test(node): cover the sweep's boot wiring and prove an interrupted push never reaches the upload

Two claims from earlier commits were argued rather than executed. Both are now
observed.

The legacy-CID sweep's spawn sat inline in main() where no test could reach it,
so the batch size, the inter-batch delay, the detachment and the shutdown select
were all reasoned. The block moves verbatim into `spawn_legacy_cid_sweep`, which
a test calls directly. It seeds rows whose keys are already canonical, so the
cost gate skips each and the persisted cursor reads out walk progress cleanly,
then asserts the cursor stops at the configured batch boundary, the call returns
without blocking, the task is still alive inside its delay, and shutdown ends it.
Never spawning, reading the batch or delay from the wrong knob, or removing the
shutdown branch each turns it red. What remains reasoned is the single call line
inside main(), down from a twenty-six line block.

The claim that a disconnect-interrupted push never uploads to Tigris was
structural: the tests build the store with no Tigris client, so a counter inside
the client arm could never move and would have proved nothing. The counter now
sits at the upload decision, before the client is consulted, and the disconnect
test asserts zero while the success test asserts exactly one. That positive
control is what makes the zero meaningful, and it is itself load-bearing:
releasing the success path with failure semantics drops it to zero, and adding a
Drop impl that uploads raises the disconnect count to one.

The counter observes reaching the upload site, not an S3 request. TigrisClient
wraps a concrete SDK client with no injectable endpoint, and plumbing one through
would be out of proportion to the risk here.

.env.example

@@ -24,11 +24,8 @@ DATABASE_URL=postgresql://gitlawb:changeme@localhost:5432/gitlawb
 # ── Database pool & startup resilience ────────────────────────────────────
 # Maximum connections in the PostgreSQL pool. A cap, not a floor —
 # connections open lazily. Size against the DB server's max_connections,
-# remembering admin tooling opens its own pool. Each concurrent write pins one
-# connection for its whole duration (the connection-affine advisory lock), so the
-# node REJECTS at boot any value below GITLAWB_MAX_CONCURRENT_GIT_PUSHES + 8
-# headroom — keep this comfortably above that (default 48 for pushes 32).
-GITLAWB_DB_MAX_CONNECTIONS=48
+# remembering admin tooling opens its own pool.
+GITLAWB_DB_MAX_CONNECTIONS=20
 # Seconds a request waits for a pool connection before failing with 503.
 GITLAWB_DB_ACQUIRE_TIMEOUT_SECS=5
 # Upper bound on each startup connect+migrate attempt, in seconds. Keep it
@@ -115,13 +112,7 @@ GITLAWB_MAX_PACK_BYTES=2147483648
 # worker and, on push, the repo write lock. Also bounds both info/refs
 # advertisements, the withheld-blob pack build, and the push-side candidate
 # discovery (rev-list / cat-file), all reaped via process-group teardown (#174).
-# On the path-scoped upload-pack path the withheld-blob classification walk and
-# the pack serve share ONE deadline, so this value bounds their COMBINED duration
-# rather than giving each stage a full budget: a walk that consumes it leaves the
-# serve nothing and the clone gets a 504. Serving large path-scoped repos may
-# need a higher value here than when each stage was budgeted separately.
-# Must be 1..=3153600000 (100 years): the node derives deadlines from this value,
-# and a larger one cannot be represented. Default 600.
+# Default 600.
 GITLAWB_GIT_SERVICE_TIMEOUT_SECS=600
 
 # Max seconds the storage-ACQUISITION phase of a served git op may run before the
@@ -150,25 +141,6 @@ GITLAWB_MAX_CONCURRENT_GIT_OPS=128
 # Retry-After. Default 32.
 GITLAWB_MAX_CONCURRENT_GIT_PUSHES=32
 
-# Max pushes PARKED at once waiting for the per-repo write lease of the SAME repo.
-# A parked push holds its already-buffered pack body in memory, so this bounds that
-# memory for a hot repo. Past the cap the newest push sheds a clean 503 +
-# Retry-After ("repo is busy with another push") instead of joining the queue; a
-# push to a DIFFERENT repo is never affected. The lease holder is not counted.
-# Raising GITLAWB_MAX_CONCURRENT_GIT_PUSHES does not raise this; set it explicitly.
-# Default 8.
-GITLAWB_REPO_LEASE_MAX_WAITERS=8
-
-# Max concurrent post-push pin loops (IPFS + Pinata pin_new_objects) across all
-# repos. The per-repo encrypt-task set caps the pin-task COUNT; this caps how many
-# of those loops RUN CONCURRENTLY, and so how much MB-scale object-id list memory is
-# held WHILE BEING PINNED. It does not bound retained memory in general: on the local
-# IPFS path the caller builds its list before this pool is entered, so a loop parked
-# waiting for a permit still holds its full list, and how many park is capped only
-# per repo. Do not size memory from this knob alone. A loop DEFERS (waits) when the
-# pool is full, never drops a pin. Default 8.
-GITLAWB_MAX_CONCURRENT_PIN_TASKS=8
-
 # Max concurrent read ops (upload-pack + the upload-pack info/refs advertisement)
 # a single caller may hold, so one caller cannot monopolize the read pool. Keyed
 # on the resolved SOURCE IP, never the DID: a signature does not move a caller off
@@ -179,23 +151,6 @@ GITLAWB_MAX_CONCURRENT_PIN_TASKS=8
 # Default 16.
 GITLAWB_MAX_CONCURRENT_READS_PER_CALLER=16
 
-# Two further per-source concurrency caps exist on the PUSH side but have NO
-# environment variable of their own: both are DERIVED as
-# GITLAWB_MAX_CONCURRENT_GIT_PUSHES / 8, with a floor of 1. They are not settable
-# independently, so raising the push pool raises both proportionally, and the
-# default push pool of 32 gives each a cap of 4.
-#   * The anon receive-pack info/refs advertisement cap: one source IP may hold at
-#     most this many slots in the dedicated advert pool, so saturating that pool
-#     takes ~8 distinct source IPs.
-#   * The authenticated receive-pack POST cap: one source IP may hold at most this
-#     many WRITE-pool slots. This one is load-bearing for push availability, since
-#     it is acquired before the global write permit: without it, one host minting
-#     disposable did:key identities could open enough slow pushes to monopolize the
-#     write pool and 503 every other source (owner enforcement defaults off, and
-#     the push rate limiter caps arrival rate, not in-flight concurrency).
-# Keyed on the resolved source IP, never the DID, so a DID farm does not defeat
-# them; keying granularity follows GITLAWB_TRUSTED_PROXY like the read cap above.
-
 # ── Push rate limiting (git-receive-pack flood brake) ─────────────────────
 # Max receive-pack requests (info/refs advertisement + push POST) per client
 # IP per hour. 0 disables. Default 600.
@@ -213,30 +168,10 @@ GITLAWB_MAX_CONCURRENT_IPFS_WALKS=32
 # per-caller caps via GITLAWB_TRUSTED_PROXY; reject-before-insert bounded map).
 # Default 4.
 GITLAWB_IPFS_WALK_PER_SOURCE=4
-# Max EXPENSIVE path-scope visibility walks per single /ipfs request (only a
-# blob in a path-scoped repo costs a full-history walk). Over-cap repos are
-# skipped without a verdict and the scan continues; if the object is then found
-# nowhere the request sheds a retryable 503 instead of a false 404. Default 64.
-GITLAWB_IPFS_MAX_REPOS_WALKED=64
-# Ceiling on repos one /ipfs request may VISIT past the visibility gate. Each
-# visit costs a repo acquire — on a Tigris cache miss a full archive download,
-# so this is also the worst-case object-store fetch count per request — plus a
-# cat-file probe. On exhaustion the scan stops and sheds a retryable 503.
-# Default 1024.
-GITLAWB_IPFS_MAX_REPO_VISITS=1024
-# Absolute wall-clock budget for one admitted /ipfs request's acquire+walk
-# lifetime (all stages of the whole scan). Per-stage clamps bound the acquire
-# and walk stages to the remaining budget, and no stage starts once it is
-# exhausted (the scan then sheds a retryable 503). The object-type probe and
-# content-read cat-file subprocesses are budget-checked before starting AND each
-# run under their own deadline (the lesser of GITLAWB_GIT_SERVICE_TIMEOUT_SECS and
-# the remaining budget), reaped via process-group teardown, so a hung cat-file
-# cannot hold the request's walk slot past it. One hang path is still unbounded:
-# the probe's object-store readability check is a plain filesystem sweep with
-# nothing to reap, so a wedged filesystem can hold the slot past the deadline.
-# Must be 1..=3153600000 (100 years): the node derives an Instant deadline from
-# this value, and a larger one cannot be represented. Default 600.
-GITLAWB_IPFS_REQUEST_BUDGET_SECS=600
+# Max legacy (NULL-provenance) repos probed per single /ipfs request, bounding the
+# scan-fallback fan-out (git cat-file per candidate repo) for an anonymous caller. A
+# truncated scan sheds a retryable 503, never a false 404. Default 256.
+GITLAWB_IPFS_MAX_REPOS_WALKED=256
 # Max /ipfs/{cid} requests per client IP per hour (route flood brake, distinct
 # from the concurrency caps above). 0 disables. Default 600.
 GITLAWB_IPFS_RATE_LIMIT=600

.github/workflows/main-red-alert.yml

@@ -1,121 +0,0 @@
-# Tracks main's CI state as a labeled issue: opens (or updates) a ci-main-red
-# issue when a push-to-main run of PR Checks ends red, and closes it when a
-# subsequent run on main's tip goes green.
-#
-# Why: two individually-green PRs can break main in combination when the
-# second merges on checks that ran against a stale base (semantic merge
-# race — #113 + #145 broke test compilation, found only via #229). A red main
-# is otherwise silent, and release-please PRs inherit the breakage.
-#
-# The alert reflects main's CURRENT STATE, not raw CI events: runs whose
-# commit is no longer main's tip are ignored (a re-run of an old red run
-# after a fix has landed must not cry wolf), and a green run on the tip
-# closes any open alert.
-name: Main red alert
-
-on:
-  workflow_run:
-    workflows: ["PR Checks"]
-    types: [completed]
-    branches: [main]
-
-permissions:
-  issues: write
-  contents: read # getBranch tip check
-
-# Serialize runs: concurrent completions would race the label/issue lookups
-# into duplicates (or 422 on createLabel). queue: max keeps every pending
-# completion instead of letting a later (possibly green-skipped) arrival
-# displace a pending red alert under burst merges; it is only incompatible
-# with cancel-in-progress: true, which we don't use.
-concurrency:
-  group: main-red-alert
-  cancel-in-progress: false
-  queue: max
-
-jobs:
-  track:
-    name: Track main CI state
-    # timed_out (the test job runs 45 min against Postgres) and
-    # startup_failure (malformed workflow) are red too — only cancelled is
-    # excluded as a deliberate human abort. success runs are needed to close
-    # the alert once main recovers.
-    if: >-
-      github.event.workflow_run.event == 'push' &&
-      contains(fromJSON('["failure", "timed_out", "startup_failure", "success"]'), github.event.workflow_run.conclusion)
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Reconcile the broken-main issue with main's current state
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          script: |
-            const run = context.payload.workflow_run;
-            const label = 'ci-main-red';
-
-            // Freshness gate: only the run for main's current tip may open or
-            // close anything. Re-runs of superseded commits are events about
-            // the past, not statements about main's state.
-            const { data: branch } = await github.rest.repos.getBranch({
-              ...context.repo, branch: 'main',
-            });
-            if (branch.commit.sha !== run.head_sha) {
-              core.info(`run ${run.id} is for ${run.head_sha}, main is at ${branch.commit.sha} — ignoring stale run`);
-              return;
-            }
-
-            // listForRepo returns PRs carrying the label too — those must
-            // never be mistaken for the tracking issue.
-            const open = (await github.rest.issues.listForRepo({
-              ...context.repo, state: 'open', labels: label, per_page: 100,
-            })).data.filter(item => !item.pull_request);
-
-            if (run.conclusion === 'success') {
-              const body = `Recovered: [PR Checks](${run.html_url}) is green on main at \`${run.head_sha}\`.`;
-              for (const issue of open) {
-                await github.rest.issues.createComment({
-                  ...context.repo, issue_number: issue.number, body,
-                });
-                await github.rest.issues.update({
-                  ...context.repo, issue_number: issue.number, state: 'closed', state_reason: 'completed',
-                });
-              }
-              return;
-            }
-
-            const headline = run.head_commit?.message?.split('\n')[0] ?? '';
-            const body = [
-              `[PR Checks run](${run.html_url}) concluded \`${run.conclusion}\` on main at \`${run.head_sha}\`.`,
-              '',
-              `> ${headline}`,
-              '',
-              'Likely a semantic merge race: each merged PR was green on a stale base.',
-              'Fix main before merging anything else — release-please PRs inherit this breakage.',
-              '',
-              "This issue closes automatically when a run on main's tip goes green.",
-            ].join('\n');
-
-            try {
-              await github.rest.issues.getLabel({ ...context.repo, name: label });
-            } catch (e) {
-              if (e.status !== 404) throw e;
-              await github.rest.issues.createLabel({
-                ...context.repo,
-                name: label,
-                color: 'b60205',
-                description: 'CI is failing on main',
-              });
-            }
-
-            if (open.length > 0) {
-              await github.rest.issues.createComment({
-                ...context.repo, issue_number: open[0].number, body,
-              });
-            } else {
-              await github.rest.issues.create({
-                ...context.repo,
-                title: 'CI is red on main',
-                body,
-                labels: [label],
-              });
-            }

.github/workflows/pr-checks.yml

@@ -2,17 +2,6 @@ name: PR Checks
 
 on:
   pull_request:
-  # Run in the merge queue so a PR is re-validated against the true merged
-  # result before it lands. Guards against semantic merge races where two
-  # individually-green PRs break main in combination (#113 + #145 → #229).
-  merge_group:
-  # Release-branch heads are created and pushed by GITHUB_TOKEN (release-please
-  # and the lock-sync job), and GitHub's recursion guard means those pushes
-  # trigger no workflow runs. workflow_dispatch is the documented carve-out that
-  # GITHUB_TOKEN CAN trigger, so the release flow dispatches this workflow at
-  # the release branch to attach check runs to its head. Read-only workflow
-  # (contents: read), so the dispatch surface adds no privilege.
-  workflow_dispatch:
   push:
     branches:
       - main
@@ -53,20 +42,7 @@ jobs:
         run: cargo fmt --all -- --check
 
       - name: cargo clippy
-        run: cargo clippy --locked --workspace --all-targets -- -D warnings
-
-  release-tag-validation:
-    name: release tag validation
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Test release tag resolver
-        run: scripts/test-resolve-release-tag.sh
+        run: cargo clippy --workspace --all-targets -- -D warnings
 
   test:
     name: test (${{ matrix.toolchain }})
@@ -114,7 +90,7 @@ jobs:
       - name: cargo test
         env:
           DATABASE_URL: postgres://postgres:postgres@localhost:5432/gitlawb_test
-        run: cargo test --locked --workspace
+        run: cargo test --workspace
 
   build-release:
     name: build --release
@@ -137,7 +113,7 @@ jobs:
           key: release
 
       - name: cargo build --release
-        run: cargo build --locked --release --workspace
+        run: cargo build --release --workspace
 
   audit:
     name: cargo audit
@@ -219,7 +195,7 @@ jobs:
           key: msrv
 
       - name: cargo check on MSRV
-        run: cargo check --locked --workspace --all-targets
+        run: cargo check --workspace --all-targets
 
   docker-build:
     name: Docker build smoke test
@@ -236,95 +212,3 @@ jobs:
 
       - name: Smoke test --version
         run: docker run --rm gitlawb-node:ci-test --version
-
-  test-windows:
-    name: test (windows, non-blocking)
-    runs-on: windows-latest
-    timeout-minutes: 45
-    # Non-blocking, mirroring the informational `beta` lane above. We ship `gl`
-    # and `git-remote-gitlawb` to Windows users (release.yml) with zero Windows
-    # test coverage, so run their suites here to make Windows-only regressions
-    # VISIBLE on the PR without gating merge (#228). These two are the client
-    # CLIs and depend on no database, so no Postgres service is needed (service
-    # containers do not run on windows-latest regardless). `git` is preinstalled
-    # on windows-latest, which the real_git_fetch harness relies on.
-    continue-on-error: true
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-        with:
-          toolchain: stable
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-        with:
-          key: windows
-
-      - name: cargo test (shipped Windows crates)
-        run: cargo test --locked -p gl -p git-remote-gitlawb
-
-  # gitlawb-core is embedded by every consumer (gl, git-remote-gitlawb, the node
-  # daemon), so it must stay lean. This gate fails if gitlawb-core's normal
-  # (non-dev, non-build) dependency tree gains any crate not on the allowlist in
-  # ci/gitlawb-core-allowed-deps.txt. Exhaustive-by-construction: a new heavy
-  # dependency reds CI whether or not anyone thought to ban it, which a denylist
-  # cannot do. Regen instructions live in the allowlist header.
-  core-deps-purity:
-    name: gitlawb-core dependency purity
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-        with:
-          toolchain: stable
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-        with:
-          key: core-deps-purity
-
-      - name: Check gitlawb-core dependency allowlist
-        run: bash scripts/check-gitlawb-core-deps.sh
-
-  # release-please only rewrites a crate's version when the line carries the
-  # `# x-release-please-version` annotation AND the manifest is listed under
-  # extra-files in release-please-config.json. Miss either half and the crate
-  # is skipped silently at release time, freezing at its creation version:
-  # icaptcha-client was added as a workspace member after the config was last
-  # written and sat at 0.4.0 through four releases before anyone noticed.
-  # Exhaustive-by-construction, like the allowlist gate above: the required set
-  # is derived from `cargo metadata`, so a newly added crate reds CI whether or
-  # not its author knew this gate existed.
-  release-versioning:
-    name: release versioning coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Rust toolchain
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-        with:
-          toolchain: stable
-
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
-        with:
-          key: release-versioning
-
-      - name: Check every workspace crate is release-managed
-        run: bash scripts/check-release-versioning.sh

.github/workflows/pr-triage.yml

@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Label and guide
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const pr = context.payload.pull_request;
@@ -70,15 +70,9 @@ jobs:
             const changedRust = names.some(n => n.startsWith("crates/") && n.endsWith(".rs"));
             // A test can live in a tests/ dir, a *_test.rs file, or (the common Rust
             // pattern) an inline #[test] / #[cfg(test)] block added inside the source file.
-            // Async tests use a namespaced attribute (#[tokio::test], #[async_std::test],
-            // possibly with args like #[tokio::test(flavor = ...)]) rather than the bare
-            // #[test]. Match only on added lines, with the attribute at the start of the
-            // line after horizontal whitespace, covering bare, cfg(test), namespaced,
-            // optional leading ::, and raw-identifier (r#test) forms. No head-file fetch
-            // or lexer: needs-tests is advisory, not a merge gate.
             const addsInlineTest = files.some(f =>
               f.filename.endsWith(".rs") && f.patch &&
-              /^\+[ \t]*#\[[ \t]*(?:cfg[ \t]*\([ \t]*test[ \t]*\)|(?:::[ \t]*)?(?:[\w-]+[ \t]*::[ \t]*)*(?:r#)?test\b)/m.test(f.patch));
+              /^\+.*#\[(test\]|cfg\(test\))/m.test(f.patch));
             const touchedTests =
               names.some(n => n.includes("/tests/") || n.endsWith("_test.rs")) || addsInlineTest;
             if (changedRust && !touchedTests) want.add("needs-tests");

.github/workflows/release.yml

@@ -4,20 +4,6 @@ on:
   push:
     branches:
       - main
-  # Manual backfill: republish an already-cut release to a channel that
-  # missed it. Fill in only the channel(s) you want — an empty input leaves
-  # that channel's jobs skipped. npm reuses the existing release's binary
-  # assets; docker rebuilds the image from the tag and re-tags the manifest.
-  workflow_dispatch:
-    inputs:
-      npm_backfill_tag:
-        description: "Existing release tag to publish to npm (e.g. v0.6.0)"
-        required: false
-        type: string
-      docker_backfill_tag:
-        description: "Existing release tag to publish to ghcr (e.g. v0.6.0)"
-        required: false
-        type: string
 
 concurrency:
   group: release-${{ github.ref }}
@@ -28,10 +14,7 @@ permissions: {}
 
 jobs:
   release-please:
-    # Skipped on manual dispatch: a backfill must never create or advance a
-    # release PR as a side effect (npm-publish tolerates the skipped need via
-    # !cancelled(), and every other job gates on release_created == 'true').
-    if: ${{ github.repository == 'Gitlawb/node' && github.event_name != 'workflow_dispatch' }}
+    if: ${{ github.repository == 'Gitlawb/node' }}
     name: Release Please
     runs-on: ubuntu-latest
     permissions:
@@ -41,7 +24,6 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
       version: ${{ steps.release.outputs.version }}
-      pr: ${{ steps.release.outputs.pr }}
     steps:
       - name: Run release-please
         id: release
@@ -49,197 +31,24 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-  # The release PR bumps the workspace crate versions in the Cargo.tomls but
-  # release-please cannot update Cargo.lock, so without this job every release
-  # merge ships a tag whose lockfile disagrees with its manifests (a --locked
-  # build from the tag fails, and pr-checks builds --locked). Sync the lock on
-  # the release branch so the tagged tree is internally consistent.
-  #
-  # Runs on every push-triggered release run, not only when release-please
-  # reports the PR: the `pr` output is set only on runs that CREATE or UPDATE
-  # the release PR, so gating on it would leave an already-open release PR
-  # (opened before this job existed, or untouched by a non-releasable push)
-  # permanently without the sync and without check runs. The resolve step
-  # discovers any open release-please PR itself and no-ops when there is none.
-  sync-release-lock:
-    name: Sync Cargo.lock on the release PR
-    needs: release-please
-    if: ${{ !cancelled() && github.repository == 'Gitlawb/node' && github.event_name != 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: read
-      # actions: write lets the final step dispatch pr-checks on the release
-      # branch. Note this grant is repo-wide dispatch rights (GitHub cannot
-      # scope it to one workflow); acceptable here because reaching this job's
-      # steps already requires write to main. Needed because every push to the
-      # release branch (release-please's and the lock sync below) is made with
-      # GITHUB_TOKEN, which triggers no workflow runs, so without an explicit
-      # dispatch the release PR's head carries no check runs and the --locked
-      # gate never validates it.
-      actions: write
-    steps:
-      # Prefer the fresh `pr` output when this run just created/updated the
-      # release PR; otherwise fall back to querying for an open release-please
-      # branch (prefix match: the branch carries `--components--` suffixes).
-      - name: Resolve the open release PR branch
-        id: resolve
-        env:
-          GH_TOKEN: ${{ github.token }}
-          OWNER: ${{ github.repository_owner }}
-          BRANCH_FROM_OUTPUT: ${{ needs.release-please.outputs.pr && fromJSON(needs.release-please.outputs.pr).headBranchName || '' }}
-        run: |
-          branch="$BRANCH_FROM_OUTPUT"
-          if [ -z "$branch" ]; then
-            # The branch name alone is not a trust signal. `gh pr list` includes
-            # fork PRs, and a fork's headRefName is bare (no owner prefix), so a
-            # prefix match by itself lets any fork nominate the branch this job
-            # checks out, commits to, and dispatches checks on. Require the head
-            # repo to be THIS repository and the author to be the release-please
-            # app, so neither a fork nor a same-repo human branch named
-            # `release-please--*` can be selected. Then take the highest PR
-            # number: `[0]` depended on gh's default ordering, which is not a
-            # documented guarantee, and picking a stable one keeps a second
-            # (component) release PR from making the choice flap between runs.
-            branch=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open \
-              --json headRefName,headRepositoryOwner,number,author \
-              --jq '[ .[]
-                      | select(.headRepositoryOwner.login == env.OWNER)
-                      | select(.author.login == "app/github-actions")
-                      | select(.headRefName | startswith("release-please--"))
-                    ] | max_by(.number).headRefName // empty')
-          fi
-          if [ -z "$branch" ]; then
-            echo "no open release PR; nothing to sync"
-          fi
-          echo "branch=$branch" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout release branch
-        if: ${{ steps.resolve.outputs.branch != '' }}
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ steps.resolve.outputs.branch }}
-
-      # Resolve on a declared toolchain instead of whatever Rust the runner
-      # image happens to ship, so the lock this job writes comes off the same
-      # stable channel the other cargo jobs use. Not a claim of identical
-      # resolution: `stable` still moves between runs, and the MSRV gate
-      # checks this same lock on 1.91 (pr-checks.yml). It only removes the
-      # runner image as an undeclared input.
-      - name: Install Rust toolchain
-        if: ${{ steps.resolve.outputs.branch != '' }}
-        uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b # stable
-        with:
-          toolchain: stable
-
-      - name: Sync workspace crate versions into Cargo.lock
-        if: ${{ steps.resolve.outputs.branch != '' }}
-        run: cargo update --workspace
-
-      - name: Commit and push when the lock changed
-        if: ${{ steps.resolve.outputs.branch != '' }}
-        run: |
-          if git diff --quiet Cargo.lock; then
-            echo "Cargo.lock already in sync"
-            exit 0
-          fi
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Cargo.lock
-          git commit -m "chore: sync Cargo.lock with the release version bump"
-          git push
-
-      # Every push to the release branch is made with GITHUB_TOKEN (release-
-      # please's own pushes and the lock sync above), and events created by
-      # GITHUB_TOKEN start no workflow runs. workflow_dispatch is the documented
-      # exception GITHUB_TOKEN may trigger, so dispatch pr-checks at the release
-      # branch to attach check runs to its current head. Unconditional (also on
-      # the already-in-sync path) because the branch's ORIGINAL head has the
-      # same no-runs problem. Loud on failure by design: a silent fallback
-      # would recreate the checkless-head problem, and a job rerun is safe
-      # (sync no-ops, dispatch retries). Loop-safe: pr-checks is read-only and
-      # dispatches nothing. Runs after the push ack, so the dispatched ref tip
-      # is the sync commit. Merge-queue note: this validates the branch tip;
-      # the enforced merge queue's merge_group run still re-validates the true
-      # merged result before landing.
-      - name: Dispatch PR checks on the release branch
-        if: ${{ steps.resolve.outputs.branch != '' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BRANCH: ${{ steps.resolve.outputs.branch }}
-        run: |
-          # Every dispatch failure fails the job, including the 422 a release
-          # branch cut before pr-checks gained its workflow_dispatch trigger
-          # returns ("does not have a workflow_dispatch trigger", reported
-          # against the dispatched ref's copy of the file). An earlier revision
-          # tolerated exactly that 422 on the theory that release-please would
-          # rewrite the branch and heal it, but a rewrite only happens when a
-          # later releasable commit lands: an open release PR nobody touches is
-          # never rewritten. Tolerating it therefore left the lock-sync commit
-          # this job had just pushed sitting on the release head with no
-          # --locked validation, which is the precise state this workflow exists
-          # to prevent. The tolerance is also no longer needed: once this lands,
-          # every release branch is cut from a main that already carries the
-          # trigger, so the only branch that could 422 is one open at merge time
-          # (there is none), and a job rerun after a manual rebase is safe (the
-          # sync no-ops, the dispatch retries).
-          gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/pr-checks.yml/dispatches" \
-            -f "ref=$BRANCH"
-
-  # Each architecture builds NATIVELY (amd64 on ubuntu-latest, arm64 on
-  # ubuntu-24.04-arm) and pushes by digest; docker-manifest below stitches the
-  # digests into the tagged multi-arch image. No QEMU: emulating the arm64
-  # Rust release build wedged the v0.6.0 run for 3+ hours and, via the
-  # workflow concurrency group, blocked every queued release run behind it.
   docker:
-    name: Build & Push Docker Image (${{ matrix.arch }})
+    name: Build & Push Docker Image
     needs: release-please
-    # Runs on a fresh release, or on manual dispatch for an existing tag
-    # (release-please is skipped on dispatch, hence !cancelled()).
-    if: >-
-      ${{ !cancelled() && (
-        needs.release-please.outputs.release_created == 'true' ||
-        (github.event_name == 'workflow_dispatch' && inputs.docker_backfill_tag != '')
-      ) }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - arch: amd64
-            os: ubuntu-latest
-            platform: linux/amd64
-          - arch: arm64
-            os: ubuntu-24.04-arm
-            platform: linux/arm64
-    runs-on: ${{ matrix.os }}
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        id: rel
-        env:
-          DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-          # ghcr requires a lowercase repository path, and unlike metadata-action,
-          # buildx's `--output name=` does no lowercasing — a mixed-case owner
-          # makes the digest push fail with "invalid reference format".
-          echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
-
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.rel.outputs.tag }}
+          ref: ${{ needs.release-please.outputs.tag_name }}
           persist-credentials: false
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
@@ -250,130 +59,45 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}},value=${{ needs.release-please.outputs.version }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-please.outputs.version }}
+            type=raw,value=latest
+
       - name: Build and load locally (smoke)
         uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
         with:
           context: .
-          platforms: ${{ matrix.platform }}
           load: true
           tags: gitlawb-node:smoke
-          cache-from: type=gha,scope=docker-${{ matrix.arch }}
+          cache-from: type=gha
 
-      # Native runner on both arches, so the built image can always execute.
-      # Assert the released version so a stale artifact fails here, not in prod.
       - name: Smoke test
-        env:
-          VERSION: ${{ steps.rel.outputs.version }}
-        run: |
-          set -euo pipefail
-          out="$(docker run --rm gitlawb-node:smoke --version)"
-          echo "$out"
-          grep -qF "$VERSION" <<<"$out" || {
-            echo "::error::image --version did not report expected version $VERSION (got: $out)"
-            exit 1
-          }
+        run: docker run --rm gitlawb-node:smoke --version
 
-      # Push by digest only — tags are applied once by docker-manifest so a
-      # half-finished matrix can never publish a partially-tagged image.
-      # provenance:false keeps each push a plain single-arch manifest, which is
-      # what imagetools create expects to merge.
-      - name: Build and push by digest
-        id: push
+      - name: Build and push (multi-arch)
         uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
         with:
           context: .
-          platforms: ${{ matrix.platform }}
-          provenance: false
-          outputs: type=image,name=${{ steps.rel.outputs.image }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=docker-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=docker-${{ matrix.arch }}
-
-      - name: Export digest
-        env:
-          DIGEST: ${{ steps.push.outputs.digest }}
-        run: |
-          set -euo pipefail
-          mkdir -p /tmp/digests
-          touch "/tmp/digests/${DIGEST#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: docker-digest-${{ matrix.arch }}
-          path: /tmp/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  docker-manifest:
-    name: Publish Docker manifest
-    needs: [release-please, docker]
-    if: ${{ !cancelled() && needs.docker.result == 'success' }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        id: rel
-        env:
-          DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-
-      - name: Download digests
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          pattern: docker-digest-*
-          path: /tmp/digests
-          merge-multiple: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create and push multi-arch manifest
-        env:
-          VERSION: ${{ steps.rel.outputs.version }}
-        run: |
-          set -euo pipefail
-          # ghcr requires a lowercase repository path.
-          IMAGE="ghcr.io/${GITHUB_REPOSITORY,,}"
-          MAJOR_MINOR="${VERSION%.*}"
-          digests=""
-          for f in /tmp/digests/*; do
-            digests="$digests $IMAGE@sha256:$(basename "$f")"
-          done
-          # shellcheck disable=SC2086
-          docker buildx imagetools create \
-            -t "$IMAGE:$VERSION" \
-            -t "$IMAGE:$MAJOR_MINOR" \
-            -t "$IMAGE:latest" \
-            $digests
-          docker buildx imagetools inspect "$IMAGE:$VERSION"
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Release summary
-        env:
-          VERSION: ${{ steps.rel.outputs.version }}
-          TAG: ${{ steps.rel.outputs.tag }}
         run: |
           {
-            echo "## Released $TAG"
+            echo "## Released ${{ needs.release-please.outputs.tag_name }}"
             echo
-            echo "- Image: \`ghcr.io/${GITHUB_REPOSITORY,,}:$VERSION\` (linux/amd64 + linux/arm64)"
-            echo "- GitHub: https://github.com/$GITHUB_REPOSITORY/releases/tag/$TAG"
+            echo "- Image: \`ghcr.io/${{ github.repository }}:${{ needs.release-please.outputs.version }}\`"
+            echo "- GitHub: https://github.com/${{ github.repository }}/releases/tag/${{ needs.release-please.outputs.tag_name }}"
           } >> "$GITHUB_STEP_SUMMARY"
 
   release-binaries:
@@ -445,7 +169,7 @@ jobs:
           set -euo pipefail
           args=""
           for b in $BINS; do args="$args -p $b"; done
-          cargo build --release --locked --target ${{ matrix.target }} $args
+          cargo build --release --target ${{ matrix.target }} $args
 
       # Run each packaged binary's --version so a broken release artifact fails the
       # build instead of shipping. Every target builds on a matching-arch runner,
@@ -524,61 +248,37 @@ jobs:
   npm-publish:
     name: Publish to npm
     needs: [release-please, release-binaries]
-    # Runs on a fresh release, or on manual dispatch for an existing tag
-    # (release-binaries is skipped on dispatch, hence !cancelled()). Publishing
-    # auth is npm Trusted Publishing (GitHub OIDC) — no NPM_TOKEN. Each
-    # @gitlawb package must have this repo + workflow (release.yml) configured
-    # as its trusted publisher on npmjs.com, or publish fails loudly here —
-    # deliberately loud: the silent secret-guard skip is how 0.4.x–0.6.0
-    # never reached npm.
-    if: >-
-      ${{ !cancelled() && (
-        (needs.release-please.outputs.release_created == 'true' && needs.release-binaries.result == 'success') ||
-        (github.event_name == 'workflow_dispatch' && inputs.npm_backfill_tag != '')
-      ) }}
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write # npm trusted publishing (OIDC) + provenance
+      id-token: write # npm provenance
     steps:
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Resolve release tag
-        id: rel
+      - name: Guard on secret
+        id: guard
         env:
-          DISPATCH_TAG: ${{ inputs.npm_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
+          if [ -z "${NPM_TOKEN:-}" ]; then
+            echo "::warning::NPM_TOKEN is not set — skipping npm publish."
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Checkout release tag
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ steps.rel.outputs.tag }}
+          ref: ${{ needs.release-please.outputs.tag_name }}
           persist-credentials: false
 
-      # npm >= 11.5.1 performs the OIDC token exchange automatically when the
-      # package has a trusted publisher configured; older npm silently falls
-      # back to (absent) token auth and fails confusingly.
-      - name: Set up Node 24 + OIDC-capable npm
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version: "24"
-      - name: Ensure npm supports trusted publishing
-        run: |
-          set -euo pipefail
-          npm install -g npm@^11.5.1
-          npm --version
-
       - name: Lay in release binaries
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ steps.rel.outputs.version }}
-          TAG: ${{ steps.rel.outputs.tag }}
+          VERSION: ${{ needs.release-please.outputs.version }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
         run: |
           set -euo pipefail
           # npm platform package -> Rust target triple (unix only; Windows is not
@@ -605,8 +305,9 @@ jobs:
           done
 
       - name: Set versions
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
-          VERSION: ${{ steps.rel.outputs.version }}
+          VERSION: ${{ needs.release-please.outputs.version }}
         run: |
           set -euo pipefail
           node -e '
@@ -626,12 +327,13 @@ jobs:
           '
 
       - name: Publish
+        if: ${{ steps.guard.outputs.enabled == 'true' }}
         env:
-          VERSION: ${{ steps.rel.outputs.version }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          VERSION: ${{ needs.release-please.outputs.version }}
         run: |
           set -euo pipefail
-          # No token: npm exchanges this job's GitHub OIDC identity with the
-          # registry (trusted publishing); provenance is attested automatically.
+          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
           # Platform packages first, then the wrapper (so its optionalDependencies resolve).
           # Skip versions already on the registry so a rerun after a partial publish
           # is idempotent instead of erroring on the first existing package.
@@ -727,15 +429,6 @@ jobs:
               bin.install "git-remote-gitlawb"
             end
 
-            def caveats
-              <<~CAVEATS
-                oh-my-zsh's git plugin aliases gl='git pull', which shadows this
-                binary in interactive shells. If \`gl\` prints "fatal: not a git
-                repository", run:
-                  echo 'unalias gl 2>/dev/null' >> ~/.zshrc && source ~/.zshrc
-              CAVEATS
-            end
-
             test do
               assert_match version.to_s, shell_output("#{bin}/gl --version")
             end

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.7.1"
+  ".": "0.5.1"
 }

AGENTS.md

@@ -1,44 +0,0 @@
-# Contributor guide for coding agents
-
-This file carries the rules a patch author cannot recover from the code alone, for humans and coding agents alike. For build, test, and PR basics, read `CONTRIBUTING.md` first.
-
-## Authorization invariants (the rules PRs most often break)
-
-Every repo-scoped endpoint must bind the caller to an authorization decision before serving or mutating anything. The `known_ungated` allowlist in `authz_guard::every_repo_scoped_handler_is_gated` is empty on main: `list_webhooks`, `list_replicas`, and `list_protected_branches` are gated (`list_webhooks` with read-visibility then owner; the other two with `authorize_repo_read`). Do not re-open those surfaces as exceptions.
-
-- Owner-only mutations (visibility, webhooks, protected branches, merges) are gated against the repo owner. Three gate forms are in use and all are recognized: webhooks and merges call `require_repo_owner` (`crates/gitlawb-node/src/api/mod.rs`), visibility uses its module-local `require_owner`, and protected branches compare inline with `did_matches`. Use the form the surrounding module already uses.
-- Not every write is owner-only, and that is by design: `star_repo`/`unstar_repo` bind to the signer (they still require repo read access), `register_replica`/`unregister_replica` bind to the replica's own DID, the bounty actions (claim, submit, approve, cancel, dispute) have their own multi-party rules, and closing a PR or issue is owner-or-author. Do not add owner gates to these.
-- Content-serving reads (blobs, trees, raw files) gate through `authorize_repo_read` with the specific path being served, so a withheld subtree is denied even on an otherwise-public repo; repo-level reads (listings) pass `"/"` by the helper's own contract. The source scans below cannot check this argument's value, so review will.
-- A route that reaches repo data through a global id, with no repo in its path, or through an extractor shape the scans do not recognize still needs the same gate; the scans cannot see those.
-- Read-surface denials must not reveal existence: a caller who may not read a repo (or a withheld subtree) gets the same 404 as a missing repo, never a 403. (Owner-gated mutations currently return 403 after the repo lookup; do not widen that shape to read paths.)
-- Two tests in module `authz_guard` (`crates/gitlawb-node/src/api/mod.rs`) scan handler sources and fail on a repo-scoped handler without a recognized gate: `every_in_scope_mutation_has_its_gate` and `every_repo_scoped_handler_is_gated`. If they fail on your handler, add the gate. The second test's `known_ungated` allowlist is empty; never add an entry to it without an open issue and review.
-
-## Adding or changing routes
-
-- A new gated handler needs tests proving its route-specific gate fires: exercise an unauthorized authenticated caller and an anonymous caller where applicable, assert the exact denial status each way, and assert the body leaks nothing. The non-owner tests in `crates/gitlawb-node/src/test_support.rs` show the shape for owner-gated routes.
-- A new mutation handler also gets a row in `every_in_scope_mutation_has_its_gate` naming its gate type; the per-handler row is the point of that test.
-- A table-driven deny suite covering every deny-bearing route is in review (#194, #195). If it is present in your checkout, add a probe row there for any new deny-bearing route.
-
-## Verifying signatures and certificates
-
-- Derive the verifying key from something outside the artifact you are checking: the node's own DID, a pinned or configured value, a peers lookup. A key read from a field of the object being verified (`Did::from_str(&cert.node_did)`) only proves the artifact is self-consistent, and identities here are permissionless, so anyone can mint a keypair, name it in the artifact, self-sign, and be told it is valid. A mismatch against that anchor has to fail the result, not log a warning.
-- A handler whose correct answer is "valid" needs a positive case driven by a trusted, independently anchored artifact, and a rejection case for a well-formed, fully populated forged artifact. Invalid-only suites miss an implementation that rejects everything; a forged artifact that still returns valid is the regression that matters.
-- The fields a signature covers are a versioned format. Adding one invalidates every artifact already signed, so give the payload a version, keep a path that verifies the older form, and add a test that verifies an artifact signed before your change.
-
-## Removing a serving path
-
-When a fix removes a path that used to serve content, the same PR must add a test asserting the removed path now denies. The deletion is what turns that test green; without it the path can quietly come back.
-
-## Database migrations
-
-Schema changes are code-defined in `MIGRATIONS` (`crates/gitlawb-node/src/db/mod.rs`). Always append a new versioned entry; never edit an entry that has merged (operators deploy from main). Test runs build the schema from scratch, so editing an applied version stays green in CI while breaking every existing deployment.
-
-## Client behavior (`gl`, `git-remote-gitlawb`)
-
-When a node denies a request, surface the denial to the user. Never render a denial as an empty list or a silent success; that turns an authorization boundary into invisible data loss.
-
-## Toolchain and CI reality
-
-- MSRV is Rust 1.91 (`rust-version` in the workspace `Cargo.toml`). The MSRV CI job runs `cargo check --workspace --all-targets` on exactly 1.91, so check that an API you rely on is stable there; the full test suite runs on stable.
-- The PR workflow runs these jobs on every PR: `cargo fmt --check`, `cargo clippy --workspace --all-targets -- -D warnings`, `cargo test --workspace` (against Postgres), a release build, `cargo audit`, the MSRV check, and a Docker build. The `main` branch ruleset currently requires one approving review but does not require these checks to pass before merge; a failing job should block review approval in practice, but nothing enforces that mechanically today.
-- Conventional commit titles (`feat:`, `fix:`, `docs:`, ...) are required by convention and drive releases, but no CI job checks them; a bad title fails review, not the pipeline.

CHANGELOG.md

@@ -1,65 +1,5 @@
 # Changelog
 
-## [0.7.1](https://github.com/Gitlawb/node/compare/v0.7.0...v0.7.1) (2026-08-03)
-
-
-### Bug Fixes
-
-* **ci:** make the docker dependency cache work and unbreak Dockerfile.bins ([99b2b9a](https://github.com/Gitlawb/node/commit/99b2b9a16662761a3959a2941798e6823621bda5))
-* **ci:** make the docker dependency cache work and unbreak Dockerfile.bins ([a49e04d](https://github.com/Gitlawb/node/commit/a49e04ddcd23f3b666421486ae60c3c4329e2242)), closes [#265](https://github.com/Gitlawb/node/issues/265) [#266](https://github.com/Gitlawb/node/issues/266)
-* **db:** pin profile DID matching with lone non-key fixture and boundary matrix ([b4016dc](https://github.com/Gitlawb/node/commit/b4016dce9d1fe450603173f9d92bd880127620fa)), closes [#298](https://github.com/Gitlawb/node/issues/298)
-* **node:** add a shared owner/name slug validator ([#272](https://github.com/Gitlawb/node/issues/272)) ([51d82de](https://github.com/Gitlawb/node/commit/51d82ded57a776d9c7e2fe65895efdbf9e227dc8))
-* **node:** bound the slug owner by NAME_MAX, not the DID limit ([#272](https://github.com/Gitlawb/node/issues/272)) ([27b0495](https://github.com/Gitlawb/node/commit/27b0495a6f7edeecddbe62b0f075a7e3b1ef5053))
-* **node:** fail a sync row terminally when a non-directory holds the owner path ([2e664b7](https://github.com/Gitlawb/node/commit/2e664b7885036ee72ce175af95bb567b18222583))
-* **node:** make a stalled sync queue visible, and fix two test claims ([9aa4c17](https://github.com/Gitlawb/node/commit/9aa4c17aefd1885d134b1334b54551366cdd8ef0))
-* **node:** move the attempted_at migration to v17, clear of two open branches ([fbc5868](https://github.com/Gitlawb/node/commit/fbc5868bd16946ea184dad26abcdb0e89d68e99a))
-* **node:** prove the mirror path is inside repos_dir before running git ([#272](https://github.com/Gitlawb/node/issues/272)) ([3ca9473](https://github.com/Gitlawb/node/commit/3ca94739ed7b90e4c265a0947025dc3b50e7583b))
-* **node:** reject a malformed slug at the notify boundary ([#272](https://github.com/Gitlawb/node/issues/272)) ([c587a40](https://github.com/Gitlawb/node/commit/c587a40a508acea9f74c3468d42ff037397c75d0))
-* **node:** reset a peer's reachability gate when an announce changes its http_url ([#270](https://github.com/Gitlawb/node/issues/270)) ([1964f88](https://github.com/Gitlawb/node/commit/1964f88378fe6942ffca5836de3a092b5b8f67b4))
-* **node:** reset a peer's reachability gate when an announce changes its http_url ([#270](https://github.com/Gitlawb/node/issues/270)) ([e2560ee](https://github.com/Gitlawb/node/commit/e2560ee46c28e4e966d87867a86dc4bad4ca7a3a))
-* **node:** stamp every dequeued sync row so a stuck one yields the batch ([6e64d0d](https://github.com/Gitlawb/node/commit/6e64d0d0a7fdd38ef3a56820c1808dd7c9bbd658))
-* **node:** stop a peer-supplied repo slug from escaping repos_dir ([#272](https://github.com/Gitlawb/node/issues/272)) ([c70b1df](https://github.com/Gitlawb/node/commit/c70b1df42d5c3f70ec4c272886c85fcc16ed92d1))
-* **node:** validate the queued slug before the worker derives a path ([#272](https://github.com/Gitlawb/node/issues/272)) ([9f00e24](https://github.com/Gitlawb/node/commit/9f00e24aec217e4b8256dd437cff4741b1478b96))
-* **review:** correct two comment claims and guard two more wrong shapes ([#270](https://github.com/Gitlawb/node/issues/270)) ([811ad50](https://github.com/Gitlawb/node/commit/811ad504bc268c8e9cddac93822adcd00bfe9ff8))
-* **review:** stop the dequeue overclaiming, and pin the starvation premise ([457be11](https://github.com/Gitlawb/node/commit/457be11d728a2a34775cf96be2bc5af9a58cb250))
-* strict DID matching in get_profile ([acb4714](https://github.com/Gitlawb/node/commit/acb47145beec8ce7b20b7a2479f7a55ed68e2a89))
-* strict DID matching in get_profile ([13b565b](https://github.com/Gitlawb/node/commit/13b565bcac09f075a7fd555a6e9acdd27de6c7bb))
-* target stored did on profile update aliases ([9836c3a](https://github.com/Gitlawb/node/commit/9836c3a21bc96a2ce95cb1fd12bd84b22142787d))
-
-## [0.7.0](https://github.com/Gitlawb/node/compare/v0.6.0...v0.7.0) (2026-07-22)
-
-
-### Features
-
-* **gl:** actually verify certificate signatures in gl cert show ([b0a2ed8](https://github.com/Gitlawb/node/commit/b0a2ed830821b5a77b0dafdcf5ce4b1ad904ec25))
-* **gl:** doctor warns when a shell alias shadows the gl binary ([0765c42](https://github.com/Gitlawb/node/commit/0765c42feff47b29054b9a277881a7cd5bfd9135))
-
-
-### Bug Fixes
-
-* **gl:** address review findings — non-fatal DID check, exact-host loopback, detached HEAD, multi-URL remotes, command-aware unalias ([3fa38dc](https://github.com/Gitlawb/node/commit/3fa38dce4e435ef017f607d355266c2892161f8d))
-* **gl:** anchor cert --verify to a trusted issuer; pin canonical payload form ([c681af7](https://github.com/Gitlawb/node/commit/c681af70dba3a76b11795d324f2ca0fecf7e42fd))
-* **gl:** detect gitlawb remotes beyond origin in gl status ([2d88937](https://github.com/Gitlawb/node/commit/2d88937fbabf21013f28debb4d4f93270a4bb8cd))
-* **gl:** doctor treats a reachable local node as configuration, not failure ([94c61f7](https://github.com/Gitlawb/node/commit/94c61f79421fa26ecc1bdf7c255e0c48e66a2048))
-* **gl:** make gl init's push guidance match the repo's actual state ([cb42a48](https://github.com/Gitlawb/node/commit/cb42a4830d0d070165e2212f316d009ec716dbee))
-* warn about the oh-my-zsh gl alias at install time ([e3df51d](https://github.com/Gitlawb/node/commit/e3df51d76c0275fde33954ff0af0aab95fd0cb7d))
-
-## [0.6.0](https://github.com/Gitlawb/node/compare/v0.5.1...v0.6.0) (2026-07-22)
-
-
-### Features
-
-* **icaptcha-client:** solve the iCaptcha proof-of-work on answer ([#181](https://github.com/Gitlawb/node/issues/181)) ([c98b503](https://github.com/Gitlawb/node/commit/c98b503f90cade54ce9c588bd2373a4e3486f2fc))
-
-
-### Bug Fixes
-
-* **core:** honor wildcard capabilities in Ucan::can, matching is_attenuated_by ([#200](https://github.com/Gitlawb/node/issues/200)) ([b6877a6](https://github.com/Gitlawb/node/commit/b6877a65981dbf41c4a7838971eb5c826c7fcaf2))
-* **gl:** point doctor's version check at Gitlawb/node, not the frozen Gitlawb/releases repo ([#198](https://github.com/Gitlawb/node/issues/198)) ([98d728c](https://github.com/Gitlawb/node/commit/98d728c325f68f0ee4a62e473dc484b7dd627504))
-* **node:** carry full owner DID on ref-update wire event ([#144](https://github.com/Gitlawb/node/issues/144)) ([#145](https://github.com/Gitlawb/node/issues/145)) ([69a62e5](https://github.com/Gitlawb/node/commit/69a62e51c2d2f090f9cae88f4d8ce3b9017b7149))
-* **node:** gate /hooks and sibling read surfaces leaking private repo metadata ([#94](https://github.com/Gitlawb/node/issues/94)) ([#113](https://github.com/Gitlawb/node/issues/113)) ([ee8d7c0](https://github.com/Gitlawb/node/commit/ee8d7c03b26a0b678cc90b8801aa340fe81da700))
-* strip Cf bidi/format controls in terminal-bound error sanitizers ([#183](https://github.com/Gitlawb/node/issues/183)) ([#188](https://github.com/Gitlawb/node/issues/188)) ([b07d41e](https://github.com/Gitlawb/node/commit/b07d41ea97569d79d3f545ae5d43c373cd6f0f33))
-
 ## [0.5.1](https://github.com/Gitlawb/node/compare/v0.5.0...v0.5.1) (2026-07-10)
 
 

CONTRIBUTING.md

@@ -31,9 +31,7 @@ crates/
 ├── gitlawb-core/       crypto primitives (DID, CID, HTTP sigs, UCAN, ref certs)
 ├── gitlawb-node/       axum HTTP server, git smart HTTP, P2P, GraphQL
 ├── gl/                 CLI — identity, repos, MCP server, Base L2 names
-├── git-remote-gitlawb/ git remote helper for gitlawb:// URLs
-├── gitlawb-attest/     provenance attestations for ref-update certificates
-└── icaptcha-client/    client for the iCaptcha proof-of-intelligence service
+└── git-remote-gitlawb/ git remote helper for gitlawb:// URLs
 docs/                   Operator guides
 scripts/                Build helpers
 ```
@@ -56,7 +54,6 @@ Smart contracts live in a separate repo: [github.com/Gitlawb/contracts](https://
 3. **No breaking changes without discussion.** Open an issue first for protocol-level changes.
 4. **Conventional commits.** Use `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, `chore:`. Releases are automated by [release-please](https://github.com/googleapis/release-please) — your commit prefixes drive the next version bump.
 5. **Format and lint.** Run `cargo fmt --all` and `cargo clippy --workspace --all-targets -- -D warnings` before submitting. CI will reject anything that fails these.
-6. **Security-surface rules.** [`AGENTS.md`](AGENTS.md) carries the authorization invariants PRs most often break; it is written for coding agents and humans alike, so read it before touching endpoints, visibility, or migrations.
 
 ## What gets merged, what gets closed
 
@@ -108,7 +105,7 @@ cargo test -p gitlawb-node
 
 - **TypeScript SDK** (`@gitlawb/sdk`) — client library for the HTTP API
 - **Python SDK** (`gitlawb`) — for ML/agent pipeline integration
-- **UCAN authorization** — add trusted issuer anchoring, capability checks, and authorization-aware revocation
+- **UCAN chain validation** — complete the auth middleware
 - **Filecoin storage tier** — wire up cold storage deals
 - **Documentation** — guides, tutorials, API examples
 - **Node operators** — run a public node and report issues

Cargo.lock

@@ -770,23 +770,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "ark-ff"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7a806ac6c8307b929df4645776290a50ee2aac754ad09d8bdf73391309e43af"
-dependencies = [
- "ark-ff-asm 0.6.0",
- "ark-ff-macros 0.6.0",
- "ark-serialize 0.6.0",
- "ark-std 0.6.0",
- "digest 0.10.7",
- "educe",
- "num-bigint",
- "num-traits",
- "zeroize",
-]
-
 [[package]]
 name = "ark-ff-asm"
 version = "0.3.0"
@@ -817,16 +800,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "ark-ff-asm"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1479009684adc073dff49a1025d3a7065b317a9ead25aaaca38cdc70058ba8a2"
-dependencies = [
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-ff-macros"
 version = "0.3.0"
@@ -865,19 +838,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "ark-ff-macros"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a0691ed21ef00ef89c1e9bda832eba493dda3ec2f8d892fb25b705f73f06bb8"
-dependencies = [
- "num-bigint",
- "num-traits",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-serialize"
 version = "0.3.0"
@@ -911,30 +871,6 @@ dependencies = [
  "num-bigint",
 ]
 
-[[package]]
-name = "ark-serialize"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a74dd304fd536fb95d0a328e72be759209cc496a9da094c5bc56e5fea4f9e86b"
-dependencies = [
- "ark-serialize-derive",
- "ark-std 0.6.0",
- "digest 0.10.7",
- "num-bigint",
- "serde_with",
-]
-
-[[package]]
-name = "ark-serialize-derive"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f153690697a2b91e5e1251ff98411ee5371500a111a0fd317a70e588eb300f9"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "ark-std"
 version = "0.3.0"
@@ -965,16 +901,6 @@ dependencies = [
  "rand 0.8.6",
 ]
 
-[[package]]
-name = "ark-std"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "367c9c827ed431bff6868b7aa926e05b16eb46603cc8b6e768e4a5553fa1d155"
-dependencies = [
- "num-traits",
- "rand 0.8.6",
-]
-
 [[package]]
 name = "arrayref"
 version = "0.3.9"
@@ -2630,7 +2556,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ab67060fc6b8ef687992d439ca0fa36e7ed17e9a0b16b25b601e8757df720de"
 dependencies = [
  "data-encoding",
- "syn 2.0.117",
+ "syn 1.0.109",
 ]
 
 [[package]]
@@ -3002,7 +2928,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3374,22 +3300,19 @@ dependencies = [
 
 [[package]]
 name = "git-remote-gitlawb"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
  "anyhow",
  "gitlawb-core",
- "libc",
  "mockito",
  "reqwest",
- "tempfile",
  "tracing",
  "tracing-subscriber",
- "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "gitlawb-attest"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
  "base64",
  "ed25519-dalek",
@@ -3406,7 +3329,7 @@ dependencies = [
 
 [[package]]
 name = "gitlawb-core"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
  "anyhow",
  "base64",
@@ -3433,7 +3356,7 @@ dependencies = [
 
 [[package]]
 name = "gitlawb-node"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
  "alloy",
  "anyhow",
@@ -3489,11 +3412,10 @@ dependencies = [
 
 [[package]]
 name = "gl"
-version = "0.7.1"
+version = "0.5.1"
 dependencies = [
  "alloy",
  "anyhow",
- "base64",
  "chrono",
  "clap",
  "dirs",
@@ -3542,9 +3464,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.16"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -3899,7 +3821,6 @@ version = "0.4.0"
 dependencies = [
  "anyhow",
  "gitlawb-core",
- "mockito",
  "reqwest",
  "serde",
  "serde_json",
@@ -5818,15 +5739,14 @@ dependencies = [
 
 [[package]]
 name = "ruint"
-version = "1.20.0"
+version = "1.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5e99bff0393163bb25029a6af25d3d8d202ba5b5438a74d1bd8789f5c822970"
+checksum = "c141e807189ad38a07276942c6623032d3753c8859c146104ac2e4d68865945a"
 dependencies = [
  "alloy-rlp",
  "ark-ff 0.3.0",
  "ark-ff 0.4.2",
  "ark-ff 0.5.0",
- "ark-ff 0.6.0",
  "bytes",
  "fastrlp 0.3.1",
  "fastrlp 0.4.0",
@@ -5900,7 +5820,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6794,7 +6714,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]

Dockerfile

@@ -8,33 +8,20 @@ FROM rust:1.91-bookworm AS builder
 
 WORKDIR /build
 
-# Cache dependencies first for faster rebuilds.
-# EVERY workspace member's manifest must be copied here, not just the ones this
-# image ships: cargo loads the whole workspace before it resolves anything, so a
-# missing member's Cargo.toml (or a path dependency pointing at one) aborts the
-# layer before a single crate is fetched.
+# Cache dependencies first for faster rebuilds
 COPY Cargo.toml Cargo.lock ./
 COPY crates/gitlawb-core/Cargo.toml crates/gitlawb-core/
 COPY crates/gitlawb-node/Cargo.toml crates/gitlawb-node/
 COPY crates/gl/Cargo.toml crates/gl/
 COPY crates/git-remote-gitlawb/Cargo.toml crates/git-remote-gitlawb/
-COPY crates/gitlawb-attest/Cargo.toml crates/gitlawb-attest/
-COPY crates/icaptcha-client/Cargo.toml crates/icaptcha-client/
 
-# Fetch deps (this layer caches until Cargo.{toml,lock} change).
-# No `|| true`: this layer is expected to succeed, and swallowing its exit code
-# is what let it sit dead from the moment gl gained a path dependency on
-# icaptcha-client. A failure here should stop the build, not silently turn every
-# image build into a cold one.
-RUN mkdir -p crates/gitlawb-core/src crates/gitlawb-node/src crates/gl/src \
-        crates/git-remote-gitlawb/src crates/gitlawb-attest/src crates/icaptcha-client/src && \
+# Fetch deps (this layer caches until Cargo.{toml,lock} change)
+RUN mkdir -p crates/gitlawb-core/src crates/gitlawb-node/src crates/gl/src crates/git-remote-gitlawb/src && \
     echo 'fn main() {}' > crates/gitlawb-node/src/main.rs && \
     echo 'fn main() {}' > crates/gl/src/main.rs && \
     echo 'fn main() {}' > crates/git-remote-gitlawb/src/main.rs && \
     echo '' > crates/gitlawb-core/src/lib.rs && \
-    echo '' > crates/gitlawb-attest/src/lib.rs && \
-    echo '' > crates/icaptcha-client/src/lib.rs && \
-    cargo build --release --locked -p gitlawb-node -p gl -p git-remote-gitlawb
+    cargo build --release -p gitlawb-node -p gl -p git-remote-gitlawb || true
 
 # Now copy real sources and build for real.
 # Force-bump mtimes so cargo's fingerprint check rebuilds — without this,
@@ -47,7 +34,7 @@ RUN find crates -name "*.rs" -exec touch {} + && \
     rm -rf target/release/.fingerprint/gitlawb-node-* \
            target/release/.fingerprint/gl-* \
            target/release/.fingerprint/git-remote-gitlawb-* && \
-    cargo build --release --locked -p gitlawb-node -p gl -p git-remote-gitlawb && \
+    cargo build --release -p gitlawb-node -p gl -p git-remote-gitlawb && \
     strip target/release/gitlawb-node target/release/gl target/release/git-remote-gitlawb
 
 # ── Runtime stage ───────────────────────────────────────────────────────────

Dockerfile.bins

@@ -3,10 +3,7 @@
 # Used by scripts/build-bins.sh — not used for node deployment.
 ARG TARGET=x86_64-unknown-linux-musl
 
-# Must stay at or above the workspace `rust-version` in Cargo.toml. An unmet
-# MSRV is a hard cargo error, and nothing in CI builds this file, so a stale
-# base image here fails only when someone runs scripts/build-bins.sh.
-FROM rust:1.91-bookworm AS builder
+FROM rust:1.85-bookworm AS builder
 ARG TARGET
 
 WORKDIR /build
@@ -26,7 +23,7 @@ COPY crates/ crates/
 # Configure cross-linker for aarch64
 ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc
 
-RUN cargo build --release --locked --target "$TARGET" -p gl -p git-remote-gitlawb
+RUN cargo build --release --target "$TARGET" -p gl -p git-remote-gitlawb
 
 FROM debian:bookworm-slim
 ARG TARGET

README.md

@@ -4,7 +4,7 @@
 
 Gitlawb Node is the open-source node software behind the Gitlawb network. It lets anyone run a self-hosted node, publish repositories under a DID, sign writes with Ed25519 HTTP signatures, replicate git activity across peers, and move toward a resilient app-delivery network where code and build assets can be served closer to users.
 
-Gitlawb is not trying to be only "another git host." The long-term direction is:
+Gitlawb is not trying to be only “another git host.” The long-term direction is:
 
 ```txt
 Decentralized GitHub
@@ -19,7 +19,7 @@ The mission is simple: once code is pushed to the network, it should not disappe
 
 ## What is in this repository?
 
-This is a Rust workspace with six crates:
+This is a Rust workspace with four crates:
 
 | Crate | Purpose |
 |---|---|
@@ -27,8 +27,6 @@ This is a Rust workspace with six crates:
 | `gl` | The Gitlawb CLI for identity, repos, issues, PRs, bounties, tasks, peers, node status, MCP, and setup flows. |
 | `git-remote-gitlawb` | Git remote helper for `gitlawb://` URLs, so normal `git clone`, `git fetch`, and `git push` can talk to Gitlawb nodes. |
 | `gitlawb-core` | Shared primitives: Ed25519 identities, `did:key`, CIDs, RFC 9421 HTTP signatures, certificates, and UCAN tokens. |
-| `gitlawb-attest` | Pluggable external provenance attestations for ref-update certificates. |
-| `icaptcha-client` | Client for the iCaptcha proof-of-intelligence flow used to protect spam-prone writes. |
 
 ---
 
@@ -36,12 +34,12 @@ This is a Rust workspace with six crates:
 
 Most git hosting today depends on a small number of centralized platforms. Gitlawb Nodes are designed for a different model:
 
-- **Own your identity**: every user, agent, and node is an Ed25519 keypair represented as `did:key:z6Mk...`.
-- **Signed writes by default**: write requests use RFC 9421 HTTP Signatures instead of passwords.
-- **Git-native transport**: repositories are still real git repositories served over smart HTTP.
-- **Agent-native workflows**: the `gl` CLI and MCP server expose repo, issue, task, PR, and UCAN flows to AI agents.
-- **Peer-aware delivery**: nodes can announce, discover, gossip, and sync with each other.
-- **App CDN direction**: the network can evolve from decentralized code storage into code + asset + app delivery.
+- **Own your identity** — every user, agent, and node is an Ed25519 keypair represented as `did:key:z6Mk...`.
+- **Signed writes by default** — write requests use RFC 9421 HTTP Signatures instead of passwords.
+- **Git-native transport** — repositories are still real git repositories served over smart HTTP.
+- **Agent-native workflows** — the `gl` CLI and MCP server expose repo, issue, task, PR, and UCAN flows to AI agents.
+- **Peer-aware delivery** — nodes can announce, discover, gossip, and sync with each other.
+- **App CDN direction** — the network can evolve from decentralized code storage into code + asset + app delivery.
 
 ---
 
@@ -56,7 +54,6 @@ Good today:
 - Bare git repository storage.
 - Git smart-HTTP clone/fetch/push.
 - RFC 9421-signed writes.
-- Repository and path-scoped visibility enforcement for repository and Git content reads, with 404-shaped repository denials.
 - DID identities.
 - `gl` CLI workflows.
 - libp2p peer discovery/gossip foundation.
@@ -66,13 +63,11 @@ Good today:
 
 Known limitations:
 
-- Repository write authorization is not secure by default: `GITLAWB_ENFORCE_OWNER_PUSH` defaults to `false` for compatibility, so a valid HTTP Signature identifies a pusher but does not enforce owner-only pushes.
-- UCAN proof chains are validated when supplied, but UCAN capabilities are not consulted by write authorization and the root issuer is not independently trust-anchored. UCANs therefore do not yet grant scoped collaborator access.
-- Agent lifecycle revocation is not enforced by HTTP Signature authorization; do not rely on removing or revoking an agent record to block a compromised signer.
-- Read visibility is not a blanket data-classification boundary: task, IPFS-pin, and Arweave-anchor listings are not repository-gated; withheld path names can be visible to a root reader; and later visibility changes cannot retract content already announced or externally anchored.
+- Private repository read enforcement is not wired yet. Treat public nodes as public infrastructure unless you restrict access at your proxy/firewall.
+- UCAN chain validation and revocation are not complete.
+- Repository write authorization is not capability-complete yet; HTTP signatures prove identity, not full authorization policy.
 - Peer writes are signed by upgraded nodes, but strict signed-peer enforcement is opt-in during rolling upgrades.
-- Current GraphQL mutations require an authenticated signer, but there is no mutation-specific guardrail that prevents a future mutation from omitting that check.
-- Pull-request review comments do not yet have threaded line-level anchors, and merges do not enforce approval requirements.
+- GraphQL mutations need mutation-aware auth before becoming a public write surface.
 
 See:
 
@@ -194,14 +189,14 @@ For public-network use, make sure `GITLAWB_NODE` points to the node you want. Th
 
 Public nodes (e.g. `node.gitlawb.com`) require two things on writes:
 
-1. **RFC 9421 HTTP Signatures**: every write is signed by your identity key. `gl`
+1. **RFC 9421 HTTP Signatures** — every write is signed by your identity key. `gl`
    and the `git-remote-gitlawb` helper do this automatically. An old/unsigned CLI
    fails with `401 not_an_agent`; `gl` will tell you to upgrade and register.
 2. **An iCaptcha proof** on the spam-gated writes (**repo create, fork, register**).
    `gl` solves this for you: on the node's `403 icaptcha_proof_required` it reads the
    `x-icaptcha-url` / `x-icaptcha-level` hints, requests a challenge, solves it
    locally (arithmetic / algebra / sequence), and **retries the same signed request**
-   with the `x-icaptcha-proof` header. No manual steps, no env vars.
+   with the `x-icaptcha-proof` header — no manual steps, no env vars.
 
 ```bash
 gl identity new                                   # create did:key identity
@@ -220,14 +215,14 @@ Notes:
 - **Proofs are short-lived (~5 min TTL) and single-use.** If one expires between
   solving and use, the client transparently solves a fresh one and retries.
 - **What needs what:** create / fork / register are signed **and** iCaptcha-gated;
-  `git push` is **signed-only** (owner signature is the gate, no per-push challenge);
+  `git push` is **signed-only** (owner signature is the gate — no per-push challenge);
   reads (clone / fetch / `repo info`) need no proof. A non-existent repo returns a
   clear `404`, never a placeholder.
 - **API-key iCaptcha deployments:** set `GITLAWB_ICAPTCHA_URL` to your iCaptcha
   origin and `GITLAWB_ICAPTCHA_API_KEY` to its key. The client only talks to an
   `https` origin whose host is allowlisted (that URL or the public default), and
-  sends the bearer token **only** to your configured origin, never to a URL a
-  node advertises, so a hostile node can't capture the key or redirect the solve.
+  sends the bearer token **only** to your configured origin — never to a URL a
+  node advertises — so a hostile node can't capture the key or redirect the solve.
 
 ---
 
@@ -314,7 +309,7 @@ POST /api/v1/peers/announce
 POST /api/v1/sync/notify
 ```
 
-When `GITLAWB_REQUIRE_SIGNED_PEER_WRITES=false`, unsigned legacy peers are accepted on those two routes, but signed requests are verified when signature headers are present. Staged rollout relaxes who may announce, not who owns a peer row. An unsigned announce may register a previously unseen peer, and it may refresh an existing row whose `http_url` is unchanged, but changing an existing peer's `http_url` requires an RFC 9421 signature from that peer's own DID and is refused with 403 otherwise. An unsigned announce can only register a `did:key`, since that is the only method whose verifying key can be resolved and therefore the only kind of row anyone could ever correct through the signed path; any other DID is refused with 400. Once all live peers upgrade, operators can set:
+When `GITLAWB_REQUIRE_SIGNED_PEER_WRITES=false`, unsigned legacy peers are accepted on those two routes, but signed requests are verified when signature headers are present. Once all live peers upgrade, operators can set:
 
 ```bash
 GITLAWB_REQUIRE_SIGNED_PEER_WRITES=true
@@ -348,18 +343,11 @@ Important node settings:
 | `GITLAWB_REQUIRE_SIGNED_PEER_WRITES` | Require signed peer announce/sync writes. |
 | `GITLAWB_AUTO_SYNC` | Enable automatic sync from known peers. |
 | `GITLAWB_MAX_PACK_BYTES` | Max git pack body size for smart-HTTP routes. |
-| `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` | Max seconds a served git upload-pack, receive-pack, or `info/refs` advertisement may run before it is aborted (504). Default 600. Also bounds the withheld-blob classification walk (on both the upload-pack serve and receive-pack replication paths) and the push-side pin-candidate discovery (`rev-list` / `cat-file`), each reaped via process-group teardown at the deadline. On the path-scoped upload-pack path the classification walk and the pack serve share ONE deadline, so this value bounds their combined duration rather than granting each stage a full budget: a walk that consumes it leaves the serve nothing and the clone gets a 504. Serving large path-scoped repos may therefore need a higher value than they did when each stage was budgeted separately. Accepted range is 1 to 3153600000 (100 years), since the node derives deadlines from this value and a larger one cannot be represented. |
+| `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` | Max seconds a served git upload-pack, receive-pack, or `info/refs` advertisement may run before it is aborted (504). Default 600. Also bounds the withheld-blob classification walk (on both the upload-pack serve and receive-pack replication paths) and the push-side pin-candidate discovery (`rev-list` / `cat-file`), each reaped via process-group teardown at the deadline. |
 | `GITLAWB_GIT_ACQUIRE_TIMEOUT_SECS` | Max seconds the storage-acquisition phase (Tigris HEAD/GET, push advisory-lock) of a served git op may run before the request is shed with a 503, separate from the git-run timeout. The concurrency permit is released on expiry so a stalled backend cannot pin the pool. Default 30. |
-| `GITLAWB_MAX_CONCURRENT_GIT_OPS` | Max concurrent served git READ ops (upload-pack and its `info/refs` advertisement) across all callers; over-cap sheds a 503 + Retry-After. Anonymous reads draw from this pool, so pair it with `GITLAWB_MAX_CONCURRENT_READS_PER_CALLER`. Pushes and the receive-pack advertisement have their own pools, so a read flood cannot shed an authenticated push. Default 128. |
-| `GITLAWB_MAX_CONCURRENT_GIT_PUSHES` | Max concurrent `git-receive-pack` POST operations, in a pool separate from the read pool. The anon receive-pack `info/refs` advertisement runs in a third pool of the same size, disjoint from both, so an advertisement flood cannot shed a push either. Two per-source push caps are derived from this value (`/8`, floor 1) and have no env var of their own. Over-cap sheds a 503 + Retry-After. Default 32. |
-| `GITLAWB_MAX_CONCURRENT_READS_PER_CALLER` | Max concurrent read ops a single caller may hold, so one caller cannot monopolize the read pool. Keyed on the resolved source IP, never the DID, and only as granular as `GITLAWB_TRUSTED_PROXY`: left unset, a node behind an edge or NAT keys every caller on the edge IP and this collapses to one global cap. Default 16. |
-| `GITLAWB_MAX_CONCURRENT_PIN_TASKS` | Max post-push pin loops (IPFS + Pinata) running concurrently across all repos. This caps how many loops RUN at once, not how much object-id list memory the node retains: on the local IPFS path a loop parked waiting for a permit still holds its full list. Do not size memory from this knob alone. A loop over cap waits, never drops a pin. Default 8. |
-| `GITLAWB_REPO_LEASE_MAX_WAITERS` | Max pushes parked at once waiting for the same repo's write lease. Each waiter pins its buffered pack body, so this bounds that memory for a hot repo; past the cap the newest push sheds a 503 + Retry-After instead of queueing. Pushes to other repos are unaffected, and the lease holder is not counted. Default 8. |
 | `GITLAWB_MAX_CONCURRENT_IPFS_WALKS` | Max concurrent `GET /ipfs/{cid}` visibility walks across all callers (own pool, disjoint from the served-git pools); over-cap sheds 503. Default 32. |
 | `GITLAWB_IPFS_WALK_PER_SOURCE` | Max concurrent `/ipfs` walks a single source IP may hold. Default 4. |
-| `GITLAWB_IPFS_MAX_REPOS_WALKED` | Max expensive path-scope visibility walks per `/ipfs/{cid}` request; over-cap repos are skipped and the scan continues, shedding a retryable 503 (not a false 404) if the object is then found nowhere. Default 64. |
-| `GITLAWB_IPFS_MAX_REPO_VISITS` | Ceiling on repos one `/ipfs/{cid}` request may visit (acquire + probe) past the visibility gate. Also the worst-case per-request Tigris fetch count. On exhaustion the scan stops with a retryable 503. Default 1024. |
-| `GITLAWB_IPFS_REQUEST_BUDGET_SECS` | Absolute wall-clock budget for one admitted `/ipfs/{cid}` request's acquire+walk lifetime. Per-stage clamps bound the acquire and walk stages to the remaining budget, and no stage starts once it is exhausted; the scan then stops with a retryable 503. The object-type probe and content-read `cat-file` subprocesses are budget-checked before starting and each also run under their own deadline (the lesser of `GITLAWB_GIT_SERVICE_TIMEOUT_SECS` and the remaining budget), reaped via process-group teardown, so a hung `cat-file` cannot hold the request's walk slot past it. One hang path is still unbounded: the probe's object-store readability check is a plain filesystem sweep with nothing to reap, so a wedged filesystem can hold the slot past the deadline. Default 600. Accepted range is 1 to 3153600000 (100 years), since the node derives a deadline from this value and a larger one cannot be represented. |
+| `GITLAWB_IPFS_MAX_REPOS_WALKED` | Max legacy (NULL-provenance) repos probed per `/ipfs/{cid}` request, bounding the scan-fallback fan-out. A truncated scan returns a retryable 503, not a false 404. Default 256. |
 | `GITLAWB_IPFS_RATE_LIMIT` | Max `/ipfs/{cid}` requests per client IP per hour (route flood brake). 0 disables. Default 600. |
 | `GITLAWB_TIGRIS_BUCKET` | Optional S3/Tigris shared repo storage bucket. |
 | `GITLAWB_PINATA_JWT` | Optional Pinata/IPFS warm-storage pinning. |
@@ -367,6 +355,8 @@ Important node settings:
 
 Production note: change the default Postgres password before exposing a node publicly.
 
+Legacy-pin window: releases before the CID-resolver work stored the provider CID (Kubo dag-pb / Pinata) as a pinned object's resolver key. The `/ipfs/{cid}` resolver now recomputes the raw-content CID from the object bytes and refuses to serve a key that does not match, so `GET /api/v1/ipfs/pins` can still advertise an unrepaired legacy CID that 404s. Such a row is repaired opportunistically the next time a push carries the object again (its key is rewritten to the raw CID, the old value kept in `legacy_provider_cid`), but git negotiation omits objects the node already has, so most legacy rows never re-enter a push delta. A deferred one-shot startup sweep, not this opportunistic path, is what fully retires the advertise-then-404 window. Rows whose object bytes are gone stay withheld.
+
 ---
 
 ## Optional node staking
@@ -471,8 +461,8 @@ Short-term priorities:
 2. Add Docker and installer smoke tests.
 3. Improve operator docs and `gl doctor` checks.
 4. Harden peer writes and publish the signed-peer rollout plan.
-5. Close default-open write authorization and wire trusted UCAN delegation into repository permissions.
-6. Add threaded, line-level pull-request discussions and enforce approval requirements on merges.
+5. Implement repo write authorization: owner checks, protected branches, and UCAN capability checks.
+6. Implement private-read enforcement or remove private repo affordances until it exists.
 7. Add metrics for pushes, fetches, pack sizes, peer sync, failed auth, and webhooks.
 
 Product direction:

SECURITY.md

@@ -28,11 +28,10 @@ We will acknowledge receipt within 48 hours and aim to release a fix within 14 d
 - Every git object is content-addressed via CIDv1 (SHA-256)
 - Tamper-evident by construction — a modified object changes its CID
 
-**UCAN token validation**
-- Bootstrap UCAN tokens are issued at registration.
-- A supplied token's signature, audience, expiry, and proof-chain attenuation are validated.
-- Tokens use a signed JSON wire format with expiry.
-- Capability grants are not yet consulted by repository write authorization; see the limitations below.
+**UCAN capability tokens**
+- Bootstrap UCAN tokens issued at registration
+- Capability-scoped: `git:push`, `git:fetch`, `issue:create`, `pr:open`
+- JWT-format tokens with expiry
 
 **Smart contracts (Base Sepolia testnet)**
 - `GitlawbDIDRegistry` — on-chain DID → document registry
@@ -49,20 +48,21 @@ We will acknowledge receipt within 48 hours and aim to release a fix within 14 d
 
 ---
 
-## Known Limitations
+## Known Limitations (Planned for v0.2)
 
-These are documented limitations of the current live release. They should be prioritized without breaking existing nodes during rolling upgrades.
+These are **documented, accepted limitations** for the current live release and should be prioritized without breaking existing nodes during rolling upgrades.
 
-### Repository write authorization defaults
-- `git-receive-pack` verifies HTTP Signatures, but `GITLAWB_ENFORCE_OWNER_PUSH` defaults to `false` for compatibility during rollout.
-- **Impact:** With the default setting, a valid signature authenticates the pusher but does not require that DID to be the repository owner.
-- **Mitigation:** Set `GITLAWB_ENFORCE_OWNER_PUSH=true` on nodes where owner-only pushes are required. Confirm that every legitimate pusher uses the owner DID before enabling it.
+### UCAN chain validation
+- The auth middleware verifies HTTP Signatures and token structure, but does not yet walk the full UCAN delegation chain.
+- **Impact:** A node cannot yet enforce fine-grained capability delegation. Currently, any registered agent with a valid HTTP Signature can push.
+- **Mitigation:** Keep write endpoints signed, treat public nodes as public infrastructure, and treat trust scores as soft rate-limiting signals rather than authorization.
+- **Fix target:** v0.2
 
-### UCAN delegation and revocation
-- The middleware validates a supplied UCAN's complete proof chain, but a root token is accepted without an independently trusted issuer anchor. `Ucan::can` is not yet used by write handlers, so a UCAN does not grant scoped repository access.
-- Agent lifecycle revocation is not checked by HTTP Signature authorization. Removing or revoking an agent record does not itself block a compromised DID from authenticating.
-- **Impact:** Do not use UCANs for collaborator permissions or rely on agent-record revocation as a key-compromise response.
-- **Mitigation:** Keep sensitive deployments behind operational network controls and enable owner-only push enforcement where it fits the deployment until trusted delegation and authorization-aware revocation are implemented.
+### UCAN revocation
+- Issued UCAN tokens cannot be revoked before expiry.
+- **Impact:** If a keypair is compromised, the attacker retains access until the UCAN expires (default: 30 days).
+- **Mitigation:** Regenerate your identity (`gl identity new --force`) and re-register to issue a new UCAN. Until revocation/blocklisting is implemented, operators should remove compromised DIDs directly from their local database.
+- **Fix target:** v0.2
 
 ### git-receive-pack authentication
 - The `git-receive-pack` endpoint enforces HTTP Signature auth. Plain Git smart-HTTP clients do not generate those headers, so the `git-remote-gitlawb` helper is required for pushes.
@@ -71,20 +71,10 @@ These are documented limitations of the current live release. They should be pri
 - **Fix target:** v0.2
 
 ### Private repository reads
-- Repository and path-scoped visibility checks are enforced for repository API and Git content reads. A denied whole-repository or root read returns the same 404 shape as a missing repository, so the denial does not reveal private-repository existence.
-- Sparse-clone support exposes withheld path globs to callers who may read the repository root. Do not put sensitive information in withheld path names.
-- `GET /api/v1/tasks`, `/api/v1/ipfs/pins`, and `/api/v1/arweave/anchors` are not repository-gated. Task records include a UCAN token; pin and anchor listings expose object and ref metadata.
-- Changing a repository's visibility controls future serving, but cannot retract ref metadata or configured external pins and anchors already announced while the repository was public. Do not push secrets to an announceable repository.
-- **Impact:** Visibility policies protect the repository and Git content routes they gate, not every metadata endpoint or previously published content.
-- **Remaining boundary:** This read control does not address the independent write-authorization and UCAN-delegation limitations described above.
-
-### Pull-request review enforcement
-- Pull-request review comments are not yet threaded or line-anchored, and merges do not enforce required approvals.
-- **Impact:** Teams must use their own review policy or external controls for merge approval requirements.
-
-### GraphQL mutation coverage
-- Existing GraphQL mutations require an authenticated signer, but a mutation-specific source-level guardrail has not yet been added for future mutations.
-- **Impact:** A new mutation could accidentally omit its signer check without an explicit test fence.
+- Repository records have an `is_public` field and the node exposes `GITLAWB_PUBLIC_READ`, but per-repository private-read enforcement is not wired in the current live release.
+- **Impact:** Do not store private repositories or secrets on public nodes.
+- **Mitigation:** Run isolated nodes for non-public data and restrict network access at the reverse proxy or firewall layer.
+- **Fix target:** v0.2
 
 ### Peer route hardening rollout
 - Peer announce and sync notification routes accept signed requests and verify DID matches when a signature is present.
@@ -111,7 +101,7 @@ These are documented limitations of the current live release. They should be pri
 | Key storage | PKCS#8 PEM, 0600 permissions |
 | Content hashing | SHA-256 via CIDv1 |
 | HTTP Signatures | RFC 9421 (Ed25519 + SHA-256 Content-Digest) |
-| UCAN tokens | Signed JSON object (Ed25519 signature) |
+| UCAN tokens | JWT (Ed25519 signatures) |
 | On-chain | ECDSA secp256k1 (Base L2 / Ethereum) |
 
 ---
@@ -119,7 +109,7 @@ These are documented limitations of the current live release. They should be pri
 ## Threat Model
 
 gitlawb is designed to be secure against:
-- **Unauthenticated writes** — HTTP Signature auth on protected write endpoints; see Known Limitations for owner and capability authorization gaps
+- **Unauthorized writes** — HTTP Signature auth on all write endpoints
 - **Tampered git objects** — CIDv1 content addressing detects modification
 - **Identity spoofing** — DIDs derived from public keys, unforgeable without the private key
 - **Centralized takedown** — no single point of control; data on IPFS + Arweave

ci/gitlawb-core-allowed-deps.txt

@@ -1,112 +0,0 @@
-# Dependency allowlist for the `gitlawb-core` crate.
-#
-# gitlawb-core is the shared-primitives crate every consumer embeds (the `gl`
-# CLI, git-remote-gitlawb, the node daemon). It must stay lean so those
-# consumers do not inherit daemon-weight dependencies. This file is the source
-# of truth for the crates gitlawb-core's NORMAL (non-dev, non-build) transitive
-# dependency closure is allowed to contain. CI (`scripts/check-gitlawb-core-deps.sh`,
-# wired into the `core-deps-purity` job in .github/workflows/pr-checks.yml)
-# fails if gitlawb-core's tree contains any crate not listed here.
-#
-# The allowlist is exhaustive-by-construction: a NEW dependency reds CI whether
-# or not anyone thought to ban it, which a denylist cannot do.
-#
-# Measured in-workspace, so feature unification across the workspace can, in
-# rare cases, surface a crate here that gitlawb-core would not pull standalone.
-# An unexpected new entry is a prompt to check what pulled it in, not noise to
-# rubber-stamp.
-#
-# Regenerate (from repo root, after an INTENTIONAL dependency change):
-#   cargo tree -p gitlawb-core --edges normal --prefix none \
-#     | sed -E 's/ v[0-9].*$//' \
-#     | grep -v '^gitlawb-core$' \
-#     | sort -u
-# then paste the result below this header block. (The checker snapshots and
-# restores Cargo.lock; a manual regen may refresh it — `git checkout Cargo.lock`
-# afterward if you did not intend that.)
-#
-# Lines starting with `#` and blank lines are ignored by the checker.
-aead
-anyhow
-base-x
-base256emoji
-base64
-base64ct
-block-buffer
-cfg-if
-chacha20
-chacha20poly1305
-chrono
-cid
-cipher
-const-oid
-const-str
-core2
-cpufeatures
-crypto-common
-crypto_box
-crypto_secretbox
-curve25519-dalek
-curve25519-dalek-derive
-data-encoding
-data-encoding-macro
-data-encoding-macro-internal
-der
-digest
-ed25519
-ed25519-dalek
-equivalent
-generic-array
-getrandom
-hashbrown
-hex
-iana-time-zone
-indexmap
-inout
-itoa
-libc
-match-lookup
-memchr
-multibase
-multihash
-multihash-codetable
-multihash-derive
-multihash-derive-impl
-num-traits
-opaque-debug
-pem-rfc7468
-pkcs8
-poly1305
-ppv-lite86
-proc-macro-crate
-proc-macro2
-quote
-rand
-rand_chacha
-rand_core
-salsa20
-serde
-serde_core
-serde_derive
-serde_json
-sha2
-signature
-spki
-subtle
-syn
-synstructure
-thiserror
-thiserror-impl
-toml_datetime
-toml_edit
-toml_parser
-typenum
-unicode-ident
-universal-hash
-unsigned-varint
-uuid
-winnow
-zerocopy
-zeroize
-zeroize_derive
-zmij

crates/git-remote-gitlawb/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "git-remote-gitlawb"
 description = "Git remote helper — enables 'git clone gitlawb://did:gitlawb:...'"
-version = "0.7.1" # x-release-please-version
+version = "0.5.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -19,20 +19,3 @@ tracing-subscriber = { workspace = true }
 
 [dev-dependencies]
 mockito = "1"
-tempfile = "3"
-
-[target.'cfg(unix)'.dev-dependencies]
-libc = "0.2"
-
-[target.'cfg(windows)'.dev-dependencies]
-# Job Object bindings for the real_git_fetch harness: the Windows analog of the
-# unix process-group teardown, so the whole `git fetch` tree can be killed
-# together on both the timeout and clean-exit paths (INV-22). Win32_Security is
-# required by CreateJobObjectW, and Win32_System_Threading by
-# JOBOBJECT_EXTENDED_LIMIT_INFORMATION (it embeds IO_COUNTERS).
-windows-sys = { version = "0.61", features = [
-    "Win32_Foundation",
-    "Win32_Security",
-    "Win32_System_JobObjects",
-    "Win32_System_Threading",
-] }

crates/gitlawb-attest/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-attest"
 description = "External Attestation v1: pluggable provenance attachments for gitlawb ref-update certs"
-version = "0.7.1" # x-release-please-version
+version = "0.5.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/gitlawb-attest/src/attestation.rs

@@ -16,7 +16,7 @@
 //! by exact match.
 
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD as B64U, Engine};
-use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
+use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey};
 use serde::{de::DeserializeOwned, Deserialize, Serialize};
 
 use crate::error::{Error, Result};
@@ -111,7 +111,7 @@ impl Attestation {
             .try_into()
             .map_err(|_| Error::Signature("signature must be 64 bytes".to_string()))?;
         let sig = Signature::from_bytes(&sig_bytes);
-        vk.verify_strict(&bytes, &sig)
+        vk.verify(&bytes, &sig)
             .map_err(|e| Error::Signature(format!("ed25519: {e}")))?;
 
         Ok(vk)
@@ -554,39 +554,4 @@ mod tests {
         let err = tampered.verify_signature(cert_hash).unwrap_err();
         assert!(matches!(err, Error::Signature(_)));
     }
-
-    /// Regression guard for strict verification: a signature forged under a
-    /// weak (small-order) public key satisfies the verification equation
-    /// but must be rejected. The identity point is such a key: with R the
-    /// identity and S = 0, [S]B - [k]A is the identity for any message.
-    #[test]
-    fn verify_rejects_weak_key_signature() {
-        let mut weak_key_bytes = [0u8; 32];
-        weak_key_bytes[0] = 1; // compressed identity point (y = 1, x = 0)
-        let weak_vk = VerifyingKey::from_bytes(&weak_key_bytes).unwrap();
-        assert!(weak_vk.is_weak(), "identity point must be a weak key");
-
-        let cert_hash = sample_cert_hash();
-        let mut forged = [0u8; 64];
-        forged[0] = 1; // R = identity point, S = 0
-        let forged_sig = B64U.encode(forged);
-
-        // Build an attestation with the weak key as signer and the forged
-        // signature. The weak-key check happens at verify time.
-        let mut att = dummy_attestation(&SigningKey::generate(&mut OsRng), cert_hash);
-        let mut buf = Vec::with_capacity(ED25519_MULTICODEC.len() + 32);
-        buf.extend_from_slice(&ED25519_MULTICODEC);
-        buf.extend_from_slice(&weak_key_bytes);
-        att.signer = format!(
-            "did:key:{}",
-            multibase::encode(multibase::Base::Base58Btc, &buf)
-        );
-        att.sig = forged_sig;
-
-        let err = att.verify_signature(cert_hash).unwrap_err();
-        assert!(
-            matches!(err, Error::Signature(_)),
-            "signature under a weak (small-order) public key must be rejected"
-        );
-    }
 }

crates/gitlawb-core/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-core"
 description = "Core cryptographic primitives for the gitlawb network: DIDs, CIDs, UCAN, HTTP Signatures, ref-update certificates"
-version = "0.7.1" # x-release-please-version
+version = "0.5.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/gitlawb-core/src/cert.rs

@@ -6,8 +6,6 @@
 //! The schema is frozen at v1. All fields are mandatory for forward compatibility.
 //! Nodes that receive a certificate with an unknown version MUST reject it.
 
-use std::collections::HashSet;
-
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
@@ -137,14 +135,10 @@ impl RefUpdateCert {
 
     /// Check if this certificate satisfies a threshold of valid signatures
     /// from the provided set of authorized maintainer DIDs.
-    ///
-    /// Counts distinct signer DIDs, not signature entries: a repeated
-    /// signature from the same maintainer counts once.
     pub fn satisfies_threshold(&self, maintainers: &[Did], threshold: usize) -> Result<bool> {
         let valid = self.verify_all()?;
-        let distinct_signers: HashSet<&Did> =
-            valid.iter().filter(|d| maintainers.contains(d)).collect();
-        Ok(distinct_signers.len() >= threshold)
+        let count = valid.iter().filter(|d| maintainers.contains(d)).count();
+        Ok(count >= threshold)
     }
 
     /// Validate the certificate structure (not signatures).
@@ -350,33 +344,6 @@ mod tests {
         assert!(!cert.satisfies_threshold(&maintainers, 1).unwrap());
     }
 
-    #[test]
-    fn satisfies_threshold_rejects_duplicated_signature() {
-        let kp1 = Keypair::generate();
-        let kp2 = Keypair::generate();
-        let kp3 = Keypair::generate();
-        let repo_did = kp1.did();
-
-        let mut cert = RefUpdateCert::new(
-            repo_did,
-            "refs/heads/main".to_string(),
-            dummy_hash('0'),
-            dummy_hash('a'),
-            1,
-            &kp1,
-        )
-        .unwrap();
-        // Copy-paste the only real signature onto the certificate a second
-        // time. Same signer, same valid signature, still one real signer.
-        let dup = cert.signatures[0].clone();
-        cert.signatures.push(dup);
-
-        let maintainers = vec![kp1.did(), kp2.did(), kp3.did()];
-        // Two signature entries but a single distinct signer must not
-        // satisfy a 2-of-3 threshold.
-        assert!(!cert.satisfies_threshold(&maintainers, 2).unwrap());
-    }
-
     #[test]
     fn threshold_zero_is_always_satisfied() {
         let kp = Keypair::generate();

crates/gitlawb-core/src/cid.rs

@@ -64,6 +64,19 @@ impl Cid {
     }
 }
 
+/// True when `s` parses as a CIDv1 with the raw codec — the exact shape
+/// [`Cid::from_git_object_bytes`] produces and the `/ipfs` resolver looks up.
+/// A legacy provider CID (Kubo dag-pb, Pinata CIDv0) parses to a different
+/// version or codec and returns `false`, marking it an opportunistic-repair
+/// candidate. Decidable from the string alone (no object bytes), so the pin path
+/// can gate the byte-read/recompute cost on it and leave non-legacy rows at the
+/// existing DB-only skip cost. An unparseable string is non-canonical (`false`).
+pub fn is_raw_cidv1(s: &str) -> bool {
+    s.parse::<CidGeneric<64>>()
+        .map(|c| c.version() == cid::Version::V1 && c.codec() == RAW)
+        .unwrap_or(false)
+}
+
 impl fmt::Display for Cid {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "{}", self.0)
@@ -177,6 +190,38 @@ mod tests {
         assert!(result.is_err());
     }
 
+    #[test]
+    fn is_raw_cidv1_classifies_codec_from_string() {
+        // The canonical resolver key: CIDv1 + raw codec → not a repair candidate.
+        let raw = Cid::from_git_object_bytes(b"blob 5\0hello");
+        assert!(
+            is_raw_cidv1(raw.as_str()),
+            "from_git_object_bytes output is CIDv1/raw"
+        );
+
+        // A CIDv0 (Pinata dag-pb legacy shape) → repair candidate.
+        assert!(
+            !is_raw_cidv1("QmYwAPJzv5CZsnA625s3Xf2nemtYgPpHdWEz79ojWnPbdG"),
+            "a CIDv0 dag-pb value is a legacy-repair candidate"
+        );
+
+        // A CIDv1 with the dag-pb codec (the Kubo above-block-size root) over the
+        // same multihash → still a repair candidate (codec, not just version).
+        let parsed = raw.as_str().parse::<CidGeneric<64>>().unwrap();
+        const DAG_PB: u64 = 0x70;
+        let dagpb = CidGeneric::<64>::new_v1(DAG_PB, *parsed.hash()).to_string();
+        assert!(
+            !is_raw_cidv1(&dagpb),
+            "a CIDv1 dag-pb value is a legacy-repair candidate"
+        );
+
+        // Garbage is non-canonical.
+        assert!(
+            !is_raw_cidv1("not-a-cid"),
+            "an unparseable string is non-canonical"
+        );
+    }
+
     #[test]
     fn sha256_hex_of_empty_input_is_well_known() {
         // SHA-256("") is a fixed constant; verifies the hasher is wired correctly.

crates/gitlawb-core/src/did.rs

@@ -80,19 +80,6 @@ impl Did {
             )));
         }
 
-        // Refuse an oversized id before decoding. base58 decoding is quadratic
-        // in its input, and both callers of this function take the string from
-        // an untrusted request: the unauthenticated peer-announce gate, and the
-        // HTTP-signature keyid. An ed25519 did:key method-id is a fixed 48
-        // characters, so this bound is slack rather than a behavior change, and
-        // it has to sit ahead of the decode to be worth anything.
-        const MAX_METHOD_ID_LEN: usize = 64;
-        if self.method_id().len() > MAX_METHOD_ID_LEN {
-            return Err(Error::InvalidDid(
-                "did:key method-specific id too long".to_string(),
-            ));
-        }
-
         let (_, bytes) =
             multibase::decode(self.method_id()).map_err(|e| Error::InvalidDid(e.to_string()))?;
 
@@ -321,52 +308,4 @@ mod tests {
         assert_eq!(Did::web("example.com").method_id(), "example.com");
         assert_eq!(Did::gitlawb("z6MkSomeKey").method_id(), "z6MkSomeKey");
     }
-
-    /// An oversized method-specific id is refused on its length, before the
-    /// base58 decode runs.
-    ///
-    /// base58 decoding is quadratic in the input, and `to_verifying_key` is
-    /// reached from two places that take an attacker-supplied string: the
-    /// unauthenticated peer-announce gate, and the HTTP-signature keyid. A
-    /// 64k-character DID measured 8s through the router without this guard
-    /// against 4.6ms with it, on a tokio worker with no spawn_blocking, so a
-    /// single caller could buy CPU-seconds by the thousand.
-    ///
-    /// Asserting the MESSAGE is what makes this load-bearing: an oversized id
-    /// errors either way, so a test that only checked `is_err()` would pass
-    /// with the guard removed, having merely paid the cost it exists to avoid.
-    #[test]
-    fn to_verifying_key_rejects_an_oversized_method_id_before_decoding() {
-        let oversized = format!("did:key:z{}", "z".repeat(64_000));
-        let did: Did = oversized.parse().expect("method is still `key`");
-
-        let start = std::time::Instant::now();
-        let err = did.to_verifying_key().expect_err("must be refused");
-        let elapsed = start.elapsed();
-
-        assert!(
-            err.to_string().contains("too long"),
-            "must be refused on length, not after the decode: {err}"
-        );
-        assert!(
-            elapsed < std::time::Duration::from_secs(1),
-            "refusal must not pay the quadratic decode: took {elapsed:?}"
-        );
-    }
-
-    /// The bound must not reject a real key. Every `did:key` this project
-    /// mints is a fixed 48 characters, so the limit is slack, not a behavior
-    /// change.
-    #[test]
-    fn to_verifying_key_still_accepts_a_real_did_key() {
-        use ed25519_dalek::SigningKey;
-        let signing = SigningKey::from_bytes(&[7u8; 32]);
-        let did = Did::from_verifying_key(&signing.verifying_key());
-        assert_eq!(
-            did.method_id().len(),
-            48,
-            "did:key method-id is fixed-width"
-        );
-        did.to_verifying_key().expect("a real did:key must resolve");
-    }
 }

crates/gitlawb-core/src/identity.rs

@@ -78,9 +78,10 @@ impl Keypair {
 
 /// Verify an Ed25519 signature.
 pub fn verify(verifying_key: &VerifyingKey, msg: &[u8], sig_bytes: &[u8; 64]) -> Result<()> {
+    use ed25519_dalek::Verifier;
     let sig = Signature::from_bytes(sig_bytes);
     verifying_key
-        .verify_strict(msg, &sig)
+        .verify(msg, &sig)
         .map_err(|_| Error::SignatureInvalid)
 }
 
@@ -208,28 +209,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn verify_rejects_weak_key_signature() {
-        // Regression guard for strict verification: a signature forged under a
-        // weak (small-order) public key satisfies the verification equation
-        // but must be rejected. The identity point is such a key: with R the
-        // identity and S = 0, [S]B - [k]A is the identity for any message.
-        let mut weak_key_bytes = [0u8; 32];
-        weak_key_bytes[0] = 1; // compressed identity point (y = 1, x = 0)
-        let weak_vk = VerifyingKey::from_bytes(&weak_key_bytes).unwrap();
-        assert!(weak_vk.is_weak(), "identity point must be a weak key");
-
-        let msg = b"forged message";
-        let mut forged = [0u8; 64];
-        forged[0] = 1; // R = identity point, S = 0
-
-        let result = verify(&weak_vk, msg, &forged);
-        assert!(
-            result.is_err(),
-            "signature under a weak (small-order) public key must be rejected"
-        );
-    }
-
     #[test]
     fn signed_payload_round_trip() {
         let kp = Keypair::generate();

crates/gitlawb-core/src/lib.rs

@@ -5,7 +5,6 @@ pub mod encrypt;
 pub mod error;
 pub mod http_sig;
 pub mod identity;
-pub mod sanitize;
 pub mod ucan;
 
 pub use error::Error;

crates/gitlawb-core/src/sanitize.rs

@@ -1,69 +0,0 @@
-//! Text sanitization predicates shared across the workspace.
-//!
-//! Untrusted peer/remote bytes that reach an operator's terminal (node error
-//! bodies, node-advertised strings) must be stripped of BOTH `Cc` control bytes
-//! (`char::is_control()`) AND `Cf` bidi/format controls before display: a
-//! right-to-left override or directional isolate can visually reorder the line
-//! and spoof the text (Trojan Source, CWE-451). This is INV-6.
-//!
-//! `is_bidi_format` is the single workspace definition of the second half of
-//! that obligation. It was split out of `gl`'s local copy so the two terminal
-//! sanitizers that shipped with only the `Cc` half (#183) — and any future
-//! sanitizer — reuse one audited predicate instead of re-deriving the set.
-
-/// True for the Unicode bidirectional/directional-isolate format characters
-/// (the reordering subset of category `Cf`) that can visually reorder a terminal
-/// line. These are NOT matched by [`char::is_control()`], which covers `Cc` only.
-///
-/// This is deliberately the reordering subset, not the whole `Cf` category:
-/// legitimate `Cf` characters such as ZWJ (`U+200D`, emoji sequences) and the
-/// soft hyphen (`U+00AD`) are NOT matched, so honest international text passes
-/// through unchanged. Widening this set is a behavior change for every consumer.
-///
-/// Pair it with `!c.is_control()` in a terminal-bound sanitizer (INV-6); see the
-/// wrappers in `gl`, `git-remote-gitlawb`, and `icaptcha-client`.
-pub fn is_bidi_format(c: char) -> bool {
-    matches!(c,
-        '\u{200E}' | '\u{200F}' | '\u{061C}'   // LRM, RLM, ALM
-        | '\u{202A}'..='\u{202E}'              // LRE, RLE, PDF, LRO, RLO
-        | '\u{2066}'..='\u{2069}'              // LRI, RLI, FSI, PDI
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn strips_every_reordering_code_point() {
-        // Asserted individually so a partial predicate (e.g. one that covers the
-        // marks but not the isolates) fails loudly rather than passing.
-        for c in [
-            '\u{200E}', '\u{200F}', '\u{061C}', // LRM, RLM, ALM
-            '\u{202A}', '\u{202B}', '\u{202C}', '\u{202D}',
-            '\u{202E}', // LRE, RLE, PDF, LRO, RLO
-            '\u{2066}', '\u{2067}', '\u{2068}', '\u{2069}', // LRI, RLI, FSI, PDI
-        ] {
-            assert!(
-                is_bidi_format(c),
-                "U+{:04X} must be a bidi-format char",
-                c as u32
-            );
-        }
-    }
-
-    #[test]
-    fn passes_legitimate_and_control_chars() {
-        // Must NOT over-strip: plain text, a genuine RTL SCRIPT letter (Lo, not a
-        // format char), ZWJ (legitimate Cf), and soft hyphen (legitimate Cf) are
-        // not bidi-format. ESC is a Cc control char — owned by is_control(), not
-        // this predicate, which is bidi-only.
-        for c in ['a', '\u{0627}', '\u{200D}', '\u{00AD}', '\u{1b}'] {
-            assert!(
-                !is_bidi_format(c),
-                "U+{:04X} must NOT be a bidi-format char",
-                c as u32
-            );
-        }
-    }
-}

crates/gitlawb-core/src/ucan.rs

@@ -187,17 +187,11 @@ impl Ucan {
     }
 
     /// Check if this UCAN grants a specific capability on a resource.
-    ///
-    /// Mirrors `Capability::is_attenuated_by`'s wildcard semantics: a stored
-    /// capability of `with: "*"` or `can: "*"` / `"repo/admin"` covers any
-    /// requested resource/action, since a valid delegation chain can produce
-    /// exactly that capability (see `is_attenuated_by`).
     pub fn can(&self, resource: &str, action: &str) -> bool {
-        self.payload.att.iter().any(|cap| {
-            let resource_ok = cap.with == resource || cap.with == "*";
-            let action_ok = cap.can == action || cap.can == "*" || cap.can == caps::REPO_ADMIN;
-            resource_ok && action_ok
-        })
+        self.payload
+            .att
+            .iter()
+            .any(|cap| cap.with == resource && cap.can == action)
     }
 
     /// Encode to a compact JSON string (the wire format).
@@ -318,63 +312,6 @@ mod tests {
         assert!(!ucan.can("gitlawb://repos/test/repo", caps::PR_MERGE));
     }
 
-    #[test]
-    fn can_honors_resource_wildcard() {
-        let issuer = Keypair::generate();
-        let audience = Keypair::generate().did();
-
-        let ucan = Ucan::issue(
-            &issuer,
-            audience,
-            vec![Capability::new("*", caps::GIT_PUSH)],
-            None,
-        )
-        .unwrap();
-
-        assert!(ucan.can("gitlawb://repos/test/repo", caps::GIT_PUSH));
-        assert!(ucan.can("gitlawb://repos/other/repo", caps::GIT_PUSH));
-        assert!(!ucan.can("gitlawb://repos/test/repo", caps::PR_MERGE));
-    }
-
-    #[test]
-    fn can_honors_repo_admin_action_wildcard() {
-        let issuer = Keypair::generate();
-        let audience = Keypair::generate().did();
-
-        let ucan = Ucan::issue(
-            &issuer,
-            audience,
-            vec![Capability::new(
-                "gitlawb://repos/test/repo",
-                caps::REPO_ADMIN,
-            )],
-            None,
-        )
-        .unwrap();
-
-        assert!(ucan.can("gitlawb://repos/test/repo", caps::GIT_PUSH));
-        assert!(ucan.can("gitlawb://repos/test/repo", caps::PR_MERGE));
-        assert!(!ucan.can("gitlawb://repos/other/repo", caps::GIT_PUSH));
-    }
-
-    #[test]
-    fn can_honors_action_wildcard() {
-        let issuer = Keypair::generate();
-        let audience = Keypair::generate().did();
-
-        let ucan = Ucan::issue(
-            &issuer,
-            audience,
-            vec![Capability::new("gitlawb://repos/test/repo", "*")],
-            None,
-        )
-        .unwrap();
-
-        assert!(ucan.can("gitlawb://repos/test/repo", caps::GIT_PUSH));
-        assert!(ucan.can("gitlawb://repos/test/repo", caps::PR_MERGE));
-        assert!(!ucan.can("gitlawb://repos/other/repo", caps::GIT_PUSH));
-    }
-
     #[test]
     fn bootstrap_ucan() {
         let issuer = Keypair::generate();

crates/gitlawb-node/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "gitlawb-node"
 description = "The gitlawb node daemon — git hosting over HTTP with DID auth"
-version = "0.7.1" # x-release-please-version
+version = "0.5.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -77,6 +77,3 @@ libp2p-dns = { version = "0.44.0", features = ["tokio"] }
 [dev-dependencies]
 mockito = "1"
 tempfile = "3"
-# `test-util` for `#[tokio::test(start_paused = true)]`: lets the deadline tests assert
-# on which timer fired instead of on wall clock.
-tokio = { workspace = true, features = ["test-util"] }

crates/gitlawb-node/src/api/arweave.rs

@@ -26,61 +26,14 @@ pub async fn list_anchors(
     Query(q): Query<ListAnchorsQuery>,
 ) -> Result<Json<serde_json::Value>> {
     let limit = q.limit.min(200);
-    // Bare `?` so connection-class sqlx failures downcast to `AppError::Db` and
-    // map to 503 `db_unavailable` (not 500 via `.map_err(AppError::Internal)`) (#251).
     let anchors = state
         .db
         .list_arweave_anchors(q.repo.as_deref(), limit)
-        .await?;
+        .await
+        .map_err(crate::error::AppError::Internal)?;
 
     Ok(Json(serde_json::json!({
         "anchors": anchors,
         "count": anchors.len(),
     })))
 }
-
-#[cfg(test)]
-mod closed_pool_tests {
-    use super::*;
-    use axum::http::{Request, StatusCode};
-    use axum::Router;
-    use serde_json::Value;
-    use sqlx::PgPool;
-    use tower::ServiceExt;
-
-    /// #251: a closed pool on /api/v1/arweave/anchors must be 503 db_unavailable.
-    #[sqlx::test]
-    async fn list_anchors_closed_pool_returns_503_db_unavailable(pool: PgPool) {
-        let state = crate::test_support::test_state(pool.clone()).await;
-        pool.close().await;
-
-        let resp = Router::new()
-            .route("/api/v1/arweave/anchors", axum::routing::get(list_anchors))
-            .with_state(state)
-            .oneshot(
-                Request::builder()
-                    .uri("/api/v1/arweave/anchors")
-                    .body(axum::body::Body::empty())
-                    .unwrap(),
-            )
-            .await
-            .unwrap();
-
-        assert_eq!(
-            resp.status(),
-            StatusCode::SERVICE_UNAVAILABLE,
-            "closed-pool outage must be retryable 503, not 500"
-        );
-        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
-            .await
-            .expect("read body");
-        let v: Value = serde_json::from_slice(&bytes).expect("json body");
-        assert_eq!(
-            v,
-            serde_json::json!({
-                "error": crate::error::DB_UNAVAILABLE_CODE,
-                "message": crate::error::DB_UNAVAILABLE_MESSAGE,
-            })
-        );
-    }
-}

crates/gitlawb-node/src/api/events.rs

@@ -138,33 +138,9 @@ pub async fn list_ref_updates(
     let caller = auth.as_ref().map(|e| e.0 .0.as_str());
     let updates = collect_visible_ref_updates(&state.db, None, limit, caller).await?;
 
-    // Resolve the trusted display owner_did per row. The stored wire value is
-    // untrusted (arrives over gossip / unsigned peer notify), so it is echoed
-    // only when it matches the canonical owner of the local repo the slug
-    // names (#P1); legacy None rows are attributed via an exact unique local
-    // match (#P3). Both surfaces share this resolver so they cannot drift.
-    // The batch resolver issues at most one query per distinct local repo
-    // rather than one per event row (#P2).
-    let raw_dids: Vec<Option<String>> = state
-        .db
-        .resolve_ref_update_owner_dids(
-            &updates
-                .iter()
-                .map(|u| (u.repo.as_str(), u.owner_did.as_deref()))
-                .collect::<Vec<_>>(),
-        )
-        .await?;
-
-    let owner_dids: Vec<serde_json::Value> = raw_dids
-        .into_iter()
-        .map(|o| o.map_or(serde_json::Value::Null, |s| serde_json::json!(s)))
-        .collect();
-
     let events: Vec<serde_json::Value> = updates
         .iter()
-        .enumerate()
-        .map(|(i, u)| {
-            let owner_did = owner_dids[i].clone();
+        .map(|u| {
             serde_json::json!({
                 "id":          u.id,
                 "node_did":    u.node_did,
@@ -177,7 +153,6 @@ pub async fn list_ref_updates(
                 "cert_id":     u.cert_id,
                 "received_at": u.received_at,
                 "from_peer":   u.from_peer,
-                "owner_did":   owner_did,
             })
         })
         .collect();
@@ -250,7 +225,6 @@ pub async fn list_repo_events(
                 "pusher_did": c.pusher_did,
                 "node_did":   c.node_did,
                 "timestamp":  c.issued_at,
-                "owner_did":  record.owner_did,
                 "source":     "local",
             })
         })
@@ -266,46 +240,28 @@ pub async fn list_repo_events(
     // collect_visible_ref_updates drops any row whose slug matches a local repo the
     // caller cannot read (fail-closed), and propagates DB errors instead of swallowing
     // them.
-    let gossip_updates =
-        collect_visible_ref_updates(&state.db, Some(&repo_id_str), limit, caller).await?;
-    let gossip_raw: Vec<Option<String>> = state
-        .db
-        .resolve_ref_update_owner_dids(
-            &gossip_updates
-                .iter()
-                .map(|u| (u.repo.as_str(), u.owner_did.as_deref()))
-                .collect::<Vec<_>>(),
-        )
-        .await?;
-
-    let gossip_owner_dids: Vec<serde_json::Value> = gossip_raw
-        .into_iter()
-        .map(|o| o.map_or(serde_json::Value::Null, |s| serde_json::json!(s)))
-        .collect();
-
-    let gossip_events: Vec<serde_json::Value> = gossip_updates
-        .iter()
-        .enumerate()
-        .map(|(i, u)| {
-            let owner_did = gossip_owner_dids[i].clone();
-            serde_json::json!({
-                "type":        "gossipsub",
-                "id":          u.id,
-                "repo":        u.repo,
-                "ref_name":    u.ref_name,
-                "old_sha":     u.old_sha,
-                "new_sha":     u.new_sha,
-                "pusher_did":  u.pusher_did,
-                "node_did":    u.node_did,
-                "timestamp":   u.timestamp,
-                "cert_id":     u.cert_id,
-                "received_at": u.received_at,
-                "from_peer":   u.from_peer,
-                "owner_did":   owner_did,
-                "source":      "gossipsub",
+    let gossip_events: Vec<serde_json::Value> =
+        collect_visible_ref_updates(&state.db, Some(&repo_id_str), limit, caller)
+            .await?
+            .iter()
+            .map(|u| {
+                serde_json::json!({
+                    "type":        "gossipsub",
+                    "id":          u.id,
+                    "repo":        u.repo,
+                    "ref_name":    u.ref_name,
+                    "old_sha":     u.old_sha,
+                    "new_sha":     u.new_sha,
+                    "pusher_did":  u.pusher_did,
+                    "node_did":    u.node_did,
+                    "timestamp":   u.timestamp,
+                    "cert_id":     u.cert_id,
+                    "received_at": u.received_at,
+                    "from_peer":   u.from_peer,
+                    "source":      "gossipsub",
+                })
             })
-        })
-        .collect();
+            .collect();
 
     // Merge both lists
     let mut all_events: Vec<serde_json::Value> = cert_events;
@@ -370,7 +326,6 @@ mod ref_updates_feed_tests {
             cert_id: None,
             received_at: Utc::now().to_rfc3339(),
             from_peer: "peer1".into(),
-            owner_did: None,
         }
     }
 
@@ -1150,14 +1105,7 @@ mod ref_updates_feed_tests {
             .await
             .unwrap();
         assert_eq!(resp.status(), StatusCode::OK);
-        let body = body_json(resp).await;
-        assert_eq!(count(&body), 2);
-        for event in body["events"].as_array().unwrap() {
-            assert_eq!(
-                event["owner_did"], OWNER,
-                "each event must carry the local owner_did"
-            );
-        }
+        assert_eq!(count(&body_json(resp).await), 2);
     }
 
     // Anon reads a quarantined mirror → 404 (withheld without disclosing existence
@@ -1440,8 +1388,7 @@ mod ref_updates_feed_tests {
 
     // A DB error in the gate fails closed as 500, not swallowed into an empty 200 (the
     // regression the old get_repo().ok().flatten() allowed). Inject by dropping a
-    // column get_repo selects so its query errors. Also pin the anonymous body to
-    // the exact opaque object (#226).
+    // column get_repo selects so its query errors.
     #[sqlx::test]
     async fn repo_events_db_error_fails_closed_500(pool: PgPool) {
         let state = test_state(pool.clone()).await;
@@ -1464,18 +1411,6 @@ mod ref_updates_feed_tests {
             StatusCode::INTERNAL_SERVER_ERROR,
             "a DB error must fail closed (500), never serve an empty 200"
         );
-        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
-            .await
-            .expect("read body");
-        let body = String::from_utf8_lossy(&body);
-        let v: serde_json::Value = serde_json::from_str(&body).expect("json body");
-        assert_eq!(
-            v,
-            serde_json::json!({
-                "error": "db_error",
-                "message": crate::error::DB_ERROR_MESSAGE,
-            })
-        );
     }
 
     // Symmetric to the gate DB-error test: a DB error in the CERT fetch (after the gate

crates/gitlawb-node/src/api/issues.rs

@@ -61,11 +61,14 @@ pub async fn create_issue(
     let json_str = serde_json::to_string(&issue)
         .map_err(|e| AppError::BadRequest(format!("serialization error: {e}")))?;
 
+    // Shed 503 + Retry-After on an exhausted write-lock POOL instead of a generic
+    // git 500 (#173 F1). This path holds no admission permit, so it reaches the pool
+    // unthrottled; reuse the push handler's mapping so the two cannot drift.
     let guard = state
         .repo_store
         .acquire_write(&record.owner_did, &record.name)
         .await
-        .map_err(|e| AppError::Git(e.to_string()))?;
+        .map_err(|e| crate::api::repos::acquire_write_app_error(&e, &repo))?;
     let disk_path = guard.path().to_path_buf();
 
     let create_result = git_issues::create_issue(&disk_path, &issue_id, &json_str);
@@ -229,11 +232,13 @@ pub async fn close_issue(
         .await?
         .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
 
+    // Same capacity shed as create_issue above (#173 F1): an exhausted write-lock
+    // pool is a 503 + Retry-After, not a 500 git error.
     let guard = state
         .repo_store
         .acquire_write(&record.owner_did, &record.name)
         .await
-        .map_err(|e| AppError::Git(e.to_string()))?;
+        .map_err(|e| crate::api::repos::acquire_write_app_error(&e, &repo))?;
     let disk_path = guard.path().to_path_buf();
 
     // Owner OR issue author may close. The author lives in the issue's git-JSON
@@ -279,3 +284,168 @@ pub async fn close_issue(
 
     Ok(Json(issue))
 }
+
+/// #173 F1 follow-up: the two issue write paths reach `acquire_write` holding NO
+/// admission permit (unlike the push handler, which is capped by the git-push
+/// semaphore), so they are the callers most likely to meet an exhausted write-lock
+/// POOL under load. An exhausted pool is a capacity signal, so both must shed
+/// 503 + Retry-After (`AppError::Overloaded`) the way the push handler does, not
+/// report the generic 500 git error that says nothing about retrying.
+#[cfg(test)]
+mod lock_pool_shed_tests {
+    use super::*;
+    use axum::response::IntoResponse;
+    use sqlx::PgPool;
+
+    fn seed_repo(owner_did: &str, name: &str) -> crate::db::RepoRecord {
+        let now = Utc::now();
+        crate::db::RepoRecord {
+            id: Uuid::new_v4().to_string(),
+            name: name.to_string(),
+            owner_did: owner_did.to_string(),
+            description: None,
+            is_public: true,
+            default_branch: "main".to_string(),
+            created_at: now,
+            updated_at: now,
+            disk_path: format!("/tmp/{name}"),
+            forked_from: None,
+            machine_id: None,
+        }
+    }
+
+    /// State whose repo store draws write locks from a ONE-connection pool with a
+    /// short checkout timeout, so a single held guard exhausts it promptly rather
+    /// than at the pool default.
+    async fn one_connection_lock_pool_state(pool: &PgPool) -> AppState {
+        let mut state = crate::test_support::test_state(pool.clone()).await;
+        state.repo_store = crate::git::repo_store::RepoStore::new(
+            std::path::PathBuf::from("/tmp/gitlawb-issues-lockpool"),
+            None,
+            crate::git::repo_store::build_lock_pool(pool, 1, std::time::Duration::from_secs(1)),
+        );
+        state
+    }
+
+    /// The shed must be a real 503 carrying Retry-After, not just an internal enum
+    /// variant: assert on the rendered response so a remapping of `Overloaded` is
+    /// caught here too.
+    fn assert_sheds_503_with_retry_after(err: AppError, what: &str) {
+        let resp = err.into_response();
+        assert_eq!(
+            resp.status(),
+            StatusCode::SERVICE_UNAVAILABLE,
+            "{what}: an exhausted write-lock pool must shed 503, not a 500 git error"
+        );
+        assert_eq!(
+            resp.headers()
+                .get("retry-after")
+                .map(|v| v.to_str().unwrap()),
+            Some("1"),
+            "{what}: a capacity shed must tell the client when to retry"
+        );
+    }
+
+    /// RED-before/GREEN-after for `create_issue`. Both directions: the shed while the
+    /// only lock-pool connection is held by a guard on a DIFFERENT repo (so this is
+    /// pool capacity, not advisory-lock contention on this repo), and the must-not
+    /// case once that connection is back.
+    #[sqlx::test]
+    async fn create_issue_lock_pool_exhaustion_sheds_503_not_500(pool: PgPool) {
+        let owner = "did:key:zISSUECREATELOCKPOOLAAAAAAAAAAAAAAAAAAAA";
+        let state = one_connection_lock_pool_state(&pool).await;
+        state
+            .db
+            .create_repo(&seed_repo(owner, "lp-create"))
+            .await
+            .expect("seed repo");
+
+        let held = state
+            .repo_store
+            .acquire_write(owner, "other-repo")
+            .await
+            .expect("the first write takes the only lock-pool connection");
+
+        let shed = create_issue(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((owner.to_string(), "lp-create".to_string())),
+            Json(CreateIssueRequest {
+                title: "t".to_string(),
+                body: None,
+                signed_payload: None,
+            }),
+        )
+        .await;
+        let err = shed.expect_err("an exhausted lock pool must fail the call");
+        assert_sheds_503_with_retry_after(err, "create_issue");
+
+        // MUST-NOT: with the pool free again the call is not shed as capacity (it
+        // fails later on the nonexistent on-disk repo, which is a git 500).
+        held.release(false).await;
+        let admitted = create_issue(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((owner.to_string(), "lp-create".to_string())),
+            Json(CreateIssueRequest {
+                title: "t".to_string(),
+                body: None,
+                signed_payload: None,
+            }),
+        )
+        .await;
+        assert!(
+            !matches!(admitted, Err(AppError::Overloaded(_))),
+            "with the lock pool free, create_issue must not be shed as capacity; got {:?}",
+            admitted.err()
+        );
+    }
+
+    /// RED-before/GREEN-after for `close_issue`, same two directions.
+    #[sqlx::test]
+    async fn close_issue_lock_pool_exhaustion_sheds_503_not_500(pool: PgPool) {
+        let owner = "did:key:zISSUECLOSELOCKPOOLBBBBBBBBBBBBBBBBBBBBB";
+        let state = one_connection_lock_pool_state(&pool).await;
+        state
+            .db
+            .create_repo(&seed_repo(owner, "lp-close"))
+            .await
+            .expect("seed repo");
+
+        let held = state
+            .repo_store
+            .acquire_write(owner, "other-repo")
+            .await
+            .expect("the first write takes the only lock-pool connection");
+
+        let shed = close_issue(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((
+                owner.to_string(),
+                "lp-close".to_string(),
+                "deadbeef".to_string(),
+            )),
+        )
+        .await;
+        let err = shed.expect_err("an exhausted lock pool must fail the call");
+        assert_sheds_503_with_retry_after(err, "close_issue");
+
+        held.release(false).await;
+        let admitted = close_issue(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((
+                owner.to_string(),
+                "lp-close".to_string(),
+                "deadbeef".to_string(),
+            )),
+        )
+        .await;
+        assert!(
+            !matches!(admitted, Err(AppError::Overloaded(_))),
+            "with the lock pool free, close_issue must not be shed as capacity; got {:?}",
+            admitted.err()
+        );
+    }
+}

crates/gitlawb-node/src/api/labels.rs

@@ -71,10 +71,6 @@ pub async fn remove_label(
 }
 
 /// GET /api/v1/repos/:owner/:repo/labels
-///
-/// Read-visibility-gated (INV-2 root listing): a public repo's labels stay
-/// anonymously listable; a private repo's label names are hidden (404) from
-/// anyone who cannot read it at the root.
 pub async fn list_labels(
     State(state): State<AppState>,
     Path((owner, name)): Path<(String, String)>,

crates/gitlawb-node/src/api/mod.rs

@@ -172,7 +172,6 @@ mod authz_guard {
         let issues = include_str!("issues.rs");
         let bounties = include_str!("bounties.rs");
         let replicas = include_str!("replicas.rs");
-        let events = include_str!("events.rs");
         let tasks = include_str!("tasks.rs");
         let stars = include_str!("stars.rs");
         let protect = include_str!("protect.rs");
@@ -188,13 +187,6 @@ mod authz_guard {
             (pulls, "merge_pr", "require_repo_owner("),
             (webhooks, "create_webhook", "require_repo_owner("),
             (webhooks, "delete_webhook", "require_repo_owner("),
-            // Bucket A/B hybrid — list_webhooks is read-visibility THEN owner:
-            // authorize_repo_read 404s a non-reader of a private repo, then
-            // require_repo_owner 403s a non-owner of a public one. Both halves
-            // are pinned: the authorize_repo_read marker guards the read half
-            // (existence hiding) and require_repo_owner guards the owner half.
-            (webhooks, "list_webhooks", "authorize_repo_read("),
-            (webhooks, "list_webhooks", "require_repo_owner("),
             (labels, "add_label", "require_repo_owner("),
             (labels, "remove_label", "require_repo_owner("),
             // Bucket A' — owner OR author (did_matches against the author)
@@ -208,15 +200,11 @@ mod authz_guard {
             (issues, "create_issue", "authorize_repo_read("),
             (bounties, "create_bounty", "authorize_repo_read("),
             (repos, "fork_repo", "authorize_repo_read("),
-            // get_by_cid gates each iterated repo row directly via visibility_check
-            // (KTD2a: it must NOT route through authorize_repo_read's fuzzy re-resolve).
-            (ipfs, "get_by_cid", "visibility_check("),
-            // #94 sibling read surfaces: gate private-repo metadata on read
-            // visibility (public repos stay anonymous; private repos 404).
-            (replicas, "list_replicas", "authorize_repo_read("),
-            (protect, "list_protected_branches", "authorize_repo_read("),
-            (labels, "list_labels", "authorize_repo_read("),
-            (events, "list_repo_events", "authorize_repo_read("),
+            // get_by_cid resolves each candidate (provenance path + legacy scan) through
+            // the shared `gate_and_serve` (#173 round 2); the gate markers themselves are
+            // asserted below. This row proves the delegation is real — the gate is
+            // actually reached, not dead code.
+            (ipfs, "get_by_cid", "gate_and_serve("),
             // Bucket C — signer-self: the acting DID is matched/bound to auth.0
             (tasks, "create_task", "did_matches("),
             (tasks, "claim_task", "did_matches("),
@@ -250,6 +238,22 @@ mod authz_guard {
             "visibility::require_owner must use did_matches for DID-safe owner matching"
         );
 
+        // The CID read surface (#173) enforces its gate inside the shared
+        // `gate_and_serve`, which BOTH the provenance path and the legacy scan call, so
+        // the markers must live there (the get_by_cid row above only proves delegation).
+        // The repo's own "/" visibility check (KTD2a — never authorize_repo_read's fuzzy
+        // re-resolve) and the quarantine hard-drop BEFORE visibility (INV-11) are both
+        // load-bearing: removing either re-opens a leak on the provenance path.
+        let gate_body = fn_body(ipfs, "gate_and_serve");
+        assert!(
+            gate_body.contains("visibility_check("),
+            "gate_and_serve must gate the CID read surface via visibility_check (KTD2a)"
+        );
+        assert!(
+            gate_body.contains("if quarantined"),
+            "gate_and_serve must hard-drop a quarantined repo before the visibility gate (INV-11)"
+        );
+
         for (src, func, marker) in rows {
             let body = fn_body(src, func);
             assert!(
@@ -523,7 +527,11 @@ mod authz_guard {
 
         // Repo-scoped reads known to be ungated today, each tracked by an issue.
         // Remove an entry the moment its gate lands (the staleness assert enforces it).
-        let known_ungated: &[(&str, &str)] = &[];
+        let known_ungated: &[(&str, &str)] = &[
+            ("list_webhooks", "#94 (PR #113)"),
+            ("list_replicas", "PR #113"),
+            ("list_protected_branches", "PR #113"),
+        ];
         let is_known = |n: &str| known_ungated.iter().any(|(k, _)| *k == n);
         // Any one of these = the handler binds the caller to an authz decision: the
         // first two are read gates, the rest are the write/owner/self-binding forms.

crates/gitlawb-node/src/api/protect.rs

@@ -79,14 +79,12 @@ pub async fn unprotect_branch(
 pub async fn list_protected_branches(
     State(state): State<AppState>,
     Path((owner, repo)): Path<(String, String)>,
-    auth: Option<Extension<AuthenticatedDid>>,
 ) -> Result<Json<serde_json::Value>> {
-    // Read-visibility-gated (INV-2 root listing): a public repo's protected
-    // branches stay anonymously listable; a private repo's branch names are
-    // hidden (404) from anyone who cannot read it at the root.
-    let caller = auth.as_ref().map(|e| e.0 .0.as_str());
-    let (record, _rules) =
-        crate::api::authorize_repo_read(&state, &owner, &repo, caller, "/").await?;
+    let record = state
+        .db
+        .get_repo(&owner, &repo)
+        .await?
+        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
 
     let branches = state.db.list_protected_branches(&record.id).await?;
 

crates/gitlawb-node/src/api/pulls.rs

@@ -209,11 +209,14 @@ pub async fn merge_pr(
         return Err(AppError::BadRequest(format!("PR is already {}", pr.status)));
     }
 
+    // Shed 503 + Retry-After on an exhausted write-lock POOL instead of a generic
+    // git 500 (#173 F1). Merging holds no admission permit, so it reaches the pool
+    // unthrottled; reuse the push handler's mapping so the two cannot drift.
     let guard = state
         .repo_store
         .acquire_write(&record.owner_did, &record.name)
         .await
-        .map_err(|e| AppError::Git(e.to_string()))?;
+        .map_err(|e| crate::api::repos::acquire_write_app_error(&e, &name))?;
     let disk_path = guard.path().to_path_buf();
     let merger_did = auth.0;
     let merge_result = store::merge_branch(
@@ -424,3 +427,116 @@ pub async fn list_comments(
     let comments = state.db.list_pr_comments(&pr.id).await?;
     Ok(Json(serde_json::json!({ "comments": comments })))
 }
+
+/// #173 F1 follow-up: `merge_pr` reaches `acquire_write` holding NO admission permit
+/// (unlike the push handler, which is capped by the git-push semaphore), so it is one
+/// of the callers most likely to meet an exhausted write-lock POOL under load. An
+/// exhausted pool is a capacity signal, so the merge must shed 503 + Retry-After
+/// (`AppError::Overloaded`) the way the push handler does, not report the generic
+/// 500 git error that says nothing about retrying.
+#[cfg(test)]
+mod lock_pool_shed_tests {
+    use super::*;
+    use axum::response::IntoResponse;
+    use sqlx::PgPool;
+
+    fn seed_repo(owner_did: &str, name: &str) -> crate::db::RepoRecord {
+        let now = Utc::now();
+        crate::db::RepoRecord {
+            id: Uuid::new_v4().to_string(),
+            name: name.to_string(),
+            owner_did: owner_did.to_string(),
+            description: None,
+            is_public: true,
+            default_branch: "main".to_string(),
+            created_at: now,
+            updated_at: now,
+            disk_path: format!("/tmp/{name}"),
+            forked_from: None,
+            machine_id: None,
+        }
+    }
+
+    /// RED-before/GREEN-after for `merge_pr`. Both directions: the shed while the only
+    /// lock-pool connection is held by a guard on a DIFFERENT repo (so this is pool
+    /// capacity, not advisory-lock contention on this repo), and the must-not case
+    /// once that connection is back.
+    #[sqlx::test]
+    async fn merge_pr_lock_pool_exhaustion_sheds_503_not_500(pool: PgPool) {
+        let owner = "did:key:zMERGELOCKPOOLOWNERAAAAAAAAAAAAAAAAAAAAA";
+        let mut state = crate::test_support::test_state(pool.clone()).await;
+        // One lock-pool connection with a short checkout timeout, so a single held
+        // guard exhausts it promptly rather than at the pool default.
+        state.repo_store = crate::git::repo_store::RepoStore::new(
+            std::path::PathBuf::from("/tmp/gitlawb-pulls-lockpool"),
+            None,
+            crate::git::repo_store::build_lock_pool(&pool, 1, std::time::Duration::from_secs(1)),
+        );
+
+        let repo = seed_repo(owner, "lp-merge");
+        let repo_id = repo.id.clone();
+        state.db.create_repo(&repo).await.expect("seed repo");
+        let now = Utc::now().to_rfc3339();
+        state
+            .db
+            .create_pr(&PullRequest {
+                id: Uuid::new_v4().to_string(),
+                repo_id: repo_id.clone(),
+                number: 1,
+                title: "lp".to_string(),
+                body: None,
+                author_did: owner.to_string(),
+                source_branch: "feature".to_string(),
+                target_branch: "main".to_string(),
+                status: "open".to_string(),
+                merged_by_did: None,
+                merged_at: None,
+                created_at: now.clone(),
+                updated_at: now,
+            })
+            .await
+            .expect("seed open PR");
+
+        let held = state
+            .repo_store
+            .acquire_write(owner, "other-repo")
+            .await
+            .expect("the first write takes the only lock-pool connection");
+
+        let shed = merge_pr(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((owner.to_string(), "lp-merge".to_string(), 1)),
+        )
+        .await;
+        let err = shed.expect_err("an exhausted lock pool must fail the call");
+        let resp = err.into_response();
+        assert_eq!(
+            resp.status(),
+            StatusCode::SERVICE_UNAVAILABLE,
+            "merge_pr: an exhausted write-lock pool must shed 503, not a 500 git error"
+        );
+        assert_eq!(
+            resp.headers()
+                .get("retry-after")
+                .map(|v| v.to_str().unwrap()),
+            Some("1"),
+            "merge_pr: a capacity shed must tell the client when to retry"
+        );
+
+        // MUST-NOT: with the pool free again the merge is not shed as capacity (it
+        // fails later on the nonexistent on-disk repo, which is a git 500).
+        held.release(false).await;
+        let admitted = merge_pr(
+            State(state.clone()),
+            Extension(AuthenticatedDid(owner.to_string())),
+            Path((owner.to_string(), "lp-merge".to_string(), 1)),
+        )
+        .await;
+        assert!(
+            !matches!(admitted, Err(AppError::Overloaded(_))),
+            "with the lock pool free, merge_pr must not be shed as capacity; got {:?}",
+            admitted.err()
+        );
+    }
+}

crates/gitlawb-node/src/api/replicas.rs

@@ -113,17 +113,16 @@ pub async fn unregister_replica(
 }
 
 /// GET /api/v1/repos/:owner/:repo/replicas
-/// Read-visibility-gated: a PUBLIC repo's replica list stays anonymously
-/// listable (mirror-discovery), but a PRIVATE repo's replica URLs are hidden
-/// (404) from anyone who cannot read the repo at its root.
+/// Public — returns the list of replicas (DID + URL + registration timestamp).
 pub async fn list_replicas(
     State(state): State<AppState>,
     Path((owner, repo)): Path<(String, String)>,
-    auth: Option<Extension<AuthenticatedDid>>,
 ) -> Result<Json<serde_json::Value>> {
-    let caller = auth.as_ref().map(|e| e.0 .0.as_str());
-    let (record, _rules) =
-        crate::api::authorize_repo_read(&state, &owner, &repo, caller, "/").await?;
+    let record = state
+        .db
+        .get_repo(&owner, &repo)
+        .await?
+        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{repo}")))?;
 
     let replicas = state.db.list_replicas(&record.id).await?;
 

crates/gitlawb-node/src/api/webhooks.rs

@@ -1,8 +1,8 @@
 //! Webhook CRUD API.
 //!
-//! POST   /api/v1/repos/:owner/:repo/hooks        — create (owner only)
-//! GET    /api/v1/repos/:owner/:repo/hooks        — list (owner only; auth required)
-//! DELETE /api/v1/repos/:owner/:repo/hooks/:id   — delete (owner only)
+//! POST   /api/v1/repos/:owner/:repo/hooks        — create (auth required)
+//! GET    /api/v1/repos/:owner/:repo/hooks        — list
+//! DELETE /api/v1/repos/:owner/:repo/hooks/:id   — delete (auth required)
 
 use axum::extract::{Extension, Path, State};
 use axum::http::StatusCode;
@@ -73,26 +73,12 @@ pub async fn create_webhook(
 pub async fn list_webhooks(
     State(state): State<AppState>,
     Path((owner, name)): Path<(String, String)>,
-    auth: Option<Extension<AuthenticatedDid>>,
 ) -> Result<Json<serde_json::Value>> {
-    // This route sits on `optional_signature`, so the DID is optional. Webhook
-    // callback URLs are owner-secret config and there is no anonymous form, so a
-    // headerless caller is rejected before any lookup (401, which fires for an
-    // existing-private and an absent repo alike, so it leaks no existence).
-    let Some(Extension(AuthenticatedDid(caller))) = auth else {
-        return Err(AppError::Unauthorized(
-            "listing webhooks requires authentication".into(),
-        ));
-    };
-
-    // Read-visibility first, then owner. authorize_repo_read returns 404 on a
-    // visibility deny, so a non-reader of a private repo cannot tell it exists
-    // (uniform with the sibling read surfaces); require_repo_owner then yields
-    // 403 only for a non-owner of a public/readable repo, where existence is not
-    // secret.
-    let (record, _rules) =
-        crate::api::authorize_repo_read(&state, &owner, &name, Some(&caller), "/").await?;
-    crate::api::require_repo_owner(&record, &caller)?;
+    let record = state
+        .db
+        .get_repo(&owner, &name)
+        .await?
+        .ok_or_else(|| AppError::RepoNotFound(format!("{owner}/{name}")))?;
 
     let hooks = state.db.list_webhooks(&record.id).await?;
     // Redact secrets in list response

crates/gitlawb-node/src/auth/mod.rs

@@ -516,6 +516,11 @@ mod tests {
             rate_limiter: RateLimiter::new(100, Duration::from_secs(60)),
             create_ip_rate_limiter: RateLimiter::new(1000, Duration::from_secs(3600)),
             push_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
+            ipfs_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
+            ipfs_work_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
+            ipfs_max_history_walks: crate::api::ipfs::MAX_HISTORY_WALKS_PER_REQUEST,
+            ipfs_max_legacy_probes: crate::api::ipfs::MAX_LEGACY_PROBES_PER_REQUEST,
+            ipfs_max_served_object_bytes: crate::api::ipfs::MAX_SERVED_OBJECT_BYTES,
             push_limiter_trust: crate::rate_limit::TrustedProxy::None,
             sync_trigger_rate_limiter: RateLimiter::new(60, Duration::from_secs(3600)),
             peer_write_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
@@ -524,9 +529,7 @@ mod tests {
             git_write_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
             git_push_advert_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
             git_encrypt_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
-            pin_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
             encrypt_inflight: crate::state::EncryptInflight::new(),
-            repo_write_leases: crate::state::RepoWriteLeases::new(8),
             git_read_per_caller: crate::rate_limit::PerCallerConcurrency::with_default_max_keys(16),
             git_push_advert_per_caller:
                 crate::rate_limit::PerCallerConcurrency::with_default_max_keys(8),
@@ -534,7 +537,6 @@ mod tests {
             git_ipfs_walk_semaphore: Arc::new(tokio::sync::Semaphore::new(64)),
             git_ipfs_walk_per_caller:
                 crate::rate_limit::PerCallerConcurrency::with_default_max_keys(16),
-            ipfs_rate_limiter: RateLimiter::new(600, Duration::from_secs(3600)),
             git_bin: "git".to_string(),
         }
     }

crates/gitlawb-node/src/config.rs

@@ -1,33 +1,6 @@
 use clap::Parser;
 use std::path::PathBuf;
 
-/// Upper bound on `git_service_timeout_secs` and `ipfs_request_budget_secs`, in seconds
-/// (100 years).
-///
-/// Two consumers now, so a future tightening moves both. `ipfs_request_budget_secs`
-/// derives only the `Instant` addition in `get_by_cid`, not the lease-steal multiply
-/// below, but it shares this ceiling because the defect class and the "set it very large
-/// to disable" contract are the same.
-///
-/// The knob is not just stored, it is arithmetic input: the write path derives the
-/// per-repo lease steal bound from it (`* 2 + 60`), and #174 routed it into
-/// `build_filtered_pack` and `blob_paths`, which each build a deadline as
-/// `Instant::now() + Duration::from_secs(this)`. That addition panics on overflow in
-/// RELEASE as well as debug, so an unbounded `u64` here turns an operator typo into a
-/// serve-path crash rather than a very long timeout. Bounding at parse time keeps every
-/// derived duration in range at once, instead of hardening each site as it is found.
-///
-/// The ceiling is representability, NOT a policy view of a sane timeout, and that
-/// distinction is what sets the number. The help text has always told operators to set
-/// this very large to disable the bound, so values like `999999999` (~31 years) are
-/// working production "off" settings; a tighter, tidier cap would fail those nodes at
-/// boot on upgrade over a value that was never the defect. 100 years clears every such
-/// setting while staying a factor of about 5.85 under the ~584-year ceiling of a
-/// `u64`-nanosecond `Instant`, which is the tightest representation on any platform we
-/// build for. Every value that worked before still parses; only the ones that would have
-/// panicked are rejected.
-pub const GIT_SERVICE_TIMEOUT_SECS_MAX: u64 = 100 * 365 * 24 * 60 * 60;
-
 #[derive(Parser, Debug, Clone)]
 #[command(name = "gitlawb-node", about = "gitlawb node daemon", version)]
 pub struct Config {
@@ -197,19 +170,16 @@ pub struct Config {
     /// Maximum wall-clock time a single served git operation (upload-pack /
     /// receive-pack through `run_git_service`) may run before it is aborted and
     /// its process group torn down, in seconds. Bounds a git that neither
-    /// finishes nor disconnects. Must be positive and at most
-    /// [`GIT_SERVICE_TIMEOUT_SECS_MAX`] (100 years, the largest value every derived
-    /// deadline can represent); setting it very large is still the way to disable the
-    /// bound. Default: 600s (10 min), generous for large clones. Also bounds the ref
-    /// advertisement
-    /// (`info/refs`) and the withheld-blob pack build (`upload_pack_excluding`'s
-    /// pack-objects stage), which now share the same timeout + process-group
-    /// teardown (#174).
+    /// finishes nor disconnects. Must be positive; set it very large to
+    /// effectively disable the bound. Default: 600s (10 min), generous for large
+    /// clones. Also bounds the ref advertisement (`info/refs`) and the withheld-blob
+    /// pack build (`upload_pack_excluding`'s pack-objects stage), which now share the
+    /// same timeout + process-group teardown (#174).
     #[arg(
         long,
         env = "GITLAWB_GIT_SERVICE_TIMEOUT_SECS",
         default_value_t = 600,
-        value_parser = clap::value_parser!(u64).range(1..=GIT_SERVICE_TIMEOUT_SECS_MAX)
+        value_parser = clap::value_parser!(u64).range(1..)
     )]
     pub git_service_timeout_secs: u64,
 
@@ -236,15 +206,11 @@ pub struct Config {
 
     /// Maximum connections in the PostgreSQL pool. This is a cap, not a floor
     /// (connections open lazily). Size against the database server's
-    /// max_connections, remembering admin tooling opens its own pool. Each
-    /// concurrent write pins one pooled connection for its whole duration (the
-    /// advisory lock in `repo_store::acquire_write` is connection-affine), so this
-    /// must exceed `max_concurrent_git_pushes` by `DB_POOL_APP_HEADROOM` or slow
-    /// pushes starve every other DB path — enforced by `Config::validate`.
+    /// max_connections, remembering admin tooling opens its own pool.
     #[arg(
         long,
         env = "GITLAWB_DB_MAX_CONNECTIONS",
-        default_value_t = 48,
+        default_value_t = 20,
         value_parser = clap::value_parser!(u32).range(1..)
     )]
     pub db_max_connections: u32,
@@ -341,6 +307,17 @@ pub struct Config {
     /// Default: 32. Must be between 1 and 1_048_576 (the ceiling keeps the value
     /// under tokio's `Semaphore` permit limit so an oversized value is a clean CLI
     /// error rather than a boot-time panic).
+    ///
+    /// CONNECTION BUDGET. A push holds a Postgres connection from the node's separate
+    /// advisory-lock pool for the whole receive-pack, and that pool is sized from this
+    /// knob (this value + 8, clamped to 64 in `main.rs`). The node's total ceiling is
+    /// therefore `db_max_connections` (default 20) + the lock pool (default 40), i.e.
+    /// 60 by default, and at most `db_max_connections` + 64. Size BOTH against the
+    /// database server's `max_connections`: `db_max_connections`' own doc predates the
+    /// lock pool and no longer covers most of the node's connections. The +8 headroom
+    /// is shared with the three non-push `acquire_write` callers (`api/issues.rs` x2,
+    /// `api/pulls.rs`). Raising this knob past the clamp does NOT buy more lock-pool
+    /// connections; pushes beyond it wait briefly and then shed a 503 + Retry-After.
     #[arg(
         long,
         env = "GITLAWB_MAX_CONCURRENT_GIT_PUSHES",
@@ -349,52 +326,6 @@ pub struct Config {
     )]
     pub max_concurrent_git_pushes: usize,
 
-    /// Maximum number of pushes that may be PARKED on one repo's in-process write lease
-    /// at once. Same-repo pushes are serialized (block-and-wait), and a parked push has
-    /// already had its entire pack buffered by axum, so an unbounded queue on a contended
-    /// repo is unbounded buffered memory held for up to `git_service_timeout_secs * 2 +
-    /// 60` (1260s at defaults). Past this cap the newest push sheds a clean 503 +
-    /// Retry-After instead of joining the queue.
-    ///
-    /// The trade: raising it lets more same-repo pushes wait their turn (fewer 503s for a
-    /// hot repo, more memory pinned by waiters); lowering it sheds sooner. Only pushes to
-    /// the SAME repo count, and only ones parked right now, so the cap can never deny a
-    /// push to a different repo. The holder is deliberately not counted: a holder whose
-    /// cleanup never ran would otherwise pin a slot forever and wedge the repo, which is
-    /// the failure the `steal_after` reclaim exists to survive.
-    ///
-    /// Default: 8, a quarter of the default `max_concurrent_git_pushes` (32). Raising the
-    /// push pool does not raise this; set it explicitly. Must be between 1 and 1_048_576.
-    #[arg(
-        long,
-        env = "GITLAWB_REPO_LEASE_MAX_WAITERS",
-        default_value_t = 8,
-        value_parser = clap::builder::RangedU64ValueParser::<usize>::new().range(1..=1_048_576)
-    )]
-    pub repo_lease_max_waiters: usize,
-
-    /// Max concurrent post-push pin loops (`ipfs_pin` and `pinata`
-    /// `pin_new_objects`) across all repos. `EncryptInflight` bounds the outstanding
-    /// pin-task COUNT to one per repo, but each pin loop holds a full per-push
-    /// object-id list (up to `git_max_pack_bytes` worth of OIDs) while it walks it,
-    /// so N distinct repos could hold N such lists at once. This caps how many run
-    /// concurrently (#174 F6). Beyond it a pin loop DEFERS (waits) and never drops,
-    /// since a dropped pin would lose the object's replication copy.
-    ///
-    /// It does not cap the memory itself: the local IPFS path builds its list before
-    /// taking a permit, so tasks parked on this pool still hold theirs, and how many
-    /// park is capped only per repo. Lowering this knob bounds concurrent pinning, not
-    /// how much an actor pushing to many repos can retain.
-    ///
-    /// Default: 8. Must be between 1 and 1_048_576.
-    #[arg(
-        long,
-        env = "GITLAWB_MAX_CONCURRENT_PIN_TASKS",
-        default_value_t = 8,
-        value_parser = clap::builder::RangedU64ValueParser::<usize>::new().range(1..=1_048_576)
-    )]
-    pub max_concurrent_pin_tasks: usize,
-
     /// Maximum concurrent read operations (`upload-pack` and the upload-pack
     /// `info/refs` advertisement) a single caller may hold at once, so one caller
     /// cannot monopolize the `max_concurrent_git_ops` read pool (#174). Callers are
@@ -452,93 +383,70 @@ pub struct Config {
     )]
     pub ipfs_walk_per_source: usize,
 
-    /// Upper bound on the number of EXPENSIVE visibility walks
-    /// (`allowed_blob_set_for_caller_bounded`, a full-history git walk in a
-    /// blocking thread) a single `/ipfs/{cid}` request may run. Only a blob in a
-    /// path-scoped repo costs a walk, so the cap counts exactly those candidates
-    /// — cheap probe-only visits are bounded by `ipfs_max_repo_visits` instead
-    /// (counting them here would starve a plain public copy past the cap out of
-    /// its 200). On exhaustion the walk-needing repo is skipped WITHOUT a verdict
-    /// and the scan continues; if the request then finds the object nowhere it
-    /// sheds a retryable 503 + Retry-After rather than misreport existing content
-    /// absent with a 404. The handler still short-circuits the moment it serves.
-    /// Must be between 1 and 1_048_576. Default: 64.
+    /// Per-request ceiling on the number of legacy (NULL-provenance) repos the
+    /// `/ipfs/{cid}` resolver's scan fallback will PROBE (`acquire` + `git cat-file
+    /// -t`) before giving up. The provenance path targets one repo; the legacy scan,
+    /// absent this bound, fans one anonymous request out to O(repos) subprocess spawns
+    /// and cold-cache fetches for a CID enumerable from the public pins index (#173,
+    /// INV-10). A truncated scan surfaces as a retryable 503, never a false 404. Wired
+    /// into `AppState::ipfs_max_legacy_probes` at construction; the history-walk ceiling
+    /// stays constant (`MAX_HISTORY_WALKS_PER_REQUEST`) and is NOT governed by this knob
+    /// (a smaller value would falsely 503 a provenanced request). Must be between 1 and
+    /// 1_048_576. Default: 256.
     #[arg(
         long,
         env = "GITLAWB_IPFS_MAX_REPOS_WALKED",
-        default_value_t = 64,
+        default_value_t = crate::api::ipfs::MAX_LEGACY_PROBES_PER_REQUEST as usize,
         value_parser = clap::builder::RangedU64ValueParser::<usize>::new().range(1..=1_048_576)
     )]
     pub ipfs_max_repos_walked: usize,
 
-    /// Ceiling on the number of repos a single `/ipfs/{cid}` request may VISIT —
-    /// pass the repo-level visibility gate into the acquire + `cat-file` probe.
-    /// Each visit costs a `RepoStore::acquire` (on a Tigris cache miss that is a
-    /// full repo-archive download from object storage, so the worst-case
-    /// object-store fetch count for one request equals this ceiling) plus a git
-    /// probe subprocess. On exhaustion the scan STOPS — unlike
-    /// `ipfs_max_repos_walked`, which skips just the walk-needing repo, there is
-    /// no cheaper way to keep scanning — and the request sheds a retryable 503 +
-    /// Retry-After rather than a false 404. Must be between 1 and 1_048_576.
-    /// Default: 1024.
-    #[arg(
-        long,
-        env = "GITLAWB_IPFS_MAX_REPO_VISITS",
-        default_value_t = 1024,
-        value_parser = clap::builder::RangedU64ValueParser::<usize>::new().range(1..=1_048_576)
-    )]
-    pub ipfs_max_repo_visits: usize,
-
-    /// Absolute wall-clock budget for one admitted `GET /ipfs/{cid}` request's
-    /// acquire+walk lifetime, in seconds. `max_concurrent_ipfs_walks` bounds how
-    /// MANY requests hold walk slots; this bounds how LONG one admitted request
-    /// may keep its slot. Without it, each repo iteration draws a fresh
-    /// `git_acquire_timeout_secs` and each expensive walk a fresh
-    /// `git_service_timeout_secs`, so one request scanning many repos could hold
-    /// a scarce walk slot for hours. Every stage (acquire, `cat-file` probe,
-    /// visibility walk, content read) starts only while budget remains, and the
-    /// acquire wait and walk deadline are clamped to `min(their own timeout,
-    /// remaining budget)`; a stage is never started with zero remaining. On
-    /// exhaustion the scan stops without a verdict and the request sheds a
-    /// retryable 503 + Retry-After rather than a false 404. The clamps bound
-    /// only the acquire and walk stages (overshoot there is the walk watchdog's
-    /// SIGTERM grace + SIGKILL settle); the `object_type` /
-    /// `read_object_content` probe subprocesses are budget-checked before they
-    /// start AND each run under their own deadline (the lesser of
-    /// `git_service_timeout_secs` and the remaining budget), reaped by
-    /// process-group teardown, so a hung `cat-file` cannot hold the request's walk
-    /// slot past it. Still unbounded: the probe's `object_store_readable` check is a
-    /// synchronous filesystem sweep with nothing to reap, so a wedged filesystem can
-    /// hold the slot past the deadline.
-    /// Must be positive, and no larger than `GIT_SERVICE_TIMEOUT_SECS_MAX`. The ceiling is
-    /// representability, NOT a policy view of a sane budget: `get_by_cid` derives the
-    /// request deadline as `Instant::now() + Duration::from_secs(this)`, and that addition
-    /// is an explicit overflow check rather than a debug-only one, so a value near the top
-    /// of the `u64` range aborts every `/ipfs/{cid}` request in a release build instead of
-    /// setting a very long budget. The ceiling sits well below where that starts, about a
-    /// factor of 5.85 (see the constant's own note), so it is a conservative margin rather than the
-    /// exact overflow point; rejecting at parse time keeps the unrepresentable values out
-    /// of every reachable configuration. Setting it very large is still the way to
-    /// effectively disable the budget, and the documented sentinels (`999999999`,
-    /// `1000000000`) are well inside the range.
-    /// Default: 600s (10 min), matching `git_service_timeout_secs` so a single full-length
-    /// walk still fits.
-    #[arg(
-        long,
-        env = "GITLAWB_IPFS_REQUEST_BUDGET_SECS",
-        default_value_t = 600,
-        value_parser = clap::value_parser!(u64).range(1..=GIT_SERVICE_TIMEOUT_SECS_MAX)
-    )]
-    pub ipfs_request_budget_secs: u64,
-
     /// Per-client-IP rate limit for `GET /ipfs/{cid}`, in requests per hour. The
     /// route is publicly reachable (`optional_signature`) and each request can drive
     /// a full-history git walk, so it carries a per-IP flood brake in addition to the
     /// concurrency cap above (a rate limit bounds request *rate*, the semaphore
     /// bounds concurrent slow holds — different axes). Keyed on the resolved client
     /// IP via `GITLAWB_TRUSTED_PROXY`. `0` disables. Default: 600.
+    ///
+    /// This is the pure once-per-request ROUTE brake. The resolver's internal
+    /// per-probe/per-walk WORK budget is a SEPARATE bucket whose capacity is DERIVED
+    /// from this value (`AppState::ipfs_work_budget`), not a knob of its own; `0` here
+    /// disables that derived bucket too.
     #[arg(long, env = "GITLAWB_IPFS_RATE_LIMIT", default_value_t = 600)]
     pub ipfs_rate_limit: usize,
+
+    /// Rows the legacy provider-CID repair sweep reads per batch (U4, #173).
+    ///
+    /// The sweep walks every `pinned_cids` row on the node once, repairing rows that
+    /// releases before this branch keyed on a PROVIDER CID (Kubo dag-pb / Pinata CIDv0)
+    /// instead of the raw-content resolver key. This bounds one batch, so the sweep can
+    /// never turn into a single unbounded table scan competing with request traffic.
+    /// Conservative on purpose: paired with the inter-batch delay below the default is
+    /// ~64 rows per minute, which finishes a large pin set in hours of idle background
+    /// work rather than one expensive burst. Must be between 1 and 100_000.
+    #[arg(
+        long,
+        env = "GITLAWB_PIN_REPAIR_SWEEP_BATCH",
+        default_value_t = 64,
+        value_parser = clap::builder::RangedU64ValueParser::<i64>::new().range(1..=100_000)
+    )]
+    pub pin_repair_sweep_batch: i64,
+
+    /// Seconds the legacy provider-CID repair sweep sleeps between batches (U4, #173).
+    ///
+    /// Each batch costs an indexed range scan plus, for the legacy rows in it, a
+    /// `git cat-file` per row. The delay is what keeps that off the DB's and the disk's
+    /// critical path: the sweep is repairing rows that have been unresolvable since the
+    /// upgrade, so finishing slowly is fine and finishing fast at the cost of live
+    /// traffic is not. `0` disables the pause (test and one-off operational use only).
+    /// Must be between 0 and 86_400.
+    #[arg(
+        long,
+        env = "GITLAWB_PIN_REPAIR_SWEEP_DELAY_SECS",
+        default_value_t = 60,
+        value_parser = clap::builder::RangedU64ValueParser::<u64>::new().range(0..=86_400)
+    )]
+    pub pin_repair_sweep_delay_secs: u64,
 }
 
 impl Config {
@@ -555,36 +463,6 @@ impl Config {
         }
         PathBuf::from(&self.key_path)
     }
-
-    /// DB connections reserved for everything other than held write-locks: auth
-    /// lookups, visibility-rule reads, the post-receive tail's own DB writes, and
-    /// admin tooling. A write pins one pooled connection for its whole duration, so
-    /// the pool must clear the concurrent-write cap by at least this margin.
-    pub const DB_POOL_APP_HEADROOM: u32 = 8;
-
-    /// Cross-field boot validation. Single-field ranges are enforced by clap; this
-    /// catches combinations that ship a denial-of-service under otherwise-valid
-    /// values. Call once at startup and fail fast on `Err`.
-    pub fn validate(&self) -> Result<(), String> {
-        // A write pins one pooled connection for its whole duration (the
-        // connection-affine advisory lock in repo_store::acquire_write), and
-        // concurrent writes are capped at max_concurrent_git_pushes. If the pool
-        // does not exceed that cap by DB_POOL_APP_HEADROOM, a burst of slow pushes
-        // drains every connection and every other DB path 503s. (#174 F1)
-        let floor = (self.max_concurrent_git_pushes as u64) + (Self::DB_POOL_APP_HEADROOM as u64);
-        if (self.db_max_connections as u64) < floor {
-            return Err(format!(
-                "GITLAWB_DB_MAX_CONNECTIONS ({}) must be at least max_concurrent_git_pushes ({}) \
-                 + {} headroom = {}: each concurrent write pins one pooled connection for its whole \
-                 duration, so a smaller pool lets a burst of slow pushes starve every other DB path.",
-                self.db_max_connections,
-                self.max_concurrent_git_pushes,
-                Self::DB_POOL_APP_HEADROOM,
-                floor
-            ));
-        }
-        Ok(())
-    }
 }
 
 #[cfg(test)]
@@ -608,88 +486,6 @@ mod tests {
         );
     }
 
-    /// #174 (RED-before/GREEN-after): the upper bound is what keeps every duration
-    /// derived from this knob in range — the lease steal bound's `* 2 + 60` on the write
-    /// path, and the `Instant::now() + Duration::from_secs(..)` deadlines in
-    /// `build_filtered_pack` / `blob_paths` on the serve path, which panic on overflow in
-    /// release builds too. Checked at parse time so no reachable configuration can carry a
-    /// value those sites cannot represent.
-    ///
-    /// The pre-existing "set it very large to disable the bound" settings are asserted
-    /// alongside the rejections on purpose. The bound exists to exclude unrepresentable
-    /// values, not to impose a view of a reasonable timeout, so a node that has been
-    /// running on ~31 years must not start failing at boot on upgrade.
-    #[test]
-    fn git_service_timeout_rejects_values_no_derived_duration_can_represent() {
-        let parse = |secs: u64| {
-            Config::try_parse_from([
-                "gitlawb-node",
-                "--git-service-timeout-secs",
-                &secs.to_string(),
-            ])
-        };
-
-        // Large "disable the bound" values that predate the ceiling still parse.
-        for disable in [1_000_000_000, 999_999_999] {
-            assert_eq!(
-                parse(disable)
-                    .unwrap_or_else(|e| panic!("{disable} was a working setting: {e}"))
-                    .git_service_timeout_secs,
-                disable
-            );
-        }
-
-        // At the ceiling: accepted, and every derived duration still fits.
-        let at_max =
-            parse(GIT_SERVICE_TIMEOUT_SECS_MAX).expect("the documented maximum must parse");
-        assert_eq!(
-            at_max.git_service_timeout_secs,
-            GIT_SERVICE_TIMEOUT_SECS_MAX
-        );
-        assert!(at_max
-            .git_service_timeout_secs
-            .checked_mul(2)
-            .and_then(|v| v.checked_add(60))
-            .is_some());
-        assert!(std::time::Instant::now()
-            .checked_add(std::time::Duration::from_secs(
-                at_max.git_service_timeout_secs
-            ))
-            .is_some());
-
-        // Past the ceiling, and the top of the u64 range clap used to accept — the value
-        // that panics `Instant::now() + Duration::from_secs(..)` outright.
-        for over in [GIT_SERVICE_TIMEOUT_SECS_MAX + 1, u64::MAX] {
-            assert!(
-                parse(over).is_err(),
-                "{over} is past the representable ceiling and must be rejected at parse time"
-            );
-        }
-        assert!(std::time::Instant::now()
-            .checked_add(std::time::Duration::from_secs(u64::MAX))
-            .is_none());
-    }
-
-    #[test]
-    fn max_concurrent_pin_tasks_defaults_and_rejects_out_of_range() {
-        assert_eq!(
-            Config::parse_from(["gitlawb-node"]).max_concurrent_pin_tasks,
-            8
-        );
-        assert_eq!(
-            Config::parse_from(["gitlawb-node", "--max-concurrent-pin-tasks", "2"])
-                .max_concurrent_pin_tasks,
-            2
-        );
-        assert!(
-            Config::try_parse_from(["gitlawb-node", "--max-concurrent-pin-tasks", "0"]).is_err()
-        );
-        assert!(
-            Config::try_parse_from(["gitlawb-node", "--max-concurrent-pin-tasks", "1048577"])
-                .is_err()
-        );
-    }
-
     #[test]
     fn max_concurrent_git_ops_defaults_and_rejects_out_of_range() {
         assert_eq!(
@@ -771,6 +567,35 @@ mod tests {
         );
     }
 
+    /// U4 (#173): the repair sweep's bounds are conservative by default and a batch of
+    /// 0 (a sweep that walks nothing and never terminates) is a CLI error, not a
+    /// runtime hang. The delay does accept 0, for tests and one-off operational runs.
+    #[test]
+    fn pin_repair_sweep_knobs_default_conservatively() {
+        let c = Config::parse_from(["gitlawb-node"]);
+        assert_eq!(c.pin_repair_sweep_batch, 64);
+        assert_eq!(c.pin_repair_sweep_delay_secs, 60);
+
+        assert!(Config::try_parse_from(["gitlawb-node", "--pin-repair-sweep-batch", "0"]).is_err());
+        assert!(
+            Config::try_parse_from(["gitlawb-node", "--pin-repair-sweep-batch", "100001"]).is_err()
+        );
+        assert_eq!(
+            Config::parse_from(["gitlawb-node", "--pin-repair-sweep-batch", "8"])
+                .pin_repair_sweep_batch,
+            8
+        );
+        assert_eq!(
+            Config::parse_from(["gitlawb-node", "--pin-repair-sweep-delay-secs", "0"])
+                .pin_repair_sweep_delay_secs,
+            0
+        );
+        assert!(
+            Config::try_parse_from(["gitlawb-node", "--pin-repair-sweep-delay-secs", "86401"])
+                .is_err()
+        );
+    }
+
     #[test]
     fn ipfs_walk_per_source_defaults_and_rejects_out_of_range() {
         assert_eq!(Config::parse_from(["gitlawb-node"]).ipfs_walk_per_source, 4);
@@ -790,7 +615,7 @@ mod tests {
     fn ipfs_max_repos_walked_defaults_and_rejects_out_of_range() {
         assert_eq!(
             Config::parse_from(["gitlawb-node"]).ipfs_max_repos_walked,
-            64
+            256
         );
         assert_eq!(
             Config::parse_from(["gitlawb-node", "--ipfs-max-repos-walked", "8"])
@@ -804,103 +629,114 @@ mod tests {
         );
     }
 
+    /// The `GITLAWB_IPFS_MAX_REPOS_WALKED` knob must actually reach the legacy-probe
+    /// budget it advertises (R5, KTD5): production seeds `ipfs_max_legacy_probes` from
+    /// this helper, so the knob is a no-op unless the helper reflects it. RED while the
+    /// helper returns the hardcoded `MAX_LEGACY_PROBES_PER_REQUEST` (256 regardless of
+    /// the knob), GREEN once it reads the knob.
     #[test]
-    fn ipfs_max_repo_visits_defaults_and_rejects_out_of_range() {
+    fn ipfs_max_repos_walked_wires_the_legacy_probe_budget() {
+        use crate::state::AppState;
+        // Knob set to 1 → a one-probe legacy budget.
+        let one = Config::parse_from(["gitlawb-node", "--ipfs-max-repos-walked", "1"]);
         assert_eq!(
-            Config::parse_from(["gitlawb-node"]).ipfs_max_repo_visits,
-            1024
+            AppState::ipfs_legacy_probe_budget(&one),
+            1,
+            "the knob must control the legacy-probe budget, not be ignored"
+        );
+        // Unset knob preserves the shipped 256-probe behaviour.
+        let default = Config::parse_from(["gitlawb-node"]);
+        assert_eq!(
+            AppState::ipfs_legacy_probe_budget(&default),
+            256,
+            "the default knob keeps the shipped 256-probe budget"
         );
         assert_eq!(
-            Config::parse_from(["gitlawb-node", "--ipfs-max-repo-visits", "8"])
-                .ipfs_max_repo_visits,
-            8
+            AppState::ipfs_legacy_probe_budget(&default),
+            crate::api::ipfs::MAX_LEGACY_PROBES_PER_REQUEST,
+            "the default budget equals the constant it replaced"
         );
-        // 0 would visit no repos (serve nothing); clap must reject it.
-        assert!(Config::try_parse_from(["gitlawb-node", "--ipfs-max-repo-visits", "0"]).is_err());
+        // Ceiling guard: the knob never governs the history-walk ceiling, which must
+        // stay at MAX_PIN_SOURCES + 1 or a provenanced full source set false-503s.
         assert!(
-            Config::try_parse_from(["gitlawb-node", "--ipfs-max-repo-visits", "1048577"]).is_err()
+            crate::api::ipfs::MAX_HISTORY_WALKS_PER_REQUEST > crate::db::MAX_PIN_SOURCES as u32,
+            "the history-walk ceiling is independent of the repos-walked knob"
         );
     }
 
+    /// The `/ipfs` work-budget capacity is DERIVED from the route limit (R6, KTD6), with
+    /// a hard floor of one full legacy search per window (the effective
+    /// `ipfs_max_legacy_probes`). This guards the derived default so a single
+    /// default-config deep search never self-throttles mid-scan and recreates the F6
+    /// admit-then-429 for a legitimate caller. A `RateLimiter` sized to the derived
+    /// budget must admit the whole probe budget back to back.
     #[test]
-    fn ipfs_request_budget_secs_defaults_to_600_and_rejects_zero() {
-        assert_eq!(
-            Config::parse_from(["gitlawb-node"]).ipfs_request_budget_secs,
-            600
-        );
-        assert_eq!(
-            Config::parse_from(["gitlawb-node", "--ipfs-request-budget-secs", "30"])
-                .ipfs_request_budget_secs,
-            30
-        );
-        // 0 would expire every /ipfs request at its first stage (unconditional
-        // 503); clap must reject it.
+    fn ipfs_work_budget_derives_from_route_limit_and_clears_the_probe_floor() {
+        use crate::state::AppState;
+
+        // Default config: derived work budget = max(route 600, probe budget 256) = 600,
+        // comfortably above the 256-probe floor.
+        let default = Config::parse_from(["gitlawb-node"]);
+        let budget = AppState::ipfs_work_budget(&default);
+        assert_eq!(budget, 600, "default derives max(route 600, probe 256)");
         assert!(
-            Config::try_parse_from(["gitlawb-node", "--ipfs-request-budget-secs", "0"]).is_err()
+            budget >= AppState::ipfs_legacy_probe_budget(&default) as usize,
+            "the work budget must clear one full legacy search per window"
         );
-    }
 
-    /// #174 (RED-before/GREEN-after): the upper bound is what keeps the deadline derived
-    /// from this knob in range. `get_by_cid` builds the request budget as
-    /// `Instant::now() + Duration::from_secs(this)` (api/ipfs.rs), and that addition is an
-    /// explicit overflow check rather than a debug-only one, so an oversized value aborts
-    /// every `/ipfs/{cid}` request in a release build instead of setting a very long budget.
-    /// The route is anon-reachable, so the failure is operator-triggered but publicly felt.
-    /// Checked at parse time so no reachable configuration can carry a value the deadline
-    /// cannot represent.
-    ///
-    /// The large "disable the bound" settings are asserted alongside the rejections on
-    /// purpose, the same way the `git_service_timeout_secs` sibling does it. The ceiling
-    /// exists to exclude unrepresentable values, not to impose a view of a reasonable
-    /// budget, so a node already running on such a value must not start failing at boot on
-    /// upgrade. A test that only checked the boundary would pass with a far tighter cap.
-    #[test]
-    fn ipfs_request_budget_rejects_values_no_derived_duration_can_represent() {
-        let parse = |secs: u64| {
-            Config::try_parse_from([
-                "gitlawb-node",
-                "--ipfs-request-budget-secs",
-                &secs.to_string(),
-            ])
-        };
-
-        // Large "disable the bound" values that predate the ceiling still parse.
-        for disable in [1_000_000_000, 999_999_999] {
-            assert_eq!(
-                parse(disable)
-                    .unwrap_or_else(|e| panic!("{disable} was a working setting: {e}"))
-                    .ipfs_request_budget_secs,
-                disable
-            );
-        }
-
-        // At the ceiling: accepted, and the derived deadline still fits. This knob feeds
-        // only the `Instant` addition (no multiply derivation like the lease steal bound),
-        // so there is no `checked_mul` clause to carry over from the sibling test.
-        let at_max =
-            parse(GIT_SERVICE_TIMEOUT_SECS_MAX).expect("the documented maximum must parse");
+        // Tight route limit (1): the floor lifts the work budget to the probe budget
+        // (256), NOT down to 1 — a single deep search still completes its full scan.
+        let tight = Config::parse_from(["gitlawb-node", "--ipfs-rate-limit", "1"]);
         assert_eq!(
-            at_max.ipfs_request_budget_secs,
-            GIT_SERVICE_TIMEOUT_SECS_MAX
+            AppState::ipfs_work_budget(&tight),
+            256,
+            "a tight route limit is floored at the 256-probe budget, not clamped to 1"
         );
-        assert!(std::time::Instant::now()
-            .checked_add(std::time::Duration::from_secs(
-                at_max.ipfs_request_budget_secs
-            ))
-            .is_some());
 
-        // Past the ceiling, and the top of the u64 range clap used to accept. Only the
-        // latter actually panics `Instant::now() + Duration::from_secs(..)`; the ceiling
-        // sits well below that, which is the conservative margin the constant documents.
-        for over in [GIT_SERVICE_TIMEOUT_SECS_MAX + 1, u64::MAX] {
+        // Raised probe budget lifts the floor with it (the work budget tracks the
+        // effective probe budget, not the constant).
+        let raised = Config::parse_from([
+            "gitlawb-node",
+            "--ipfs-rate-limit",
+            "10",
+            "--ipfs-max-repos-walked",
+            "1000",
+        ]);
+        assert_eq!(
+            AppState::ipfs_work_budget(&raised),
+            1000,
+            "the floor tracks the operator-raised legacy-probe budget"
+        );
+
+        // 0 route limit disables the derived bucket too (a 0-capacity limiter admits all).
+        let disabled = Config::parse_from(["gitlawb-node", "--ipfs-rate-limit", "0"]);
+        assert_eq!(
+            AppState::ipfs_work_budget(&disabled),
+            0,
+            "route limit 0 disables the derived work bucket alongside the route brake"
+        );
+
+        // Behavioral floor: a limiter sized to the derived (tight-route) budget admits
+        // the whole probe budget back to back for one source, then sheds the next.
+        let budget = AppState::ipfs_work_budget(&tight);
+        let limiter =
+            crate::rate_limit::RateLimiter::new(budget, std::time::Duration::from_secs(3600));
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .unwrap();
+        rt.block_on(async {
+            for i in 0..budget {
+                assert!(
+                    limiter.check("1.2.3.4").await,
+                    "probe {i} of one full default-config scan must be admitted (no mid-scan throttle)"
+                );
+            }
             assert!(
-                parse(over).is_err(),
-                "{over} is past the representable ceiling and must be rejected at parse time"
+                !limiter.check("1.2.3.4").await,
+                "the probe past the derived budget is shed"
             );
-        }
-        assert!(std::time::Instant::now()
-            .checked_add(std::time::Duration::from_secs(u64::MAX))
-            .is_none());
+        });
     }
 
     #[test]
@@ -935,42 +771,4 @@ mod tests {
             1_048_576
         );
     }
-
-    /// #174 F1: a connection-affine write lock pins a pooled connection per
-    /// concurrent write, so the pool must clear `max_concurrent_git_pushes` by
-    /// `DB_POOL_APP_HEADROOM` or a push burst starves every other DB path.
-    /// `validate()` must reject an under-sized pool at boot.
-    #[test]
-    fn db_pool_must_clear_the_git_push_cap() {
-        // Shipped defaults validate (48 >= 32 + 8).
-        Config::parse_from(["gitlawb-node"])
-            .validate()
-            .expect("default config must validate");
-
-        // An under-sized pool relative to the push cap is rejected (20 < 32 + 8).
-        let under = Config::parse_from([
-            "gitlawb-node",
-            "--db-max-connections",
-            "20",
-            "--max-concurrent-git-pushes",
-            "32",
-        ]);
-        assert!(
-            under.validate().is_err(),
-            "db_max_connections 20 below max_concurrent_git_pushes 32 + headroom must be rejected"
-        );
-
-        // Exactly at the floor validates (40 == 32 + 8).
-        let at_floor = Config::parse_from([
-            "gitlawb-node",
-            "--db-max-connections",
-            "40",
-            "--max-concurrent-git-pushes",
-            "32",
-        ]);
-        assert!(
-            at_floor.validate().is_ok(),
-            "db_max_connections at the floor (pushes + headroom) must validate"
-        );
-    }
 }

crates/gitlawb-node/src/encrypted_pin.rs

@@ -170,7 +170,7 @@ pub async fn encrypt_and_pin(
                 continue;
             }
         };
-        let cid = match crate::ipfs_pin::pin_git_object(ipfs_api, oid, &envelope, None).await {
+        let cid = match crate::ipfs_pin::pin_git_object(ipfs_api, oid, &envelope).await {
             Ok(c) if !c.is_empty() => c,
             Ok(_) => {
                 tracing::warn!(oid = %oid, "pin_git_object returned no cid; skipping");

crates/gitlawb-node/src/error.rs

@@ -35,21 +35,15 @@ pub enum AppError {
     #[error("invalid request: {0}")]
     BadRequest(String),
 
-    /// A DID was well-formed enough to carry to a resolver but no verifying key
-    /// could be derived from it. Its own code rather than plain `bad_request`
-    /// because the auth middleware already answers `unresolvable_did` for the
-    /// same failure on a request's keyid, and a client should not have to
-    /// substring-match a message to tell this apart from the other validation
-    /// failures on the same route.
-    #[error("unresolvable did: {0}")]
-    UnresolvableDid(String),
-
     #[error("too many requests: {0}")]
     TooManyRequests(String),
 
     #[error("incomplete: {0}")]
     Incomplete(String),
 
+    #[error("search incomplete: {0}")]
+    SearchIncomplete(String),
+
     #[error("git error: {0}")]
     Git(String),
 
@@ -72,14 +66,6 @@ pub enum AppError {
 pub const DB_UNAVAILABLE_CODE: &str = "db_unavailable";
 pub const DB_UNAVAILABLE_MESSAGE: &str = "database is temporarily unavailable";
 
-/// Generic client-facing message for `AppError::Internal`. The real error is
-/// logged server-side; never put sqlx/anyhow detail in the HTTP body (#226).
-pub const INTERNAL_ERROR_MESSAGE: &str = "an internal error occurred";
-
-/// Generic client-facing message for non-unavailable `AppError::Db`. Query /
-/// schema errors stay in logs; the HTTP body must not leak them (#226).
-pub const DB_ERROR_MESSAGE: &str = "a database error occurred";
-
 /// Connection-level sqlx failures that mean the database is unreachable right
 /// now (retryable, 503), as opposed to server-reported query errors.
 fn db_unavailable(e: &sqlx::Error) -> bool {
@@ -152,15 +138,21 @@ impl IntoResponse for AppError {
             // IcaptchaProofRequired is handled above (it carries extra headers/fields).
             AppError::IcaptchaProofRequired { .. } => unreachable!("handled before this match"),
             AppError::BadRequest(msg) => (StatusCode::BAD_REQUEST, "bad_request", msg.clone()),
-            AppError::UnresolvableDid(msg) => {
-                (StatusCode::BAD_REQUEST, "unresolvable_did", msg.clone())
-            }
             AppError::TooManyRequests(msg) => {
                 (StatusCode::TOO_MANY_REQUESTS, "rate_limited", msg.clone())
             }
             AppError::Incomplete(msg) => {
                 (StatusCode::UNPROCESSABLE_ENTITY, "incomplete", msg.clone())
             }
+            // A bounded search that could not complete (the CID resolver hit its
+            // legacy-probe or walk ceiling), distinct from the 404 that asserts a
+            // definitive not-found: absence was NOT proven, so the caller should
+            // retry rather than treat it as gone (#173, F2). 503, retryable.
+            AppError::SearchIncomplete(msg) => (
+                StatusCode::SERVICE_UNAVAILABLE,
+                "search_incomplete",
+                msg.clone(),
+            ),
             AppError::Git(msg) => (StatusCode::INTERNAL_SERVER_ERROR, "git_error", msg.clone()),
             // 504, distinct from the 500 git_error and from the read-gate's 404 /
             // the auth 401, so the client can tell a deadline from a failure.
@@ -176,29 +168,12 @@ impl IntoResponse for AppError {
             AppError::Overloaded(msg) => {
                 (StatusCode::SERVICE_UNAVAILABLE, "overloaded", msg.clone())
             }
-            // Opaque body + server log: bare `?` on sqlx paths becomes `AppError::Db`
-            // via `From`, so this arm (not `Internal`) is the common leak for open
-            // routes like GET /api/v1/repos and GET /api/v1/peers (#226).
-            AppError::Db(e) => {
-                tracing::error!(error = %e, "database error");
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    "db_error",
-                    DB_ERROR_MESSAGE.into(),
-                )
-            }
-            // Opaque body: handlers that map with `.map_err(AppError::Internal)`
-            // (e.g. GET /ipfs/{cid}) land here; other DB failures usually hit `Db`.
-            // Log `{e:#}` so context-wrapped anyhow chains keep the leaf cause
-            // (Display alone is only the outermost layer; see api/repos.rs).
-            AppError::Internal(e) => {
-                tracing::error!(error = %format!("{e:#}"), "internal error");
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    "internal_error",
-                    INTERNAL_ERROR_MESSAGE.into(),
-                )
-            }
+            AppError::Db(e) => (StatusCode::INTERNAL_SERVER_ERROR, "db_error", e.to_string()),
+            AppError::Internal(e) => (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "internal_error",
+                e.to_string(),
+            ),
         };
 
         let body = Json(json!({
@@ -207,10 +182,14 @@ impl IntoResponse for AppError {
         }));
 
         let mut resp = (status, body).into_response();
-        // Overloaded advertises when to retry. It rides the shared tail above for
-        // its body/status, so the header is attached here rather than in a bespoke
-        // early return — keeping the variant handled in exactly one place.
-        if matches!(self, AppError::Overloaded(_)) {
+        // Both retryable 503s advertise when to retry: Overloaded (capacity shed) and
+        // SearchIncomplete (a bounded CID search cut short by a cap — retry may complete
+        // it). They ride the shared tail above for body/status, so the header is attached
+        // here rather than in bespoke early returns, keeping each variant handled once.
+        if matches!(
+            self,
+            AppError::Overloaded(_) | AppError::SearchIncomplete(_)
+        ) {
             resp.headers_mut().insert(
                 axum::http::header::RETRY_AFTER,
                 axum::http::HeaderValue::from_static("1"),
@@ -248,83 +227,4 @@ mod tests {
             "1"
         );
     }
-
-    /// #226: raw sqlx/DB detail must never appear in the Internal 500 body.
-    #[tokio::test]
-    async fn internal_error_body_is_opaque() {
-        use serde_json::{json, Value};
-
-        let leak = "error returned from database: relation \"repos\" does not exist";
-        let resp = AppError::Internal(anyhow::anyhow!("{leak}")).into_response();
-        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
-
-        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
-            .await
-            .expect("read body");
-        let v: Value = serde_json::from_slice(&bytes).expect("json body");
-        // Exact object: a new `detail` field with different sensitive text must
-        // also fail, not only a repeat of the original error string.
-        assert_eq!(
-            v,
-            json!({
-                "error": "internal_error",
-                "message": INTERNAL_ERROR_MESSAGE,
-            })
-        );
-    }
-
-    /// #226: `AppError::Db` query errors (the common `?` path) must also be opaque.
-    #[tokio::test]
-    async fn db_error_body_is_opaque() {
-        use serde_json::{json, Value};
-
-        let resp = AppError::Db(sqlx::Error::Protocol(
-            "error returned from database: column \"is_public\" does not exist".into(),
-        ))
-        .into_response();
-        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
-
-        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
-            .await
-            .expect("read body");
-        let v: Value = serde_json::from_slice(&bytes).expect("json body");
-        assert_eq!(
-            v,
-            json!({
-                "error": "db_error",
-                "message": DB_ERROR_MESSAGE,
-            })
-        );
-    }
-
-    /// Connection-level failures must stay 503 `db_unavailable`, not collapse
-    /// into the opaque 500 `db_error` arm if `db_unavailable` loses a variant.
-    #[tokio::test]
-    async fn db_pool_timeout_stays_503_unavailable() {
-        use serde_json::{json, Value};
-
-        let resp = AppError::Db(sqlx::Error::PoolTimedOut).into_response();
-        assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
-
-        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
-            .await
-            .expect("read body");
-        let v: Value = serde_json::from_slice(&bytes).expect("json body");
-        assert_eq!(
-            v,
-            json!({
-                "error": DB_UNAVAILABLE_CODE,
-                "message": DB_UNAVAILABLE_MESSAGE,
-            })
-        );
-    }
-
-    /// #251: bare `?` on anyhow-wrapped sqlx relies on this downcast so a
-    /// closed pool becomes 503 `db_unavailable`, not 500 `internal_error`.
-    #[test]
-    fn pool_closed_via_anyhow_from_is_503_db_unavailable() {
-        let err: AppError = anyhow::Error::from(sqlx::Error::PoolClosed).into();
-        let resp = err.into_response();
-        assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
-    }
 }

crates/gitlawb-node/src/git/push_delta.rs

@@ -282,61 +282,19 @@ pub struct PinCandidateSet {
 /// it can never leak because the withheld/fail-closed filter still runs on
 /// whatever set is returned. `full_scan` rides on the returned set so the caller
 /// knows when the dangling-inclusive filter is required.
-///
-/// `scan_sem` is the post-receive scan admission pool (`git_encrypt_semaphore`,
-/// #174 F4): both git-spawning stages — the per-tip `cat-file` probe + delta
-/// rev-list, and the full-scan fallback — run under ONE permit held for the
-/// whole blocking scan. The deletion-only fast path (no new tips) spawns no git
-/// and never parks.
-///
-/// `force_full_scan` forces the full-scan fallback regardless of the tips — the
-/// coalesced-drain `PendingWork::FullScan` marker (#174 F5). It composes with
-/// the env kill-switch (either forces), and it disqualifies the empty-tips fast
-/// path: a forced-scan call with no tips must still enumerate the repo, never
-/// silently resolve to an empty delta (which would pin nothing and lose the
-/// drained pushes' work — the F5 bug shape).
 pub async fn resolve_candidates_for_push(
-    scan_sem: std::sync::Arc<tokio::sync::Semaphore>,
     repo_path: PathBuf,
     new_tips: Vec<String>,
     old_tips: Vec<String>,
     git_bin: String,
     timeout: Duration,
-    force_full_scan: bool,
 ) -> PinCandidateSet {
-    let force = force_full_scan || self::force_full_scan();
-    // No-git fast path: a deletion-only push resolves to an empty delta without
-    // spawning any git child, so it must not park on the scan pool. A forced
-    // full scan (caller flag or kill-switch) disqualifies it — the scan spawns git.
-    if new_tips.is_empty() && !force {
-        tracing::info!(delta = 0usize, repo = %repo_path.display(), "pin candidate set from push delta");
-        return PinCandidateSet {
-            candidates: Vec::new(),
-            full_scan: false,
-        };
-    }
-    // Scan admission (#174 F4): DEFER, never shed — a dropped scan would
-    // silently under-pin this push. The permit moves into the blocking closure
-    // so a started scan always completes holding it. Residuals at
-    // `acquire_scan_permit`.
-    let permit =
-        crate::state::acquire_scan_permit(scan_sem, &repo_path, "pin-candidate scan").await;
     tokio::task::spawn_blocking(move || {
-        let _permit = permit;
         // ONE shared deadline for the whole scan, per jatmn ("the same deadline").
         let deadline = Instant::now() + timeout;
         let new_refs: Vec<&str> = new_tips.iter().map(String::as_str).collect();
         let old_refs: Vec<&str> = old_tips.iter().map(String::as_str).collect();
-        // `force` already folds in the env kill-switch, so the forced arm skips the
-        // delta machinery outright; the unforced arm goes through the normal
-        // resolver (whose own env read is false here by construction).
-        let resolved = if force {
-            tracing::debug!("full scan forced (coalesced-drain marker or kill-switch)");
-            PinCandidates::FullScanRequired
-        } else {
-            resolve_push_delta(&repo_path, &new_refs, &old_refs, &git_bin, deadline)
-        };
-        match resolved {
+        match resolve_push_delta(&repo_path, &new_refs, &old_refs, &git_bin, deadline) {
             PinCandidates::Delta(objs) => {
                 tracing::info!(delta = objs.len(), repo = %repo_path.display(), "pin candidate set from push delta");
                 PinCandidateSet { candidates: objs, full_scan: false }
@@ -589,13 +547,11 @@ mod tests {
         let c1 = repo.commit_file("a.txt", "one\n");
         let c2 = repo.commit_file("b.txt", "two\n");
         let set = resolve_candidates_for_push(
-            std::sync::Arc::new(tokio::sync::Semaphore::new(64)),
             repo.path.clone(),
             vec![c2.clone()],
             vec![c1.clone()],
             "git".to_string(),
             std::time::Duration::from_secs(600),
-            false,
         )
         .await;
         assert!(!set.full_scan, "happy-path delta is not a full scan");
@@ -620,13 +576,11 @@ mod tests {
             .into_iter()
             .collect();
         let set = resolve_candidates_for_push(
-            std::sync::Arc::new(tokio::sync::Semaphore::new(64)),
             repo.path.clone(),
             vec![blob],
             vec![],
             "git".to_string(),
             std::time::Duration::from_secs(600),
-            false,
         )
         .await;
         assert!(set.full_scan, "non-commit tip is signalled as a full scan");
@@ -634,180 +588,6 @@ mod tests {
         assert_eq!(got, all, "non-commit tip falls back to full repo scan");
     }
 
-    /// F4 defer proof 2: `resolve_candidates_for_push`'s git stages (the per-tip
-    /// cat-file type probe + delta rev-list, and the full-scan fallback) run under a
-    /// scan-admission permit: with a zero-permit pool the call parks and spawns no
-    /// git; once a permit is available the SAME call runs (defer, not shed). On
-    /// ungated code the git runs regardless of the pool (RED).
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn resolve_candidates_defers_when_scan_pool_exhausted() {
-        use std::os::unix::fs::PermissionsExt;
-        use std::sync::Arc;
-        use std::time::Duration;
-        use tokio::sync::Semaphore;
-
-        let dir = tempfile::TempDir::new().unwrap();
-        let marker = dir.path().join("git.ran");
-        // Fake git records ANY invocation; cat-file reports a commit tip so the
-        // delta stage proceeds, rev-list yields an empty delta.
-        let fake = dir.path().join("fakegit");
-        std::fs::write(
-            &fake,
-            format!(
-                "#!/bin/sh\necho ran >> \"{}\"\ncase \"$1\" in\n  cat-file) echo commit ;;\n  *) : ;;\nesac\nexit 0\n",
-                marker.display()
-            ),
-        )
-        .unwrap();
-        let mut perm = std::fs::metadata(&fake).unwrap().permissions();
-        perm.set_mode(0o755);
-        std::fs::set_permissions(&fake, perm).unwrap();
-        let git_bin = fake.to_str().unwrap().to_string();
-        let tip = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef".to_string();
-
-        let sem: Arc<Semaphore> = Arc::new(Semaphore::new(0));
-        let blocked = tokio::time::timeout(
-            Duration::from_millis(500),
-            resolve_candidates_for_push(
-                sem.clone(),
-                dir.path().to_path_buf(),
-                vec![tip.clone()],
-                vec![],
-                git_bin.clone(),
-                Duration::from_secs(5),
-                false,
-            ),
-        )
-        .await;
-        assert!(
-            blocked.is_err(),
-            "the pin-candidate scan must defer (park on admission) when the pool is exhausted"
-        );
-        assert!(
-            !marker.exists(),
-            "the scan's git must not spawn while its admission permit is unavailable (F4)"
-        );
-
-        // Release admission: the SAME scan now runs (defer, not shed).
-        sem.add_permits(1);
-        let set = resolve_candidates_for_push(
-            sem,
-            dir.path().to_path_buf(),
-            vec![tip],
-            vec![],
-            git_bin,
-            Duration::from_secs(5),
-            false,
-        )
-        .await;
-        assert!(
-            marker.exists(),
-            "once admission is available the deferred scan runs its git"
-        );
-        assert!(!set.full_scan, "commit tip + empty rev-list is a delta");
-        assert!(set.candidates.is_empty());
-    }
-
-    /// F4 fast-path negative arm: a deletion-only push (no new tips, kill-switch
-    /// off) computes its empty delta without spawning ANY git child, so it must
-    /// complete without acquiring from the scan pool — even at zero permits. The
-    /// per-tip cat-file probe means every push with a non-empty new tip DOES spawn
-    /// git, so this is the only genuinely git-free stage.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn resolve_candidates_no_git_fast_path_skips_admission() {
-        use std::os::unix::fs::PermissionsExt;
-        use std::sync::Arc;
-        use std::time::Duration;
-        use tokio::sync::Semaphore;
-
-        let dir = tempfile::TempDir::new().unwrap();
-        let marker = dir.path().join("git.ran");
-        let fake = dir.path().join("fakegit");
-        std::fs::write(
-            &fake,
-            format!("#!/bin/sh\necho ran >> \"{}\"\nexit 0\n", marker.display()),
-        )
-        .unwrap();
-        let mut perm = std::fs::metadata(&fake).unwrap().permissions();
-        perm.set_mode(0o755);
-        std::fs::set_permissions(&fake, perm).unwrap();
-
-        let set = tokio::time::timeout(
-            Duration::from_millis(500),
-            resolve_candidates_for_push(
-                Arc::new(Semaphore::new(0)),
-                dir.path().to_path_buf(),
-                vec![],
-                vec!["deadbeefdeadbeefdeadbeefdeadbeefdeadbeef".to_string()],
-                fake.to_str().unwrap().to_string(),
-                Duration::from_secs(5),
-                false,
-            ),
-        )
-        .await
-        .expect("the no-new-tips fast path must not park on the scan pool");
-        assert_eq!(
-            set,
-            PinCandidateSet {
-                candidates: Vec::new(),
-                full_scan: false
-            }
-        );
-        assert!(!marker.exists(), "the fast path must spawn no git at all");
-    }
-
-    /// #174 F5: the coalesced-drain FullScan marker is signalled via the explicit
-    /// `force_full_scan` flag, and a flagged call with NO tips must still enumerate
-    /// the whole repo (full_scan=true, non-empty candidates). The RED arm of the
-    /// encoding question: if the marker were encoded as a plain empty-tips call
-    /// (flag off — the fast path), the drain would resolve to an empty delta and
-    /// pin nothing, silently losing the coalesced pushes' work.
-    #[tokio::test]
-    async fn forced_full_scan_with_no_tips_enumerates_the_repo() {
-        let repo = Repo::new();
-        repo.commit_file("a.txt", "one\n");
-        let all: HashSet<String> = list_all_objects(&repo.path, "git", td())
-            .unwrap()
-            .into_iter()
-            .collect();
-        assert!(!all.is_empty(), "fixture repo has objects");
-
-        let set = resolve_candidates_for_push(
-            std::sync::Arc::new(tokio::sync::Semaphore::new(64)),
-            repo.path.clone(),
-            vec![],
-            vec![],
-            "git".to_string(),
-            std::time::Duration::from_secs(600),
-            true,
-        )
-        .await;
-        assert!(set.full_scan, "the forced call is signalled as a full scan");
-        let got: HashSet<String> = set.candidates.into_iter().collect();
-        assert_eq!(
-            got, all,
-            "a forced full scan with no tips enumerates the repo — never an empty delta"
-        );
-
-        // The discriminator: the SAME empty-tips call without the flag is the
-        // deletion-only fast path (empty delta, pin nothing). The two must differ,
-        // or the marker encoding has collapsed into the silent-loss shape.
-        let unforced = resolve_candidates_for_push(
-            std::sync::Arc::new(tokio::sync::Semaphore::new(64)),
-            repo.path.clone(),
-            vec![],
-            vec![],
-            "git".to_string(),
-            std::time::Duration::from_secs(600),
-            false,
-        )
-        .await;
-        assert!(!unforced.full_scan);
-        assert!(unforced.candidates.is_empty());
-    }
-
     #[test]
     fn missing_oid_tip_forces_full_scan() {
         let repo = Repo::new();

crates/gitlawb-node/src/git/tigris.rs

@@ -31,25 +31,6 @@ impl TigrisClient {
         })
     }
 
-    /// Test-only constructor with an explicit S3 endpoint, region, and static
-    /// credentials — no env-var reads, so parallel tests cannot race each other's
-    /// `AWS_*` environment the way the env-based `new` would. Lets a test point
-    /// the client at a non-routable endpoint to exercise acquire-stall paths.
-    #[cfg(test)]
-    pub(crate) async fn for_testing_with_endpoint(bucket: &str, endpoint_url: &str) -> Self {
-        let creds = aws_sdk_s3::config::Credentials::new("test", "test", None, None, "test");
-        let config = aws_config::defaults(aws_config::BehaviorVersion::latest())
-            .endpoint_url(endpoint_url)
-            .region(aws_config::Region::new("auto"))
-            .credentials_provider(creds)
-            .load()
-            .await;
-        Self {
-            s3: S3Client::new(&config),
-            bucket: bucket.to_string(),
-        }
-    }
-
     /// S3 key for a given repo: `repos/v1/{owner_slug}/{repo_name}.tar.zst`
     fn repo_key(owner_slug: &str, repo_name: &str) -> String {
         format!("repos/v1/{owner_slug}/{repo_name}.tar.zst")

crates/gitlawb-node/src/graphql/mod.rs

@@ -14,68 +14,6 @@ use subscription::SubscriptionRoot;
 
 pub type GitlawbSchema = Schema<QueryRoot, MutationRoot, SubscriptionRoot>;
 
-/// Client-facing message for GraphQL resolver failures that wrap a real
-/// `sqlx::Error`. The real error is logged server-side; never put sqlx/Postgres
-/// detail in the GraphQL `errors` array (#250).
-///
-/// Kept as its own constant on this PR's base (main still renders
-/// `AppError::Db` with `e.to_string()`). If/when #247's `DB_ERROR_MESSAGE`
-/// lands, fold this into that shared constant.
-pub const GRAPHQL_DB_ERROR_MESSAGE: &str = "a database error occurred";
-
-fn anyhow_has_sqlx(e: &anyhow::Error) -> bool {
-    e.chain().any(|c| c.downcast_ref::<sqlx::Error>().is_some())
-}
-
-/// Map an `anyhow` failure from the db layer to a GraphQL error.
-///
-/// - Real DB faults (`sqlx::Error` anywhere in the chain) → opaque client
-///   message + `error!` log with the full `{e:#}` cause chain.
-/// - Application/business errors (e.g. claim race, not-in-claimed-state) →
-///   keep the actionable message; log at `warn!` so they are not mistaken for
-///   infrastructure failures (#250 review).
-pub(crate) fn graphql_db_err(e: anyhow::Error) -> async_graphql::Error {
-    if anyhow_has_sqlx(&e) {
-        tracing::error!(error = %format!("{e:#}"), "graphql database error");
-        async_graphql::Error::new(GRAPHQL_DB_ERROR_MESSAGE)
-    } else {
-        tracing::warn!(error = %format!("{e:#}"), "graphql application error");
-        async_graphql::Error::new(e.to_string())
-    }
-}
-
-/// Map an `AppError` from a shared collector (e.g. ref-update feed) to a
-/// GraphQL error.
-///
-/// Fail closed: only explicitly curated variants surface their `Display`
-/// text. Unnamed variants (including `Git`, which may embed on-disk paths)
-/// render opaque so a future addition cannot leak by default (#255 review).
-pub(crate) fn graphql_app_err(e: crate::error::AppError) -> async_graphql::Error {
-    match e {
-        crate::error::AppError::Db(sql) => graphql_db_err(sql.into()),
-        crate::error::AppError::Internal(err) => {
-            tracing::error!(error = %format!("{err:#}"), "graphql internal error");
-            async_graphql::Error::new(GRAPHQL_DB_ERROR_MESSAGE)
-        }
-        // Curated client-safe variants — `Display` is intentional API text.
-        safe @ (crate::error::AppError::RepoNotFound(_)
-        | crate::error::AppError::RepoExists(_)
-        | crate::error::AppError::NotFound(_)
-        | crate::error::AppError::Unauthorized(_)
-        | crate::error::AppError::Forbidden(_)
-        | crate::error::AppError::BadRequest(_)
-        | crate::error::AppError::TooManyRequests(_)
-        | crate::error::AppError::Incomplete(_)) => {
-            tracing::warn!(error = %safe, "graphql application error");
-            async_graphql::Error::new(safe.to_string())
-        }
-        other => {
-            tracing::error!(error = %other, "graphql unclassified AppError (opaque)");
-            async_graphql::Error::new(GRAPHQL_DB_ERROR_MESSAGE)
-        }
-    }
-}
-
 pub fn build_schema(
     db: Arc<Db>,
     ref_update_tx: tokio::sync::broadcast::Sender<RefUpdateBroadcast>,
@@ -87,105 +25,3 @@ pub fn build_schema(
         .data(task_event_tx)
         .finish()
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn graphql_db_err_opaques_sqlx_chain() {
-        let leak = "error returned from database: column \"is_public\" does not exist";
-        // Context layer must not hide sqlx from the chain walk (db helpers
-        // wrap with `.context(...)` in several places).
-        let err = graphql_db_err(
-            anyhow::Error::from(sqlx::Error::Protocol(leak.into())).context("loading repos"),
-        );
-        assert_eq!(err.message, GRAPHQL_DB_ERROR_MESSAGE);
-        assert!(!err.message.contains("is_public"));
-        assert!(!err.message.contains(leak));
-        assert!(!err.message.contains("loading repos"));
-    }
-
-    #[test]
-    fn graphql_db_err_keeps_business_message() {
-        let msg = "task not claimable: not found or already claimed";
-        let err = graphql_db_err(anyhow::anyhow!("{msg}"));
-        assert_eq!(err.message, msg);
-    }
-
-    #[test]
-    fn graphql_app_err_opaques_db_and_internal() {
-        let leak = "column \"is_public\" does not exist";
-        let db_err = graphql_app_err(crate::error::AppError::Db(sqlx::Error::Protocol(
-            leak.into(),
-        )));
-        assert_eq!(db_err.message, GRAPHQL_DB_ERROR_MESSAGE);
-        assert!(!db_err.message.contains("is_public"));
-
-        let internal = graphql_app_err(crate::error::AppError::Internal(anyhow::anyhow!(
-            "loading repo: {leak}"
-        )));
-        assert_eq!(internal.message, GRAPHQL_DB_ERROR_MESSAGE);
-        assert!(!internal.message.contains("is_public"));
-    }
-
-    #[test]
-    fn graphql_app_err_keeps_safe_variant_messages() {
-        let err = graphql_app_err(crate::error::AppError::NotFound("widget".into()));
-        assert!(
-            err.message.contains("widget"),
-            "safe NotFound message must reach the client: {}",
-            err.message
-        );
-        assert_ne!(err.message, GRAPHQL_DB_ERROR_MESSAGE);
-
-        let err = graphql_app_err(crate::error::AppError::BadRequest("bad cid".into()));
-        assert!(
-            err.message.contains("bad cid"),
-            "safe BadRequest message must reach the client: {}",
-            err.message
-        );
-        assert_ne!(err.message, GRAPHQL_DB_ERROR_MESSAGE);
-    }
-
-    #[test]
-    fn graphql_app_err_opaques_unclassified_variants() {
-        // `Git` may embed on-disk paths from libgit2; fail closed.
-        let path = "/var/lib/gitlawb/repos/owner/secret.git";
-        let err = graphql_app_err(crate::error::AppError::Git(format!(
-            "failed to open '{path}'"
-        )));
-        assert_eq!(err.message, GRAPHQL_DB_ERROR_MESSAGE);
-        assert!(!err.message.contains(path));
-        assert!(!err.message.contains("failed to open"));
-    }
-
-    /// Every `.map_err(` in the GraphQL query/mutation resolvers must route
-    /// through the opaque helpers, or discard the error (`|_|`). Same source-
-    /// scrape pattern as `api::authz_guard` (#255 review).
-    #[test]
-    fn every_graphql_map_err_uses_opaque_helpers() {
-        for (file, src) in [
-            ("query.rs", include_str!("query.rs")),
-            ("mutation.rs", include_str!("mutation.rs")),
-        ] {
-            for (lineno, line) in src.lines().enumerate() {
-                let code = line.split("//").next().unwrap_or(line);
-                let Some(idx) = code.find(".map_err(") else {
-                    continue;
-                };
-                let after = code[idx + ".map_err(".len()..].trim_start();
-                let ok = after.starts_with("crate::graphql::graphql_db_err")
-                    || after.starts_with("crate::graphql::graphql_app_err")
-                    || after.starts_with("|_|")
-                    || after.starts_with("|_ ");
-                assert!(
-                    ok,
-                    "{file}:{}: `.map_err(` must use graphql_db_err / graphql_app_err \
-                     or discard (`|_|`): {line}",
-                    lineno + 1
-                );
-            }
-        }
-    }
-}

crates/gitlawb-node/src/graphql/mutation.rs

@@ -54,7 +54,7 @@ impl MutationRoot {
         };
         db.create_task(&task)
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         Ok(AgentTaskType::from(task))
     }
 
@@ -76,7 +76,7 @@ impl MutationRoot {
         let task = db
             .claim_task(&id, &assignee_did)
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         let _ = tx.send(TaskEventBroadcast {
             task_id: id,
             old_status: "pending".to_string(),
@@ -108,7 +108,7 @@ impl MutationRoot {
         let existing = db
             .get_task(&id)
             .await
-            .map_err(crate::graphql::graphql_db_err)?
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?
             .ok_or_else(|| async_graphql::Error::new("task not found"))?;
         if !crate::api::did_matches(caller, existing.assignee_did.as_deref().unwrap_or_default()) {
             return Err(async_graphql::Error::new(
@@ -118,7 +118,7 @@ impl MutationRoot {
         let task = db
             .finish_task(&id, "completed", input.result.as_deref())
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         let _ = tx.send(TaskEventBroadcast {
             task_id: id,
             old_status: "claimed".to_string(),
@@ -149,7 +149,7 @@ impl MutationRoot {
         let existing = db
             .get_task(&id)
             .await
-            .map_err(crate::graphql::graphql_db_err)?
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?
             .ok_or_else(|| async_graphql::Error::new("task not found"))?;
         if !crate::api::did_matches(caller, existing.assignee_did.as_deref().unwrap_or_default()) {
             return Err(async_graphql::Error::new(
@@ -160,7 +160,7 @@ impl MutationRoot {
         let task = db
             .finish_task(&id, "failed", Some(&reason))
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         let _ = tx.send(TaskEventBroadcast {
             task_id: id,
             old_status: "claimed".to_string(),
@@ -218,9 +218,8 @@ mod tests {
             errors(&resp)
         );
 
-        // 3. Signed as the claimed assignee → passes the auth gate. The missing
-        //    task is a business error from claim_task, not a sqlx fault, so the
-        //    actionable message must survive (not the opaque DB string) (#250).
+        // 3. Signed as the claimed assignee → passes the auth gate (any remaining
+        //    error is the missing task, not an auth error).
         let resp = schema
             .execute(Request::new(&q).data(AuthenticatedDid(assignee.into())))
             .await;
@@ -229,47 +228,6 @@ mod tests {
             !errs.contains("authentication required") && !errs.contains("authenticated signer"),
             "matching signer must pass the auth gate: {errs}"
         );
-        assert!(
-            errs.contains("task not claimable"),
-            "claim race / missing task must keep its business message: {errs}"
-        );
-        assert!(
-            !errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
-            "business error must not be rewritten as opaque DB error: {errs}"
-        );
-    }
-
-    /// #250: mutation DB faults must be opaque; create_task hits agent_tasks.
-    #[sqlx::test]
-    async fn create_task_db_error_message_is_opaque(pool: PgPool) {
-        let state = crate::test_support::test_state(pool.clone()).await;
-        sqlx::query("ALTER TABLE agent_tasks DROP COLUMN status")
-            .execute(&pool)
-            .await
-            .unwrap();
-
-        let delegator = "did:key:zGQLDELEGATORAAAAAAAAAAAAAAAAAAAAAAAAAA";
-        let q = format!(
-            r#"mutation {{
-                createTask(
-                    delegatorDid: "{delegator}",
-                    input: {{ kind: "build", capability: "repo:write" }}
-                ) {{ id }}
-            }}"#
-        );
-        let resp = state
-            .graphql_schema
-            .execute(Request::new(&q).data(AuthenticatedDid(delegator.into())))
-            .await;
-        let errs = errors(&resp);
-        assert!(
-            errs.contains(crate::graphql::GRAPHQL_DB_ERROR_MESSAGE),
-            "sqlx fault must be opaque: {errs}"
-        );
-        assert!(
-            !errs.contains("column") && !errs.contains("status"),
-            "schema text leaked: {errs}"
-        );
     }
 
     /// Adversarial-review GATE-1 (GraphQL): completing a task requires being its

crates/gitlawb-node/src/graphql/query.rs

@@ -14,7 +14,7 @@ impl QueryRoot {
         let repos = db
             .list_all_repos_deduped()
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
 
         // Apply the same "/" visibility gate the REST/per-repo endpoints use so
         // this surface does not enumerate private repos (#97). The caller DID is
@@ -27,7 +27,7 @@ impl QueryRoot {
         let rules_by_repo = db
             .list_visibility_rules_for_repos(&ids)
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
 
         Ok(repos
             .into_iter()
@@ -71,27 +71,11 @@ impl QueryRoot {
         let updates =
             crate::api::events::collect_visible_ref_updates(db, repo.as_deref(), limit, caller)
                 .await
-                .map_err(crate::graphql::graphql_app_err)?;
+                .map_err(|e| async_graphql::Error::new(e.to_string()))?;
 
-        // Resolve the trusted display owner_did per row, identical to the REST
-        // feed: the stored wire value is untrusted, so it is echoed only when it
-        // matches the canonical owner of the local repo the slug names (#P1);
-        // legacy None rows are attributed via an exact unique local match (#P3).
-        // The batch resolver issues at most one query per distinct local repo
-        // rather than one per event row (#P2).
-        let pairs: Vec<(&str, Option<&str>)> = updates
-            .iter()
-            .map(|u| (u.repo.as_str(), u.owner_did.as_deref()))
-            .collect();
-        let owner_dids = db
-            .resolve_ref_update_owner_dids(&pairs)
-            .await
-            .map_err(crate::graphql::graphql_db_err)?;
-
-        let resolved: Vec<RefUpdateType> = updates
+        Ok(updates
             .into_iter()
-            .zip(owner_dids)
-            .map(|(u, owner_did)| RefUpdateType {
+            .map(|u| RefUpdateType {
                 repo: u.repo,
                 ref_name: u.ref_name,
                 old_sha: u.old_sha,
@@ -99,10 +83,8 @@ impl QueryRoot {
                 pusher_did: u.pusher_did,
                 node_did: u.node_did,
                 timestamp: u.timestamp,
-                owner_did,
             })
-            .collect();
-        Ok(resolved)
+            .collect())
     }
 
     async fn tasks(
@@ -110,21 +92,13 @@ impl QueryRoot {
         ctx: &Context<'_>,
         status: Option<String>,
         assignee_did: Option<String>,
-        #[graphql(
-            default = 50,
-            desc = "Max 200; larger requests are clamped to 200 (no error). Negative values clamp to 0."
-        )]
-        limit: i64,
+        #[graphql(default = 50)] limit: i64,
     ) -> Result<Vec<AgentTaskType>> {
         let db = ctx.data_unchecked::<Arc<Db>>();
-        // Clamp before SQL: a negative LIMIT is a client fault that Postgres
-        // rejects with 2201W, which would otherwise trip the opaque DB path
-        // and write an error-level log on every probe (#250 review).
-        let limit = limit.clamp(0, 200);
         let tasks = db
             .list_tasks(status.as_deref(), assignee_did.as_deref(), limit)
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         Ok(tasks.into_iter().map(AgentTaskType::from).collect())
     }
 
@@ -133,7 +107,7 @@ impl QueryRoot {
         let t = db
             .get_task(&id)
             .await
-            .map_err(crate::graphql::graphql_db_err)?;
+            .map_err(|e| async_graphql::Error::new(e.to_string()))?;
         Ok(t.map(AgentTaskType::from))
     }
 }
@@ -188,7 +162,6 @@ mod tests {
             cert_id: None,
             received_at: Utc::now().to_rfc3339(),
             from_peer: "peer1".into(),
-            owner_did: None,
         }
     }
 
@@ -272,10 +245,10 @@ mod tests {
             .await
             .unwrap();
         let schema = schema(db);
-        let q = r#"{ refUpdates { repo refName ownerDid } }"#;
+        let q = r#"{ refUpdates { repo refName } }"#;
         let resp = anon(&schema, q).await;
         assert_eq!(count(&resp), 1);
-        // The one row returned must be the public repo's with owner_did echoed.
+        // The one row returned must be the public repo's.
         let async_graphql::Value::Object(obj) = &resp.data else {
             unreachable!()
         };
@@ -289,11 +262,6 @@ mod tests {
             row.get("repo").unwrap(),
             &async_graphql::Value::from("z6MkOwner/openrepo")
         );
-        assert_eq!(
-            row.get("ownerDid").unwrap(),
-            &async_graphql::Value::from(OWNER),
-            "ownerDid must fall back to the local record's owner for legacy rows"
-        );
     }
 
     // Scenario 4 — alias fail-closed: private repo's row stored full-DID form.
@@ -427,91 +395,4 @@ mod tests {
         let q = r#"{ refUpdates { repo } }"#;
         assert_eq!(count(&authed(&schema, q, "did:key:z6MkQuar").await), 0);
     }
-
-    /// #250: anonymous GraphQL query DB failures must not leak sqlx/schema text.
-    #[sqlx::test]
-    async fn repos_query_db_error_message_is_opaque(pool: PgPool) {
-        let db = db(pool.clone()).await;
-        db.create_repo(&repo("r1", OWNER, "widget", true))
-            .await
-            .unwrap();
-        sqlx::query("ALTER TABLE repos DROP COLUMN is_public")
-            .execute(&pool)
-            .await
-            .unwrap();
-
-        let schema = schema(db);
-        let resp = anon(&schema, "{ repos { name ownerDid } }").await;
-        assert!(
-            !resp.errors.is_empty(),
-            "DB failure must surface as a GraphQL error"
-        );
-        for err in &resp.errors {
-            assert_eq!(
-                err.message,
-                crate::graphql::GRAPHQL_DB_ERROR_MESSAGE,
-                "raw DB detail leaked into GraphQL error: {}",
-                err.message
-            );
-            assert!(
-                !err.message.contains("is_public") && !err.message.contains("column"),
-                "schema text leaked: {}",
-                err.message
-            );
-        }
-    }
-
-    /// #250: negative tasks(limit) must not hit Postgres (and must not 500-log).
-    #[sqlx::test]
-    async fn tasks_negative_limit_clamped(pool: PgPool) {
-        let db = db(pool).await;
-        let schema = schema(db);
-        let resp = anon(&schema, "{ tasks(limit: -1) { id } }").await;
-        assert!(
-            resp.errors.is_empty(),
-            "negative limit must clamp, not fail: {:?}",
-            resp.errors
-        );
-        assert_eq!(count_tasks(&resp), 0);
-    }
-
-    /// #255: ceiling of the tasks(limit) clamp must be held (schema promises Max 200).
-    #[sqlx::test]
-    async fn tasks_limit_ceiling_clamped_to_200(pool: PgPool) {
-        let db = db(pool).await;
-        let now = Utc::now().to_rfc3339();
-        for i in 0..201 {
-            db.create_task(&crate::db::AgentTask {
-                id: format!("task-ceil-{i}"),
-                repo_id: None,
-                kind: "build".into(),
-                status: "pending".into(),
-                delegator_did: OWNER.into(),
-                assignee_did: None,
-                capability: "repo:write".into(),
-                ucan_token: None,
-                payload: None,
-                result: None,
-                created_at: now.clone(),
-                updated_at: now.clone(),
-                deadline: None,
-            })
-            .await
-            .unwrap();
-        }
-        let schema = schema(db);
-        let resp = anon(&schema, "{ tasks(limit: 5000) { id } }").await;
-        assert_eq!(count_tasks(&resp), 200, "limit above 200 must clamp to 200");
-    }
-
-    fn count_tasks(resp: &async_graphql::Response) -> usize {
-        assert!(resp.errors.is_empty(), "graphql errors: {:?}", resp.errors);
-        let async_graphql::Value::Object(obj) = &resp.data else {
-            panic!("data not an object: {:?}", resp.data);
-        };
-        let async_graphql::Value::List(rows) = obj.get("tasks").expect("tasks key") else {
-            panic!("tasks not a list");
-        };
-        rows.len()
-    }
 }

crates/gitlawb-node/src/graphql/subscription.rs

@@ -39,7 +39,6 @@ impl SubscriptionRoot {
                     pusher_did: ev.pusher_did,
                     node_did: ev.node_did,
                     timestamp: ev.timestamp,
-                    owner_did: Some(ev.owner_did),
                 }),
                 _ => None,
             }

crates/gitlawb-node/src/graphql/types.rs

@@ -57,7 +57,6 @@ pub struct RefUpdateType {
     pub pusher_did: String,
     pub node_did: String,
     pub timestamp: String,
-    pub owner_did: Option<String>,
 }
 
 #[derive(SimpleObject, Clone)]

crates/gitlawb-node/src/main.rs

@@ -31,7 +31,6 @@ use axum::response::IntoResponse;
 use axum::routing::get;
 use axum::{Json, Router};
 use clap::Parser;
-use std::collections::HashSet;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
 use tokio::net::TcpListener;
@@ -59,6 +58,32 @@ struct DbStartupStatus {
     next_retry_secs: AtomicU64,
 }
 
+/// Hard ceiling on the advisory-lock pool's `max_connections`.
+///
+/// `max_concurrent_git_pushes` is validated all the way up to 1_048_576, and the lock
+/// pool used to derive its size straight from that knob, so raising the push cap
+/// silently raised the node's Postgres connection ceiling with no CLI error and no
+/// relation to the server's own `max_connections` (#173 F4). The node's total budget is
+/// now bounded: `db_max_connections` (default 20) + at most this.
+const LOCK_POOL_MAX_CONNECTIONS: u32 = 64;
+
+/// Connections the lock pool keeps above the push cap. Covers the three non-push
+/// `acquire_write` callers (`api/issues.rs` x2, `api/pulls.rs`), which hold no
+/// concurrency permit, so a push never queues here for a connection where it did not
+/// before.
+const LOCK_POOL_PUSH_HEADROOM: u8 = 8;
+
+/// Size the advisory-lock pool for a given push cap: the cap plus
+/// [`LOCK_POOL_PUSH_HEADROOM`], clamped to [`LOCK_POOL_MAX_CONNECTIONS`]. Past the
+/// clamp a push may wait for a lock-pool connection, which is a bounded wait that sheds
+/// a clean 503 (see `LockPoolBusy`), not an unbounded hang.
+fn lock_pool_size(max_concurrent_git_pushes: usize) -> u32 {
+    u32::try_from(max_concurrent_git_pushes)
+        .unwrap_or(u32::MAX)
+        .saturating_add(u32::from(LOCK_POOL_PUSH_HEADROOM))
+        .min(LOCK_POOL_MAX_CONNECTIONS)
+}
+
 #[tokio::main]
 async fn main() -> Result<()> {
     tracing_subscriber::fmt()
@@ -75,13 +100,6 @@ async fn main() -> Result<()> {
     // bootstrap peers. Operators can opt out via GITLAWB_BOOTSTRAP_DISABLE_SEEDS.
     bootstrap::merge_seeds(&mut config);
 
-    // Fail fast on config combinations that are individually in-range but jointly
-    // unsafe — notably a DB pool too small for the concurrent-write cap, which
-    // would let a push burst starve every other DB path (#174 F1).
-    config
-        .validate()
-        .map_err(|e| anyhow::anyhow!("invalid configuration: {e}"))?;
-
     if !config.public_read {
         warn!(
             "GITLAWB_PUBLIC_READ=false is reserved; per-repository private-read enforcement is not wired in alpha"
@@ -287,8 +305,17 @@ async fn main() -> Result<()> {
         None
     };
 
-    let repo_store =
-        git::repo_store::RepoStore::new(config.repos_dir.clone(), tigris, db.pool().clone());
+    // Repo write locks run on their own pool, never the main query pool: each
+    // push holds its connection for the whole receive-pack, and
+    // db_max_connections (20) is below max_concurrent_git_pushes (32), so sharing
+    // would starve every other query under a push burst. See build_lock_pool for
+    // the cancellation semantics (#173).
+    let lock_pool = git::repo_store::build_lock_pool(
+        db.pool(),
+        lock_pool_size(config.max_concurrent_git_pushes),
+        std::time::Duration::from_secs(config.db_acquire_timeout_secs),
+    );
+    let repo_store = git::repo_store::RepoStore::new(config.repos_dir.clone(), tigris, lock_pool);
 
     // Per-DID limiter for the creation endpoints. Keyed on the authenticated
     // DID (attacker-varied), so bound its key set to cap memory.
@@ -382,6 +409,12 @@ async fn main() -> Result<()> {
         rate_limiter,
         create_ip_rate_limiter,
         push_rate_limiter,
+        ipfs_max_history_walks: crate::api::ipfs::MAX_HISTORY_WALKS_PER_REQUEST,
+        // The legacy-probe budget is operator-tunable via GITLAWB_IPFS_MAX_REPOS_WALKED
+        // (R5); the history-walk ceiling above stays constant (a smaller value false-503s
+        // a provenanced request). Default 256 preserves the shipped behaviour.
+        ipfs_max_legacy_probes: AppState::ipfs_legacy_probe_budget(&config),
+        ipfs_max_served_object_bytes: crate::api::ipfs::MAX_SERVED_OBJECT_BYTES,
         push_limiter_trust,
         sync_trigger_rate_limiter,
         peer_write_rate_limiter,
@@ -403,44 +436,27 @@ async fn main() -> Result<()> {
         git_encrypt_semaphore: Arc::new(tokio::sync::Semaphore::new(
             config.max_concurrent_git_pushes,
         )),
-        // Bounds how many post-push pin loops run concurrently across all repos (#174 F6),
-        // independent of the per-repo encrypt-task coalescing below. Not a bound on the
-        // MB-scale object-id lists themselves: parked tasks still hold theirs (see the
-        // field doc on AppState::pin_semaphore).
-        pin_semaphore: Arc::new(tokio::sync::Semaphore::new(config.max_concurrent_pin_tasks)),
         // Coalesces the DETACHED post-push encryption tasks per repo so a rapid pusher
         // cannot grow the outstanding parked-waiter set past one task per repo (#174
         // P2-2). No knob: it is a natural cap (one entry per distinct repo), not a
         // sized pool.
         encrypt_inflight: crate::state::EncryptInflight::new(),
-        // Per-repo in-process write-lease serializer (#174 U2/F3): supplements the pg
-        // advisory lock so a disconnected push's still-reaping git group can't be raced
-        // by a second same-node push. The map is naturally capped (one entry per contended
-        // repo, freed when unreferenced); the sized knob is how many pushes may PARK on
-        // one repo, since each parked push holds a fully buffered pack.
-        repo_write_leases: crate::state::RepoWriteLeases::new(config.repo_lease_max_waiters),
         git_read_per_caller: rate_limit::PerCallerConcurrency::with_default_max_keys(
             config.max_concurrent_reads_per_caller,
         ),
         // Per-source cap on the receive-pack advertisement, sized to an eighth of the
-        // write pool (min 1): one resolved client key (rate_limit::client_key) can hold
-        // at most this many slots in the DEDICATED advert pool (git_push_advert_semaphore,
-        // disjoint from the write pool), so saturating that pool takes ~8 distinct keys
-        // (#174). That bounds an IPv4 or single-address caller; a caller controlling many
-        // addresses (an IPv6 /64 is 2^64 keys) still gets one cap per address, since
-        // client_key uses the full IP with no prefix folding. Narrowing the keying is a
-        // deferred design call, not something these caps claim to solve. Sized off the
-        // write pool only because the advert pool is created at the same size; an advert
-        // flood cannot touch a write permit.
+        // write pool (min 1): a single source can hold at most this many write-pool
+        // slots via the anon advertisement, so saturating the pool takes ~8 distinct
+        // source IPs, each also rate-limited (#174).
         git_push_advert_per_caller: rate_limit::PerCallerConcurrency::with_default_max_keys(
-            rate_limit::per_source_push_cap(config.max_concurrent_git_pushes),
+            (config.max_concurrent_git_pushes / 8).max(1),
         ),
         // Per-source cap on the authenticated receive-pack POST, sized like the advert
-        // cap: one resolved client key can hold at most this many write-pool slots, so
-        // monopolizing the pool takes ~8 distinct keys (#174 P1-d). Same residual as
-        // above: keys are full IPs, so a caller with many addresses has many caps.
+        // cap: one source IP can hold at most this many write-pool slots, so
+        // monopolizing the pool takes ~8 distinct source IPs, each also rate-limited
+        // (#174 P1-d).
         git_write_per_caller: rate_limit::PerCallerConcurrency::with_default_max_keys(
-            rate_limit::per_source_push_cap(config.max_concurrent_git_pushes),
+            (config.max_concurrent_git_pushes / 8).max(1),
         ),
         // Bounds concurrent /ipfs visibility walks — a distinct public cost center, so
         // its own pool + per-source sub-cap + per-IP rate limiter, never a git pool
@@ -456,6 +472,15 @@ async fn main() -> Result<()> {
             std::time::Duration::from_secs(3600),
             200_000,
         ),
+        // Separate WORK-budget bucket for the resolver's per-probe/per-walk charges (R6).
+        // Its capacity is DERIVED from the route limit (no new knob) and floored at the
+        // legacy-probe budget, so one full default-config legacy scan never self-throttles
+        // mid-request while the route brake above stays the pure once-per-request cap.
+        ipfs_work_rate_limiter: rate_limit::RateLimiter::new_bounded(
+            AppState::ipfs_work_budget(&config),
+            std::time::Duration::from_secs(3600),
+            200_000,
+        ),
         git_bin: "git".to_string(),
     };
     if config.ipfs_rate_limit == 0 {
@@ -490,14 +515,16 @@ async fn main() -> Result<()> {
 
     // Periodic cleanup of expired rate limit entries + consumed-proof ledger
     {
-        let sweep_state = state.clone();
+        let cleanup_state = state.clone();
         let db = state.db.clone();
         let mut shutdown_rx = state.subscribe_shutdown();
         tokio::spawn(async move {
             loop {
                 tokio::select! {
                     _ = tokio::time::sleep(std::time::Duration::from_secs(300)) => {
-                        sweep_rate_limiters(&sweep_state).await;
+                        // Sweep every per-IP/DID limiter (incl. the ipfs walk brake)
+                        // so bounded maps shed stale keys instead of sitting at cap.
+                        cleanup_state.sweep_rate_limiters().await;
                         let now = std::time::SystemTime::now()
                             .duration_since(std::time::UNIX_EPOCH)
                             .map(|d| d.as_secs() as i64)
@@ -516,6 +543,8 @@ async fn main() -> Result<()> {
         });
     }
 
+    let _legacy_cid_sweep = spawn_legacy_cid_sweep(&state, &config);
+
     let router = server::build_router(state.clone());
     // Re-register the socket bound at startup — same fd, so there was never a
     // moment with the port closed between the degraded and full servers.
@@ -638,6 +667,49 @@ async fn main() -> Result<()> {
     Ok(())
 }
 
+/// U4 (#173): spawn the one-shot legacy provider-CID repair sweep. Releases before this
+/// version stored the PROVIDER CID (Kubo dag-pb / Pinata CIDv0) in `pinned_cids.cid`,
+/// and this version's `/ipfs/{cid}` resolver withholds any row whose stored key is not
+/// the raw-content CID. The opportunistic repair on the pin path only fires when a push
+/// re-carries the object, which normal git negotiation makes it not do, so those rows
+/// need a walk. DETACHED, never on the boot path: the caller keeps serving while this
+/// runs, and the sweep's own batch bound plus inter-batch delay keep it off the DB's
+/// critical path. Its cursor is durable, so a restart mid-walk resumes instead of
+/// rewinding.
+///
+/// A named function rather than an inline block in `main` so the WIRING has a seam a
+/// test can call: that the task is spawned at all, that it reads its batch and delay
+/// from the config knobs rather than some other field, that the caller is not blocked
+/// on it, and that the shutdown watcher actually ends it mid-walk. The sweep's own
+/// behavior is covered elsewhere; this is the boot-path half.
+fn spawn_legacy_cid_sweep(state: &AppState, config: &Config) -> tokio::task::JoinHandle<()> {
+    let db = state.db.clone();
+    let repos_dir = config.repos_dir.clone();
+    let git_bin = state.git_bin.clone();
+    let git_timeout = std::time::Duration::from_secs(config.git_service_timeout_secs);
+    let batch = config.pin_repair_sweep_batch;
+    let delay = std::time::Duration::from_secs(config.pin_repair_sweep_delay_secs);
+    let mut shutdown_rx = state.subscribe_shutdown();
+    tokio::spawn(async move {
+        tokio::select! {
+            stats = ipfs_pin::sweep_legacy_provider_cids(
+                &repos_dir, &git_bin, git_timeout, batch, delay, &db,
+            ) => {
+                if stats.repaired > 0 {
+                    tracing::info!(
+                        scanned = stats.scanned,
+                        repaired = stats.repaired,
+                        "legacy provider-CID sweep finished"
+                    );
+                }
+            }
+            // Shutdown mid-walk simply drops the run; the persisted cursor means the
+            // next boot picks up where this one stopped.
+            _ = shutdown_rx.changed() => {}
+        }
+    })
+}
+
 fn spawn_shutdown_signal(tx: watch::Sender<bool>) {
     tokio::spawn(async move {
         #[cfg(unix)]
@@ -807,8 +879,8 @@ fn build_degraded_router(node_did: String, db_startup: Arc<DbStartupStatus>) ->
         db_startup,
     };
     // Everything answers 503 with the same body — including /health and
-    // /ready, so peer readiness probes and uptime monitors correctly see a
-    // node that cannot serve traffic.
+    // /ready, so peer pings (which treat any 2xx /health as alive) and
+    // uptime monitors correctly see a node that cannot serve traffic.
     // `/` additionally carries the node identity for probing peers.
     Router::new()
         .route("/", get(degraded_node_info))
@@ -940,7 +1012,7 @@ async fn gossip_task(
     }
 
     // Reuse the shared no-redirect client for every gossip outbound call (the
-    // bootstrap announce POST and the periodic peer /ready ping). Peer URLs are
+    // bootstrap announce POST and the periodic peer /health ping). Peer URLs are
     // attacker-influenceable, so a 3xx to a private address must not be followed.
     // Do NOT fall back to reqwest::Client::new(): its default follows redirects
     // and would reintroduce the SSRF closed here (#93).
@@ -995,33 +1067,8 @@ async fn gossip_task(
                             json.get("node_url").and_then(|v| v.as_str()),
                         ) {
                             if !their_url.is_empty() {
-                                // Unproven, unconditionally: their_did and
-                                // their_url come straight out of the contacted
-                                // peer's JSON response body, with no signature
-                                // and no proof the claimed DID belongs to the
-                                // peer we reached. This path therefore seeds
-                                // new peers and can never repoint an existing
-                                // row. The upsert's result is matched rather
-                                // than discarded, because "bootstrap peer
-                                // added" printed over a refused write is a
-                                // denial rendering as success. Non-fatal to the
-                                // loop either way.
-                                match state
-                                    .db
-                                    .upsert_peer(
-                                        their_did,
-                                        their_url,
-                                        db::PeerWriteAuthority::Unproven,
-                                    )
-                                    .await
-                                {
-                                    Ok(()) => {
-                                        tracing::info!(did = %their_did, url = %their_url, "bootstrap peer added")
-                                    }
-                                    Err(e) => {
-                                        tracing::warn!(did = %their_did, url = %their_url, err = %e, "bootstrap peer announce-back rejected")
-                                    }
-                                }
+                                let _ = state.db.upsert_peer(their_did, their_url).await;
+                                tracing::info!(did = %their_did, url = %their_url, "bootstrap peer added");
                             }
                         }
                     }
@@ -1036,8 +1083,6 @@ async fn gossip_task(
 
     // Periodic ping every 5 minutes — exit on shutdown.
     let mut interval = tokio::time::interval(std::time::Duration::from_secs(300));
-    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
-    let mut failed_once: HashSet<String> = HashSet::new();
     loop {
         tokio::select! {
             _ = interval.tick() => {
@@ -1045,13 +1090,10 @@ async fn gossip_task(
                     Ok(p) => p,
                     Err(_) => continue,
                 };
-                gossip_ping_round(
-                    state.db.as_ref(),
-                    client.as_ref(),
-                    &mut failed_once,
-                    peers,
-                )
-                .await;
+                for peer in peers {
+                    let ok = ping_peer_health(&client, &peer.http_url).await;
+                    let _ = state.db.mark_peer_ping(&peer.did, ok).await;
+                }
             }
             _ = shutdown_rx.changed() => {
                 if *shutdown_rx.borrow() {
@@ -1063,106 +1105,6 @@ async fn gossip_task(
     }
 }
 
-#[cfg(test)]
-mod rate_limiter_sweep_tests {
-    use crate::rate_limit::RateLimiter;
-    use std::time::Duration;
-
-    // Every per-key limiter the router mounts must be swept by the periodic
-    // task, the `/ipfs` one included: a limiter left out keeps expired keys
-    // until its map fills and the inline capacity sweep fires. Fails on the
-    // pre-fix sweeper, which skipped `ipfs_rate_limiter`.
-    #[tokio::test]
-    async fn sweep_evicts_expired_keys_from_every_limiter() {
-        let window = Duration::from_millis(30);
-        let mut state = crate::test_support::test_state_lazy();
-        state.rate_limiter = RateLimiter::new(10, window);
-        state.create_ip_rate_limiter = RateLimiter::new(10, window);
-        state.push_rate_limiter = RateLimiter::new(10, window);
-        state.sync_trigger_rate_limiter = RateLimiter::new(10, window);
-        state.peer_write_rate_limiter = RateLimiter::new(10, window);
-        state.ipfs_rate_limiter = RateLimiter::new(10, window);
-
-        let limiters = |s: &crate::state::AppState| {
-            [
-                s.rate_limiter.clone(),
-                s.create_ip_rate_limiter.clone(),
-                s.push_rate_limiter.clone(),
-                s.sync_trigger_rate_limiter.clone(),
-                s.peer_write_rate_limiter.clone(),
-                s.ipfs_rate_limiter.clone(),
-            ]
-        };
-        for l in limiters(&state) {
-            assert!(l.check("1.2.3.4").await);
-            assert_eq!(l.tracked_keys().await, 1);
-        }
-
-        tokio::time::sleep(window * 3).await;
-        super::sweep_rate_limiters(&state).await;
-
-        for (i, l) in limiters(&state).into_iter().enumerate() {
-            assert_eq!(l.tracked_keys().await, 0, "limiter {i} was not swept");
-        }
-    }
-}
-
-/// Evict expired entries from every per-key rate limiter on the state.
-///
-/// Named and driven off `AppState` so the periodic sweeper stays in step with
-/// the limiters the router actually mounts: adding a limiter field and
-/// forgetting it here leaves its keys pinned until the map hits `max_keys` and
-/// the inline capacity sweep runs (the `/ipfs` limiter was missed this way).
-async fn sweep_rate_limiters(state: &AppState) {
-    state.rate_limiter.cleanup().await;
-    state.create_ip_rate_limiter.cleanup().await;
-    state.push_rate_limiter.cleanup().await;
-    state.sync_trigger_rate_limiter.cleanup().await;
-    state.peer_write_rate_limiter.cleanup().await;
-    state.ipfs_rate_limiter.cleanup().await;
-}
-
-async fn gossip_ping_round(
-    db: &Db,
-    client: &reqwest::Client,
-    failed_once: &mut HashSet<String>,
-    peers: Vec<db::PeerRecord>,
-) {
-    {
-        let current_dids: HashSet<&str> = peers.iter().map(|peer| peer.did.as_str()).collect();
-        failed_once.retain(|did| current_dids.contains(did.as_str()));
-    }
-    for peer in peers {
-        let ok = ping_peer_readiness(client, &peer.http_url).await;
-        match peer_ping_db_update(failed_once, &peer.did, ok) {
-            Some(reachable) => {
-                if let Err(error) = db.mark_peer_ping(&peer.did, reachable).await {
-                    warn!(did = %peer.did, err = %error, "failed to persist peer readiness");
-                }
-            }
-            None => warn!(
-                did = %peer.did,
-                "peer readiness probe failed once; preserving previous federation status"
-            ),
-        }
-    }
-}
-
-/// Decide whether one readiness sample should update the persisted federation
-/// gate. A success is authoritative immediately. A failure must repeat on the
-/// next gossip tick before it can mark a peer unreachable, so one transient
-/// database hiccup does not hide the peer's repositories for five minutes.
-fn peer_ping_db_update(failed_once: &mut HashSet<String>, did: &str, ready: bool) -> Option<bool> {
-    if ready {
-        failed_once.remove(did);
-        Some(true)
-    } else if failed_once.insert(did.to_owned()) {
-        None
-    } else {
-        Some(false)
-    }
-}
-
 /// Build the shared node HTTP client used for every outbound fan-out (sync
 /// trigger, profile/repo fetches, gossip announce + peer pings).
 ///
@@ -1173,96 +1115,26 @@ fn peer_ping_db_update(failed_once: &mut HashSet<String>, did: &str, ready: bool
 /// runs, not a hand-rolled equivalent.
 fn build_http_client() -> reqwest::Result<reqwest::Client> {
     reqwest::Client::builder()
-        .timeout(OUTBOUND_HTTP_TIMEOUT)
+        .timeout(std::time::Duration::from_secs(10))
         .redirect(reqwest::redirect::Policy::none())
         .build()
 }
 
-const OUTBOUND_HTTP_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
-
-/// Ping a peer's DB-aware `/ready` endpoint and report whether it answered 2xx.
-///
-/// A 404 falls back to `/health` for compatibility with nodes released before
-/// `/ready` existed. Other readiness failures, including 503 during a database
-/// outage, fail closed and must not use the liveness-only endpoint. The complete
-/// `/ready`-then-`/health` probe shares one timeout budget.
+/// Ping a peer's `/health` endpoint and report whether it answered 2xx.
 ///
 /// Takes the client by reference so callers supply the shared, no-redirect
 /// `state.http_client`. Peer URLs are attacker-influenceable, so a `3xx` to a
 /// private address must not be followed. Do NOT call this with a bare
 /// `reqwest::Client::new()`: its default follows redirects and would
 /// reintroduce the SSRF this guards against (#93).
-pub(crate) async fn ping_peer_readiness(client: &reqwest::Client, http_url: &str) -> bool {
-    ping_peer_readiness_with_timeout(client, http_url, OUTBOUND_HTTP_TIMEOUT).await
-}
-
-async fn ping_peer_readiness_with_timeout(
-    client: &reqwest::Client,
-    http_url: &str,
-    timeout: std::time::Duration,
-) -> bool {
-    let base_url = http_url.trim_end_matches('/');
-    let result = tokio::time::timeout(timeout, async {
-        let readiness = client.get(format!("{base_url}/ready")).send().await;
-
-        match readiness {
-            Ok(response) if response.status().is_success() => true,
-            Ok(response) if response.status() == reqwest::StatusCode::NOT_FOUND => {
-                info!(
-                    peer_url = %http_url,
-                    "peer has no readiness endpoint; falling back to legacy health probe"
-                );
-                match client.get(format!("{base_url}/health")).send().await {
-                    Ok(response) if response.status().is_success() => true,
-                    Ok(response) => {
-                        warn!(
-                            peer_url = %http_url,
-                            status = %response.status(),
-                            "legacy peer health probe reported unhealthy"
-                        );
-                        false
-                    }
-                    Err(error) => {
-                        warn!(
-                            peer_url = %http_url,
-                            err = %error,
-                            "legacy peer health probe failed"
-                        );
-                        false
-                    }
-                }
-            }
-            Ok(response) => {
-                warn!(
-                    peer_url = %http_url,
-                    status = %response.status(),
-                    "peer readiness probe reported unready"
-                );
-                false
-            }
-            Err(error) => {
-                warn!(
-                    peer_url = %http_url,
-                    err = %error,
-                    "peer readiness probe failed"
-                );
-                false
-            }
-        }
-    })
-    .await;
-
-    match result {
-        Ok(ready) => ready,
-        Err(_) => {
-            warn!(
-                peer_url = %http_url,
-                timeout_ms = timeout.as_millis(),
-                "peer readiness probe timed out"
-            );
-            false
-        }
-    }
+async fn ping_peer_health(client: &reqwest::Client, http_url: &str) -> bool {
+    let url = format!("{}/health", http_url.trim_end_matches('/'));
+    client
+        .get(&url)
+        .send()
+        .await
+        .map(|r| r.status().is_success())
+        .unwrap_or(false)
 }
 
 fn load_or_create_keypair(config: &Config) -> Result<Keypair> {
@@ -1299,131 +1171,155 @@ fn load_or_create_keypair(config: &Config) -> Result<Keypair> {
 }
 
 #[cfg(test)]
-mod gossip_ssrf_tests {
-    use super::{
-        gossip_ping_round, peer_ping_db_update, ping_peer_readiness,
-        ping_peer_readiness_with_timeout,
-    };
-    use axum::{http::StatusCode, routing::get, Router};
+mod legacy_cid_sweep_wiring_tests {
+    use super::spawn_legacy_cid_sweep;
     use sqlx::PgPool;
-    use std::collections::HashSet;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use std::sync::Arc;
     use std::time::Duration;
 
+    /// Seed `count` `pinned_cids` rows whose keys are already canonical raw CIDv1, in a
+    /// known `sha256_hex` order. The sweep's own cost gate skips a raw-CIDv1 row without
+    /// reading bytes or resolving a repo, so each row is SCANNED (it advances the cursor)
+    /// and nothing else. That is what makes the cursor a clean readout of how far the
+    /// walk got, with no dependency on repos on disk.
+    async fn seed_scannable_rows(pool: &PgPool, count: usize) -> Vec<String> {
+        let mut shas = Vec::new();
+        for i in 1..=count {
+            let sha = format!("wire{i:02}");
+            let cid = gitlawb_core::cid::Cid::from_git_object_bytes(sha.as_bytes()).to_string();
+            assert!(
+                gitlawb_core::cid::is_raw_cidv1(&cid),
+                "the seeded key must hit the sweep's raw-CIDv1 skip, not a repair attempt"
+            );
+            sqlx::query("INSERT INTO pinned_cids (sha256_hex, cid, pinned_at) VALUES ($1, $2, $3)")
+                .bind(&sha)
+                .bind(&cid)
+                .bind("2020-01-01T00:00:00Z")
+                .execute(pool)
+                .await
+                .unwrap();
+            shas.push(sha);
+        }
+        shas
+    }
+
+    /// Poll the persisted sweep cursor until it reaches `want`, or give up.
+    async fn cursor_reaches(db: &crate::db::Db, want: &str, within: Duration) -> String {
+        let deadline = std::time::Instant::now() + within;
+        loop {
+            let c = db.pin_repair_cursor().await.unwrap();
+            if c == want || std::time::Instant::now() >= deadline {
+                return c;
+            }
+            tokio::time::sleep(Duration::from_millis(20)).await;
+        }
+    }
+
+    /// #173 U4, the BOOT-PATH half. The sweep's own logic (batching, cursor resumption,
+    /// terminal vs retryable skips) is covered in `test_support`; what this covers is the
+    /// wiring `main` performs, which nothing else executes: the task is spawned at all,
+    /// it takes its batch and delay from the two `pin_repair_sweep_*` knobs rather than
+    /// some other config field, the caller is not blocked on the walk, and the shutdown
+    /// watcher ends the run mid-walk.
+    ///
+    /// Six scannable rows, batch 2, delay 30s. One pass must land the cursor on exactly
+    /// the second row and the task must then still be alive in its inter-batch sleep,
+    /// which pins both knobs at once: a different batch stops at a different row, and a
+    /// delay that did not come from the knob either finishes the table or leaves the task
+    /// gone. Shutdown must then end it while four rows are still unwalked.
+    #[sqlx::test]
+    async fn the_boot_path_spawns_the_sweep_detached_with_its_configured_knobs(pool: PgPool) {
+        let state = crate::test_support::test_state(pool.clone()).await;
+        let shas = seed_scannable_rows(&pool, 6).await;
+        let repos_dir = tempfile::TempDir::new().unwrap();
+
+        let mut config = (*state.config).clone();
+        config.repos_dir = repos_dir.path().to_path_buf();
+        config.pin_repair_sweep_batch = 2;
+        // Far longer than this test runs, so a task still alive after the first pass can
+        // only be one that is honoring the configured inter-batch delay.
+        config.pin_repair_sweep_delay_secs = 30;
+
+        let started = std::time::Instant::now();
+        let handle = spawn_legacy_cid_sweep(&state, &config);
+        let spawn_cost = started.elapsed();
+
+        let cursor = cursor_reaches(&state.db, &shas[1], Duration::from_secs(10)).await;
+        assert_eq!(
+            cursor, shas[1],
+            "the spawned sweep must run and stop its first pass at the CONFIGURED batch \
+             bound (2), leaving the cursor on the second row"
+        );
+        assert!(
+            spawn_cost < Duration::from_secs(1),
+            "the sweep must be detached, not awaited on the boot path; the spawn took \
+             {spawn_cost:?}"
+        );
+        assert!(
+            !handle.is_finished(),
+            "with a 30s inter-batch delay the task must still be sleeping between passes, \
+             not finished: a finished task means the delay was not the configured one"
+        );
+
+        state.shutdown();
+        tokio::time::timeout(Duration::from_secs(10), handle)
+            .await
+            .expect("the shutdown watcher must end the sweep, and not after its 30s delay")
+            .expect("the sweep task must not panic");
+
+        assert_eq!(
+            state.db.pin_repair_cursor().await.unwrap(),
+            shas[1],
+            "shutdown must have ended the run MID-walk, with the remaining rows unwalked"
+        );
+    }
+}
+
+#[cfg(test)]
+mod lock_pool_sizing_tests {
+    use super::{lock_pool_size, LOCK_POOL_MAX_CONNECTIONS, LOCK_POOL_PUSH_HEADROOM};
+
+    /// The default push cap gets its cap plus headroom, so no push ever queues for a
+    /// lock-pool connection where it did not before.
+    #[test]
+    fn default_push_cap_gets_headroom_over_the_cap() {
+        assert_eq!(lock_pool_size(32), 32 + u32::from(LOCK_POOL_PUSH_HEADROOM));
+        assert_eq!(lock_pool_size(1), 1 + u32::from(LOCK_POOL_PUSH_HEADROOM));
+    }
+
+    /// #173 F4: `max_concurrent_git_pushes` is validated all the way to 1_048_576, so an
+    /// operator raising it used to raise the node's Postgres connection ceiling with it,
+    /// silently and without bound. The lock pool is CLAMPED instead.
+    #[test]
+    fn an_oversized_push_cap_is_clamped_not_propagated() {
+        assert_eq!(lock_pool_size(1_048_576), LOCK_POOL_MAX_CONNECTIONS);
+        assert_eq!(lock_pool_size(usize::MAX), LOCK_POOL_MAX_CONNECTIONS);
+        // The largest cap that still fits under the clamp keeps its full headroom.
+        let widest = (LOCK_POOL_MAX_CONNECTIONS - u32::from(LOCK_POOL_PUSH_HEADROOM)) as usize;
+        assert_eq!(lock_pool_size(widest), LOCK_POOL_MAX_CONNECTIONS);
+        assert_eq!(
+            lock_pool_size(widest - 1),
+            LOCK_POOL_MAX_CONNECTIONS - 1,
+            "values below the clamp must not be rounded up to it"
+        );
+    }
+}
+
+#[cfg(test)]
+mod gossip_ssrf_tests {
+    use super::ping_peer_health;
+
     // Build the client exactly as production does (super::build_http_client) so
     // these tests bind the redirect guarantee to the real shared client the
     // node runs. A regression that makes build_http_client follow redirects
-    // fails ping_peer_readiness_does_not_follow_redirect.
+    // fails ping_peer_health_does_not_follow_redirect.
     fn production_http_client() -> reqwest::Client {
         super::build_http_client().expect("failed to build production http client")
     }
 
-    #[test]
-    fn peer_ping_requires_two_failures_before_marking_unreachable() {
-        let mut failed_once = HashSet::new();
-        let did = "did:key:z6MkPeer";
-
-        assert_eq!(
-            peer_ping_db_update(&mut failed_once, did, false),
-            None,
-            "one transient failure must preserve the persisted federation gate"
-        );
-        assert_eq!(
-            peer_ping_db_update(&mut failed_once, did, false),
-            Some(false),
-            "a sustained failure must mark the peer unreachable"
-        );
-        assert_eq!(
-            peer_ping_db_update(&mut failed_once, did, true),
-            Some(true),
-            "a success must restore reachability immediately"
-        );
-        assert_eq!(
-            peer_ping_db_update(&mut failed_once, did, false),
-            None,
-            "a success must reset the consecutive-failure state"
-        );
-    }
-
-    #[sqlx::test]
-    async fn gossip_ping_round_requires_two_failures_before_persisting_unreachable(pool: PgPool) {
-        let mut server = mockito::Server::new_async().await;
-        let ready = server
-            .mock("GET", "/ready")
-            .with_status(503)
-            .expect(2)
-            .create_async()
-            .await;
-        let state = crate::test_support::test_state(pool.clone()).await;
-        let did = "did:key:z6MkGossipHysteresis";
-        let now = chrono::Utc::now().to_rfc3339();
-        sqlx::query(
-            "INSERT INTO peers (did, http_url, last_seen, last_ping_ok, announced_at)
-             VALUES ($1, $2, $3, TRUE, $3)",
-        )
-        .bind(did)
-        .bind(server.url())
-        .bind(now)
-        .execute(&pool)
-        .await
-        .unwrap();
-
-        let mut failed_once = HashSet::from(["did:key:z6MkRemovedPeer".to_owned()]);
-        gossip_ping_round(
-            state.db.as_ref(),
-            &production_http_client(),
-            &mut failed_once,
-            state.db.list_peers().await.unwrap(),
-        )
-        .await;
-        assert!(
-            !failed_once.contains("did:key:z6MkRemovedPeer"),
-            "failure tracking must prune peers outside the current snapshot"
-        );
-        assert!(
-            failed_once.contains(did),
-            "the first failed sample must be retained for the next round"
-        );
-        assert!(
-            state
-                .db
-                .list_peers()
-                .await
-                .unwrap()
-                .into_iter()
-                .find(|peer| peer.did == did)
-                .unwrap()
-                .last_ping_ok,
-            "one transient failure must preserve the persisted federation gate"
-        );
-
-        gossip_ping_round(
-            state.db.as_ref(),
-            &production_http_client(),
-            &mut failed_once,
-            state.db.list_peers().await.unwrap(),
-        )
-        .await;
-        assert!(
-            !state
-                .db
-                .list_peers()
-                .await
-                .unwrap()
-                .into_iter()
-                .find(|peer| peer.did == did)
-                .unwrap()
-                .last_ping_ok,
-            "two consecutive failed rounds must persist the peer as unreachable"
-        );
-        ready.assert_async().await;
-    }
-
-    // A peer answering `/ready` with a 302 toward an internal address must not
+    // A peer answering `/health` with a 302 toward an internal address must not
     // be followed: the redirect target must never be requested (#93).
     #[tokio::test]
-    async fn ping_peer_readiness_does_not_follow_redirect() {
+    async fn ping_peer_health_does_not_follow_redirect() {
         let mut server = mockito::Server::new_async().await;
         let internal = server
             .mock("GET", "/internal-metadata")
@@ -1431,154 +1327,6 @@ mod gossip_ssrf_tests {
             .expect(0)
             .create_async()
             .await;
-        let _ready = server
-            .mock("GET", "/ready")
-            .with_status(302)
-            .with_header("location", &format!("{}/internal-metadata", server.url()))
-            .create_async()
-            .await;
-
-        let ok = ping_peer_readiness(&production_http_client(), &server.url()).await;
-
-        assert!(!ok, "a 302 must not count as a healthy peer");
-        // expect(0) is enforced only at assert time; this fails if the redirect
-        // was followed to the internal target.
-        internal.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn ping_peer_readiness_reports_success_on_200() {
-        let mut server = mockito::Server::new_async().await;
-        let _ready = server
-            .mock("GET", "/ready")
-            .with_status(200)
-            .create_async()
-            .await;
-
-        let ok = ping_peer_readiness(&production_http_client(), &server.url()).await;
-
-        assert!(ok, "a 200 /ready must count as a ready peer");
-    }
-
-    #[tokio::test]
-    async fn ping_peer_readiness_ignores_liveness_only_health() {
-        let mut server = mockito::Server::new_async().await;
-        let health = server
-            .mock("GET", "/health")
-            .with_status(200)
-            .expect(0)
-            .create_async()
-            .await;
-        let ready = server
-            .mock("GET", "/ready")
-            .with_status(503)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let ok = ping_peer_readiness(&production_http_client(), &server.url()).await;
-
-        assert!(!ok, "a peer with an unavailable database must not be ready");
-        health.assert_async().await;
-        ready.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn ping_peer_readiness_falls_back_for_legacy_peer() {
-        let mut server = mockito::Server::new_async().await;
-        let ready = server
-            .mock("GET", "/ready")
-            .with_status(404)
-            .expect(1)
-            .create_async()
-            .await;
-        let health = server
-            .mock("GET", "/health")
-            .with_status(200)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let ok = ping_peer_readiness(&production_http_client(), &server.url()).await;
-
-        assert!(
-            ok,
-            "a legacy peer with a healthy /health must remain reachable"
-        );
-        ready.assert_async().await;
-        health.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn ping_peer_readiness_legacy_fallback_shares_deadline() {
-        let health_requests = Arc::new(AtomicUsize::new(0));
-        let health_requests_for_route = Arc::clone(&health_requests);
-        let app = Router::new()
-            .route(
-                "/ready",
-                get(|| async {
-                    tokio::time::sleep(Duration::from_millis(100)).await;
-                    StatusCode::NOT_FOUND
-                }),
-            )
-            .route(
-                "/health",
-                get(move || {
-                    let health_requests = Arc::clone(&health_requests_for_route);
-                    async move {
-                        health_requests.fetch_add(1, Ordering::Relaxed);
-                        tokio::time::sleep(Duration::from_millis(300)).await;
-                        StatusCode::OK
-                    }
-                }),
-            );
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
-            .await
-            .expect("failed to bind delayed legacy peer");
-        let peer_url = format!(
-            "http://{}",
-            listener
-                .local_addr()
-                .expect("delayed legacy peer has no local address")
-        );
-        let server = tokio::spawn(async move {
-            axum::serve(listener, app)
-                .await
-                .expect("delayed legacy peer failed");
-        });
-
-        let ok = ping_peer_readiness_with_timeout(
-            &production_http_client(),
-            &peer_url,
-            // Each response arrives within 350 ms, but the two serial requests
-            // cannot both finish within one 350 ms probe budget.
-            Duration::from_millis(350),
-        )
-        .await;
-
-        assert!(!ok, "the fallback must not start a fresh timeout budget");
-        assert_eq!(
-            health_requests.load(Ordering::Relaxed),
-            1,
-            "the delayed 404 should reach the legacy fallback"
-        );
-        server.abort();
-    }
-
-    #[tokio::test]
-    async fn ping_peer_readiness_legacy_fallback_does_not_follow_redirect() {
-        let mut server = mockito::Server::new_async().await;
-        let internal = server
-            .mock("GET", "/internal-metadata")
-            .with_status(200)
-            .expect(0)
-            .create_async()
-            .await;
-        let _ready = server
-            .mock("GET", "/ready")
-            .with_status(404)
-            .create_async()
-            .await;
         let _health = server
             .mock("GET", "/health")
             .with_status(302)
@@ -1586,17 +1334,33 @@ mod gossip_ssrf_tests {
             .create_async()
             .await;
 
-        let ok = ping_peer_readiness(&production_http_client(), &server.url()).await;
+        let ok = ping_peer_health(&production_http_client(), &server.url()).await;
 
-        assert!(!ok, "the legacy fallback must not follow redirects");
+        assert!(!ok, "a 302 must not count as a healthy peer");
+        // expect(0) is enforced only at assert time; this fails if the redirect
+        // was followed to the internal target.
         internal.assert_async().await;
     }
 
+    #[tokio::test]
+    async fn ping_peer_health_reports_success_on_200() {
+        let mut server = mockito::Server::new_async().await;
+        let _health = server
+            .mock("GET", "/health")
+            .with_status(200)
+            .create_async()
+            .await;
+
+        let ok = ping_peer_health(&production_http_client(), &server.url()).await;
+
+        assert!(ok, "a 200 /health must count as a healthy peer");
+    }
+
     // A transport error (nothing listening) must map to unhealthy, never a
     // spurious healthy — the .unwrap_or(false) arm.
     #[tokio::test]
-    async fn ping_peer_readiness_reports_unready_on_connection_error() {
-        let ok = ping_peer_readiness(&production_http_client(), "http://127.0.0.1:1").await;
-        assert!(!ok, "a connection error must count as an unready peer");
+    async fn ping_peer_health_reports_unhealthy_on_connection_error() {
+        let ok = ping_peer_health(&production_http_client(), "http://127.0.0.1:1").await;
+        assert!(!ok, "a connection error must count as an unhealthy peer");
     }
 }

crates/gitlawb-node/src/metrics.rs

@@ -57,15 +57,10 @@ static PEERS_CONNECTED: OnceLock<IntGauge> = OnceLock::new();
 /// more than once is a silent no-op. MUST be called from `main()` after
 /// the node DID is known.
 pub fn init(version: &str, node_did: &str) {
-    // Guard with Once so two concurrent callers cannot both pass an unsynchronized
-    // `REGISTRY.get()` check and then race on `OnceLock::set(...).expect(...)`,
-    // panicking the loser (#192 F4). Once runs the body exactly once, so the
-    // `.expect("set X once")` calls below can never observe an already-set slot.
-    static INIT: std::sync::Once = std::sync::Once::new();
-    INIT.call_once(|| init_inner(version, node_did));
-}
+    if REGISTRY.get().is_some() {
+        return;
+    }
 
-fn init_inner(version: &str, node_did: &str) {
     let registry = Registry::new();
 
     let info = IntGaugeVec::new(
@@ -223,17 +218,6 @@ pub fn record_fetch(repo: &str) {
     }
 }
 
-/// Test-only: current `gitlawb_fetches_total` value for `repo` (0 if the registry
-/// is not initialized). Lets api-layer tests assert the completed-fetch count with
-/// a unique label instead of scraping the encoded text.
-#[cfg(test)]
-pub fn fetch_count_for_test(repo: &str) -> u64 {
-    FETCHES
-        .get()
-        .map(|c| c.with_label_values(&[repo]).get())
-        .unwrap_or(0)
-}
-
 /// Record one HTTP signature check that passed.
 #[allow(dead_code)] // wired in a follow-up; helpers are part of the public metrics surface
 pub fn record_auth_success(route: &str) {
@@ -251,11 +235,7 @@ pub fn record_auth_failure(route: &str, reason: &str) {
     }
 }
 
-/// Record one sync_queue item outcome. `status` ∈ {done, failed, skipped,
-/// rejected, deferred}. `rejected` is terminal and caused by a guard (a
-/// malformed slug, or a path resolving outside repos_dir); `deferred` leaves
-/// the row pending for a later pass, so a queue stalled on an operator
-/// condition is visible rather than looking idle.
+/// Record one sync_queue item outcome. `status` ∈ {done, failed, skipped}.
 pub fn record_sync_processed(status: &str) {
     if let Some(c) = SYNC_PROCESSED.get() {
         c.with_label_values(&[status]).inc();
@@ -302,11 +282,11 @@ pub fn encode() -> Result<String, prometheus::Error> {
 mod tests {
     use super::*;
 
-    // Note: cargo runs tests in a binary in parallel via threads, and several
-    // tests here call init(). init() is guarded by std::sync::Once, so concurrent
-    // callers run the body exactly once and never race on the OnceLock setters
-    // (#192 F4). The encode test below is structured so it's safe to run alongside
-    // other tests in the same binary regardless of ordering.
+    // Note: these tests are not run in parallel by default (cargo runs
+    // tests in a binary in parallel via threads but the OnceLock guard
+    // means only the first init() call succeeds; subsequent ones are
+    // no-ops). The encode test below is structured so it's safe to run
+    // alongside other tests in the same binary.
 
     #[test]
     fn encode_after_init_returns_prometheus_text() {
@@ -337,24 +317,6 @@ mod tests {
         );
     }
 
-    /// #192 F4: `init` is idempotent and safe to call repeatedly. The panic that
-    /// hit concurrent callers (both passing the old unsynchronized `REGISTRY.get()`
-    /// check, then racing on `OnceLock::set(...).expect(...)`) is fixed by the
-    /// `Once` guard. That race is inherently non-deterministic to assert in the
-    /// shared-binary suite — a 32-thread barrier stress-test reproduces it only in
-    /// isolation (verified: RED before the `Once` fix, GREEN after). This guard
-    /// covers the deterministic half of the contract: a repeat call is a no-op,
-    /// never a panic, and the registry stays usable.
-    #[test]
-    fn init_is_idempotent_no_panic_on_repeat() {
-        init("0.0.0-a", "did:key:a");
-        init("0.0.0-b", "did:key:b");
-        assert!(
-            encode().is_ok(),
-            "registry must stay usable after a repeated init"
-        );
-    }
-
     #[test]
     fn record_helpers_are_noops_before_init() {
         // These don't panic. They also don't show up in encode() output

crates/gitlawb-node/src/p2p/mod.rs

@@ -39,11 +39,6 @@ pub struct RefUpdateEvent {
     pub pusher_did: String,
     /// Repository identifier (owner/name)
     pub repo: String,
-    /// Full owner DID — added in #144 for display and storage; not yet
-    /// wired into the feed gate matcher. Optional for backward compat with
-    /// older peers that don't include it.
-    #[serde(default)]
-    pub owner_did: Option<String>,
     /// Git ref that changed (e.g., "refs/heads/main")
     pub ref_name: String,
     /// SHA before the push (all-zeros for new ref)
@@ -312,7 +307,6 @@ pub async fn start(
                                     node_did: event.node_did.clone(),
                                     pusher_did: event.pusher_did.clone(),
                                     repo: event.repo.clone(),
-                                    owner_did: event.owner_did.clone(),
                                     ref_name: event.ref_name.clone(),
                                     old_sha: event.old_sha.clone(),
                                     new_sha: event.new_sha.clone(),
@@ -438,67 +432,3 @@ pub async fn start(
 
     Ok(handle)
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn ref_update_event_round_trip_with_owner_did() {
-        let event = RefUpdateEvent {
-            node_did: "did:key:zNode".into(),
-            pusher_did: "did:key:zPusher".into(),
-            repo: "zOwner/myrepo".into(),
-            owner_did: Some("did:key:zOwner".into()),
-            ref_name: "refs/heads/main".into(),
-            old_sha: "0000000000000000000000000000000000000000".into(),
-            new_sha: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".into(),
-            timestamp: "2026-07-02T12:00:00Z".into(),
-            cert_id: None,
-            cid: None,
-        };
-        let json = serde_json::to_value(&event).unwrap();
-        // owner_did must be present in the serialized output
-        assert_eq!(json["owner_did"], "did:key:zOwner");
-        assert_eq!(json["repo"], "zOwner/myrepo");
-
-        let deserialized: RefUpdateEvent = serde_json::from_value(json).unwrap();
-        assert_eq!(deserialized.owner_did, Some("did:key:zOwner".into()));
-    }
-
-    #[test]
-    fn ref_update_event_backward_compat_no_owner_did() {
-        let old_json = serde_json::json!({
-            "node_did": "did:key:zNode",
-            "pusher_did": "did:key:zPusher",
-            "repo": "zOwner/myrepo",
-            "ref_name": "refs/heads/main",
-            "old_sha": "0000000000000000000000000000000000000000",
-            "new_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-            "timestamp": "2026-07-02T12:00:00Z",
-            "cert_id": null,
-            "cid": null
-        });
-        let deserialized: RefUpdateEvent = serde_json::from_value(old_json).unwrap();
-        assert_eq!(deserialized.owner_did, None);
-        assert_eq!(deserialized.repo, "zOwner/myrepo");
-    }
-
-    #[test]
-    fn ref_update_event_backward_compat_null_owner_did() {
-        let with_null = serde_json::json!({
-            "node_did": "did:key:zNode",
-            "pusher_did": "did:key:zPusher",
-            "repo": "zOwner/myrepo",
-            "owner_did": null,
-            "ref_name": "refs/heads/main",
-            "old_sha": "0000000000000000000000000000000000000000",
-            "new_sha": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-            "timestamp": "2026-07-02T12:00:00Z",
-            "cert_id": null,
-            "cid": null
-        });
-        let deserialized: RefUpdateEvent = serde_json::from_value(with_null).unwrap();
-        assert_eq!(deserialized.owner_did, None);
-    }
-}

crates/gitlawb-node/src/pinata.rs

@@ -7,7 +7,6 @@
 //! no-op, so nodes without Pinata backing work fine.
 
 use anyhow::Result;
-use std::time::{Duration, Instant};
 
 /// Pin a single git object's raw bytes on Pinata (v3 API).
 ///
@@ -73,79 +72,62 @@ pub async fn pin_object(
 /// `object_list` is the already-withheld-filtered OID set to pin: the caller
 /// applies `visibility_pack::replicable_objects` on the delta path or the
 /// `..._fail_closed` filter on the full-scan path before calling. `repo_path` is
-/// still needed to read each object's bytes, and `git_bin` names the binary those
-/// reads run: the production caller passes the literal `"git"`, and a test passes a
-/// fake so the loop's own bound can be driven with a git that never answers.
-/// Objects already recorded with a `pinata_cid` are skipped. Returns
-/// `(sha_hex, cid)` pairs for each newly pinned object.
-///
-/// # What `batch_budget` does and does not bound
-///
-/// The loop runs under a `pin_semaphore` permit and that pool defers rather than
-/// sheds, so the hold has to be bounded by something other than the pusher's object
-/// count. Two things here are:
-///
-/// - this loop's own wall-clock: the deadline is taken once at loop start and
-///   checked at the top of every iteration, so no object's work begins with less
-///   than the read floor left. It is a gate, not a hard ceiling, since a started
-///   iteration still runs to completion;
-/// - the git read: `store::read_object_bounded` runs under `spawn_blocking` against the
-///   ABSOLUTE batch deadline (not the loop-top remainder, which the `has_pinata_cid`
-///   round-trip sitting between the two would push past it), with SIGTERM-then-SIGKILL
-///   process-group teardown, so a hung `git cat-file` costs this batch its remaining
-///   budget plus one watchdog teardown instead of holding the permit for the child's
-///   whole lifetime and blocking a runtime worker while it does.
-///
-/// So the LOOP's hold is bounded by roughly `batch_budget`, plus one watchdog
-/// teardown and one upload (the shared client's whole-request timeout bounds the
-/// upload; `pin_object` takes no per-request override). The PERMIT's hold is NOT
-/// bounded by any of this: `api::repos` acquires the permit and then re-derives the
-/// object list with `pinata_object_list_for_refs` BEFORE this function is entered,
-/// and that walk carries no aggregate deadline. The DB round-trips
-/// (`has_pinata_cid`, `record_pinata_cid`) are untimed inside the budgeted region
-/// too.
-///
-/// The twin in `ipfs_pin.rs` shares the budget gate and the bounded read with this
-/// loop, so both are at parity again. Change them in lockstep: the skip-if-pinned
-/// check, the fault arms, the returned pairs, and the budget handling.
-// Eight arguments, one over clippy's threshold: the two the budget adds (`git_bin`,
-// `batch_budget`) are what put the read under test injection and under a deadline, and
-// grouping them into a struct would only move the same values behind a name the twin in
-// `ipfs_pin.rs` does not use. Same allow as the sibling call sites in `api::repos`.
-#[allow(clippy::too_many_arguments)]
+/// still needed to read each object's bytes. The twin in `ipfs_pin.rs` mirrors
+/// this shape — change both in lockstep. Objects already recorded with a
+/// `pinata_cid` are skipped. `repo_id` records the pin's provenance (#173).
+/// Returns `(sha_hex, provider_cid)` pairs for each newly pinned object: the
+/// provider CID is the Pinata gateway CID (used for branch→CID recording and
+/// ref-update gossip), NOT the raw resolver-key CID stored in `pinned_cids.cid`.
 pub async fn pin_new_objects(
     client: &reqwest::Client,
     upload_url: &str,
     jwt: &str,
     repo_path: &std::path::Path,
-    git_bin: &str,
     object_list: Vec<String>,
     db: &crate::db::Db,
-    batch_budget: Duration,
+    repo_id: &str,
 ) -> Vec<(String, String)> {
     if jwt.is_empty() {
         return vec![];
     }
 
-    let deadline = Instant::now() + batch_budget;
-    let total = object_list.len();
     let mut pinned = Vec::new();
 
-    for (attempted, sha) in object_list.into_iter().enumerate() {
-        // Top of the iteration, before any of this object's work: an object is never
-        // started with a remainder too small to cover a bounded read's teardown. The
-        // gate is shared with the IPFS loop so the two cannot drift apart in how they
-        // report a truncated batch. Consumed as a guard only: the read below runs against
-        // the absolute batch deadline, and `pin_object` takes no per-request override, so
-        // the remainder has no other consumer here.
-        if crate::ipfs_pin::batch_budget_gate("Pinata", deadline, pinned.len(), total - attempted)
-            .is_none()
-        {
-            break;
-        }
-
+    for sha in object_list {
         match db.has_pinata_cid(&sha).await {
-            Ok(true) => continue,
+            Ok(true) => {
+                // Backfill NULL first-pinner provenance from a known source, in lockstep
+                // with the ipfs_pin skip branch: a pinata-only node otherwise leaves
+                // pre-provenance rows' `pinned_cids.repo_id` NULL forever (grok P2-D). The
+                // resolver still finds the object via the pin_repo_sources union below, so
+                // this is a consistency backfill, not a correctness fix.
+                match db.provenance_for_oid(&sha).await {
+                    Ok(None) => {
+                        if let Err(e) = db.backfill_pin_provenance(&sha, repo_id).await {
+                            tracing::warn!(sha = %sha, err = %e, "failed to backfill pin provenance");
+                        }
+                    }
+                    Ok(Some(_)) => {}
+                    Err(e) => {
+                        tracing::warn!(sha = %sha, err = %e, "DB error reading pin provenance");
+                    }
+                }
+                // F1 (#173 round 8): record this repo as an additional source for the
+                // already-pinned object (mirrors the ipfs_pin skip-branch insert) so the
+                // resolver can serve a shared object from any pin-path source. U3 (#173):
+                // retried through the SHARED helper (this was a bare call, so a single
+                // transient error dropped the source outright) and, on exhaustion, marked
+                // durably so the resolver keeps the bounded scan fallback for the object.
+                if let Err(e) =
+                    crate::ipfs_pin::retry_db_record(|| db.record_pin_source(&sha, repo_id)).await
+                {
+                    tracing::warn!(sha = %sha, err = %e, "failed to record pin source");
+                    if let Err(e) = db.mark_pin_sources_incomplete(&sha).await {
+                        tracing::warn!(sha = %sha, err = %e, "failed to mark pin sources incomplete");
+                    }
+                }
+                continue;
+            }
             Ok(false) => {}
             Err(e) => {
                 tracing::warn!(sha = %sha, err = %e, "DB error checking pinata_cid");
@@ -153,80 +135,43 @@ pub async fn pin_new_objects(
             }
         }
 
-        // Read raw object content, bounded and reaped, under `spawn_blocking`: this is
-        // synchronous blocking work (child spawn, pipe drain, watchdog join), so calling
-        // it from the runtime task would block a worker thread for its whole duration.
-        // Placement mirrors the `/ipfs` serve path and the IPFS pin loop.
-        //
-        // The read runs against the ABSOLUTE batch deadline, not against the remainder
-        // measured at the top of the iteration: the `has_pinata_cid` round-trip above sits
-        // between the two, so `Instant::now() + budget_left` would land past `deadline` by
-        // however long the DB took, and under a saturated pool that is the dominant term.
-        // A slow DB check must not push the read's own bound out.
-        let read_deadline = deadline;
-        let read_path = repo_path.to_path_buf();
-        let read_sha = sha.clone();
-        let read_git = git_bin.to_string();
-        let read = tokio::task::spawn_blocking(move || {
-            crate::git::store::read_object_bounded(&read_git, &read_path, &read_sha, read_deadline)
-        })
-        .await;
-        let data = match read {
-            Ok(Ok(Some((_kind, bytes)))) => bytes,
-            // A verified absence, and the only outcome that is not a fault.
-            Ok(Ok(None)) => continue,
-            // A Transient fault does NOT by itself mean the store is gone. It also covers
-            // a spawn or watchdog-timeout failure of the reaped child, an unaffordable
-            // confirming re-probe, and, because readability is judged FOR one oid, a
-            // single unreadable `objects/<xx>` fan-out, which is 1/256 of the store. So
-            // re-check store-wide before deciding what the fault costs.
-            Ok(Err(e @ crate::git::store::ProbeError::Transient(_))) => {
-                if !crate::git::store::object_store_readable_store_wide(repo_path) {
-                    // Genuinely store-wide: every remaining object fails identically, and
-                    // continuing would spawn one doomed bounded child per object and spend
-                    // the batch budget reaping them.
-                    tracing::warn!(
-                        sha = %sha,
-                        err = %e,
-                        unattempted = total - attempted,
-                        "object store unreadable while pinning to Pinata; stopping the batch"
-                    );
-                    break;
-                }
-                // The store still reads store-wide, so the fault is object-scoped or
-                // transient to this read. Breaking would forfeit a healthy store's
-                // remaining objects permanently: the documented recovery re-derives the
-                // same list and breaks at the same index.
-                tracing::warn!(
-                    sha = %sha,
-                    err = %e,
-                    "transient fault reading git object for Pinata; the object store is \
-                     still readable store-wide, so this costs only this object"
-                );
-                continue;
-            }
-            // The store is readable and git still failed: a corrupt object, or a
-            // repo-wide fault git reports immediately. Either way it is per-object work
-            // that stays inside the budget, and breaking would forfeit a healthy store's
-            // remaining objects over one bad one, permanently (a later full-scan push
-            // re-offers the same object and breaks in the same place).
-            Ok(Err(e)) => {
+        let data = match crate::git::store::read_object(repo_path, &sha) {
+            Ok(Some((_kind, bytes))) => bytes,
+            Ok(None) => continue,
+            Err(e) => {
                 tracing::warn!(sha = %sha, err = %e, "failed to read git object for Pinata");
                 continue;
             }
-            // A panic in the read closure leaves no evidence that the failure is
-            // object-scoped, so fail toward the conservative arm.
-            Err(e) => {
-                tracing::warn!(sha = %sha, err = %e, "bounded git read task failed; stopping the batch");
-                break;
-            }
         };
 
         match pin_object(client, upload_url, jwt, &sha, &data).await {
             Ok(cid) if !cid.is_empty() => {
-                if let Err(e) = db.record_pinata_cid(&sha, &cid).await {
+                // The resolver key (`pinned_cids.cid`) must be the locally-computed
+                // raw-content CID, never the provider CID: Pinata wraps the bytes in
+                // dag-pb/UnixFS, so its returned CID does not hash the raw content and
+                // must not become an alias `/ipfs/{cid}` serves raw git bytes for (#173).
+                let raw_cid = gitlawb_core::cid::Cid::from_git_object_bytes(&data).to_string();
+                // U3 (#173): both records go through the shared retry helper, at parity
+                // with the ipfs_pin twin. These were bare calls, so one transient DB error
+                // permanently dropped a pin source.
+                if let Err(e) = crate::ipfs_pin::retry_db_record(|| {
+                    db.record_pinata_cid(&sha, &raw_cid, &cid, Some(repo_id))
+                })
+                .await
+                {
                     tracing::warn!(sha = %sha, err = %e, "failed to record pinata_cid in DB");
                 }
+                // F1 (#173 round 8): also record the first pinner in pin_repo_sources.
+                // U3: an exhausted retry marks the set incomplete so the resolver keeps
+                // the scan fallback rather than 404ing a copy it could serve.
+                if let Err(e) =
+                    crate::ipfs_pin::retry_db_record(|| db.record_pin_source(&sha, repo_id)).await
+                {
+                    tracing::warn!(sha = %sha, err = %e, "failed to record pin source");
+                    if let Err(e) = db.mark_pin_sources_incomplete(&sha).await {
+                        tracing::warn!(sha = %sha, err = %e, "failed to mark pin sources incomplete");
+                    }
+                }
                 pinned.push((sha, cid));
             }
             Ok(_) => {}
@@ -245,626 +190,6 @@ pub async fn pin_new_objects(
 mod tests {
     use super::*;
 
-    /// Write `n` loose blobs into a fresh bare repo and return their oids. The read
-    /// path shells to `git cat-file`, so the objects must genuinely exist on disk: a
-    /// fabricated oid would `continue` past the upload and the loop scenarios below
-    /// would prove nothing. Copied from `ipfs_pin.rs`'s test mod rather than shared,
-    /// since test mods are private.
-    fn seed_loose_blobs(repo_path: &std::path::Path, n: usize) -> Vec<String> {
-        crate::git::store::init_bare(repo_path).expect("init bare repo");
-        (0..n)
-            .map(|i| {
-                let mut cmd = std::process::Command::new("git");
-                cmd.args(["hash-object", "-w", "--stdin"])
-                    .current_dir(repo_path)
-                    .stdin(std::process::Stdio::piped())
-                    .stdout(std::process::Stdio::piped());
-                let mut child = cmd.spawn().expect("spawn git hash-object");
-                {
-                    use std::io::Write;
-                    child
-                        .stdin
-                        .as_mut()
-                        .expect("stdin")
-                        .write_all(format!("pinata loop object {i}\n").as_bytes())
-                        .expect("write stdin");
-                }
-                let out = child.wait_with_output().expect("hash-object output");
-                assert!(
-                    out.status.success(),
-                    "git hash-object: {}",
-                    String::from_utf8_lossy(&out.stderr)
-                );
-                String::from_utf8_lossy(&out.stdout).trim().to_string()
-            })
-            .collect()
-    }
-
-    /// A live Pinata-shaped endpoint that answers each upload with a v3 `data.cid`
-    /// body after `delays[i]` for the i-th request it accepts (the last entry
-    /// repeats), counting the requests it received.
-    ///
-    /// Hand rolled rather than driven with `mockito` like the `pin_object` tests
-    /// above: mockito has no per-response delay primitive, and the batch-budget test
-    /// needs uploads that are slow enough to exhaust the budget partway. Drains the
-    /// full request, headers plus the declared `Content-Length` body, before
-    /// sleeping: answering early and closing would surface as a write failure on the
-    /// client and turn a slow-but-healthy upload into a different failure shape.
-    /// Same fixture shape as `ipfs_pin.rs`'s `delaying_endpoint`.
-    async fn delaying_pinata_endpoint(
-        delays: Vec<Duration>,
-        requests: std::sync::Arc<std::sync::atomic::AtomicUsize>,
-    ) -> String {
-        use tokio::io::{AsyncReadExt, AsyncWriteExt};
-        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let endpoint = format!("http://{}", listener.local_addr().unwrap());
-        tokio::spawn(async move {
-            let mut seen = 0usize;
-            while let Ok((mut sock, _)) = listener.accept().await {
-                let delay = *delays
-                    .get(seen)
-                    .or_else(|| delays.last())
-                    .unwrap_or(&Duration::ZERO);
-                seen += 1;
-                requests.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
-                tokio::spawn(async move {
-                    let mut acc = Vec::new();
-                    let mut buf = [0u8; 4096];
-                    loop {
-                        let n = match sock.read(&mut buf).await {
-                            Ok(0) | Err(_) => break,
-                            Ok(n) => n,
-                        };
-                        acc.extend_from_slice(&buf[..n]);
-                        if let Some(hdr_end) =
-                            acc.windows(4).position(|w| w == b"\r\n\r\n").map(|p| p + 4)
-                        {
-                            let headers = String::from_utf8_lossy(&acc[..hdr_end]).to_lowercase();
-                            let len: usize = headers
-                                .lines()
-                                .find_map(|l| l.strip_prefix("content-length:"))
-                                .and_then(|v| v.trim().parse().ok())
-                                .unwrap_or(0);
-                            if acc.len() >= hdr_end + len {
-                                break;
-                            }
-                        }
-                    }
-                    tokio::time::sleep(delay).await;
-                    let body = br#"{"data":{"cid":"QmPinataBatchTestCid","name":"git.bin"}}"#;
-                    let head = format!(
-                        "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n",
-                        body.len()
-                    );
-                    let _ = sock.write_all(head.as_bytes()).await;
-                    let _ = sock.write_all(body).await;
-                    let _ = sock.flush().await;
-                });
-            }
-        });
-        endpoint
-    }
-
-    /// A `tracing` sink a test can read back, so the truncation warn and its sink
-    /// label can be asserted on rather than assumed. Installed with `set_default`,
-    /// which is thread-local and scoped to the guard, so it cannot bleed into any
-    /// other test in the binary.
-    #[derive(Clone, Default)]
-    struct CapturedLogs(std::sync::Arc<std::sync::Mutex<Vec<u8>>>);
-
-    impl CapturedLogs {
-        fn text(&self) -> String {
-            String::from_utf8_lossy(&self.0.lock().unwrap()).to_string()
-        }
-    }
-
-    impl std::io::Write for CapturedLogs {
-        fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-            self.0.lock().unwrap().extend_from_slice(buf);
-            Ok(buf.len())
-        }
-        fn flush(&mut self) -> std::io::Result<()> {
-            Ok(())
-        }
-    }
-
-    impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for CapturedLogs {
-        type Writer = CapturedLogs;
-        fn make_writer(&'a self) -> Self::Writer {
-            self.clone()
-        }
-    }
-
-    fn capture_logs() -> (CapturedLogs, tracing::subscriber::DefaultGuard) {
-        let logs = CapturedLogs::default();
-        let subscriber = tracing_subscriber::fmt()
-            .with_writer(logs.clone())
-            .with_max_level(tracing::Level::WARN)
-            .with_ansi(false)
-            .finish();
-        let guard = tracing::subscriber::set_default(subscriber);
-        (logs, guard)
-    }
-
-    /// Write an executable `/bin/sh` script. Copied per module rather than shared:
-    /// `store.rs`, `visibility_pack.rs` and `ipfs_pin.rs` each keep their own, since
-    /// their test mods are private and not reachable from here.
-    #[cfg(unix)]
-    fn write_script(path: &std::path::Path, body: &str) {
-        use std::os::unix::fs::PermissionsExt;
-        std::fs::write(path, body).expect("write fake git");
-        let mut perm = std::fs::metadata(path).unwrap().permissions();
-        perm.set_mode(0o755);
-        std::fs::set_permissions(path, perm).unwrap();
-    }
-
-    /// The permit-hold bound on this branch. `pin_new_objects` runs under the same
-    /// deferring `pin_semaphore` as the IPFS loop, so without a batch deadline the
-    /// hold is O(N) with N chosen by the pusher. Five objects against an endpoint
-    /// that takes 2s each, under a 5.5s budget, must stop partway: the batch is
-    /// truncated and the remainder is left unattempted with exactly one warn naming
-    /// how many, labelled for this sink.
-    ///
-    /// The windows are deliberately loose. Four pins would need every upload to
-    /// answer in under 1.4s, which the endpoint's own 2s sleep forbids, and one pin
-    /// needs only the first upload to land inside 5.5s, so both bounds hold with
-    /// more than a second of slack on a loaded box.
-    #[sqlx::test]
-    async fn pin_new_objects_stops_the_batch_at_its_deadline(pool: sqlx::PgPool) {
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("slow.git");
-        let oids = seed_loose_blobs(&repo_path, 5);
-        let requests = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let endpoint = delaying_pinata_endpoint(
-            vec![Duration::from_secs(2)],
-            std::sync::Arc::clone(&requests),
-        )
-        .await;
-
-        let (logs, _guard) = capture_logs();
-        let client = reqwest::Client::new();
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "test-jwt",
-                &repo_path,
-                "git",
-                oids,
-                &db,
-                Duration::from_millis(5500),
-            ),
-        )
-        .await
-        .expect("wedge guard: a 5.5s budget cannot take 30s");
-
-        assert!(
-            (1..=3).contains(&pinned.len()),
-            "the batch must stop partway, not pin all five and not stall on the first: pinned {}",
-            pinned.len()
-        );
-        assert_eq!(
-            requests.load(std::sync::atomic::Ordering::SeqCst),
-            pinned.len(),
-            "no upload may be issued for an object the budget stopped short of"
-        );
-        let text = logs.text();
-        let warns: Vec<&str> = text
-            .lines()
-            .filter(|l| l.contains("pin batch deadline reached"))
-            .collect();
-        assert_eq!(
-            warns.len(),
-            1,
-            "the deadline must be reported exactly once for the batch, not per object: {text}"
-        );
-        assert!(
-            warns[0].contains("Pinata"),
-            "the truncation warn must name this sink, not the twin's: {}",
-            warns[0]
-        );
-        let unattempted: usize = warns[0]
-            .split("unattempted=")
-            .nth(1)
-            .and_then(|s| {
-                s.split(|c: char| !c.is_ascii_digit())
-                    .next()
-                    .and_then(|d| d.parse().ok())
-            })
-            .unwrap_or_else(|| panic!("the deadline warn must name the unattempted count: {text}"));
-        assert!(
-            unattempted >= 1 && unattempted + pinned.len() <= 5,
-            "unattempted={unattempted} with {} pinned is not a partial batch of five",
-            pinned.len()
-        );
-    }
-
-    /// #174 F3 on this branch: the git read runs while the `pin_semaphore` permit is
-    /// held, so a wedged `git cat-file` used to hold that permit for as long as the
-    /// child lived, with no deadline and no reaping, on a path a pusher drives. With
-    /// the read bounded, a git that never answers costs the batch its budget plus one
-    /// watchdog teardown and no more.
-    ///
-    /// The fake traps SIGTERM and sleeps a BOUNDED 30s, following the fixture in
-    /// `visibility_pack.rs`: with the deadline neutralized the read would otherwise
-    /// leave the blocking closure and its child alive long after the test-level
-    /// timeout fires, wedging the run instead of reporting a failure. The endpoint is
-    /// never reached, since no object's bytes are ever produced.
-    ///
-    /// The batch ends on the BUDGET, not on the fault arm: the repo is a healthy bare
-    /// store, so the timeout's `Transient` verdict is object-scoped and the loop moves on,
-    /// only to find the budget spent. Capturing that warn is not decoration. `tracing`
-    /// caches a callsite's interest globally the first time it is hit, and a hit from a
-    /// thread with no subscriber caches it as never-interested for the whole binary, which
-    /// silently blinds the deadline tests running beside this one.
-    #[cfg(unix)]
-    #[sqlx::test]
-    async fn pin_new_objects_returns_by_budget_with_a_hung_git(pool: sqlx::PgPool) {
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("wedged.git");
-        let oids = seed_loose_blobs(&repo_path, 3);
-        let fake = tmp.path().join("hanging-git");
-        write_script(&fake, "#!/bin/sh\ntrap '' TERM\necho $$ > pid\nsleep 30\n");
-
-        let (logs, _guard) = capture_logs();
-        let client = reqwest::Client::new();
-        let started = std::time::Instant::now();
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(25),
-            pin_new_objects(
-                &client,
-                "http://127.0.0.1:9",
-                "test-jwt",
-                &repo_path,
-                fake.to_str().unwrap(),
-                oids,
-                &db,
-                Duration::from_secs(2),
-            ),
-        )
-        .await
-        .expect(
-            "a wedged git must not hold the pin permit past the batch budget: the read is \
-             bounded and reaped, so this cannot reach the outer timeout",
-        );
-        let elapsed = started.elapsed();
-
-        assert!(
-            pinned.is_empty(),
-            "a git that never answers cannot produce a pinned object: {pinned:?}"
-        );
-        assert!(
-            elapsed < Duration::from_secs(20),
-            "elapsed {elapsed:?} must stay inside the budget plus one watchdog teardown"
-        );
-        let text = logs.text();
-        assert_eq!(
-            text.lines()
-                .filter(|l| l.contains("pin batch deadline reached"))
-                .count(),
-            1,
-            "one wedged read must spend the whole budget and stop the batch there, exactly \
-             once: {text}"
-        );
-
-        // The child's process group must be gone once the call returns; a bounded read
-        // that leaves the child running has only moved the hold somewhere else.
-        let pid: i32 = std::fs::read_to_string(repo_path.join("pid"))
-            .expect("the fake git must have recorded its pid, or it was never on the read path")
-            .trim()
-            .parse()
-            .unwrap();
-        let mut gone = false;
-        for _ in 0..200 {
-            // SAFETY: kill(2) with signal 0 only probes existence; ESRCH means gone.
-            if unsafe { libc::kill(pid, 0) } != 0 {
-                gone = true;
-                break;
-            }
-            std::thread::sleep(Duration::from_millis(10));
-        }
-        assert!(
-            gone,
-            "the reaped fake git ({pid}) must not outlive the call"
-        );
-    }
-
-    /// A `git_bin` wrapper that records every invocation's arguments and then execs the
-    /// real git, so a test can tell which objects the loop actually attempted. The returned
-    /// pin list cannot: it is empty both when the loop broke after one object and when it
-    /// continued past all of them. Copied from `ipfs_pin.rs`'s test mod, like the fixtures
-    /// above, since test mods are private.
-    #[cfg(unix)]
-    fn counting_git(dir: &std::path::Path, log: &std::path::Path) -> String {
-        let fake = dir.join("counting-git");
-        write_script(
-            &fake,
-            &format!(
-                "#!/bin/sh\necho \"$*\" >> {}\nexec git \"$@\"\n",
-                log.display()
-            ),
-        );
-        fake.to_str().unwrap().to_string()
-    }
-
-    /// How many objects the loop actually attempted, read off the invocation log.
-    ///
-    /// Counts `--batch-check` invocations, not log lines and not oid occurrences: the type
-    /// probe carries its oid on stdin rather than in argv, so an oid appears in the log only
-    /// once an object has already got past its probe, and a healthy object costs two
-    /// invocations to a faulting one's one.
-    fn objects_attempted(log: &std::path::Path) -> usize {
-        std::fs::read_to_string(log)
-            .unwrap_or_default()
-            .lines()
-            .filter(|l| l.contains("--batch-check"))
-            .count()
-    }
-
-    /// The store-wide fault arm, the twin of the IPFS loop's. When the object store cannot
-    /// be read at all every remaining object fails identically, so continuing would spawn
-    /// one doomed bounded child per object and burn the batch budget on reaping them.
-    ///
-    /// The fixture looks wrong and is not: with the objects LOOSE and only `objects/pack`
-    /// unreadable, git still resolves each object, but it prints an `error:` diagnostic
-    /// that the probe routes to a fault before the present/missing parse, so the read
-    /// reaches the fault classification and (the store being unreadable) returns
-    /// `Transient`, which the store-wide re-check then confirms really is store-wide.
-    #[cfg(unix)]
-    #[sqlx::test]
-    async fn pin_new_objects_breaks_the_batch_on_an_unreadable_store(pool: sqlx::PgPool) {
-        use std::os::unix::fs::PermissionsExt;
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("unreadable.git");
-        let oids = seed_loose_blobs(&repo_path, 5);
-        let log = tmp.path().join("calls.log");
-        let git_bin = counting_git(tmp.path(), &log);
-        let requests = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let endpoint =
-            delaying_pinata_endpoint(vec![Duration::ZERO], std::sync::Arc::clone(&requests)).await;
-        let client = reqwest::Client::new();
-
-        let pack_dir = repo_path.join("objects").join("pack");
-        let chmod = |mode: u32| {
-            let mut perms = std::fs::metadata(&pack_dir).unwrap().permissions();
-            perms.set_mode(mode);
-            std::fs::set_permissions(&pack_dir, perms).unwrap();
-        };
-        chmod(0o000);
-        // Root bypasses permission bits, so witness the exact operation the probe performs
-        // and skip rather than falsely fail.
-        let genuinely_unreadable = std::fs::read_dir(&pack_dir).is_err();
-
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "test-jwt",
-                &repo_path,
-                &git_bin,
-                oids,
-                &db,
-                Duration::from_secs(60),
-            ),
-        )
-        .await
-        .expect("an immediately-faulting store cannot take 30s");
-        let attempted = objects_attempted(&log);
-        chmod(0o755); // restore BEFORE any assertion that can panic, so TempDir cleans up
-
-        if genuinely_unreadable {
-            assert!(
-                pinned.is_empty(),
-                "nothing can be pinned through a store that cannot be read: {pinned:?}"
-            );
-            assert_eq!(
-                attempted, 1,
-                "a store-wide fault must break the batch after the first object, not spawn \
-                 one doomed bounded child per object: {attempted} of 5 objects were read"
-            );
-            assert_eq!(
-                requests.load(std::sync::atomic::Ordering::SeqCst),
-                0,
-                "no upload may be issued for an object whose bytes were never read"
-            );
-        }
-    }
-
-    /// The must-not direction of the arm above, the twin of the IPFS loop's. One corrupt
-    /// loose object among healthy ones is a `Deterministic` fault (the store is readable,
-    /// git still fails), and the documented recovery path cannot repair it: a later
-    /// full-scan push re-offers the same object and would break at the same place, so
-    /// breaking here stops the repo replicating permanently.
-    ///
-    /// Deliberately not the bad-config corruption, which is repo-wide: all five objects
-    /// would fault and the test would pin the store-wide case rather than the object-scoped
-    /// one this arm rests on.
-    #[cfg(unix)]
-    #[sqlx::test]
-    async fn pin_new_objects_continues_past_a_deterministic_fault(pool: sqlx::PgPool) {
-        use std::os::unix::fs::PermissionsExt;
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("corrupt.git");
-        let oids = seed_loose_blobs(&repo_path, 5);
-        let log = tmp.path().join("calls.log");
-        let git_bin = counting_git(tmp.path(), &log);
-        let requests = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let endpoint =
-            delaying_pinata_endpoint(vec![Duration::ZERO], std::sync::Arc::clone(&requests)).await;
-        let client = reqwest::Client::new();
-
-        // Overwrite exactly one loose object with non-zlib garbage (0o444 by default).
-        let victim = repo_path
-            .join("objects")
-            .join(&oids[0][0..2])
-            .join(&oids[0][2..]);
-        assert!(victim.is_file(), "fixture must leave the blob loose");
-        let mut perms = std::fs::metadata(&victim).unwrap().permissions();
-        perms.set_mode(0o644);
-        std::fs::set_permissions(&victim, perms).unwrap();
-        std::fs::write(&victim, b"garbage not a zlib stream").unwrap();
-
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "test-jwt",
-                &repo_path,
-                &git_bin,
-                oids,
-                &db,
-                Duration::from_secs(60),
-            ),
-        )
-        .await
-        .expect("an immediate endpoint and four healthy objects cannot take 30s");
-
-        assert_eq!(
-            objects_attempted(&log),
-            5,
-            "an object-scoped fault must not stop the batch: every object must be read"
-        );
-        assert_eq!(
-            pinned.len(),
-            4,
-            "one corrupt object must cost only itself: the other four must still pin"
-        );
-        assert_eq!(
-            requests.load(std::sync::atomic::Ordering::SeqCst),
-            4,
-            "exactly the readable objects may reach the endpoint"
-        );
-    }
-
-    /// The normal direction, and the dedup branch driven both ways: on a healthy
-    /// store with a healthy endpoint and a generous budget every object pins and the
-    /// CID is recorded, and a second call over the same list uploads nothing because
-    /// `has_pinata_cid` now answers true for all of them.
-    #[sqlx::test]
-    async fn pin_new_objects_pins_every_object_then_skips_the_recorded_ones(pool: sqlx::PgPool) {
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("healthy.git");
-        let oids = seed_loose_blobs(&repo_path, 3);
-        let requests = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let endpoint =
-            delaying_pinata_endpoint(vec![Duration::ZERO], std::sync::Arc::clone(&requests)).await;
-        let client = reqwest::Client::new();
-
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "test-jwt",
-                &repo_path,
-                "git",
-                oids.clone(),
-                &db,
-                Duration::from_secs(60),
-            ),
-        )
-        .await
-        .expect("an immediate endpoint and three healthy objects cannot take 30s");
-
-        assert_eq!(pinned.len(), 3, "every healthy object must pin: {pinned:?}");
-        for (i, (sha, cid)) in pinned.iter().enumerate() {
-            assert_eq!(sha, &oids[i], "the pairs must carry the objects' own oids");
-            assert_eq!(cid, "QmPinataBatchTestCid");
-            assert!(
-                db.has_pinata_cid(sha).await.unwrap(),
-                "a pinned object must be recorded so the next batch skips it"
-            );
-        }
-        assert_eq!(requests.load(std::sync::atomic::Ordering::SeqCst), 3);
-
-        let again = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "test-jwt",
-                &repo_path,
-                "git",
-                oids,
-                &db,
-                Duration::from_secs(60),
-            ),
-        )
-        .await
-        .expect("a fully deduped batch cannot take 30s");
-        assert!(again.is_empty(), "already-recorded objects must be skipped");
-        assert_eq!(
-            requests.load(std::sync::atomic::Ordering::SeqCst),
-            3,
-            "the skip must happen before the upload, not after it"
-        );
-    }
-
-    /// The no-op configuration still short-circuits with the budgeted signature: an
-    /// empty JWT must return before any git child is spawned and before any request
-    /// is issued. The `git_bin` here records every invocation, so "git was never
-    /// touched" is observed rather than assumed.
-    #[cfg(unix)]
-    #[sqlx::test]
-    async fn pin_new_objects_with_an_empty_jwt_touches_neither_git_nor_the_endpoint(
-        pool: sqlx::PgPool,
-    ) {
-        let db = crate::db::Db::for_testing(pool);
-        db.run_migrations().await.expect("migrations");
-        let tmp = tempfile::TempDir::new().unwrap();
-        let repo_path = tmp.path().join("unconfigured.git");
-        let oids = seed_loose_blobs(&repo_path, 2);
-        let log = tmp.path().join("calls.log");
-        let fake = tmp.path().join("counting-git");
-        write_script(
-            &fake,
-            &format!(
-                "#!/bin/sh\necho \"$*\" >> {}\nexec git \"$@\"\n",
-                log.display()
-            ),
-        );
-        let requests = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
-        let endpoint =
-            delaying_pinata_endpoint(vec![Duration::ZERO], std::sync::Arc::clone(&requests)).await;
-        let client = reqwest::Client::new();
-
-        let pinned = tokio::time::timeout(
-            Duration::from_secs(30),
-            pin_new_objects(
-                &client,
-                &endpoint,
-                "",
-                &repo_path,
-                fake.to_str().unwrap(),
-                oids,
-                &db,
-                Duration::from_secs(60),
-            ),
-        )
-        .await
-        .expect("an unconfigured sink returns immediately");
-
-        assert!(pinned.is_empty(), "an empty JWT pins nothing");
-        assert!(
-            !log.exists(),
-            "no git child may be spawned when the sink is not configured"
-        );
-        assert_eq!(requests.load(std::sync::atomic::Ordering::SeqCst), 0);
-    }
-
     #[tokio::test]
     async fn test_pin_skipped_when_jwt_empty() {
         let client = reqwest::Client::new();

crates/gitlawb-node/src/rate_limit.rs

@@ -121,11 +121,26 @@ impl RateLimiter {
         true
     }
 
-    /// Number of keys currently tracked. Tests use it to observe what a sweep
-    /// reclaimed; there is no production reader.
-    #[cfg(test)]
-    pub async fn tracked_keys(&self) -> usize {
-        self.state.lock().await.len()
+    /// Non-consuming check: is this key ALREADY at its limit for the current window?
+    /// Unlike [`check`], it records nothing and never inserts a new key — used to shed
+    /// expensive preparatory work (e.g. the `/ipfs/{cid}` legacy scan's O(repos) DB
+    /// preload) BEFORE it runs, without perturbing the per-unit budget the consuming
+    /// `check` maintains (#173, F3). An unknown key or a disabled limiter is not
+    /// throttled. Prunes the key's expired timestamps as a side effect (keeps state
+    /// tidy) but adds none, so it cannot itself fill or grow the map.
+    pub(crate) async fn is_throttled(&self, key: &str) -> bool {
+        if self.max_requests == 0 {
+            return false;
+        }
+        let now = Instant::now();
+        let mut state = self.state.lock().await;
+        if let Some(window) = state.get_mut(key) {
+            window
+                .timestamps
+                .retain(|t| now.duration_since(*t) < self.window);
+            return window.timestamps.len() >= self.max_requests;
+        }
+        false
     }
 
     pub async fn cleanup(&self) {
@@ -137,20 +152,13 @@ impl RateLimiter {
             !w.timestamps.is_empty()
         });
     }
-}
 
-/// Per-source concurrency cap derived from the write-pool size: one resolved client
-/// key (see [`client_key`]) may hold at most an eighth of the pool, so saturating it
-/// takes ~8 distinct keys. Real for an IPv4 or single-address caller; a caller with a
-/// routed IPv6 /64 has 2^64 keys, because `client_key` returns the full address with
-/// no prefix folding. Narrowing that keying is a deferred decision, so this cap is a
-/// bound per key, not a bound per operator.
-///
-/// Floored at 1 because the value feeds [`PerCallerConcurrency`], where a cap of 0
-/// would shed EVERY receive-pack advertisement and break all pushes. The floor is
-/// load-bearing at the minimum write-pool size (1), which integer-divides to 0.
-pub(crate) fn per_source_push_cap(max_concurrent_git_pushes: usize) -> usize {
-    (max_concurrent_git_pushes / 8).max(1)
+    /// Number of distinct keys currently tracked. Test-only introspection so a
+    /// cross-module test can assert that a sweep actually evicted expired entries.
+    #[cfg(test)]
+    pub(crate) async fn tracked_keys(&self) -> usize {
+        self.state.lock().await.len()
+    }
 }
 
 /// A bounded per-caller CONCURRENCY limiter — distinct from [`RateLimiter`], which

crates/gitlawb-node/src/visibility.rs

@@ -437,6 +437,31 @@ mod tests {
         );
     }
 
+    // #135 T1: a Mode-B rule on `/secret/**` must DENY the withheld directory's
+    // OWN path `/secret` (the `path == prefix` arm), not just strict descendants —
+    // otherwise get_by_cid's tree gate would serve the /secret tree object and leak
+    // its children. Pins parity with get_tree, which denies the /secret path.
+    #[test]
+    fn subtree_rule_denies_the_withheld_directory_itself() {
+        let reader = "did:key:z6MkReader";
+        let rules = [rule("/secret/**", VisibilityMode::B, &[reader])];
+        assert_eq!(
+            visibility_check(&rules, true, OWNER, None, "/secret"),
+            Decision::Deny,
+            "anon denied at the withheld directory's OWN path /secret"
+        );
+        assert_eq!(
+            visibility_check(&rules, true, OWNER, None, "/public"),
+            Decision::Allow,
+            "anon allowed at a sibling path outside the withheld subtree"
+        );
+        assert_eq!(
+            visibility_check(&rules, true, OWNER, Some(reader), "/secret"),
+            Decision::Allow,
+            "listed reader allowed at the withheld directory (caller-aware)"
+        );
+    }
+
     // #153 regression: cross-method DID must still be denied even when the
     // trailing segment collides with a bare owner key.
     #[test]

crates/gitlawb-node/tests/inv22_gates.rs

@@ -29,6 +29,7 @@ fn inv22_concurrency_gates_present_and_not_bypassed() {
     let repos = src("api/repos.rs");
     let smart_http = src("git/smart_http.rs");
     let vis = src("git/visibility_pack.rs");
+    let ipfs = src("api/ipfs.rs");
 
     // U1 / P1-a: run_bounded_git stands the watchdog down only after confirming the
     // child actually terminated (WNOWAIT), not on the raw stdout-drain EOF — otherwise
@@ -68,6 +69,54 @@ fn inv22_concurrency_gates_present_and_not_bypassed() {
          withheld_recipients_gated, which acquires git_encrypt_semaphore"
     );
 
+    // U1 / R2 (#173 round-10): the path-scoped filtered-pack serve must thread the
+    // caller's AdmissionGuard through BOTH git stages so read + per-caller admission is
+    // held until the pack-objects group is reaped on disconnect, closing the cap bypass
+    // the plain upload_pack path already fixed. Two load-bearing markers: rev-list hands
+    // the disarmed guard back (its tuple return type), and build_filtered_pack forwards
+    // that guard into the pack-objects stage (the `admission` arg after the
+    // "pack-objects" label). Reverting either — dropping the guard between stages, or
+    // passing `None` to pack-objects — trips this.
+    assert!(
+        smart_http.contains("Result<(Vec<String>, Option<AdmissionGuard>)>")
+            && smart_http.contains("\"pack-objects\",\n        admission,"),
+        "U1/R2 gate missing: build_filtered_pack must thread the AdmissionGuard through \
+         rev-list -> pack-objects so the permits are held until the pack-objects group \
+         is reaped on disconnect (the path-scoped half of #174 P1-a)"
+    );
+
+    // U2 / R1 (#173 round-10): the `GET /ipfs/{cid}` serve pipeline must run in a
+    // DETACHED tokio task that OWNS the AdmissionGuard built from BOTH walk permits, so a
+    // cancelled or timed-out request releases admission only after the spawned (bounded)
+    // work completes — not the instant the handler future drops (the /ipfs half of #174
+    // P1-a). Two load-bearing markers: the guard is constructed from the two named
+    // permits, and the whole pipeline is moved into a `tokio::spawn`. Reverting to
+    // handler-local permits (dropping the guard/spawn) trips this.
+    assert!(
+        ipfs.contains("AdmissionGuard::new(ipfs_walk_permit, ipfs_caller_permit)")
+            && ipfs.contains(
+                "let serve: tokio::task::JoinHandle<Result<Response>> = tokio::spawn(async move {"
+            ),
+        "U2/R1 gate missing: get_by_cid must move both /ipfs admission permits into an \
+         AdmissionGuard owned by a detached tokio::spawn task so admission is released \
+         only after the spawned serve work completes (the /ipfs half of #174 P1-a)"
+    );
+
+    // U2 / KTD2 (#173 round-10): the probe/read children on the /ipfs path must be the
+    // duration-bounded twins (process-group teardown via run_bounded_git), not the bare
+    // `store::object_type` / `read_object_content` (or an unbounded `cat-file -s`) a tokio
+    // timeout cannot cancel — otherwise a wedged cat-file lingers and pins the held
+    // admission past the deadline. Reverting any twin call site back to a bare read trips
+    // this.
+    assert!(
+        ipfs.contains("object_type_bounded(")
+            && ipfs.contains("object_size_bounded(")
+            && ipfs.contains("read_object_content_bounded("),
+        "U2/KTD2 gate missing: the /ipfs probe+read must call the run_bounded_git-backed \
+         *_bounded twins so a wedged cat-file is reaped at the deadline, not left to pin \
+         the held /ipfs walk admission"
+    );
+
     // P1-e non-bypass tripwire: the bounded recipients walk is spawn_blocking'd nowhere
     // but inside withheld_recipients_gated. A second call site (count > 1) is a new
     // detached git walk that skips the admission gate — exactly the class U5 closed.
@@ -87,403 +136,4 @@ fn inv22_concurrency_gates_present_and_not_bypassed() {
         "U4/P2-2 gate missing: the detached post-push encryption spawn must consult \
          encrypt_inflight.try_begin to coalesce per repo (bound the outstanding-task set)"
     );
-
-    // F5: coalescing must REQUEUE, not shed. The in-flight task pins only its own
-    // pre-spawn snapshot, so a coalesced push's tip pairs are recorded on its key and
-    // the task must loop-drain them (`finish_or_take_pending`) before releasing it.
-    // Removing the drain reverts to the silent loss: a coalesced push's pins and
-    // recovery copies are absent until an unrelated later push. Scan only the
-    // production half of the file — the u5 tests in its `mod tests` also name the
-    // drain call, and matching them would make this check vacuous.
-    let repos_production = repos
-        .split("#[cfg(test)]")
-        .next()
-        .expect("split always yields a first chunk");
-    assert!(
-        repos_production.contains("finish_or_take_pending"),
-        "F5 gate missing: the post-push encryption task must loop-drain coalesced \
-         pushes via finish_or_take_pending before releasing its repo key"
-    );
-
-    // F4: every post-receive scan helper admits itself to the shared scan pool via
-    // `crate::state::acquire_scan_permit` BEFORE its spawn_blocking git walk, so a
-    // push burst cannot accumulate unbounded concurrent scans once the write permit
-    // is released. Two halves, both load-bearing: the helper body must actually
-    // acquire the pool (state.rs sits the helper at the end of the file, so the
-    // definition tail contains no other `acquire_owned` to match vacuously), and
-    // within each scan helper the first qualified call precedes the first
-    // `spawn_blocking`. Severing a call site pushes the next occurrence past the
-    // helper's own `spawn_blocking` (or off the end of the file), turning the
-    // assertion red; comments name the helper without the `crate::state::` prefix,
-    // so this targets the real call sites.
-    let state_rs = src("state.rs");
-    let helper_def = state_rs
-        .find("fn acquire_scan_permit")
-        .expect("F4 gate missing: state.rs no longer defines acquire_scan_permit");
-    assert!(
-        state_rs[helper_def..].contains("acquire_owned"),
-        "F4 gate gutted: acquire_scan_permit must acquire the scan pool via acquire_owned"
-    );
-    let push_delta = src("git/push_delta.rs");
-    for (file_src, file, helper) in [
-        (&repos, "api/repos.rs", "fn replication_withheld_set"),
-        (&repos, "api/repos.rs", "fn fail_closed_full_scan_objects"),
-        (
-            &push_delta,
-            "git/push_delta.rs",
-            "fn resolve_candidates_for_push",
-        ),
-    ] {
-        let start = file_src
-            .find(helper)
-            .unwrap_or_else(|| panic!("{file}: `{helper}` not found"));
-        let tail = &file_src[start..];
-        let acquire = tail
-            .find("crate::state::acquire_scan_permit(")
-            .unwrap_or_else(|| {
-                panic!("F4 gate missing: {file} `{helper}` no longer acquires a scan permit")
-            });
-        let spawn = tail.find("spawn_blocking").unwrap_or_else(|| {
-            panic!("{file}: `{helper}` lost its spawn_blocking walk — update this guard")
-        });
-        assert!(
-            acquire < spawn,
-            "F4 gate bypassed: {file} `{helper}` must acquire its git_encrypt_semaphore \
-             permit BEFORE dispatching the blocking git scan"
-        );
-    }
-}
-
-/// F4 (repo_store advisory-unlock cancellation safety): `RepoWriteGuard::release`
-/// must await `pg_advisory_unlock` while `self` still owns the pooled connection,
-/// and must not mark itself `released` until that await resolves. Either shape,
-/// reintroduced, re-opens the mid-unlock cancellation leak: taking the connection
-/// early leaves `Drop` with `conn == None`, and setting `released = true` early
-/// leaves the `Drop` backstop inert — both strand the session lock on cancellation.
-///
-/// Scoped to the `release` fn body: the `Drop` impl legitimately takes the
-/// connection and unlocks, so a whole-file scan would match it and read as a false
-/// pass. Reverting either ordering turns this red (proven load-bearing).
-#[test]
-fn f4_release_keeps_conn_owned_until_unlock_resolves() {
-    let repo_store = src("git/repo_store.rs");
-
-    let rel_start = repo_store
-        .find("pub async fn release(mut self")
-        .expect("F4 gate: repo_store.rs no longer defines RepoWriteGuard::release");
-    let rel_end = repo_store[rel_start..]
-        .find("impl Drop for RepoWriteGuard")
-        .map(|off| rel_start + off)
-        .expect("F4 gate: release fn / Drop impl markers moved — update this guard");
-    let release_body = &repo_store[rel_start..rel_end];
-
-    let unlock = release_body
-        .find("pg_advisory_unlock")
-        .expect("F4 gate: release must still issue pg_advisory_unlock");
-    let before_unlock = &release_body[..unlock];
-
-    // (a) the connection must still be owned by `self` at the unlock await.
-    assert!(
-        !before_unlock.contains("self.conn.take()"),
-        "F4 regression: RepoWriteGuard::release takes self.conn BEFORE awaiting \
-         pg_advisory_unlock. A cancellation during the unlock await then strands the \
-         session advisory lock (Drop sees conn == None and skips its backstop). \
-         Unlock through the still-owned connection instead."
-    );
-    // (b) `released` must not be set before the unlock await — the other
-    // reintroduction shape a single-reorder check on (a) alone is blind to.
-    assert!(
-        !before_unlock.contains("released = true"),
-        "F4 regression: RepoWriteGuard::release sets `released = true` BEFORE awaiting \
-         pg_advisory_unlock. A cancellation during the await then leaves the Drop \
-         backstop inert (it early-returns on released). Set released only AFTER the \
-         unlock await resolves."
-    );
-}
-
-/// F6/KTD-5 (initial IPFS metadata queries deadline-wrapped): `get_by_cid` acquires
-/// the scarce walk permits (RAII, held for the whole request) BEFORE its two initial
-/// metadata queries, and the per-repo loop's first budget gate runs only later. So
-/// both `list_all_repos` and `list_visibility_rules_for_repos` must be clamped to the
-/// remaining request budget — otherwise a query blocked in Postgres pins the walk slot
-/// for the whole stall, past the budget. This scans the PRODUCTION half of `api/ipfs.rs`
-/// (the `mod tests` half names the same calls in its own harness and would make the
-/// check vacuous) and asserts each query call is immediately preceded by a
-/// `tokio::time::timeout(` wrapper. Removing either wrapper turns this red (proven
-/// load-bearing).
-#[test]
-fn f6_ipfs_metadata_queries_are_deadline_wrapped() {
-    let ipfs = src("api/ipfs.rs");
-    let production = ipfs
-        .split("#[cfg(test)]")
-        .next()
-        .expect("split always yields a first chunk");
-
-    for call in [".list_all_repos()", ".list_visibility_rules_for_repos("] {
-        assert_eq!(
-            production.matches(call).count(),
-            1,
-            "F6 guard stale: `{call}` must appear exactly once in the production half \
-             of api/ipfs.rs (the deadline-wrapped handler call) — update this guard"
-        );
-        let idx = production
-            .find(call)
-            .unwrap_or_else(|| panic!("F6 gate: api/ipfs.rs no longer calls `{call}`"));
-        // The wrapper opens a few lines above the call (match tokio::time::timeout( ...
-        // remaining budget ..., <query> )); a 240-char lookback covers it without
-        // reaching the previous statement.
-        let window = &production[idx.saturating_sub(240)..idx];
-        assert!(
-            window.contains("tokio::time::timeout("),
-            "F6 gate missing: `{call}` must be wrapped in tokio::time::timeout(...) \
-             clamped to the remaining request budget. An unwrapped await pins the held \
-             walk permit for the whole DB stall, past GITLAWB_IPFS_REQUEST_BUDGET_SECS."
-        );
-    }
-}
-
-/// #174 F2 / KTD-3: the detached post-receive Pinata replication task must enqueue
-/// only the push's `(ref, old, new)` tuples and RE-DERIVE its object set inside the
-/// worker once a pin slot frees — it must NOT move the full per-push object list into
-/// the closure and hold it across the `pin_semaphore` acquire. Retaining the list makes
-/// every parked task (under a slow Pinata backend) hold an MB-scale OID list, so
-/// outstanding memory grows O(pushes x object-list). Coalescing/shedding the task is
-/// forbidden (its per-ref effects are non-idempotent), so the fix bounds the retained
-/// data, not the task count.
-///
-/// Two load-bearing checks, both against the PRODUCTION half of `api/repos.rs` (the
-/// `mod tests` half names the same identifiers in its own harness and would make the
-/// scan vacuous): (a) the closure-local `object_list_pinata` binding — the retain form —
-/// must be gone; reintroducing `let object_list_pinata = object_list;` turns this red.
-/// (b) the re-derivation (`pinata_object_list_for_refs`) must appear AFTER the Pinata
-/// pin permit is acquired, so the object list is materialized only inside the pin-bounded
-/// section and a parked task holds O(ref tuples).
-#[test]
-fn f2_pinata_enqueues_refs_not_retained_object_lists() {
-    let repos = src("api/repos.rs");
-    let production = repos
-        .split("#[cfg(test)]")
-        .next()
-        .expect("split always yields a first chunk");
-
-    // (a) the retained-list form must be gone from production.
-    assert!(
-        !production.contains("object_list_pinata"),
-        "F2/KTD-3 regression: the Pinata task retains a full per-push object list \
-         (`object_list_pinata`) across the pin-permit acquire. Enqueue only the ref \
-         tuples and re-derive the object set inside the worker (pinata_object_list_for_refs)."
-    );
-
-    // (b) the re-derivation runs AFTER the pin permit is acquired. Anchor on the
-    // Pinata pin-admission clone so the window is the Pinata task, not the sibling
-    // IPFS/encrypt spawn (which shares `pin_semaphore` but never re-derives).
-    let anchor = production
-        .find("let pin_sem_pinata")
-        .expect("F2 gate stale: the Pinata pin-admission clone (pin_sem_pinata) moved");
-    let tail = &production[anchor..];
-    let acquire = tail
-        .find(".acquire_owned()")
-        .expect("F2 gate: the Pinata task no longer acquires a pin permit (acquire_owned)");
-    let rederive = tail.find("pinata_object_list_for_refs(").expect(
-        "F2 gate missing: the Pinata task must re-derive its object set via \
-         pinata_object_list_for_refs; it can no longer move a pre-resolved list into the closure",
-    );
-    assert!(
-        acquire < rederive,
-        "F2 gate bypassed: the Pinata object-set re-derivation must run AFTER the pin \
-         permit is acquired, so a parked task never holds the MB-scale object list"
-    );
-
-    // The re-derivation is driven by the push's ref tuples (the enqueued unit), not a
-    // retained object list — tie "enqueue ref_updates" to the call explicitly.
-    assert!(
-        tail[rederive..].starts_with("pinata_object_list_for_refs(")
-            && tail[rederive..]
-                .get(..400)
-                .map(|w| w.contains("ref_updates_clone"))
-                .unwrap_or(false),
-        "F2 gate: pinata_object_list_for_refs must re-derive from the push's ref tuples \
-         (ref_updates_clone), the small unit the parked task retains"
-    );
-}
-
-/// #174 U2 / F3 (second same-repo writer serialized until a disconnected first push's
-/// git group is reaped): `git_receive_pack` must take the per-repo in-process write
-/// lease and CARRY it on the write-path `AdmissionGuard` (via `.with_lease`), so the
-/// lease rides `KillGroupOnDrop`'s detached reaper and frees only after the group is
-/// reaped — supplementing the pg advisory lock, which `RepoWriteGuard::Drop` releases at
-/// the disconnect instant. Tying the lease to `RepoWriteGuard` instead (or dropping the
-/// `.with_lease` carry) reopens the race; the behavioral RED/GREEN test
-/// (`f3_second_push_serialized_until_disconnected_group_reaped`) is the real bar, this
-/// is the completeness tripwire. Scanned against the PRODUCTION half of `api/repos.rs`
-/// (the `mod tests` half names these identifiers in its own harness).
-#[test]
-fn f3_second_writer_leased_until_reap() {
-    let repos = src("api/repos.rs");
-    let smart_http = src("git/smart_http.rs");
-    let repos_production = repos
-        .split("#[cfg(test)]")
-        .next()
-        .expect("split always yields a first chunk");
-
-    // The lease is acquired, then carried by the AdmissionGuard (.with_lease), before
-    // receive_pack runs the write. Severing any of the three turns this red.
-    let lease_acquire = repos_production.find("repo_write_leases").expect(
-        "F3 gate missing: git_receive_pack no longer takes the per-repo write lease \
-         (state.repo_write_leases)",
-    );
-    let with_lease = repos_production.find(".with_lease(").expect(
-        "F3 gate missing: the write-path AdmissionGuard no longer carries the lease \
-         (.with_lease). The lease must ride the disconnect reaper via the AdmissionGuard, \
-         NOT RepoWriteGuard (which drops at the disconnect instant, reopening F3).",
-    );
-    let receive = repos_production
-        .find("smart_http::receive_pack(")
-        .expect("F3 gate stale: git_receive_pack no longer calls smart_http::receive_pack");
-    assert!(
-        lease_acquire < with_lease && with_lease < receive,
-        "F3 gate bypassed: the write lease must be acquired, then carried by the \
-         AdmissionGuard (.with_lease), BEFORE receive_pack runs the write"
-    );
-
-    // The AdmissionGuard must actually hold the lease (Option<RepoWriteLease>) via a
-    // with_lease setter, so it travels into the detached reaper. Removing the field or
-    // method turns this red.
-    assert!(
-        smart_http.contains("_lease: Option<crate::state::RepoWriteLease>")
-            && smart_http.contains("pub fn with_lease("),
-        "F3 gate missing: AdmissionGuard must hold an Option<RepoWriteLease> set via \
-         with_lease, so the lease rides the guard into KillGroupOnDrop's reaper"
-    );
-}
-
-/// #174 U1 — every blocking walk in the `/ipfs` scan carries the request's walk
-/// admission.
-///
-/// The admission is an `Arc<WalkAdmission>` cloned into each `spawn_blocking`
-/// closure, so the global + per-source permits release only when the last holder
-/// drops: a client disconnect leaves the abandoned closure holding the slot, and a
-/// panicking closure leaves the handler holding it.
-///
-/// Only the walk site runs under `state.git_bin`, so only it can be pinned by the
-/// fake-git harness and mutation-verified dynamically (see
-/// `get_by_cid_walk_permit_held_through_blocking_walk`). The probe and the content
-/// read deliberately shell to the real `git`, which is why this structural check
-/// exists: it binds all three sites, and any blocking site added to this loop
-/// later, without reversing that deliberate independence.
-///
-/// MUTATION (RED): delete any one `Arc::clone(&admission)` binding, or drop the
-/// clone from inside its closure, and the count falls below three.
-#[test]
-fn inv22_ipfs_walk_admission_reaches_every_blocking_site() {
-    let ipfs = src("api/ipfs.rs");
-
-    // The shared owner must exist and be built once per request.
-    assert!(
-        ipfs.contains("struct WalkAdmission") && ipfs.contains("Arc::new(WalkAdmission {"),
-        "U1 gate missing: the /ipfs walk admission must be a shared WalkAdmission, \
-         not a handler-local permit pair"
-    );
-
-    // Every blocking site in the scan takes its own clone...
-    let clones = ipfs.matches("Arc::clone(&admission)").count();
-    assert!(
-        clones >= 3,
-        "U1 gate bypassed: expected an admission clone for each of the three \
-         /ipfs spawn_blocking sites (probe, walk, read); found {clones}. A blocking \
-         walk that does not hold the admission lets a disconnect or a panic free the \
-         slot while its git child is still running."
-    );
-
-    // ...and each clone is actually moved INTO the blocking closure, not merely
-    // created in the async frame (which would hold nothing across the join).
-    let held = ipfs.matches("let _admission = ").count();
-    assert!(
-        held >= 3,
-        "U1 gate bypassed: each admission clone must be bound inside its \
-         spawn_blocking closure so the blocking work owns it; found {held} of 3."
-    );
-
-    // The count of blocking sites is itself the thing being covered: if a fourth
-    // appears, it needs an admission clone too and this gate must be revisited.
-    let sites = ipfs.matches("spawn_blocking(move ||").count();
-    assert_eq!(
-        sites, 3,
-        "the /ipfs scan grew or lost a spawn_blocking site ({sites} found, expected 3); \
-         give any new blocking walk its own Arc::clone(&admission) and update this gate"
-    );
-}
-
-/// #174 U5: the post-receive replication tail is spawned at the DURABILITY BOUNDARY,
-/// which is the moment receive-pack returns success, not the end of the handler and
-/// not after `guard.release()`.
-///
-/// The tail owes this push its pins, recovery copy, and announcements. Everything
-/// below the spawn stays in the cancellable request future, so anything the tail is
-/// spawned after is a window where a client disconnect drops that work while the pack
-/// is already durable on disk. `guard.release()` is such a window: on success it
-/// awaits the Tigris upload and then the advisory unlock.
-///
-/// The lower bound matters just as much as the upper one: `release` runs on failure
-/// too, so an ungated spawn would fire for a push git rejected, pinning and announcing
-/// a half-applied repo. Above `release` the `?` on `receive_result` can no longer be
-/// what gates it, so the success check is explicit and this gate binds it: the spawn
-/// must sit inside `if push_succeeded`, and `release` must consume the same flag so
-/// the two cannot drift apart.
-///
-/// This is an ordering check rather than a cancellation-race test on purpose: it is
-/// the companion to `receive_pack_tail_survives_a_disconnect_during_release`, which
-/// drives the actual disconnect through a parked `release`. Same instrument the F3
-/// gate above uses.
-///
-/// MUTATION (RED): move the `tokio::spawn(post_receive_replication_tail` call below
-/// `guard.release(` and the ordering assertion fails; take it out of the
-/// `if push_succeeded` block and the failed-push assertion fails.
-#[test]
-fn inv22_replication_tail_spawns_at_the_durability_boundary() {
-    let repos = src("api/repos.rs");
-    // Production half only — the tests below name these identifiers too.
-    let production = repos
-        .split("#[cfg(test)]")
-        .next()
-        .expect("split always yields a first chunk");
-
-    let success_flag = production
-        .find("let push_succeeded = receive_result.is_ok();")
-        .expect(
-            "U5 gate missing: the tail's success gate must be bound from receive_result.is_ok()",
-        );
-    let gate_open = production
-        .find("if push_succeeded {")
-        .expect("U5 gate missing: the tail spawn must be gated on the push having succeeded");
-    let spawn = production
-        .find("tokio::spawn(post_receive_replication_tail(")
-        .expect("U5 gate missing: the replication tail must be spawned by git_receive_pack");
-    let release = production
-        .find("guard.release(push_succeeded)")
-        .expect("U5 gate stale: release must consume the same success flag as the tail gate");
-    let touch = production
-        .find("state.db.touch_repo(")
-        .expect("U5 gate stale: git_receive_pack no longer calls touch_repo");
-    let webhook = production
-        .find("webhooks::fire_event(")
-        .expect("U5 gate stale: git_receive_pack no longer fires push webhooks");
-
-    assert!(
-        success_flag < gate_open && gate_open < spawn,
-        "U5 gate bypassed: the tail must be spawned inside `if push_succeeded`, or a \
-         rejected push spawns a tail that pins and announces a half-applied repo"
-    );
-    // Still inside that block: no `}` may close it between the gate and the spawn.
-    assert!(
-        !production[gate_open + "if push_succeeded {".len()..spawn].contains('}'),
-        "U5 gate bypassed: the tail spawn left the `if push_succeeded` block, so a \
-         rejected push now spawns a tail"
-    );
-    assert!(
-        spawn < release && spawn < touch && spawn < webhook,
-        "U5 gate bypassed: the tail must be spawned BEFORE guard.release, touch_repo \
-         and the webhook fan-out, so a disconnect in any of those windows cannot drop \
-         this push's pins, recovery copy, and announcements"
-    );
 }

crates/gl/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "gl"
 description = "The gitlawb CLI — identity management, node control, MCP server"
-version = "0.7.1" # x-release-please-version
+version = "0.5.1" # x-release-please-version
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -13,7 +13,6 @@ path = "src/main.rs"
 [dependencies]
 gitlawb-core = { path = "../gitlawb-core" }
 icaptcha-client = { path = "../icaptcha-client" }
-base64 = { workspace = true }
 tokio = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

crates/gl/src/cert.rs

@@ -41,16 +41,6 @@ pub enum CertCmd {
         node: String,
         #[arg(long)]
         dir: Option<PathBuf>,
-        /// Exit non-zero unless the Ed25519 signature verifies AND the
-        /// issuing node matches the queried node (or --expect-node)
-        #[arg(long)]
-        verify: bool,
-        /// Expected issuing node DID for --verify. A valid signature alone
-        /// only proves the cert is internally consistent — signed by whatever
-        /// key it names — so --verify also anchors the issuer to a DID you
-        /// trust: this value when given, else the queried node's DID.
-        #[arg(long, requires = "verify")]
-        expect_node: Option<String>,
     },
 }
 
@@ -62,9 +52,7 @@ pub async fn run(args: CertArgs) -> Result<()> {
             id,
             node,
             dir,
-            verify,
-            expect_node,
-        } => cmd_show(repo, id, node, dir, verify, expect_node).await,
+        } => cmd_show(repo, id, node, dir).await,
     }
 }
 
@@ -126,14 +114,7 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
     Ok(())
 }
 
-async fn cmd_show(
-    repo: String,
-    id: String,
-    node: String,
-    dir: Option<PathBuf>,
-    require_valid: bool,
-    expect_node: Option<String>,
-) -> Result<()> {
+async fn cmd_show(repo: String, id: String, node: String, dir: Option<PathBuf>) -> Result<()> {
     let (owner, name) = resolve_repo(&repo, &node, dir.as_deref()).await?;
 
     let client = signed_client(&node, dir.as_deref());
@@ -167,124 +148,39 @@ async fn cmd_show(
     println!("  Signature: {signature}");
     println!();
 
-    // Verify the Ed25519 signature: rebuild the exact canonical payload the
-    // node signed (see gitlawb-node/src/cert.rs::issue_ref_certificate) and
-    // check it against the public key embedded in the certificate's node DID.
-    // This proves the cert is internally authentic — signed by the key it
-    // names; the node-DID comparison below covers *which* node that is.
-    let repo_id = cert["repo_id"].as_str().unwrap_or("");
-    let verdict = verify_signature(
-        repo_id, ref_name, old_sha, new_sha, pusher, node_did, issued_at, signature,
-    );
+    // Reconstruct the signing payload and verify
+    // Fetch the node's current public key to verify
+    let info: Value = client
+        .get("/")
+        .await?
+        .json()
+        .await
+        .context("failed to fetch node info")?;
+    let current_node_did = info["did"].as_str().unwrap_or("");
 
     println!("Signature verification:");
-    match &verdict {
-        Ok(()) => {
-            println!(
-                "  VALID — Ed25519 signature verified against the key the certificate names ({node_did})"
-            );
-        }
-        Err(reason) => {
-            println!("  INVALID — {reason}");
-        }
+    println!("  Signing payload would be:");
+    println!("    {{\"repo_id\": ..., \"ref\": \"{ref_name}\", \"old\": \"{old_sha}\",");
+    println!("      \"new\": \"{new_sha}\", \"pusher\": \"{pusher}\",");
+    println!("      \"node\": \"{node_did}\", \"ts\": \"{issued_at}\"}}");
+    println!();
+
+    if current_node_did == node_did {
+        println!("  Node DID matches current node. Signature is an Ed25519/base64url value.");
+        println!("  To verify offline, use the node's Ed25519 public key derived from:");
+        println!("    did:key → {node_did}");
+    } else {
+        println!("  WARNING: Certificate node DID ({node_did}) does not match");
+        println!("           current node DID ({current_node_did}).");
+        println!("           This certificate was issued by a different node.");
     }
 
-    // Contextual only — the verdict above stands on its own, so a node-info
-    // hiccup here must not turn a successfully displayed certificate into an
-    // error exit.
-    let current_node_did = match client.get("/").await {
-        Ok(resp) => resp
-            .json::<Value>()
-            .await
-            .ok()
-            .and_then(|info| info["did"].as_str().map(str::to_string)),
-        Err(_) => None,
-    };
-    match current_node_did.as_deref() {
-        Some(current) if current == node_did => {
-            println!("  Issuing node DID matches the node being queried.");
-        }
-        Some(current) => {
-            println!("  WARNING: Certificate node DID ({node_did}) does not match");
-            println!("           current node DID ({current}).");
-            println!("           This certificate was issued by a different node.");
-        }
-        None => {
-            println!("  NOTE: could not fetch current node info — skipping node-DID comparison.");
-        }
-    }
-
-    if require_valid {
-        if let Err(reason) = verdict {
-            anyhow::bail!("certificate signature did not verify: {reason}");
-        }
-        // A valid signature proves internal consistency only: the payload was
-        // signed by whatever key the certificate itself names. A hostile
-        // source can mint a keypair, put its DID in node_did, and self-sign.
-        // --verify therefore also anchors the issuer to a trusted DID:
-        // --expect-node when given, else the DID of the node being queried.
-        let expected = expect_node.as_deref().or(current_node_did.as_deref());
-        match expected {
-            Some(expected) if expected == node_did => {}
-            Some(expected) => anyhow::bail!(
-                "certificate is signed by {node_did}, but the expected issuer is {expected} — \
-                 a valid signature alone proves internal consistency, not a trusted issuer"
-            ),
-            None => anyhow::bail!(
-                "cannot anchor the issuer: node info is unreachable and no --expect-node was given"
-            ),
-        }
-    }
+    println!();
+    println!("  Signature (base64url): {signature}");
 
     Ok(())
 }
 
-/// Rebuild the node's canonical signing payload (field order must match
-/// gitlawb-node/src/cert.rs::issue_ref_certificate exactly) and verify the
-/// certificate's Ed25519 signature against the key embedded in `node_did`.
-#[allow(clippy::too_many_arguments)]
-fn verify_signature(
-    repo_id: &str,
-    ref_name: &str,
-    old_sha: &str,
-    new_sha: &str,
-    pusher: &str,
-    node_did: &str,
-    issued_at: &str,
-    signature_b64: &str,
-) -> std::result::Result<(), String> {
-    use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-    use std::str::FromStr;
-
-    let payload = serde_json::json!({
-        "repo_id": repo_id,
-        "ref":     ref_name,
-        "old":     old_sha,
-        "new":     new_sha,
-        "pusher":  pusher,
-        "node":    node_did,
-        "ts":      issued_at,
-    });
-    let payload_bytes =
-        serde_json::to_vec(&payload).map_err(|e| format!("could not serialize payload: {e}"))?;
-
-    let did =
-        gitlawb_core::did::Did::from_str(node_did).map_err(|e| format!("bad node DID: {e}"))?;
-    let verifying_key = did
-        .to_verifying_key()
-        .map_err(|e| format!("cannot derive a public key from {node_did}: {e}"))?;
-
-    let sig_vec = URL_SAFE_NO_PAD
-        .decode(signature_b64)
-        .map_err(|e| format!("signature is not valid base64url: {e}"))?;
-    let sig_bytes: [u8; 64] = sig_vec
-        .try_into()
-        .map_err(|_| "signature is not 64 bytes".to_string())?;
-
-    gitlawb_core::identity::verify(&verifying_key, &payload_bytes, &sig_bytes)
-        .map_err(|_| "Ed25519 signature does not match the signed payload".to_string())
-}
-
 async fn resolve_cert_id(client: &NodeClient, owner: &str, name: &str, id: &str) -> Result<String> {
     if id.len() >= 36 {
         return Ok(id.to_string());
@@ -313,88 +209,3 @@ async fn resolve_cert_id(client: &NodeClient, owner: &str, name: &str, id: &str)
         _ => anyhow::bail!("certificate prefix {id} matches multiple certificates"),
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// Pins gl's payload reconstruction to the frozen canonical byte form the
-    /// node signs (default serde_json maps = alphabetically ordered keys). If
-    /// serialization drifts — a field added, or a preserve_order feature
-    /// landing anywhere in the workspace (feature unification flips every
-    /// crate at once) — this literal stops matching and the test fails,
-    /// instead of every real certificate silently rendering INVALID.
-    #[test]
-    fn payload_serialization_matches_frozen_canonical_form() {
-        let payload = serde_json::json!({
-            "repo_id": "repo-1",
-            "ref":     "refs/heads/main",
-            "old":     "oldsha",
-            "new":     "newsha",
-            "pusher":  "did:key:z6MkPusher",
-            "node":    "did:key:z6MkNode",
-            "ts":      "2026-07-22T00:00:00+00:00",
-        });
-        let frozen = concat!(
-            r#"{"new":"newsha","node":"did:key:z6MkNode","old":"oldsha","#,
-            r#""pusher":"did:key:z6MkPusher","ref":"refs/heads/main","#,
-            r#""repo_id":"repo-1","ts":"2026-07-22T00:00:00+00:00"}"#,
-        );
-        assert_eq!(serde_json::to_string(&payload).unwrap(), frozen);
-    }
-
-    /// Signing exactly as the node does must round-trip through
-    /// verify_signature; any field tampering must fail it.
-    #[test]
-    fn verify_signature_round_trip_and_tamper() {
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let node_did = kp.did().as_str().to_string();
-
-        let payload = serde_json::json!({
-            "repo_id": "repo-1",
-            "ref":     "refs/heads/main",
-            "old":     "0".repeat(40),
-            "new":     "a".repeat(40),
-            "pusher":  "did:key:z6MkPusher",
-            "node":    node_did,
-            "ts":      "2026-07-22T00:00:00+00:00",
-        });
-        let sig = kp.sign_b64(&serde_json::to_vec(&payload).unwrap());
-
-        let ok = verify_signature(
-            "repo-1",
-            "refs/heads/main",
-            &"0".repeat(40),
-            &"a".repeat(40),
-            "did:key:z6MkPusher",
-            &node_did,
-            "2026-07-22T00:00:00+00:00",
-            &sig,
-        );
-        assert!(ok.is_ok(), "expected valid signature, got: {ok:?}");
-
-        let tampered = verify_signature(
-            "repo-1",
-            "refs/heads/main",
-            &"0".repeat(40),
-            &"b".repeat(40), // new_sha changed after signing
-            "did:key:z6MkPusher",
-            &node_did,
-            "2026-07-22T00:00:00+00:00",
-            &sig,
-        );
-        assert!(tampered.is_err(), "tampered payload must not verify");
-
-        let garbage = verify_signature(
-            "repo-1",
-            "refs/heads/main",
-            &"0".repeat(40),
-            &"a".repeat(40),
-            "did:key:z6MkPusher",
-            &node_did,
-            "2026-07-22T00:00:00+00:00",
-            "not-base64url!!!",
-        );
-        assert!(garbage.is_err(), "malformed signature must not verify");
-    }
-}

crates/gl/src/doctor.rs

@@ -16,7 +16,6 @@ use std::path::PathBuf;
 use crate::http::NodeClient;
 
 const PUBLIC_NODE: &str = "https://node.gitlawb.com";
-const GITHUB_API_BASE: &str = "https://api.github.com";
 
 #[derive(Args)]
 pub struct DoctorArgs {
@@ -142,20 +141,18 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
 
     // ── 3. GITLAWB_NODE env var ───────────────────────────────────────────
     match std::env::var("GITLAWB_NODE") {
-        // A loopback host is a legitimate setup (self-hosted node, dev
-        // harness) — the connectivity check below fails loudly if it is not
-        // actually reachable, so don't red-flag the configuration itself.
-        Ok(v) if is_loopback_url(&v) => {
-            checks.push(Check::pass(
+        Ok(v) if !v.is_empty() && !v.contains("127.0.0.1") && !v.contains("localhost") => {
+            checks.push(Check::pass("GITLAWB_NODE", v.to_string()));
+        }
+        Ok(v) if v.contains("127.0.0.1") || v.contains("localhost") => {
+            checks.push(Check::fail(
                 "GITLAWB_NODE",
                 format!(
-                    "{v} (local node — intentional for self-hosting/dev; unset to target the public network)"
+                    "set to local address ({v}) — git push/clone will fail against remote nodes"
                 ),
+                "export GITLAWB_NODE=https://node.gitlawb.com",
             ));
         }
-        Ok(v) if !v.is_empty() => {
-            checks.push(Check::pass("GITLAWB_NODE", v.to_string()));
-        }
         _ => {
             checks.push(Check::fail(
                 "GITLAWB_NODE",
@@ -245,15 +242,6 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
         ));
     }
 
-    // ── 5b. shell alias shadowing ─────────────────────────────────────────
-    // oh-my-zsh's default `git` plugin aliases gl='git pull', which silently
-    // shadows this binary in every interactive zsh — the classic symptom is
-    // `gl` printing "fatal: not a git repository". Aliases beat PATH, so no
-    // install method can fix it; the user's rc file has to unalias.
-    if let Some(check) = check_shell_alias_shadowing(dirs::home_dir()) {
-        checks.push(check);
-    }
-
     // ── 6. git ────────────────────────────────────────────────────────────
     match std::process::Command::new("git")
         .arg("--version")
@@ -275,7 +263,7 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
 
     // ── 7. Version up to date ─────────────────────────────────────────────
     let current = env!("CARGO_PKG_VERSION");
-    checks.push(check_version(current, GITHUB_API_BASE).await);
+    checks.push(check_version(current).await);
 
     // ── Render ────────────────────────────────────────────────────────────
     for check in &checks {
@@ -320,83 +308,6 @@ pub async fn run(args: DoctorArgs) -> Result<()> {
 }
 
 /// Check if a binary name exists anywhere on PATH.
-/// True when the rc file contains a real `unalias` command naming `gl` —
-/// not a comment, and not a longer word like `unalias global`. Ordering
-/// relative to oh-my-zsh loading is not modeled (an unalias placed before the
-/// plugin loads would be ineffective); acceptable slack for a warning check.
-fn rc_unaliases_gl(rc: &str) -> bool {
-    rc.lines().any(|line| {
-        let line = line.trim_start();
-        if line.starts_with('#') {
-            return false;
-        }
-        line.split([';', '&', '|']).any(|cmd| {
-            // A trailing comment must not count: `unalias foo  # gl`
-            let cmd = cmd.split('#').next().unwrap_or("");
-            let mut tokens = cmd.split_whitespace();
-            tokens.next() == Some("unalias") && tokens.any(|t| t == "gl")
-        })
-    })
-}
-
-/// True when the URL's host is exactly a loopback address. Substring checks
-/// misclassify hosts like `localhost.example` or URLs with "localhost" in the
-/// path, so parse and compare the actual host.
-fn is_loopback_url(value: &str) -> bool {
-    reqwest::Url::parse(value)
-        .ok()
-        .and_then(|u| {
-            u.host_str()
-                .map(|h| h == "localhost" || h == "127.0.0.1" || h == "[::1]" || h == "::1")
-        })
-        .unwrap_or(false)
-}
-
-/// Detect interactive-shell setups where an alias shadows `gl` (aliases beat
-/// PATH, so no install method can fix this). Best-effort heuristic over
-/// ~/.zshrc: an explicit `alias gl=`, or oh-my-zsh's `git` plugin (which
-/// ships gl='git pull'). Returns None when nothing suspicious is found or the
-/// rc file already contains an `unalias gl`.
-fn check_shell_alias_shadowing(home: Option<PathBuf>) -> Option<Check> {
-    let home = home?;
-    let rc = std::fs::read_to_string(home.join(".zshrc")).ok()?;
-    if rc_unaliases_gl(&rc) {
-        return None;
-    }
-
-    let explicit_alias = rc.lines().any(|l| l.trim_start().starts_with("alias gl="));
-    // Single-line `plugins=(git ...)` is the overwhelmingly common form; a
-    // multi-line plugins array slips past this heuristic, which is acceptable
-    // for a warning-level check.
-    let omz_git_plugin = home.join(".oh-my-zsh/plugins/git").exists()
-        && rc.lines().any(|l| {
-            let l = l.trim_start();
-            l.starts_with("plugins=")
-                && l.trim_start_matches("plugins=(")
-                    .trim_end_matches(')')
-                    .split_whitespace()
-                    .any(|p| p == "git")
-        });
-
-    if explicit_alias || omz_git_plugin {
-        let source = if explicit_alias {
-            "~/.zshrc defines `alias gl=`"
-        } else {
-            "oh-my-zsh's git plugin aliases gl='git pull'"
-        };
-        Some(Check::warn(
-            "shell alias",
-            format!(
-                "{source} — interactive shells run that instead of this binary \
-                 (symptom: `gl` prints \"fatal: not a git repository\")"
-            ),
-            "echo 'unalias gl 2>/dev/null' >> ~/.zshrc && source ~/.zshrc  (must come after oh-my-zsh loads)",
-        ))
-    } else {
-        None
-    }
-}
-
 fn which_in_path(name: &str) -> bool {
     std::env::var_os("PATH")
         .map(|paths| {
@@ -408,9 +319,8 @@ fn which_in_path(name: &str) -> bool {
         .unwrap_or(false)
 }
 
-/// Fetch the latest release tag from Gitlawb/node (the actual release repo — see install.sh's
-/// `GITLAWB_RELEASE_REPO` default) and compare to current version.
-async fn check_version(current: &'static str, github_api_base: &str) -> Check {
+/// Fetch the latest release tag from gitlawb/releases and compare to current version.
+async fn check_version(current: &'static str) -> Check {
     let client = match reqwest::Client::builder()
         .user_agent(format!("gl/{current}"))
         .timeout(std::time::Duration::from_secs(5))
@@ -421,9 +331,7 @@ async fn check_version(current: &'static str, github_api_base: &str) -> Check {
     };
 
     let resp = match client
-        .get(format!(
-            "{github_api_base}/repos/Gitlawb/node/releases/latest"
-        ))
+        .get("https://api.github.com/repos/gitlawb/releases/releases/latest")
         .send()
         .await
     {
@@ -431,13 +339,6 @@ async fn check_version(current: &'static str, github_api_base: &str) -> Check {
         Err(_) => return Check::pass("version", format!("v{current} (offline — could not check)")),
     };
 
-    if !resp.status().is_success() {
-        return Check::pass(
-            "version",
-            format!("v{current} (GitHub API returned HTTP {})", resp.status()),
-        );
-    }
-
     let body: serde_json::Value = match resp.json().await {
         Ok(v) => v,
         Err(_) => return Check::pass("version", format!("v{current} (invalid response)")),
@@ -481,88 +382,6 @@ fn is_newer(latest: &str, current: &str) -> bool {
 mod tests {
     use super::*;
 
-    fn fake_home(zshrc: Option<&str>, with_omz_git: bool) -> tempfile::TempDir {
-        let home = tempfile::TempDir::new().unwrap();
-        if let Some(rc) = zshrc {
-            std::fs::write(home.path().join(".zshrc"), rc).unwrap();
-        }
-        if with_omz_git {
-            std::fs::create_dir_all(home.path().join(".oh-my-zsh/plugins/git")).unwrap();
-        }
-        home
-    }
-
-    #[test]
-    fn alias_shadowing_flags_omz_git_plugin() {
-        let home = fake_home(Some("plugins=(git z)\nsource $ZSH/oh-my-zsh.sh\n"), true);
-        let check = check_shell_alias_shadowing(Some(home.path().to_path_buf()));
-        assert!(check.is_some(), "omz git plugin without unalias must warn");
-    }
-
-    #[test]
-    fn alias_shadowing_flags_explicit_alias() {
-        let home = fake_home(Some("alias gl='git pull'\n"), false);
-        assert!(check_shell_alias_shadowing(Some(home.path().to_path_buf())).is_some());
-    }
-
-    #[test]
-    fn alias_shadowing_silent_when_unaliased() {
-        let home = fake_home(
-            Some("plugins=(git z)\nsource $ZSH/oh-my-zsh.sh\nunalias gl 2>/dev/null\n"),
-            true,
-        );
-        assert!(check_shell_alias_shadowing(Some(home.path().to_path_buf())).is_none());
-    }
-
-    #[test]
-    fn alias_shadowing_ignores_fake_unaliases() {
-        // None of these actually free `gl` — the warning must survive them.
-        for rc in [
-            "plugins=(git)\n# unalias gl\n",          // commented out
-            "plugins=(git)\nunalias global\n",        // longer word
-            "plugins=(git)\nunalias foo  # gl\n",     // gl only in a comment
-            "plugins=(git)\necho unalias-gl-later\n", // not an unalias command
-        ] {
-            let home = fake_home(Some(rc), true);
-            assert!(
-                check_shell_alias_shadowing(Some(home.path().to_path_buf())).is_some(),
-                "must still warn for rc: {rc:?}"
-            );
-        }
-        // Real unalias forms that do free it — all must silence the warning.
-        for rc in [
-            "plugins=(git)\nunalias gl\n",
-            "plugins=(git)\nunalias gl 2>/dev/null\n",
-            "plugins=(git)\ntrue; unalias gl\n",
-            "plugins=(git)\nunalias glog gl gst\n",
-        ] {
-            let home = fake_home(Some(rc), true);
-            assert!(
-                check_shell_alias_shadowing(Some(home.path().to_path_buf())).is_none(),
-                "must be silent for rc: {rc:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn loopback_url_detection_is_host_exact() {
-        assert!(is_loopback_url("http://127.0.0.1:7545"));
-        assert!(is_loopback_url("http://localhost:7545"));
-        assert!(is_loopback_url("http://[::1]:7545"));
-        assert!(!is_loopback_url("https://localhost.example"));
-        assert!(!is_loopback_url("https://node.gitlawb.com/localhost"));
-        assert!(!is_loopback_url("not a url"));
-    }
-
-    #[test]
-    fn alias_shadowing_silent_without_signals() {
-        let home = fake_home(Some("plugins=(z)\nexport EDITOR=vim\n"), false);
-        assert!(check_shell_alias_shadowing(Some(home.path().to_path_buf())).is_none());
-        let no_rc = fake_home(None, false);
-        assert!(check_shell_alias_shadowing(Some(no_rc.path().to_path_buf())).is_none());
-        assert!(check_shell_alias_shadowing(None).is_none());
-    }
-
     #[test]
     fn test_is_newer_minor_bump() {
         assert!(is_newer("0.2.0", "0.1.0"));
@@ -598,50 +417,4 @@ mod tests {
     fn test_which_in_path_missing_binary() {
         assert!(!which_in_path("this-binary-does-not-exist-gl-test-12345"));
     }
-
-    #[tokio::test]
-    async fn test_check_version_queries_gitlawb_node_releases() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/repos/Gitlawb/node/releases/latest")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"tag_name":"v9.9.9"}"#)
-            .create_async()
-            .await;
-
-        let check = check_version("0.1.0", &server.url()).await;
-        assert!(matches!(check.state, CheckState::Warn));
-        assert!(check.detail.contains("v9.9.9"));
-    }
-
-    #[tokio::test]
-    async fn test_check_version_up_to_date() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/repos/Gitlawb/node/releases/latest")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"tag_name":"v0.1.0"}"#)
-            .create_async()
-            .await;
-
-        let check = check_version("0.1.0", &server.url()).await;
-        assert!(matches!(check.state, CheckState::Ok));
-        assert!(check.detail.contains("up to date"));
-    }
-
-    #[tokio::test]
-    async fn test_check_version_http_error() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/repos/Gitlawb/node/releases/latest")
-            .with_status(403)
-            .create_async()
-            .await;
-
-        let check = check_version("0.1.0", &server.url()).await;
-        assert!(matches!(check.state, CheckState::Ok));
-        assert!(check.detail.contains("GitHub API returned HTTP 403"));
-    }
 }

crates/gl/src/http.rs

@@ -72,23 +72,6 @@ impl NodeClient {
         req.send().await.with_context(|| format!("GET {url}"))
     }
 
-    /// GET that signs when an identity keypair is present and falls back to an
-    /// anonymous GET otherwise — for read-visibility endpoints, where a public
-    /// repo is readable anonymously but a private repo requires the owner/reader
-    /// to be authenticated. Mirrors the conditional signing of post/put/delete.
-    pub async fn get_maybe_signed(&self, path: &str) -> Result<reqwest::Response> {
-        let url = format!("{}{}", self.node_url, path);
-        let mut req = self.inner.get(&url);
-        if let Some(kp) = &self.keypair {
-            let signed = sign_request(kp, "GET", path, b"");
-            req = req
-                .header("Content-Digest", signed.content_digest)
-                .header("Signature-Input", signed.signature_input)
-                .header("Signature", signed.signature);
-        }
-        req.send().await.with_context(|| format!("GET {url}"))
-    }
-
     /// POST with JSON body + RFC 9421 signing + transparent iCaptcha solve/retry.
     pub async fn post(&self, path: &str, body: &[u8]) -> Result<reqwest::Response> {
         self.send_signed("POST", path, body).await
@@ -203,39 +186,6 @@ async fn obtain_proof(cfg: IcaptchaCfg) -> Result<String> {
         .context("iCaptcha solver task panicked")?
 }
 
-/// Read at most `cap` bytes of a response body. Bounds the allocation from a
-/// hostile or broken node returning a huge error body — the display is capped
-/// separately, but the read itself must not be unbounded (INV-6, read half).
-pub(crate) async fn read_body_capped(mut resp: reqwest::Response, cap: usize) -> String {
-    let mut buf: Vec<u8> = Vec::new();
-    while buf.len() < cap {
-        match resp.chunk().await {
-            Ok(Some(chunk)) => {
-                let take = (cap - buf.len()).min(chunk.len());
-                buf.extend_from_slice(&chunk[..take]);
-                if take < chunk.len() {
-                    break; // hit the cap mid-chunk
-                }
-            }
-            _ => break, // end of body or read error — return what we have
-        }
-    }
-    String::from_utf8_lossy(&buf).into_owned()
-}
-
-/// Strip terminal-dangerous characters from (and cap the length of) a
-/// node-supplied error string before surfacing it. The node a caller talks to
-/// could be hostile and embed escape sequences in its error body; those must not
-/// reach the terminal verbatim (INV-6). We drop the C0/C1 control bytes (which
-/// defangs ANSI/OSC escapes) AND the Unicode bidi/format controls (which
-/// `char::is_control` does not cover — they can reorder the displayed line).
-pub(crate) fn sanitize_node_msg(s: &str) -> String {
-    s.chars()
-        .filter(|c| !c.is_control() && !gitlawb_core::sanitize::is_bidi_format(*c))
-        .take(200)
-        .collect()
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -620,35 +570,4 @@ mod tests {
         ic.challenge.assert();
         ic.answer.assert();
     }
-
-    #[test]
-    fn sanitize_strips_controls_bidi_and_caps_length() {
-        // C0 (ESC/BEL) and the Cf bidi override (U+202E) are both removed; the
-        // printable text survives. (Note: a stripped ESC leaves any following
-        // "[31m" as inert literal text — that is the point, so the input here
-        // avoids that residue to keep the expectation unambiguous.)
-        let out = sanitize_node_msg("a\u{1b}\u{07}b\u{202e}c");
-        assert!(
-            !out.chars().any(|c| c.is_control()),
-            "control char leaked: {out:?}"
-        );
-        assert!(
-            !out.contains('\u{202e}'),
-            "RLO bidi override leaked: {out:?}"
-        );
-        assert_eq!(out, "abc");
-        // Length is capped at 200 chars regardless of input size.
-        let long = "x".repeat(250);
-        assert_eq!(sanitize_node_msg(&long).chars().count(), 200);
-    }
-
-    #[test]
-    fn sanitize_preserves_legitimate_and_rtl_text() {
-        // Must not over-strip: a plain word, a genuine RTL SCRIPT letter (Arabic
-        // U+0627, category Lo — NOT a format char), and ZWJ (U+200D, a legitimate
-        // Cf char, e.g. emoji sequences) all survive. Guards the shared predicate
-        // against being widened into a blanket Cf stripper.
-        let out = sanitize_node_msg("ok \u{0627}\u{200D}b");
-        assert_eq!(out, "ok \u{0627}\u{200D}b");
-    }
 }

crates/gl/src/init.rs

@@ -38,23 +38,13 @@ pub async fn run(args: InitArgs) -> Result<()> {
     let git_dir = cwd.join(".git");
     if !git_dir.exists() {
         println!("Initializing git repository...");
-        // -b main: the push flow targets `main`; without it a fresh repo uses
-        // the user's init.defaultBranch (often `master`). Older git (<2.28)
-        // lacks the flag, so fall back to a plain init.
         let status = std::process::Command::new("git")
-            .args(["init", "-b", "main"])
+            .args(["init"])
             .current_dir(&cwd)
             .status()
             .context("failed to run git init")?;
         if !status.success() {
-            let status = std::process::Command::new("git")
-                .args(["init"])
-                .current_dir(&cwd)
-                .status()
-                .context("failed to run git init")?;
-            if !status.success() {
-                anyhow::bail!("git init failed");
-            }
+            anyhow::bail!("git init failed");
         }
     } else {
         println!("Git repository detected.");
@@ -175,47 +165,9 @@ pub async fn run(args: InitArgs) -> Result<()> {
         }
     }
 
-    // The hint must match the repo's actual state: with no commits yet, a bare
-    // `git push` fails with "src refspec ... does not match any" — exactly the
-    // trap a zero-to-push command must not set.
-    let has_commits = std::process::Command::new("git")
-        .args(["rev-parse", "--verify", "HEAD"])
-        .current_dir(&cwd)
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false);
-    // symbolic-ref succeeds on a branch (including an unborn one) and fails
-    // on a detached HEAD — where guessing "main" could push the wrong ref.
-    let branch = std::process::Command::new("git")
-        .args(["symbolic-ref", "--short", "HEAD"])
-        .current_dir(&cwd)
-        .stderr(std::process::Stdio::null())
-        .output()
-        .ok()
-        .filter(|o| o.status.success())
-        .and_then(|o| String::from_utf8(o.stdout).ok())
-        .map(|s| s.trim().to_string())
-        .filter(|s| !s.is_empty());
-
     println!();
-    match (branch, has_commits) {
-        (Some(branch), true) => {
-            println!("Ready! Push with:");
-            println!("  git push gitlawb {branch}");
-        }
-        (Some(branch), false) => {
-            println!("Ready! Nothing is committed yet — commit, then push:");
-            println!("  git add -A && git commit -m \"initial commit\"");
-            println!("  git push gitlawb {branch}");
-        }
-        (None, _) => {
-            println!("Ready! HEAD is detached — create or switch to a branch, then push:");
-            println!("  git switch -c main");
-            println!("  git push gitlawb main");
-        }
-    }
+    println!("Ready! Push with:");
+    println!("  git push gitlawb main");
 
     Ok(())
 }

crates/gl/src/ipfs_cmd.rs

@@ -33,13 +33,16 @@ pub enum IpfsCmd {
         cid: String,
         #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
+        /// Identity directory (default: ~/.gitlawb)
+        #[arg(long)]
+        dir: Option<PathBuf>,
     },
 }
 
 pub async fn run(args: IpfsArgs) -> Result<()> {
     match args.cmd {
         IpfsCmd::List { node, dir } => cmd_list(node, dir).await,
-        IpfsCmd::Get { cid, node } => cmd_get(cid, node).await,
+        IpfsCmd::Get { cid, node, dir } => cmd_get(cid, node, dir).await,
     }
 }
 
@@ -86,11 +89,32 @@ async fn cmd_list(node: String, dir: Option<PathBuf>) -> Result<()> {
     Ok(())
 }
 
-async fn cmd_get(cid: String, node: String) -> Result<()> {
-    let client = NodeClient::new(&node, None);
-    let path = format!("/ipfs/{cid}");
+async fn cmd_get(cid: String, node: String, dir: Option<PathBuf>) -> Result<()> {
+    // #173 (F5): the resolver now serves path-scoped objects to authorized readers,
+    // so sign with an available identity like `gl ipfs list` — otherwise an owner or
+    // listed reader gets the opaque anonymous 404 for content they can read.
+    // `get_authed` signs when a keypair is present and falls back to unsigned.
+    //
+    // An explicit `--dir` is a request to use THAT identity: propagate a
+    // missing/corrupt-keystore error (like `list`) instead of silently sending an
+    // anonymous request the authorized reader would see as the node's opaque 404
+    // (#173 review). Only the default (no `--dir`) keeps the best-effort unsigned
+    // fallback, so `get` stays usable for genuinely public content.
+    let keypair = match dir.as_deref() {
+        Some(dir) => Some(crate::identity::load_keypair_from_dir(Some(dir))?),
+        None => crate::identity::load_keypair_from_dir(None).ok(),
+    };
+    let client = NodeClient::new(&node, keypair);
+    // #173 review (F1): the node now accepts equivalent multibase spellings,
+    // including base64 CIDs (prefix 'm'), whose alphabet contains '/', '+', '='.
+    // Interpolating the CID raw would make the client request (and sign)
+    // `/ipfs/<prefix>/<suffix>`, which neither matches the single-segment Axum
+    // route nor points at the intended target. Percent-encode the CID as exactly
+    // one path segment so the signed and sent target agree and the server's
+    // `Path` extractor decodes it back to the original CID.
+    let path = format!("/ipfs/{}", encode_cid_segment(&cid));
     let resp = client
-        .get(&path)
+        .get_authed(&path)
         .await
         .with_context(|| format!("failed to fetch CID {cid} from {node}"))?;
 
@@ -119,6 +143,16 @@ async fn cmd_get(cid: String, node: String) -> Result<()> {
     Ok(())
 }
 
+/// Percent-encode a CID so it occupies exactly one path segment of `/ipfs/<cid>`.
+/// `urlencoding::encode` escapes every byte outside the RFC 3986 unreserved set
+/// (ALPHA / DIGIT / `-._~`), so the base64-CID characters that would otherwise
+/// break the single-segment route — `/`, `+`, `=` — are all escaped, and the
+/// server's `Path` extractor decodes the result back to the original CID (#173
+/// review, F1).
+fn encode_cid_segment(cid: &str) -> String {
+    urlencoding::encode(cid).into_owned()
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -235,4 +269,162 @@ mod tests {
 
         m.assert_async().await;
     }
+
+    /// #173 (F5): `gl ipfs get` must SIGN with an available identity, like
+    /// `gl ipfs list`, so an owner/reader can retrieve a path-scoped object the node
+    /// now resolves by CID. RED before the fix: cmd_get ignores the identity dir and
+    /// sends an unsigned request, so the signature-matching mock is never hit
+    /// (cmd_get errors on the unmatched 501, and m.assert fails). GREEN after: the
+    /// signed request carries the RFC 9421 headers and is served 200.
+    #[tokio::test]
+    async fn test_cmd_get_signs_when_identity_present() {
+        let mut server = mockito::Server::new_async().await;
+        let keystore = seed_keystore();
+
+        let m = server
+            .mock("GET", "/ipfs/bafkreitestcid")
+            .match_header("signature", mockito::Matcher::Any)
+            .match_header("signature-input", mockito::Matcher::Any)
+            .with_status(200)
+            .with_header("content-type", "application/octet-stream")
+            .with_header("x-git-hash", "abc123")
+            .with_body("object bytes")
+            .create_async()
+            .await;
+
+        cmd_get(
+            "bafkreitestcid".to_string(),
+            server.url(),
+            Some(keystore.path().to_path_buf()),
+        )
+        .await
+        .expect("signed get of a resolvable object should succeed");
+
+        m.assert_async().await;
+    }
+
+    /// #173 (F5) must-not: a genuine anonymous denial must surface as an error, not
+    /// be masked as success. With no identity dir the request is unsigned; a 404
+    /// from the node must produce an Err mentioning the status.
+    #[tokio::test]
+    async fn test_cmd_get_anonymous_denial_is_error() {
+        let mut server = mockito::Server::new_async().await;
+
+        let m = server
+            .mock("GET", "/ipfs/bafkreidenied")
+            .with_status(404)
+            .with_header("content-type", "text/plain")
+            .with_body("no git object found")
+            .create_async()
+            .await;
+
+        let err = cmd_get("bafkreidenied".to_string(), server.url(), None)
+            .await
+            .expect_err("a 404 denial must be an error, not masked success");
+        assert!(
+            err.to_string().contains("404"),
+            "error should mention the status, got: {err}"
+        );
+
+        m.assert_async().await;
+    }
+
+    /// #173 (INV-8) must-not: the node's new 503 "search incomplete" (the legacy CID
+    /// scan hit its bound and could not prove absence) must surface as an actionable
+    /// Err naming the status, NOT be rendered as an empty/"not found" success — a
+    /// retryable outcome the caller has to see. Mirrors the 404 denial case for the
+    /// bounded-search response the resolver now emits.
+    #[tokio::test]
+    async fn test_cmd_get_search_incomplete_503_is_error() {
+        let mut server = mockito::Server::new_async().await;
+
+        let m = server
+            .mock("GET", "/ipfs/bafkreiincomplete")
+            .with_status(503)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"error":"search_incomplete","message":"CID search incomplete — retry"}"#)
+            .create_async()
+            .await;
+
+        let err = cmd_get("bafkreiincomplete".to_string(), server.url(), None)
+            .await
+            .expect_err("a 503 incomplete-search must be an error, not masked as not-found");
+        assert!(
+            err.to_string().contains("503"),
+            "error should mention the status, got: {err}"
+        );
+
+        m.assert_async().await;
+    }
+
+    /// #173 review (F1): a base64 CID (multibase prefix 'm') can contain '/', '+',
+    /// and '='. The client must percent-encode it into ONE path segment before
+    /// building and signing `/ipfs/<cid>`; otherwise the '/' splits the target so
+    /// it misses the single-segment Axum route and the signature covers the wrong
+    /// path. Assert the encoded segment carries no raw '/', '+', or '=', and that
+    /// it decodes back to the original CID (the server's `Path` extractor performs
+    /// that same decode). RED with the old raw `format!("/ipfs/{cid}")`: the
+    /// segment still contains '/'.
+    #[test]
+    fn test_encode_cid_segment_escapes_base64_alphabet() {
+        let cid = "mFoo/Bar+baz==";
+        let encoded = encode_cid_segment(cid);
+
+        assert!(
+            !encoded.contains('/'),
+            "encoded CID must be a single path segment (no raw '/'), got: {encoded}"
+        );
+        assert!(
+            !encoded.contains('+'),
+            "encoded CID must escape '+', got: {encoded}"
+        );
+        assert!(
+            !encoded.contains('='),
+            "encoded CID must escape '=', got: {encoded}"
+        );
+
+        let decoded = urlencoding::decode(&encoded).expect("encoded CID must decode");
+        assert_eq!(
+            decoded, cid,
+            "encoding must round-trip back to the original CID"
+        );
+    }
+
+    /// #173 review: `gl ipfs get --dir <path>` must PROPAGATE a missing/corrupt
+    /// identity-load error like `gl ipfs list`, not silently fall back to an anonymous
+    /// request — otherwise an authorized reader pointing `--dir` at a broken keystore
+    /// gets the node's opaque 404 instead of the actionable key-load error. The
+    /// unsigned fallback is preserved only when NO `--dir` is given (covered by
+    /// `test_cmd_get_anonymous_denial_is_error`). RED before the fix (`.ok()` swallows
+    /// the error, an anonymous request is sent, and the `.expect(0)` mock is hit),
+    /// GREEN after.
+    #[tokio::test]
+    async fn test_cmd_get_explicit_dir_no_identity_errors_without_request() {
+        let mut server = mockito::Server::new_async().await;
+        // Empty keystore dir passed explicitly via --dir: no identity.pem present.
+        let empty = tempfile::TempDir::new().unwrap();
+
+        // The endpoint must never be hit when an explicit --dir fails to load.
+        let m = server
+            .mock("GET", "/ipfs/bafkreitestcid")
+            .expect(0)
+            .create_async()
+            .await;
+
+        let err = cmd_get(
+            "bafkreitestcid".to_string(),
+            server.url(),
+            Some(empty.path().to_path_buf()),
+        )
+        .await
+        .expect_err("an explicit --dir that fails to load must be an error");
+        assert!(
+            err.to_string().contains("gl identity new")
+                || err.to_string().contains("no identity found")
+                || err.to_string().contains("failed to load keypair"),
+            "error should name the key-load failure, got: {err}"
+        );
+
+        m.assert_async().await;
+    }
 }

crates/gl/src/mcp.rs

@@ -932,33 +932,13 @@ async fn call_tool(
 
         "webhook_list" => {
             let repo = args["repo"].as_str().context("missing 'repo'")?;
-            // Owner-gated route: an explicit `owner` arg wins, otherwise default to
-            // the signing keypair's short DID (NOT the node DID). The request is
-            // signed by this keypair, so the path owner must match it or the node
-            // returns 403/404.
-            let owner = if let Some(o) = args.get("owner").and_then(|v| v.as_str()) {
-                o.to_string()
-            } else {
-                let kp = keypair
-                    .as_ref()
-                    .context("no identity found — run `gl identity new` first")?;
-                let did = kp.did().to_string();
-                did.split(':').next_back().unwrap_or(&did).to_string()
-            };
-            // Owner-gated route: must be signed (get_signed), not a plain get().
-            let resp = client
-                .get_signed(&format!("/api/v1/repos/{owner}/{repo}/hooks"))
+            let owner = resolve_owner(&args, &client).await?;
+            let resp: Value = client
+                .get(&format!("/api/v1/repos/{owner}/{repo}/hooks"))
+                .await?
+                .json()
                 .await?;
-            // Check the HTTP status before deserializing: a 401/403/404 JSON error
-            // body (missing identity, wrong owner, private/deleted repo) must fail
-            // the tool call, not be returned as a successful result.
-            let status = resp.status();
-            let body: Value = resp.json().await?;
-            if !status.is_success() {
-                let msg = body["message"].as_str().unwrap_or("unknown error");
-                anyhow::bail!("webhook_list failed ({status}): {msg}");
-            }
-            Ok(serde_json::to_string_pretty(&body)?)
+            Ok(serde_json::to_string_pretty(&resp)?)
         }
 
         "webhook_delete" => {
@@ -1845,187 +1825,6 @@ mod tests {
         assert_eq!(parsed["body"], "looks good");
     }
 
-    #[tokio::test]
-    async fn test_webhook_list_via_mcp_signs_the_request() {
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        // /hooks is owner-gated, so the MCP webhook_list tool must send a SIGNED
-        // request (get_signed). Requiring the header catches a regression to get().
-        // Passing `owner` in args makes resolve_owner skip the node-root lookup.
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"webhooks":[],"count":0}"#)
-            .create_async()
-            .await;
-
-        let result = call_tool(
-            "webhook_list",
-            json!({"owner": "alice", "repo": "myrepo"}),
-            &server.url(),
-            Some(dir.path()),
-        )
-        .await
-        .unwrap();
-        assert!(result.contains("webhooks"), "got: {result}");
-    }
-
-    #[tokio::test]
-    async fn test_webhook_list_default_owner_is_keypair_not_node_did() {
-        // When `owner` is omitted, the owner segment must come from the signing
-        // keypair's short DID, NOT the node root DID. The "/" mock returns a
-        // different DID; the /hooks mock only matches the keypair's short DID,
-        // so a regression to the node DID would leave the request unmatched.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _root = server
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"did":"did:key:z6MkNodeRootDid"}"#)
-            .create_async()
-            .await;
-
-        let did = kp.did().to_string();
-        let short = did.split(':').next_back().unwrap_or(&did).to_string();
-
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(format!(r"/api/v1/repos/{short}/myrepo/hooks$")),
-            )
-            .match_header("signature", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"webhooks":[],"count":0}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = call_tool(
-            "webhook_list",
-            json!({"repo": "myrepo"}),
-            &server.url(),
-            Some(dir.path()),
-        )
-        .await
-        .unwrap();
-        assert!(result.contains("webhooks"), "got: {result}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_webhook_list_explicit_owner_overrides_keypair() {
-        // An explicit `owner` arg must win over the keypair default and the node
-        // DID. The path must use the supplied owner; "/" must not even be hit.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/api/v1/repos/someoneelse/myrepo/hooks$".to_string()),
-            )
-            .match_header("signature", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"webhooks":[],"count":0}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        let result = call_tool(
-            "webhook_list",
-            json!({"repo": "myrepo", "owner": "someoneelse"}),
-            &server.url(),
-            Some(dir.path()),
-        )
-        .await
-        .unwrap();
-        assert!(result.contains("webhooks"), "got: {result}");
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_webhook_list_non_success_status_errors() {
-        // A 403 (or any non-2xx) JSON error body for a missing identity, wrong
-        // owner, or private/deleted repo must fail the tool call, NOT be returned
-        // as a successful result. Mirrors the `gl webhook list` status check.
-        let mut server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"only the repo owner can perform this action"}"#)
-            .create_async()
-            .await;
-
-        let err = call_tool(
-            "webhook_list",
-            json!({"owner": "alice", "repo": "myrepo"}),
-            &server.url(),
-            Some(dir.path()),
-        )
-        .await
-        .expect_err("non-2xx must error, not return the error body as success");
-        let msg = err.to_string();
-        assert!(msg.contains("webhook_list failed (403"), "got: {msg}");
-        assert!(
-            msg.contains("only the repo owner"),
-            "must surface the node message, got: {msg}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_webhook_list_without_keypair_errors() {
-        // No identity loaded and no explicit owner → the tool must error rather
-        // than fall back to the node DID and issue an unsigned, mis-scoped GET.
-        let server = mockito::Server::new_async().await;
-        let dir = tempfile::TempDir::new().unwrap(); // empty: no identity.pem
-
-        let err = call_tool(
-            "webhook_list",
-            json!({"repo": "myrepo"}),
-            &server.url(),
-            Some(dir.path()),
-        )
-        .await
-        .expect_err("must error without an identity");
-        assert!(err.to_string().contains("no identity found"), "got: {err}");
-    }
-
     #[test]
     fn test_tool_count_is_42() {
         let tools = tool_definitions();

crates/gl/src/peer.rs

@@ -7,7 +7,7 @@ use clap::{Args, Subcommand};
 use serde_json::Value;
 use std::path::PathBuf;
 
-use crate::http::{read_body_capped, sanitize_node_msg, NodeClient};
+use crate::http::NodeClient;
 use crate::identity::load_keypair_from_dir;
 
 #[derive(Args)]
@@ -97,74 +97,6 @@ async fn cmd_list(node: String) -> Result<()> {
     Ok(())
 }
 
-/// The warning text for a local peer-add reply, or `None` when the node
-/// accepted it.
-///
-/// Split out so the refusal path is assertable. The node now answers 403 when
-/// an unproven caller tries to repoint an existing peer's `http_url`, so a
-/// reply that arrived and refused must not reach the success line.
-fn local_add_refusal(status: reqwest::StatusCode, body: &Value) -> Option<String> {
-    if status.is_success() {
-        return None;
-    }
-    // The message is the node's, not ours, so it is defanged before it reaches
-    // the terminal. Only the message: the status and the prose are ours.
-    let msg = sanitize_node_msg(body["message"].as_str().unwrap_or("unknown error"));
-    Some(format!(
-        "warning: local peer list not updated ({status}): {msg}"
-    ))
-}
-
-/// The error text for a remote announce reply, or `None` when the peer accepted
-/// it.
-///
-/// Split out so the ordering is assertable: the status has to reach the caller
-/// even when the body does not parse. That case is reachable rather than
-/// theoretical, because the read above is capped, so a peer answering with a
-/// body past the cap leaves truncated JSON behind, and `peer_url` is whatever
-/// the caller passed, so a non-JSON error page is just as easy. Parsing first
-/// and failing on the parse would swallow the status the user needs.
-fn remote_announce_failure(status: reqwest::StatusCode, raw: &str) -> Option<String> {
-    if status.is_success() {
-        return None;
-    }
-    // Falls back to the body itself when there is no `message` field, which is
-    // what a truncated or non-JSON reply leaves. Sanitized either way: it is the
-    // peer's text and it is headed for the terminal.
-    let parsed: Value = serde_json::from_str(raw).unwrap_or(Value::Null);
-    let msg = sanitize_node_msg(parsed["message"].as_str().unwrap_or(raw));
-    Some(format!("announce failed ({status}): {msg}"))
-}
-
-/// Which line the local peer-add prints, and whether it is a warning.
-///
-/// Split out because the SELECTION is what the fix is: `local_add_refusal` was
-/// already unit-tested six ways, and replacing this whole match with an
-/// unconditional "Added to local peer list." still left 312 tests green. The
-/// helper was pinned; the wiring was not, which is the shape
-/// `unit-test-on-helper-does-not-prove-handler-wiring` names. With the choice
-/// extracted, the call site is a two-line dispatch carrying no logic.
-fn local_add_report(status: reqwest::StatusCode, body: &Value) -> (bool, String) {
-    match local_add_refusal(status, body) {
-        Some(warning) => (true, warning),
-        None => (false, "  Added to local peer list.".to_string()),
-    }
-}
-
-/// The block printed after a peer accepts our announce. Split out so the
-/// defanging is assertable: the DID and URL are the remote peer's own strings,
-/// and `peer_url` is caller-chosen, so this is the least trusted body the
-/// command handles. Only the display is sanitized; the values sent on to our
-/// local node stay verbatim, since that is data rather than terminal output and
-/// the node runs its own validation on them.
-fn announced_peer_summary(their_did: &str, their_url: &str, peer_count: u64) -> String {
-    format!(
-        "Announced to peer node:\n  DID:        {}\n  URL:        {}\n  Their peers: {peer_count}\n",
-        sanitize_node_msg(their_did),
-        sanitize_node_msg(their_url),
-    )
-}
-
 async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result<()> {
     let keypair = load_keypair_from_dir(dir.as_deref())?;
     let my_did = keypair.did().to_string();
@@ -195,26 +127,21 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
         .await
         .context("failed to connect to peer")?;
     let status = resp.status();
-    // `peer_url` is fully caller-chosen, so this body is the least trusted one
-    // in the command: bound the read, and defang the message before it reaches
-    // the terminal through the error return. An announce reply is a DID, a URL
-    // and a count, so 8 KiB is well past what the shape needs.
-    let raw = read_body_capped(resp, 8 * 1024).await;
+    let result: Value = resp.json().await.context("invalid JSON response")?;
 
-    if let Some(failure) = remote_announce_failure(status, &raw) {
-        anyhow::bail!("{failure}");
+    if !status.is_success() {
+        let msg = result["message"].as_str().unwrap_or("unknown error");
+        anyhow::bail!("announce failed ({status}): {msg}");
     }
 
-    let result: Value = serde_json::from_str(&raw).context("invalid JSON response")?;
-
     let their_did = result["node_did"].as_str().unwrap_or("?");
     let their_url = result["node_url"].as_str().unwrap_or("?");
     let peer_count = result["peer_count"].as_u64().unwrap_or(0);
 
-    print!(
-        "{}",
-        announced_peer_summary(their_did, their_url, peer_count)
-    );
+    println!("Announced to peer node:");
+    println!("  DID:        {their_did}");
+    println!("  URL:        {their_url}");
+    println!("  Their peers: {peer_count}");
 
     // Also add their info to our local node's peer list
     // (the peer's /announce response includes their did + url)
@@ -223,31 +150,9 @@ async fn cmd_add(peer_url: String, node: String, dir: Option<PathBuf>) -> Result
             "did": their_did,
             "http_url": their_url,
         }))?;
-        // This requires the local node to be running, so a transport failure
-        // stays a warning rather than failing the command. A reply that
-        // ARRIVED and refused is different: the announce route answers 403
-        // when an unproven caller tries to repoint an existing peer, and
-        // printing the success line over that reports a completed add that
-        // never happened. Same status handling as the remote announce above,
-        // except best effort.
-        match local_client.post("/api/v1/peers/announce", &add_body).await {
-            Ok(resp) => {
-                let status = resp.status();
-                // Same bound as the remote announce above: a compromised local
-                // node (or a MITM on plain http) must not force an unbounded
-                // read. A body that does not parse stays `Null`, which still
-                // routes a non-success status to the warning.
-                let raw = read_body_capped(resp, 8 * 1024).await;
-                let result: Value = serde_json::from_str(&raw).unwrap_or(Value::Null);
-                let (is_warning, line) = local_add_report(status, &result);
-                if is_warning {
-                    eprintln!("{line}");
-                } else {
-                    println!("{line}");
-                }
-            }
-            Err(e) => eprintln!("warning: local peer list not updated: {e}"),
-        }
+        // This requires the local node to be running; ignore errors here
+        let _ = local_client.post("/api/v1/peers/announce", &add_body).await;
+        println!("  Added to local peer list.");
     }
 
     Ok(())
@@ -305,302 +210,3 @@ async fn cmd_resolve(did: String, node: String) -> Result<()> {
     }
     Ok(())
 }
-
-#[cfg(test)]
-mod tests {
-    use super::{
-        announced_peer_summary, cmd_add, local_add_refusal, local_add_report,
-        remote_announce_failure,
-    };
-    use reqwest::StatusCode;
-    use serde_json::json;
-
-    /// The node's 403 for repointing an existing peer must surface, not print
-    /// as a completed add. Without the status check the command prints "Added
-    /// to local peer list." over a refusal.
-    ///
-    /// The fixture body is the real wire shape, not an invented one: the
-    /// message is the Display of `PeerWriteDenied::UnprovenRepoint`, declared
-    /// in `crates/gitlawb-node/src/db/mod.rs`. The executable detector for a
-    /// wording change is the node-side pin
-    /// `announce_unsigned_repoint_is_a_403_denial` in
-    /// `crates/gitlawb-node/src/api/peers.rs`, which asserts this same
-    /// substring against a response driven through the real router, so
-    /// rewording the Display turns that test red and the grep for the old
-    /// phrase lands here.
-    ///
-    /// The assertion bites rather than echoing its own input because the
-    /// substring is reachable only through the helper's `body["message"]`
-    /// extraction; the fixture's `error` field carries a different string, so
-    /// reading `body["error"]` instead fails this test.
-    #[test]
-    fn a_refused_local_add_warns_with_the_node_reason() {
-        let warning = local_add_refusal(
-            StatusCode::FORBIDDEN,
-            &json!({
-                "error": "forbidden",
-                "message": "unproven announce cannot change an existing peer's http_url: did:key:z6MkuMqUm4i228K9qXidJ57zqSWAcQLgrcbMxB8RKVLuqitj"
-            }),
-        )
-        .expect("a refusal must not render as success");
-
-        assert!(warning.contains("403"), "must name the status: {warning}");
-        assert!(
-            warning.contains("unproven announce cannot change an existing peer"),
-            "must carry the node's own reason: {warning}"
-        );
-    }
-
-    /// A refusal with no message body still warns rather than passing silently.
-    #[test]
-    fn a_refusal_without_a_message_still_warns() {
-        let warning = local_add_refusal(StatusCode::BAD_REQUEST, &serde_json::Value::Null)
-            .expect("a refusal must not render as success");
-        assert!(warning.contains("400"), "must name the status: {warning}");
-    }
-
-    /// The accepted case stays quiet, so the success line still prints.
-    #[test]
-    fn an_accepted_local_add_produces_no_warning() {
-        assert!(local_add_refusal(StatusCode::OK, &json!({ "peer_count": 3 })).is_none());
-    }
-
-    /// The warning is printed straight to a terminal, so a node-supplied message
-    /// carrying an OSC title-rewrite plus a C0 escape must reach it defanged.
-    #[test]
-    fn a_refusal_message_cannot_carry_terminal_escapes() {
-        let warning = local_add_refusal(
-            StatusCode::FORBIDDEN,
-            &json!({ "message": "\u{1b}]2;pwned\u{7}legit-looking text" }),
-        )
-        .expect("a refusal must not render as success");
-
-        assert!(
-            !warning.chars().any(|c| c.is_control()),
-            "control char leaked to the terminal: {warning:?}"
-        );
-        assert!(
-            warning.contains("legit-looking text"),
-            "printable text dropped: {warning:?}"
-        );
-    }
-
-    /// Bidi format chars are not `char::is_control`, yet they reorder the
-    /// displayed line, so a refusal must not carry them either.
-    #[test]
-    fn a_refusal_message_cannot_carry_bidi_overrides() {
-        let warning = local_add_refusal(
-            StatusCode::FORBIDDEN,
-            &json!({ "message": "peer \u{202e}refused\u{202c} here" }),
-        )
-        .expect("a refusal must not render as success");
-
-        assert!(
-            !warning.chars().any(gitlawb_core::sanitize::is_bidi_format),
-            "bidi format char leaked to the terminal: {warning:?}"
-        );
-    }
-
-    /// A hostile node must not be able to dump an arbitrary amount of text into
-    /// the user's scrollback through the warning line.
-    #[test]
-    fn a_refusal_message_is_length_bounded() {
-        let warning = local_add_refusal(
-            StatusCode::FORBIDDEN,
-            &json!({ "message": "x".repeat(5000) }),
-        )
-        .expect("a refusal must not render as success");
-
-        assert!(
-            warning.chars().count() < 500,
-            "warning not bounded: {} chars",
-            warning.chars().count()
-        );
-    }
-
-    /// The status is the part the user can act on, so it must survive a body
-    /// that does not parse. The read is capped, so a peer answering past the cap
-    /// leaves exactly this: a valid status and truncated JSON.
-    #[test]
-    fn a_remote_announce_failure_keeps_the_status_when_the_body_does_not_parse() {
-        let truncated = r#"{"error":"service_unavailable","message":"backend is do"#;
-        let failure = remote_announce_failure(StatusCode::SERVICE_UNAVAILABLE, truncated)
-            .expect("a non-success status must produce a failure");
-
-        assert!(
-            failure.contains("503"),
-            "the status must survive an unparseable body: {failure:?}"
-        );
-    }
-
-    /// A parseable error body still reports the peer's own message.
-    #[test]
-    fn a_remote_announce_failure_carries_the_peers_message() {
-        let failure = remote_announce_failure(
-            StatusCode::FORBIDDEN,
-            r#"{"error":"forbidden","message":"unproven announce cannot change an existing peer"}"#,
-        )
-        .expect("a non-success status must produce a failure");
-
-        assert!(
-            failure.contains("403")
-                && failure.contains("unproven announce cannot change an existing peer"),
-            "status and reason must both survive: {failure:?}"
-        );
-    }
-
-    /// The fallback path prints the raw body, so it is defanged like every other
-    /// peer-supplied string headed for the terminal.
-    #[test]
-    fn a_remote_announce_failure_defangs_an_unparseable_body() {
-        let failure = remote_announce_failure(
-            StatusCode::BAD_GATEWAY,
-            "\u{1b}]2;pwned\u{7}<html>gateway error</html>",
-        )
-        .expect("a non-success status must produce a failure");
-
-        assert!(
-            !failure.chars().any(|c| c.is_control()),
-            "control char leaked to the terminal: {failure:?}"
-        );
-        assert!(failure.contains("502"), "status dropped: {failure:?}");
-        assert!(
-            failure.contains("gateway error"),
-            "the body is all the user gets when there is no message field: {failure:?}"
-        );
-    }
-
-    /// The unit tests above bind the helper. This one binds the CALL SITE: the
-    /// failure check has to run before the parse, or a body past the read cap
-    /// turns a 503 into "invalid JSON response" and the status the user needs is
-    /// gone. Reordering the two statements in `cmd_add` compiles and passes every
-    /// other test in this file, so only driving the command catches it.
-    #[tokio::test]
-    async fn a_peer_failure_past_the_read_cap_still_reports_its_status() {
-        let mut peer = mockito::Server::new_async().await;
-        let mut local = mockito::Server::new_async().await;
-
-        let dir = tempfile::TempDir::new().unwrap();
-        let kp = gitlawb_core::identity::Keypair::generate();
-        std::fs::write(
-            dir.path().join("identity.pem"),
-            kp.to_pem().unwrap().as_bytes(),
-        )
-        .unwrap();
-
-        let _local_info = local
-            .mock("GET", "/")
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"public_url":"https://me.example"}"#)
-            .create_async()
-            .await;
-
-        // Valid JSON, but past the 8 KiB read cap, so what survives the read is
-        // truncated and unparseable. This is the shape the cap itself creates.
-        let oversized = format!(r#"{{"message":"{}"}}"#, "x".repeat(16 * 1024));
-        let _peer_refusal = peer
-            .mock("POST", "/api/v1/peers/announce")
-            .with_status(503)
-            .with_header("content-type", "application/json")
-            .with_body(oversized)
-            .create_async()
-            .await;
-
-        let err = cmd_add(peer.url(), local.url(), Some(dir.path().to_path_buf()))
-            .await
-            .expect_err("a 503 from the peer must fail the command");
-
-        let rendered = format!("{err:#}");
-        assert!(
-            rendered.contains("503"),
-            "the status must survive a body past the read cap: {rendered:?}"
-        );
-        assert!(
-            !rendered.contains("invalid JSON response"),
-            "the parse failure must not stand in for the status: {rendered:?}"
-        );
-    }
-
-    /// An accepted announce produces no error, so the caller proceeds to parse.
-    #[test]
-    fn an_accepted_remote_announce_produces_no_failure() {
-        assert!(remote_announce_failure(StatusCode::OK, r#"{"peer_count":3}"#).is_none());
-    }
-
-    /// The selection, not the helper. A refusal must never yield the success
-    /// line, and the success line must never carry the warning prefix. This is
-    /// what stayed green when the entire match was replaced with an
-    /// unconditional "Added to local peer list."
-    #[test]
-    fn a_local_add_refusal_never_selects_the_success_line() {
-        let (is_warning, line) = local_add_report(
-            StatusCode::FORBIDDEN,
-            &json!({ "message": "unproven announce cannot change an existing peer's http_url: did:key:zAbc" }),
-        );
-
-        assert!(is_warning, "a 403 must select the warning stream: {line:?}");
-        assert!(
-            !line.contains("Added to local peer list"),
-            "a refusal rendered as the success line: {line:?}"
-        );
-        assert!(
-            line.contains("unproven announce cannot change an existing peer"),
-            "the node's reason must reach the user: {line:?}"
-        );
-    }
-
-    /// The other direction, so the fix cannot be satisfied by always warning.
-    #[test]
-    fn an_accepted_local_add_selects_the_success_line() {
-        let (is_warning, line) = local_add_report(StatusCode::OK, &json!({ "peer_count": 3 }));
-
-        assert!(!is_warning, "a 200 must not select the warning stream");
-        assert!(
-            line.contains("Added to local peer list"),
-            "the success line must still print: {line:?}"
-        );
-    }
-
-    /// The accepted-announce block prints the remote peer's own DID and URL, so
-    /// a hostile peer answering 200 must not get escapes onto the terminal that
-    /// way either. The refusal path is not the only sink in this command.
-    #[test]
-    fn an_accepted_announce_summary_cannot_carry_terminal_escapes() {
-        let summary = announced_peer_summary(
-            "did:key:z6Mk\u{1b}]2;pwned\u{7}abc",
-            "https://peer.example\u{202e}moc.live//:sptth",
-            3,
-        );
-
-        assert!(
-            !summary.chars().any(|c| c.is_control() && c != '\n'),
-            "control char leaked to the terminal: {summary:?}"
-        );
-        assert!(
-            !summary.chars().any(gitlawb_core::sanitize::is_bidi_format),
-            "bidi format char leaked to the terminal: {summary:?}"
-        );
-        assert!(
-            summary.contains("did:key:z6Mk") && summary.contains("Their peers: 3"),
-            "printable content dropped: {summary:?}"
-        );
-    }
-
-    /// The counterweight to the stripping tests: a legitimate message with RTL
-    /// script letters and a ZWJ must survive intact, so the sanitizer is not
-    /// proven by over-stripping.
-    #[test]
-    fn a_legitimate_refusal_message_survives_intact() {
-        let warning = local_add_refusal(
-            StatusCode::FORBIDDEN,
-            &json!({ "message": "peer refused \u{0627}\u{200D}b" }),
-        )
-        .expect("a refusal must not render as success");
-
-        assert!(
-            warning.contains("peer refused \u{0627}\u{200D}b"),
-            "legitimate text mangled: {warning:?}"
-        );
-    }
-}

crates/gl/src/protect.rs

@@ -154,12 +154,10 @@ async fn cmd_remove(
 
 async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()> {
     let (owner, name) = resolve_owner_repo(&repo, &node, dir.as_deref()).await?;
-    // Read-visibility-gated on the node: public repos list anonymously, private
-    // repos need the owner's signature. Sign when an identity is available.
-    let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
+    let client = NodeClient::new(&node, None);
 
     let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/branches/protected"))
+        .get(&format!("/api/v1/repos/{owner}/{name}/branches/protected"))
         .await
         .context("failed to connect to node")?;
 
@@ -309,9 +307,6 @@ mod tests {
                 "GET",
                 mockito::Matcher::Regex(r"branches/protected".to_string()),
             )
-            // An identity is supplied, so get_maybe_signed must sign the request.
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"protected_branches":[],"count":0}"#)
@@ -343,8 +338,6 @@ mod tests {
                 "GET",
                 mockito::Matcher::Regex(r"branches/protected".to_string()),
             )
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"protected_branches":["main","release"],"count":2}"#)

crates/gl/src/repo.rs

@@ -146,8 +146,6 @@ pub enum RepoCmd {
         repo: String,
         #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
-        #[arg(long)]
-        dir: Option<PathBuf>,
     },
 }
 
@@ -205,7 +203,7 @@ pub async fn run(args: RepoArgs) -> Result<()> {
         RepoCmd::ReplicaUnregister { repo, node, dir } => {
             cmd_replica_unregister(repo, node, dir).await
         }
-        RepoCmd::Replicas { repo, node, dir } => cmd_replicas(repo, node, dir).await,
+        RepoCmd::Replicas { repo, node } => cmd_replicas(repo, node).await,
     }
 }
 
@@ -331,10 +329,7 @@ async fn cmd_clone(name: String, node: String, dir: Option<PathBuf>) -> Result<(
 }
 
 async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()> {
-    // Sign when an identity is available so the read-visibility-gated replica
-    // sub-fetch below resolves for a private repo's owner (public repos still
-    // work anonymously).
-    let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
+    let client = NodeClient::new(&node, None);
 
     let (owner, name) = if repo.contains('/') {
         let (o, n) = repo.split_once('/').unwrap();
@@ -344,10 +339,7 @@ async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
         (short, repo)
     };
 
-    let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}"))
-        .await
-        .context("failed to connect to node")?;
+    let resp = client.get(&format!("/api/v1/repos/{owner}/{name}")).await?;
     // A non-existent (or unreadable/quarantined) repo is a real 404 from the
     // node — surface it plainly instead of printing a stub card with `?` fields
     // and a placeholder owner DID.
@@ -387,7 +379,7 @@ async fn cmd_info(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
     // Replica count — failure to fetch is non-fatal (older nodes don't expose this).
     if let Ok(resp) = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/replicas"))
+        .get(&format!("/api/v1/repos/{owner}/{name}/replicas"))
         .await
     {
         if resp.status().is_success() {
@@ -467,17 +459,15 @@ async fn cmd_replica_unregister(repo: String, node: String, dir: Option<PathBuf>
     Ok(())
 }
 
-async fn cmd_replicas(repo: String, node: String, dir: Option<PathBuf>) -> Result<()> {
+async fn cmd_replicas(repo: String, node: String) -> Result<()> {
     let (owner, name) = repo
         .split_once('/')
         .map(|(o, n)| (o.to_string(), n.to_string()))
         .context("use owner/repo format")?;
 
-    // Read-visibility-gated: public repos list anonymously, private repos need
-    // the owner's signature. Sign when an identity is available.
-    let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
+    let client = NodeClient::new(&node, None);
     let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/replicas"))
+        .get(&format!("/api/v1/repos/{owner}/{name}/replicas"))
         .await
         .context("failed to connect to node")?;
     let status = resp.status();
@@ -595,7 +585,7 @@ async fn cmd_fork(
 }
 
 /// Returns (owner, repo_name) — if repo contains '/', splits on it; otherwise uses caller's DID.
-pub(crate) async fn resolve_owner_repo_pair(
+async fn resolve_owner_repo_pair(
     repo: &str,
     node: &str,
     dir: Option<&std::path::Path>,
@@ -668,23 +658,16 @@ async fn cmd_label_remove(
 
 async fn cmd_label_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()> {
     let (owner, name) = resolve_owner_repo_pair(&repo, &node, dir.as_deref()).await?;
-    // Read-visibility-gated like the sibling read surfaces (replicas, protected
-    // branches): sign when an identity is available so a private-repo owner can
-    // read their own labels, while public repos stay anonymously listable.
     let client = NodeClient::new(&node, load_keypair_from_dir(dir.as_deref()).ok());
 
-    let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/labels"))
+    let resp: Value = client
+        .get_authed(&format!("/api/v1/repos/{owner}/{name}/labels"))
+        .await?
+        .json()
         .await
-        .context("failed to connect to node")?;
-    let status = resp.status();
-    let body: Value = resp.json().await.unwrap_or_default();
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list labels failed ({status}): {msg}");
-    }
+        .context("invalid JSON")?;
 
-    let labels = body["labels"].as_array().cloned().unwrap_or_default();
+    let labels = resp["labels"].as_array().cloned().unwrap_or_default();
     if labels.is_empty() {
         println!("No labels on {owner}/{name}");
     } else {
@@ -696,39 +679,17 @@ async fn cmd_label_list(repo: String, node: String, dir: Option<PathBuf>) -> Res
     Ok(())
 }
 
-/// Parse the protected-branch list from the node's `GET /branches/protected`
-/// response. The endpoint returns `{"protected_branches": [...], "count": N}`
-/// (see `crates/gitlawb-node/src/api/protect.rs`); each entry may be a plain
-/// branch-name string or an object carrying a `name` field.
-fn parse_protected_branches(val: &Value) -> Vec<String> {
-    val["protected_branches"]
-        .as_array()
-        .map(|arr| {
-            arr.iter()
-                .filter_map(|b| {
-                    b.as_str()
-                        .map(String::from)
-                        .or_else(|| b["name"].as_str().map(String::from))
-                })
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
 async fn cmd_owner(repo: String, node: String, dir: Option<PathBuf>, json_out: bool) -> Result<()> {
     let keypair = load_keypair_from_dir(dir.as_deref())?;
     let my_did = keypair.did().to_string();
     let my_short = my_did.split(':').next_back().unwrap_or(&my_did).to_string();
 
     let (owner, name) = resolve_owner_repo_pair(&repo, &node, dir.as_deref()).await?;
-    // Sign with the loaded identity so the read-visibility-gated protected-branch
-    // fetch below works on the owner's own private repos.
-    let client = NodeClient::new(&node, Some(keypair));
+    let client = NodeClient::new(&node, None);
 
-    // Fetch repo info (get_repo is read-visibility-gated; sign so the owner can
-    // inspect their own private repo).
+    // Fetch repo info
     let resp = client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}"))
+        .get(&format!("/api/v1/repos/{owner}/{name}"))
         .await
         .context("failed to connect to node")?;
     if !resp.status().is_success() {
@@ -743,14 +704,25 @@ async fn cmd_owner(repo: String, node: String, dir: Option<PathBuf>, json_out: b
         .to_string();
     let is_owner = my_did == owner_did || my_short == owner_short;
 
-    // Fetch protected branches (read-visibility-gated; signed via the client).
+    // Fetch protected branches
     let protected: Vec<String> = match client
-        .get_maybe_signed(&format!("/api/v1/repos/{owner}/{name}/branches/protected"))
+        .get(&format!("/api/v1/repos/{owner}/{name}/branches/protected"))
         .await
     {
         Ok(resp) if resp.status().is_success() => {
             let val: Value = resp.json().await.unwrap_or_default();
-            parse_protected_branches(&val)
+            val.as_array()
+                .or_else(|| val["branches"].as_array())
+                .map(|arr| {
+                    arr.iter()
+                        .filter_map(|b| {
+                            b.as_str()
+                                .map(String::from)
+                                .or_else(|| b["name"].as_str().map(String::from))
+                        })
+                        .collect()
+                })
+                .unwrap_or_default()
         }
         _ => Vec::new(),
     };
@@ -788,20 +760,6 @@ mod tests {
     use super::*;
     use tempfile::TempDir;
 
-    #[test]
-    fn parse_protected_branches_reads_node_shape() {
-        use serde_json::json;
-        assert_eq!(
-            parse_protected_branches(&json!({"protected_branches":["main","release"],"count":2})),
-            vec!["main".to_string(), "release".to_string()]
-        );
-        assert!(parse_protected_branches(&json!({"count":0})).is_empty());
-        assert_eq!(
-            parse_protected_branches(&json!({"protected_branches":[{"name":"main"}]})),
-            vec!["main".to_string()]
-        );
-    }
-
     fn write_identity(dir: &TempDir) {
         let kp = gitlawb_core::identity::Keypair::generate();
         let pem = kp.to_pem().unwrap();
@@ -1139,10 +1097,6 @@ mod tests {
                 "GET",
                 mockito::Matcher::Regex(r"^/api/v1/repos/[^/]+/myrepo/labels$".to_string()),
             )
-            // Identity is loaded, so get_maybe_signed must sign — requiring the
-            // header guards against a regression back to bare get().
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"labels":[]}"#)
@@ -1169,10 +1123,6 @@ mod tests {
                 "GET",
                 mockito::Matcher::Regex(r"^/api/v1/repos/[^/]+/myrepo/labels$".to_string()),
             )
-            // Identity is loaded, so get_maybe_signed must sign — requiring the
-            // header guards against a regression back to bare get().
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"labels":["language:rust","topic:defi"]}"#)
@@ -1188,97 +1138,6 @@ mod tests {
         .unwrap();
     }
 
-    #[tokio::test]
-    async fn test_cmd_label_list_anonymous_when_no_identity() {
-        // Empty dir → no identity → get_maybe_signed must fall back to an
-        // anonymous GET (the public-repo path). Assert NO signature header.
-        let dir = TempDir::new().unwrap();
-
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/labels$".to_string()))
-            .match_header("signature", mockito::Matcher::Missing)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"labels":[]}"#)
-            .create_async()
-            .await;
-
-        cmd_label_list(
-            "owner/pubrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_cmd_label_list_404_errors() {
-        // A non-reader of a private repo gets 404 from the now-gated endpoint.
-        // The client must surface that as an error, not print "No labels" and
-        // exit 0 (the error body has no `labels` key).
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/[^/]+/myrepo/labels$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repo not found"}"#)
-            .create_async()
-            .await;
-
-        let err = cmd_label_list(
-            "myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(
-            err.to_string().contains("list labels failed (404")
-                && err.to_string().contains("repo not found"),
-            "got: {err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_cmd_label_list_non_json_error_surfaces_status() {
-        // A non-2xx response with a non-JSON body (e.g. a proxy 502) must still
-        // surface the HTTP status, not collapse to a bare JSON-parse error.
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/[^/]+/myrepo/labels$".to_string()),
-            )
-            .with_status(502)
-            .with_header("content-type", "text/html")
-            .with_body("<html>502 Bad Gateway</html>")
-            .create_async()
-            .await;
-
-        let err = cmd_label_list(
-            "myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(
-            err.to_string().contains("list labels failed (502"),
-            "got: {err}"
-        );
-    }
-
     #[tokio::test]
     async fn test_cmd_owner_is_owner() {
         let dir = TempDir::new().unwrap();
@@ -1289,15 +1148,11 @@ mod tests {
         let short = did.split(':').next_back().unwrap().to_string();
 
         let mut server = mockito::Server::new_async().await;
-        // Both fetches are read-visibility-gated; with an identity loaded they
-        // must be signed. Requiring the header guards a regression to get().
         let _repo = server
             .mock(
                 "GET",
                 mockito::Matcher::Regex(format!(r"^/api/v1/repos/{short}/myrepo$")),
             )
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(format!(
@@ -1312,11 +1167,9 @@ mod tests {
                     r"^/api/v1/repos/{short}/myrepo/branches/protected$"
                 )),
             )
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
-            .with_body(r#"{"protected_branches":["main"],"count":1}"#)
+            .with_body(r#"["main"]"#)
             .create_async()
             .await;
 
@@ -1357,7 +1210,7 @@ mod tests {
             )
             .with_status(200)
             .with_header("content-type", "application/json")
-            .with_body(r#"{"protected_branches":["main","release"],"count":2}"#)
+            .with_body(r#"["main","release"]"#)
             .create_async()
             .await;
 
@@ -1398,7 +1251,7 @@ mod tests {
             )
             .with_status(200)
             .with_header("content-type", "application/json")
-            .with_body(r#"{"protected_branches":["main"],"count":1}"#)
+            .with_body(r#"["main"]"#)
             .create_async()
             .await;
 
@@ -1439,254 +1292,4 @@ mod tests {
         .unwrap_err();
         assert!(err.to_string().contains("not found"), "got: {err}");
     }
-
-    #[tokio::test]
-    async fn test_cmd_replicas_signs_when_identity_present() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        // Read-visibility-gated: with an identity the request must be signed.
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/replicas$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"repo":"owner/myrepo","replica_count":0,"replicas":[]}"#)
-            .create_async()
-            .await;
-
-        cmd_replicas(
-            "owner/myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_cmd_replicas_anonymous_when_no_identity() {
-        // Empty dir → no identity → get_maybe_signed must fall back to an
-        // anonymous GET (the public-repo path). Assert NO signature header.
-        let dir = TempDir::new().unwrap();
-
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/replicas$".to_string()))
-            .match_header("signature", mockito::Matcher::Missing)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"repo":"owner/pubrepo","replica_count":0,"replicas":[]}"#)
-            .create_async()
-            .await;
-
-        cmd_replicas(
-            "owner/pubrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_cmd_info_signs_repo_and_replica_fetches() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        // Both the primary repo fetch and the replica sub-fetch are
-        // read-visibility-gated; with an identity loaded both must be signed.
-        let _repo = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/owner/myrepo$".to_string()),
-            )
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(
-                r#"{"id":"r1","name":"myrepo","owner_did":"did:key:zOwner","is_public":false,"default_branch":"main"}"#,
-            )
-            .create_async()
-            .await;
-        let _replicas = server
-            .mock("GET", mockito::Matcher::Regex(r"/replicas$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"replica_count":0,"replicas":[]}"#)
-            .create_async()
-            .await;
-
-        cmd_info(
-            "owner/myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_cmd_info_404_surfaces_error_not_fake_repo() {
-        // A non-reader of a private repo gets a JSON 404 from the now-gated
-        // GET /api/v1/repos/{owner}/{name}. The command must surface that as an
-        // error, not parse the error body and print a fabricated repo summary
-        // (owner / "?" / public=true / main) before exiting 0.
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        let _repo = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/owner/myrepo$".to_string()),
-            )
-            .with_status(404)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"repo not found"}"#)
-            .create_async()
-            .await;
-
-        let err = cmd_info(
-            "owner/myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        // The merged cmd_info maps a 404 to a generic "not found" (it does not
-        // echo the server's message body on 404), which still surfaces the error
-        // rather than fabricating a repo card, and avoids leaking any
-        // server-provided detail on a private-repo denial.
-        assert!(
-            err.to_string()
-                .contains("repository 'owner/myrepo' not found"),
-            "got: {err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_cmd_info_non_json_error_surfaces_status() {
-        // A non-2xx response with a non-JSON body (e.g. a proxy 502) must still
-        // surface the HTTP status, not collapse to a bare JSON-parse error.
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-
-        let mut server = mockito::Server::new_async().await;
-        let _repo = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/owner/myrepo$".to_string()),
-            )
-            .with_status(502)
-            .with_header("content-type", "text/html")
-            .with_body("<html>502 Bad Gateway</html>")
-            .create_async()
-            .await;
-
-        let err = cmd_info(
-            "owner/myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(
-            err.to_string().contains("repo info failed (502"),
-            "got: {err}"
-        );
-    }
-}
-
-// Drives the three deny/negative arms that the merge reconciliation changed but
-// that no existing test executed (they were only reasoned): resolve_owner_did
-// with no identity, cmd_info on an authenticated-but-denied 403, and
-// get_maybe_signed with no keypair. Each asserts the must-not case.
-#[cfg(test)]
-mod vet_merge_deny_arms {
-    use super::*;
-    use tempfile::TempDir;
-
-    fn write_identity(dir: &TempDir) {
-        let kp = gitlawb_core::identity::Keypair::generate();
-        let pem = kp.to_pem().unwrap();
-        std::fs::write(dir.path().join("identity.pem"), pem.as_bytes()).unwrap();
-    }
-
-    // No local identity must hard-error, never fall back to the node's own DID.
-    // (Load-bearing: #113's pre-merge resolve_owner_did returned Ok via a node
-    // fetch here; a reintroduced fallback makes this go red.)
-    #[tokio::test]
-    async fn resolve_owner_did_no_identity_errors_not_fallback() {
-        let empty = TempDir::new().unwrap(); // no identity.pem written
-        let err = resolve_owner_did("http://unused.invalid", Some(empty.path()))
-            .await
-            .unwrap_err();
-        assert!(
-            err.to_string()
-                .contains("no local identity to resolve the repo owner"),
-            "got: {err}"
-        );
-    }
-
-    // An authenticated caller DENIED with a 403 must surface an error, never
-    // render a repo card (deny-as-success is the INV-8 client-contract break).
-    #[tokio::test]
-    async fn cmd_info_403_denied_surfaces_error_not_card() {
-        let dir = TempDir::new().unwrap();
-        write_identity(&dir);
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"^/api/v1/repos/owner/myrepo$".to_string()),
-            )
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"forbidden"}"#)
-            .create_async()
-            .await;
-        let err = cmd_info(
-            "owner/myrepo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(
-            err.to_string().contains("repo info failed (403"),
-            "got: {err}"
-        );
-    }
-
-    // No keypair must send an unsigned GET; the mock only matches when the
-    // Signature header is absent, so a wrongly-signed request fails to match.
-    #[tokio::test]
-    async fn get_maybe_signed_no_keypair_sends_unsigned() {
-        let mut server = mockito::Server::new_async().await;
-        let _m = server
-            .mock("GET", "/api/v1/repos/owner/pub")
-            .match_header("signature", mockito::Matcher::Missing)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body("{}")
-            .create_async()
-            .await;
-        let client = NodeClient::new(server.url(), None);
-        let resp = client
-            .get_maybe_signed("/api/v1/repos/owner/pub")
-            .await
-            .unwrap();
-        assert!(
-            resp.status().is_success(),
-            "unsigned GET should match the Missing-signature mock; got {}",
-            resp.status()
-        );
-    }
 }

crates/gl/src/status.rs

@@ -59,7 +59,7 @@ pub async fn run(args: StatusArgs) -> Result<()> {
             println!("  repo      {short_did}/{repo}");
         }
         None => {
-            println!("  repo      (not in a gitlawb repo — no gitlawb:// remote)");
+            println!("  repo      (not in a gitlawb repo — no gitlawb:// origin)");
         }
     }
 
@@ -143,68 +143,29 @@ fn trust_bar(score: f64) -> String {
     format!("{}{}", "█".repeat(filled), "░".repeat(empty))
 }
 
-/// Find a `gitlawb://<did>/<repo>` remote in the current repo.
-///
-/// Checks `origin` first (clones), then `gitlawb` (the name `gl init` adds),
-/// then any other remote with a gitlawb:// URL.
+/// Parse `gitlawb://<did>/<repo>` from the git origin remote.
 fn detect_gitlawb_remote() -> Option<(String, String)> {
     let out = std::process::Command::new("git")
-        .args(["remote"])
+        .args(["remote", "get-url", "origin"])
         .stderr(std::process::Stdio::null())
         .output()
         .ok()?;
     if !out.status.success() {
         return None;
     }
-    let names: Vec<String> = String::from_utf8(out.stdout)
-        .ok()?
-        .lines()
-        .map(str::trim)
-        .filter(|l| !l.is_empty())
-        .map(str::to_string)
-        .collect();
-
-    let preferred = ["origin", "gitlawb"];
-    let ordered = preferred
-        .iter()
-        .filter(|p| names.iter().any(|n| n == *p))
-        .map(|p| p.to_string())
-        .chain(
-            names
-                .iter()
-                .filter(|n| !preferred.contains(&n.as_str()))
-                .cloned(),
-        );
-
-    for name in ordered {
-        // A remote can carry several URLs, and the gitlawb:// one may be a
-        // push URL behind an https fetch URL — check every fetch and push URL.
-        for extra in [&["--all"][..], &["--push", "--all"][..]] {
-            let mut args = vec!["remote", "get-url"];
-            args.extend_from_slice(extra);
-            args.push(&name);
-            let Ok(out) = std::process::Command::new("git")
-                .args(&args)
-                .stderr(std::process::Stdio::null())
-                .output()
-            else {
-                continue;
-            };
-            if !out.status.success() {
-                continue;
-            }
-            let Ok(urls) = String::from_utf8(out.stdout) else {
-                continue;
-            };
-            if let Some(parsed) = urls.lines().find_map(parse_gitlawb_url) {
-                return Some(parsed);
-            }
-        }
+    let url = String::from_utf8(out.stdout).ok()?;
+    let rest = url.trim().strip_prefix("gitlawb://")?;
+    let slash = rest.rfind('/')?;
+    let did = rest[..slash].to_string();
+    let repo = rest[slash + 1..].to_string();
+    if did.is_empty() || repo.is_empty() {
+        return None;
     }
-    None
+    Some((did, repo))
 }
 
-/// Parse a gitlawb:// URL string into (did, repo).
+/// Parse a gitlawb:// URL string into (did, repo) — extracted for testing.
+#[cfg(test)]
 fn parse_gitlawb_url(url: &str) -> Option<(String, String)> {
     let rest = url.trim().strip_prefix("gitlawb://")?;
     let slash = rest.rfind('/')?;

crates/gl/src/sync.rs

@@ -2,7 +2,7 @@ use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
 use std::path::PathBuf;
 
-use crate::http::{read_body_capped, sanitize_node_msg, NodeClient};
+use crate::http::NodeClient;
 use crate::identity::load_keypair_from_dir;
 
 #[derive(Args)]
@@ -104,6 +104,51 @@ fn trigger_counts(resp: &serde_json::Value) -> (u64, u64) {
     )
 }
 
+/// Read at most `cap` bytes of a response body. Bounds the allocation from a
+/// hostile or broken node returning a huge error body — the display is capped
+/// separately, but the read itself must not be unbounded (INV-6, read half).
+async fn read_body_capped(mut resp: reqwest::Response, cap: usize) -> String {
+    let mut buf: Vec<u8> = Vec::new();
+    while buf.len() < cap {
+        match resp.chunk().await {
+            Ok(Some(chunk)) => {
+                let take = (cap - buf.len()).min(chunk.len());
+                buf.extend_from_slice(&chunk[..take]);
+                if take < chunk.len() {
+                    break; // hit the cap mid-chunk
+                }
+            }
+            _ => break, // end of body or read error — return what we have
+        }
+    }
+    String::from_utf8_lossy(&buf).into_owned()
+}
+
+/// Strip terminal-dangerous characters from (and cap the length of) a
+/// node-supplied error string before surfacing it. The node a caller talks to
+/// could be hostile and embed escape sequences in its error body; those must not
+/// reach the terminal verbatim (INV-6). We drop the C0/C1 control bytes (which
+/// defangs ANSI/OSC escapes) AND the Unicode bidi/format controls (which
+/// `char::is_control` does not cover — they can reorder the displayed line).
+fn sanitize_node_msg(s: &str) -> String {
+    s.chars()
+        .filter(|c| !c.is_control() && !is_bidi_format(*c))
+        .take(200)
+        .collect()
+}
+
+/// Unicode bidirectional and directional-isolate format characters (category
+/// `Cf`). These are not `char::is_control()` (that is category `Cc` only), but a
+/// right-to-left override or isolate can visually reorder a terminal line to
+/// spoof the error text, so they are stripped alongside the control bytes.
+fn is_bidi_format(c: char) -> bool {
+    matches!(c,
+        '\u{200E}' | '\u{200F}' | '\u{061C}'   // LRM, RLM, ALM
+        | '\u{202A}'..='\u{202E}'              // LRE, RLE, PDF, LRO, RLO
+        | '\u{2066}'..='\u{2069}'              // LRI, RLI, FSI, PDI
+    )
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -227,6 +272,27 @@ mod tests {
         run(args).await.unwrap();
     }
 
+    #[test]
+    fn sanitize_strips_controls_bidi_and_caps_length() {
+        // C0 (ESC/BEL) and the Cf bidi override (U+202E) are both removed; the
+        // printable text survives. (Note: a stripped ESC leaves any following
+        // "[31m" as inert literal text — that is the point, so the input here
+        // avoids that residue to keep the expectation unambiguous.)
+        let out = sanitize_node_msg("a\u{1b}\u{07}b\u{202e}c");
+        assert!(
+            !out.chars().any(|c| c.is_control()),
+            "control char leaked: {out:?}"
+        );
+        assert!(
+            !out.contains('\u{202e}'),
+            "RLO bidi override leaked: {out:?}"
+        );
+        assert_eq!(out, "abc");
+        // Length is capped at 200 chars regardless of input size.
+        let long = "x".repeat(250);
+        assert_eq!(sanitize_node_msg(&long).chars().count(), 200);
+    }
+
     #[tokio::test]
     async fn trigger_handles_oversized_error_body_without_unbounded_output() {
         // A hostile/broken node returns a 2 MB error body. The command must still

crates/gl/src/webhook.rs

@@ -42,8 +42,6 @@ pub enum WebhookCmd {
         repo: String,
         #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")]
         node: String,
-        #[arg(long)]
-        dir: Option<PathBuf>,
     },
     /// Delete a webhook
     Delete {
@@ -68,7 +66,7 @@ pub async fn run(args: WebhookArgs) -> Result<()> {
             node,
             dir,
         } => cmd_create(repo, url, events, secret, node, dir).await,
-        WebhookCmd::List { repo, node, dir } => cmd_list(repo, node, dir).await,
+        WebhookCmd::List { repo, node } => cmd_list(repo, node).await,
         WebhookCmd::Delete {
             repo,
             id,
@@ -78,6 +76,15 @@ pub async fn run(args: WebhookArgs) -> Result<()> {
     }
 }
 
+async fn resolve_owner(client: &NodeClient) -> Result<String> {
+    let info: Value = client.get("/").await?.json().await?;
+    let did = info["did"]
+        .as_str()
+        .context("node missing DID")?
+        .to_string();
+    Ok(did.split(':').next_back().unwrap_or(&did).to_string())
+}
+
 async fn cmd_create(
     repo: String,
     url: String,
@@ -87,8 +94,8 @@ async fn cmd_create(
     dir: Option<PathBuf>,
 ) -> Result<()> {
     let keypair = load_keypair_from_dir(dir.as_deref())?;
-    let (owner, name) = crate::repo::resolve_owner_repo_pair(&repo, &node, dir.as_deref()).await?;
     let client = NodeClient::new(&node, Some(keypair));
+    let owner = resolve_owner(&client).await?;
 
     let event_list: Vec<&str> = events.split(',').map(str::trim).collect();
 
@@ -99,7 +106,7 @@ async fn cmd_create(
     }))?;
 
     let resp = client
-        .post(&format!("/api/v1/repos/{owner}/{name}/hooks"), &payload)
+        .post(&format!("/api/v1/repos/{owner}/{repo}/hooks"), &payload)
         .await
         .context("failed to connect to node")?;
     let status = resp.status();
@@ -136,31 +143,18 @@ async fn cmd_create(
     Ok(())
 }
 
-async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()> {
-    // The node owner-gates GET /hooks (callback URLs are owner-secret), so the
-    // list request must be signed — anonymous callers get 401.
-    let keypair = load_keypair_from_dir(dir.as_deref())?;
-    let (owner, name) = crate::repo::resolve_owner_repo_pair(&repo, &node, dir.as_deref()).await?;
-    let client = NodeClient::new(&node, Some(keypair));
+async fn cmd_list(repo: String, node: String) -> Result<()> {
+    let client = NodeClient::new(&node, None);
+    let owner = resolve_owner(&client).await?;
 
-    // get_signed (not get) attaches the RFC 9421 signature — plain get() never
-    // signs, and the node owner-gates this route, so an unsigned GET 401s.
-    let resp = client
-        .get_signed(&format!("/api/v1/repos/{owner}/{name}/hooks"))
-        .await?;
-    let status = resp.status();
-    let body: Value = resp.json().await.context("invalid JSON")?;
+    let resp: Value = client
+        .get(&format!("/api/v1/repos/{owner}/{repo}/hooks"))
+        .await?
+        .json()
+        .await
+        .context("invalid JSON")?;
 
-    if !status.is_success() {
-        let msg = body["message"].as_str().unwrap_or("unknown error");
-        anyhow::bail!("list webhooks failed ({status}): {msg}");
-    }
-
-    let hooks = body
-        .get("webhooks")
-        .and_then(Value::as_array)
-        .cloned()
-        .context("node response missing webhooks array")?;
+    let hooks = resp["webhooks"].as_array().cloned().unwrap_or_default();
     if hooks.is_empty() {
         println!("No webhooks for {repo}");
         return Ok(());
@@ -191,13 +185,13 @@ async fn cmd_list(repo: String, node: String, dir: Option<PathBuf>) -> Result<()
 
 async fn cmd_delete(repo: String, id: String, node: String, dir: Option<PathBuf>) -> Result<()> {
     let keypair = load_keypair_from_dir(dir.as_deref())?;
-    let (owner, name) = crate::repo::resolve_owner_repo_pair(&repo, &node, dir.as_deref()).await?;
     let client = NodeClient::new(&node, Some(keypair));
+    let owner = resolve_owner(&client).await?;
 
     let payload = serde_json::to_vec(&serde_json::json!({}))?;
     let resp = client
         .delete(
-            &format!("/api/v1/repos/{owner}/{name}/hooks/{id}"),
+            &format!("/api/v1/repos/{owner}/{repo}/hooks/{id}"),
             &payload,
         )
         .await
@@ -343,170 +337,33 @@ mod tests {
     #[tokio::test]
     async fn test_list_webhooks_empty() {
         let mut server = mockito::Server::new_async().await;
-        let (dir, _kp) = tmp_identity();
         let _root = mock_root(&mut server).await;
 
         let _m = server
             .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            // The route is owner-gated, so the list request must be signed.
-            // Requiring the header here is what catches a regression to plain get().
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"webhooks":[]}"#)
             .create_async()
             .await;
 
-        cmd_list(
-            "my-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
+        cmd_list("my-repo".to_string(), server.url()).await.unwrap();
     }
 
     #[tokio::test]
     async fn test_list_webhooks_with_items() {
         let mut server = mockito::Server::new_async().await;
-        let (dir, _kp) = tmp_identity();
         let _root = mock_root(&mut server).await;
 
         let _m = server
             .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
             .with_status(200)
             .with_header("content-type", "application/json")
             .with_body(r#"{"webhooks":[{"id":"h1","url":"https://a.com","events":["push"],"active":true},{"id":"h2","url":"https://b.com","events":["*"],"active":false}]}"#)
             .create_async()
             .await;
 
-        cmd_list(
-            "my-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_list_owner_comes_from_keypair_not_node_did() {
-        // The owner segment must be derived from the caller's keypair (loaded
-        // from --dir), NOT the node root DID. mock_root returns a different DID;
-        // if the code regressed to using it, this path mock would not match.
-        let mut server = mockito::Server::new_async().await;
-        let (dir, kp) = tmp_identity();
-        let _root = mock_root(&mut server).await;
-
-        let did = kp.did().to_string();
-        let short = did.split(':').next_back().unwrap_or(&did).to_string();
-
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(format!(r"/api/v1/repos/{short}/my-repo/hooks$")),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"webhooks":[]}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        cmd_list(
-            "my-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_list_honors_owner_repo_arg() {
-        // An explicit `owner/repo` argument is split and used verbatim.
-        let mut server = mockito::Server::new_async().await;
-        let (dir, _kp) = tmp_identity();
-        let _root = mock_root(&mut server).await;
-
-        let _m = server
-            .mock(
-                "GET",
-                mockito::Matcher::Regex(r"/api/v1/repos/someoneelse/their-repo/hooks$".to_string()),
-            )
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"webhooks":[]}"#)
-            .expect(1)
-            .create_async()
-            .await;
-
-        cmd_list(
-            "someoneelse/their-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap();
-        _m.assert_async().await;
-    }
-
-    #[tokio::test]
-    async fn test_list_webhooks_non_success_status_errors() {
-        // A 403 (or any non-2xx) JSON body has no `webhooks` field; cmd_list must
-        // surface the failure, not print "No webhooks" and exit 0.
-        let mut server = mockito::Server::new_async().await;
-        let (dir, _kp) = tmp_identity();
-        let _root = mock_root(&mut server).await;
-
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            .with_status(403)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"message":"not the owner"}"#)
-            .create_async()
-            .await;
-
-        let err = cmd_list(
-            "my-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("not the owner"));
-    }
-
-    #[tokio::test]
-    async fn test_list_webhooks_2xx_missing_array_errors() {
-        // A 2xx body without a `webhooks` array signals a node/API contract
-        // regression. cmd_list must error rather than print "No webhooks".
-        let mut server = mockito::Server::new_async().await;
-        let (dir, _kp) = tmp_identity();
-        let _root = mock_root(&mut server).await;
-
-        let _m = server
-            .mock("GET", mockito::Matcher::Regex(r"/hooks$".to_string()))
-            .match_header("signature", mockito::Matcher::Any)
-            .match_header("signature-input", mockito::Matcher::Any)
-            .with_status(200)
-            .with_header("content-type", "application/json")
-            .with_body(r#"{"ok":true}"#)
-            .create_async()
-            .await;
-
-        let err = cmd_list(
-            "my-repo".to_string(),
-            server.url(),
-            Some(dir.path().to_path_buf()),
-        )
-        .await
-        .unwrap_err();
-        assert!(err.to_string().contains("missing webhooks array"));
+        cmd_list("my-repo".to_string(), server.url()).await.unwrap();
     }
 
     // ── delete ───────────────────────────────────────────────────────

crates/icaptcha-client/Cargo.toml

@@ -16,6 +16,3 @@ anyhow = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }
 sha2 = { workspace = true }
-
-[dev-dependencies]
-mockito = "1"

crates/icaptcha-client/src/lib.rs

@@ -64,12 +64,6 @@ fn sanitize_excerpt(s: &str) -> String {
             }
             continue;
         }
-        if gitlawb_core::sanitize::is_bidi_format(ch) {
-            // Drop Cf bidi/format controls (INV-6, #183) without setting
-            // pending_space: they are not whitespace, so stripping leaves no
-            // phantom gap.
-            continue;
-        }
         if ch.is_whitespace() {
             pending_space = true;
             continue;
@@ -427,34 +421,6 @@ mod tests {
         assert!(clean.contains("owned") && clean.contains("done"));
     }
 
-    #[test]
-    fn sanitize_strips_bidi_format_controls() {
-        // The Cc-only test above is vacuous for Cf: it passes whether or not bidi
-        // controls survive, which is why this gap shipped (#183). Here every Cf
-        // bidi class is stripped — override (RLO), embedding + pop (LRE/PDF),
-        // isolate (LRI/PDI), marks (LRM/ALM) — asserted per code point, and the
-        // visible words JOIN with no phantom space (a bidi char is dropped like a
-        // control byte, but unlike a newline/tab it is not whitespace). The leading
-        // bidi char (index 0) also exercises the empty-out path.
-        let out = sanitize_excerpt("\u{202e}err\u{202a}\u{202c}\u{2066}\u{2069}\u{200e}\u{061c}ok");
-        for c in [
-            '\u{202e}', '\u{202a}', '\u{202c}', '\u{2066}', '\u{2069}', '\u{200e}', '\u{061c}',
-        ] {
-            assert!(!out.contains(c), "bidi U+{:04X} leaked: {out:?}", c as u32);
-        }
-        assert_eq!(out, "errok");
-    }
-
-    #[test]
-    fn sanitize_preserves_legitimate_and_rtl_text() {
-        // Must not over-strip: plain text, a genuine RTL SCRIPT letter (Arabic
-        // U+0627, category Lo), and ZWJ (U+200D, a legitimate Cf char) survive.
-        assert_eq!(
-            sanitize_excerpt("ok \u{0627}\u{200D}b"),
-            "ok \u{0627}\u{200D}b"
-        );
-    }
-
     #[test]
     fn sanitize_collapses_whitespace_and_caps_length() {
         let collapsed = sanitize_excerpt("a\n\n\t  b");
@@ -463,18 +429,6 @@ mod tests {
         assert_eq!(sanitize_excerpt(&long).chars().count(), MAX_ERR_CHARS);
     }
 
-    #[test]
-    fn sanitize_bidi_chars_do_not_consume_the_length_cap() {
-        // A dropped bidi char must not count toward MAX_ERR_CHARS: it is dropped
-        // before `kept` increments, so interleaving bidi controls cannot truncate
-        // the visible output early. MAX_ERR_CHARS + 100 visible 'x', each trailed by
-        // a bidi override, must still yield exactly MAX_ERR_CHARS visible 'x' with
-        // no phantom spaces. (Would regress to fewer 'x' if bidi consumed budget, or
-        // to spaces if the drop branch wrongly set pending_space.)
-        let body = "x\u{202e}".repeat(MAX_ERR_CHARS + 100);
-        assert_eq!(sanitize_excerpt(&body), "x".repeat(MAX_ERR_CHARS));
-    }
-
     // ── P2: never talk to (or hand a key to) an untrusted node-chosen URL ──
 
     #[test]
@@ -550,215 +504,4 @@ mod tests {
         );
         assert!(key_trusted, "key stays trusted with operator origin");
     }
-
-    #[test]
-    fn new_withholds_key_from_untrusted_origin_but_attaches_for_operator() {
-        let guard = ICAPTCHA_ENV_LOCK.lock().unwrap();
-        let prev_key = std::env::var_os("GITLAWB_ICAPTCHA_API_KEY");
-        let prev_op = std::env::var_os("GITLAWB_ICAPTCHA_URL");
-        std::env::set_var("GITLAWB_ICAPTCHA_API_KEY", "secret-bearer");
-
-        // Arm 1: No operator configured, node advertises an attacker origin.
-        // The key has no trusted destination; the advert is rejected.
-        std::env::remove_var("GITLAWB_ICAPTCHA_URL");
-        let untrusted =
-            IcaptchaCfg::new("did:key:zTEST", Some("https://evil.example".into()), None);
-
-        // Arm 1b: No operator configured, no URL advertised. The fallback goes
-        // to the default public origin, and with no operator to trust, the key
-        // must not ride.
-        let no_operator_no_advert = IcaptchaCfg::new("did:key:zTEST", None, None);
-
-        // Arm 2: Operator origin configured and advertised — key attached.
-        std::env::set_var("GITLAWB_ICAPTCHA_URL", "https://icap.mynode.example");
-        let operator_match = IcaptchaCfg::new(
-            "did:key:zTEST",
-            Some("https://icap.mynode.example/v1".into()),
-            None,
-        );
-
-        // Arm 3: Operator configured, default host advertised. The default host
-        // is allowlisted and selected, but its origin differs from the
-        // operator's, so key must not ride.
-        let default_advert = IcaptchaCfg::new(
-            "did:key:zTEST",
-            Some("https://icaptcha.gitlawb.com/v2".into()),
-            None,
-        );
-
-        // Arm 4: Operator configured, no URL advertised (the node sent only
-        // x-icaptcha-level, not x-icaptcha-url). resolve_solver_url falls back
-        // to the operator origin and marks the key trusted. This is the common
-        // API-key deployment path — a regression that additionally required
-        // url.is_some() for key attachment would leave all current tests green
-        // but make these fallback challenge/answer requests omit Authorization
-        // and fail against the protected operator service.
-        let operator_fallback = IcaptchaCfg::new("did:key:zTEST", None, Some(3));
-
-        // Arm 5: Operator configured, node advertises an attacker origin.
-        // The advert is rejected and the solver falls back to the operator's
-        // own origin, which keeps the key trusted — this is the exfiltration
-        // scenario the test name describes (withhold key from *untrusted*
-        // origin, not from the operator's fallback).
-        let operator_hostile_advert =
-            IcaptchaCfg::new("did:key:zTEST", Some("https://evil.example".into()), None);
-
-        // Arm 6: Operator configured, same host but different port.
-        // origin_key includes the port, so :8443 must not match the
-        // operator origin at the default :443 — the advert is rejected
-        // and the solver falls back to the operator origin.
-        let operator_diff_port = IcaptchaCfg::new(
-            "did:key:zTEST",
-            Some("https://icap.mynode.example:8443/evil".into()),
-            None,
-        );
-
-        // Restore env and release the lock BEFORE asserting, so a failing
-        // assertion can't poison the shared lock or cascade into a sibling.
-        match prev_key {
-            Some(v) => std::env::set_var("GITLAWB_ICAPTCHA_API_KEY", v),
-            None => std::env::remove_var("GITLAWB_ICAPTCHA_API_KEY"),
-        }
-        match prev_op {
-            Some(v) => std::env::set_var("GITLAWB_ICAPTCHA_URL", v),
-            None => std::env::remove_var("GITLAWB_ICAPTCHA_URL"),
-        }
-        drop(guard);
-
-        let mut failures: Vec<String> = Vec::new();
-
-        if untrusted.api_key.is_some() {
-            failures.push(format!(
-                "arm 1 (no operator, attacker advert): expected api_key=None, got {:?}",
-                untrusted.api_key
-            ));
-        }
-        if untrusted.url != DEFAULT_URL {
-            failures.push(format!(
-                "arm 1 (no operator, attacker advert): expected url={DEFAULT_URL}, got {}",
-                untrusted.url
-            ));
-        }
-
-        if no_operator_no_advert.api_key.is_some() {
-            failures.push(format!(
-                "arm 1b (no operator, no advert): expected api_key=None, got {:?}",
-                no_operator_no_advert.api_key
-            ));
-        }
-        if no_operator_no_advert.url != DEFAULT_URL {
-            failures.push(format!(
-                "arm 1b (no operator, no advert): expected url={DEFAULT_URL}, got {}",
-                no_operator_no_advert.url
-            ));
-        }
-
-        if operator_match.api_key.as_deref() != Some("secret-bearer") {
-            failures.push(format!(
-                "arm 2 (operator match): expected api_key=Some(\"secret-bearer\"), got {:?}",
-                operator_match.api_key
-            ));
-        }
-        if operator_match.url != "https://icap.mynode.example/v1" {
-            failures.push(format!(
-                "arm 2 (operator match): expected url=https://icap.mynode.example/v1, got {}",
-                operator_match.url
-            ));
-        }
-
-        if default_advert.api_key.is_some() {
-            failures.push(format!(
-                "arm 3 (operator + default advert): expected api_key=None, got {:?}",
-                default_advert.api_key
-            ));
-        }
-        if default_advert.url != "https://icaptcha.gitlawb.com/v2" {
-            failures.push(format!(
-                "arm 3 (operator + default advert): expected url=https://icaptcha.gitlawb.com/v2, got {}",
-                default_advert.url
-            ));
-        }
-
-        if operator_fallback.api_key.as_deref() != Some("secret-bearer") {
-            failures.push(format!(
-                "arm 4 (operator fallback, no advert): expected api_key=Some(\"secret-bearer\"), got {:?}",
-                operator_fallback.api_key
-            ));
-        }
-        if operator_fallback.url != "https://icap.mynode.example" {
-            failures.push(format!(
-                "arm 4 (operator fallback, no advert): expected url=https://icap.mynode.example, got {}",
-                operator_fallback.url
-            ));
-        }
-
-        if operator_hostile_advert.api_key.as_deref() != Some("secret-bearer") {
-            failures.push(format!(
-                "arm 5 (operator + hostile advert): expected api_key=Some(\"secret-bearer\"), got {:?}",
-                operator_hostile_advert.api_key
-            ));
-        }
-        if operator_hostile_advert.url != "https://icap.mynode.example" {
-            failures.push(format!(
-                "arm 5 (operator + hostile advert): expected url=https://icap.mynode.example, got {}",
-                operator_hostile_advert.url
-            ));
-        }
-
-        if operator_diff_port.api_key.as_deref() != Some("secret-bearer") {
-            failures.push(format!(
-                "arm 6 (operator + different port advert): expected api_key=Some(\"secret-bearer\"), got {:?}",
-                operator_diff_port.api_key
-            ));
-        }
-        if operator_diff_port.url != "https://icap.mynode.example" {
-            failures.push(format!(
-                "arm 6 (operator + different port advert): expected url=https://icap.mynode.example, got {}",
-                operator_diff_port.url
-            ));
-        }
-
-        assert!(failures.is_empty(), "\n{}", failures.join("\n"));
-    }
-
-    #[test]
-    fn new_normalizes_empty_api_key_to_none_on_trusted_origin() {
-        let guard = ICAPTCHA_ENV_LOCK.lock().unwrap();
-        let prev_key = std::env::var_os("GITLAWB_ICAPTCHA_API_KEY");
-        let prev_op = std::env::var_os("GITLAWB_ICAPTCHA_URL");
-
-        // Operator origin configured and resolved as trusted (no advert), so
-        // api_key reaches the env read and the emptiness filter is the only
-        // thing standing between a blank var and an empty bearer token.
-        std::env::set_var("GITLAWB_ICAPTCHA_URL", "https://icap.mynode.example");
-
-        // "Operator set the var but left it blank" must stay keyless: a
-        // Some("") would attach `Authorization: Bearer ` (empty token) to the
-        // challenge and answer requests instead of omitting the header.
-        std::env::set_var("GITLAWB_ICAPTCHA_API_KEY", "");
-        let empty = IcaptchaCfg::new("did:key:zTEST", None, None);
-
-        // Contrast arm: a real key on the same trusted path must survive the
-        // filter, so the filter can't regress to dropping every key.
-        std::env::set_var("GITLAWB_ICAPTCHA_API_KEY", "secret-bearer");
-        let non_empty = IcaptchaCfg::new("did:key:zTEST", None, None);
-
-        // Restore env and release the lock BEFORE asserting, so a failing
-        // assertion can't poison the shared lock or cascade into a sibling.
-        match prev_key {
-            Some(v) => std::env::set_var("GITLAWB_ICAPTCHA_API_KEY", v),
-            None => std::env::remove_var("GITLAWB_ICAPTCHA_API_KEY"),
-        }
-        match prev_op {
-            Some(v) => std::env::set_var("GITLAWB_ICAPTCHA_URL", v),
-            None => std::env::remove_var("GITLAWB_ICAPTCHA_URL"),
-        }
-        drop(guard);
-
-        assert_eq!(
-            empty.api_key, None,
-            "empty GITLAWB_ICAPTCHA_API_KEY must normalize to None"
-        );
-        assert_eq!(non_empty.api_key.as_deref(), Some("secret-bearer"));
-    }
 }

crates/icaptcha-client/tests/icaptcha_blackhole_tripwire.rs

@@ -1,146 +0,0 @@
-//! Tripwire: a committed negative case that locks the blackhole mechanism.
-//!
-//! The guard against non-loopback egress works because `obtain_proof` builds a
-//! stock `reqwest::blocking::Client` that inherits the process's proxy env vars.
-//! If the builder later gains `.no_proxy()` or a custom connector, the guard
-//! disarms silently and every existing test stays green (no live call is made
-//! during the normal mock-consumed run because the mock is on loopback and
-//! `NO_PROXY` covers it — the blackhole isn't even exercised).
-//!
-//! This test asserts that a destination the blackhole's `NO_PROXY` does NOT
-//! cover fails *while the blackhole is armed*.  The destination is a local HTTP
-//! server on `[::1]` (IPv6 loopback), which `NO_PROXY` (`127.0.0.1, localhost`)
-//! does not list.  With the blackhole active the proxy intercepts the
-//! connection and blocks it; without the blackhole the request would reach the
-//! server directly and succeed, turning this test RED.
-//!
-//! A positive control (disarmed blackhole) runs first, proving the fixture is
-//! valid and `[::1]` is reachable.
-//!
-//! Design constraints (see issue #211):
-//!   - An unresolvable host would keep the request failing even when the guard
-//!     is disarmed (DNS failure masquerading as the blackhole), so we must use
-//!     a reachable address.
-//!   - A real external host would make a live network call the moment the guard
-//!     disarms, and on any runner that cannot reach that host the connect error
-//!     again masquerades as the blackhole.  A local loopback address avoids both
-//!     problems — it is always reachable when unblocked and never reaches the
-//!     real network.
-//!   - The address must NOT be covered by `NO_PROXY`, yet must exist on every
-//!     platform.  An arbitrary `127/8` alias is not portable: macOS only binds
-//!     `127.0.0.1` by default.  `[::1]` (IPv6 loopback) is present by default
-//!     on Linux, macOS, and Windows, and `NO_PROXY` only lists `127.0.0.1` and
-//!     `localhost`, so the blackhole still intercepts it.
-//!   - This depends on hyper-util's proxy matcher having no implicit loopback
-//!     bypass — a host is only proxied-around when literally listed in
-//!     `NO_PROXY` (verified in the pinned hyper-util; recheck on upgrade).
-
-use std::io::{Read, Write};
-use std::net::TcpListener;
-use std::thread;
-
-use icaptcha_client::{obtain_proof, Challenge, IcaptchaCfg};
-
-mod support;
-
-/// A minimal HTTP server that responds to iCaptcha challenge and answer
-/// requests on the IPv6 loopback address NOT covered by NO_PROXY.
-///
-/// When the blackhole is working, the proxy should intercept these requests
-/// and `obtain_proof` should fail.  When the blackhole is disarmed, the
-/// requests reach this server and the flow succeeds.
-fn serve_icaptcha(listener: TcpListener) {
-    thread::spawn(move || {
-        for stream in listener.incoming() {
-            let Ok(mut stream) = stream else { continue };
-            // Read until the first \n (end of request line) so TCP
-            // segmentation cannot split the path out of a single read.
-            let mut buf = [0u8; 4096];
-            let mut n = 0usize;
-            while n < buf.len() {
-                match stream.read(&mut buf[n..]) {
-                    Ok(0) | Err(_) => break,
-                    Ok(read) => {
-                        n += read;
-                        if buf[..n].contains(&b'\n') {
-                            break;
-                        }
-                    }
-                }
-            }
-            if n == 0 {
-                continue;
-            }
-            let request = String::from_utf8_lossy(&buf[..n]);
-            let body = if request.contains("/v1/answer") {
-                r#"{"status":"passed","proof":"PROOF-TRIP"}"#
-            } else {
-                r#"{"challengeId":"c1","type":"anagram","difficulty":1,"prompt":"listen","token":"tok-1"}"#
-            };
-            let response = format!(
-                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}",
-                body.len(),
-            );
-            let _ = stream.write_all(response.as_bytes());
-        }
-    });
-}
-
-fn make_cfg(url: &str) -> IcaptchaCfg {
-    IcaptchaCfg {
-        url: url.to_string(),
-        did: "did:key:zTEST".to_string(),
-        level: 1,
-        api_key: None,
-    }
-}
-
-#[test]
-fn obtain_proof_blackhole_tripwire() {
-    // Bind to [::1], IPv6 loopback, which NO_PROXY (127.0.0.1, localhost)
-    // does not cover.  Unlike an arbitrary 127/8 alias, IPv6 loopback is
-    // present by default on Linux, macOS, and Windows, so the fixture is
-    // portable across platforms.  Fail loudly if it cannot be bound: a
-    // silent skip would report this tripwire as green while exercising
-    // none of the negative control, recreating the very gap it exists to
-    // close.
-    let listener = TcpListener::bind(("::1", 0)).expect(
-        "cannot bind [::1] for the blackhole tripwire. IPv6 loopback (::1) \
-         is present by default on Linux, macOS, and Windows. This test fails \
-         rather than silently skipping so a platform without it cannot count \
-         the negative control as passed.",
-    );
-    let port = listener.local_addr().unwrap().port();
-    let url = format!("http://[::1]:{port}");
-    serve_icaptcha(listener);
-
-    // ── Positive control: disarmed blackhole → obtain_proof succeeds ──────
-    let _disarmed_guard = support::disarm_proxy_env();
-
-    let solve: &dyn Fn(&Challenge) -> Option<String> = &|_c| Some("silent".to_string());
-    let cfg = make_cfg(&url);
-    let proof = obtain_proof(&cfg, Some(solve))
-        .expect("positive control: obtain_proof should succeed when the proxy is disarmed");
-    assert_eq!(
-        proof, "PROOF-TRIP",
-        "positive control: unexpected proof value"
-    );
-    drop(_disarmed_guard);
-
-    // ── Negative control: armed blackhole → obtain_proof fails with connect error ──
-    let _armed_guard = support::arm_blackhole("http://127.0.0.1:1");
-
-    let result = obtain_proof(&cfg, Some(solve));
-
-    let err = result.expect_err(
-        "blackhole tripwire: obtain_proof succeeded against [::1], \
-         meaning the proxy blackhole did not intercept the request; \
-         the no-live-call guard is disarmed",
-    );
-    assert!(
-        err.chain().any(|c| c
-            .downcast_ref::<reqwest::Error>()
-            .is_some_and(|e| e.is_connect())),
-        "expected a connect/proxy error, got: {err:#}",
-    );
-}

crates/icaptcha-client/tests/icaptcha_mock_consumed.rs

@@ -1,199 +0,0 @@
-//! INV-19 guard: the icaptcha flow must actually call the service (consuming the
-//! mock), not short-circuit or make a live call. If a future change let
-//! `obtain_proof` skip the network (e.g. a stray `cfg(test)` relaxation, which
-//! INV-19/INV-20 warn is inert across crates), the `.assert()` calls below go
-//! RED because the mocked endpoints were never hit.
-//!
-//! The mock-consumed assertions alone only prove the mock was hit; they cannot
-//! see a request that ALSO leaks the DID / answer / API key to `DEFAULT_URL` or
-//! any other origin (a different host the mock never observes). To make the
-//! "no live call" half of the guard load-bearing, the test blackholes every
-//! non-loopback destination via a proxy observer: `NO_PROXY` lets the loopback
-//! mock through while every proxy variable routes any other host through a TCP
-//! listener that counts connections.  Zero observed connections proves no leak
-//! reached the network on the exercised path.
-//!
-//! The observer design counts every accepted connection regardless of whether
-//! the caller propagates the transport error, so it catches leaks that a
-//! closed-port blackhole (which only surfaces propagating errors) would miss.
-//! To close the timing race inherent in a detached accept loop, the count is
-//! read only after a bounded drain: the test opens a flush connection and
-//! blocks until the accept thread has accepted *that specific connection*
-//! (tagged by its source port), not merely until any next counter tick.
-//! Because `accept()` hands out connections FIFO, every leak connection that
-//! completed its TCP handshake before the flush is counted before the flush —
-//! the assertion therefore covers all egress in flight when `obtain_proof`
-//! returned.  A leak that starts its handshake after the drain is outside the
-//! window; that is the irreducible limit of observing a detached accept loop,
-//! and it is the remaining, well-defined gap this guard accepts.
-//!
-//! SCOPE: The observer only witnesses leaks issued on the path this test drives
-//! (a single passing round, 200 on both endpoints, no PoW, no Continue/Failed,
-//! no non-2xx response).  A leak living on an error or retry branch makes no
-//! connection during the run and the zero-count assertion stays green.  The
-//! guarantee covers only the exercised happy path and proxy-honoring transports;
-//! a future `.no_proxy()` or raw `TcpStream` bypasses the observer entirely.
-//!
-//! `ALL_PROXY` alone is NOT enough: reqwest honors the scheme-specific
-//! `HTTPS_PROXY` / `https_proxy` (and the http equivalents) OVER `ALL_PROXY`, so
-//! a runner with a working `HTTPS_PROXY` in its environment would route an https
-//! leak to `DEFAULT_URL` (which is https) through that proxy while the loopback
-//! mock is still consumed and this test stayed green.  So we blackhole the
-//! scheme-specific variables too.
-
-use std::net::{TcpListener, TcpStream};
-use std::sync::{Arc, Condvar, Mutex};
-
-use icaptcha_client::{obtain_proof, Challenge, IcaptchaCfg};
-
-mod support;
-
-/// A TCP listener that counts every accepted connection.
-///
-/// Acts as the proxy target: any leaked connection to a non-loopback
-/// destination will be routed through this listener and counted.  Every
-/// accepted connection is recorded by its source port so the test's own
-/// flush connection ([`ProxyObserver::drain`]) can be recognised and
-/// excluded from the leak count.
-struct ProxyObserver {
-    _listener: Arc<TcpListener>,
-    port: u16,
-    /// Source ports of every accepted connection, in accept order.
-    accepted: Arc<Mutex<Vec<u16>>>,
-    /// Source ports of the test's own flush connections (never counted).
-    flush_ports: Arc<Mutex<Vec<u16>>>,
-    /// Signalled after each accept so `drain` can wait on the flush.
-    ack: Arc<Condvar>,
-}
-
-impl ProxyObserver {
-    fn bind() -> Self {
-        let listener = Arc::new(TcpListener::bind("127.0.0.1:0").expect("bind proxy observer"));
-        let port = listener.local_addr().unwrap().port();
-        let accepted = Arc::new(Mutex::new(Vec::new()));
-        let flush_ports = Arc::new(Mutex::new(Vec::new()));
-        let ack = Arc::new(Condvar::new());
-        let a = Arc::clone(&accepted);
-        let c = Arc::clone(&ack);
-        let l = Arc::clone(&listener);
-        std::thread::spawn(move || {
-            for stream in l.incoming() {
-                let Ok(stream) = stream else { continue };
-                a.lock()
-                    .unwrap()
-                    .push(stream.peer_addr().map(|a| a.port()).unwrap_or(0));
-                c.notify_all();
-            }
-        });
-        ProxyObserver {
-            _listener: listener,
-            port,
-            accepted,
-            flush_ports,
-            ack,
-        }
-    }
-
-    fn port(&self) -> u16 {
-        self.port
-    }
-
-    /// Number of accepted connections that are not the test's own flush
-    /// connections — i.e. the leak count.
-    fn count(&self) -> usize {
-        let flush = self.flush_ports.lock().unwrap();
-        let accepted = self.accepted.lock().unwrap();
-        accepted.iter().filter(|p| !flush.contains(p)).count()
-    }
-
-    /// Bounded acknowledgement barrier for the accept loop.
-    ///
-    /// Opens a flush connection and blocks until the accept thread has
-    /// accepted *that connection* (identified by its source port), bounded by
-    /// a timeout.  Because `accept()` hands out connections FIFO, once the
-    /// flush is accepted every connection that completed its handshake before
-    /// it has been accepted and recorded too — so counting on afterwards
-    /// cannot miss a leak that was already in flight.  The flush connection
-    /// itself is never counted.
-    ///
-    /// A counter-tick barrier would be unsound here: sampling "current + 1"
-    /// and waiting for any increment lets a leak accepted after the sample
-    /// satisfy the wait, and the flush is then miscounted as that leak.
-    fn drain(&self) {
-        let flush =
-            TcpStream::connect(("127.0.0.1", self.port)).expect("observer flush connection");
-        let flush_port = flush.local_addr().unwrap().port();
-        self.flush_ports.lock().unwrap().push(flush_port);
-        let mut accepted = self.accepted.lock().unwrap();
-        while !accepted.contains(&flush_port) {
-            let (guard, timed_out) = self
-                .ack
-                .wait_timeout(accepted, std::time::Duration::from_secs(5))
-                .unwrap();
-            accepted = guard;
-            assert!(
-                !timed_out.timed_out(),
-                "proxy observer drain timed out; accept loop stalled"
-            );
-        }
-    }
-}
-
-#[test]
-fn obtain_proof_consumes_the_mocked_service_and_makes_no_live_call() {
-    let observer = ProxyObserver::bind();
-    let _guard = support::arm_blackhole(&format!("http://127.0.0.1:{}", observer.port()));
-
-    let mut server = mockito::Server::new();
-
-    let challenge = server
-        .mock("POST", "/v1/challenge")
-        .with_status(200)
-        .with_header("content-type", "application/json")
-        .with_body(
-            r#"{"challengeId":"c1","type":"anagram","difficulty":1,"prompt":"listen","token":"tok-1"}"#,
-        )
-        .expect(1)
-        .create();
-
-    let answer = server
-        .mock("POST", "/v1/answer")
-        .with_status(200)
-        .with_header("content-type", "application/json")
-        .with_body(r#"{"status":"passed","proof":"PROOF-XYZ"}"#)
-        .expect(1)
-        .create();
-
-    let cfg = IcaptchaCfg {
-        url: server.url(),
-        did: "did:key:zTEST".to_string(),
-        level: 1,
-        api_key: None,
-    };
-
-    let solve = |_c: &Challenge| Some("silent".to_string());
-    let solver: &dyn Fn(&Challenge) -> Option<String> = &solve;
-
-    let count_before = observer.count();
-
-    let proof = obtain_proof(&cfg, Some(solver))
-        .expect("obtain_proof should complete against the mocked service");
-    assert_eq!(proof, "PROOF-XYZ");
-
-    challenge.assert();
-    answer.assert();
-
-    // Drain the accept loop before asserting: the flush connection is not
-    // counted, and because accept() is FIFO every leak connection that
-    // completed its handshake before the flush is recorded before the flush
-    // is — so the count after drain reflects all egress in flight during the
-    // call.
-    observer.drain();
-    let leak_count = observer.count() - count_before;
-
-    assert_eq!(
-        leak_count, 0,
-        "proxy observer caught leaked connections; \
-         the blackhole failed to contain egress"
-    );
-}

crates/icaptcha-client/tests/support/mod.rs

@@ -1,93 +0,0 @@
-//! Shared helpers for the icaptcha-client integration tests.
-//!
-//! CONCURRENCY CONSTRAINT: [`arm_blackhole`] and [`disarm_proxy_env`] mutate
-//! process-wide proxy env vars and restore them on drop.  Each test binary
-//! that consumes this module currently has exactly one `#[test]`, so there is
-//! no concurrent use.  `cargo test` runs tests within a binary in parallel by
-//! default, so the NEXT test added to either file MUST be serialized against
-//! these helpers (e.g. a shared `Mutex` in this module, or the `serial_test`
-//! crate) or it will race on the proxy vars.
-
-use std::ffi::OsString;
-
-const PROXY_VARS: &[&str] = &[
-    "NO_PROXY",
-    "no_proxy",
-    "ALL_PROXY",
-    "all_proxy",
-    "HTTPS_PROXY",
-    "https_proxy",
-    "HTTP_PROXY",
-    "http_proxy",
-    "REQUEST_METHOD",
-];
-
-/// Captures the current values of a set of env vars and restores them on drop.
-pub struct EnvSnapshot(Vec<(String, Option<OsString>)>);
-
-impl EnvSnapshot {
-    pub fn capture(vars: &[&str]) -> Self {
-        EnvSnapshot(
-            vars.iter()
-                .map(|v| (v.to_string(), std::env::var_os(v)))
-                .collect(),
-        )
-    }
-}
-
-impl Drop for EnvSnapshot {
-    fn drop(&mut self) {
-        for (var, val) in &self.0 {
-            match val {
-                Some(v) => std::env::set_var(var, v),
-                None => std::env::remove_var(var),
-            }
-        }
-    }
-}
-
-/// Guard that restores env vars captured at construction time.
-pub struct EnvGuard {
-    _prev: EnvSnapshot,
-}
-
-/// Override every proxy-related env var so that non-loopback destinations are
-/// forced through `proxy_url`, with NO_PROXY covering loopback.  Also clears
-/// REQUEST_METHOD, which causes hyper-util to ignore all proxy variables when
-/// set.  Restores prior values on drop.
-///
-/// Not safe to call from concurrent tests (see module docs).
-pub fn arm_blackhole(proxy_url: &str) -> EnvGuard {
-    let prev = EnvSnapshot::capture(PROXY_VARS);
-
-    std::env::set_var("NO_PROXY", "127.0.0.1,localhost");
-    std::env::set_var("no_proxy", "127.0.0.1,localhost");
-    for var in [
-        "ALL_PROXY",
-        "all_proxy",
-        "HTTPS_PROXY",
-        "https_proxy",
-        "HTTP_PROXY",
-        "http_proxy",
-    ] {
-        std::env::set_var(var, proxy_url);
-    }
-    std::env::remove_var("REQUEST_METHOD");
-
-    EnvGuard { _prev: prev }
-}
-
-/// Clear every proxy-related env var so connections go direct.  Restores
-/// prior values on drop.
-///
-/// Not safe to call from concurrent tests (see module docs).
-#[allow(dead_code)]
-pub fn disarm_proxy_env() -> EnvGuard {
-    let prev = EnvSnapshot::capture(PROXY_VARS);
-
-    for var in PROXY_VARS {
-        std::env::remove_var(var);
-    }
-
-    EnvGuard { _prev: prev }
-}

docs/MAINTAINER-ROADMAP.md

@@ -38,8 +38,8 @@ Owner focus: node reliability.
 
 Owner focus: protocol/auth.
 
-- Close default-open repo write authorization and wire trusted UCAN delegation into repository permissions.
-- Close the remaining visibility gaps: restrict or document task, pin, and anchor metadata routes, and publish an irreversible-publication policy.
+- Implement repo write authorization: repo owner checks, protected branches, UCAN capability checks, and clear delegation semantics.
+- Implement private-read enforcement or remove private-repo affordances until it exists.
 - Add UCAN revocation or blocklisting, with an emergency compromised-key runbook.
 - Add mutation-aware GraphQL auth before GraphQL becomes a public write API surface.
 - Harden peer registration and outbound peer calls against SSRF and peer-list poisoning.

docs/OSS-READINESS-AUDIT.md

@@ -3,11 +3,6 @@
 Date: 2026-05-28
 Repo state inspected: `main` tracking `origin/main`, starting at `b12c6bc feat: per-DID rate limiting on creation endpoints (10/hour) (#13)`.
 
-> **Historical snapshot.** This audit describes the repository at the commit above. Its
-> statements about incomplete UCAN chain validation and absent per-repository read
-> enforcement have been superseded; see [`SECURITY.md`](../SECURITY.md) for the current
-> security posture.
-
 ## Commands run
 
 ```sh

docs/RUN-A-NODE.md

@@ -177,8 +177,7 @@ GITLAWB_ENFORCE_OWNER_PUSH=true
 | Missed heartbeats | After 3 days without one, you're excluded from rewards until you beat again |
 | Operator key | Dedicated wallet, small ETH balance, not your main treasury |
 | Monitoring | Watch `lastHeartbeat` on-chain; alert if > 22h since last beat |
-| Public URL | Must resolve and serve `/health` for liveness and DB-aware `/ready` for peer readiness |
-| Rolling upgrade (advisory-lock algorithm) | The SHA-256 advisory-lock key swap (replacing `DefaultHasher`) re-keys every repo in the first release that carries it. During a shared-Postgres rolling upgrade, old nodes compute a different `i64` key than new nodes for the same repo, so PostgreSQL treats them as independent locks and cross-machine write-exclusion is lost. **Drain in-flight writes** or cut over through a **single node** before bringing new-binary nodes online. |
+| Public URL | Must resolve and serve `/health` — peers will ping it |
 
 ---
 

infra/fly/gitlawb-node-2.fly.toml

@@ -1,65 +0,0 @@
-# fly.toml app configuration file generated for gitlawb-node-2 on 2026-07-22T09:47:18+08:00
-#
-# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
-#
-
-app = 'gitlawb-node-2'
-primary_region = 'sjc'
-
-[build]
-  dockerfile = '../../Dockerfile'
-
-[env]
-  GITLAWB_AUTO_SYNC = 'true'
-  GITLAWB_BOOTSTRAP_PEERS = 'https://node.gitlawb.com,https://node3.gitlawb.com'
-  GITLAWB_HOST = '0.0.0.0'
-  GITLAWB_KEY = '/data/keys/identity.pem'
-  GITLAWB_MAX_PACK_BYTES = '524288000'
-  GITLAWB_P2P_PORT = '7546'
-  GITLAWB_PORT = '7545'
-  GITLAWB_PUBLIC_URL = 'https://node2.gitlawb.com'
-  GITLAWB_REPOS_DIR = '/data/repos'
-  ICAPTCHA_MODE = 'enforce'
-  ICAPTCHA_PUBKEY = 'xjyPNqIbvc9U-kwXW6u9mDqRJ7E2UUMOaJdUWhpEXq8'
-  ICAPTCHA_REQUIRED_LEVEL = '3'
-
-[[mounts]]
-  source = 'gitlawb_data'
-  destination = '/data'
-
-[http_service]
-  internal_port = 7545
-  force_https = true
-  auto_stop_machines = 'off'
-  auto_start_machines = true
-  min_machines_running = 1
-
-  [http_service.concurrency]
-    type = 'connections'
-    hard_limit = 500
-    soft_limit = 400
-
-  [http_service.http_options]
-    idle_timeout = 120
-
-  [[http_service.checks]]
-    interval = '15s'
-    timeout = '5s'
-    grace_period = '30s'
-    method = 'GET'
-    path = '/ready'
-
-[[services]]
-  protocol = 'udp'
-  internal_port = 7546
-
-  [[services.ports]]
-    port = 7546
-
-[[vm]]
-  size = 'shared-cpu-1x'
-  memory = '1024'
-
-[[metrics]]
-  port = 9091
-  path = '/metrics'

infra/fly/gitlawb-node-3.fly.toml

@@ -1,65 +0,0 @@
-# fly.toml app configuration file generated for gitlawb-node-3 on 2026-07-22T09:47:19+08:00
-#
-# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
-#
-
-app = 'gitlawb-node-3'
-primary_region = 'nrt'
-
-[build]
-  dockerfile = '../../Dockerfile'
-
-[env]
-  GITLAWB_AUTO_SYNC = 'true'
-  GITLAWB_BOOTSTRAP_PEERS = 'https://node.gitlawb.com,https://node2.gitlawb.com'
-  GITLAWB_HOST = '0.0.0.0'
-  GITLAWB_KEY = '/data/keys/identity.pem'
-  GITLAWB_MAX_PACK_BYTES = '524288000'
-  GITLAWB_P2P_PORT = '7546'
-  GITLAWB_PORT = '7545'
-  GITLAWB_PUBLIC_URL = 'https://node3.gitlawb.com'
-  GITLAWB_REPOS_DIR = '/data/repos'
-  ICAPTCHA_MODE = 'enforce'
-  ICAPTCHA_PUBKEY = 'xjyPNqIbvc9U-kwXW6u9mDqRJ7E2UUMOaJdUWhpEXq8'
-  ICAPTCHA_REQUIRED_LEVEL = '3'
-
-[[mounts]]
-  source = 'gitlawb_data'
-  destination = '/data'
-
-[http_service]
-  internal_port = 7545
-  force_https = true
-  auto_stop_machines = 'off'
-  auto_start_machines = true
-  min_machines_running = 1
-
-  [http_service.concurrency]
-    type = 'connections'
-    hard_limit = 500
-    soft_limit = 400
-
-  [http_service.http_options]
-    idle_timeout = 120
-
-  [[http_service.checks]]
-    interval = '15s'
-    timeout = '5s'
-    grace_period = '30s'
-    method = 'GET'
-    path = '/ready'
-
-[[services]]
-  protocol = 'udp'
-  internal_port = 7546
-
-  [[services.ports]]
-    port = 7546
-
-[[vm]]
-  size = 'shared-cpu-1x'
-  memory = '1024'
-
-[[metrics]]
-  port = 9091
-  path = '/metrics'

install.sh

@@ -193,19 +193,5 @@ else
   echo "  gl quickstart"
 fi
 
-# oh-my-zsh's default git plugin aliases gl='git pull', which silently shadows
-# the gl binary in every interactive zsh (aliases beat PATH). Detect the common
-# setup and say so now, at install time, instead of letting the first `gl`
-# print git's baffling "fatal: not a git repository".
-if [ -f "$HOME/.zshrc" ] && [ -d "$HOME/.oh-my-zsh/plugins/git" ] \
-  && grep -Eq '^[[:space:]]*plugins=\(([^)]*[[:space:]])?git([[:space:]][^)]*)?\)' "$HOME/.zshrc" \
-  && ! grep -Eq '^([^#]*[[:space:];&|])?unalias[[:space:]]+([^;&|#]*[[:space:]])?gl([[:space:]]|$)' "$HOME/.zshrc"; then
-  echo ""
-  echo "NOTE: oh-my-zsh's git plugin aliases gl='git pull', which will shadow"
-  echo "the gl command in interactive shells. To use gl by name, run:"
-  echo ""
-  echo "  echo 'unalias gl 2>/dev/null' >> ~/.zshrc && source ~/.zshrc"
-fi
-
 echo ""
 echo "Docs: https://docs.gitlawb.com"

release-please-config.json

@@ -12,8 +12,7 @@
         { "type": "generic", "path": "crates/gitlawb-node/Cargo.toml" },
         { "type": "generic", "path": "crates/gl/Cargo.toml" },
         { "type": "generic", "path": "crates/git-remote-gitlawb/Cargo.toml" },
-        { "type": "generic", "path": "crates/gitlawb-attest/Cargo.toml" },
-        { "type": "generic", "path": "crates/icaptcha-client/Cargo.toml" }
+        { "type": "generic", "path": "crates/gitlawb-attest/Cargo.toml" }
       ]
     }
   }

scripts/build-bins.sh

@@ -46,7 +46,7 @@ build_darwin_arm64() {
   echo "==> Building darwin-arm64 (native cargo)..."
   cd "$ROOT"
   export PATH="$HOME/.cargo/bin:$PATH"
-  cargo build --release --locked -p gl -p git-remote-gitlawb
+  cargo build --release -p gl -p git-remote-gitlawb
   cp target/release/gl "$OUT/gl-darwin-arm64"
   cp target/release/git-remote-gitlawb "$OUT/git-remote-gitlawb-darwin-arm64"
   chmod +x "$OUT/gl-darwin-arm64" "$OUT/git-remote-gitlawb-darwin-arm64"

scripts/check-gitlawb-core-deps.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-#
-# Dependency-purity gate for the `gitlawb-core` crate.
-#
-# gitlawb-core is embedded by every consumer (the gl CLI, git-remote-gitlawb,
-# the node daemon), so it must stay lean. This script recomputes gitlawb-core's
-# NORMAL (non-dev, non-build) transitive dependency set and fails if it contains
-# any crate not present in ci/gitlawb-core-allowed-deps.txt.
-#
-# Hard-fail direction: a crate present now but NOT allowlisted. That is the case
-# the gate exists to catch (core silently gaining a heavy dependency).
-# Informational only: an allowlisted crate no longer present (stale entry) — a
-# legitimate dependency removal should not red CI, so it is reported, not failed.
-#
-# Runnable from anywhere in the repo.
-set -euo pipefail
-
-ROOT="$(git rev-parse --show-toplevel)"
-ALLOW="$ROOT/ci/gitlawb-core-allowed-deps.txt"
-
-if [ ! -f "$ALLOW" ]; then
-  echo "ERROR: allowlist not found at $ALLOW" >&2
-  exit 1
-fi
-
-# `cargo tree` resolves WITHOUT --locked on purpose, unlike the blocking cargo
-# jobs in pr-checks. This gate answers one question, whether gitlawb-core's
-# dependency closure gained something unallowlisted, and a stale Cargo.lock
-# would red it for a reason that has nothing to do with that closure. Lock
-# staleness is already caught by the --locked cargo jobs, so it does not need a
-# second gate here.
-#
-# Resolving can refresh Cargo.lock as a side effect, so snapshot and restore
-# it: this check must never leave the working tree dirty when run locally.
-lock_backup="$(mktemp)"
-cp "$ROOT/Cargo.lock" "$lock_backup"
-restore_lock() { cp "$lock_backup" "$ROOT/Cargo.lock"; rm -f "$lock_backup"; }
-trap restore_lock EXIT
-
-# Current normal-dependency closure of gitlawb-core, one crate name per line.
-# Must match the regen command documented in the allowlist header exactly.
-current="$(
-  cargo tree -p gitlawb-core --edges normal --prefix none --manifest-path "$ROOT/Cargo.toml" \
-    | sed -E 's/ v[0-9].*$//' \
-    | grep -v '^gitlawb-core$' \
-    | sort -u
-)"
-
-# Allowlist with comments and blank lines stripped.
-allowed="$(grep -vE '^[[:space:]]*(#|$)' "$ALLOW" | sort -u)"
-
-# comm needs sorted input; both sides are sorted above.
-offenders="$(comm -23 <(printf '%s\n' "$current") <(printf '%s\n' "$allowed"))"
-stale="$(comm -13 <(printf '%s\n' "$current") <(printf '%s\n' "$allowed"))"
-
-if [ -n "$stale" ]; then
-  echo "NOTE: allowlisted crates no longer in gitlawb-core's dependency tree"
-  echo "      (safe to prune from ci/gitlawb-core-allowed-deps.txt):"
-  printf '  %s\n' $stale
-  echo
-fi
-
-if [ -n "$offenders" ]; then
-  {
-    echo "ERROR: gitlawb-core gained dependencies not on the allowlist:"
-    printf '  %s\n' $offenders
-    echo
-    echo "gitlawb-core must stay embeddable and lean. If a new dependency is"
-    echo "intentional, add it to ci/gitlawb-core-allowed-deps.txt (regen command"
-    echo "is in that file's header). Otherwise, drop the dependency."
-  } >&2
-  exit 1
-fi
-
-echo "gitlawb-core dependency purity: OK ($(printf '%s\n' "$current" | wc -l | tr -d ' ') normal deps, all allowlisted)."

scripts/check-release-versioning.sh

@@ -1,117 +0,0 @@
-#!/usr/bin/env bash
-#
-# Release-versioning coverage gate for the workspace crates.
-#
-# release-please owns every crate's version. It rewrites a version line only
-# when BOTH halves hold: the line carries an `# x-release-please-version`
-# annotation, and the crate's manifest is listed under `extra-files` in
-# release-please-config.json. A crate missing either half is silently skipped
-# at release time and freezes at whatever version it was created with, which
-# is exactly what happened to icaptcha-client (added as a workspace member
-# after the config was last written, so it sat at 0.4.0 while the rest of the
-# workspace walked to 0.7.1 across four releases).
-#
-# Exhaustive-by-construction: the required set is DERIVED from the workspace
-# member list via `cargo metadata`, never from a hand-maintained list here. A
-# newly added crate reds CI whether or not anyone remembered this gate exists,
-# which is the property a hand list cannot have.
-#
-# Hard-fail directions, all three release-silent:
-#   1. a workspace member absent from extra-files
-#   2. a workspace member whose version line lacks the annotation
-#   3. an extra-files entry pointing at a manifest that no longer exists
-#
-# Runnable from anywhere in the repo.
-set -euo pipefail
-
-ROOT="$(git rev-parse --show-toplevel)"
-CONFIG="$ROOT/release-please-config.json"
-
-if [ ! -f "$CONFIG" ]; then
-  echo "ERROR: release-please config not found at $CONFIG" >&2
-  exit 1
-fi
-
-# Resolving can refresh Cargo.lock as a side effect, so snapshot and restore it:
-# this check must never leave the working tree dirty when run locally. Same
-# reasoning as scripts/check-gitlawb-core-deps.sh.
-lock_backup="$(mktemp)"
-cp "$ROOT/Cargo.lock" "$lock_backup"
-restore_lock() { cp "$lock_backup" "$ROOT/Cargo.lock"; rm -f "$lock_backup"; }
-trap restore_lock EXIT
-
-# Workspace members as repo-relative manifest paths, one per line. This is the
-# derived required set: whatever cargo considers a member must be release-managed.
-members="$(
-  cargo metadata --no-deps --format-version 1 --manifest-path "$ROOT/Cargo.toml" \
-    | jq -r '.packages[].manifest_path' \
-    | sed "s#^$ROOT/##" \
-    | sort -u
-)"
-
-# Manifest paths release-please is configured to rewrite.
-listed="$(jq -r '.packages["."]["extra-files"][] | .path' "$CONFIG" | sort -u)"
-
-unlisted="$(comm -23 <(printf '%s\n' "$members") <(printf '%s\n' "$listed"))"
-orphaned="$(comm -13 <(printf '%s\n' "$members") <(printf '%s\n' "$listed"))"
-
-# Second half of the invariant: being listed does nothing without the marker,
-# because the generic updater keys on the annotation to find the line.
-#
-# Scoped to the [package] table on purpose. A manifest-wide match is satisfied by
-# an annotated `version` under any other table, so a crate could leave the version
-# cargo actually reads unannotated, pass this gate, and still freeze at release
-# time while release-please rewrote the decoy line instead.
-unmarked=""
-while IFS= read -r manifest; do
-  [ -n "$manifest" ] || continue
-  if ! awk '
-    /^[[:space:]]*\[/ { in_package = ($0 ~ /^[[:space:]]*\[package\][[:space:]]*$/); next }
-    in_package && /^version = ".*" # x-release-please-version/ { found = 1 }
-    END { exit(found ? 0 : 1) }
-  ' "$ROOT/$manifest"; then
-    unmarked="$unmarked$manifest"$'\n'
-  fi
-done <<< "$members"
-
-failed=0
-
-if [ -n "$unlisted" ]; then
-  {
-    echo "ERROR: workspace members missing from extra-files in release-please-config.json:"
-    printf '  %s\n' $unlisted
-    echo
-    echo "release-please will never bump these crates, so they freeze at their"
-    echo "current version while the rest of the workspace moves. Add each one as"
-    echo '  { "type": "generic", "path": "<manifest path>" }'
-  } >&2
-  failed=1
-fi
-
-if [ -n "$unmarked" ]; then
-  {
-    echo "ERROR: workspace members whose version line lacks the release-please annotation:"
-    printf '  %s\n' $unmarked
-    echo
-    echo 'The generic updater finds the line by its trailing `# x-release-please-version`'
-    echo "comment. Without it the crate is listed but never rewritten."
-  } >&2
-  failed=1
-fi
-
-if [ -n "$orphaned" ]; then
-  {
-    echo "ERROR: extra-files entries pointing at manifests that are not workspace members:"
-    printf '  %s\n' $orphaned
-    echo
-    echo "release-please fails the release when an extra-file path does not exist."
-    echo "Drop the stale entry, or restore the crate to the workspace."
-  } >&2
-  failed=1
-fi
-
-if [ "$failed" -ne 0 ]; then
-  exit 1
-fi
-
-echo "release versioning coverage: OK ($(printf '%s\n' "$members" | wc -l | tr -d ' ') workspace members, all annotated and listed)."

scripts/resolve-release-tag.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-tag="${1-}"
-: "${GITHUB_OUTPUT:?GITHUB_OUTPUT must be set}"
-
-case "$tag" in
-  ""|*[!A-Za-z0-9._-]*)
-    printf '%s\n' "::error::release tag is empty or contains invalid characters"
-    exit 1
-    ;;
-esac
-
-case "$tag" in
-  v[0-9]*) ;;
-  *)
-    printf '%s\n' "::error::'$tag' does not look like a release tag (vX.Y.Z)"
-    exit 1
-    ;;
-esac
-
-printf '%s\n' "tag=$tag" >> "$GITHUB_OUTPUT"
-printf '%s\n' "version=${tag#v}" >> "$GITHUB_OUTPUT"

scripts/test-resolve-release-tag.sh

@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-resolver="$repo_root/scripts/resolve-release-tag.sh"
-test_tmp="$(mktemp -d)"
-trap 'rm -r -- "$test_tmp"' EXIT
-
-valid_output="$test_tmp/valid-output"
-GITHUB_OUTPUT="$valid_output" "$resolver" "v1.2.3"
-
-expected_output="$test_tmp/expected-output"
-printf '%s\n' "tag=v1.2.3" "version=1.2.3" > "$expected_output"
-cmp "$expected_output" "$valid_output"
-
-newline_output="$test_tmp/newline-output"
-newline_stdout="$test_tmp/newline-stdout"
-newline_stderr="$test_tmp/newline-stderr"
-if GITHUB_OUTPUT="$newline_output" "$resolver" $'v1.2.3\nname=owned' \
-  > "$newline_stdout" 2> "$newline_stderr"
-then
-  printf '%s\n' "newline-containing release tag unexpectedly passed" >&2
-  exit 1
-fi
-test ! -s "$newline_output"
-grep -qxF "::error::release tag is empty or contains invalid characters" "$newline_stdout"
-test ! -s "$newline_stderr"
-
-empty_output="$test_tmp/empty-output"
-if GITHUB_OUTPUT="$empty_output" "$resolver" ""; then
-  printf '%s\n' "empty release tag unexpectedly passed" >&2
-  exit 1
-fi
-test ! -s "$empty_output"
-
-invalid_output="$test_tmp/invalid-output"
-for invalid_tag in \
-  "v1.2.3 tag" \
-  "v1.2.3;name=owned" \
-  "v1.2.3+build.5" \
-  "release-1.2.3" \
-  "v-1" \
-  "vlatest" \
-  "v" \
-  "v1.2.3/../../x" \
-  "V1.2.3"
-do
-  : > "$invalid_output"
-  if GITHUB_OUTPUT="$invalid_output" "$resolver" "$invalid_tag"; then
-    printf '%s\n' "invalid release tag unexpectedly passed: $invalid_tag" >&2
-    exit 1
-  fi
-  test ! -s "$invalid_output"
-done
-
-release_workflow="$repo_root/.github/workflows/release.yml"
-actual_resolver_steps="$test_tmp/actual-resolver-steps"
-expected_resolver_steps="$test_tmp/expected-resolver-steps"
-
-# Pin each resolver step and the checkout step that supplies its script. Any
-# change to one of these reviewed blocks must be reflected here deliberately.
-awk '
-  function emit_step() {
-    if (in_step && (is_rel || is_workflow_scripts_checkout)) {
-      printf "job=%s\n%s", job, step
-    }
-    in_step = 0
-    is_rel = 0
-    is_workflow_scripts_checkout = 0
-    step = ""
-  }
-
-  /^  [A-Za-z0-9_-]+:[[:space:]]*$/ {
-    emit_step()
-    job = $0
-    sub(/^  /, "", job)
-    sub(/:[[:space:]]*$/, "", job)
-    next
-  }
-
-  /^      - / {
-    emit_step()
-    in_step = 1
-    is_workflow_scripts_checkout = ($0 ~ /^      - name:[[:space:]]*Check out workflow scripts[[:space:]]*$/)
-    step = $0 ORS
-    next
-  }
-
-  in_step {
-    step = step $0 ORS
-    if ($0 ~ /^        id:[[:space:]]*rel[[:space:]]*$/) {
-      is_rel = 1
-    }
-  }
-
-  END {
-    emit_step()
-  }
-' "$release_workflow" > "$actual_resolver_steps"
-
-cat > "$expected_resolver_steps" <<'EOF'
-job=docker
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-job=docker
-      - name: Resolve release tag
-        id: rel
-        env:
-          DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-          # ghcr requires a lowercase repository path, and unlike metadata-action,
-          # buildx's `--output name=` does no lowercasing — a mixed-case owner
-          # makes the digest push fail with "invalid reference format".
-          echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
-
-job=docker-manifest
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-job=docker-manifest
-      - name: Resolve release tag
-        id: rel
-        env:
-          DISPATCH_TAG: ${{ inputs.docker_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-
-job=npm-publish
-      - name: Check out workflow scripts
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-job=npm-publish
-      - name: Resolve release tag
-        id: rel
-        env:
-          DISPATCH_TAG: ${{ inputs.npm_backfill_tag }}
-          RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          scripts/resolve-release-tag.sh "${DISPATCH_TAG:-$RELEASE_TAG}"
-
-EOF
-
-if ! cmp "$expected_resolver_steps" "$actual_resolver_steps"; then
-  printf '%s\n' \
-    "release workflow resolver steps differ from the three reviewed blocks" >&2
-  diff -u "$expected_resolver_steps" "$actual_resolver_steps" >&2 || true
-  exit 1
-fi
-
-printf '%s\n' "release tag validation tests passed"