steid

fix: a shipped migration is immutable, comments included

build: release 0.5.0, the first the control plane can provision from

feat: a throttled search is counted, like every other refusal

docs: fold the search-limit handover into plans

docs: what wave 7's search limit and git-read cap decided, and left open

feat: a code search is rate limited, and says so as a page

fix: a plain git read is read through a cap too

docs: fold the composition-root handover into plans

docs: handover for the composition-root step

refactor: the boot sweeps move beside the wiring they run before

test: the first tests that speak HTTP

test: the operator's recovery path gets its first tests

refactor: the composition root and the subcommands move into the library

docs: fold the access handover into plans, and amend the Access section

docs: handover for the access/visibility refactor

docs: the milestone 7 shape, written where the change will happen

refactor: "the instance's owner" becomes a name, not a comparison

refactor: one body for "may this repository be seen"

docs: fold the migration-compat handover into plans

docs: deploy.sh names the one thing its rollback cannot undo

test: a migration the previous release cannot read fails the build

docs: the security review, its evidence, and what it left open

fix: a page is never kept by a cache that was not asked to keep it

fix: a request body is capped, because Topcoat's readers are not

fix: a repository search reads git's output through a cap

fix: an import clone follows no redirects either

fix: a webhook delivery follows no redirects, so the SSRF check cannot be walked past

fix: a reset token from a URL can no longer panic the worker that answers it

fix: the operator bearer token is redacted like every other secret

fix: the CSRF scan walks web/ recursively, so a module split cannot escape it

docs: a second organisation review, measured against the first

docs: the ops step is done, and where the ladder pauses

docs: record the CSRF decision, what it opened, and what it costs on restart

fix: a submission with no token at all is refused, not rejected as malformed

test: a scan that fails when a POST handler forgets the CSRF check

feat: signing out carries a CSRF token, and a refused sign-in answers 303

feat: the repository and account settings forms carry a CSRF token

feat: the pull request forms carry a CSRF token

feat: the issue forms carry a CSRF token

feat: the label forms carry a CSRF token

feat: the webhook forms carry a CSRF token

feat: the import forms carry a CSRF token

feat: the token settings forms carry a CSRF token

feat: a CSRF token bound to the session, and the pair that renders and checks it

fix: a refused claim answers 303, not 307

feat: one password rule, twelve characters, in one place

refactor: the repository owns its number sequence

refactor: the orgs/memberships/repos triple becomes one borrowed bundle

refactor: one access module for every authorization predicate

docs: the web guard and helper refactors, folded into plans