| | @@ -200,6 +200,38 @@ Ordered. Pull from the top. |
| 200 | 200 | single author, a stored-XSS hole the moment Milestone 7 adds a second user. A |
| 201 | 201 | repository's README rendering on its page falls out of the same pipeline. |
| 202 | 202 | |
| 203 | +### Forge feature candidates (surveyed 2026-09-05) |
| 204 | + |
| 205 | +Not yet ordered against Milestone 6. Grouped by what they touch, because the plan is to |
| 206 | +run several agents at once and the grouping is what decides what can run together. |
| 207 | +**Section 1 is being tackled first.** Shared hotspots: `GitQuery` in `port.rs` (every |
| 208 | +browsing feature appends a method), `git_query.rs`, the repo sub-nav, and `plans/` |
| 209 | +itself. New tables touch `sqlite.rs` + `in_memory.rs` and should merge one at a time. |
| 210 | + |
| 211 | +1. **Read-only browsing** (no DB; parallel-safe with each other): commit page with |
| 212 | + diff · branches and tags pages · compare view (merge-base) · archive download · |
| 213 | + syntax highlighting · blame · per-file last-commit column (blocked on the |
| 214 | + [0006](decisions/0006-git-binary-behind-narrow-ports.md) amendment: it is the trigger |
| 215 | + for a kept-alive `cat-file --batch`) · code search via `git grep`. |
| 216 | +2. **Repo model** (a column or use case each; merge serially): rename · default branch |
| 217 | + setting · archived flag · topics and pinned repos on the profile · orphan-directory |
| 218 | + reconciliation sweep on boot. |
| 219 | +3. **Collaboration** (8+): issues · pull requests (needs the commit and compare pages, |
| 220 | + plus a merge on the bare repo) · labels and milestones. |
| 221 | +4. **Transport and git ops**: import from URL (mirror clone) · post-receive events and |
| 222 | + webhooks (first brick of CI) · `REMOTE_USER` passthrough · LFS (not yet) · SSH |
| 223 | + (would reverse [0001](decisions/0001-git-over-http-not-ssh.md)). |
| 224 | +5. **Identity and auth**: token expiry and last-used · rate limiting on token auth · |
| 225 | + CSRF (touches every form — run alone) · Milestone 7 multi-user (run alone). |
| 226 | +6. **Portfolio**: posts (Milestone 6) · profile links · Atom feeds for posts and commits. |
| 227 | +7. **Platform and quality**: scheduled backups and served releases (closes 5b) · |
| 228 | + HTTP-level test harness plus security-header tests and `cargo audit` · `/api` |
| 229 | + coverage for existing use cases · styled auth pages, light mode, fonts. |
| 230 | + |
| 231 | +Process decisions still open for parallel work: whether agents get worktrees and |
| 232 | +short-lived branches (bending the commit-to-main rule), and that agents do **not** edit |
| 233 | +`plans/` — it is updated once per wave at merge time. |
| 234 | + |
| 203 | 235 | ## Open questions |
| 204 | 236 | |
| 205 | 237 | - **Topcoat is early** (v0.5.0, first released 2026-07-22, breaking changes expected |