web: serve the static tree through ecore's assets discoverStyleHref and the bare http.FileServer are sr-ht-ecore's assets package now: one hashed-name pattern, the cache policy the hash implies (immutable for a content-addressed name, an hour for the rest), and a refusal to publish a directory listing of the build. The unhashed fallback survives, but only when static/main.css is really there — an href to a file this deployment does not ship is a 404 per page load, which is what an empty Resolve exists to avoid.
web: draw the chrome from sr-ht-ecore The brand, the service switcher, the login block, the environment banner and the database listing were a local port of core.sr.ht's nav — one of five such ports on this instance, and they had already drifted. They are now sourcecraft.dev/bigbes/sr-ht-ecore/chrome, the one copy every custom service draws from. Deleted: web/chrome.go entire (navEntry, networkOrder, networkExcluded, buildNetwork, basePage, loginURL, logoutURL), templates/nav.html, templates/icons/circle.svg (ecore inlines the identical SVG), the repoList partial, and the local dict/shortHash duplicates. Added: one chrome.Service built in newApp from our config section with the hashed stylesheet href set on it, a chrome.Page per request through app.page, chrome.Attach on every template set, and chrome.Funcs as the base of the funcmap. Handlers embed chrome.Page in their view structs instead of copying its fields; the row browser sets ContainerClass to container-fluid, since its column count is the table's and not ours. Three behaviour changes come with ecore's policy, all deliberate: the profile link now prefers hub's ~username page when hub.sr.ht is configured (it was always meta's /profile), the brand carries a fixed 15rem min-width so the switcher starts at the same x on every service, and a binary built without a stylesheet renders bare rather than linking an empty href. The nav test went with the code it tested — ordering, exclusions and login URLs are ecore's to cover — and what replaced it asserts only what is ours: that pages are drawn through the chrome at all, and that the row browser is full-bleed. The auth path is untouched: a foreign bearer token is still accepted as a meta.sr.ht PAT.
web: mirror the git twin's description onto companion databases The internal create endpoint accepts a description, but its only caller — dolt-git-hook — never sends one: git.sr.ht's push context does not carry it. Companion databases therefore all sat descriptionless on the dashboard while their git twins had perfectly good descriptions. Resolve the description server-side instead: a GitDescriber dependency (internal GraphQL query to git.sr.ht in the owner's name, the same network-key trust the hook uses to reach us, pointed the other way) is consulted on every /internal/repos call. A fresh companion is created with the twin's description; for an existing one the push doubles as the sync point — a changed, non-empty git description overwrites the stored one. An empty git description never clobbers one set in dolt's own settings, and every failure mode (no twin, git.sr.ht down, no resolver wired) degrades to no mirroring. The lookup is capped at 3s so the hook's own 5s POST timeout is never exceeded. Adds testify as a direct dependency for the new tests.
build: pure-Go (CGO_ENABLED=0) build via a klauspost-backed gozstd shim dolthub/dolt/go pulls in two hard cgo dependencies — go-icu-regex (SQL REGEXP) and gozstd (NBS zstd compression) — which forced a C toolchain + ICU headers on every build. Both are now avoided so the default build is pure Go and statically linkable: - ICU: build with `-tags gms_pure_go`, selecting go-mysql-server's stdlib regexp fallback. Safe because this service never runs the SQL engine (it serves bare NBS stores and browses read-only), so it never evaluates SQL REGEXP. - zstd: `replace github.com/dolthub/gozstd => ./third_party/gozstd-purego`, a pure-Go drop-in over klauspost/compress/zstd (already in the graph). It reproduces the nine gozstd symbols dolt references. dolt is unmodified. dolt uses gozstd only in its NBS archive subsystem; this binary hits only the decompress side at runtime (archive dictionary TRAINING is gc/ archive-writer code we never run — the shim implements it over klauspost but panics on the trainer errors that only that off-path use could trigger). zstd frames and dictionaries are standard-format, so libzstd-authored archives decode correctly; the shim's tests prove this by decoding plain and dictionary-compressed frames produced by the zstd CLI (libzstd). The Makefile now defaults to CGO_ENABLED=0 + -tags gms_pure_go (override with `make CGO_ENABLED=1 GO_TAGS=` for the cgo variant). Verified: CGO_ENABLED=0 build of ./..., all unit tests, the real-dolt-CLI integration + spike suites, and the shim's libzstd-interop tests, all green with no cgo.
rename module to sourcecraft.dev/bigbes/sr-ht-dolt; depend on sourcecraft sr-ht-core
build: source core-go from the instance fork Replace git.sr.ht/~sircmpwn/core-go with git.srht.bigb.es/~bigbes/core-go at c2c2f38 (upstream fdb3662 + newer upstream commits + the phoebe-lab S3 UnsignedPayload patch) - the code production actually runs. Requires GOPRIVATE=git.srht.bigb.es to fetch. Full suite re-verified including the remotesapi integration scenarios.
cmd: doltsrht and doltsrht-migrate binaries, module tidy
foundation: module, core domain, schema, spike-verified dolt interop Phase 0 foundation for dolt.sr.ht (pure-Go Dolt hosting for SourceHut). Dependency pins: - core-go v0.0.0-20260520082310-fdb3662452dc: the production instance's submodule commit (fdb3662); must never be upgraded so token/config/crypto behavior matches the rest of the instance. - dolthub/dolt/go v0.40.5-0.20260626152440-45335d44ad79: pseudo-version at the commit tagged v2.1.10 (45335d44), matching the installed dolt CLI. The /go submodule's latest tag (v0.40.4, 2021) does not interop with a modern CLI; matching the CLI commit guarantees a common NBS format (Format_DOLT) and remotesapi proto. - gopkg.in/go-jose/go-jose.v2 v2.6.3: same JOSE version dolt's creds package signs EdDSA keypair JWTs with, avoiding a duplicate JOSE lib. - grpc v1.79.3, logrus v1.8.3, lib/pq v1.10.9, chi/v5 v5.3.1, brant v0.5.1. Contents: - core/ pure domain: models, ValidateName/ParseRepoPath, the access matrix (Allowed + NotFoundForPrivate), full table-driven tests. - schema.sql + migrations/0001_initial.sql (brant format). - config.example.ini, contrib/dolt.sr.ht.conf (nginx), Makefile, scss/main.scss, static/logo.svg, README, .gitignore. - internal/smoke: throwaway import-and-build check (deleted in Phase 3). Spike (storage/spike_test.go, tag `spike`): bare NBS store via WriteEmptyRepo, served by remotesrv on an ephemeral single port, round-tripped through the real dolt CLI v2.1.10 (clone -> insert -> commit -> push -> re-clone -> verify rows). Green, no version juggling needed beyond selecting the v2.1.10 commit. FS must be rooted at the repos dir (LocalFilesysWithWorkingDir) so sealed chunk-URL prefixes are clean relatives. Build note: dolt pulls go-icu-regex (CGO), which needs ICU4C headers; on this Mac set CGO_CPPFLAGS/CGO_LDFLAGS to icu4c@78 (documented in README).