feat(config): origin-first forge resolution and host-keyed credentials (ADR 0025) #41

Merged

hexajon merged 1 commit from refs/pull/41/head into main

2026-07-13 20:36:12 +00:00

hexajon commented

2026-07-13 20:36:04 +00:00

(Migrated from codeberg.org)

Summary

Implements ADR 0025 (docs/adr/0025-origin-first-forge-resolution.md, now Accepted) — epic #30, tasks T1–T11.

Behavior changes:

For repos WITH an origin remote, the origin-derived forge now outranks a global madtea.url (previously the global value silently won and operations could query the wrong forge). Installs whose API host differs from the git host set the per-repo madtea.url override once.
Credentials are host-keyed — one account per forge; the secure backend is the registry of known forges. Pre-existing compound-keyed entries migrate on first use, and the legacy entry is deleted only after the host-keyed re-store succeeds (a failed re-store never loses a token). The systemd-creds single-slot legacy entry is forge-checked on both read and delete — no cross-forge reuse, no cross-scope destruction.
auth login is origin-aware, prompt-minimal, and forge-wide: inside a repo the forge comes from origin (no URL prompt), the username comes from GET /user, there is no storage-scope prompt, and --global on login is a deprecated no-op (logout --global unchanged).
Repo-less calls resolve a session forge from a workspace scan of child repos' origins: unanimous host wins (outranks global); mixed hosts defer to an explicitly-set global madtea.url; mixed without a global fails closed with ambiguous forge: found <h1>, <h2> — pass dir= or set madtea.url; an explicit dir= always outranks the session default.
dir=-taking operations (finish, push exit-128 diagnostics) resolve the TARGET repo's forge via the new GetConfigForDir/GetConfigForURL entry points; IsConfigured is origin-aware.
MCP conformance now probes the fail-closed ambiguity path; reference docs regenerated; COMPARISON auth row updated.

Refs #38, #39, #40 (follow-ups filed during review).

Closes #30
Closes #31
Closes #32
Closes #33
Closes #34
Closes #35
Closes #36
Closes #37

## Summary Implements ADR 0025 (docs/adr/0025-origin-first-forge-resolution.md, now Accepted) — epic #30, tasks T1–T11. **Behavior changes:** - For repos WITH an origin remote, the origin-derived forge now outranks a global `madtea.url` (previously the global value silently won and operations could query the wrong forge). Installs whose API host differs from the git host set the per-repo `madtea.url` override once. - Credentials are host-keyed — one account per forge; the secure backend is the registry of known forges. Pre-existing compound-keyed entries migrate on first use, and the legacy entry is deleted only after the host-keyed re-store succeeds (a failed re-store never loses a token). The systemd-creds single-slot legacy entry is forge-checked on both read and delete — no cross-forge reuse, no cross-scope destruction. - `auth login` is origin-aware, prompt-minimal, and forge-wide: inside a repo the forge comes from origin (no URL prompt), the username comes from `GET /user`, there is no storage-scope prompt, and `--global` on login is a deprecated no-op (logout `--global` unchanged). - Repo-less calls resolve a session forge from a workspace scan of child repos' origins: unanimous host wins (outranks global); mixed hosts defer to an explicitly-set global `madtea.url`; mixed without a global fails closed with `ambiguous forge: found <h1>, <h2> — pass dir= or set madtea.url`; an explicit `dir=` always outranks the session default. - `dir=`-taking operations (finish, push exit-128 diagnostics) resolve the TARGET repo's forge via the new `GetConfigForDir`/`GetConfigForURL` entry points; `IsConfigured` is origin-aware. - MCP conformance now probes the fail-closed ambiguity path; reference docs regenerated; COMPARISON auth row updated. Refs #38, #39, #40 (follow-ups filed during review). Closes #30 Closes #31 Closes #32 Closes #33 Closes #34 Closes #35 Closes #36 Closes #37

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!41

No description provided.

Rows
Columns