fix(node): bound the invalid Hash echoed in the add error

Resolve Dependabot alerts for the ANS-104 golden-vector tooling in
scripts/:

- follow-redirects 1.16.0 -> 1.16.2 (lockfile only, within axios's
  ^1.16.0 range): GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8,
  GHSA-8r9p-f939-6h3c.
- ws 8.18.0 -> 8.22.1 via an npm override. @ethersproject/providers
  5.8.0 (latest v5) pins ws to exactly 8.18.0, so a lockfile bump
  alone cannot move it: GHSA-96hv-2xvq-fx4p, GHSA-58qx-3vcg-4xpx.

elliptic (GHSA-848j-6mx2-7j84, low) has no patched release and is
left as is.

Co-authored-by: Claude Opus 5.5 <[email protected]>

.env.example

@@ -156,8 +156,8 @@ GITLAWB_ENFORCE_OWNER_PUSH=true
 GITLAWB_P2P_BOOTSTRAP=
 
 # ── Access control ────────────────────────────────────────────────────────
-# Reserved for private-read mode. Public/private repo read enforcement is not
-# wired in the current live release; do not rely on this for private repositories.
+# Reserved and currently inert. Repo reads are gated per repository by
+# is_public and path-scoped visibility rules; this flag changes nothing.
 GITLAWB_PUBLIC_READ=true
 
 # Maximum git smart-HTTP pack request size, in bytes.

.github/workflows/pr-checks.yml

@@ -68,6 +68,22 @@ jobs:
       - name: Test release tag resolver
         run: scripts/test-resolve-release-tag.sh
 
+  triage-detector:
+    name: triage detector matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      # pr-triage.yml runs on pull_request_target and never checks out PR
+      # code, so its inline detector can only be exercised here, where the
+      # proposed workflow body IS the checked-out one.
+      - name: Test inline-test detector
+        run: node scripts/test-pr-triage-detect.mjs
+
   test:
     name: test (${{ matrix.toolchain }})
     runs-on: ubuntu-latest

.github/workflows/pr-triage.yml

@@ -76,9 +76,221 @@ jobs:
             // line after horizontal whitespace, covering bare, cfg(test), namespaced,
             // optional leading ::, and raw-identifier (r#test) forms. No head-file fetch
             // or lexer: needs-tests is advisory, not a merge gate.
-            const addsInlineTest = files.some(f =>
-              f.filename.endsWith(".rs") && f.patch &&
-              /^\+[ \t]*#\[[ \t]*(?:cfg[ \t]*\([ \t]*test[ \t]*\)|(?:::[ \t]*)?(?:[\w-]+[ \t]*::[ \t]*)*(?:r#)?test\b)/m.test(f.patch));
+            //
+            // The final path component may also carry `test` as an underscore-delimited
+            // segment, so third-party harnesses land without enumerating them one by one
+            // (#[test_case(1)], #[wasm_bindgen_test]). It is deliberately a segment and
+            // not a substring: a substring would also match #[contest] / #[latest], and a
+            // false positive here SUPPRESSES needs-tests rather than adding it. This
+            // heuristic has to fail loud, because a wrongly labeled PR gets corrected by
+            // the author while a wrongly cleared one is invisible. That trade costs the
+            // no-underscore harness names (#[rstest]), which stay unmatched on purpose.
+            //
+            // The segment classes are [A-Za-z0-9]+ rather than \w+ on purpose, so that `_`
+            // is only ever the literal delimiter. \w+ contains `_`, which makes the repeat
+            // ambiguous and backtracks exponentially: on this workflow's pull_request_target
+            // trigger f.patch is fork-controlled, so `#[test` followed by a long `_a` run is
+            // a permissionless stall of the triage job.
+            // Rust allows whitespace, line breaks, and comments between the
+            // attribute path and ] or (. A flat regex cannot decide that
+            // boundary: `//` runs to end of line, and block comments NEST, which
+            // is beyond regular languages — every enumeration of comment
+            // spellings so far has either dropped a legal separator (regressing
+            // real tests into needs-tests) or let unrelated patch records
+            // complete each other (clearing needs-tests from a testless PR, the
+            // invisible direction). So the closer is found by a token-aware
+            // scan instead: it consumes horizontal whitespace, `//`-to-newline,
+            // and depth-counted `/* */` runs, and accepts only when the first
+            // real token after the attribute path is `]` or `(`.
+            //
+            // Association is positional: the scan starts on the attribute's own
+            // added line and may continue ONLY through the immediately following
+            // added lines (a context line, hunk header, or removal breaks the
+            // chain). Unrelated `]`/`(` lines elsewhere in the patch can never
+            // complete a path they do not adjoin. The continuation is bounded;
+            // past the bound the scan gives up and reports NO inline test, which
+            // fails toward the loud label rather than the silent clearance.
+            //
+            // The detector body is fenced by the TRIAGE_DETECTOR markers so
+            // scripts/test-pr-triage-detect.mjs can extract and run it against
+            // the committed case matrix. Keep the fenced block self-contained.
+            // TRIAGE_DETECTOR_BEGIN
+            const TEST_ATTR_PATH =
+              "(?:cfg[ \\t]*\\([ \\t]*test[ \\t]*\\)|(?:::[ \\t]*)?(?:[\\w-]+[ \\t]*::[ \\t]*)*(?:r#)?(?:[A-Za-z0-9]+_)*test(?:_[A-Za-z0-9]+)*)";
+            // Anchored to the start of one added line; group 1 is whatever
+            // follows the path on that line, handed to the separator scan.
+            const TEST_ATTR_LINE = new RegExp(
+              "^[ \\t]*#\\[[ \\t]*" + TEST_ATTR_PATH + "([\\s\\S]*)$"
+            );
+            // An attribute split across more added lines than this is not a
+            // spelling anyone writes; refusing to scan further keeps the walk
+            // linear in the patch and fails toward the loud label.
+            const MAX_ATTR_CONTINUATION_LINES = 16;
+            // segs[0] is the remainder of the attribute's own line; each later
+            // entry is the text of one immediately following added line. True
+            // only when the first non-separator token across them is ] or (.
+            // Single forward pass, no backtracking: fork-controlled input.
+            function attrCloserFollows(segs) {
+              let depth = 0; // open block-comment nesting carried across lines
+              for (const seg of segs) {
+                let i = 0;
+                while (i < seg.length) {
+                  if (depth > 0) {
+                    if (seg.startsWith("/*", i)) { depth += 1; i += 2; }
+                    else if (seg.startsWith("*/", i)) { depth -= 1; i += 2; }
+                    else { i += 1; }
+                    continue;
+                  }
+                  const c = seg[i];
+                  if (c === " " || c === "\t") { i += 1; continue; }
+                  if (seg.startsWith("//", i)) break; // comment to end of line
+                  if (seg.startsWith("/*", i)) { depth = 1; i += 2; continue; }
+                  return c === "]" || c === "(";
+                }
+                // Line exhausted inside separators; the newline is itself a
+                // separator, so continue on the next added line.
+              }
+              return false; // out of adjoined lines (or bound hit): stay loud
+            }
+            // Before the candidate scan, a pre-pass walks added patch lines
+            // tracking Rust lexical state: raw strings (r#*", br#*", cr#*"),
+            // block comments (/* */ with nesting), regular strings ("...",
+            // which can span newlines), and line comments (//). An added line
+            // that starts inside any of these is skipped as a candidate,
+            // because a #[test_case] appearing there is lexical non-code, not
+            // a real test attribute. State is only tracked across consecutive
+            // added lines and reset at any break (context line, removal,
+            // hunk header): context lines carry a partial view of the file,
+            // so a " or r#" or /* there might be inside a string that opened
+            // before the hunk's visible window, and treating it as an opener
+            // would mark every later added line as non-code (a false negative
+            // on a real #[test]). The tradeoff is that a non-code region
+            // opened by a context line is invisible: an added #[test] inside
+            // an existing raw string or block comment is scanned as code and
+            // may match (a false positive, silent direction). This is accepted
+            // because (1) the old detector had the same behavior, (2) the
+            // pattern is rare, and (3) needs-tests is advisory, not a merge
+            // gate. Scanning context lines to close this gap would re-introduce
+            // the false negative, which affects the far more common case of a
+            // context line carrying a stray " from a string that opened before
+            // the visible window. Single forward pass, O(n) in patch length.
+            function patchAddsInlineTest(patch) {
+              const lines = patch.split("\n");
+              const nonCodeStart = new Set();
+              let rawHashes = -1; // -1 = not in raw string; >=0 = # count
+              let blockDepth = 0;
+              let inString = false;
+              for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (!line) continue;
+                const prefix = line[0];
+                // Only scan added lines. Context and removal lines carry
+                // a partial view of the file: a " or r#" or /* on a context
+                // line might be inside a string that opened before the
+                // hunk's visible window, and treating it as an opener would
+                // mark every later added line as non-code (a false negative
+                // on a real #[test]). So lexical state is only tracked across
+                // consecutive added lines and reset at any break. A non-code
+                // region opened by a context line is invisible; the candidate
+                // is still scanned, which fails toward the loud label.
+                if (prefix !== "+") {
+                  rawHashes = -1; blockDepth = 0; inString = false;
+                  continue;
+                }
+                const text = line.slice(1);
+                if (rawHashes >= 0 || blockDepth > 0 || inString)
+                  nonCodeStart.add(i);
+                let j = 0;
+                while (j < text.length) {
+                  if (rawHashes >= 0) {
+                    if (text[j] === '"') {
+                      let h = 1;
+                      while (h <= rawHashes && text[j + h] === "#") h++;
+                      if (h > rawHashes) { rawHashes = -1; j += h; continue; }
+                    }
+                    j += 1; continue;
+                  }
+                  if (blockDepth > 0) {
+                    if (text.startsWith("/*", j)) { blockDepth += 1; j += 2; }
+                    else if (text.startsWith("*/", j)) { blockDepth -= 1; j += 2; }
+                    else { j += 1; }
+                    continue;
+                  }
+                  if (inString) {
+                    if (text[j] === "\\") { j += 2; continue; }
+                    if (text[j] === '"') { inString = false; j += 1; continue; }
+                    j += 1; continue;
+                  }
+                  // Recognize Rust char and byte-char literals ('X', '\X',
+                  // '\u{...}', b'X') so their contents never open string or
+                  // comment state. A char literal has a closing ' within a
+                  // bounded distance; a lifetime or label ('a, 'static,
+                  // 'label:) does not, so it falls through as a regular char.
+                  // This is not a skip-to-next-' rule: the lookahead is 2-4
+                  // chars, or bounded to 20 for \u escapes (at most 6 hex
+                  // digits), never unbounded.
+                  if (text[j] === "'") {
+                    let k = j + 1;
+                    if (text[k] === "\\") {
+                      k += 1;
+                      if (text[k] === "u" && text[k + 1] === "{") {
+                        const uBound = k + 20;
+                        while (k < uBound && text[k] && text[k] !== "}") k++;
+                        if (text[k] === "}") k++;
+                      } else {
+                        k += 1;
+                      }
+                    } else {
+                      k += 1;
+                    }
+                    if (text[k] === "'") { j = k + 1; continue; }
+                    // lifetime or label: just skip the apostrophe
+                  }
+                  if (text[j] === '"') { inString = true; j += 1; continue; }
+                  if (text.startsWith("//", j)) break;
+                  if (text.startsWith("/*", j)) { blockDepth = 1; j += 2; continue; }
+                  const prev = j > 0 ? text[j - 1] : "";
+                  const isIdent = /[A-Za-z0-9_]/.test(prev);
+                  if (!isIdent && text[j] === "r") {
+                    let k = j + 1, h = 0;
+                    while (text[k + h] === "#") h++;
+                    if (text[k + h] === '"') {
+                      rawHashes = h; j = k + h + 1; continue;
+                    }
+                  }
+                  if (!isIdent && (text[j] === "b" || text[j] === "c") && text[j + 1] === "r") {
+                    let k = j + 2, h = 0;
+                    while (text[k + h] === "#") h++;
+                    if (text[k + h] === '"') {
+                      rawHashes = h; j = k + h + 1; continue;
+                    }
+                  }
+                  j += 1;
+                }
+              }
+              for (let i = 0; i < lines.length; i++) {
+                if (lines[i][0] !== "+") continue;
+                if (nonCodeStart.has(i)) continue;
+                const m = TEST_ATTR_LINE.exec(lines[i].slice(1));
+                if (m === null) continue;
+                const segs = [m[1]];
+                for (
+                  let j = i + 1;
+                  j < lines.length &&
+                  lines[j][0] === "+" &&
+                  segs.length <= MAX_ATTR_CONTINUATION_LINES;
+                  j++
+                ) {
+                  segs.push(lines[j].slice(1));
+                }
+                if (attrCloserFollows(segs)) return true;
+              }
+              return false;
+            }
+            // TRIAGE_DETECTOR_END
+            const addsInlineTest = files.some(
+              f => f.filename.endsWith(".rs") && !!f.patch && patchAddsInlineTest(f.patch)
+            );
             const touchedTests =
               names.some(n => n.includes("/tests/") || n.endsWith("_test.rs")) || addsInlineTest;
             if (changedRust && !touchedTests) want.add("needs-tests");

.github/workflows/release.yml

@@ -20,7 +20,15 @@ on:
         type: string
 
 concurrency:
-  group: release-${{ github.ref }}
+  # Not keyed on the ref: two runs racing `imagetools create` on the same
+  # moving tags could interleave, so runs of this workflow serialize outright.
+  # GitHub keeps at most one running and one pending run per group; a newer
+  # queued run replaces the pending one, and cancel-in-progress: false
+  # protects only the run already executing. So a backfill dispatched while a
+  # release is running, followed by a push to main, is replaced silently: the
+  # remedy is to re-dispatch it once the running release completes, which the
+  # push-only gate on the moving-tag step makes safe in any ordering.
+  group: release
   cancel-in-progress: false
 
 # Least privilege by default; every job opts in to exactly what it needs.
@@ -37,6 +45,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    environment: release
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -78,6 +87,7 @@ jobs:
       # dispatch the release PR's head carries no check runs and the --locked
       # gate never validates it.
       actions: write
+    environment: release
     steps:
       # Prefer the fresh `pr` output when this run just created/updated the
       # release PR; otherwise fall back to querying for an open release-please
@@ -215,6 +225,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -226,6 +237,7 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
@@ -237,7 +249,9 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.rel.outputs.tag }}
+          # Pin the commit the resolver verified; a tag ref re-resolved here
+          # could have been moved between resolve and checkout.
+          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -312,6 +326,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -323,9 +338,14 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
+          # ghcr requires a lowercase repository path, and unlike metadata-action,
+          # buildx's `--output name=` does no lowercasing, so a mixed-case owner
+          # makes the digest push fail with "invalid reference format".
+          echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
 
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -345,24 +365,80 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create and push multi-arch manifest
+        id: manifest
         env:
           VERSION: ${{ steps.rel.outputs.version }}
+          IMAGE: ${{ steps.rel.outputs.image }}
         run: |
           set -euo pipefail
-          # ghcr requires a lowercase repository path.
-          IMAGE="ghcr.io/${GITHUB_REPOSITORY,,}"
-          MAJOR_MINOR="${VERSION%.*}"
+          # The docker matrix pushes one digest per arch leg; anything else is
+          # a broken set, not a smaller multi-arch image.
+          count="$(find /tmp/digests -maxdepth 1 -type f | wc -l)"
+          if [ "$count" -ne 2 ]; then
+            echo "::error::expected 2 arch digests in /tmp/digests, found $count"
+            exit 1
+          fi
           digests=""
           for f in /tmp/digests/*; do
-            digests="$digests $IMAGE@sha256:$(basename "$f")"
+            d="$(basename "$f")"
+            case "$d" in
+              *[!0-9a-f]*)
+                echo "::error::digest filename is not lowercase sha256 hex: $d"
+                exit 1
+                ;;
+            esac
+            if [ "${#d}" -ne 64 ]; then
+              echo "::error::digest is not 64 hex chars: $d"
+              exit 1
+            fi
+            digests="$digests $IMAGE@sha256:$d"
           done
+          # The immutable tag always publishes. The moving tags are applied by
+          # the gated step below, which never runs on workflow_dispatch.
           # shellcheck disable=SC2086
-          docker buildx imagetools create \
-            -t "$IMAGE:$VERSION" \
-            -t "$IMAGE:$MAJOR_MINOR" \
-            -t "$IMAGE:latest" \
-            $digests
+          docker buildx imagetools create -t "$IMAGE:$VERSION" $digests
           docker buildx imagetools inspect "$IMAGE:$VERSION"
+          echo "digests=${digests# }" >> "$GITHUB_OUTPUT"
+
+      - name: Move floating tags
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+        env:
+          VERSION: ${{ steps.rel.outputs.version }}
+          IMAGE: ${{ steps.rel.outputs.image }}
+          DIGESTS: ${{ steps.manifest.outputs.digests }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          MAJOR_MINOR="${VERSION%.*}"
+          # :latest and :X.Y track the newest release. Only a push to main
+          # carries a release-please-cut version, and release-please versions
+          # are monotonic, so on this path the tags only ever advance. A
+          # workflow_dispatch backfill republishes an existing tag and must
+          # never move a pointer, so this step skips on dispatch. After a
+          # backfill that is genuinely newest in its minor line, advance :X.Y
+          # by hand: docker buildx imagetools create -t "$IMAGE:X.Y" <digests>.
+          # The event gate alone does not bound a stale run: re-running an
+          # older push run replays its stored needs outputs under the
+          # original event and ref, and would move the pointers backward to
+          # that run's version. Floor against live state instead: this run's
+          # release already exists by now, so VERSION must be the newest
+          # published release or the run is stale and the tags stay put. The
+          # releases list is ordered by creation, not semver, so read every
+          # page and take the semver maximum, not the first page's.
+          tags="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
+            -q '.[] | select(.draft == false) | .tag_name')" || {
+            echo "::error::could not list releases to bound the moving tags"
+            exit 1
+          }
+          floor="$(printf '%s\n' "$tags" \
+            | { grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' || true; } \
+            | sed 's/^v//' | sort -V | tail -n 1)"
+          if [ -n "$floor" ] && [ "$floor" != "$VERSION" ]; then
+            echo "::error::release v$floor is newer than this run's v$VERSION; refusing to move the moving tags backward (stale re-run?)"
+            exit 1
+          fi
+          # shellcheck disable=SC2086
+          docker buildx imagetools create -t "$IMAGE:latest" -t "$IMAGE:$MAJOR_MINOR" $DIGESTS
 
       - name: Release summary
         env:
@@ -386,6 +462,7 @@ jobs:
     continue-on-error: ${{ startsWith(matrix.target, 'x86_64-pc-windows') }}
     permissions:
       contents: write
+    environment: release
     strategy:
       fail-fast: false
       matrix:
@@ -405,10 +482,27 @@ jobs:
           - target: x86_64-pc-windows-msvc
             os: windows-latest
     steps:
+      - name: Check out workflow scripts
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Resolve release tag
+        id: rel
+        env:
+          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash # matrix includes windows-latest, where run: defaults to pwsh
+        run: |
+          set -euo pipefail
+          scripts/resolve-release-tag.sh "$RELEASE_TAG"
+
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
+          # Pin the commit the resolver verified; a tag ref re-resolved here
+          # could have been moved between resolve and checkout.
+          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
           persist-credentials: false
 
       - name: Set up Rust toolchain
@@ -454,7 +548,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION="${{ needs.release-please.outputs.version }}"
+          VERSION="${{ steps.rel.outputs.version }}"
           BIN_DIR="target/${{ matrix.target }}/release"
           EXE=""
           case "${{ matrix.target }}" in *windows*) EXE=".exe" ;; esac
@@ -474,7 +568,7 @@ jobs:
         run: |
           set -euo pipefail
           TARGET="${{ matrix.target }}"
-          NAME="gitlawb-node-${{ needs.release-please.outputs.version }}-${TARGET}"
+          NAME="gitlawb-node-${{ steps.rel.outputs.version }}-${TARGET}"
           BIN_DIR="target/${TARGET}/release"
           EXE=""
           case "$TARGET" in *windows*) EXE=".exe" ;; esac
@@ -515,7 +609,7 @@ jobs:
       - name: Attach to release
         uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
         with:
-          tag_name: ${{ needs.release-please.outputs.tag_name }}
+          tag_name: ${{ steps.rel.outputs.tag }}
           files: |
             dist/*.tar.gz
             dist/*.zip
@@ -528,7 +622,9 @@ jobs:
     # (release-binaries is skipped on dispatch, hence !cancelled()). Publishing
     # auth is npm Trusted Publishing (GitHub OIDC) — no NPM_TOKEN. Each
     # @gitlawb package must have this repo + workflow (release.yml) configured
-    # as its trusted publisher on npmjs.com, or publish fails loudly here —
+    # as its trusted publisher on npmjs.com, scoped to the release environment
+    # so a dispatched copy of this file on another ref cannot mint a token, or
+    # publish fails loudly here —
     # deliberately loud: the silent secret-guard skip is how 0.4.x–0.6.0
     # never reached npm.
     if: >-
@@ -540,6 +636,7 @@ jobs:
     permissions:
       contents: read
       id-token: write # npm trusted publishing (OIDC) + provenance
+    environment: release
     steps:
       - name: Check out workflow scripts
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -551,6 +648,7 @@ jobs:
         env:
           DISPATCH_TAG: ${{ inputs.npm_backfill_tag }}
           RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
@@ -558,7 +656,9 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.rel.outputs.tag }}
+          # Pin the commit the resolver verified; a tag ref re-resolved here
+          # could have been moved between resolve and checkout.
+          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
           persist-credentials: false
 
       # npm >= 11.5.1 performs the OIDC token exchange automatically when the
@@ -571,14 +671,23 @@ jobs:
       - name: Ensure npm supports trusted publishing
         run: |
           set -euo pipefail
-          npm install -g npm@^11.5.1
-          npm --version
+          npm install -g npm@11.19.1
+          # Assert the pin took, so an accidental unpin or a drift off 11.19.1
+          # fails loudly here instead of silently running a different npm on
+          # the OIDC path.
+          installed="$(npm --version)"
+          echo "npm installed: $installed"
+          if [ "$installed" != "11.19.1" ]; then
+            echo "::error::npm is not the pinned 11.19.1 (got: $installed)"
+            exit 1
+          fi
 
       - name: Lay in release binaries
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ steps.rel.outputs.version }}
           TAG: ${{ steps.rel.outputs.tag }}
+          ASSETS: ${{ steps.rel.outputs.assets }}
         run: |
           set -euo pipefail
           # npm platform package -> Rust target triple (unix only; Windows is not
@@ -595,8 +704,18 @@ jobs:
             target="${entry#*:}"
             archive="gitlawb-node-${VERSION}-${target}.tar.gz"
             echo "==> $pkg <- $archive"
-            gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-              --pattern "$archive" --dir _dl --clobber
+            # Download by the asset id the resolver captured and uploader-
+            # checked, not by name: release assets are mutable, and an id can
+            # only ever point at the exact blob captured at resolve time.
+            # The map keys are base64-encoded asset names.
+            want="$(printf '%s' "$archive" | base64 -w0)"
+            asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
+            if [ -z "$asset_id" ]; then
+              echo "::error::release $TAG has no asset $archive captured at resolve time"
+              exit 1
+            fi
+            gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
+              -H 'Accept: application/octet-stream' > "_dl/$archive"
             tar -xzf "_dl/$archive" -C _dl
             src="_dl/gitlawb-node-${VERSION}-${target}"
             cp "$src/gl" "npm/packages/$pkg/gl"
@@ -635,14 +754,39 @@ jobs:
           # Platform packages first, then the wrapper (so its optionalDependencies resolve).
           # Skip versions already on the registry so a rerun after a partial publish
           # is idempotent instead of erroring on the first existing package.
+          # npm publish moves the latest dist-tag to whatever it publishes, so a
+          # backfilled older version would hand :latest to stale code. Decide
+          # the dist-tag per package from that package's own registry latest:
+          # a partial publish can leave the platform packages ahead of the
+          # wrapper. E404 means the package has never been published, so this
+          # release gets latest; any other lookup failure must fail closed
+          # rather than guess at the dist-tag and risk moving latest backward.
+          # stderr goes to a file so a warning on a successful lookup cannot
+          # leak into registry_latest; it is read only when the lookup fails.
+          npm_err="$(mktemp)"
+          trap 'rm -f -- "$npm_err"' EXIT
           for pkg in gl-darwin-arm64 gl-darwin-x64 gl-linux-arm64 gl-linux-x64 gl; do
             name="@gitlawb/$pkg"
             if npm view "$name@$VERSION" version >/dev/null 2>&1; then
               echo "==> $name@$VERSION already published, skipping"
               continue
             fi
-            echo "==> npm publish $name@$VERSION"
-            npm publish "npm/packages/$pkg" --provenance --access public
+            registry_latest="$(npm view "$name" dist-tags.latest 2>"$npm_err")" || {
+              if ! grep -q E404 "$npm_err"; then
+                cat "$npm_err" >&2
+                echo "::error::npm dist-tags lookup failed for $name; not guessing the dist-tag"
+                exit 1
+              fi
+              registry_latest=""
+            }
+            dist_tag="latest"
+            if [ -n "$registry_latest" ] && \
+               [ "$VERSION" != "$(printf '%s\n%s\n' "$registry_latest" "$VERSION" | sort -V | tail -1)" ]; then
+              dist_tag="backfill"
+              echo "::notice::$VERSION is older than $name@$registry_latest; publishing under dist-tag backfill"
+            fi
+            echo "==> npm publish $name@$VERSION (dist-tag $dist_tag)"
+            npm publish "npm/packages/$pkg" --provenance --access public --tag "$dist_tag"
           done
 
   homebrew-bump:
@@ -652,6 +796,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read # GITHUB_TOKEN downloads release assets; the tap push uses HOMEBREW_TAP_PAT
+    environment: release
     steps:
       - name: Guard on secret
         id: guard
@@ -665,6 +810,22 @@ jobs:
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Check out workflow scripts
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Resolve release tag
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
+        id: rel
+        env:
+          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          scripts/resolve-release-tag.sh "$RELEASE_TAG"
+
       - name: Checkout tap repo
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -678,15 +839,32 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ needs.release-please.outputs.version }}
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          VERSION: ${{ steps.rel.outputs.version }}
+          TAG: ${{ steps.rel.outputs.tag }}
+          ASSETS: ${{ steps.rel.outputs.assets }}
         run: |
           set -euo pipefail
           base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}"
           mkdir -p _sums
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" \
-            --pattern '*.tar.gz.sha256' --dir _sums --clobber
-          sha() { awk '{print $1}' "_sums/gitlawb-node-${VERSION}-$1.tar.gz.sha256"; }
+          # Hash the tarballs themselves, fetched by the asset id the resolver
+          # captured and uploader-checked. The *.sha256 sidecars are mutable
+          # release assets too; trusting them would trust the same surface.
+          sha() {
+            archive="gitlawb-node-${VERSION}-$1.tar.gz"
+            want="$(printf '%s' "$archive" | base64 -w0)"
+            asset_id="$(printf '%s\n' "$ASSETS" | awk -v n="$want" '$1 == n {print $2; exit}')"
+            if [ -z "$asset_id" ]; then
+              echo "::error::release $TAG has no asset $archive captured at resolve time" >&2
+              exit 1
+            fi
+            # errexit is off inside the $(...) this runs under, so a failed
+            # download must exit the function itself instead of hashing a
+            # truncated file.
+            gh api "repos/$GITHUB_REPOSITORY/releases/assets/$asset_id" \
+              -H 'Accept: application/octet-stream' > "_sums/$archive" \
+              || exit 1
+            sha256sum "_sums/$archive" | awk '{print $1}'
+          }
           SHA_MAC_ARM="$(sha aarch64-apple-darwin)"
           SHA_MAC_X64="$(sha x86_64-apple-darwin)"
           SHA_LNX_ARM="$(sha aarch64-unknown-linux-musl)"
@@ -747,7 +925,7 @@ jobs:
         working-directory: tap
         env:
           HOMEBREW_TAP_PAT: ${{ secrets.HOMEBREW_TAP_PAT }}
-          VERSION: ${{ needs.release-please.outputs.version }}
+          VERSION: ${{ steps.rel.outputs.version }}
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
@@ -769,6 +947,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read # GITHUB_TOKEN checks out node; the web PR uses WEB_SYNC_PAT
+    environment: release
     steps:
       - name: Guard on secret
         id: guard
@@ -782,11 +961,29 @@ jobs:
             echo "enabled=true" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Check out workflow scripts
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Resolve release tag
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
+        id: rel
+        env:
+          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          scripts/resolve-release-tag.sh "$RELEASE_TAG"
+
       - name: Checkout node (release tag)
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ needs.release-please.outputs.tag_name }}
+          # Pin the commit the resolver verified; a tag ref re-resolved here
+          # could have been moved between resolve and checkout.
+          ref: ${{ steps.rel.outputs.tag_commit || format('refs/tags/{0}', steps.rel.outputs.tag) }}
           path: node
           persist-credentials: false
 
@@ -806,8 +1003,8 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ needs.release-please.outputs.version }}
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          VERSION: ${{ steps.rel.outputs.version }}
+          TAG: ${{ steps.rel.outputs.tag }}
         run: |
           set -euo pipefail
           gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json assets \
@@ -825,8 +1022,8 @@ jobs:
         if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.WEB_SYNC_PAT }}
-          VERSION: ${{ needs.release-please.outputs.version }}
-          TAG: ${{ needs.release-please.outputs.tag_name }}
+          VERSION: ${{ steps.rel.outputs.version }}
+          TAG: ${{ steps.rel.outputs.tag }}
         run: |
           set -euo pipefail
           # Canonical install scripts (source of truth lives in the node repo).

Cargo.lock

@@ -3595,6 +3595,7 @@ dependencies = [
  "chrono",
  "clap",
  "dirs",
+ "ed25519-dalek 2.2.0",
  "gitlawb-core",
  "icaptcha-client",
  "mockito",

README.md

@@ -71,7 +71,7 @@ Known limitations:
 - Agent lifecycle revocation is not enforced by HTTP Signature authorization; do not rely on removing or revoking an agent record to block a compromised signer.
 - Read visibility is not a blanket data-classification boundary: task, IPFS-pin, and Arweave-anchor listings are not repository-gated; withheld path names can be visible to a root reader; and later visibility changes cannot retract content already announced or externally anchored.
 - Peer writes are signed by upgraded nodes, but strict signed-peer enforcement is opt-in during rolling upgrades.
-- Current GraphQL mutations require an authenticated signer, but there is no mutation-specific guardrail that prevents a future mutation from omitting that check.
+- GraphQL mutations require a signed identity (a verified signer bound to the acting DID), are limited to the agent-task queue, and are covered by a CI completeness fence that requires signer acquisition and actor binding on every registered mutation; repo writes are not exposed over GraphQL and remain REST-only.
 - Pull-request review comments do not yet have threaded line-level anchors, and merges do not enforce approval requirements.
 
 See:

crates/git-remote-gitlawb/src/main.rs

@@ -287,8 +287,10 @@ fn handle_connect<R: Read>(
     //    this into one POST deadlocks a multi-round fetch (#117).
     //
     //  git-receive-pack (push):
-    //    Git sends ref-update commands + the complete PACK blob, then closes its
-    //    write pipe. read_to_end is safe and correct here, a single POST.
+    //    Git sends the ref-update command list (pkt-lines ending in a flush),
+    //    then the complete PACK blob only when a command has a non-zero new-oid.
+    //    A delete-only push sends no pack, and git holds its write pipe open for
+    //    the report-status response, so EOF cannot delimit the request (#369).
 
     let post_url = format!("{}/{}", repo_base, service);
 
@@ -296,10 +298,7 @@ fn handle_connect<R: Read>(
         return negotiate_upload_pack(&client, &post_url, service, signing_key, stdin, &mut stdout);
     }
 
-    let mut request_body = Vec::new();
-    stdin
-        .read_to_end(&mut request_body)
-        .context("reading receive-pack request")?;
+    let request_body = read_receive_pack_request(stdin)?;
     tracing::debug!("pack request: {} bytes from git", request_body.len());
 
     if request_body.is_empty() {
@@ -535,6 +534,108 @@ fn read_upload_pack_round<R: Read>(stdin: &mut R) -> Result<(Vec<u8>, RoundEnd)>
     }
 }
 
+/// Read one git-receive-pack request: optional `shallow` lines, then EITHER a
+/// command list (pkt-lines terminated by a flush) or a push-cert block
+/// (pkt-lines terminated by a "push-cert-end" line), then the negotiated
+/// push-options block, then the pack ONLY when a command carries a non-zero
+/// new-oid.
+///
+/// A delete-only push sends no pack, and git holds its write pipe open waiting
+/// for the report-status response, so a plain read_to_end deadlocks the two
+/// (#369). A signed push is the other trap: when the client sends a push-cert
+/// it sends NO command list at all (the commands live inside the cert), so the
+/// request starts with a "push-cert" line and no flush ever arrives. The
+/// negotiated capability list is on the push-cert line, or on the first
+/// command line after its NUL when there is no cert. EOF at any point also
+/// ends the read, covering git versions that close the pipe early.
+fn read_receive_pack_request<R: Read>(stdin: &mut R) -> Result<Vec<u8>> {
+    /// Read one pkt-line into `body` (length prefix + data), returning its data
+    /// or `None` on flush or EOF. Malformed lengths bail rather than collapse
+    /// into a synthesized flush (#192 F5).
+    fn read_pkt<R: Read>(stdin: &mut R, body: &mut Vec<u8>) -> Result<Option<Vec<u8>>> {
+        let mut len_bytes = [0u8; 4];
+        match stdin.read_exact(&mut len_bytes) {
+            Ok(()) => {}
+            Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(None),
+            Err(e) => return Err(e.into()),
+        }
+        let Ok(len_hex) = std::str::from_utf8(&len_bytes) else {
+            bail!("malformed pkt-line length prefix: non-UTF-8 bytes {len_bytes:02x?}");
+        };
+        let Ok(pkt_len) = usize::from_str_radix(len_hex, 16) else {
+            bail!("malformed pkt-line length prefix: non-hex {len_hex:?}");
+        };
+        body.extend_from_slice(&len_bytes);
+        if pkt_len == 0 {
+            return Ok(None);
+        }
+        if pkt_len < 4 {
+            bail!("invalid pkt-line length: {pkt_len}");
+        }
+        let mut data = vec![0u8; pkt_len - 4];
+        stdin
+            .read_exact(&mut data)
+            .context("reading pkt-line data")?;
+        body.extend_from_slice(&data);
+        Ok(Some(data))
+    }
+
+    /// "<40-hex old> <40-hex new> <refname>" — the command shape, whether it
+    /// appears in a command list or inside a push-cert.
+    fn is_command(data: &[u8]) -> bool {
+        data.len() >= 82
+            && data[..40].iter().all(|b| b.is_ascii_hexdigit())
+            && data[40] == b' '
+            && data[41..81].iter().all(|b| b.is_ascii_hexdigit())
+            && data[81] == b' '
+    }
+
+    let mut body = Vec::new();
+    let mut caps = String::new();
+    let mut pack_expected = false;
+    let mut in_cert = false;
+    loop {
+        let Some(data) = read_pkt(stdin, &mut body)? else {
+            // Flush ends a command list; EOF ends anything. A cert has no
+            // legal flush inside it, so the same break covers malformed
+            // input without hanging.
+            break;
+        };
+        if !in_cert && data.starts_with(b"push-cert") {
+            in_cert = true;
+            if let Some(nul) = data.iter().position(|&b| b == 0) {
+                caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
+            }
+            continue;
+        }
+        if in_cert && data == b"push-cert-end\n" {
+            break;
+        }
+        if is_command(&data) {
+            if caps.is_empty() {
+                if let Some(nul) = data.iter().position(|&b| b == 0) {
+                    caps = String::from_utf8_lossy(&data[nul + 1..]).into_owned();
+                }
+            }
+            if data[41..81].iter().any(|&b| b != b'0') {
+                pack_expected = true;
+            }
+        }
+    }
+    // When both are negotiated the push-options block follows the cert; when
+    // only options are negotiated it follows the command flush. Either way it
+    // is pkt-lines to a flush.
+    if caps.split(' ').any(|c| c.starts_with("push-options")) {
+        while read_pkt(stdin, &mut body)?.is_some() {}
+    }
+    if pack_expected {
+        stdin
+            .read_to_end(&mut body)
+            .context("reading receive-pack pack")?;
+    }
+    Ok(body)
+}
+
 /// POST one self-contained stateless-RPC request body and stream the response to
 /// `stdout`. Signs the request when `signing_key` is present, so every round of a
 /// private-repo fetch carries the caller's signature (the node visibility-gates
@@ -2017,6 +2118,184 @@ mod tests {
         assert!(help.ends_with('\n'));
     }
 
+    // ── #369 delete-only push deadlock ───────────────────────────────────────
+
+    /// A delete-only receive-pack request ends at the command flush; git then
+    /// holds the write pipe open for the report and sends no pack. A reader that
+    /// blocks after the command list reproduces the hang that a Cursor (EOF)
+    /// hides. The read must return at the flush, inside the timeout.
+    #[test]
+    fn delete_only_receive_pack_request_returns_at_command_flush() {
+        let old = "a".repeat(40);
+        let zero = "0".repeat(40);
+        let mut seed = Vec::new();
+        seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
+        seed.extend_from_slice(b"0000"); // command-list flush; git then blocks
+
+        let (tx, rx) = std::sync::mpsc::channel::<()>();
+        let mut reader = BlockAfterSeed {
+            seed: io::Cursor::new(seed),
+            gate: rx,
+        };
+
+        let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
+        let handle = std::thread::spawn(move || {
+            let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
+        });
+
+        let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
+        let _ = tx.send(()); // unblock the reader so the thread can exit
+        let _ = handle.join();
+
+        let body = got.expect(
+            "read_receive_pack_request blocked past the command flush waiting for \
+             a pack a delete-only push never sends (#369)",
+        );
+        assert!(
+            body.ends_with(b"0000"),
+            "the request body keeps the command list and its flush terminator"
+        );
+    }
+
+    /// A push carrying objects still reads the pack through to EOF, and the
+    /// command flush sits between the commands and the pack in the body.
+    #[test]
+    fn receive_pack_request_with_pack_reads_through_eof() {
+        let old = "a".repeat(40);
+        let new = "b".repeat(40);
+        let mut stream = Vec::new();
+        stream.extend_from_slice(&pkt(&format!(
+            "{old} {new} refs/heads/main\0 report-status-v2\n"
+        )));
+        stream.extend_from_slice(b"0000");
+        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
+
+        let mut stdin = io::Cursor::new(stream);
+        let body = read_receive_pack_request(&mut stdin).unwrap();
+        let pos = body.windows(4).position(|w| w == b"0000").unwrap();
+        assert_eq!(
+            &body[pos + 4..],
+            b"PACK\x00\x00\x00\x02fakepack",
+            "a non-zero new-oid means the pack follows the flush"
+        );
+    }
+
+    /// A signed delete-only push sends NO command list: the request starts
+    /// with the "push-cert" line, the commands live inside the cert, and the
+    /// cert ends with a "push-cert-end" pkt-line (not a flush). The reader
+    /// must return after push-cert-end without waiting on the pipe.
+    #[test]
+    fn signed_delete_only_push_returns_after_push_cert_end() {
+        let old = "a".repeat(40);
+        let zero = "0".repeat(40);
+        let mut seed = Vec::new();
+        seed.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
+        seed.extend_from_slice(&pkt("certificate version 0.1\n"));
+        seed.extend_from_slice(&pkt("pusher did:key:z6Mk\n"));
+        seed.extend_from_slice(&pkt("\n")); // empty line ends the headers
+        seed.extend_from_slice(&pkt(&format!("{old} {zero} refs/heads/gone\n")));
+        seed.extend_from_slice(&pkt("sig-line\n"));
+        seed.extend_from_slice(&pkt("push-cert-end\n"));
+        // git now blocks for the report; the pipe stays open.
+
+        let (tx, rx) = std::sync::mpsc::channel::<()>();
+        let mut reader = BlockAfterSeed {
+            seed: io::Cursor::new(seed),
+            gate: rx,
+        };
+
+        let (done_tx, done_rx) = std::sync::mpsc::channel::<Vec<u8>>();
+        let handle = std::thread::spawn(move || {
+            let _ = done_tx.send(read_receive_pack_request(&mut reader).unwrap());
+        });
+        let got = done_rx.recv_timeout(std::time::Duration::from_secs(2));
+        let _ = tx.send(());
+        let _ = handle.join();
+
+        let body = got.expect(
+            "read_receive_pack_request blocked past push-cert-end on a signed \
+             delete-only push (#369)",
+        );
+        assert!(
+            body.windows(6).any(|w| w == b"pusher"),
+            "the cert block is part of the request body"
+        );
+    }
+
+    /// A signed pack-bearing push: cert with the commands inside, then the
+    /// pack. Everything must land in the body.
+    #[test]
+    fn signed_pack_push_keeps_cert_and_pack() {
+        let old = "a".repeat(40);
+        let new = "b".repeat(40);
+        let mut stream = Vec::new();
+        stream.extend_from_slice(&pkt("push-cert\0 report-status-v2 push-cert\n"));
+        stream.extend_from_slice(&pkt("certificate version 0.1\n"));
+        stream.extend_from_slice(&pkt("\n"));
+        stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
+        stream.extend_from_slice(&pkt("push-cert-end\n"));
+        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
+
+        let mut stdin = io::Cursor::new(stream);
+        let body = read_receive_pack_request(&mut stdin).unwrap();
+        assert!(
+            body.windows(5).any(|w| w == b"PACK\x00"),
+            "the pack follows the cert into the body"
+        );
+    }
+
+    /// A negotiated push-options block is pkt-lines ending in its own flush.
+    /// With no cert it follows the command flush; with a cert it follows
+    /// push-cert-end.
+    #[test]
+    fn receive_pack_request_consumes_a_push_options_block() {
+        let old = "a".repeat(40);
+        let new = "b".repeat(40);
+        let mut stream = Vec::new();
+        stream.extend_from_slice(&pkt(&format!(
+            "{old} {new} refs/heads/main\0 report-status-v2 push-options\n"
+        )));
+        stream.extend_from_slice(b"0000"); // command flush
+        stream.extend_from_slice(&pkt("ci.skip\n"));
+        stream.extend_from_slice(b"0000"); // options flush
+        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
+
+        let mut stdin = io::Cursor::new(stream);
+        let body = read_receive_pack_request(&mut stdin).unwrap();
+        assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
+        assert!(
+            body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
+            "the pack lands after the options block"
+        );
+    }
+
+    /// Cert and options together: the cert comes first and the options block
+    /// sits between push-cert-end and the pack.
+    #[test]
+    fn signed_push_with_options_reads_cert_then_options_then_pack() {
+        let old = "a".repeat(40);
+        let new = "b".repeat(40);
+        let mut stream = Vec::new();
+        stream.extend_from_slice(&pkt(
+            "push-cert\0 report-status-v2 push-cert push-options\n",
+        ));
+        stream.extend_from_slice(&pkt("certificate version 0.1\n"));
+        stream.extend_from_slice(&pkt("\n"));
+        stream.extend_from_slice(&pkt(&format!("{old} {new} refs/heads/main\n")));
+        stream.extend_from_slice(&pkt("push-cert-end\n"));
+        stream.extend_from_slice(&pkt("ci.skip\n"));
+        stream.extend_from_slice(b"0000"); // options flush
+        stream.extend_from_slice(b"PACK\x00\x00\x00\x02fakepack");
+
+        let mut stdin = io::Cursor::new(stream);
+        let body = read_receive_pack_request(&mut stdin).unwrap();
+        assert!(body.windows(7).any(|w| w == b"ci.skip"), "options survived");
+        assert!(
+            body.ends_with(b"PACK\x00\x00\x00\x02fakepack"),
+            "the pack lands after the options block"
+        );
+    }
+
     // ── #117 multi-round fetch negotiation ───────────────────────────────────
 
     /// Encode a git pkt-line: 4-byte hex length (incl. the 4 bytes) + data.

crates/git-remote-gitlawb/tests/real_git_fetch.rs

@@ -95,6 +95,36 @@ fn upload_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
     out.stdout
 }
 
+/// Run `git receive-pack --stateless-rpc [--advertise-refs] <repo>`, optionally
+/// feeding `input` on stdin. Returns raw stdout (the wire bytes). The receive
+/// half of `upload_pack`, used so the shim can serve a real push.
+fn receive_pack(repo: &Path, advertise: bool, input: &[u8]) -> Vec<u8> {
+    let mut cmd = Command::new("git");
+    cmd.arg("receive-pack").arg("--stateless-rpc");
+    if advertise {
+        cmd.arg("--advertise-refs");
+    }
+    cmd.arg(repo)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    let mut child = cmd.spawn().expect("spawn git receive-pack");
+    let mut stdin = child.stdin.take().unwrap();
+    let input = input.to_vec();
+    let writer = std::thread::spawn(move || {
+        let _ = stdin.write_all(&input);
+        // drop closes stdin
+    });
+    let out = child.wait_with_output().expect("wait receive-pack");
+    writer.join().ok();
+    assert!(
+        out.status.success(),
+        "git receive-pack failed: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    out.stdout
+}
+
 #[derive(Clone, Copy)]
 enum ShimMode {
     /// Faithful v0 serving: pipe each POST to `git upload-pack --stateless-rpc`.
@@ -218,7 +248,21 @@ fn handle_conn(stream: TcpStream, repo: &Path, mode: ShimMode, posts: &AtomicUsi
         reader.read_exact(&mut body).ok();
     }
 
-    let (content_type, payload) = if method == "GET" && target.contains("/info/refs") {
+    let (content_type, payload) = if method == "GET" && target.contains("service=git-receive-pack")
+    {
+        // Receive-pack advertisement, same wrapper shape as upload-pack.
+        let adv = receive_pack(repo, true, b"");
+        let mut wrapped = pkt(b"# service=git-receive-pack\n");
+        wrapped.extend_from_slice(b"0000");
+        wrapped.extend_from_slice(&adv);
+        ("application/x-git-receive-pack-advertisement", wrapped)
+    } else if method == "POST" && target.ends_with("/git-receive-pack") {
+        posts.fetch_add(1, Ordering::SeqCst);
+        (
+            "application/x-git-receive-pack-result",
+            receive_pack(repo, false, &body),
+        )
+    } else if method == "GET" && target.contains("/info/refs") {
         // v0 advertisement, wrapped exactly as the node's info_refs does.
         let adv = upload_pack(repo, true, b"");
         let mut wrapped = pkt(b"# service=git-upload-pack\n");
@@ -293,6 +337,34 @@ fn fetch_with_helper(clone: &Path, node_url: &str) -> (bool, std::process::Outpu
     run_bounded(cmd, Duration::from_secs(30))
 }
 
+/// Run `git push` in `local` through the helper, same wiring and hard timeout as
+/// [`fetch_with_helper`]. `args` carries the push spec, e.g.
+/// `["--delete", "doomed"]`.
+fn push_with_helper(local: &Path, node_url: &str, args: &[&str]) -> (bool, std::process::Output) {
+    let helper_bin = PathBuf::from(env!("CARGO_BIN_EXE_git-remote-gitlawb"));
+    let helper_dir = helper_bin.parent().unwrap().to_path_buf();
+    let path_env = match std::env::var_os("PATH") {
+        Some(p) => {
+            let mut dirs = vec![helper_dir.clone()];
+            dirs.extend(std::env::split_paths(&p));
+            std::env::join_paths(dirs).unwrap()
+        }
+        None => helper_dir.clone().into_os_string(),
+    };
+
+    let mut cmd = Command::new("git");
+    cmd.arg("-C")
+        .arg(local)
+        .arg("push")
+        .arg("origin")
+        .args(args)
+        .env("PATH", path_env)
+        .env("LC_ALL", "C")
+        .env("GITLAWB_NODE", node_url)
+        .env("GITLAWB_KEY", "/nonexistent-key-for-anon-push");
+    run_bounded(cmd, Duration::from_secs(30))
+}
+
 /// A synthetic non-success `ExitStatus` used only on the unix timeout path, where
 /// `reap_group` has already consumed the child and the later `wait` returns ECHILD.
 /// The timeout branch already reports `completed == false`, so the exact status is
@@ -1242,3 +1314,77 @@ fn run_bounded_bounds_join_when_leader_exits_leaving_a_pipe_holder() {
          held pipes do not stall the joins)"
     );
 }
+
+/// #369 end-to-end: a real `git push --delete` through the helper completes.
+/// The receive-pack request for a delete-only push is commands + flush with NO
+/// pack, and git holds its write pipe open for the report — so a helper that
+/// reads stdin to EOF deadlocks against it. The shim pipes the POST to a real
+/// `git receive-pack --stateless-rpc`, so the branch actually has to be deleted
+/// server-side for the assertions to pass.
+#[test]
+fn real_git_push_delete_completes() {
+    let dir = tempfile::tempdir().unwrap();
+    let server = dir.path().join("server.git");
+    let local = dir.path().join("local");
+
+    // A bare repo holding the doomed branch, plus a live one.
+    git(
+        dir.path(),
+        &[
+            "init",
+            "--bare",
+            server.to_str().unwrap(),
+            "--initial-branch=main",
+        ],
+    );
+    let work = dir.path().join("work");
+    git(
+        dir.path(),
+        &["init", work.to_str().unwrap(), "--initial-branch=main"],
+    );
+    git(&work, &["config", "user.email", "t@t"]);
+    git(&work, &["config", "user.name", "t"]);
+    std::fs::write(work.join("f"), "x").unwrap();
+    git(&work, &["add", "f"]);
+    git(&work, &["commit", "-m", "c"]);
+    git(&work, &["branch", "doomed"]);
+    git(&work, &["push", server.to_str().unwrap(), "main", "doomed"]);
+
+    // The pusher: a local repo whose origin is the gitlawb remote pointing at
+    // the shim. Nothing needs to be fetched first; git takes the old-oid from
+    // the receive-pack advertisement.
+    git(
+        dir.path(),
+        &["init", local.to_str().unwrap(), "--initial-branch=main"],
+    );
+    git(
+        &local,
+        &["remote", "add", "origin", "gitlawb://did:key:z6MkTest/repo"],
+    );
+
+    let shim = start_shim(server.clone(), ShimMode::Normal);
+    let (completed, out) = push_with_helper(&local, &shim.base_url, &["--delete", "doomed"]);
+    let posts = shim.posts.load(Ordering::SeqCst);
+
+    assert!(
+        completed,
+        "git push --delete did not complete within the timeout (deadlock signature). stderr:\n{}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    assert!(
+        out.status.success(),
+        "git push --delete failed. stderr:\n{}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    assert_eq!(posts, 1, "a delete-only push is exactly one POST");
+    let gone = Command::new("git")
+        .arg("-C")
+        .arg(&server)
+        .args(["rev-parse", "--verify", "--quiet", "refs/heads/doomed"])
+        .output()
+        .unwrap();
+    assert!(
+        !gone.status.success(),
+        "refs/heads/doomed must be deleted in the server repo"
+    );
+}

crates/gitlawb-attest/src/attestation.rs

@@ -105,16 +105,30 @@ impl Attestation {
         let bytes = canonical_signing_bytes(&self.type_, &self.payload, &self.cert_hash)?;
 
         let vk = verifying_key_from_did_key(&self.signer)?;
+        self.verify_sig_with_key(&vk, &bytes)?;
+
+        Ok(vk)
+    }
+
+    /// The signature check itself, against a key the caller supplies.
+    ///
+    /// Split out so the STRICTNESS of the check stays provable on its own.
+    /// `verifying_key_from_did_key` now refuses a small-order key, so a weak
+    /// signer can no longer reach this line through `verify_signature`. Without
+    /// this seam there would be nothing left that fails when `verify_strict` is
+    /// downgraded to the non-strict `verify`, and that regression would land
+    /// silently. Check order in `verify_signature` is unchanged.
+    fn verify_sig_with_key(&self, vk: &VerifyingKey, bytes: &[u8]) -> Result<()> {
         let sig_bytes: [u8; 64] = B64U
             .decode(&self.sig)
             .map_err(|e| Error::Signature(format!("base64url: {e}")))?
             .try_into()
             .map_err(|_| Error::Signature("signature must be 64 bytes".to_string()))?;
         let sig = Signature::from_bytes(&sig_bytes);
-        vk.verify_strict(&bytes, &sig)
+        vk.verify_strict(bytes, &sig)
             .map_err(|e| Error::Signature(format!("ed25519: {e}")))?;
 
-        Ok(vk)
+        Ok(())
     }
 
     /// Reparse `payload` as `P`. Errors if the type discriminator does not
@@ -181,7 +195,7 @@ fn canonical_signing_bytes(
     Ok(out)
 }
 
-fn did_key_from_verifying_key(key: &VerifyingKey) -> String {
+pub(crate) fn did_key_from_verifying_key(key: &VerifyingKey) -> String {
     let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
     buf.extend_from_slice(&ED25519_MULTICODEC);
     buf.extend_from_slice(&key.to_bytes());
@@ -202,6 +216,19 @@ fn verifying_key_from_did_key(did: &str) -> Result<VerifyingKey> {
             "did:key must use base58btc (z-prefix): {did}"
         )));
     }
+    // Refuse an oversized id before decoding. base58 decoding is quadratic in
+    // its input and `signer` comes off an attacker-supplied attestation, so a
+    // short request could otherwise buy a large decode. An ed25519 did:key
+    // method-id is a fixed 48 characters, so this bound is slack rather than a
+    // behavior change, and it only helps ahead of the decode. Mirrors the same
+    // cap in gitlawb-core's Did::to_verifying_key, which this crate cannot call
+    // (gitlawb-core is a dev-dependency here).
+    const MAX_METHOD_ID_LEN: usize = 64;
+    if method_id.len() > MAX_METHOD_ID_LEN {
+        return Err(Error::Did(
+            "did:key method-specific id too long".to_string(),
+        ));
+    }
     let (base, bytes) =
         multibase::decode(method_id).map_err(|e| Error::Did(format!("multibase: {e}")))?;
     if base != multibase::Base::Base58Btc {
@@ -217,8 +244,20 @@ fn verifying_key_from_did_key(did: &str) -> Result<VerifyingKey> {
     let key_bytes: [u8; 32] = bytes[ED25519_MULTICODEC.len()..]
         .try_into()
         .expect("length checked above");
-    VerifyingKey::from_bytes(&key_bytes)
-        .map_err(|e| Error::Did(format!("invalid ed25519 key: {e}")))
+    let key = VerifyingKey::from_bytes(&key_bytes)
+        .map_err(|e| Error::Did(format!("invalid ed25519 key: {e}")))?;
+
+    // `from_bytes` only decompresses, so it accepts a small-order point. This
+    // crate parses did:key itself rather than going through gitlawb-core's
+    // `Did`, and it cannot go through it (gitlawb-core is a dev-dependency
+    // here), so the rejection is mirrored rather than inherited. Signature
+    // verification is already strict, so this is defense in depth against a
+    // future consumer of this parser that does not verify strictly.
+    if key.is_weak() {
+        return Err(Error::Did("small-order ed25519 key".to_string()));
+    }
+
+    Ok(key)
 }
 
 #[cfg(test)]
@@ -559,6 +598,111 @@ mod tests {
     /// weak (small-order) public key satisfies the verification equation
     /// but must be rejected. The identity point is such a key: with R the
     /// identity and S = 0, [S]B - [k]A is the identity for any message.
+    /// gitlawb-attest parses did:key itself and never routes through
+    /// gitlawb-core's `Did`, which it cannot: gitlawb-core is a dev-dependency
+    /// here. So the choke-point rejection has to be mirrored in this parser or
+    /// this crate keeps handing out keys the rest of the system rejects.
+    #[test]
+    fn verifying_key_from_did_key_rejects_a_small_order_key() {
+        let mut weak = [0u8; 32];
+        weak[0] = 1; // compressed identity point
+        let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
+        buf.extend_from_slice(&ED25519_MULTICODEC);
+        buf.extend_from_slice(&weak);
+        let did = format!(
+            "did:key:{}",
+            multibase::encode(multibase::Base::Base58Btc, &buf)
+        );
+
+        let err =
+            verifying_key_from_did_key(&did).expect_err("a small-order did:key must not resolve");
+        match err {
+            Error::Did(msg) => assert!(
+                msg.contains("small-order"),
+                "rejection must name the small-order key, got: {msg}"
+            ),
+            other => panic!("expected Error::Did, got {other:?}"),
+        }
+    }
+
+    /// base58 decoding is quadratic in its input and `signer` is attacker
+    /// controlled, so an oversized method-id must be refused BEFORE the decode
+    /// or a hostile attestation buys a large decode for a short request. The
+    /// assertion is on the length error specifically: a multibase error here
+    /// would mean the cap ran too late to matter.
+    #[test]
+    fn verifying_key_from_did_key_refuses_an_oversized_method_id_before_decoding() {
+        let oversized = format!("did:key:z{}", "1".repeat(65_536));
+        let err = verifying_key_from_did_key(&oversized)
+            .expect_err("an oversized method-id must be refused");
+        match err {
+            Error::Did(msg) => assert!(
+                msg.contains("too long"),
+                "must fail on the length cap, not after decoding: {msg}"
+            ),
+            other => panic!("expected Error::Did, got {other:?}"),
+        }
+    }
+
+    /// Strictness regression guard. The parser now refuses a small-order key,
+    /// so `verify_signature` can no longer carry a weak signer down to the
+    /// signature check; this drives that check directly to prove it is still
+    /// STRICT. Downgrading `verify_strict` to `verify` makes this go red,
+    /// which nothing else in the suite would catch.
+    #[test]
+    fn verify_sig_with_key_is_strict_about_a_weak_key() {
+        let mut weak_key_bytes = [0u8; 32];
+        weak_key_bytes[0] = 1; // compressed identity point
+        let weak_vk = VerifyingKey::from_bytes(&weak_key_bytes).unwrap();
+        assert!(weak_vk.is_weak());
+
+        let cert_hash = sample_cert_hash();
+        let mut att = dummy_attestation(&SigningKey::generate(&mut OsRng), cert_hash);
+        // R = identity, S = 0: satisfies the non-strict verification equation
+        // for any message under a small-order key.
+        let mut forged = [0u8; 64];
+        forged[0] = 1;
+        att.sig = B64U.encode(forged);
+
+        let bytes = canonical_signing_bytes(&att.type_, &att.payload, &att.cert_hash).expect("jcs");
+        let err = att
+            .verify_sig_with_key(&weak_vk, &bytes)
+            .expect_err("strict verification must reject a small-order key");
+        assert!(
+            matches!(err, Error::Signature(_)),
+            "expected a signature error, got {err:?}"
+        );
+    }
+
+    /// Accept control for the seam: a genuine signature still verifies through
+    /// the same helper, so the guard above is not simply rejecting everything.
+    #[test]
+    fn verify_sig_with_key_accepts_a_genuine_signature() {
+        let cert_hash = sample_cert_hash();
+        let sk = SigningKey::generate(&mut OsRng);
+        let att = dummy_attestation(&sk, cert_hash);
+        let bytes = canonical_signing_bytes(&att.type_, &att.payload, &att.cert_hash).expect("jcs");
+        att.verify_sig_with_key(&sk.verifying_key(), &bytes)
+            .expect("a real signature must verify");
+    }
+
+    /// Control for the guard above: a real did:key must still resolve.
+    #[test]
+    fn verifying_key_from_did_key_still_accepts_a_real_key() {
+        let sk = SigningKey::from_bytes(&[3u8; 32]);
+        let vk = sk.verifying_key();
+        let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
+        buf.extend_from_slice(&ED25519_MULTICODEC);
+        buf.extend_from_slice(&vk.to_bytes());
+        let did = format!(
+            "did:key:{}",
+            multibase::encode(multibase::Base::Base58Btc, &buf)
+        );
+
+        let got = verifying_key_from_did_key(&did).expect("a real did:key must resolve");
+        assert_eq!(got.to_bytes(), vk.to_bytes());
+    }
+
     #[test]
     fn verify_rejects_weak_key_signature() {
         let mut weak_key_bytes = [0u8; 32];
@@ -572,7 +716,13 @@ mod tests {
         let forged_sig = B64U.encode(forged);
 
         // Build an attestation with the weak key as signer and the forged
-        // signature. The weak-key check happens at verify time.
+        // signature. Rejection now happens at DID RESOLUTION rather than at
+        // verify time: `verifying_key_from_did_key` refuses a small-order key
+        // before `verify_strict` is reached, so the observed error is
+        // `Error::Did`, not `Error::Signature`. `verify_strict` remains the
+        // second layer for malleability cases that do not involve a weak
+        // public key (a small-order R under an honest key), which this fixture
+        // cannot construct and therefore no longer covers.
         let mut att = dummy_attestation(&SigningKey::generate(&mut OsRng), cert_hash);
         let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
         buf.extend_from_slice(&ED25519_MULTICODEC);
@@ -584,9 +734,12 @@ mod tests {
         att.sig = forged_sig;
 
         let err = att.verify_signature(cert_hash).unwrap_err();
-        assert!(
-            matches!(err, Error::Signature(_)),
-            "signature under a weak (small-order) public key must be rejected"
-        );
+        match err {
+            Error::Did(msg) => assert!(
+                msg.contains("small-order"),
+                "weak signer must be refused as a small-order key, got: {msg}"
+            ),
+            other => panic!("expected Error::Did for a small-order signer, got {other:?}"),
+        }
     }
 }

crates/gitlawb-attest/src/verifier.rs

@@ -121,7 +121,12 @@ impl Registry {
         attestation: &Attestation,
         expected_cert_hash: [u8; 32],
     ) -> Result<VerifiedAttestation> {
-        attestation.verify_signature(expected_cert_hash)?;
+        // The key that actually verified is the trust anchor for the signer a
+        // consumer sees. `verify_signature` recovers it from the artifact's
+        // `signer` field and rejects a field that does not match the signing
+        // key, so this is the canonical DID of the key that signed — never a
+        // raw artifact string that could disagree with it.
+        let verified_key = attestation.verify_signature(expected_cert_hash)?;
 
         let fully = match self.by_type.get(attestation.type_.as_str()) {
             Some(v) => {
@@ -138,7 +143,7 @@ impl Registry {
 
         Ok(VerifiedAttestation {
             type_: attestation.type_.clone(),
-            signer: attestation.signer.clone(),
+            signer: crate::attestation::did_key_from_verifying_key(&verified_key),
             cert_hash: attestation.cert_hash.clone(),
             fully_verified: fully,
         })
@@ -171,7 +176,7 @@ impl Registry {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::attestation::{Attestation, AttestationPayload};
+    use crate::attestation::{did_key_from_verifying_key, Attestation, AttestationPayload};
     use ed25519_dalek::SigningKey;
     use rand::rngs::OsRng;
     use serde::{Deserialize, Serialize};
@@ -374,4 +379,52 @@ mod tests {
         let err = reg.verify(&att, cert_hash).unwrap_err();
         assert!(matches!(err, Error::Payload(_)));
     }
+
+    /// The signer a consumer sees must be the canonical DID of the key that
+    /// actually verified, never a raw artifact string that could disagree.
+    /// `verify_signature` derives the key from the artifact's `signer` field
+    /// and the parser is canonical (base58btc, exact length, ed25519
+    /// multicodec), so a forged field fails verification outright: the
+    /// must-not here is that no `VerifiedAttestation` ever carries a signer
+    /// that did not verify.
+    #[test]
+    fn verified_signer_is_anchored_to_the_key_that_verified() {
+        let signer = fresh();
+        let other = fresh();
+        assert_ne!(
+            signer.verifying_key().to_bytes(),
+            other.verifying_key().to_bytes(),
+            "fixture precondition: distinct signing keys"
+        );
+
+        let cert_hash = sample_hash();
+        let reg = Registry::new();
+
+        // Control: an honest artifact reports the signer's canonical DID, and
+        // it agrees with the artifact field.
+        let att = signed_demo(&signer, cert_hash, "ok");
+        let v = reg.verify(&att, cert_hash).unwrap();
+        let expected = did_key_from_verifying_key(&signer.verifying_key());
+        assert_eq!(v.signer, expected, "signer must be the verified key's DID");
+        assert_eq!(v.signer, att.signer, "honest artifact: field and key agree");
+
+        // Must-not, both directions: a signer field naming a DIFFERENT key
+        // than the one that signed must fail verification, so the artifact
+        // string can never redirect the reported signer.
+        let mut forged = signed_demo(&signer, cert_hash, "ok");
+        forged.signer = did_key_from_verifying_key(&other.verifying_key());
+        let err = reg.verify(&forged, cert_hash).unwrap_err();
+        assert!(
+            matches!(err, Error::Signature(_)),
+            "a signer field that does not match the signing key must fail, got {err:?}"
+        );
+
+        let mut forged_rev = signed_demo(&other, cert_hash, "ok");
+        forged_rev.signer = did_key_from_verifying_key(&signer.verifying_key());
+        let err_rev = reg.verify(&forged_rev, cert_hash).unwrap_err();
+        assert!(
+            matches!(err_rev, Error::Signature(_)),
+            "mismatched signer field must fail verification, got {err_rev:?}"
+        );
+    }
 }

crates/gitlawb-core/src/did.rs

@@ -71,7 +71,8 @@ impl Did {
 
     /// Resolve the Ed25519 verifying key from a `did:key`.
     ///
-    /// Returns `Err` if the DID is not a `did:key` or the key bytes are invalid.
+    /// Returns `Err` if the DID is not a `did:key`, the key bytes are malformed,
+    /// or the key is a small-order (weak) point.
     pub fn to_verifying_key(&self) -> Result<VerifyingKey> {
         if !self.is_did_key() {
             return Err(Error::InvalidDid(format!(
@@ -106,7 +107,25 @@ impl Did {
             .try_into()
             .map_err(|_| Error::InvalidDid("ed25519 key must be 32 bytes".to_string()))?;
 
-        VerifyingKey::from_bytes(&key_bytes).map_err(|e| Error::InvalidDid(e.to_string()))
+        let key =
+            VerifyingKey::from_bytes(&key_bytes).map_err(|e| Error::InvalidDid(e.to_string()))?;
+
+        // `from_bytes` only decompresses, so it accepts a small-order point.
+        // Such a key satisfies the verification equation for any message, and
+        // every X25519 shared secret derived from it is the all-zero key: the
+        // order-1 and order-2 points convert to the all-zero Montgomery u
+        // directly, and the order-4 and order-8 points are annihilated by the
+        // scalar clamping instead. `is_weak` covers the whole torsion set.
+        // Mixed-order points are correctly NOT rejected, since clamping clears
+        // the cofactor component. Rejecting
+        // at resolution is what makes this the choke point: every consumer that
+        // resolves a DID through here inherits the rejection, and a recipient
+        // that cannot resolve already fails closed downstream.
+        if key.is_weak() {
+            return Err(Error::InvalidDid("small-order ed25519 key".to_string()));
+        }
+
+        Ok(key)
     }
 
     /// Return the full DID string as a `&str`.
@@ -369,4 +388,36 @@ mod tests {
         );
         did.to_verifying_key().expect("a real did:key must resolve");
     }
+
+    /// A `did:key` can encode a small-order (weak) Ed25519 point. Such a key
+    /// satisfies the verification equation for any message and, converted to
+    /// Montgomery form for X25519, yields the all-zero shared secret, so an
+    /// envelope sealed to it is decryptable by anyone. Resolution is the choke
+    /// point every `Did`-based consumer shares, so it fails closed here.
+    #[test]
+    fn to_verifying_key_rejects_a_small_order_key() {
+        // The compressed identity point, the canonical small-order key.
+        let mut weak = [0u8; 32];
+        weak[0] = 1;
+        let mut prefixed = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
+        prefixed.extend_from_slice(ED25519_MULTICODEC);
+        prefixed.extend_from_slice(&weak);
+        let did: Did = format!(
+            "did:key:{}",
+            multibase::encode(multibase::Base::Base58Btc, &prefixed)
+        )
+        .parse()
+        .expect("a small-order did:key is still well-formed");
+
+        let err = did
+            .to_verifying_key()
+            .expect_err("a small-order did:key must not resolve");
+        match err {
+            Error::InvalidDid(msg) => assert!(
+                msg.contains("small-order"),
+                "rejection must name the small-order key, got: {msg}"
+            ),
+            other => panic!("expected Error::InvalidDid, got {other:?}"),
+        }
+    }
 }

crates/gitlawb-core/src/encrypt.rs

@@ -11,6 +11,22 @@ use zeroize::Zeroizing;
 /// X25519 public key (Montgomery u) for an Ed25519 verifying key.
 fn x25519_public(vk: &VerifyingKey) -> Result<[u8; 32]> {
     use curve25519_dalek::edwards::CompressedEdwardsY;
+
+    // Every X25519 shared secret derived from a small-order point is the
+    // all-zero key: order-1 and order-2 convert to the all-zero Montgomery u
+    // directly, order-4 and order-8 are annihilated by the scalar clamping in
+    // x25519_secret_from_seed. Either way the per-recipient wrap could be
+    // rebuilt by anyone. Resolution already refuses such a key (see
+    // Did::to_verifying_key); this guard covers the SEAL side on its own terms
+    // for a caller that obtained the key some other way. The open side
+    // (open_blob's attacker-supplied `eph`) skips any entry whose exchange with
+    // this reader yields the all-zero shared secret
+    // (`yields_all_zero_shared_secret`), regardless of whether the bytes decode
+    // to an Edwards point.
+    if vk.is_weak() {
+        return Err(anyhow::anyhow!("verifying key is a small-order point"));
+    }
+
     let edwards = CompressedEdwardsY::from_slice(vk.as_bytes())
         .ok()
         .and_then(|c| c.decompress())
@@ -18,6 +34,26 @@ fn x25519_public(vk: &VerifyingKey) -> Result<[u8; 32]> {
     Ok(edwards.to_montgomery().to_bytes())
 }
 
+/// True when the X25519 exchange between an attacker-supplied `u` and this
+/// reader's scalar yields the all-zero shared secret.
+///
+/// Asked of the RESULT, not of the encoding, and that distinction is the whole
+/// guard. The previous version decompressed `u` to an Edwards point and asked
+/// `is_small_order`, which reports "safe" for any low-order encoding that does
+/// not decompress at all. Measured across the seven standard low-order
+/// encodings, six were caught and `u = p - 1` was not: it fails to decompress,
+/// so the check returned false, and the exchange is still the all-zero secret.
+/// An entry built on it unwraps for every reader.
+///
+/// Enumerating encodings cannot be exhaustive, because the attack depends on the
+/// shared secret rather than on the bytes that produced it, and twist and
+/// non-canonical inputs keep arriving. Asking the result needs no list.
+fn yields_all_zero_shared_secret(u: &[u8; 32], scalar: &[u8; 32]) -> bool {
+    use curve25519_dalek::montgomery::MontgomeryPoint;
+
+    MontgomeryPoint(*u).mul_clamped(*scalar).to_bytes() == [0u8; 32]
+}
+
 /// X25519 secret scalar for an Ed25519 seed (SHA-512 of seed, lower 32, clamped).
 /// Returns the scalar wrapped in `Zeroizing`, and scrubs the intermediate
 /// SHA-512 digest, so no copy of this secret material lingers in freed memory.
@@ -49,6 +85,13 @@ use serde::{Deserialize, Serialize};
 const MAGIC: &[u8] = b"GLENC";
 const VERSION: u8 = 2;
 
+/// Upper bound on the blinded recipient list. The envelope author controls
+/// this count and `open_blob` pays one X25519 exchange per entry before it can
+/// answer "not a recipient", so the count has to be capped rather than
+/// optimized (#419). Legitimate envelopes carry a handful of authorized
+/// readers, so 256 is far above real use.
+const MAX_RECIPIENTS: usize = 256;
+
 #[derive(Serialize, Deserialize)]
 struct Recipient {
     eph: String,   // base64 ephemeral x25519 pubkey (32B)
@@ -68,6 +111,14 @@ pub fn seal_blob(plaintext: &[u8], recipients: &[VerifyingKey]) -> Result<Vec<u8
     if recipients.is_empty() {
         return Err(anyhow::anyhow!("seal_blob: no recipients"));
     }
+    // Same bound open_blob enforces: an envelope over the cap could never be
+    // opened, so refuse to seal it (#419).
+    if recipients.len() > MAX_RECIPIENTS {
+        return Err(anyhow::anyhow!(
+            "seal_blob: {} recipients, over the {MAX_RECIPIENTS} cap",
+            recipients.len()
+        ));
+    }
     let mut content_key = [0u8; 32];
     OsRng.fill_bytes(&mut content_key);
     let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key)
@@ -126,9 +177,20 @@ pub fn open_blob(envelope: &[u8], keypair: &Keypair) -> Result<Vec<u8>> {
     let header: Header =
         serde_json::from_slice(envelope.get(p..p + hlen).context("truncated header")?)
             .context("decode header")?;
+    // Reject before the recipient scan: every entry below is an X25519
+    // exchange, and a non-recipient would run the whole list (#419).
+    if header.recipients.len() > MAX_RECIPIENTS {
+        return Err(anyhow::anyhow!(
+            "envelope carries {} recipients, over the {MAX_RECIPIENTS} cap",
+            header.recipients.len()
+        ));
+    }
     let body = &envelope[p + hlen..];
 
-    let my_x = XSecret::from(*x25519_secret_from_seed(&keypair.to_seed()));
+    // The raw scalar is kept alongside the box secret so the exchange can be
+    // tested BEFORE a box is built from an attacker-supplied ephemeral.
+    let my_x_scalar = x25519_secret_from_seed(&keypair.to_seed());
+    let my_x = XSecret::from(*my_x_scalar);
 
     // Identities are blinded: no entry says which recipient it belongs to, so
     // try each one. The ChaChaBox AEAD tag authenticates, so exactly the
@@ -140,7 +202,12 @@ pub fn open_blob(envelope: &[u8], keypair: &Keypair) -> Result<Vec<u8>> {
             .ok()
             .and_then(|b| <[u8; 32]>::try_from(b.as_slice()).ok())
         {
-            Some(b) => XPublic::from(b),
+            // An ephemeral whose exchange with this reader is the all-zero
+            // shared secret would unwrap for anyone, so the entry is skipped.
+            // Tested on the exchange itself: an encoding-shaped check misses
+            // every low-order input that does not decompress to Edwards.
+            Some(b) if !yields_all_zero_shared_secret(&b, &my_x_scalar) => XPublic::from(b),
+            Some(_) => continue,
             None => continue,
         };
         // from_slice panics on a wrong length, and the envelope is attacker
@@ -293,4 +360,436 @@ mod tests {
         header["nonce"] = bad_nonce;
         assert!(open_blob(&reframe(&header), &reader).is_err());
     }
+
+    #[test]
+    fn over_cap_recipient_list_is_rejected_before_the_scan() {
+        // #419: the envelope author controls the recipient count and each entry
+        // costs an X25519 exchange, so the list is capped. Reframe a valid
+        // envelope with MAX_RECIPIENTS + 1 junk entries.
+        let reader = Keypair::generate();
+        let env = seal_blob(b"private blob contents", &[reader.verifying_key()]).unwrap();
+
+        let mut p = MAGIC.len() + 1;
+        let hlen = u32::from_le_bytes(env[p..p + 4].try_into().unwrap()) as usize;
+        p += 4;
+        let header_bytes = &env[p..p + hlen];
+        let body = &env[p + hlen..];
+
+        let mut header: serde_json::Value = serde_json::from_slice(header_bytes).unwrap();
+        let junk = serde_json::json!({
+            "eph": B64.encode([0u8; 32]),
+            "nonce": B64.encode([0u8; 24]),
+            "wrap": B64.encode([0u8; 48]),
+        });
+        header["recipients"] = serde_json::Value::Array(vec![junk.clone(); MAX_RECIPIENTS + 1]);
+
+        let hj = serde_json::to_vec(&header).unwrap();
+        let mut fat = Vec::new();
+        fat.extend_from_slice(MAGIC);
+        fat.push(VERSION);
+        fat.extend_from_slice(&(hj.len() as u32).to_le_bytes());
+        fat.extend_from_slice(&hj);
+        fat.extend_from_slice(body);
+
+        let err = open_blob(&fat, &reader).unwrap_err();
+        assert!(
+            err.to_string().contains("recipients"),
+            "expected the recipient-cap error, got: {err}"
+        );
+
+        // Exactly at the cap the envelope is still processed end to end.
+        header["recipients"] = serde_json::Value::Array(vec![junk; MAX_RECIPIENTS]);
+        let hj = serde_json::to_vec(&header).unwrap();
+        let mut at_cap = Vec::new();
+        at_cap.extend_from_slice(MAGIC);
+        at_cap.push(VERSION);
+        at_cap.extend_from_slice(&(hj.len() as u32).to_le_bytes());
+        at_cap.extend_from_slice(&hj);
+        at_cap.extend_from_slice(body);
+        let err = open_blob(&at_cap, &reader).unwrap_err();
+        assert!(
+            !err.to_string().contains("over the"),
+            "at-cap envelope must reach the scan, got: {err}"
+        );
+    }
+
+    #[test]
+    fn seal_refuses_a_recipient_list_over_the_cap() {
+        // An envelope over the cap can never be opened, so seal must reject it
+        // instead of minting one.
+        let keys: Vec<VerifyingKey> = (0..MAX_RECIPIENTS + 1)
+            .map(|_| Keypair::generate().verifying_key())
+            .collect();
+        let err = seal_blob(b"blob", &keys).unwrap_err();
+        assert!(
+            err.to_string().contains("recipients"),
+            "expected the recipient-cap error, got: {err}"
+        );
+    }
+
+    /// Every standard low-order X25519 encoding must be detected by
+    /// `yields_all_zero_shared_secret`, including encodings that do not
+    /// decompress to an Edwards point (notably `u = p - 1`). The open side
+    /// rejects on the exchange result, not on decode shape, because an
+    /// encoding-shaped check misses non-decompressing low-order inputs while
+    /// still yielding the all-zero shared secret.
+    #[test]
+    fn all_zero_shared_secret_is_detected_for_every_standard_low_order_encoding() {
+        // The seven standard X25519 low-order encodings, driven as a set rather
+        // than as the two that happen to decompress. The encoding-shaped check
+        // this replaced reported `p - 1` as safe, and its exchange is all-zero.
+        let mut one = [0u8; 32];
+        one[0] = 1;
+        let hex = |h: &str| -> [u8; 32] {
+            let mut out = [0u8; 32];
+            for i in 0..32 {
+                out[i] = u8::from_str_radix(&h[i * 2..i * 2 + 2], 16).unwrap();
+            }
+            out
+        };
+        let vectors = [
+            ("u=0", [0u8; 32]),
+            ("u=1", one),
+            (
+                "order8-a",
+                hex("e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800"),
+            ),
+            (
+                "order8-b",
+                hex("5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157"),
+            ),
+            (
+                "p-1",
+                hex("ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
+            ),
+            (
+                "p",
+                hex("edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
+            ),
+            (
+                "p+1",
+                hex("eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"),
+            ),
+        ];
+        let kp = Keypair::generate();
+        let scalar = x25519_secret_from_seed(&kp.to_seed());
+        for (name, u) in vectors {
+            assert!(
+                yields_all_zero_shared_secret(&u, &scalar),
+                "{name} is a low-order encoding and must be detected"
+            );
+        }
+
+        // And the other direction, or a guard that returned true always would
+        // pass everything above while making the envelope unopenable.
+        let real_u = x25519_public(&kp.verifying_key()).unwrap();
+        assert!(
+            !yields_all_zero_shared_secret(&real_u, &scalar),
+            "a real key must not be treated as low-order"
+        );
+    }
+
+    /// The open side must skip an entry whose header-supplied `eph` is a
+    /// low-order point: such an entry forces the all-zero shared secret and
+    /// would unwrap for any reader. A poisoned entry among honest ones must
+    /// not DoS the envelope — the honest entry still opens.
+    #[test]
+    fn open_blob_skips_a_low_order_ephemeral_and_still_opens_honest_entry() {
+        use curve25519_dalek::montgomery::MontgomeryPoint;
+        let reader = Keypair::generate();
+        let env = seal_blob(b"private blob contents", &[reader.verifying_key()]).unwrap();
+
+        // Split the envelope framing into header JSON and body.
+        let mut p = MAGIC.len() + 1;
+        let hlen = u32::from_le_bytes(env[p..p + 4].try_into().unwrap()) as usize;
+        p += 4;
+        let header_bytes = &env[p..p + hlen];
+        let body = &env[p + hlen..];
+
+        // A low-order Montgomery u (u = 0) encoded as the entry's eph.
+        let low_order_u = MontgomeryPoint([0u8; 32]).to_bytes();
+        let poisoned = serde_json::json!({
+            "eph": B64.encode(low_order_u),
+            "nonce": B64.encode([0u8; 24]),
+            "wrap": B64.encode([0u8; 32]),
+        });
+
+        let reframe = |header: &serde_json::Value| -> Vec<u8> {
+            let hj = serde_json::to_vec(header).unwrap();
+            let mut out = Vec::new();
+            out.extend_from_slice(MAGIC);
+            out.push(VERSION);
+            out.extend_from_slice(&(hj.len() as u32).to_le_bytes());
+            out.extend_from_slice(&hj);
+            out.extend_from_slice(body);
+            out
+        };
+
+        let mut header: serde_json::Value = serde_json::from_slice(header_bytes).unwrap();
+        // Prepend the poisoned entry. The reader's honest entry must still
+        // unwrap, so the envelope opens despite the low-order entry.
+        let recipients = header["recipients"].as_array_mut().unwrap();
+        recipients.insert(0, poisoned);
+        assert_eq!(
+            open_blob(&reframe(&header), &reader).unwrap(),
+            b"private blob contents",
+            "the honest entry must still open despite a low-order eph entry"
+        );
+    }
+
+    /// Must-not for the open-side guard: an envelope whose ONLY entry is built
+    /// on a low-order ephemeral must not open for any reader. Without the
+    /// guard the all-zero shared secret unwraps for everyone, so the attacker
+    /// controls the plaintext and the envelope's confidentiality is void.
+    #[test]
+    fn open_blob_rejects_a_poisoned_only_envelope() {
+        use chacha20poly1305::{aead::Aead, KeyInit, XChaCha20Poly1305, XNonce};
+        use crypto_box::aead::AeadCore;
+        use curve25519_dalek::montgomery::MontgomeryPoint;
+
+        // Build a poisoned envelope from scratch: one recipient entry whose
+        // eph is the low-order u = 0. The wrap is the encryption of a content
+        // key under the all-zero shared secret, so without the guard any
+        // reader's ChaChaBox against u = 0 decrypts it.
+        let mut content_key: [u8; 32] = Default::default();
+        OsRng.fill_bytes(&mut content_key);
+        let attacker_x = XSecret::generate(&mut OsRng);
+        let zero_box = ChaChaBox::new(&XPublic::from(<[u8; 32]>::default()), &attacker_x);
+        let nonce = ChaChaBox::generate_nonce(&mut OsRng);
+        let wrap = zero_box.encrypt(&nonce, &content_key[..]).unwrap();
+
+        let mut body_nonce: [u8; 24] = Default::default();
+        OsRng.fill_bytes(&mut body_nonce);
+        let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
+        let body = body_cipher
+            .encrypt(
+                XNonce::from_slice(&body_nonce),
+                b"attacker-chosen plaintext".as_slice(),
+            )
+            .unwrap();
+
+        let header = serde_json::json!({
+            "alg": "xchacha20poly1305",
+            "nonce": B64.encode(body_nonce),
+            "recipients": [{
+                "eph": B64.encode(MontgomeryPoint([0u8; 32]).to_bytes()),
+                "nonce": B64.encode(nonce),
+                "wrap": B64.encode(wrap),
+            }],
+        });
+        let header_json = serde_json::to_vec(&header).unwrap();
+        let mut env = Vec::new();
+        env.extend_from_slice(MAGIC);
+        env.push(VERSION);
+        env.extend_from_slice(&(header_json.len() as u32).to_le_bytes());
+        env.extend_from_slice(&header_json);
+        env.extend_from_slice(&body);
+
+        let reader = Keypair::generate();
+        let err = open_blob(&env, &reader).unwrap_err();
+        assert!(
+            err.to_string().contains("not a recipient"),
+            "a poisoned-only envelope must not open for anyone, got: {err}"
+        );
+    }
+
+    /// The same must-not, driven with the low-order encoding that does NOT map
+    /// to an Edwards point.
+    ///
+    /// This is the case an encoding-shaped guard cannot see. `u = p - 1` is a
+    /// legal X25519 input whose exchange is the all-zero secret for any scalar,
+    /// and `MontgomeryPoint::to_edwards` returns None for it, so a check written
+    /// as "decompress, then ask is_small_order" reports it as safe. Measured
+    /// across the seven standard low-order encodings: six are caught that way
+    /// and this one is not.
+    ///
+    /// Found by a cross-family review of the head that first added the guard,
+    /// and the comment beside that guard asserted this case was already handled
+    /// by a decode path that does not exist. That is why the fix rejects on the
+    /// RESULT of the exchange rather than on a list of encodings: the result is
+    /// what the attack actually depends on, and it needs no enumeration to be
+    /// exhaustive.
+    #[test]
+    fn open_blob_rejects_a_non_edwards_low_order_ephemeral() {
+        // No blanket `use ...::Aead` here. Two aead versions are reachable, and a
+        // blanket import silently resolved the wrap through the one open_blob does
+        // NOT decrypt with, producing a ciphertext that could never open. The test
+        // then passed with the guard, without it, and with the original pre-fix
+        // guard alike, proving nothing. Every call below names its trait.
+        use chacha20poly1305::{KeyInit, XChaCha20Poly1305, XNonce};
+        use crypto_box::aead::AeadCore;
+
+        // u = p - 1 = 2^255 - 20, little endian.
+        let mut eph = [0xffu8; 32];
+        eph[0] = 0xec;
+        eph[31] = 0x7f;
+
+        let mut content_key: [u8; 32] = Default::default();
+        OsRng.fill_bytes(&mut content_key);
+        let attacker_x = XSecret::generate(&mut OsRng);
+        let zero_box = ChaChaBox::new(&XPublic::from(<[u8; 32]>::default()), &attacker_x);
+        let nonce = ChaChaBox::generate_nonce(&mut OsRng);
+        let wrap = crypto_box::aead::Aead::encrypt(&zero_box, &nonce, &content_key[..]).unwrap();
+
+        let mut body_nonce: [u8; 24] = Default::default();
+        OsRng.fill_bytes(&mut body_nonce);
+        let body_cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
+        let body = chacha20poly1305::aead::Aead::encrypt(
+            &body_cipher,
+            XNonce::from_slice(&body_nonce),
+            b"attacker-chosen plaintext".as_slice(),
+        )
+        .unwrap();
+
+        let header = serde_json::json!({
+            "alg": "xchacha20poly1305",
+            "nonce": B64.encode(body_nonce),
+            "recipients": [{
+                "eph": B64.encode(eph),
+                "nonce": B64.encode(nonce),
+                "wrap": B64.encode(wrap),
+            }],
+        });
+        let header_json = serde_json::to_vec(&header).unwrap();
+        let mut env = Vec::new();
+        env.extend_from_slice(MAGIC);
+        env.push(VERSION);
+        env.extend_from_slice(&(header_json.len() as u32).to_le_bytes());
+        env.extend_from_slice(&header_json);
+        env.extend_from_slice(&body);
+
+        let reader = Keypair::generate();
+        let err = open_blob(&env, &reader).unwrap_err();
+        assert!(
+            err.to_string().contains("not a recipient"),
+            "an envelope whose only entry uses a non-Edwards low-order eph must not \
+             open for anyone, got: {err}"
+        );
+    }
+
+    /// The compressed identity point: a well-formed Ed25519 encoding that is
+    /// small-order, so every shared secret derived from it is all-zero.
+    fn weak_verifying_key() -> VerifyingKey {
+        let mut weak = [0u8; 32];
+        weak[0] = 1;
+        let vk = VerifyingKey::from_bytes(&weak).expect("identity point decompresses");
+        assert!(vk.is_weak(), "fixture precondition: key is small-order");
+        vk
+    }
+
+    /// A small-order recipient key converts to Montgomery u = 0, and X25519
+    /// against u = 0 is the all-zero shared secret for ANY scalar, so the
+    /// wrapping box is reconstructable with no secret at all. Reject at the
+    /// primitive so the seal side is safe regardless of how the caller
+    /// obtained the key.
+    #[test]
+    fn x25519_public_rejects_a_small_order_key() {
+        let weak_vk = weak_verifying_key();
+
+        assert!(
+            x25519_public(&weak_vk).is_err(),
+            "a small-order key must not yield an x25519 public key"
+        );
+    }
+
+    /// Control: a legitimate key still converts, and to a non-zero u.
+    #[test]
+    fn x25519_public_still_accepts_a_real_key() {
+        let kp = Keypair::generate();
+        let u = x25519_public(&kp.verifying_key()).expect("a real key must convert");
+        assert_ne!(u, [0u8; 32], "a real key must not map to the zero point");
+    }
+
+    /// The guard has to propagate: no envelope may be produced for a weak
+    /// recipient even when the DID choke point is bypassed entirely.
+    #[test]
+    fn seal_blob_refuses_a_small_order_recipient() {
+        let weak_vk = weak_verifying_key();
+
+        assert!(
+            seal_blob(b"withheld", &[weak_vk]).is_err(),
+            "sealing to a weak recipient must fail"
+        );
+
+        // And a mixed set must fail too: one weak recipient exposes the shared
+        // content key, so a partial envelope is not an acceptable outcome.
+        let honest = Keypair::generate();
+        assert!(
+            seal_blob(b"withheld", &[honest.verifying_key(), weak_vk]).is_err(),
+            "a mixed honest+weak recipient set must fail closed, not seal partially"
+        );
+    }
+
+    /// Control for the two above: the ordinary seal/open round trip is intact.
+    #[test]
+    fn legit_seal_open_round_trip_still_works() {
+        let reader = Keypair::generate();
+        let env = seal_blob(b"withheld blob", &[reader.verifying_key()]).expect("seal");
+        assert_eq!(open_blob(&env, &reader).expect("open"), b"withheld blob");
+    }
+
+    /// The defect this fix exists to close, kept as an executable regression
+    /// rather than an assertion about absence. It runs the real attack: craft a
+    /// small-order did:key, get it into a recipient set alongside an honest
+    /// reader, then rebuild the wrapping box from the all-zero shared secret
+    /// that a small-order recipient forces. If any guard regresses, this does
+    /// not merely fail, it fails printing the plaintext it recovered.
+    #[test]
+    fn attacker_cannot_recover_plaintext_via_a_weak_recipient() {
+        use crate::did::Did;
+        use std::str::FromStr;
+
+        let weak_vk = weak_verifying_key();
+
+        // Layer 1: the attacker's did:key string must not resolve at all.
+        let weak_did = Did::from_verifying_key(&weak_vk).to_string();
+        assert!(
+            Did::from_str(&weak_did)
+                .expect("still a well-formed did:key")
+                .to_verifying_key()
+                .is_err(),
+            "a small-order did:key must not resolve"
+        );
+
+        // Layer 2: even handed the key directly, sealing must refuse. One weak
+        // recipient would expose the single shared content key, so the honest
+        // reader's blob would be readable by anyone.
+        let honest = Keypair::generate();
+        let secret_plaintext = b"WITHHELD BLOB CONTENTS";
+        let envelope = match seal_blob(secret_plaintext, &[honest.verifying_key(), weak_vk]) {
+            Err(_) => return, // no envelope exists, nothing to attack
+            Ok(env) => env,
+        };
+
+        // Only reachable if a guard regressed. Run the attack and report what
+        // it got, so the failure names the actual exposure.
+        let mut p = MAGIC.len() + 1;
+        let hlen = u32::from_le_bytes(envelope[p..p + 4].try_into().unwrap()) as usize;
+        p += 4;
+        let header: serde_json::Value = serde_json::from_slice(&envelope[p..p + hlen]).unwrap();
+        let body = &envelope[p + hlen..];
+        let body_nonce = B64.decode(header["nonce"].as_str().unwrap()).unwrap();
+
+        // X25519 against u = 0 is the all-zero shared secret for any scalar, so
+        // the sealer's box is reconstructable with a key the attacker picks.
+        let zero_box = ChaChaBox::new(
+            &XPublic::from(<[u8; 32]>::default()),
+            &XSecret::generate(&mut OsRng),
+        );
+        for r in header["recipients"].as_array().unwrap() {
+            let n = B64.decode(r["nonce"].as_str().unwrap()).unwrap();
+            let w = B64.decode(r["wrap"].as_str().unwrap()).unwrap();
+            if let Ok(content_key) = zero_box.decrypt(n.as_slice().into(), w.as_slice()) {
+                let cipher = XChaCha20Poly1305::new_from_slice(&content_key).unwrap();
+                let recovered = cipher
+                    .decrypt(XNonce::from_slice(&body_nonce), body)
+                    .expect("body decrypts once the content key is out");
+                panic!(
+                    "REGRESSION: attacker recovered plaintext with no private key: {:?}",
+                    String::from_utf8_lossy(&recovered)
+                );
+            }
+        }
+        panic!("an envelope was sealed to a small-order recipient; the seal guard regressed");
+    }
 }

crates/gitlawb-core/src/http_sig.rs

@@ -122,15 +122,48 @@ impl HttpSignature {
         })
     }
 
-    /// Reject if the `created` timestamp is more than 5 minutes from now.
+    /// Reject a `created` timestamp outside the acceptance window, which is
+    /// ASYMMETRIC: up to 5 minutes into the past, but only 60 seconds into the
+    /// future.
+    ///
+    /// The two directions are two comparisons rather than one distance, because
+    /// they are not the same event. A signature that arrives late is ordinary:
+    /// clocks run slow, requests queue, and networks are not instant, so the
+    /// past side keeps the full 300-second allowance. A signature stamped ahead
+    /// of this node's clock is not ordinary, and folding both sides into an
+    /// `abs()` let a signer extend its own validity: signed at T with
+    /// `created = T + 300`, it stayed acceptable until roughly T + 600, so the
+    /// effective window was double the one this function advertises. The
+    /// forward tolerance exists only to absorb honest drift between two hosts,
+    /// which is what 60 seconds buys; it is the same allowance the gossip
+    /// path's freshness check uses for the same reason.
     pub fn check_created(&self) -> Result<()> {
+        const MAX_AGE_SECS: i64 = 300;
+        const MAX_FUTURE_SECS: i64 = 60;
+
         let now = Utc::now().timestamp();
-        let skew = (now - self.created).abs();
-        if skew > 300 {
+
+        // Saturating, not plain subtraction. `created` is parsed as an
+        // unrestricted i64 straight from the Signature-Input header, so a
+        // sender picks it: at i64::MIN the past-side subtraction overflows,
+        // which panics a debug build and wraps a release one into an absurd
+        // value that can read as acceptable. Saturating gives the answer the
+        // check wants at both extremes, since a timestamp that far away is
+        // refused by whichever side it saturates toward.
+        let age = now.saturating_sub(self.created);
+        if age > MAX_AGE_SECS {
             return Err(Error::HttpSignature(format!(
-                "clock skew too large: {skew}s (max 300s)"
+                "clock skew too large: created {age}s in the past (max {MAX_AGE_SECS}s)"
             )));
         }
+
+        let ahead = self.created.saturating_sub(now);
+        if ahead > MAX_FUTURE_SECS {
+            return Err(Error::HttpSignature(format!(
+                "clock skew too large: created {ahead}s in the future (max {MAX_FUTURE_SECS}s)"
+            )));
+        }
+
         Ok(())
     }
 
@@ -456,6 +489,75 @@ mod tests {
         assert!(sig.check_created().is_err());
     }
 
+    /// Build a parseable signature whose `created` is `offset` seconds from now
+    /// (negative for the past), so a test can pin one side of the window.
+    fn sig_created_at_offset(offset: i64) -> HttpSignature {
+        let kp = Keypair::generate();
+        let did = kp.did();
+        let created = Utc::now().timestamp() + offset;
+        let sig_input = format!(
+            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created={created}"#
+        );
+        HttpSignature::parse(&sig_input, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:").unwrap()
+    }
+
+    /// Build a signature at an ABSOLUTE `created`, so a test can drive the
+    /// extremes an offset from now cannot reach.
+    fn sig_created_absolute(created: i64) -> HttpSignature {
+        let kp = Keypair::generate();
+        let did = kp.did();
+        let sig_input = format!(
+            r#"sig1=("@method" "@path" "content-digest");keyid="{did}";alg="ed25519";created={created}"#
+        );
+        HttpSignature::parse(&sig_input, "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:").unwrap()
+    }
+
+    /// `created` is parsed as an unrestricted i64 from a header the sender
+    /// writes, so the window check has to survive both ends of the type. Before
+    /// the saturating form this panicked with "attempt to subtract with
+    /// overflow" on the past side, which is a debug-build crash any client
+    /// could trigger by sending one header value.
+    #[test]
+    fn extreme_created_values_are_refused_rather_than_overflowing() {
+        for created in [i64::MIN, i64::MIN + 1, i64::MAX - 1, i64::MAX] {
+            let err = sig_created_absolute(created)
+                .check_created()
+                .expect_err("an extreme created must be refused, not accepted");
+            let msg = err.to_string();
+            assert!(
+                msg.contains("past") || msg.contains("future"),
+                "created={created} must be refused by a named direction, got: {msg}"
+            );
+        }
+    }
+
+    #[test]
+    fn created_301s_in_past_rejected() {
+        let err = sig_created_at_offset(-301).check_created().unwrap_err();
+        assert!(err.to_string().contains("past"), "{err}");
+    }
+
+    #[test]
+    fn created_299s_in_past_accepted() {
+        assert!(sig_created_at_offset(-299).check_created().is_ok());
+    }
+
+    #[test]
+    fn created_61s_in_future_rejected() {
+        let err = sig_created_at_offset(61).check_created().unwrap_err();
+        assert!(err.to_string().contains("future"), "{err}");
+    }
+
+    #[test]
+    fn created_30s_in_future_accepted() {
+        assert!(sig_created_at_offset(30).check_created().is_ok());
+    }
+
+    #[test]
+    fn created_exactly_now_accepted() {
+        assert!(sig_created_at_offset(0).check_created().is_ok());
+    }
+
     #[test]
     fn fresh_signature_passes_clock_skew() {
         let kp = Keypair::generate();

crates/gitlawb-node/src/api/ipfs.rs

@@ -2520,7 +2520,10 @@ mod tests {
                 "/ipfs/{cid}",
                 axum::routing::get(crate::api::ipfs::get_by_cid),
             )
-            .layer(axum::middleware::from_fn(crate::auth::optional_signature))
+            .layer(axum::middleware::from_fn_with_state(
+                crate::auth::SignatureBodyLimit(crate::server::SIGNED_BODY_LIMIT),
+                crate::auth::optional_signature,
+            ))
             .with_state(state)
     }
 

crates/gitlawb-node/src/api/mod.rs

@@ -298,6 +298,573 @@ mod authz_guard {
         }
     }
 
+    /// Completeness fence over the GraphQL mutation surface: the mirror of
+    /// `every_in_scope_mutation_has_its_gate` for `graphql/mutation.rs`. Kept a
+    /// SEPARATE guard with its own table (never folded into the REST rows above):
+    /// a guard over a heterogeneous set must classify per member, and these
+    /// same-named task rows belong to the GraphQL surface, not `api/tasks.rs`.
+    ///
+    /// COMPLETENESS comes from the engine's own SDL (`schema.sdl()`), parsed as a
+    /// structured AST (#219), NOT introspection and NOT a text parse of source.
+    /// This matters: async-graphql OMITS `#[graphql(visible = false)]` fields from
+    /// introspection while leaving them executable, so an introspection-sourced fence
+    /// could be defeated by a hidden mutation. SDL includes those fields, so no
+    /// visibility flag (and, via the AST parse, no brace-in-description quirk) can hide
+    /// a live mutation. The SDL field set must equal the registered set: a new field with
+    /// no row fails (a repo-write cannot slip in unlisted); a registered name absent from
+    /// the schema fails (renamed or removed). The set is also cross-checked against
+    /// introspection, so any field present in SDL but hidden from introspection fails
+    /// named as a forbidden hidden mutation.
+    ///
+    /// The MARKER check is the only source-scraped part, and it is not the
+    /// completeness guarantee. Three honest limits, so a green check is not misread
+    /// as full authorization coverage:
+    ///   1. A present marker is not load-bearingness (the gate may not redden on a
+    ///      hostile probe: the #203 present-but-vacuous case). The adversarial tests
+    ///      in `graphql/mutation.rs` are the load-bearing layer.
+    ///   2. A present marker is not gate-correctness (it may be the wrong bucket for
+    ///      the operation's resource: a repo-write registered as signer-self would
+    ///      pass, so INV-1 review remains the defense).
+    ///   3. The marker check scrapes the comment-masked, brace-bounded resolver body;
+    ///      a `{`/`}` or a `did_matches(` inside a STRING literal is not masked, so it
+    ///      could mis-slice that body or satisfy the marker vacuously (the same
+    ///      vacuous-marker class as limit 1). Completeness is unaffected: it comes
+    ///      from the SDL AST, not from this scrape.
+    #[test]
+    fn every_graphql_mutation_has_its_gate() {
+        // (Rust snake name, schema field in camelCase, expected gate markers). The
+        // four are Bucket C signer-self: `/graphql` uses optional_signature, so each
+        // resolver must call `require_signer(ctx)?` and bind the acting DID with
+        // `did_matches(`. A repo-write would be Bucket A (`require_repo_owner(`).
+        // Same-named REST rows live in the guard above against `api/tasks.rs`.
+        let registered: &[(&str, &str, &[&str])] = &[
+            (
+                "create_task",
+                "createTask",
+                &["require_signer(ctx)?", "did_matches("],
+            ),
+            (
+                "claim_task",
+                "claimTask",
+                &["require_signer(ctx)?", "did_matches("],
+            ),
+            (
+                "complete_task",
+                "completeTask",
+                &["require_signer(ctx)?", "did_matches("],
+            ),
+            (
+                "fail_task",
+                "failTask",
+                &["require_signer(ctx)?", "did_matches("],
+            ),
+        ];
+
+        // Completeness + hidden-mutation cross-check against the REAL schema (#219),
+        // delegated to the generic `assert_mutation_fence` so the SDL sourcing and the
+        // cross-check are ALSO exercised by a synthetic hidden schema in
+        // `fence_rejects_a_hidden_mutation` (INV-21). Because the real MutationRoot has no
+        // hidden field today, that synthetic test — not a hypothetical production canary —
+        // is what turns reverting the SDL source or deleting the cross-check RED.
+        {
+            use crate::graphql::mutation::MutationRoot;
+            use crate::graphql::query::QueryRoot;
+            use crate::graphql::subscription::SubscriptionRoot;
+            let schema =
+                async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
+            let registered_camel: Vec<&str> = registered.iter().map(|(_, c, _)| *c).collect();
+            assert_mutation_fence(&schema, &registered_camel);
+        }
+
+        // Marker present (source scrape; the vacuity limit, backstopped by the
+        // adversarial tests): each resolver body carries every required gate marker.
+        let masked = mask_comments(include_str!("../graphql/mutation.rs"));
+        for (snake, _, markers) in registered {
+            let body = resolver_body(&masked, snake);
+            for marker in *markers {
+                assert!(
+                    body.contains(marker),
+                    "GraphQL mutation `{snake}` is missing its gate marker `{marker}`: gate removed"
+                );
+            }
+        }
+    }
+
+    /// Version-safety self-check (#219, INV-21): the fence's completeness guarantee rests
+    /// on `schema.sdl()` INCLUDING `visible = false` fields while introspection omits
+    /// them. That is observed async-graphql behavior, not a documented contract, so pin
+    /// it here: a synthetic schema with a hidden mutation must have that field in its
+    /// SDL-derived set and NOT in its introspection-derived set. If a future
+    /// async-graphql upgrade ever filters SDL by visibility, the first assertion flips
+    /// RED — the assumption is load-bearing, not trusted.
+    #[test]
+    fn sdl_source_sees_hidden_mutations_that_introspection_omits() {
+        use async_graphql::{EmptySubscription, Object, Schema};
+        struct Q;
+        #[Object]
+        impl Q {
+            async fn ping(&self) -> i32 {
+                0
+            }
+        }
+        struct M;
+        #[Object]
+        impl M {
+            async fn visible_mut(&self) -> i32 {
+                1
+            }
+            #[graphql(visible = false)]
+            async fn hidden_mut(&self) -> i32 {
+                2
+            }
+        }
+        let schema = Schema::build(Q, M, EmptySubscription).finish();
+
+        // SDL source (the fix): includes the hidden field.
+        let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
+        assert!(
+            sdl_fields.iter().any(|f| f == "hiddenMut"),
+            "SDL-sourced set MUST include the visible=false mutation; if this is RED, \
+             async-graphql started filtering SDL by visibility and the fence's \
+             completeness guarantee is broken: {sdl_fields:?}"
+        );
+
+        // Introspection (the fence's own helper): OMITS the hidden field. This is the
+        // exact gap the fix closes — an introspection-sourced fence never sees `hiddenMut`.
+        let introspected = introspection_mutation_fields(&schema);
+        assert!(
+            !introspected.iter().any(|f| f == "hiddenMut"),
+            "introspection is expected to OMIT the visible=false mutation (that is the \
+             gap the SDL source closes); got {introspected:?}"
+        );
+
+        // The exact diff the fence computes: hidden ∈ (sdl \ introspection).
+        let hidden: Vec<&String> = sdl_fields
+            .iter()
+            .filter(|f| !introspected.iter().any(|i| i == *f))
+            .collect();
+        assert_eq!(
+            hidden,
+            vec!["hiddenMut"],
+            "the SDL-vs-introspection diff must surface exactly the hidden mutation"
+        );
+    }
+
+    /// INV-21 wiring guard (#219): drives the generic `assert_mutation_fence` — the SAME
+    /// helper the real fence calls — against a synthetic schema whose mutation is
+    /// `visible = false` and IS registered, so completeness passes and ONLY the
+    /// hidden-from-introspection cross-check can fail. This is what makes the fence's SDL
+    /// sourcing load-bearing without a production canary: reverting the source to
+    /// introspection (the hidden field then absent from the SDL set) or deleting the
+    /// cross-check removes this panic (or changes its message), turning the
+    /// `should_panic` test RED. The real MutationRoot has no hidden field, so nothing on
+    /// the real schema could catch that regression.
+    #[test]
+    #[should_panic(expected = "hidden from introspection")]
+    fn fence_rejects_a_hidden_mutation() {
+        use async_graphql::{EmptySubscription, Object, Schema};
+        struct Q;
+        #[Object]
+        impl Q {
+            async fn ping(&self) -> i32 {
+                0
+            }
+        }
+        struct M;
+        #[Object]
+        impl M {
+            async fn visible_mut(&self) -> i32 {
+                1
+            }
+            #[graphql(visible = false)]
+            async fn hidden_mut(&self) -> i32 {
+                2
+            }
+        }
+        let schema = Schema::build(Q, M, EmptySubscription).finish();
+        // Both fields registered, so completeness passes and only the cross-check fires.
+        assert_mutation_fence(&schema, &["visibleMut", "hiddenMut"]);
+    }
+
+    /// Deprecated-mutation guard (#219): a `#[graphql(deprecation = "...")]` mutation is
+    /// executable and present in SDL, but GraphQL introspection omits it by default. The
+    /// fence's introspection helper uses `includeDeprecated: true`, so a deprecated (but
+    /// visible) mutation is NOT mistaken for a hidden one. With it registered, the fence
+    /// must NOT panic. Remove `includeDeprecated: true` and this goes RED — the deprecated
+    /// field would look hidden and false-red as a forbidden visible=false mutation.
+    #[test]
+    fn fence_admits_a_deprecated_mutation() {
+        use async_graphql::{EmptySubscription, Object, Schema};
+        struct Q;
+        #[Object]
+        impl Q {
+            async fn ping(&self) -> i32 {
+                0
+            }
+        }
+        struct M;
+        #[Object]
+        impl M {
+            async fn visible_mut(&self) -> i32 {
+                1
+            }
+            #[graphql(deprecation = "use visibleMut")]
+            async fn deprecated_mut(&self) -> i32 {
+                2
+            }
+        }
+        let schema = Schema::build(Q, M, EmptySubscription).finish();
+        // Must not panic: the deprecated field is visible (present in introspection with
+        // includeDeprecated) and registered, so it is neither hidden nor unclassified.
+        assert_mutation_fence(&schema, &["visibleMut", "deprecatedMut"]);
+    }
+
+    /// Completeness + hidden-mutation cross-check for a BUILT schema (#219). Generic over
+    /// the schema type so the real fence AND the synthetic `fence_rejects_a_hidden_mutation`
+    /// / `fence_admits_a_deprecated_mutation` tests drive the SAME sourcing and cross-check.
+    /// Completeness is sourced from SDL (which includes `visible = false` fields); the
+    /// cross-check fails any SDL field hidden from introspection. This genericity is the
+    /// INV-21 fix: because the real MutationRoot has no hidden field, only a synthetic
+    /// hidden schema through THIS helper makes reverting the SDL source or removing the
+    /// cross-check RED, rather than leaving the class latent behind a production canary.
+    fn assert_mutation_fence<Q, M, S>(
+        schema: &async_graphql::Schema<Q, M, S>,
+        registered_camel: &[&str],
+    ) where
+        Q: async_graphql::ObjectType + 'static,
+        M: async_graphql::ObjectType + 'static,
+        S: async_graphql::SubscriptionType + 'static,
+    {
+        let sdl_fields = mutation_field_names_from_sdl(&schema.sdl());
+        let introspected = introspection_mutation_fields(schema);
+        // No SDL field may be hidden from introspection (a visible=false mutation).
+        for f in &sdl_fields {
+            assert!(
+                introspected.iter().any(|i| i == f),
+                "GraphQL mutation `{f}` is in the schema but hidden from introspection \
+                 (a `#[graphql(visible = false)]` field): hidden mutations are forbidden \
+                 by this fence — make it visible so its classification is enforceable, or \
+                 remove it"
+            );
+        }
+        // Completeness both directions against the registered (camelCase) set.
+        for f in &sdl_fields {
+            assert!(
+                registered_camel.contains(&f.as_str()),
+                "unclassified GraphQL mutation `{f}`: add it to \
+                 every_graphql_mutation_has_its_gate with a deliberate gate \
+                 (`require_repo_owner(` for a repo-write, `did_matches(` for a task op)"
+            );
+        }
+        for c in registered_camel {
+            assert!(
+                sdl_fields.iter().any(|f| f == c),
+                "registered GraphQL mutation `{c}` is not in the schema \
+                 (renamed or removed); update the table"
+            );
+        }
+    }
+
+    /// The mutation field names via the engine's introspection, run against a passed
+    /// schema. STRUCTURED (names arrive as data). Uses `fields(includeDeprecated: true)`:
+    /// GraphQL's default omits `@deprecated` fields, but a `#[graphql(deprecation = "...")]`
+    /// mutation is still executable and present in SDL, so without this the cross-check
+    /// above would false-red a deprecated mutation as a hidden (visible=false) one. Only a
+    /// real visibility filter should trip that arm; deprecation is a lifecycle marker.
+    fn introspection_mutation_fields<Q, M, S>(
+        schema: &async_graphql::Schema<Q, M, S>,
+    ) -> Vec<String>
+    where
+        Q: async_graphql::ObjectType + 'static,
+        M: async_graphql::ObjectType + 'static,
+        S: async_graphql::SubscriptionType + 'static,
+    {
+        use async_graphql::Value;
+        let resp = tokio::runtime::Runtime::new()
+            .expect("tokio runtime")
+            .block_on(schema.execute(
+                "{ __schema { mutationType { fields(includeDeprecated: true) { name } } } }",
+            ));
+        assert!(
+            resp.errors.is_empty(),
+            "schema introspection failed: {:?}",
+            resp.errors
+        );
+        let mut names = Vec::new();
+        if let Value::Object(root) = &resp.data {
+            if let Some(Value::Object(sc)) = root.get("__schema") {
+                if let Some(Value::Object(mt)) = sc.get("mutationType") {
+                    if let Some(Value::List(field_list)) = mt.get("fields") {
+                        for field in field_list {
+                            if let Value::Object(fo) = field {
+                                if let Some(Value::String(n)) = fo.get("name") {
+                                    names.push(n.clone());
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        names
+    }
+
+    /// The mutation field names sourced from the built schema's SDL — the completeness
+    /// source (#219). Builds the same DB-free schema as the introspection helper and runs
+    /// its `.sdl()` (sync, no runtime needed) through [`mutation_field_names_from_sdl`].
+    /// SDL includes `#[graphql(visible = false)]` fields, so this source cannot be
+    /// defeated by hiding a mutation from introspection.
+    fn graphql_mutation_fields_from_sdl() -> Vec<String> {
+        use crate::graphql::mutation::MutationRoot;
+        use crate::graphql::query::QueryRoot;
+        use crate::graphql::subscription::SubscriptionRoot;
+        let schema =
+            async_graphql::Schema::build(QueryRoot, MutationRoot, SubscriptionRoot).finish();
+        mutation_field_names_from_sdl(&schema.sdl())
+    }
+
+    /// The mutation type's field names extracted from an async-graphql SDL string via
+    /// the engine's OWN parser AST (`async_graphql::parser::parse_schema`), NOT
+    /// introspection. This is the completeness source (#219): unlike introspection,
+    /// which async-graphql filters by `visible` (a `#[graphql(visible = false)]`
+    /// mutation is executable but ABSENT from introspection), `schema.sdl()` includes
+    /// every registered field, so a hidden mutation still appears here and must carry a
+    /// classified row. Parsing the AST (not a brace/line text scan) means a `}` inside a
+    /// field description cannot mis-slice the type block. camelCase, as async-graphql
+    /// emits. An empty result on a navigation miss is safe: the set-equality in
+    /// `every_graphql_mutation_has_its_gate` turns "no fields" into a loud failure for
+    /// every registered name, never a vacuous pass.
+    fn mutation_field_names_from_sdl(sdl: &str) -> Vec<String> {
+        use async_graphql::parser::parse_schema;
+        use async_graphql::parser::types::{TypeKind, TypeSystemDefinition};
+
+        let doc = parse_schema(sdl).expect("async-graphql SDL must parse");
+        // The mutation root type name: from the `schema { mutation: X }` block if
+        // present, else the GraphQL default "Mutation".
+        let mutation_type = doc
+            .definitions
+            .iter()
+            .find_map(|def| match def {
+                TypeSystemDefinition::Schema(s) => s
+                    .node
+                    .mutation
+                    .as_ref()
+                    .map(|m| m.node.as_str().to_string()),
+                _ => None,
+            })
+            .unwrap_or_else(|| "Mutation".to_string());
+        // The fields of that object type.
+        doc.definitions
+            .iter()
+            .find_map(|def| match def {
+                TypeSystemDefinition::Type(t) if t.node.name.node.as_str() == mutation_type => {
+                    match &t.node.kind {
+                        TypeKind::Object(obj) => Some(
+                            obj.fields
+                                .iter()
+                                .map(|f| f.node.name.node.as_str().to_string())
+                                .collect::<Vec<_>>(),
+                        ),
+                        _ => None,
+                    }
+                }
+                _ => None,
+            })
+            .unwrap_or_default()
+    }
+
+    #[test]
+    fn sdl_extractor_includes_a_hidden_visible_false_field() {
+        // A field that would be hidden from introspection must still be listed from SDL.
+        let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
+                   type QueryRoot { ping: Int! }\n\
+                   type MutationRoot { createTask: Int! hiddenMut: Int! }\n";
+        let fields = mutation_field_names_from_sdl(sdl);
+        assert!(
+            fields.iter().any(|f| f == "createTask"),
+            "visible field must be listed: {fields:?}"
+        );
+        assert!(
+            fields.iter().any(|f| f == "hiddenMut"),
+            "a visible=false field (present in SDL, hidden from introspection) MUST be \
+             listed by the completeness source: {fields:?}"
+        );
+    }
+
+    #[test]
+    fn sdl_extractor_is_not_fooled_by_a_brace_in_a_field_description() {
+        // A `}` inside a field description must not truncate the type block (the AST
+        // parse is immune to the text-parse quirk the old design feared).
+        let sdl = "schema { query: QueryRoot mutation: MutationRoot }\n\
+                   type QueryRoot { ping: Int! }\n\
+                   type MutationRoot {\n\
+                     \"\"\"a description with a } brace and { another\"\"\"\n\
+                     createTask: Int!\n\
+                     claimTask: Int!\n\
+                   }\n";
+        let fields = mutation_field_names_from_sdl(sdl);
+        assert!(
+            fields.iter().any(|f| f == "createTask") && fields.iter().any(|f| f == "claimTask"),
+            "both fields must be extracted despite a brace in a description: {fields:?}"
+        );
+    }
+
+    #[test]
+    fn sdl_extractor_returns_empty_for_a_query_only_schema() {
+        let sdl = "schema { query: QueryRoot }\ntype QueryRoot { ping: Int! }\n";
+        assert!(
+            mutation_field_names_from_sdl(sdl).is_empty(),
+            "a schema with no mutation root yields no mutation fields (no panic)"
+        );
+    }
+
+    /// The comment-masked body of `async fn <snake>` in `graphql/mutation.rs`, bounded
+    /// to the resolver's OWN braces (its `{ .. }`), for the marker check. Brace-matching
+    /// on the comment-masked source means a `}` in a trailing helper cannot extend the
+    /// body and a comment marker does not count. A `{`/`}` inside a STRING literal is
+    /// not masked, a documented marker-check-only residual (limit 3); completeness does
+    /// not use this.
+    fn resolver_body(masked_src: &str, snake: &str) -> String {
+        let needle = format!("async fn {snake}(");
+        let start = masked_src.find(&needle).unwrap_or_else(|| {
+            panic!("resolver `async fn {snake}(` not found in graphql/mutation.rs")
+        });
+        let open = start
+            + masked_src[start..]
+                .find('{')
+                .expect("resolver body opening brace");
+        let mut depth = 0i32;
+        let mut end = masked_src.len();
+        for (i, c) in masked_src[open..].char_indices() {
+            match c {
+                '{' => depth += 1,
+                '}' => {
+                    depth -= 1;
+                    if depth == 0 {
+                        end = open + i + 1;
+                        break;
+                    }
+                }
+                _ => {}
+            }
+        }
+        masked_src[open..end].to_string()
+    }
+
+    /// `src` with `//` line comments and `/* */` block comments (nested) blanked to
+    /// spaces, WITHOUT opening a comment inside a `"..."` string (so a `"https://"` does
+    /// not erase the rest of its line). String CONTENTS are left intact, so a brace or
+    /// a gate marker inside a string is not masked; for the marker check that is a
+    /// documented vacuity residual (limit 3), and completeness does not use this at
+    /// all. Char literals and raw/byte strings are not tracked (absent in resolver
+    /// bodies); a `'"'` char or a raw string is the remaining narrow residual.
+    fn mask_comments(src: &str) -> String {
+        let chars: Vec<char> = src.chars().collect();
+        let mut out = String::with_capacity(src.len());
+        let mut i = 0;
+        let mut block_depth = 0usize;
+        let mut in_string = false;
+        while i < chars.len() {
+            let c = chars[i];
+            let next = chars.get(i + 1).copied();
+            if block_depth > 0 {
+                if c == '/' && next == Some('*') {
+                    block_depth += 1;
+                    out.push_str("  ");
+                    i += 2;
+                } else if c == '*' && next == Some('/') {
+                    block_depth -= 1;
+                    out.push_str("  ");
+                    i += 2;
+                } else {
+                    out.push(if c == '\n' { '\n' } else { ' ' });
+                    i += 1;
+                }
+            } else if in_string {
+                out.push(c);
+                if c == '\\' {
+                    if let Some(n) = next {
+                        out.push(n);
+                        i += 2;
+                    } else {
+                        i += 1;
+                    }
+                } else {
+                    if c == '"' {
+                        in_string = false;
+                    }
+                    i += 1;
+                }
+            } else if c == '"' {
+                in_string = true;
+                out.push('"');
+                i += 1;
+            } else if c == '/' && next == Some('/') {
+                while i < chars.len() && chars[i] != '\n' {
+                    out.push(' ');
+                    i += 1;
+                }
+            } else if c == '/' && next == Some('*') {
+                block_depth = 1;
+                out.push_str("  ");
+                i += 2;
+            } else {
+                out.push(c);
+                i += 1;
+            }
+        }
+        out
+    }
+
+    /// The SDL field set (the completeness source of truth, #219) is exactly the
+    /// registered mutations. If async-graphql adds or renames a field, this reddens
+    /// and forces the `every_graphql_mutation_has_its_gate` table to be updated. Uses
+    /// SDL, not introspection: introspection omits `visible = false` fields, so an
+    /// introspection-based pin here would go green while a hidden mutation existed.
+    #[test]
+    fn schema_lists_exactly_the_registered_mutations() {
+        let mut fields = graphql_mutation_fields_from_sdl();
+        fields.sort();
+        assert_eq!(
+            fields,
+            vec!["claimTask", "completeTask", "createTask", "failTask"],
+            "the SDL mutation field set is the authoritative discovered set"
+        );
+    }
+
+    /// The marker check is bounded to a resolver's OWN body and is comment- and
+    /// string-aware: a `//` inside a `"https://"` string does not erase a real gate on
+    /// that line (no false-red), and a trailing module helper's `did_matches(` does not
+    /// rescue a resolver whose own gate was removed (no false-green).
+    #[test]
+    fn resolver_body_is_bounded_and_comment_and_string_aware() {
+        let src = "\
+impl MutationRoot {
+    async fn ok(&self) -> Result<u32> {
+        let _ = (\"see https://x/y\", did_matches(a, b)); // URL string then gate, one line
+        Ok(0)
+    }
+    async fn last(&self) -> Result<u32> {
+        // did_matches( only in a comment
+        Ok(0)
+    }
+}
+fn helper() { let _ = did_matches(z, z); }
+#[cfg(test)]
+mod tests { async fn t() { let _ = did_matches(x, y); } }
+";
+        let masked = mask_comments(src);
+        assert!(
+            resolver_body(&masked, "ok").contains("did_matches("),
+            "a `//` inside a string must not erase the real gate on that line"
+        );
+        assert!(
+            !resolver_body(&masked, "last").contains("did_matches("),
+            "the marker check must be bounded to the resolver's own body (a trailing \
+             helper's marker must not rescue a resolver whose gate was removed)"
+        );
+    }
+
     /// Proves the comment-stripping that GUARD-1 added: a marker that appears only
     /// in a full-line comment (the real `replicas.rs` false-pass shape) must NOT
     /// satisfy a row.

crates/gitlawb-node/src/api/replicas.rs

@@ -39,11 +39,11 @@ pub async fn register_replica(
 ) -> Result<(StatusCode, Json<serde_json::Value>)> {
     validate_replica_url(&req.url)?;
 
-    let record = state
-        .db
-        .get_repo(&owner, &repo)
-        .await?
-        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
+    // The mutation response carries repo metadata (name, replica count), so
+    // registration applies the same read-visibility decision as the listing:
+    // a caller who may not read the repo gets the same 404 as a missing one.
+    let (record, _rules) =
+        crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
 
     let replica_did = &auth.0;
 
@@ -93,11 +93,10 @@ pub async fn unregister_replica(
     Extension(auth): Extension<AuthenticatedDid>,
     Path((owner, repo)): Path<(String, String)>,
 ) -> Result<Json<serde_json::Value>> {
-    let record = state
-        .db
-        .get_repo(&owner, &repo)
-        .await?
-        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
+    // Same gate as register_replica: removal mutates repo-scoped metadata and
+    // its response discloses the replica count.
+    let (record, _rules) =
+        crate::api::authorize_repo_read(&state, &owner, &repo, Some(auth.0.as_str()), "/").await?;
 
     let replica_did = &auth.0;
     state.db.unregister_replica(&record.id, replica_did).await?;

crates/gitlawb-node/src/api/repos.rs

@@ -3186,10 +3186,21 @@ pub async fn list_refs(
     auth: Option<Extension<AuthenticatedDid>>,
 ) -> Result<Json<serde_json::Value>> {
     let caller = auth.as_ref().map(|e| e.0 .0.as_str());
-    let (_record, _rules) =
+    let (record, _rules) =
         crate::api::authorize_repo_read(&state, &owner, &repo, caller, "/").await?;
 
-    let repo_slug = format!("{owner}/{repo}");
+    // Build the filter from the canonical stored slug, NOT from the raw path
+    // segments. `branch_cids.repo` is written as
+    // `{normalize_owner_key(owner_did)}/{name}` (the push path builds the same
+    // slug before calling `upsert_branch_cid`), and
+    // `get_repo` resolves both `did:key:zX` and bare `zX` to the same record, so
+    // a request in the full-DID form authorizes and then matches zero rows,
+    // returning an empty page with a 200.
+    let repo_slug = format!(
+        "{}/{}",
+        crate::db::normalize_owner_key(&record.owner_did),
+        record.name
+    );
     let refs = state.db.list_branch_cids(&repo_slug).await?;
 
     Ok(Json(
@@ -3543,6 +3554,25 @@ pub async fn fork_repo(
         ));
     }
 
+    // Same barrier every other repo-creation route goes through. The character
+    // allowlist above is vacuously true on an empty name, and `repo_disk_path`
+    // is a raw join, so without this a `{"name":""}` fork lands a row with an
+    // empty name at `<repos_dir>/<owner_slug>/.git`. Closed #272 fixed this
+    // class on the sync route and never scoped fork.
+    //
+    // It runs with the other admissibility checks, above the proof spend and the
+    // source acquire, because the header comment promises that a fork rejected
+    // for a bad name never burns a valid proof. The two name rules are kept
+    // separate on purpose: neither is a subset of the other, since the allowlist
+    // above rejects a dot (`v1.2.3`) that `validate_repo_name` accepts, and
+    // accepts a non-ASCII alphanumeric that it rejects.
+    let disk_path = crate::git::repo_store::validated_repo_disk_path(
+        &state.config.repos_dir,
+        &forker_did,
+        &fork_name,
+    )
+    .map_err(|e| AppError::BadRequest(e.to_string()))?;
+
     // Check no name conflict under the forker's ownership
     let forker_short = crate::db::normalize_owner_key(&forker_did);
     if state.db.get_repo(forker_short, &fork_name).await?.is_some() {
@@ -3561,13 +3591,6 @@ pub async fn fork_repo(
         .await
         .map_err(|e| AppError::Git(e.to_string()))?;
 
-    let disk_path = crate::git::repo_store::validated_repo_disk_path(
-        &state.config.repos_dir,
-        &forker_did,
-        &fork_name,
-    )
-    .map_err(|e| AppError::BadRequest(e.to_string()))?;
-
     // Clone the source repo as a mirror
     let output = std::process::Command::new("git")
         .args([
@@ -3854,6 +3877,12 @@ struct RefUpdate {
     ref_name: String,
 }
 
+/// A git object id is 40 hex chars; length alone is not enough, since a peer
+/// can send 40 arbitrary bytes (#398).
+fn is_hex_sha(s: &str) -> bool {
+    s.len() == 40 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
 /// Parse git receive-pack pkt-line ref updates from the request body.
 /// Format per line: `<40-hex-old> <40-hex-new> <refname>[NUL capabilities]\n`
 fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
@@ -3895,7 +3924,7 @@ fn parse_ref_updates(body: &[u8]) -> Vec<RefUpdate> {
             .trim_end_matches('\n');
 
         let parts: Vec<&str> = line.splitn(3, ' ').collect();
-        if parts.len() == 3 && parts[0].len() == 40 && parts[1].len() == 40 {
+        if parts.len() == 3 && is_hex_sha(parts[0]) && is_hex_sha(parts[1]) {
             updates.push(RefUpdate {
                 old_sha: parts[0].to_string(),
                 new_sha: parts[1].to_string(),
@@ -4415,6 +4444,45 @@ mod tests {
         );
     }
 
+    // #398: a peer-supplied pkt-line whose 40-byte "SHA" fields carry non-hex
+    // content must be dropped, not forwarded into RefUpdate events, branch_cid
+    // rows, and sync-notify JSON as a canonical-looking identifier.
+    #[test]
+    fn parse_ref_updates_requires_hex_shas() {
+        let sha_a = "a".repeat(40);
+        let sha_b = "b".repeat(40);
+        let pkt = |old: &str, new: &str, refname: &str| {
+            let line = format!("{old} {new} {refname}");
+            format!("{:04x}{}0000", line.len() + 4, line).into_bytes()
+        };
+
+        // Valid 40-hex old + new -> accepted.
+        let updates = parse_ref_updates(&pkt(&sha_a, &sha_b, "refs/heads/main"));
+        assert_eq!(updates.len(), 1);
+        assert_eq!(updates[0].old_sha, sha_a);
+        assert_eq!(updates[0].new_sha, sha_b);
+        assert_eq!(updates[0].ref_name, "refs/heads/main");
+
+        // 40-byte non-hex fields -> dropped.
+        let junk = "Z".repeat(40);
+        assert!(parse_ref_updates(&pkt(&junk, &sha_b, "refs/heads/main")).is_empty());
+        assert!(parse_ref_updates(&pkt(&sha_a, &junk, "refs/heads/main")).is_empty());
+
+        // Wrong lengths -> dropped.
+        assert!(parse_ref_updates(&pkt(&"a".repeat(39), &sha_b, "refs/heads/main")).is_empty());
+        assert!(parse_ref_updates(&pkt(&sha_a, &"b".repeat(41), "refs/heads/main")).is_empty());
+
+        // A bad line among good ones drops only the bad line.
+        let sha_c = "c".repeat(40);
+        let bad = pkt(&junk, &sha_b, "refs/heads/bad");
+        let good = pkt(&sha_a, &sha_c, "refs/heads/good");
+        let mut mixed = bad[..bad.len() - 4].to_vec(); // strip trailing flush
+        mixed.extend_from_slice(&good);
+        let updates = parse_ref_updates(&mixed);
+        assert_eq!(updates.len(), 1);
+        assert_eq!(updates[0].ref_name, "refs/heads/good");
+    }
+
     #[test]
     fn git_service_app_error_classifies_timeout_bad_request_and_git() {
         // GitServiceTimeout carried through anyhow -> 504 Timeout.
@@ -8221,7 +8289,7 @@ mod tests {
         let add = server
             .mock("POST", mockito::Matcher::Any)
             .with_status(200)
-            .with_body(r#"{"Hash":"QmShouldNotHappen"}"#)
+            .with_body(r#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4"}"#)
             .expect(0)
             .create_async()
             .await;

crates/gitlawb-node/src/arweave_v2.rs

@@ -0,0 +1,62 @@
+//! #26 Split PR 2 — three-outcome recovery policy types.
+//!
+//! This module owns the recovery classification policy the reviewer
+//! demanded: only a trustworthy, protocol-defined absence authorizes
+//! a paid re-upload. Everything else stays non-terminal.
+//!
+//! Deliberately narrow: the ANS-104 codec lives in `ans104`, and the
+//! gateway probe, the `verify_anchor` path, and the public verify
+//! endpoint are deferred until the uploader, retrieval proof, and
+//! recovery consumer can be proven as one vertical slice (reviewer 2,
+//! round 5). A probe against a real provider contract — same-network
+//! upload/read pair, redirect-safe client, envelope-supplying read
+//! API, provider-documented absence evidence — belongs in that slice,
+//! not here. What ships here is the policy type plus the rule that
+//! only `DefinitivelyAbsent` permits spending another upload.
+
+/// Outcome of a gateway probe for a persisted `item_id`.
+// Policy surface for the recovery slice: no construction on this
+// head (the probe arrives with the provider contract); the unit
+// test pins the rule meanwhile.
+#[allow(dead_code)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProbeOutcome {
+    /// The persisted item was served back with a verifiable envelope
+    /// bound to the requested id. No re-upload allowed.
+    Present,
+    /// Trustworthy, protocol-defined proof the item was never
+    /// accepted. Authorizes re-upload. The exact evidence that
+    /// establishes this is defined by the provider contract in the
+    /// vertical slice that introduces the probe — never by a
+    /// mock-only body shape.
+    DefinitivelyAbsent,
+    /// Anything else: transport failure, oversized body, bad
+    /// signature, id mismatch, ambiguous gateway response. The
+    /// outbox stays non-terminal.
+    Indeterminate,
+}
+
+impl ProbeOutcome {
+    /// True iff the recovery code is allowed to spend another paid
+    /// upload request. Only `DefinitivelyAbsent` qualifies.
+    #[allow(dead_code)] // the recovery consumer lives in a later slice
+    pub fn permits_reupload(self) -> bool {
+        matches!(self, ProbeOutcome::DefinitivelyAbsent)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Only `DefinitivelyAbsent` authorizes a paid re-upload. This is
+    /// the policy the reviewer named: collapsing any ambiguous outcome
+    /// to absent spends a second immutable upload for the same
+    /// transition.
+    #[test]
+    fn only_definitively_absent_authorizes_reupload() {
+        assert!(!ProbeOutcome::Present.permits_reupload());
+        assert!(ProbeOutcome::DefinitivelyAbsent.permits_reupload());
+        assert!(!ProbeOutcome::Indeterminate.permits_reupload());
+    }
+}

crates/gitlawb-node/src/auth/mod.rs

@@ -34,6 +34,38 @@ use gitlawb_core::http_sig::{
 };
 use gitlawb_core::identity::verify;
 
+/// Per-route-group ceiling on how much request body [`require_signature`] will
+/// buffer BEFORE it has authenticated anything.
+///
+/// This is middleware state rather than a constant because a single number cannot
+/// serve both a 2 GB git push and a 2 MB profile update: the git write group
+/// passes `GITLAWB_MAX_PACK_BYTES`, every other signed group passes
+/// [`crate::server::SIGNED_BODY_LIMIT`]. Making it a required piece of state means
+/// a new signed route group cannot be wired up without choosing a limit.
+#[derive(Clone, Copy, Debug)]
+pub struct SignatureBodyLimit(pub usize);
+
+/// The hint for an unresolvable DID, chosen by method. The hint is only true
+/// for a method we have no resolver for: a did:key that parsed and then failed
+/// on its key material (a small-order key, wrong multicodec, wrong length)
+/// would be sent looking for the wrong problem by the alpha-support wording.
+fn unresolvable_did_hint(key_id: &Did) -> &'static str {
+    if key_id.is_did_key() {
+        "the DID is a did:key whose key material did not resolve"
+    } else {
+        "only did:key is supported in alpha"
+    }
+}
+
+/// Bound the echoed keyid in the unresolvable-DID message. `key_id` is
+/// unauthenticated request input, so reflecting it back at whatever length the
+/// caller chose would amplify attacker input into the response body. The bound
+/// is slack (a did:key method-id is a fixed 48 characters) and only defends
+/// the echo, not the resolution.
+fn bounded_did_echo(key_id: &str) -> String {
+    key_id.chars().take(96).collect()
+}
+
 /// Axum middleware that enforces HTTP Signature authentication (RFC 9421).
 ///
 /// Every write request must carry:
@@ -48,20 +80,52 @@ use gitlawb_core::identity::verify;
 ///   4. Resolves the did:key to an Ed25519 VerifyingKey
 ///   5. Rebuilds the signing string and verifies the Ed25519 signature
 ///   6. Verifies Content-Digest matches the request body
-pub async fn require_signature(request: Request, next: Next) -> Response {
-    // Buffer the body so we can verify content-digest and pass it downstream
+pub async fn require_signature(
+    State(SignatureBodyLimit(limit)): State<SignatureBodyLimit>,
+    request: Request,
+    next: Next,
+) -> Response {
+    verify_signature(limit, request, next).await
+}
+
+/// The signature check itself, shared by [`require_signature`] and the optional
+/// variant. `limit` bounds the pre-auth buffer; see [`SignatureBodyLimit`].
+async fn verify_signature(limit: usize, request: Request, next: Next) -> Response {
+    // Buffer the body so we can verify content-digest and pass it downstream.
+    //
+    // The buffer is bounded, because this runs BEFORE any identity check: an
+    // unauthenticated caller with no DID, no signature and no repo reaches this
+    // line. Nothing upstream supplies the bound. On the git write routes
+    // `RequestBodyLimitLayer` sits on the inner router, and a later `.layer()` is
+    // the OUTER service, so this middleware runs first and sees the raw body. On
+    // every other signed group axum's 2 MB `DefaultBodyLimit` is enforced by the
+    // `Bytes`/`Json` extractors through a request extension, which collecting the
+    // body here bypasses. `Limited` stops reading at the limit rather than reading
+    // everything and then measuring it, which is the property that matters.
     let (parts, body) = request.into_parts();
-    let body_bytes =
-        match body.collect().await {
-            Ok(collected) => collected.to_bytes(),
-            Err(_) => return (
+    let body_bytes = match http_body_util::Limited::new(body, limit).collect().await {
+        Ok(collected) => collected.to_bytes(),
+        // Over the limit: a distinct status from the 401 an unsigned request gets
+        // and the 400 below, so a client can tell "too big" from "not authenticated"
+        // and from "your body did not arrive".
+        Err(e) if e.is::<http_body_util::LengthLimitError>() => return (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            Json(json!({
+                "error": "body_too_large",
+                "message": format!("request body exceeds the {limit}-byte limit for this route"),
+            })),
+        )
+            .into_response(),
+        Err(_) => {
+            return (
                 StatusCode::BAD_REQUEST,
                 Json(
                     json!({ "error": "unreadable_body", "message": "could not read request body" }),
                 ),
             )
-                .into_response(),
-        };
+                .into_response()
+        }
+    };
 
     let sig_input = parts
         .headers
@@ -145,11 +209,14 @@ pub async fn require_signature(request: Request, next: Next) -> Response {
                 StatusCode::BAD_REQUEST,
                 Json(json!({
                     "error": "unresolvable_did",
-                    "message": format!("cannot resolve DID '{}': {e}", sig.key_id),
-                    "hint": "only did:key is supported in alpha",
+                    "message": format!(
+                        "cannot resolve DID '{}': {e}",
+                        bounded_did_echo(&sig.key_id.to_string())
+                    ),
+                    "hint": unresolvable_did_hint(&sig.key_id),
                 })),
             )
-                .into_response()
+                .into_response();
         }
     };
 
@@ -260,11 +327,17 @@ pub async fn require_signature(request: Request, next: Next) -> Response {
 /// Optional variant for rolling upgrades: verify and inject `AuthenticatedDid` when
 /// RFC 9421 signature headers are present, but allow legacy unsigned requests to
 /// continue when no signature attempt was made.
-pub async fn optional_signature(request: Request, next: Next) -> Response {
+pub async fn optional_signature(
+    State(SignatureBodyLimit(limit)): State<SignatureBodyLimit>,
+    request: Request,
+    next: Next,
+) -> Response {
     let has_signature_headers = request.headers().contains_key("signature-input")
         || request.headers().contains_key("signature");
     if has_signature_headers {
-        return require_signature(request, next).await;
+        // Same pre-auth buffer, same bound: presenting signature headers is not
+        // authentication, so this path is as reachable as the required one.
+        return verify_signature(limit, request, next).await;
     }
     next.run(request).await
 }
@@ -435,6 +508,58 @@ mod tests {
         assert!(validate_ucan_chain(&token, &node_did, &agent_did).is_ok());
     }
 
+    /// The two-branch hint selection is the point of the unresolvable-DID
+    /// change: a did:key that failed on its key material must be told the key
+    /// material did not resolve, and any other method must be told only did:key
+    /// is supported. A regression that drops the is_did_key() check would send
+    /// a did:key caller after the wrong problem, so both branches are pinned.
+    #[test]
+    fn unresolvable_did_hint_distinguishes_key_material_from_method() {
+        // A real did:key whose key material fails to resolve (small-order):
+        // key-material hint.
+        let mut weak = [0u8; 32];
+        weak[0] = 1; // compressed identity point
+        let weak_vk = ed25519_dalek::VerifyingKey::from_bytes(&weak).unwrap();
+        let weak_did = Did::from_verifying_key(&weak_vk);
+        assert!(
+            weak_did.to_verifying_key().is_err(),
+            "fixture precondition: small-order did:key must not resolve"
+        );
+        assert_eq!(
+            unresolvable_did_hint(&weak_did),
+            "the DID is a did:key whose key material did not resolve"
+        );
+
+        // A method with no resolver: alpha-support hint.
+        let web = Did::web("example.com");
+        assert!(
+            web.to_verifying_key().is_err(),
+            "fixture precondition: did:web must not resolve locally"
+        );
+        assert_eq!(
+            unresolvable_did_hint(&web),
+            "only did:key is supported in alpha"
+        );
+    }
+
+    /// The unresolvable-DID message echoes the keyid, which is unauthenticated
+    /// request input. The echoed value must be bounded so a hostile caller
+    /// cannot amplify arbitrary-length input into the response body.
+    #[test]
+    fn unresolvable_did_message_bounds_the_echoed_keyid() {
+        let long_keyid = format!("did:key:z{}", "A".repeat(2000));
+        let shown = bounded_did_echo(&long_keyid);
+        assert!(
+            shown.len() <= 96,
+            "echoed keyid must be bounded, got {} chars",
+            shown.len()
+        );
+        assert!(
+            !shown.contains(&"A".repeat(1000)),
+            "the full keyid must not survive into the message"
+        );
+    }
+
     #[test]
     fn validate_ucan_chain_wrong_issuer() {
         let node = Keypair::generate();
@@ -693,7 +818,10 @@ mod tests {
                     StatusCode::OK
                 }),
             )
-            .layer(middleware::from_fn(require_signature));
+            .layer(middleware::from_fn_with_state(
+                SignatureBodyLimit(crate::server::SIGNED_BODY_LIMIT),
+                require_signature,
+            ));
 
         let req = Request::builder()
             .method("POST")

crates/gitlawb-node/src/config.rs

@@ -55,7 +55,10 @@ pub struct Config {
     #[arg(long, env = "GITLAWB_KEY", default_value = "~/.gitlawb/identity.pem")]
     pub key_path: String,
 
-    /// Reserved for private-read mode; per-repo read enforcement is not wired in alpha
+    /// Reserved and currently inert: read access is enforced per repository
+    /// through `is_public` and path-scoped visibility rules, not this flag.
+    /// Setting it to false changes nothing; make a repo private through its
+    /// own visibility instead.
     #[arg(long, env = "GITLAWB_PUBLIC_READ", default_value_t = true)]
     pub public_read: bool,
 
@@ -1634,6 +1637,28 @@ mod tests {
         );
     }
 
+    /// #338: GITLAWB_PUBLIC_READ is inert, so its help must not claim read
+    /// enforcement is missing; it must tell the operator the flag changes
+    /// nothing and where the real control lives.
+    #[test]
+    fn public_read_help_describes_the_flag_as_inert() {
+        use clap::CommandFactory;
+        let cmd = Config::command();
+        let arg = cmd
+            .get_arguments()
+            .find(|a| a.get_id() == "public_read")
+            .expect("the argument must exist");
+        let help = arg.get_help().map(|h| h.to_string()).unwrap_or_default();
+        assert!(
+            !help.contains("not wired"),
+            "the help still claims read enforcement is unwired: {help}"
+        );
+        assert!(
+            help.contains("inert"),
+            "the help must say the flag is inert so an operator does not rely on it: {help}"
+        );
+    }
+
     /// The flip must not strand an operator mid-upgrade.
     ///
     /// Turning the gate on is a breaking change for any deployment whose pushers are

crates/gitlawb-node/src/encrypted_pin.rs

@@ -69,6 +69,12 @@ fn resolve_all_recipients(dids: &BTreeSet<String>) -> Result<Vec<VerifyingKey>,
 enum SealPlan {
     /// An existing envelope already covers exactly this recipient set; nothing to do.
     SkipUnchanged,
+    /// The stored tag matches, but the stored reader set contains a DID that
+    /// must not resolve (e.g. a small-order did:key sealed before the choke
+    /// point landed). The old envelope is already public and cannot be
+    /// withdrawn, but it must be surfaced for operator action rather than
+    /// silently skipped as unchanged.
+    SkipUnresolvableStored(Vec<String>),
     /// No recipient DID resolved to a key, so there is nothing to seal to.
     SkipNoRecipients,
     /// At least one recipient DID is unresolvable. Fail closed: never seal to a
@@ -90,15 +96,30 @@ enum SealPlan {
 /// recover the blob; reader removal is not retroactive (the old envelope is
 /// already public). The comparison is on the opaque node-keyed tag, never the
 /// DID list.
+///
+/// A matching stored tag is normally a skip, but the set is still resolved
+/// before skipping: a reader that used to resolve and now must not (a
+/// small-order did:key sealed before the choke point landed) is surfaced as
+/// [`SealPlan::SkipUnresolvableStored`] instead of being silently treated as
+/// unchanged. The old envelope is already public and cannot be withdrawn, but
+/// the operator must be able to see that a persisted envelope was sealed to a
+/// weak recipient.
 fn plan_seal(node_seed: &[u8; 32], dids: &BTreeSet<String>, stored_tag: Option<&str>) -> SealPlan {
     let tag = recipients_tag(node_seed, dids);
     if stored_tag == Some(tag.as_str()) {
-        return SealPlan::SkipUnchanged;
-    }
-    match resolve_all_recipients(dids) {
-        Ok(keys) if keys.is_empty() => SealPlan::SkipNoRecipients,
-        Ok(keys) => SealPlan::Seal { keys, tag },
-        Err(unresolved) => SealPlan::SkipUnresolvable(unresolved),
+        // The stored envelope already covers exactly this set, so there is
+        // nothing to re-seal. Resolve anyway so a now-unresolvable reader in an
+        // unchanged set is surfaced rather than hidden by the tag match.
+        match resolve_all_recipients(dids) {
+            Ok(_) => SealPlan::SkipUnchanged,
+            Err(unresolved) => SealPlan::SkipUnresolvableStored(unresolved),
+        }
+    } else {
+        match resolve_all_recipients(dids) {
+            Ok(keys) if keys.is_empty() => SealPlan::SkipNoRecipients,
+            Ok(keys) => SealPlan::Seal { keys, tag },
+            Err(unresolved) => SealPlan::SkipUnresolvable(unresolved),
+        }
     }
 }
 
@@ -131,6 +152,21 @@ pub async fn encrypt_and_pin(
         // covered (which would permanently lock out the dropped readers, #47).
         let (keys, tag) = match plan_seal(node_seed, dids, stored_tag.as_deref()) {
             SealPlan::SkipUnchanged => continue,
+            SealPlan::SkipUnresolvableStored(unresolved) => {
+                // A stored envelope already covers this exact reader set, and
+                // the set now contains a DID that must not resolve (a
+                // small-order did:key sealed before the choke point landed).
+                // The old envelope is already public and cannot be withdrawn
+                // or re-sealed; surface it so the operator can act.
+                let sample: Vec<&String> = unresolved.iter().take(3).collect();
+                tracing::warn!(
+                    oid = %oid,
+                    unresolved_count = unresolved.len(),
+                    unresolved_sample = ?sample,
+                    "stored envelope was sealed to a recipient that must not resolve; operator action may be required"
+                );
+                continue;
+            }
             SealPlan::SkipNoRecipients => {
                 tracing::warn!(oid = %oid, "no resolvable recipient keys; skipping encrypted pin");
                 continue;
@@ -206,6 +242,49 @@ mod tests {
     use super::*;
     use ed25519_dalek::SigningKey;
 
+    /// A did:key encoding a small-order point. Well-formed, indistinguishable
+    /// from a real one by eye, and refused at resolution since the choke-point
+    /// guard landed.
+    fn weak_did_key() -> String {
+        let mut weak = [0u8; 32];
+        weak[0] = 1; // compressed identity point
+        let vk = ed25519_dalek::VerifyingKey::from_bytes(&weak).expect("decompresses");
+        Did::from_verifying_key(&vk).to_string()
+    }
+
+    /// The #47 fail-closed arm already refuses to seal to a partial recipient
+    /// set. Because a small-order did:key no longer RESOLVES, it lands in the
+    /// unresolved set and that existing arm catches it: nothing is sealed, and
+    /// no new code path was added to make that happen.
+    #[test]
+    fn weak_recipient_falls_into_the_existing_fail_closed_arm() {
+        let weak = weak_did_key();
+        let mut dids = BTreeSet::new();
+        dids.insert(did_key(9));
+        dids.insert(weak.clone());
+
+        match plan_seal(&[0u8; 32], &dids, None) {
+            SealPlan::SkipUnresolvable(unresolved) => assert!(
+                unresolved.contains(&weak),
+                "the weak DID must be named in the unresolved set, got {unresolved:?}"
+            ),
+            other => panic!("expected SkipUnresolvable, got {other:?}"),
+        }
+    }
+
+    /// Must-not-over-reject control: an all-legitimate recipient set still seals.
+    #[test]
+    fn legitimate_recipient_set_still_seals() {
+        let mut dids = BTreeSet::new();
+        dids.insert(did_key(9));
+        dids.insert(did_key(11));
+
+        match plan_seal(&[0u8; 32], &dids, None) {
+            SealPlan::Seal { keys, .. } => assert_eq!(keys.len(), 2, "both recipients resolve"),
+            other => panic!("expected Seal, got {other:?}"),
+        }
+    }
+
     fn did_key(seed: u8) -> String {
         let vk = SigningKey::from_bytes(&[seed; 32]).verifying_key();
         Did::from_verifying_key(&vk).to_string()
@@ -348,6 +427,43 @@ mod tests {
         ));
     }
 
+    /// P1 remediation (review): an unchanged reader set is normally a skip, but
+    /// the skip must not hide a recipient that now fails to resolve. A blob
+    /// sealed to a small-order did:key before the choke-point guard landed keeps
+    /// its old CID and stays decryptable-without-a-private-key unless the
+    /// matching-tag path surfaces it. This pins that the stored-tag match still
+    /// resolves the set instead of short-circuiting.
+    #[test]
+    fn plan_seal_surfaces_unresolvable_recipient_in_unchanged_reader_set() {
+        let weak = weak_did_key();
+        let mut dids = BTreeSet::new();
+        dids.insert(did_key(9));
+        dids.insert(weak.clone());
+        let stored = recipients_tag(&SEED, &dids);
+
+        match plan_seal(&SEED, &dids, Some(&stored)) {
+            SealPlan::SkipUnresolvableStored(unresolved) => assert!(
+                unresolved.contains(&weak),
+                "the weak DID must be named in the unresolved set, got {unresolved:?}"
+            ),
+            other => panic!("expected SkipUnresolvableStored, got {other:?}"),
+        }
+    }
+
+    /// Degenerate control: an empty set with a matching stored tag stays a
+    /// silent skip. The state is unreachable in practice (a seal is never
+    /// recorded for an empty reader set), so this pins only that the
+    /// resolve-on-match path must not turn it into a re-seal or a warning.
+    #[test]
+    fn plan_seal_unchanged_empty_set_still_skips() {
+        let empty = BTreeSet::new();
+        let empty_tag = recipients_tag(&SEED, &empty);
+        assert!(matches!(
+            plan_seal(&SEED, &empty, Some(&empty_tag)),
+            SealPlan::SkipUnchanged
+        ));
+    }
+
     #[test]
     fn plan_seal_reseals_when_recipient_set_changed() {
         // A stored tag for a DIFFERENT set is a miss: a newly added reader must

crates/gitlawb-node/src/git/issues.rs

@@ -129,6 +129,18 @@ pub fn list_issues(repo_path: &Path) -> Result<Vec<String>> {
 /// Returns Ok(Some(full_id)) on unique match, Ok(None) if not found,
 /// Err if the prefix is ambiguous (matches more than one issue).
 pub fn resolve_issue_id(repo_path: &Path, id_or_prefix: &str) -> Result<Option<String>> {
+    // The id comes from the request path and is spliced into a git revision and a
+    // for-each-ref pattern below. Issue ids are UUIDs, so accept only ASCII
+    // alphanumerics and '-': anything else (`^{blob}`, `@{0}`, `*`, `/`, `..`) is
+    // revision or glob syntax, never an issue id, and is reported as not found.
+    if id_or_prefix.is_empty()
+        || !id_or_prefix
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'-')
+    {
+        return Ok(None);
+    }
+
     // Try exact match first — fast path for callers passing the full UUID.
     let exact_ref = format!("refs/gitlawb/issues/{id_or_prefix}");
     let check = Command::new("git")
@@ -270,6 +282,35 @@ mod tests {
         assert_eq!(resolved, Some(full_id.to_string()));
     }
 
+    #[test]
+    fn test_resolve_rejects_revision_syntax() {
+        let dir = TempDir::new().unwrap();
+        init_repo(&dir);
+        let full_id = "abc12345-0000-0000-0000-000000000000";
+        create_issue(
+            dir.path(),
+            full_id,
+            r#"{"id":"abc12345-0000-0000-0000-000000000000","status":"open"}"#,
+        )
+        .unwrap();
+        // Each of these resolves to (or globs over) the issue blob in git, but none
+        // is an issue id, so the lookup must not accept it.
+        for crafted in [
+            "abc12345-0000-0000-0000-000000000000^{blob}",
+            "abc12345-0000-0000-0000-000000000000^{}",
+            "abc12345-0000-0000-0000-000000000000~0",
+            "*",
+            "",
+        ] {
+            assert_eq!(
+                resolve_issue_id(dir.path(), crafted).unwrap(),
+                None,
+                "{crafted:?}"
+            );
+            assert_eq!(get_issue(dir.path(), crafted).unwrap(), None, "{crafted:?}");
+        }
+    }
+
     #[test]
     fn test_resolve_prefix_not_found() {
         let dir = TempDir::new().unwrap();

crates/gitlawb-node/src/git/smart_http.rs

@@ -106,7 +106,7 @@ pub async fn info_refs(
 
     let mut command = Command::new(git_bin);
     command
-        .arg(service_to_command(service))
+        .arg(service_to_command(service)?)
         .arg("--stateless-rpc")
         .arg("--advertise-refs")
         .arg(repo_path);
@@ -426,7 +426,7 @@ async fn run_git_service(
 ) -> Result<Vec<u8>> {
     let mut command = Command::new(git_bin);
     command
-        .arg(service_to_command(service))
+        .arg(service_to_command(service)?)
         .arg("--stateless-rpc")
         .arg(repo_path);
     let (out, admission) = drive_git_child(command, input, timeout, service, admission).await?;
@@ -578,11 +578,13 @@ async fn drive_git_child(
     Ok((out, admission))
 }
 
-fn service_to_command(service: &str) -> &str {
+/// Map a validated service name to its git subcommand. Only the two fixed
+/// subcommands can come out, so an unrecognized service can never reach git's argv.
+fn service_to_command(service: &str) -> Result<&'static str> {
     match service {
-        "git-upload-pack" => "upload-pack",
-        "git-receive-pack" => "receive-pack",
-        _ => service,
+        "git-upload-pack" => Ok("upload-pack"),
+        "git-receive-pack" => Ok("receive-pack"),
+        other => bail!("unknown git service: {other}"),
     }
 }
 
@@ -866,6 +868,24 @@ mod tests {
     use std::process::Command;
     use tempfile::TempDir;
 
+    #[test]
+    fn service_to_command_maps_allowlist_and_rejects_passthrough() {
+        assert_eq!(
+            service_to_command("git-upload-pack").unwrap(),
+            "upload-pack"
+        );
+        assert_eq!(
+            service_to_command("git-receive-pack").unwrap(),
+            "receive-pack"
+        );
+        for bad in ["git-fetch-pack", "--version", "upload-pack", ""] {
+            assert!(
+                service_to_command(bad).is_err(),
+                "must reject passthrough for {bad:?}"
+            );
+        }
+    }
+
     /// List OIDs in a pack by writing it to a temp dir and running verify-pack.
     pub(super) fn pack_object_ids(pack: &[u8]) -> std::collections::HashSet<String> {
         let dir = TempDir::new().unwrap();

crates/gitlawb-node/src/git/store.rs

@@ -1,5 +1,5 @@
 use anyhow::{bail, Context, Result};
-use std::path::{Path, PathBuf};
+use std::path::Path;
 use std::process::Command;
 
 /// Initialize a new bare git repository with SHA-1 object format (default).
@@ -1091,8 +1091,19 @@ pub fn merge_branch(
 }
 
 /// Resolve a repo disk path: {repos_dir}/{owner_slug}/{repo_name}.git
-#[allow(dead_code)] // exercised from test_support and state tests; production uses validated_repo_disk_path
-pub fn repo_disk_path(repos_dir: &Path, owner_did: &str, repo_name: &str) -> PathBuf {
+///
+/// UNVALIDATED, and test-only for that reason. It performs the bare join with no
+/// allowlist, no containment check and no component walk, so it accepts an empty
+/// or traversal-bearing name. Production code must use
+/// `git::repo_store::validated_repo_disk_path`; the last production caller was
+/// `fork_repo`, which used this and turned a `{"name":""}` request into a repo
+/// row at `<repos_dir>/<owner_slug>/.git`. The `cfg(test)` is the guard: a new
+/// production caller fails to compile rather than silently skipping the barrier.
+///
+/// Tests keep it because a fixture that must escape `repos_dir` cannot be built
+/// with the validated form.
+#[cfg(test)]
+pub fn repo_disk_path(repos_dir: &Path, owner_did: &str, repo_name: &str) -> std::path::PathBuf {
     // Sanitize the DID for use as a directory name
     let owner_slug = owner_did.replace([':', '/'], "_");
     repos_dir.join(owner_slug).join(format!("{repo_name}.git"))

crates/gitlawb-node/src/graphql/mutation.rs

@@ -186,57 +186,78 @@ mod tests {
             .join("; ")
     }
 
-    /// N2: GraphQL mutations require a verified signer and bind the acting DID to
-    /// it. Unsigned is rejected; a signer other than the claimed actor is
+    /// N2: every GraphQL mutation requires a verified signer and binds the acting
+    /// DID to it. Unsigned is rejected; a signer other than the claimed actor is
     /// rejected; the matching signer passes the auth gate.
     #[sqlx::test]
-    async fn mutation_requires_and_binds_signer(pool: PgPool) {
+    async fn each_mutation_requires_and_binds_signer(pool: PgPool) {
         let state = crate::test_support::test_state(pool).await;
         let schema = state.graphql_schema.as_ref();
-        let assignee = "did:key:zASSIGNEEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let q = format!(
-            r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{assignee}") {{ id }} }}"#
-        );
+        let actor = "did:key:zGQLACTORAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+        let other = "did:key:zGQLOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+        let cases: Vec<(&str, String)> = vec![
+            (
+                "createTask",
+                format!(
+                    r#"mutation {{ createTask(delegatorDid: "{actor}", input: {{ kind: "build", capability: "repo:write" }}) {{ id }} }}"#
+                ),
+            ),
+            (
+                "claimTask",
+                format!(
+                    r#"mutation {{ claimTask(id: "no-such-task", assigneeDid: "{actor}") {{ id }} }}"#
+                ),
+            ),
+            (
+                "completeTask",
+                format!(
+                    r#"mutation {{ completeTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
+                ),
+            ),
+            (
+                "failTask",
+                format!(
+                    r#"mutation {{ failTask(id: "no-such-task", byDid: "{actor}", input: {{}}) {{ id }} }}"#
+                ),
+            ),
+        ];
 
-        // 1. Unsigned → rejected before any DB work.
-        let resp = schema.execute(Request::new(&q)).await;
-        assert!(
-            errors(&resp).contains("authentication required"),
-            "unsigned mutation must be rejected: {}",
-            errors(&resp)
-        );
+        for (name, q) in &cases {
+            let resp = schema.execute(Request::new(q.as_str())).await;
+            assert!(
+                errors(&resp).contains("authentication required"),
+                "{name}: unsigned mutation must be rejected: {}",
+                errors(&resp)
+            );
 
-        // 2. Signed as someone other than the claimed assignee → rejected.
-        let resp = schema
-            .execute(Request::new(&q).data(AuthenticatedDid(
-                "did:key:zOTHERBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB".into(),
-            )))
-            .await;
-        assert!(
-            errors(&resp).contains("authenticated signer"),
-            "DID mismatch must be rejected: {}",
-            errors(&resp)
-        );
+            let resp = schema
+                .execute(Request::new(q.as_str()).data(AuthenticatedDid(other.into())))
+                .await;
+            assert!(
+                errors(&resp).contains("authenticated signer"),
+                "{name}: DID mismatch must be rejected: {}",
+                errors(&resp)
+            );
 
-        // 3. Signed as the claimed assignee → passes the auth gate. The missing
-        //    task is a business error from claim_task, not a sqlx fault, so the
-        //    actionable message must survive (not the opaque DB string) (#250).
-        let resp = schema
-            .execute(Request::new(&q).data(AuthenticatedDid(assignee.into())))
-            .await;
-        let errs = errors(&resp);
-        assert!(
-            !errs.contains("authentication required") && !errs.contains("authenticated signer"),
-            "matching signer must pass the auth gate: {errs}"
-        );
-        assert!(
-            errs.contains("task not claimable"),
-            "claim race / missing task must keep its business message: {errs}"
-        );
-        assert!(
-            !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
-            "business error must not be rewritten as opaque DB error: {errs}"
-        );
+            let resp = schema
+                .execute(Request::new(q.as_str()).data(AuthenticatedDid(actor.into())))
+                .await;
+            let errs = errors(&resp);
+            assert!(
+                !errs.contains("authentication required") && !errs.contains("authenticated signer"),
+                "{name}: matching signer must pass the auth gate: {errs}"
+            );
+            if *name == "claimTask" {
+                assert!(
+                    errs.contains("task not claimable"),
+                    "claim race / missing task must keep its business message: {errs}"
+                );
+                assert!(
+                    !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
+                    "business error must not be rewritten as opaque DB error: {errs}"
+                );
+            }
+        }
     }
 
     /// #250: mutation DB faults must be opaque; create_task hits agent_tasks.

crates/gitlawb-node/src/ipfs_pin.rs

@@ -1508,9 +1508,6 @@ pub async fn pin_git_object(
         return Ok(String::new());
     }
 
-    // Compute the expected CIDv1 from the content bytes
-    let expected_cid = Cid::from_git_object_bytes(data).to_string();
-
     let url = format!(
         "{}/api/v0/add?cid-version=1&raw-leaves=true&pin=true",
         ipfs_api.trim_end_matches('/')
@@ -1557,6 +1554,10 @@ pub async fn pin_git_object(
         .text()
         .await
         .map_err(|e| anyhow::anyhow!("IPFS add response body read failed: {e}"))?;
+    // A 200 without a parseable Hash is not a successful pin. Fabricating the
+    // caller-computed CID would record an address the backend never confirmed;
+    // above its chunk threshold that raw CID is not even a stored block, so
+    // every later cat fails permanently.
     let cid = body
         .lines()
         .filter(|l| !l.trim().is_empty())
@@ -1565,7 +1566,17 @@ pub async fn pin_git_object(
             v["Hash"].as_str().map(|s| s.to_string())
         })
         .next_back()
-        .unwrap_or(expected_cid.clone());
+        .ok_or_else(|| {
+            anyhow::anyhow!(
+                "IPFS /api/v0/add returned 200 without a usable Hash: {:.200}",
+                body
+            )
+        })?;
+    // The string still has to be a CID. A garbage Hash would be recorded and
+    // later cat-ed the same way a missing one was, so reject it here.
+    Cid::from_str(&cid).map_err(|e| {
+        anyhow::anyhow!("IPFS /api/v0/add returned a Hash that is not a CID ({cid:.200}): {e}")
+    })?;
 
     tracing::debug!(sha256 = %sha256_hex, %cid, "pinned git object to IPFS");
     Ok(cid)
@@ -2223,16 +2234,16 @@ mod tests {
         endpoint
     }
 
-    /// A sleeping-but-live endpoint. Answers `200` with an empty body after
-    /// `delays[i]` for the i-th request it accepts (the last entry repeats), so
-    /// a test can make one add slow and the next fast. Drains the full request,
-    /// headers plus the declared `Content-Length` body, before sleeping: exactly
-    /// as in `rejecting_endpoint`, answering early and closing would surface as
-    /// a write failure on the client and turn a slow-but-healthy add into a
-    /// different failure shape.
+    /// A sleeping-but-live endpoint. Answers `200` with a conformant NDJSON add
+    /// response after `delays[i]` for the i-th request it accepts (the last
+    /// entry repeats), so a test can make one add slow and the next fast.
+    /// Drains the full request, headers plus the declared `Content-Length`
+    /// body, before sleeping: exactly as in `rejecting_endpoint`, answering
+    /// early and closing would surface as a write failure on the client and
+    /// turn a slow-but-healthy add into a different failure shape.
     ///
-    /// An empty body is a successful pin: `pin_git_object` falls back to the CID
-    /// it computed from the bytes when the response carries no `Hash`.
+    /// The Hash is a fixed, real CID: the timing tests assert on pin counts,
+    /// not on the recorded address.
     async fn delaying_endpoint(delays: Vec<Duration>) -> String {
         use tokio::io::{AsyncReadExt, AsyncWriteExt};
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -2269,9 +2280,14 @@ mod tests {
                         }
                     }
                     tokio::time::sleep(delay).await;
-                    let _ = sock
-                        .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
-                        .await;
+                    let body = br#"{"Hash":"bafkreifjjcie6lypi6ny7amxnfftagclbuxndqonfipmb64f2km2devei4","Size":"12"}
+"#;
+                    let resp = format!(
+                        "HTTP/1.1 200 OK\r\nContent-Type: application/x-ndjson\r\nContent-Length: {}\r\n\r\n",
+                        body.len()
+                    );
+                    let _ = sock.write_all(resp.as_bytes()).await;
+                    let _ = sock.write_all(body).await;
                     let _ = sock.flush().await;
                 });
             }
@@ -2373,6 +2389,71 @@ mod tests {
         );
     }
 
+    /// A 200 add response with no parseable Hash must surface as an add
+    /// failure. Falling back to the caller-computed CID records an
+    /// unverifiable address: above the backend's chunk threshold that raw
+    /// CID is not a stored block, so every later cat 500s.
+    #[tokio::test]
+    async fn pin_git_object_rejects_a_200_without_a_hash() {
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
+            .with_status(200)
+            .with_body(r#"{"Name":"object","Size":"19"}"#)
+            .create_async()
+            .await;
+        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
+        assert!(
+            result.is_err(),
+            "a 200 without a Hash must be an add failure, not a fabricated CID: {result:?}"
+        );
+    }
+
+    /// A Hash that is a string but not a CID must also fail. It would be
+    /// recorded into `encrypted_blobs.cid` and every later cat would miss.
+    #[tokio::test]
+    async fn pin_git_object_rejects_a_malformed_hash() {
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
+            .with_status(200)
+            .with_body(r#"{"Hash":"not-a-cid","Size":"19"}"#)
+            .create_async()
+            .await;
+        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
+        assert!(
+            result.is_err(),
+            "a Hash that is not a CID must be an add failure: {result:?}"
+        );
+    }
+
+    /// The Hash text goes into the error and `encrypted_pin` logs that error,
+    /// so a backend answering with a huge invalid Hash must not produce an
+    /// unbounded log entry.
+    #[tokio::test]
+    async fn pin_git_object_bounds_an_oversized_invalid_hash_in_the_error() {
+        let long = "x".repeat(5000);
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("POST", mockito::Matcher::Regex(r"^/api/v0/add".to_string()))
+            .with_status(200)
+            .with_body(format!(r#"{{"Hash":"{long}","Size":"19"}}"#))
+            .create_async()
+            .await;
+        let result = pin_git_object(&server.url(), "deadbeef", b"some object bytes\n", None).await;
+        let err = result.expect_err("an invalid Hash must be an add failure");
+        let msg = err.to_string();
+        assert!(
+            msg.len() < 1000,
+            "the error must bound the echoed Hash, got {} bytes",
+            msg.len()
+        );
+        assert!(
+            !msg.contains(&long),
+            "the error must not carry the full invalid Hash"
+        );
+    }
+
     /// The permit-hold bound. `pin_new_objects` runs under a deferring
     /// `pin_semaphore`, so without a batch deadline the hold is O(N) with N
     /// chosen by the pusher. Five objects against an endpoint that takes 2s

crates/gitlawb-node/src/main.rs

@@ -1,5 +1,7 @@
+mod ans104;
 mod api;
 mod arweave;
+mod arweave_v2;
 mod auth;
 mod bootstrap;
 mod cert;
@@ -84,7 +86,7 @@ async fn main() -> Result<()> {
 
     if !config.public_read {
         warn!(
-            "GITLAWB_PUBLIC_READ=false is reserved; per-repository private-read enforcement is not wired in alpha"
+            "GITLAWB_PUBLIC_READ=false has no effect; reads are gated per repository by is_public and path-scoped visibility rules, not this flag"
         );
     }
 

crates/gitlawb-node/src/metrics.rs

@@ -13,6 +13,9 @@
 //!     `gitlawb_webhook_deliveries_total{result}`
 //!   * is inbound gossip being admitted or shed, and for which reason?
 //!     `gitlawb_gossip_ingest_events_total{outcome}`
+//!   * is the gossip replay seen-set full, and therefore admitting events it
+//!     cannot deduplicate?
+//!     `gitlawb_gossip_replay_guard_saturated_total`
 //!   * how big are the packs we're sending and receiving? —
 //!     `gitlawb_pack_size_bytes`
 //!   * a single `gitlawb_info{version, did}` gauge = 1, for joins/dashboards
@@ -35,8 +38,8 @@
 use std::sync::OnceLock;
 
 use prometheus::{
-    Encoder, Histogram, HistogramOpts, IntCounterVec, IntGauge, IntGaugeVec, Opts, Registry,
-    TextEncoder,
+    Encoder, Histogram, HistogramOpts, IntCounter, IntCounterVec, IntGauge, IntGaugeVec, Opts,
+    Registry, TextEncoder,
 };
 
 /// The single, process-wide metrics registry. Initialized by [`init`].
@@ -52,6 +55,7 @@ static AUTH_FAILURES: OnceLock<IntCounterVec> = OnceLock::new();
 static SYNC_PROCESSED: OnceLock<IntCounterVec> = OnceLock::new();
 static WEBHOOK_DELIVERIES: OnceLock<IntCounterVec> = OnceLock::new();
 static GOSSIP_INGEST: OnceLock<IntCounterVec> = OnceLock::new();
+static GOSSIP_REPLAY_GUARD_SATURATED: OnceLock<IntCounter> = OnceLock::new();
 static PACK_SIZE: OnceLock<Histogram> = OnceLock::new();
 static PEERS_CONNECTED: OnceLock<IntGauge> = OnceLock::new();
 /// 1 when the node started without its p2p identity because the key storage
@@ -191,6 +195,18 @@ fn init_inner(version: &str, node_did: &str) {
         .set(gossip_ingest)
         .expect("set GOSSIP_INGEST once");
 
+    let gossip_replay_guard_saturated = IntCounter::with_opts(Opts::new(
+        "gitlawb_gossip_replay_guard_saturated_total",
+        "Inbound gossip ref-updates admitted without being recorded because the replay seen-set was at capacity",
+    ))
+    .expect("gitlawb_gossip_replay_guard_saturated_total definition");
+    registry
+        .register(Box::new(gossip_replay_guard_saturated.clone()))
+        .expect("register gitlawb_gossip_replay_guard_saturated_total");
+    GOSSIP_REPLAY_GUARD_SATURATED
+        .set(gossip_replay_guard_saturated)
+        .expect("set GOSSIP_REPLAY_GUARD_SATURATED once");
+
     let pack_size = Histogram::with_opts(
         HistogramOpts::new(
             "gitlawb_pack_size_bytes",
@@ -307,7 +323,8 @@ pub fn record_webhook_delivery(result: &str) {
 
 /// Record what the gossip ingest path decided about one inbound ref-update.
 /// `outcome` ∈ {accepted, unsigned_admitted, write_failed, rejected,
-/// source_rate_limited, author_rate_limited, unsigned_source_rate_limited}.
+/// source_rate_limited, author_rate_limited, unsigned_source_rate_limited,
+/// replayed, stale_timestamp}.
 ///
 /// `accepted` is reserved for signature-verified events. An unsigned event that
 /// survives the rolling-upgrade window is `unsigned_admitted`, so the
@@ -332,6 +349,38 @@ pub fn record_gossip_ingest(outcome: &str) {
     }
 }
 
+/// Record one inbound gossip ref-update that the replay seen-set could not
+/// record because it was at capacity.
+///
+/// Label-less on purpose: there is one degradation mode and nothing about it
+/// varies per event, so a label would only add cardinality.
+///
+/// This is an alert-worthy signal, not a debug counter, and it is the ONLY way
+/// the degraded state is visible. At capacity the guard fails open, which means
+/// the event is admitted and `gitlawb_gossip_ingest_events_total{outcome=
+/// "accepted"}` counts it exactly as it counts a healthy admission. Fail-open is
+/// the right policy (a saturated set that dropped all fresh gossip would convert
+/// a loud resource attack into quiet mesh-wide censorship), but it is not a free
+/// one: while this counter is moving, a captured signature can again be replayed
+/// against the freshness window's full 10 minutes, spending a `peer_exists`
+/// round trip and a debit from the victim author's budget on every replay.
+pub fn record_gossip_replay_guard_saturated() {
+    if let Some(c) = GOSSIP_REPLAY_GUARD_SATURATED.get() {
+        c.inc();
+    }
+}
+
+/// Test-only: current `gitlawb_gossip_replay_guard_saturated_total` value (0 if
+/// the registry is not initialized). Lets the seen-set tests assert the
+/// saturation signal fires without scraping the encoded text.
+#[cfg(test)]
+pub fn replay_guard_saturated_count_for_test() -> u64 {
+    GOSSIP_REPLAY_GUARD_SATURATED
+        .get()
+        .map(|c| c.get())
+        .unwrap_or(0)
+}
+
 /// Record a pack body size observation (bytes).
 pub fn observe_pack_size(bytes: f64) {
     if let Some(h) = PACK_SIZE.get() {
@@ -434,6 +483,11 @@ mod tests {
         record_auth_failure("test/route", "test_reason");
         record_sync_processed("done");
         record_webhook_delivery("ok");
+        // `record_gossip_replay_guard_saturated` is deliberately NOT called
+        // here. It is a label-less process-wide counter and the seen-set test
+        // that asserts it asserts a before/after delta, so an increment from a
+        // second test running concurrently in this binary would be a flake with
+        // no diagnostic value.
         record_gossip_ingest("accepted");
         observe_pack_size(1024.0);
         set_peers_connected(0);

crates/gitlawb-node/src/server.rs

@@ -42,17 +42,37 @@ async fn graphql_playground() -> impl IntoResponse {
     ))
 }
 
+/// Pre-auth body-buffer ceiling for every signed route group except the git write
+/// routes. Deliberately equal to axum's `DefaultBodyLimit` (2 MB), which is what
+/// these groups' `Bytes`/`Json` extractors already enforce: that default works
+/// through a request extension the extractors consult, and `require_signature`
+/// collects the raw body itself, so it never saw the cap. Matching the number
+/// keeps this change behavior-preserving on the response path (nothing that used
+/// to be accepted starts failing) and purely a memory fix.
+pub const SIGNED_BODY_LIMIT: usize = 2 * 1024 * 1024;
+
 /// Applies the standard auth middleware pair to a router: HTTP Signature verification
 /// followed by UCAN chain validation. The two layers run in this order for every
 /// matched request: `require_signature` first (sets `AuthenticatedDid`), then
 /// `require_ucan_chain` (reads it).
-fn add_auth_layers(router: Router<AppState>, state: AppState) -> Router<AppState> {
+///
+/// `body_limit` bounds the request body `require_signature` buffers before it has
+/// authenticated anything (see [`auth::SignatureBodyLimit`]): `max_pack_bytes` for
+/// the git write group, [`SIGNED_BODY_LIMIT`] for every other group.
+fn add_auth_layers(
+    router: Router<AppState>,
+    state: AppState,
+    body_limit: usize,
+) -> Router<AppState> {
     router
         .layer(middleware::from_fn_with_state(
             state,
             auth::require_ucan_chain,
         ))
-        .layer(middleware::from_fn(auth::require_signature))
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(body_limit),
+            auth::require_signature,
+        ))
 }
 
 pub fn build_router(state: AppState) -> Router {
@@ -63,7 +83,10 @@ pub fn build_router(state: AppState) -> Router {
         // Attach the verified DID to /graphql when a signature is present. The
         // layer covers only routes added before it, so /graphql/ws (added after,
         // read-only subscriptions) stays open.
-        .layer(middleware::from_fn(auth::optional_signature))
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
+            auth::optional_signature,
+        ))
         .route_service("/graphql/ws", GraphQLSubscription::new(schema));
 
     // ── Task routes (write — require HTTP Signature) ───────────────────────
@@ -74,6 +97,7 @@ pub fn build_router(state: AppState) -> Router {
             .route("/api/v1/tasks/{id}/complete", post(tasks::complete_task))
             .route("/api/v1/tasks/{id}/fail", post(tasks::fail_task)),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     );
 
     // ── Task routes (read — open) ──────────────────────────────────────────
@@ -107,6 +131,7 @@ pub fn build_router(state: AppState) -> Router {
             .layer(middleware::from_fn(rate_limit::rate_limit_by_did))
             .layer(axum::Extension(limiter)),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(create_ip_limiter));
@@ -181,6 +206,7 @@ pub fn build_router(state: AppState) -> Router {
                 axum::routing::delete(agents::deregister_agent),
             ),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     );
 
     // Body limit is raised to GITLAWB_MAX_PACK_BYTES (default 2 GB) for git
@@ -205,6 +231,7 @@ pub fn build_router(state: AppState) -> Router {
             .layer(DefaultBodyLimit::disable())
             .layer(RequestBodyLimitLayer::new(pack_limit)),
         state.clone(),
+        pack_limit,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(push_limiter));
@@ -225,12 +252,19 @@ pub fn build_router(state: AppState) -> Router {
     };
     let ipfs_routes = Router::new()
         .route("/ipfs/{cid}", get(ipfs::get_by_cid))
-        .layer(middleware::from_fn(auth::optional_signature))
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
+            auth::optional_signature,
+        ))
         .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
         .layer(axum::Extension(ipfs_limiter))
         .merge(Router::new().route("/api/v1/ipfs/pins", get(ipfs::list_pins)));
 
     // ── Arweave permanent anchors ──────────────────────────────────────────
+    // List endpoint only (public; issue #134 tracks surfacing
+    // visibility rules on list). The verify endpoint and its probe
+    // are deferred to the vertical slice with the uploader and a
+    // real provider contract (reviewer 2, #26 split 2/4 round 5).
     let arweave_routes = Router::new().route("/api/v1/arweave/anchors", get(arweave::list_anchors));
 
     // ── Bounty routes (write — require HTTP Signature) ─────────────────
@@ -258,6 +292,7 @@ pub fn build_router(state: AppState) -> Router {
                 post(bounties::dispute_bounty),
             ),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     );
 
     // ── Bounty routes (read — open) ──────────────────────────────────────
@@ -273,12 +308,16 @@ pub fn build_router(state: AppState) -> Router {
             "/api/v1/agents/{did}/bounties",
             get(bounties::agent_bounty_stats),
         )
-        .layer(middleware::from_fn(auth::optional_signature));
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
+            auth::optional_signature,
+        ));
 
     // ── Profile routes (write — require HTTP Signature) ─────────────────
     let profile_write_routes = add_auth_layers(
         Router::new().route("/api/v1/profile", axum::routing::put(profiles::set_profile)),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     );
 
     // ── Issue routes (write — require HTTP Signature, no rate limit) ─────
@@ -293,6 +332,7 @@ pub fn build_router(state: AppState) -> Router {
                 post(issues::create_issue_comment),
             ),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     );
 
     // ── Peer discovery routes ─────────────────────────────────────────────
@@ -311,6 +351,7 @@ pub fn build_router(state: AppState) -> Router {
     let sync_trigger_routes = add_auth_layers(
         Router::new().route("/api/v1/sync/trigger", post(peers::trigger_sync)),
         state.clone(),
+        SIGNED_BODY_LIMIT,
     )
     .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
     .layer(axum::Extension(rate_limit::IpRateLimiter {
@@ -327,9 +368,12 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/v1/peers/announce", post(peers::announce))
         .route("/api/v1/sync/notify", post(peers::notify_sync));
     peer_write_routes = if state.config.require_signed_peer_writes {
-        add_auth_layers(peer_write_routes, state.clone())
+        add_auth_layers(peer_write_routes, state.clone(), SIGNED_BODY_LIMIT)
     } else {
-        peer_write_routes.layer(middleware::from_fn(auth::optional_signature))
+        peer_write_routes.layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
+            auth::optional_signature,
+        ))
     };
     let peer_write_routes = peer_write_routes
         .layer(middleware::from_fn(rate_limit::rate_limit_by_ip))
@@ -428,7 +472,10 @@ pub fn build_router(state: AppState) -> Router {
             "/api/v1/repos/{owner}/{repo}/replicas",
             get(replicas::list_replicas),
         )
-        .layer(middleware::from_fn(auth::optional_signature));
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(SIGNED_BODY_LIMIT),
+            auth::optional_signature,
+        ));
 
     // git-upload-pack (clone/fetch) — same raised body limit as receive-pack so
     // large pack responses from the server don't get truncated on the client side.
@@ -460,7 +507,13 @@ pub fn build_router(state: AppState) -> Router {
         )
         .layer(DefaultBodyLimit::disable())
         .layer(RequestBodyLimitLayer::new(pack_limit))
-        .layer(middleware::from_fn(auth::optional_signature));
+        // `pack_limit`, not SIGNED_BODY_LIMIT: git-upload-pack POSTs live here and
+        // the group has deliberately raised its ceiling, so the pre-auth buffer for
+        // a signed fetch negotiation must match rather than narrow it.
+        .layer(middleware::from_fn_with_state(
+            auth::SignatureBodyLimit(pack_limit),
+            auth::optional_signature,
+        ));
 
     // ── Meta ──────────────────────────────────────────────────────────────
     let meta_routes = Router::new()

crates/gl/Cargo.toml

@@ -42,3 +42,4 @@ alloy = { version = "1", default-features = false, features = [
 mockito = "1"
 tempfile = "3"
 tokio = { workspace = true }
+ed25519-dalek = { workspace = true }

crates/gl/src/agent.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -65,24 +64,16 @@ async fn cmd_list(node: String, capability: Option<String>) -> Result<()> {
         .get(&path)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-
-    if status == reqwest::StatusCode::NOT_FOUND {
+    // Keep the bespoke 404 hint (older node without the agents API) ahead of
+    // read_json; every other status routes through it (capped + sanitized error).
+    if resp.status() == reqwest::StatusCode::NOT_FOUND {
         anyhow::bail!(
             "this node does not yet support the agents API (v0.3+)\n\
              upgrade the node or check GITLAWB_NODE is pointing to the right server"
         );
     }
 
-    let body: Value = resp
-        .json()
-        .await
-        .context("invalid JSON from node — is GITLAWB_NODE correct?")?;
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list agents failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "list agents").await?;
 
     let agents = body["agents"].as_array().cloned().unwrap_or_default();
 
@@ -125,24 +116,15 @@ async fn cmd_show(did: String, node: String) -> Result<()> {
         .get(&format!("/api/v1/agents/{did}"))
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-
-    if status == reqwest::StatusCode::NOT_FOUND {
+    // Keep the bespoke 404 hint ahead of read_json; other statuses route through it.
+    if resp.status() == reqwest::StatusCode::NOT_FOUND {
         anyhow::bail!(
             "agent not found, or this node does not yet support the agents API (v0.3+)\n\
              upgrade the node or check GITLAWB_NODE is pointing to the right server"
         );
     }
 
-    let agent: Value = resp
-        .json()
-        .await
-        .context("invalid JSON from node — is GITLAWB_NODE correct?")?;
-
-    if !status.is_success() {
-        let msg = agent["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("agent not found ({status}): {msg}");
-    }
+    let agent = crate::http::read_json(resp, "agent").await?;
 
     let full_did = agent["did"].as_str().unwrap_or("?");
     let trust = agent["trust_score"].as_f64().unwrap_or(0.0);
@@ -223,11 +205,14 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
         let err = cmd_list(server.url(), None).await.unwrap_err();
         assert!(err.to_string().contains("agents API"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -238,11 +223,14 @@ mod tests {
             .with_status(500)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"internal error"}"#)
+            .expect(1)
             .create_async()
             .await;
 
         let err = cmd_list(server.url(), None).await.unwrap_err();
         assert!(err.to_string().contains("list agents failed"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -269,6 +257,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"agent not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -276,6 +265,8 @@ mod tests {
             .await
             .unwrap_err();
         assert!(err.to_string().contains("agents API") || err.to_string().contains("not found"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]

crates/gl/src/bounty.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -221,13 +220,7 @@ async fn cmd_create(
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("create bounty failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "create bounty").await?;
 
     let id = body["id"].as_str().unwrap_or("?");
     println!("Bounty created: {id}");
@@ -263,11 +256,14 @@ async fn cmd_list(
         u
     };
 
-    let resp = client
-        .get_authed(&url)
-        .await
-        .context("failed to connect to node")?;
-    let body: Value = resp.json().await.unwrap_or_default();
+    let body = crate::http::read_json(
+        client
+            .get_authed(&url)
+            .await
+            .context("failed to connect to node")?,
+        "bounties",
+    )
+    .await?;
 
     let bounties = body["bounties"].as_array();
     if let Some(arr) = bounties {
@@ -291,13 +287,7 @@ async fn cmd_show(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
     let client = signed_client(&node, dir.as_deref());
     let resp = client.get_authed(&format!("/api/v1/bounties/{id}")).await?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("not found");
-        anyhow::bail!("bounty not found: {msg}");
-    }
+    let body = crate::http::read_json(resp, "show bounty").await?;
 
     println!("{}", serde_json::to_string_pretty(&body)?);
     Ok(())
@@ -321,13 +311,7 @@ async fn cmd_claim(
         )
         .await?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("claim failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "claim").await?;
 
     println!("Bounty {id} claimed. Deadline starts now.");
     Ok(())
@@ -346,13 +330,7 @@ async fn cmd_submit(id: String, pr: String, node: String, dir: Option<PathBuf>)
         )
         .await?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("submit failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "submit").await?;
 
     println!("Bounty {id} submitted with PR {pr}. Awaiting creator approval.");
     Ok(())
@@ -376,13 +354,7 @@ async fn cmd_approve(
         )
         .await?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("approve failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "approve").await?;
 
     println!("Bounty {id} approved! Payout released to agent.");
     Ok(())
@@ -401,13 +373,7 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
         )
         .await?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("cancel failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "cancel").await?;
 
     println!("Bounty {id} cancelled. Tokens refunded.");
     Ok(())
@@ -415,8 +381,11 @@ async fn cmd_cancel(id: String, node: String, dir: Option<PathBuf>) -> Result<()
 
 async fn cmd_stats(node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    let resp = client.get("/api/v1/bounties/stats").await?;
-    let body: Value = resp.json().await.unwrap_or_default();
+    // Route through read_json so a node denial (403/404/5xx, incl. a non-JSON
+    // body) surfaces as an error instead of a fake `Bounty Stats` with every
+    // counter zeroed (#186, the denial-as-success class #123 fixes elsewhere).
+    let body =
+        crate::http::read_json(client.get("/api/v1/bounties/stats").await?, "bounty stats").await?;
 
     let open = body["open"].as_i64().unwrap_or(0);
     let claimed = body["claimed"].as_i64().unwrap_or(0);
@@ -553,6 +522,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -560,6 +530,8 @@ mod tests {
             .await
             .unwrap_err();
         assert!(err.to_string().contains("not found"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -576,4 +548,86 @@ mod tests {
 
         cmd_stats(server.url()).await.unwrap();
     }
+
+    /// #186 (F1): a node denial on the stats endpoint must surface as an error,
+    /// not print a fake `Bounty Stats` with every counter zeroed. RED before the
+    /// fix (unwrap_or_default + no status check -> Ok with zeros), GREEN after
+    /// (read_json bails on the non-2xx).
+    #[tokio::test]
+    async fn cmd_stats_surfaces_denial_not_fake_result() {
+        let mut server = mockito::Server::new_async().await;
+        let m = server
+            .mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"forbidden"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_stats(server.url())
+            .await
+            .expect_err("a 403 must be an error, not a zeroed fake result");
+        assert!(err.to_string().contains("403"), "err={err}");
+        // Pin the mock hit explicitly. The status assertion above already fails
+        // when the route does not match (mockito answers an unmatched route with
+        // 501, so "403" is absent), but that proof is incidental to mockito's
+        // fallback status; assert the hit directly so it survives a reworded
+        // assertion.
+        m.assert_async().await;
+    }
+
+    /// #186 (F1): the same denial-as-error behavior across the non-2xx response
+    /// classes, not just 403 — a 404 and a 500 (incl. a non-JSON body) must each
+    /// surface as an error with the status, never a zeroed fake result.
+    #[tokio::test]
+    async fn cmd_stats_surfaces_denial_across_status_classes() {
+        for (status, body, json) in [
+            (404, r#"{"message":"not found"}"#, true),
+            (500, "internal boom", false),
+        ] {
+            let mut server = mockito::Server::new_async().await;
+            let mut m = server
+                .mock("GET", mockito::Matcher::Regex(r"/stats$".to_string()))
+                .with_status(status)
+                .with_body(body);
+            if json {
+                m = m.with_header("content-type", "application/json");
+            }
+            let m = m.expect(1).create_async().await;
+
+            let err = cmd_stats(server.url()).await.unwrap_err().to_string();
+            assert!(
+                err.contains(&status.to_string()),
+                "status {status} must surface as an error, got: {err}"
+            );
+            m.assert_async().await;
+        }
+    }
+
+    #[tokio::test]
+    async fn cmd_list_repo_scoped_surfaces_denial_not_empty() {
+        // `gl bounty list --repo owner/name` hits the gated /repos/{o}/{n}/bounties;
+        // a 404 must Err, not silently print nothing.
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/repos/alice/secret/bounties".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_list(Some("alice/secret".to_string()), None, server.url(), None).await;
+        assert!(
+            result.is_err(),
+            "bounty list --repo must Err on a gated 404"
+        );
+        // Prove the gated repo-scoped path was actually requested: without this,
+        // an unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
+        _m.assert_async().await;
+    }
 }

crates/gl/src/cert.rs

@@ -4,7 +4,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -90,12 +89,7 @@ async fn resolve_repo(
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = signed_client(node, dir);
-            let info: Value = client
-                .get_authed("/")
-                .await?
-                .json()
-                .await
-                .context("failed to fetch node info")?;
+            let info = crate::http::read_json(client.get_authed("/").await?, "node info").await?;
             let did = info["did"].as_str().context("node info missing 'did'")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -108,12 +102,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     let client = signed_client(&node, dir.as_deref());
     let path = format!("/api/v1/repos/{owner}/{name}/certs");
-    let resp: Value = client
-        .get_authed(&path)
-        .await?
-        .json()
-        .await
-        .context("failed to list certificates")?;
+    let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
 
     let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
 
@@ -147,14 +136,10 @@ async fn cmd_show(
     let client = signed_client(&node, dir.as_deref());
     let id = resolve_cert_id(&client, &owner, &name, &id).await?;
 
-    // Fetch the certificate
+    // Fetch the certificate. read_json checks status first and surfaces the node's
+    // capped+sanitized message on a non-2xx (a bounded error read, not the whole body).
     let path = format!("/api/v1/repos/{owner}/{name}/certs/{id}");
-    let resp = client
-        .get_authed(&path)
-        .await?
-        .error_for_status()
-        .context("certificate not found")?;
-    let cert: Value = resp.json().await.context("certificate not found")?;
+    let cert = crate::http::read_json(client.get_authed(&path).await?, "certificate").await?;
 
     let cert_id = cert["id"].as_str().unwrap_or("?");
     let ref_name = cert["ref_name"].as_str().unwrap_or("?");
@@ -199,27 +184,20 @@ async fn cmd_show(
 
     // Contextual only — the verdict above stands on its own, so a node-info
     // hiccup here must not turn a successfully displayed certificate into an
-    // error exit.
-    let current_node_did = match client.get("/").await {
-        Ok(resp) => resp
-            .json::<Value>()
-            .await
-            .ok()
-            .and_then(|info| info["did"].as_str().map(str::to_string)),
-        Err(_) => None,
+    // error exit. Route the lookup through read_json so a denial or a capped
+    // error body yields a reportable reason instead of an opaque None, and keep
+    // "carried no DID" distinct from "the lookup failed": an empty DID must not
+    // reach the comparison and fabricate a mismatch warning.
+    let current: std::result::Result<String, String> = match client.get("/").await {
+        Ok(resp) => match crate::http::read_json(resp, "node info").await {
+            Ok(info) => did_from_node_info(&info),
+            Err(e) => Err(e.to_string()),
+        },
+        Err(e) => Err(e.to_string()),
     };
-    match current_node_did.as_deref() {
-        Some(current) if current == node_did => {
-            println!("  Issuing node DID matches the node being queried.");
-        }
-        Some(current) => {
-            println!("  WARNING: Certificate node DID ({node_did}) does not match");
-            println!("           current node DID ({current}).");
-            println!("           This certificate was issued by a different node.");
-        }
-        None => {
-            println!("  NOTE: could not fetch current node info — skipping node-DID comparison.");
-        }
+    let current_node_did = current.as_ref().ok().cloned();
+    for line in did_check_report(&current, node_did) {
+        println!("{line}");
     }
 
     if require_valid {
@@ -247,6 +225,46 @@ async fn cmd_show(
     Ok(())
 }
 
+/// Pull the node's DID out of a `GET /` body for the comparison in `cmd_show`.
+///
+/// A missing OR empty `did` is a failure, not a value: letting `""` through
+/// would reach the comparison and print a mismatch WARNING against a DID the
+/// node never claimed, which reads as "issued by a different node" when the
+/// truth is that the lookup told us nothing.
+fn did_from_node_info(info: &serde_json::Value) -> std::result::Result<String, String> {
+    match info["did"].as_str() {
+        Some(did) if !did.is_empty() => Ok(did.to_string()),
+        _ => Err("node info response carried no DID".to_string()),
+    }
+}
+
+/// Select the report lines for the node-DID comparison in `cmd_show`.
+///
+/// `current` is the current node's DID, or the reason it could not be
+/// determined. A comparison verdict (match or WARNING) is only produced when a
+/// real DID was obtained; otherwise the report degrades to a could-not-compare
+/// hint naming the reason, plus the offline-verification guidance. The signature
+/// verdict printed above stands on its own either way — this block only answers
+/// *which* node issued the certificate.
+fn did_check_report(current: &std::result::Result<String, String>, node_did: &str) -> Vec<String> {
+    match current {
+        Ok(current) if current == node_did => {
+            vec!["  Issuing node DID matches the node being queried.".to_string()]
+        }
+        Ok(current) => vec![
+            format!("  WARNING: Certificate node DID ({node_did}) does not match"),
+            format!("           current node DID ({current})."),
+            "           This certificate was issued by a different node.".to_string(),
+        ],
+        Err(reason) => vec![
+            format!("  Could not fetch the current node's DID ({reason}), so the comparison"),
+            "  with the certificate's node DID is unavailable.".to_string(),
+            "  To verify offline, use the node's Ed25519 public key derived from:".to_string(),
+            format!("    did:key → {node_did}"),
+        ],
+    }
+}
+
 /// Rebuild the node's canonical signing payload (field order must match
 /// gitlawb-node/src/cert.rs::issue_ref_certificate exactly) and verify the
 /// certificate's Ed25519 signature against the key embedded in `node_did`.
@@ -299,14 +317,7 @@ async fn resolve_cert_id(client: &NodeClient, owner: &str, name: &str, id: &str)
     }
 
     let path = format!("/api/v1/repos/{owner}/{name}/certs?prefix={id}");
-    let resp: Value = client
-        .get_authed(&path)
-        .await?
-        .error_for_status()
-        .context("failed to list certificates")?
-        .json()
-        .await
-        .context("failed to list certificates")?;
+    let resp = crate::http::read_json(client.get_authed(&path).await?, "certificates").await?;
 
     let certs = resp["certificates"].as_array().cloned().unwrap_or_default();
     let matches: Vec<String> = certs
@@ -405,4 +416,558 @@ mod tests {
         );
         assert!(garbage.is_err(), "malformed signature must not verify");
     }
+
+    #[tokio::test]
+    async fn cmd_list_surfaces_denial_not_empty() {
+        // A gated 404 on the repo-scoped certs read must Err, not print "No certificates".
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/certs$".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
+        assert!(result.is_err(), "cert list must Err on a gated 404");
+        // Prove the gated certs path was actually requested: without this, an
+        // unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn resolve_repo_surfaces_denial() {
+        // A slash-free repo with an empty identity dir forces the GET / node-info
+        // fetch. A gated 404 there must Err (surfacing the status), proving the
+        // read_json conversion is load-bearing rather than silently ignored.
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
+        let _m = server
+            .mock("GET", "/")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    // The `GET /` node-info lookup after the cert loads is a fail-soft diagnostic:
+    // a response-level failure degrades to a could-not-compare hint and the command
+    // completes Ok, never a fabricated mismatch warning and never a fatal Err. The
+    // cert fetch itself stays fail-closed. A >=36-char id skips resolve_cert_id so
+    // only two mocks are needed.
+    #[tokio::test]
+    async fn cmd_show_completes_with_degraded_hint_when_node_info_denied() {
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
+            )
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let result = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await;
+        assert!(
+            result.is_ok(),
+            "cert show must complete despite a denied node-info lookup"
+        );
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_show_degrades_on_malformed_node_info() {
+        // A 2xx node-info body that fails to parse degrades the same way a denial
+        // does: hint printed, command completes Ok.
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
+            )
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(200)
+            .with_body("not json")
+            .expect(1)
+            .create_async()
+            .await;
+
+        let result = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await;
+        assert!(
+            result.is_ok(),
+            "cert show must complete despite malformed node info"
+        );
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_show_degrades_when_node_info_lacks_did() {
+        // A 2xx node-info body with no `did` routes to the degraded hint, not a
+        // fabricated empty-DID mismatch warning; the command completes Ok.
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
+            )
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body("{}")
+            .expect(1)
+            .create_async()
+            .await;
+
+        let result = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await;
+        assert!(
+            result.is_ok(),
+            "cert show must complete when node info lacks a DID"
+        );
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    // Must-not case: the certificate fetch itself stays fail-closed. A gated 404
+    // aborts the command with the status surfaced, and the node-info lookup is
+    // never reached (the expect(0) assert proves it never ran).
+    #[tokio::test]
+    async fn cmd_show_surfaces_denied_certificate() {
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"did":"n"}"#)
+            .expect(0)
+            .create_async()
+            .await;
+
+        let err = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await
+        .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_show_reports_matching_node_did() {
+        // Pins the unchanged success path: node info fetched, DIDs compared, Ok.
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
+            )
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"did":"n"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let result = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await;
+        assert!(result.is_ok(), "cert show must report a matching node DID");
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_show_warns_on_mismatching_node_did() {
+        // A real, differing node DID drives the WARNING branch end to end; the
+        // command still completes Ok.
+        let mut server = mockito::Server::new_async().await;
+        let long_id = "a".repeat(36);
+        let _cert = server
+            .mock(
+                "GET",
+                format!("/api/v1/repos/alice/secret/certs/{long_id}").as_str(),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(
+                r#"{"id":"c1","ref_name":"refs/heads/main","old_sha":"0","new_sha":"1","pusher_did":"p","node_did":"n","signature":"s","issued_at":"2026-01-01T00:00:00Z"}"#,
+            )
+            .create_async()
+            .await;
+        let _root = server
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"did":"did:key:other"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let result = cmd_show(
+            "alice/secret".to_string(),
+            long_id,
+            server.url(),
+            None,
+            false,
+            None,
+        )
+        .await;
+        assert!(
+            result.is_ok(),
+            "cert show must warn, not fail, on a mismatching node DID"
+        );
+        _cert.assert_async().await;
+        _root.assert_async().await;
+    }
+
+    // ── --verify issuer anchoring ────────────────────────────────────────────
+    //
+    // Every other cmd_show test passes require_valid=false, so the whole
+    // `if require_valid` block went unexecuted. It is the security-bearing half of
+    // the command: a valid signature only proves the certificate is internally
+    // consistent (a hostile node can mint a keypair, name it in node_did, and
+    // self-sign), so --verify must additionally anchor the issuer to a DID the
+    // caller trusts. These drive all four outcomes plus the must-not case.
+    //
+    // The certificate must carry a REAL signature over the canonical payload:
+    // with a bogus one, --verify bails on the signature and never reaches the
+    // anchoring, which would make every assertion below vacuous.
+    fn signed_cert(node_kp: &gitlawb_core::identity::Keypair) -> (String, String) {
+        let node_did = node_kp.did().as_str().to_string();
+        let id = "a".repeat(36); // >= 36 chars skips resolve_cert_id's prefix lookup
+        let payload = serde_json::json!({
+            "repo_id": "repo-1",
+            "ref":     "refs/heads/main",
+            "old":     "0".repeat(40),
+            "new":     "b".repeat(40),
+            "pusher":  "did:key:z6MkPusher",
+            "node":    node_did,
+            "ts":      "2026-07-22T00:00:00+00:00",
+        });
+        let sig = node_kp.sign_b64(&serde_json::to_vec(&payload).unwrap());
+        let body = serde_json::json!({
+            "id": id,
+            "repo_id": "repo-1",
+            "ref_name": "refs/heads/main",
+            "old_sha": "0".repeat(40),
+            "new_sha": "b".repeat(40),
+            "pusher_did": "did:key:z6MkPusher",
+            "node_did": node_did,
+            "signature": sig,
+            "issued_at": "2026-07-22T00:00:00+00:00",
+        })
+        .to_string();
+        (id, body)
+    }
+
+    /// Mount the cert fetch, plus a `GET /` answering with `node_info` (a JSON
+    /// body) or a denial when `None`.
+    async fn cert_server(
+        server: &mut mockito::Server,
+        id: &str,
+        cert_body: &str,
+        node_info: Option<&str>,
+    ) -> (mockito::Mock, mockito::Mock) {
+        let cert = server
+            .mock("GET", format!("/api/v1/repos/alice/r/certs/{id}").as_str())
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(cert_body)
+            .expect(1)
+            .create_async()
+            .await;
+        let root = match node_info {
+            Some(b) => {
+                server
+                    .mock("GET", "/")
+                    .with_status(200)
+                    .with_header("content-type", "application/json")
+                    .with_body(b)
+                    .create_async()
+                    .await
+            }
+            None => {
+                server
+                    .mock("GET", "/")
+                    .with_status(403)
+                    .with_header("content-type", "application/json")
+                    .with_body(r#"{"message":"denied"}"#)
+                    .create_async()
+                    .await
+            }
+        };
+        (cert, root)
+    }
+
+    #[tokio::test]
+    async fn verify_ok_when_issuing_node_is_the_queried_node() {
+        let kp = gitlawb_core::identity::Keypair::generate();
+        let (id, body) = signed_cert(&kp);
+        let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
+        let mut server = mockito::Server::new_async().await;
+        let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
+
+        let got = cmd_show("alice/r".to_string(), id, server.url(), None, true, None).await;
+        assert!(got.is_ok(), "valid sig + matching issuer must pass");
+        cert.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn verify_bails_when_issuer_is_a_different_node() {
+        // The self-signing-hostile-node case: the signature verifies against the
+        // key the cert names, but that key is not the node we queried.
+        let kp = gitlawb_core::identity::Keypair::generate();
+        let (id, body) = signed_cert(&kp);
+        let other = gitlawb_core::identity::Keypair::generate();
+        let info = format!(r#"{{"did":"{}"}}"#, other.did().as_str());
+        let mut server = mockito::Server::new_async().await;
+        let (cert, _root) = cert_server(&mut server, &id, &body, Some(&info)).await;
+
+        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("expected issuer"), "got: {err}");
+        cert.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn verify_bails_when_node_info_denied_and_no_expect_node() {
+        // Fail closed: with no trusted DID to anchor against, --verify must NOT
+        // fall through to a pass just because the signature checked out.
+        let kp = gitlawb_core::identity::Keypair::generate();
+        let (id, body) = signed_cert(&kp);
+        let mut server = mockito::Server::new_async().await;
+        let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
+
+        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("cannot anchor the issuer"), "got: {err}");
+        cert.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn verify_ok_when_expect_node_anchors_a_denied_lookup() {
+        // --expect-node supplies the trust anchor the denied lookup could not, so
+        // the same denial that fails the case above now passes.
+        let kp = gitlawb_core::identity::Keypair::generate();
+        let (id, body) = signed_cert(&kp);
+        let mut server = mockito::Server::new_async().await;
+        let (cert, _root) = cert_server(&mut server, &id, &body, None).await;
+
+        let got = cmd_show(
+            "alice/r".to_string(),
+            id,
+            server.url(),
+            None,
+            true,
+            Some(kp.did().as_str().to_string()),
+        )
+        .await;
+        assert!(got.is_ok(), "explicit anchor must pass");
+        cert.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn verify_bails_on_a_bad_signature_before_anchoring() {
+        // The must-not: a forged certificate naming the queried node must fail on
+        // the signature, even though its issuer would otherwise anchor cleanly.
+        let kp = gitlawb_core::identity::Keypair::generate();
+        let (id, body) = signed_cert(&kp);
+        let forged = body.replace(&"b".repeat(40), &"c".repeat(40));
+        let info = format!(r#"{{"did":"{}"}}"#, kp.did().as_str());
+        let mut server = mockito::Server::new_async().await;
+        let (cert, _root) = cert_server(&mut server, &id, &forged, Some(&info)).await;
+
+        let err = cmd_show("alice/r".to_string(), id, server.url(), None, true, None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(err.contains("signature did not verify"), "got: {err}");
+        cert.assert_async().await;
+    }
+
+    // The must-not case for the DID extraction: an empty or missing `did` has to
+    // become a could-not-compare reason. If it leaks through as a value, the
+    // comparison below fabricates a mismatch WARNING against a DID the node
+    // never claimed.
+    #[test]
+    fn did_from_node_info_rejects_empty_and_missing() {
+        assert!(did_from_node_info(&serde_json::json!({"did": "n"})).is_ok());
+        for body in [
+            serde_json::json!({"did": ""}),
+            serde_json::json!({}),
+            serde_json::json!({"did": 7}),
+        ] {
+            let got = did_from_node_info(&body);
+            assert!(
+                got.is_err(),
+                "must not yield a comparable DID: {body} -> {got:?}"
+            );
+        }
+        // And the reason it produces must route to the degraded hint, never a verdict.
+        let report =
+            did_check_report(&did_from_node_info(&serde_json::json!({"did": ""})), "n").join("\n");
+        assert!(
+            !report.contains("WARNING"),
+            "fabricated a mismatch: {report}"
+        );
+        assert!(report.contains("Could not fetch"), "got: {report}");
+    }
+
+    // did_check_report is the three-way selector between the match text, the
+    // mismatch WARNING, and the degraded could-not-compare hint. Substring
+    // asserts (not full-line equality) so cosmetic wording edits don't break them.
+
+    #[test]
+    fn did_check_report_match() {
+        let report = did_check_report(&Ok("n".to_string()), "n").join("\n");
+        assert!(
+            report.contains("matches the node being queried"),
+            "got: {report}"
+        );
+        assert!(!report.contains("WARNING"), "got: {report}");
+        assert!(!report.contains("Could not fetch"), "got: {report}");
+    }
+
+    #[test]
+    fn did_check_report_mismatch() {
+        let report = did_check_report(&Ok("did:key:other".to_string()), "n").join("\n");
+        assert!(report.contains("WARNING"), "got: {report}");
+        assert!(report.contains("does not match"), "got: {report}");
+        assert!(report.contains("did:key:other"), "got: {report}");
+        assert!(!report.contains("Could not fetch"), "got: {report}");
+    }
+
+    #[test]
+    fn did_check_report_missing_did_reason() {
+        let report =
+            did_check_report(&Err("node info response carried no DID".to_string()), "n").join("\n");
+        assert!(report.contains("Could not fetch"), "got: {report}");
+        assert!(
+            report.contains("node info response carried no DID"),
+            "got: {report}"
+        );
+        assert!(report.contains("verify offline"), "got: {report}");
+        // The must-not case: no real DID was obtained, so no comparison verdict
+        // may be claimed in either direction.
+        assert!(!report.contains("WARNING"), "got: {report}");
+        assert!(
+            !report.contains("matches the node being queried"),
+            "got: {report}"
+        );
+    }
+
+    #[test]
+    fn did_check_report_lookup_error_reason() {
+        let report =
+            did_check_report(&Err("node info failed (403): denied".to_string()), "n").join("\n");
+        assert!(report.contains("Could not fetch"), "got: {report}");
+        assert!(report.contains("403"), "got: {report}");
+        assert!(report.contains("verify offline"), "got: {report}");
+        assert!(!report.contains("WARNING"), "got: {report}");
+    }
 }

crates/gl/src/changelog.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::Args;
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -46,12 +45,7 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = NodeClient::new(&args.node, None);
-            let info: Value = client
-                .get("/")
-                .await?
-                .json()
-                .await
-                .context("failed to fetch node info")?;
+            let info = crate::http::read_json(client.get("/").await?, "node info").await?;
             let did = info["did"].as_str().context("node missing DID")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -68,13 +62,7 @@ pub async fn run(args: ChangelogArgs) -> Result<()> {
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("changelog failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "changelog").await?;
 
     let events = body["events"].as_array().cloned().unwrap_or_default();
 
@@ -216,6 +204,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -227,6 +216,8 @@ mod tests {
         };
         let err = run(args).await.unwrap_err();
         assert!(err.to_string().contains("changelog failed"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -274,4 +265,31 @@ mod tests {
         let err = rt.block_on(run(args)).unwrap_err();
         assert!(err.to_string().contains("no repo specified"));
     }
+
+    #[tokio::test]
+    async fn resolve_via_run_surfaces_denial() {
+        // A slash-free repo with an empty identity dir forces the inline GET /
+        // node-info fetch during resolution. A gated 404 there must Err (surfacing
+        // the status), proving the read_json conversion is load-bearing.
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
+        let _m = server
+            .mock("GET", "/")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = run(ChangelogArgs {
+            repo: Some("noslash".to_string()),
+            limit: 20,
+            node: server.url(),
+            dir: Some(dir.path().to_path_buf()),
+        })
+        .await
+        .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/http.rs

@@ -10,6 +10,7 @@ use anyhow::{Context, Result};
 use gitlawb_core::http_sig::sign_request;
 use gitlawb_core::identity::Keypair;
 use icaptcha_client::IcaptchaCfg;
+use serde_json::Value;
 
 /// Max times we'll fetch a fresh proof and retry a 403-iCaptcha response
 /// (absorbs proof expiry / first-seen replay).
@@ -319,7 +320,7 @@ pub(crate) async fn read_body_capped(mut resp: reqwest::Response, cap: usize) ->
 /// Strip terminal-dangerous characters from (and cap the length of) a
 /// node-supplied error string before surfacing it. The node a caller talks to
 /// could be hostile and embed escape sequences in its error body; those must not
-/// reach the terminal verbatim (INV-6). We drop the C0/C1 control bytes (which
+/// reach the terminal verbatim. We drop the C0/C1 control bytes (which
 /// defangs ANSI/OSC escapes) AND the Unicode bidi/format controls (which
 /// `char::is_control` does not cover — they can reorder the displayed line).
 pub(crate) fn sanitize_node_msg(s: &str) -> String {
@@ -329,6 +330,60 @@ pub(crate) fn sanitize_node_msg(s: &str) -> String {
         .collect()
 }
 
+/// Read a JSON response, surfacing a node denial/error instead of parsing it as
+/// the requested resource. On a non-2xx status it returns an `Err` carrying the
+/// node's sanitized `message` plus the status; on success it parses the
+/// body and propagates a parse error, so a truncated/garbage 2xx body is an error
+/// rather than a silently-empty success (the denial-as-success bug #123 fixes).
+/// `what` names the resource for the error text (e.g. "repo", "commits").
+///
+/// Callers must route gated reads through this rather than `resp.json().await?`:
+/// the bare parse renders a gated 404/5xx body back as the resource.
+/// Cap on the error body `read_json` reads before parsing a node's `message`.
+/// Matches the capped-read bound used on the sync error path; large enough for any
+/// legitimate error, small enough that a hostile node cannot exhaust memory.
+const ERROR_BODY_CAP: usize = 8 * 1024;
+
+pub(crate) async fn read_json(resp: reqwest::Response, what: &str) -> Result<Value> {
+    let status = resp.status();
+    if !status.is_success() {
+        // Bound the error read: `resp.json()` would buffer and parse the WHOLE
+        // body, so a hostile node could stream an arbitrarily large valid JSON
+        // error and exhaust this process's memory (#186). Read a small capped body
+        // first, then best-effort extract `message`. The error body may also be
+        // non-JSON (503 degraded, 413 body-limit from middleware), so a parse miss
+        // falls back to the capped raw text; an empty body to the status alone.
+        let raw = read_body_capped(resp, ERROR_BODY_CAP).await.text;
+        // Preserve the prior contract: surface the JSON `message` when present in
+        // the capped body, else the status alone ("request failed") — a non-JSON
+        // or message-less body (503 degraded, 413 body-limit) never surfaces raw
+        // node bytes. A body whose `message` sits past the cap parses as truncated
+        // garbage here and correctly falls back rather than being buffered whole.
+        //
+        // Fall back to `error` before giving up: the node's shared AppError
+        // envelope carries both keys, but the task API answers with `error` alone
+        // (`{"error":"task not found"}` in gitlawb-node/src/api/tasks.rs), so
+        // reading only `message` blanked every `gl task` denial to the generic
+        // "request failed". `sync.rs`'s hand-rolled reader already reads both; this
+        // matches it.
+        let msg = serde_json::from_str::<Value>(&raw)
+            .ok()
+            .and_then(|b| {
+                b.get("message")
+                    .or_else(|| b.get("error"))
+                    .and_then(|m| m.as_str())
+                    .map(str::to_owned)
+            })
+            .unwrap_or_else(|| "request failed".to_owned());
+        anyhow::bail!("{what} failed ({status}): {}", sanitize_node_msg(&msg));
+    }
+    // Success: a truncated/garbage 2xx body must be an `Err`, not `Ok(Null)` that
+    // a caller then renders as an empty success.
+    resp.json()
+        .await
+        .with_context(|| format!("invalid JSON in {what} response"))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1268,4 +1323,217 @@ mod tests {
         let out = sanitize_node_msg("ok \u{0627}\u{200D}b");
         assert_eq!(out, "ok \u{0627}\u{200D}b");
     }
+
+    // ── read_json (status-checked, bounded, sanitized read; #123) ────────
+
+    /// Drive a real `reqwest::Response` off a mockito mock so `read_json` sees an
+    /// actual HTTP status + body, the same shape the gated read arms produce.
+    async fn response_for(
+        server: &mut Server,
+        status: usize,
+        body: &str,
+        json: bool,
+    ) -> reqwest::Response {
+        let mut m = server.mock("GET", "/x").with_status(status).with_body(body);
+        if json {
+            m = m.with_header("content-type", "application/json");
+        }
+        let _m = m.create_async().await;
+        NodeClient::new(server.url(), None).get("/x").await.unwrap()
+    }
+
+    #[tokio::test]
+    async fn read_json_returns_body_on_2xx() {
+        let mut server = Server::new_async().await;
+        let resp = response_for(
+            &mut server,
+            200,
+            r#"{"name":"r","owner_did":"did:gitlawb:z"}"#,
+            true,
+        )
+        .await;
+        let v = read_json(resp, "repo").await.unwrap();
+        assert_eq!(v["name"], "r");
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_404_surfacing_message_and_status() {
+        let mut server = Server::new_async().await;
+        let resp = response_for(
+            &mut server,
+            404,
+            r#"{"message":"repository 'o/r' not found"}"#,
+            true,
+        )
+        .await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("404"), "err={err}");
+        assert!(err.contains("not found"), "err={err}");
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_500_surfacing_message() {
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 500, r#"{"message":"internal boom"}"#, true).await;
+        let err = read_json(resp, "commits").await.unwrap_err().to_string();
+        assert!(err.contains("500"), "err={err}");
+        assert!(err.contains("internal boom"), "err={err}");
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_non_json_error_body_with_fallback() {
+        // 503 with a plain-text (middleware) body: no `message` field to surface.
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 503, "service unavailable", false).await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("503"), "err={err}");
+        assert!(err.contains("request failed"), "err={err}");
+    }
+
+    #[tokio::test]
+    async fn read_json_sanitizes_control_and_bidi_in_message() {
+        // A hostile node embeds ESC, BEL, and a right-to-left override in
+        // the error message; none may reach the terminal verbatim.
+        let mut server = Server::new_async().await;
+        let resp = response_for(
+            &mut server,
+            404,
+            r#"{"message":"a\u001b[31mb\u0007c\u202ed"}"#,
+            true,
+        )
+        .await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
+        assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
+        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_garbage_2xx_body() {
+        // The #123 correctness point: a 200 with a non-JSON/truncated body must be
+        // an `Err`, NOT `Ok(Null)` that a caller renders as an empty success.
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 200, "this is not json", false).await;
+        assert!(read_json(resp, "repo").await.is_err());
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_empty_2xx_body() {
+        // A zero-byte 200 body must be an `Err`, not a silent `Ok(Null)`.
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 200, "", false).await;
+        assert!(read_json(resp, "repo").await.is_err());
+    }
+
+    #[tokio::test]
+    async fn read_json_errs_on_non_2xx_json_without_message_or_error() {
+        // A non-2xx JSON body carrying NEITHER key is the real fallback case.
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 403, r#"{"detail":"forbidden"}"#, true).await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("403"), "err={err}");
+        assert!(err.contains("request failed"), "err={err}");
+        // The body's own text must not leak when no recognised key carries it.
+        assert!(!err.contains("forbidden"), "raw body leaked: {err}");
+    }
+
+    #[tokio::test]
+    async fn read_json_surfaces_error_key_when_message_absent() {
+        // The task API answers with `error` alone — see
+        // gitlawb-node/src/api/tasks.rs `{"error":"task not found"}`. Reading only
+        // `message` blanked those denials to the generic "request failed", so the
+        // user was told nothing about why the call failed.
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 404, r#"{"error":"task not found"}"#, true).await;
+        let err = read_json(resp, "task show").await.unwrap_err().to_string();
+        assert!(err.contains("404"), "err={err}");
+        assert!(err.contains("task not found"), "reason not surfaced: {err}");
+    }
+
+    #[tokio::test]
+    async fn read_json_prefers_message_over_error_key() {
+        // The shared AppError envelope carries both; `message` is the human text
+        // and must win over the machine code in `error`.
+        let mut server = Server::new_async().await;
+        let resp = response_for(
+            &mut server,
+            500,
+            r#"{"error":"db_error","message":"database unavailable"}"#,
+            true,
+        )
+        .await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("database unavailable"), "err={err}");
+        assert!(
+            !err.contains("db_error"),
+            "machine code won over message: {err}"
+        );
+    }
+
+    #[tokio::test]
+    async fn read_json_sanitizes_error_key_text() {
+        // The `error` fallback goes through the same sanitizer as `message`; a
+        // hostile node must not reach the terminal through the new path. The
+        // controls are JSON \u escapes so the body stays VALID JSON — embedding
+        // them raw would fail the parse and pass this test vacuously.
+        let mut server = Server::new_async().await;
+        let resp = response_for(
+            &mut server,
+            404,
+            r#"{"error":"a\u001b[31mb\u0007c\u202ed"}"#,
+            true,
+        )
+        .await;
+        let err = read_json(resp, "task show").await.unwrap_err().to_string();
+        // Proves the parse succeeded and the `error` key was read, not the
+        // "request failed" fallback (which would make the asserts below vacuous).
+        assert!(err.contains("task show failed (404"), "err={err}");
+        assert!(
+            !err.contains("request failed"),
+            "fell back, sanitizer untested: {err}"
+        );
+        assert!(
+            err.contains('a') && err.contains('d'),
+            "text dropped: {err}"
+        );
+        assert!(!err.contains('\u{1b}'), "ESC leaked: {err:?}");
+        assert!(!err.contains('\u{7}'), "BEL leaked: {err:?}");
+        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
+    }
+
+    /// #186 (F2): the non-2xx error path must read a CAPPED body, not buffer and
+    /// parse the whole thing — a hostile node can stream an arbitrarily large valid
+    /// JSON error. Place the `message` field AFTER more than the cap of padding: the
+    /// bounded read stops before it, so it must be ABSENT from the surfaced error.
+    /// RED before the fix (`resp.json()` parses the full body → the far message
+    /// appears), GREEN after (capped read truncates → fallback → far message gone).
+    /// The status is still surfaced, so a legitimate small error is unaffected.
+    #[tokio::test]
+    async fn read_json_bounds_the_error_body_read() {
+        let mut server = Server::new_async().await;
+        // >8 KiB of padding, then the marker message at the very end of the body.
+        let big = format!(
+            r#"{{"padding":"{}","message":"FARMARKER_BEYOND_CAP"}}"#,
+            "A".repeat(16 * 1024)
+        );
+        let resp = response_for(&mut server, 500, &big, true).await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("500"), "bounded read still errors: {err}");
+        assert!(
+            !err.contains("FARMARKER_BEYOND_CAP"),
+            "the error body read must be capped: a message beyond the cap must not be surfaced, err={err}"
+        );
+    }
+
+    /// #186 (F2): an EMPTY non-2xx body is its own input class — the capped read
+    /// yields "", the JSON parse fails, and it falls back to the status alone
+    /// ("request failed"), never a panic or a spurious success.
+    #[tokio::test]
+    async fn read_json_errs_on_empty_non_2xx_body() {
+        let mut server = Server::new_async().await;
+        let resp = response_for(&mut server, 502, "", false).await;
+        let err = read_json(resp, "repo").await.unwrap_err().to_string();
+        assert!(err.contains("502"), "err={err}");
+        assert!(err.contains("request failed"), "err={err}");
+    }
 }

crates/gl/src/issue.rs

@@ -3,7 +3,7 @@
 use anyhow::{Context, Result};
 use chrono::Utc;
 use clap::{Args, Subcommand};
-use serde_json::{json, Value};
+use serde_json::json;
 use std::path::PathBuf;
 use uuid::Uuid;
 
@@ -166,12 +166,7 @@ async fn resolve_repo(
             did.split(':').next_back().unwrap_or(&did).to_string()
         } else {
             let client = NodeClient::new(node, None);
-            let info: Value = client
-                .get("/")
-                .await?
-                .json()
-                .await
-                .context("failed to fetch node info")?;
+            let info = crate::http::read_json(client.get("/").await?, "node info").await?;
             let did = info["did"].as_str().context("node info missing 'did'")?;
             did.split(':').next_back().unwrap_or(did).to_string()
         };
@@ -222,13 +217,7 @@ async fn cmd_create(
         .post(&path, &request_body)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("create issue failed ({status}): {msg}");
-    }
+    let result = crate::http::read_json(resp, "create issue").await?;
 
     let id = result["id"].as_str().unwrap_or("?");
     println!("✓ Created issue #{id}");
@@ -245,12 +234,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     let client = signed_client(&node, dir.as_deref());
     let path = format!("/api/v1/repos/{owner}/{name}/issues");
-    let resp: Value = client
-        .get_authed(&path)
-        .await?
-        .json()
-        .await
-        .context("failed to list issues")?;
+    let resp = crate::http::read_json(client.get_authed(&path).await?, "issues").await?;
 
     let issues = resp["issues"].as_array().cloned().unwrap_or_default();
 
@@ -288,13 +272,7 @@ async fn cmd_show(repo: String, id: String, node: String, dir: Option<PathBuf>)
         .get_authed(&path)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let issue: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = issue["message"].as_str().unwrap_or("issue not found");
-        anyhow::bail!("show failed ({status}): {msg}");
-    }
+    let issue = crate::http::read_json(resp, "show").await?;
 
     let title = issue["title"].as_str().unwrap_or("(no title)");
     let status = issue["status"].as_str().unwrap_or("?");
@@ -325,13 +303,7 @@ async fn cmd_close(repo: String, id: String, node: String, dir: Option<PathBuf>)
         .post(&format!("{path}/close"), &body)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("close issue failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "close issue").await?;
 
     println!("✗ Closed issue {id}");
     Ok(())
@@ -356,13 +328,7 @@ async fn cmd_issue_comment(
         )
         .await
         .context("failed to connect to node")?;
-    let code = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !code.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("comment failed ({code}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "comment").await?;
 
     println!("· Comment posted on issue {id}");
     Ok(())
@@ -377,14 +343,15 @@ async fn cmd_issue_comments(
     let (owner, name) = resolve_repo(&repo, &node, dir.as_deref()).await?;
     let client = signed_client(&node, dir.as_deref());
 
-    let resp: Value = client
-        .get_authed(&format!(
-            "/api/v1/repos/{owner}/{name}/issues/{id}/comments"
-        ))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
+    let resp = crate::http::read_json(
+        client
+            .get_authed(&format!(
+                "/api/v1/repos/{owner}/{name}/issues/{id}/comments"
+            ))
+            .await?,
+        "issue comments",
+    )
+    .await?;
 
     let comments = resp["comments"].as_array().cloned().unwrap_or_default();
     if comments.is_empty() {
@@ -514,6 +481,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -528,6 +496,8 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("repo not found"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -575,6 +545,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -588,6 +559,8 @@ mod tests {
         .unwrap_err();
         assert!(err.to_string().contains("show failed"), "got: {err}");
         assert!(err.to_string().contains("issue not found"), "got: {err}");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -636,6 +609,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -648,6 +622,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("close issue failed"), "got: {err}");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -694,6 +670,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"issue not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -707,6 +684,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("issue not found"), "got: {err}");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -764,4 +743,48 @@ mod tests {
         .await
         .unwrap();
     }
+
+    #[tokio::test]
+    async fn cmd_list_surfaces_denial_not_empty() {
+        // A gated 404 on the issue-list read must Err, not print "No issues".
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/issues$".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_list("alice/secret".to_string(), server.url(), None).await;
+        assert!(result.is_err(), "issue list must Err on a gated 404");
+        // Prove the gated issues path was actually requested: without this, an
+        // unmatched route (mockito's 501, also non-2xx) would satisfy is_err().
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn resolve_repo_surfaces_denial() {
+        // A slash-free repo with an empty identity dir forces the GET / node-info
+        // fetch. A gated 404 there must Err (surfacing the status), proving the
+        // read_json conversion is load-bearing rather than silently ignored.
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
+        let _m = server
+            .mock("GET", "/")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = resolve_repo("noslash", &server.url(), Some(dir.path()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/mirror.rs

@@ -84,14 +84,7 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
     let _guard = TmpGuard(tmp_root);
 
     println!("Cloning source (this may take a while for large repos)...");
-    let clone_status = Command::new("git")
-        .args(["clone", "--mirror", &source, mirror_path.to_str().unwrap()])
-        .status()
-        .context("failed to run git clone — is git installed?")?;
-
-    if !clone_status.success() {
-        bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
-    }
+    clone_mirror(&source, &mirror_path)?;
 
     // ── 4. Create the repo on Twigpine ─────────────────────────────────────
     println!("Creating repo on Twigpine node...");
@@ -143,6 +136,25 @@ pub async fn run(args: MirrorArgs) -> Result<()> {
     Ok(())
 }
 
+/// `git clone --mirror <source> <dest>`. The destination is passed as an
+/// OS-native path so a non-UTF-8 temp dir (e.g. a TMPDIR with non-UTF-8 bytes)
+/// does not panic on a `to_str()` conversion.
+fn clone_mirror(source: &str, dest: &std::path::Path) -> Result<()> {
+    // allow-unbounded-git: gl is the client CLI; this clone runs in the user's
+    // terminal with no server-side permit or disconnect to survive. The
+    // bounded-runner rule governs node request handlers. Same spawn as before,
+    // only relocated into this helper.
+    let status = Command::new("git")
+        .args(["clone", "--mirror", source])
+        .arg(dest)
+        .status()
+        .context("failed to run git clone — is git installed?")?;
+    if !status.success() {
+        bail!("git clone --mirror failed\nCheck that the source URL is accessible: {source}");
+    }
+    Ok(())
+}
+
 /// Extract the repo name from a git URL.
 /// - `https://github.com/owner/repo`     → `"repo"`
 /// - `https://github.com/owner/repo.git` → `"repo"`
@@ -225,6 +237,80 @@ mod tests {
         assert_eq!(extract_repo_name("https://example.com/.git"), None);
     }
 
+    // #417: a non-UTF-8 destination path must reach git as an OS-native arg, not
+    // panic on a `to_str()` conversion.
+    #[cfg(unix)]
+    #[test]
+    fn test_clone_mirror_non_utf8_dest() {
+        use std::ffi::OsStr;
+        use std::os::unix::ffi::OsStrExt;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let src = tmp.path().join("src.git");
+        let st = Command::new("git")
+            .args(["init", "--bare"])
+            .arg(&src)
+            .status()
+            .unwrap();
+        assert!(st.success());
+
+        let dest = tmp.path().join(OsStr::from_bytes(b"mirror-\xffdest"));
+        clone_mirror(src.to_str().unwrap(), &dest).unwrap();
+        assert!(dest.join("HEAD").exists());
+    }
+
+    // #417 end-to-end: the real trigger is `std::env::temp_dir()` itself
+    // returning a non-UTF-8 path (a TMPDIR with non-UTF-8 bytes), because the
+    // mirror dest is built from it. Env is process-global, so this test
+    // re-execs the test binary in a child with a non-UTF-8 TMPDIR rather than
+    // mutating this process's env.
+    #[cfg(unix)]
+    #[test]
+    fn test_clone_mirror_under_non_utf8_tmpdir() {
+        use std::ffi::OsStr;
+        use std::os::unix::ffi::OsStrExt;
+
+        if std::env::var_os("GL_MIRROR_NONUTF8_TMPDIR").is_none() {
+            // Parent: a source repo under a normal path, a TMPDIR whose name
+            // is not UTF-8, and a child run of this same test under that env.
+            let parent = tempfile::TempDir::new().unwrap();
+            let src = parent.path().join("src.git");
+            let st = Command::new("git")
+                .args(["init", "--bare"])
+                .arg(&src)
+                .status()
+                .unwrap();
+            assert!(st.success());
+            let bad_tmp = parent.path().join(OsStr::from_bytes(b"tmp-\xff"));
+            std::fs::create_dir_all(&bad_tmp).unwrap();
+
+            let status = Command::new(std::env::current_exe().unwrap())
+                .args([
+                    "mirror::tests::test_clone_mirror_under_non_utf8_tmpdir",
+                    "--exact",
+                ])
+                .env("GL_MIRROR_NONUTF8_TMPDIR", "1")
+                .env("GL_MIRROR_SRC", &src)
+                .env("TMPDIR", &bad_tmp)
+                .status()
+                .unwrap();
+            assert!(status.success(), "child failed under non-UTF-8 TMPDIR");
+            return;
+        }
+
+        // Child: the same path shape run() computes — temp_dir() joined with
+        // the mirror dest. It must be non-UTF-8 or the test proves nothing.
+        let src = std::env::var("GL_MIRROR_SRC").unwrap();
+        let tmp_root = std::env::temp_dir().join("gl-mirror-child");
+        let dest = tmp_root.join("repo");
+        assert!(
+            dest.to_str().is_none(),
+            "fixture broken: dest under a non-UTF-8 TMPDIR must be non-UTF-8"
+        );
+        clone_mirror(&src, &dest).unwrap();
+        assert!(dest.join("HEAD").exists());
+    }
+
     #[tokio::test]
     async fn test_create_repo_conflict_error() {
         let mut server = mockito::Server::new_async().await;

crates/gl/src/peer.rs

@@ -79,12 +79,7 @@ pub async fn run(args: PeerArgs) -> Result<()> {
 
 async fn cmd_list(node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    let resp: Value = client
-        .get("/api/v1/peers")
-        .await?
-        .json()
-        .await
-        .context("failed to list peers")?;
+    let resp = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
 
     let peers = resp["peers"].as_array().cloned().unwrap_or_default();
     let count = resp["count"].as_u64().unwrap_or(peers.len() as u64);
@@ -185,18 +180,20 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
     let keypair = load_keypair_from_dir(dir.as_deref())?;
     let my_did = keypair.did().to_string();
 
-    // Fetch our node's public URL so we can announce it to the peer
+    // Fetch our node's public URL so we can announce it to the peer. This lookup
+    // is a deliberate fail-soft diagnostic: it only improves the URL we advertise.
+    // A response-level failure (denial, error, garbage body) falls back to the
+    // --node value with a visible note rather than aborting; only a transport
+    // failure on the GET itself is fatal. The announce below keeps the
+    // fail-closed read_json check.
     let local_client = NodeClient::new(&node, None);
-    let node_info: Value = local_client
-        .get("/")
-        .await?
-        .json()
-        .await
-        .context("failed to fetch local node info")?;
-    let my_url = node_info["public_url"]
-        .as_str()
-        .unwrap_or(&node)
-        .to_string();
+    let my_url = match crate::http::read_json(local_client.get("/").await?, "node info").await {
+        Ok(info) => info["public_url"].as_str().unwrap_or(&node).to_string(),
+        Err(e) => {
+            eprintln!("note: local node info unavailable ({e}); announcing {node}");
+            node.clone()
+        }
+    };
 
     // Announce our local node to the remote peer
     let body = serde_json::to_vec(&serde_json::json!({
@@ -272,12 +269,7 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
 async fn cmd_ping(did: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
     let path = format!("/api/v1/peers/{did}/ping");
-    let resp: Value = client
-        .get(&path)
-        .await?
-        .json()
-        .await
-        .context("failed to ping peer")?;
+    let resp = crate::http::read_json(client.get(&path).await?, "ping peer").await?;
 
     let url = resp["http_url"].as_str().unwrap_or("?");
     let reachable = resp["reachable"].as_bool().unwrap_or(false);
@@ -297,12 +289,7 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
     let encoded = urlencoding::encode(&did);
     let path = format!("/api/v1/resolve/{encoded}");
-    let resp: Value = client
-        .get(&path)
-        .await?
-        .json()
-        .await
-        .context("failed to resolve DID")?;
+    let resp = crate::http::read_json(client.get(&path).await?, "resolve DID").await?;
 
     let source = resp["source"].as_str().unwrap_or("not found");
     let http_url = resp["http_url"].as_str().unwrap_or("(none)");
@@ -325,8 +312,8 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
 #[cfg(test)]
 mod tests {
     use super::{
-        announced_peer_summary, cmd_add, local_add_refusal, local_add_report,
-        remote_announce_failure,
+        announced_peer_summary, cmd_add, cmd_list, cmd_ping, cmd_resolve, local_add_refusal,
+        local_add_report, remote_announce_failure,
     };
     use reqwest::StatusCode;
     use serde_json::json;
@@ -619,4 +606,282 @@ mod tests {
             "legitimate text mangled: {warning:?}"
         );
     }
+
+    #[tokio::test]
+    async fn cmd_list_surfaces_denial_not_empty() {
+        // A node error must Err, not print "No known peers" as if the list were empty.
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("GET", "/api/v1/peers")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = cmd_list(server.url()).await.unwrap_err();
+        assert!(err.to_string().contains("500"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_ping_surfaces_denial_not_unreachable() {
+        // A node error must Err, not print a fabricated "unreachable" peer.
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("GET", "/api/v1/peers/peer1/ping")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = cmd_ping("peer1".to_string(), server.url())
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_resolve_surfaces_denial_not_notfound() {
+        // A node error must Err, not print "Source: not found" as if resolved-absent.
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/api/v1/resolve/".to_string()),
+            )
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = cmd_resolve("peer1".to_string(), server.url())
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("500"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    // cmd_add needs a local identity to build my_did before the GET /.
+    fn identity_dir() -> tempfile::TempDir {
+        let dir = tempfile::TempDir::new().unwrap();
+        let kp = gitlawb_core::identity::Keypair::generate();
+        std::fs::write(
+            dir.path().join("identity.pem"),
+            kp.to_pem().unwrap().as_bytes(),
+        )
+        .unwrap();
+        dir
+    }
+
+    /// Mock a successful announce that requires `http_url` in the POSTed body.
+    /// The `{}` response body matters: it leaves `node_url` absent, so cmd_add
+    /// skips the follow-up local peer-list POST.
+    async fn announce_ok_mock(server: &mut mockito::ServerGuard, http_url: &str) -> mockito::Mock {
+        announce_mock_with_body(server, http_url, "{}").await
+    }
+
+    /// Like [`announce_ok_mock`] but with a custom response body, for tests
+    /// that need `node_url` populated so the follow-up local add runs.
+    async fn announce_mock_with_body(
+        server: &mut mockito::ServerGuard,
+        http_url: &str,
+        body: &str,
+    ) -> mockito::Mock {
+        server
+            .mock("POST", "/api/v1/peers/announce")
+            .match_body(mockito::Matcher::PartialJson(serde_json::json!({
+                "http_url": http_url,
+            })))
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(body)
+            .expect(1)
+            .create_async()
+            .await
+    }
+
+    // The local `GET /` lookup in cmd_add is a fail-soft diagnostic: a denied
+    // or error node-info response must fall back to announcing the --node URL
+    // (with a stderr note), not abort the command before the announce POST.
+    #[tokio::test]
+    async fn cmd_add_announces_fallback_url_when_node_info_denied() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"internal"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = announce_ok_mock(&mut remote, &local.url()).await;
+
+        let dir = identity_dir();
+        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap();
+        _info.assert_async().await;
+        _announce.assert_async().await;
+    }
+
+    // Same fallback for a 200 node-info response whose body is not JSON.
+    #[tokio::test]
+    async fn cmd_add_falls_back_on_malformed_node_info() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(200)
+            .with_body("not json")
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = announce_ok_mock(&mut remote, &local.url()).await;
+
+        let dir = identity_dir();
+        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap();
+        _info.assert_async().await;
+        _announce.assert_async().await;
+    }
+
+    // Must-not case: the announce POST itself stays fail-closed. A denied
+    // announce surfaces as an Err naming the status, never a printed success.
+    #[tokio::test]
+    async fn cmd_add_surfaces_denied_announce() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"public_url":"https://pub.example"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = remote
+            .mock("POST", "/api/v1/peers/announce")
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let dir = identity_dir();
+        let err = cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("403"), "got: {err}");
+        _info.assert_async().await;
+        _announce.assert_async().await;
+    }
+
+    // Success path unchanged: a usable node-info response announces its
+    // public_url; the --node fallback must not leak in.
+    #[tokio::test]
+    async fn cmd_add_uses_public_url_when_lookup_succeeds() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"public_url":"https://pub.example"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = announce_ok_mock(&mut remote, "https://pub.example").await;
+
+        let dir = identity_dir();
+        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap();
+        _info.assert_async().await;
+        _announce.assert_async().await;
+    }
+
+    // When the peer's announce response carries a node_url, cmd_add posts the
+    // peer back to the local node's peer list; a successful local POST is the
+    // one case that prints the added line.
+    #[tokio::test]
+    async fn cmd_add_adds_peer_to_local_list_on_success() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"public_url":"https://pub.example"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _local_add = local
+            .mock("POST", "/api/v1/peers/announce")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"status":"added"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = announce_mock_with_body(
+            &mut remote,
+            "https://pub.example",
+            r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
+        )
+        .await;
+
+        let dir = identity_dir();
+        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap();
+        _info.assert_async().await;
+        _announce.assert_async().await;
+        _local_add.assert_async().await;
+    }
+
+    // The local add stays best-effort: a failing local POST must not fail the
+    // command (the announce to the remote peer already succeeded), it only
+    // changes the printed outcome.
+    #[tokio::test]
+    async fn cmd_add_stays_ok_when_local_add_fails() {
+        let mut local = mockito::Server::new_async().await;
+        let _info = local
+            .mock("GET", "/")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"public_url":"https://pub.example"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _local_add = local
+            .mock("POST", "/api/v1/peers/announce")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let mut remote = mockito::Server::new_async().await;
+        let _announce = announce_mock_with_body(
+            &mut remote,
+            "https://pub.example",
+            r#"{"node_did":"their-did","node_url":"http://their.example"}"#,
+        )
+        .await;
+
+        let dir = identity_dir();
+        cmd_add(remote.url(), local.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap();
+        _info.assert_async().await;
+        _announce.assert_async().await;
+        _local_add.assert_async().await;
+    }
 }

crates/gl/src/pr.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -265,13 +264,7 @@ async fn cmd_create(
         .post(&format!("/api/v1/repos/{owner}/{repo}/pulls"), &payload)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let pr: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = pr["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("create PR failed ({status}): {msg}");
-    }
+    let pr = crate::http::read_json(resp, "create PR").await?;
 
     let number = pr["number"].as_i64().unwrap_or(0);
     println!("✓ Opened PR #{number}: {title}");
@@ -286,12 +279,13 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp: Value = client
-        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
+    let resp = crate::http::read_json(
+        client
+            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls"))
+            .await?,
+        "pull requests",
+    )
+    .await?;
 
     let prs = resp["pulls"].as_array().cloned().unwrap_or_default();
     if prs.is_empty() {
@@ -330,12 +324,13 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let pr: Value = client
-        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
+    let pr = crate::http::read_json(
+        client
+            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}"))
+            .await?,
+        "pull request",
+    )
+    .await?;
 
     let title = pr["title"].as_str().unwrap_or("?");
     let status = pr["status"].as_str().unwrap_or("?");
@@ -353,15 +348,25 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     }
 
     // Show reviews
-    let reviews: Value = client
-        .get(&format!(
-            "/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
-        ))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
-    let reviews = reviews["reviews"].as_array().cloned().unwrap_or_default();
+    // A denied sub-fetch degrades this section rather than aborting: the header
+    // above has already printed, so a bare `?` here leaves a half-rendered PR and
+    // skips the comments below it. Mirrors `gl status`'s unavailable-section line.
+    let reviews = match crate::http::read_json(
+        client
+            .get(&format!(
+                "/api/v1/repos/{owner}/{repo}/pulls/{number}/reviews"
+            ))
+            .await?,
+        "reviews",
+    )
+    .await
+    {
+        Ok(v) => v["reviews"].as_array().cloned().unwrap_or_default(),
+        Err(e) => {
+            println!("\nReviews unavailable ({e})");
+            Vec::new()
+        }
+    };
     if !reviews.is_empty() {
         println!("\nReviews ({}):", reviews.len());
         for r in &reviews {
@@ -386,15 +391,22 @@ async fn cmd_view(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     }
 
     // Show comments
-    let comments: Value = client
-        .get(&format!(
-            "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
-        ))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
-    let comments = comments["comments"].as_array().cloned().unwrap_or_default();
+    let comments = match crate::http::read_json(
+        client
+            .get(&format!(
+                "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
+            ))
+            .await?,
+        "comments",
+    )
+    .await
+    {
+        Ok(v) => v["comments"].as_array().cloned().unwrap_or_default(),
+        Err(e) => {
+            println!("\nComments unavailable ({e})");
+            Vec::new()
+        }
+    };
     if !comments.is_empty() {
         println!("\nComments ({}):", comments.len());
         for c in &comments {
@@ -418,12 +430,13 @@ async fn cmd_diff(repo: String, number: u64, node: String, dir: Option<PathBuf>)
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp: Value = client
-        .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
+    let resp = crate::http::read_json(
+        client
+            .get(&format!("/api/v1/repos/{owner}/{repo}/pulls/{number}/diff"))
+            .await?,
+        "diff",
+    )
+    .await?;
 
     let diff = resp["diff"].as_str().unwrap_or("");
     if diff.is_empty() {
@@ -447,13 +460,7 @@ async fn cmd_merge(repo: String, number: u64, node: String, dir: Option<PathBuf>
         )
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("merge failed ({status}): {msg}");
-    }
+    let result = crate::http::read_json(resp, "merge").await?;
 
     let sha = result["merge_sha"].as_str().unwrap_or("?");
     println!("✓ Merged PR #{number}");
@@ -485,13 +492,7 @@ async fn cmd_review(
         )
         .await
         .context("failed to connect to node")?;
-    let code = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !code.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("review failed ({code}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "review").await?;
 
     let icon = match status.as_str() {
         "approved" => "✓",
@@ -521,13 +522,7 @@ async fn cmd_comment(
         )
         .await
         .context("failed to connect to node")?;
-    let code = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !code.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("comment failed ({code}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "comment").await?;
 
     println!("· Comment posted on PR #{number}");
     Ok(())
@@ -538,14 +533,15 @@ async fn cmd_comments(repo: String, number: u64, node: String, dir: Option<PathB
     let owner = resolve_owner(&keypair);
     let client = NodeClient::new(&node, None);
 
-    let resp: Value = client
-        .get(&format!(
-            "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
-        ))
-        .await?
-        .json()
-        .await
-        .context("invalid JSON")?;
+    let resp = crate::http::read_json(
+        client
+            .get(&format!(
+                "/api/v1/repos/{owner}/{repo}/pulls/{number}/comments"
+            ))
+            .await?,
+        "comments",
+    )
+    .await?;
 
     let comments = resp["comments"].as_array().cloned().unwrap_or_default();
     if comments.is_empty() {
@@ -686,6 +682,7 @@ mod tests {
             .with_status(422)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"branch not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -703,6 +700,8 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("branch not found"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -800,6 +799,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"PR not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -813,6 +813,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("PR not found"), "got: {err}");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -897,4 +899,250 @@ mod tests {
         .await
         .unwrap();
     }
+
+    // ── Gated PR reads surface node denials, not empty/stub renders (#123) ──
+
+    #[tokio::test]
+    async fn cmd_list_surfaces_denial_not_empty() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("GET", mockito::Matcher::Regex(r"/pulls$".to_string()))
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_list(
+            "myrepo".to_string(),
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(
+            result.is_err(),
+            "cmd_list must Err on 404, not print 'No pull requests'"
+        );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_view_surfaces_denial_not_stub() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        // The PR fetch is first; a 404 there errors before the reviews/comments reads.
+        let _m = server
+            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_view(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(
+            result.is_err(),
+            "cmd_view must Err on 404, not print a stub PR"
+        );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_diff_surfaces_denial_not_empty() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/diff$".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_diff(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(
+            result.is_err(),
+            "cmd_diff must Err on 404, not print 'No diff'"
+        );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_comments_surfaces_denial_not_empty() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_comments(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(result.is_err(), "cmd_comments must Err on a gated 404");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    /// A denied sub-fetch must not abort `gl pr view` after the header has
+    /// already printed. The header is fatal; reviews and comments degrade.
+    #[tokio::test]
+    async fn cmd_view_continues_when_reviews_are_denied() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _pr = server
+            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _reviews = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
+            )
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"forbidden"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        // The load-bearing assertion: this mock is only hit if rendering
+        // continued past the denied reviews fetch.
+        let _comments = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"comments":[]}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let r = cmd_view(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(
+            r.is_ok(),
+            "cmd_view must finish rendering when reviews are denied"
+        );
+        _comments.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_view_continues_when_comments_are_denied() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _pr = server
+            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"number":1,"title":"T","status":"open","source_branch":"a","target_branch":"main","author_did":"did:key:z6MkTest"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _reviews = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/reviews$".to_string()),
+            )
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"reviews":[]}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let _comments = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/pulls/1/comments$".to_string()),
+            )
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"forbidden"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let r = cmd_view(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(
+            r.is_ok(),
+            "cmd_view must finish rendering when comments are denied"
+        );
+        _comments.assert_async().await;
+    }
+
+    /// The must-not case: with no header there is nothing to render partially,
+    /// so a denied header stays fatal. Softening it would resurrect
+    /// denial-as-success for the whole command.
+    #[tokio::test]
+    async fn cmd_view_header_denial_stays_fatal() {
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+        let mut server = mockito::Server::new_async().await;
+        let _pr = server
+            .mock("GET", mockito::Matcher::Regex(r"/pulls/1$".to_string()))
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let r = cmd_view(
+            "myrepo".to_string(),
+            1,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await;
+        assert!(r.is_err(), "a denied PR header must stay fatal");
+        _pr.assert_async().await;
+    }
 }

crates/gl/src/protect.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -94,12 +93,7 @@ async fn resolve_owner_repo(
         did.split(':').next_back().unwrap_or(&did).to_string()
     } else {
         let client = NodeClient::new(node, None);
-        let info: Value = client
-            .get("/")
-            .await?
-            .json()
-            .await
-            .context("failed to fetch node info")?;
+        let info = crate::http::read_json(client.get("/").await?, "node info").await?;
         let did = info["did"].as_str().context("node missing DID")?;
         did.split(':').next_back().unwrap_or(did).to_string()
     };
@@ -120,13 +114,7 @@ async fn cmd_set(branch: String, repo: String, node: String, dir: Option<PathBuf
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("protect failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "protect").await?;
 
     println!("✓ Branch '{branch}' is now protected in {owner}/{name}");
     println!("  Only the repo owner can push to this branch.");
@@ -152,13 +140,7 @@ async fn cmd_remove(
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("unprotect failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "unprotect").await?;
 
     println!("✓ Branch '{branch}' is no longer protected in {owner}/{name}");
     Ok(())
@@ -175,13 +157,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list protected branches failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "list protected branches").await?;
 
     let branches = body["protected_branches"]
         .as_array()
@@ -259,6 +235,7 @@ mod tests {
             .with_status(400)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"only the repo owner can protect branches"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -271,6 +248,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("protect failed"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -382,4 +361,26 @@ mod tests {
         assert_eq!(owner, "alice");
         assert_eq!(name, "myrepo");
     }
+
+    #[tokio::test]
+    async fn resolve_owner_repo_surfaces_denial() {
+        // A slash-free repo with an empty identity dir forces the GET / node-info
+        // fetch. A gated 404 there must Err (surfacing the status), proving the
+        // read_json conversion is load-bearing rather than silently ignored.
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
+        let _m = server
+            .mock("GET", "/")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/register.rs

@@ -5,7 +5,7 @@
 
 use anyhow::{Context, Result};
 use clap::Args;
-use serde_json::{json, Value};
+use serde_json::json;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -59,16 +59,7 @@ pub async fn run(args: RegisterArgs) -> Result<()> {
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let payload: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = payload
-            .get("message")
-            .and_then(|v| v.as_str())
-            .unwrap_or("unknown error");
-        anyhow::bail!("registration failed ({status}): {msg}");
-    }
+    let payload = crate::http::read_json(resp, "registration").await?;
 
     // Save bootstrap UCAN
     let ucan = payload.get("ucan").and_then(|v| v.as_str()).unwrap_or("");
@@ -175,6 +166,7 @@ mod tests {
             .with_status(401)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"invalid signature"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -191,6 +183,8 @@ mod tests {
             .unwrap_err()
             .to_string()
             .contains("invalid signature"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]

crates/gl/src/repo.rs

@@ -303,13 +303,7 @@ async fn cmd_create(
         .post("/api/v1/repos", &body)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let payload: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = payload["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("create failed ({status}): {msg}");
-    }
+    let payload = crate::http::read_json(resp, "create").await?;
 
     let clone_url = payload["clone_url"].as_str().unwrap_or("");
     let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
@@ -329,12 +323,7 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
     let client = NodeClient::new(&node, None);
 
     let url = format!("/api/v1/repos?owner={owner}");
-    let repos: Value = client
-        .get(&url)
-        .await?
-        .json()
-        .await
-        .context("failed to list repos")?;
+    let repos = crate::http::read_json(client.get(&url).await?, "list repos").await?;
     let repos = repos.as_array().context("expected array")?;
 
     if repos.is_empty() {
@@ -403,20 +392,13 @@ async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
     // A non-existent (or unreadable/quarantined) repo is a real 404 from the
     // node — surface it plainly instead of printing a stub card with `?` fields
     // and a placeholder owner DID.
-    if !resp.status().is_success() {
-        if resp.status().as_u16() == 404 {
-            anyhow::bail!("repository '{owner}/{name}' not found");
-        }
-        let status = resp.status();
-        let msg = resp
-            .json::<Value>()
-            .await
-            .ok()
-            .and_then(|v| v["message"].as_str().map(String::from))
-            .unwrap_or_else(|| "request failed".to_string());
-        anyhow::bail!("repo info failed ({status}): {msg}");
+    if resp.status().as_u16() == 404 {
+        anyhow::bail!("repository '{owner}/{name}' not found");
     }
-    let r: Value = resp.json().await.context("parse repo info")?;
+    // Every other status routes through read_json: a 2xx yields the parsed body,
+    // any other non-2xx yields the node's capped + sanitized message, and
+    // the error read is bounded rather than buffering the whole hostile body.
+    let r = crate::http::read_json(resp, "repo info").await?;
 
     let owner_did = r["owner_did"].as_str().unwrap_or(&owner);
     let gitlawb_url = format!("gitlawb://{owner_did}/{name}");
@@ -475,12 +457,7 @@ async fn cmd_replica_register(
         .await
         .context("failed to connect to origin node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("replica register failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "replica register").await?;
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("Registered as replica of {owner}/{name}");
@@ -507,12 +484,7 @@ async fn cmd_replica_unregister(repo: String, node: String, dir: Option<PathBuf>
         .await
         .context("failed to connect to origin node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("replica unregister failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "replica unregister").await?;
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("Unregistered as replica of {owner}/{name}  ({count} replicas remaining)");
@@ -532,12 +504,7 @@ async fn cmd_replicas(repo: String, node: String, dir: Option<PathBuf>) -> Resul
         .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/replicas"))
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("replicas list failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "replicas list").await?;
 
     let count = body["replica_count"].as_i64().unwrap_or(0);
     println!("{owner}/{name}: {count} replicas");
@@ -573,12 +540,7 @@ pub(crate) async fn cmd_commits(
     };
 
     let url = format!("/api/v1/repos/{owner}/{name}/commits?branch={branch}&limit={limit}");
-    let resp: Value = client
-        .get(&url)
-        .await?
-        .json()
-        .await
-        .context("failed to fetch commits")?;
+    let resp = crate::http::read_json(client.get(&url).await?, "commits").await?;
 
     let commits = resp["commits"].as_array().cloned().unwrap_or_default();
     if commits.is_empty() {
@@ -631,13 +593,7 @@ async fn cmd_fork(
         .post(&format!("/api/v1/repos/{owner}/{repo_name}/fork"), &body)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON response")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("fork failed ({status}): {msg}");
-    }
+    let result = crate::http::read_json(resp, "fork").await?;
 
     let fork_name = result["name"].as_str().unwrap_or(&repo_name);
     let owner_did = result["owner_did"].as_str().unwrap_or("?");
@@ -675,13 +631,7 @@ async fn cmd_label_add(
         .post(&format!("/api/v1/repos/{owner}/{name}/labels"), &body)
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("add label failed ({status}): {msg}");
-    }
+    let result = crate::http::read_json(resp, "add label").await?;
 
     let added = result["added"].as_bool().unwrap_or(true);
     if added {
@@ -706,13 +656,7 @@ async fn cmd_label_remove(
         .delete(&format!("/api/v1/repos/{owner}/{name}/labels/{label}"), &[])
         .await
         .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("remove label failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "remove label").await?;
 
     println!("- Label removed: {label} from {owner}/{name}");
     Ok(())
@@ -725,18 +669,21 @@ async fn cmd_label_list(repo: String, node: String, dir: Option<PathBuf>) -> Res
     // read their own labels, while public repos stay anonymously listable.
     let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
 
-    let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
-        .await
-        .context("failed to connect to node")?;
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list labels failed ({status}): {msg}");
-    }
+    // Marry both refactors: main's get_maybe_signed (read-visibility gating —
+    // public repos stay anon-listable, private-repo owner signs) carrying the
+    // PR's read_json status-check-before-parse (#186: bounded error read, no
+    // parse-before-status). get_authed from the PR is dropped in favor of
+    // get_maybe_signed so the visibility gate is preserved.
+    let resp = crate::http::read_json(
+        client
+            .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
+            .await
+            .context("failed to connect to node")?,
+        "list labels",
+    )
+    .await?;
 
-    let labels = body["labels"].as_array().cloned().unwrap_or_default();
+    let labels = resp["labels"].as_array().cloned().unwrap_or_default();
     if labels.is_empty() {
         println!("No labels on {owner}/{name}");
     } else {
@@ -909,6 +856,7 @@ mod tests {
             .with_status(409)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repository already exists"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -924,6 +872,8 @@ mod tests {
 
         assert!(result.is_err());
         assert!(result.unwrap_err().to_string().contains("already exists"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -992,6 +942,33 @@ mod tests {
         _m.assert_async().await;
     }
 
+    #[tokio::test]
+    async fn cmd_list_repos_surfaces_denial() {
+        // A node error must Err with the status, not trip the vague "expected
+        // array" fallback that hides the node's actual response.
+        let dir = TempDir::new().unwrap();
+        write_identity(&dir);
+
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/repos\?owner=".to_string()),
+            )
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_list(server.url(), Some(dir.path().to_path_buf()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("500"), "got: {err}");
+        _m.assert_async().await;
+    }
+
     #[tokio::test]
     async fn test_cmd_commits_empty() {
         let dir = TempDir::new().unwrap();
@@ -1091,6 +1068,7 @@ mod tests {
             .with_status(400)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"you already have a repo named myrepo"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -1106,6 +1084,8 @@ mod tests {
             err.to_string().contains("already have a repo"),
             "got: {err}"
         );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -1478,6 +1458,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -1490,6 +1471,106 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("not found"), "got: {err}");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _repo.assert_async().await;
+    }
+
+    // ── Gated CLI reads surface node denials, not empty renders (#123) ──
+
+    #[tokio::test]
+    async fn cmd_commits_surfaces_denial_not_empty() {
+        // A gated 404 must Err, not print "No commits" as if the repo were empty.
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/commits".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_commits(
+            "alice/secret".to_string(),
+            "main".to_string(),
+            20,
+            server.url(),
+            None,
+        )
+        .await;
+        assert!(result.is_err(), "cmd_commits must Err on 404");
+        assert!(result.unwrap_err().to_string().contains("not found"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn cmd_label_list_surfaces_denial_not_empty() {
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/repos/alice/secret/labels".to_string()),
+            )
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"repository 'alice/secret' not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let result = cmd_label_list("alice/secret".to_string(), server.url(), None).await;
+        assert!(result.is_err(), "cmd_label_list must Err on 404");
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy is_err() vacuously.
+        _m.assert_async().await;
+    }
+
+    // cmd_info keeps its bespoke 404 message ahead of read_json...
+    #[tokio::test]
+    async fn cmd_info_404_keeps_bespoke_message() {
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("GET", "/api/v1/repos/alice/secret")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"gone"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = cmd_info("alice/secret".to_string(), server.url(), None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(
+            err.contains("repository 'alice/secret' not found"),
+            "bespoke 404 text lost: {err}"
+        );
+        _m.assert_async().await;
+    }
+
+    // ...and every other non-2xx routes through read_json (capped + sanitized).
+    #[tokio::test]
+    async fn cmd_info_500_routes_through_read_json() {
+        let mut server = mockito::Server::new_async().await;
+        let _m = server
+            .mock("GET", "/api/v1/repos/alice/secret")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = cmd_info("alice/secret".to_string(), server.url(), None)
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(
+            err.contains("repo info failed"),
+            "read_json label lost: {err}"
+        );
+        assert!(err.contains("500"), "status not surfaced: {err}");
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -1688,7 +1769,7 @@ mod vet_merge_deny_arms {
     }
 
     // An authenticated caller DENIED with a 403 must surface an error, never
-    // render a repo card (deny-as-success is the INV-8 client-contract break).
+    // render a repo card (deny-as-success is the client-contract break).
     #[tokio::test]
     async fn cmd_info_403_denied_surfaces_error_not_card() {
         let dir = TempDir::new().unwrap();

crates/gl/src/star.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::PathBuf;
 
 use crate::http::NodeClient;
@@ -87,13 +86,7 @@ async fn cmd_add(repo: String, node: String, dir: Option<PathBuf>) -> Result<()>
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("star failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "star").await?;
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("Starred {owner}/{name}  ({count} stars total)");
@@ -111,13 +104,7 @@ async fn cmd_remove(repo: String, node: String, dir: Option<PathBuf>) -> Result<
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("unstar failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "unstar").await?;
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("Unstarred {owner}/{name}  ({count} stars remaining)");
@@ -136,13 +123,7 @@ async fn cmd_count(repo: String, node: String, dir: Option<PathBuf>) -> Result<(
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("star count failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "star count").await?;
 
     let count = body["star_count"].as_i64().unwrap_or(0);
     println!("{owner}/{name}: {count} stars");
@@ -242,6 +223,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -253,6 +235,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("star failed"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -299,6 +283,7 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"repo not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
@@ -310,6 +295,8 @@ mod tests {
         .await
         .unwrap_err();
         assert!(err.to_string().contains("unstar failed"));
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -347,4 +334,51 @@ mod tests {
         assert_eq!(owner, "alice");
         assert_eq!(name, "myrepo");
     }
+
+    // U15 (#186): a converted handler must inherit read_json's capped + sanitized
+    // error path end-to-end. A hostile 500 whose `message` carries terminal-control
+    // + bidi bytes and is long must reach the terminal neither verbatim nor unbounded.
+    #[tokio::test]
+    async fn cmd_add_hostile_error_is_sanitized_and_bounded() {
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap();
+        let kp = gitlawb_core::identity::Keypair::generate();
+        std::fs::write(
+            dir.path().join("identity.pem"),
+            kp.to_pem().unwrap().as_bytes(),
+        )
+        .unwrap();
+
+        // ESC + a long run + a right-to-left override, all inside the node message
+        // (JSON \u escapes so the source has no raw control bytes).
+        let hostile = format!(r#"{{"message":"a\u001b[31m{}b\u202ec"}}"#, "Z".repeat(500));
+        let _m = server
+            .mock("PUT", mockito::Matcher::Regex(r"/star$".to_string()))
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(hostile)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_add(
+            "myrepo".to_string(),
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await
+        .unwrap_err()
+        .to_string();
+
+        assert!(
+            !err.contains('\u{1b}'),
+            "ESC leaked to the terminal: {err:?}"
+        );
+        assert!(!err.contains('\u{202e}'), "bidi override leaked: {err:?}");
+        // Bounded: sanitize_node_msg caps the surfaced message, so the 500-char run
+        // cannot flood the error string.
+        assert!(err.len() < 300, "error not bounded ({} bytes)", err.len());
+        assert!(err.contains("star failed"), "handler label lost: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/status.rs

@@ -41,17 +41,9 @@ pub async fn run(args: StatusArgs) -> Result<()> {
     let client = NodeClient::new(&args.node, None);
     if let Some(ref did) = maybe_did {
         let short_key = did.split(':').next_back().unwrap_or(did);
-        match client.get(&format!("/api/v1/agents/{short_key}")).await {
-            Ok(resp) if resp.status().is_success() => {
-                if let Ok(body) = resp.json::<Value>().await {
-                    let score = body["trust_score"].as_f64().unwrap_or(0.0);
-                    let bar = trust_bar(score);
-                    println!("  trust     {score:.2}  {bar}");
-                }
-            }
-            _ => {
-                println!("  trust     — not registered (run `gl register`)");
-            }
+        let resp = client.get(&format!("/api/v1/agents/{short_key}")).await;
+        if let Some(line) = trust_line(resp).await {
+            println!("{line}");
         }
     }
 
@@ -85,8 +77,10 @@ pub async fn run(args: StatusArgs) -> Result<()> {
         let pr_resp = client
             .get(&format!("/api/v1/repos/{short_owner}/{repo_name}/pulls"))
             .await;
-        if let Ok(r) = pr_resp {
-            if let Ok(body) = r.json::<Value>().await {
+        if let Some(line) = section_unavailable_line("PRs", &pr_resp) {
+            println!("{line}");
+        } else if let Ok(r) = pr_resp {
+            if let Ok(body) = crate::http::read_json(r, "pull requests").await {
                 let prs = body["pulls"].as_array().cloned().unwrap_or_default();
                 let open: Vec<_> = prs
                     .iter()
@@ -112,8 +106,10 @@ pub async fn run(args: StatusArgs) -> Result<()> {
         let issue_resp = client
             .get(&format!("/api/v1/repos/{short_owner}/{repo_name}/issues"))
             .await;
-        if let Ok(r) = issue_resp {
-            if let Ok(body) = r.json::<Value>().await {
+        if let Some(line) = section_unavailable_line("issues", &issue_resp) {
+            println!("{line}");
+        } else if let Ok(r) = issue_resp {
+            if let Ok(body) = crate::http::read_json(r, "issues").await {
                 let issues = body["issues"].as_array().cloned().unwrap_or_default();
                 let open: Vec<_> = issues
                     .iter()
@@ -140,6 +136,40 @@ pub async fn run(args: StatusArgs) -> Result<()> {
     Ok(())
 }
 
+/// The status line for a repo section (PRs / issues) whose gated read returned a
+/// non-2xx: the denial must surface, never render as "no open ...".
+/// Returns `None` for a success (the caller renders the body) or a transport error
+/// (the section degrades silently — R5 — so the multi-section `gl status` never
+/// hard-fails on one denied read).
+fn section_unavailable_line(label: &str, resp: &Result<reqwest::Response>) -> Option<String> {
+    match resp {
+        Ok(r) if !r.status().is_success() => {
+            Some(format!("  {label:<10}unavailable ({})", r.status()))
+        }
+        _ => None,
+    }
+}
+
+/// The `trust` status line for the caller's own identity. A genuine 404 means the
+/// identity is not registered; any OTHER non-2xx (403/429/5xx) is a failed lookup
+/// and must surface as unavailable rather than fabricating an unregistered state
+/// A transport error degrades silently — the node-unreachable line below
+/// already surfaces it — matching `section_unavailable_line`.
+async fn trust_line(resp: Result<reqwest::Response>) -> Option<String> {
+    match resp {
+        Ok(r) if r.status().is_success() => {
+            let body = r.json::<Value>().await.ok()?;
+            let score = body["trust_score"].as_f64().unwrap_or(0.0);
+            Some(format!("  trust     {score:.2}  {}", trust_bar(score)))
+        }
+        Ok(r) if r.status() == reqwest::StatusCode::NOT_FOUND => {
+            Some("  trust     — not registered (run `gl register`)".to_string())
+        }
+        Ok(r) => Some(format!("  trust     unavailable ({})", r.status())),
+        Err(_) => None,
+    }
+}
+
 /// Render a simple ASCII trust bar: 0.75 → "███░"
 fn trust_bar(score: f64) -> String {
     let filled = (score * 4.0).round() as usize;
@@ -380,4 +410,125 @@ mod tests {
     fn trust_bar_quarter() {
         assert_eq!(trust_bar(0.25), "█░░░");
     }
+
+    // ── gl status section denial surfacing (#123, R5) ────────────────────
+
+    async fn get_response(
+        server: &mut mockito::Server,
+        status: usize,
+    ) -> Result<reqwest::Response> {
+        let _m = server
+            .mock("GET", "/x")
+            .with_status(status)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"pulls":[]}"#)
+            .create_async()
+            .await;
+        NodeClient::new(server.url(), None).get("/x").await
+    }
+
+    #[tokio::test]
+    async fn gated_section_surfaces_unavailable_not_empty() {
+        // A gated 404 on a status section must surface "unavailable", never be
+        // treated as "no open PRs".
+        let mut server = mockito::Server::new_async().await;
+        let resp = get_response(&mut server, 404).await;
+        assert_eq!(
+            section_unavailable_line("PRs", &resp),
+            Some(format!("  {:<10}unavailable (404 Not Found)", "PRs"))
+        );
+    }
+
+    #[tokio::test]
+    async fn success_section_returns_none_for_body_render() {
+        // A 2xx returns None so the caller renders the body as before.
+        let mut server = mockito::Server::new_async().await;
+        let resp = get_response(&mut server, 200).await;
+        assert!(section_unavailable_line("issues", &resp).is_none());
+    }
+
+    #[test]
+    fn transport_error_degrades_silently() {
+        // A transport error (not a status) must NOT surface — the section
+        // degrades silently so gl status never hard-fails on one bad read (R5).
+        let err: Result<reqwest::Response> = Err(anyhow::anyhow!("connection refused"));
+        assert!(section_unavailable_line("PRs", &err).is_none());
+    }
+
+    // ── trust_line: a 404 means unregistered; any OTHER failure must surface as
+    //    unavailable, never fabricate an unregistered verdict. ───────────────
+    async fn agents_resp(
+        server: &mut mockito::Server,
+        status: usize,
+        body: &str,
+    ) -> Result<reqwest::Response> {
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"^/api/v1/agents/".to_string()),
+            )
+            .with_status(status)
+            .with_header("content-type", "application/json")
+            .with_body(body)
+            .create_async()
+            .await;
+        NodeClient::new(server.url(), None)
+            .get("/api/v1/agents/zTest")
+            .await
+    }
+
+    #[tokio::test]
+    async fn trust_line_registered_shows_score_only() {
+        let mut s = mockito::Server::new_async().await;
+        let line = trust_line(agents_resp(&mut s, 200, r#"{"trust_score":0.5}"#).await)
+            .await
+            .unwrap();
+        assert!(line.contains("0.50"), "line={line}");
+        assert!(!line.contains("not registered"), "line={line}");
+        assert!(!line.contains("unavailable"), "line={line}");
+    }
+
+    #[tokio::test]
+    async fn trust_line_404_is_not_registered() {
+        let mut s = mockito::Server::new_async().await;
+        let line = trust_line(agents_resp(&mut s, 404, r#"{"message":"agent not found"}"#).await)
+            .await
+            .unwrap();
+        assert!(line.contains("not registered"), "line={line}");
+        assert!(!line.contains("unavailable"), "line={line}");
+    }
+
+    // Load-bearing: a 403 for an existing identity is a denied lookup, not proof it is unregistered.
+    #[tokio::test]
+    async fn trust_line_403_is_unavailable_not_registered() {
+        let mut s = mockito::Server::new_async().await;
+        let line = trust_line(agents_resp(&mut s, 403, r#"{"message":"forbidden"}"#).await)
+            .await
+            .unwrap();
+        assert!(
+            line.contains("unavailable") && line.contains("403"),
+            "line={line}"
+        );
+        assert!(!line.contains("not registered"), "line={line}");
+    }
+
+    // Load-bearing: a 5xx is a failed lookup, not an unregistered verdict.
+    #[tokio::test]
+    async fn trust_line_500_is_unavailable_not_registered() {
+        let mut s = mockito::Server::new_async().await;
+        let line = trust_line(agents_resp(&mut s, 500, r#"{"message":"boom"}"#).await)
+            .await
+            .unwrap();
+        assert!(line.contains("unavailable"), "line={line}");
+        assert!(!line.contains("not registered"), "line={line}");
+    }
+
+    // Load-bearing: a transport error degrades silently, never fabricates unregistered.
+    #[tokio::test]
+    async fn trust_line_transport_error_is_silent() {
+        let resp = NodeClient::new("http://127.0.0.1:1", None)
+            .get("/api/v1/agents/zTest")
+            .await;
+        assert!(trust_line(resp).await.is_none());
+    }
 }

crates/gl/src/sync.rs

@@ -75,8 +75,9 @@ pub async fn run(args: SyncArgs) -> Result<()> {
         SyncCmd::Status => {
             let client = NodeClient::new(&args.node, None);
             // Just show peer list and node stats for now
-            let stats: serde_json::Value = client.get("/api/v1/stats").await?.json().await?;
-            let peers: serde_json::Value = client.get("/api/v1/peers").await?.json().await?;
+            let stats =
+                crate::http::read_json(client.get("/api/v1/stats").await?, "node stats").await?;
+            let peers = crate::http::read_json(client.get("/api/v1/peers").await?, "peers").await?;
             println!("Node stats:");
             println!("  repos:  {}", stats["repos"].as_i64().unwrap_or(0));
             println!("  agents: {}", stats["agents"].as_i64().unwrap_or(0));
@@ -162,6 +163,7 @@ mod tests {
             // Valid JSON: the parse-without-status-check bug deserializes this
             // into a zero-count success struct and prints "✓ sync triggered".
             .with_body(r#"{"message":"unauthorized"}"#)
+            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -170,6 +172,8 @@ mod tests {
             err.to_string().contains("401"),
             "expected 401 surfaced, got: {err}"
         );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -180,6 +184,7 @@ mod tests {
             .with_status(429)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"slow down"}"#)
+            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -188,6 +193,8 @@ mod tests {
             err.to_string().contains("429"),
             "expected 429 surfaced, got: {err}"
         );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -204,6 +211,7 @@ mod tests {
             // BEL (\u0007); serde decodes them to real control bytes a naive
             // client would print. (The status-check bug fake-successes here.)
             .with_body("{\"message\":\"pwned\\u001b[31m\\u0007bad\"}")
+            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -215,6 +223,8 @@ mod tests {
             s.contains("pwned") && s.contains("bad"),
             "message text dropped: {s:?}"
         );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -240,6 +250,7 @@ mod tests {
             .mock("POST", "/api/v1/sync/trigger")
             .with_status(401)
             .with_body("A".repeat(2_000_000))
+            .expect(1)
             .create_async()
             .await;
         let (args, _dir) = trigger_args(server.url());
@@ -251,6 +262,8 @@ mod tests {
             "error message not bounded: {} chars",
             s.len()
         );
+        // Prove the mocked route was actually requested; a non-matching request (mockito's 501, also non-2xx) would otherwise satisfy the error assertion vacuously.
+        _m.assert_async().await;
     }
 
     #[tokio::test]
@@ -281,4 +294,71 @@ mod tests {
             (0, 0)
         );
     }
+
+    #[tokio::test]
+    async fn status_surfaces_stats_denial_not_fake_zeros() {
+        // A node error on /stats must Err, not print "0 repos / 0 agents / 0 pushes".
+        let mut server = mockito::Server::new_async().await;
+        let stats = server
+            .mock("GET", "/api/v1/stats")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        // A peers mock so the pre-fix path reaches a clean success rather than a
+        // 501 on an unmocked route; after the fix the /stats denial bails first.
+        let _peers = server
+            .mock("GET", "/api/v1/peers")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"count":0,"peers":[]}"#)
+            .create_async()
+            .await;
+        let args = SyncArgs {
+            cmd: SyncCmd::Status,
+            node: server.url(),
+            dir: None,
+        };
+        let err = run(args).await.unwrap_err();
+        assert!(
+            err.to_string().contains("500"),
+            "expected 500 surfaced, got: {err}"
+        );
+        stats.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn status_surfaces_peers_denial() {
+        // /stats succeeds but /peers denies — the peers read must Err too, not
+        // print "Known peers: 0".
+        let mut server = mockito::Server::new_async().await;
+        let _stats = server
+            .mock("GET", "/api/v1/stats")
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"repos":1,"agents":2,"pushes":3}"#)
+            .create_async()
+            .await;
+        let peers = server
+            .mock("GET", "/api/v1/peers")
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let args = SyncArgs {
+            cmd: SyncCmd::Status,
+            node: server.url(),
+            dir: None,
+        };
+        let err = run(args).await.unwrap_err();
+        assert!(
+            err.to_string().contains("500"),
+            "expected 500 surfaced, got: {err}"
+        );
+        peers.assert_async().await;
+    }
 }

crates/gl/src/task.rs

@@ -190,13 +190,14 @@ async fn cmd_create(
         "delegator_did": delegator_did,
     }))?;
 
-    let resp: Value = client
-        .post("/api/v1/tasks", &body)
-        .await
-        .context("failed to create task")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client
+            .post("/api/v1/tasks", &body)
+            .await
+            .context("failed to create task")?,
+        "create task",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
@@ -215,26 +216,25 @@ async fn cmd_list(
     if let Some(a) = &assignee_did {
         path.push_str(&format!("&assignee_did={}", urlencoding::encode(a)));
     }
-    let resp: Value = client
-        .get(&path)
-        .await
-        .context("failed to list tasks")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client.get(&path).await.context("failed to list tasks")?,
+        "list tasks",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
 
 async fn cmd_view(id: String, node: String) -> Result<()> {
     let client = NodeClient::new(&node, None);
-    let resp: Value = client
-        .get(&format!("/api/v1/tasks/{}", id))
-        .await
-        .context("failed to get task")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client
+            .get(&format!("/api/v1/tasks/{}", id))
+            .await
+            .context("failed to get task")?,
+        "view task",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
@@ -245,13 +245,14 @@ async fn cmd_claim(id: String, node: String, dir: Option<PathBuf>) -> Result<()>
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "assignee_did": assignee_did }))?;
-    let resp: Value = client
-        .post(&format!("/api/v1/tasks/{}/claim", id), &body)
-        .await
-        .context("failed to claim task")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client
+            .post(&format!("/api/v1/tasks/{}/claim", id), &body)
+            .await
+            .context("failed to claim task")?,
+        "claim task",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
@@ -267,13 +268,14 @@ async fn cmd_complete(
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "result": result, "by_did": by_did }))?;
-    let resp: Value = client
-        .post(&format!("/api/v1/tasks/{}/complete", id), &body)
-        .await
-        .context("failed to complete task")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client
+            .post(&format!("/api/v1/tasks/{}/complete", id), &body)
+            .await
+            .context("failed to complete task")?,
+        "complete task",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
@@ -289,13 +291,14 @@ async fn cmd_fail(
     let client = NodeClient::new(&node, Some(keypair));
 
     let body = serde_json::to_vec(&json!({ "reason": reason, "by_did": by_did }))?;
-    let resp: Value = client
-        .post(&format!("/api/v1/tasks/{}/fail", id), &body)
-        .await
-        .context("failed to fail task")?
-        .json()
-        .await
-        .context("invalid JSON response")?;
+    let resp = crate::http::read_json(
+        client
+            .post(&format!("/api/v1/tasks/{}/fail", id), &body)
+            .await
+            .context("failed to fail task")?,
+        "fail task",
+    )
+    .await?;
     print_json(&resp);
     Ok(())
 }
@@ -379,11 +382,12 @@ mod tests {
             .with_status(500)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"internal error"}"#)
+            .expect(1)
             .create_async()
             .await;
 
-        // Should still succeed (prints JSON, doesn't check status code)
-        cmd_create(
+        // A node 5xx must surface as an Err, not be printed as if it were a task.
+        let err = cmd_create(
             "deploy".to_string(),
             "agent:task".to_string(),
             None,
@@ -395,7 +399,9 @@ mod tests {
             Some(dir.path().to_path_buf()),
         )
         .await
-        .unwrap();
+        .unwrap_err();
+        assert!(err.to_string().contains("500"), "got: {err}");
+        _m.assert_async().await;
     }
 
     // ── list ─────────────────────────────────────────────────────────
@@ -469,11 +475,16 @@ mod tests {
             .with_status(404)
             .with_header("content-type", "application/json")
             .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
             .create_async()
             .await;
 
-        // cmd_view doesn't check status — it prints the JSON
-        cmd_view("nope".to_string(), server.url()).await.unwrap();
+        // A 404 must surface as an Err, not be printed as if it were a task.
+        let err = cmd_view("nope".to_string(), server.url())
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
     }
 
     // ── claim ────────────────────────────────────────────────────────
@@ -625,4 +636,122 @@ mod tests {
         .await
         .unwrap();
     }
+
+    // ── denial surfaces: a node 4xx/5xx must Err, not render as success ──
+
+    #[tokio::test]
+    async fn test_list_tasks_surfaces_denial() {
+        let mut server = mockito::Server::new_async().await;
+
+        let _m = server
+            .mock(
+                "GET",
+                mockito::Matcher::Regex(r"/api/v1/tasks\?".to_string()),
+            )
+            .with_status(500)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"boom"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_list(None, None, 50, server.url()).await.unwrap_err();
+        assert!(err.to_string().contains("500"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn test_claim_task_surfaces_denial() {
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap();
+        let kp = gitlawb_core::identity::Keypair::generate();
+        std::fs::write(
+            dir.path().join("identity.pem"),
+            kp.to_pem().unwrap().as_bytes(),
+        )
+        .unwrap();
+
+        let _m = server
+            .mock("POST", "/api/v1/tasks/task-x/claim")
+            .with_status(403)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"forbidden"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_claim(
+            "task-x".to_string(),
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await
+        .unwrap_err();
+        assert!(err.to_string().contains("403"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn test_complete_task_surfaces_denial() {
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap();
+        let kp = gitlawb_core::identity::Keypair::generate();
+        std::fs::write(
+            dir.path().join("identity.pem"),
+            kp.to_pem().unwrap().as_bytes(),
+        )
+        .unwrap();
+
+        let _m = server
+            .mock("POST", "/api/v1/tasks/task-x/complete")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"not found"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_complete(
+            "task-x".to_string(),
+            None,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await
+        .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
+
+    #[tokio::test]
+    async fn test_fail_task_surfaces_denial() {
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap();
+        let kp = gitlawb_core::identity::Keypair::generate();
+        std::fs::write(
+            dir.path().join("identity.pem"),
+            kp.to_pem().unwrap().as_bytes(),
+        )
+        .unwrap();
+
+        let _m = server
+            .mock("POST", "/api/v1/tasks/task-x/fail")
+            .with_status(409)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"already terminal"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let err = cmd_fail(
+            "task-x".to_string(),
+            None,
+            server.url(),
+            Some(dir.path().to_path_buf()),
+        )
+        .await
+        .unwrap_err();
+        assert!(err.to_string().contains("409"), "got: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/visibility.rs

@@ -2,7 +2,6 @@
 
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
-use serde_json::Value;
 use std::path::{Path, PathBuf};
 
 use crate::http::NodeClient;
@@ -99,12 +98,7 @@ async fn resolve_owner_repo(
         did.split(':').next_back().unwrap_or(&did).to_string()
     } else {
         let client = NodeClient::new(node, None);
-        let info: Value = client
-            .get("/")
-            .await?
-            .json()
-            .await
-            .context("failed to fetch node info")?;
+        let info = crate::http::read_json(client.get("/").await?, "node info").await?;
         let did = info["did"].as_str().context("node missing DID")?;
         did.split(':').next_back().unwrap_or(did).to_string()
     };
@@ -135,12 +129,7 @@ async fn cmd_set(
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("visibility set failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "visibility set").await?;
 
     println!("✓ Visibility rule set on {owner}/{name}: {path_glob} (mode {mode})");
     if path_glob != "/" {
@@ -168,12 +157,7 @@ async fn cmd_remove(
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("visibility remove failed ({status}): {msg}");
-    }
+    let _ = crate::http::read_json(resp, "visibility remove").await?;
 
     println!("✓ Visibility rule removed from {owner}/{name}: {path_glob}");
     Ok(())
@@ -191,12 +175,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         .await
         .context("failed to connect to node")?;
 
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("visibility list failed ({status}): {msg}");
-    }
+    let body = crate::http::read_json(resp, "visibility list").await?;
 
     let rules = body["rules"].as_array().cloned().unwrap_or_default();
     if rules.is_empty() {
@@ -319,4 +298,26 @@ mod tests {
         .await
         .unwrap();
     }
+
+    #[tokio::test]
+    async fn resolve_owner_repo_surfaces_denial() {
+        // A slash-free repo with an empty identity dir forces the GET / node-info
+        // fetch. A gated 404 there must Err (surfacing the status), proving the
+        // read_json conversion is load-bearing rather than silently ignored.
+        let mut server = mockito::Server::new_async().await;
+        let dir = tempfile::TempDir::new().unwrap(); // empty, no identity.pem, forces the GET / branch
+        let _m = server
+            .mock("GET", "/")
+            .with_status(404)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"message":"denied"}"#)
+            .expect(1)
+            .create_async()
+            .await;
+        let err = resolve_owner_repo("noslash", &server.url(), Some(dir.path()))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("404"), "got: {err}");
+        _m.assert_async().await;
+    }
 }

crates/gl/src/webhook.rs

@@ -110,17 +110,17 @@ async fn cmd_create(
         "events": event_list,
     }))?;
 
-    let resp = client
-        .post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
-        .await
-        .context("failed to connect to node")?;
-    let status = resp.status();
-    let hook: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = hook["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("create webhook failed ({status}): {msg}");
-    }
+    // #186: read_json status-checks before parsing and bounds the error body, so
+    // a denial (or a hostile oversized error) fails here instead of being parsed
+    // whole. `what` preserves main's "create webhook failed (...)" message prefix.
+    let hook = crate::http::read_json(
+        client
+            .post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
+            .await
+            .context("failed to connect to node")?,
+        "create webhook",
+    )
+    .await?;
 
     let id = hook["id"].as_str().unwrap_or("?");
     let hook_events = hook["events"]
@@ -157,16 +157,15 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     // get_signed (not get) attaches the RFC 9421 signature — plain get() never
     // signs, and the node owner-gates this route, so an unsigned GET 401s.
-    let resp = client
-        .get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
-        .await?;
-    let status = resp.status();
-    let body: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list webhooks failed ({status}): {msg}");
-    }
+    // #186: read_json status-checks + bounds the error body; `what` preserves
+    // main's "list webhooks failed (...)" message prefix.
+    let body = crate::http::read_json(
+        client
+            .get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
+            .await?,
+        "list webhooks",
+    )
+    .await?;
 
     let hooks = body
         .get("webhooks")
@@ -207,20 +206,20 @@ async fn cmd_delete(repo: String, id: String, node: String, dir: Option<PathBuf>
     let client = NodeClient::new(&node, Some(keypair));
 
     let payload = serde_json::to_vec(&serde_json::json!({}))?;
-    let resp = client
-        .delete(
-            &format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
-            &payload,
-        )
-        .await
-        .context("failed to connect to node")?;
-    let status = resp.status();
-    let result: Value = resp.json().await.context("invalid JSON")?;
-
-    if !status.is_success() {
-        let msg = result["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("delete webhook failed ({status}): {msg}");
-    }
+    // #186: read_json status-checks + bounds the error body; `what` preserves
+    // main's "delete webhook failed (...)" message prefix. The success body is
+    // unused, so discard it.
+    let _ = crate::http::read_json(
+        client
+            .delete(
+                &format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
+                &payload,
+            )
+            .await
+            .context("failed to connect to node")?,
+        "delete webhook",
+    )
+    .await?;
 
     println!("✓ Webhook {id} deleted");
     Ok(())

crates/gl/tests/no_parse_before_status.rs

@@ -0,0 +1,356 @@
+//! Completeness gate for #186, itself proven load-bearing by reverting a
+//! converted handler and watching this go red.
+//!
+//! The client handlers converted in #186 must read node responses through
+//! `crate::http::read_json` — status-first, capped error read, sanitized message.
+//! The bypass this fix removed is *parse-before-status*: a `resp.json().await`
+//! whose result is only checked against the status AFTER parsing, which lets a
+//! hostile node stream an unbounded JSON error and print its `message` unsanitized.
+//!
+//! This test scans the converted source files and fails if that idiom returns —
+//! a `.json().await` call (not `read_json`) with an `.is_success()` check within a
+//! few lines AFTER it. A status check BEFORE the parse (the `KEEP` probes in
+//! repo.rs) reads as status-first and is not flagged. If a converted site is
+//! reverted to the bypass, this goes RED.
+//!
+//! The gate does not hand-list the files to scan; it DERIVES them: every
+//! `src/*.rs` that references `read_json` (except `http.rs`, where it is defined)
+//! is a converted handler and is scanned for the bypass idiom.
+//!
+//! Derivation alone has a blind spot: it keys on the very `read_json` marker a
+//! full revert deletes. A converted handler with a single node call (register.rs)
+//! reverted to `resp.json().await` loses `read_json` entirely, drops out of the
+//! derived set, and its bypass goes unscanned. So `CONVERTED_IN_186` is the
+//! authoritative required set and the gate asserts the derived surface EQUALS it,
+//! failing closed in both directions:
+//!
+//! - a pinned file missing from the derived set was reverted off `read_json`
+//!   (the blind-spot escape), so the gate goes RED;
+//! - a file that uses `read_json` but is not pinned is a conversion that was
+//!   never enrolled, so its own later revert would escape unseen; RED until it
+//!   is added to the pin.
+//!
+//! Equality is what extends the protection to handlers converted after #186, not
+//! just the original sixteen: a conversion cannot ship unpinned, and a pinned
+//! surface cannot be deconverted silently.
+//!
+//! Pre-existing bypasses in files this PR did not convert (e.g. init.rs,
+//! mirror.rs, profile.rs) are known debt, tracked separately and out of scope.
+//! They do not use `read_json`, so the derivation excludes them and they are not
+//! pinned.
+
+use std::path::Path;
+
+/// Files that define/host `read_json` rather than consume it as a converted
+/// handler. Excluded from the scanned set even though they reference the symbol.
+const NOT_A_HANDLER: &[&str] = &["http.rs"];
+
+/// The authoritative converted-handler surface: every non-`http.rs` file whose
+/// node-response reads route through `read_json`. The gate asserts the derived
+/// `read_json` set EQUALS this exactly, so a new conversion must be added here
+/// (the gate is RED until it is) and a pinned surface cannot be reverted off
+/// `read_json` without tripping the gate. Both directions fail closed, which is
+/// what protects post-#186 conversions, not only the original sixteen.
+const CONVERTED_IN_186: &[&str] = &[
+    "agent.rs",
+    "bounty.rs",
+    "cert.rs",
+    "changelog.rs",
+    "issue.rs",
+    "mcp.rs",
+    "peer.rs",
+    "pr.rs",
+    "protect.rs",
+    "register.rs",
+    "repo.rs",
+    "star.rs",
+    "status.rs",
+    "sync.rs",
+    "task.rs",
+    "visibility.rs",
+    "webhook.rs",
+];
+
+/// Derive the converted-handler surface: every `src/*.rs` that references
+/// `read_json`, minus the definition site(s). This is the set the equality check
+/// compares against `CONVERTED_IN_186`; a newly-converted handler surfaces here
+/// and must then be pinned (the gate is RED until it is).
+fn scanned_handlers(src: &Path) -> Vec<(String, String)> {
+    let mut handlers = Vec::new();
+    for entry in std::fs::read_dir(src).expect("read src dir") {
+        let path = entry.expect("dir entry").path();
+        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
+            continue;
+        }
+        let file_name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .expect("file name")
+            .to_string();
+        if NOT_A_HANDLER.contains(&file_name.as_str()) {
+            continue;
+        }
+        let text = std::fs::read_to_string(&path)
+            .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+        if has_read_json_call_site(&text) {
+            handlers.push((file_name, text));
+        }
+    }
+    handlers.sort();
+    handlers
+}
+
+/// Does this file actually CALL `read_json`, as opposed to merely mentioning it?
+///
+/// Membership in the derived set must key on a call site, never on the text of
+/// the file. A textual `contains("read_json")` matched prose too, so a handler
+/// fully reverted off `read_json` kept its membership on the strength of a
+/// leftover comment ("previously routed through read_json"). Still-derived means
+/// the pinned-vs-derived equality below never fired, and the reverted file went
+/// on being scanned as though it were converted, so the deconversion — which
+/// drops the cap and the sanitizer — shipped green. Requiring the trailing `(`
+/// on a non-comment line also drops test names and doc references.
+fn has_read_json_call_site(text: &str) -> bool {
+    text.lines().any(|l| {
+        let t = l.trim_start();
+        !t.starts_with("//") && t.contains("read_json(")
+    })
+}
+
+/// How far above a parse site to look for its status check.
+///
+/// The widest legitimate gap in the tree is `sync.rs`'s hand-rolled status-first
+/// `Trigger` arm, whose `.status()` sits 19 lines above its parse; 24 leaves a
+/// little headroom. Wider is weaker, so this should shrink if that arm is ever
+/// routed through `read_json` like its siblings.
+const STATUS_LOOKBACK: usize = 24;
+
+/// Does `line` open a JSON parse — `.json().await`, or a turbofish
+/// `.json::<T>().await`, or the head of a split-line chain (`.json(` /
+/// `.json::<T>(` whose `()` / `.await` continue on following lines)?
+///
+/// Lines routed through `read_json` are never parse sites (that IS the fix).
+fn opens_json_parse(line: &str) -> bool {
+    if line.contains("read_json") {
+        return false;
+    }
+    // A `.json(` token starts every reqwest JSON parse, bare or turbofished,
+    // single- or split-line. We anchor on it and let the window below confirm
+    // the `.await` / status check; anchoring on `.json(` alone is what catches
+    // `resp.json::<Value>().await` and `resp\n    .json()\n    .await` chains
+    // that the old bare-`.json().await` substring missed.
+    line.contains(".json()") || line.contains(".json::<")
+}
+
+/// Within `window` (the parse-site line joined with the few lines after it), is
+/// the parse actually completed with `.await` and then checked against the
+/// status? A completed parse whose `.is_success()` lands AFTER it is the
+/// parse-before-status bypass. A status check BEFORE the parse (KEEP probes)
+/// never appears in this after-the-parse window, so it is not flagged.
+fn window_is_bypass(window: &str) -> bool {
+    // The parse must actually resolve — guards against matching a `.json`-shaped
+    // token that never awaits. Split-line chains put `.await` a line or two down,
+    // which the joined window still contains.
+    let completes = window.contains(".await");
+    completes && window.contains(".is_success()")
+}
+
+/// Is there a FULL non-success guard ABOVE this parse site — one that exits for
+/// every non-2xx status, not merely a bespoke branch for one code?
+///
+/// `window_is_bypass` only recognises a status check that lands AFTER the parse,
+/// so it describes one specific bypass and says nothing about a parse with no
+/// status check anywhere. That shape is the more dangerous revert (it renders a
+/// denial body as a successful result with no check at all). Requiring positive
+/// evidence of a guard first turns the rule from "detect one bad ordering" into
+/// "require the good ordering".
+///
+/// The evidence must cover the whole non-success range. "Any `.status()`
+/// nearby" is not enough: agent.rs legitimately keeps a 404-only hint
+/// (`resp.status() == StatusCode::NOT_FOUND`) ahead of its `read_json` call,
+/// and a revert that swaps that call for `resp.json().await?` would still see
+/// the 404 check in the lookback — while a 500's JSON denial body renders as an
+/// empty agent list again. A single-status equality (or a `matches!(…, 404 |
+/// 501)` enumeration) guards its own arm and nothing else, so it does not
+/// count. What counts:
+///
+/// - `.is_success()` — the canonical spelling; sync.rs binds the status to a
+///   variable first, so this token is matched on its own rather than as a
+///   `.status()` suffix;
+/// - a RANGE comparison over `as_u16()` (`>= 400` and friends), which reads the
+///   whole class rather than enumerating codes.
+///
+/// The `special_404_hint_is_not_a_guard` mutation test below keeps this
+/// distinction honest against the real agent.rs source.
+fn has_full_status_guard_above(lookback: &str) -> bool {
+    if lookback.contains(".is_success()") {
+        return true;
+    }
+    lookback.contains("as_u16() >=")
+        || lookback.contains("as_u16() >")
+        || lookback.contains("as_u16() <=")
+        || lookback.contains("as_u16() <")
+}
+
+/// The scan shared by the gate and the mutation regression: every raw parse
+/// site in `text` is classified as an after-the-parse bypass (`offenders`) or a
+/// parse with no full status guard above it (`unguarded`). Factored out so the
+/// mutation test exercises EXACTLY the logic the gate runs, not a paraphrase of
+/// it.
+fn scan_handler(name: &str, text: &str) -> (Vec<String>, Vec<String>) {
+    let mut offenders = Vec::new();
+    let mut unguarded = Vec::new();
+    let lines: Vec<&str> = text.lines().collect();
+    for (i, line) in lines.iter().enumerate() {
+        if !opens_json_parse(line) {
+            continue;
+        }
+        // Join the parse-site line with the following lines so a split-line
+        // chain's `.await` and an after-the-parse `.is_success()` are both in
+        // view. Status-first probes put `.is_success()` on an EARLIER line, so
+        // it is outside this window and stays green.
+        let window = lines[i..(i + 6).min(lines.len())].join("\n");
+        if window_is_bypass(&window) {
+            offenders.push(format!("{name}:{}", i + 1));
+            continue;
+        }
+        // A parse that never resolves is not a read; only a completed parse
+        // can render a denial body as a result.
+        if !window.contains(".await") {
+            continue;
+        }
+        let lookback = lines[i.saturating_sub(STATUS_LOOKBACK)..i].join("\n");
+        if !has_full_status_guard_above(&lookback) {
+            unguarded.push(format!("{name}:{}", i + 1));
+        }
+    }
+    (offenders, unguarded)
+}
+
+#[test]
+fn converted_handlers_never_parse_before_status() {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let handlers = scanned_handlers(&src);
+
+    // Deriving the set is the whole point of the fix; if the tree ever stops
+    // using `read_json` the gate would silently pass on an empty set.
+    assert!(
+        !handlers.is_empty(),
+        "derived no converted handlers from src/*.rs read_json usage — the gate \
+         would vacuously pass; check the derivation"
+    );
+
+    // The pin is the authoritative required set: the derived `read_json` surface
+    // must EQUAL it, failing closed in both directions. A pinned file that drops
+    // out was reverted off `read_json` (register.rs, its single call, is the
+    // motivating case) and its bypass would escape the derived scan. A derived
+    // file that is not pinned is a conversion nobody enrolled, so ITS later revert
+    // would escape the same way; force it into the pin now. Equality is what
+    // extends the protection to handlers converted after #186.
+    let derived: Vec<&str> = handlers.iter().map(|(n, _)| n.as_str()).collect();
+    let deconverted: Vec<&str> = CONVERTED_IN_186
+        .iter()
+        .copied()
+        .filter(|f| !derived.contains(f))
+        .collect();
+    assert!(
+        deconverted.is_empty(),
+        "pinned handler(s) no longer route node responses through read_json: a \
+         parse-before-status revert would otherwise escape the derived scan. \
+         Re-route through crate::http::read_json (or drop from CONVERTED_IN_186 if \
+         the surface was intentionally deconverted): {deconverted:?}"
+    );
+    let unpinned: Vec<&str> = derived
+        .iter()
+        .copied()
+        .filter(|f| !CONVERTED_IN_186.contains(f))
+        .collect();
+    assert!(
+        unpinned.is_empty(),
+        "handler(s) use read_json but are absent from CONVERTED_IN_186: add them so \
+         the gate protects them against a later parse-before-status revert (an \
+         unpinned conversion drops out of both the scan and this check when \
+         reverted): {unpinned:?}"
+    );
+
+    let mut offenders = Vec::new();
+    let mut unguarded = Vec::new();
+    for (name, text) in &handlers {
+        let (o, u) = scan_handler(name, text);
+        offenders.extend(o);
+        unguarded.extend(u);
+    }
+
+    assert!(
+        offenders.is_empty(),
+        "parse-before-status bypass present in converted handler(s) — route the read \
+         through crate::http::read_json (status-first, capped, sanitized): {offenders:?}"
+    );
+    assert!(
+        unguarded.is_empty(),
+        "node response parsed with NO full status guard above it in a converted \
+         handler — the denial body is being rendered as a result. Route the read \
+         through crate::http::read_json (status-first, capped, sanitized): {unguarded:?}"
+    );
+}
+
+/// Mutation regression for the special-404 escape: agent.rs (and the agent-show
+/// / repo-info paths shaped like it) keeps a legitimate 404-only hint ahead of
+/// its `read_json` call. Revert that call to a raw `resp.json().await?` and the
+/// 404 equality is the only status evidence in the lookback — under the old
+/// "any `.status()` nearby" rule the fence stayed green while a 500's denial
+/// body rendered as an empty agent list. This test performs that exact revert
+/// on the REAL agent.rs source and requires the scan to flag the mutant, so the
+/// full-guard distinction in `has_full_status_guard_above` cannot regress to a
+/// mere proximity check without going red here.
+#[test]
+fn special_404_hint_is_not_a_guard() {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let text = std::fs::read_to_string(src.join("agent.rs")).expect("read agent.rs");
+
+    // The mutation must stay real: it requires the idiom it reverts. If
+    // agent.rs drops the 404 hint or the read_json call, this needs re-basing
+    // on whichever handler carries the special-404 idiom then.
+    assert!(
+        text.contains("StatusCode::NOT_FOUND"),
+        "agent.rs no longer carries the special-404 hint this mutation reverts; \
+         re-anchor the mutation on the handler that does"
+    );
+    let lines: Vec<&str> = text.lines().collect();
+    let not_found_line = lines
+        .iter()
+        .position(|l| l.contains("StatusCode::NOT_FOUND"))
+        .unwrap();
+    let read_json_line = lines[not_found_line..]
+        .iter()
+        .position(|l| l.contains("read_json"))
+        .map(|off| not_found_line + off)
+        .expect(
+            "agent.rs has no read_json call after its 404 hint; re-anchor the \
+             mutation on the handler that carries the idiom",
+        );
+
+    // The revert under test: the guarded helper call becomes a raw parse.
+    let mut mutant: Vec<String> = lines.iter().map(|l| l.to_string()).collect();
+    mutant[read_json_line] = "    let body: serde_json::Value = resp.json().await?;".to_string();
+    let mutant = mutant.join("\n");
+
+    let (_, unguarded) = scan_handler("agent.rs[mutant]", &mutant);
+    assert!(
+        unguarded
+            .iter()
+            .any(|hit| hit.starts_with("agent.rs[mutant]:")),
+        "the special-404 revert was not flagged: a 404-only equality upstream is \
+         being accepted as a full status guard, which reopens the escape this \
+         mutation pins (expected an unguarded hit, got {unguarded:?})"
+    );
+
+    // Positive control: the unmutated file must stay green, or the fence is
+    // flagging the legitimate hint rather than the revert.
+    let (offenders, unguarded) = scan_handler("agent.rs", &text);
+    assert!(
+        offenders.is_empty() && unguarded.is_empty(),
+        "unmutated agent.rs trips the fence; the guard classifier is wrong, not \
+         the handler: offenders={offenders:?} unguarded={unguarded:?}"
+    );
+}

crates/icaptcha-client/src/lib.rs

@@ -355,7 +355,13 @@ fn submit_answer(
 /// Returns `None` when stdin isn't a usable interactive source (e.g. an agent),
 /// so the caller surfaces a clear "couldn't auto-solve" error instead.
 fn interactive_prompt(challenge: &Challenge) -> Option<String> {
-    use std::io::{stderr, stdin, Write};
+    use std::io::{stderr, stdin, IsTerminal, Write};
+    // An open but silent stdin (a pipe an orchestrator holds open, an agent
+    // harness) has no one to answer: `read_line` would block forever. Only a
+    // terminal can be interactive.
+    if !stdin().is_terminal() {
+        return None;
+    }
     let mut err = stderr();
     let _ = writeln!(
         err,
@@ -761,4 +767,68 @@ mod tests {
         );
         assert_eq!(non_empty.api_key.as_deref(), Some("secret-bearer"));
     }
+
+    /// #345: an open-but-silent non-TTY stdin must not hang the prompt. The
+    /// child runs `interactive_prompt` with a held-open, empty pipe as stdin:
+    /// without the terminal check `read_line` blocks forever; with it the
+    /// child returns `None` and exits.
+    #[test]
+    fn interactive_prompt_skips_open_silent_pipe() {
+        const CHILD_ENV: &str = "ICAPTCHA_PROMPT_PIPE_CHILD";
+        if std::env::var_os(CHILD_ENV).is_some() {
+            let ch = Challenge {
+                challenge_id: "c".into(),
+                kind: "arithmetic".into(),
+                difficulty: 1,
+                prompt: "What is 1 + 1?".into(),
+                token: "t".into(),
+                pow: None,
+            };
+            assert!(interactive_prompt(&ch).is_none());
+            println!("prompt-skipped");
+            return;
+        }
+        let exe = std::env::current_exe().expect("current test binary");
+        let mut child = std::process::Command::new(exe)
+            .args([
+                "--exact",
+                "tests::interactive_prompt_skips_open_silent_pipe",
+                "--nocapture",
+            ])
+            .env(CHILD_ENV, "1")
+            .stdin(std::process::Stdio::piped())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::null())
+            .spawn()
+            .expect("spawn child test");
+        // The parent keeps the write end open with no data, which is exactly
+        // the shape that hung: an open, silent, non-terminal stdin.
+        let _held_stdin = child.stdin.take();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        loop {
+            match child.try_wait().expect("poll child") {
+                Some(status) => {
+                    assert!(status.success(), "child exited with {status}");
+                    let mut out = String::new();
+                    std::io::Read::read_to_string(
+                        &mut child.stdout.take().expect("child stdout"),
+                        &mut out,
+                    )
+                    .expect("read child stdout");
+                    assert!(
+                        out.contains("prompt-skipped"),
+                        "child test body did not run: {out}"
+                    );
+                    return;
+                }
+                None if std::time::Instant::now() < deadline => {
+                    std::thread::sleep(std::time::Duration::from_millis(50));
+                }
+                None => {
+                    let _ = child.kill();
+                    panic!("interactive_prompt blocked on an open, silent non-TTY stdin");
+                }
+            }
+        }
+    }
 }

crates/icaptcha-client/src/solvers.rs

@@ -30,8 +30,8 @@ fn solve_arithmetic(prompt: &str) -> Option<i64> {
     while let Some(op) = tokens.next() {
         let n: i64 = tokens.next()?.parse().ok()?;
         match op {
-            "+" => acc += n,
-            "-" => acc -= n,
+            "+" => acc = acc.checked_add(n)?,
+            "-" => acc = acc.checked_sub(n)?,
             _ => return None,
         }
     }
@@ -45,15 +45,15 @@ fn solve_algebra(prompt: &str) -> Option<i64> {
     let (lhs, rhs) = eq.split_once('=')?;
     let (al, cl) = parse_linear(lhs.trim())?;
     let (ar, cr) = parse_linear(rhs.trim())?;
-    let denom = al - ar;
+    let denom = al.checked_sub(ar)?;
     if denom == 0 {
         return None;
     }
-    let num = cr - cl;
-    if num % denom != 0 {
+    let num = cr.checked_sub(cl)?;
+    if num.checked_rem(denom)? != 0 {
         return None;
     }
-    Some(num / denom)
+    num.checked_div(denom)
 }
 
 /// Parse a linear expression in `x` into `(coeff_of_x, constant)`.
@@ -76,12 +76,12 @@ fn parse_linear(s: &str) -> Option<(i64, i64)> {
                 let m: i64 = it.next()?.parse().ok()?;
                 match op {
                     "+" => (1, m),
-                    "-" => (1, -m),
+                    "-" => (1, m.checked_neg()?),
                     _ => return None,
                 }
             }
         };
-        return Some((a * coeff_inner, a * const_inner));
+        return Some((a.checked_mul(coeff_inner)?, a.checked_mul(const_inner)?));
     }
 
     // Sum of `±`-separated terms.
@@ -99,10 +99,10 @@ fn parse_linear(s: &str) -> Option<(i64, i64)> {
                         "-" => -1,
                         _ => cpart.parse().ok()?,
                     };
-                    coeff += sign * c;
+                    coeff = coeff.checked_add(sign.checked_mul(c)?)?;
                 } else {
                     let n: i64 = t.parse().ok()?;
-                    konst += sign * n;
+                    konst = konst.checked_add(sign.checked_mul(n)?)?;
                 }
                 sign = 1;
             }
@@ -127,23 +127,26 @@ fn solve_sequence(prompt: &str) -> Option<i64> {
 fn next_in_sequence(n: &[i64]) -> Option<i64> {
     let last = *n.last()?;
 
-    // Arithmetic: constant first difference.
-    let d = n[1] - n[0];
-    if n.windows(2).all(|w| w[1] - w[0] == d) {
-        return Some(last + d);
+    // Arithmetic: constant first difference. An overflowing difference means
+    // the pattern doesn't fit, not that the answer wraps.
+    if let Some(d) = n[1].checked_sub(n[0]) {
+        if n.windows(2).all(|w| w[1].checked_sub(w[0]) == Some(d)) {
+            return last.checked_add(d);
+        }
     }
 
     // Geometric: constant integer ratio.
-    if n.iter().all(|&v| v != 0) && n[0] != 0 && n[1] % n[0] == 0 {
-        let r = n[1] / n[0];
-        if r != 0 && n.windows(2).all(|w| w[1] == w[0] * r) {
-            return Some(last * r);
+    if n.iter().all(|&v| v != 0) && n[1].checked_rem(n[0]) == Some(0) {
+        if let Some(r) = n[1].checked_div(n[0]) {
+            if r != 0 && n.windows(2).all(|w| w[0].checked_mul(r) == Some(w[1])) {
+                return last.checked_mul(r);
+            }
         }
     }
 
     // Fibonacci-like: each term is the sum of the two before it.
-    if n.len() >= 3 && (2..n.len()).all(|i| n[i] == n[i - 1] + n[i - 2]) {
-        return Some(n[n.len() - 1] + n[n.len() - 2]);
+    if n.len() >= 3 && (2..n.len()).all(|i| n[i - 1].checked_add(n[i - 2]) == Some(n[i])) {
+        return n[n.len() - 1].checked_add(n[n.len() - 2]);
     }
 
     // Squares: all perfect squares with consecutive roots.
@@ -151,7 +154,7 @@ fn next_in_sequence(n: &[i64]) -> Option<i64> {
     if let Some(roots) = roots {
         if roots.windows(2).all(|w| w[1] == w[0] + 1) {
             let nr = roots[roots.len() - 1] + 1;
-            return Some(nr * nr);
+            return nr.checked_mul(nr);
         }
     }
 
@@ -160,12 +163,16 @@ fn next_in_sequence(n: &[i64]) -> Option<i64> {
         .iter()
         .enumerate()
         .all(|(i, &v)| if i % 2 == 0 { v >= 0 } else { v < 0 });
-    let mags: Vec<i64> = n.iter().map(|v| v.abs()).collect();
-    let md = mags[1] - mags[0];
-    if signs_alternate && mags.windows(2).all(|w| w[1] - w[0] == md) {
-        let next_mag = mags[mags.len() - 1] + md;
-        let next_sign = if last >= 0 { -1 } else { 1 };
-        return Some(next_sign * next_mag);
+    let mags: Option<Vec<i64>> = n.iter().map(|v| v.checked_abs()).collect();
+    if signs_alternate {
+        if let Some(mags) = mags {
+            if let Some(md) = mags[1].checked_sub(mags[0]) {
+                if mags.windows(2).all(|w| w[1].checked_sub(w[0]) == Some(md)) {
+                    let next_sign: i64 = if last >= 0 { -1 } else { 1 };
+                    return next_sign.checked_mul(mags[mags.len() - 1].checked_add(md)?);
+                }
+            }
+        }
     }
 
     None
@@ -179,7 +186,7 @@ fn isqrt_exact(v: i64) -> Option<i64> {
     let r = (v as f64).sqrt().round() as i64;
     [r - 1, r, r + 1]
         .into_iter()
-        .find(|&cand| cand >= 0 && cand * cand == v)
+        .find(|&cand| cand >= 0 && cand.checked_mul(cand) == Some(v))
 }
 
 #[cfg(test)]
@@ -267,4 +274,80 @@ mod tests {
         assert_eq!(solve("anagram", "Unscramble: tca"), None);
         assert_eq!(solve("riddle", "What has keys but no locks?"), None);
     }
+
+    // #345: prompts are attacker/service-controlled and every literal can be a
+    // valid i64 while the evaluation still overflows. Overflow must return
+    // None (unsolvable), never a debug panic or a wrapped wrong answer.
+
+    #[test]
+    fn arithmetic_overflow_returns_none() {
+        assert_eq!(
+            solve("arithmetic", "What is 9223372036854775807 + 1?"),
+            None
+        );
+        assert_eq!(
+            solve("arithmetic", "What is -9223372036854775808 - 1?"),
+            None
+        );
+        // Boundary-adjacent values still solve.
+        assert_eq!(
+            solve("arithmetic", "What is 9223372036854775806 + 1?").as_deref(),
+            Some("9223372036854775807")
+        );
+    }
+
+    #[test]
+    fn algebra_overflow_returns_none() {
+        // num = i64::MIN, denom = -1: the quotient overflows.
+        assert_eq!(
+            solve("algebra", "Solve for x: x + 1 = 2x + -9223372036854775807"),
+            None
+        );
+        // sign * coefficient overflows at i64::MIN.
+        assert_eq!(
+            solve("algebra", "Solve for x: x - -9223372036854775808x = 1"),
+            None
+        );
+        // A large but solvable equation still solves.
+        assert_eq!(
+            solve("algebra", "Solve for x: 4611686018427387904x + 0 = 0").as_deref(),
+            Some("0")
+        );
+    }
+
+    #[test]
+    fn sequence_overflow_returns_none() {
+        // First difference overflows (1 - i64::MIN).
+        assert_eq!(
+            solve(
+                "sequence",
+                "What is the next number in this sequence? -9223372036854775808, 1, 9223372036854775806, ?"
+            ),
+            None
+        );
+        // i64::MIN in an alternating-sign candidate: abs() overflows.
+        assert_eq!(
+            solve(
+                "sequence",
+                "What is the next number in this sequence? 1, -9223372036854775808, 3, ?"
+            ),
+            None
+        );
+        // Perfect-square check near i64::MAX: candidate root squared overflows.
+        assert_eq!(
+            solve(
+                "sequence",
+                "What is the next number in this sequence? 9223372036854775807, 9223372036854775800, 9223372036854775801, ?"
+            ),
+            None
+        );
+        // Geometric next term overflows (r = 2, last * 2 > i64::MAX).
+        assert_eq!(
+            solve(
+                "sequence",
+                "What is the next number in this sequence? 2305843009213693951, 4611686018427387902, 9223372036854775804, ?"
+            ),
+            None
+        );
+    }
 }

crates/icaptcha-client/tests/icaptcha_stdin_e2e.rs

@@ -0,0 +1,134 @@
+//! #345 end-to-end: `obtain_proof` must not block or crash when stdin is an
+//! open, silent non-TTY and the challenge can't be solved deterministically.
+//!
+//! The unit seam can't fake a process stdin, so the parent spawns this test
+//! binary with a held-open pipe as stdin and the child runs the real
+//! `obtain_proof` against a mocked iCaptcha service over HTTP. Before the fix
+//! the child blocked in `read_line` forever (unsolvable type) or panicked /
+//! submitted a wrapped answer (overflowing arithmetic). After the fix it
+//! exits promptly with the "cannot solve" error.
+
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+use icaptcha_client::{obtain_proof, IcaptchaCfg};
+
+const CHILD_ENV: &str = "ICAPTCHA_STDIN_E2E_CHILD";
+const URL_ENV: &str = "ICAPTCHA_STDIN_E2E_URL";
+const CHILD_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// Child entry point: fetch the challenge from the mock service and run the
+/// full solve loop. Both scenarios must reach the same clean error.
+fn run_child() {
+    let url = std::env::var(URL_ENV).expect("child needs the mock url");
+    let cfg = IcaptchaCfg {
+        url,
+        did: "did:key:zTEST".to_string(),
+        level: 1,
+        api_key: None,
+    };
+    let err = obtain_proof(&cfg, None).expect_err("the challenge is unsolvable");
+    assert!(
+        err.to_string().contains("cannot solve iCaptcha challenge"),
+        "expected the unsolvable-challenge error, got: {err}"
+    );
+    println!("child-finished-cleanly");
+}
+
+/// Spawn the child with a held-open, empty pipe as stdin, wait with a
+/// deadline, and assert it printed the clean-exit marker.
+fn run_scenario(prompt_type: &str, prompt: &str, expect_answer_calls: usize) {
+    let mut server = mockito::Server::new();
+    let challenge = server
+        .mock("POST", "/v1/challenge")
+        .with_status(200)
+        .with_header("content-type", "application/json")
+        .with_body(format!(
+            r#"{{"challengeId":"c1","type":"{prompt_type}","difficulty":1,"prompt":"{prompt}","token":"tok-1"}}"#
+        ))
+        .expect(1)
+        .create();
+    // No answer may be submitted: an unsolvable prompt must produce no
+    // request to /v1/answer (a wrapped wrong answer would still hit it).
+    let answer = server
+        .mock("POST", "/v1/answer")
+        .expect(expect_answer_calls)
+        .create();
+
+    let exe = std::env::current_exe().expect("current test binary");
+    let mut cmd = Command::new(exe);
+    cmd.args([
+        "--exact",
+        "obtain_proof_does_not_block_on_silent_non_tty_stdin",
+        "--nocapture",
+    ])
+    .env(CHILD_ENV, "1")
+    .env(URL_ENV, server.url())
+    .stdin(Stdio::piped())
+    .stdout(Stdio::piped())
+    .stderr(Stdio::piped());
+    // The solver client honors proxy env; force direct connections so the
+    // loopback mock is always reachable regardless of the runner's env.
+    for var in [
+        "HTTP_PROXY",
+        "http_proxy",
+        "HTTPS_PROXY",
+        "https_proxy",
+        "ALL_PROXY",
+        "all_proxy",
+        "REQUEST_METHOD",
+    ] {
+        cmd.env_remove(var);
+    }
+    cmd.env("NO_PROXY", "*");
+    let mut child = cmd.spawn().expect("spawn child");
+
+    // Hold the write end open with no data: exactly the shape that hung.
+    let _held_stdin = child.stdin.take();
+
+    let deadline = Instant::now() + CHILD_TIMEOUT;
+    loop {
+        match child.try_wait().expect("poll child") {
+            Some(_) => break,
+            None if Instant::now() < deadline => std::thread::sleep(Duration::from_millis(50)),
+            None => {
+                let _ = child.kill();
+                panic!("obtain_proof blocked on an open, silent non-TTY stdin");
+            }
+        }
+    }
+    let out = child.wait_with_output().expect("collect child output");
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        out.status.success(),
+        "child failed: status {:?}\nstdout: {stdout}\nstderr: {stderr}",
+        out.status.code()
+    );
+    assert!(
+        stdout.contains("child-finished-cleanly"),
+        "child body did not run to completion: {stdout}"
+    );
+    assert!(
+        !stderr.contains("panicked"),
+        "child panicked instead of returning a clean error: {stderr}"
+    );
+    challenge.assert();
+    answer.assert();
+}
+
+#[test]
+fn obtain_proof_does_not_block_on_silent_non_tty_stdin() {
+    if std::env::var_os(CHILD_ENV).is_some() {
+        run_child();
+        return;
+    }
+
+    // An unsolvable challenge type falls through to the interactive prompt,
+    // which must decline the non-TTY stdin instead of blocking on read_line.
+    run_scenario("anagram", "listen", 0);
+
+    // An arithmetic prompt whose evaluation overflows i64 must also end at
+    // the unsolvable error: no panic, and no wrapped answer submitted.
+    run_scenario("arithmetic", "What is 9223372036854775807 + 1?", 0);
+}

docs/MAINTAINER-ROADMAP.md

@@ -41,7 +41,7 @@ Owner focus: protocol/auth.
 - Close default-open repo write authorization and wire trusted UCAN delegation into repository permissions.
 - Close the remaining visibility gaps: restrict or document task, pin, and anchor metadata routes, and publish an irreversible-publication policy.
 - Add UCAN revocation or blocklisting, with an emergency compromised-key runbook.
-- Add mutation-aware GraphQL auth before GraphQL becomes a public write API surface.
+- GraphQL mutations require a verified signer (shipped, #87). Keep the surface limited to the agent-task queue; do not expose an owner-gated repo-write mutation over GraphQL without its owner-gate and REST parity. The `every_graphql_mutation_has_its_gate` fence forces any new mutation to be classified in its table (discovered from the schema SDL, with an introspection cross-check for hidden fields, so none can slip in unlisted) and requires `require_signer` plus actor binding in each registered resolver; the owner-gate and REST parity themselves stay the INV-1 review check, not something the fence proves.
 - Harden peer registration and outbound peer calls against SSRF and peer-list poisoning.
 - After all live peers upgrade, enable signed peer writes by default.
 

docs/OSS-READINESS-AUDIT.md

@@ -95,7 +95,7 @@ Live-network blockers to prioritize:
 - GraphQL POST is still open for compatibility; GraphQL mutations should get mutation-aware auth before it becomes a public write API surface.
 - Push authorization is still not capability-complete. A valid DID signature is authentication, not authorization. Owner checks are now enforced on every branch, protected or not (`GITLAWB_ENFORCE_OWNER_PUSH`, on by default); what remains is that a UCAN `git/push` capability is not yet honored, so a delegated or CI key cannot push.
 - UCAN chain validation is incomplete and UCAN revocation/blocklisting is not implemented as an operator feature.
-- Private repository reads are not enforced. `is_public` and `GITLAWB_PUBLIC_READ` exist, but per-repository private-read behavior is not wired.
+- Private repository reads are enforced per repository through `is_public` and path-scoped visibility rules. `GITLAWB_PUBLIC_READ` remains reserved and inert.
 - Peer URLs are self-asserted by DIDs. Signatures prove control of the DID key when present, not ownership/safety of the announced URL.
 - Outbound peer fetch/ping/sync paths should be reviewed for SSRF protections before accepting arbitrary public peer registrations.
 
@@ -146,8 +146,16 @@ Risks:
 ## Obvious live-network priorities
 
 1. Implement repo write authorization: owner checks, UCAN capability checks, and clear delegation semantics for push/PR/issue/bounty operations.
-2. Implement private-read enforcement or remove private repo affordances until it exists.
+2. Private reads are already enforced per repository (`is_public` plus path-scoped rules); retire the reserved and inert `GITLAWB_PUBLIC_READ` flag or document it as permanently reserved.
 3. Add UCAN revocation/blocklisting and operator docs for emergency key compromise.
 4. Harden peer registration and outbound fetch behavior against SSRF and peer-list poisoning.
 5. Add Docker/installer/release smoke tests to CI.
 6. Label PoS/economics docs consistently with the current live contract and rewards status.
+
+## Status updates (post-snapshot)
+
+These entries record security-posture changes after the 2026-05-28 inspection above. They do not rewrite that snapshot's command output or test counts.
+
+### 2026-08-30: GraphQL mutation auth and completeness fence (#87, #219)
+
+At `main` from `bfc44f92` onward, GraphQL mutations require a verified signer bound to the acting DID. The surface stays limited to the agent-task queue; repo writes are not exposed over GraphQL. PR #219 adds `every_graphql_mutation_has_its_gate`, a CI completeness fence that discovers mutations from the built schema SDL (with an introspection cross-check for hidden fields) and requires signer acquisition plus actor binding in each registered resolver.

scripts/ans104_golden.mjs

@@ -0,0 +1,33 @@
+import { createData, EthereumSigner } from "arbundles";
+import { createHash } from "node:crypto";
+import base64url from "base64url";
+
+const data = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+-=[]{};':\",./<>?`~";
+const tags = [
+  { name: "tag1", value: "value1" },
+  { name: "tag2", value: "value2" },
+];
+const anchor = "thisSentenceIs32BytesLongTrustMe";
+const target = "OXcT1sVRSA5eGwt2k6Yuz8-3e3g9WJi5uSE99CWqsBs";
+const signer = new EthereumSigner("8da4ef21b864d2cc526dbdb2a120bd2874c36c9d0a1fb7f8c63d7f7a8b41de8f");
+
+const item = createData(data, signer, { anchor, target, tags });
+// Sign so the captured signature is real: `createData` alone leaves a
+// zeroed placeholder, whose id is just sha256(zeros).
+await item.sign(signer);
+const raw = item.getRaw();
+const id = item.id;
+
+// `item.signature` is base64url(rawSignature). Decode and sha256.
+const sigBytes = base64url.toBuffer(item.signature);
+const idCheck = base64url.encode(createHash("sha256").update(sigBytes).digest());
+if (idCheck !== id) {
+  console.error(`MISMATCH: id=${id} sha256(sig)=${idCheck}`);
+  process.exit(1);
+}
+
+console.log("id           =", id);
+console.log("signature_b64=", item.signature);
+console.log("signature_len=", sigBytes.length);
+console.log("binary_len   =", raw.length);
+console.log("binary_hex   =", raw.toString("hex"));

scripts/ans104_golden_ed25519.mjs

@@ -0,0 +1,40 @@
+import { createData, SolanaSigner } from "arbundles";
+import bs58 from "bs58";
+import { getPublicKey } from "@noble/ed25519";
+import { createHash } from "node:crypto";
+import base64url from "base64url";
+
+// Deterministic Ed25519 keypair from seed 0x01 * 32.
+const seed = Buffer.alloc(32, 0x01);
+const pub = await getPublicKey(seed);
+const secret64 = Buffer.concat([seed, Buffer.from(pub)]);
+const signer = new SolanaSigner(bs58.encode(secret64));
+
+const data = "hello gitlawb ed25519 golden";
+const tags = [
+  { name: "App-Name", value: "gitlawb" },
+  { name: "Schema", value: "gitlawb/ref-update/v1" },
+];
+
+const item = createData(data, signer, { tags });
+await item.sign(signer);
+const raw = Buffer.from(item.getRaw());
+const id = item.id;
+const sigBytes = base64url.toBuffer(item.signature);
+const idCheck = base64url.encode(createHash("sha256").update(sigBytes).digest());
+if (idCheck !== id) {
+  console.error(`MISMATCH: id=${id} sha256(sig)=${idCheck}`);
+  process.exit(1);
+}
+const sigData = await item.getSignatureData();
+console.log("id           =", id);
+console.log("signature_b64=", item.signature);
+console.log("signature_len=", sigBytes.length);
+console.log("owner_b64    =", item.owner);
+console.log("owner_len    =", base64url.toBuffer(item.owner).length);
+console.log("sigtype      =", item.signatureType);
+console.log("binary_len   =", raw.length);
+console.log("binary_hex   =", raw.toString("hex"));
+console.log("deephash_hex =", Buffer.from(sigData).toString("hex"));
+console.log("data_b64     =", base64url.encode(Buffer.from(data)));
+console.log("isValid      =", await item.isValid());

scripts/ans104_golden_output.txt

@@ -0,0 +1,39 @@
+ANS-104 golden vectors, captured from arbundles 0.10.x.
+
+To regenerate: run `npm ci` in scripts/, then `node ans104_golden_ed25519.mjs`.
+
+Ed25519 vector (the interop pin used by
+`ans104::tests::dataitem_matches_arbundles_golden_vector`):
+  captured by  = scripts/ans104_golden_ed25519.mjs (deterministic seed
+                 0x01 * 32 via SolanaSigner, sigtype 2, `await item.sign`)
+  data         = "hello gitlawb ed25519 golden"
+  tags         = [{name:"App-Name",value:"gitlawb"},
+                  {name:"Schema",value:"gitlawb/ref-update/v1"}]
+  target       = absent
+  anchor       = absent
+
+Outputs:
+  signature_type = 2 (Ed25519)
+  signature_len  = 64 bytes
+  owner_len      = 32 bytes
+  binary_len     = 192 bytes
+  id             = SGrcBs-ITTyzvd7eIB5kk2GdBWoxB_iTi9iJ6KOe_RE (base64url of sha256(signature))
+  deephash_hex   = f15c82431767f14ac9e66ab8e995a8cd08e094be3773245163b53c12feb50aefc55d9f8c1098fabcfbf11a462706d347
+                   (arbundles `getSignatureData` 8-element fold)
+
+binary_hex:
+0200da41825fd44ca3b2705af18fce86ed6d04d0204331965d9af5d5cb1a740fcc6587ee81501b1d7928c54c0f174fde8893560d785db4d988a3161113b10a2028038a88e3dd7409f195fd52db2d3cba5d72ca6709bf1d94121bf3748801b40f6f5c00000200000000000000300000000000000004104170702d4e616d650e6769746c6177620c536368656d612a6769746c6177622f7265662d7570646174652f76310068656c6c6f206769746c617762206564323535313920676f6c64656e
+
+The Rust side will:
+1. Parse binary via DataItem::from_binary (signature_type, signature,
+   owner, target, anchor, tags, data).
+2. Compute deep_hash via DataItem::deep_hash (the 8-element arbundles
+   fold) and compare to deephash_hex above.
+3. Verify the Ed25519 signature via DataItem::verify_data_item WITHOUT
+   re-signing.
+4. Assert sha256(signature_bytes) base64url-encodes to the captured id.
+5. Assert to_binary round-trips byte-exact (signature slot preserved).
+
+Legacy Ethereum script (scripts/ans104_golden.mjs) now signs before
+capture as well; its output is illustrative only — the node verifies
+Ed25519 (sigtype 2) on the verify path.

scripts/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "ans104-golden",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@noble/ed25519": "^1.7.5",
+    "arbundles": "^0.10.0",
+    "base64url": "^3.0.1",
+    "bs58": "^4.0.1"
+  },
+  "overrides": {
+    "ws": "^8.21.0"
+  }
+}

scripts/resolve-release-tag.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
+shopt -s extglob
 
 tag="${1-}"
 : "${GITHUB_OUTPUT:?GITHUB_OUTPUT must be set}"
@@ -11,13 +12,79 @@ case "$tag" in
     ;;
 esac
 
+# Right-anchored on purpose: v[0-9]* leaves the tail unbounded and accepts
+# v1.2.3.4.5, v1_x, v1-any-branch-name, and bare v1. Every existing tag is
+# plain vX.Y.Z (release-please, release-type: simple, no prerelease channel).
 case "$tag" in
-  v[0-9]*) ;;
+  v+([0-9]).+([0-9]).+([0-9])) ;;
   *)
     printf '%s\n' "::error::'$tag' does not look like a release tag (vX.Y.Z)"
     exit 1
     ;;
 esac
 
+# Provenance, enforced only in CI where a token is present. The environment
+# gate restricts which REF a dispatch may run from; this restricts which TAG
+# the input may name: it must be a tag the release flow already published,
+# pointing at a commit main already contains. Otherwise a write-access user
+# could plant a v99.99.99 tag on unreviewed content and backfill-publish it.
+if [ -n "${GH_TOKEN:-}" ] && [ -n "${GITHUB_REPOSITORY:-}" ]; then
+  release_meta="$(gh release view "$tag" --repo "$GITHUB_REPOSITORY" \
+    --json author,targetCommitish -q '.author.login + " " + .targetCommitish' \
+    2>/dev/null)" || {
+    printf '%s\n' "::error::no GitHub release exists for tag $tag"
+    exit 1
+  }
+  release_author="${release_meta%% *}"
+  release_target="${release_meta##* }"
+  # A hand-created release on a valid tag does not qualify. Not a hard bound
+  # (a workflow run can mint a bot-authored release), but it removes the
+  # cheapest path to publishing attacker-uploaded release assets.
+  if [ "$release_author" != "github-actions[bot]" ]; then
+    printf '%s\n' "::error::release $tag was authored by $release_author, not the release automation"
+    exit 1
+  fi
+  # Same boundary for the assets the npm backfill republishes: a release
+  # asset replaced by a collaborator login is attacker-mutable content. The
+  # captured name/id pairs go to GITHUB_OUTPUT so the download step fetches
+  # by immutable asset id; a delete+reupload between here and the download
+  # produces a new id and fails closed. Names are emitted base64-encoded:
+  # an asset name is attacker-controlled text, and whitespace in it would
+  # otherwise let a crafted name shift the positional fields.
+  assets="$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$tag" \
+    -q '.assets[] | (.name | @base64) + " " + (.id | tostring) + " " + (.uploader.login // "unknown")')"
+  uploaders="$(printf '%s\n' "$assets" | awk 'NF {print $3}' | sort -u)"
+  if [ -n "$uploaders" ] && [ "$uploaders" != "github-actions[bot]" ]; then
+    printf '%s\n' "::error::release $tag has assets not uploaded by the release automation: $uploaders"
+    exit 1
+  fi
+  {
+    printf '%s\n' 'assets<<GHAE'
+    printf '%s\n' "$assets" | awk 'NF {print $1, $2}'
+    printf '%s\n' 'GHAE'
+  } >> "$GITHUB_OUTPUT"
+  # Resolve through the fully-qualified tag ref to a commit SHA: an
+  # unqualified name can resolve to a same-named branch and vouch for the
+  # wrong commit, the same shadowing the refs/tags/ checkout prefix avoids.
+  # The SHA is emitted so checkouts pin the verified commit instead of
+  # re-resolving a tag that could be moved between resolve and checkout.
+  tag_commit="$(gh api "repos/$GITHUB_REPOSITORY/commits/refs/tags/$tag" -q .sha)"
+  # The tag must still point at the commit the release was created against.
+  # Reachable-from-main alone accepts a tag moved to any other main commit.
+  if [ "$tag_commit" != "$release_target" ]; then
+    printf '%s\n' "::error::tag $tag points at $tag_commit but release $tag was created against $release_target (tag moved)"
+    exit 1
+  fi
+  status="$(gh api "repos/$GITHUB_REPOSITORY/compare/main...$tag_commit" -q .status)"
+  case "$status" in
+    identical|behind) ;;
+    *)
+      printf '%s\n' "::error::tag $tag is not reachable from main (compare: $status)"
+      exit 1
+      ;;
+  esac
+  printf '%s\n' "tag_commit=$tag_commit" >> "$GITHUB_OUTPUT"
+fi
+
 printf '%s\n' "tag=$tag" >> "$GITHUB_OUTPUT"
 printf '%s\n' "version=${tag#v}" >> "$GITHUB_OUTPUT"

scripts/test-pr-triage-detect.mjs

@@ -0,0 +1,297 @@
+#!/usr/bin/env node
+// Case matrix for the inline-test detector embedded in
+// .github/workflows/pr-triage.yml. The workflow runs on pull_request_target
+// and deliberately never checks out PR code, so the detector cannot be tested
+// where it runs; this script extracts the fenced TRIAGE_DETECTOR block from
+// the committed workflow body and exercises it here, where pr-checks.yml DOES
+// check out the proposed workflow. If the fence markers move or the block
+// stops being self-contained, this script fails loudly rather than testing a
+// stale copy.
+//
+// The matrix encodes the review contract for the detector
+// (Gitlawb/node#277): legal Rust separators between the attribute path and
+// its ]/( delimiter must be accepted (line comments, nested block comments,
+// splits onto immediately following added lines), while unrelated patch
+// records - delimiter-looking lines before the path, later in the hunk, or in
+// another hunk - must never complete a path they do not adjoin. False
+// positives here SUPPRESS the needs-tests label silently (they set
+// touchedTests, which clears the label), while false negatives apply it
+// (the loud, corrigible direction). So every uncertain path in the detector
+// is required to answer "no inline test".
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+const workflow = readFileSync(
+  join(repoRoot, ".github/workflows/pr-triage.yml"),
+  "utf8"
+);
+
+const BEGIN = "// TRIAGE_DETECTOR_BEGIN";
+const END = "// TRIAGE_DETECTOR_END";
+const begin = workflow.indexOf(BEGIN);
+const end = workflow.indexOf(END);
+if (begin === -1 || end === -1 || end <= begin) {
+  console.error("FAIL: TRIAGE_DETECTOR fence not found in pr-triage.yml");
+  process.exit(1);
+}
+const block = workflow.slice(begin + BEGIN.length, end);
+
+let patchAddsInlineTest;
+try {
+  const factory = new Function(`${block}\nreturn patchAddsInlineTest;`);
+  patchAddsInlineTest = factory();
+} catch (err) {
+  console.error(
+    "FAIL: fenced detector block is not self-contained JavaScript:",
+    err.message
+  );
+  process.exit(1);
+}
+
+// Each patch is the `patch` field GitHub's listFiles API returns: hunk
+// headers plus +/-/space-prefixed lines, no ---/+++ file headers.
+const cases = [
+  // ── Accepted spellings ────────────────────────────────────────────────
+  ["bare same-line", "@@ -1,0 +1,2 @@\n+#[test]\n+fn a() {}", true],
+  ["cfg(test)", "@@ -1,0 +1,1 @@\n+#[cfg(test)]", true],
+  ["indented with inner space", "@@ -1,0 +1,1 @@\n+    #[ test ]", true],
+  [
+    "namespaced with args",
+    '@@ -1,0 +1,1 @@\n+#[tokio::test(flavor = "multi_thread")]',
+    true,
+  ],
+  ["test_case harness", "@@ -1,0 +1,1 @@\n+#[test_case(1)]", true],
+  ["wasm_bindgen_test harness", "@@ -1,0 +1,1 @@\n+#[wasm_bindgen_test]", true],
+  ["raw identifier", "@@ -1,0 +1,1 @@\n+#[r#test]", true],
+  [
+    "line comment then closer on next added line",
+    "@@ -1,0 +1,2 @@\n+#[test // rationale\n+]",
+    true,
+  ],
+  [
+    "nested block comment, same line",
+    "@@ -1,0 +1,1 @@\n+#[test /* outer /* inner */ outer */]",
+    true,
+  ],
+  [
+    "block comment spanning added lines",
+    "@@ -1,0 +1,3 @@\n+#[test /* why\n+   still why */ ]\n+fn a() {}",
+    true,
+  ],
+  [
+    "path-only line, ( on the immediately following added line",
+    "@@ -1,0 +1,2 @@\n+#[test_case\n+(1)]",
+    true,
+  ],
+  [
+    "whitespace-only continuation before closer",
+    "@@ -1,0 +1,3 @@\n+#[test\n+\t\n+]",
+    true,
+  ],
+  // ── Rejected spellings and adversarial shapes ─────────────────────────
+  ["rstest stays excluded", "@@ -1,0 +1,1 @@\n+#[rstest]", false],
+  ["substring #[testable]", "@@ -1,0 +1,1 @@\n+#[testable]", false],
+  ["substring #[contest]", "@@ -1,0 +1,1 @@\n+#[contest]", false],
+  [
+    "delimiter-looking line BEFORE the path",
+    "@@ -1,0 +1,2 @@\n+(\n+#[test_case",
+    false,
+  ],
+  [
+    "raw-string fixture path + unrelated ( later in the same hunk",
+    '@@ -1,0 +1,5 @@\n+let s = r#"\n+#[test_case\n+not a separator token\n+"#;\n+let t = (1);',
+    false,
+  ],
+  [
+    "path at end of one hunk, closer in another hunk",
+    "@@ -1,0 +1,1 @@\n+#[test_case\n@@ -10,0 +11,1 @@\n+(1)]",
+    false,
+  ],
+  [
+    "closer only on a context line",
+    "@@ -1,1 +1,1 @@\n+#[test_case\n (1)]",
+    false,
+  ],
+  [
+    "closer only on a removed line",
+    "@@ -1,1 +1,1 @@\n+#[test_case\n-(1)]",
+    false,
+  ],
+  [
+    "unfinished block comment never closes",
+    "@@ -1,0 +1,2 @@\n+#[test /*\n+ still open",
+    false,
+  ],
+  [
+    "continuation bound exceeded stays loud",
+    "@@ -1,0 +1,40 @@\n+#[test /*\n" + "+ filler\n".repeat(30) + "+ */ ]",
+    false,
+  ],
+  [
+    "raw-string fixture with adjoining closer",
+    '@@ -1,0 +1,4 @@\n+const FIXTURE: &str = r#"\n+#[test_case\n+(1)]\n+"#;',
+    false,
+  ],
+  [
+    "block comment with adjoining closer",
+    '@@ -1,0 +1,4 @@\n+/* this is a comment\n+#[test_case\n+(1)]\n+end of comment */',
+    false,
+  ],
+  [
+    "raw string with no hash delimiters",
+    '@@ -1,0 +1,4 @@\n+let s = r"\n+#[test_case\n+(1)]\n+";',
+    false,
+  ],
+  [
+    "raw string closes then real test attribute on next line",
+    '@@ -1,0 +1,2 @@\n+let s = r#""#;\n+#[test_case(1)]',
+    true,
+  ],
+  [
+    "block comment closes then real test attribute on next line",
+    '@@ -1,0 +1,2 @@\n+/* c */\n+#[test]',
+    true,
+  ],
+  [
+    "multiline regular string with test attribute inside",
+    '@@ -1,0 +1,3 @@\n+const S: &str = "\n+#[test]\n+";',
+    false,
+  ],
+  [
+    "regular string closes then real test on next line",
+    '@@ -1,0 +1,2 @@\n+let s = "text";\n+#[test]',
+    true,
+  ],
+  [
+    "char literal with double quote then real test",
+    "@@ -1,0 +1,4 @@\n+const QUOTE: char = '\"';\n+#[test]\n+fn real_test() {\n+    assert_eq!(QUOTE as u32, 34);\n+}",
+    true,
+  ],
+  [
+    "byte char literal with double quote then real test",
+    "@@ -1,0 +1,4 @@\n+const QUOTE: u8 = b'\"';\n+#[test]\n+fn real_test() {\n+    assert_eq!(QUOTE, 34);\n+}",
+    true,
+  ],
+  [
+    "char literal with escaped quote then real test",
+    "@@ -1,0 +1,4 @@\n+const Q: char = '\\'';\n+#[test]\n+fn real_test() {\n+    assert_eq!(Q as u32, 39);\n+}",
+    true,
+  ],
+  [
+    "char literal with escaped backslash then real test",
+    "@@ -1,0 +1,4 @@\n+const Q: char = '\\\\';\n+#[test]\n+fn real_test() {\n+    assert_eq!(Q as u32, 92);\n+}",
+    true,
+  ],
+  [
+    "char literal with unicode escape then real test",
+    "@@ -1,0 +1,4 @@\n+const Q: char = '\\u{2764}';\n+#[test]\n+fn real_test() {\n+    assert_eq!(Q as u32, 10084);\n+}",
+    true,
+  ],
+  [
+    "lifetime in type then real test",
+    "@@ -1,0 +1,3 @@\n+fn foo<'a>(x: &'a str) {}\n+#[test]\n+fn real_test() {}",
+    true,
+  ],
+  [
+    "label then real test",
+    "@@ -1,0 +1,3 @@\n+'label: loop {}\n+#[test]\n+fn real_test() {}",
+    true,
+  ],
+  [
+    "static lifetime then real test",
+    "@@ -1,0 +1,3 @@\n+const S: &'static str = \"hi\";\n+#[test]\n+fn real_test() {}",
+    true,
+  ],
+  [
+    "context line with stray closing quote then real test",
+    '@@ -1,1 +1,2 @@\n  );"\n+#[test]',
+    true,
+  ],
+  [
+    "context line with stray opening quote then real test",
+    '@@ -1,1 +1,2 @@\n  let s = "\n+#[test]',
+    true,
+  ],
+  [
+    "r# inside string on context line then real test",
+    '@@ -1,1 +1,2 @@\n  let s = "r#";\n+#[test]',
+    true,
+  ],
+  [
+    "/* inside string on context line then real test",
+    '@@ -1,1 +1,2 @@\n  let s = "/*";\n+#[test]',
+    true,
+  ],
+  // Known limitation: a non-code region opened by a context line is invisible
+  // to the pre-pass (context lines are not scanned). An added #[test] inside
+  // an existing raw string or block comment is scanned as code and may match.
+  // This is a false positive (silent direction), accepted because the old
+  // detector had the same behavior, the pattern is rare, and needs-tests is
+  // advisory. Scanning context lines to close this gap would re-introduce a
+  // false negative on the far more common case of a context line with a stray
+  // " from a string that opened before the visible window.
+  [
+    "known limitation: #[test] inside context-opened raw string (FP)",
+    '@@ -1,1 +1,2 @@\n  const FIX: &str = r#"\n+#[test]\n  "#;',
+    true,
+  ],
+  [
+    "known limitation: #[test_case] inside context-opened raw string (FP)",
+    '@@ -1,1 +1,3 @@\n  const FIX: &str = r#"\n+#[test_case\n+(1)]\n  "#;',
+    true,
+  ],
+  [
+    "known limitation: #[test] inside context-opened block comment (FP)",
+    '@@ -1,1 +1,2 @@\n  /*\n+#[test]\n  */',
+    true,
+  ],
+];
+
+let failures = 0;
+for (const [name, patch, expected] of cases) {
+  const got = patchAddsInlineTest(patch);
+  if (got !== expected) {
+    failures += 1;
+    console.error(`FAIL: ${name}: expected ${expected}, got ${got}`);
+  }
+}
+
+// Runtime probe: the detector walks fork-controlled input on
+// pull_request_target, so a pathological head must not stall the job. The
+// long `_a` run is the historical exponential-backtracking shape for the
+// attribute-path regex; the comment run exercises the scanner loop.
+const probes = [
+  ["long _a run", "@@ -1,0 +1,1 @@\n+#[test" + "_a".repeat(30000), false],
+  [
+    "long unclosed comment line",
+    "@@ -1,0 +1,1 @@\n+#[test /*" + " *".repeat(30000),
+    false,
+  ],
+  [
+    "long malformed \\u{ escape run (quadratic guard)",
+    "@@ -1,0 +1,1 @@\n+" + "'\\u{".repeat(30000),
+    false,
+  ],
+];
+for (const [name, patch, expected] of probes) {
+  const t0 = process.hrtime.bigint();
+  const got = patchAddsInlineTest(patch);
+  const ms = Number(process.hrtime.bigint() - t0) / 1e6;
+  if (got !== expected) {
+    failures += 1;
+    console.error(`FAIL: probe ${name}: expected ${expected}, got ${got}`);
+  }
+  if (ms > 1000) {
+    failures += 1;
+    console.error(`FAIL: probe ${name}: took ${ms.toFixed(0)}ms (>1000ms)`);
+  }
+}
+
+if (failures) {
+  console.error(`${failures} failure(s) across ${cases.length + probes.length} cases`);
+  process.exit(1);
+}
+console.log(`ok: ${cases.length + probes.length} detector cases passed`);