deps: the ecore of the third uplift, and auxilia's first tag sr-ht-ecore grew login, logging, instconf and chimw, which between them replace this service's identity middleware, its logging setup and its config validation. auxilia is a real v0.7.0 rather than a pseudo-version now, so the requirement can name a tag.
deps: auxilia whose scribe.Err reads the whole error chain Until now scribe.Err type-asserted the outermost error for slog.LogValuer, so a culpa error under a single fmt.Errorf logged as a flat string and lost its code, hint and stacktrace with no warning. It walks the chain now, which is what makes the culpa wrapping in this service visible in the journal.
log: slog through auxilia's scribe, not logrus This was the last service on the instance still logging through logrus, and the ecore bump made it a correctness question rather than a consistency one: the recovery middleware reports a panic through slog's DEFAULT logger, so without a SetDefault the one record carrying a stack trace would have gone to Go's plain handler while every other line went through logrus. initLogging installs a scribe tint handler on stderr — source on, colour only when stderr is a terminal, and the mask rules for token, cookie and authorization. It reads -d out of the argument vector rather than waiting for core-go's parse, because a daemon that only became verbose after it had finished starting would be silent for exactly the part of its life an operator passes -d to watch. Terminal detection is a stdlib Stat rather than golang.org/x/term, which would be a new dependency for one predicate. The startup config check keeps its shape deliberately: it still accumulates every missing key and reports them in ONE record before ONE exit, so an operator fixes the config in a single pass. The keys go in as a slice attribute rather than a joined string, so the structured sinks keep them as a list. culpa goes in at the one boundary where it pays: the errors web.New returns, which are the only errors this package produces and all of which arrive at that single startup record. Each carries a hint naming the config key or the build step that fixes it, and scribe.Err unfolds message, code, hint and stacktrace into fields of their own. The failing request path logs the same way, with ErrorContext so a cancelled request reads as cancelled rather than as an unexplained 500. TestPanicIsAnErrorPage covers the wiring end to end through Register: a panicking authorizer yields the chrome-wrapped 500, the panic value does not reach the viewer, and the report reaches slog's default logger.
deps: sr-ht-ecore whose middleware reports panics through slog The panic report is structured now (method, path, panic, stack) and goes through slog's default logger, so a service that never calls slog.SetDefault gets those reports in Go's plain stderr handler. The next commit is what makes this one land somewhere useful.
deps: sr-ht-ecore with the web-tier packages Brings in assets, pages, csrf, middleware and ecoretest, plus the chrome that grew Service.Assets — the slot three services had each added a field of their own for.
web: draw the chrome from sr-ht-ecore The nav/service-switcher, the brand, the login block and the environment banner were a copy of code every custom service on this instance carries. The copies drifted, so they now come from one place: sourcecraft.dev/bigbes/sr-ht-ecore/chrome. web/chrome.go is gone. New builds one chrome.Service from the shared config.ini and hands it the discovered stylesheet; view() asks it for a chrome.Page per request, which viewData embeds rather than copies, so a field ecore adds later arrives here without an edit. The layout invokes "srht-env-banner" and "srht-nav" instead of the markup it used to spell out, the landing's repository listing goes through "srht-repo-list", and the FuncMap starts from chrome.Funcs() with the local shortsha deleted. Two ecore policies differ from what this service did and are adopted as the instance's: the brand label is the config section's short name rather than a literal "compare", and the origins are trimmed of a trailing slash. What stays local is what is compare's alone: the bundle href, the diff-status colours, and the container-fluid the two diff views ask for. Tests move to testify; the nav ordering/exclusion test goes with the code it tested, and a test that the layout invokes the chrome at all replaces it.
rename module to sourcecraft.dev/bigbes/sr-ht-compare; depend on sourcecraft sr-ht-core
go.mod: tidy and complete the README go mod tidy promotes fernet-go and vaughan0/go-ini from indirect to direct (the cmd entry point imports go-ini and the smoke test imports fernet) and drops stale transitive checksums for AWS S3/CLI packages that core-go pulls but compare.sr.ht never imports. The require block is otherwise unchanged; build and tests stay green. README: correct the architecture to reflect the go-git in-process backend (no runtime git shell-out), document the full local development recipe (config.ini template, key generation, dev-stub, forging a login cookie), the deployment steps (install, config propagation for nav, DNS, internal-ipnet, nginx, User=git systemd), and design notes recording the go-git decision, the 10 MB bundle rationale, and the pending LICENSE.
gitx: repository access and ref-to-ref diffs on go-git Implement the git access layer for compare.sr.ht on go-git v5 (no runtime git binary). Public surface: Open (owner/name validated via core, bare-repo HEAD check, ErrNotFound on any miss); Refs/DefaultBranch; ResolveCommit/Log/ Parents; Diff/RawDiff/DiffStat/MergeBase/CommitPatch. - Diffs route through DiffTreeWithOptions(DetectRenames) so old/new tree order is explicit: three-dot uses the merge base as old side, two-dot uses base; CommitPatch diffs a commit against its parent (root vs empty tree, merge vs first parent, ParentSHAs exposed for the banner). - Patch text is generated in memory then capped (5 MiB page, 50 MiB raw, injectable override for tests) and cut at a "diff --git" file boundary so the browser parser never sees a torn hunk; ctx timeout (10s) guards runaways. - FileChange status/counts/binary derived purely from go-git FilePatches (mapFilePatches); Log excludes base's full reachable set for correct base..head semantics. Tests build fixtures by driving the real git CLI in t.TempDir(). Fidelity gate (TestPatchFidelity) confirms go-git emits standard git headers — diff --git, index, rename from/to, "Binary files ... differ", @@ hunks — parseable by the frontend parsePatchFiles(). 82% coverage. core validators reject ^/~ so navigation revs are resolved to SHAs in tests.
compare.sr.ht: project foundation — core package, build scaffolding, core-go fork pin Bootstrap the go.bigb.es/sourcehut-compare service: - go.mod (go 1.26.4) pinning core-go to the private fork git.srht.bigb.es/~bigbes/core-go @ c2c2f3848fa9 via a replace directive; go.sum populated by a throwaway smoke build importing core-go config/crypto/client/server + chi + logrus (gates API drift from the verification baseline fdb3662 to upstream 71b2787). - core/: pure domain package — sentinel errors, owner/repo/ref validation (check-ref-format-style, hostile-input hardened), and the compare-spec grammar (ParseCompareSpec, three-dot/two-dot, percent-unescape). Table tests at 97% coverage. - Makefile (all/build/test/css/bundle/run-dev/install), config.example.ini documenting the shared keys read in place, contrib/ nginx block and systemd unit, README skeleton, .gitignore. core-go dep deps and go mod tidy are deferred to later phases per plan.