assert_eq!(posts, 1, "a delete-only push is exactly one POST");
-    let gone = Command::new("git")
-        .arg("-C")
-        .arg(&server)
-        .args(["rev-parse", "--verify", "--quiet", "refs/heads/doomed"])
-        .output()
-        .unwrap();
-    assert!(
-        !gone.status.success(),
-        "refs/heads/doomed must be deleted in the server repo"
-    );
-}

crates/gitlawb-attest/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gitlawb-attest"
-description = "External Attestation v1: pluggable provenance attachments for Twigpine ref-update certs"
+description = "External Attestation v1: pluggable provenance attachments for gitlawb ref-update certs"
 version = "0.7.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true

crates/gitlawb-attest/src/attestation.rs

@@ -105,30 +105,16 @@ impl Attestation {
         let bytes = canonical_signing_bytes(&self.type_, &self.payload, &self.cert_hash)?;
 
         let vk = verifying_key_from_did_key(&self.signer)?;
-        self.verify_sig_with_key(&vk, &bytes)?;
-
-        Ok(vk)
-    }
-
-    /// The signature check itself, against a key the caller supplies.
-    ///
-    /// Split out so the STRICTNESS of the check stays provable on its own.
-    /// `verifying_key_from_did_key` now refuses a small-order key, so a weak
-    /// signer can no longer reach this line through `verify_signature`. Without
-    /// this seam there would be nothing left that fails when `verify_strict` is
-    /// downgraded to the non-strict `verify`, and that regression would land
-    /// silently. Check order in `verify_signature` is unchanged.
-    fn verify_sig_with_key(&self, vk: &VerifyingKey, bytes: &[u8]) -> Result<()> {
         let sig_bytes: [u8; 64] = B64U
             .decode(&self.sig)
             .map_err(|e| Error::Signature(format!("base64url: {e}")))?
             .try_into()
             .map_err(|_| Error::Signature("signature must be 64 bytes".to_string()))?;
         let sig = Signature::from_bytes(&sig_bytes);
-        vk.verify_strict(bytes, &sig)
+        vk.verify_strict(&bytes, &sig)
             .map_err(|e| Error::Signature(format!("ed25519: {e}")))?;
 
-        Ok(())
+        Ok(vk)
     }
 
     /// Reparse `payload` as `P`. Errors if the type discriminator does not
@@ -195,7 +181,7 @@ fn canonical_signing_bytes(
     Ok(out)
 }
 
-pub(crate) fn did_key_from_verifying_key(key: &VerifyingKey) -> String {
+fn did_key_from_verifying_key(key: &VerifyingKey) -> String {
     let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
     buf.extend_from_slice(&ED25519_MULTICODEC);
     buf.extend_from_slice(&key.to_bytes());
@@ -216,19 +202,6 @@ fn verifying_key_from_did_key(did: &str) -> Result<VerifyingKey> {
             "did:key must use base58btc (z-prefix): {did}"
         )));
     }
-    // Refuse an oversized id before decoding. base58 decoding is quadratic in
-    // its input and `signer` comes off an attacker-supplied attestation, so a
-    // short request could otherwise buy a large decode. An ed25519 did:key
-    // method-id is a fixed 48 characters, so this bound is slack rather than a
-    // behavior change, and it only helps ahead of the decode. Mirrors the same
-    // cap in gitlawb-core's Did::to_verifying_key, which this crate cannot call
-    // (gitlawb-core is a dev-dependency here).
-    const MAX_METHOD_ID_LEN: usize = 64;
-    if method_id.len() > MAX_METHOD_ID_LEN {
-        return Err(Error::Did(
-            "did:key method-specific id too long".to_string(),
-        ));
-    }
     let (base, bytes) =
         multibase::decode(method_id).map_err(|e| Error::Did(format!("multibase: {e}")))?;
     if base != multibase::Base::Base58Btc {
@@ -244,20 +217,8 @@ fn verifying_key_from_did_key(did: &str) -> Result<VerifyingKey> {
     let key_bytes: [u8; 32] = bytes[ED25519_MULTICODEC.len()..]
         .try_into()
         .expect("length checked above");
-    let key = VerifyingKey::from_bytes(&key_bytes)
-        .map_err(|e| Error::Did(format!("invalid ed25519 key: {e}")))?;
-
-    // `from_bytes` only decompresses, so it accepts a small-order point. This
-    // crate parses did:key itself rather than going through gitlawb-core's
-    // `Did`, and it cannot go through it (gitlawb-core is a dev-dependency
-    // here), so the rejection is mirrored rather than inherited. Signature
-    // verification is already strict, so this is defense in depth against a
-    // future consumer of this parser that does not verify strictly.
-    if key.is_weak() {
-        return Err(Error::Did("small-order ed25519 key".to_string()));
-    }
-
-    Ok(key)
+    VerifyingKey::from_bytes(&key_bytes)
+        .map_err(|e| Error::Did(format!("invalid ed25519 key: {e}")))
 }
 
 #[cfg(test)]
@@ -504,23 +465,6 @@ mod tests {
         assert!(matches!(err, Error::Did(_)));
     }
 
-    #[test]
-    fn verify_rejects_oversized_method_id_before_decoding() {
-        let sk = fresh();
-        let mut att = dummy_attestation(&sk, sample_cert_hash());
-        // A well-formed prefix on an absurdly long id must fail the length
-        // bound, not the decoder: base58 decode cost is quadratic in input
-        // length, so reaching it at all is the defect.
-        att.signer = format!("did:key:z{}", "1".repeat(256));
-        let err = att.verify_signature(sample_cert_hash()).unwrap_err();
-        // Match the bound's own message: any other Did error (a decode or
-        // length mismatch downstream) means the oversized input was decoded.
-        match err {
-            Error::Did(m) => assert!(m.contains("too long"), "unexpected: {m}"),
-            e => panic!("expected Error::Did, got {e:?}"),
-        }
-    }
-
     #[test]
     fn verify_rejects_bad_signature_base64() {
         let sk = fresh();
@@ -615,111 +559,6 @@ mod tests {
     /// weak (small-order) public key satisfies the verification equation
     /// but must be rejected. The identity point is such a key: with R the
     /// identity and S = 0, [S]B - [k]A is the identity for any message.
-    /// gitlawb-attest parses did:key itself and never routes through
-    /// gitlawb-core's `Did`, which it cannot: gitlawb-core is a dev-dependency
-    /// here. So the choke-point rejection has to be mirrored in this parser or
-    /// this crate keeps handing out keys the rest of the system rejects.
-    #[test]
-    fn verifying_key_from_did_key_rejects_a_small_order_key() {
-        let mut weak = [0u8; 32];
-        weak[0] = 1; // compressed identity point
-        let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
-        buf.extend_from_slice(&ED25519_MULTICODEC);
-        buf.extend_from_slice(&weak);
-        let did = format!(
-            "did:key:{}",
-            multibase::encode(multibase::Base::Base58Btc, &buf)
-        );
-
-        let err =
-            verifying_key_from_did_key(&did).expect_err("a small-order did:key must not resolve");
-        match err {
-            Error::Did(msg) => assert!(
-                msg.contains("small-order"),
-                "rejection must name the small-order key, got: {msg}"
-            ),
-            other => panic!("expected Error::Did, got {other:?}"),
-        }
-    }
-
-    /// base58 decoding is quadratic in its input and `signer` is attacker
-    /// controlled, so an oversized method-id must be refused BEFORE the decode
-    /// or a hostile attestation buys a large decode for a short request. The
-    /// assertion is on the length error specifically: a multibase error here
-    /// would mean the cap ran too late to matter.
-    #[test]
-    fn verifying_key_from_did_key_refuses_an_oversized_method_id_before_decoding() {
-        let oversized = format!("did:key:z{}", "1".repeat(65_536));
-        let err = verifying_key_from_did_key(&oversized)
-            .expect_err("an oversized method-id must be refused");
-        match err {
-            Error::Did(msg) => assert!(
-                msg.contains("too long"),
-                "must fail on the length cap, not after decoding: {msg}"
-            ),
-            other => panic!("expected Error::Did, got {other:?}"),
-        }
-    }
-
-    /// Strictness regression guard. The parser now refuses a small-order key,
-    /// so `verify_signature` can no longer carry a weak signer down to the
-    /// signature check; this drives that check directly to prove it is still
-    /// STRICT. Downgrading `verify_strict` to `verify` makes this go red,
-    /// which nothing else in the suite would catch.
-    #[test]
-    fn verify_sig_with_key_is_strict_about_a_weak_key() {
-        let mut weak_key_bytes = [0u8; 32];
-        weak_key_bytes[0] = 1; // compressed identity point
-        let weak_vk = VerifyingKey::from_bytes(&weak_key_bytes).unwrap();
-        assert!(weak_vk.is_weak());
-
-        let cert_hash = sample_cert_hash();
-        let mut att = dummy_attestation(&SigningKey::generate(&mut OsRng), cert_hash);
-        // R = identity, S = 0: satisfies the non-strict verification equation
-        // for any message under a small-order key.
-        let mut forged = [0u8; 64];
-        forged[0] = 1;
-        att.sig = B64U.encode(forged);
-
-        let bytes = canonical_signing_bytes(&att.type_, &att.payload, &att.cert_hash).expect("jcs");
-        let err = att
-            .verify_sig_with_key(&weak_vk, &bytes)
-            .expect_err("strict verification must reject a small-order key");
-        assert!(
-            matches!(err, Error::Signature(_)),
-            "expected a signature error, got {err:?}"
-        );
-    }
-
-    /// Accept control for the seam: a genuine signature still verifies through
-    /// the same helper, so the guard above is not simply rejecting everything.
-    #[test]
-    fn verify_sig_with_key_accepts_a_genuine_signature() {
-        let cert_hash = sample_cert_hash();
-        let sk = SigningKey::generate(&mut OsRng);
-        let att = dummy_attestation(&sk, cert_hash);
-        let bytes = canonical_signing_bytes(&att.type_, &att.payload, &att.cert_hash).expect("jcs");
-        att.verify_sig_with_key(&sk.verifying_key(), &bytes)
-            .expect("a real signature must verify");
-    }
-
-    /// Control for the guard above: a real did:key must still resolve.
-    #[test]
-    fn verifying_key_from_did_key_still_accepts_a_real_key() {
-        let sk = SigningKey::from_bytes(&[3u8; 32]);
-        let vk = sk.verifying_key();
-        let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
-        buf.extend_from_slice(&ED25519_MULTICODEC);
-        buf.extend_from_slice(&vk.to_bytes());
-        let did = format!(
-            "did:key:{}",
-            multibase::encode(multibase::Base::Base58Btc, &buf)
-        );
-
-        let got = verifying_key_from_did_key(&did).expect("a real did:key must resolve");
-        assert_eq!(got.to_bytes(), vk.to_bytes());
-    }
-
     #[test]
     fn verify_rejects_weak_key_signature() {
         let mut weak_key_bytes = [0u8; 32];
@@ -733,13 +572,7 @@ mod tests {
         let forged_sig = B64U.encode(forged);
 
         // Build an attestation with the weak key as signer and the forged
-        // signature. Rejection now happens at DID RESOLUTION rather than at
-        // verify time: `verifying_key_from_did_key` refuses a small-order key
-        // before `verify_strict` is reached, so the observed error is
-        // `Error::Did`, not `Error::Signature`. `verify_strict` remains the
-        // second layer for malleability cases that do not involve a weak
-        // public key (a small-order R under an honest key), which this fixture
-        // cannot construct and therefore no longer covers.
+        // signature. The weak-key check happens at verify time.
         let mut att = dummy_attestation(&SigningKey::generate(&mut OsRng), cert_hash);
         let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
         buf.extend_from_slice(&ED25519_MULTICODEC);
@@ -751,12 +584,9 @@ mod tests {
         att.sig = forged_sig;
 
         let err = att.verify_signature(cert_hash).unwrap_err();
-        match err {
-            Error::Did(msg) => assert!(
-                msg.contains("small-order"),
-                "weak signer must be refused as a small-order key, got: {msg}"
-            ),
-            other => panic!("expected Error::Did for a small-order signer, got {other:?}"),
-        }
+        assert!(
+            matches!(err, Error::Signature(_)),
+            "signature under a weak (small-order) public key must be rejected"
+        );
     }
 }

crates/gitlawb-attest/src/lib.rs

@@ -1,4 +1,4 @@
-//! Pluggable provenance attachments for Twigpine ref-update certs.
+//! Pluggable provenance attachments for gitlawb ref-update certs.
 //!
 //! A `gitlawb/ref-update/v1` cert proves who pushed and where a ref moved to.
 //! It does not say how the commit was produced. This crate adds an optional

crates/gitlawb-attest/src/verifier.rs

@@ -121,12 +121,7 @@ impl Registry {
         attestation: &Attestation,
         expected_cert_hash: [u8; 32],
     ) -> Result<VerifiedAttestation> {
-        // The key that actually verified is the trust anchor for the signer a
-        // consumer sees. `verify_signature` recovers it from the artifact's
-        // `signer` field and rejects a field that does not match the signing
-        // key, so this is the canonical DID of the key that signed — never a
-        // raw artifact string that could disagree with it.
-        let verified_key = attestation.verify_signature(expected_cert_hash)?;
+        attestation.verify_signature(expected_cert_hash)?;
 
         let fully = match self.by_type.get(attestation.type_.as_str()) {
             Some(v) => {
@@ -143,55 +138,30 @@ impl Registry {
 
         Ok(VerifiedAttestation {
             type_: attestation.type_.clone(),
-            signer: crate::attestation::did_key_from_verifying_key(&verified_key),
+            signer: attestation.signer.clone(),
             cert_hash: attestation.cert_hash.clone(),
             fully_verified: fully,
         })
     }
 
     /// Verify a batch, then enforce `RequireAll`.
-    ///
-    /// Under [`Policy::RequireAll`] this never short-circuits: an attestation
-    /// that fails to verify — bad signature, cert-hash mismatch, or malformed
-    /// payload, the actual `Err` paths of [`Registry::verify`] — is dropped
-    /// from the result rather than aborting the batch. A valid attestation of
-    /// a type with NO registered verifier is not one of those: under
-    /// `RequireAll` it verifies to `Ok` with `fully_verified: false` and stays
-    /// in the result, preserving the distinction between *untrusted* and
-    /// *invalid* (see `require_all_is_lenient_on_unknown_types_in_the_batch`).
-    /// Any third party can attach an attestation, so a hard error here would
-    /// let an unrelated `attacker/spam/v1` deny-of-service the whole cert (the
-    /// DoS vector the module docstring warns about). The `required_types`
-    /// check below is the real gate, and it only counts `fully_verified`
-    /// entries — so a required type represented solely by a malformed
-    /// attestation still fails with [`Error::RequiredMissing`].
-    ///
-    /// Under `AcceptKnown` and `RejectUnknown` the batch stays strict: the
-    /// first verification error is surfaced to the caller.
     pub fn verify_all(
         &self,
         attestations: &[Attestation],
         expected_cert_hash: [u8; 32],
     ) -> Result<Vec<VerifiedAttestation>> {
-        if self.policy != Policy::RequireAll {
-            let mut verified = Vec::with_capacity(attestations.len());
-            for a in attestations {
-                verified.push(self.verify(a, expected_cert_hash)?);
-            }
-            return Ok(verified);
+        let mut verified = Vec::with_capacity(attestations.len());
+        for a in attestations {
+            verified.push(self.verify(a, expected_cert_hash)?);
         }
-
-        // RequireAll: drop entries that fail to verify instead of aborting.
-        let verified: Vec<VerifiedAttestation> = attestations
-            .iter()
-            .filter_map(|a| self.verify(a, expected_cert_hash).ok())
-            .collect();
-        for required in &self.required_types {
-            let present = verified
-                .iter()
-                .any(|v| &v.type_ == required && v.fully_verified);
-            if !present {
-                return Err(Error::RequiredMissing(required.clone()));
+        if self.policy == Policy::RequireAll {
+            for required in &self.required_types {
+                let present = verified
+                    .iter()
+                    .any(|v| &v.type_ == required && v.fully_verified);
+                if !present {
+                    return Err(Error::RequiredMissing(required.clone()));
+                }
             }
         }
         Ok(verified)
@@ -201,7 +171,7 @@ impl Registry {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::attestation::{did_key_from_verifying_key, Attestation, AttestationPayload};
+    use crate::attestation::{Attestation, AttestationPayload};
     use ed25519_dalek::SigningKey;
     use rand::rngs::OsRng;
     use serde::{Deserialize, Serialize};
@@ -349,38 +319,6 @@ mod tests {
             .any(|v| v.type_ == "other/v1" && !v.fully_verified));
     }
 
-    /// The strict policies must surface a batch member's verification error
-    /// through `verify_all`, not launder it into a partial result. This binds
-    /// the POLICY BOUNDARY itself: only the `RequireAll` arm may drop failing
-    /// entries, and an apparently harmless cleanup that applies its
-    /// `filter_map(Result::ok)` shape to the strict arms would silently turn
-    /// the fail-closed contracts into fail-open — with every per-attestation
-    /// `verify` test still green, because none of them go through the batch
-    /// path. The failing entry is a wrong-cert-hash attestation (signed over a
-    /// different hash than the batch expects), a genuine `Err` under every
-    /// policy.
-    #[test]
-    fn strict_policies_propagate_a_batch_members_error() {
-        let sk = fresh();
-        let cert_hash = sample_hash();
-        let mut wrong_hash = sample_hash();
-        wrong_hash[0] ^= 0xff;
-
-        for policy in [Policy::AcceptKnown, Policy::RejectUnknown] {
-            let mut reg = Registry::new().with_policy(policy);
-            reg.register(DemoVerifier);
-            let good = signed_demo(&sk, cert_hash, "ok");
-            let bad = signed_demo(&sk, wrong_hash, "ok");
-            let err = reg
-                .verify_all(&[good, bad], cert_hash)
-                .expect_err("a strict policy must fail the whole batch");
-            assert!(
-                matches!(err, Error::Signature(_) | Error::CertHashMismatch),
-                "expected the underlying verification error, got {err:?}"
-            );
-        }
-    }
-
     /// A required type that is present but unverified (no verifier registered
     /// even though the type appears in `required_types`) must fail
     /// `verify_all` with `RequiredMissing`. Catches a misconfiguration where
@@ -398,65 +336,6 @@ mod tests {
         assert!(matches!(err, Error::RequiredMissing(t) if t == "demo/v1"));
     }
 
-    /// A cert-hash that does not match `sample_hash()`, so an attestation
-    /// signed against it fails `verify_signature` when the batch is checked
-    /// against `sample_hash()`.
-    fn other_hash() -> [u8; 32] {
-        let mut h = sample_hash();
-        h[0] ^= 0xff;
-        h
-    }
-
-    /// Under `RequireAll`, a malformed attestation (here: signed against the
-    /// wrong cert hash, so it fails signature verification) attached alongside a
-    /// valid required one must not abort the batch. The junk is dropped and the
-    /// cert still verifies. Before the fix, `verify_all` propagated the error
-    /// via `?` and the whole batch failed — the DoS vector the docstring warns
-    /// about.
-    #[test]
-    fn require_all_drops_a_malformed_extra_and_still_accepts() {
-        let sk = fresh();
-        let cert_hash = sample_hash();
-        let mut reg = Registry::new()
-            .with_policy(Policy::RequireAll)
-            .require_types(["demo/v1"]);
-        reg.register(DemoVerifier);
-
-        // Signed against `other_hash()`, so it will not verify under `cert_hash`.
-        let malformed = signed_demo(&sk, other_hash(), "boom");
-        let real = signed_demo(&sk, cert_hash, "ok");
-
-        let verified = reg
-            .verify_all(&[malformed, real], cert_hash)
-            .expect("a malformed extra must not abort the batch under RequireAll");
-        assert_eq!(verified.len(), 1, "the malformed entry should be dropped");
-        assert!(verified
-            .iter()
-            .any(|v| v.type_ == "demo/v1" && v.fully_verified));
-    }
-
-    /// Leniency must not open a hole: if the *only* attestation of a required
-    /// type is malformed, dropping it leaves the required type absent and
-    /// `verify_all` must still fail with `RequiredMissing`. Guards against a fix
-    /// that skips errors so eagerly it lets an unverified required type pass.
-    #[test]
-    fn require_all_rejects_when_only_a_malformed_required_type_is_present() {
-        let sk = fresh();
-        let cert_hash = sample_hash();
-        let mut reg = Registry::new()
-            .with_policy(Policy::RequireAll)
-            .require_types(["demo/v1"]);
-        reg.register(DemoVerifier);
-
-        // The sole demo/v1 is bound to the wrong cert hash → fails verification.
-        let malformed_required = signed_demo(&sk, other_hash(), "ok");
-
-        let err = reg
-            .verify_all(&[malformed_required], cert_hash)
-            .unwrap_err();
-        assert!(matches!(err, Error::RequiredMissing(t) if t == "demo/v1"));
-    }
-
     #[test]
     fn payload_check_failure_rejects() {
         let sk = fresh();
@@ -495,52 +374,4 @@ mod tests {
         let err = reg.verify(&att, cert_hash).unwrap_err();
         assert!(matches!(err, Error::Payload(_)));
     }
-
-    /// The signer a consumer sees must be the canonical DID of the key that
-    /// actually verified, never a raw artifact string that could disagree.
-    /// `verify_signature` derives the key from the artifact's `signer` field
-    /// and the parser is canonical (base58btc, exact length, ed25519
-    /// multicodec), so a forged field fails verification outright: the
-    /// must-not here is that no `VerifiedAttestation` ever carries a signer
-    /// that did not verify.
-    #[test]
-    fn verified_signer_is_anchored_to_the_key_that_verified() {
-        let signer = fresh();
-        let other = fresh();
-        assert_ne!(
-            signer.verifying_key().to_bytes(),
-            other.verifying_key().to_bytes(),
-            "fixture precondition: distinct signing keys"
-        );
-
-        let cert_hash = sample_hash();
-        let reg = Registry::new();
-
-        // Control: an honest artifact reports the signer's canonical DID, and
-        // it agrees with the artifact field.
-        let att = signed_demo(&signer, cert_hash, "ok");
-        let v = reg.verify(&att, cert_hash).unwrap();
-        let expected = did_key_from_verifying_key(&signer.verifying_key());
-        assert_eq!(v.signer, expected, "signer must be the verified key's DID");
-        assert_eq!(v.signer, att.signer, "honest artifact: field and key agree");
-
-        // Must-not, both directions: a signer field naming a DIFFERENT key
-        // than the one that signed must fail verification, so the artifact
-        // string can never redirect the reported signer.
-        let mut forged = signed_demo(&signer, cert_hash, "ok");
-        forged.signer = did_key_from_verifying_key(&other.verifying_key());
-        let err = reg.verify(&forged, cert_hash).unwrap_err();
-        assert!(
-            matches!(err, Error::Signature(_)),
-            "a signer field that does not match the signing key must fail, got {err:?}"
-        );
-
-        let mut forged_rev = signed_demo(&other, cert_hash, "ok");
-        forged_rev.signer = did_key_from_verifying_key(&signer.verifying_key());
-        let err_rev = reg.verify(&forged_rev, cert_hash).unwrap_err();
-        assert!(
-            matches!(err_rev, Error::Signature(_)),
-            "mismatched signer field must fail verification, got {err_rev:?}"
-        );
-    }
 }

crates/gitlawb-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gitlawb-core"
-description = "Core cryptographic primitives for the Twigpine network: DIDs, CIDs, UCAN, HTTP Signatures, ref-update certificates"
+description = "Core cryptographic primitives for the gitlawb network: DIDs, CIDs, UCAN, HTTP Signatures, ref-update certificates"
 version = "0.7.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true

crates/gitlawb-core/src/did.rs

@@ -1,11 +1,11 @@
-//! Decentralized Identifier (DID) types for the Twigpine network.
+//! Decentralized Identifier (DID) types for the gitlawb network.
 //!
 //! Supported methods:
 //!   - `did:key`      — ephemeral, derived directly from an Ed25519 public key
 //!   - `did:web`      — anchored to a domain
 //!   - `did:gitlawb`  — native, anchored to the libp2p DHT
 //!
-//! The canonical DID for a Twigpine actor is `did:key` during bootstrap
+//! The canonical DID for a gitlawb actor is `did:key` during bootstrap
 //! and migrates to `did:gitlawb` once DHT anchoring is live.
 
 use ed25519_dalek::VerifyingKey;
@@ -71,8 +71,7 @@ impl Did {
 
     /// Resolve the Ed25519 verifying key from a `did:key`.
     ///
-    /// Returns `Err` if the DID is not a `did:key`, the key bytes are malformed,
-    /// or the key is a small-order (weak) point.
+    /// Returns `Err` if the DID is not a `did:key` or the key bytes are invalid.
     pub fn to_verifying_key(&self) -> Result<VerifyingKey> {
         if !self.is_did_key() {
             return Err(Error::InvalidDid(format!(
@@ -107,25 +106,7 @@ impl Did {
             .try_into()
             .map_err(|_| Error::InvalidDid("ed25519 key must be 32 bytes".to_string()))?;
 
-        let key =
-            VerifyingKey::from_bytes(&key_bytes).map_err(|e| Error::InvalidDid(e.to_string()))?;
-
-        // `from_bytes` only decompresses, so it accepts a small-order point.
-        // Such a key satisfies the verification equation for any message, and
-        // every X25519 shared secret derived from it is the all-zero key: the
-        // order-1 and order-2 points convert to the all-zero Montgomery u
-        // directly, and the order-4 and order-8 points are annihilated by the
-        // scalar clamping instead. `is_weak` covers the whole torsion set.
-        // Mixed-order points are correctly NOT rejected, since clamping clears
-        // the cofactor component. Rejecting
-        // at resolution is what makes this the choke point: every consumer that
-        // resolves a DID through here inherits the rejection, and a recipient
-        // that cannot resolve already fails closed downstream.
-        if key.is_weak() {
-            return Err(Error::InvalidDid("small-order ed25519 key".to_string()));
-        }
-
-        Ok(key)
+        VerifyingKey::from_bytes(&key_bytes).map_err(|e| Error::InvalidDid(e.to_string()))
     }
 
     /// Return the full DID string as a `&str`.
@@ -171,7 +152,7 @@ impl From<Did> for String {
     }
 }
 
-/// A DID Document for a Twigpine actor.
+/// A DID Document for a gitlawb actor.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct DidDocument {
     #[serde(rename = "@context")]
@@ -388,36 +369,4 @@ mod tests {
         );
         did.to_verifying_key().expect("a real did:key must resolve");
     }
-
-    /// A `did:key` can encode a small-order (weak) Ed25519 point. Such a key
-    /// satisfies the verification equation for any message and, converted to
-    /// Montgomery form for X25519, yields the all-zero shared secret, so an
-    /// envelope sealed to it is decryptable by anyone. Resolution is the choke
-    /// point every `Did`-based consumer shares, so it fails closed here.
-    #[test]
-    fn to_verifying_key_rejects_a_small_order_key() {
-        // The compressed identity point, the canonical small-order key.
-        let mut weak = [0u8; 32];
-        weak[0] = 1;
-        let mut prefixed = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
-        prefixed.extend_from_slice(ED25519_MULTICODEC);
-        prefixed.extend_from_slice(&weak);
-        let did: Did = format!(
-            "did:key:{}",
-            multibase::encode(multibase::Base::Base58Btc, &prefixed)
-        )
-        .parse()
-        .expect("a small-order did:key is still well-formed");
-
-        let err = did
-            .to_verifying_key()
-            .expect_err("a small-order did:key must not resolve");
-        match err {
-            Error::InvalidDid(msg) => assert!(
-                msg.contains("small-order"),
-                "rejection must name the small-order key, got: {msg}"
-            ),
-            other => panic!("expected Error::InvalidDid, got {other:?}"),
-        }
-    }
 }

crates/gitlawb-core/src/encrypt.rs

@@ -11,22 +11,6 @@ use zeroize::Zeroizing;
 /// X25519 public key (Montgomery u) for an Ed25519 verifying key.
 fn x25519_public(vk: &VerifyingKey) -> Result<[u8; 32]> {
     use curve25519_dalek::edwards::CompressedEdwardsY;
-
-    // Every X25519 shared secret derived from a small-order point is the
-    // all-zero key: order-1 and order-2 convert to the all-zero Montgomery u
-    // directly, order-4 and order-8 are annihilated by the scalar clamping in
-    // x25519_secret_from_seed. Either way the per-recipient wrap could be
-    // rebuilt by anyone. Resolution already refuses such a key (see
-    // Did::to_verifying_key); this guard covers the SEAL side on its own terms
-    // for a caller that obtained the key some other way. The open side
-    // (open_blob's attacker-supplied `eph`) skips any entry whose exchange with
-    // this reader yields the all-zero shared secret
-    // (`yields_all_zero_shared_secret`), regardless of whether the bytes decode
-    // to an Edwards point.
-    if vk.is_weak() {
-        return Err(anyhow::anyhow!("verifying key is a small-order point"));
-    }
-
     let edwards = CompressedEdwardsY::from_slice(vk.as_bytes())
         .ok()
         .and_then(|c| c.decompress())
@@ -34,26 +18,6 @@ fn x25519_public(vk: &VerifyingKey) -> Result<[u8; 32]> {
     Ok(edwards.to_montgomery().to_bytes())
 }
 
-/// True when the X25519 exchange between an attacker-supplied `u` and this
-/// reader's scalar yields the all-zero shared secret.
-///
-/// Asked of the RESULT, not of the encoding, and that distinction is the whole
-/// guard. The previous version decompressed `u` to an Edwards point and asked
-/// `is_small_order`, which reports "safe" for any low-order encoding that does
-/// not decompress at all. Measured across the seven standard low-order
-/// encodings, six were caught and `u = p - 1` was not: it fails to decompress,
-/// so the check returned false, and the exchange is still the all-zero secret.
-/// An entry built on it unwraps for every reader.
-///
-/// Enumerating encodings cannot be exhaustive, because the attack depends on the
-/// shared secret rather than on the bytes that produced it, and twist and
-/// non-canonical inputs keep arriving. Asking the result needs no list.
-fn yields_all_zero_shared_secret(u: &[u8; 32], scalar: &[u8; 32]) -> bool {
-    use curve25519_dalek::montgomery::MontgomeryPoint;
-
-    MontgomeryPoint(*u).mul_clamped(*scalar).to_bytes() == [0u8; 32]
-}
-
 /// X25519 secret scalar for an Ed25519 seed (SHA-512 of seed, lower 32, clamped).
 /// Returns the scalar wrapped in `Zeroizing`, and scrubs the intermediate
 /// SHA-512 digest, so no copy of this secret material lingers in freed memory.
@@ -85,13 +49,6 @@ use serde::{Deserialize, Serialize};
 const MAGIC: &[u8] = b"GLENC";
 const VERSION: u8 = 2;
 
-/// Upper bound on the blinded recipient list. The envelope author controls
-/// this count and `open_blob` pays one X25519 exchange per entry before it can
-/// answer "not a recipient", so the count has to be capped rather than
-/// optimized (#419). Legitimate envelopes carry a handful of authorized
-/// readers, so 256 is far above real use.
-const MAX_RECIPIENTS: usize = 256;
-
 #[derive(Serialize, Deserialize)]
 struct Recipient {
     eph: String,   // base64 ephemeral x25519 pubkey (32B)
@@ -111,14 +68,6 @@ pub fn seal_blob(plaintext: &[u8], recipients: &[VerifyingKey]) -> Result<Vec<u8
     if recipients.is_empty() {
         return Err(anyhow::anyhow!("seal_blob: no recipients"));
     }
-    // Same bound open_blob enforces: an envelope over the cap could never be
-    // opened, so refuse to seal it (#419).
-    if recipients.len() > MAX_RECIPIENTS {
-        return Err(anyhow::anyhow!(
-            "seal_blob: {} recipients, over the {MAX_RECIPIENTS} cap",
-            recipients.len()
-        ));
-    }
     let mut content_key = [0u8; 32];
     OsRng.fill_bytes(&mut content_key);
     let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key)
@@ -177,20 +126,9 @@ pub fn open_blob(envelope: &[u8], keypair: &Keypair) -> Result<Vec<u8>> {
     let header: Header =
         serde_json::from_slice(envelope.get(p..p + hlen).context("truncated header")?)
             .context("decode header")?;
-    // Reject before the recipient scan: every entry below is an X25519
-    // exchange, and a non-recipient would run the whole list (#419).
-    if header.recipients.len() > MAX_RECIPIENTS {
-        return Err(anyhow::anyhow!(
-            "envelope carries {} recipients, over the {MAX_RECIPIENTS} cap",
-            header.recipients.len()
-        ));
-    }
     let body = &envelope[p + hlen..];
 
-    // The raw scalar is kept alongside the box secret so the exchange can be
-    // tested BEFORE a box is built from an attacker-supplied ephemeral.
-    let my_x_scalar = x25519_secret_from_seed(&keypair.to_seed());
-    let my_x = XSecret::from(*my_x_scalar);
+    let my_x = XSecret::from(*x25519_secret_from_seed(&keypair.to_seed()));
 
     // Identities are blinded: no entry says which recipient it belongs to, so
     // try each one. The ChaChaBox AEAD tag authenticates, so exactly the
@@ -202,12 +140,7 @@ pub fn open_blob(envelope: &[u8], keypair: &Keypair) -> Result<Vec<u8>> {
             .ok()
             .and_then(|b| <[u8; 32]>::try_from(b.as_slice()).ok())
         {
-            // An ephemeral whose exchange with this reader is the all-zero
-            // shared secret would unwrap for anyone, so the entry is skipped.
-            // Tested on the exchange itself: an encoding-shaped check misses
-            // every low-order input that does not decompress to Edwards.
-            Some(b) if !yields_all_zero_shared_secret(&b, &my_x_scalar) => XPublic::from(b),
-            Some(_) => continue,
+            Some(b) => XPublic::from(b),
             None => continue,
         };
         // from_slice panics on a wrong length, and the envelope is attacker
@@ -360,436 +293,4 @@ mod tests {
         header["nonce"] = bad_nonce;
         assert!(open_blob(&reframe(&header), &reader).is_err());
     }
-
-    #[test]
-    fn over_cap_recipient_list_is_rejected_before_the_scan() {
-        // #419: the envelope author controls the recipient count and each entry
-        // costs an X25519 exchange, so the list is capped. Reframe a valid
-        // envelope with MAX_RECIPIENTS + 1 junk entries.
-        let reader = Keypair::generate();
-        let env = seal_blob(b"private blob contents", &[reader.verifying_key()]).unwrap();
-
-        let mut p = MAGIC.len() + 1;
-        let hlen = u32::from_le_bytes(env[p..p + 4].try_into().unwrap()) as usize;
-        p += 4;
-        let header_bytes = &env[p..p + hlen];
-        let body = &env[p + hlen..];
-
-        let mut header: serde_json::Value = serde_json::from_slice(header_bytes).unwrap();
-        let junk = serde_json::json!({
-            "eph": B64.encode([0u8; 32]),
-            "nonce": B64.encode([0u8; 24]),
-            "wrap": B64.encode([0u8; 48]),
-        });
-        header["recipients"] = serde_json::Value::Array(vec![junk.clone(); MAX_RECIPIENTS + 1]);
-
-        let hj = serde_json::to_vec(&header).unwrap();
-        let mut fat = Vec::new();
-        fat.extend_from_slice(MAGIC);
-        fat.push(VERSION);
-        fat.extend_from_slice(&(hj.len() as u32).to_le_bytes());
-        fat.extend_from_slice(&hj);
-        fat.extend_from_slice(body);
-
-        let err = open_blob(&fat, &reader).unwrap_err();
-        assert!(
-            err.to_string().contains("recipients"),
-            "expected the recipient-cap error, got: {err}"
-        );
-
-        // Exactly at the cap the envelope is still processed end to end.
-        header["recipients"] = serde_json::Value::Array(vec![junk; MAX_RECIPIENTS]);
-        let hj = serde_json::to_vec(&header).unwrap();
-        let mut at_cap = Vec::new();
-        at_cap.extend_from_slice(MAGIC);
-        at_cap.push(VERSION);
-        at_cap.extend_from_slice(&(hj.len() as u32).to_le_bytes());
-        at_cap.extend_from_slice(&hj);
-        at_cap.extend_from_slice(body);
-        let err = open_blob(&at_cap, &reader).unwrap_err();
-        assert!(
-            !err.to_string().contains("over the"),
-            "at-cap envelope must reach the scan, got: {err}"
-        );
-    }
-
-    #[test]
-    fn seal_refuses_a_recipient_list_over_the_cap() {
-        // An envelope over the cap can never be opened, so seal must reject it
-        // instead of minting one.
-        let keys: Vec<VerifyingKey> = (0..MAX_RECIPIENTS + 1)
-            .map(|_| Keypair::generate().verifying_key())
-            .collect();
-        let err = seal_blob(b"blob", &keys).unwrap_err();
-        assert!(
-            err.to_string().contains("recipients"),
-            "expected the recipient-cap error, got: {err}"
-        );
-    }
-
-    /// Every standard low-order X25519 encoding must be detected by
-    /// `yields_all_zero_shared_secret`, including encodings that do not
-    /// decompress to an Edwards point (notably `u = p - 1`). The open side
-    /// rejects on the exchange result, not on decode shape, because an
-    /// encoding-shaped check misses non-decompressing low-order inputs while
-    /// still yielding the all-zero shared secret.
-    #[test]
-    fn all_zero_shared_secret_is_detected_for_every_standard_low_order_encoding() {
-        // The seven standard X25519 low-order encodings, driven as a set rather
-        // than as the two that happen to decompress. The encoding-shaped check
-        // this replaced reported `p - 1` as safe, and its exchange is all-zero.
-        let mut one = [0u8; 32];
-        one[0] = 1;
-        let hex = |h: &str| -> [u8; 32] {
-            let mut out = [0u8; 32];
-            for i in 0..32 {
-                out[i] = u8::from_str_radix(&h[i * 2..i * 2 + 2], 16).unwrap();
-            }
-            out
-        };
-        let vectors = [
-            ("u=0", [0u8; 32]),
-            ("u=1", one),
-            (
-                "order8-a",
-                hex("e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800"),
-            ),
-            (
-                "order8-b",
-                hex("5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157"),
-            ),
-            (
-                "p-1",
-                hex("ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
-            ),
-            (
-                "p",
-                hex("edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
-            ),
-            (
-                "p+1",
-                hex("eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
-            ),
-        ];
-        let kp = Keypair::generate();
-        let scalar = x25519_secret_from_seed(&kp.to_seed());
-        for (name, u) in vectors {
-            assert!(
-                yields_all_zero_shared_secret(&u, &scalar),
-                "{name} is a low-order encoding and must be detected"
-            );
-        }
-
-        // And the other direction, or a guard that returned true always would
-        // pass everything above while making the envelope unopenable.
-        let real_u = x25519_public(&kp.verifying_key()).unwrap();
-        assert!(
-            !yields_all_zero_shared_secret(&real_u, &scalar),
-            "a real key must not be treated as low-order"
-        );
-    }
-
-    /// The open side must skip an entry whose header-supplied `eph` is a
-    /// low-order point: such an entry forces the all-zero shared secret and
-    /// would unwrap for any reader. A poisoned entry among honest ones must
-    /// not DoS the envelope — the honest entry still opens.
-    #[test]
-    fn open_blob_skips_a_low_order_ephemeral_and_still_opens_honest_entry() {
-        use curve25519_dalek::montgomery::MontgomeryPoint;
-        let reader = Keypair::generate();
-        let env = seal_blob(b"private blob contents", &[reader.verifying_key()]).unwrap();
-
-        // Split the envelope framing into header JSON and body.
-        let mut p = MAGIC.len() + 1;
-        let hlen = u32::from_le_bytes(env[p..p + 4].try_into().unwrap()) as usize;
-        p += 4;
-        let header_bytes = &env[p..p + hlen];
-        let body = &env[p + hlen..];
-
-        // A low-order Montgomery u (u = 0) encoded as the entry's eph.
-        let low_order_u = MontgomeryPoint([0u8; 32]).to_bytes();
-        let poisoned = serde_json::json!({
-            "eph": B64.encode(low_order_u),
-            "nonce": B64.encode([0u8; 24]),
-            "wrap": B64.encode([0u8; 32]),
-        });
-
-        let reframe = |header: &serde_json::Value| -> Vec<u8> {
-            let hj = serde_json::to_vec(header).unwrap();
-            let mut out = Vec::new();
-            out.extend_from_slice(MAGIC);
-            out.push(VERSION);
-            out.extend_from_slice(&(hj.len() as u32).to_le_bytes());
-            out.extend_from_slice(&hj);
-            out.extend_from_slice(body);
-            out
-        };
-
-        let mut header: serde_json::Value = serde_json::from_slice(header_bytes).unwrap();
-        // Prepend the poisoned entry. The reader's honest entry must still
-        // unwrap, so the envelope opens despite the low-order entry.
-        let recipients = header["recipients"].as_array_mut().unwrap();
-        recipients.insert(0, poisoned);
-        assert_eq!(
-            open_blob(&reframe(&header), &reader).unwrap(),
-            b"private blob contents",
-            "the honest entry must still open despite a low-order eph entry"
-        );
-    }
-
-    /// Must-not for the open-side guard: an envelope whose ONLY entry is built
-    /// on a low-order ephemeral must not open for any reader. Without the
-    /// guard the all-zero shared secret unwraps for everyone, so the attacker
-    /// controls the plaintext and the envelope's confidentiality is void.
-    #[test]
-    fn open_blob_rejects_a_poisoned_only_envelope() {
-        use chacha20poly1305::{aead::Aead, KeyInit, XChaCha20Poly1305, XNonce};
-        use crypto_box::aead::AeadCore;
-        use curve25519_dalek::montgomery::MontgomeryPoint;
-
-        // Build a poisoned envelope from scratch: one recipient entry whose
-        // eph is the low-order u = 0. The wrap is the encryption of a content
-        // key under the all-zero shared secret, so without the guard any
-        // reader's ChaChaBox against u = 0 decrypts it.
-        let mut content_key: [u8; 32] = Default::default();
-        OsRng.fill_bytes(&mut content_key);
-        let attacker_x = XSecret::generate(&mut OsRng);
-        let zero_box = ChaChaBox::new(&XPublic::from(<[u8; 32]>::default()), &attacker_x);
-        let nonce = ChaChaBox::generate_nonce(&mut OsRng);
-        let wrap = zero_box.encrypt(&nonce, &content_key[..]).unwrap();
-
-        let mut body_nonce: [u8; 24] = Default::default();
-        OsRng.fill_bytes(&mut body_nonce);
-        let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
-        let body = body_cipher
-            .encrypt(
-                XNonce::from_slice(&body_nonce),
-                b"attacker-chosen plaintext".as_slice(),
-            )
-            .unwrap();
-
-        let header = serde_json::json!({
-            "alg": "xchacha20poly1305",
-            "nonce": B64.encode(body_nonce),
-            "recipients": [{
-                "eph": B64.encode(MontgomeryPoint([0u8; 32]).to_bytes()),
-                "nonce": B64.encode(nonce),
-                "wrap": B64.encode(wrap),
-            }],
-        });
-        let header_json = serde_json::to_vec(&header).unwrap();
-        let mut env = Vec::new();
-        env.extend_from_slice(MAGIC);
-        env.push(VERSION);
-        env.extend_from_slice(&(header_json.len() as u32).to_le_bytes());
-        env.extend_from_slice(&header_json);
-        env.extend_from_slice(&body);
-
-        let reader = Keypair::generate();
-        let err = open_blob(&env, &reader).unwrap_err();
-        assert!(
-            err.to_string().contains("not a recipient"),
-            "a poisoned-only envelope must not open for anyone, got: {err}"
-        );
-    }
-
-    /// The same must-not, driven with the low-order encoding that does NOT map
-    /// to an Edwards point.
-    ///
-    /// This is the case an encoding-shaped guard cannot see. `u = p - 1` is a
-    /// legal X25519 input whose exchange is the all-zero secret for any scalar,
-    /// and `MontgomeryPoint::to_edwards` returns None for it, so a check written
-    /// as "decompress, then ask is_small_order" reports it as safe. Measured
-    /// across the seven standard low-order encodings: six are caught that way
-    /// and this one is not.
-    ///
-    /// Found by a cross-family review of the head that first added the guard,
-    /// and the comment beside that guard asserted this case was already handled
-    /// by a decode path that does not exist. That is why the fix rejects on the
-    /// RESULT of the exchange rather than on a list of encodings: the result is
-    /// what the attack actually depends on, and it needs no enumeration to be
-    /// exhaustive.
-    #[test]
-    fn open_blob_rejects_a_non_edwards_low_order_ephemeral() {
-        // No blanket `use ...::Aead` here. Two aead versions are reachable, and a
-        // blanket import silently resolved the wrap through the one open_blob does
-        // NOT decrypt with, producing a ciphertext that could never open. The test
-        // then passed with the guard, without it, and with the original pre-fix
-        // guard alike, proving nothing. Every call below names its trait.
-        use chacha20poly1305::{KeyInit, XChaCha20Poly1305, XNonce};
-        use crypto_box::aead::AeadCore;
-
-        // u = p - 1 = 2^255 - 20, little endian.
-        let mut eph = [0xffu8; 32];
-        eph[0] = 0xec;
-        eph[31] = 0x7f;
-
-        let mut content_key: [u8; 32] = Default::default();
-        OsRng.fill_bytes(&mut content_key);
-        let attacker_x = XSecret::generate(&mut OsRng);
-        let zero_box = ChaChaBox::new(&XPublic::from(<[u8; 32]>::default()), &attacker_x);
-        let nonce = ChaChaBox::generate_nonce(&mut OsRng);
-        let wrap = crypto_box::aead::Aead::encrypt(&zero_box, &nonce, &content_key[..]).unwrap();
-
-        let mut body_nonce: [u8; 24] = Default::default();
-        OsRng.fill_bytes(&mut body_nonce);
-        let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
-        let body = chacha20poly1305::aead::Aead::encrypt(
-            &body_cipher,
-            XNonce::from_slice(&body_nonce),
-            b"attacker-chosen plaintext".as_slice(),
-        )
-        .unwrap();
-
-        let header = serde_json::json!({
-            "alg": "xchacha20poly1305",
-            "nonce": B64.encode(body_nonce),
-            "recipients": [{
-                "eph": B64.encode(eph),
-                "nonce": B64.encode(nonce),
-                "wrap": B64.encode(wrap),
-            }],
-        });
-        let header_json = serde_json::to_vec(&header).unwrap();
-        let mut env = Vec::new();
-        env.extend_from_slice(MAGIC);
-        env.push(VERSION);
-        env.extend_from_slice(&(header_json.len() as u32).to_le_bytes());
-        env.extend_from_slice(&header_json);
-        env.extend_from_slice(&body);
-
-        let reader = Keypair::generate();
-        let err = open_blob(&env, &reader).unwrap_err();
-        assert!(
-            err.to_string().contains("not a recipient"),
-            "an envelope whose only entry uses a non-Edwards low-order eph must not \
-             open for anyone, got: {err}"
-        );
-    }
-
-    /// The compressed identity point: a well-formed Ed25519 encoding that is
-    /// small-order, so every shared secret derived from it is all-zero.
-    fn weak_verifying_key() -> VerifyingKey {
-        let mut weak = [0u8; 32];
-        weak[0] = 1;
-        let vk = VerifyingKey::from_bytes(&weak).expect("identity point decompresses");
-        assert!(vk.is_weak(), "fixture precondition: key is small-order");
-        vk
-    }
-
-    /// A small-order recipient key converts to Montgomery u = 0, and X25519
-    /// against u = 0 is the all-zero shared secret for ANY scalar, so the
-    /// wrapping box is reconstructable with no secret at all. Reject at the
-    /// primitive so the seal side is safe regardless of how the caller
-    /// obtained the key.
-    #[test]
-    fn x25519_public_rejects_a_small_order_key() {
-        let weak_vk = weak_verifying_key();
-
-        assert!(
-            x25519_public(&weak_vk).is_err(),
-            "a small-order key must not yield an x25519 public key"
-        );
-    }
-
-    /// Control: a legitimate key still converts, and to a non-zero u.
-    #[test]
-    fn x25519_public_still_accepts_a_real_key() {
-        let kp = Keypair::generate();
-        let u = x25519_public(&kp.verifying_key()).expect("a real key must convert");
-        assert_ne!(u, [0u8; 32], "a real key must not map to the zero point");
-    }
-
-    /// The guard has to propagate: no envelope may be produced for a weak
-    /// recipient even when the DID choke point is bypassed entirely.
-    #[test]
-    fn seal_blob_refuses_a_small_order_recipient() {
-        let weak_vk = weak_verifying_key();
-
-        assert!(
-            seal_blob(b"withheld", &[weak_vk]).is_err(),
-            "sealing to a weak recipient must fail"
-        );
-
-        // And a mixed set must fail too: one weak recipient exposes the shared
-        // content key, so a partial envelope is not an acceptable outcome.
-        let honest = Keypair::generate();
-        assert!(
-            seal_blob(b"withheld", &[honest.verifying_key(), weak_vk]).is_err(),
-            "a mixed honest+weak recipient set must fail closed, not seal partially"
-        );
-    }
-
-    /// Control for the two above: the ordinary seal/open round trip is intact.
-    #[test]
-    fn legit_seal_open_round_trip_still_works() {
-        let reader = Keypair::generate();
-        let env = seal_blob(b"withheld blob", &[reader.verifying_key()]).expect("seal");
-        assert_eq!(open_blob(&env, &reader).expect("open"), b"withheld blob");
-    }
-
-    /// The defect this fix exists to close, kept as an executable regression
-    /// rather than an assertion about absence. It runs the real attack: craft a
-    /// small-order did:key, get it into a recipient set alongside an honest
-    /// reader, then rebuild the wrapping box from the all-zero shared secret
-    /// that a small-order recipient forces. If any guard regresses, this does
-    /// not merely fail, it fails printing the plaintext it recovered.
-    #[test]
-    fn attacker_cannot_recover_plaintext_via_a_weak_recipient() {
-        use crate::did::Did;
-        use std::str::FromStr;
-
-        let weak_vk = weak_verifying_key();
-
-        // Layer 1: the attacker's did:key string must not resolve at all.
-        let weak_did = Did::from_verifying_key(&weak_vk).to_string();
-        assert!(
-            Did::from_str(&weak_did)
-                .expect("still a well-formed did:key")
-                .to_verifying_key()
-                .is_err(),
-            "a small-order did:key must not resolve"
-        );
-
-        // Layer 2: even handed the key directly, sealing must refuse. One weak
-        // recipient would expose the single shared content key, so the honest
-        // reader's blob would be readable by anyone.
-        let honest = Keypair::generate();
-        let secret_plaintext = b"WITHHELD BLOB CONTENTS";
-        let envelope = match seal_blob(secret_plaintext, &[honest.verifying_key(), weak_vk]) {
-            Err(_) => return, // no envelope exists, nothing to attack
-            Ok(env) => env,
-        };
-
-        // Only reachable if a guard regressed. Run the attack and report what
-        // it got, so the failure names the actual exposure.
-        let mut p = MAGIC.len() + 1;
-        let hlen = u32::from_le_bytes(envelope[p..p + 4].try_into().unwrap()) as usize;
-        p += 4;
-        let header: serde_json::Value = serde_json::from_slice(&envelope[p..p + hlen]).unwrap();
-        let body = &envelope[p + hlen..];
-        let body_nonce = B64.decode(header["nonce"].as_str().unwrap()).unwrap();
-
-        // X25519 against u = 0 is the all-zero shared secret for any scalar, so
-        // the sealer's box is reconstructable with a key the attacker picks.
-        let zero_box = ChaChaBox::new(
-            &XPublic::from(<[u8; 32]>::default()),
-            &XSecret::generate(&mut OsRng),
-        );
-        for r in header["recipients"].as_array().unwrap() {
-            let n = B64.decode(r["nonce"].as_str().unwrap()).unwrap();
-            let w = B64.decode(r["wrap"].as_str().unwrap()).unwrap();
-            if let Ok(content_key) = zero_box.decrypt(n.as_slice().into(), w.as_slice()) {
-                let cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
-                let recovered = cipher
-                    .decrypt(XNonce::from_slice(&body_nonce), body)
-                    .expect("body decrypts once the content key is out");
-                panic!(
-                    "REGRESSION: attacker recovered plaintext with no private key: {:?}",
-                    String::from_utf8_lossy(&recovered)
-                );
-            }
-        }
-        panic!("an envelope was sealed to a small-order recipient; the seal guard regressed");
-    }
 }

crates/gitlawb-core/src/http_sig.rs

@@ -1,6 +1,6 @@
 //! HTTP Signatures (RFC 9421) for gitlawb.
 //!
-//! Every write request to a Twigpine node must be signed by the actor's
+//! Every write request to a gitlawb node must be signed by the actor's
 //! Ed25519 private key. The signature covers:
 //!   - `@method`         — HTTP method (uppercase)
 //!   - `@path`           — request path and query
@@ -14,13 +14,13 @@
 use base64::{engine::general_purpose::STANDARD, Engine};
 use chrono::Utc;
 use sha2::{Digest, Sha256};
-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 
 use crate::did::Did;
 use crate::identity::Keypair;
 use crate::{Error, Result};
 
-/// The component identifiers covered by every Twigpine signature.
+/// The component identifiers covered by every gitlawb signature.
 pub const COVERED_COMPONENTS: &[&str] = &["@method", "@path", "content-digest"];
 
 /// The three headers produced by RFC 9421 signing.
@@ -67,20 +67,11 @@ impl HttpSignature {
         let components_str = &rest[open + 1..close];
         let params_str = &rest[close + 1..]; // starts with ';'
 
-        // RFC 9421 §2.1: a component identifier appears at most once. Gitlawb
-        // only supports bare names; parameters are rejected so reordered
-        // equivalent forms cannot bypass duplicate detection as distinct strings.
-        let mut components = Vec::new();
-        let mut seen = HashSet::new();
-        for token in components_str.split_whitespace() {
-            let name = parse_covered_component(token)?;
-            if !seen.insert(name.clone()) {
-                return Err(Error::HttpSignature(format!(
-                    "duplicate covered component '{name}' in Signature-Input"
-                )));
-            }
-            components.push(name);
-        }
+        // "\"@method\" \"@path\" \"content-digest\"" → ["@method", "@path", "content-digest"]
+        let components: Vec<String> = components_str
+            .split_whitespace()
+            .map(|s| s.trim_matches('"').to_string())
+            .collect();
 
         let params = parse_params(params_str)?;
 
@@ -122,48 +113,15 @@ impl HttpSignature {
         })
     }
 
-    /// Reject a `created` timestamp outside the acceptance window, which is
-    /// ASYMMETRIC: up to 5 minutes into the past, but only 60 seconds into the
-    /// future.
-    ///
-    /// The two directions are two comparisons rather than one distance, because
-    /// they are not the same event. A signature that arrives late is ordinary:
-    /// clocks run slow, requests queue, and networks are not instant, so the
-    /// past side keeps the full 300-second allowance. A signature stamped ahead
-    /// of this node's clock is not ordinary, and folding both sides into an
-    /// `abs()` let a signer extend its own validity: signed at T with
-    /// `created = T + 300`, it stayed acceptable until roughly T + 600, so the
-    /// effective window was double the one this function advertises. The
-    /// forward tolerance exists only to absorb honest drift between two hosts,
-    /// which is what 60 seconds buys; it is the same allowance the gossip
-    /// path's freshness check uses for the same reason.
+    /// Reject if the `created` timestamp is more than 5 minutes from now.
     pub fn check_created(&self) -> Result<()> {
-        const MAX_AGE_SECS: i64 = 300;
-        const MAX_FUTURE_SECS: i64 = 60;
-
         let now = Utc::now().timestamp();
-
-        // Saturating, not plain subtraction. `created` is parsed as an
-        // unrestricted i64 straight from the Signature-Input header, so a
-        // sender picks it: at i64::MIN the past-side subtraction overflows,
-        // which panics a debug build and wraps a release one into an absurd
-        // value that can read as acceptable. Saturating gives the answer the
-        // check wants at both extremes, since a timestamp that far away is
-        // refused by whichever side it saturates toward.
-        let age = now.saturating_sub(self.created);
-        if age > MAX_AGE_SECS {
+        let skew = (now - self.created).abs();
+        if skew > 300 {
             return Err(Error::HttpSignature(format!(
-                "clock skew too large: created {age}s in the past (max {MAX_AGE_SECS}s)"
+                "clock skew too large: {skew}s (max 300s)"
             )));
         }
-
-        let ahead = self.created.saturating_sub(now);
-        if ahead > MAX_FUTURE_SECS {
-            return Err(Error::HttpSignature(format!(
-                "clock skew too large: created {ahead}s in the future (max {MAX_FUTURE_SECS}s)"
-            )));
-        }
-
         Ok(())
     }
 
@@ -245,33 +203,6 @@ pub fn compute_content_digest(body: &[u8]) -> String {
     format!("sha-256=:{}:", STANDARD.encode(hasher.finalize()))
 }
 
-/// Parse one covered-component token from Signature-Input's parenthesized list.
-///
-/// Gitlawb only supports bare component names (`"@method"`, `"@path"`,
-/// `"content-digest"`). RFC 9421 permits parameters on identifiers; they are
-/// rejected rather than accepted in a form `missing_components()` and
-/// `build_signing_string()` cannot handle consistently.
-fn parse_covered_component(token: &str) -> Result<String> {
-    let token = token.trim();
-    let open = token
-        .strip_prefix('"')
-        .ok_or_else(|| Error::HttpSignature("component must be a quoted string".into()))?;
-    let close = open
-        .find('"')
-        .ok_or_else(|| Error::HttpSignature("unterminated component string".into()))?;
-    let name = &open[..close];
-    if name.is_empty() {
-        return Err(Error::HttpSignature("empty component name".into()));
-    }
-    let trailing = open[close + 1..].trim();
-    if !trailing.is_empty() {
-        return Err(Error::HttpSignature(format!(
-            "component parameters are not supported on '{name}'"
-        )));
-    }
-    Ok(name.to_string())
-}
-
 /// Parse `;key="value";key2=value` parameter string into a map.
 fn parse_params(s: &str) -> Result<HashMap<String, String>> {
     let mut map = HashMap::new();
@@ -341,91 +272,6 @@ mod tests {
         assert!(missing.contains(&"content-digest"));
     }
 
-    /// RFC 9421 §2.1: a component identifier must not appear twice in the
-    /// covered list. Repeating one is not a way to say anything, but it does
-    /// repeat a line in the signing string, so the size of what a verifier
-    /// builds (and what a node persists alongside a claim) is set by how many
-    /// times the caller chose to write the same name.
-    #[test]
-    fn parse_rejects_component_parameters() {
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let sig_input = format!(
-            r#"sig1=("@method" "@path" "content-digest";sf);keyid="{did}";alg="ed25519";created=1000"#
-        );
-        let err = HttpSignature::parse(
-            &sig_input,
-            "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:",
-        )
-        .expect_err("parameterized components must be refused");
-        assert!(
-            err.to_string().contains("component parameters"),
-            "got: {err}"
-        );
-    }
-
-    #[test]
-    fn parse_rejects_reordered_equivalent_component_parameters() {
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let sig_input = format!(
-            r#"sig1=("content-digest";sf;tr "content-digest";tr;sf "@method" "@path");keyid="{did}";alg="ed25519";created=1000"#
-        );
-        let err = HttpSignature::parse(
-            &sig_input,
-            "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:",
-        )
-        .expect_err("reordered equivalent parameters must not bypass as distinct components");
-        assert!(
-            err.to_string().contains("component parameters"),
-            "got: {err}"
-        );
-    }
-
-    #[test]
-    fn parse_many_distinct_components_completes_quickly() {
-        use std::time::{Duration, Instant};
-
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let names: Vec<String> = (0..20_000).map(|i| format!("\"c{i}\"")).collect();
-        let inner = names.join(" ");
-        let sig_input = format!(r#"sig1=({inner});keyid="{did}";alg="ed25519";created=1000"#);
-        let start = Instant::now();
-        let result = HttpSignature::parse(
-            &sig_input,
-            "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:",
-        );
-        let elapsed = start.elapsed();
-        assert!(
-            elapsed < Duration::from_secs(2),
-            "duplicate tracking must stay linear, took {elapsed:?}"
-        );
-        assert!(result.is_ok(), "distinct names should parse: {:?}", result);
-    }
-
-    #[test]
-    fn parse_rejects_duplicate_components() {
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let sig_input = format!(
-            r#"sig1=("@method" "@path" "@path" "content-digest");keyid="{did}";alg="ed25519";created=1000"#
-        );
-        let err = HttpSignature::parse(&sig_input, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:")
-            .expect_err("a repeated component must be refused");
-        assert!(
-            err.to_string().contains("duplicate"),
-            "the error must name the duplication, got: {err}"
-        );
-
-        // The control: the same list without the repeat still parses.
-        let ok = format!(
-            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created=1000"#
-        );
-        HttpSignature::parse(&ok, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:")
-            .expect("a distinct component list must still parse");
-    }
-
     #[test]
     fn verify_signature_end_to_end() {
         use crate::identity::verify;
@@ -489,75 +335,6 @@ mod tests {
         assert!(sig.check_created().is_err());
     }
 
-    /// Build a parseable signature whose `created` is `offset` seconds from now
-    /// (negative for the past), so a test can pin one side of the window.
-    fn sig_created_at_offset(offset: i64) -> HttpSignature {
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let created = Utc::now().timestamp() + offset;
-        let sig_input = format!(
-            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created={created}"#
-        );
-        HttpSignature::parse(&sig_input, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:").unwrap()
-    }
-
-    /// Build a signature at an ABSOLUTE `created`, so a test can drive the
-    /// extremes an offset from now cannot reach.
-    fn sig_created_absolute(created: i64) -> HttpSignature {
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let sig_input = format!(
-            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created={created}"#
-        );
-        HttpSignature::parse(&sig_input, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:").unwrap()
-    }
-
-    /// `created` is parsed as an unrestricted i64 from a header the sender
-    /// writes, so the window check has to survive both ends of the type. Before
-    /// the saturating form this panicked with "attempt to subtract with
-    /// overflow" on the past side, which is a debug-build crash any client
-    /// could trigger by sending one header value.
-    #[test]
-    fn extreme_created_values_are_refused_rather_than_overflowing() {
-        for created in [i64::MIN, i64::MIN + 1, i64::MAX - 1, i64::MAX] {
-            let err = sig_created_absolute(created)
-                .check_created()
-                .expect_err("an extreme created must be refused, not accepted");
-            let msg = err.to_string();
-            assert!(
-                msg.contains("past") || msg.contains("future"),
-                "created={created} must be refused by a named direction, got: {msg}"
-            );
-        }
-    }
-
-    #[test]
-    fn created_301s_in_past_rejected() {
-        let err = sig_created_at_offset(-301).check_created().unwrap_err();
-        assert!(err.to_string().contains("past"), "{err}");
-    }
-
-    #[test]
-    fn created_299s_in_past_accepted() {
-        assert!(sig_created_at_offset(-299).check_created().is_ok());
-    }
-
-    #[test]
-    fn created_61s_in_future_rejected() {
-        let err = sig_created_at_offset(61).check_created().unwrap_err();
-        assert!(err.to_string().contains("future"), "{err}");
-    }
-
-    #[test]
-    fn created_30s_in_future_accepted() {
-        assert!(sig_created_at_offset(30).check_created().is_ok());
-    }
-
-    #[test]
-    fn created_exactly_now_accepted() {
-        assert!(sig_created_at_offset(0).check_created().is_ok());
-    }
-
     #[test]
     fn fresh_signature_passes_clock_skew() {
         let kp = Keypair::generate();

crates/gitlawb-core/src/identity.rs

@@ -1,6 +1,6 @@
 //! Keypair generation, storage, and signing.
 //!
-//! A Twigpine identity is an Ed25519 keypair. The public key encodes into a
+//! A gitlawb identity is an Ed25519 keypair. The public key encodes into a
 //! `did:key` DID. The private key is stored as PKCS#8 PEM on disk.
 
 use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
@@ -11,7 +11,7 @@ use zeroize::Zeroizing;
 use crate::did::Did;
 use crate::{Error, Result};
 
-/// An Ed25519 keypair that is the root identity for a Twigpine actor.
+/// An Ed25519 keypair that is the root identity for a gitlawb actor.
 #[derive(Clone)]
 pub struct Keypair {
     signing_key: SigningKey,

crates/gitlawb-core/src/redirect.rs

@@ -1,4 +1,4 @@
-//! Redirect policy shared by every Twigpine HTTP client that signs its requests.
+//! Redirect policy shared by every gitlawb HTTP client that signs its requests.
 //!
 //! Both `gl` (async) and `git-remote-gitlawb` (blocking) attach RFC 9421
 //! `Signature` and `Signature-Input` headers, and reqwest strips only
@@ -50,7 +50,7 @@ pub const MAX_REDIRECTS: usize = 10;
 /// signed and unsigned callers alike, for the same reason the predicate is shared:
 /// two rules would drift.
 ///
-/// The clause pins `@path`, and only `@path`. A Twigpine signature also covers
+/// The clause pins `@path`, and only `@path`. A gitlawb signature also covers
 /// `@method` and `content-digest`, and both of those are still open on a followed
 /// hop: on a 301, 302 or 303, reqwest 0.12.28 delegates to tower-http's
 /// `FollowRedirect`, which rewrites a POST to a GET and empties the body
@@ -188,7 +188,7 @@ mod tests {
                 "the node's name pushed into the fragment: the host is the attacker's",
             ),
             // The request-target clause, both directions. `@path` is the only thing a
-            // Twigpine signature binds the request to, so a hop that rewrites it hands
+            // gitlawb signature binds the request to, so a hop that rewrites it hands
             // the node a signature over a target it never received.
             (
                 "https://node.example/a?x=1",

crates/gitlawb-core/src/ucan.rs

@@ -1,7 +1,7 @@
 //! UCAN (User Controlled Authorization Networks) — capability token types.
 //!
 //! UCANs let a DID delegate specific capabilities to another DID,
-//! with optional expiry and revocation. Twigpine uses UCANs for:
+//! with optional expiry and revocation. gitlawb uses UCANs for:
 //!   - Delegating push access to a branch to a CI agent
 //!   - Granting a reviewer the ability to approve PRs
 //!   - Bootstrap tokens issued at registration
@@ -57,7 +57,7 @@ impl Capability {
     }
 }
 
-/// Well-known Twigpine capability strings.
+/// Well-known gitlawb capability strings.
 pub mod caps {
     pub const GIT_PUSH: &str = "git/push";
     pub const GIT_FETCH: &str = "git/fetch";

crates/gitlawb-node/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gitlawb-node"
-description = "The Twigpine node daemon — git hosting over HTTP with DID auth"
+description = "The gitlawb node daemon — git hosting over HTTP with DID auth"
 version = "0.7.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
@@ -33,7 +33,6 @@ sqlx = { version = "0.8", features = ["postgres", "runtime-tokio-rustls", "chron
 clap = { version = "4", features = ["derive", "env"] }
 bytes = "1"
 libc = "0.2"
-zeroize = "1"
 cid = { workspace = true }
 hex = { workspace = true }
 sha2 = { workspace = true }
@@ -45,14 +44,14 @@ dirs-next = "2"
 # withholds a canonically-equivalent path regardless of NFC/NFD form (#101).
 unicode-normalization = "0.1"
 reqwest = { workspace = true }
-libp2p-core = "0.44"
-libp2p-gossipsub = "0.50.1"
-libp2p-identify = "0.48"
-libp2p-identity = { version = "0.3", features = ["ed25519", "peerid", "rand"] }
-libp2p-kad = "0.49"
-libp2p-quic = { version = "0.14", features = ["tokio"] }
-libp2p-swarm = { version = "0.48", features = ["macros", "tokio"] }
-multiaddr = "0.19"
+libp2p-core = "0.43"
+libp2p-gossipsub = "0.49.4"
+libp2p-identify = "0.47"
+libp2p-identity = { version = "0.2", features = ["ed25519", "peerid", "rand"] }
+libp2p-kad = "0.48"
+libp2p-quic = { version = "0.13", features = ["tokio"] }
+libp2p-swarm = { version = "0.47", features = ["macros", "tokio"] }
+multiaddr = "0.18"
 futures = "0.3"
 aws-sdk-s3 = { version = "1", default-features = false, features = ["sigv4a", "default-https-client", "rt-tokio"] }
 aws-config = { version = "1", features = ["behavior-version-latest"] }
@@ -73,7 +72,7 @@ alloy = { version = "1", default-features = false, features = [
     "network",
     "rpc-types-eth",
 ] }
-libp2p-dns = { version = "0.45.0", features = ["tokio"] }
+libp2p-dns = { version = "0.44.0", features = ["tokio"] }
 
 [dev-dependencies]
 mockito = "1"

crates/gitlawb-node/src/api/bounties.rs

@@ -285,22 +285,11 @@ pub async fn submit_bounty(
     Path(id): Path<String>,
     Json(req): Json<SubmitBountyRequest>,
 ) -> Result<Json<BountyRecord>> {
-    let not_found = || AppError::NotFound(format!("bounty {id} not found"));
-
-    let bounty = state.db.get_bounty(&id).await?.ok_or_else(not_found)?;
-
-    if crate::api::authorize_repo_read(
-        &state,
-        &bounty.repo_owner,
-        &bounty.repo_name,
-        Some(auth.0.as_str()),
-        "/",
-    )
-    .await
-    .is_err()
-    {
-        return Err(not_found());
-    }
+    let bounty = state
+        .db
+        .get_bounty(&id)
+        .await?
+        .ok_or_else(|| AppError::NotFound(format!("bounty {id} not found")))?;
 
     if bounty.status != "claimed" {
         return Err(AppError::BadRequest(format!(
@@ -336,22 +325,11 @@ pub async fn approve_bounty(
     Path(id): Path<String>,
     Json(req): Json<ApproveBountyRequest>,
 ) -> Result<Json<BountyRecord>> {
-    let not_found = || AppError::NotFound(format!("bounty {id} not found"));
-
-    let bounty = state.db.get_bounty(&id).await?.ok_or_else(not_found)?;
-
-    if crate::api::authorize_repo_read(
-        &state,
-        &bounty.repo_owner,
-        &bounty.repo_name,
-        Some(auth.0.as_str()),
-        "/",
-    )
-    .await
-    .is_err()
-    {
-        return Err(not_found());
-    }
+    let bounty = state
+        .db
+        .get_bounty(&id)
+        .await?
+        .ok_or_else(|| AppError::NotFound(format!("bounty {id} not found")))?;
 
     if bounty.status != "submitted" {
         return Err(AppError::BadRequest(format!(
@@ -394,22 +372,11 @@ pub async fn cancel_bounty(
     Extension(auth): Extension<AuthenticatedDid>,
     Path(id): Path<String>,
 ) -> Result<Json<BountyRecord>> {
-    let not_found = || AppError::NotFound(format!("bounty {id} not found"));
-
-    let bounty = state.db.get_bounty(&id).await?.ok_or_else(not_found)?;
-
-    if crate::api::authorize_repo_read(
-        &state,
-        &bounty.repo_owner,
-        &bounty.repo_name,
-        Some(auth.0.as_str()),
-        "/",
-    )
-    .await
-    .is_err()
-    {
-        return Err(not_found());
-    }
+    let bounty = state
+        .db
+        .get_bounty(&id)
+        .await?
+        .ok_or_else(|| AppError::NotFound(format!("bounty {id} not found")))?;
 
     if bounty.status != "open" {
         return Err(AppError::BadRequest(format!(
@@ -440,22 +407,11 @@ pub async fn dispute_bounty(
     Extension(auth): Extension<AuthenticatedDid>,
     Path(id): Path<String>,
 ) -> Result<Json<BountyRecord>> {
-    let not_found = || AppError::NotFound(format!("bounty {id} not found"));
-
-    let bounty = state.db.get_bounty(&id).await?.ok_or_else(not_found)?;
-
-    if crate::api::authorize_repo_read(
-        &state,
-        &bounty.repo_owner,
-        &bounty.repo_name,
-        Some(auth.0.as_str()),
-        "/",
-    )
-    .await
-    .is_err()
-    {
-        return Err(not_found());
-    }
+    let bounty = state
+        .db
+        .get_bounty(&id)
+        .await?
+        .ok_or_else(|| AppError::NotFound(format!("bounty {id} not found")))?;
 
     if bounty.status != "claimed" && bounty.status != "submitted" {
         return Err(AppError::BadRequest(format!(
@@ -500,68 +456,21 @@ pub async fn dispute_bounty(
     Ok(Json(updated))
 }
 
-/// Resolve the set of `(owner_did, name)` pairs for repos an anonymous caller
-/// can list.  Mirrors the `stats()` pattern in `server.rs` (#104): batch-load
-/// all deduped repos, batch-load their visibility rules, keep only those that
-/// pass `listable_at_root`.  Pure I/O after the two DB round-trips — no
-/// per-repo authorization queries.
-///
-/// Both bounty stats handlers mount behind `optional_signature` (see
-/// `bounty_read_routes` in server.rs), so the caller is always `None` for
-/// anonymous access.  Every caller, signed or not, currently receives the
-/// anonymous-scoped aggregates (matching the #104 pattern); per-caller
-/// visibility can be threaded through here when that work lands.
-///
-/// A database error is returned to the caller, never collapsed to an empty
-/// set: an empty set would render as HTTP 200 with zero counts, which a client
-/// reads as confirmed absence of activity.
-async fn visible_repo_pairs(state: &AppState) -> Result<Vec<(String, String)>> {
-    let rows = state.db.list_all_repos_deduped().await?;
-    let ids: Vec<String> = rows.iter().map(|r| r.id.clone()).collect();
-    let rules_by_repo = state.db.list_visibility_rules_for_repos(&ids).await?;
-    let pairs = rows
-        .iter()
-        .filter(|r| {
-            let rules = rules_by_repo.get(&r.id).map(Vec::as_slice).unwrap_or(&[]);
-            // mirror-rows-handled: a mirror with a canonical twin is deduped to the
-            // canonical row and its rules; a mirror-only repo counts as public, the
-            // same answer authorize_repo_read and /stats give. Pinned by
-            // bounty_stats_mirror_rows_follow_canonical_twin_or_count_when_alone.
-            crate::visibility::listable_at_root(rules, r.is_public, &r.owner_did, None)
-        })
-        .map(|r| {
-            (
-                crate::db::normalize_owner_key(&r.owner_did).to_string(),
-                r.name.clone(),
-            )
-        })
-        .collect();
-    Ok(pairs)
-}
-
 /// GET /api/v1/bounties/stats
-///
-/// Aggregates are restricted to anonymously-listable repos so private-repo
-/// bounty activity is not exposed (#477).  The visible-repo set is resolved
-/// once per request via `visible_repo_pairs` (two SQL round-trips), then
-/// passed into the filtered aggregate queries.
 pub async fn bounty_stats(State(state): State<AppState>) -> Result<Json<BountyStatsResponse>> {
-    let visible = visible_repo_pairs(&state).await?;
-
-    let open = state
-        .db
-        .count_bounties_by_status_visible("open", &visible)
-        .await?;
+    let open = state.db.count_bounties_by_status("open").await.unwrap_or(0);
     let claimed = state
         .db
-        .count_bounties_by_status_visible("claimed", &visible)
-        .await?;
+        .count_bounties_by_status("claimed")
+        .await
+        .unwrap_or(0);
     let completed = state
         .db
-        .count_bounties_by_status_visible("completed", &visible)
-        .await?;
+        .count_bounties_by_status("completed")
+        .await
+        .unwrap_or(0);
 
-    let leaders = state.db.bounty_leaderboard_visible(10, &visible).await?;
+    let leaders = state.db.bounty_leaderboard(10).await.unwrap_or_default();
     let leaderboard = leaders
         .into_iter()
         .map(|(did, cnt, total)| AgentBountyEntry {
@@ -580,14 +489,11 @@ pub async fn bounty_stats(State(state): State<AppState>) -> Result<Json<BountySt
 }
 
 /// GET /api/v1/agents/{did}/bounties
-///
-/// Per-agent earnings restricted to anonymously-listable repos (#477).
 pub async fn agent_bounty_stats(
     State(state): State<AppState>,
     Path(did): Path<String>,
 ) -> Result<Json<serde_json::Value>> {
-    let visible = visible_repo_pairs(&state).await?;
-    let (count, total) = state.db.agent_bounty_stats_visible(&did, &visible).await?;
+    let (count, total) = state.db.agent_bounty_stats(&did).await.unwrap_or((0, 0));
     Ok(Json(serde_json::json!({
         "did": did,
         "completed_bounties": count,

crates/gitlawb-node/src/api/ipfs.rs

@@ -2520,10 +2520,7 @@ mod tests {
                 "/ipfs/{cid}",
                 axum::routing::get(crate::api::ipfs::get_by_cid),
             )
-            .layer(axum::middleware::from_fn_with_state(
-                crate::auth::SignatureBodyLimit(crate::server::SIGNED_BODY_LIMIT),
-                crate::auth::optional_signature,
-            ))
+            .layer(axum::middleware::from_fn(crate::auth::optional_signature))
             .with_state(state)
     }
 

crates/gitlawb-node/src/api/issues.rs

@@ -938,63 +938,6 @@ mod lock_pool_shed_tests {
         );
     }
 
-    /// #285 U2, gap-driving. `close_issue` decides authorship out of a
-    /// `read_snapshot`, and on a node whose only copy is the live tree that
-    /// snapshot IS the live tree. When a write left that tree carrying refs the
-    /// store never confirmed, the pre-check reads authorship out of state no
-    /// other node can see, so it must be refused as retryable rather than
-    /// answered.
-    ///
-    /// No backend is configured here, which is the sharpest form: nothing can
-    /// ever confirm the marked tree, so serving it is not a race, it is a
-    /// standing wrong answer.
-    #[sqlx::test]
-    async fn close_issue_refuses_a_quarantined_snapshot_before_authorization(pool: PgPool) {
-        let tmp = tempfile::TempDir::new().unwrap();
-        let owner = "did:key:zISSUECLOSEQUARANTINEBBBBBBBBBBBBBBBBBBB";
-        let mut state = crate::test_support::test_state(pool.clone()).await;
-        state.repo_store =
-            crate::git::repo_store::RepoStore::for_testing(tmp.path().to_path_buf(), pool.clone());
-        state
-            .db
-            .create_repo(&seed_repo(owner, "quar-close"))
-            .await
-            .expect("seed repo");
-
-        // A live tree with an unresolved publish beside it.
-        let live = state
-            .repo_store
-            .acquire(owner, "quar-close")
-            .await
-            .expect("resolve the live path");
-        let _ = std::fs::remove_dir_all(&live);
-        crate::git::store::init_bare(&live).expect("init bare repo");
-        crate::git::repo_store::quarantine_local_tree(
-            &live,
-            "quar-close",
-            Some(&crate::git::publish::PublishAttemptId::new()),
-        );
-
-        let refused = close_issue(
-            State(state.clone()),
-            Extension(AuthenticatedDid(
-                "did:key:zISSUECLOSEQUARSTRANGER".to_string(),
-            )),
-            Path((
-                owner.to_string(),
-                "quar-close".to_string(),
-                "deadbeef".to_string(),
-            )),
-            axum::http::HeaderMap::new(),
-            crate::rate_limit::PeerAddr(None),
-        )
-        .await;
-        assert!(
-            matches!(refused, Err(AppError::RepoUnavailable)),
-            "close_issue must not read authorship out of a quarantined tree the store cannot confirm"
-        );
-    }
-
     #[sqlx::test]
     async fn close_issue_lock_pool_exhaustion_sheds_503_not_500(pool: PgPool) {
         let owner = "did:key:zISSUECLOSELOCKPOOLBBBBBBBBBBBBBBBBBBBBB";

crates/gitlawb-node/src/api/labels.rs

@@ -14,13 +14,14 @@ pub struct LabelRequest {
     pub label: String,
 }
 
-/// Canonicalize and validate a label string. `add_label` and `remove_label`
-/// must agree on the form stored in the DB: `add_label` already trims and
-/// lowercases before storing, so `remove_label` has to do the same to find
-/// the row. Validation is shared so neither handler can drift on charset or
-/// length (#344).
-fn canonicalize_label(raw: &str) -> std::result::Result<String, AppError> {
-    let label = raw.trim().to_lowercase();
+/// POST /api/v1/repos/:owner/:repo/labels
+pub async fn add_label(
+    State(state): State<AppState>,
+    Extension(auth): Extension<AuthenticatedDid>,
+    Path((owner, name)): Path<(String, String)>,
+    Json(req): Json<LabelRequest>,
+) -> Result<(StatusCode, Json<serde_json::Value>)> {
+    let label = req.label.trim().to_lowercase();
     if label.is_empty() || label.len() > 50 {
         return Err(AppError::BadRequest("label must be 1–50 characters".into()));
     }
@@ -32,17 +33,6 @@ fn canonicalize_label(raw: &str) -> std::result::Result<String, AppError> {
             "label must contain only alphanumeric characters, hyphens, and colons".into(),
         ));
     }
-    Ok(label)
-}
-
-/// POST /api/v1/repos/:owner/:repo/labels
-pub async fn add_label(
-    State(state): State<AppState>,
-    Extension(auth): Extension<AuthenticatedDid>,
-    Path((owner, name)): Path<(String, String)>,
-    Json(req): Json<LabelRequest>,
-) -> Result<(StatusCode, Json<serde_json::Value>)> {
-    let label = canonicalize_label(&req.label)?;
 
     let record = state
         .db
@@ -69,8 +59,6 @@ pub async fn remove_label(
     Extension(auth): Extension<AuthenticatedDid>,
     Path((owner, name, label)): Path<(String, String, String)>,
 ) -> Result<Json<serde_json::Value>> {
-    let label = canonicalize_label(&label)?;
-
     let record = state
         .db
         .get_repo(&owner, &name)
@@ -78,10 +66,7 @@ pub async fn remove_label(
         .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{name}")))?;
     crate::api::require_repo_owner(&record, &auth.0)?;
 
-    let removed = state.db.remove_label(&record.id, &label).await?;
-    if !removed {
-        return Err(AppError::NotFound(format!("label '{label}'")));
-    }
+    state.db.remove_label(&record.id, &label).await?;
     Ok(Json(serde_json::json!({ "label": label, "removed": true })))
 }
 

crates/gitlawb-node/src/api/mod.rs

@@ -92,25 +92,6 @@ pub(crate) fn require_repo_owner(record: &RepoRecord, caller: &str) -> Result<()
     }
 }
 
-/// Validate a branch name using the configured git binary (storage boundaries).
-pub(crate) fn validate_git_ref_with_git(
-    git_bin: &str,
-    name: &str,
-) -> std::result::Result<(), crate::git::store::GitRefValidationError> {
-    crate::git::store::validate_git_ref_with_git(git_bin, name)
-}
-
-/// Map ref-validation failures to the correct HTTP surface: malformed caller
-/// input stays 400; an inability to run git stays on the git/server-error path.
-pub(crate) fn map_git_ref_validation_error(
-    err: crate::git::store::GitRefValidationError,
-) -> AppError {
-    match err {
-        crate::git::store::GitRefValidationError::Invalid(msg) => AppError::BadRequest(msg),
-        crate::git::store::GitRefValidationError::GitUnavailable(msg) => AppError::Git(msg),
-    }
-}
-
 #[cfg(test)]
 mod did_tests {
     use super::did_matches;
@@ -298,573 +279,6 @@ mod authz_guard {
         }
     }
 
-    /// Completeness fence over the GraphQL mutation surface: the mirror of
-    /// `every_in_scope_mutation_has_its_gate` for `graphql/mutation.rs`. Kept a
-    /// SEPARATE guard with its own table (never folded into the REST rows above):
-    /// a guard over a heterogeneous set must classify per member, and these
-    /// same-named task rows belong to the GraphQL surface, not `api/tasks.rs`.
-    ///
-    /// COMPLETENESS comes from the engine's own SDL (`schema.sdl()`), parsed as a
-    /// structured AST (#219), NOT introspection and NOT a text parse of source.
-    /// This matters: async-graphql OMITS `#[graphql(visible = false)]` fields from
-    /// introspection while leaving them executable, so an introspection-sourced fence
-    /// could be defeated by a hidden mutation. SDL includes those fields, so no
-    /// visibility flag (and, via the AST parse, no brace-in-description quirk) can hide
-    /// a live mutation. The SDL field set must equal the registered set: a new field with
-    /// no row fails (a repo-write cannot slip in unlisted); a registered name absent from
-    /// the schema fails (renamed or removed). The set is also cross-checked against
-    /// introspection, so any field present in SDL but hidden from introspection fails
-    /// named as a forbidden hidden mutation.
-    ///
-    /// The MARKER check is the only source-scraped part, and it is not the
-    /// completeness guarantee. Three honest limits, so a green check is not misread
-    /// as full authorization coverage:
-    ///   1. A present marker is not load-bearingness (the gate may not redden on a
-    ///      hostile probe: the #203 present-but-vacuous case). The adversarial tests
-    ///      in `graphql/mutation.rs` are the load-bearing layer.
-    ///   2. A present marker is not gate-correctness (it may be the wrong bucket for
-    ///      the operation's resource: a repo-write registered as signer-self would
-    ///      pass, so INV-1 review remains the defense).
-    ///   3. The marker check scrapes the comment-masked, brace-bounded resolver body;
-    ///      a `{`/`}` or a `did_matches(` inside a STRING literal is not masked, so it
-    ///      could mis-slice that body or satisfy the marker vacuously (the same
-    ///      vacuous-marker class as limit 1). Completeness is unaffected: it comes
-    ///      from the SDL AST, not from this scrape.
-    #[test]
-    fn every_graphql_mutation_has_its_gate() {
-        // (Rust snake name, schema field in camelCase, expected gate markers). The
-        // four are Bucket C signer-self: `/graphql` uses optional_signature, so each
-        // resolver must call `require_signer(ctx)?` and bind the acting DID with
-        // `did_matches(`. A repo-write would be Bucket A (`require_repo_owner(`).
-        // Same-named REST rows live in the guard above against `api/tasks.rs`.
-        let registered: &[(&str, &str, &[&str])] = &[
-            (
-                "create_task",
-                "createTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "claim_task",
-                "claimTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "complete_task",
-                "completeTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-            (
-                "fail_task",
-                "failTask",
-                &["require_signer(ctx)?", "did_matches("],
-            ),
-        ];
-
-        // Completeness + hidden-mutation cross-check against the REAL schema (#219),
-        // delegated to the generic `assert_mutation_fence` so the SDL sourcing and the
-        // cross-check are ALSO exercised by a synthetic hidden schema in
-        // `fence_rejects_a_hidden_mutation` (INV-21). Because the real MutationRoot has no
-        // hidden field today, that synthetic test — not a hypothetical production canary —
-        // is what turns reverting the SDL source or deleting the cross-check RED.
-        {
-            use crate::graphql::mutation::MutationRoot;
-            use crate::graphql::query::QueryRoot;
-            use crate::graphql::subscription::SubscriptionRoot;
-            let schema =
-                async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
-            let registered_camel: Vec<&str> = registered.iter().map(|(_, c, _)| *c).collect();
-            assert_mutation_fence(&schema, &registered_camel);
-        }
-
-        // Marker present (source scrape; the vacuity limit, backstopped by the
-        // adversarial tests): each resolver body carries every required gate marker.
-        let masked = mask_comments(include_str!("../graphql/mutation.rs"));
-        for (snake, _, markers) in registered {
-            let body = resolver_body(&masked, snake);
-            for marker in *markers {
-                assert!(
-                    body.contains(marker),
-                    "GraphQL mutation `{snake}` is missing its gate marker `{marker}`: gate removed"
-                );
-            }
-        }
-    }
-
-    /// Version-safety self-check (#219, INV-21): the fence's completeness guarantee rests
-    /// on `schema.sdl()` INCLUDING `visible = false` fields while introspection omits
-    /// them. That is observed async-graphql behavior, not a documented contract, so pin
-    /// it here: a synthetic schema with a hidden mutation must have that field in its
-    /// SDL-derived set and NOT in its introspection-derived set. If a future
-    /// async-graphql upgrade ever filters SDL by visibility, the first assertion flips
-    /// RED — the assumption is load-bearing, not trusted.
-    #[test]
-    fn sdl_source_sees_hidden_mutations_that_introspection_omits() {
-        use async_graphql::{EmptySubscription, Object, Schema};
-        struct Q;
-        #[Object]
-        impl Q {
-            async fn ping(&self) -> i32 {
-                0
-            }
-        }
-        struct M;
-        #[Object]
-        impl M {
-            async fn visible_mut(&self) -> i32 {
-                1
-            }
-            #[graphql(visible = false)]
-            async fn hidden_mut(&self) -> i32 {
-                2
-            }
-        }
-        let schema = Schema::build(Q, M, EmptySubscription).finish();
-
-        // SDL source (the fix): includes the hidden field.
-        let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
-        assert!(
-            sdl_fields.iter().any(|f| f == "hiddenMut"),
-            "SDL-sourced set MUST include the visible=false mutation; if this is RED, \
-             async-graphql started filtering SDL by visibility and the fence's \
-             completeness guarantee is broken: {sdl_fields:?}"
-        );
-
-        // Introspection (the fence's own helper): OMITS the hidden field. This is the
-        // exact gap the fix closes — an introspection-sourced fence never sees `hiddenMut`.
-        let introspected = introspection_mutation_fields(&schema);
-        assert!(
-            !introspected.iter().any(|f| f == "hiddenMut"),
-            "introspection is expected to OMIT the visible=false mutation (that is the \
-             gap the SDL source closes); got {introspected:?}"
-        );
-
-        // The exact diff the fence computes: hidden ∈ (sdl \ introspection).
-        let hidden: Vec<&String> = sdl_fields
-            .iter()
-            .filter(|f| !introspected.iter().any(|i| i == *f))
-            .collect();
-        assert_eq!(
-            hidden,
-            vec!["hiddenMut"],
-            "the SDL-vs-introspection diff must surface exactly the hidden mutation"
-        );
-    }
-
-    /// INV-21 wiring guard (#219): drives the generic `assert_mutation_fence` — the SAME
-    /// helper the real fence calls — against a synthetic schema whose mutation is
-    /// `visible = false` and IS registered, so completeness passes and ONLY the
-    /// hidden-from-introspection cross-check can fail. This is what makes the fence's SDL
-    /// sourcing load-bearing without a production canary: reverting the source to
-    /// introspection (the hidden field then absent from the SDL set) or deleting the
-    /// cross-check removes this panic (or changes its message), turning the
-    /// `should_panic` test RED. The real MutationRoot has no hidden field, so nothing on
-    /// the real schema could catch that regression.
-    #[test]
-    #[should_panic(expected = "hidden from introspection")]
-    fn fence_rejects_a_hidden_mutation() {
-        use async_graphql::{EmptySubscription, Object, Schema};
-        struct Q;
-        #[Object]
-        impl Q {
-            async fn ping(&self) -> i32 {
-                0
-            }
-        }
-        struct M;
-        #[Object]
-        impl M {
-            async fn visible_mut(&self) -> i32 {
-                1
-            }
-            #[graphql(visible = false)]
-            async fn hidden_mut(&self) -> i32 {
-                2
-            }
-        }
-        let schema = Schema::build(Q, M, EmptySubscription).finish();
-        // Both fields registered, so completeness passes and only the cross-check fires.
-        assert_mutation_fence(&schema, &["visibleMut", "hiddenMut"]);
-    }
-
-    /// Deprecated-mutation guard (#219): a `#[graphql(deprecation = "...")]` mutation is
-    /// executable and present in SDL, but GraphQL introspection omits it by default. The
-    /// fence's introspection helper uses `includeDeprecated: true`, so a deprecated (but
-    /// visible) mutation is NOT mistaken for a hidden one. With it registered, the fence
-    /// must NOT panic. Remove `includeDeprecated: true` and this goes RED — the deprecated
-    /// field would look hidden and false-red as a forbidden visible=false mutation.
-    #[test]
-    fn fence_admits_a_deprecated_mutation() {
-        use async_graphql::{EmptySubscription, Object, Schema};
-        struct Q;
-        #[Object]
-        impl Q {
-            async fn ping(&self) -> i32 {
-                0
-            }
-        }
-        struct M;
-        #[Object]
-        impl M {
-            async fn visible_mut(&self) -> i32 {
-                1
-            }
-            #[graphql(deprecation = "use visibleMut")]
-            async fn deprecated_mut(&self) -> i32 {
-                2
-            }
-        }
-        let schema = Schema::build(Q, M, EmptySubscription).finish();
-        // Must not panic: the deprecated field is visible (present in introspection with
-        // includeDeprecated) and registered, so it is neither hidden nor unclassified.
-        assert_mutation_fence(&schema, &["visibleMut", "deprecatedMut"]);
-    }
-
-    /// Completeness + hidden-mutation cross-check for a BUILT schema (#219). Generic over
-    /// the schema type so the real fence AND the synthetic `fence_rejects_a_hidden_mutation`
-    /// / `fence_admits_a_deprecated_mutation` tests drive the SAME sourcing and cross-check.
-    /// Completeness is sourced from SDL (which includes `visible = false` fields); the
-    /// cross-check fails any SDL field hidden from introspection. This genericity is the
-    /// INV-21 fix: because the real MutationRoot has no hidden field, only a synthetic
-    /// hidden schema through THIS helper makes reverting the SDL source or removing the
-    /// cross-check RED, rather than leaving the class latent behind a production canary.
-    fn assert_mutation_fence<Q, M, S>(
-        schema: &async_graphql::Schema<Q, M, S>,
-        registered_camel: &[&str],
-    ) where
-        Q: async_graphql::ObjectType + 'static,
-        M: async_graphql::ObjectType + 'static,
-        S: async_graphql::SubscriptionType + 'static,
-    {
-        let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
-        let introspected = introspection_mutation_fields(schema);
-        // No SDL field may be hidden from introspection (a visible=false mutation).
-        for f in &sdl_fields {
-            assert!(
-                introspected.iter().any(|i| i == f),
-                "GraphQL mutation `{f}` is in the schema but hidden from introspection \
-                 (a `#[graphql(visible = false)]` field): hidden mutations are forbidden \
-                 by this fence — make it visible so its classification is enforceable, or \
-                 remove it"
-            );
-        }
-        // Completeness both directions against the registered (camelCase) set.
-        for f in &sdl_fields {
-            assert!(
-                registered_camel.contains(&f.as_str()),
-                "unclassified GraphQL mutation `{f}`: add it to \
-                 every_graphql_mutation_has_its_gate with a deliberate gate \
-                 (`require_repo_owner(` for a repo-write, `did_matches(` for a task op)"
-            );
-        }
-        for c in registered_camel {
-            assert!(
-                sdl_fields.iter().any(|f| f == c),
-                "registered GraphQL mutation `{c}` is not in the schema \
-                 (renamed or removed); update the table"
-            );
-        }
-    }
-
-    /// The mutation field names via the engine's introspection, run against a passed
-    /// schema. STRUCTURED (names arrive as data). Uses `fields(includeDeprecated: true)`:
-    /// GraphQL's default omits `@deprecated` fields, but a `#[graphql(deprecation = "...")]`
-    /// mutation is still executable and present in SDL, so without this the cross-check
-    /// above would false-red a deprecated mutation as a hidden (visible=false) one. Only a
-    /// real visibility filter should trip that arm; deprecation is a lifecycle marker.
-    fn introspection_mutation_fields<Q, M, S>(
-        schema: &async_graphql::Schema<Q, M, S>,
-    ) -> Vec<String>
-    where
-        Q: async_graphql::ObjectType + 'static,
-        M: async_graphql::ObjectType + 'static,
-        S: async_graphql::SubscriptionType + 'static,
-    {
-        use async_graphql::Value;
-        let resp = tokio::runtime::Runtime::new()
-            .expect("tokio runtime")
-            .block_on(schema.execute(
-                "{ __schema { mutationType { fields(includeDeprecated: true) { name } } } }",
-            ));
-        assert!(
-            resp.errors.is_empty(),
-            "schema introspection failed: {:?}",
-            resp.errors
-        );
-        let mut names = Vec::new();
-        if let Value::Object(root) = &resp.data {
-            if let Some(Value::Object(sc)) = root.get("__schema") {
-                if let Some(Value::Object(mt)) = sc.get("mutationType") {
-                    if let Some(Value::List(field_list)) = mt.get("fields") {
-                        for field in field_list {
-                            if let Value::Object(fo) = field {
-                                if let Some(Value::String(n)) = fo.get("name") {
-                                    names.push(n.clone());
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        names
-    }
-
-    /// The mutation field names sourced from the built schema's SDL — the completeness
-    /// source (#219). Builds the same DB-free schema as the introspection helper and runs
-    /// its `.sdl()` (sync, no runtime needed) through [`mutation_field_names_from_sdl`].
-    /// SDL includes `#[graphql(visible = false)]` fields, so this source cannot be
-    /// defeated by hiding a mutation from introspection.
-    fn graphql_mutation_fields_from_sdl() -> Vec<String> {
-        use crate::graphql::mutation::MutationRoot;
-        use crate::graphql::query::QueryRoot;
-        use crate::graphql::subscription::SubscriptionRoot;
-        let schema =
-            async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
-        mutation_field_names_from_sdl(&schema.sdl())
-    }
-
-    /// The mutation type's field names extracted from an async-graphql SDL string via
-    /// the engine's OWN parser AST (`async_graphql::parser::parse_schema`), NOT
-    /// introspection. This is the completeness source (#219): unlike introspection,
-    /// which async-graphql filters by `visible` (a `#[graphql(visible = false)]`
-    /// mutation is executable but ABSENT from introspection), `schema.sdl()` includes
-    /// every registered field, so a hidden mutation still appears here and must carry a
-    /// classified row. Parsing the AST (not a brace/line text scan) means a `}` inside a
-    /// field description cannot mis-slice the type block. camelCase, as async-graphql
-    /// emits. An empty result on a navigation miss is safe: the set-equality in
-    /// `every_graphql_mutation_has_its_gate` turns "no fields" into a loud failure for
-    /// every registered name, never a vacuous pass.
-    fn mutation_field_names_from_sdl(sdl: &str) -> Vec<String> {
-        use async_graphql::parser::parse_schema;
-        use async_graphql::parser::types::{TypeKind, TypeSystemDefinition};
-
-        let doc = parse_schema(sdl).expect("async-graphql SDL must parse");
-        // The mutation root type name: from the `schema { mutation: X }` block if
-        // present, else the GraphQL default "Mutation".
-        let mutation_type = doc
-            .definitions
-            .iter()
-            .find_map(|def| match def {
-                TypeSystemDefinition::Schema(s) => s
-                    .node
-                    .mutation
-                    .as_ref()
-                    .map(|m| m.node.as_str().to_string()),
-                _ => None,
-            })
-            .unwrap_or_else(|| "Mutation".to_string());
-        // The fields of that object type.
-        doc.definitions
-            .iter()
-            .find_map(|def| match def {
-                TypeSystemDefinition::Type(t) if t.node.name.node.as_str() == mutation_type => {
-                    match &t.node.kind {
-                        TypeKind::Object(obj) => Some(
-                            obj.fields
-                                .iter()
-                                .map(|f| f.node.name.node.as_str().to_string())
-                                .collect::<Vec<_>>(),
-                        ),
-                        _ => None,
-                    }
-                }
-                _ => None,
-            })
-            .unwrap_or_default()
-    }
-
-    #[test]
-    fn sdl_extractor_includes_a_hidden_visible_false_field() {
-        // A field that would be hidden from introspection must still be listed from SDL.
-        let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
-                   type QueryRoot { ping: Int! }\n\
-                   type MutationRoot { createTask: Int! hiddenMut: Int! }\n";
-        let fields = mutation_field_names_from_sdl(sdl);
-        assert!(
-            fields.iter().any(|f| f == "createTask"),
-            "visible field must be listed: {fields:?}"
-        );
-        assert!(
-            fields.iter().any(|f| f == "hiddenMut"),
-            "a visible=false field (present in SDL, hidden from introspection) MUST be \
-             listed by the completeness source: {fields:?}"
-        );
-    }
-
-    #[test]
-    fn sdl_extractor_is_not_fooled_by_a_brace_in_a_field_description() {
-        // A `}` inside a field description must not truncate the type block (the AST
-        // parse is immune to the text-parse quirk the old design feared).
-        let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
-                   type QueryRoot { ping: Int! }\n\
-                   type MutationRoot {\n\
-                     \"\"\"a description with a } brace and { another\"\"\"\n\
-                     createTask: Int!\n\
-                     claimTask: Int!\n\
-                   }\n";
-        let fields = mutation_field_names_from_sdl(sdl);
-        assert!(
-            fields.iter().any(|f| f == "createTask") && fields.iter().any(|f| f == "claimTask"),
-            "both fields must be extracted despite a brace in a description: {fields:?}"
-        );
-    }
-
-    #[test]
-    fn sdl_extractor_returns_empty_for_a_query_only_schema() {
-        let sdl = "schema { query: QueryRoot }\ntype QueryRoot { ping: Int! }\n";
-        assert!(
-            mutation_field_names_from_sdl(sdl).is_empty(),
-            "a schema with no mutation root yields no mutation fields (no panic)"
-        );
-    }
-
-    /// The comment-masked body of `async fn <snake>` in `graphql/mutation.rs`, bounded
-    /// to the resolver's OWN braces (its `{ .. }`), for the marker check. Brace-matching
-    /// on the comment-masked source means a `}` in a trailing helper cannot extend the
-    /// body and a comment marker does not count. A `{`/`}` inside a STRING literal is
-    /// not masked, a documented marker-check-only residual (limit 3); completeness does
-    /// not use this.
-    fn resolver_body(masked_src: &str, snake: &str) -> String {
-        let needle = format!("async fn {snake}(");
-        let start = masked_src.find(&needle).unwrap_or_else(|| {
-            panic!("resolver `async fn {snake}(` not found in graphql/mutation.rs")
-        });
-        let open = start
-            + masked_src[start..]
-                .find('{')
-                .expect("resolver body opening brace");
-        let mut depth = 0i32;
-        let mut end = masked_src.len();
-        for (i, c) in masked_src[open..].char_indices() {
-            match c {
-                '{' => depth += 1,
-                '}' => {
-                    depth -= 1;
-                    if depth == 0 {
-                        end = open + i + 1;
-                        break;
-                    }
-                }
-                _ => {}
-            }
-        }
-        masked_src[open..end].to_string()
-    }
-
-    /// `src` with `//` line comments and `/* */` block comments (nested) blanked to
-    /// spaces, WITHOUT opening a comment inside a `"..."` string (so a `"https://"` does
-    /// not erase the rest of its line). String CONTENTS are left intact, so a brace or
-    /// a gate marker inside a string is not masked; for the marker check that is a
-    /// documented vacuity residual (limit 3), and completeness does not use this at
-    /// all. Char literals and raw/byte strings are not tracked (absent in resolver
-    /// bodies); a `'"'` char or a raw string is the remaining narrow residual.
-    fn mask_comments(src: &str) -> String {
-        let chars: Vec<char> = src.chars().collect();
-        let mut out = String::with_capacity(src.len());
-        let mut i = 0;
-        let mut block_depth = 0usize;
-        let mut in_string = false;
-        while i < chars.len() {
-            let c = chars[i];
-            let next = chars.get(i + 1).copied();
-            if block_depth > 0 {
-                if c == '/' && next == Some('*') {
-                    block_depth += 1;
-                    out.push_str("  ");
-                    i += 2;
-                } else if c == '*' && next == Some('/') {
-                    block_depth -= 1;
-                    out.push_str("  ");
-                    i += 2;
-                } else {
-                    out.push(if c == '\n' { '\n' } else { ' ' });
-                    i += 1;
-                }
-            } else if in_string {
-                out.push(c);
-                if c == '\\' {
-                    if let Some(n) = next {
-                        out.push(n);
-                        i += 2;
-                    } else {
-                        i += 1;
-                    }
-                } else {
-                    if c == '"' {
-                        in_string = false;
-                    }
-                    i += 1;
-                }
-            } else if c == '"' {
-                in_string = true;
-                out.push('"');
-                i += 1;
-            } else if c == '/' && next == Some('/') {
-                while i < chars.len() && chars[i] != '\n' {
-                    out.push(' ');
-                    i += 1;
-                }
-            } else if c == '/' && next == Some('*') {
-                block_depth = 1;
-                out.push_str("  ");
-                i += 2;
-            } else {
-                out.push(c);
-                i += 1;
-            }
-        }
-        out
-    }
-
-    /// The SDL field set (the completeness source of truth, #219) is exactly the
-    /// registered mutations. If async-graphql adds or renames a field, this reddens
-    /// and forces the `every_graphql_mutation_has_its_gate` table to be updated. Uses
-    /// SDL, not introspection: introspection omits `visible = false` fields, so an
-    /// introspection-based pin here would go green while a hidden mutation existed.
-    #[test]
-    fn schema_lists_exactly_the_registered_mutations() {
-        let mut fields = graphql_mutation_fields_from_sdl();
-        fields.sort();
-        assert_eq!(
-            fields,
-            vec!["claimTask", "completeTask", "createTask", "failTask"],
-            "the SDL mutation field set is the authoritative discovered set"
-        );
-    }
-
-    /// The marker check is bounded to a resolver's OWN body and is comment- and
-    /// string-aware: a `//` inside a `"https://"` string does not erase a real gate on
-    /// that line (no false-red), and a trailing module helper's `did_matches(` does not
-    /// rescue a resolver whose own gate was removed (no false-green).
-    #[test]
-    fn resolver_body_is_bounded_and_comment_and_string_aware() {
-        let src = "\
-impl MutationRoot {
-    async fn ok(&self) -> Result<u32> {
-        let _ = (\"see https://x/y\", did_matches(a, b)); // URL string then gate, one line
-        Ok(0)
-    }
-    async fn last(&self) -> Result<u32> {
-        // did_matches( only in a comment
-        Ok(0)
-    }
-}
-fn helper() { let _ = did_matches(z, z); }
-#[cfg(test)]
-mod tests { async fn t() { let _ = did_matches(x, y); } }
-";
-        let masked = mask_comments(src);
-        assert!(
-            resolver_body(&masked, "ok").contains("did_matches("),
-            "a `//` inside a string must not erase the real gate on that line"
-        );
-        assert!(
-            !resolver_body(&masked, "last").contains("did_matches("),
-            "the marker check must be bounded to the resolver's own body (a trailing \
-             helper's marker must not rescue a resolver whose gate was removed)"
-        );
-    }
-
     /// Proves the comment-stripping that GUARD-1 added: a marker that appears only
     /// in a full-line comment (the real `replicas.rs` false-pass shape) must NOT
     /// satisfy a row.

crates/gitlawb-node/src/api/peers.rs

@@ -118,11 +118,11 @@ pub fn is_public_http_url(raw: &str) -> bool {
         Some(h) => h.to_ascii_lowercase(),
         None => return false,
     };
-    // Drop trailing dots (FQDN root): `localhost.` resolves the same as
+    // Drop a single trailing dot (FQDN root): `localhost.` resolves the same as
     // `localhost`, so normalize before the suffix/equality checks below.
-    // Strip to fixation rather than once, or `localhost..` reduces to
-    // `localhost.` and matches neither the equality nor the suffix check.
-    host.truncate(host.trim_end_matches('.').len());
+    if let Some(stripped) = host.strip_suffix('.') {
+        host = stripped.to_string();
+    }
     if host.is_empty()
         || host == "localhost"
         || host.ends_with(".local")
@@ -167,13 +167,8 @@ pub fn is_public_http_url(raw: &str) -> bool {
             }
             std::net::IpAddr::V6(v6) => {
                 let s = v6.segments();
-                // fc00::/7 (unique-local), fe80::/10 (link-local), or fec0::/10
-                // (site-local, deprecated by RFC 3879 and so never a legitimate
-                // peer address, but still routable on networks that kept it).
-                if (s[0] & 0xfe00) == 0xfc00
-                    || (s[0] & 0xffc0) == 0xfe80
-                    || (s[0] & 0xffc0) == 0xfec0
-                {
+                // fc00::/7 (unique-local) or fe80::/10 (link-local)
+                if (s[0] & 0xfe00) == 0xfc00 || (s[0] & 0xffc0) == 0xfe80 {
                     return false;
                 }
                 // Any NAT64 address (64:ff9b::/32) that is not the cleanly
@@ -188,13 +183,6 @@ pub fn is_public_http_url(raw: &str) -> bool {
                 }
             }
         }
-    } else if !host.contains('.') {
-        // A name with no dot at all. The `.local` / `.internal` rules above are
-        // suffix checks, so a single label slips both, and the resolver decides
-        // what it means by appending a search domain we cannot see from here.
-        // Only reachable when the host did not parse as an IP literal, which is
-        // what keeps bracketed IPv6 (also dotless) on the accepting path.
-        return false;
     }
     true
 }
@@ -532,7 +520,7 @@ mod tests {
 
     #[test]
     fn accepts_public_https_and_http() {
-        assert!(is_public_http_url("https://node.twigpine.com"));
+        assert!(is_public_http_url("https://node.gitlawb.com"));
         assert!(is_public_http_url("https://manila.gitlawb.com/"));
         assert!(is_public_http_url("http://203.0.113.10:7545"));
     }
@@ -556,7 +544,7 @@ mod tests {
             "http://[::1]:7545",
             "http://gitlawb-node.internal:7545",
             "http://my-node.local/",
-            "ftp://node.twigpine.com",
+            "ftp://node.gitlawb.com",
             "not-a-url",
             "",
             // Trailing-dot FQDN of an internal host.
@@ -589,46 +577,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn rejects_dotless_single_label_hosts() {
-        // `.local` and `.internal` are suffix checks, so a name with no dot at
-        // all never matches one. A single-label name is completed by whatever
-        // search domain the resolver is configured with, which is not a
-        // destination we can reason about from the URL.
-        for bad in [
-            "http://local/",
-            "http://internal/",
-            "http://intranet/",
-            "http://wpad/",
-            "http://metadata/",
-            "http://local./",
-            "http://internal.:7545",
-        ] {
-            assert!(!is_public_http_url(bad), "{bad:?} must be rejected");
-        }
-    }
-
-    #[test]
-    fn rejects_deprecated_site_local_v6() {
-        // fec0::/10, deprecated by RFC 3879. The link-local mask (0xffc0 ==
-        // 0xfe80) does not cover it: 0xfec0 & 0xffc0 is 0xfec0.
-        for bad in ["http://[fec0::1]/", "http://[feff:ffff::1]:7545"] {
-            assert!(!is_public_http_url(bad), "{bad:?} must be rejected");
-        }
-    }
-
-    #[test]
-    fn rejects_repeated_trailing_root_dots() {
-        // Stripping a single root dot leaves `localhost.`, which matches
-        // neither the equality nor the suffix check. The subdomain form
-        // (`node.localhost..`) is not asserted here: `.localhost` is not yet a
-        // rejected suffix on this base, so that case belongs to whichever
-        // change adds it rather than to this one.
-        for bad in ["http://localhost../", "http://localhost...:7545"] {
-            assert!(!is_public_http_url(bad), "{bad:?} must be rejected");
-        }
-    }
-
     #[test]
     fn accepts_6to4_and_nat64_wrapping_public_v4() {
         // Fold-and-recheck stays consistent with the mapped/compatible handling:

crates/gitlawb-node/src/api/pulls.rs

@@ -50,17 +50,6 @@ pub async fn create_pr(
     let target_branch = req
         .target_branch
         .unwrap_or_else(|| record.default_branch.clone());
-
-    // Validate both refs before they are stored, since both are later
-    // interpolated into git argv (git diff / worktree add / merge). Validate the
-    // RESOLVED target, not just a caller-supplied one: create_repo also gates
-    // default_branch, but validating here as well means a PR can never feed the
-    // git sink an unchecked ref even if a default was poisoned by an older row
-    // or a future path that skips create_repo's gate.
-    crate::api::validate_git_ref_with_git(&state.git_bin, &req.source_branch)
-        .map_err(crate::api::map_git_ref_validation_error)?;
-    crate::api::validate_git_ref_with_git(&state.git_bin, &target_branch)
-        .map_err(crate::api::map_git_ref_validation_error)?;
     let number = state.db.next_pr_number(&record.id).await?;
     let now = Utc::now().to_rfc3339();
 

crates/gitlawb-node/src/api/replicas.rs

@@ -39,11 +39,11 @@ pub async fn register_replica(
 ) -> Result<(StatusCode, Json<serde_json::Value>)> {
     validate_replica_url(&req.url)?;
 
-    // The mutation response carries repo metadata (name, replica count), so
-    // registration applies the same read-visibility decision as the listing:
-    // a caller who may not read the repo gets the same 404 as a missing one.
-    let (record, _rules) =
-        crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
+    let record = state
+        .db
+        .get_repo(&owner, &repo)
+        .await?
+        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
 
     let replica_did = &auth.0;
 
@@ -93,10 +93,11 @@ pub async fn unregister_replica(
     Extension(auth): Extension<AuthenticatedDid>,
     Path((owner, repo)): Path<(String, String)>,
 ) -> Result<Json<serde_json::Value>> {
-    // Same gate as register_replica: removal mutates repo-scoped metadata and
-    // its response discloses the replica count.
-    let (record, _rules) =
-        crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
+    let record = state
+        .db
+        .get_repo(&owner, &repo)
+        .await?
+        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
 
     let replica_did = &auth.0;
     state.db.unregister_replica(&record.id, replica_did).await?;

crates/gitlawb-node/src/api/resolve.rs

@@ -1,4 +1,4 @@
-//! DID resolution — look up a node by its Twigpine DID.
+//! DID resolution — look up a node by its gitlawb DID.
 //!
 //! First checks the local peers table (HTTP-layer peer discovery),
 //! then queries the Kademlia DHT via the libp2p swarm.
@@ -14,7 +14,7 @@ use crate::state::AppState;
 
 /// GET /api/v1/resolve/{did}
 ///
-/// Resolves a Twigpine DID to an HTTP URL and p2p multiaddr.
+/// Resolves a gitlawb DID to an HTTP URL and p2p multiaddr.
 /// Checks local peer cache first, then falls back to Kademlia DHT lookup.
 pub async fn resolve_did(
     State(state): State<AppState>,

crates/gitlawb-node/src/arweave_v2.rs

@@ -1,62 +0,0 @@
-//! #26 Split PR 2 — three-outcome recovery policy types.
-//!
-//! This module owns the recovery classification policy the reviewer
-//! demanded: only a trustworthy, protocol-defined absence authorizes
-//! a paid re-upload. Everything else stays non-terminal.
-//!
-//! Deliberately narrow: the ANS-104 codec lives in `ans104`, and the
-//! gateway probe, the `verify_anchor` path, and the public verify
-//! endpoint are deferred until the uploader, retrieval proof, and
-//! recovery consumer can be proven as one vertical slice (reviewer 2,
-//! round 5). A probe against a real provider contract — same-network
-//! upload/read pair, redirect-safe client, envelope-supplying read
-//! API, provider-documented absence evidence — belongs in that slice,
-//! not here. What ships here is the policy type plus the rule that
-//! only `DefinitivelyAbsent` permits spending another upload.
-
-/// Outcome of a gateway probe for a persisted `item_id`.
-// Policy surface for the recovery slice: no construction on this
-// head (the probe arrives with the provider contract); the unit
-// test pins the rule meanwhile.
-#[allow(dead_code)]
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ProbeOutcome {
-    /// The persisted item was served back with a verifiable envelope
-    /// bound to the requested id. No re-upload allowed.
-    Present,
-    /// Trustworthy, protocol-defined proof the item was never
-    /// accepted. Authorizes re-upload. The exact evidence that
-    /// establishes this is defined by the provider contract in the
-    /// vertical slice that introduces the probe — never by a
-    /// mock-only body shape.
-    DefinitivelyAbsent,
-    /// Anything else: transport failure, oversized body, bad
-    /// signature, id mismatch, ambiguous gateway response. The
-    /// outbox stays non-terminal.
-    Indeterminate,
-}
-
-impl ProbeOutcome {
-    /// True iff the recovery code is allowed to spend another paid
-    /// upload request. Only `DefinitivelyAbsent` qualifies.
-    #[allow(dead_code)] // the recovery consumer lives in a later slice
-    pub fn permits_reupload(self) -> bool {
-        matches!(self, ProbeOutcome::DefinitivelyAbsent)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Only `DefinitivelyAbsent` authorizes a paid re-upload. This is
-    /// the policy the reviewer named: collapsing any ambiguous outcome
-    /// to absent spends a second immutable upload for the same
-    /// transition.
-    #[test]
-    fn only_definitively_absent_authorizes_reupload() {
-        assert!(!ProbeOutcome::Present.permits_reupload());
-        assert!(ProbeOutcome::DefinitivelyAbsent.permits_reupload());
-        assert!(!ProbeOutcome::Indeterminate.permits_reupload());
-    }
-}

crates/gitlawb-node/src/auth/mod.rs

@@ -34,38 +34,6 @@ use gitlawb_core::http_sig::{
 };
 use gitlawb_core::identity::verify;
 
-/// Per-route-group ceiling on how much request body [`require_signature`] will
-/// buffer BEFORE it has authenticated anything.
-///
-/// This is middleware state rather than a constant because a single number cannot
-/// serve both a 2 GB git push and a 2 MB profile update: the git write group
-/// passes `GITLAWB_MAX_PACK_BYTES`, every other signed group passes
-/// [`crate::server::SIGNED_BODY_LIMIT`]. Making it a required piece of state means
-/// a new signed route group cannot be wired up without choosing a limit.
-#[derive(Clone, Copy, Debug)]
-pub struct SignatureBodyLimit(pub usize);
-
-/// The hint for an unresolvable DID, chosen by method. The hint is only true
-/// for a method we have no resolver for: a did:key that parsed and then failed
-/// on its key material (a small-order key, wrong multicodec, wrong length)
-/// would be sent looking for the wrong problem by the alpha-support wording.
-fn unresolvable_did_hint(key_id: &Did) -> &'static str {
-    if key_id.is_did_key() {
-        "the DID is a did:key whose key material did not resolve"
-    } else {
-        "only did:key is supported in alpha"
-    }
-}
-
-/// Bound the echoed keyid in the unresolvable-DID message. `key_id` is
-/// unauthenticated request input, so reflecting it back at whatever length the
-/// caller chose would amplify attacker input into the response body. The bound
-/// is slack (a did:key method-id is a fixed 48 characters) and only defends
-/// the echo, not the resolution.
-fn bounded_did_echo(key_id: &str) -> String {
-    key_id.chars().take(96).collect()
-}
-
 /// Axum middleware that enforces HTTP Signature authentication (RFC 9421).
 ///
 /// Every write request must carry:
@@ -80,52 +48,20 @@ fn bounded_did_echo(key_id: &str) -> String {
 ///   4. Resolves the did:key to an Ed25519 VerifyingKey
 ///   5. Rebuilds the signing string and verifies the Ed25519 signature
 ///   6. Verifies Content-Digest matches the request body
-pub async fn require_signature(
-    State(SignatureBodyLimit(limit)): State<SignatureBodyLimit>,
-    request: Request,
-    next: Next,
-) -> Response {
-    verify_signature(limit, request, next).await
-}
-
-/// The signature check itself, shared by [`require_signature`] and the optional
-/// variant. `limit` bounds the pre-auth buffer; see [`SignatureBodyLimit`].
-async fn verify_signature(limit: usize, request: Request, next: Next) -> Response {
-    // Buffer the body so we can verify content-digest and pass it downstream.
-    //
-    // The buffer is bounded, because this runs BEFORE any identity check: an
-    // unauthenticated caller with no DID, no signature and no repo reaches this
-    // line. Nothing upstream supplies the bound. On the git write routes
-    // `RequestBodyLimitLayer` sits on the inner router, and a later `.layer()` is
-    // the OUTER service, so this middleware runs first and sees the raw body. On
-    // every other signed group axum's 2 MB `DefaultBodyLimit` is enforced by the
-    // `Bytes`/`Json` extractors through a request extension, which collecting the
-    // body here bypasses. `Limited` stops reading at the limit rather than reading
-    // everything and then measuring it, which is the property that matters.
+pub async fn require_signature(request: Request, next: Next) -> Response {
+    // Buffer the body so we can verify content-digest and pass it downstream
     let (parts, body) = request.into_parts();
-    let body_bytes = match http_body_util::Limited::new(body, limit).collect().await {
-        Ok(collected) => collected.to_bytes(),
-        // Over the limit: a distinct status from the 401 an unsigned request gets
-        // and the 400 below, so a client can tell "too big" from "not authenticated"
-        // and from "your body did not arrive".
-        Err(e) if e.is::<http_body_util::LengthLimitError>() => return (
-            StatusCode::PAYLOAD_TOO_LARGE,
-            Json(json!({
-                "error": "body_too_large",
-                "message": format!("request body exceeds the {limit}-byte limit for this route"),
-            })),
-        )
-            .into_response(),
-        Err(_) => {
-            return (
+    let body_bytes =
+        match body.collect().await {
+            Ok(collected) => collected.to_bytes(),
+            Err(_) => return (
                 StatusCode::BAD_REQUEST,
                 Json(
                     json!({ "error": "unreadable_body", "message": "could not read request body" }),
                 ),
             )
-                .into_response()
-        }
-    };
+                .into_response(),
+        };
 
     let sig_input = parts
         .headers
@@ -184,7 +120,7 @@ async fn verify_signature(limit: usize, request: Request, next: Next) -> Respons
                     COVERED_COMPONENTS.join(", "),
                     missing.join(", ")
                 ),
-                "hint": "See https://twigpine.com/agents#authentication",
+                "hint": "See https://gitlawb.com/agents#authentication",
             })),
         )
             .into_response();
@@ -209,14 +145,11 @@ async fn verify_signature(limit: usize, request: Request, next: Next) -> Respons
                 StatusCode::BAD_REQUEST,
                 Json(json!({
                     "error": "unresolvable_did",
-                    "message": format!(
-                        "cannot resolve DID '{}': {e}",
-                        bounded_did_echo(&sig.key_id.to_string())
-                    ),
-                    "hint": unresolvable_did_hint(&sig.key_id),
+                    "message": format!("cannot resolve DID '{}': {e}", sig.key_id),
+                    "hint": "only did:key is supported in alpha",
                 })),
             )
-                .into_response();
+                .into_response()
         }
     };
 
@@ -229,34 +162,17 @@ async fn verify_signature(limit: usize, request: Request, next: Next) -> Respons
         .unwrap_or("/")
         .to_string();
 
-    // Required, never defaulted. The signing string is rebuilt from the request,
-    // so an absent header would make the covered `content-digest` empty on both
-    // sides: verification would pass and the digest-versus-body comparison below
-    // would have nothing to compare, leaving a signed request free to carry a
-    // body its signature never covered. `sign_request` always emits the header,
-    // so refusing here costs no conforming client anything.
-    let content_digest = match parts
+    let content_digest = parts
         .headers
         .get("content-digest")
         .and_then(|v| v.to_str().ok())
-    {
-        Some(v) => v.to_string(),
-        None => {
-            return (
-                StatusCode::BAD_REQUEST,
-                Json(json!({
-                    "error": "missing_content_digest",
-                    "message": "Content-Digest header is required on a signed request",
-                })),
-            )
-                .into_response()
-        }
-    };
+        .unwrap_or("")
+        .to_string();
 
     let mut request_values: HashMap<String, String> = HashMap::new();
     request_values.insert("@method".to_string(), method);
     request_values.insert("@path".to_string(), path_and_query);
-    request_values.insert("content-digest".to_string(), content_digest.clone());
+    request_values.insert("content-digest".to_string(), content_digest);
 
     // The @signature-params value is the part of Signature-Input after "sig1="
     let sig_params_value = sig_input.strip_prefix("sig1=").unwrap_or(&sig_input);
@@ -301,18 +217,23 @@ async fn verify_signature(limit: usize, request: Request, next: Next) -> Respons
             .into_response();
     }
 
-    // Verify Content-Digest matches the actual request body. Unconditional: the
-    // header's presence was established above, so there is no branch here that
-    // skips the comparison.
-    if content_digest != compute_content_digest(&body_bytes) {
-        return (
-            StatusCode::BAD_REQUEST,
-            Json(json!({
-                "error": "content_digest_mismatch",
-                "message": "Content-Digest does not match request body",
-            })),
-        )
-            .into_response();
+    // Verify Content-Digest matches the actual request body
+    if let Some(claimed) = parts
+        .headers
+        .get("content-digest")
+        .and_then(|v| v.to_str().ok())
+    {
+        let actual = compute_content_digest(&body_bytes);
+        if claimed != actual {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(json!({
+                    "error": "content_digest_mismatch",
+                    "message": "Content-Digest does not match request body",
+                })),
+            )
+                .into_response();
+        }
     }
 
     tracing::info!(did = %sig.key_id, "✓ authenticated request");
@@ -327,17 +248,11 @@ async fn verify_signature(limit: usize, request: Request, next: Next) -> Respons
 /// Optional variant for rolling upgrades: verify and inject `AuthenticatedDid` when
 /// RFC 9421 signature headers are present, but allow legacy unsigned requests to
 /// continue when no signature attempt was made.
-pub async fn optional_signature(
-    State(SignatureBodyLimit(limit)): State<SignatureBodyLimit>,
-    request: Request,
-    next: Next,
-) -> Response {
+pub async fn optional_signature(request: Request, next: Next) -> Response {
     let has_signature_headers = request.headers().contains_key("signature-input")
         || request.headers().contains_key("signature");
     if has_signature_headers {
-        // Same pre-auth buffer, same bound: presenting signature headers is not
-        // authentication, so this path is as reachable as the required one.
-        return verify_signature(limit, request, next).await;
+        return require_signature(request, next).await;
     }
     next.run(request).await
 }
@@ -465,7 +380,7 @@ fn human_detected(message: &str) -> impl IntoResponse {
             "error": "not_an_agent",
             "message": message,
             "hint": "gl identity new && gl register",
-            "docs": "https://twigpine.com/agents",
+            "docs": "https://gitlawb.com/agents",
         })),
     )
 }
@@ -508,58 +423,6 @@ mod tests {
         assert!(validate_ucan_chain(&token, &node_did, &agent_did).is_ok());
     }
 
-    /// The two-branch hint selection is the point of the unresolvable-DID
-    /// change: a did:key that failed on its key material must be told the key
-    /// material did not resolve, and any other method must be told only did:key
-    /// is supported. A regression that drops the is_did_key() check would send
-    /// a did:key caller after the wrong problem, so both branches are pinned.
-    #[test]
-    fn unresolvable_did_hint_distinguishes_key_material_from_method() {
-        // A real did:key whose key material fails to resolve (small-order):
-        // key-material hint.
-        let mut weak = [0u8; 32];
-        weak[0] = 1; // compressed identity point
-        let weak_vk = ed25519_dalek::VerifyingKey::from_bytes(&weak).unwrap();
-        let weak_did = Did::from_verifying_key(&weak_vk);
-        assert!(
-            weak_did.to_verifying_key().is_err(),
-            "fixture precondition: small-order did:key must not resolve"
-        );
-        assert_eq!(
-            unresolvable_did_hint(&weak_did),
-            "the DID is a did:key whose key material did not resolve"
-        );
-
-        // A method with no resolver: alpha-support hint.
-        let web = Did::web("example.com");
-        assert!(
-            web.to_verifying_key().is_err(),
-            "fixture precondition: did:web must not resolve locally"
-        );
-        assert_eq!(
-            unresolvable_did_hint(&web),
-            "only did:key is supported in alpha"
-        );
-    }
-
-    /// The unresolvable-DID message echoes the keyid, which is unauthenticated
-    /// request input. The echoed value must be bounded so a hostile caller
-    /// cannot amplify arbitrary-length input into the response body.
-    #[test]
-    fn unresolvable_did_message_bounds_the_echoed_keyid() {
-        let long_keyid = format!("did:key:z{}", "A".repeat(2000));
-        let shown = bounded_did_echo(&long_keyid);
-        assert!(
-            shown.len() <= 96,
-            "echoed keyid must be bounded, got {} chars",
-            shown.len()
-        );
-        assert!(
-            !shown.contains(&"A".repeat(1000)),
-            "the full keyid must not survive into the message"
-        );
-    }
-
     #[test]
     fn validate_ucan_chain_wrong_issuer() {
         let node = Keypair::generate();
@@ -774,78 +637,4 @@ mod tests {
         let body_json: serde_json::Value = serde_json::from_slice(&body_bytes).unwrap();
         assert_eq!(body_json["error"], "invalid_ucan");
     }
-
-    /// A request that signs `content-digest` as the EMPTY string and then sends
-    /// no Content-Digest header at all must be refused before any handler runs.
-    ///
-    /// This is the whole point of requiring the header rather than defaulting it:
-    /// the middleware rebuilds the signing string from the request, so an absent
-    /// header makes the covered digest empty on both sides. The Ed25519 check
-    /// passes, the body-versus-digest comparison is skipped for want of a header,
-    /// and a signed request carries a body the signature never covered.
-    #[tokio::test]
-    async fn signed_request_without_content_digest_is_rejected() {
-        use base64::{engine::general_purpose::STANDARD, Engine};
-        use std::sync::atomic::{AtomicBool, Ordering};
-
-        static REACHED: AtomicBool = AtomicBool::new(false);
-
-        let kp = Keypair::generate();
-        let did = kp.did();
-        let created = chrono::Utc::now().timestamp();
-        let signature_input = format!(
-            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created={created}"#
-        );
-        let sig_params_value = &signature_input["sig1=".len()..];
-
-        let mut values: HashMap<String, String> = HashMap::new();
-        values.insert("@method".to_string(), "POST".to_string());
-        values.insert("@path".to_string(), "/x".to_string());
-        // Exactly what the middleware derives when the header is absent.
-        values.insert("content-digest".to_string(), String::new());
-        let signing_string =
-            build_signing_string(COVERED_COMPONENTS, sig_params_value, &values).unwrap();
-        let signature = format!(
-            "sig1=:{}:",
-            STANDARD.encode(kp.sign(signing_string.as_bytes()).to_bytes())
-        );
-
-        let app = Router::new()
-            .route(
-                "/x",
-                axum::routing::post(|| async {
-                    REACHED.store(true, Ordering::SeqCst);
-                    StatusCode::OK
-                }),
-            )
-            .layer(middleware::from_fn_with_state(
-                SignatureBodyLimit(crate::server::SIGNED_BODY_LIMIT),
-                require_signature,
-            ));
-
-        let req = Request::builder()
-            .method("POST")
-            .uri("/x")
-            .header("signature-input", signature_input)
-            .header("signature", signature)
-            .body(Body::from("a body no signature covers"))
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(
-            resp.status(),
-            StatusCode::BAD_REQUEST,
-            "a signed request with no Content-Digest header must be refused"
-        );
-        let bytes = axum::body::to_bytes(resp.into_body(), 2048).await.unwrap();
-        let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
-        assert_eq!(
-            body["error"], "missing_content_digest",
-            "the refusal must name the absent Content-Digest header"
-        );
-        assert!(
-            !REACHED.load(Ordering::SeqCst),
-            "the handler must never see a request whose body no signature covers"
-        );
-    }
 }

crates/gitlawb-node/src/bootstrap.rs

@@ -1,4 +1,4 @@
-//! Embedded seed list of public Twigpine network nodes.
+//! Embedded seed list of public Gitlawb network nodes.
 //!
 //! This module parses `bootstrap-peers.json` (embedded at compile time) and
 //! merges its contents into the runtime config so a fresh `docker compose up`

crates/gitlawb-node/src/config.rs

@@ -1,5 +1,5 @@
 use clap::Parser;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 /// Upper bound on `git_service_timeout_secs`, `ipfs_request_budget_secs`, and
 /// `ipfs_resolve_budget_secs`, in seconds (100 years).
@@ -29,7 +29,7 @@ use std::path::{Path, PathBuf};
 pub const GIT_SERVICE_TIMEOUT_SECS_MAX: u64 = 100 * 365 * 24 * 60 * 60;
 
 #[derive(Parser, Debug, Clone)]
-#[command(name = "gitlawb-node", about = "Twigpine node daemon", version)]
+#[command(name = "gitlawb-node", about = "gitlawb node daemon", version)]
 pub struct Config {
     /// Directory where bare git repositories are stored
     #[arg(long, env = "GITLAWB_REPOS_DIR", default_value = "./data/repos")]
@@ -55,10 +55,7 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_KEY", default_value = "~/.gitlawb/identity.pem")]
     pub key_path: String,
 
-    /// Reserved and currently inert: read access is enforced per repository
-    /// through `is_public` and path-scoped visibility rules, not this flag.
-    /// Setting it to false changes nothing; make a repo private through its
-    /// own visibility instead.
+    /// Reserved for private-read mode; per-repo read enforcement is not wired in alpha
     #[arg(long, env = "GITLAWB_PUBLIC_READ", default_value_t = true)]
     pub public_read: bool,
 
@@ -70,9 +67,7 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_BOOTSTRAP_PEERS", value_delimiter = ',')]
     pub bootstrap_peers: Vec<String>,
 
-    /// Require a peer write to prove its DID on any transport: RFC 9421
-    /// signatures on the peer announce/sync write routes, and a payload
-    /// signature on gossip ref-update events.
+    /// Require RFC 9421 signatures on peer announce/sync write routes.
     /// Keep false during rolling upgrades so existing live nodes can still gossip.
     #[arg(
         long,
@@ -125,18 +120,6 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_P2P_PORT", default_value_t = 7546)]
     pub p2p_port: u16,
 
-    /// Path to the persistent libp2p identity key. A value that cannot name a
-    /// securable key file (a bare filename, `..` traversal, a trailing
-    /// separator, the filesystem root, or a `~/` path that escapes home) is
-    /// refused before the node binds. A problem with the storage itself leaves
-    /// p2p off while HTTP keeps serving, logged as p2p_identity_key_load_failed.
-    /// With a relative path the node verifies the working directory (ownership
-    /// and write permissions) before using it. A 0755 key directory is tightened
-    /// on start; rotate the key only if the directory was group/world-writable
-    /// or the key was group/world-readable.
-    #[arg(long, env = "GITLAWB_P2P_KEY", default_value = "~/.gitlawb/p2p.key")]
-    pub p2p_key_path: String,
-
     /// libp2p bootstrap multiaddrs (comma-separated)
     /// Example: /ip4/1.2.3.4/udp/7546/quic-v1/p2p/12D3KooW...
     #[arg(long, env = "GITLAWB_P2P_BOOTSTRAP", value_delimiter = ',')]
@@ -766,29 +749,13 @@ impl Config {
     /// Resolve ~ in key_path
     pub fn resolved_key_path(&self) -> PathBuf {
         if self.key_path.starts_with("~/") {
-            let suffix = &self.key_path[2..];
-            if !crate::p2p::tilde_suffix_escapes_home(suffix) {
-                if let Some(home) = dirs_next::home_dir() {
-                    return home.join(suffix);
-                }
+            if let Some(home) = dirs_next::home_dir() {
+                return home.join(&self.key_path[2..]);
             }
         }
         PathBuf::from(&self.key_path)
     }
 
-    /// Resolve ~ in p2p_key_path
-    pub fn resolved_p2p_key_path(&self) -> PathBuf {
-        if self.p2p_key_path.starts_with("~/") {
-            let suffix = &self.p2p_key_path[2..];
-            if !crate::p2p::tilde_suffix_escapes_home(suffix) {
-                if let Some(home) = dirs_next::home_dir() {
-                    return home.join(suffix);
-                }
-            }
-        }
-        PathBuf::from(&self.p2p_key_path)
-    }
-
     /// DB connections reserved for everything other than held write-locks: auth
     /// lookups, visibility-rule reads, the post-receive tail's own DB writes, and
     /// admin tooling. A write pins one pooled connection for its whole duration, so
@@ -828,98 +795,6 @@ impl Config {
                 self.db_max_connections, main_floor
             ));
         }
-
-        // Identity is always loaded, so a directory-valued or escaping spelling
-        // is boot-fatal here. Bare `identity.pem` stays legal; the p2p "must
-        // include a dedicated directory" rule is not imported.
-        if self.key_path.starts_with("~/") {
-            let suffix = &self.key_path[2..];
-            if crate::p2p::tilde_suffix_escapes_home(suffix) {
-                return Err(format!(
-                    "GITLAWB_KEY ({}) must stay inside the home directory after `~/` \
-                     expansion; rooted suffixes such as `~//etc/identity.pem`, drive-prefixed \
-                     suffixes, and `..` traversal are refused",
-                    self.key_path
-                ));
-            }
-        }
-        let identity_key_path = self.resolved_key_path();
-        if self.key_path.starts_with("~/") && identity_key_path == Path::new(&self.key_path) {
-            return Err(format!(
-                "GITLAWB_KEY ({}) starts with `~/` but no home directory could be resolved, \
-                 so it would name a literal `~` directory relative to the working directory. \
-                 Set an absolute path such as /data/keys/identity.pem.",
-                self.key_path
-            ));
-        }
-        if crate::p2p::path_denotes_a_directory(&identity_key_path, Some(&self.key_path))
-            || identity_key_path
-                .components()
-                .any(|c| matches!(c, std::path::Component::ParentDir))
-        {
-            return Err(format!(
-                "GITLAWB_KEY ({}) must name a key file, not a directory; a trailing separator, \
-                 a final `.` or `..` component, and `..` traversal are refused so the path \
-                 cannot retarget a parent",
-                self.key_path
-            ));
-        }
-
-        // P2P is optional: an HTTP-only node with GITLAWB_P2P_PORT=0 never loads
-        // or creates this key, so refusing startup on an unused path would be a
-        // silent outage with no security benefit.
-        if self.p2p_port > 0 {
-            // A p2p key path naming no directory puts the node's private key in
-            // whatever directory the process was started from. The node cannot
-            // protect that: `ensure_key_dir` would have to chmod a directory the
-            // operator never nominated as a key directory, and a directory it
-            // cannot secure is one where any local user with write access can
-            // replace the key and choose the node's libp2p identity. Refuse it here,
-            // where the denial actually stops the process, rather than in the p2p
-            // start path, where main.rs logs the error and keeps serving with a
-            // green /health.
-            //
-            // Decided lexically on the resolved path: `canonicalize` would fail on a
-            // parent that does not exist yet (the shipped `~/.gitlawb` default, and
-            // every container's first boot), and comparing against the process
-            // working directory would reject `/data/p2p.key` under the image's
-            // WORKDIR, an absolute directory the operator did name.
-            // `resolved_p2p_key_path` expands a leading `~/` only when a home
-            // directory is resolvable, and otherwise hands back the literal string.
-            // That would leave the shipped default naming a directory called `~`
-            // relative to wherever the process started, which is a real directory
-            // the node would create and chmod, and whose location moves with the
-            // working directory. It passes the check below because `~` is an
-            // ordinary path component, so it has to be caught separately.
-            if self.p2p_key_path.starts_with("~/") {
-                let suffix = &self.p2p_key_path[2..];
-                if crate::p2p::tilde_suffix_escapes_home(suffix) {
-                    return Err(format!(
-                        "GITLAWB_P2P_KEY ({}) must stay inside the home directory after `~/` \
-                         expansion; rooted suffixes such as `~//etc/p2p.key`, drive-prefixed \
-                         suffixes, and `..` traversal are refused",
-                        self.p2p_key_path
-                    ));
-                }
-            }
-            let p2p_key_path = self.resolved_p2p_key_path();
-            if self.p2p_key_path.starts_with("~/") && p2p_key_path == Path::new(&self.p2p_key_path)
-            {
-                return Err(format!(
-                    "GITLAWB_P2P_KEY ({}) starts with `~/` but no home directory could be resolved, \
-                     so it would name a literal `~` directory relative to the working directory. \
-                     Set an absolute path such as /data/keys/p2p.key.",
-                    self.p2p_key_path
-                ));
-            }
-            // Lexical only: this runs before the listener binds and its
-            // failure stops the node, so it must not decide anything about
-            // live filesystem objects. Storage faults belong to the load path,
-            // which degrades instead of exiting.
-            let _ = crate::p2p::validate_p2p_key_config(&p2p_key_path, Some(&self.p2p_key_path))
-                .map_err(|e| e.to_string())?;
-        }
-
         Ok(())
     }
 }
@@ -1637,28 +1512,6 @@ mod tests {
         );
     }
 
-    /// #338: GITLAWB_PUBLIC_READ is inert, so its help must not claim read
-    /// enforcement is missing; it must tell the operator the flag changes
-    /// nothing and where the real control lives.
-    #[test]
-    fn public_read_help_describes_the_flag_as_inert() {
-        use clap::CommandFactory;
-        let cmd = Config::command();
-        let arg = cmd
-            .get_arguments()
-            .find(|a| a.get_id() == "public_read")
-            .expect("the argument must exist");
-        let help = arg.get_help().map(|h| h.to_string()).unwrap_or_default();
-        assert!(
-            !help.contains("not wired"),
-            "the help still claims read enforcement is unwired: {help}"
-        );
-        assert!(
-            help.contains("inert"),
-            "the help must say the flag is inert so an operator does not rely on it: {help}"
-        );
-    }
-
     /// The flip must not strand an operator mid-upgrade.
     ///
     /// Turning the gate on is a breaking change for any deployment whose pushers are
@@ -1682,519 +1535,4 @@ mod tests {
             Config::parse_from(["gitlawb-node", "--enforce-owner-push", "true"]).enforce_owner_push
         );
     }
-
-    fn config_with_p2p_key(path: &str) -> Config {
-        Config::parse_from(["gitlawb-node", "--p2p-key-path", path])
-    }
-
-    fn config_with_key(path: &str) -> Config {
-        Config::parse_from(["gitlawb-node", "--key-path", path])
-    }
-
-    fn config_with_p2p_port_and_key(port: u16, path: &str) -> Config {
-        Config::parse_from([
-            "gitlawb-node",
-            "--p2p-port",
-            &port.to_string(),
-            "--p2p-key-path",
-            path,
-        ])
-    }
-
-    /// The configuration half of the key-storage contract matrix: enabled
-    /// versus disabled p2p, crossed with the path spellings the contract
-    /// rules on. The filesystem-object half (which objects at and around the
-    /// key path boot or are refused) lives in `p2p::tests::
-    /// p2p_key_storage_contract_matrix`; nothing there runs unless this gate
-    /// lets a config through.
-    ///
-    /// Rule 1 is proven through its own rejections: every disabled row uses a
-    /// path that an enabled row shows to be invalid, so `Ok` on the disabled
-    /// row is direct evidence the validator never resolved or inspected the
-    /// unused key storage.
-    #[test]
-    fn p2p_key_storage_contract_config_matrix() {
-        enum Expect {
-            Accepted,
-            Rejected(&'static str),
-        }
-
-        struct Row {
-            port: u16,
-            path: &'static str,
-            expect: Expect,
-            /// Skip when no home directory resolves: the row's outcome is
-            /// about `~/` expansion, which then legitimately fails earlier
-            /// with the no-home error instead.
-            needs_home: bool,
-        }
-
-        let rows = [
-            // Rule 1: disabled p2p leaves its unused key storage alone.
-            Row {
-                port: 0,
-                path: "p2p.key",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 0,
-                path: "~/",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 0,
-                path: "~//etc/p2p.key",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 0,
-                path: "~/../etc/p2p.key",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 0,
-                path: "",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            // Enabled: ordinary absolute and home-relative paths pass, a
-            // doubled separator in an absolute path is harmless (it does not
-            // re-root anything), and the shipped default resolves beneath
-            // home (asserted separately below).
-            Row {
-                port: 7546,
-                path: "/data/keys/p2p.key",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "/data//keys/p2p.key",
-                expect: Expect::Accepted,
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "~/.gitlawb/p2p.key",
-                expect: Expect::Accepted,
-                needs_home: true,
-            },
-            // Rule 2: a `~/` suffix that would re-root or walk out of home is
-            // refused at parse time, before any join. These fire whether or
-            // not a home directory resolves, because the suffix is judged
-            // before expansion.
-            Row {
-                port: 7546,
-                path: "~//etc/p2p.key",
-                expect: Expect::Rejected("inside the home directory"),
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "~/../etc/p2p.key",
-                expect: Expect::Rejected("inside the home directory"),
-                needs_home: false,
-            },
-            // Rule 3's lexical pre-checks, still gated on the port.
-            Row {
-                port: 7546,
-                path: "p2p.key",
-                expect: Expect::Rejected("directory"),
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "~/",
-                expect: Expect::Rejected("must name a key file"),
-                needs_home: true,
-            },
-            Row {
-                port: 7546,
-                path: "/data/keys/.",
-                expect: Expect::Rejected("must name a key file"),
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "/data/keys/./.",
-                expect: Expect::Rejected("must name a key file"),
-                needs_home: false,
-            },
-            Row {
-                port: 7546,
-                path: "~/.gitlawb/.",
-                expect: Expect::Rejected("must name a key file"),
-                needs_home: true,
-            },
-        ];
-
-        let have_home = dirs_next::home_dir().is_some();
-        for row in rows {
-            if row.needs_home && !have_home {
-                continue;
-            }
-            let result = config_with_p2p_port_and_key(row.port, row.path).validate();
-            match row.expect {
-                Expect::Accepted => assert!(
-                    result.is_ok(),
-                    "[port={} path={:?}] must be accepted, got: {result:?}",
-                    row.port,
-                    row.path
-                ),
-                Expect::Rejected(needle) => {
-                    let err = result.expect_err(&format!(
-                        "[port={} path={:?}] must be rejected",
-                        row.port, row.path
-                    ));
-                    assert!(
-                        err.contains(needle),
-                        "[port={} path={:?}] rejection must mention {needle:?}, got: {err}",
-                        row.port,
-                        row.path
-                    );
-                }
-            }
-        }
-    }
-
-    /// Rule 1's absence-of-IO half against a real on-disk trap: a disabled
-    /// node pointed at a key path whose parent is a symlink — a shape the
-    /// enabled path refuses and must never chmod — validates clean and leaves
-    /// the trap directory exactly as it was.
-    #[cfg(unix)]
-    #[test]
-    fn p2p_disabled_key_storage_is_never_inspected_or_mutated() {
-        use std::os::unix::fs::PermissionsExt;
-
-        let base = tempfile::tempdir().unwrap();
-        let target = base.path().join("real");
-        std::fs::create_dir(&target).unwrap();
-        std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let link = base.path().join("keys");
-        std::os::unix::fs::symlink(&target, &link).unwrap();
-        let key_path = link.join("p2p.key");
-
-        let config = Config::parse_from([
-            "gitlawb-node",
-            "--p2p-port",
-            "0",
-            "--p2p-key-path",
-            key_path.to_str().unwrap(),
-        ]);
-        assert!(
-            config.validate().is_ok(),
-            "a disabled node must not validate the unused key path"
-        );
-
-        let mode = std::fs::metadata(&target).unwrap().permissions().mode() & 0o777;
-        assert_eq!(mode, 0o755, "the symlink target's mode must stay unchanged");
-        assert_eq!(
-            std::fs::read_dir(&target).unwrap().count(),
-            0,
-            "nothing may be created behind the symlink"
-        );
-    }
-
-    /// The other half of the scoping pair: p2p ENABLED, hostile resource on
-    /// disk, and `validate` still passes.
-    ///
-    /// This is the finding-2 boundary. A symlinked parent, a regular file
-    /// where the key directory should be, and an unreadable parent are live
-    /// storage facts, not properties of the configured value, so they belong
-    /// to the load path, which degrades. Deciding them here made the node exit
-    /// before binding for exactly the cases README and `.env.example` promise
-    /// leave HTTP up. Each row also proves validate touched nothing: an
-    /// inspection is still an observation, and the port-zero test above is the
-    /// disabled half of the same pair.
-    #[cfg(unix)]
-    #[test]
-    fn enabled_p2p_does_not_treat_live_storage_faults_as_configuration_errors() {
-        use std::os::unix::fs::PermissionsExt;
-
-        fn snapshot(root: &std::path::Path) -> Vec<String> {
-            let mut out = Vec::new();
-            if let Ok(entries) = std::fs::read_dir(root) {
-                for e in entries.flatten() {
-                    let md = std::fs::symlink_metadata(e.path()).unwrap();
-                    out.push(format!(
-                        "{} dir={} link={} mode={:04o}",
-                        e.path().display(),
-                        md.is_dir(),
-                        md.is_symlink(),
-                        md.permissions().mode() & 0o7777
-                    ));
-                }
-            }
-            out.sort();
-            out
-        }
-
-        /// Builds a trap under `base` and returns the key path inside it.
-        type BuildTrap = Box<dyn Fn(&std::path::Path) -> std::path::PathBuf>;
-
-        // (label, build the trap, the key path inside it)
-        let cases: Vec<(&str, BuildTrap)> = vec![
-            (
-                "symlinked parent",
-                Box::new(|base: &std::path::Path| {
-                    let target = base.join("real");
-                    std::fs::create_dir(&target).unwrap();
-                    let link = base.join("keys");
-                    std::os::unix::fs::symlink(&target, &link).unwrap();
-                    link.join("p2p.key")
-                }),
-            ),
-            (
-                "regular file as the key directory",
-                Box::new(|base: &std::path::Path| {
-                    let file = base.join("keys");
-                    std::fs::write(&file, b"not a directory").unwrap();
-                    file.join("p2p.key")
-                }),
-            ),
-            (
-                "unreadable parent",
-                Box::new(|base: &std::path::Path| {
-                    let locked = base.join("locked");
-                    std::fs::create_dir(&locked).unwrap();
-                    std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o000))
-                        .unwrap();
-                    locked.join("keys").join("p2p.key")
-                }),
-            ),
-        ];
-
-        for (label, build) in cases {
-            let base = tempfile::tempdir().unwrap();
-            let key_path = build(base.path());
-            let before = snapshot(base.path());
-
-            let config = Config::parse_from([
-                "gitlawb-node",
-                "--p2p-port",
-                "7546",
-                "--p2p-key-path",
-                key_path.to_str().unwrap(),
-            ]);
-            let verdict = config.validate();
-            assert!(
-                verdict.is_ok(),
-                "{label}: a live storage fault is not a configuration error, got: {verdict:?}"
-            );
-            assert_eq!(
-                snapshot(base.path()),
-                before,
-                "{label}: validation must not mutate the key tree"
-            );
-
-            // Leave the tempdir removable.
-            let locked = base.path().join("locked");
-            if locked.exists() {
-                let _ = std::fs::set_permissions(&locked, std::fs::Permissions::from_mode(0o700));
-            }
-        }
-    }
-
-    /// Rule 2's positive direction: the shipped `~/` default resolves to a
-    /// path beneath the selected home, and suffixes that would escape are
-    /// left unexpanded (and then rejected by `validate`, as the matrix above
-    /// asserts) rather than joined and repaired after.
-    #[test]
-    fn p2p_tilde_expansion_stays_beneath_home() {
-        let Some(home) = dirs_next::home_dir() else {
-            return;
-        };
-
-        let resolved = config_with_p2p_key("~/.gitlawb/p2p.key").resolved_p2p_key_path();
-        assert!(
-            resolved.starts_with(&home),
-            "the resolved default must stay beneath home"
-        );
-        assert!(
-            resolved.ends_with(".gitlawb/p2p.key"),
-            "the resolved default must keep the configured suffix"
-        );
-
-        for path in ["~//etc/p2p.key", "~/../etc/p2p.key"] {
-            assert_eq!(
-                config_with_p2p_key(path).resolved_p2p_key_path(),
-                Path::new(path),
-                "an escaping suffix must never be joined onto home"
-            );
-        }
-    }
-
-    /// A p2p key path that names no directory component would put the node's
-    /// private key in whatever directory the process happens to be started from,
-    /// which `ensure_key_dir` cannot protect without tightening a directory the
-    /// operator never nominated. Reject it at boot instead.
-    #[test]
-    fn p2p_key_path_without_a_directory_component_is_rejected() {
-        for path in [
-            // No directory component at all.
-            "p2p.key",
-            "./p2p.key",
-            "././p2p.key",
-            "p2p.key/",
-            "",
-            // Looks like it names a directory and does not: each of these
-            // resolves back to the working directory or above it, so accepting
-            // them would defeat the check and chmod an unnominated directory.
-            "a/../p2p.key",
-            "./keys/../p2p.key",
-            "../p2p.key",
-            // Absolute too: the lexical parent is what gets chmodded, so these
-            // would tighten /data and / rather than the named directory.
-            "/data/keys/../p2p.key",
-            "/data/../p2p.key",
-        ] {
-            let err = config_with_p2p_key(path)
-                .validate()
-                .expect_err(&format!("{path:?} names no directory and must be rejected"));
-            assert!(
-                err.contains("directory"),
-                "{path:?} must be rejected for naming no directory, got: {err}"
-            );
-        }
-    }
-
-    /// The mirror of the above, and the case that stops the predicate widening
-    /// into "reject every relative path". The shipped default is included on
-    /// purpose: a predicate that rejects it is a boot failure for every node.
-    #[test]
-    fn p2p_key_path_naming_a_directory_is_accepted() {
-        for path in [
-            "keys/p2p.key",
-            "./keys/p2p.key",
-            "/data/keys/p2p.key",
-            "/data/p2p.key",
-            "~/.gitlawb/p2p.key",
-        ] {
-            assert!(
-                config_with_p2p_key(path).validate().is_ok(),
-                "{path:?} names a directory and must be accepted"
-            );
-        }
-
-        Config::parse_from(["gitlawb-node"])
-            .validate()
-            .expect("the shipped default p2p key path must validate");
-    }
-
-    /// `~/` expands to the home directory itself, which is a directory rather
-    /// than a key file, so it must be rejected before its parent is chmodded.
-    #[test]
-    fn p2p_key_path_is_checked_after_tilde_expansion() {
-        if dirs_next::home_dir().is_none() {
-            panic!("this test needs a home directory to distinguish raw from resolved");
-        }
-        let err = config_with_p2p_key("~/")
-            .validate()
-            .expect_err("`~/` must name a key file, not a directory");
-        assert!(
-            err.contains("must name a key file"),
-            "`~/` must be rejected before chmodding its parent, got: {err}"
-        );
-    }
-
-    #[test]
-    fn p2p_key_path_trailing_directory_separator_is_rejected() {
-        let err = config_with_p2p_key("/data/keys/")
-            .validate()
-            .expect_err("a trailing directory separator must be rejected");
-        assert!(
-            err.contains("must name a key file"),
-            "trailing `/` must be rejected before chmod, got: {err}"
-        );
-    }
-
-    /// A terminal `.` is a directory-valued spelling. Rust's Path drops it, so
-    /// `/data/keys/.` would otherwise be stored as the file `keys` under `/data`.
-    #[test]
-    fn p2p_key_path_terminal_dot_is_rejected() {
-        for path in ["/data/keys/.", "/data/keys/./.", "/data/keys/.//."] {
-            let err = config_with_p2p_key(path)
-                .validate()
-                .expect_err("a terminal `.` must be rejected as a directory");
-            assert!(
-                err.contains("must name a key file"),
-                "{path:?} must be refused before Path can retarget it, got: {err}"
-            );
-        }
-    }
-
-    /// Identity allows a bare filename; it does not allow a directory spelling
-    /// that Path would retarget onto a parent.
-    #[test]
-    fn identity_key_path_terminal_dot_is_rejected() {
-        for path in ["/data/keys/.", "/data/keys/./.", "/data/keys/.//."] {
-            let err = config_with_key(path)
-                .validate()
-                .expect_err("a terminal `.` must be rejected as a directory");
-            assert!(
-                err.contains("GITLAWB_KEY") && err.contains("must name a key file"),
-                "{path:?} must be refused before Path can retarget it, got: {err}"
-            );
-        }
-    }
-
-    #[test]
-    fn identity_key_path_trailing_directory_separator_is_rejected() {
-        let err = config_with_key("/data/keys/")
-            .validate()
-            .expect_err("a trailing directory separator must be rejected");
-        assert!(
-            err.contains("must name a key file"),
-            "trailing `/` must be rejected, got: {err}"
-        );
-    }
-
-    #[test]
-    fn identity_key_path_tilde_directory_is_rejected() {
-        let err = config_with_key("~/")
-            .validate()
-            .expect_err("`~/` must name a key file, not a directory");
-        assert!(
-            err.contains("must name a key file"),
-            "`~/` must be rejected, got: {err}"
-        );
-    }
-
-    #[test]
-    fn identity_key_path_tilde_escape_is_rejected() {
-        let err = config_with_key("~//etc/identity.pem")
-            .validate()
-            .expect_err("a `~/` spelling that escapes home must be rejected");
-        assert!(
-            err.contains("must stay inside the home directory"),
-            "tilde escape must be refused, got: {err}"
-        );
-    }
-
-    #[test]
-    fn identity_key_path_parent_dir_component_is_rejected() {
-        let err = config_with_key("/data/keys/../identity.pem")
-            .validate()
-            .expect_err("`..` in an identity path must be rejected");
-        assert!(
-            err.contains("..") || err.contains("must name a key file"),
-            "`..` must be refused so the parent cannot retarget, got: {err}"
-        );
-    }
-
-    #[test]
-    fn identity_key_path_bare_filename_is_accepted() {
-        for path in ["identity.pem", "./identity.pem", "/identity.pem"] {
-            config_with_key(path)
-                .validate()
-                .unwrap_or_else(|e| panic!("{path:?} is a legal identity path, got: {e}"));
-        }
-        Config::parse_from(["gitlawb-node"])
-            .validate()
-            .expect("the shipped default identity path must validate");
-    }
 }

crates/gitlawb-node/src/db/mod.rs

@@ -1184,16 +1184,6 @@ const OWNER_KEY_CASE_SQL: &str = "CASE WHEN owner_did LIKE 'did:key:%' AND posit
 /// named `did` (like in agent_profiles) instead of `owner_did`.
 const PROFILE_DID_CASE_SQL: &str = "CASE WHEN did LIKE 'did:key:%' AND position(':' in substr(did, 9)) = 0 THEN substr(did, 9) ELSE did END";
 
-/// SQL CASE expression byte-identical to `normalize_owner_key`, but for columns
-/// named `repo_owner` (bounties table).  The bounties `repo_owner` is stored
-/// verbatim from the URL segment, so it may be either the full `did:key:` form
-/// or the bare key.
-const BOUNTY_OWNER_CASE_SQL: &str = "CASE WHEN repo_owner LIKE 'did:key:%' AND position(':' in substr(repo_owner, 9)) = 0 THEN substr(repo_owner, 9) ELSE repo_owner END";
-
-/// SQL CASE expression byte-identical to `normalize_owner_key`, but for columns
-/// named `claimant_did` (bounties table).
-const BOUNTY_CLAIMANT_CASE_SQL: &str = "CASE WHEN claimant_did LIKE 'did:key:%' AND position(':' in substr(claimant_did, 9)) = 0 THEN substr(claimant_did, 9) ELSE claimant_did END";
-
 #[cfg(test)]
 mod normalize_owner_key_tests {
     use super::normalize_owner_key;
@@ -2261,13 +2251,13 @@ impl Db {
         Ok(result.rows_affected() > 0)
     }
 
-    pub async fn remove_label(&self, repo_id: &str, label: &str) -> Result<bool> {
-        let result = sqlx::query("DELETE FROM repo_labels WHERE repo_id = $1 AND label = $2")
+    pub async fn remove_label(&self, repo_id: &str, label: &str) -> Result<()> {
+        sqlx::query("DELETE FROM repo_labels WHERE repo_id = $1 AND label = $2")
             .bind(repo_id)
             .bind(label)
             .execute(&self.pool)
             .await?;
-        Ok(result.rows_affected() > 0)
+        Ok(())
     }
 
     pub async fn list_labels(&self, repo_id: &str) -> Result<Vec<String>> {
@@ -2616,7 +2606,15 @@ impl Db {
             // The read-then-write race is benign: if a row appears in between,
             // this write becomes an UPDATE and the UnprovenRepoint guard below
             // still refuses any http_url change.
-            PeerWriteAuthority::Unproven if !self.peer_exists(did).await.unwrap_or(false) => {
+            PeerWriteAuthority::Unproven
+                if !sqlx::query_scalar::<_, bool>(
+                    "SELECT EXISTS(SELECT 1 FROM peers WHERE did = $1)",
+                )
+                .bind(did)
+                .fetch_one(&self.pool)
+                .await
+                .unwrap_or(false) =>
+            {
                 match did.parse::<gitlawb_core::did::Did>() {
                     // Only reachable from the bootstrap announce-back in main.rs,
                     // which passes the contacted peer's raw JSON string; the
@@ -2746,21 +2744,6 @@ impl Db {
         Ok(())
     }
 
-    /// Whether a DID has a row in `peers`, by keyed lookup.
-    ///
-    /// For callers that only need the membership answer. `list_peers` fetches
-    /// and materializes every row, so using it as a membership test on a hot
-    /// path (the gossip ingest gate) makes the cost of one event grow with the
-    /// size of the table.
-    pub async fn peer_exists(&self, did: &str) -> Result<bool> {
-        Ok(
-            sqlx::query_scalar::<_, bool>("SELECT EXISTS(SELECT 1 FROM peers WHERE did = $1)")
-                .bind(did)
-                .fetch_one(&self.pool)
-                .await?,
-        )
-    }
-
     pub async fn list_peers(&self) -> Result<Vec<PeerRecord>> {
         let rows = sqlx::query(
             "SELECT did, http_url, last_seen, last_ping_ok, announced_at
@@ -4579,110 +4562,31 @@ impl Db {
         Ok(())
     }
 
-    // ── Visibility-filtered bounty aggregates (#477) ─────────────────────
-
-    /// Count bounties by status, restricted to repos whose `(owner_did, name)`
-    /// pairs are in `visible`.  Owner keys are normalized on both sides so
-    /// `did:key:` and bare-key forms match.  An empty set returns 0.
-    pub async fn count_bounties_by_status_visible(
-        &self,
-        status: &str,
-        visible: &[(String, String)],
-    ) -> Result<i64> {
-        if visible.is_empty() {
-            return Ok(0);
-        }
-        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
-        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
-        let sql = format!(
-            "SELECT COUNT(*) as c FROM bounties b \
-             WHERE b.status = $1 \
-             AND EXISTS ( \
-                 SELECT 1 FROM unnest($2::text[], $3::text[]) AS v(o, n) \
-                 WHERE ({bounty_owner}) = v.o AND b.repo_name = v.n \
-             )",
-            bounty_owner = BOUNTY_OWNER_CASE_SQL,
-        );
-        let row = sqlx::query(&sql)
+    pub async fn count_bounties_by_status(&self, status: &str) -> Result<i64> {
+        let row = sqlx::query("SELECT COUNT(*) as c FROM bounties WHERE status = $1")
             .bind(status)
-            .bind(&owners)
-            .bind(&names)
             .fetch_one(&self.pool)
             .await?;
         Ok(row.get::<i64, _>("c"))
     }
 
-    /// Per-agent bounty stats restricted to visible repos.  `b.repo_owner` is
-    /// normalized and `b.claimant_did` is matched against both spellings of the
-    /// agent key, so `did:key:` and bare-key forms match.
-    pub async fn agent_bounty_stats_visible(
-        &self,
-        agent_did: &str,
-        visible: &[(String, String)],
-    ) -> Result<(i64, i64)> {
-        if visible.is_empty() {
-            return Ok((0, 0));
-        }
-        // Index-friendly form of `normalize(claimant_did) = N`: a claimant
-        // normalizes to N only when stored as N or as `did:key:N` (the latter
-        // only when N has no ':', else the prefix is not stripped). Matching
-        // the raw column keeps `idx_bounties_claimant` usable.
-        let normalized_agent = normalize_owner_key(agent_did);
-        let mut claimants: Vec<String> = vec![normalized_agent.to_string()];
-        if !normalized_agent.contains(':') {
-            claimants.push(format!("did:key:{normalized_agent}"));
-        }
-        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
-        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
-        let sql = format!(
-            "SELECT COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total FROM bounties b \
-             WHERE b.claimant_did = ANY($1::text[]) \
-             AND b.status = 'completed' \
-             AND EXISTS ( \
-                 SELECT 1 FROM unnest($2::text[], $3::text[]) AS v(o, n) \
-                 WHERE ({bounty_owner}) = v.o AND b.repo_name = v.n \
-             )",
-            bounty_owner = BOUNTY_OWNER_CASE_SQL,
-        );
-        let row = sqlx::query(&sql)
-            .bind(&claimants)
-            .bind(&owners)
-            .bind(&names)
-            .fetch_one(&self.pool)
-            .await?;
+    pub async fn agent_bounty_stats(&self, agent_did: &str) -> Result<(i64, i64)> {
+        let row = sqlx::query(
+            "SELECT COUNT(*) as cnt, COALESCE(SUM(amount),0) as total FROM bounties WHERE claimant_did = $1 AND status = 'completed'",
+        )
+        .bind(agent_did)
+        .fetch_one(&self.pool)
+        .await?;
         Ok((row.get::<i64, _>("cnt"), row.get::<i64, _>("total")))
     }
 
-    /// Leaderboard restricted to visible repos.  Owner and claimant keys are
-    /// normalized so `did:key:` and bare-key forms match and group together.
-    pub async fn bounty_leaderboard_visible(
-        &self,
-        limit: i64,
-        visible: &[(String, String)],
-    ) -> Result<Vec<(String, i64, i64)>> {
-        if visible.is_empty() {
-            return Ok(Vec::new());
-        }
-        let owners: Vec<String> = visible.iter().map(|(o, _)| o.clone()).collect();
-        let names: Vec<String> = visible.iter().map(|(_, n)| n.clone()).collect();
-        let sql = format!(
-            "SELECT MIN(claimant_did) as claimant_did, COUNT(*) as cnt, COALESCE(SUM(amount), 0)::BIGINT as total \
-             FROM bounties b \
-             WHERE b.status = 'completed' AND b.claimant_did IS NOT NULL \
-             AND EXISTS ( \
-                 SELECT 1 FROM unnest($1::text[], $2::text[]) AS v(o, n) \
-                 WHERE ({bounty_owner}) = v.o AND b.repo_name = v.n \
-             ) \
-             GROUP BY ({claimant_case}) ORDER BY total DESC LIMIT $3",
-            claimant_case = BOUNTY_CLAIMANT_CASE_SQL,
-            bounty_owner = BOUNTY_OWNER_CASE_SQL,
-        );
-        let rows = sqlx::query(&sql)
-            .bind(&owners)
-            .bind(&names)
-            .bind(limit)
-            .fetch_all(&self.pool)
-            .await?;
+    pub async fn bounty_leaderboard(&self, limit: i64) -> Result<Vec<(String, i64, i64)>> {
+        let rows = sqlx::query(
+            "SELECT claimant_did, COUNT(*) as cnt, COALESCE(SUM(amount),0) as total FROM bounties WHERE status='completed' AND claimant_did IS NOT NULL GROUP BY claimant_did ORDER BY total DESC LIMIT $1",
+        )
+        .bind(limit)
+        .fetch_all(&self.pool)
+        .await?;
         Ok(rows
             .iter()
             .map(|r| {
@@ -7995,41 +7899,6 @@ mod peer_authority_tests {
         db
     }
 
-    /// `peer_exists` answers the membership question the gossip ingest gate
-    /// asks on every event, so both answers are pinned here: a registered DID
-    /// is true, and an unregistered one is false rather than an error or a
-    /// prefix match on a registered DID.
-    #[sqlx::test]
-    async fn peer_exists_answers_both_ways(pool: sqlx::PgPool) {
-        let db = db(pool).await;
-        let did = VICTIM_DID;
-
-        assert!(
-            !db.peer_exists(did).await.unwrap(),
-            "an empty peers table must answer false, not error"
-        );
-
-        db.upsert_peer(
-            did,
-            "https://peer.example.com",
-            PeerWriteAuthority::Proven(did),
-        )
-        .await
-        .unwrap();
-
-        assert!(db.peer_exists(did).await.unwrap());
-        assert!(
-            !db.peer_exists(OTHER_DID).await.unwrap(),
-            "a different DID must not match"
-        );
-        assert!(
-            !db.peer_exists(&VICTIM_DID[..VICTIM_DID.len() - 1])
-                .await
-                .unwrap(),
-            "the lookup is an equality test, not a prefix test"
-        );
-    }
-
     /// The whole row, read back through `list_peers` rather than raw SQL, so a
     /// case that claims "unchanged" is comparing every column a consumer sees.
     async fn row(db: &Db, did: &str) -> Option<(String, String, Option<String>, bool, String)> {
@@ -8446,7 +8315,6 @@ mod peer_authority_tests {
 /// | `a_legacy_row_can_still_refresh_its_liveness` (db/mod.rs) | test-only. Seeds a PRE-GATE row by raw SQL on purpose: `upsert_peer` cannot create one, since the gate it is testing refuses exactly that DID. The fixture models what a deployed table already holds |
 /// | `gossip_ping_round_requires_two_failures_before_persisting_unreachable` (main.rs) | test-only fixture seed. Raw SQL because the test drives the readiness HYSTERESIS, which needs a row already at `last_ping_ok = TRUE` before the round runs; it never exercises the announce gate |
 /// | `manual_ping_uses_readiness_without_mutating_federation_gate` (api/peers.rs) | test-only fixture seed, same shape and same reason: the row under test must pre-exist so the assertion is about what the ping does NOT rewrite |
-/// | `seed_peer` (p2p/mod.rs) | test-only fixture seed. Raw SQL so the gossip ingest tests can drive the known-peer gate directly, including the did:web case `upsert_peer` would refuse |
 ///
 /// And the `upsert_peer` CALL-SITE authority table, which the ledger above
 /// structurally cannot hold, because the bootstrap site issues no SQL of its own
@@ -8544,7 +8412,6 @@ mod peers_table_writer_guard {
         ("prune_non_public_peers", 1),
         ("prune_self_peers", 1),
         ("seed_local_peer", 1),
-        ("seed_peer", 1),
         ("upsert_peer", 2),
     ];
 

crates/gitlawb-node/src/encrypted_pin.rs

@@ -69,12 +69,6 @@ fn resolve_all_recipients(dids: &BTreeSet<String>) -> Result<Vec<VerifyingKey>,
 enum SealPlan {
     /// An existing envelope already covers exactly this recipient set; nothing to do.
     SkipUnchanged,
-    /// The stored tag matches, but the stored reader set contains a DID that
-    /// must not resolve (e.g. a small-order did:key sealed before the choke
-    /// point landed). The old envelope is already public and cannot be
-    /// withdrawn, but it must be surfaced for operator action rather than
-    /// silently skipped as unchanged.
-    SkipUnresolvableStored(Vec<String>),
     /// No recipient DID resolved to a key, so there is nothing to seal to.
     SkipNoRecipients,
     /// At least one recipient DID is unresolvable. Fail closed: never seal to a
@@ -96,30 +90,15 @@ enum SealPlan {
 /// recover the blob; reader removal is not retroactive (the old envelope is
 /// already public). The comparison is on the opaque node-keyed tag, never the
 /// DID list.
-///
-/// A matching stored tag is normally a skip, but the set is still resolved
-/// before skipping: a reader that used to resolve and now must not (a
-/// small-order did:key sealed before the choke point landed) is surfaced as
-/// [`SealPlan::SkipUnresolvableStored`] instead of being silently treated as
-/// unchanged. The old envelope is already public and cannot be withdrawn, but
-/// the operator must be able to see that a persisted envelope was sealed to a
-/// weak recipient.
 fn plan_seal(node_seed: &[u8; 32], dids: &BTreeSet<String>, stored_tag: Option<&str>) -> SealPlan {
     let tag = recipients_tag(node_seed, dids);
     if stored_tag == Some(tag.as_str()) {
-        // The stored envelope already covers exactly this set, so there is
-        // nothing to re-seal. Resolve anyway so a now-unresolvable reader in an
-        // unchanged set is surfaced rather than hidden by the tag match.
-        match resolve_all_recipients(dids) {
-            Ok(_) => SealPlan::SkipUnchanged,
-            Err(unresolved) => SealPlan::SkipUnresolvableStored(unresolved),
-        }
-    } else {
-        match resolve_all_recipients(dids) {
-            Ok(keys) if keys.is_empty() => SealPlan::SkipNoRecipients,
-            Ok(keys) => SealPlan::Seal { keys, tag },
-            Err(unresolved) => SealPlan::SkipUnresolvable(unresolved),
-        }
+        return SealPlan::SkipUnchanged;
+    }
+    match resolve_all_recipients(dids) {
+        Ok(keys) if keys.is_empty() => SealPlan::SkipNoRecipients,
+        Ok(keys) => SealPlan::Seal { keys, tag },
+        Err(unresolved) => SealPlan::SkipUnresolvable(unresolved),
     }
 }
 
@@ -152,21 +131,6 @@ pub async fn encrypt_and_pin(
         // covered (which would permanently lock out the dropped readers, #47).
         let (keys, tag) = match plan_seal(node_seed, dids, stored_tag.as_deref()) {
             SealPlan::SkipUnchanged => continue,
-            SealPlan::SkipUnresolvableStored(unresolved) => {
-                // A stored envelope already covers this exact reader set, and
-                // the set now contains a DID that must not resolve (a
-                // small-order did:key sealed before the choke point landed).
-                // The old envelope is already public and cannot be withdrawn
-                // or re-sealed; surface it so the operator can act.
-                let sample: Vec<&String> = unresolved.iter().take(3).collect();
-                tracing::warn!(
-                    oid = %oid,
-                    unresolved_count = unresolved.len(),
-                    unresolved_sample = ?sample,
-                    "stored envelope was sealed to a recipient that must not resolve; operator action may be required"
-                );
-                continue;
-            }
             SealPlan::SkipNoRecipients => {
                 tracing::warn!(oid = %oid, "no resolvable recipient keys; skipping encrypted pin");
                 continue;
@@ -242,49 +206,6 @@ mod tests {
     use super::*;
     use ed25519_dalek::SigningKey;
 
-    /// A did:key encoding a small-order point. Well-formed, indistinguishable
-    /// from a real one by eye, and refused at resolution since the choke-point
-    /// guard landed.
-    fn weak_did_key() -> String {
-        let mut weak = [0u8; 32];
-        weak[0] = 1; // compressed identity point
-        let vk = ed25519_dalek::VerifyingKey::from_bytes(&weak).expect("decompresses");
-        Did::from_verifying_key(&vk).to_string()
-    }
-
-    /// The #47 fail-closed arm already refuses to seal to a partial recipient
-    /// set. Because a small-order did:key no longer RESOLVES, it lands in the
-    /// unresolved set and that existing arm catches it: nothing is sealed, and
-    /// no new code path was added to make that happen.
-    #[test]
-    fn weak_recipient_falls_into_the_existing_fail_closed_arm() {
-        let weak = weak_did_key();
-        let mut dids = BTreeSet::new();
-        dids.insert(did_key(9));
-        dids.insert(weak.clone());
-
-        match plan_seal(&[0u8; 32], &dids, None) {
-            SealPlan::SkipUnresolvable(unresolved) => assert!(
-                unresolved.contains(&weak),
-                "the weak DID must be named in the unresolved set, got {unresolved:?}"
-            ),
-            other => panic!("expected SkipUnresolvable, got {other:?}"),
-        }
-    }
-
-    /// Must-not-over-reject control: an all-legitimate recipient set still seals.
-    #[test]
-    fn legitimate_recipient_set_still_seals() {
-        let mut dids = BTreeSet::new();
-        dids.insert(did_key(9));
-        dids.insert(did_key(11));
-
-        match plan_seal(&[0u8; 32], &dids, None) {
-            SealPlan::Seal { keys, .. } => assert_eq!(keys.len(), 2, "both recipients resolve"),
-            other => panic!("expected Seal, got {other:?}"),
-        }
-    }
-
     fn did_key(seed: u8) -> String {
         let vk = SigningKey::from_bytes(&[seed; 32]).verifying_key();
         Did::from_verifying_key(&vk).to_string()
@@ -427,43 +348,6 @@ mod tests {
         ));
     }
 
-    /// P1 remediation (review): an unchanged reader set is normally a skip, but
-    /// the skip must not hide a recipient that now fails to resolve. A blob
-    /// sealed to a small-order did:key before the choke-point guard landed keeps
-    /// its old CID and stays decryptable-without-a-private-key unless the
-    /// matching-tag path surfaces it. This pins that the stored-tag match still
-    /// resolves the set instead of short-circuiting.
-    #[test]
-    fn plan_seal_surfaces_unresolvable_recipient_in_unchanged_reader_set() {
-        let weak = weak_did_key();
-        let mut dids = BTreeSet::new();
-        dids.insert(did_key(9));
-        dids.insert(weak.clone());
-        let stored = recipients_tag(&SEED, &dids);
-
-        match plan_seal(&SEED, &dids, Some(&stored)) {
-            SealPlan::SkipUnresolvableStored(unresolved) => assert!(
-                unresolved.contains(&weak),
-                "the weak DID must be named in the unresolved set, got {unresolved:?}"
-            ),
-            other => panic!("expected SkipUnresolvableStored, got {other:?}"),
-        }
-    }
-
-    /// Degenerate control: an empty set with a matching stored tag stays a
-    /// silent skip. The state is unreachable in practice (a seal is never
-    /// recorded for an empty reader set), so this pins only that the
-    /// resolve-on-match path must not turn it into a re-seal or a warning.
-    #[test]
-    fn plan_seal_unchanged_empty_set_still_skips() {
-        let empty = BTreeSet::new();
-        let empty_tag = recipients_tag(&SEED, &empty);
-        assert!(matches!(
-            plan_seal(&SEED, &empty, Some(&empty_tag)),
-            SealPlan::SkipUnchanged
-        ));
-    }
-
     #[test]
     fn plan_seal_reseals_when_recipient_set_changed() {
         // A stored tag for a DIFFERENT set is a miss: a newly added reader must

crates/gitlawb-node/src/git/issues.rs

@@ -129,22 +129,19 @@ pub fn list_issues(repo_path: &Path) -> Result<Vec<String>> {
 /// Returns Ok(Some(full_id)) on unique match, Ok(None) if not found,
 /// Err if the prefix is ambiguous (matches more than one issue).
 pub fn resolve_issue_id(repo_path: &Path, id_or_prefix: &str) -> Result<Option<String>> {
-    // The id comes from the request path and is spliced into a git revision and a
-    // for-each-ref pattern below. Issue ids are UUIDs, so accept only ASCII
-    // alphanumerics and '-': anything else (`^{blob}`, `@{0}`, `*`, `/`, `..`) is
-    // revision or glob syntax, never an issue id, and is reported as not found.
-    if id_or_prefix.is_empty()
-        || !id_or_prefix
-            .bytes()
-            .all(|b| b.is_ascii_alphanumeric() || b == b'-')
-    {
-        return Ok(None);
+    // Try exact match first — fast path for callers passing the full UUID.
+    let exact_ref = format!("refs/gitlawb/issues/{id_or_prefix}");
+    let check = Command::new("git")
+        .args(["cat-file", "-e", &exact_ref])
+        .current_dir(repo_path)
+        .output()
+        .context("failed to run git cat-file -e")?;
+    if check.status.success() {
+        return Ok(Some(id_or_prefix.to_string()));
     }
 
-    // List all refs that start with the given string; the glob also matches the exact
-    // ref. The id handed back is always git's own refname, never the request input.
-    let exact_ref = format!("refs/gitlawb/issues/{id_or_prefix}");
-    let prefix_glob = format!("{exact_ref}*");
+    // Prefix search: list all refs that start with the given string.
+    let prefix_glob = format!("refs/gitlawb/issues/{id_or_prefix}*");
     let list = Command::new("git")
         .args(["for-each-ref", "--format=%(refname)", &prefix_glob])
         .current_dir(repo_path)
@@ -156,44 +153,25 @@ pub fn resolve_issue_id(repo_path: &Path, id_or_prefix: &str) -> Result<Option<S
     }
 
     let output = String::from_utf8_lossy(&list.stdout);
-    let matches: Vec<&str> = output
-        .lines()
-        .map(str::trim)
-        .filter(|l| !l.is_empty())
-        .collect();
+    let matches: Vec<&str> = output.lines().filter(|l| !l.trim().is_empty()).collect();
 
-    // An exact id wins over longer ids that share it as a prefix, but only if its
-    // object exists: for-each-ref also lists a ref whose blob is missing, so a
-    // dangling exact ref falls through to the prefix rules below.
-    let exact = match matches.iter().find(|m| **m == exact_ref) {
-        Some(m) => {
-            let check = Command::new("git")
-                .args(["cat-file", "-e", m])
-                .current_dir(repo_path)
-                .output()
-                .context("failed to run git cat-file -e")?;
-            check.status.success().then_some(*m)
+    match matches.len() {
+        0 => Ok(None),
+        1 => {
+            // Strip the "refs/gitlawb/issues/" prefix to get the bare ID.
+            let full_id = matches[0]
+                .trim()
+                .strip_prefix("refs/gitlawb/issues/")
+                .unwrap_or(matches[0].trim())
+                .to_string();
+            Ok(Some(full_id))
         }
-        None => None,
-    };
-    let found = match exact {
-        Some(m) => m,
-        None => match matches.as_slice() {
-            [] => return Ok(None),
-            [m] => *m,
-            _ => anyhow::bail!(
-                "ambiguous issue prefix '{}': matches {} issues",
-                id_or_prefix,
-                matches.len()
-            ),
-        },
-    };
-    // Strip the "refs/gitlawb/issues/" prefix to get the bare ID.
-    let full_id = found
-        .strip_prefix("refs/gitlawb/issues/")
-        .unwrap_or(found)
-        .to_string();
-    Ok(Some(full_id))
+        _ => anyhow::bail!(
+            "ambiguous issue prefix '{}': matches {} issues",
+            id_or_prefix,
+            matches.len()
+        ),
+    }
 }
 
 /// Close an issue by updating its status to "closed" in the git ref.
@@ -277,43 +255,6 @@ mod tests {
         assert_eq!(resolved, Some(full_id.to_string()));
     }
 
-    #[test]
-    fn test_resolve_exact_id_wins_over_longer_id() {
-        let dir = TempDir::new().unwrap();
-        init_repo(&dir);
-        create_issue(dir.path(), "abc12345", r#"{"status":"open"}"#).unwrap();
-        create_issue(dir.path(), "abc12345-0000", r#"{"status":"open"}"#).unwrap();
-        let resolved = resolve_issue_id(dir.path(), "abc12345").unwrap();
-        assert_eq!(resolved, Some("abc12345".to_string()));
-    }
-
-    #[test]
-    fn test_resolve_dangling_exact_id_does_not_win_over_longer_id() {
-        let dir = TempDir::new().unwrap();
-        init_repo(&dir);
-        create_issue(dir.path(), "abc12345", r#"{"status":"open","n":1}"#).unwrap();
-        create_issue(dir.path(), "abc12345-0000", r#"{"status":"open","n":2}"#).unwrap();
-        // Dangle the exact ref: the ref stays listed by for-each-ref, but its blob is gone.
-        let out = Command::new("git")
-            .args(["rev-parse", "refs/gitlawb/issues/abc12345"])
-            .current_dir(dir.path())
-            .output()
-            .unwrap();
-        let hash = String::from_utf8(out.stdout).unwrap();
-        let hash = hash.trim();
-        std::fs::remove_file(
-            dir.path()
-                .join(".git/objects")
-                .join(&hash[..2])
-                .join(&hash[2..]),
-        )
-        .unwrap();
-
-        let result = resolve_issue_id(dir.path(), "abc12345");
-        assert!(result.unwrap_err().to_string().contains("ambiguous"));
-        assert!(close_issue(dir.path(), "abc12345").is_err());
-    }
-
     #[test]
     fn test_resolve_prefix_matches_unique() {
         let dir = TempDir::new().unwrap();
@@ -329,35 +270,6 @@ mod tests {
         assert_eq!(resolved, Some(full_id.to_string()));
     }
 
-    #[test]
-    fn test_resolve_rejects_revision_syntax() {
-        let dir = TempDir::new().unwrap();
-        init_repo(&dir);
-        let full_id = "abc12345-0000-0000-0000-000000000000";
-        create_issue(
-            dir.path(),
-            full_id,
-            r#"{"id":"abc12345-0000-0000-0000-000000000000","status":"open"}"#,
-        )
-        .unwrap();
-        // Each of these resolves to (or globs over) the issue blob in git, but none
-        // is an issue id, so the lookup must not accept it.
-        for crafted in [
-            "abc12345-0000-0000-0000-000000000000^{blob}",
-            "abc12345-0000-0000-0000-000000000000^{}",
-            "abc12345-0000-0000-0000-000000000000~0",
-            "*",
-            "",
-        ] {
-            assert_eq!(
-                resolve_issue_id(dir.path(), crafted).unwrap(),
-                None,
-                "{crafted:?}"
-            );
-            assert_eq!(get_issue(dir.path(), crafted).unwrap(), None, "{crafted:?}");
-        }
-    }
-
     #[test]
     fn test_resolve_prefix_not_found() {
         let dir = TempDir::new().unwrap();

crates/gitlawb-node/src/git/mod.rs

@@ -1,5 +1,4 @@
 pub mod issues;
-pub mod publish;
 pub mod push_delta;
 pub mod repo_store;
 pub mod smart_http;

crates/gitlawb-node/src/git/publish.rs

@@ -1,358 +0,0 @@
-//! The publication boundary: WHO wrote, and HOW FAR that write got.
-//!
-//! Four lifecycle defects on this branch shared one root cause. A resource was
-//! tracked by a coarse state — "release started", "the path exists", "a row with
-//! this name exists" — when the safety question was about the IDENTITY and the
-//! PUBLICATION STAGE of one specific write attempt. A tail replicated refs from
-//! an attempt that had not dispatched a PUT; a read served a tree whose
-//! generation nobody had confirmed; a fork claimed a concurrent attempt's row and
-//! deleted a successor's object; a response-loss failure was compensated as if it
-//! proved non-publication.
-//!
-//! This module is the vocabulary that makes those questions answerable, and it is
-//! deliberately free of any object-storage type:
-//!
-//! - [`PublishAttemptId`] — minted before the request is built, carried with the
-//!   bytes as user metadata, read back off the store to decide whether what is
-//!   published is THIS attempt's work.
-//! - [`PublishStage`] / [`PublishStageCell`] — how far one attempt got, observable
-//!   from outside the future that is performing it, so a CANCELLED attempt can
-//!   still be classified.
-//! - [`UploadError`] — what the client KNOWS about dispatch and commit, not just
-//!   which HTTP status came back. Destructive compensation is licensed only by
-//!   [`UploadError::proves_not_published`].
-//!
-//! # Porting note (#79)
-//!
-//! PR #79 (`feat/storage-abstraction`) deletes `git/tigris.rs` and replaces it
-//! with a `BlobStore`/`RepoArchive` layer. Everything in this file is
-//! backend-agnostic on purpose and is meant to survive that swap unchanged: a new
-//! backend supplies its own error classifier (the one in `tigris.rs` is a single
-//! private function) and keeps these types as the contract its callers read.
-
-use std::sync::Mutex;
-
-/// A durable identity for ONE publish attempt.
-///
-/// The point is reconciliation. A conditional PUT whose response was lost leaves
-/// the client unable to say whether its bytes committed; an attempt id stored
-/// alongside those bytes turns that into a question the store can answer, because
-/// "is the published object mine?" is decidable where "did my request succeed?"
-/// is not.
-///
-/// Fork creation passes the DB row id it is about to insert, so the object, the
-/// on-disk clone and the database row are all stamped with the same attempt
-/// identity and every cleanup can be made conditional on still owning all three.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct PublishAttemptId(String);
-
-impl PublishAttemptId {
-    /// A fresh identity for an attempt that has nothing else to be named after.
-    pub fn new() -> Self {
-        Self(uuid::Uuid::new_v4().to_string())
-    }
-
-    /// Name the attempt after a caller-owned identity — fork creation uses the
-    /// `record.id` it is about to insert, which is what ties the object back to
-    /// the exact row rather than to the logical owner/name.
-    pub fn from_owned(id: impl Into<String>) -> Self {
-        Self(id.into())
-    }
-
-    pub fn as_str(&self) -> &str {
-        &self.0
-    }
-}
-
-impl Default for PublishAttemptId {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl std::fmt::Display for PublishAttemptId {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.write_str(&self.0)
-    }
-}
-
-/// The object user-metadata key an attempt id travels in.
-///
-/// S3 lowercases user-metadata keys, so this must already be lowercase or the
-/// read back would never match what was written.
-pub const ATTEMPT_METADATA_KEY: &str = "gitlawb-attempt";
-
-/// The precondition an upload is fenced on.
-///
-/// Object storage is the only place a fence can hold. Dropping the future of an
-/// in-flight PUT does not cancel the request the server is already processing,
-/// so no amount of local locking stops an abandoned writer's bytes from landing
-/// after a successor has published. A conditional PUT the store itself refuses
-/// is what actually stops it.
-#[derive(Clone, Debug)]
-pub enum UploadPrecondition {
-    /// Publish only if the stored object is still the generation we observed.
-    IfMatch(String),
-    /// Publish only if nothing is stored under the key yet.
-    IfAbsent,
-    /// No fence. Last writer wins.
-    Unconditional,
-}
-
-/// What the store holds under a key right now.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct StoredGeneration {
-    /// The generation a later conditional upload can fence itself on.
-    pub etag: Option<String>,
-    /// The attempt that published it, when the object carries our metadata.
-    /// `None` for anything written by something that does not stamp attempts
-    /// (an operator upload, a pre-attempt-id archive).
-    pub attempt: Option<String>,
-}
-
-impl StoredGeneration {
-    /// Is what the store holds the work of `attempt`?
-    ///
-    /// This is the whole reconciliation primitive. It is deliberately a
-    /// three-way question collapsed to a boolean only at the point of use: an
-    /// object with no attempt metadata answers `false`, because "somebody else's
-    /// bytes" and "bytes nobody stamped" license exactly the same caution.
-    pub fn belongs_to(&self, attempt: &PublishAttemptId) -> bool {
-        self.attempt.as_deref() == Some(attempt.as_str())
-    }
-}
-
-/// The receipt of a publish the store ACKNOWLEDGED.
-///
-/// Only produced on a response the client actually read, so holding one is proof
-/// of publication in a way that "the upload future returned" is not.
-#[derive(Clone, Debug)]
-pub struct UploadReceipt {
-    pub attempt: PublishAttemptId,
-    pub etag: Option<String>,
-}
-
-/// How far ONE publish attempt got.
-///
-/// Observable through [`PublishStageCell`] from outside the future doing the
-/// work, which is the property the whole design turns on: a handler future that
-/// is DROPPED never returns an outcome, so the only way to classify a cancelled
-/// attempt is to read the stage it had reached when it was abandoned.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub enum PublishStage {
-    /// Nothing has been attempted.
-    Idle,
-    /// No object-storage backend is configured, so there is no publication to
-    /// confirm and the local write IS the durable copy. Distinct from `Idle`,
-    /// which means an attempt was possible and had not started: a cancellation
-    /// under `NoBackend` loses nothing, while a cancellation under `Idle` means
-    /// a publish that could have happened never did.
-    NoBackend,
-    /// The archive is being built. The request has not been constructed, let
-    /// alone sent. A cancellation here is a DEFINITE "no publication was
-    /// attempted" — not an ambiguous in-flight PUT.
-    PreparingArchive,
-    /// The request is on the wire. Its fate is unknown until the store answers,
-    /// and a cancellation here does NOT stop the server processing it.
-    PutDispatched { attempt: PublishAttemptId },
-    /// The store acknowledged the write. This is the ONLY stage that licenses
-    /// replication, a 2xx, or treating the local tree as durable.
-    Published {
-        attempt: PublishAttemptId,
-        etag: Option<String>,
-    },
-    /// The store definitively did not publish this attempt (a refused
-    /// precondition, or a failure that proves the bytes never committed).
-    Refused,
-    /// The attempt may or may not have committed and has not been reconciled.
-    /// Destructive compensation is NEVER licensed from here.
-    Ambiguous { attempt: PublishAttemptId },
-}
-
-impl PublishStage {
-    /// Did this attempt reach a state where the store may hold its bytes?
-    ///
-    /// True from dispatch onward. `false` is what makes deleting the attempt's
-    /// object or local tree safe.
-    pub fn may_have_published(&self) -> bool {
-        matches!(
-            self,
-            PublishStage::PutDispatched { .. }
-                | PublishStage::Published { .. }
-                | PublishStage::Ambiguous { .. }
-        )
-    }
-
-    /// The attempt whose fate is unresolved, when there is one. This is what a
-    /// reconciliation HEAD is compared against.
-    pub fn unresolved_attempt(&self) -> Option<&PublishAttemptId> {
-        match self {
-            PublishStage::PutDispatched { attempt } | PublishStage::Ambiguous { attempt } => {
-                Some(attempt)
-            }
-            _ => None,
-        }
-    }
-}
-
-/// A [`PublishStage`] an in-flight upload writes and an outside observer reads.
-///
-/// `std::sync::Mutex` rather than an async lock on purpose: every write is a
-/// field assignment with no await inside, and the reader that matters most runs
-/// inside a `Drop` impl, where an async lock cannot be awaited at all.
-#[derive(Debug)]
-pub struct PublishStageCell(Mutex<PublishStage>);
-
-impl PublishStageCell {
-    pub fn new() -> Self {
-        Self::seeded(PublishStage::Idle)
-    }
-
-    pub fn seeded(stage: PublishStage) -> Self {
-        Self(Mutex::new(stage))
-    }
-
-    pub fn set(&self, stage: PublishStage) {
-        *self.0.lock().expect("publish stage mutex poisoned") = stage;
-    }
-
-    pub fn get(&self) -> PublishStage {
-        self.0.lock().expect("publish stage mutex poisoned").clone()
-    }
-}
-
-impl Default for PublishStageCell {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-/// What the client knows about whether a request it could not complete ever
-/// reached the wire.
-///
-/// The classifier that produces this is the ONLY backend-aware code in the
-/// publish path; a pluggable store (#79) supplies its own and every caller below
-/// keeps working off [`UploadError`].
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum DispatchKnowledge {
-    /// The request could not be built or sent. The store cannot hold these bytes.
-    NeverSent,
-    /// The request may have been sent, and may have committed.
-    MaybeSent,
-}
-
-/// Why an upload did not publish, split by what it leaves the caller ENTITLED TO
-/// DO — not by which HTTP status came back.
-///
-/// The split exists because the previous shape ("precondition lost" vs "some
-/// other error") made every caller treat a lost response as proof of failure.
-/// Smithy timeout, dispatch and response errors all allow that the request was
-/// sent and committed: a server can accept a complete conditional PUT and lose
-/// or corrupt the response before the client observes success. Compensating that
-/// as a definite failure deletes state that IS published.
-#[derive(Debug, thiserror::Error)]
-pub enum UploadError {
-    /// The store explicitly refused the fence (412, or 409 under create-only).
-    /// DEFINITE: this attempt did not publish, and a successor did.
-    #[error("upload precondition lost (HTTP {status})")]
-    PreconditionLost { status: u16 },
-    /// The attempt provably never committed: it failed before the request could
-    /// be dispatched, or the store answered a definite client-side refusal.
-    /// Destructive compensation is safe here and ONLY here.
-    #[error("upload did not reach the store: {0:#}")]
-    NotPublished(#[source] anyhow::Error),
-    /// The request may have been dispatched and may have committed; the client
-    /// never learned which. The attempt id is carried so the caller can ask the
-    /// store rather than guess.
-    #[error("upload outcome is unknowable (attempt {attempt}): {source:#}")]
-    Ambiguous {
-        attempt: PublishAttemptId,
-        #[source]
-        source: anyhow::Error,
-    },
-}
-
-impl UploadError {
-    /// May this caller destroy state that would be needed if the write HAD
-    /// landed — delete the object, drop the only local clone, invalidate the
-    /// cache?
-    ///
-    /// Only a proven non-publication says yes. Every new variant must default to
-    /// `false`, which is why this is a match on the safe arms rather than a
-    /// negation of the unsafe one.
-    pub fn proves_not_published(&self) -> bool {
-        matches!(
-            self,
-            UploadError::PreconditionLost { .. } | UploadError::NotPublished(_)
-        )
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn only_definite_outcomes_license_destructive_compensation() {
-        assert!(UploadError::PreconditionLost { status: 412 }.proves_not_published());
-        assert!(
-            UploadError::NotPublished(anyhow::anyhow!("no route to host")).proves_not_published()
-        );
-        assert!(
-            !UploadError::Ambiguous {
-                attempt: PublishAttemptId::new(),
-                source: anyhow::anyhow!("response body truncated"),
-            }
-            .proves_not_published(),
-            "a response-loss failure must never license deleting state the write may own"
-        );
-    }
-
-    #[test]
-    fn a_stage_may_have_published_only_from_dispatch_onward() {
-        let attempt = PublishAttemptId::new();
-        assert!(!PublishStage::Idle.may_have_published());
-        assert!(!PublishStage::NoBackend.may_have_published());
-        assert!(
-            !PublishStage::PreparingArchive.may_have_published(),
-            "compression has not constructed a request, let alone sent one"
-        );
-        assert!(!PublishStage::Refused.may_have_published());
-        assert!(PublishStage::PutDispatched {
-            attempt: attempt.clone()
-        }
-        .may_have_published());
-        assert!(PublishStage::Ambiguous {
-            attempt: attempt.clone()
-        }
-        .may_have_published());
-        assert!(PublishStage::Published {
-            attempt,
-            etag: None
-        }
-        .may_have_published());
-    }
-
-    #[test]
-    fn an_unstamped_object_never_belongs_to_an_attempt() {
-        let attempt = PublishAttemptId::new();
-        assert!(StoredGeneration {
-            etag: Some("\"e\"".into()),
-            attempt: Some(attempt.as_str().to_string()),
-        }
-        .belongs_to(&attempt));
-        assert!(
-            !StoredGeneration {
-                etag: Some("\"e\"".into()),
-                attempt: None,
-            }
-            .belongs_to(&attempt),
-            "bytes nobody stamped must not be claimed by this attempt"
-        );
-        assert!(!StoredGeneration {
-            etag: Some("\"e\"".into()),
-            attempt: Some("someone-else".into()),
-        }
-        .belongs_to(&attempt));
-    }
-}

crates/gitlawb-node/src/git/push_delta.rs

@@ -19,7 +19,7 @@
 //! objects the reachable withheld set never classified, so subtracting that set
 //! is not enough — a dangling private blob would slip through (#99). The caller
 //! signals a full scan via [`PinCandidateSet::full_scan`] and must then apply
-//! the fail-closed blob-and-tree filter (`visibility_pack::replicable_objects_fail_closed`)
+//! the fail-closed blob filter (`visibility_pack::replicable_objects_fail_closed`)
 //! instead of the plain reachable-only subtraction.
 //!
 //! Because the pin candidate set needs only the OID *set* (never the per-path
@@ -211,9 +211,8 @@ pub fn list_all_objects(repo_path: &Path, git_bin: &str, deadline: Instant) -> R
 
 /// Like [`list_all_objects`] but pairs each OID with its object type, via
 /// `--batch-check='%(objectname) %(objecttype)'`. The pin path's fail-closed
-/// filter needs to tell blobs (content, withholdable) and trees (content,
-/// withholdable since #135/#173) from commits/tags (structural, never withheld)
-/// without typing the candidate list itself.
+/// filter needs to tell blobs (content, withholdable) from commits/trees
+/// (structural, never withheld) without typing the candidate list itself.
 pub fn list_all_objects_with_type(
     repo_path: &Path,
     git_bin: &str,
@@ -245,48 +244,24 @@ pub fn list_all_objects_with_type(
 /// Every blob OID in the repo, including unreachable/dangling ones. The
 /// fail-closed pin filter drops any candidate blob absent from the reachable,
 /// visibility-allowed set; a dangling private blob is in this set but not the
-/// allowed set, so it never replicates (#99). Production uses
-/// [`all_blob_and_tree_oids`] (one typed pass); this wrapper stays for tests.
-#[cfg(test)]
+/// allowed set, so it never replicates (#99).
 pub fn all_blob_oids(
     repo_path: &Path,
     git_bin: &str,
     deadline: Instant,
 ) -> Result<HashSet<String>> {
-    Ok(all_blob_and_tree_oids(repo_path, git_bin, deadline)?.0)
-}
-
-/// Every blob OID and every tree OID in the repo, including unreachable/dangling
-/// ones, from one typed enumeration. The fail-closed pin filter drops any
-/// candidate blob or tree absent from the matching reachable visibility-allowed
-/// set; a dangling or withheld object is in this universe but not the allowed
-/// set, so it never replicates (#99, #172).
-pub fn all_blob_and_tree_oids(
-    repo_path: &Path,
-    git_bin: &str,
-    deadline: Instant,
-) -> Result<(HashSet<String>, HashSet<String>)> {
-    let mut blobs = HashSet::new();
-    let mut trees = HashSet::new();
-    for (oid, ty) in list_all_objects_with_type(repo_path, git_bin, deadline)? {
-        match ty.as_str() {
-            "blob" => {
-                blobs.insert(oid);
-            }
-            "tree" => {
-                trees.insert(oid);
-            }
-            _ => {}
-        }
-    }
-    Ok((blobs, trees))
+    Ok(list_all_objects_with_type(repo_path, git_bin, deadline)?
+        .into_iter()
+        .filter(|(_, ty)| ty == "blob")
+        .map(|(oid, _)| oid)
+        .collect())
 }
 
 /// The pin candidate OIDs for a push plus whether they came from a full-repo
 /// scan. `full_scan` is true when the delta could not be used and the whole
 /// object DB (including dangling objects) was enumerated — the caller must then
-/// apply the fail-closed blob-and-tree filter, because the reachable-only withheld set
-/// cannot classify dangling blobs or trees (#99, #172).
+/// apply the fail-closed blob filter, because the reachable-only withheld set
+/// cannot classify dangling blobs (#99).
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PinCandidateSet {
     pub candidates: Vec<String>,

crates/gitlawb-node/src/git/smart_http.rs

@@ -106,7 +106,7 @@ pub async fn info_refs(
 
     let mut command = Command::new(git_bin);
     command
-        .arg(service_to_command(service)?)
+        .arg(service_to_command(service))
         .arg("--stateless-rpc")
         .arg("--advertise-refs")
         .arg(repo_path);
@@ -426,7 +426,7 @@ async fn run_git_service(
 ) -> Result<Vec<u8>> {
     let mut command = Command::new(git_bin);
     command
-        .arg(service_to_command(service)?)
+        .arg(service_to_command(service))
         .arg("--stateless-rpc")
         .arg(repo_path);
     let (out, admission) = drive_git_child(command, input, timeout, service, admission).await?;
@@ -578,13 +578,11 @@ async fn drive_git_child(
     Ok((out, admission))
 }
 
-/// Map a validated service name to its git subcommand. Only the two fixed
-/// subcommands can come out, so an unrecognized service can never reach git's argv.
-fn service_to_command(service: &str) -> Result<&'static str> {
+fn service_to_command(service: &str) -> &str {
     match service {
-        "git-upload-pack" => Ok("upload-pack"),
-        "git-receive-pack" => Ok("receive-pack"),
-        other => bail!("unknown git service: {other}"),
+        "git-upload-pack" => "upload-pack",
+        "git-receive-pack" => "receive-pack",
+        _ => service,
     }
 }
 
@@ -868,24 +866,6 @@ mod tests {
     use std::process::Command;
     use tempfile::TempDir;
 
-    #[test]
-    fn service_to_command_maps_allowlist_and_rejects_passthrough() {
-        assert_eq!(
-            service_to_command("git-upload-pack").unwrap(),
-            "upload-pack"
-        );
-        assert_eq!(
-            service_to_command("git-receive-pack").unwrap(),
-            "receive-pack"
-        );
-        for bad in ["git-fetch-pack", "--version", "upload-pack", ""] {
-            assert!(
-                service_to_command(bad).is_err(),
-                "must reject passthrough for {bad:?}"
-            );
-        }
-    }
-
     /// List OIDs in a pack by writing it to a temp dir and running verify-pack.
     pub(super) fn pack_object_ids(pack: &[u8]) -> std::collections::HashSet<String> {
         let dir = TempDir::new().unwrap();

crates/gitlawb-node/src/git/store.rs

@@ -1,5 +1,5 @@
 use anyhow::{bail, Context, Result};
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::process::Command;
 
 /// Initialize a new bare git repository with SHA-1 object format (default).
@@ -746,149 +746,13 @@ pub fn read_object(repo_path: &Path, sha256_hex: &str) -> Result<Option<(String,
     Ok(Some((obj_type, content)))
 }
 
-/// Outcome of validating a stored branch-field value.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum GitRefValidationError {
-    /// Caller supplied a name that is not a valid local branch name.
-    Invalid(String),
-    /// Git could not be executed to validate the name.
-    GitUnavailable(String),
-}
-
-impl std::fmt::Display for GitRefValidationError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Invalid(msg) | Self::GitUnavailable(msg) => f.write_str(msg),
-        }
-    }
-}
-
-/// Reject revision shorthands and pseudoref names that `git check-ref-format
-/// --branch` accepts but that git later interprets as symbolic revisions rather
-/// than literal local branch names.
-fn reject_revision_shorthand(name: &str) -> Option<&'static str> {
-    if name == "@" {
-        return Some("branch ref must not be a revision shorthand");
-    }
-    if name.starts_with("@{") {
-        return Some("branch ref must not be a reflog revision expression");
-    }
-    const PSEUDOREFS: &[&str] = &[
-        "FETCH_HEAD",
-        "ORIG_HEAD",
-        "MERGE_HEAD",
-        "CHERRY_PICK_HEAD",
-        "RERERE_MERGE_HEAD",
-        "REBASE_HEAD",
-        "REVERT_HEAD",
-        "BISECT_HEAD",
-        "AUTO_MERGE",
-    ];
-    if PSEUDOREFS.contains(&name) {
-        return Some("branch ref must not be a git pseudoref name");
-    }
-    None
-}
-
-/// Validate a git *branch name* before it is stored or passed to git subprocesses.
-/// Delegates to `git check-ref-format --branch`, then rejects fully qualified
-/// ref paths, revision-namespace shorthands (`heads/`, `tags/`, `remotes/`), and
-/// symbolic names that git would reinterpret at the sink.
-///
-/// At diff/merge sinks, validated short names are passed as `refs/heads/{name}` so
-/// grammar-valid revision shorthands cannot retarget another ref namespace. The
-/// merge worktree checks out the local branch name instead, so merge commits
-/// advance refs/heads/{target}. Symbolic revision names (`HEAD`), option-shaped
-/// trailing dots, and other invalid forms are rejected by check-ref-format itself.
-/// Revision shorthands that pass the grammar check (`@`, `@{-1}`, pseudorefs) are
-/// rejected explicitly because git treats them as symbolic revisions when bare.
-///
-/// Storage boundaries call this via [`validate_git_ref_with_git`] with the configured
-/// git binary. Sink functions call [`validate_git_ref`] (system `git`) then prefix
-/// before building argv, so the property holds for every caller and every row,
-/// including legacy rows and any writer that skipped the boundary check.
-pub fn validate_git_ref(name: &str) -> std::result::Result<(), GitRefValidationError> {
-    validate_git_ref_with_git("git", name)
-}
-
-pub(crate) fn validate_git_ref_with_git(
-    git_bin: &str,
-    name: &str,
-) -> std::result::Result<(), GitRefValidationError> {
-    if name.is_empty() {
-        return Err(GitRefValidationError::Invalid(
-            "branch ref must not be empty".into(),
-        ));
-    }
-    if name.starts_with("refs/") {
-        return Err(GitRefValidationError::Invalid(
-            "branch ref must be a local branch name, not a fully qualified ref".into(),
-        ));
-    }
-    if name.starts_with("heads/") || name.starts_with("tags/") || name.starts_with("remotes/") {
-        return Err(GitRefValidationError::Invalid(
-            "branch ref must be a local branch name, not a revision shorthand".into(),
-        ));
-    }
-    if let Some(reason) = reject_revision_shorthand(name) {
-        return Err(GitRefValidationError::Invalid(reason.into()));
-    }
-    // allow-unbounded-git: stateless check-ref-format on a user-supplied name; no repo acquire or concurrency permit
-    let output = Command::new(git_bin)
-        .args(["check-ref-format", "--branch", name])
-        .output()
-        .map_err(|e| {
-            // allow-unbounded-git: stateless check-ref-format on user-supplied name; no repo acquire
-            GitRefValidationError::GitUnavailable(format!(
-                "failed to run git check-ref-format: {e}"
-            ))
-        })?;
-
-    if output.status.success() {
-        Ok(())
-    } else {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        Err(GitRefValidationError::Invalid(stderr.trim().to_string()))
-    }
-}
-
-/// Reject both refs at the sink, so an option-shaped ref can never reach a git
-/// argv element regardless of how it was stored.
-fn map_ref_validation_to_anyhow(which: &str, err: GitRefValidationError) -> anyhow::Error {
-    match err {
-        GitRefValidationError::Invalid(msg) => {
-            anyhow::anyhow!("invalid {which} branch ref: {msg}")
-        }
-        GitRefValidationError::GitUnavailable(msg) => anyhow::anyhow!("{msg}"),
-    }
-}
-
-fn guard_refs(target_branch: &str, source_branch: &str) -> Result<()> {
-    validate_git_ref(target_branch).map_err(|e| map_ref_validation_to_anyhow("target", e))?;
-    validate_git_ref(source_branch).map_err(|e| map_ref_validation_to_anyhow("source", e))?;
-    Ok(())
-}
-
-/// Stored short branch names are passed to git as explicit local-branch refs so a
-/// syntax-valid name cannot be reinterpreted as a revision shorthand at the sink.
-fn local_branch_ref(short_name: &str) -> String {
-    format!("refs/heads/{short_name}")
-}
-
 /// Get the diff between two branches: changes on source_branch not in target_branch.
 pub fn branch_diff(repo_path: &Path, target_branch: &str, source_branch: &str) -> Result<String> {
-    guard_refs(target_branch, source_branch)?;
-    let target = local_branch_ref(target_branch);
-    let source = local_branch_ref(source_branch);
     let output = Command::new("git")
-        .args(["diff", &format!("{target}...{source}")])
+        .args(["diff", &format!("{target_branch}...{source_branch}")])
         .current_dir(repo_path)
         .output()
         .context("failed to run git diff")?;
-    if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
-        bail!("git diff failed: {stderr}");
-    }
 
     Ok(String::from_utf8_lossy(&output.stdout).to_string())
 }
@@ -901,11 +765,13 @@ pub fn branch_diff_names(
     target_branch: &str,
     source_branch: &str,
 ) -> Result<Vec<String>> {
-    guard_refs(target_branch, source_branch)?;
-    let target = local_branch_ref(target_branch);
-    let source = local_branch_ref(source_branch);
     let output = Command::new("git")
-        .args(["diff", "--name-only", "-z", &format!("{target}...{source}")])
+        .args([
+            "diff",
+            "--name-only",
+            "-z",
+            &format!("{target_branch}...{source_branch}"),
+        ])
         .current_dir(repo_path)
         .output()
         .context("failed to run git diff --name-only")?;
@@ -933,78 +799,18 @@ pub fn merge_branch(
     author_did: &str,
     pr_title: &str,
 ) -> Result<String> {
-    guard_refs(target_branch, source_branch)?;
-    let source_ref = local_branch_ref(source_branch);
-    let target_ref = local_branch_ref(target_branch);
     let worktree_path = repo_path.join("_merge_worktree");
 
-    let remove_worktree = || {
-        // Two --force flags, not one. A single --force refuses a LOCKED worktree
-        // ("cannot remove a locked working tree") and `git worktree prune` skips
-        // locked registrations too, so with one flag a locked leftover survives
-        // the whole cleanup and wedges this endpoint for good. With both flags a
-        // separate prune adds nothing: over every leftover state that can reach
-        // here (registered/unregistered x directory present/gone/locked/corrupt)
-        // `remove -f -f` plus the removal below already clears the registration.
+    // Clean up any leftover worktree
+    if worktree_path.exists() {
         let _ = Command::new("git")
-            .args([
-                "worktree",
-                "remove",
-                "--force",
-                "--force",
-                "_merge_worktree",
-            ])
+            .args(["worktree", "remove", "--force", "_merge_worktree"])
             .current_dir(repo_path)
             .output();
         let _ = std::fs::remove_dir_all(&worktree_path);
-    };
-
-    // Clean up any leftover worktree. This cannot be gated on the directory
-    // existing: a registration whose directory is gone is the one state
-    // `worktree add` refuses outright ("missing but already registered"), and
-    // it is reachable from the cleanup above, so gating on .exists() would let
-    // one failed removal wedge every later merge on this repo.
-    remove_worktree();
-
-    // The merge must land on the LOCAL target branch, so the worktree has to end
-    // up attached to exactly refs/heads/{target}. validate_git_ref proves
-    // branch-name grammar only: it does not prove refs/heads/{target} exists,
-    // and it cannot stop git's revision DWIM rules from resolving the same
-    // short name in another namespace (refs/tags/{name}, refs/remotes/...). If
-    // DWIM won, `worktree add` would check out a detached HEAD at the foreign
-    // ref, the merge would succeed on that disposable HEAD, and cleanup would
-    // discard the commit without ever advancing refs/heads/{target}.
-    //
-    // (1) Require the exact local ref before creating the worktree. show-ref
-    // --verify matches the full refname literally — no DWIM, no abbreviation —
-    // so a same-named tag with no local branch fails here instead of being
-    // silently resolved.
-    //
-    // allow-unbounded-git: read-only `show-ref --verify` on one literal refname,
-    // no network and no object walk. It also sits alongside the pre-existing bare
-    // `git diff`, `git merge` and `git rev-parse` spawns in this same function,
-    // all under the same acquire_write lock, so bounding only this one would not
-    // change the function's exposure. Bounding merge_branch as a whole is a
-    // separate change against already-reviewed code, tracked as follow-up.
-    let target_exists = Command::new("git")
-        .args(["show-ref", "--verify", "--quiet", &target_ref])
-        .current_dir(repo_path)
-        .output()
-        .context("failed to run git show-ref")?;
-    if !target_exists.status.success() {
-        bail!("target branch {target_ref} does not exist as a local branch");
     }
 
-    // (2) Check out the local target branch in the worktree. The bare short
-    // name is what makes git attach HEAD to the branch (passing
-    // refs/heads/{name} would detach, so a successful merge would not advance
-    // refs/heads/{target}); step (1) guarantees the branch exists, so an
-    // attached checkout is the only acceptable outcome — verified right below.
-    //
-    // allow-unbounded-git: local `worktree add`, no network. Same reasoning as the
-    // show-ref spawn above: the surrounding function's other git children are
-    // already bare under this lock, so this one is not the thing that would need
-    // bounding first.
+    // Create worktree on target branch
     let wt = Command::new("git")
         .args(["worktree", "add", "_merge_worktree", target_branch])
         .current_dir(repo_path)
@@ -1017,31 +823,12 @@ pub fn merge_branch(
         );
     }
 
-    // The worktree's HEAD must be a symbolic ref to exactly refs/heads/{target}.
-    // A detached or differently-attached HEAD means git resolved the name as
-    // something other than the local target branch; a merge committed on it
-    // would be thrown away by cleanup, so refuse before merging rather than
-    // relying on any denylist of symbolic shapes.
-    //
-    // allow-unbounded-git: read-only `symbolic-ref` resolving one local HEAD, no
-    // network. Same reasoning as the two spawns above.
-    let head_ref = Command::new("git")
-        .args(["symbolic-ref", "--quiet", "HEAD"])
-        .current_dir(&worktree_path)
-        .output()
-        .context("failed to run git symbolic-ref")?;
-    let head_ref_name = String::from_utf8_lossy(&head_ref.stdout).trim().to_string();
-    if !head_ref.status.success() || head_ref_name != target_ref {
-        remove_worktree();
-        bail!("merge worktree is not attached to {target_ref} (HEAD is {head_ref_name:?})");
-    }
-
     // Run merge in worktree
     let merge = Command::new("git")
         .args([
             "merge",
             "--no-ff",
-            &source_ref,
+            source_branch,
             "-m",
             &format!(
                 "Merge branch '{}' into {} ({})",
@@ -1059,7 +846,11 @@ pub fn merge_branch(
     let success = merge.status.success();
 
     // Always remove worktree
-    remove_worktree();
+    let _ = Command::new("git")
+        .args(["worktree", "remove", "--force", "_merge_worktree"])
+        .current_dir(repo_path)
+        .output();
+    let _ = std::fs::remove_dir_all(&worktree_path);
 
     if !success {
         bail!(
@@ -1068,42 +859,19 @@ pub fn merge_branch(
         );
     }
 
-    // (3) The merge only counts if the exact target ref now points at a commit.
-    // Plain `rev-parse` echoes an unresolvable token back on stdout with a
-    // nonzero exit status, so an unchecked call here would hand the literal
-    // string "refs/heads/{target}" upward as an apparently valid merge SHA and
-    // the caller would mark the PR merged and fire the webhook. --verify plus
-    // ^{commit} plus an explicit status check turn "target ref missing or not a
-    // commit" into a hard failure before any of that happens.
+    // Get new HEAD of target branch
     let head = Command::new("git")
-        .args(["rev-parse", "--verify", &format!("{target_ref}^{{commit}}")])
+        .args(["rev-parse", &format!("refs/heads/{target_branch}")])
         .current_dir(repo_path)
         .output()
         .context("failed to get merge commit")?;
-    if !head.status.success() {
-        bail!(
-            "merge completed but {target_ref} does not resolve to a commit: {}",
-            String::from_utf8_lossy(&head.stderr)
-        );
-    }
 
     Ok(String::from_utf8_lossy(&head.stdout).trim().to_string())
 }
 
 /// Resolve a repo disk path: {repos_dir}/{owner_slug}/{repo_name}.git
-///
-/// UNVALIDATED, and test-only for that reason. It performs the bare join with no
-/// allowlist, no containment check and no component walk, so it accepts an empty
-/// or traversal-bearing name. Production code must use
-/// `git::repo_store::validated_repo_disk_path`; the last production caller was
-/// `fork_repo`, which used this and turned a `{"name":""}` request into a repo
-/// row at `<repos_dir>/<owner_slug>/.git`. The `cfg(test)` is the guard: a new
-/// production caller fails to compile rather than silently skipping the barrier.
-///
-/// Tests keep it because a fixture that must escape `repos_dir` cannot be built
-/// with the validated form.
-#[cfg(test)]
-pub fn repo_disk_path(repos_dir: &Path, owner_did: &str, repo_name: &str) -> std::path::PathBuf {
+#[allow(dead_code)] // exercised from test_support and state tests; production uses validated_repo_disk_path
+pub fn repo_disk_path(repos_dir: &Path, owner_did: &str, repo_name: &str) -> PathBuf {
     // Sanitize the DID for use as a directory name
     let owner_slug = owner_did.replace([':', '/'], "_");
     repos_dir.join(owner_slug).join(format!("{repo_name}.git"))
@@ -1111,73 +879,7 @@ pub fn repo_disk_path(repos_dir: &Path, owner_did: &str, repo_name: &str) -> std
 
 #[cfg(test)]
 mod tests {
-    use super::{validate_git_ref, validate_git_ref_with_git, GitRefValidationError};
-
-    #[test]
-    fn validate_git_ref_accepts_normal_branch_names() {
-        for good in [
-            "main",
-            "feature/foo",
-            "release-1.2",
-            "v1.0.0",
-            "user/fix-bug",
-            "feature@",
-            "user@host",
-        ] {
-            assert!(
-                validate_git_ref(good).is_ok(),
-                "{good:?} should be accepted"
-            );
-        }
-    }
-
-    #[test]
-    fn validate_git_ref_rejects_option_injection_and_malformed_refs() {
-        for bad in [
-            "",
-            "HEAD",
-            "@",
-            "@{-1}",
-            "FETCH_HEAD",
-            "MERGE_HEAD",
-            "feature.",
-            "feature/x.",
-            "refs/heads/main",
-            "refs/tags/v1",
-            "refs/heads/--output=/tmp/x",
-            "heads/main",
-            "tags/v1",
-            "remotes/origin/main",
-            "--output=/tmp/x",
-            "-rf",
-            "a b",
-            "a..b",
-            "a~b",
-            "refs/heads/@{x}",
-            "foo.lock",
-            "/leading",
-            "trailing/",
-            "a//b",
-        ] {
-            let err = validate_git_ref(bad).expect_err("{bad:?} should be rejected");
-            assert!(
-                matches!(err, GitRefValidationError::Invalid(_)),
-                "{bad:?} should be an invalid-name rejection, got {err:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn validate_git_ref_spawn_failure_is_git_unavailable_not_invalid() {
-        let err = validate_git_ref_with_git("/nonexistent/gitlawb-git", "main")
-            .expect_err("missing git binary should fail");
-        assert!(
-            matches!(err, GitRefValidationError::GitUnavailable(_)),
-            "spawn failure must not be classified as invalid input, got {err:?}"
-        );
-    }
-
-    use super::{branch_diff_names, merge_branch};
+    use super::branch_diff_names;
     use std::path::Path;
     use std::process::Command;
 
@@ -2324,259 +2026,4 @@ mod tests {
             "a clean `missing` twice on a readable store is a genuine absence; got {res:?}"
         );
     }
-
-    /// CodeRabbit #379: `merge_branch`'s leftover-worktree cleanup ran only when the
-    /// `_merge_worktree` DIRECTORY still existed. A directory that is gone while
-    /// `$GIT_DIR/worktrees/_merge_worktree` still holds its registration is precisely
-    /// the state `git worktree add` refuses ("is a missing but already registered
-    /// worktree", exit 128), and it is self-inflicted: `remove_worktree` deletes the
-    /// directory even when the `git worktree remove` before it failed. Once a repo is
-    /// in that state every later merge on it fails permanently. REVERT PROOF (RED):
-    /// put the cleanup call back behind `if worktree_path.exists()` and this test
-    /// fails at the merge below with "missing but already registered".
-    #[test]
-    fn merge_branch_recovers_from_a_stale_worktree_registration() {
-        let td = tempfile::TempDir::new().unwrap();
-        let work = td.path().join("work");
-        std::fs::create_dir_all(&work).unwrap();
-        let g = |args: &[&str], dir: &Path| {
-            assert!(
-                Command::new("git")
-                    .args(args)
-                    .current_dir(dir)
-                    .status()
-                    .unwrap()
-                    .success(),
-                "git {args:?} failed"
-            );
-        };
-        g(&["init", "-q"], &work);
-        g(&["config", "user.email", "t@t"], &work);
-        g(&["config", "user.name", "t"], &work);
-        std::fs::write(work.join("base.txt"), b"base\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "base"], &work);
-        let main = {
-            let o = Command::new("git")
-                .args(["symbolic-ref", "--short", "HEAD"])
-                .current_dir(&work)
-                .output()
-                .unwrap();
-            String::from_utf8_lossy(&o.stdout).trim().to_string()
-        };
-        g(&["checkout", "-q", "-b", "feature"], &work);
-        std::fs::write(work.join("feat.txt"), b"feat\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "feat"], &work);
-        g(&["checkout", "-q", &main], &work);
-
-        let bare = td.path().join("bare.git");
-        g(
-            &[
-                "clone",
-                "--bare",
-                "-q",
-                work.to_str().unwrap(),
-                bare.to_str().unwrap(),
-            ],
-            td.path(),
-        );
-
-        // Reproduce the stuck state exactly: register the worktree, then delete its
-        // directory without unregistering it. This is what a failed `worktree remove`
-        // followed by the unconditional `remove_dir_all` leaves behind.
-        //
-        // `gc.worktreePruneExpire=never` is set on purpose. Recovery must not depend on
-        // git's prune expiry policy: a registration this fresh would sit inside any
-        // sane expiry window, so a cleanup that only pruned on expiry would leave the
-        // repo wedged. Both `worktree remove --force` and `worktree prune` unregister a
-        // worktree whose gitdir target is gone regardless of this setting, and pinning
-        // it here keeps that true if either call is ever changed.
-        g(&["config", "gc.worktreePruneExpire", "never"], &bare);
-        g(&["worktree", "add", "_merge_worktree", &main], &bare);
-        std::fs::remove_dir_all(bare.join("_merge_worktree")).unwrap();
-        assert!(
-            bare.join("worktrees/_merge_worktree").exists(),
-            "fixture must leave the registration behind"
-        );
-
-        let before = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let before = String::from_utf8_lossy(&before.stdout).trim().to_string();
-
-        let merged = merge_branch(&bare, &main, "feature", "did:key:zTest", "t")
-            .expect("a stale worktree registration must not wedge the merge endpoint");
-
-        let after = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let after = String::from_utf8_lossy(&after.stdout).trim().to_string();
-        assert_ne!(before, after, "the merge must advance refs/heads/{main}");
-        assert_eq!(after, merged, "the returned sha must be the new branch tip");
-    }
-
-    /// Companion to the stale-registration case: the leftover worktree is also LOCKED.
-    /// `git worktree remove --force` (ONE flag) refuses a locked worktree outright, and
-    /// `git worktree prune` skips locked registrations too, so with a single --force the
-    /// cleanup makes no progress and `worktree add` keeps failing. REVERT PROOF (RED):
-    /// drop either --force from remove_worktree and this test fails.
-    #[test]
-    fn merge_branch_recovers_from_a_locked_stale_worktree() {
-        let td = tempfile::TempDir::new().unwrap();
-        let work = td.path().join("work");
-        std::fs::create_dir_all(&work).unwrap();
-        let g = |args: &[&str], dir: &Path| {
-            assert!(
-                Command::new("git")
-                    .args(args)
-                    .current_dir(dir)
-                    .status()
-                    .unwrap()
-                    .success(),
-                "git {args:?} failed"
-            );
-        };
-        g(&["init", "-q"], &work);
-        g(&["config", "user.email", "t@t"], &work);
-        g(&["config", "user.name", "t"], &work);
-        std::fs::write(work.join("base.txt"), b"base\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "base"], &work);
-        let main = {
-            let o = Command::new("git")
-                .args(["symbolic-ref", "--short", "HEAD"])
-                .current_dir(&work)
-                .output()
-                .unwrap();
-            String::from_utf8_lossy(&o.stdout).trim().to_string()
-        };
-        g(&["checkout", "-q", "-b", "feature"], &work);
-        std::fs::write(work.join("feat.txt"), b"feat\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "feat"], &work);
-        g(&["checkout", "-q", &main], &work);
-
-        let bare = td.path().join("bare.git");
-        g(
-            &[
-                "clone",
-                "--bare",
-                "-q",
-                work.to_str().unwrap(),
-                bare.to_str().unwrap(),
-            ],
-            td.path(),
-        );
-
-        g(&["worktree", "add", "_merge_worktree", &main], &bare);
-        g(&["worktree", "lock", "_merge_worktree"], &bare);
-        std::fs::remove_dir_all(bare.join("_merge_worktree")).unwrap();
-
-        let before = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let before = String::from_utf8_lossy(&before.stdout).trim().to_string();
-
-        let merged = merge_branch(&bare, &main, "feature", "did:key:zTest", "t")
-            .expect("a locked leftover worktree must not wedge the merge endpoint");
-
-        let after = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let after = String::from_utf8_lossy(&after.stdout).trim().to_string();
-        assert_ne!(before, after, "the merge must advance refs/heads/{main}");
-        assert_eq!(after, merged, "the returned sha must be the new branch tip");
-    }
-
-    /// The third leftover shape: a `_merge_worktree` DIRECTORY with no registration
-    /// behind it, which is what a crash between `worktree add` creating the directory
-    /// and git recording it leaves. `git worktree remove` refuses this one outright
-    /// ("is not a working tree"), so the `remove_dir_all` in remove_worktree is the
-    /// only thing that clears it and `worktree add` otherwise fails on the existing
-    /// path. REVERT PROOF (RED): drop the remove_dir_all from remove_worktree and this
-    /// test fails.
-    #[test]
-    fn merge_branch_recovers_from_an_unregistered_leftover_directory() {
-        let td = tempfile::TempDir::new().unwrap();
-        let work = td.path().join("work");
-        std::fs::create_dir_all(&work).unwrap();
-        let g = |args: &[&str], dir: &Path| {
-            assert!(
-                Command::new("git")
-                    .args(args)
-                    .current_dir(dir)
-                    .status()
-                    .unwrap()
-                    .success(),
-                "git {args:?} failed"
-            );
-        };
-        g(&["init", "-q"], &work);
-        g(&["config", "user.email", "t@t"], &work);
-        g(&["config", "user.name", "t"], &work);
-        std::fs::write(work.join("base.txt"), b"base\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "base"], &work);
-        let main = {
-            let o = Command::new("git")
-                .args(["symbolic-ref", "--short", "HEAD"])
-                .current_dir(&work)
-                .output()
-                .unwrap();
-            String::from_utf8_lossy(&o.stdout).trim().to_string()
-        };
-        g(&["checkout", "-q", "-b", "feature"], &work);
-        std::fs::write(work.join("feat.txt"), b"feat\n").unwrap();
-        g(&["add", "."], &work);
-        g(&["commit", "-qm", "feat"], &work);
-        g(&["checkout", "-q", &main], &work);
-
-        let bare = td.path().join("bare.git");
-        g(
-            &[
-                "clone",
-                "--bare",
-                "-q",
-                work.to_str().unwrap(),
-                bare.to_str().unwrap(),
-            ],
-            td.path(),
-        );
-
-        // A directory in the way, with nothing registered behind it.
-        std::fs::create_dir_all(bare.join("_merge_worktree")).unwrap();
-        std::fs::write(bare.join("_merge_worktree/leftover.txt"), b"junk\n").unwrap();
-        assert!(
-            !bare.join("worktrees/_merge_worktree").exists(),
-            "fixture must leave no registration, only the directory"
-        );
-
-        let before = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let before = String::from_utf8_lossy(&before.stdout).trim().to_string();
-
-        let merged = merge_branch(&bare, &main, "feature", "did:key:zTest", "t")
-            .expect("an unregistered leftover directory must not wedge the merge endpoint");
-
-        let after = Command::new("git")
-            .args(["rev-parse", &format!("refs/heads/{main}")])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        let after = String::from_utf8_lossy(&after.stdout).trim().to_string();
-        assert_ne!(before, after, "the merge must advance refs/heads/{main}");
-        assert_eq!(after, merged, "the returned sha must be the new branch tip");
-    }
 }

crates/gitlawb-node/src/git/tigris.rs

@@ -10,64 +10,34 @@ use std::sync::{Arc, Mutex, OnceLock};
 
 use anyhow::{Context, Result};
 use aws_sdk_s3::Client as S3Client;
-use tracing::{debug, info, warn};
+use tracing::{debug, info};
 
-// The publication vocabulary lives in `git::publish`, which carries no
-// object-storage types, and is re-exported here so existing `git::tigris::…`
-// imports keep resolving. #79 deletes this file; `git::publish` is what survives
-// the swap, and the only backend-aware code below is `classify_dispatch`.
-pub use super::publish::{
-    DispatchKnowledge, PublishAttemptId, PublishStage, PublishStageCell, StoredGeneration,
-    UploadError, UploadPrecondition, UploadReceipt, ATTEMPT_METADATA_KEY,
-};
-
-/// What happened to a conditional, attempt-guarded delete.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum AttemptDelete {
-    /// The object was this attempt's and is gone.
-    Deleted,
-    /// Nothing is stored under the key.
-    Absent,
-    /// Something is stored, and it is NOT this attempt's work. Left alone.
-    NotOurs,
+/// The precondition an upload is fenced on.
+///
+/// Object storage is the only place a fence can hold. Dropping the future of an
+/// in-flight PUT does not cancel the request the server is already processing,
+/// so no amount of local locking stops an abandoned writer's bytes from landing
+/// after a successor has published. A conditional PUT the store itself refuses
+/// is what actually stops it.
+#[derive(Clone, Debug)]
+pub enum UploadPrecondition {
+    /// Publish only if the stored object is still the generation we observed.
+    IfMatch(String),
+    /// Publish only if nothing is stored under the key yet.
+    IfAbsent,
+    /// No fence. Last writer wins.
+    Unconditional,
 }
 
-/// THE ONLY BACKEND-AWARE CLASSIFIER in the publish path.
-///
-/// It answers one question: does this failure PROVE the request never committed?
-/// Anything short of proof is [`DispatchKnowledge::MaybeSent`], because the
-/// caller's next move on a definite failure is destructive (delete the object,
-/// drop the only local clone, invalidate the cache) and being wrong there
-/// destroys published state.
-///
-/// - An HTTP status means the server answered. A 4xx is a refusal it took
-///   BEFORE storing anything, so it proves non-publication. A 5xx does not: the
-///   store can commit and then fail to report it.
-/// - No status at all means no response was read. Only a construction failure
-///   proves the request never left; Smithy's timeout, dispatch and response
-///   errors all allow that the bytes arrived and committed while the answer was
-///   lost, corrupted, or never parsed.
-/// - `SdkError` is `#[non_exhaustive]`, so the fallback arm must be the CAUTIOUS
-///   one. A future variant defaulting to "definitely failed" would silently
-///   re-open exactly the class this closes.
-///
-/// #79 replaces `tigris.rs` with a `BlobStore` layer; this function is the piece
-/// each backend reimplements, and nothing above it changes.
-fn classify_put_failure<E, R>(
-    err: &aws_sdk_s3::error::SdkError<E, R>,
-    status: Option<u16>,
-) -> DispatchKnowledge {
-    if let Some(status) = status {
-        return if (400..500).contains(&status) {
-            DispatchKnowledge::NeverSent
-        } else {
-            DispatchKnowledge::MaybeSent
-        };
-    }
-    match err {
-        aws_sdk_s3::error::SdkError::ConstructionFailure(_) => DispatchKnowledge::NeverSent,
-        _ => DispatchKnowledge::MaybeSent,
-    }
+/// Why an upload failed, split so a caller can tell "someone else already
+/// published this key" (expected, and dropping our bytes is the correct
+/// outcome) from a real storage failure.
+#[derive(Debug, thiserror::Error)]
+pub enum UploadError {
+    #[error("upload precondition lost (HTTP {status})")]
+    PreconditionLost { status: u16 },
+    #[error(transparent)]
+    Other(#[from] anyhow::Error),
 }
 
 /// Wrapper around the S3 client with the configured bucket.
@@ -75,51 +45,6 @@ fn classify_put_failure<E, R>(
 pub struct TigrisClient {
     s3: S3Client,
     bucket: String,
-    /// Test-only seam: when set, the blocking compression inside `upload_tracked`
-    /// parks on this barrier. That is the ONLY window in which a publish attempt
-    /// can be cancelled with `PublishStage::PreparingArchive` still holding, and
-    /// it is unreachable from outside without a seam because compression of a
-    /// test-sized repo finishes in microseconds.
-    #[cfg(test)]
-    compress_gate: Option<Arc<BlockingGate>>,
-}
-
-/// A gate a BLOCKING thread parks on until a test opens it.
-///
-/// A condvar rather than a held `MutexGuard`: the test's assertions run while the
-/// gate is shut, and holding a `std::sync::MutexGuard` across those awaits is
-/// both a lint violation and a real hazard. Here the test owns no guard at all —
-/// it flips a flag and notifies.
-#[cfg(test)]
-#[derive(Default)]
-pub struct BlockingGate {
-    open: Mutex<bool>,
-    opened: std::sync::Condvar,
-}
-
-#[cfg(test)]
-impl BlockingGate {
-    /// A gate that starts SHUT.
-    pub fn shut() -> Self {
-        Self::default()
-    }
-
-    fn wait(&self) {
-        let mut open = self.open.lock().expect("compression gate poisoned");
-        while !*open {
-            open = self
-                .opened
-                .wait(open)
-                .expect("compression gate poisoned while waiting");
-        }
-    }
-
-    /// Let every parked compression through. Call this at teardown so the
-    /// blocking thread is not stranded for the life of the process.
-    pub fn open(&self) {
-        *self.open.lock().expect("compression gate poisoned") = true;
-        self.opened.notify_all();
-    }
 }
 
 impl TigrisClient {
@@ -132,8 +57,6 @@ impl TigrisClient {
         Ok(Self {
             s3,
             bucket: bucket.to_string(),
-            #[cfg(test)]
-            compress_gate: None,
         })
     }
 
@@ -161,19 +84,9 @@ impl TigrisClient {
         Self {
             s3: S3Client::from_conf(config),
             bucket: bucket.to_string(),
-            compress_gate: None,
         }
     }
 
-    /// Test-only: park this client's blocking compression on `gate` until the
-    /// holder releases it, so a cancellation can be aimed at
-    /// [`PublishStage::PreparingArchive`] rather than at the PUT.
-    #[cfg(test)]
-    pub fn with_compress_gate(mut self, gate: Arc<BlockingGate>) -> Self {
-        self.compress_gate = Some(gate);
-        self
-    }
-
     /// S3 key for a given repo: `repos/v1/{owner_slug}/{repo_name}.tar.zst`
     fn repo_key(owner_slug: &str, repo_name: &str) -> String {
         format!("repos/v1/{owner_slug}/{repo_name}.tar.zst")
@@ -209,24 +122,6 @@ impl TigrisClient {
     /// that only want the boolean, and widening its return type would churn
     /// every one of them for no benefit.
     pub async fn head_etag(&self, owner_slug: &str, repo_name: &str) -> Result<Option<String>> {
-        Ok(self
-            .head_generation(owner_slug, repo_name)
-            .await?
-            .map(|g| g.etag)
-            .unwrap_or(None))
-    }
-
-    /// The full stored generation: the ETag AND the attempt that published it.
-    ///
-    /// The attempt half is what makes a lost response recoverable. An ETag alone
-    /// answers "has the generation moved", which every writer sees the same way;
-    /// the attempt id answers "are the published bytes MINE", which is the
-    /// question a client whose PUT response vanished actually needs answered.
-    pub async fn head_generation(
-        &self,
-        owner_slug: &str,
-        repo_name: &str,
-    ) -> Result<Option<StoredGeneration>> {
         let key = Self::repo_key(owner_slug, repo_name);
         match self
             .s3
@@ -236,20 +131,11 @@ impl TigrisClient {
             .send()
             .await
         {
-            Ok(out) => {
-                let etag = out
-                    .e_tag()
+            Ok(out) => Ok(Some(
+                out.e_tag()
                     .context(format!("tigris HEAD {key}: hit carried no ETag"))?
-                    .to_string();
-                let attempt = out
-                    .metadata()
-                    .and_then(|m| m.get(ATTEMPT_METADATA_KEY))
-                    .cloned();
-                Ok(Some(StoredGeneration {
-                    etag: Some(etag),
-                    attempt,
-                }))
-            }
+                    .to_string(),
+            )),
             Err(e) => {
                 if e.as_service_error().is_some_and(|e| e.is_not_found()) {
                     Ok(None)
@@ -260,110 +146,26 @@ impl TigrisClient {
         }
     }
 
-    /// Did `attempt`'s bytes land? The reconciliation an ambiguous dispatch owes
-    /// before anything downstream may treat it as confirmation.
-    ///
-    /// `Ok(false)` is deliberately NOT "the PUT failed": an abandoned request may
-    /// still be in flight, so a negative answer licenses refusing and retrying,
-    /// never deleting. Only `Ok(true)` upgrades an unresolved attempt to
-    /// published.
-    pub async fn attempt_landed(
-        &self,
-        owner_slug: &str,
-        repo_name: &str,
-        attempt: &PublishAttemptId,
-    ) -> Result<bool> {
-        Ok(self
-            .head_generation(owner_slug, repo_name)
-            .await?
-            .is_some_and(|g| g.belongs_to(attempt)))
-    }
-
     /// Upload a local bare repo directory to Tigris as a tar.zst archive,
-    /// fenced by `precondition`, under a freshly minted attempt identity.
+    /// fenced by `precondition`.
     pub async fn upload(
         &self,
         owner_slug: &str,
         repo_name: &str,
         local_path: &Path,
         precondition: UploadPrecondition,
-    ) -> std::result::Result<UploadReceipt, UploadError> {
-        self.upload_tracked(
-            owner_slug,
-            repo_name,
-            local_path,
-            precondition,
-            PublishAttemptId::new(),
-            None,
-        )
-        .await
-    }
-
-    /// The full form: a caller-chosen attempt identity, and a stage cell the
-    /// upload reports its progress into.
-    ///
-    /// The stage cell is the answer to "a dropped future never returns an
-    /// outcome". Compression runs inside `spawn_blocking` and the conditional PUT
-    /// is not even constructed until it finishes, so a handler cancelled during
-    /// compression definitely never attempted publication — but nothing could
-    /// observe that, because the only report was the return value of a future
-    /// that no longer exists. Marking [`PublishStage::PreparingArchive`] before
-    /// the blocking call and [`PublishStage::PutDispatched`] immediately before
-    /// `send()` makes that boundary readable from outside.
-    pub async fn upload_tracked(
-        &self,
-        owner_slug: &str,
-        repo_name: &str,
-        local_path: &Path,
-        precondition: UploadPrecondition,
-        attempt: PublishAttemptId,
-        stage: Option<&PublishStageCell>,
-    ) -> std::result::Result<UploadReceipt, UploadError> {
+    ) -> std::result::Result<(), UploadError> {
         let key = Self::repo_key(owner_slug, repo_name);
-        debug!(key = %key, path = %local_path.display(), attempt = %attempt, "uploading repo to tigris");
+        debug!(key = %key, path = %local_path.display(), "uploading repo to tigris");
 
-        if let Some(stage) = stage {
-            stage.set(PublishStage::PreparingArchive);
-        }
-
-        // Create tar.zst in memory. Nothing has been sent at this point and
-        // nothing can be: the request below is not constructed until this
-        // returns. A failure or a cancellation here is a definite
-        // non-publication.
-        let compressed = {
+        // Create tar.zst in memory
+        let archive_bytes = tokio::task::spawn_blocking({
             let local_path = local_path.to_path_buf();
-            #[cfg(test)]
-            let gate = self.compress_gate.clone();
-            tokio::task::spawn_blocking(move || {
-                // Test-only seam: park INSIDE the blocking compression, which is
-                // the window a handler can be cancelled in while
-                // `PublishStage::PreparingArchive` still holds.
-                #[cfg(test)]
-                if let Some(gate) = gate {
-                    // Blocks until the test opens the gate.
-                    gate.wait();
-                }
-                compress_repo(&local_path)
-            })
-            .await
-        };
-        let archive_bytes = match compressed {
-            Ok(Ok(bytes)) => bytes,
-            Ok(Err(e)) => {
-                if let Some(stage) = stage {
-                    stage.set(PublishStage::Refused);
-                }
-                return Err(UploadError::NotPublished(e.context("compressing repo")));
-            }
-            Err(e) => {
-                if let Some(stage) = stage {
-                    stage.set(PublishStage::Refused);
-                }
-                return Err(UploadError::NotPublished(
-                    anyhow::Error::new(e).context("tar task panicked"),
-                ));
-            }
-        };
+            move || compress_repo(&local_path)
+        })
+        .await
+        .context("tar task panicked")?
+        .context("compressing repo")?;
 
         let body = aws_sdk_s3::primitives::ByteStream::from(archive_bytes);
 
@@ -372,12 +174,6 @@ impl TigrisClient {
             .put_object()
             .bucket(&self.bucket)
             .key(&key)
-            // The attempt identity travels WITH the bytes. That is what makes a
-            // lost response recoverable: the client can HEAD the key afterwards
-            // and ask whether the published object is its own work, which is
-            // decidable, instead of asking whether its request succeeded, which
-            // is not.
-            .metadata(ATTEMPT_METADATA_KEY, attempt.as_str())
             .body(body)
             .content_type("application/zstd");
         match &precondition {
@@ -386,140 +182,47 @@ impl TigrisClient {
             UploadPrecondition::Unconditional => {}
         }
 
-        // From HERE the bytes may reach the store. Everything downstream that
-        // could destroy state has to treat this stage as "maybe published".
-        if let Some(stage) = stage {
-            stage.set(PublishStage::PutDispatched {
-                attempt: attempt.clone(),
-            });
-        }
-
-        let sent = req.send().await;
-        let out = match sent {
-            Ok(out) => out,
-            Err(e) => {
-                // `PutObjectError` models no PreconditionFailed variant (its arms are
-                // EncryptionTypeMismatch, InvalidRequest, InvalidWriteOffset,
-                // TooManyParts, Unhandled), so a refused precondition arrives as
-                // `Unhandled` and matching the enum would classify it as a generic
-                // failure. The raw HTTP status off the response is the only place the
-                // answer actually lives.
-                //
-                // Read it via `raw_response()`, not a `ServiceError`-only match: the
-                // SDK exposes the raw response for BOTH `ServiceError` and
-                // `ResponseError`, and a refused conditional PUT whose error body the
-                // SDK cannot parse (malformed XML, premature close) surfaces as
-                // `ResponseError`. Matching only `ServiceError` would classify that
-                // unparsable 409/412 as a generic failure, and `RepoWriteGuard::release`
-                // would log-and-succeed instead of taking the supersede retry,
-                // acknowledging a write that was definitively not published.
-                let status = e.raw_response().map(|raw| raw.status().as_u16());
-                // 412 is always a lost precondition. 409 is one only when we asked
-                // for create-only, which is how S3-compatible stores report "the key
-                // already exists". Everything else, 404 included, is a real failure:
-                // archive keys are never deleted by the write path, so a 404 here
-                // means something permanent like a missing bucket or a misrouted
-                // endpoint, and reporting that as a lost precondition would tell a
-                // caller to expect a successor that does not exist.
-                let lost = match status {
-                    Some(412) => true,
-                    Some(409) => matches!(precondition, UploadPrecondition::IfAbsent),
-                    _ => false,
-                };
-                if lost {
-                    if let Some(stage) = stage {
-                        stage.set(PublishStage::Refused);
-                    }
-                    return Err(UploadError::PreconditionLost {
-                        status: status.expect("a lost precondition came from a status"),
-                    });
-                }
-                let knowledge = classify_put_failure(&e, status);
-                let ctx = anyhow::Error::new(e).context(format!("tigris PUT {key}"));
-                return Err(match knowledge {
-                    DispatchKnowledge::NeverSent => {
-                        if let Some(stage) = stage {
-                            stage.set(PublishStage::Refused);
-                        }
-                        UploadError::NotPublished(ctx)
-                    }
-                    DispatchKnowledge::MaybeSent => {
-                        warn!(
-                            key = %key,
-                            attempt = %attempt,
-                            status = ?status,
-                            "tigris PUT failed WITHOUT proving it did not commit — the outcome \
-                             is ambiguous and must be reconciled, not compensated"
-                        );
-                        if let Some(stage) = stage {
-                            stage.set(PublishStage::Ambiguous {
-                                attempt: attempt.clone(),
-                            });
-                        }
-                        UploadError::Ambiguous {
-                            attempt: attempt.clone(),
-                            source: ctx,
-                        }
-                    }
+        if let Err(e) = req.send().await {
+            // `PutObjectError` models no PreconditionFailed variant (its arms are
+            // EncryptionTypeMismatch, InvalidRequest, InvalidWriteOffset,
+            // TooManyParts, Unhandled), so a refused precondition arrives as
+            // `Unhandled` and matching the enum would classify it as a generic
+            // failure. The raw HTTP status off the response is the only place the
+            // answer actually lives.
+            //
+            // Read it via `raw_response()`, not a `ServiceError`-only match: the
+            // SDK exposes the raw response for BOTH `ServiceError` and
+            // `ResponseError`, and a refused conditional PUT whose error body the
+            // SDK cannot parse (malformed XML, premature close) surfaces as
+            // `ResponseError`. Matching only `ServiceError` would classify that
+            // unparsable 409/412 as a generic failure, and `RepoWriteGuard::release`
+            // would log-and-succeed instead of taking the supersede retry,
+            // acknowledging a write that was definitively not published.
+            let status = e.raw_response().map(|raw| raw.status().as_u16());
+            // 412 is always a lost precondition. 409 is one only when we asked
+            // for create-only, which is how S3-compatible stores report "the key
+            // already exists". Everything else, 404 included, is a real failure:
+            // archive keys are never deleted (`delete` has no callers), so a 404
+            // here means something permanent like a missing bucket or a
+            // misrouted endpoint, and reporting that as a lost precondition
+            // would tell a caller to expect a successor that does not exist.
+            let lost = match status {
+                Some(412) => true,
+                Some(409) => matches!(precondition, UploadPrecondition::IfAbsent),
+                _ => false,
+            };
+            if lost {
+                return Err(UploadError::PreconditionLost {
+                    status: status.expect("a lost precondition came from a status"),
                 });
             }
-        };
+            return Err(UploadError::Other(
+                anyhow::Error::new(e).context(format!("tigris PUT {key}")),
+            ));
+        }
 
-        let etag = out.e_tag().map(str::to_string);
-        if let Some(stage) = stage {
-            stage.set(PublishStage::Published {
-                attempt: attempt.clone(),
-                etag: etag.clone(),
-            });
-        }
-        info!(key = %key, attempt = %attempt, "uploaded repo to tigris");
-        Ok(UploadReceipt { attempt, etag })
-    }
-
-    /// Delete a repo archive ONLY while it is still `attempt`'s work.
-    ///
-    /// The unconditional delete this replaces used the logical owner/name as its
-    /// cleanup authority, so a failed attempt compensating late could erase the
-    /// object a SUCCESSOR had already published under the same name and already
-    /// returned 201 for. A second name lookup before the delete only narrows that
-    /// window; reading the attempt id off the object and fencing the delete on
-    /// the generation it came from closes it.
-    pub async fn delete_if_attempt_matches(
-        &self,
-        owner_slug: &str,
-        repo_name: &str,
-        attempt: &PublishAttemptId,
-    ) -> Result<AttemptDelete> {
-        let Some(generation) = self.head_generation(owner_slug, repo_name).await? else {
-            return Ok(AttemptDelete::Absent);
-        };
-        if !generation.belongs_to(attempt) {
-            return Ok(AttemptDelete::NotOurs);
-        }
-        let key = Self::repo_key(owner_slug, repo_name);
-        let mut req = self.s3.delete_object().bucket(&self.bucket).key(&key);
-        // The If-Match guard is what makes this atomic rather than merely
-        // narrowed: between the HEAD above and this call a successor can publish,
-        // and the store refusing on the moved generation is the only thing that
-        // stops the delete landing on their object.
-        if let Some(etag) = generation.etag.as_deref() {
-            req = req.if_match(etag);
-        }
-        match req.send().await {
-            Ok(_) => Ok(AttemptDelete::Deleted),
-            Err(e) => {
-                // A refused conditional delete means the generation moved: the
-                // object is no longer ours, which is a successful outcome for a
-                // guard whose whole job is not to touch somebody else's bytes.
-                if e.raw_response()
-                    .map(|raw| raw.status().as_u16())
-                    .is_some_and(|s| s == 412 || s == 409)
-                {
-                    return Ok(AttemptDelete::NotOurs);
-                }
-                Err(anyhow::anyhow!("tigris conditional DELETE {key}: {e}"))
-            }
-        }
+        info!(key = %key, "uploaded repo to tigris");
+        Ok(())
     }
 
     /// Download a repo archive from Tigris and extract to local disk.
@@ -624,6 +327,19 @@ impl TigrisClient {
         info!(key = %key, path = %target.as_path().display(), "downloaded repo from tigris");
         Ok(extracted)
     }
+
+    /// Delete a repo archive from Tigris.
+    pub async fn delete(&self, owner_slug: &str, repo_name: &str) -> Result<()> {
+        let key = Self::repo_key(owner_slug, repo_name);
+        self.s3
+            .delete_object()
+            .bucket(&self.bucket)
+            .key(&key)
+            .send()
+            .await
+            .context(format!("tigris DELETE {key}"))?;
+        Ok(())
+    }
 }
 
 /// Compress a bare repo directory into a tar.zst byte vector.

crates/gitlawb-node/src/git/visibility_pack.rs

@@ -1,9 +1,7 @@
-//! Resolve which object OIDs must be withheld from a caller because every path
-//! at which the object appears is denied by the repo's visibility rules. Blobs
-//! and subtree trees are withholdable (mode B; trees since #135/#173). Commits
-//! and tags are never withheld: they are root-level metadata a "/" reader already
-//! clears. The replication pin path uses [`withheld_object_oids_bounded`] so a
-//! withheld-subtree tree is not exported to public IPFS (#172).
+//! Resolve which blob OIDs must be withheld from a caller because every path
+//! at which the blob appears is denied by the repo's visibility rules. Trees
+//! and commits are never withheld (mode B keeps SHAs intact); only blob
+//! content is held back.
 
 use crate::db::VisibilityRule;
 use crate::visibility::{visibility_check, Decision};
@@ -542,79 +540,6 @@ pub fn withheld_blob_oids_bounded(
     ))
 }
 
-/// Reachable blob AND withheld-subtree tree OIDs the anonymous (or `caller`)
-/// replication audience must not receive. The single source for
-/// `replication_withheld_set`: a blob-only set handed to [`replicable_objects`]
-/// reintroduces #172 (withheld trees pin to public IPFS).
-///
-/// Strict where [`tree_paths`] is lenient. This feeds a withheld filter, so
-/// absence means replicate; a missed reachable tree would leak. The walk
-/// therefore matches [`blob_paths`]: [`assert_all_refs_are_commits`] first, then
-/// a failing `rev-list --all [HEAD]` is an error, then [`object_paths`] (already
-/// fail-closed on ls-tree / non-UTF-8) plus [`root_tree_pairs`]. [`tree_paths`]
-/// stays the lenient allow-list walk for GET /ipfs/{cid} and the full-scan
-/// allowed-tree set, where absence withholds.
-pub fn withheld_object_oids_bounded(
-    repo_path: &Path,
-    git_bin: &str,
-    timeout: Duration,
-    rules: &[VisibilityRule],
-    is_public: bool,
-    owner_did: &str,
-    caller: Option<&str>,
-) -> Result<HashSet<String>> {
-    let deadline = Instant::now() + timeout;
-    assert_all_refs_are_commits(repo_path, git_bin, deadline)?;
-    let head_resolves = run_bounded_git(
-        git_bin,
-        &["rev-parse", "--verify", "HEAD"],
-        repo_path,
-        b"",
-        deadline,
-    )
-    .is_ok();
-    let mut rev_args = vec!["rev-list", "--all"];
-    if head_resolves {
-        rev_args.push("HEAD");
-    }
-    let commits_out = run_bounded_git(git_bin, &rev_args, repo_path, b"", deadline)?;
-    let commits: Vec<String> = String::from_utf8_lossy(&commits_out)
-        .lines()
-        .map(|l| l.trim().to_string())
-        .filter(|l| !l.is_empty())
-        .collect();
-    let triples = object_paths(repo_path, git_bin, &commits, deadline)?;
-    let mut pairs: Vec<(String, String)> = triples
-        .into_iter()
-        .filter(|(_, _, kind)| kind == "blob" || kind == "tree")
-        .map(|(oid, path, _)| (oid, path))
-        .collect();
-    pairs.extend(root_tree_pairs(repo_path, git_bin, &commits, deadline)?);
-    Ok(withheld_from_pairs(
-        &pairs, rules, is_public, owner_did, caller,
-    ))
-}
-
-/// [`withheld_object_oids_bounded`] with the test walk budget.
-#[cfg(test)]
-pub fn withheld_object_oids(
-    repo_path: &Path,
-    rules: &[VisibilityRule],
-    is_public: bool,
-    owner_did: &str,
-    caller: Option<&str>,
-) -> Result<HashSet<String>> {
-    withheld_object_oids_bounded(
-        repo_path,
-        "git",
-        WALK_TIMEOUT,
-        rules,
-        is_public,
-        owner_did,
-        caller,
-    )
-}
-
 /// Withheld set from an already-computed (oid, "/path") listing: a blob is
 /// withheld only when visibility denies the caller at *every* path it appears
 /// at. Split out so a caller that already walked `blob_paths` (e.g.
@@ -663,9 +588,8 @@ pub fn has_path_scoped_rule(rules: &[VisibilityRule]) -> bool {
 
 /// Objects that may replicate to the public: everything not in `withheld`.
 /// Order-preserving. The single seam every replication site (IPFS, Pinata)
-/// passes its object list through on the delta path. `withheld` MUST be the
-/// combined blob-and-tree set from [`withheld_object_oids_bounded`] (via
-/// `replication_withheld_set`); a blob-only set reintroduces #172.
+/// passes its object list through; option B would later reroute the withheld
+/// ones through encrypt-then-pin instead of dropping them.
 pub fn replicable_objects(all: Vec<String>, withheld: &HashSet<String>) -> Vec<String> {
     all.into_iter()
         .filter(|oid| !withheld.contains(oid))
@@ -703,23 +627,6 @@ pub fn replicable_blob_set_bounded(
     )
 }
 
-/// Reachable tree OIDs that visibility ALLOWS the anonymous replication
-/// audience at some path. The tree analog of [`replicable_blob_set_bounded`],
-/// used on the fail-closed full-scan pin path so a withheld or dangling tree
-/// is absent and dropped (#172).
-pub fn replicable_tree_set_bounded(
-    repo_path: &Path,
-    git_bin: &str,
-    timeout: Duration,
-    rules: &[VisibilityRule],
-    is_public: bool,
-    owner_did: &str,
-) -> Result<HashSet<String>> {
-    allowed_tree_set_for_caller_bounded(
-        repo_path, git_bin, timeout, rules, is_public, owner_did, None,
-    )
-}
-
 /// Reachable blob OIDs that visibility ALLOWS `caller` at some path. The
 /// caller-aware generalization of `replicable_blob_set` (which is the anonymous
 /// `caller = None` case). Used by `GET /ipfs/{cid}` to gate fail-closed against
@@ -920,12 +827,11 @@ fn root_tree_pairs(
 /// Every `(tree_oid, "/path")` pair reachable in `repo_path`: the `kind == "tree"`
 /// slice of [`object_paths`] (subtree trees at their directory paths) PLUS every
 /// reachable commit's root tree at "/" (see [`root_tree_pairs`]). Computes the
-/// reachable-commit set ONCE (leniently, see [`reachable_commit_oids`]; the tree
-/// allowed-set feeds the `/ipfs/{cid}` tree gate AND the full-scan pin allow-list,
-/// where absence = fail-closed) and drives both the ls-tree walk and the root-tree
-/// pass from it, so the two cannot diverge and neither re-enumerates. The tree analog
-/// of [`blob_paths`], bounded by the same shared `deadline`. Not for a withheld
-/// filter: that path is [`withheld_object_oids_bounded`].
+/// reachable-commit set ONCE (leniently — see [`reachable_commit_oids`]; the tree
+/// allowed-set feeds ONLY the `/ipfs/{cid}` tree gate, where absence = fail-closed
+/// 404) and drives both the ls-tree walk and the root-tree pass from it, so the two
+/// cannot diverge and neither re-enumerates. The tree analog of [`blob_paths`],
+/// bounded by the same shared `deadline`.
 fn tree_paths(
     repo_path: &Path,
     git_bin: &str,
@@ -1244,29 +1150,22 @@ pub fn reachable_commit_tag_oids_bounded(
     Ok(set)
 }
 
-/// Objects safe to replicate, failing closed on blobs AND trees (#99, #172).
-/// A candidate replicates iff it is neither a known blob nor a known tree
-/// (commits and tags: structural, a "/" reader already clears) OR it is in
-/// `allowed_blobs` OR it is in `allowed_trees`. Trees have been content-withholdable
-/// since #135/#173; the old premise that they always pass is falsified. A dangling
-/// or withheld tree is in `all_tree_oids` and absent from `allowed_trees`, so it
-/// drops. Used on the full-scan pin path, where the candidate set can contain
-/// dangling objects the reachable-only withheld set cannot cover; the delta path
-/// keeps [`replicable_objects`].
+/// Objects safe to replicate, failing closed on blobs (#99). A candidate
+/// replicates iff it is NOT a blob (`all_blob_oids` — commits and trees are
+/// structural, never content-withheld) OR it is in `allowed_blobs` (reachable
+/// and visibility-allowed). This drops both withheld reachable blobs and
+/// dangling/unreachable blobs the reachable walk never classified, without
+/// tagging the candidate list with per-object types. Used on the full-scan pin
+/// path, where the candidate set can contain dangling objects the reachable-only
+/// withheld set cannot cover; the delta path keeps `replicable_objects`.
 pub fn replicable_objects_fail_closed(
     candidates: Vec<String>,
     allowed_blobs: &HashSet<String>,
     all_blob_oids: &HashSet<String>,
-    allowed_trees: &HashSet<String>,
-    all_tree_oids: &HashSet<String>,
 ) -> Vec<String> {
     candidates
         .into_iter()
-        .filter(|oid| {
-            let is_blob = all_blob_oids.contains(oid);
-            let is_tree = all_tree_oids.contains(oid);
-            (!is_blob && !is_tree) || allowed_blobs.contains(oid) || allowed_trees.contains(oid)
-        })
+        .filter(|oid| !all_blob_oids.contains(oid) || allowed_blobs.contains(oid))
         .collect()
 }
 
@@ -2485,49 +2384,28 @@ esac\n";
     }
 
     #[test]
-    fn fail_closed_keeps_commits_allowed_blobs_and_allowed_trees_only() {
-        // Deliberate invariant flip of fail_closed_keeps_nonblobs_and_allowed_blobs_only
-        // (#172). That test's premise ("commits and trees are structural, never
-        // content-withheld") was falsified by #135/#173: a withheld-subtree tree is
-        // content, same as a withheld blob. Commits and tags still pass; a blob or
-        // tree passes only if it is in its allowed set. Withheld and dangling blobs
-        // and trees (in the all-set, absent from allowed) drop.
-        let allowed_blobs: HashSet<String> = ["b_pub".to_string()].into_iter().collect();
+    fn fail_closed_keeps_nonblobs_and_allowed_blobs_only() {
+        // Non-blob objects (commit/tree) always pass; a blob passes only if it
+        // is in the allowed set. A withheld blob and a dangling blob (both in
+        // all_blob_oids, neither in allowed) are dropped.
+        let allowed: HashSet<String> = ["b_pub".to_string()].into_iter().collect();
         let all_blobs: HashSet<String> = ["b_pub", "b_secret", "b_dangling"]
             .into_iter()
             .map(String::from)
             .collect();
-        let allowed_trees: HashSet<String> =
-            ["t_root", "t_pub"].into_iter().map(String::from).collect();
-        let all_trees: HashSet<String> = ["t_root", "t_pub", "t_secret", "t_dangling"]
-            .into_iter()
-            .map(String::from)
-            .collect();
         let candidates = vec![
             "commit1".to_string(),
-            "tag1".to_string(),
-            "t_root".to_string(),
-            "t_pub".to_string(),
-            "t_secret".to_string(),
-            "t_dangling".to_string(),
+            "tree1".to_string(),
             "b_pub".to_string(),
             "b_secret".to_string(),
             "b_dangling".to_string(),
         ];
-        let got = replicable_objects_fail_closed(
-            candidates,
-            &allowed_blobs,
-            &all_blobs,
-            &allowed_trees,
-            &all_trees,
-        );
+        let got = replicable_objects_fail_closed(candidates, &allowed, &all_blobs);
         assert_eq!(
             got,
             vec![
                 "commit1".to_string(),
-                "tag1".to_string(),
-                "t_root".to_string(),
-                "t_pub".to_string(),
+                "tree1".to_string(),
                 "b_pub".to_string()
             ]
         );
@@ -2604,12 +2482,8 @@ esac\n";
         );
 
         // Full-scan candidate set includes the dangling blob; fail-closed drops it.
-        // Empty tree sets keep today's keep-all-trees behavior for this blob-only
-        // case (U1 signature adapt; U3 wires the real tree walks).
-        let no_trees: HashSet<String> = HashSet::new();
         let candidates = vec![dangling_oid.clone(), public_oid.clone()];
-        let replicable =
-            replicable_objects_fail_closed(candidates, &allowed, &all_blobs, &no_trees, &no_trees);
+        let replicable = replicable_objects_fail_closed(candidates, &allowed, &all_blobs);
         assert!(
             !replicable.contains(&dangling_oid),
             "#99: a dangling private blob must not replicate"
@@ -2620,210 +2494,6 @@ esac\n";
         );
     }
 
-    #[test]
-    fn withheld_object_set_contains_withheld_subtree_tree() {
-        // #172 repro as a test: the withheld /secret tree must enter the combined
-        // withheld set (today's blob-only walk omits it because trees are never in
-        // all_blob_oids). Nested secret/nested is the same leak class.
-        let td = TempDir::new().unwrap();
-        let work = td.path().join("work");
-        let bare = td.path().join("bare.git");
-        let run = |args: &[&str], dir: &Path| {
-            assert!(
-                Command::new("git")
-                    .args(args)
-                    .current_dir(dir)
-                    .status()
-                    .unwrap()
-                    .success(),
-                "git {args:?} failed"
-            );
-        };
-        std::fs::create_dir_all(work.join("public")).unwrap();
-        std::fs::create_dir_all(work.join("secret/nested")).unwrap();
-        std::fs::write(work.join("public/a.txt"), b"public bytes\n").unwrap();
-        std::fs::write(work.join("secret/b.txt"), b"TOP SECRET\n").unwrap();
-        std::fs::write(work.join("secret/nested/c.txt"), b"NESTED SECRET\n").unwrap();
-        run(&["init", "-q"], &work);
-        run(&["config", "user.email", "t@t"], &work);
-        run(&["config", "user.name", "t"], &work);
-        run(&["add", "."], &work);
-        run(&["commit", "-qm", "init"], &work);
-        run(
-            &[
-                "clone",
-                "-q",
-                "--bare",
-                work.to_str().unwrap(),
-                bare.to_str().unwrap(),
-            ],
-            td.path(),
-        );
-        let oid = |rev: &str| {
-            let out = Command::new("git")
-                .args(["rev-parse", rev])
-                .current_dir(&bare)
-                .output()
-                .unwrap();
-            assert!(out.status.success(), "rev-parse {rev}");
-            String::from_utf8_lossy(&out.stdout).trim().to_string()
-        };
-        let secret_tree = oid("HEAD:secret");
-        let nested_tree = oid("HEAD:secret/nested");
-        let secret_blob = oid("HEAD:secret/b.txt");
-        let public_tree = oid("HEAD:public");
-        let public_blob = oid("HEAD:public/a.txt");
-        let root_tree = oid("HEAD^{tree}");
-        let head = oid("HEAD");
-        let rules = [rule("/secret/**", &[])];
-        let withheld = withheld_object_oids(&bare, &rules, true, OWNER, None).unwrap();
-        assert!(
-            withheld.contains(&secret_tree),
-            "withheld /secret tree must be in the combined withheld set (#172)"
-        );
-        assert!(
-            withheld.contains(&nested_tree),
-            "nested withheld tree secret/nested must also be withheld"
-        );
-        assert!(
-            withheld.contains(&secret_blob),
-            "withheld blob remains withheld"
-        );
-        assert!(!withheld.contains(&root_tree), "root tree is allowed at /");
-        assert!(
-            !withheld.contains(&public_tree),
-            "public subtree tree is not withheld"
-        );
-        assert!(
-            !withheld.contains(&public_blob),
-            "public blob is not withheld"
-        );
-        assert!(!withheld.contains(&head), "commits are never withheld");
-
-        let candidates_out = Command::new("git")
-            .args(["rev-list", "--objects", "--no-object-names", "HEAD"])
-            .current_dir(&bare)
-            .output()
-            .unwrap();
-        assert!(candidates_out.status.success());
-        let candidates: Vec<String> = String::from_utf8_lossy(&candidates_out.stdout)
-            .lines()
-            .map(|l| l.trim().to_string())
-            .filter(|l| !l.is_empty())
-            .collect();
-        let replicable = replicable_objects(candidates, &withheld);
-        assert!(
-            replicable.contains(&head) && replicable.contains(&root_tree),
-            "commit and root tree still replicate"
-        );
-        assert!(
-            replicable.contains(&public_tree) && replicable.contains(&public_blob),
-            "public tree and blob still replicate"
-        );
-        assert!(
-            !replicable.contains(&secret_tree) && !replicable.contains(&secret_blob),
-            "secret tree and blob must drop from the replicable set (#172)"
-        );
-        assert!(
-            !replicable.contains(&nested_tree),
-            "nested withheld tree must drop too"
-        );
-    }
-
-    #[test]
-    fn withheld_object_set_blob_slice_matches_withheld_blob_oids() {
-        let (_td, bare, _s, _p) = fixture();
-        let rules = [rule("/secret/**", &[])];
-        let combined = withheld_object_oids(&bare, &rules, true, OWNER, None).unwrap();
-        let blobs = withheld_blob_oids(&bare, &rules, true, OWNER, None).unwrap();
-        let all_blobs =
-            crate::git::push_delta::all_blob_oids(&bare, "git", Instant::now() + WALK_TIMEOUT)
-                .unwrap();
-        let blob_slice: HashSet<String> = combined.intersection(&all_blobs).cloned().collect();
-        assert_eq!(
-            blob_slice, blobs,
-            "combined withheld set's blob slice must equal withheld_blob_oids (R4)"
-        );
-    }
-
-    #[test]
-    fn withheld_object_set_keeps_tree_shared_across_allowed_and_denied_paths() {
-        let td = TempDir::new().unwrap();
-        let work = td.path().join("work");
-        std::fs::create_dir_all(work.join("pub/sub")).unwrap();
-        std::fs::create_dir_all(work.join("sec/sub")).unwrap();
-        std::fs::write(work.join("pub/sub/f.txt"), b"same bytes\n").unwrap();
-        std::fs::write(work.join("sec/sub/f.txt"), b"same bytes\n").unwrap();
-        let run = |args: &[&str]| {
-            assert!(
-                Command::new("git")
-                    .args(args)
-                    .current_dir(&work)
-                    .status()
-                    .unwrap()
-                    .success(),
-                "git {args:?}"
-            );
-        };
-        run(&["init", "-q"]);
-        run(&["config", "user.email", "t@t"]);
-        run(&["config", "user.name", "t"]);
-        run(&["add", "."]);
-        run(&["commit", "-qm", "seed"]);
-        let oid = |rev: &str| {
-            let out = Command::new("git")
-                .args(["rev-parse", rev])
-                .current_dir(&work)
-                .output()
-                .unwrap();
-            String::from_utf8_lossy(&out.stdout).trim().to_string()
-        };
-        let pub_sub = oid("HEAD:pub/sub");
-        let sec_sub = oid("HEAD:sec/sub");
-        assert_eq!(pub_sub, sec_sub, "identical content dedups to one tree oid");
-        let rules = [rule("/sec/**", &[])];
-        let withheld = withheld_object_oids(&work, &rules, true, OWNER, None).unwrap();
-        assert!(
-            !withheld.contains(&pub_sub),
-            "a tree reachable at an allowed path is not withheld even when also at a denied path"
-        );
-    }
-
-    #[test]
-    fn withheld_object_set_empty_with_root_only_rules() {
-        let (_td, bare, _s, _p) = fixture();
-        // A caller who has already passed the "/" gate: the listed reader of a
-        // root-only rule. Path-scoped withholding cannot apply, so the set is empty
-        // (R7, the has_path_scoped_rule short-circuit premise).
-        let rules = [rule("/", &["did:key:zFriend"])];
-        let withheld =
-            withheld_object_oids(&bare, &rules, true, OWNER, Some("did:key:zFriend")).unwrap();
-        assert!(
-            withheld.is_empty(),
-            "root-only rules cannot withhold a blob or tree from a caller who passed the / gate (R7)"
-        );
-    }
-
-    #[test]
-    fn withheld_object_walk_fails_closed_on_non_commit_ref() {
-        let (_td, bare, _s, _p) = fixture();
-        let secret_tree = {
-            let out = Command::new("git")
-                .args(["rev-parse", "HEAD:secret"])
-                .current_dir(&bare)
-                .output()
-                .unwrap();
-            String::from_utf8_lossy(&out.stdout).trim().to_string()
-        };
-        std::fs::write(bare.join("refs/heads/treeref"), format!("{secret_tree}\n")).unwrap();
-        let rules = [rule("/secret/**", &[])];
-        let result = withheld_object_oids(&bare, &rules, true, OWNER, None);
-        assert!(
-            result.is_err(),
-            "a ref that peels to a tree must fail the withheld walk closed (Err), not a partial set"
-        );
-    }
-
     #[test]
     fn allowed_set_excludes_dangling_blob_for_every_caller() {
         // #126: a blob written via `git hash-object -w` but never referenced has

crates/gitlawb-node/src/graphql/mutation.rs

@@ -186,78 +186,57 @@ mod tests {
             .join("; ")
     }
 
-    /// N2: every GraphQL mutation requires a verified signer and binds the acting
-    /// DID to it. Unsigned is rejected; a signer other than the claimed actor is
+    /// N2: GraphQL mutations require a verified signer and bind the acting DID to
+    /// it. Unsigned is rejected; a signer other than the claimed actor is
     /// rejected; the matching signer passes the auth gate.
     #[sqlx::test]
-    async fn each_mutation_requires_and_binds_signer(pool: PgPool) {
+    async fn mutation_requires_and_binds_signer(pool: PgPool) {
         let state = crate::test_support::test_state(pool).await;
         let schema = state.graphql_schema.as_ref();
-        let actor = "did:key:zGQLACTORAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let other = "did:key:zGQLOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
-        let cases: Vec<(&str, String)> = vec![
-            (
-                "createTask",
-                format!(
-                    r#"mutation {{ createTask(delegatorDid: "{actor}", input: {{ kind: "build", capability: "repo:write" }}) {{ id }} }}"#
-                ),
-            ),
-            (
-                "claimTask",
-                format!(
-                    r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{actor}") {{ id }} }}"#
-                ),
-            ),
-            (
-                "completeTask",
-                format!(
-                    r#"mutation {{ completeTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
-                ),
-            ),
-            (
-                "failTask",
-                format!(
-                    r#"mutation {{ failTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
-                ),
-            ),
-        ];
+        let assignee = "did:key:zASSIGNEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+        let q = format!(
+            r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{assignee}") {{ id }} }}"#
+        );
 
-        for (name, q) in &cases {
-            let resp = schema.execute(Request::new(q.as_str())).await;
-            assert!(
-                errors(&resp).contains("authentication required"),
-                "{name}: unsigned mutation must be rejected: {}",
-                errors(&resp)
-            );
+        // 1. Unsigned → rejected before any DB work.
+        let resp = schema.execute(Request::new(&q)).await;
+        assert!(
+            errors(&resp).contains("authentication required"),
+            "unsigned mutation must be rejected: {}",
+            errors(&resp)
+        );
 
-            let resp = schema
-                .execute(Request::new(q.as_str()).data(AuthenticatedDid(other.into())))
-                .await;
-            assert!(
-                errors(&resp).contains("authenticated signer"),
-                "{name}: DID mismatch must be rejected: {}",
-                errors(&resp)
-            );
+        // 2. Signed as someone other than the claimed assignee → rejected.
+        let resp = schema
+            .execute(Request::new(&q).data(AuthenticatedDid(
+                "did:key:zOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".into(),
+            )))
+            .await;
+        assert!(
+            errors(&resp).contains("authenticated signer"),
+            "DID mismatch must be rejected: {}",
+            errors(&resp)
+        );
 
-            let resp = schema
-                .execute(Request::new(q.as_str()).data(AuthenticatedDid(actor.into())))
-                .await;
-            let errs = errors(&resp);
-            assert!(
-                !errs.contains("authentication required") && !errs.contains("authenticated signer"),
-                "{name}: matching signer must pass the auth gate: {errs}"
-            );
-            if *name == "claimTask" {
-                assert!(
-                    errs.contains("task not claimable"),
-                    "claim race / missing task must keep its business message: {errs}"
-                );
-                assert!(
-                    !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
-                    "business error must not be rewritten as opaque DB error: {errs}"
-                );
-            }
-        }
+        // 3. Signed as the claimed assignee → passes the auth gate. The missing
+        //    task is a business error from claim_task, not a sqlx fault, so the
+        //    actionable message must survive (not the opaque DB string) (#250).
+        let resp = schema
+            .execute(Request::new(&q).data(AuthenticatedDid(assignee.into())))
+            .await;
+        let errs = errors(&resp);
+        assert!(
+            !errs.contains("authentication required") && !errs.contains("authenticated signer"),
+            "matching signer must pass the auth gate: {errs}"
+        );
+        assert!(
+            errs.contains("task not claimable"),
+            "claim race / missing task must keep its business message: {errs}"
+        );
+        assert!(
+            !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
+            "business error must not be rewritten as opaque DB error: {errs}"
+        );
     }
 
     /// #250: mutation DB faults must be opaque; create_task hits agent_tasks.

crates/gitlawb-node/src/ipfs_pin.rs

@@ -676,20 +676,7 @@ async fn warm_candidates(
                 &repo.owner_did,
                 &repo.name,
             ) {
-                // A tree whose publish is unresolved is filtered HERE, before the
-                // candidate is ever probed: discovery records the repo as a source
-                // for a CID, and refs that may never become durable must not become
-                // durable provenance. This is a different filter from the `quarantined`
-                // status flag dropped at candidate-load time; that one is an operator
-                // decision about a mirror, this one is "the store cannot confirm what
-                // is on disk right now". An unresolved candidate falls into the arm
-                // below and is accounted exactly as a cold one: absent, not evidence.
-                Ok(p)
-                    if p.is_dir()
-                        && !crate::git::repo_store::live_tree_publish_unresolved(p.as_path()) =>
-                {
-                    out.push((repo, created_at_key, p.into_path_buf()))
-                }
+                Ok(p) if p.is_dir() => out.push((repo, created_at_key, p.into_path_buf())),
                 Ok(_) => {}
                 Err(e) => {
                     tracing::warn!(repo_id = %repo.id, err = %e, "sweep discovery: rejected unsafe repo path");
@@ -1028,16 +1015,6 @@ async fn sweep_pass(
                 row_retryable = true;
                 continue;
             }
-            // The repo is on disk but its last publish is unresolved, so the refs it
-            // holds may never become durable. The sweep does not merely read here: it
-            // rewrites the legacy provider CID from whatever these objects say, which
-            // is state the resolver then serves. Skip, and count it retryable rather
-            // than settled: an unresolved publish resolves one way or the other, so
-            // the row is worth walking again, unlike a repo that is simply gone.
-            if crate::git::repo_store::live_tree_publish_unresolved(repo_path.as_path()) {
-                row_retryable = true;
-                continue;
-            }
             // The sweep holds no pin permit and has no batch to overrun, so the plain
             // `git_timeout` is the right budget here.
             row_read_attempted = true;
@@ -1508,6 +1485,9 @@ pub async fn pin_git_object(
         return Ok(String::new());
     }
 
+    // Compute the expected CIDv1 from the content bytes
+    let expected_cid = Cid::from_git_object_bytes(data).to_string();
+
     let url = format!(
         "{}/api/v0/add?cid-version=1&raw-leaves=true&pin=true",
         ipfs_api.trim_end_matches('/')
@@ -1554,10 +1534,6 @@ pub async fn pin_git_object(
         .text()
         .await
         .map_err(|e| anyhow::anyhow!("IPFS add response body read failed: {e}"))?;
-    // A 200 without a parseable Hash is not a successful pin. Fabricating the
-    // caller-computed CID would record an address the backend never confirmed;
-    // above its chunk threshold that raw CID is not even a stored block, so
-    // every later cat fails permanently.
     let cid = body
         .lines()
         .filter(|l| !l.trim().is_empty())
@@ -1566,17 +1542,7 @@ pub async fn pin_git_object(
             v["Hash"].as_str().map(|s| s.to_string())
         })
         .next_back()
-        .ok_or_else(|| {
-            anyhow::anyhow!(
-                "IPFS /api/v0/add returned 200 without a usable Hash: {:.200}",
-                body
-            )
-        })?;
-    // The string still has to be a CID. A garbage Hash would be recorded and
-    // later cat-ed the same way a missing one was, so reject it here.
-    Cid::from_str(&cid).map_err(|e| {
-        anyhow::anyhow!("IPFS /api/v0/add returned a Hash that is not a CID ({cid:.200}): {e}")
-    })?;
+        .unwrap_or(expected_cid.clone());
 
     tracing::debug!(sha256 = %sha256_hex, %cid, "pinned git object to IPFS");
     Ok(cid)
@@ -1636,7 +1602,7 @@ pub(crate) fn batch_budget_gate(
 /// `object_list` is the already-withheld-filtered OID set to pin: the caller
 /// applies `visibility_pack::replicable_objects` on the delta path or the
 /// `..._fail_closed` filter on the full-scan path before calling, so this
-/// function never sees a withheld blob or withheld-subtree tree. `repo_path` is still needed to read each
+/// function never sees a withheld blob. `repo_path` is still needed to read each
 /// object's bytes, and `git_bin` names the binary those reads run: the production
 /// callers pass the literal `"git"`, and a test passes a fake so the loop's own bound
 /// can be driven with a git that never answers. `repo_id` records the pin's provenance
@@ -2234,16 +2200,16 @@ mod tests {
         endpoint
     }
 
-    /// A sleeping-but-live endpoint. Answers `200` with a conformant NDJSON add
-    /// response after `delays[i]` for the i-th request it accepts (the last
-    /// entry repeats), so a test can make one add slow and the next fast.
-    /// Drains the full request, headers plus the declared `Content-Length`
-    /// body, before sleeping: exactly as in `rejecting_endpoint`, answering
-    /// early and closing would surface as a write failure on the client and
-    /// turn a slow-but-healthy add into a different failure shape.
+    /// A sleeping-but-live endpoint. Answers `200` with an empty body after
+    /// `delays[i]` for the i-th request it accepts (the last entry repeats), so
+    /// a test can make one add slow and the next fast. Drains the full request,
+    /// headers plus the declared `Content-Length` body, before sleeping: exactly
+    /// as in `rejecting_endpoint`, answering early and closing would surface as
+    /// a write failure on the client and turn a slow-but-healthy add into a
+    /// different failure shape.
     ///
-    /// The Hash is a fixed, real CID: the timing tests assert on pin counts,
-    /// not on the recorded address.
+    /// An empty body is a successful pin: `pin_git_object` falls back to the CID
+    /// it computed from the bytes when the response carries no `Hash`.
     async fn delaying_endpoint(delays: Vec<Duration>) -> String {
         use tokio::io::{AsyncReadExt, AsyncWriteExt};
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -2280,14 +2246,9 @@ mod tests {
                         }
                     }
                     tokio::time::sleep(delay).await;
-                    let body = br#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4","Size":"12"}
-"#;
-                    let resp = format!(
-                        "HTTP/1.1 200 OK\r\nContent-Type: application/x-ndjson\r\nContent-Length: {}\r\n\r\n",
-                        body.len()
-                    );
-                    let _ = sock.write_all(resp.as_bytes()).await;
-                    let _ = sock.write_all(body).await;
+                    let _ = sock
+                        .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
+                        .await;
                     let _ = sock.flush().await;
                 });
             }
@@ -2389,71 +2350,6 @@ mod tests {
         );
     }
 
-    /// A 200 add response with no parseable Hash must surface as an add
-    /// failure. Falling back to the caller-computed CID records an
-    /// unverifiable address: above the backend's chunk threshold that raw
-    /// CID is not a stored block, so every later cat 500s.
-    #[tokio::test]
-    async fn pin_git_object_rejects_a_200_without_a_hash() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
-            .with_status(200)
-            .with_body(r#"{"Name":"object","Size":"19"}"#)
-            .create_async()
-            .await;
-        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
-        assert!(
-            result.is_err(),
-            "a 200 without a Hash must be an add failure, not a fabricated CID: {result:?}"
-        );
-    }
-
-    /// A Hash that is a string but not a CID must also fail. It would be
-    /// recorded into `encrypted_blobs.cid` and every later cat would miss.
-    #[tokio::test]
-    async fn pin_git_object_rejects_a_malformed_hash() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
-            .with_status(200)
-            .with_body(r#"{"Hash":"not-a-cid","Size":"19"}"#)
-            .create_async()
-            .await;
-        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
-        assert!(
-            result.is_err(),
-            "a Hash that is not a CID must be an add failure: {result:?}"
-        );
-    }
-
-    /// The Hash text goes into the error and `encrypted_pin` logs that error,
-    /// so a backend answering with a huge invalid Hash must not produce an
-    /// unbounded log entry.
-    #[tokio::test]
-    async fn pin_git_object_bounds_an_oversized_invalid_hash_in_the_error() {
-        let long = "x".repeat(5000);
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
-            .with_status(200)
-            .with_body(format!(r#"{{"Hash":"{long}","Size":"19"}}"#))
-            .create_async()
-            .await;
-        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
-        let err = result.expect_err("an invalid Hash must be an add failure");
-        let msg = err.to_string();
-        assert!(
-            msg.len() < 1000,
-            "the error must bound the echoed Hash, got {} bytes",
-            msg.len()
-        );
-        assert!(
-            !msg.contains(&long),
-            "the error must not carry the full invalid Hash"
-        );
-    }
-
     /// The permit-hold bound. `pin_new_objects` runs under a deferring
     /// `pin_semaphore`, so without a batch deadline the hold is O(N) with N
     /// chosen by the pusher. Five objects against an endpoint that takes 2s

crates/gitlawb-node/src/metrics.rs

@@ -1,4 +1,4 @@
-//! Prometheus metrics for the Twigpine node.
+//! Prometheus metrics for the gitlawb node.
 //!
 //! Exposes a small, deliberately conservative set of counters and histograms
 //! that cover the questions an operator actually asks of a live node:
@@ -11,11 +11,6 @@
 //!     `gitlawb_sync_queue_processed_total{status}`
 //!   * are webhooks reaching their endpoints? —
 //!     `gitlawb_webhook_deliveries_total{result}`
-//!   * is inbound gossip being admitted or shed, and for which reason?
-//!     `gitlawb_gossip_ingest_events_total{outcome}`
-//!   * is the gossip replay seen-set full, and therefore admitting events it
-//!     cannot deduplicate?
-//!     `gitlawb_gossip_replay_guard_saturated_total`
 //!   * how big are the packs we're sending and receiving? —
 //!     `gitlawb_pack_size_bytes`
 //!   * a single `gitlawb_info{version, did}` gauge = 1, for joins/dashboards
@@ -38,8 +33,8 @@
 use std::sync::OnceLock;
 
 use prometheus::{
-    Encoder, Histogram, HistogramOpts, IntCounter, IntCounterVec, IntGauge, IntGaugeVec, Opts,
-    Registry, TextEncoder,
+    Encoder, Histogram, HistogramOpts, IntCounterVec, IntGauge, IntGaugeVec, Opts, Registry,
+    TextEncoder,
 };
 
 /// The single, process-wide metrics registry. Initialized by [`init`].
@@ -54,15 +49,8 @@ static AUTH_SUCCESSES: OnceLock<IntCounterVec> = OnceLock::new();
 static AUTH_FAILURES: OnceLock<IntCounterVec> = OnceLock::new();
 static SYNC_PROCESSED: OnceLock<IntCounterVec> = OnceLock::new();
 static WEBHOOK_DELIVERIES: OnceLock<IntCounterVec> = OnceLock::new();
-static GOSSIP_INGEST: OnceLock<IntCounterVec> = OnceLock::new();
-static GOSSIP_REPLAY_GUARD_SATURATED: OnceLock<IntCounter> = OnceLock::new();
 static PACK_SIZE: OnceLock<Histogram> = OnceLock::new();
 static PEERS_CONNECTED: OnceLock<IntGauge> = OnceLock::new();
-/// 1 when the node started without its p2p identity because the key storage
-/// could not be used. The node keeps serving HTTP in that state and /health
-/// stays green, so without this the outage is visible only to whoever reads
-/// the startup log.
-static P2P_KEY_LOAD_FAILED: OnceLock<IntGauge> = OnceLock::new();
 
 /// One-time initializer. Builds the registry, registers every metric,
 /// and sets the constant `gitlawb_info` gauge. Idempotent — calling
@@ -180,33 +168,6 @@ fn init_inner(version: &str, node_did: &str) {
         .set(webhook_deliveries)
         .expect("set WEBHOOK_DELIVERIES once");
 
-    let gossip_ingest = IntCounterVec::new(
-        Opts::new(
-            "gitlawb_gossip_ingest_events_total",
-            "Total inbound gossip ref-update events and what the ingest path decided about each",
-        ),
-        &["outcome"],
-    )
-    .expect("gitlawb_gossip_ingest_events_total definition");
-    registry
-        .register(Box::new(gossip_ingest.clone()))
-        .expect("register gitlawb_gossip_ingest_events_total");
-    GOSSIP_INGEST
-        .set(gossip_ingest)
-        .expect("set GOSSIP_INGEST once");
-
-    let gossip_replay_guard_saturated = IntCounter::with_opts(Opts::new(
-        "gitlawb_gossip_replay_guard_saturated_total",
-        "Inbound gossip ref-updates admitted without being recorded because the replay seen-set was at capacity",
-    ))
-    .expect("gitlawb_gossip_replay_guard_saturated_total definition");
-    registry
-        .register(Box::new(gossip_replay_guard_saturated.clone()))
-        .expect("register gitlawb_gossip_replay_guard_saturated_total");
-    GOSSIP_REPLAY_GUARD_SATURATED
-        .set(gossip_replay_guard_saturated)
-        .expect("set GOSSIP_REPLAY_GUARD_SATURATED once");
-
     let pack_size = Histogram::with_opts(
         HistogramOpts::new(
             "gitlawb_pack_size_bytes",
@@ -241,18 +202,6 @@ fn init_inner(version: &str, node_did: &str) {
         .set(peers_connected)
         .expect("set PEERS_CONNECTED once");
 
-    let p2p_key_load_failed = IntGauge::with_opts(Opts::new(
-        "gitlawb_p2p_identity_key_load_failed",
-        "1 if the node is running without p2p because its identity key could not be loaded",
-    ))
-    .expect("gitlawb_p2p_identity_key_load_failed definition");
-    registry
-        .register(Box::new(p2p_key_load_failed.clone()))
-        .expect("register gitlawb_p2p_identity_key_load_failed");
-    P2P_KEY_LOAD_FAILED
-        .set(p2p_key_load_failed)
-        .expect("set P2P_KEY_LOAD_FAILED once");
-
     REGISTRY
         .set(registry)
         .expect("set REGISTRY once (init must be called exactly once)");
@@ -321,66 +270,6 @@ pub fn record_webhook_delivery(result: &str) {
     }
 }
 
-/// Record what the gossip ingest path decided about one inbound ref-update.
-/// `outcome` ∈ {accepted, unsigned_admitted, write_failed, rejected,
-/// source_rate_limited, author_rate_limited, unsigned_source_rate_limited,
-/// replayed, stale_timestamp}.
-///
-/// `accepted` is reserved for signature-verified events. An unsigned event that
-/// survives the rolling-upgrade window is `unsigned_admitted`, so the
-/// authenticated-admission rate is not silently padded by legacy compatibility
-/// traffic; an operator can tell whether the fleet still relies on the
-/// compatibility allowance.
-///
-/// The three shed reasons stay separate labels rather than one `rate_limited`
-/// because they answer different operator questions: `source_rate_limited` is a
-/// forwarding peer over the pre-parse brake, `unsigned_source_rate_limited` is
-/// that same forwarder relaying unproven traffic, and `author_rate_limited`
-/// names a principal a signature actually proved. Collapsing them would make a
-/// flood of unauthenticated garbage indistinguishable from one registered peer
-/// pushing too hard, which is exactly the distinction an alert needs.
-///
-/// The label is the variant, never the free-form reason string that
-/// `Rejected`/`WriteFailed` carry: those are attacker-influenced and would blow
-/// up the label cardinality of a process-wide registry.
-pub fn record_gossip_ingest(outcome: &str) {
-    if let Some(c) = GOSSIP_INGEST.get() {
-        c.with_label_values(&[outcome]).inc();
-    }
-}
-
-/// Record one inbound gossip ref-update that the replay seen-set could not
-/// record because it was at capacity.
-///
-/// Label-less on purpose: there is one degradation mode and nothing about it
-/// varies per event, so a label would only add cardinality.
-///
-/// This is an alert-worthy signal, not a debug counter, and it is the ONLY way
-/// the degraded state is visible. At capacity the guard fails open, which means
-/// the event is admitted and `gitlawb_gossip_ingest_events_total{outcome=
-/// "accepted"}` counts it exactly as it counts a healthy admission. Fail-open is
-/// the right policy (a saturated set that dropped all fresh gossip would convert
-/// a loud resource attack into quiet mesh-wide censorship), but it is not a free
-/// one: while this counter is moving, a captured signature can again be replayed
-/// against the freshness window's full 10 minutes, spending a `peer_exists`
-/// round trip and a debit from the victim author's budget on every replay.
-pub fn record_gossip_replay_guard_saturated() {
-    if let Some(c) = GOSSIP_REPLAY_GUARD_SATURATED.get() {
-        c.inc();
-    }
-}
-
-/// Test-only: current `gitlawb_gossip_replay_guard_saturated_total` value (0 if
-/// the registry is not initialized). Lets the seen-set tests assert the
-/// saturation signal fires without scraping the encoded text.
-#[cfg(test)]
-pub fn replay_guard_saturated_count_for_test() -> u64 {
-    GOSSIP_REPLAY_GUARD_SATURATED
-        .get()
-        .map(|c| c.get())
-        .unwrap_or(0)
-}
-
 /// Record a pack body size observation (bytes).
 pub fn observe_pack_size(bytes: f64) {
     if let Some(h) = PACK_SIZE.get() {
@@ -395,13 +284,6 @@ pub fn set_peers_connected(count: i64) {
     }
 }
 
-/// Record whether the node is running without its p2p identity.
-pub fn set_p2p_key_load_failed(failed: bool) {
-    if let Some(g) = P2P_KEY_LOAD_FAILED.get() {
-        g.set(i64::from(failed));
-    }
-}
-
 /// Encode the registry as the standard Prometheus text exposition format.
 /// Returns an error if `init` was never called.
 pub fn encode() -> Result<String, prometheus::Error> {
@@ -483,12 +365,6 @@ mod tests {
         record_auth_failure("test/route", "test_reason");
         record_sync_processed("done");
         record_webhook_delivery("ok");
-        // `record_gossip_replay_guard_saturated` is deliberately NOT called
-        // here. It is a label-less process-wide counter and the seen-set test
-        // that asserts it asserts a before/after delta, so an increment from a
-        // second test running concurrently in this binary would be a flake with
-        // no diagnostic value.
-        record_gossip_ingest("accepted");
         observe_pack_size(1024.0);
         set_peers_connected(0);
     }

crates/gitlawb-node/src/pinata.rs

@@ -70,8 +70,7 @@ pub async fn pin_object(
 /// Pin any of the given candidate git objects that haven't yet been sent to
 /// Pinata.
 ///
-/// `object_list` is the already-withheld-filtered OID set to pin (blobs and
-/// withheld-subtree trees already dropped): the caller
+/// `object_list` is the already-withheld-filtered OID set to pin: the caller
 /// applies `visibility_pack::replicable_objects` on the delta path or the
 /// `..._fail_closed` filter on the full-scan path before calling. `repo_path` is
 /// still needed to read each object's bytes, and `git_bin` names the binary those

crates/gitlawb-node/src/rate_limit.rs

@@ -143,23 +143,6 @@ impl RateLimiter {
         false
     }
 
-    /// The configured key ceiling. Tests use it to assert that a limiter a
-    /// production factory builds is actually bounded, which flooding the real
-    /// ceiling in distinct keys would be far too slow to show.
-    #[cfg(test)]
-    pub fn max_keys(&self) -> usize {
-        self.max_keys
-    }
-
-    /// The configured per-key request cap. Tests use it to assert that a
-    /// limiter a production factory builds carries the cap it is documented
-    /// with; re-asserting the constant on its own cannot tell whether the
-    /// factory passed that constant or a different one.
-    #[cfg(test)]
-    pub fn max_requests(&self) -> usize {
-        self.max_requests
-    }
-
     pub async fn cleanup(&self) {
         let now = Instant::now();
         let mut state = self.state.lock().await;

crates/gitlawb-node/src/server.rs

@@ -42,37 +42,17 @@ async fn graphql_playground() -> impl IntoResponse {
     ))
 }
 
-/// Pre-auth body-buffer ceiling for every signed route group except the git write
-/// routes. Deliberately equal to axum's `DefaultBodyLimit` (2 MB), which is what
-/// these groups' `Bytes`/`Json` extractors already enforce: that default works
-/// through a request extension the extractors consult, and `require_signature`
-/// collects the raw body itself, so it never saw the cap. Matching the number
-/// keeps this change behavior-preserving on the response path (nothing that used
-/// to be accepted starts failing) and purely a memory fix.
-pub const SIGNED_BODY_LIMIT: usize = 2 * 1024 * 1024;
-
 /// Applies the standard auth middleware pair to a router: HTTP Signature verification
 /// followed by UCAN chain validation. The two layers run in this order for every
 /// matched request: `require_signature` first (sets `AuthenticatedDid`), then
 /// `require_ucan_chain` (reads it).
-///
-/// `body_limit` bounds the request body `require_signature` buffers before it has
-/// authenticated anything (see [`auth::SignatureBodyLimit`]): `max_pack_bytes` for
-/// the git write group, [`SIGNED_BODY_LIMIT`] for every other group.
-fn add_auth_layers(
-    router: Router<AppState>,
-    state: AppState,
-    body_limit: usize,
-) -> Router<AppState> {
+fn add_auth_layers(router: Router<AppState>, state: AppState) -> Router<AppState> {
     router
         .layer(middleware::from_fn_with_state(
             state,
             auth::require_ucan_chain,
         ))
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(body_limit),
-            auth::require_signature,
-        ))
+        .layer(middleware::from_fn(auth::require_signature))
 }
 
 pub fn build_router(state: AppState) -> Router {
@@ -83,10 +63,7 @@ pub fn build_router(state: AppState) -> Router {
         // Attach the verified DID to /graphql when a signature is present. The
         // layer covers only routes added before it, so /graphql/ws (added after,
         // read-only subscriptions) stays open.
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
-            auth::optional_signature,
-        ))
+        .layer(middleware::from_fn(auth::optional_signature))
         .route_service("/graphql/ws", GraphQLSubscription::new(schema));
 
     // ── Task routes (write — require HTTP Signature) ───────────────────────
@@ -97,7 +74,6 @@ pub fn build_router(state: AppState) -> Router {
             .route("/api/v1/tasks/{id}/complete", post(tasks::complete_task))
             .route("/api/v1/tasks/{id}/fail", post(tasks::fail_task)),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     );
 
     // ── Task routes (read — open) ──────────────────────────────────────────
@@ -131,7 +107,6 @@ pub fn build_router(state: AppState) -> Router {
             .layer(middleware::from_fn(rate_limit::rate_limit_by_did))
             .layer(axum::Extension(limiter)),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(create_ip_limiter));
@@ -206,7 +181,6 @@ pub fn build_router(state: AppState) -> Router {
                 axum::routing::delete(agents::deregister_agent),
             ),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     );
 
     // Body limit is raised to GITLAWB_MAX_PACK_BYTES (default 2 GB) for git
@@ -231,7 +205,6 @@ pub fn build_router(state: AppState) -> Router {
             .layer(DefaultBodyLimit::disable())
             .layer(RequestBodyLimitLayer::new(pack_limit)),
         state.clone(),
-        pack_limit,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(push_limiter));
@@ -252,19 +225,12 @@ pub fn build_router(state: AppState) -> Router {
     };
     let ipfs_routes = Router::new()
         .route("/ipfs/{cid}", get(ipfs::get_by_cid))
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
-            auth::optional_signature,
-        ))
+        .layer(middleware::from_fn(auth::optional_signature))
         .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
         .layer(axum::Extension(ipfs_limiter))
         .merge(Router::new().route("/api/v1/ipfs/pins", get(ipfs::list_pins)));
 
     // ── Arweave permanent anchors ──────────────────────────────────────────
-    // List endpoint only (public; issue #134 tracks surfacing
-    // visibility rules on list). The verify endpoint and its probe
-    // are deferred to the vertical slice with the uploader and a
-    // real provider contract (reviewer 2, #26 split 2/4 round 5).
     let arweave_routes = Router::new().route("/api/v1/arweave/anchors", get(arweave::list_anchors));
 
     // ── Bounty routes (write — require HTTP Signature) ─────────────────
@@ -292,7 +258,6 @@ pub fn build_router(state: AppState) -> Router {
                 post(bounties::dispute_bounty),
             ),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     );
 
     // ── Bounty routes (read — open) ──────────────────────────────────────
@@ -308,16 +273,12 @@ pub fn build_router(state: AppState) -> Router {
             "/api/v1/agents/{did}/bounties",
             get(bounties::agent_bounty_stats),
         )
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
-            auth::optional_signature,
-        ));
+        .layer(middleware::from_fn(auth::optional_signature));
 
     // ── Profile routes (write — require HTTP Signature) ─────────────────
     let profile_write_routes = add_auth_layers(
         Router::new().route("/api/v1/profile", axum::routing::put(profiles::set_profile)),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     );
 
     // ── Issue routes (write — require HTTP Signature, no rate limit) ─────
@@ -332,7 +293,6 @@ pub fn build_router(state: AppState) -> Router {
                 post(issues::create_issue_comment),
             ),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     );
 
     // ── Peer discovery routes ─────────────────────────────────────────────
@@ -351,7 +311,6 @@ pub fn build_router(state: AppState) -> Router {
     let sync_trigger_routes = add_auth_layers(
         Router::new().route("/api/v1/sync/trigger", post(peers::trigger_sync)),
         state.clone(),
-        SIGNED_BODY_LIMIT,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(rate_limit::IpRateLimiter {
@@ -368,12 +327,9 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/v1/peers/announce", post(peers::announce))
         .route("/api/v1/sync/notify", post(peers::notify_sync));
     peer_write_routes = if state.config.require_signed_peer_writes {
-        add_auth_layers(peer_write_routes, state.clone(), SIGNED_BODY_LIMIT)
+        add_auth_layers(peer_write_routes, state.clone())
     } else {
-        peer_write_routes.layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
-            auth::optional_signature,
-        ))
+        peer_write_routes.layer(middleware::from_fn(auth::optional_signature))
     };
     let peer_write_routes = peer_write_routes
         .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
@@ -472,10 +428,7 @@ pub fn build_router(state: AppState) -> Router {
             "/api/v1/repos/{owner}/{repo}/replicas",
             get(replicas::list_replicas),
         )
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
-            auth::optional_signature,
-        ));
+        .layer(middleware::from_fn(auth::optional_signature));
 
     // git-upload-pack (clone/fetch) — same raised body limit as receive-pack so
     // large pack responses from the server don't get truncated on the client side.
@@ -507,13 +460,7 @@ pub fn build_router(state: AppState) -> Router {
         )
         .layer(DefaultBodyLimit::disable())
         .layer(RequestBodyLimitLayer::new(pack_limit))
-        // `pack_limit`, not SIGNED_BODY_LIMIT: git-upload-pack POSTs live here and
-        // the group has deliberately raised its ceiling, so the pre-auth buffer for
-        // a signed fetch negotiation must match rather than narrow it.
-        .layer(middleware::from_fn_with_state(
-            auth::SignatureBodyLimit(pack_limit),
-            auth::optional_signature,
-        ));
+        .layer(middleware::from_fn(auth::optional_signature));
 
     // ── Meta ──────────────────────────────────────────────────────────────
     let meta_routes = Router::new()

crates/gitlawb-node/tests/p2p_key_startup_policy.rs

@@ -1,637 +0,0 @@
-//! Which p2p key-storage failures stop the node, and which leave HTTP up.
-//!
-//! The two domains are decided by different code at different phases, so the
-//! only honest proof is at the process boundary: spawn the real binary and
-//! watch what it does. A helper's returned error says nothing about whether
-//! `main` treated it as fatal.
-//!
-//! Every row also asserts the key tree is byte-identical afterwards. A refusal
-//! that mutates storage on its way out is its own defect, and a returned error
-//! cannot show that.
-//!
-//! No database: `DATABASE_URL` points at a closed port on purpose, so a row
-//! that reaches the degraded server proves the outcome is observable without
-//! Postgres. That is what makes the port-zero no-I/O guarantee testable at all.
-
-#![cfg(unix)]
-
-use std::io::{BufRead, BufReader, Read, Write};
-use std::os::unix::fs::PermissionsExt;
-use std::path::{Path, PathBuf};
-use std::process::{Child, Command, Stdio};
-use std::time::{Duration, Instant};
-
-/// Wall clock, never an iteration count: a fixed loop count starves on a slow
-/// or loaded machine and turns a real pass into a flake.
-const DEADLINE: Duration = Duration::from_secs(15);
-
-/// Kills the child on every exit path, including a panicking assertion.
-///
-/// Without this a failing row leaves a node behind that retries its database
-/// connection forever, holding the row's tempdir open. The first run of this
-/// file did exactly that, and the leak is invisible until something else in
-/// the suite gets slow.
-struct ChildGuard(Child);
-
-impl ChildGuard {
-    /// The tracing subscriber writes to STDOUT; only anyhow's final error
-    /// print goes to stderr. A row that watches one stream sees half the
-    /// story, so both are read.
-    fn take_stdout(&mut self) -> std::process::ChildStdout {
-        self.0.stdout.take().expect("stdout piped")
-    }
-
-    fn take_stderr(&mut self) -> std::process::ChildStderr {
-        self.0.stderr.take().expect("stderr piped")
-    }
-}
-
-impl Drop for ChildGuard {
-    fn drop(&mut self) {
-        let _ = self.0.kill();
-        let _ = self.0.wait();
-    }
-}
-
-/// `(path, is_dir, is_symlink, mode, len)` for everything under `root`, sorted.
-/// Taken before and after each row so a refusal that creates, chmods, or
-/// deletes anything fails the row.
-fn snapshot(root: &Path) -> Vec<String> {
-    fn walk(dir: &Path, out: &mut Vec<String>) {
-        let Ok(entries) = std::fs::read_dir(dir) else {
-            return;
-        };
-        for e in entries.flatten() {
-            let p = e.path();
-            let Ok(md) = std::fs::symlink_metadata(&p) else {
-                continue;
-            };
-            out.push(format!(
-                "{} dir={} link={} mode={:04o} len={}",
-                p.display(),
-                md.is_dir(),
-                md.is_symlink(),
-                md.permissions().mode() & 0o7777,
-                if md.is_file() { md.len() } else { 0 }
-            ));
-            if md.is_dir() && !md.is_symlink() {
-                walk(&p, out);
-            }
-        }
-    }
-    let mut out = Vec::new();
-    walk(root, &mut out);
-    out.sort();
-    out
-}
-
-struct Row {
-    /// Sandbox the row owns: HOME, repos, cwd and the key tree all live here.
-    home: tempfile::TempDir,
-}
-
-impl Row {
-    /// The only directory the no-mutation assertions watch.
-    fn tree(&self) -> PathBuf {
-        self.home.path().join("keytree")
-    }
-}
-
-impl Row {
-    fn new() -> Row {
-        let home = tempfile::tempdir().expect("tempdir");
-        std::fs::set_permissions(home.path(), std::fs::Permissions::from_mode(0o700))
-            .expect("chmod home");
-        // Created here, before any row takes its `before` snapshot, so the
-        // no-mutation assertions measure what the NODE did and not what this
-        // harness set up.
-        std::fs::create_dir_all(home.path().join("repos")).expect("repos dir");
-        // The p2p key tree lives in its own subdirectory so the no-mutation
-        // assertions can watch exactly it. HOME also holds `.gitlawb`, which
-        // the node creates for its NODE identity on every start; measuring the
-        // whole home would read that legitimate write as a p2p storage
-        // mutation.
-        let tree = home.path().join("keytree");
-        std::fs::create_dir(&tree).expect("key tree");
-        std::fs::set_permissions(&tree, std::fs::Permissions::from_mode(0o700))
-            .expect("chmod key tree");
-        Row { home }
-    }
-
-    fn spawn(&self, p2p_key: &str, p2p_port: &str, cwd: &Path) -> ChildGuard {
-        self.spawn_env(p2p_key, p2p_port, cwd, &[])
-    }
-
-    fn spawn_env(
-        &self,
-        p2p_key: &str,
-        p2p_port: &str,
-        cwd: &Path,
-        extra: &[(&str, &str)],
-    ) -> ChildGuard {
-        let repos = self.home.path().join("repos");
-        let mut cmd = Command::new(env!("CARGO_BIN_EXE_gitlawb-node"));
-        cmd.env_clear()
-            .env("PATH", std::env::var("PATH").unwrap_or_default())
-            // The subscriber is built from the default env filter, so with a
-            // cleared environment the node logs nothing at all and every
-            // assertion here reads as a timeout with empty output. The rows
-            // are about which log lines appear, so the filter is part of the
-            // fixture, not incidental setup.
-            .env("RUST_LOG", "info")
-            .env("HOME", self.home.path())
-            .env("GITLAWB_REPOS_DIR", &repos)
-            .env("GITLAWB_HOST", "127.0.0.1")
-            // Ephemeral: the real port is read back from the ready log.
-            .env("GITLAWB_PORT", "0")
-            // A closed port, so the node stays on the degraded path for the
-            // whole row instead of ever reaching a database.
-            .env("DATABASE_URL", "postgres://127.0.0.1:1/nonexistent")
-            .env("GITLAWB_P2P_PORT", p2p_port)
-            .env("GITLAWB_P2P_KEY", p2p_key)
-            .env("GITLAWB_METRICS_ADDR", "")
-            .current_dir(cwd)
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped());
-        for (k, v) in extra {
-            cmd.env(k, v);
-        }
-        cmd.spawn().map(ChildGuard).expect("spawn gitlawb-node")
-    }
-}
-
-/// Read the child's stderr until `needle` appears, the stream ends, or the
-/// deadline passes. Returns everything read.
-///
-/// The read runs on its own thread feeding a channel, and the deadline is
-/// enforced with `recv_timeout`. Checking elapsed time between blocking
-/// `read_line` calls does NOT work: a child that goes quiet blocks the read
-/// forever and the check never runs, so the deadline looks present and cannot
-/// fire. The first version of this file did that and hung for minutes on a row
-/// that was supposed to fail in fifteen seconds.
-fn read_until(child: &mut ChildGuard, needle: &str) -> (bool, String) {
-    read_until_all(child, &[needle])
-}
-
-/// Read until EVERY needle has appeared, the stream ends, or the deadline
-/// passes.
-///
-/// Waiting on a single line is a race here: the degraded server logs "ready"
-/// from a spawned task while the p2p gate logs its verdict from the main task,
-/// so whichever the reader stops at first can leave the other uncaptured. That
-/// made this file pass or fail depending on scheduling.
-fn read_until_all(child: &mut ChildGuard, needles: &[&str]) -> (bool, String) {
-    let stdout = child.take_stdout();
-    let (tx, rx) = std::sync::mpsc::channel::<String>();
-    std::thread::spawn(move || {
-        let mut reader = BufReader::new(stdout);
-        loop {
-            let mut line = String::new();
-            match reader.read_line(&mut line) {
-                Ok(0) | Err(_) => break,
-                Ok(_) => {
-                    if tx.send(line).is_err() {
-                        break;
-                    }
-                }
-            }
-        }
-    });
-
-    let mut acc = String::new();
-    let start = Instant::now();
-    loop {
-        if needles.iter().all(|n| acc.contains(n)) {
-            return (true, acc);
-        }
-        let left = match DEADLINE.checked_sub(start.elapsed()) {
-            Some(d) if !d.is_zero() => d,
-            _ => return (false, acc),
-        };
-        match rx.recv_timeout(left) {
-            Ok(line) => acc.push_str(&line),
-            // Sender gone: the stream ended. One last check, then give up.
-            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => {
-                return (needles.iter().all(|n| acc.contains(n)), acc)
-            }
-            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => return (false, acc),
-        }
-    }
-}
-
-fn wait_for_exit(child: &mut ChildGuard) -> (std::process::ExitStatus, String) {
-    // Both streams: the refusal reason is anyhow's stderr print, while
-    // "binding HTTP listener" is a tracing line on stdout, and the fatal rows
-    // assert on one of each.
-    let mut out = String::new();
-    let mut o = child.take_stdout();
-    let mut e = child.take_stderr();
-    let reader = std::thread::spawn(move || {
-        let mut buf = String::new();
-        let _ = o.read_to_string(&mut buf);
-        buf
-    });
-    let _ = e.read_to_string(&mut out);
-    let status = child.0.wait().expect("wait");
-    out.push_str(&reader.join().unwrap_or_default());
-    (status, out)
-}
-
-/// Strip ANSI escapes: the subscriber colourises even when piped, which would
-/// otherwise sit between `addr=` and the value.
-fn strip_ansi(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    let mut chars = s.chars();
-    while let Some(c) = chars.next() {
-        if c == '\u{1b}' {
-            for c2 in chars.by_ref() {
-                if c2.is_ascii_alphabetic() {
-                    break;
-                }
-            }
-        } else {
-            out.push(c);
-        }
-    }
-    out
-}
-
-/// A lexically invalid value must stop the process before the listener binds.
-fn assert_fatal_before_bind(row: &Row, key: &str, cwd: &Path) {
-    let before = snapshot(&row.tree());
-    let mut child = row.spawn(key, "7546", cwd);
-    let (status, err) = wait_for_exit(&mut child);
-
-    assert!(
-        !status.success(),
-        "key={key:?} must exit non-zero\n--- stderr ---\n{err}"
-    );
-    assert!(
-        err.contains("invalid configuration"),
-        "key={key:?} must fail as invalid configuration\n--- stderr ---\n{err}"
-    );
-    assert!(
-        !err.contains("binding HTTP listener"),
-        "key={key:?} must be refused BEFORE the listener binds\n--- stderr ---\n{err}"
-    );
-    assert_eq!(
-        snapshot(&row.tree()),
-        before,
-        "key={key:?}: a configuration refusal must not touch the key tree"
-    );
-}
-
-/// A live storage fault must leave HTTP serving with p2p off, and must not
-/// mutate the tree on its way to that verdict.
-fn assert_degrades_with_http_up(row: &Row, key: &str, cwd: &Path, label: &str) {
-    let before = snapshot(&row.tree());
-    let mut child = row.spawn(key, "7546", cwd);
-    let (found, log) = read_until_all(
-        &mut child,
-        &[
-            "degraded HTTP server ready",
-            "failed to load p2p identity key",
-        ],
-    );
-    assert!(
-        found,
-        "{label}: the node must bind and serve while p2p is off\n--- stderr ---\n{log}"
-    );
-    // The operator docs promise a specific signal, so pin it here: the level,
-    // the stable event name, and the message. A degrade that logs at warn or
-    // renames the event silently breaks the alert those docs tell operators to
-    // build, and asserting only the prose would not notice.
-    let clean_log = strip_ansi(&log);
-    let signal = clean_log
-        .lines()
-        .find(|l| l.contains("failed to load p2p identity key"))
-        .unwrap_or_else(|| panic!("{label}: the p2p failure must be logged\n{clean_log}"));
-    assert!(
-        signal.contains("ERROR"),
-        "{label}: the p2p failure must be logged at error level, got: {signal}"
-    );
-    assert!(
-        signal.contains("p2p_identity_key_load_failed"),
-        "{label}: the p2p failure must carry the documented event name, got: {signal}"
-    );
-
-    let clean = strip_ansi(&log);
-    let addr = clean
-        .lines()
-        .find(|l| l.contains("degraded HTTP server ready"))
-        .and_then(|l| l.rsplit("addr=").next())
-        .map(|a| {
-            a.trim()
-                .trim_start_matches("Some(")
-                .trim_matches(|c| c == '"' || c == ')')
-        })
-        .and_then(|a| a.parse::<std::net::SocketAddr>().ok())
-        .unwrap_or_else(|| panic!("{label}: could not parse the bound address from {clean}"));
-
-    // A served response, any status: the degraded server answers 503, which is
-    // still proof the port is up and answering.
-    let mut sock = std::net::TcpStream::connect(addr).expect("connect to the degraded server");
-    sock.set_read_timeout(Some(DEADLINE)).unwrap();
-    sock.write_all(b"GET /health HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n")
-        .expect("send request");
-    let mut resp = String::new();
-    let _ = sock.read_to_string(&mut resp);
-    assert!(
-        resp.starts_with("HTTP/1.1 "),
-        "{label}: the degraded server must answer, got {resp:?}"
-    );
-
-    drop(child);
-    assert_eq!(
-        snapshot(&row.tree()),
-        before,
-        "{label}: a storage refusal must not mutate the key tree"
-    );
-}
-
-#[test]
-fn lexically_invalid_key_paths_stop_the_node_before_it_binds() {
-    for key in [
-        "p2p.key",
-        "./p2p.key",
-        "a/../p2p.key",
-        "../p2p.key",
-        "/p2p.key",
-        "keys/",
-        "~/",
-        "~//etc/p2p.key",
-        "~/../x/p2p.key",
-    ] {
-        let row = Row::new();
-        let cwd = row.home.path().to_path_buf();
-        assert_fatal_before_bind(&row, key, &cwd);
-    }
-}
-
-#[test]
-fn live_storage_faults_leave_http_up_with_p2p_off() {
-    // Symlinked final parent.
-    {
-        let row = Row::new();
-        let real = row.tree().join("real");
-        std::fs::create_dir(&real).unwrap();
-        std::fs::set_permissions(&real, std::fs::Permissions::from_mode(0o700)).unwrap();
-        let link = row.tree().join("keys");
-        std::os::unix::fs::symlink(&real, &link).unwrap();
-        let key = link.join("p2p.key");
-        let cwd = row.home.path().to_path_buf();
-        assert_degrades_with_http_up(&row, key.to_str().unwrap(), &cwd, "symlinked parent");
-    }
-
-    // Regular file where the key directory should be.
-    {
-        let row = Row::new();
-        let file = row.tree().join("keys");
-        std::fs::write(&file, b"not a directory").unwrap();
-        let key = file.join("p2p.key");
-        let cwd = row.home.path().to_path_buf();
-        assert_degrades_with_http_up(&row, key.to_str().unwrap(), &cwd, "regular-file parent");
-    }
-
-    // Unreadable parent: an inspection error, the purest instance of a live
-    // fault that used to be reported as invalid configuration.
-    {
-        let row = Row::new();
-        let parent = row.tree().join("locked");
-        std::fs::create_dir(&parent).unwrap();
-        std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o000)).unwrap();
-        let key = parent.join("keys").join("p2p.key");
-        let cwd = row.home.path().to_path_buf();
-        assert_degrades_with_http_up(&row, key.to_str().unwrap(), &cwd, "unreadable parent");
-        // Restore so the tempdir can be cleaned up.
-        let _ = std::fs::set_permissions(&parent, std::fs::Permissions::from_mode(0o700));
-    }
-
-    // World-writable non-sticky ancestor: already the degrade class today, kept
-    // so the row set covers both sides of the policy.
-    {
-        let row = Row::new();
-        let anc = row.tree().join("open");
-        std::fs::create_dir(&anc).unwrap();
-        std::fs::set_permissions(&anc, std::fs::Permissions::from_mode(0o777)).unwrap();
-        let key = anc.join("keys").join("p2p.key");
-        let cwd = row.home.path().to_path_buf();
-        assert_degrades_with_http_up(&row, key.to_str().unwrap(), &cwd, "world-writable ancestor");
-    }
-}
-
-#[test]
-fn port_zero_does_no_key_storage_io_at_all() {
-    // A lexically invalid path that would be fatal with p2p enabled.
-    {
-        let row = Row::new();
-        let before = snapshot(&row.tree());
-        let cwd = row.home.path().to_path_buf();
-        let mut child = row.spawn("p2p.key", "0", &cwd);
-        let (found, log) = read_until(&mut child, "p2p disabled");
-        assert!(
-            found,
-            "port zero must bypass key handling entirely\n--- stderr ---\n{log}"
-        );
-        drop(child);
-        assert_eq!(
-            snapshot(&row.tree()),
-            before,
-            "port zero must not touch the key tree"
-        );
-    }
-
-    // A hostile tree that would degrade with p2p enabled.
-    {
-        let row = Row::new();
-        let real = row.tree().join("real");
-        std::fs::create_dir(&real).unwrap();
-        let link = row.tree().join("keys");
-        std::os::unix::fs::symlink(&real, &link).unwrap();
-        let before = snapshot(&row.tree());
-        let cwd = row.home.path().to_path_buf();
-        let key: PathBuf = link.join("p2p.key");
-        let mut child = row.spawn(key.to_str().unwrap(), "0", &cwd);
-        let (found, log) = read_until(&mut child, "p2p disabled");
-        assert!(
-            found,
-            "port zero must bypass a hostile tree too\n--- stderr ---\n{log}"
-        );
-        drop(child);
-        assert_eq!(
-            snapshot(&row.tree()),
-            before,
-            "port zero must not touch a hostile key tree"
-        );
-    }
-}
-
-/// A terminal `.` is a directory-valued spelling. Path drops it, so the load
-/// path would otherwise chmod the parent and publish a file named `keys`.
-#[test]
-fn terminal_dot_key_path_is_fatal_and_does_not_mutate() {
-    // Absent leaf: `/data/keys/.` must not create `keys` as a file or chmod `/data`.
-    {
-        let row = Row::new();
-        let data = row.tree().join("data");
-        std::fs::create_dir(&data).unwrap();
-        std::fs::set_permissions(&data, std::fs::Permissions::from_mode(0o755)).unwrap();
-        let key = format!("{}/keys/.", data.display());
-        let cwd = row.home.path().to_path_buf();
-        assert_fatal_before_bind(&row, &key, &cwd);
-        let mode = std::fs::metadata(&data).unwrap().permissions().mode() & 0o7777;
-        assert_eq!(mode, 0o755, "rejection must not chmod the parent");
-        assert!(
-            !data.join("keys").exists(),
-            "rejection must not create a file named keys"
-        );
-    }
-
-    // Existing directory at the would-be leaf: still boot-fatal, directory untouched.
-    {
-        let row = Row::new();
-        let data = row.tree().join("data");
-        let keys = data.join("keys");
-        std::fs::create_dir_all(&keys).unwrap();
-        std::fs::set_permissions(&data, std::fs::Permissions::from_mode(0o755)).unwrap();
-        std::fs::set_permissions(&keys, std::fs::Permissions::from_mode(0o700)).unwrap();
-        let key = format!("{}/.", keys.display());
-        let cwd = row.home.path().to_path_buf();
-        assert_fatal_before_bind(&row, &key, &cwd);
-        assert!(
-            keys.is_dir(),
-            "the existing keys directory must remain a directory"
-        );
-        let data_mode = std::fs::metadata(&data).unwrap().permissions().mode() & 0o7777;
-        let keys_mode = std::fs::metadata(&keys).unwrap().permissions().mode() & 0o7777;
-        assert_eq!(data_mode, 0o755, "rejection must not chmod the parent");
-        assert_eq!(
-            keys_mode, 0o700,
-            "rejection must not chmod the existing keys dir"
-        );
-    }
-}
-
-/// GITLAWB_KEY has the same Path-retarget hole as GITLAWB_P2P_KEY: a terminal
-/// `.` would publish a file named `keys` under `data`. Fatal before bind, and
-/// the parent tree is unchanged. p2p is off so it cannot chmod a shared dir.
-#[test]
-fn identity_terminal_dot_is_fatal_and_does_not_mutate() {
-    let row = Row::new();
-    let data = row.home.path().join("data");
-    std::fs::create_dir(&data).unwrap();
-    std::fs::set_permissions(&data, std::fs::Permissions::from_mode(0o755)).unwrap();
-    let key = format!("{}/keys/.", data.display());
-    let cwd = row.home.path().to_path_buf();
-    let mut child = row.spawn_env("p2p.key", "0", &cwd, &[("GITLAWB_KEY", key.as_str())]);
-    let (status, err) = wait_for_exit(&mut child);
-    assert!(
-        !status.success(),
-        "GITLAWB_KEY={key:?} must exit non-zero\n--- stderr ---\n{err}"
-    );
-    assert!(
-        err.contains("invalid configuration"),
-        "GITLAWB_KEY={key:?} must fail as invalid configuration\n--- stderr ---\n{err}"
-    );
-    assert!(
-        !err.contains("binding HTTP listener"),
-        "GITLAWB_KEY={key:?} must be refused BEFORE the listener binds\n--- stderr ---\n{err}"
-    );
-    let mode = std::fs::metadata(&data).unwrap().permissions().mode() & 0o7777;
-    assert_eq!(mode, 0o755, "rejection must not chmod the parent");
-    assert!(
-        !data.join("keys").exists(),
-        "rejection must not create a file named keys"
-    );
-}
-
-/// An existing 0755 identity parent is usable and must not be chmodded. p2p is
-/// off so a default `~/.gitlawb/p2p.key` cannot tighten the same directory.
-#[test]
-fn identity_existing_0755_parent_is_not_chmodded_on_boot() {
-    let row = Row::new();
-    let iddir = row.home.path().join("idparent");
-    std::fs::create_dir(&iddir).unwrap();
-    std::fs::set_permissions(&iddir, std::fs::Permissions::from_mode(0o755)).unwrap();
-    let key = iddir.join("identity.pem");
-    let cwd = row.home.path().to_path_buf();
-    let mut child = row.spawn_env(
-        "p2p.key",
-        "0",
-        &cwd,
-        &[("GITLAWB_KEY", key.to_str().unwrap())],
-    );
-    let (found, log) = read_until(&mut child, "degraded HTTP server ready");
-    assert!(
-        found,
-        "a 0755 identity parent must still boot\n--- stderr ---\n{log}"
-    );
-    drop(child);
-    let mode = std::fs::metadata(&iddir).unwrap().permissions().mode() & 0o7777;
-    assert_eq!(
-        mode, 0o755,
-        "boot must not chmod the existing identity parent"
-    );
-    assert_eq!(
-        std::fs::metadata(&key).unwrap().permissions().mode() & 0o7777,
-        0o600,
-        "the identity key must be owner-only"
-    );
-}
-
-/// Creating into a world-writable identity parent is refused before bind, and
-/// the directory is left untouched.
-#[test]
-fn identity_writable_parent_is_fatal_and_unchanged() {
-    let row = Row::new();
-    let iddir = row.home.path().join("idparent");
-    std::fs::create_dir(&iddir).unwrap();
-    std::fs::set_permissions(&iddir, std::fs::Permissions::from_mode(0o777)).unwrap();
-    let key = iddir.join("identity.pem");
-    let cwd = row.home.path().to_path_buf();
-    let mut child = row.spawn_env(
-        "p2p.key",
-        "0",
-        &cwd,
-        &[("GITLAWB_KEY", key.to_str().unwrap())],
-    );
-    let (status, err) = wait_for_exit(&mut child);
-    assert!(
-        !status.success(),
-        "a writable identity parent must exit non-zero\n--- stderr ---\n{err}"
-    );
-    assert!(
-        !err.contains("binding HTTP listener"),
-        "a writable identity parent must be refused BEFORE the listener binds\n--- stderr ---\n{err}"
-    );
-    let mode = std::fs::metadata(&iddir).unwrap().permissions().mode() & 0o7777;
-    assert_eq!(mode, 0o777, "refusal must not chmod the parent");
-    assert!(!key.exists(), "refusal must not publish the identity key");
-}
-
-/// A 2700 (setgid, owner rwx) p2p key directory is repairable: boot, tighten
-/// to 0700, HTTP still comes up.
-#[test]
-fn p2p_setgid_key_directory_is_tightened_and_http_comes_up() {
-    let row = Row::new();
-    let keys = row.tree().join("keys");
-    std::fs::create_dir(&keys).unwrap();
-    std::fs::set_permissions(&keys, std::fs::Permissions::from_mode(0o2700)).unwrap();
-    let key = keys.join("p2p.key");
-    let cwd = row.home.path().to_path_buf();
-    let mut child = row.spawn(key.to_str().unwrap(), "7546", &cwd);
-    let (found, log) = read_until_all(
-        &mut child,
-        &["degraded HTTP server ready", "generated new p2p identity"],
-    );
-    assert!(
-        found,
-        "a 2700 key directory must boot and generate a key\n--- stderr ---\n{log}"
-    );
-    drop(child);
-    let mode = std::fs::metadata(&keys).unwrap().permissions().mode() & 0o7777;
-    assert_eq!(
-        mode, 0o700,
-        "2700 must be normalized to 0700, found {mode:04o}"
-    );
-}

crates/gl/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gl"
-description = "The Twigpine CLI — identity management, node control, MCP server"
+description = "The gitlawb CLI — identity management, node control, MCP server"
 version = "0.7.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
@@ -42,4 +42,3 @@ alloy = { version = "1", default-features = false, features = [
 mockito = "1"
 tempfile = "3"
 tokio = { workspace = true }
-ed25519-dalek = { workspace = true }

crates/gl/src/agent.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -16,11 +17,7 @@ pub struct AgentArgs {
 pub enum AgentCmd {
     /// List agents registered on a node
     List {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         /// Filter by capability (e.g. git:push)
         #[arg(long)]
@@ -32,11 +29,7 @@ pub enum AgentCmd {
     Show {
         /// Agent DID or short key segment
         did: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
 }
@@ -64,16 +57,24 @@ async fn cmd_list(node: String, capability: Option<String>) -> Result<()> {
         .get(&path)
         .await
         .context("failed to connect to node")?;
-    // Keep the bespoke 404 hint (older node without the agents API) ahead of
-    // read_json; every other status routes through it (capped + sanitized error).
-    if resp.status() == reqwest::StatusCode::NOT_FOUND {
+    let status = resp.status();
+
+    if status == reqwest::StatusCode::NOT_FOUND {
         anyhow::bail!(
             "this node does not yet support the agents API (v0.3+)\n\
              upgrade the node or check GITLAWB_NODE is pointing to the right server"
         );
     }
 
-    let body = crate::http::read_json(resp, "list agents").await?;
+    let body: Value = resp
+        .json()
+        .await
+        .context("invalid JSON from node — is GITLAWB_NODE correct?")?;
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("list agents failed ({status}): {msg}");
+    }
 
     let agents = body["agents"].as_array().cloned().unwrap_or_default();
 
@@ -88,7 +89,7 @@ async fn cmd_list(node: String, capability: Option<String>) -> Result<()> {
         let short = did
             .split(':')
             .next_back()
-            .map(|s| crate::text::truncate(s, 16))
+            .map(|s| &s[..s.len().min(16)])
             .unwrap_or("?");
         let trust = agent["trust_score"].as_f64().unwrap_or(0.0);
         let caps = agent["capabilities"]
@@ -116,15 +117,24 @@ async fn cmd_show(did: String, node: String) -> Result<()> {
         .get(&format!("/api/v1/agents/{did}"))
         .await
         .context("failed to connect to node")?;
-    // Keep the bespoke 404 hint ahead of read_json; other statuses route through it.
-    if resp.status() == reqwest::StatusCode::NOT_FOUND {
+    let status = resp.status();
+
+    if status == reqwest::StatusCode::NOT_FOUND {
         anyhow::bail!(
             "agent not found, or this node does not yet support the agents API (v0.3+)\n\
              upgrade the node or check GITLAWB_NODE is pointing to the right server"
         );
     }
 
-    let agent = crate::http::read_json(resp, "agent").await?;
+    let agent: Value = resp
+        .json()
+        .await
+        .context("invalid JSON from node — is GITLAWB_NODE correct?")?;
+
+    if !status.is_success() {
+        let msg = agent["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("agent not found ({status}): {msg}");
+    }
 
     let full_did = agent["did"].as_str().unwrap_or("?");
     let trust = agent["trust_score"].as_f64().unwrap_or(0.0);
@@ -205,14 +215,11 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
         let err = cmd_list(server.url(), None).await.unwrap_err();
         assert!(err.to_string().contains("agents API"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -223,14 +230,11 @@ mod tests {
             .with_status(500)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"internal error"}"#)
-            .expect(1)
             .create_async()
             .await;
 
         let err = cmd_list(server.url(), None).await.unwrap_err();
         assert!(err.to_string().contains("list agents failed"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -257,7 +261,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"agent not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -265,8 +268,6 @@ mod tests {
             .await
             .unwrap_err();
         assert!(err.to_string().contains("agents API") || err.to_string().contains("not found"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]

crates/gl/src/bounty.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -38,11 +39,7 @@ pub enum BountyCmd {
         /// Deadline in seconds (default 7 days)
         #[arg(long)]
         deadline: Option<i64>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -54,11 +51,7 @@ pub enum BountyCmd {
         /// Filter by status: open, claimed, submitted, completed
         #[arg(long)]
         status: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -67,11 +60,7 @@ pub enum BountyCmd {
     Show {
         /// Bounty ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -83,11 +72,7 @@ pub enum BountyCmd {
         /// Your wallet address for payout
         #[arg(long)]
         wallet: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -99,11 +84,7 @@ pub enum BountyCmd {
         /// Pull request ID
         #[arg(long)]
         pr: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -115,11 +96,7 @@ pub enum BountyCmd {
         /// On-chain payout tx hash
         #[arg(long)]
         tx_hash: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -128,22 +105,14 @@ pub enum BountyCmd {
     Cancel {
         /// Bounty ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
     },
     /// Show bounty stats and leaderboard
     Stats {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
 }
@@ -220,7 +189,13 @@ async fn cmd_create(
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "create bounty").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("create bounty failed ({status}): {msg}");
+    }
 
     let id = body["id"].as_str().unwrap_or("?");
     println!("Bounty created: {id}");
@@ -256,14 +231,11 @@ async fn cmd_list(
         u
     };
 
-    let body = crate::http::read_json(
-        client
-            .get_authed(&url)
-            .await
-            .context("failed to connect to node")?,
-        "bounties",
-    )
-    .await?;
+    let resp = client
+        .get_authed(&url)
+        .await
+        .context("failed to connect to node")?;
+    let body: Value = resp.json().await.unwrap_or_default();
 
     let bounties = body["bounties"].as_array();
     if let Some(arr) = bounties {
@@ -275,7 +247,7 @@ async fn cmd_list(
                 let title = b["title"].as_str().unwrap_or("?");
                 let amount = b["amount"].as_i64().unwrap_or(0);
                 let st = b["status"].as_str().unwrap_or("?");
-                let short_id = crate::text::truncate(id, 8);
+                let short_id = &id[..8.min(id.len())];
                 println!("{short_id}  {st:<10}  {amount:>12} $GITLAWB  {title}");
             }
         }
@@ -287,7 +259,13 @@ async fn cmd_show(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
     let client = signed_client(&node, dir.as_deref());
     let resp = client.get_authed(&format!("/api/v1/bounties/{id}")).await?;
 
-    let body = crate::http::read_json(resp, "show bounty").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("not found");
+        anyhow::bail!("bounty not found: {msg}");
+    }
 
     println!("{}", serde_json::to_string_pretty(&body)?);
     Ok(())
@@ -311,7 +289,13 @@ async fn cmd_claim(
         )
         .await?;
 
-    let _ = crate::http::read_json(resp, "claim").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("claim failed ({status}): {msg}");
+    }
 
     println!("Bounty {id} claimed. Deadline starts now.");
     Ok(())
@@ -330,7 +314,13 @@ async fn cmd_submit(id: String, pr: String, node: String, dir: Option<PathBuf>)
         )
         .await?;
 
-    let _ = crate::http::read_json(resp, "submit").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("submit failed ({status}): {msg}");
+    }
 
     println!("Bounty {id} submitted with PR {pr}. Awaiting creator approval.");
     Ok(())
@@ -354,7 +344,13 @@ async fn cmd_approve(
         )
         .await?;
 
-    let _ = crate::http::read_json(resp, "approve").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("approve failed ({status}): {msg}");
+    }
 
     println!("Bounty {id} approved! Payout released to agent.");
     Ok(())
@@ -373,7 +369,13 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
         )
         .await?;
 
-    let _ = crate::http::read_json(resp, "cancel").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("cancel failed ({status}): {msg}");
+    }
 
     println!("Bounty {id} cancelled. Tokens refunded.");
     Ok(())
@@ -381,11 +383,8 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
 
 async fn cmd_stats(node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    // Route through read_json so a node denial (403/404/5xx, incl. a non-JSON
-    // body) surfaces as an error instead of a fake `Bounty Stats` with every
-    // counter zeroed (#186, the denial-as-success class #123 fixes elsewhere).
-    let body =
-        crate::http::read_json(client.get("/api/v1/bounties/stats").await?, "bounty stats").await?;
+    let resp = client.get("/api/v1/bounties/stats").await?;
+    let body: Value = resp.json().await.unwrap_or_default();
 
     let open = body["open"].as_i64().unwrap_or(0);
     let claimed = body["claimed"].as_i64().unwrap_or(0);
@@ -403,7 +402,7 @@ async fn cmd_stats(node: String) -> Result<()> {
                 let did = entry["did"].as_str().unwrap_or("?");
                 let count = entry["completed"].as_i64().unwrap_or(0);
                 let earned = entry["total_earned"].as_i64().unwrap_or(0);
-                let short = crate::text::truncate_suffix(did, 8);
+                let short = &did[did.len().saturating_sub(8)..];
                 println!(
                     "  {}. ...{short}  {count} bounties  {earned} $GITLAWB",
                     i + 1
@@ -522,7 +521,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -530,8 +528,6 @@ mod tests {
             .await
             .unwrap_err();
         assert!(err.to_string().contains("not found"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -548,86 +544,4 @@ mod tests {
 
         cmd_stats(server.url()).await.unwrap();
     }
-
-    /// #186 (F1): a node denial on the stats endpoint must surface as an error,
-    /// not print a fake `Bounty Stats` with every counter zeroed. RED before the
-    /// fix (unwrap_or_default + no status check -> Ok with zeros), GREEN after
-    /// (read_json bails on the non-2xx).
-    #[tokio::test]
-    async fn cmd_stats_surfaces_denial_not_fake_result() {
-        let mut server = mockito::Server::new_async().await;
-        let m = server
-            .mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"forbidden"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_stats(server.url())
-            .await
-            .expect_err("a 403 must be an error, not a zeroed fake result");
-        assert!(err.to_string().contains("403"), "err={err}");
-        // Pin the mock hit explicitly. The status assertion above already fails
-        // when the route does not match (mockito answers an unmatched route with
-        // 501, so "403" is absent), but that proof is incidental to mockito's
-        // fallback status; assert the hit directly so it survives a reworded
-        // assertion.
-        m.assert_async().await;
-    }
-
-    /// #186 (F1): the same denial-as-error behavior across the non-2xx response
-    /// classes, not just 403 — a 404 and a 500 (incl. a non-JSON body) must each
-    /// surface as an error with the status, never a zeroed fake result.
-    #[tokio::test]
-    async fn cmd_stats_surfaces_denial_across_status_classes() {
-        for (status, body, json) in [
-            (404, r#"{"message":"not found"}"#, true),
-            (500, "internal boom", false),
-        ] {
-            let mut server = mockito::Server::new_async().await;
-            let mut m = server
-                .mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
-                .with_status(status)
-                .with_body(body);
-            if json {
-                m = m.with_header("content-type", "application/json");
-            }
-            let m = m.expect(1).create_async().await;
-
-            let err = cmd_stats(server.url()).await.unwrap_err().to_string();
-            assert!(
-                err.contains(&status.to_string()),
-                "status {status} must surface as an error, got: {err}"
-            );
-            m.assert_async().await;
-        }
-    }
-
-    #[tokio::test]
-    async fn cmd_list_repo_scoped_surfaces_denial_not_empty() {
-        // `gl bounty list --repo owner/name` hits the gated /repos/{o}/{n}/bounties;
-        // a 404 must Err, not silently print nothing.
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/repos/alice/secret/bounties".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_list(Some("alice/secret".to_string()), None, server.url(), None).await;
-        assert!(
-            result.is_err(),
-            "bounty list --repo must Err on a gated 404"
-        );
-        // Prove the gated repo-scoped path was actually requested: without this,
-        // an unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
-        _m.assert_async().await;
-    }
 }

crates/gl/src/cert.rs

@@ -4,6 +4,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -25,11 +26,7 @@ pub enum CertCmd {
     List {
         /// Repository in <owner>/<repo> or <repo> format
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -40,11 +37,7 @@ pub enum CertCmd {
         repo: String,
         /// Certificate ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -89,7 +82,12 @@ async fn resolve_repo(
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = signed_client(node, dir);
-            let info = crate::http::read_json(client.get_authed("/").await?, "node info").await?;
+            let info: Value = client
+                .get_authed("/")
+                .await?
+                .json()
+                .await
+                .context("failed to fetch node info")?;
             let did = info["did"].as_str().context("node info missing 'did'")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -102,7 +100,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     let client = signed_client(&node, dir.as_deref());
     let path = format!("/api/v1/repos/{owner}/{name}/certs");
-    let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
+    let resp: Value = client
+        .get_authed(&path)
+        .await?
+        .json()
+        .await
+        .context("failed to list certificates")?;
 
     let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
 
@@ -117,10 +120,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         let id = cert["id"].as_str().unwrap_or("?");
         let ref_name = cert["ref_name"].as_str().unwrap_or("?");
         let new_sha = cert["new_sha"].as_str().unwrap_or("?");
-        let issued_at = cert["issued_at"]
-            .as_str()
-            .map(|s| crate::text::truncate(s, 19))
-            .unwrap_or("?");
+        let issued_at = cert["issued_at"].as_str().map(|s| &s[..19]).unwrap_or("?");
         println!("  {id:.8}  {issued_at}  {ref_name}  {new_sha:.12}");
     }
     Ok(())
@@ -139,10 +139,14 @@ async fn cmd_show(
     let client = signed_client(&node, dir.as_deref());
     let id = resolve_cert_id(&client, &owner, &name, &id).await?;
 
-    // Fetch the certificate. read_json checks status first and surfaces the node's
-    // capped+sanitized message on a non-2xx (a bounded error read, not the whole body).
+    // Fetch the certificate
     let path = format!("/api/v1/repos/{owner}/{name}/certs/{id}");
-    let cert = crate::http::read_json(client.get_authed(&path).await?, "certificate").await?;
+    let resp = client
+        .get_authed(&path)
+        .await?
+        .error_for_status()
+        .context("certificate not found")?;
+    let cert: Value = resp.json().await.context("certificate not found")?;
 
     let cert_id = cert["id"].as_str().unwrap_or("?");
     let ref_name = cert["ref_name"].as_str().unwrap_or("?");
@@ -187,20 +191,27 @@ async fn cmd_show(
 
     // Contextual only — the verdict above stands on its own, so a node-info
     // hiccup here must not turn a successfully displayed certificate into an
-    // error exit. Route the lookup through read_json so a denial or a capped
-    // error body yields a reportable reason instead of an opaque None, and keep
-    // "carried no DID" distinct from "the lookup failed": an empty DID must not
-    // reach the comparison and fabricate a mismatch warning.
-    let current: std::result::Result<String, String> = match client.get("/").await {
-        Ok(resp) => match crate::http::read_json(resp, "node info").await {
-            Ok(info) => did_from_node_info(&info),
-            Err(e) => Err(e.to_string()),
-        },
-        Err(e) => Err(e.to_string()),
+    // error exit.
+    let current_node_did = match client.get("/").await {
+        Ok(resp) => resp
+            .json::<Value>()
+            .await
+            .ok()
+            .and_then(|info| info["did"].as_str().map(str::to_string)),
+        Err(_) => None,
     };
-    let current_node_did = current.as_ref().ok().cloned();
-    for line in did_check_report(&current, node_did) {
-        println!("{line}");
+    match current_node_did.as_deref() {
+        Some(current) if current == node_did => {
+            println!("  Issuing node DID matches the node being queried.");
+        }
+        Some(current) => {
+            println!("  WARNING: Certificate node DID ({node_did}) does not match");
+            println!("           current node DID ({current}).");
+            println!("           This certificate was issued by a different node.");
+        }
+        None => {
+            println!("  NOTE: could not fetch current node info — skipping node-DID comparison.");
+        }
     }
 
     if require_valid {
@@ -228,46 +239,6 @@ async fn cmd_show(
     Ok(())
 }
 
-/// Pull the node's DID out of a `GET /` body for the comparison in `cmd_show`.
-///
-/// A missing OR empty `did` is a failure, not a value: letting `""` through
-/// would reach the comparison and print a mismatch WARNING against a DID the
-/// node never claimed, which reads as "issued by a different node" when the
-/// truth is that the lookup told us nothing.
-fn did_from_node_info(info: &serde_json::Value) -> std::result::Result<String, String> {
-    match info["did"].as_str() {
-        Some(did) if !did.is_empty() => Ok(did.to_string()),
-        _ => Err("node info response carried no DID".to_string()),
-    }
-}
-
-/// Select the report lines for the node-DID comparison in `cmd_show`.
-///
-/// `current` is the current node's DID, or the reason it could not be
-/// determined. A comparison verdict (match or WARNING) is only produced when a
-/// real DID was obtained; otherwise the report degrades to a could-not-compare
-/// hint naming the reason, plus the offline-verification guidance. The signature
-/// verdict printed above stands on its own either way — this block only answers
-/// *which* node issued the certificate.
-fn did_check_report(current: &std::result::Result<String, String>, node_did: &str) -> Vec<String> {
-    match current {
-        Ok(current) if current == node_did => {
-            vec!["  Issuing node DID matches the node being queried.".to_string()]
-        }
-        Ok(current) => vec![
-            format!("  WARNING: Certificate node DID ({node_did}) does not match"),
-            format!("           current node DID ({current})."),
-            "           This certificate was issued by a different node.".to_string(),
-        ],
-        Err(reason) => vec![
-            format!("  Could not fetch the current node's DID ({reason}), so the comparison"),
-            "  with the certificate's node DID is unavailable.".to_string(),
-            "  To verify offline, use the node's Ed25519 public key derived from:".to_string(),
-            format!("    did:key → {node_did}"),
-        ],
-    }
-}
-
 /// Rebuild the node's canonical signing payload (field order must match
 /// gitlawb-node/src/cert.rs::issue_ref_certificate exactly) and verify the
 /// certificate's Ed25519 signature against the key embedded in `node_did`.
@@ -320,7 +291,14 @@ async fn resolve_cert_id(client: &NodeClient, owner: &str, name: &str, id: &str)
     }
 
     let path = format!("/api/v1/repos/{owner}/{name}/certs?prefix={id}");
-    let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
+    let resp: Value = client
+        .get_authed(&path)
+        .await?
+        .error_for_status()
+        .context("failed to list certificates")?
+        .json()
+        .await
+        .context("failed to list certificates")?;
 
     let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
     let matches: Vec<String> = certs
@@ -419,558 +397,4 @@ mod tests {
         );
         assert!(garbage.is_err(), "malformed signature must not verify");
     }
-
-    #[tokio::test]
-    async fn cmd_list_surfaces_denial_not_empty() {
-        // A gated 404 on the repo-scoped certs read must Err, not print "No certificates".
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/certs$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
-        assert!(result.is_err(), "cert list must Err on a gated 404");
-        // Prove the gated certs path was actually requested: without this, an
-        // unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn resolve_repo_surfaces_denial() {
-        // A slash-free repo with an empty identity dir forces the GET / node-info
-        // fetch. A gated 404 there must Err (surfacing the status), proving the
-        // read_json conversion is load-bearing rather than silently ignored.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
-        let _m = server
-            .mock("GET", "/")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    // The `GET /` node-info lookup after the cert loads is a fail-soft diagnostic:
-    // a response-level failure degrades to a could-not-compare hint and the command
-    // completes Ok, never a fabricated mismatch warning and never a fatal Err. The
-    // cert fetch itself stays fail-closed. A >=36-char id skips resolve_cert_id so
-    // only two mocks are needed.
-    #[tokio::test]
-    async fn cmd_show_completes_with_degraded_hint_when_node_info_denied() {
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
-            )
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "cert show must complete despite a denied node-info lookup"
-        );
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_show_degrades_on_malformed_node_info() {
-        // A 2xx node-info body that fails to parse degrades the same way a denial
-        // does: hint printed, command completes Ok.
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
-            )
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_body("not json")
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "cert show must complete despite malformed node info"
-        );
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_show_degrades_when_node_info_lacks_did() {
-        // A 2xx node-info body with no `did` routes to the degraded hint, not a
-        // fabricated empty-DID mismatch warning; the command completes Ok.
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
-            )
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body("{}")
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "cert show must complete when node info lacks a DID"
-        );
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    // Must-not case: the certificate fetch itself stays fail-closed. A gated 404
-    // aborts the command with the status surfaced, and the node-info lookup is
-    // never reached (the expect(0) assert proves it never ran).
-    #[tokio::test]
-    async fn cmd_show_surfaces_denied_certificate() {
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"did":"n"}"#)
-            .expect(0)
-            .create_async()
-            .await;
-
-        let err = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_show_reports_matching_node_did() {
-        // Pins the unchanged success path: node info fetched, DIDs compared, Ok.
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
-            )
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"did":"n"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await;
-        assert!(result.is_ok(), "cert show must report a matching node DID");
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_show_warns_on_mismatching_node_did() {
-        // A real, differing node DID drives the WARNING branch end to end; the
-        // command still completes Ok.
-        let mut server = mockito::Server::new_async().await;
-        let long_id = "a".repeat(36);
-        let _cert = server
-            .mock(
-                "GET",
-                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
-            )
-            .create_async()
-            .await;
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"did":"did:key:other"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = cmd_show(
-            "alice/secret".to_string(),
-            long_id,
-            server.url(),
-            None,
-            false,
-            None,
-        )
-        .await;
-        assert!(
-            result.is_ok(),
-            "cert show must warn, not fail, on a mismatching node DID"
-        );
-        _cert.assert_async().await;
-        _root.assert_async().await;
-    }
-
-    // ── --verify issuer anchoring ────────────────────────────────────────────
-    //
-    // Every other cmd_show test passes require_valid=false, so the whole
-    // `if require_valid` block went unexecuted. It is the security-bearing half of
-    // the command: a valid signature only proves the certificate is internally
-    // consistent (a hostile node can mint a keypair, name it in node_did, and
-    // self-sign), so --verify must additionally anchor the issuer to a DID the
-    // caller trusts. These drive all four outcomes plus the must-not case.
-    //
-    // The certificate must carry a REAL signature over the canonical payload:
-    // with a bogus one, --verify bails on the signature and never reaches the
-    // anchoring, which would make every assertion below vacuous.
-    fn signed_cert(node_kp: &gitlawb_core::identity::Keypair) -> (String, String) {
-        let node_did = node_kp.did().as_str().to_string();
-        let id = "a".repeat(36); // >= 36 chars skips resolve_cert_id's prefix lookup
-        let payload = serde_json::json!({
-            "repo_id": "repo-1",
-            "ref":     "refs/heads/main",
-            "old":     "0".repeat(40),
-            "new":     "b".repeat(40),
-            "pusher":  "did:key:z6MkPusher",
-            "node":    node_did,
-            "ts":      "2026-07-22T00:00:00+00:00",
-        });
-        let sig = node_kp.sign_b64(&serde_json::to_vec(&payload).unwrap());
-        let body = serde_json::json!({
-            "id": id,
-            "repo_id": "repo-1",
-            "ref_name": "refs/heads/main",
-            "old_sha": "0".repeat(40),
-            "new_sha": "b".repeat(40),
-            "pusher_did": "did:key:z6MkPusher",
-            "node_did": node_did,
-            "signature": sig,
-            "issued_at": "2026-07-22T00:00:00+00:00",
-        })
-        .to_string();
-        (id, body)
-    }
-
-    /// Mount the cert fetch, plus a `GET /` answering with `node_info` (a JSON
-    /// body) or a denial when `None`.
-    async fn cert_server(
-        server: &mut mockito::Server,
-        id: &str,
-        cert_body: &str,
-        node_info: Option<&str>,
-    ) -> (mockito::Mock, mockito::Mock) {
-        let cert = server
-            .mock("GET", format!("/api/v1/repos/alice/r/certs/{id}").as_str())
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(cert_body)
-            .expect(1)
-            .create_async()
-            .await;
-        let root = match node_info {
-            Some(b) => {
-                server
-                    .mock("GET", "/")
-                    .with_status(200)
-                    .with_header("content-type", "application/json")
-                    .with_body(b)
-                    .create_async()
-                    .await
-            }
-            None => {
-                server
-                    .mock("GET", "/")
-                    .with_status(403)
-                    .with_header("content-type", "application/json")
-                    .with_body(r#"{"message":"denied"}"#)
-                    .create_async()
-                    .await
-            }
-        };
-        (cert, root)
-    }
-
-    #[tokio::test]
-    async fn verify_ok_when_issuing_node_is_the_queried_node() {
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let (id, body) = signed_cert(&kp);
-        let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
-        let mut server = mockito::Server::new_async().await;
-        let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
-
-        let got = cmd_show("alice/r".to_string(), id, server.url(), None, true, None).await;
-        assert!(got.is_ok(), "valid sig + matching issuer must pass");
-        cert.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn verify_bails_when_issuer_is_a_different_node() {
-        // The self-signing-hostile-node case: the signature verifies against the
-        // key the cert names, but that key is not the node we queried.
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let (id, body) = signed_cert(&kp);
-        let other = gitlawb_core::identity::Keypair::generate();
-        let info = format!(r#"{{"did":"{}"}}"#, other.did().as_str());
-        let mut server = mockito::Server::new_async().await;
-        let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
-
-        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
-            .await
-            .unwrap_err()
-            .to_string();
-        assert!(err.contains("expected issuer"), "got: {err}");
-        cert.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn verify_bails_when_node_info_denied_and_no_expect_node() {
-        // Fail closed: with no trusted DID to anchor against, --verify must NOT
-        // fall through to a pass just because the signature checked out.
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let (id, body) = signed_cert(&kp);
-        let mut server = mockito::Server::new_async().await;
-        let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
-
-        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
-            .await
-            .unwrap_err()
-            .to_string();
-        assert!(err.contains("cannot anchor the issuer"), "got: {err}");
-        cert.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn verify_ok_when_expect_node_anchors_a_denied_lookup() {
-        // --expect-node supplies the trust anchor the denied lookup could not, so
-        // the same denial that fails the case above now passes.
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let (id, body) = signed_cert(&kp);
-        let mut server = mockito::Server::new_async().await;
-        let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
-
-        let got = cmd_show(
-            "alice/r".to_string(),
-            id,
-            server.url(),
-            None,
-            true,
-            Some(kp.did().as_str().to_string()),
-        )
-        .await;
-        assert!(got.is_ok(), "explicit anchor must pass");
-        cert.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn verify_bails_on_a_bad_signature_before_anchoring() {
-        // The must-not: a forged certificate naming the queried node must fail on
-        // the signature, even though its issuer would otherwise anchor cleanly.
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let (id, body) = signed_cert(&kp);
-        let forged = body.replace(&"b".repeat(40), &"c".repeat(40));
-        let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
-        let mut server = mockito::Server::new_async().await;
-        let (cert, _root) = cert_server(&mut server, &id, &forged, Some(&info)).await;
-
-        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
-            .await
-            .unwrap_err()
-            .to_string();
-        assert!(err.contains("signature did not verify"), "got: {err}");
-        cert.assert_async().await;
-    }
-
-    // The must-not case for the DID extraction: an empty or missing `did` has to
-    // become a could-not-compare reason. If it leaks through as a value, the
-    // comparison below fabricates a mismatch WARNING against a DID the node
-    // never claimed.
-    #[test]
-    fn did_from_node_info_rejects_empty_and_missing() {
-        assert!(did_from_node_info(&serde_json::json!({"did": "n"})).is_ok());
-        for body in [
-            serde_json::json!({"did": ""}),
-            serde_json::json!({}),
-            serde_json::json!({"did": 7}),
-        ] {
-            let got = did_from_node_info(&body);
-            assert!(
-                got.is_err(),
-                "must not yield a comparable DID: {body} -> {got:?}"
-            );
-        }
-        // And the reason it produces must route to the degraded hint, never a verdict.
-        let report =
-            did_check_report(&did_from_node_info(&serde_json::json!({"did": ""})), "n").join("\n");
-        assert!(
-            !report.contains("WARNING"),
-            "fabricated a mismatch: {report}"
-        );
-        assert!(report.contains("Could not fetch"), "got: {report}");
-    }
-
-    // did_check_report is the three-way selector between the match text, the
-    // mismatch WARNING, and the degraded could-not-compare hint. Substring
-    // asserts (not full-line equality) so cosmetic wording edits don't break them.
-
-    #[test]
-    fn did_check_report_match() {
-        let report = did_check_report(&Ok("n".to_string()), "n").join("\n");
-        assert!(
-            report.contains("matches the node being queried"),
-            "got: {report}"
-        );
-        assert!(!report.contains("WARNING"), "got: {report}");
-        assert!(!report.contains("Could not fetch"), "got: {report}");
-    }
-
-    #[test]
-    fn did_check_report_mismatch() {
-        let report = did_check_report(&Ok("did:key:other".to_string()), "n").join("\n");
-        assert!(report.contains("WARNING"), "got: {report}");
-        assert!(report.contains("does not match"), "got: {report}");
-        assert!(report.contains("did:key:other"), "got: {report}");
-        assert!(!report.contains("Could not fetch"), "got: {report}");
-    }
-
-    #[test]
-    fn did_check_report_missing_did_reason() {
-        let report =
-            did_check_report(&Err("node info response carried no DID".to_string()), "n").join("\n");
-        assert!(report.contains("Could not fetch"), "got: {report}");
-        assert!(
-            report.contains("node info response carried no DID"),
-            "got: {report}"
-        );
-        assert!(report.contains("verify offline"), "got: {report}");
-        // The must-not case: no real DID was obtained, so no comparison verdict
-        // may be claimed in either direction.
-        assert!(!report.contains("WARNING"), "got: {report}");
-        assert!(
-            !report.contains("matches the node being queried"),
-            "got: {report}"
-        );
-    }
-
-    #[test]
-    fn did_check_report_lookup_error_reason() {
-        let report =
-            did_check_report(&Err("node info failed (403): denied".to_string()), "n").join("\n");
-        assert!(report.contains("Could not fetch"), "got: {report}");
-        assert!(report.contains("403"), "got: {report}");
-        assert!(report.contains("verify offline"), "got: {report}");
-        assert!(!report.contains("WARNING"), "got: {report}");
-    }
 }

crates/gl/src/changelog.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::Args;
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -14,11 +15,7 @@ pub struct ChangelogArgs {
     /// Maximum number of events to show
     #[arg(long, default_value = "20")]
     pub limit: usize,
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
     #[arg(long)]
     pub dir: Option<PathBuf>,
@@ -34,7 +31,7 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
     };
 
     if repo.is_empty() {
-        anyhow::bail!("no repo specified — pass <repo> or run from inside a Twigpine repo");
+        anyhow::bail!("no repo specified — pass <repo> or run from inside a gitlawb repo");
     }
 
     let (owner, name) = if let Some((o, n)) = repo.split_once('/') {
@@ -45,7 +42,12 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = NodeClient::new(&args.node, None);
-            let info = crate::http::read_json(client.get("/").await?, "node info").await?;
+            let info: Value = client
+                .get("/")
+                .await?
+                .json()
+                .await
+                .context("failed to fetch node info")?;
             let did = info["did"].as_str().context("node missing DID")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -62,7 +64,13 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "changelog").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("changelog failed ({status}): {msg}");
+    }
 
     let events = body["events"].as_array().cloned().unwrap_or_default();
 
@@ -75,14 +83,14 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
 
     for event in &events {
         let ts = event["timestamp"].as_str().unwrap_or("?");
-        let date = crate::text::truncate(ts, 10);
+        let date = &ts[..ts.len().min(10)];
 
         match event["type"].as_str().unwrap_or("") {
             "commit" => {
                 let sha = event["sha"].as_str().unwrap_or("?");
                 let msg = event["message"].as_str().unwrap_or("?");
                 let first_line = msg.lines().next().unwrap_or(msg);
-                let short_sha = crate::text::truncate(sha, 8);
+                let short_sha = &sha[..sha.len().min(8)];
                 println!("  {date}  commit      {short_sha}  {first_line}");
             }
             "pr_merged" => {
@@ -204,7 +212,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -216,8 +223,6 @@ mod tests {
         };
         let err = run(args).await.unwrap_err();
         assert!(err.to_string().contains("changelog failed"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -265,31 +270,4 @@ mod tests {
         let err = rt.block_on(run(args)).unwrap_err();
         assert!(err.to_string().contains("no repo specified"));
     }
-
-    #[tokio::test]
-    async fn resolve_via_run_surfaces_denial() {
-        // A slash-free repo with an empty identity dir forces the inline GET /
-        // node-info fetch during resolution. A gated 404 there must Err (surfacing
-        // the status), proving the read_json conversion is load-bearing.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
-        let _m = server
-            .mock("GET", "/")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = run(ChangelogArgs {
-            repo: Some("noslash".to_string()),
-            limit: 20,
-            node: server.url(),
-            dir: Some(dir.path().to_path_buf()),
-        })
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/clone.rs

@@ -1,4 +1,4 @@
-//! `gl clone`: clean partial clone of a Twigpine repo with private subtrees.
+//! `gl clone`: clean partial clone of a gitlawb repo with private subtrees.
 //!
 //! A repo may withhold blob content under some path globs from the caller
 //! (Phase 3). The resulting pack is not closed under reachability, so a stock
@@ -76,11 +76,7 @@ pub struct CloneArgs {
     #[arg(long)]
     pub branch: Option<String>,
 
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
 
     /// Arweave gateway for B3 manifest discovery/fetch when a node cannot supply
@@ -578,7 +574,7 @@ fn merge_manifests(
         .collect()
 }
 
-/// Option B3 fallback recovery, with no dependency on a Twigpine node API. Query
+/// Option B3 fallback recovery, with no dependency on a gitlawb node API. Query
 /// the Arweave gateway for this repo's encrypted manifests, merge them, and for
 /// each blob still missing locally that the caller can decrypt, pull the envelope
 /// from a public IPFS gateway, decrypt, and install it as a loose object. Returns

crates/gl/src/doctor.rs

@@ -1,10 +1,10 @@
-//! `gl doctor` — check your Twigpine installation and connectivity.
+//! `gl doctor` — check your gitlawb installation and connectivity.
 //!
 //! Checks:
 //!   1. Identity        — ~/.gitlawb/identity.pem exists, DID parseable
 //!   2. Registration    — ~/.gitlawb/ucan.json exists (registered with a node)
 //!   3. GITLAWB_NODE    — env var is set to a non-localhost URL
-//!   4. Node            — GITLAWB_NODE is reachable (default: https://node.twigpine.com)
+//!   4. Node            — GITLAWB_NODE is reachable (default: https://node.gitlawb.com)
 //!   5. git helper      — git-remote-gitlawb is in PATH
 //!   6. git             — git is installed
 //!   7. version         — gl is up to date with latest GitHub release
@@ -15,7 +15,7 @@ use std::path::PathBuf;
 
 use crate::http::NodeClient;
 
-const PUBLIC_NODE: &str = "https://node.twigpine.com";
+const PUBLIC_NODE: &str = "https://node.gitlawb.com";
 const GITHUB_API_BASE: &str = "https://api.github.com";
 
 #[derive(Args)]
@@ -70,7 +70,7 @@ impl Check {
 }
 
 pub async fn run(args: DoctorArgs) -> Result<()> {
-    println!("gl doctor — checking your Twigpine setup");
+    println!("gl doctor — checking your gitlawb setup");
     println!();
 
     let dir = args.dir.unwrap_or_else(|| {
@@ -160,7 +160,7 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
             checks.push(Check::fail(
                 "GITLAWB_NODE",
                 "not set — git-remote-gitlawb will fall back to http://127.0.0.1:7545",
-                "export GITLAWB_NODE=https://node.twigpine.com",
+                "export GITLAWB_NODE=https://node.gitlawb.com",
             ));
         }
     }
@@ -187,7 +187,7 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
                         "node is v{version} but gl is v{gl_ver} — your CLI may be missing \
                          features (signing / iCaptcha) this node requires"
                     ),
-                    "upgrade gl: curl -sSf https://twigpine.com/install.sh | sh",
+                    "upgrade gl: curl -sSf https://gitlawb.com/install.sh | sh",
                 ));
             }
         }
@@ -241,7 +241,7 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
         checks.push(Check::fail(
             "git-remote-gitlawb",
             "not found in PATH — gitlawb:// clone/push will not work",
-            "curl -sSf https://twigpine.com/install.sh | sh",
+            "curl -sSf https://gitlawb.com/install.sh | sh",
         ));
     }
 
@@ -408,7 +408,7 @@ fn which_in_path(name: &str) -> bool {
         .unwrap_or(false)
 }
 
-/// Fetch the latest release tag from Twigpine/node (the actual release repo — see install.sh's
+/// Fetch the latest release tag from Gitlawb/node (the actual release repo — see install.sh's
 /// `GITLAWB_RELEASE_REPO` default) and compare to current version.
 async fn check_version(current: &'static str, github_api_base: &str) -> Check {
     let client = match reqwest::Client::builder()
@@ -422,7 +422,7 @@ async fn check_version(current: &'static str, github_api_base: &str) -> Check {
 
     let resp = match client
         .get(format!(
-            "{github_api_base}/repos/Twigpine/node/releases/latest"
+            "{github_api_base}/repos/Gitlawb/node/releases/latest"
         ))
         .send()
         .await
@@ -457,7 +457,7 @@ async fn check_version(current: &'static str, github_api_base: &str) -> Check {
         Check::warn(
             "version",
             format!("v{current} → v{tag} available"),
-            "curl -sSf https://twigpine.com/install.sh | sh",
+            "curl -sSf https://gitlawb.com/install.sh | sh",
         )
     } else {
         Check::pass("version", format!("v{current} (up to date)"))
@@ -550,7 +550,7 @@ mod tests {
         assert!(is_loopback_url("http://localhost:7545"));
         assert!(is_loopback_url("http://[::1]:7545"));
         assert!(!is_loopback_url("https://localhost.example"));
-        assert!(!is_loopback_url("https://node.twigpine.com/localhost"));
+        assert!(!is_loopback_url("https://node.gitlawb.com/localhost"));
         assert!(!is_loopback_url("not a url"));
     }
 
@@ -603,7 +603,7 @@ mod tests {
     async fn test_check_version_queries_gitlawb_node_releases() {
         let mut server = mockito::Server::new_async().await;
         let _m = server
-            .mock("GET", "/repos/Twigpine/node/releases/latest")
+            .mock("GET", "/repos/Gitlawb/node/releases/latest")
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"tag_name":"v9.9.9"}"#)
@@ -619,7 +619,7 @@ mod tests {
     async fn test_check_version_up_to_date() {
         let mut server = mockito::Server::new_async().await;
         let _m = server
-            .mock("GET", "/repos/Twigpine/node/releases/latest")
+            .mock("GET", "/repos/Gitlawb/node/releases/latest")
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"tag_name":"v0.1.0"}"#)
@@ -635,7 +635,7 @@ mod tests {
     async fn test_check_version_http_error() {
         let mut server = mockito::Server::new_async().await;
         let _m = server
-            .mock("GET", "/repos/Twigpine/node/releases/latest")
+            .mock("GET", "/repos/Gitlawb/node/releases/latest")
             .with_status(403)
             .create_async()
             .await;

crates/gl/src/http.rs

@@ -1,4 +1,4 @@
-//! Signed HTTP client for Twigpine API calls (async).
+//! Signed HTTP client for gitlawb API calls (async).
 //!
 //! Writes are signed with RFC 9421 HTTP Signatures. When the node gates a write
 //! behind iCaptcha (HTTP 403 `icaptcha_proof_required`, advertised via the
@@ -10,7 +10,6 @@ use anyhow::{Context, Result};
 use gitlawb_core::http_sig::sign_request;
 use gitlawb_core::identity::Keypair;
 use icaptcha_client::IcaptchaCfg;
-use serde_json::Value;
 
 /// Max times we'll fetch a fresh proof and retry a 403-iCaptcha response
 /// (absorbs proof expiry / first-seen replay).
@@ -320,7 +319,7 @@ pub(crate) async fn read_body_capped(mut resp: reqwest::Response, cap: usize) ->
 /// Strip terminal-dangerous characters from (and cap the length of) a
 /// node-supplied error string before surfacing it. The node a caller talks to
 /// could be hostile and embed escape sequences in its error body; those must not
-/// reach the terminal verbatim. We drop the C0/C1 control bytes (which
+/// reach the terminal verbatim (INV-6). We drop the C0/C1 control bytes (which
 /// defangs ANSI/OSC escapes) AND the Unicode bidi/format controls (which
 /// `char::is_control` does not cover — they can reorder the displayed line).
 pub(crate) fn sanitize_node_msg(s: &str) -> String {
@@ -330,60 +329,6 @@ pub(crate) fn sanitize_node_msg(s: &str) -> String {
         .collect()
 }
 
-/// Read a JSON response, surfacing a node denial/error instead of parsing it as
-/// the requested resource. On a non-2xx status it returns an `Err` carrying the
-/// node's sanitized `message` plus the status; on success it parses the
-/// body and propagates a parse error, so a truncated/garbage 2xx body is an error
-/// rather than a silently-empty success (the denial-as-success bug #123 fixes).
-/// `what` names the resource for the error text (e.g. "repo", "commits").
-///
-/// Callers must route gated reads through this rather than `resp.json().await?`:
-/// the bare parse renders a gated 404/5xx body back as the resource.
-/// Cap on the error body `read_json` reads before parsing a node's `message`.
-/// Matches the capped-read bound used on the sync error path; large enough for any
-/// legitimate error, small enough that a hostile node cannot exhaust memory.
-const ERROR_BODY_CAP: usize = 8 * 1024;
-
-pub(crate) async fn read_json(resp: reqwest::Response, what: &str) -> Result<Value> {
-    let status = resp.status();
-    if !status.is_success() {
-        // Bound the error read: `resp.json()` would buffer and parse the WHOLE
-        // body, so a hostile node could stream an arbitrarily large valid JSON
-        // error and exhaust this process's memory (#186). Read a small capped body
-        // first, then best-effort extract `message`. The error body may also be
-        // non-JSON (503 degraded, 413 body-limit from middleware), so a parse miss
-        // falls back to the capped raw text; an empty body to the status alone.
-        let raw = read_body_capped(resp, ERROR_BODY_CAP).await.text;
-        // Preserve the prior contract: surface the JSON `message` when present in
-        // the capped body, else the status alone ("request failed") — a non-JSON
-        // or message-less body (503 degraded, 413 body-limit) never surfaces raw
-        // node bytes. A body whose `message` sits past the cap parses as truncated
-        // garbage here and correctly falls back rather than being buffered whole.
-        //
-        // Fall back to `error` before giving up: the node's shared AppError
-        // envelope carries both keys, but the task API answers with `error` alone
-        // (`{"error":"task not found"}` in gitlawb-node/src/api/tasks.rs), so
-        // reading only `message` blanked every `gl task` denial to the generic
-        // "request failed". `sync.rs`'s hand-rolled reader already reads both; this
-        // matches it.
-        let msg = serde_json::from_str::<Value>(&raw)
-            .ok()
-            .and_then(|b| {
-                b.get("message")
-                    .or_else(|| b.get("error"))
-                    .and_then(|m| m.as_str())
-                    .map(str::to_owned)
-            })
-            .unwrap_or_else(|| "request failed".to_owned());
-        anyhow::bail!("{what} failed ({status}): {}", sanitize_node_msg(&msg));
-    }
-    // Success: a truncated/garbage 2xx body must be an `Err`, not `Ok(Null)` that
-    // a caller then renders as an empty success.
-    resp.json()
-        .await
-        .with_context(|| format!("invalid JSON in {what} response"))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1323,217 +1268,4 @@ mod tests {
         let out = sanitize_node_msg("ok \u{0627}\u{200D}b");
         assert_eq!(out, "ok \u{0627}\u{200D}b");
     }
-
-    // ── read_json (status-checked, bounded, sanitized read; #123) ────────
-
-    /// Drive a real `reqwest::Response` off a mockito mock so `read_json` sees an
-    /// actual HTTP status + body, the same shape the gated read arms produce.
-    async fn response_for(
-        server: &mut Server,
-        status: usize,
-        body: &str,
-        json: bool,
-    ) -> reqwest::Response {
-        let mut m = server.mock("GET", "/x").with_status(status).with_body(body);
-        if json {
-            m = m.with_header("content-type", "application/json");
-        }
-        let _m = m.create_async().await;
-        NodeClient::new(server.url(), None).get("/x").await.unwrap()
-    }
-
-    #[tokio::test]
-    async fn read_json_returns_body_on_2xx() {
-        let mut server = Server::new_async().await;
-        let resp = response_for(
-            &mut server,
-            200,
-            r#"{"name":"r","owner_did":"did:gitlawb:z"}"#,
-            true,
-        )
-        .await;
-        let v = read_json(resp, "repo").await.unwrap();
-        assert_eq!(v["name"], "r");
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_404_surfacing_message_and_status() {
-        let mut server = Server::new_async().await;
-        let resp = response_for(
-            &mut server,
-            404,
-            r#"{"message":"repository 'o/r' not found"}"#,
-            true,
-        )
-        .await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("404"), "err={err}");
-        assert!(err.contains("not found"), "err={err}");
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_500_surfacing_message() {
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 500, r#"{"message":"internal boom"}"#, true).await;
-        let err = read_json(resp, "commits").await.unwrap_err().to_string();
-        assert!(err.contains("500"), "err={err}");
-        assert!(err.contains("internal boom"), "err={err}");
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_non_json_error_body_with_fallback() {
-        // 503 with a plain-text (middleware) body: no `message` field to surface.
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 503, "service unavailable", false).await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("503"), "err={err}");
-        assert!(err.contains("request failed"), "err={err}");
-    }
-
-    #[tokio::test]
-    async fn read_json_sanitizes_control_and_bidi_in_message() {
-        // A hostile node embeds ESC, BEL, and a right-to-left override in
-        // the error message; none may reach the terminal verbatim.
-        let mut server = Server::new_async().await;
-        let resp = response_for(
-            &mut server,
-            404,
-            r#"{"message":"a\u001b[31mb\u0007c\u202ed"}"#,
-            true,
-        )
-        .await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
-        assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
-        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_garbage_2xx_body() {
-        // The #123 correctness point: a 200 with a non-JSON/truncated body must be
-        // an `Err`, NOT `Ok(Null)` that a caller renders as an empty success.
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 200, "this is not json", false).await;
-        assert!(read_json(resp, "repo").await.is_err());
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_empty_2xx_body() {
-        // A zero-byte 200 body must be an `Err`, not a silent `Ok(Null)`.
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 200, "", false).await;
-        assert!(read_json(resp, "repo").await.is_err());
-    }
-
-    #[tokio::test]
-    async fn read_json_errs_on_non_2xx_json_without_message_or_error() {
-        // A non-2xx JSON body carrying NEITHER key is the real fallback case.
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 403, r#"{"detail":"forbidden"}"#, true).await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("403"), "err={err}");
-        assert!(err.contains("request failed"), "err={err}");
-        // The body's own text must not leak when no recognised key carries it.
-        assert!(!err.contains("forbidden"), "raw body leaked: {err}");
-    }
-
-    #[tokio::test]
-    async fn read_json_surfaces_error_key_when_message_absent() {
-        // The task API answers with `error` alone — see
-        // gitlawb-node/src/api/tasks.rs `{"error":"task not found"}`. Reading only
-        // `message` blanked those denials to the generic "request failed", so the
-        // user was told nothing about why the call failed.
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 404, r#"{"error":"task not found"}"#, true).await;
-        let err = read_json(resp, "task show").await.unwrap_err().to_string();
-        assert!(err.contains("404"), "err={err}");
-        assert!(err.contains("task not found"), "reason not surfaced: {err}");
-    }
-
-    #[tokio::test]
-    async fn read_json_prefers_message_over_error_key() {
-        // The shared AppError envelope carries both; `message` is the human text
-        // and must win over the machine code in `error`.
-        let mut server = Server::new_async().await;
-        let resp = response_for(
-            &mut server,
-            500,
-            r#"{"error":"db_error","message":"database unavailable"}"#,
-            true,
-        )
-        .await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("database unavailable"), "err={err}");
-        assert!(
-            !err.contains("db_error"),
-            "machine code won over message: {err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn read_json_sanitizes_error_key_text() {
-        // The `error` fallback goes through the same sanitizer as `message`; a
-        // hostile node must not reach the terminal through the new path. The
-        // controls are JSON \u escapes so the body stays VALID JSON — embedding
-        // them raw would fail the parse and pass this test vacuously.
-        let mut server = Server::new_async().await;
-        let resp = response_for(
-            &mut server,
-            404,
-            r#"{"error":"a\u001b[31mb\u0007c\u202ed"}"#,
-            true,
-        )
-        .await;
-        let err = read_json(resp, "task show").await.unwrap_err().to_string();
-        // Proves the parse succeeded and the `error` key was read, not the
-        // "request failed" fallback (which would make the asserts below vacuous).
-        assert!(err.contains("task show failed (404"), "err={err}");
-        assert!(
-            !err.contains("request failed"),
-            "fell back, sanitizer untested: {err}"
-        );
-        assert!(
-            err.contains('a') && err.contains('d'),
-            "text dropped: {err}"
-        );
-        assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
-        assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
-        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
-    }
-
-    /// #186 (F2): the non-2xx error path must read a CAPPED body, not buffer and
-    /// parse the whole thing — a hostile node can stream an arbitrarily large valid
-    /// JSON error. Place the `message` field AFTER more than the cap of padding: the
-    /// bounded read stops before it, so it must be ABSENT from the surfaced error.
-    /// RED before the fix (`resp.json()` parses the full body → the far message
-    /// appears), GREEN after (capped read truncates → fallback → far message gone).
-    /// The status is still surfaced, so a legitimate small error is unaffected.
-    #[tokio::test]
-    async fn read_json_bounds_the_error_body_read() {
-        let mut server = Server::new_async().await;
-        // >8 KiB of padding, then the marker message at the very end of the body.
-        let big = format!(
-            r#"{{"padding":"{}","message":"FARMARKER_BEYOND_CAP"}}"#,
-            "A".repeat(16 * 1024)
-        );
-        let resp = response_for(&mut server, 500, &big, true).await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("500"), "bounded read still errors: {err}");
-        assert!(
-            !err.contains("FARMARKER_BEYOND_CAP"),
-            "the error body read must be capped: a message beyond the cap must not be surfaced, err={err}"
-        );
-    }
-
-    /// #186 (F2): an EMPTY non-2xx body is its own input class — the capped read
-    /// yields "", the JSON parse fails, and it falls back to the status alone
-    /// ("request failed"), never a panic or a spurious success.
-    #[tokio::test]
-    async fn read_json_errs_on_empty_non_2xx_body() {
-        let mut server = Server::new_async().await;
-        let resp = response_for(&mut server, 502, "", false).await;
-        let err = read_json(resp, "repo").await.unwrap_err().to_string();
-        assert!(err.contains("502"), "err={err}");
-        assert!(err.contains("request failed"), "err={err}");
-    }
 }

crates/gl/src/identity.rs

@@ -154,7 +154,7 @@ async fn cmd_new_with_reader(
     println!("  DID:  {did}");
     println!("  Key:  {}", path.display());
     println!();
-    println!("  Your DID is your identity on the Twigpine network.");
+    println!("  Your DID is your identity on the gitlawb network.");
     println!("  Keep your key file safe — it cannot be recovered if lost.");
 
     Ok(())

crates/gl/src/init.rs

@@ -1,7 +1,7 @@
 //! `gl init` — zero-to-push in one command.
 //!
 //! Detects or initializes a git repo, ensures an identity exists,
-//! registers with the node, creates a remote repo, adds the Twigpine
+//! registers with the node, creates a remote repo, adds the gitlawb
 //! remote, and pushes.
 
 use anyhow::{Context, Result};
@@ -19,11 +19,7 @@ pub struct InitArgs {
     pub name: Option<String>,
 
     /// Node URL to register with
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
 
     /// Identity directory (default: ~/.gitlawb)
@@ -155,7 +151,7 @@ pub async fn run(args: InitArgs) -> Result<()> {
         println!("  Repository created.");
     }
 
-    // 5. Add Twigpine remote
+    // 5. Add gitlawb remote
     let did_short = did.to_string();
     let did_short = did_short.split(':').next_back().unwrap_or(&did_short);
     let remote_url = format!("gitlawb://{did_short}/{repo_name}");

crates/gl/src/ipfs_cmd.rs

@@ -1,6 +1,6 @@
 //! `gl ipfs` — IPFS pin management commands.
 //!
-//! Communicates with the Twigpine node to list pinned CIDs and retrieve git
+//! Communicates with the gitlawb node to list pinned CIDs and retrieve git
 //! objects by their content-addressed CID.
 
 use std::path::PathBuf;
@@ -22,11 +22,7 @@ pub struct IpfsArgs {
 pub enum IpfsCmd {
     /// List all CIDs pinned to the node's local IPFS daemon
     List {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         /// Identity directory (default: ~/.gitlawb)
         #[arg(long)]
@@ -73,11 +69,7 @@ pub enum IpfsCmd {
     Get {
         /// The CIDv1 string (e.g. bafkrei...)
         cid: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         /// Identity directory (default: ~/.gitlawb)
         #[arg(long)]
@@ -131,7 +123,11 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
         let sha = pin["sha256_hex"].as_str().unwrap_or("?");
         let pinned_at = pin["pinned_at"].as_str().unwrap_or("?");
         // Trim pinned_at to date+time without subseconds
-        let ts = crate::text::truncate(pinned_at, 19);
+        let ts = if pinned_at.len() >= 19 {
+            &pinned_at[..19]
+        } else {
+            pinned_at
+        };
         println!("  {cid}");
         println!("    sha256: {sha}");
         println!("    pinned: {ts}");

crates/gl/src/issue.rs

@@ -3,7 +3,7 @@
 use anyhow::{Context, Result};
 use chrono::Utc;
 use clap::{Args, Subcommand};
-use serde_json::json;
+use serde_json::{json, Value};
 use std::path::PathBuf;
 use uuid::Uuid;
 
@@ -32,11 +32,7 @@ pub enum IssueCmd {
         /// Issue body (optional)
         #[arg(long, short)]
         body: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -45,11 +41,7 @@ pub enum IssueCmd {
     List {
         /// Repository in <owner>/<repo> or <repo> format
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -60,11 +52,7 @@ pub enum IssueCmd {
         repo: String,
         /// Issue ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -75,11 +63,7 @@ pub enum IssueCmd {
         repo: String,
         /// Issue ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -90,11 +74,7 @@ pub enum IssueCmd {
         id: String,
         #[arg(long, short)]
         body: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -103,11 +83,7 @@ pub enum IssueCmd {
     Comments {
         repo: String,
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -166,7 +142,12 @@ async fn resolve_repo(
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = NodeClient::new(node, None);
-            let info = crate::http::read_json(client.get("/").await?, "node info").await?;
+            let info: Value = client
+                .get("/")
+                .await?
+                .json()
+                .await
+                .context("failed to fetch node info")?;
             let did = info["did"].as_str().context("node info missing 'did'")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -217,7 +198,13 @@ async fn cmd_create(
         .post(&path, &request_body)
         .await
         .context("failed to connect to node")?;
-    let result = crate::http::read_json(resp, "create issue").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("create issue failed ({status}): {msg}");
+    }
 
     let id = result["id"].as_str().unwrap_or("?");
     println!("✓ Created issue #{id}");
@@ -234,7 +221,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     let client = signed_client(&node, dir.as_deref());
     let path = format!("/api/v1/repos/{owner}/{name}/issues");
-    let resp = crate::http::read_json(client.get_authed(&path).await?, "issues").await?;
+    let resp: Value = client
+        .get_authed(&path)
+        .await?
+        .json()
+        .await
+        .context("failed to list issues")?;
 
     let issues = resp["issues"].as_array().cloned().unwrap_or_default();
 
@@ -251,7 +243,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         let status = issue["status"].as_str().unwrap_or("?");
         let created = issue["created_at"]
             .as_str()
-            .map(|s| crate::text::truncate(s, 10))
+            .map(|s| &s[..10])
             .unwrap_or("?");
         let icon = match status {
             "open" => "○",
@@ -272,7 +264,13 @@ async fn cmd_show(repo: String, id: String, node: String, dir: Option<PathBuf>)
         .get_authed(&path)
         .await
         .context("failed to connect to node")?;
-    let issue = crate::http::read_json(resp, "show").await?;
+    let status = resp.status();
+    let issue: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = issue["message"].as_str().unwrap_or("issue not found");
+        anyhow::bail!("show failed ({status}): {msg}");
+    }
 
     let title = issue["title"].as_str().unwrap_or("(no title)");
     let status = issue["status"].as_str().unwrap_or("?");
@@ -303,7 +301,13 @@ async fn cmd_close(repo: String, id: String, node: String, dir: Option<PathBuf>)
         .post(&format!("{path}/close"), &body)
         .await
         .context("failed to connect to node")?;
-    let _ = crate::http::read_json(resp, "close issue").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("close issue failed ({status}): {msg}");
+    }
 
     println!("✗ Closed issue {id}");
     Ok(())
@@ -328,7 +332,13 @@ async fn cmd_issue_comment(
         )
         .await
         .context("failed to connect to node")?;
-    let _ = crate::http::read_json(resp, "comment").await?;
+    let code = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !code.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("comment failed ({code}): {msg}");
+    }
 
     println!("· Comment posted on issue {id}");
     Ok(())
@@ -343,15 +353,14 @@ async fn cmd_issue_comments(
     let (owner, name) = resolve_repo(&repo, &node, dir.as_deref()).await?;
     let client = signed_client(&node, dir.as_deref());
 
-    let resp = crate::http::read_json(
-        client
-            .get_authed(&format!(
-                "/api/v1/repos/{owner}/{name}/issues/{id}/comments"
-            ))
-            .await?,
-        "issue comments",
-    )
-    .await?;
+    let resp: Value = client
+        .get_authed(&format!(
+            "/api/v1/repos/{owner}/{name}/issues/{id}/comments"
+        ))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
     let comments = resp["comments"].as_array().cloned().unwrap_or_default();
     if comments.is_empty() {
@@ -365,13 +374,10 @@ async fn cmd_issue_comments(
         let author_short = author
             .split(':')
             .next_back()
-            .map(|s| crate::text::truncate(s, 8))
+            .map(|s| &s[..s.len().min(8)])
             .unwrap_or("?");
         let cbody = c["body"].as_str().unwrap_or("");
-        let created = c["created_at"]
-            .as_str()
-            .map(|s| crate::text::truncate(s, 10))
-            .unwrap_or("?");
+        let created = c["created_at"].as_str().map(|s| &s[..10]).unwrap_or("?");
         println!("  · {author_short} ({created})");
         println!("    {cbody}");
         println!();
@@ -442,34 +448,6 @@ mod tests {
         .unwrap();
     }
 
-    #[tokio::test]
-    async fn test_cmd_list_survives_malformed_timestamps() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        // A short timestamp used to panic on `&s[..10]`; a timestamp whose
-        // byte 10 is mid-char panics even with a len() guard.
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/[^/]+/myrepo/issues$".to_string()),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"issues":[{"id":"a","title":"short ts","status":"open","created_at":"2026"},{"id":"b","title":"mb ts","status":"open","created_at":"2026-08-1é5T00:00:00Z"},{"id":"c","title":"empty ts","status":"open","created_at":""}]}"#)
-            .create_async()
-            .await;
-
-        cmd_list(
-            "myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
     #[tokio::test]
     async fn test_cmd_create_success() {
         let dir = TempDir::new().unwrap();
@@ -512,7 +490,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -527,8 +504,6 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("repo not found"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -576,7 +551,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -590,8 +564,6 @@ mod tests {
         .unwrap_err();
         assert!(err.to_string().contains("show failed"), "got: {err}");
         assert!(err.to_string().contains("issue not found"), "got: {err}");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -640,7 +612,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -653,8 +624,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("close issue failed"), "got: {err}");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -701,7 +670,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -715,8 +683,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("issue not found"), "got: {err}");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -774,48 +740,4 @@ mod tests {
         .await
         .unwrap();
     }
-
-    #[tokio::test]
-    async fn cmd_list_surfaces_denial_not_empty() {
-        // A gated 404 on the issue-list read must Err, not print "No issues".
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/issues$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
-        assert!(result.is_err(), "issue list must Err on a gated 404");
-        // Prove the gated issues path was actually requested: without this, an
-        // unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn resolve_repo_surfaces_denial() {
-        // A slash-free repo with an empty identity dir forces the GET / node-info
-        // fetch. A gated 404 there must Err (surfacing the status), proving the
-        // read_json conversion is load-bearing rather than silently ignored.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
-        let _m = server
-            .mock("GET", "/")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/main.rs

@@ -30,7 +30,6 @@ mod star;
 mod status;
 mod sync;
 mod task;
-mod text;
 mod ucan_cmd;
 mod visibility;
 mod webhook;
@@ -39,7 +38,7 @@ mod whoami;
 #[derive(Parser)]
 #[command(
     name = "gl",
-    about = "Twigpine CLI — identity, repos, MCP server",
+    about = "gitlawb CLI — identity, repos, MCP server",
     version,
     propagate_version = true
 )]
@@ -50,16 +49,16 @@ struct Cli {
 
 #[derive(Subcommand)]
 enum Commands {
-    /// Manage your Twigpine identity (DID + keypair)
+    /// Manage your gitlawb identity (DID + keypair)
     Identity {
         #[command(subcommand)]
         cmd: identity::IdentityCmd,
     },
 
-    /// Register this agent with a Twigpine node
+    /// Register this agent with a gitlawb node
     Register(register::RegisterArgs),
 
-    /// Clone a Twigpine repo, handling private subtrees cleanly
+    /// Clone a gitlawb repo, handling private subtrees cleanly
     Clone(clone::CloneArgs),
 
     /// Manage repositories
@@ -86,10 +85,10 @@ enum Commands {
     /// Manage webhooks for a repository
     Webhook(webhook::WebhookArgs),
 
-    /// Mirror a public GitHub/GitLab/any-git repo into Twigpine
+    /// Mirror a public GitHub/GitLab/any-git repo into gitlawb
     Mirror(mirror::MirrorArgs),
 
-    /// MCP server — expose Twigpine tools to LLM agents
+    /// MCP server — expose gitlawb tools to LLM agents
     Mcp(mcp::McpArgs),
 
     /// Sync repos from peer nodes (HTTP fallback for p2p gossip)
@@ -101,7 +100,7 @@ enum Commands {
     /// Register and resolve names on Base L2
     Name(name::NameArgs),
 
-    /// Check your Twigpine installation and connectivity
+    /// Check your gitlawb installation and connectivity
     Doctor(doctor::DoctorArgs),
 
     /// Zero-to-push in one command — init repo, identity, register, remote

crates/gl/src/mirror.rs

@@ -3,7 +3,7 @@
 //! Flow:
 //!   1. Parse source URL → derive repo name (or use --repo override)
 //!   2. `git clone --mirror <source>` into a temp dir
-//!   3. Create the repo on the Twigpine node (authenticated)
+//!   3. Create the repo on the gitlawb node (authenticated)
 //!   4. `git push --mirror gitlawb://<did>/<name>`
 //!   5. Clean up temp dir
 
@@ -22,19 +22,15 @@ pub struct MirrorArgs {
     /// Source repository URL (https://github.com/owner/repo, GitLab, or any public git URL)
     pub source: String,
 
-    /// Name to use on Twigpine (default: last path segment of source URL, .git suffix stripped)
+    /// Name to use on gitlawb (default: last path segment of source URL, .git suffix stripped)
     #[arg(long)]
     pub repo: Option<String>,
 
-    /// Optional description for the Twigpine repo
+    /// Optional description for the gitlawb repo
     #[arg(long, short)]
     pub description: Option<String>,
 
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
 
     #[arg(long)]
@@ -66,7 +62,7 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
     let owner_did = kp.did().to_string();
 
     println!("Mirroring {source}");
-    println!("  → Twigpine repo: {name}");
+    println!("  → gitlawb repo: {name}");
     println!();
 
     // ── 3. git clone --mirror into a temp dir ─────────────────────────────
@@ -84,10 +80,17 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
     let _guard = TmpGuard(tmp_root);
 
     println!("Cloning source (this may take a while for large repos)...");
-    clone_mirror(&source, &mirror_path)?;
+    let clone_status = Command::new("git")
+        .args(["clone", "--mirror", &source, mirror_path.to_str().unwrap()])
+        .status()
+        .context("failed to run git clone — is git installed?")?;
 
-    // ── 4. Create the repo on Twigpine ─────────────────────────────────────
-    println!("Creating repo on Twigpine node...");
+    if !clone_status.success() {
+        bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
+    }
+
+    // ── 4. Create the repo on gitlawb ─────────────────────────────────────
+    println!("Creating repo on gitlawb node...");
     let client = NodeClient::new(&args.node, Some(kp));
 
     let body = serde_json::to_vec(&json!({
@@ -110,7 +113,7 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
         bail!("failed to create repo ({status}): {msg}");
     }
 
-    // ── 5. git push --mirror to Twigpine ───────────────────────────────────
+    // ── 5. git push --mirror to gitlawb ───────────────────────────────────
     let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
     println!("Pushing to {gitlawb_url}...");
 
@@ -122,7 +125,7 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
         .context("failed to run git push")?;
 
     if !push_status.success() {
-        bail!("git push --mirror failed\nThe repo was created on Twigpine but the push did not complete.\nYou can retry with:\n  cd {path} && git push --mirror {gitlawb_url}",
+        bail!("git push --mirror failed\nThe repo was created on gitlawb but the push did not complete.\nYou can retry with:\n  cd {path} && git push --mirror {gitlawb_url}",
             path = mirror_path.display());
     }
 
@@ -131,30 +134,11 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
     println!();
     println!("✓ Mirror complete: {name}");
     println!("  Clone:  git clone {gitlawb_url}");
-    println!("  View:   https://twigpine.com/{owner_short}/{name}");
+    println!("  View:   https://gitlawb.com/{owner_short}/{name}");
 
     Ok(())
 }
 
-/// `git clone --mirror <source> <dest>`. The destination is passed as an
-/// OS-native path so a non-UTF-8 temp dir (e.g. a TMPDIR with non-UTF-8 bytes)
-/// does not panic on a `to_str()` conversion.
-fn clone_mirror(source: &str, dest: &std::path::Path) -> Result<()> {
-    // allow-unbounded-git: gl is the client CLI; this clone runs in the user's
-    // terminal with no server-side permit or disconnect to survive. The
-    // bounded-runner rule governs node request handlers. Same spawn as before,
-    // only relocated into this helper.
-    let status = Command::new("git")
-        .args(["clone", "--mirror", source])
-        .arg(dest)
-        .status()
-        .context("failed to run git clone — is git installed?")?;
-    if !status.success() {
-        bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
-    }
-    Ok(())
-}
-
 /// Extract the repo name from a git URL.
 /// - `https://github.com/owner/repo`     → `"repo"`
 /// - `https://github.com/owner/repo.git` → `"repo"`
@@ -237,80 +221,6 @@ mod tests {
         assert_eq!(extract_repo_name("https://example.com/.git"), None);
     }
 
-    // #417: a non-UTF-8 destination path must reach git as an OS-native arg, not
-    // panic on a `to_str()` conversion.
-    #[cfg(unix)]
-    #[test]
-    fn test_clone_mirror_non_utf8_dest() {
-        use std::ffi::OsStr;
-        use std::os::unix::ffi::OsStrExt;
-
-        let tmp = tempfile::TempDir::new().unwrap();
-        let src = tmp.path().join("src.git");
-        let st = Command::new("git")
-            .args(["init", "--bare"])
-            .arg(&src)
-            .status()
-            .unwrap();
-        assert!(st.success());
-
-        let dest = tmp.path().join(OsStr::from_bytes(b"mirror-\xffdest"));
-        clone_mirror(src.to_str().unwrap(), &dest).unwrap();
-        assert!(dest.join("HEAD").exists());
-    }
-
-    // #417 end-to-end: the real trigger is `std::env::temp_dir()` itself
-    // returning a non-UTF-8 path (a TMPDIR with non-UTF-8 bytes), because the
-    // mirror dest is built from it. Env is process-global, so this test
-    // re-execs the test binary in a child with a non-UTF-8 TMPDIR rather than
-    // mutating this process's env.
-    #[cfg(unix)]
-    #[test]
-    fn test_clone_mirror_under_non_utf8_tmpdir() {
-        use std::ffi::OsStr;
-        use std::os::unix::ffi::OsStrExt;
-
-        if std::env::var_os("GL_MIRROR_NONUTF8_TMPDIR").is_none() {
-            // Parent: a source repo under a normal path, a TMPDIR whose name
-            // is not UTF-8, and a child run of this same test under that env.
-            let parent = tempfile::TempDir::new().unwrap();
-            let src = parent.path().join("src.git");
-            let st = Command::new("git")
-                .args(["init", "--bare"])
-                .arg(&src)
-                .status()
-                .unwrap();
-            assert!(st.success());
-            let bad_tmp = parent.path().join(OsStr::from_bytes(b"tmp-\xff"));
-            std::fs::create_dir_all(&bad_tmp).unwrap();
-
-            let status = Command::new(std::env::current_exe().unwrap())
-                .args([
-                    "mirror::tests::test_clone_mirror_under_non_utf8_tmpdir",
-                    "--exact",
-                ])
-                .env("GL_MIRROR_NONUTF8_TMPDIR", "1")
-                .env("GL_MIRROR_SRC", &src)
-                .env("TMPDIR", &bad_tmp)
-                .status()
-                .unwrap();
-            assert!(status.success(), "child failed under non-UTF-8 TMPDIR");
-            return;
-        }
-
-        // Child: the same path shape run() computes — temp_dir() joined with
-        // the mirror dest. It must be non-UTF-8 or the test proves nothing.
-        let src = std::env::var("GL_MIRROR_SRC").unwrap();
-        let tmp_root = std::env::temp_dir().join("gl-mirror-child");
-        let dest = tmp_root.join("repo");
-        assert!(
-            dest.to_str().is_none(),
-            "fixture broken: dest under a non-UTF-8 TMPDIR must be non-UTF-8"
-        );
-        clone_mirror(&src, &dest).unwrap();
-        assert!(dest.join("HEAD").exists());
-    }
-
     #[tokio::test]
     async fn test_create_repo_conflict_error() {
         let mut server = mockito::Server::new_async().await;

crates/gl/src/name.rs

@@ -72,7 +72,7 @@ pub enum NameCmd {
         /// Name registry contract address
         #[arg(long, env = "GITLAWB_CONTRACT_NAME_REGISTRY", default_value = DEFAULT_NAME_REGISTRY)]
         contract: String,
-        /// Twigpine identity directory (reads your DID)
+        /// gitlawb identity directory (reads your DID)
         #[arg(long)]
         dir: Option<PathBuf>,
     },

crates/gl/src/node.rs

@@ -20,11 +20,7 @@ pub struct NodeArgs {
 pub enum NodeCmd {
     /// Show a comprehensive status dashboard for the node
     Status {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         /// Identity directory (default: ~/.gitlawb)
         #[arg(long)]
@@ -33,21 +29,13 @@ pub enum NodeCmd {
     /// Check trust score for a DID
     Trust {
         did: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
     /// Resolve a DID to node info
     Resolve {
         did: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
 
@@ -324,7 +312,7 @@ async fn cmd_status(node: String, dir: Option<PathBuf>) -> Result<()> {
 
     // ── Render dashboard ──────────────────────────────────────────────────
     println!("╔══════════════════════════════════════════════╗");
-    println!("║  Twigpine node status                        ║");
+    println!("║  gitlawb node status                         ║");
     println!("╚══════════════════════════════════════════════╝");
     println!();
 
@@ -413,7 +401,7 @@ async fn cmd_status(node: String, dir: Option<PathBuf>) -> Result<()> {
                     let ref_name = ev["ref"].as_str().unwrap_or("?");
                     let ts = ev["timestamp"]
                         .as_str()
-                        .map(|s| crate::text::truncate(s, 10))
+                        .map(|s| &s[..10.min(s.len())])
                         .unwrap_or("?");
                     println!("  {ts}  {repo}  {ref_name}");
                 }

crates/gl/src/node_stake.rs

@@ -72,7 +72,7 @@ pub async fn cmd_register(
     let token_addr: Address = token.parse().context("invalid token address")?;
     let contract_addr: Address = contract.parse().context("invalid contract address")?;
 
-    println!("Registering Twigpine node on Base L2...");
+    println!("Registering gitlawb node on Base L2...");
     println!("  DID:      {did}");
     println!("  Stake:    {stake} $GITLAWB");
     println!("  HTTP URL: {http_url}");

crates/gl/src/peer.rs

@@ -20,22 +20,14 @@ pub struct PeerArgs {
 pub enum PeerCmd {
     /// List known peers on the node
     List {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
     /// Announce yourself to a peer node (adds you to their peer list)
     Add {
         /// The URL of the peer node to announce to
         peer_url: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -44,22 +36,14 @@ pub enum PeerCmd {
     Ping {
         /// The DID of the peer to ping
         did: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
     /// Resolve a DID to its node URL and p2p info (checks local cache then Kademlia DHT)
     Resolve {
         /// The DID to resolve (e.g. did:key:z6Mk...)
         did: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
 }
@@ -79,7 +63,12 @@ pub async fn run(args: PeerArgs) -> Result<()> {
 
 async fn cmd_list(node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    let resp = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
+    let resp: Value = client
+        .get("/api/v1/peers")
+        .await?
+        .json()
+        .await
+        .context("failed to list peers")?;
 
     let peers = resp["peers"].as_array().cloned().unwrap_or_default();
     let count = resp["count"].as_u64().unwrap_or(peers.len() as u64);
@@ -97,7 +86,7 @@ async fn cmd_list(node: String) -> Result<()> {
         let reachable = peer["reachable"].as_bool().unwrap_or(false);
         let last_seen = peer["last_seen"]
             .as_str()
-            .map(|s| crate::text::truncate(s, 10))
+            .map(|s| &s[..10])
             .unwrap_or("never");
         let status = if reachable { "✓" } else { "✗" };
         println!("  {status} {url}");
@@ -180,20 +169,18 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
     let keypair = load_keypair_from_dir(dir.as_deref())?;
     let my_did = keypair.did().to_string();
 
-    // Fetch our node's public URL so we can announce it to the peer. This lookup
-    // is a deliberate fail-soft diagnostic: it only improves the URL we advertise.
-    // A response-level failure (denial, error, garbage body) falls back to the
-    // --node value with a visible note rather than aborting; only a transport
-    // failure on the GET itself is fatal. The announce below keeps the
-    // fail-closed read_json check.
+    // Fetch our node's public URL so we can announce it to the peer
     let local_client = NodeClient::new(&node, None);
-    let my_url = match crate::http::read_json(local_client.get("/").await?, "node info").await {
-        Ok(info) => info["public_url"].as_str().unwrap_or(&node).to_string(),
-        Err(e) => {
-            eprintln!("note: local node info unavailable ({e}); announcing {node}");
-            node.clone()
-        }
-    };
+    let node_info: Value = local_client
+        .get("/")
+        .await?
+        .json()
+        .await
+        .context("failed to fetch local node info")?;
+    let my_url = node_info["public_url"]
+        .as_str()
+        .unwrap_or(&node)
+        .to_string();
 
     // Announce our local node to the remote peer
     let body = serde_json::to_vec(&serde_json::json!({
@@ -269,7 +256,12 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
 async fn cmd_ping(did: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
     let path = format!("/api/v1/peers/{did}/ping");
-    let resp = crate::http::read_json(client.get(&path).await?, "ping peer").await?;
+    let resp: Value = client
+        .get(&path)
+        .await?
+        .json()
+        .await
+        .context("failed to ping peer")?;
 
     let url = resp["http_url"].as_str().unwrap_or("?");
     let reachable = resp["reachable"].as_bool().unwrap_or(false);
@@ -289,7 +281,12 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
     let encoded = urlencoding::encode(&did);
     let path = format!("/api/v1/resolve/{encoded}");
-    let resp = crate::http::read_json(client.get(&path).await?, "resolve DID").await?;
+    let resp: Value = client
+        .get(&path)
+        .await?
+        .json()
+        .await
+        .context("failed to resolve DID")?;
 
     let source = resp["source"].as_str().unwrap_or("not found");
     let http_url = resp["http_url"].as_str().unwrap_or("(none)");
@@ -312,8 +309,8 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
 #[cfg(test)]
 mod tests {
     use super::{
-        announced_peer_summary, cmd_add, cmd_list, cmd_ping, cmd_resolve, local_add_refusal,
-        local_add_report, remote_announce_failure,
+        announced_peer_summary, cmd_add, local_add_refusal, local_add_report,
+        remote_announce_failure,
     };
     use reqwest::StatusCode;
     use serde_json::json;
@@ -606,282 +603,4 @@ mod tests {
             "legitimate text mangled: {warning:?}"
         );
     }
-
-    #[tokio::test]
-    async fn cmd_list_surfaces_denial_not_empty() {
-        // A node error must Err, not print "No known peers" as if the list were empty.
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/api/v1/peers")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = cmd_list(server.url()).await.unwrap_err();
-        assert!(err.to_string().contains("500"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_ping_surfaces_denial_not_unreachable() {
-        // A node error must Err, not print a fabricated "unreachable" peer.
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/api/v1/peers/peer1/ping")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = cmd_ping("peer1".to_string(), server.url())
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_resolve_surfaces_denial_not_notfound() {
-        // A node error must Err, not print "Source: not found" as if resolved-absent.
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/api/v1/resolve/".to_string()),
-            )
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = cmd_resolve("peer1".to_string(), server.url())
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("500"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    // cmd_add needs a local identity to build my_did before the GET /.
-    fn identity_dir() -> tempfile::TempDir {
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-        dir
-    }
-
-    /// Mock a successful announce that requires `http_url` in the POSTed body.
-    /// The `{}` response body matters: it leaves `node_url` absent, so cmd_add
-    /// skips the follow-up local peer-list POST.
-    async fn announce_ok_mock(server: &mut mockito::ServerGuard, http_url: &str) -> mockito::Mock {
-        announce_mock_with_body(server, http_url, "{}").await
-    }
-
-    /// Like [`announce_ok_mock`] but with a custom response body, for tests
-    /// that need `node_url` populated so the follow-up local add runs.
-    async fn announce_mock_with_body(
-        server: &mut mockito::ServerGuard,
-        http_url: &str,
-        body: &str,
-    ) -> mockito::Mock {
-        server
-            .mock("POST", "/api/v1/peers/announce")
-            .match_body(mockito::Matcher::PartialJson(serde_json::json!({
-                "http_url": http_url,
-            })))
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(body)
-            .expect(1)
-            .create_async()
-            .await
-    }
-
-    // The local `GET /` lookup in cmd_add is a fail-soft diagnostic: a denied
-    // or error node-info response must fall back to announcing the --node URL
-    // (with a stderr note), not abort the command before the announce POST.
-    #[tokio::test]
-    async fn cmd_add_announces_fallback_url_when_node_info_denied() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"internal"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = announce_ok_mock(&mut remote, &local.url()).await;
-
-        let dir = identity_dir();
-        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap();
-        _info.assert_async().await;
-        _announce.assert_async().await;
-    }
-
-    // Same fallback for a 200 node-info response whose body is not JSON.
-    #[tokio::test]
-    async fn cmd_add_falls_back_on_malformed_node_info() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_body("not json")
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = announce_ok_mock(&mut remote, &local.url()).await;
-
-        let dir = identity_dir();
-        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap();
-        _info.assert_async().await;
-        _announce.assert_async().await;
-    }
-
-    // Must-not case: the announce POST itself stays fail-closed. A denied
-    // announce surfaces as an Err naming the status, never a printed success.
-    #[tokio::test]
-    async fn cmd_add_surfaces_denied_announce() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"public_url":"https://pub.example"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = remote
-            .mock("POST", "/api/v1/peers/announce")
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let dir = identity_dir();
-        let err = cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("403"), "got: {err}");
-        _info.assert_async().await;
-        _announce.assert_async().await;
-    }
-
-    // Success path unchanged: a usable node-info response announces its
-    // public_url; the --node fallback must not leak in.
-    #[tokio::test]
-    async fn cmd_add_uses_public_url_when_lookup_succeeds() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"public_url":"https://pub.example"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = announce_ok_mock(&mut remote, "https://pub.example").await;
-
-        let dir = identity_dir();
-        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap();
-        _info.assert_async().await;
-        _announce.assert_async().await;
-    }
-
-    // When the peer's announce response carries a node_url, cmd_add posts the
-    // peer back to the local node's peer list; a successful local POST is the
-    // one case that prints the added line.
-    #[tokio::test]
-    async fn cmd_add_adds_peer_to_local_list_on_success() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"public_url":"https://pub.example"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _local_add = local
-            .mock("POST", "/api/v1/peers/announce")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"status":"added"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = announce_mock_with_body(
-            &mut remote,
-            "https://pub.example",
-            r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
-        )
-        .await;
-
-        let dir = identity_dir();
-        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap();
-        _info.assert_async().await;
-        _announce.assert_async().await;
-        _local_add.assert_async().await;
-    }
-
-    // The local add stays best-effort: a failing local POST must not fail the
-    // command (the announce to the remote peer already succeeded), it only
-    // changes the printed outcome.
-    #[tokio::test]
-    async fn cmd_add_stays_ok_when_local_add_fails() {
-        let mut local = mockito::Server::new_async().await;
-        let _info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"public_url":"https://pub.example"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _local_add = local
-            .mock("POST", "/api/v1/peers/announce")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let mut remote = mockito::Server::new_async().await;
-        let _announce = announce_mock_with_body(
-            &mut remote,
-            "https://pub.example",
-            r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
-        )
-        .await;
-
-        let dir = identity_dir();
-        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap();
-        _info.assert_async().await;
-        _announce.assert_async().await;
-        _local_add.assert_async().await;
-    }
 }

crates/gl/src/pr.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -34,11 +35,7 @@ pub enum PrCmd {
         /// Repo owner DID short key (defaults to your DID — use when opening a PR on another user's repo)
         #[arg(long)]
         owner: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -47,11 +44,7 @@ pub enum PrCmd {
     List {
         /// Repository name
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -62,11 +55,7 @@ pub enum PrCmd {
         repo: String,
         /// PR number
         number: u64,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -77,11 +66,7 @@ pub enum PrCmd {
         repo: String,
         /// PR number
         number: u64,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -92,11 +77,7 @@ pub enum PrCmd {
         repo: String,
         /// PR number
         number: u64,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -113,11 +94,7 @@ pub enum PrCmd {
         /// Review body
         #[arg(long, short)]
         body: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -131,11 +108,7 @@ pub enum PrCmd {
         /// Comment body
         #[arg(long, short)]
         body: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -146,11 +119,7 @@ pub enum PrCmd {
         repo: String,
         /// PR number
         number: u64,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -264,7 +233,13 @@ async fn cmd_create(
         .post(&format!("/api/v1/repos/{owner}/{repo}/pulls"), &payload)
         .await
         .context("failed to connect to node")?;
-    let pr = crate::http::read_json(resp, "create PR").await?;
+    let status = resp.status();
+    let pr: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = pr["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("create PR failed ({status}): {msg}");
+    }
 
     let number = pr["number"].as_i64().unwrap_or(0);
     println!("✓ Opened PR #{number}: {title}");
@@ -279,13 +254,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp = crate::http::read_json(
-        client
-            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
-            .await?,
-        "pull requests",
-    )
-    .await?;
+    let resp: Value = client
+        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
     let prs = resp["pulls"].as_array().cloned().unwrap_or_default();
     if prs.is_empty() {
@@ -304,7 +278,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         let author_short = author
             .split(':')
             .next_back()
-            .map(|s| crate::text::truncate(s, 8))
+            .map(|s| &s[..s.len().min(8)])
             .unwrap_or("?");
         let status_icon = match status {
             "open" => "○",
@@ -324,13 +298,12 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let pr = crate::http::read_json(
-        client
-            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
-            .await?,
-        "pull request",
-    )
-    .await?;
+    let pr: Value = client
+        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
     let title = pr["title"].as_str().unwrap_or("?");
     let status = pr["status"].as_str().unwrap_or("?");
@@ -348,25 +321,15 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     }
 
     // Show reviews
-    // A denied sub-fetch degrades this section rather than aborting: the header
-    // above has already printed, so a bare `?` here leaves a half-rendered PR and
-    // skips the comments below it. Mirrors `gl status`'s unavailable-section line.
-    let reviews = match crate::http::read_json(
-        client
-            .get(&format!(
-                "/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
-            ))
-            .await?,
-        "reviews",
-    )
-    .await
-    {
-        Ok(v) => v["reviews"].as_array().cloned().unwrap_or_default(),
-        Err(e) => {
-            println!("\nReviews unavailable ({e})");
-            Vec::new()
-        }
-    };
+    let reviews: Value = client
+        .get(&format!(
+            "/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
+        ))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
+    let reviews = reviews["reviews"].as_array().cloned().unwrap_or_default();
     if !reviews.is_empty() {
         println!("\nReviews ({}):", reviews.len());
         for r in &reviews {
@@ -374,7 +337,7 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
             let reviewer_short = reviewer
                 .split(':')
                 .next_back()
-                .map(|s| crate::text::truncate(s, 8))
+                .map(|s| &s[..s.len().min(8)])
                 .unwrap_or("?");
             let rstatus = r["status"].as_str().unwrap_or("?");
             let rbody = r["body"].as_str().unwrap_or("");
@@ -391,22 +354,15 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     }
 
     // Show comments
-    let comments = match crate::http::read_json(
-        client
-            .get(&format!(
-                "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
-            ))
-            .await?,
-        "comments",
-    )
-    .await
-    {
-        Ok(v) => v["comments"].as_array().cloned().unwrap_or_default(),
-        Err(e) => {
-            println!("\nComments unavailable ({e})");
-            Vec::new()
-        }
-    };
+    let comments: Value = client
+        .get(&format!(
+            "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
+        ))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
+    let comments = comments["comments"].as_array().cloned().unwrap_or_default();
     if !comments.is_empty() {
         println!("\nComments ({}):", comments.len());
         for c in &comments {
@@ -414,13 +370,10 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
             let author_short = author
                 .split(':')
                 .next_back()
-                .map(|s| crate::text::truncate(s, 8))
+                .map(|s| &s[..s.len().min(8)])
                 .unwrap_or("?");
             let cbody = c["body"].as_str().unwrap_or("");
-            let created = c["created_at"]
-                .as_str()
-                .map(|s| crate::text::truncate(s, 10))
-                .unwrap_or("?");
+            let created = c["created_at"].as_str().map(|s| &s[..10]).unwrap_or("?");
             println!("  · {author_short} ({created})");
             println!("    {cbody}");
         }
@@ -433,13 +386,12 @@ async fn cmd_diff(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp = crate::http::read_json(
-        client
-            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
-            .await?,
-        "diff",
-    )
-    .await?;
+    let resp: Value = client
+        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
     let diff = resp["diff"].as_str().unwrap_or("");
     if diff.is_empty() {
@@ -463,11 +415,17 @@ async fn cmd_merge(repo: String, number: u64, node: String, dir: Option<PathBuf>
         )
         .await
         .context("failed to connect to node")?;
-    let result = crate::http::read_json(resp, "merge").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("merge failed ({status}): {msg}");
+    }
 
     let sha = result["merge_sha"].as_str().unwrap_or("?");
     println!("✓ Merged PR #{number}");
-    println!("  Merge commit: {}", crate::text::truncate(sha, 12));
+    println!("  Merge commit: {}", &sha[..sha.len().min(12)]);
     Ok(())
 }
 
@@ -495,7 +453,13 @@ async fn cmd_review(
         )
         .await
         .context("failed to connect to node")?;
-    let _ = crate::http::read_json(resp, "review").await?;
+    let code = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !code.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("review failed ({code}): {msg}");
+    }
 
     let icon = match status.as_str() {
         "approved" => "✓",
@@ -525,7 +489,13 @@ async fn cmd_comment(
         )
         .await
         .context("failed to connect to node")?;
-    let _ = crate::http::read_json(resp, "comment").await?;
+    let code = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !code.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("comment failed ({code}): {msg}");
+    }
 
     println!("· Comment posted on PR #{number}");
     Ok(())
@@ -536,15 +506,14 @@ async fn cmd_comments(repo: String, number: u64, node: String, dir: Option<PathB
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp = crate::http::read_json(
-        client
-            .get(&format!(
-                "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
-            ))
-            .await?,
-        "comments",
-    )
-    .await?;
+    let resp: Value = client
+        .get(&format!(
+            "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
+        ))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
     let comments = resp["comments"].as_array().cloned().unwrap_or_default();
     if comments.is_empty() {
@@ -558,13 +527,10 @@ async fn cmd_comments(repo: String, number: u64, node: String, dir: Option<PathB
         let author_short = author
             .split(':')
             .next_back()
-            .map(|s| crate::text::truncate(s, 8))
+            .map(|s| &s[..s.len().min(8)])
             .unwrap_or("?");
         let cbody = c["body"].as_str().unwrap_or("");
-        let created = c["created_at"]
-            .as_str()
-            .map(|s| crate::text::truncate(s, 10))
-            .unwrap_or("?");
+        let created = c["created_at"].as_str().map(|s| &s[..10]).unwrap_or("?");
         println!("  · {author_short} ({created})");
         println!("    {cbody}");
         println!();
@@ -688,7 +654,6 @@ mod tests {
             .with_status(422)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"branch not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -706,8 +671,6 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("branch not found"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -805,7 +768,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"PR not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -819,8 +781,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("PR not found"), "got: {err}");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -905,250 +865,4 @@ mod tests {
         .await
         .unwrap();
     }
-
-    // ── Gated PR reads surface node denials, not empty/stub renders (#123) ──
-
-    #[tokio::test]
-    async fn cmd_list_surfaces_denial_not_empty() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/pulls$".to_string()))
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_list(
-            "myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "cmd_list must Err on 404, not print 'No pull requests'"
-        );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_view_surfaces_denial_not_stub() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        // The PR fetch is first; a 404 there errors before the reviews/comments reads.
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_view(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "cmd_view must Err on 404, not print a stub PR"
-        );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_diff_surfaces_denial_not_empty() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/diff$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_diff(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(
-            result.is_err(),
-            "cmd_diff must Err on 404, not print 'No diff'"
-        );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_comments_surfaces_denial_not_empty() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_comments(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(result.is_err(), "cmd_comments must Err on a gated 404");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    /// A denied sub-fetch must not abort `gl pr view` after the header has
-    /// already printed. The header is fatal; reviews and comments degrade.
-    #[tokio::test]
-    async fn cmd_view_continues_when_reviews_are_denied() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _pr = server
-            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _reviews = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
-            )
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"forbidden"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        // The load-bearing assertion: this mock is only hit if rendering
-        // continued past the denied reviews fetch.
-        let _comments = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"comments":[]}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let r = cmd_view(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(
-            r.is_ok(),
-            "cmd_view must finish rendering when reviews are denied"
-        );
-        _comments.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_view_continues_when_comments_are_denied() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _pr = server
-            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _reviews = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"reviews":[]}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let _comments = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
-            )
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"forbidden"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let r = cmd_view(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(
-            r.is_ok(),
-            "cmd_view must finish rendering when comments are denied"
-        );
-        _comments.assert_async().await;
-    }
-
-    /// The must-not case: with no header there is nothing to render partially,
-    /// so a denied header stays fatal. Softening it would resurrect
-    /// denial-as-success for the whole command.
-    #[tokio::test]
-    async fn cmd_view_header_denial_stays_fatal() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _pr = server
-            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let r = cmd_view(
-            "myrepo".to_string(),
-            1,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await;
-        assert!(r.is_err(), "a denied PR header must stay fatal");
-        _pr.assert_async().await;
-    }
 }

crates/gl/src/profile.rs

@@ -1,6 +1,6 @@
 //! `gl profile` — manage your agent profile (display name, bio, avatar, socials).
 //!
-//! Profile metadata is stored on the Twigpine node and optionally pinned to IPFS
+//! Profile metadata is stored on the gitlawb node and optionally pinned to IPFS
 //! for decentralized resolution. All writes are signed with your DID key.
 
 use anyhow::{Context, Result};
@@ -59,11 +59,7 @@ pub enum ProfileCmd {
         pin: bool,
 
         /// Node URL
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
 
         /// Identity directory
@@ -74,11 +70,7 @@ pub enum ProfileCmd {
     /// Show your own profile
     Show {
         /// Node URL
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
 
         /// Identity directory
@@ -92,11 +84,7 @@ pub enum ProfileCmd {
         did: String,
 
         /// Node URL
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
 
@@ -110,11 +98,7 @@ pub enum ProfileCmd {
         pin: bool,
 
         /// Node URL
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
 
         /// Identity directory
@@ -125,11 +109,7 @@ pub enum ProfileCmd {
     /// Export your profile as JSON
     Export {
         /// Node URL
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
 
         /// Identity directory

crates/gl/src/protect.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -22,11 +23,7 @@ pub enum ProtectCmd {
         /// Repository name or owner/repo
         #[arg(long)]
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -37,11 +34,7 @@ pub enum ProtectCmd {
         branch: String,
         #[arg(long)]
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -50,11 +43,7 @@ pub enum ProtectCmd {
     List {
         #[arg(long)]
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -93,7 +82,12 @@ async fn resolve_owner_repo(
         did.split(':').next_back().unwrap_or(&did).to_string()
     } else {
         let client = NodeClient::new(node, None);
-        let info = crate::http::read_json(client.get("/").await?, "node info").await?;
+        let info: Value = client
+            .get("/")
+            .await?
+            .json()
+            .await
+            .context("failed to fetch node info")?;
         let did = info["did"].as_str().context("node missing DID")?;
         did.split(':').next_back().unwrap_or(did).to_string()
     };
@@ -114,7 +108,13 @@ async fn cmd_set(branch: String, repo: String, node: String, dir: Option<PathBuf
         .await
         .context("failed to connect to node")?;
 
-    let _ = crate::http::read_json(resp, "protect").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("protect failed ({status}): {msg}");
+    }
 
     println!("✓ Branch '{branch}' is now protected in {owner}/{name}");
     println!("  Only the repo owner can push to this branch.");
@@ -140,7 +140,13 @@ async fn cmd_remove(
         .await
         .context("failed to connect to node")?;
 
-    let _ = crate::http::read_json(resp, "unprotect").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("unprotect failed ({status}): {msg}");
+    }
 
     println!("✓ Branch '{branch}' is no longer protected in {owner}/{name}");
     Ok(())
@@ -157,7 +163,13 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "list protected branches").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("list protected branches failed ({status}): {msg}");
+    }
 
     let branches = body["protected_branches"]
         .as_array()
@@ -235,7 +247,6 @@ mod tests {
             .with_status(400)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"only the repo owner can protect branches"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -248,8 +259,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("protect failed"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -361,26 +370,4 @@ mod tests {
         assert_eq!(owner, "alice");
         assert_eq!(name, "myrepo");
     }
-
-    #[tokio::test]
-    async fn resolve_owner_repo_surfaces_denial() {
-        // A slash-free repo with an empty identity dir forces the GET / node-info
-        // fetch. A gated 404 there must Err (surfacing the status), proving the
-        // read_json conversion is load-bearing rather than silently ignored.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
-        let _m = server
-            .mock("GET", "/")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/quickstart.rs

@@ -15,7 +15,7 @@ use std::path::PathBuf;
 use crate::http::NodeClient;
 use crate::identity::load_keypair_from_dir;
 
-const PUBLIC_NODE: &str = "https://node.twigpine.com";
+const PUBLIC_NODE: &str = "https://node.gitlawb.com";
 
 #[derive(Args)]
 pub struct QuickstartArgs {

crates/gl/src/register.rs

@@ -1,11 +1,11 @@
-//! `gl register` — register this agent identity with a Twigpine node.
+//! `gl register` — register this agent identity with a gitlawb node.
 //!
 //! Sends a signed POST /api/register request and saves the returned bootstrap
 //! UCAN token to `~/.gitlawb/ucan.json` for use by other commands.
 
 use anyhow::{Context, Result};
 use clap::Args;
-use serde_json::json;
+use serde_json::{json, Value};
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -14,11 +14,7 @@ use crate::identity::load_keypair_from_dir;
 #[derive(Args)]
 pub struct RegisterArgs {
     /// Node URL to register with
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
 
     /// Capabilities to advertise (comma-separated)
@@ -59,7 +55,16 @@ pub async fn run(args: RegisterArgs) -> Result<()> {
         .await
         .context("failed to connect to node")?;
 
-    let payload = crate::http::read_json(resp, "registration").await?;
+    let status = resp.status();
+    let payload: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = payload
+            .get("message")
+            .and_then(|v| v.as_str())
+            .unwrap_or("unknown error");
+        anyhow::bail!("registration failed ({status}): {msg}");
+    }
 
     // Save bootstrap UCAN
     let ucan = payload.get("ucan").and_then(|v| v.as_str()).unwrap_or("");
@@ -95,7 +100,7 @@ pub async fn run(args: RegisterArgs) -> Result<()> {
     println!("  UCAN expires: {expires}");
     println!();
     println!("  Bootstrap UCAN saved to ~/.gitlawb/ucan.json");
-    println!("  You are now a verified agent on the Twigpine network.");
+    println!("  You are now a verified agent on the gitlawb network.");
 
     Ok(())
 }
@@ -166,7 +171,6 @@ mod tests {
             .with_status(401)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"invalid signature"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -183,8 +187,6 @@ mod tests {
             .unwrap_err()
             .to_string()
             .contains("invalid signature"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]

crates/gl/src/repo.rs

@@ -25,22 +25,14 @@ pub enum RepoCmd {
         private: bool,
         #[arg(long, default_value = "main")]
         branch: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
     },
     /// List repositories on a node
     List {
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -48,11 +40,7 @@ pub enum RepoCmd {
     /// Print the gitlawb:// clone command for a repo
     Clone {
         name: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -60,11 +48,7 @@ pub enum RepoCmd {
     /// Show repository metadata
     Info {
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -79,11 +63,7 @@ pub enum RepoCmd {
         /// Max number of commits to show
         #[arg(long, short, default_value = "20")]
         limit: u32,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -95,11 +75,7 @@ pub enum RepoCmd {
         /// New name for the fork (defaults to source repo name)
         #[arg(long, short)]
         name: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -108,11 +84,7 @@ pub enum RepoCmd {
     LabelAdd {
         repo: String,
         label: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -121,11 +93,7 @@ pub enum RepoCmd {
     LabelRemove {
         repo: String,
         label: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -133,11 +101,7 @@ pub enum RepoCmd {
     /// List labels on a repository
     LabelList {
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -146,11 +110,7 @@ pub enum RepoCmd {
     Owner {
         /// Repository name or owner/repo
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -166,11 +126,7 @@ pub enum RepoCmd {
         #[arg(long)]
         url: String,
         /// URL of the origin node (where the repo lives)
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -179,11 +135,7 @@ pub enum RepoCmd {
     ReplicaUnregister {
         /// Repository in owner/repo format
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -192,11 +144,7 @@ pub enum RepoCmd {
     Replicas {
         /// Repository in owner/repo format
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -303,7 +251,13 @@ async fn cmd_create(
         .post("/api/v1/repos", &body)
         .await
         .context("failed to connect to node")?;
-    let payload = crate::http::read_json(resp, "create").await?;
+    let status = resp.status();
+    let payload: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = payload["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("create failed ({status}): {msg}");
+    }
 
     let clone_url = payload["clone_url"].as_str().unwrap_or("");
     let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
@@ -311,7 +265,7 @@ async fn cmd_create(
     println!("✓ Created repository: {name}");
     println!("  Clone: git clone {gitlawb_url}");
     println!("  HTTP:  {clone_url}");
-    println!("  View:  https://twigpine.com/{owner_short}/{name}");
+    println!("  View:  https://gitlawb.com/{owner_short}/{name}");
     if let Some(desc) = payload["description"].as_str().filter(|s| !s.is_empty()) {
         println!("  Desc:  {desc}");
     }
@@ -323,7 +277,12 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
     let client = NodeClient::new(&node, None);
 
     let url = format!("/api/v1/repos?owner={owner}");
-    let repos = crate::http::read_json(client.get(&url).await?, "list repos").await?;
+    let repos: Value = client
+        .get(&url)
+        .await?
+        .json()
+        .await
+        .context("failed to list repos")?;
     let repos = repos.as_array().context("expected array")?;
 
     if repos.is_empty() {
@@ -337,10 +296,7 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
         let name = r["name"].as_str().unwrap_or("?");
         let desc = r["description"].as_str().unwrap_or("");
         let public = r["is_public"].as_bool().unwrap_or(true);
-        let updated = r["updated_at"]
-            .as_str()
-            .map(|s| crate::text::truncate(s, 10))
-            .unwrap_or("?");
+        let updated = r["updated_at"].as_str().map(|s| &s[..10]).unwrap_or("?");
         let vis = if public { "public" } else { "private" };
         println!("  {name:<24}  {vis:<8}  {updated}  {desc}");
     }
@@ -395,13 +351,20 @@ async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
     // A non-existent (or unreadable/quarantined) repo is a real 404 from the
     // node — surface it plainly instead of printing a stub card with `?` fields
     // and a placeholder owner DID.
-    if resp.status().as_u16() == 404 {
-        anyhow::bail!("repository '{owner}/{name}' not found");
+    if !resp.status().is_success() {
+        if resp.status().as_u16() == 404 {
+            anyhow::bail!("repository '{owner}/{name}' not found");
+        }
+        let status = resp.status();
+        let msg = resp
+            .json::<Value>()
+            .await
+            .ok()
+            .and_then(|v| v["message"].as_str().map(String::from))
+            .unwrap_or_else(|| "request failed".to_string());
+        anyhow::bail!("repo info failed ({status}): {msg}");
     }
-    // Every other status routes through read_json: a 2xx yields the parsed body,
-    // any other non-2xx yields the node's capped + sanitized message, and
-    // the error read is bounded rather than buffering the whole hostile body.
-    let r = crate::http::read_json(resp, "repo info").await?;
+    let r: Value = resp.json().await.context("parse repo info")?;
 
     let owner_did = r["owner_did"].as_str().unwrap_or(&owner);
     let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
@@ -460,7 +423,12 @@ async fn cmd_replica_register(
         .await
         .context("failed to connect to origin node")?;
 
-    let body = crate::http::read_json(resp, "replica register").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("replica register failed ({status}): {msg}");
+    }
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("Registered as replica of {owner}/{name}");
@@ -487,7 +455,12 @@ async fn cmd_replica_unregister(repo: String, node: String, dir: Option<PathBuf>
         .await
         .context("failed to connect to origin node")?;
 
-    let body = crate::http::read_json(resp, "replica unregister").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("replica unregister failed ({status}): {msg}");
+    }
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("Unregistered as replica of {owner}/{name}  ({count} replicas remaining)");
@@ -507,7 +480,12 @@ async fn cmd_replicas(repo: String, node: String, dir: Option<PathBuf>) -> Resul
         .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/replicas"))
         .await
         .context("failed to connect to node")?;
-    let body = crate::http::read_json(resp, "replicas list").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("replicas list failed ({status}): {msg}");
+    }
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("{owner}/{name}: {count} replicas");
@@ -517,7 +495,7 @@ async fn cmd_replicas(repo: String, node: String, dir: Option<PathBuf>) -> Resul
             let url = r["replica_url"].as_str().unwrap_or("?");
             let registered = r["registered_at"]
                 .as_str()
-                .map(|s| crate::text::truncate(s, 10))
+                .map(|s| &s[..10.min(s.len())])
                 .unwrap_or("?");
             println!("  {registered}  {did}  →  {url}");
         }
@@ -543,7 +521,12 @@ pub(crate) async fn cmd_commits(
     };
 
     let url = format!("/api/v1/repos/{owner}/{name}/commits?branch={branch}&limit={limit}");
-    let resp = crate::http::read_json(client.get(&url).await?, "commits").await?;
+    let resp: Value = client
+        .get(&url)
+        .await?
+        .json()
+        .await
+        .context("failed to fetch commits")?;
 
     let commits = resp["commits"].as_array().cloned().unwrap_or_default();
     if commits.is_empty() {
@@ -559,7 +542,7 @@ pub(crate) async fn cmd_commits(
             .or_else(|| c["sha"].as_str())
             .or_else(|| c["oid"].as_str())
             .unwrap_or("?");
-        let short_sha = crate::text::truncate(sha, 10);
+        let short_sha = &sha[..sha.len().min(10)];
         let msg = c["message"].as_str().unwrap_or("(no message)");
         let first_line = msg.lines().next().unwrap_or(msg);
         let author = c["author_name"]
@@ -569,7 +552,7 @@ pub(crate) async fn cmd_commits(
         let date = c["date"]
             .as_str()
             .or_else(|| c["committer_date"].as_str())
-            .map(|s| crate::text::truncate(s, 10))
+            .map(|s| &s[..10.min(s.len())])
             .unwrap_or("?");
         println!("  {short_sha}  {date}  {first_line}  ({author})");
     }
@@ -596,7 +579,13 @@ async fn cmd_fork(
         .post(&format!("/api/v1/repos/{owner}/{repo_name}/fork"), &body)
         .await
         .context("failed to connect to node")?;
-    let result = crate::http::read_json(resp, "fork").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON response")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("fork failed ({status}): {msg}");
+    }
 
     let fork_name = result["name"].as_str().unwrap_or(&repo_name);
     let owner_did = result["owner_did"].as_str().unwrap_or("?");
@@ -634,7 +623,13 @@ async fn cmd_label_add(
         .post(&format!("/api/v1/repos/{owner}/{name}/labels"), &body)
         .await
         .context("failed to connect to node")?;
-    let result = crate::http::read_json(resp, "add label").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("add label failed ({status}): {msg}");
+    }
 
     let added = result["added"].as_bool().unwrap_or(true);
     if added {
@@ -659,7 +654,13 @@ async fn cmd_label_remove(
         .delete(&format!("/api/v1/repos/{owner}/{name}/labels/{label}"), &[])
         .await
         .context("failed to connect to node")?;
-    let _ = crate::http::read_json(resp, "remove label").await?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("remove label failed ({status}): {msg}");
+    }
 
     println!("- Label removed: {label} from {owner}/{name}");
     Ok(())
@@ -672,21 +673,18 @@ async fn cmd_label_list(repo: String, node: String, dir: Option<PathBuf>) -> Res
     // read their own labels, while public repos stay anonymously listable.
     let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
 
-    // Marry both refactors: main's get_maybe_signed (read-visibility gating —
-    // public repos stay anon-listable, private-repo owner signs) carrying the
-    // PR's read_json status-check-before-parse (#186: bounded error read, no
-    // parse-before-status). get_authed from the PR is dropped in favor of
-    // get_maybe_signed so the visibility gate is preserved.
-    let resp = crate::http::read_json(
-        client
-            .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
-            .await
-            .context("failed to connect to node")?,
-        "list labels",
-    )
-    .await?;
+    let resp = client
+        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
+        .await
+        .context("failed to connect to node")?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("list labels failed ({status}): {msg}");
+    }
 
-    let labels = resp["labels"].as_array().cloned().unwrap_or_default();
+    let labels = body["labels"].as_array().cloned().unwrap_or_default();
     if labels.is_empty() {
         println!("No labels on {owner}/{name}");
     } else {
@@ -859,7 +857,6 @@ mod tests {
             .with_status(409)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repository already exists"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -875,8 +872,6 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("already exists"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -945,33 +940,6 @@ mod tests {
         _m.assert_async().await;
     }
 
-    #[tokio::test]
-    async fn cmd_list_repos_surfaces_denial() {
-        // A node error must Err with the status, not trip the vague "expected
-        // array" fallback that hides the node's actual response.
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos\?owner=".to_string()),
-            )
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_list(server.url(), Some(dir.path().to_path_buf()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("500"), "got: {err}");
-        _m.assert_async().await;
-    }
-
     #[tokio::test]
     async fn test_cmd_commits_empty() {
         let dir = TempDir::new().unwrap();
@@ -1071,7 +1039,6 @@ mod tests {
             .with_status(400)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"you already have a repo named myrepo"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -1087,8 +1054,6 @@ mod tests {
             err.to_string().contains("already have a repo"),
             "got: {err}"
         );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -1461,7 +1426,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -1474,106 +1438,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("not found"), "got: {err}");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _repo.assert_async().await;
-    }
-
-    // ── Gated CLI reads surface node denials, not empty renders (#123) ──
-
-    #[tokio::test]
-    async fn cmd_commits_surfaces_denial_not_empty() {
-        // A gated 404 must Err, not print "No commits" as if the repo were empty.
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/commits".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_commits(
-            "alice/secret".to_string(),
-            "main".to_string(),
-            20,
-            server.url(),
-            None,
-        )
-        .await;
-        assert!(result.is_err(), "cmd_commits must Err on 404");
-        assert!(result.unwrap_err().to_string().contains("not found"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn cmd_label_list_surfaces_denial_not_empty() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/labels".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let result = cmd_label_list("alice/secret".to_string(), server.url(), None).await;
-        assert!(result.is_err(), "cmd_label_list must Err on 404");
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
-        _m.assert_async().await;
-    }
-
-    // cmd_info keeps its bespoke 404 message ahead of read_json...
-    #[tokio::test]
-    async fn cmd_info_404_keeps_bespoke_message() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/api/v1/repos/alice/secret")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"gone"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = cmd_info("alice/secret".to_string(), server.url(), None)
-            .await
-            .unwrap_err()
-            .to_string();
-        assert!(
-            err.contains("repository 'alice/secret' not found"),
-            "bespoke 404 text lost: {err}"
-        );
-        _m.assert_async().await;
-    }
-
-    // ...and every other non-2xx routes through read_json (capped + sanitized).
-    #[tokio::test]
-    async fn cmd_info_500_routes_through_read_json() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/api/v1/repos/alice/secret")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = cmd_info("alice/secret".to_string(), server.url(), None)
-            .await
-            .unwrap_err()
-            .to_string();
-        assert!(
-            err.contains("repo info failed"),
-            "read_json label lost: {err}"
-        );
-        assert!(err.contains("500"), "status not surfaced: {err}");
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -1772,7 +1636,7 @@ mod vet_merge_deny_arms {
     }
 
     // An authenticated caller DENIED with a 403 must surface an error, never
-    // render a repo card (deny-as-success is the client-contract break).
+    // render a repo card (deny-as-success is the INV-8 client-contract break).
     #[tokio::test]
     async fn cmd_info_403_denied_surfaces_error_not_card() {
         let dir = TempDir::new().unwrap();

crates/gl/src/star.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -19,11 +20,7 @@ pub enum StarCmd {
     Add {
         /// Repository name (owner/repo or just name — owner derived from identity)
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -32,11 +29,7 @@ pub enum StarCmd {
     Remove {
         /// Repository name (owner/repo or just name — owner derived from identity)
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -45,11 +38,7 @@ pub enum StarCmd {
     Count {
         /// Repository in owner/repo format
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -86,7 +75,13 @@ async fn cmd_add(repo: String, node: String, dir: Option<PathBuf>) -> Result<()>
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "star").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("star failed ({status}): {msg}");
+    }
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("Starred {owner}/{name}  ({count} stars total)");
@@ -104,7 +99,13 @@ async fn cmd_remove(repo: String, node: String, dir: Option<PathBuf>) -> Result<
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "unstar").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("unstar failed ({status}): {msg}");
+    }
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("Unstarred {owner}/{name}  ({count} stars remaining)");
@@ -123,7 +124,13 @@ async fn cmd_count(repo: String, node: String, dir: Option<PathBuf>) -> Result<(
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "star count").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("star count failed ({status}): {msg}");
+    }
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("{owner}/{name}: {count} stars");
@@ -223,7 +230,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -235,8 +241,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("star failed"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -283,7 +287,6 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
@@ -295,8 +298,6 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("unstar failed"));
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -334,51 +335,4 @@ mod tests {
         assert_eq!(owner, "alice");
         assert_eq!(name, "myrepo");
     }
-
-    // U15 (#186): a converted handler must inherit read_json's capped + sanitized
-    // error path end-to-end. A hostile 500 whose `message` carries terminal-control
-    // + bidi bytes and is long must reach the terminal neither verbatim nor unbounded.
-    #[tokio::test]
-    async fn cmd_add_hostile_error_is_sanitized_and_bounded() {
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        // ESC + a long run + a right-to-left override, all inside the node message
-        // (JSON \u escapes so the source has no raw control bytes).
-        let hostile = format!(r#"{{"message":"a\u001b[31m{}b\u202ec"}}"#, "Z".repeat(500));
-        let _m = server
-            .mock("PUT", mockito::Matcher::Regex(r"/star$".to_string()))
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(hostile)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_add(
-            "myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err()
-        .to_string();
-
-        assert!(
-            !err.contains('\u{1b}'),
-            "ESC leaked to the terminal: {err:?}"
-        );
-        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
-        // Bounded: sanitize_node_msg caps the surfaced message, so the 500-char run
-        // cannot flood the error string.
-        assert!(err.len() < 300, "error not bounded ({} bytes)", err.len());
-        assert!(err.contains("star failed"), "handler label lost: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/status.rs

@@ -10,11 +10,7 @@ use crate::identity::load_keypair_from_dir;
 
 #[derive(Args)]
 pub struct StatusArgs {
-    #[arg(
-        long,
-        default_value = "https://node.twigpine.com",
-        env = "GITLAWB_NODE"
-    )]
+    #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
     pub node: String,
     #[arg(long)]
     pub dir: Option<PathBuf>,
@@ -41,13 +37,21 @@ pub async fn run(args: StatusArgs) -> Result<()> {
     let client = NodeClient::new(&args.node, None);
     if let Some(ref did) = maybe_did {
         let short_key = did.split(':').next_back().unwrap_or(did);
-        let resp = client.get(&format!("/api/v1/agents/{short_key}")).await;
-        if let Some(line) = trust_line(resp).await {
-            println!("{line}");
+        match client.get(&format!("/api/v1/agents/{short_key}")).await {
+            Ok(resp) if resp.status().is_success() => {
+                if let Ok(body) = resp.json::<Value>().await {
+                    let score = body["trust_score"].as_f64().unwrap_or(0.0);
+                    let bar = trust_bar(score);
+                    println!("  trust     {score:.2}  {bar}");
+                }
+            }
+            _ => {
+                println!("  trust     — not registered (run `gl register`)");
+            }
         }
     }
 
-    // ── Current git repo + Twigpine remote ─────────────────────────────────
+    // ── Current git repo + gitlawb remote ─────────────────────────────────
     let remote = detect_gitlawb_remote();
     match &remote {
         Some((did, repo)) => {
@@ -55,7 +59,7 @@ pub async fn run(args: StatusArgs) -> Result<()> {
             println!("  repo      {short_did}/{repo}");
         }
         None => {
-            println!("  repo      (not in a Twigpine repo — no gitlawb:// remote)");
+            println!("  repo      (not in a gitlawb repo — no gitlawb:// remote)");
         }
     }
 
@@ -77,10 +81,8 @@ pub async fn run(args: StatusArgs) -> Result<()> {
         let pr_resp = client
             .get(&format!("/api/v1/repos/{short_owner}/{repo_name}/pulls"))
             .await;
-        if let Some(line) = section_unavailable_line("PRs", &pr_resp) {
-            println!("{line}");
-        } else if let Ok(r) = pr_resp {
-            if let Ok(body) = crate::http::read_json(r, "pull requests").await {
+        if let Ok(r) = pr_resp {
+            if let Ok(body) = r.json::<Value>().await {
                 let prs = body["pulls"].as_array().cloned().unwrap_or_default();
                 let open: Vec<_> = prs
                     .iter()
@@ -106,10 +108,8 @@ pub async fn run(args: StatusArgs) -> Result<()> {
         let issue_resp = client
             .get(&format!("/api/v1/repos/{short_owner}/{repo_name}/issues"))
             .await;
-        if let Some(line) = section_unavailable_line("issues", &issue_resp) {
-            println!("{line}");
-        } else if let Ok(r) = issue_resp {
-            if let Ok(body) = crate::http::read_json(r, "issues").await {
+        if let Ok(r) = issue_resp {
+            if let Ok(body) = r.json::<Value>().await {
                 let issues = body["issues"].as_array().cloned().unwrap_or_default();
                 let open: Vec<_> = issues
                     .iter()
@@ -136,40 +136,6 @@ pub async fn run(args: StatusArgs) -> Result<()> {
     Ok(())
 }
 
-/// The status line for a repo section (PRs / issues) whose gated read returned a
-/// non-2xx: the denial must surface, never render as "no open ...".
-/// Returns `None` for a success (the caller renders the body) or a transport error
-/// (the section degrades silently — R5 — so the multi-section `gl status` never
-/// hard-fails on one denied read).
-fn section_unavailable_line(label: &str, resp: &Result<reqwest::Response>) -> Option<String> {
-    match resp {
-        Ok(r) if !r.status().is_success() => {
-            Some(format!("  {label:<10}unavailable ({})", r.status()))
-        }
-        _ => None,
-    }
-}
-
-/// The `trust` status line for the caller's own identity. A genuine 404 means the
-/// identity is not registered; any OTHER non-2xx (403/429/5xx) is a failed lookup
-/// and must surface as unavailable rather than fabricating an unregistered state
-/// A transport error degrades silently — the node-unreachable line below
-/// already surfaces it — matching `section_unavailable_line`.
-async fn trust_line(resp: Result<reqwest::Response>) -> Option<String> {
-    match resp {
-        Ok(r) if r.status().is_success() => {
-            let body = r.json::<Value>().await.ok()?;
-            let score = body["trust_score"].as_f64().unwrap_or(0.0);
-            Some(format!("  trust     {score:.2}  {}", trust_bar(score)))
-        }
-        Ok(r) if r.status() == reqwest::StatusCode::NOT_FOUND => {
-            Some("  trust     — not registered (run `gl register`)".to_string())
-        }
-        Ok(r) => Some(format!("  trust     unavailable ({})", r.status())),
-        Err(_) => None,
-    }
-}
-
 /// Render a simple ASCII trust bar: 0.75 → "███░"
 fn trust_bar(score: f64) -> String {
     let filled = (score * 4.0).round() as usize;
@@ -410,125 +376,4 @@ mod tests {
     fn trust_bar_quarter() {
         assert_eq!(trust_bar(0.25), "█░░░");
     }
-
-    // ── gl status section denial surfacing (#123, R5) ────────────────────
-
-    async fn get_response(
-        server: &mut mockito::Server,
-        status: usize,
-    ) -> Result<reqwest::Response> {
-        let _m = server
-            .mock("GET", "/x")
-            .with_status(status)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"pulls":[]}"#)
-            .create_async()
-            .await;
-        NodeClient::new(server.url(), None).get("/x").await
-    }
-
-    #[tokio::test]
-    async fn gated_section_surfaces_unavailable_not_empty() {
-        // A gated 404 on a status section must surface "unavailable", never be
-        // treated as "no open PRs".
-        let mut server = mockito::Server::new_async().await;
-        let resp = get_response(&mut server, 404).await;
-        assert_eq!(
-            section_unavailable_line("PRs", &resp),
-            Some(format!("  {:<10}unavailable (404 Not Found)", "PRs"))
-        );
-    }
-
-    #[tokio::test]
-    async fn success_section_returns_none_for_body_render() {
-        // A 2xx returns None so the caller renders the body as before.
-        let mut server = mockito::Server::new_async().await;
-        let resp = get_response(&mut server, 200).await;
-        assert!(section_unavailable_line("issues", &resp).is_none());
-    }
-
-    #[test]
-    fn transport_error_degrades_silently() {
-        // A transport error (not a status) must NOT surface — the section
-        // degrades silently so gl status never hard-fails on one bad read (R5).
-        let err: Result<reqwest::Response> = Err(anyhow::anyhow!("connection refused"));
-        assert!(section_unavailable_line("PRs", &err).is_none());
-    }
-
-    // ── trust_line: a 404 means unregistered; any OTHER failure must surface as
-    //    unavailable, never fabricate an unregistered verdict. ───────────────
-    async fn agents_resp(
-        server: &mut mockito::Server,
-        status: usize,
-        body: &str,
-    ) -> Result<reqwest::Response> {
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/agents/".to_string()),
-            )
-            .with_status(status)
-            .with_header("content-type", "application/json")
-            .with_body(body)
-            .create_async()
-            .await;
-        NodeClient::new(server.url(), None)
-            .get("/api/v1/agents/zTest")
-            .await
-    }
-
-    #[tokio::test]
-    async fn trust_line_registered_shows_score_only() {
-        let mut s = mockito::Server::new_async().await;
-        let line = trust_line(agents_resp(&mut s, 200, r#"{"trust_score":0.5}"#).await)
-            .await
-            .unwrap();
-        assert!(line.contains("0.50"), "line={line}");
-        assert!(!line.contains("not registered"), "line={line}");
-        assert!(!line.contains("unavailable"), "line={line}");
-    }
-
-    #[tokio::test]
-    async fn trust_line_404_is_not_registered() {
-        let mut s = mockito::Server::new_async().await;
-        let line = trust_line(agents_resp(&mut s, 404, r#"{"message":"agent not found"}"#).await)
-            .await
-            .unwrap();
-        assert!(line.contains("not registered"), "line={line}");
-        assert!(!line.contains("unavailable"), "line={line}");
-    }
-
-    // Load-bearing: a 403 for an existing identity is a denied lookup, not proof it is unregistered.
-    #[tokio::test]
-    async fn trust_line_403_is_unavailable_not_registered() {
-        let mut s = mockito::Server::new_async().await;
-        let line = trust_line(agents_resp(&mut s, 403, r#"{"message":"forbidden"}"#).await)
-            .await
-            .unwrap();
-        assert!(
-            line.contains("unavailable") && line.contains("403"),
-            "line={line}"
-        );
-        assert!(!line.contains("not registered"), "line={line}");
-    }
-
-    // Load-bearing: a 5xx is a failed lookup, not an unregistered verdict.
-    #[tokio::test]
-    async fn trust_line_500_is_unavailable_not_registered() {
-        let mut s = mockito::Server::new_async().await;
-        let line = trust_line(agents_resp(&mut s, 500, r#"{"message":"boom"}"#).await)
-            .await
-            .unwrap();
-        assert!(line.contains("unavailable"), "line={line}");
-        assert!(!line.contains("not registered"), "line={line}");
-    }
-
-    // Load-bearing: a transport error degrades silently, never fabricates unregistered.
-    #[tokio::test]
-    async fn trust_line_transport_error_is_silent() {
-        let resp = NodeClient::new("http://127.0.0.1:1", None)
-            .get("/api/v1/agents/zTest")
-            .await;
-        assert!(trust_line(resp).await.is_none());
-    }
 }

crates/gl/src/sync.rs

@@ -11,11 +11,7 @@ pub struct SyncArgs {
     pub cmd: SyncCmd,
 
     /// Node URL
-    #[arg(
-        long,
-        env = "GITLAWB_NODE",
-        default_value = "https://node.twigpine.com"
-    )]
+    #[arg(long, env = "GITLAWB_NODE", default_value = "https://node.gitlawb.com")]
     pub node: String,
 
     /// Identity directory for signed sync trigger requests
@@ -75,9 +71,8 @@ pub async fn run(args: SyncArgs) -> Result<()> {
         SyncCmd::Status => {
             let client = NodeClient::new(&args.node, None);
             // Just show peer list and node stats for now
-            let stats =
-                crate::http::read_json(client.get("/api/v1/stats").await?, "node stats").await?;
-            let peers = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
+            let stats: serde_json::Value = client.get("/api/v1/stats").await?.json().await?;
+            let peers: serde_json::Value = client.get("/api/v1/peers").await?.json().await?;
             println!("Node stats:");
             println!("  repos:  {}", stats["repos"].as_i64().unwrap_or(0));
             println!("  agents: {}", stats["agents"].as_i64().unwrap_or(0));
@@ -163,7 +158,6 @@ mod tests {
             // Valid JSON: the parse-without-status-check bug deserializes this
             // into a zero-count success struct and prints "✓ sync triggered".
             .with_body(r#"{"message":"unauthorized"}"#)
-            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -172,8 +166,6 @@ mod tests {
             err.to_string().contains("401"),
             "expected 401 surfaced, got: {err}"
         );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -184,7 +176,6 @@ mod tests {
             .with_status(429)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"slow down"}"#)
-            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -193,8 +184,6 @@ mod tests {
             err.to_string().contains("429"),
             "expected 429 surfaced, got: {err}"
         );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -211,7 +200,6 @@ mod tests {
             // BEL (\u0007); serde decodes them to real control bytes a naive
             // client would print. (The status-check bug fake-successes here.)
             .with_body("{\"message\":\"pwned\\u001b[31m\\u0007bad\"}")
-            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -223,8 +211,6 @@ mod tests {
             s.contains("pwned") && s.contains("bad"),
             "message text dropped: {s:?}"
         );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -250,7 +236,6 @@ mod tests {
             .mock("POST", "/api/v1/sync/trigger")
             .with_status(401)
             .with_body("A".repeat(2_000_000))
-            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -262,8 +247,6 @@ mod tests {
             "error message not bounded: {} chars",
             s.len()
         );
-        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
-        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -294,71 +277,4 @@ mod tests {
             (0, 0)
         );
     }
-
-    #[tokio::test]
-    async fn status_surfaces_stats_denial_not_fake_zeros() {
-        // A node error on /stats must Err, not print "0 repos / 0 agents / 0 pushes".
-        let mut server = mockito::Server::new_async().await;
-        let stats = server
-            .mock("GET", "/api/v1/stats")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        // A peers mock so the pre-fix path reaches a clean success rather than a
-        // 501 on an unmocked route; after the fix the /stats denial bails first.
-        let _peers = server
-            .mock("GET", "/api/v1/peers")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"count":0,"peers":[]}"#)
-            .create_async()
-            .await;
-        let args = SyncArgs {
-            cmd: SyncCmd::Status,
-            node: server.url(),
-            dir: None,
-        };
-        let err = run(args).await.unwrap_err();
-        assert!(
-            err.to_string().contains("500"),
-            "expected 500 surfaced, got: {err}"
-        );
-        stats.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn status_surfaces_peers_denial() {
-        // /stats succeeds but /peers denies — the peers read must Err too, not
-        // print "Known peers: 0".
-        let mut server = mockito::Server::new_async().await;
-        let _stats = server
-            .mock("GET", "/api/v1/stats")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"repos":1,"agents":2,"pushes":3}"#)
-            .create_async()
-            .await;
-        let peers = server
-            .mock("GET", "/api/v1/peers")
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let args = SyncArgs {
-            cmd: SyncCmd::Status,
-            node: server.url(),
-            dir: None,
-        };
-        let err = run(args).await.unwrap_err();
-        assert!(
-            err.to_string().contains("500"),
-            "expected 500 surfaced, got: {err}"
-        );
-        peers.assert_async().await;
-    }
 }

crates/gl/src/task.rs

@@ -38,11 +38,7 @@ pub enum TaskCmd {
         /// ISO-8601 deadline for the task
         #[arg(long)]
         deadline: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -55,31 +51,19 @@ pub enum TaskCmd {
         assignee_did: Option<String>,
         #[arg(long, default_value = "50")]
         limit: i64,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
     /// View a specific task
     View {
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
     },
     /// Claim a pending task
     Claim {
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -89,11 +73,7 @@ pub enum TaskCmd {
         id: String,
         #[arg(long)]
         result: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -103,11 +83,7 @@ pub enum TaskCmd {
         id: String,
         #[arg(long)]
         reason: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -190,14 +166,13 @@ async fn cmd_create(
         "delegator_did": delegator_did,
     }))?;
 
-    let resp = crate::http::read_json(
-        client
-            .post("/api/v1/tasks", &body)
-            .await
-            .context("failed to create task")?,
-        "create task",
-    )
-    .await?;
+    let resp: Value = client
+        .post("/api/v1/tasks", &body)
+        .await
+        .context("failed to create task")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
@@ -216,25 +191,26 @@ async fn cmd_list(
     if let Some(a) = &assignee_did {
         path.push_str(&format!("&assignee_did={}", urlencoding::encode(a)));
     }
-    let resp = crate::http::read_json(
-        client.get(&path).await.context("failed to list tasks")?,
-        "list tasks",
-    )
-    .await?;
+    let resp: Value = client
+        .get(&path)
+        .await
+        .context("failed to list tasks")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
 
 async fn cmd_view(id: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    let resp = crate::http::read_json(
-        client
-            .get(&format!("/api/v1/tasks/{}", id))
-            .await
-            .context("failed to get task")?,
-        "view task",
-    )
-    .await?;
+    let resp: Value = client
+        .get(&format!("/api/v1/tasks/{}", id))
+        .await
+        .context("failed to get task")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
@@ -245,14 +221,13 @@ async fn cmd_claim(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "assignee_did": assignee_did }))?;
-    let resp = crate::http::read_json(
-        client
-            .post(&format!("/api/v1/tasks/{}/claim", id), &body)
-            .await
-            .context("failed to claim task")?,
-        "claim task",
-    )
-    .await?;
+    let resp: Value = client
+        .post(&format!("/api/v1/tasks/{}/claim", id), &body)
+        .await
+        .context("failed to claim task")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
@@ -268,14 +243,13 @@ async fn cmd_complete(
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "result": result, "by_did": by_did }))?;
-    let resp = crate::http::read_json(
-        client
-            .post(&format!("/api/v1/tasks/{}/complete", id), &body)
-            .await
-            .context("failed to complete task")?,
-        "complete task",
-    )
-    .await?;
+    let resp: Value = client
+        .post(&format!("/api/v1/tasks/{}/complete", id), &body)
+        .await
+        .context("failed to complete task")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
@@ -291,14 +265,13 @@ async fn cmd_fail(
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "reason": reason, "by_did": by_did }))?;
-    let resp = crate::http::read_json(
-        client
-            .post(&format!("/api/v1/tasks/{}/fail", id), &body)
-            .await
-            .context("failed to fail task")?,
-        "fail task",
-    )
-    .await?;
+    let resp: Value = client
+        .post(&format!("/api/v1/tasks/{}/fail", id), &body)
+        .await
+        .context("failed to fail task")?
+        .json()
+        .await
+        .context("invalid JSON response")?;
     print_json(&resp);
     Ok(())
 }
@@ -382,12 +355,11 @@ mod tests {
             .with_status(500)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"internal error"}"#)
-            .expect(1)
             .create_async()
             .await;
 
-        // A node 5xx must surface as an Err, not be printed as if it were a task.
-        let err = cmd_create(
+        // Should still succeed (prints JSON, doesn't check status code)
+        cmd_create(
             "deploy".to_string(),
             "agent:task".to_string(),
             None,
@@ -399,9 +371,7 @@ mod tests {
             Some(dir.path().to_path_buf()),
         )
         .await
-        .unwrap_err();
-        assert!(err.to_string().contains("500"), "got: {err}");
-        _m.assert_async().await;
+        .unwrap();
     }
 
     // ── list ─────────────────────────────────────────────────────────
@@ -475,16 +445,11 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
             .create_async()
             .await;
 
-        // A 404 must surface as an Err, not be printed as if it were a task.
-        let err = cmd_view("nope".to_string(), server.url())
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
+        // cmd_view doesn't check status — it prints the JSON
+        cmd_view("nope".to_string(), server.url()).await.unwrap();
     }
 
     // ── claim ────────────────────────────────────────────────────────
@@ -636,122 +601,4 @@ mod tests {
         .await
         .unwrap();
     }
-
-    // ── denial surfaces: a node 4xx/5xx must Err, not render as success ──
-
-    #[tokio::test]
-    async fn test_list_tasks_surfaces_denial() {
-        let mut server = mockito::Server::new_async().await;
-
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/api/v1/tasks\?".to_string()),
-            )
-            .with_status(500)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"boom"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_list(None, None, 50, server.url()).await.unwrap_err();
-        assert!(err.to_string().contains("500"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_claim_task_surfaces_denial() {
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _m = server
-            .mock("POST", "/api/v1/tasks/task-x/claim")
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"forbidden"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_claim(
-            "task-x".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("403"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_complete_task_surfaces_denial() {
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _m = server
-            .mock("POST", "/api/v1/tasks/task-x/complete")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"not found"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_complete(
-            "task-x".to_string(),
-            None,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_fail_task_surfaces_denial() {
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _m = server
-            .mock("POST", "/api/v1/tasks/task-x/fail")
-            .with_status(409)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"already terminal"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let err = cmd_fail(
-            "task-x".to_string(),
-            None,
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("409"), "got: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/text.rs

@@ -1,63 +0,0 @@
-//! Display helpers for strings that come off the wire unchecked.
-
-/// Truncate `s` to at most `max` bytes, cutting at a char boundary.
-///
-/// `&s[..max]` panics when `s` is shorter than `max` bytes and when `max`
-/// lands inside a multi-byte char; `s.len().min(max)` guards only the first
-/// case. Node-supplied timestamps and ids hit both.
-pub(crate) fn truncate(s: &str, max: usize) -> &str {
-    let mut end = max.min(s.len());
-    while !s.is_char_boundary(end) {
-        end -= 1;
-    }
-    &s[..end]
-}
-
-/// Keep at most the last `max` bytes of `s`, cutting at a char boundary.
-///
-/// `&s[s.len().saturating_sub(max)..]` panics when the start index lands
-/// inside a multi-byte char; node-supplied ids hit that case.
-pub(crate) fn truncate_suffix(s: &str, max: usize) -> &str {
-    let mut start = s.len().saturating_sub(max);
-    while !s.is_char_boundary(start) {
-        start += 1;
-    }
-    &s[start..]
-}
-
-#[cfg(test)]
-mod tests {
-    use super::{truncate, truncate_suffix};
-
-    #[test]
-    fn cuts_ascii_at_max() {
-        assert_eq!(truncate("2026-08-15T12:34:56Z", 10), "2026-08-15");
-    }
-
-    #[test]
-    fn short_and_empty_inputs_return_whole() {
-        assert_eq!(truncate("2026", 10), "2026");
-        assert_eq!(truncate("", 10), "");
-    }
-
-    #[test]
-    fn multibyte_cut_does_not_panic() {
-        // Byte index 10 lands inside 'é'; the cut must land on the boundary
-        // before it (9 bytes) rather than panic or exceed the byte limit.
-        assert_eq!(truncate("2026-08-1\u{e9}5T12:34:56Z", 10), "2026-08-1");
-        // A string that is entirely multi-byte and shorter than max.
-        assert_eq!(truncate("\u{e9}\u{e9}", 10), "\u{e9}\u{e9}");
-    }
-
-    #[test]
-    fn suffix_cut_does_not_panic() {
-        // 'é' is two bytes; a start index of len-8 lands inside it.
-        assert_eq!(truncate_suffix("did:key:\u{e9}1234567", 8), "1234567");
-    }
-
-    #[test]
-    fn suffix_short_input_returns_whole() {
-        assert_eq!(truncate_suffix("short", 8), "short");
-        assert_eq!(truncate_suffix("", 8), "");
-    }
-}

crates/gl/src/visibility.rs

@@ -2,6 +2,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
+use serde_json::Value;
 use std::path::{Path, PathBuf};
 
 use crate::http::NodeClient;
@@ -27,11 +28,7 @@ pub enum VisibilityCmd {
         /// Replication mode: "a" (hide, whole-repo only) or "b" (lock content)
         #[arg(long, default_value = "b")]
         mode: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -41,11 +38,7 @@ pub enum VisibilityCmd {
         path_glob: String,
         #[arg(long)]
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -54,11 +47,7 @@ pub enum VisibilityCmd {
     List {
         #[arg(long)]
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -98,7 +87,12 @@ async fn resolve_owner_repo(
         did.split(':').next_back().unwrap_or(&did).to_string()
     } else {
         let client = NodeClient::new(node, None);
-        let info = crate::http::read_json(client.get("/").await?, "node info").await?;
+        let info: Value = client
+            .get("/")
+            .await?
+            .json()
+            .await
+            .context("failed to fetch node info")?;
         let did = info["did"].as_str().context("node missing DID")?;
         did.split(':').next_back().unwrap_or(did).to_string()
     };
@@ -129,7 +123,12 @@ async fn cmd_set(
         .await
         .context("failed to connect to node")?;
 
-    let _ = crate::http::read_json(resp, "visibility set").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("visibility set failed ({status}): {msg}");
+    }
 
     println!("✓ Visibility rule set on {owner}/{name}: {path_glob} (mode {mode})");
     if path_glob != "/" {
@@ -157,7 +156,12 @@ async fn cmd_remove(
         .await
         .context("failed to connect to node")?;
 
-    let _ = crate::http::read_json(resp, "visibility remove").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("visibility remove failed ({status}): {msg}");
+    }
 
     println!("✓ Visibility rule removed from {owner}/{name}: {path_glob}");
     Ok(())
@@ -175,7 +179,12 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         .await
         .context("failed to connect to node")?;
 
-    let body = crate::http::read_json(resp, "visibility list").await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.unwrap_or_default();
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("visibility list failed ({status}): {msg}");
+    }
 
     let rules = body["rules"].as_array().cloned().unwrap_or_default();
     if rules.is_empty() {
@@ -298,26 +307,4 @@ mod tests {
         .await
         .unwrap();
     }
-
-    #[tokio::test]
-    async fn resolve_owner_repo_surfaces_denial() {
-        // A slash-free repo with an empty identity dir forces the GET / node-info
-        // fetch. A gated 404 there must Err (surfacing the status), proving the
-        // read_json conversion is load-bearing rather than silently ignored.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
-        let _m = server
-            .mock("GET", "/")
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"denied"}"#)
-            .expect(1)
-            .create_async()
-            .await;
-        let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
-            .await
-            .unwrap_err();
-        assert!(err.to_string().contains("404"), "got: {err}");
-        _m.assert_async().await;
-    }
 }

crates/gl/src/webhook.rs

@@ -31,11 +31,7 @@ pub enum WebhookCmd {
         /// Optional HMAC secret for payload signing (sets X-Gitlawb-Signature-256)
         #[arg(long)]
         secret: Option<String>,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -44,11 +40,7 @@ pub enum WebhookCmd {
     List {
         /// Repository name
         repo: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -59,11 +51,7 @@ pub enum WebhookCmd {
         repo: String,
         /// Webhook ID
         id: String,
-        #[arg(
-            long,
-            default_value = "https://node.twigpine.com",
-            env = "GITLAWB_NODE"
-        )]
+        #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
@@ -110,17 +98,17 @@ async fn cmd_create(
         "events": event_list,
     }))?;
 
-    // #186: read_json status-checks before parsing and bounds the error body, so
-    // a denial (or a hostile oversized error) fails here instead of being parsed
-    // whole. `what` preserves main's "create webhook failed (...)" message prefix.
-    let hook = crate::http::read_json(
-        client
-            .post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
-            .await
-            .context("failed to connect to node")?,
-        "create webhook",
-    )
-    .await?;
+    let resp = client
+        .post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
+        .await
+        .context("failed to connect to node")?;
+    let status = resp.status();
+    let hook: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = hook["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("create webhook failed ({status}): {msg}");
+    }
 
     let id = hook["id"].as_str().unwrap_or("?");
     let hook_events = hook["events"]
@@ -157,15 +145,16 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     // get_signed (not get) attaches the RFC 9421 signature — plain get() never
     // signs, and the node owner-gates this route, so an unsigned GET 401s.
-    // #186: read_json status-checks + bounds the error body; `what` preserves
-    // main's "list webhooks failed (...)" message prefix.
-    let body = crate::http::read_json(
-        client
-            .get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
-            .await?,
-        "list webhooks",
-    )
-    .await?;
+    let resp = client
+        .get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
+        .await?;
+    let status = resp.status();
+    let body: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = body["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("list webhooks failed ({status}): {msg}");
+    }
 
     let hooks = body
         .get("webhooks")
@@ -206,20 +195,20 @@ async fn cmd_delete(repo: String, id: String, node: String, dir: Option<PathBuf>
     let client = NodeClient::new(&node, Some(keypair));
 
     let payload = serde_json::to_vec(&serde_json::json!({}))?;
-    // #186: read_json status-checks + bounds the error body; `what` preserves
-    // main's "delete webhook failed (...)" message prefix. The success body is
-    // unused, so discard it.
-    let _ = crate::http::read_json(
-        client
-            .delete(
-                &format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
-                &payload,
-            )
-            .await
-            .context("failed to connect to node")?,
-        "delete webhook",
-    )
-    .await?;
+    let resp = client
+        .delete(
+            &format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
+            &payload,
+        )
+        .await
+        .context("failed to connect to node")?;
+    let status = resp.status();
+    let result: Value = resp.json().await.context("invalid JSON")?;
+
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("delete webhook failed ({status}): {msg}");
+    }
 
     println!("✓ Webhook {id} deleted");
     Ok(())

crates/gl/tests/no_parse_before_status.rs

@@ -1,356 +0,0 @@
-//! Completeness gate for #186, itself proven load-bearing by reverting a
-//! converted handler and watching this go red.
-//!
-//! The client handlers converted in #186 must read node responses through
-//! `crate::http::read_json` — status-first, capped error read, sanitized message.
-//! The bypass this fix removed is *parse-before-status*: a `resp.json().await`
-//! whose result is only checked against the status AFTER parsing, which lets a
-//! hostile node stream an unbounded JSON error and print its `message` unsanitized.
-//!
-//! This test scans the converted source files and fails if that idiom returns —
-//! a `.json().await` call (not `read_json`) with an `.is_success()` check within a
-//! few lines AFTER it. A status check BEFORE the parse (the `KEEP` probes in
-//! repo.rs) reads as status-first and is not flagged. If a converted site is
-//! reverted to the bypass, this goes RED.
-//!
-//! The gate does not hand-list the files to scan; it DERIVES them: every
-//! `src/*.rs` that references `read_json` (except `http.rs`, where it is defined)
-//! is a converted handler and is scanned for the bypass idiom.
-//!
-//! Derivation alone has a blind spot: it keys on the very `read_json` marker a
-//! full revert deletes. A converted handler with a single node call (register.rs)
-//! reverted to `resp.json().await` loses `read_json` entirely, drops out of the
-//! derived set, and its bypass goes unscanned. So `CONVERTED_IN_186` is the
-//! authoritative required set and the gate asserts the derived surface EQUALS it,
-//! failing closed in both directions:
-//!
-//! - a pinned file missing from the derived set was reverted off `read_json`
-//!   (the blind-spot escape), so the gate goes RED;
-//! - a file that uses `read_json` but is not pinned is a conversion that was
-//!   never enrolled, so its own later revert would escape unseen; RED until it
-//!   is added to the pin.
-//!
-//! Equality is what extends the protection to handlers converted after #186, not
-//! just the original sixteen: a conversion cannot ship unpinned, and a pinned
-//! surface cannot be deconverted silently.
-//!
-//! Pre-existing bypasses in files this PR did not convert (e.g. init.rs,
-//! mirror.rs, profile.rs) are known debt, tracked separately and out of scope.
-//! They do not use `read_json`, so the derivation excludes them and they are not
-//! pinned.
-
-use std::path::Path;
-
-/// Files that define/host `read_json` rather than consume it as a converted
-/// handler. Excluded from the scanned set even though they reference the symbol.
-const NOT_A_HANDLER: &[&str] = &["http.rs"];
-
-/// The authoritative converted-handler surface: every non-`http.rs` file whose
-/// node-response reads route through `read_json`. The gate asserts the derived
-/// `read_json` set EQUALS this exactly, so a new conversion must be added here
-/// (the gate is RED until it is) and a pinned surface cannot be reverted off
-/// `read_json` without tripping the gate. Both directions fail closed, which is
-/// what protects post-#186 conversions, not only the original sixteen.
-const CONVERTED_IN_186: &[&str] = &[
-    "agent.rs",
-    "bounty.rs",
-    "cert.rs",
-    "changelog.rs",
-    "issue.rs",
-    "mcp.rs",
-    "peer.rs",
-    "pr.rs",
-    "protect.rs",
-    "register.rs",
-    "repo.rs",
-    "star.rs",
-    "status.rs",
-    "sync.rs",
-    "task.rs",
-    "visibility.rs",
-    "webhook.rs",
-];
-
-/// Derive the converted-handler surface: every `src/*.rs` that references
-/// `read_json`, minus the definition site(s). This is the set the equality check
-/// compares against `CONVERTED_IN_186`; a newly-converted handler surfaces here
-/// and must then be pinned (the gate is RED until it is).
-fn scanned_handlers(src: &Path) -> Vec<(String, String)> {
-    let mut handlers = Vec::new();
-    for entry in std::fs::read_dir(src).expect("read src dir") {
-        let path = entry.expect("dir entry").path();
-        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
-            continue;
-        }
-        let file_name = path
-            .file_name()
-            .and_then(|n| n.to_str())
-            .expect("file name")
-            .to_string();
-        if NOT_A_HANDLER.contains(&file_name.as_str()) {
-            continue;
-        }
-        let text = std::fs::read_to_string(&path)
-            .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
-        if has_read_json_call_site(&text) {
-            handlers.push((file_name, text));
-        }
-    }
-    handlers.sort();
-    handlers
-}
-
-/// Does this file actually CALL `read_json`, as opposed to merely mentioning it?
-///
-/// Membership in the derived set must key on a call site, never on the text of
-/// the file. A textual `contains("read_json")` matched prose too, so a handler
-/// fully reverted off `read_json` kept its membership on the strength of a
-/// leftover comment ("previously routed through read_json"). Still-derived means
-/// the pinned-vs-derived equality below never fired, and the reverted file went
-/// on being scanned as though it were converted, so the deconversion — which
-/// drops the cap and the sanitizer — shipped green. Requiring the trailing `(`
-/// on a non-comment line also drops test names and doc references.
-fn has_read_json_call_site(text: &str) -> bool {
-    text.lines().any(|l| {
-        let t = l.trim_start();
-        !t.starts_with("//") && t.contains("read_json(")
-    })
-}
-
-/// How far above a parse site to look for its status check.
-///
-/// The widest legitimate gap in the tree is `sync.rs`'s hand-rolled status-first
-/// `Trigger` arm, whose `.status()` sits 19 lines above its parse; 24 leaves a
-/// little headroom. Wider is weaker, so this should shrink if that arm is ever
-/// routed through `read_json` like its siblings.
-const STATUS_LOOKBACK: usize = 24;
-
-/// Does `line` open a JSON parse — `.json().await`, or a turbofish
-/// `.json::<T>().await`, or the head of a split-line chain (`.json(` /
-/// `.json::<T>(` whose `()` / `.await` continue on following lines)?
-///
-/// Lines routed through `read_json` are never parse sites (that IS the fix).
-fn opens_json_parse(line: &str) -> bool {
-    if line.contains("read_json") {
-        return false;
-    }
-    // A `.json(` token starts every reqwest JSON parse, bare or turbofished,
-    // single- or split-line. We anchor on it and let the window below confirm
-    // the `.await` / status check; anchoring on `.json(` alone is what catches
-    // `resp.json::<Value>().await` and `resp\n    .json()\n    .await` chains
-    // that the old bare-`.json().await` substring missed.
-    line.contains(".json()") || line.contains(".json::<")
-}
-
-/// Within `window` (the parse-site line joined with the few lines after it), is
-/// the parse actually completed with `.await` and then checked against the
-/// status? A completed parse whose `.is_success()` lands AFTER it is the
-/// parse-before-status bypass. A status check BEFORE the parse (KEEP probes)
-/// never appears in this after-the-parse window, so it is not flagged.
-fn window_is_bypass(window: &str) -> bool {
-    // The parse must actually resolve — guards against matching a `.json`-shaped
-    // token that never awaits. Split-line chains put `.await` a line or two down,
-    // which the joined window still contains.
-    let completes = window.contains(".await");
-    completes && window.contains(".is_success()")
-}
-
-/// Is there a FULL non-success guard ABOVE this parse site — one that exits for
-/// every non-2xx status, not merely a bespoke branch for one code?
-///
-/// `window_is_bypass` only recognises a status check that lands AFTER the parse,
-/// so it describes one specific bypass and says nothing about a parse with no
-/// status check anywhere. That shape is the more dangerous revert (it renders a
-/// denial body as a successful result with no check at all). Requiring positive
-/// evidence of a guard first turns the rule from "detect one bad ordering" into
-/// "require the good ordering".
-///
-/// The evidence must cover the whole non-success range. "Any `.status()`
-/// nearby" is not enough: agent.rs legitimately keeps a 404-only hint
-/// (`resp.status() == StatusCode::NOT_FOUND`) ahead of its `read_json` call,
-/// and a revert that swaps that call for `resp.json().await?` would still see
-/// the 404 check in the lookback — while a 500's JSON denial body renders as an
-/// empty agent list again. A single-status equality (or a `matches!(…, 404 |
-/// 501)` enumeration) guards its own arm and nothing else, so it does not
-/// count. What counts:
-///
-/// - `.is_success()` — the canonical spelling; sync.rs binds the status to a
-///   variable first, so this token is matched on its own rather than as a
-///   `.status()` suffix;
-/// - a RANGE comparison over `as_u16()` (`>= 400` and friends), which reads the
-///   whole class rather than enumerating codes.
-///
-/// The `special_404_hint_is_not_a_guard` mutation test below keeps this
-/// distinction honest against the real agent.rs source.
-fn has_full_status_guard_above(lookback: &str) -> bool {
-    if lookback.contains(".is_success()") {
-        return true;
-    }
-    lookback.contains("as_u16() >=")
-        || lookback.contains("as_u16() >")
-        || lookback.contains("as_u16() <=")
-        || lookback.contains("as_u16() <")
-}
-
-/// The scan shared by the gate and the mutation regression: every raw parse
-/// site in `text` is classified as an after-the-parse bypass (`offenders`) or a
-/// parse with no full status guard above it (`unguarded`). Factored out so the
-/// mutation test exercises EXACTLY the logic the gate runs, not a paraphrase of
-/// it.
-fn scan_handler(name: &str, text: &str) -> (Vec<String>, Vec<String>) {
-    let mut offenders = Vec::new();
-    let mut unguarded = Vec::new();
-    let lines: Vec<&str> = text.lines().collect();
-    for (i, line) in lines.iter().enumerate() {
-        if !opens_json_parse(line) {
-            continue;
-        }
-        // Join the parse-site line with the following lines so a split-line
-        // chain's `.await` and an after-the-parse `.is_success()` are both in
-        // view. Status-first probes put `.is_success()` on an EARLIER line, so
-        // it is outside this window and stays green.
-        let window = lines[i..(i + 6).min(lines.len())].join("\n");
-        if window_is_bypass(&window) {
-            offenders.push(format!("{name}:{}", i + 1));
-            continue;
-        }
-        // A parse that never resolves is not a read; only a completed parse
-        // can render a denial body as a result.
-        if !window.contains(".await") {
-            continue;
-        }
-        let lookback = lines[i.saturating_sub(STATUS_LOOKBACK)..i].join("\n");
-        if !has_full_status_guard_above(&lookback) {
-            unguarded.push(format!("{name}:{}", i + 1));
-        }
-    }
-    (offenders, unguarded)
-}
-
-#[test]
-fn converted_handlers_never_parse_before_status() {
-    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
-    let handlers = scanned_handlers(&src);
-
-    // Deriving the set is the whole point of the fix; if the tree ever stops
-    // using `read_json` the gate would silently pass on an empty set.
-    assert!(
-        !handlers.is_empty(),
-        "derived no converted handlers from src/*.rs read_json usage — the gate \
-         would vacuously pass; check the derivation"
-    );
-
-    // The pin is the authoritative required set: the derived `read_json` surface
-    // must EQUAL it, failing closed in both directions. A pinned file that drops
-    // out was reverted off `read_json` (register.rs, its single call, is the
-    // motivating case) and its bypass would escape the derived scan. A derived
-    // file that is not pinned is a conversion nobody enrolled, so ITS later revert
-    // would escape the same way; force it into the pin now. Equality is what
-    // extends the protection to handlers converted after #186.
-    let derived: Vec<&str> = handlers.iter().map(|(n, _)| n.as_str()).collect();
-    let deconverted: Vec<&str> = CONVERTED_IN_186
-        .iter()
-        .copied()
-        .filter(|f| !derived.contains(f))
-        .collect();
-    assert!(
-        deconverted.is_empty(),
-        "pinned handler(s) no longer route node responses through read_json: a \
-         parse-before-status revert would otherwise escape the derived scan. \
-         Re-route through crate::http::read_json (or drop from CONVERTED_IN_186 if \
-         the surface was intentionally deconverted): {deconverted:?}"
-    );
-    let unpinned: Vec<&str> = derived
-        .iter()
-        .copied()
-        .filter(|f| !CONVERTED_IN_186.contains(f))
-        .collect();
-    assert!(
-        unpinned.is_empty(),
-        "handler(s) use read_json but are absent from CONVERTED_IN_186: add them so \
-         the gate protects them against a later parse-before-status revert (an \
-         unpinned conversion drops out of both the scan and this check when \
-         reverted): {unpinned:?}"
-    );
-
-    let mut offenders = Vec::new();
-    let mut unguarded = Vec::new();
-    for (name, text) in &handlers {
-        let (o, u) = scan_handler(name, text);
-        offenders.extend(o);
-        unguarded.extend(u);
-    }
-
-    assert!(
-        offenders.is_empty(),
-        "parse-before-status bypass present in converted handler(s) — route the read \
-         through crate::http::read_json (status-first, capped, sanitized): {offenders:?}"
-    );
-    assert!(
-        unguarded.is_empty(),
-        "node response parsed with NO full status guard above it in a converted \
-         handler — the denial body is being rendered as a result. Route the read \
-         through crate::http::read_json (status-first, capped, sanitized): {unguarded:?}"
-    );
-}
-
-/// Mutation regression for the special-404 escape: agent.rs (and the agent-show
-/// / repo-info paths shaped like it) keeps a legitimate 404-only hint ahead of
-/// its `read_json` call. Revert that call to a raw `resp.json().await?` and the
-/// 404 equality is the only status evidence in the lookback — under the old
-/// "any `.status()` nearby" rule the fence stayed green while a 500's denial
-/// body rendered as an empty agent list. This test performs that exact revert
-/// on the REAL agent.rs source and requires the scan to flag the mutant, so the
-/// full-guard distinction in `has_full_status_guard_above` cannot regress to a
-/// mere proximity check without going red here.
-#[test]
-fn special_404_hint_is_not_a_guard() {
-    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
-    let text = std::fs::read_to_string(src.join("agent.rs")).expect("read agent.rs");
-
-    // The mutation must stay real: it requires the idiom it reverts. If
-    // agent.rs drops the 404 hint or the read_json call, this needs re-basing
-    // on whichever handler carries the special-404 idiom then.
-    assert!(
-        text.contains("StatusCode::NOT_FOUND"),
-        "agent.rs no longer carries the special-404 hint this mutation reverts; \
-         re-anchor the mutation on the handler that does"
-    );
-    let lines: Vec<&str> = text.lines().collect();
-    let not_found_line = lines
-        .iter()
-        .position(|l| l.contains("StatusCode::NOT_FOUND"))
-        .unwrap();
-    let read_json_line = lines[not_found_line..]
-        .iter()
-        .position(|l| l.contains("read_json"))
-        .map(|off| not_found_line + off)
-        .expect(
-            "agent.rs has no read_json call after its 404 hint; re-anchor the \
-             mutation on the handler that carries the idiom",
-        );
-
-    // The revert under test: the guarded helper call becomes a raw parse.
-    let mut mutant: Vec<String> = lines.iter().map(|l| l.to_string()).collect();
-    mutant[read_json_line] = "    let body: serde_json::Value = resp.json().await?;".to_string();
-    let mutant = mutant.join("\n");
-
-    let (_, unguarded) = scan_handler("agent.rs[mutant]", &mutant);
-    assert!(
-        unguarded
-            .iter()
-            .any(|hit| hit.starts_with("agent.rs[mutant]:")),
-        "the special-404 revert was not flagged: a 404-only equality upstream is \
-         being accepted as a full status guard, which reopens the escape this \
-         mutation pins (expected an unguarded hit, got {unguarded:?})"
-    );
-
-    // Positive control: the unmutated file must stay green, or the fence is
-    // flagging the legitimate hint rather than the revert.
-    let (offenders, unguarded) = scan_handler("agent.rs", &text);
-    assert!(
-        offenders.is_empty() && unguarded.is_empty(),
-        "unmutated agent.rs trips the fence; the guard classifier is wrong, not \
-         the handler: offenders={offenders:?} unguarded={unguarded:?}"
-    );
-}