vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Make change requests follow branches and allow base retargeting

e050e14a64f6f19c1b1478c4c073d690ef3d3129 · Keenan Nemetz · 13d ago · parent 59464445

Make change requests follow branches and allow base retargeting

A request opened from a branch now follows it: post-receive moves the
request's head to the new tip after an accepted push, so approvals and
checks that named the old tip stop counting. Approvals stay bound to an
exact base and commit; the approval writers now require the base and head
the approver saw, so a push or retarget cannot silently approve a target
nobody reviewed. Merged requests freeze the reviewed head.

Add `vole change update --base` and a Change base control for stacked
requests. A new base changes the diff and therefore invalidates approvals,
which is what retargeting an upper request after its lower branch lands
needs. Base names may now contain slashes.

Also fix a second-boundary flake in the landing test.

docs/architecture.md +9−5

@@ -32,9 +32,11 @@ change request from a branch the account may push, and approve a change request.
	32	32	An untrusted contributor's Git writes are confined to
	33	33	`refs/heads/contrib/<name>/`; the pre-receive gate enforces the namespace,
	34	34	and CI for that branch does not run until a maintainer allows the exact tip. They are built by the same metadata writers the CLI uses, so
	35		the file format and its validation do not fork. Everything else still changes by
	36		pushing over SSH. Approvals, comments, and CI results belong to the account the
	37		credential resolved to, never to a name typed into a form.
		35	the file format and its validation do not fork. A change request opened from a
		36	branch follows it: after an accepted push, the server records the new tip as the
		37	request's head, so approvals of the old tip stop counting. Everything else still
		38	changes by pushing over SSH. Approvals, comments, and CI results belong to the
		39	account the credential resolved to, never to a name typed into a form.
	38	40
	39	41	Vole does not require or check Git commit signatures. A signature would only
	40	42	repeat what the credential already established, and it cannot reliably prove who
@@ -83,8 +85,10 @@ runs/<run-id>/<attempt>/steps/<n>.md
	83	85	runs/<run-id>/<attempt>/artifacts/<name>
	84	86	```
	85	87
	86		People write the issue and request files. Vole writes the run records. All of it
	87		is checked when it is pushed.
		88	People write the issue and request files. Vole writes the run records and moves
		89	the head of a change request that follows a branch: post-receive derives the new
		90	head from the accepted ref and validates the request tree before committing it.
		91	Everything that is pushed is checked at the boundary.
	88	92
	89	93	## Why these choices
	90	94