vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Name branches after the account, and labels after the display

474a812d199a109ba894124cd6f26be12c73285d · Keenan Nemetz · 15d ago · parent ade6107e

Name branches after the account, and labels after the display

A contributor's folder was `refs/heads/contrib/<account-id>/`, which told a
reader nothing without decoding a ULID. It is now the account name,

    refs/heads/contrib/<name>/<branch>

and the name is therefore fixed at creation: renaming an account would strand
every ref under its old folder, so `vole admin user rename` is gone and the
users row itself — kept after retirement — is what stops a name being reissued.

What people see is now a separate, mutable display name, validated by the same
rules wherever it is set (CLI, remote admin, registration, `/account`) and shown
on pages, approvals, listings and refusals. Nothing is authorized by it and
nothing on disk is keyed by it: metadata authors stay account names because the
push boundary resolves them for ownership, and approvals stay account ids.

`user_names`, `Snapshot.Reserved` and `Account.Former` are dropped: with a fixed
name there are no former names to remember, and the UNIQUE column already does
the reserving. Opening an older roster adds the `display` column and drops the
alias table in place; contributor refs written under the old id namespace are
left where they are, readable, and landable by a maintainer.

docs/change-requests.md +9−6

@@ -15,11 +15,13 @@ requests/<ulid>/approvals/<account-id>.md # one approval per account
	15	15	## Opening and landing a request
	16	16
	17	17	A contributor opens a request from the web after pushing a branch under
	18		`refs/heads/contrib/<account-id>/`. The Open change request form on the
		18	`refs/heads/contrib/<name>/`. The Open change request form on the
	19	19	repository's change-request page lists their namespaced branches; the browser
	20	20	builds the request from the branch's current commit. A contributor cannot name an
	21		arbitrary commit or another account's branch. CI for that commit is held until a
	22		maintainer allows the exact tip from the repository page.
		21	arbitrary commit or another account's branch. The namespace is the account name,
		22	which is fixed at creation, so changing a display name never moves a branch. CI
		23	for that commit is held until a maintainer allows the exact tip from the
		24	repository page.
	23	25
	24	26	Maintainers can still use the CLI:
	25	27
@@ -60,9 +62,10 @@ signed-in account has maintain access. The approver is the session's account id,
	60	62	a name from the page.
	61	63
	62	64	An approval is stored at `approvals/<account-id>.md`. Only the account named in
	63		that path can create, change, or remove it. The `author` field on a request is for
	64		display and carries no authority. An admin can repair an approval, and the
	65		override is recorded in `data/audit.log`.
		65	that path can create, change, or remove it. `request.md` records the author's
		66	account name in `author` and their id in `author_id`; the page shows the author's
		67	display name, but neither field carries authority. An admin can repair an
		68	approval, and the override is recorded in `data/audit.log`.
	66	69
	67	70	The request page shows:
	68	71