1 files changed, 40 insertions(+), 3 deletions(-)

M README.md

@@ 11,9 11,13 @@ copies of the same code.
 - `chrome` — the shared page chrome: service-switcher nav built from the
   shared config.ini (`chrome.BuildNav`), per-request `chrome.Page` with
   login/logout/profile URLs against meta.sr.ht's unified login, embedded
-  `srht-nav` / `srht-env-banner` template partials (circle brand + red service
-  label + switcher + login box), and the generic template helpers (`dict`,
-  `shortsha`, `reltime`, `abstime`).
+  `srht-nav` / `srht-env-banner` / `srht-head-links` template partials (circle
+  brand + red service label + switcher + login box, and the stylesheet and
+  favicon links), the `srht-repo-list` and `srht-repo-table` listings over one
+  dot, and the generic template helpers (`dict`, `shortsha`, `reltime`,
+  `abstime`). A service that ships no icon still gets one: `FaviconHref`
+  defaults to the brand's ring as a `data:` URI, which — unlike a path into a
+  static tree the binary does not have — cannot 404 once per page load.
 - `grants` — the grant vocabulary of tokens.sr.ht (SPEC ch. 3):
   `<service>:<action>` members split on ASCII whitespace, `*` for every action
   of every service, the reserved `id:<n>` member a registered token carries,


@@ 62,6 66,39 @@ copies of the same code.
   distinguished from a real failure, or a disconnected browser inflates the
   5xx rate. A panic that arrives after the response has started aborts the
   connection instead of appending an error page to a truncated one.
+- `login` — the one decoder of meta.sr.ht's unified-login cookie. Six services
+  read the same fernet-sealed cookie and each made the same five decisions
+  alone: decrypt without an expiry (a service-side TTL logs a viewer out of
+  that one service on a schedule no sibling shares), take the name, strip the
+  `~`, treat every failure as anonymity rather than as an error, and validate
+  the name before it reaches a path, a log line or a query. `Optional` never
+  refuses and `Required(deny)` does, because folding the gate into the decoder
+  is exactly how the six copies drifted. The validator cannot be switched off:
+  the two services that validate nothing today are the two that would go on
+  passing nothing.
+- `internalauth` — both ends of the `Authorization: Internal` handshake
+  between services, which core-go implements unexported. Minting and verifying
+  live in one package on purpose: dolt had the receiver in one repository and
+  the caller in another, so a change to the payload broke provisioning at
+  runtime instead of at compile time.
+- `instconf` — canonical reading of the shared config's origins. Five services
+  and this library disagreed about what "the origin" is: `TrimRight` against
+  `TrimSuffix`, a malformed one becoming `""` here and `"localhost"` there —
+  on a path that includes a DNS-rebinding guard, where an empty host means the
+  guard is off. `OriginHost` (no port) and `OriginAuthority` (with it) are two
+  concepts, not a drift.
+- `logging` — the instance's slog policy without the handler: level from
+  `-d`/`$LOG_LEVEL`/config, colour from `NO_COLOR` and the terminal, and the
+  credential mask set. The mask set is the shared part — what is being redacted
+  is the instance's login cookie and its bearer tokens — while tint-versus-JSON
+  is the service's own call, so the policy also ships as a stdlib
+  `ReplaceAttr`. `middleware.RecoverPanics` reports through `slog.Default()`,
+  which is what gave ecore a stake in every service installing a compatible
+  handler.
+- `chimw` — the chi-shaped helpers, kept out of `middleware` so that package
+  can stay dependency-free: `GetHead`, the 404/405 installer pointing at the
+  service's own error page, and a request logger that emits a slog record
+  instead of chi's unstructured line on stdout.
 - `ecoretest` — the test bootstrap: a synthetic instance `config.ini` with the
   sections the nav rules need (canonical services, hub, the excluded
   paste/pages, the custom ones, and one section with no origin that must not