docs: confirm browser review, and make the link the entry point Review happens in a browser, so the prose differ stays in v1 and remains the Phase 0 gate. The link, not the inbox, is the normal way in: you are usually already talking to an agent when it proposes, so every write response must carry the proposal URL for the agent to surface. Proposal URLs are stable past merge or rejection. The inbox demotes to a backstop for unattended work, sharing a page with the policy-merged digest, which is invisible for the same reason.
docs: correct errors found by independent review Two claims were plainly wrong and load-bearing: - post-receive cannot reject a push; its exit status is ignored once refs have moved. Validation and the refs rule move to the update hook. The hooks are also not 'zero service code': bleve is single-writer and the daemon holds the index, so both hooks RPC into the daemon, and push fails closed when it is unreachable. - hut builds endpoints from per-service origins, never from api.sr.ht, so federation buys it nothing and 'one endpoint, one token' is hollow. The decision is now a read schema at our own /query; federation is a free config line rather than a motivation. Also resolves an internal contradiction: the doc argued for a single shared index and then specified one bleve index per project. Now one global index with projects as query-time filters, and globally unique document IDs, which removes the per-project collision hole. Further corrections: merge staleness keyed by document ID rather than path, deletion and rename made human-push-only, approval expressed as a property of the branch rather than frontmatter, the proposal state machine collapsed to open/merged/rejected for a single reviewer, If-Match pinned to the approved head, and a new consistency section covering crash repair, the reconciler, per-space mutexes and unix ownership. Records warren's index as a batch full rebuild rather than incremental, and the eight questions from review that still need answers.
docs: fold in scope, audience, cadence and edit-path decisions Four confirmed answers reshape the design rather than just the backlog: - Agent-authored specs only. Read-only mounts leave v1; the meta-project now unifies owned spaces. The store is a fresh silo, so it is empty until filled, which reorders the phases. - Single-user. Visibility levels, approver lists, approval counts and request-changes cycles drop. Authorization relocates rather than disappearing: it is about scoping agents, not separating humans. - Bimodal cadence. Records approval as human or policy so auto-merged notes are not laundered as reviewed, and adds a digest so the firehose half stays visible. - Human edits via clone and push. Adds the git remote as a v1 requirement and drops the web editor. Humans push to the approved branch, agents may only write proposals/*; SSH plus a post-receive hook needs no service code and validates every write path. Also records mixed ru/en search analyzers as an unresolved question that determines whether search is usable at all.
docs: federate the read side into api.sr.ht from Phase 2 Reverses the earlier no-federation call. The deciding arguments are one endpoint plus one meta PAT for agents already querying git/todo/builds, hut ergonomics, and core-go/webhooks being GraphQL-native so Phase 5 pulls gqlgen in regardless. The dolt precedent does not generalize: its API is a chunk-store protocol, whereas documents and proposals are an ordinary CRUD graph. Mutations stay on REST + MCP. If-Match optimistic concurrency is an HTTP idiom with well-defined 409 semantics, and a federated type is a consumed contract, so the unsettled proposal types stay out of the gateway. Also records that federation is not cross-service search: thistle merges schemas and routes fields, so the meta-project still needs our own index.
docs: add SourceHut integration section to the spec.sr.ht design Records the config-driven wiring (Recipe B: pure Go, chrome copied from compare.sr.ht), the canonical [spec.sr.ht] keys, and the shared keys read in place. Documents why skipping GraphQL federation is safe: api.sr.ht federates every .sr.ht config section with no allow-list, but updateSchema skips services that fail to serve /query, and the refresh is SIGHUP-driven rather than a ticker.
docs: design proposal for spec.sr.ht Reviewable document storage for the self-hosted SourceHut instance: bots propose, humans review and curate, bots consume the approved text. Records the four confirmed decisions (proposal-first review gate, own bare git repos, absorb warren's read plane, thin full-loop v1) and the projects model that gives cross-space unified search.