-
server: refuse git over HTTPS for suspended and deactivated accounts
-
Pin the status every workflow test was only asserting the shape of
-
Drop libgit2: the server now links no GPL code
-
Give the CLI the repo and key verbs, and stop publishing on push
-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
security: seal git-push CSRF, close 7z/RAR polyglot evasion, exhaustive sanitizer allowlists
-
Add git personal-access-tokens for HTTPS clone and push
-
Reconcile git HTTP read access with SSH (honor collaborators)
-
Stream git clone packfile and gate clone concurrency