| 1 | # Steid |
| 2 | |
| 3 | The source of truth for everything in a developer's or organization's portfolio. |
| 4 | |
| 5 | ## Vision |
| 6 | |
| 7 | Steid is a developer/org identity and portfolio platform. It's where you host your |
| 8 | code, your writing, your projects — everything you do, in one place, under your |
| 9 | control. |
| 10 | |
| 11 | Git repos are a core feature, not the whole product. Blogs, documentation, project |
| 12 | showcases, and anything else a dev or org wants to present lives here too. |
| 13 | |
| 14 | Personal-first, but organizations can collaborate on it. |
| 15 | |
| 16 | A managed offering — Steid instances hosted for companies and individuals — is |
| 17 | planned, but lives entirely in its own repo (`../steid-control-plane`, decision 0001 |
| 18 | there). The constraint it places here: Steid stays single-tenant, never learns it is |
| 19 | managed, and everything an operator does must eventually be drivable headlessly. |
| 20 | |
| 21 | **What makes it different from Gitea/Forgejo:** those are GitHub clones scaled down. |
| 22 | Steid is portfolio-first — the profile page is the product, and repos are one kind of |
| 23 | thing that appears on it. That framing should win any tie-break. |
| 24 | |
| 25 | ## Core Principles |
| 26 | |
| 27 | - **Fast** — Rust, minimal overhead |
| 28 | - **Reliable** — correct first, then optimize |
| 29 | - **Personal-first** — great for a single dev, scales to orgs |
| 30 | - **Identity-centric** — everything is built around who you are (user/org); auth is |
| 31 | designed in from day one, not bolted on |
| 32 | |
| 33 | ## Stack |
| 34 | |
| 35 | Starting intent, not settled decisions. Each one gets a record in |
| 36 | [decisions/](decisions/) when it's actually made and confirmed in this build. |
| 37 | |
| 38 | | Concern | Choice | Decision | |
| 39 | |---|---|---| |
| 40 | | Web framework | Topcoat (tokio-rs) | — | |
| 41 | | Git transport | smart HTTP via `git http-backend` | [0001](decisions/0001-git-over-http-not-ssh.md) | |
| 42 | | Git auth | personal access tokens over HTTP Basic | [0001](decisions/0001-git-over-http-not-ssh.md) | |
| 43 | | Git operations | the `git` binary, behind narrow ports | [0006](decisions/0006-git-binary-behind-narrow-ports.md) | |
| 44 | | Crate layout | single crate | — | |
| 45 | | Ownership | personal org owns repos | — | |
| 46 | | URLs | root handles, grouped routes | [0004](decisions/0004-root-handles-grouped-routes.md) | |
| 47 | | Database | SQLite via sqlx | — | |
| 48 | |
| 49 | Architecture and conventions: [architecture.md](architecture.md). |
| 50 | |
| 51 | ## Milestone Ladder |
| 52 | |
| 53 | A from-scratch rebuild on Topcoat. Much of this was built and verified end-to-end in a |
| 54 | previous attempt — see [progress.md](progress.md). Treat that code as reference, not as |
| 55 | a baseline. |
| 56 | |
| 57 | | # | Milestone | Status | |
| 58 | |---|---|---| |
| 59 | | 0 | **Skeleton** — Topcoat app boots, config, one page, SQLite wired | done | |
| 60 | | 1 | **Identity, thin** — claim on first run, login, session | done | |
| 61 | | 2 | **Profile page** — `/{handle}` as the real profile | done | |
| 62 | | 3 | **Repo model** — records + bare repos on disk | done | |
| 63 | | 4a | **Clone over HTTP** — `git http-backend`, public repos, no auth | done | |
| 64 | | 4b | **Push and tokens** — PATs over HTTP Basic, push, private clone | done | |
| 65 | | 5 | **Repo browsing** — tree, blob, commit log | done | |
| 66 | | 5b | **Deployable by anyone** — binary release, installer, TLS proxy | active | |
| 67 | | 6 | **Writing** — posts, markdown | not started | |
| 68 | | 7 | **Identity, full** — multi-user, orgs, invites, registration policy | not started | |
| 69 | | 8+ | Projects/showcases · issues & PRs · CI/CD · SSH transport · federation | not started | |
| 70 | |
| 71 | **CI/CD is a milestone, eventually, and it is 8+.** Push-to-release — a repository that |
| 72 | builds and publishes itself on push — is the obvious end state for a forge that already |
| 73 | receives pushes, and it is what "source code integration" means for anyone arriving from |
| 74 | GitHub. It needs receive-pack hooks, a job model, isolation to run untrusted code, and |
| 75 | somewhere to keep artefacts, so it is a milestone in its own right rather than a feature. |
| 76 | Recorded now because it was asked for; deliberately not scheduled. |
| 77 | |
| 78 | `/api` is not a milestone. It's a standing practice: every milestone that adds a use |
| 79 | case exposes it under `/api` where that makes sense. An API isn't a feature, it's a |
| 80 | second surface on work already being done — and having a third consumer keeps the use |
| 81 | case layer honest. |
| 82 | |
| 83 | ### Why this order |
| 84 | |
| 85 | The vision calls Steid portfolio-first, but every previous ladder put portfolio behind |
| 86 | four milestones of git plumbing. Across two attempts and ~6,000 lines, Steid has |
| 87 | shipped identity, repo records, clone, push, and key auth — and not one portfolio |
| 88 | feature. Attempt #2 ended with all the git infrastructure working and nothing that |
| 89 | distinguishes it from Gitea. |
| 90 | |
| 91 | The differentiator therefore shipped early: the profile page is milestone 2, not |
| 92 | milestone 6. Full multi-user identity stays deferred to 7 — personal-first means one |
| 93 | user, and there is nothing to collaborate on until there is something worth |
| 94 | collaborating on. |
| 95 | |
| 96 | **Git moved ahead of writing after milestone 2 shipped**, deliberately reversing the |
| 97 | original order. Two reasons. The profile has a Repositories section that a visitor |
| 98 | expects to be full, and a gitforge whose repo list is permanently empty is its own kind |
| 99 | of wrong. And git-over-HTTP is the least-understood work left — everything else is CRUD |
| 100 | over SQLite, while that is pack data streamed through a subprocess — so learning what |
| 101 | Topcoat makes awkward is worth more now than after three more features are stacked on |
| 102 | top. |
| 103 | |
| 104 | The risk being run knowingly: disappearing into protocol work is what ended both |
| 105 | previous attempts. Milestone 3 is deliberately small and ships something visible on the |
| 106 | profile; if milestone 4 starts to sprawl, that is the signal to bank it and go back to |
| 107 | writing. |
| 108 | |
| 109 | **Milestone 5b was inserted rather than renumbered.** Deployment became urgent the |
| 110 | moment Steid could host its own source: a gitforge nobody can install is a demo. It is |
| 111 | lettered rather than numbered for the same reason 4a/4b were — decisions |
| 112 | [0003](decisions/0003-scoped-urls.md) and [0004](decisions/0004-root-handles-grouped-routes.md) |
| 113 | both refer forward to "Milestone 7" meaning multi-user identity, and renumbering would |
| 114 | quietly falsify accepted records to save a table row. |
| 115 | |
| 116 | **Milestone 4 was split before it started**, acting on that warning rather than waiting |
| 117 | to be surprised by it. It bundled two subsystems — personal access tokens and the smart |
| 118 | HTTP protocol — and neither shipped anything until both were done. Split, 4a is |
| 119 | anonymous clone of a public repository with no authentication code at all, which is a |
| 120 | working `git clone` in one small milestone; 4b adds tokens, push, and private clone on |
| 121 | top. If 4b sprawls, 4a has already banked the capability. |
| 122 | |
| 123 | **One numbering scheme.** The previous attempt kept two (a roadmap ladder and a |
| 124 | separate build log with conflicting numbers) and they drifted apart within three |
| 125 | milestones. If the plan changes, edit this table — don't start a second list. |
| 126 | |
| 127 | The active milestone is broken into steps in [current.md](current.md). |