gitoria

27.2 KB

1. # gitoria.worldapi.org — status
3. ## Built
5. - **072 (2026-10-02): re-vendored hybriel master 190aa11d — ADOPTED** (fc838894 GC correctness, 04df4428 #127 mountKids by
6. reference, #126, #48). Old copy `.scratch/pre-072/` (ff51cf46). Not deployed by me (conductor deploys).
7. - Gates (ports 8720–8729): browser **200/0**, push **46/0**, ssh **44/0** (`.scratch/w072/gate-*.txt`); commands in the 072 report.
8. - #48 (new for gitoria): `probe48.hl` → new `copy: 0`, old `copy: 1`; `lambdas*.py` re-run, no `.hl` change since the 069
9. audit → nothing needs `&`.
10. - Real-data copy (deleted): tracker `/` via curl, 20 loads: 0.54–0.61 s, RSS 232 MB boot → 298 after load 1 → 319 MB at load 20 / 10 s
11. idle (flat). Old: 8.9 → 16.1 s over 8 loads, 4.7–6.2 GB. Page body identical old vs new (only css hash + client script differ).
12. - Chrome memtest, signed in, 200 loads incl. tracker `/` + `/code`, 20 clones: 225 → 321 → 343 MB, avg 1951 ms. Without the
13. tracker pages: 224 → 268 → 315 MB, avg 671 ms (069 old: 760 → 7448 → 7757 MB, avg 1736 ms).
14. - **Open (pre-existing, also on old)**: in Chrome, tracker `/code` takes ~13 s from the 2nd load on (1st 0.7 s), gitoria
15. `/code` up to 6.9 s; server answers `/code` in 0.04 s via curl and RSS doesn't move → browser-side (client/service worker?).
16. Series: `.scratch/w072/mem-{new,old}-tracker.txt`.
17. - **069 round 2 (2026-10-02): master 1a096ad3 (with #127 d98926c6) NOT adopted either, old vendor ff51cf46 kept**.
18. - Gates on new: browser **200/0** (was 198/1 once, see below), push **46/0**, ssh **44/0**.
19. - Repro `.scratch/w069/repro`, flat and child variants: now flat at 0.3–0.6 GB, 2.5 s per request (old 3.7–4.6 s, 3–8 GB).
20. - **Still growing: gitoria's Markdown component** on the tracker README.
21. - App, curl: +190 MB per load, 7.5 s → 14.6 s by load 30, 7.4 GB, nothing freed after 60 s idle. Old: 9 → 16 s, 7 GB.
22. - Repro with only components/markdown.hl (`cp components/big-md.hl components/big.hl; ./run.sh <bin> <plugins> 8`): new
23. +185 MB per request, 7.2 → 8.5 s. Old 9.6 → 11.9 s.
24. - Chrome memtest without the tracker pages: new 227 → 2967 → 3106 MB, average 1267 ms; old 760 → 7448 → 7757 MB, 1736 ms.
25. With the tracker pages it ran over 580 s.
26. - Faster and smaller than old, but not flat, so not adopted (the condition was "≤ old speed and flat").
27. New vendor: `.scratch/w069/vendor-1a096ad3/`.
28. - **Gate fix**: browser.mjs waits until the server has the logout before it restarts the server. Once, the logout emit was cut
29. off by `stopServer()` ("browsers: no console errors" red). New check: "logout: the server has it too". 200/0 on old and new.
30. - **Re-vendor to hybriel master 8efba065 (#126 memory, #48 lambda copy) STOPPED, old vendor kept (antcolony mission 069,
31. 2026-10-02)**: gates were green on the new binary (ports 8760–8769; 8765/8766 are taken by others, so Chrome gets 8763–8769
32. and Firefox 8769 — Firefox is closed before the 5th Chrome opens): browser.mjs **199/0**, push.mjs **46/0**, ssh.mjs **44/0**
33. (`.scratch/w069/gate-*.txt`). Lambda audit (#48, 221 lambdas, `.scratch/w069/lambdas*.py`): nothing needs `&`. No lambda
34. writes to a parameter; session writes are in faces or call `server.sessions.save(s)` themselves; `withMerge`/`withRefParts`/
35. `withPullParts` return their result (probe `.scratch/w069/probe48.hl`). **Stopped at the memory proof**: real-data copy, 200
36. signed-in Chrome loads (`.scratch/w069/memtest.mjs`):
37. - Without the tracker pages: new 398 MB at boot → 3508 MB after the loads → 3581 MB after 20 clones; old 760 → 7448 → 7757 MB.
38. The README on gitoria `/` takes up to 17 s on new vs 8.7 s on old.
39. - With tracker `/` and `/code` (104 KB README → 2.3 MB HTML): new 12 s on the 1st load, 47 s on the 17th, +350 MB per load
40. (`curlloop.sh`), and Chrome times out at load #28. Old: 9–14 s per load, 4.6–6.6 GB.
41. Repro without gitoria: `.scratch/w069/repro/run.sh <bin> <plugins> N`. 40k text nodes: new 9–10 s and 0.5–0.8 GB; old 3.3–4.3 s
42. and 7.4–8.3 GB. The same rows passed to a child component: new 15 → 23 s and +40 MB per request; old 3.7–6.9 s.
43. New vendor ready to re-apply: `.scratch/w069/vendor-8efba065/{bin,plugins}`.
44. - **Re-vendor to hybriel master ff51cf46 (antcolony mission 048, 2026-10-01)**: binary + plugins copied (old copy `.scratch/pre-048/`
45. = 317d4754 bin/plugins + the pre-048 tests/). Gates on ports 8750–8758: browser.mjs **199/0** (twice), push.mjs **46/0**,
46. ssh.mjs **44/0** (outputs `.scratch/048-*.out`). Found + fixed:
47. - **Rows listed twice** (tokens, SSH keys): since hybriel 64527baa a face taking `session` syncs the session-derived members
48. (`tokens`, `keyItems`) in its ack, so `makeToken`/`makeKey` prepended a row the list already had (ssh gate: 2 `li` with the
49. same id; old binary 44/0, new one red — checked by swapping bin/plugins back). `components/tokens.hl`, `sshkeys.hl`: skip a
50. row with the new id. push.mjs: new check "the first token is listed ONCE".
51. - push.mjs + ssh.mjs still expected the pre-gitoria#20 "add code" `<details>` on every repo page (were red on the old binary
52. too, never re-run after #20): now the box on the empty repo's `/code`, plain text; none on Readme / `/code` after a push.
53. - browser.mjs tickets: the server pushes `ticketOpened` before the face answers, so the list row can come before the notice
54. (failed once) — the check now waits for `#ticketnotice`.
55. Duplicate `@id`s in the LIVE data (copy of Byrodin `storage/mpackdb`, deleted after): repos 13 rows / 0 dup, sshkeys 1/0,
56. tokens 1/0, users 1/0, ticketlinks 0/0. Workarounds: none of #115/#116/#118 kind in gitoria (component helpers are plain
57. lambdas already, no literal-list loops); no SVG built in the browser. Kept: `.nomerge` class (if-in-for), netProbe, temp
58. files + `sh -c`, `base64 -d`. `short-id-switch.mjs` not run (fixed ports 8724/8725, one-off migration gate). Not deployed.
59. - **Installable app (PWA) + icons (antcolony mission 046, 2026-10-01)**: `icons/` (`icon.svg` source = a git branch in blue
60. `#569bd4` on rgb(25,30,35), inside the maskable safe zone → `icon-192.png`, `icon-512.png`, `apple-touch-icon.png` 180;
61. `favicon.svg`, `favicon.ico` 16/32/48 — commands in README "PWA"). `project.hl`: `appIcons` (192/512 × any/maskable),
62. `appTouchIcon`, `appFavicon`, `appThemeColor = darker.value` (header), `appBackgroundColor = dark.value`,
63. `offline = [ Index ]`, file routes for the icons, `/favicon.ico` now a real file (was `direct = ""`).
64. `components/main.hl`: offline note + `netProbe` tick (as tracker#10); `styles.hl`: `offlineNote`, `netProbe`,
65. `@keyframes gitoria-net-tick`. Gate +15 checks at the end (see README "Test", PWA block): **199 passed, 0 failed**
66. (`GITORIA_GATE_PORT=8720 GITORIA_GATE_IDENT_PORT=8721 GITORIA_GATE_TICKETS_PORT=8722 GITORIA_GATE_CHROME=8723-8727
67. GITORIA_GATE_FIREFOX=8728 node tests/browser.mjs`). Looked at: Loreana `/tmp/w046-gitoria/` (`icon-48/192/512.png`,
68. `maskable-circle.png`, `small-on-white.png`, `sheet.png`, `gate-pwa-phone-{online,offline}.png`).
69. Offline `/` is the page AS LAST SEEN (repo list / Readme — possibly stale, and the logged-in view if that was the last
70. visit); offline the header's ident selector still shows "choose ident" (script from ident's origin). Real-phone install
71. test after deploy: https://gitoria.worldapi.org → "Add to home screen". Not deployed.
72. - **"Add code" only on the Code page of an empty repo (gitoria#20, 2026-09-27)**: the help was a `<details>` open by
73. default on every repo tab; the creator wants it plain text (no toggle) and only where it makes sense — the Code page,
74. while the repo has no commits yet. `components/repohead.hl`: new `onCodePage` (default `false`, only `code.hl` sets it
75. `true`); `showAddCode = onCodePage && emptyRepo`; the `<details>/<summary>` is gone, `addCode` is now the outer box
76. (`id="addcode"`) rendered only when `showAddCode`. `styles.hl`: dropped the `summary` rule. `components/readme.hl`'s
77. "no README.md yet" message now links to the Code page instead of "the box above" (which no longer stands there);
78. `git.hl`'s two "no commits yet" messages (shared by `/code`, `/branch`, `/commit`) point to the Code page the same way.
79. `tests/browser.mjs`: 12 new checks — an empty repo (gamma) shows the plain-text box only on `/code`, not on Readme /
80. Pull requests / Releases / Tickets / Settings; a filled repo (alpha, has commits) shows it nowhere. **184 passed, 0
81. failed** (was 172; ports 8700–8703 server/ident/tickets/Firefox, 8704–8709 Chrome). Not deployed.
82. - **Tickets with projects and roles (gitoria#19, 2026-09-26)**: tickets #20 no longer makes a project with its first ticket and needs the role edit. `tickets.hl` `ensureProject`: before the first ticket of a repo gitoria creates the project (`POST /api/projects`, slug = title = `<slug>.<host>`); the creator is its admin (includes edit), so gitoria's user is a member. Existing projects are left as they are. `tests/browser.mjs` seeds its own direct ticket the same way: **157 passed, 0 failed** against the current tickets code (ports 8710–8713). Until the connect flow (tickets#21 → gitoria#18).
84. - **Short ids (antcolony mission 039, ident#23, 2026-09-26)**: `users.hl`: the exchange answer is checked with the new `isIdentId` (lower-case letters/digits, 1–64) instead of
85. `isHex(…, 64)`, which refused ident#23's short ids (`a68sz`) — without it nobody could log in after the switch (shown on
86. tickets, whose code antcolony mission 039 could not change). New `tools/migrate-short-ids.hl` (users.identity old → short id via
87. ident `POST /api/migrate-ids`, idempotent, never `finish`, prints `users seen / mapped / already short / unmapped /
88. conflicts / failed`, key/secret from env only; non-zero exit on refusal/failed write/conflict). New gate
89. `node tests/short-id-switch.mjs` (ports 8724/8725; old ident `ident.worldapi.org/.scratch/pre-023-ident` → data → copies →
90. new ident → control copy = NEW empty user → tool twice → same user + same data, old session too): **18 passed, 0 failed**.
91. `tests/browser.mjs` 157/0 — with `GITORIA_GATE_TICKETS_DIR` = a tickets copy that has the same users.hl change
92. (tickets' own folder still refuses short ids: the gate's tickets login fails 400, gate crashes and LEAVES its tickets process on
93. the tickets port — kill it); push.mjs 46/0, ssh.mjs 44/0 (ports 8728-8739).
94. Runbook (architect, one go for all four apps): Loreana `antcolony-docs/docs/short-id-switch.md`. Deploy this code BEFORE
95. ident#23 (accepts old ids too). Not deployed.
96. - **Re-vendor to hybriel master 317d4754** (mission 038, 2026-09-26; includes 7cb9f8fc = hybriel#107 fix): copy binary + plugins
97. (no local patch; old copy `.scratch/pre-038/` = 13ef4f9b). Gate change re-applied from 037: the logged-in folder step in
98. `tests/browser.mjs` (`loggedSteps`, used by Chrome AND Firefox) waits for `#crumbs a` instead of `#crumbs strong` (which /code
99. already has, so the step passed with /code/src still in flight). Gates (ports as below): browser.mjs **157/0** twice (both runs
100. incl. `FIREFOX, navigation LOGGED IN` ok — #107 does not reproduce), push.mjs **46/0**, ssh.mjs **44/0**; outputs
101. `.scratch/038-{browser-1,browser-2,push,ssh}.out`. Dev server (port 8726, scratch storage): `app.css`, `hl-runtime.js`,
102. `web/client.js` `?v=5ceedf0b9850f8c7`, hashed app.css → `immutable`, bare → `no-cache`. Not deployed.
103. - **Re-vendor to hybriel master e6720b1f** (antcolony mission 037, 2026-09-26; ROLLED BACK, superseded by 038): copy binary + plugins (no local patch; old copy
104. `.scratch/pre-037/`). Gates (ports as below): browser.mjs **157/0** (2 runs, incl. Firefox), push.mjs **46/0**, ssh.mjs **44/0**.
105. Dev server: `hl-runtime.js`, `web/client.js`, `app.css` `?v=c7398714992bf1de` (immutable), bare app.css no-cache, 0 unhashed refs.
106. One gate change: the logged-in navigation step into a folder waited for `#crumbs strong`, which /code already has → the step
107. passed with the page emit for /code/src still in flight; the next `ff.goto(gamma)` then failed with NS_BINDING_ABORTED
108. (reproducible 2/2; 157/0 on 13ef4f9b). Now it waits for `#crumbs a` (only inside a folder). The cause is a HYBRIEL bug
109. (new client `lost()`, #82): Firefox closes the page's WebSocket when a navigation away starts; `lost()` answers the
110. in-flight `page` emit with null, and `showOne` then does `location.href = path` — a full load of the in-app page that
111. cancels the navigation the user started (traced with WebDriver BiDi: navigationStarted gamma → warn "the socket closed before
112. an emit was answered" 44 ms later → navigationStarted alpha/code/src). Reported to the architect for a hybriel ticket. Not deployed.
113. - **Re-vendor to hybriel master 13ef4f9b** (antcolony mission 035, 2026-09-25): copy binary + plugins (no local patch). Consequence of #89
114. (chunked request bodies): the push gate's "direct chunked push → 411" check failed (the push now works) → dropped the 411
115. branch in `transport.hl`, the check now pushes a 4 MB commit straight to hl:http1 (`http.postBuffer=65536`, chunked) and
116. expects it in the bare repo. Kept: temp files + `sh -c`, `base64 -d` (reasons in README "Behind nginx"). Gates (ports
117. `GITORIA_GATE_PORT=8720 GITORIA_GATE_IDENT_PORT=8721 GITORIA_GATE_TICKETS_PORT=8722 GITORIA_GATE_PROXY=8722
118. GITORIA_GATE_SSH_PORT=8723 GITORIA_GATE_FIREFOX=8724 GITORIA_GATE_CHROME=8725-8739`): browser.mjs **157/0** (incl. Firefox),
119. push.mjs **46/0**, ssh.mjs **44/0**. Dev server serves `/__hl/app.css?v=<hash>` (immutable), bare → no-cache. Not deployed.
121. - **Merge button for pull requests** (gitoria#17, 2026-09-25): on `/pulls` the repo owner (only) sees "Merge" on an open request whose source and target
122. branches exist; the click (face `gitoriaMergePull` in `components/pulls.hl`, `git.hl mergePullNow`) merges the source into the target IN the bare repo:
123. `merge-tree --write-tree` → `commit-tree` (merge commit, author = the owner's name) → `update-ref` with the old value (a push meanwhile = no merge).
124. A conflict merges nothing and the page names the files. Never automatic (creator, gitoria#13). The request is found again on the server by its commit sha.
125. Gate `node tests/browser.mjs`: **157 checks green** (buttons only for the owner on open requests, forged session, conflict → nothing merged, merge
126. commit with two parents, request shows merged). Not deployed. Found: an `if` inside a `for` row is not re-evaluated when the list is reassigned
127. (the button stayed) — the button is always rendered and hidden with a class (`.nomerge`). Not built: squash / rebase, closing a request without merging.
129. - **Push and pull over SSH** (gitoria#7, 2026-09-25, second worker): `docker/sshd` (sshd container: `AuthorizedKeysCommand` → app, forced command `gitoria-shell`, host keys volume),
130. `sshkeys.hl` + `components/sshkeys.hl` (SSH keys page: paste public key, `ssh-keygen -l` check, list, remove), `sshgate.hl` (`/__git/keys`, `/__git/access`, secret + no proxy),
131. ssh commands in the "add code" box (`repohead.hl`), service `gitoria-sshd` in `docker-compose.yml`, `openssh-client` in the Dockerfile. Gate `node tests/ssh.mjs`: **44 checks green**
132. with the real sshd container + real ssh/git (needs docker); `push.mjs` 46 and `browser.mjs` 149 still green. Not deployed. **Deploy needs** (README "Git over SSH"): `GITORIA_SSH_SECRET`
133. in `.env`, firewall port (2222), DNS-only record for the ssh host (Cloudflare proxy carries no ssh), rebuild both images. SSH is hidden on the site until the secret is set.
134. Not built (not decided): private repos, collaborators, protected branches, size limits.
136. - **Push and pull over HTTPS + "Add code" box** (gitoria#7, 2026-09-25): `transport.hl` (smart-HTTP clone/fetch/push with `git upload-pack|receive-pack
137. --stateless-rpc`, body via temp files, protocol v0/v1/v2, gzip requests), `tokens.hl` + `components/tokens.hl` (access tokens: shown once, sha256 stored,
138. list/remove, on the main address), the box in `components/repohead.hl` (clone command, new/existing-project commands, open while the repo is empty),
139. `git.hl isEmptyNow`, routes in `project.hl`, `styles.hl`. Read is public; only the owner's token may push. Gate `node tests/push.mjs`: **46 checks
140. green** (real git: clone empty, push refused without / with wrong / another user's token, owner pushes a 4 MB pack, clone, gzip fetch with 300 local commits,
141. pull, v0/v2, removed token stops at once, odd requests, layout 390/1280); `node tests/browser.mjs` still 149 green. Not deployed. **SSH: see the next entry.** Not built: collaborators / private repos / protected branches (not decided), SSH keys page.
142. Deploy needs: nginx `client_max_body_size` (500m) and default request buffering on the `*.gitoria` vhost (README "Push and pull"); the Dockerfile has git, gzip, base64 (debian).
143. Found: hl:http1 gives `body = null` for a chunked request (hence the proxy note); hybriel has no base64 decoder (the Basic header is decoded with `base64 -d`).
145. - **Every repo view its own server-rendered page** (gitoria#16, mission 001 (old 033), 2026-09-25): `components/index.hl` (`/`: list.hl on the
146. main address, readme.hl on a repo address), `code.hl` / `branch.hl` / `commit.hl` (+ `codebrowser.hl`), `pulls.hl`, `releases.hl`,
147. `tickets.hl`, `repohead.hl`, `loginfailed.hl` (was `htmlPage`). The repo comes from `host = null` (hybriel#74), git is read with
148. hl:proc `run()` (hybriel#80, `git.hl` `*Now`): README, file list/file, branch, commit, pulls, releases and tickets are in the FIRST
149. HTML, no "Loading". Gone: `components/home.hl`, `/host.js` (+ route), the hidden #hostslug/#loading inputs, `gitoriaOpen`,
150. `gitoriaDocs/Code/Pulls/Releases` and their pushed answers; `?next=` moved into `login.js`. The rest of `/code/*path` etc. is the
151. page member `path` (hybriel#81). Gate `node tests/browser.mjs`: **149 checks green**, incl. hybriel#43 (a code view in another tab
152. keeps its elements through a login + logout) and NAVIGATION LOGGED IN in Chrome AND a real Firefox 155 (`tests/firefox.mjs`, BiDi):
153. button login on a repo address, Readme → Code → Releases → Pulls → Tickets → Code → folder, an empty owned repo, and (Chrome) with
154. the socket closed — no full page load anywhere. Not deployed.
155. **Open — the creator's full page loads in Firefox 155 are NOT reproduced**: locally logged in (Chrome + Firefox) and on the LIVE site
156. signed out (Firefox, h3 via Cloudflare, also with the socket closed) the marker survives. Not tested: live + logged in (it would
157. write a user into live data). Found on the way: hl:web never reconnects a closed WebSocket (`client.hl` `close` → `socket = null`,
158. no retry): after Cloudflare's ~100 s idle close every emit rides POST and live pushes (new repo, new ticket, login in another tab)
159. no longer arrive — a hybriel ticket candidate.
160. - **Hybriel re-vendored from master 2fbfe195** (mission 001 (old 033); edf27bc1 → 6ae171af → 2fbfe195): binary sha256 `2a3c2b02…b565`
161. (ReleaseFast from `git archive`), plugins core crypto data fetch fs http http1 mpackdb proc time **web** (every import `'hl:web'`).
162. Older copies in `.scratch/pre-033/`, `pre-033b/`, `pre-033d/`. **No local patch left**: the cookie Domain is `sessionDomain`
163. (#44) in project.hl. Dropped earlier: patches for #34/#39, HL_HOST listener (#24), `server.sessions.cookie` (#10), `realSession()`
164. (#16), URL encoders (#14), `sessions.resolve` in the callback (#11). Master refuses `if (!x)` in a View → `noSource` for pulls.
166. - **Identity selector** (gitoria#14, 2026-09-25): ident's `<ident-selector>` in the header beside "Log in with ident", like tickets
167. (`components/main.hl` face `gitoriaLogin`, `login.js`, `users.hl selectorScript`, `styles.hl`, route `/login.js`). Gate `node tests/browser.mjs`:
168. 122 checks green (choose identity → logged in without reload, logout resets it, hidden on a repo address, button unchanged). The gate now
169. serves ident as `ident.gitoria.test` (same site as gitoria.test, else ident's Lax cookie never reaches the selector's fetch). Not deployed.
171. - **Releases from commit messages** (gitoria#12, 2026-09-25): `/releases` of a repo address lists them (`git.hl` `parseRelease`, `releases`,
172. `components/home.hl`, face `gitoriaReleases`, pushed `releasesReady`). Gate `node tests/browser.mjs`: 116 checks green (patch / `med` / `mj` /
173. by-hand versions counted up, newest first, marker inside text / bad version / repeated version / other branch ignored, HTML as text,
174. empty repo, forged face, 390/1280px). Not deployed. Not built: real git tags, downloadable archives, release notes page, API.
176. - **Pull requests from commit messages** (gitoria#11, 2026-09-24): `/pulls` of a repo address lists them (`git.hl` `parsePull`, `pulls`,
177. `components/home.hl`, face `gitoriaPulls`, pushed `pullsReady`). Gate `node tests/browser.mjs`: 108 checks green (marker parsing,
178. target `|||PR|branch] `, merged vs open, missing target, one per source branch, HTML as text, empty repo, forged face, 390/1280px).
179. Not deployed. Not built: merging in gitoria (open question to the creator), a PR page with diff/comments, PR numbers, API, a settings page
180. for the default target (the repo's main branch is used).
182. - **Connect a repo to a tickets project; #N links** (gitoria#18, 2026-09-26): `/settings` "Tickets: connect" (tickets' connect flow, key per repo),
183. `/tickets` and open-ticket use the key + the user's ident id, `#N` links in commits / pull requests, "mentioned in commit" comments and
184. "fixes #N" → review on push / merge (`tickets.hl`, `components/settings.hl`, `project.hl` /settings/connect(ed)).
185. Gate `node tests/browser.mjs` (ports 8700-8708; `GITORIA_GATE_FIREFOX=8708 GITORIA_GATE_CHROME=8703-8707`): **172 passed, 0 failed** against
186. a real tickets copy: the owner connects (button → tickets' project choice → back), opens a ticket (created by the person); a REAL git push
187. over HTTP with "fix login, #1" → ticket 1 shows "Mentioned in commit …" (once); a merged `|||PR … fixes #1` pushed → ticket 1 in review
188. (once); #N links on the commit page and /pulls; forget + connect again; a replaced tickets copy. `tests/ticketskit.mjs` takes `origins`
189. (TICKETS_CONNECT_ORIGINS) and returns the session cookie; the token flow is gone from the gate. Fixed on the way: the Merge click built the
190. ticket-link pieces in the browser (tickets.hl reads the environment, so the list stayed stale); the face now sends them. Decided: #99 (a
191. ticket that does not exist) is still a link. Not deployed.
193. - **Tickets inside a repo** (gitoria#10, 2026-09-24): `/tickets` of a repo address lists the tickets of its project in tickets.worldapi.org
194. (`<slug>.<host>`), any named user opens one (gitoria's own API token; the text says who), the first ticket creates the project there.
195. `tickets.hl`, `components/home.hl`, `git.hl parseView`, `tests/ticketskit.mjs`. Gate `node tests/browser.mjs`: 99 checks green (own tickets
196. copy: 404 → first ticket creates the project, text as text, live to another viewer, ticket made in tickets shows on reload, forged
197. session refused, tickets down message, 390/1280px). Not deployed: needs `GITORIA_TICKETS_TOKEN` in `.env` (README "Tickets").
198. Not built: ticket text/comments inside gitoria, real author in tickets (tickets has no act-on-behalf).
200. - **Browse code** (gitoria#9, 2026-09-24): `/code`, `/branch/<name>`, `/commit/<id>` (+ a path), `git.hl` `browse`, `components/home.hl`, `host.js`,
201. `repos.hl` (`branch` field, `setMainBranch`), routes in `project.hl`. Gate `node tests/browser.mjs`: 79 checks green (main branch tree,
202. folder/file/crumbs, old commit incl. short id, branch with a slash, binary file, unknown branch/commit/path messages, empty repo,
203. "Make main" for the owner only, homepage follows the setting, 390/1280px). Not deployed. Not built: API / Markdown read view of code,
204. commit diff, syntax highlighting. Found: hl:proc lines cannot carry non-UTF-8 bytes (breaks the socket) — files are checked with
205. `git grep` first; a non-UTF-8 author name / branch name is not handled.
207. - **Repo homepage from README and $docs** (gitoria#8, 2026-09-24): `git.hl`, `markdown.hl`, `components/markdown.hl`, `components/home.hl`;
208. repo creation makes a bare git repo. Gate `node tests/browser.mjs`: 54 checks green (README as HTML incl. table/quote/rule/code,
209. unsafe HTML and `javascript:` links stay text, `$docs` replaces README, empty repo message, 390/1280px). Not deployed:
210. the Dockerfile now installs `git`; repos created before this have no bare repo yet (they show "no README.md yet").
211. Not built: Markdown read view of the homepage in the API, images in Markdown, per-repo branch setting (#9).
213. - **Repos with their own address** (gitoria#6, 2026-09-24): the app (`project.hl`, `components/`, `repos.hl`, `users.hl`),
214. README "How a repo gets its address". Gate `node tests/browser.mjs`: 46 checks green (create, refusals, unique slug, live
215. list, `<slug>.gitoria.test` pages, login from a repo address, shared cookie, restart, 390/1280px). Not deployed.
216. Not built: git data (#7), homepage (#8), code browsing (#9), tickets (#10), pulls (#11), releases (#12), API creation, settings.
218. ## Research done
220. - [`docs/differ-from-custom-ide.md`](docs/differ-from-custom-ide.md) — gitoria#2: whether to reuse
221. custom-ide's diff/editor (CodeJar-based) as a Hybriel component. Verdict: the diff **algorithm**
222. (`lineDiff.js`, pure, no DOM) is directly reusable as a native Hybriel module; the CodeJar-based
223. editing **surface** is real engineering (~3,400 LOC total, not "simple") and a native rewrite is blocked on
224. open webex tickets (hybriel#31/#32/#33/#17/#41). Final plan (see Decision below): native Hybriel only,
225. no JS-asset interim.
227. - [`docs/git-backend.md`](docs/git-backend.md) — gitoria#5: how to use git from Hybriel. Verdict: the `git`
228. binary, no `hl:git` library plugin (libgit2 has no server side). Reads via `hl:proc`; HTTPS clone/push
229. served by Hybriel itself (`git upload-pack|receive-pack --stateless-rpc` through hl:proc stdin/binary, after
230. hybriel#42); only SSH needs a small sshd container. Tested: byte-exact blobs, upload-pack over stdin, hl:http1
231. byte-safe bodies. Full endpoint (#7) and SSH not run.
233. ## Decision (gitoria#4, rejected 2026-09-24)
235. Embedding custom-ide's JS bundle is **not** wanted. Editor and differ are built natively in Hybriel as
236. shared components in layouts.worldapi.org (as ticket #2 said). Not started: the native port; the editing
237. surface is blocked on hybriel#31/#32/#33/#17.
239. Note: `DECISIONS.md` is generated by the librarian and still says "no decisions recorded yet"; it does not yet hold this decision.
241. - **How to get code in, said where the creator looks** (gitoria#8 sent back 2026-09-25: "no description how i get a repo in at the /code page"): the "Add code to this repository" box (gitoria#7, `repohead.hl`, open while the repo is empty) was built but not yet deployed when the creator tested. The empty messages of the Readme and Code views now point to it (`components/readme.hl`, `git.hl`). Gate `node tests/browser.mjs`: 149 green. Needs the gitoria#7 deploy.
243. ## 2026-09-26 antcolony mission 037 rolled back
244. The re-vendor to hybriel master e6720b1f was ROLLED BACK (bin/ plugins/ tests/browser.mjs from .scratch/pre-037): the new client pulls Firefox users back during a navigation (hybriel#107). gitoria stays on 13ef4f9b until #107 is fixed; then re-vendor and use the stricter code-browser check (#crumbs a) from antcolony mission 037.
245. **Done in mission 038** (see Built): master 317d4754 with the #107 fix, stricter check applied, all gates green.