fix(service): separate the read-plane rev guard from the review path The previous commit's guard broke two service tests, which were right and the guard was too broad: rendering and diffing a proposal branch genuinely needs to read one, so a blanket ban on ref names is not the shape. ReadDocument keeps the strict object-name rule. ReadDocumentAtRef reaches an arbitrary ref, deliberately as a separate awkwardly-named method rather than a flag, so serving unreviewed content is something a caller asks for by name and a reviewer can grep for. A rejected rev now wraps ErrNotFound as well, preserving the existing deliberate property that a crafted revision cannot distinguish malformed from absent by probing.
feat(mcpsrv): MCP read tools, with Host validation replacing the SDK guard Adds the Phase 2 read tools (spec_search, spec_read, spec_list) over the service layer. Two security fixes came out of building them. The read plane could serve proposal content. gitx resolves ref names, and service.resolveRev passed any string through, so rev=proposals/42 made the READ plane hand back unreviewed text — which would then flow into agent context as though approved, the single failure this service exists to prevent. ValidateReadRev now admits only the approved-head sentinel or a full 40-character object name, at the layer all three surfaces share. Abbreviations are refused too: one that is unique today can become ambiguous later, so a pinned revision would silently stop meaning one thing. The MCP SDK's DNS-rebinding guard rejects a loopback listener whose Host is not loopback, which is exactly nginx forwarding to 127.0.0.1 — it would 403 only in production, passing every local test. The SDK offers no allowlist, so the guard is disabled and replaced by a stricter check: Host must equal the configured origin, or a loopback name for development. A rebinding attack carries the attacker's name in Host and fails it. An unusable origin logs loudly rather than quietly unguarding the endpoint.
feat: projects — a saved filter over one global index, not a container A project is a named space set; querying one filters the single global index. The meta-project is an implicit filter at a reserved address rather than a row: a stored +everything would need a sync job on every space creation, and its one failure mode is silently omitting a space. SpaceFilter distinguishes All from an empty member list, because a freshly created project has no members and must mean selects-nothing. Collapsing the two would make every new project silently match the whole corpus.
refactor: move the reconciler's two deletes down to the layers that own them The reconciler reached past its layer twice, because the primitives it needed did not exist: a raw DELETE FROM proposal — the only SQL written outside db/ — and a go-git RemoveReference under gitx's write lock. Both move down, with no change in behaviour. db.Store.DeleteOpenProposal keeps the guard in the statement, as resolveProposal does, and distinguishes the two ways it can bite: a row that is gone is ErrNotFound, a row that has been resolved is the new ErrProposalNotOpen, which tells the reconciler "nothing to repair" apart from "the repair no longer applies". gitx.Repo.DeleteProposalBranch refuses anything outside proposals/* — the only thing between a caller bug and a deleted approved branch — takes the per-space write lock like every other write, and treats an already-absent branch as success: the repair is a postcondition, and the ref may legitimately vanish between the listing that found it and the delete.
feat: service — wiring, space lifecycle, read paths, push validation, reconciler Phase 1 of the implementation plan: the orchestration layer's read, validate and repair halves. The write plane (propose/merge) is Phase 3 and is absent. - Config/New assemble a Service from the shared config.ini, reporting every missing key in one message; TokenStore adapts db/ to authn.TokenStore, mapping db.ErrNotFound onto authn.ErrUnknownToken so an unknown credential is a 401 rather than a 503. - CreateSpace writes the repository first and the row second, removing the repository again if the insert fails; a crash between the two leaves content that is merely unlisted rather than a phantom space. - ReadDocument/ListDocuments/Policy/ResolveRev resolve the approved head or a pinned revision through one code path. - ValidatePush checks the refs rule first and unconditionally, then frontmatter and document-id uniqueness, which --push-option=skip-validation waives. The rejection is a structured, terminal-shaped message naming the document. - PlanRepairs is the repair table as a pure, table-tested function; Reconcile gathers the facts and applies them, listing stale-index spaces for Phase 2. Two departures from the design's repair table, both to stop the reconciler destroying live state, documented at their definitions: an open row with no branch is left alone inside a grace window (every propose passes through that state), and a branch still sitting on its recorded base is never treated as merged (its tip is trivially an ancestor of the approved head).