chore(main): release 0.8.0 - #307

🤖 I have created a release beep boop

0.8.0 (2026-11-13)

⚠ BREAKING CHANGES

• node: Ucan::verify_chain returns Result instead of Result<()>.
• node: pending_ref_transitions.first_ref_name is dropped. Callers that read or write that column must move to receive_pack_requests.accepted_ordinal.
• node: gate agent-task reads behind visibility rules (#553)
• node: the GraphQL repos field now returns an error instead of the full list when more than MAX_VISIBLE_REPO_PAGE_SIZE (200) repositories are visible; larger lists must use reposPage with limit/after. Repository names are additionally limited to 100 bytes at creation, fork, and mirror-registration time.
• node: gl cert show --verify now requires --expect-node ; the node's self-reported DID is no longer trusted as a cert anchor.
• node: git-receive-pack now rejects a push whose authenticated DID is not the repo owner, returning 403 before any ref update is applied. Delegated and CI keys count as non-owners: a UCAN git/push capability is verified but not yet honored for authorization, so an agent pushing under its own DID cannot push while this is on. Set GITLAWB_ENFORCE_OWNER_PUSH=false during a rolling upgrade, or have automation push as the repo owner, until scoped collaborator / UCAN-delegated push rights land.

Features

• add push, fetch, and sync latency metrics (#580) (5a7576b)
• core: carry the resumed candidate's identity in the scan token (2656718)
• node,git: cap concurrent served git ops with a 503 load-shed (#62) (5981257)
• node: add scheduled inbound mirror worker (#555) (209618a)
• node: anchor the UCAN proof chain and honour delegated git/push (#567) (3a0d91a)
• node: per-IP write-surface rate brake + purge-spam admin tool (#196) (6f99019)
• node: persist upstream mirror configuration and transition state (#538) (0e5a160)

Bug Fixes

• api,sync: Delimit positional arguments in git clone mirror invocations (#539) (0cdb4bc)
• attest: bound did:key method-id length before base58 decode (#360) (#535) (9b915b0)
• attest: make verify_all lenient under RequireAll (#359) (#532) (db98b39)
• attest: use strict Ed25519 verification with regression test (1fcbbbd)
• ci: add tested release tag resolver (1b65f70)
• ci: recognize namespaced test attributes in pr-triage's needs-tests check (1989fcc)
• ci: reject unsafe release dispatch tags (7b365b0)
• ci: reject unsafe release dispatch tags (0b990d6)
• core: cap the blinded recipient scan in open_blob (#419) (#440) (2450bbd)
• core: compute created-skew in checked arithmetic (#358) (#545) (61d8a4f)
• core: count distinct signer DIDs in certificate threshold check (3993fd1)
• core: Count distinct signer DIDs in certificate threshold check (50d3cbb)
• core: enforce strict RFC 8032 Ed25519 signature verification (425ebf4)
• core: ignore invalid signatures in satisfies_threshold (#349) (#554) (0919cf7)
• core: put the redirect predicate behind a feature so core stays lean (c82a70a)
• core: refuse a redirect that rewrites the signed request-target (5c0d6f3)
• core: reject small-order Ed25519 keys at DID resolution and before X25519 (#314) (86c544a)
• core: reject zero threshold, canonicalize did:key, document replay (#509) (#540) (b4a3122)
• core: share the origin-scoped redirect rule with the git helper (ba44a01)
• core: use strict Ed25519 signature verification (a6c13be)
• deps: bump aws-smithy-json to 0.62.7 (GHSA-8ffr-xgwf-xj56) (#516) (151d688)
• deps: bump follow-redirects and override ws in scripts/ (#525) (a23c81d)
• deps: bump libp2p to pick up hickory 0.26 and serde_with 3.22 (#518) (623b600), closes #76
• deps: resolve cargo audit failures on main (#514) (4d024e0)
• git-remote: abort fetch on EOF without POSTing; harden the real-git test harness (#192) (1cb930c)
• git-remote: drive multi-round fetch as a v0 stateless-RPC client loop (#117) (5fdf155)
• git-remote: drive multi-round fetch as a v0 stateless-RPC client loop (#117) (a64b141)
• git-remote: normalize the shim's accepted socket to blocking (10e0840)
• git-remote: normalize the shim's accepted socket to blocking (#192) (8d7f95f)
• git-remote: reject malformed pkt-line length headers instead of flushing (8c04043)
• git-remote: skip content-free flush rounds in the fetch loop (#117) (68ba492)
• git-remote: stop waiting on EOF for a delete-only push (#442) (c2e175d)
• gl: accept the resume token the incomplete-scan message tells you to pass (181f617)
• gl: assert 404 verdict and harden transport error handling in whoami (#220) (a329174)
• gl: assert whoami 404 verdict and preserve transport error cause (#220) (b4007a5)
• gl: close two completeness-gate escapes; surface the node's error key (6b2c53b)
• gl: derive View: URL from node instead of hardcoding gitlawb.com (#370) (#549) (d84c445)
• gl: follow scan continuations in gl ipfs get, bounded three ways (9a8d190)
• gl: make doctor exit non-zero on Fail-class checks (#357) (#547) (42cc893)
• gl: only report registered: false on 404 in whoami (#220) (21c74c6)
• gl: only report registered: false on 404 in whoami (#220) (fd78cfa)
• gl: only report registered: false on 404 in whoami (#220) (3cc15cf)
• gl: only report registered: false on 404 in whoami (#220) (16cc3b3)
• gl: only report registered: false on 404 in whoami (#220) (3f41df5)
• gl: only report registered: false on 404 in whoami (#220) (b0e5cc0)
• gl: only report registered: false on 404 in whoami (#220) (12bc759)
• gl: only report registered: false on 404 in whoami (#220) (10e3492)
• gl: only report registered: false on 404 in whoami (#220) (c10f2ca)
• gl: only report registered: false on 404 in whoami (#220) (3add535)
• gl: only report registered: false on 404 in whoami (#220) (fdd1103)
• gl: pass the mirror temp path to git as an OS string (#434) (df87b15)
• gl: pin secret-file modes at creation instead of chmod after (#354) (#557) (a00d7d5)
• gl: read whoami error bodies through CappedBody.text (bfc44f9)
• gl: read whoami error bodies through CappedBody.text (4725146)
• gl: report quickstart registration failure when the node returns no UCAN (#355) (#556) (10d5b98)
• gl: report why the node-DID comparison was skipped in cert show (6b2c53b)
• gl: require non-empty error message and use ephemeral port in whoami tests (#220) (a27a267)
• gl: resolve webhook owner from caller identity, not node DID (#568) (f67688e)
• gl: sanitize full transport error chain in whoami, remove raw error attachment (#220) (39ce655)
• gl: status-check the client read/write surfaces so a node denial surfaces as an error, not a fake result (#123) (#186) (6b2c53b)
• gl: stop carrying request signatures to a host the node redirected us to (de3f230)
• icaptcha-client: parse GITLAWB_ICAPTCHA_INSECURE as truthy only (#227) (#533) (77ac103)
• icaptcha: return unsolved instead of blocking or overflowing (#444) (5479fd5)
• infra: serialize the upgrade and write compose through a unique temp path (888fab6)
• ipfs: page the legacy CID scan instead of materializing every repo (4985e38)
• node,infra,macos: make the owner-push opt-out reach every launch path (1f0d9ff)
• node: ANS-104 codec and recovery policy types (#26 split 2/4) (#524) (2c341f7)
• node: authenticate gossip ref-update events before writing them (#325) (9bda2e1)
• node: bind a peer row to its DID so only its keyholder can repoint it (#273) (8d38043)
• node: bound federated repository aggregation (#546) (0189990)
• node: bound GraphQL query cost (#552) (c805e35)
• node: bound Identify-derived Kademlia addresses (#544) (b33562f)
• node: bound legacy readiness fallback (5af14c2)
• node: bound peer failure tracking (74f7554)
• node: bound replay of authenticated gossip ref-update events (#334) (206e082)
• node: bound the fruitless reads one sweep run will spend (e4aaae8)
• node: bound the legacy CID scan and let the caller carry its position (22f4db9)
• node: bound the legacy scan's query by the remaining row budget (21e6873)
• node: bound the legacy-repair read by the pin batch deadline (ea2219b)
• node: bound the pin loops' DB work by the batch deadline, both lanes (9984e08)
• node: bound the pre-walk CID resolve on its own short budget (0d7711c)
• node: bound the request body the signature middleware buffers before it verifies (#262) (288ad92)
• node: bring the Pinata pin path back into lockstep with the Kubo one (4681f54)
• node: budget provenance and fallback walks separately (ae96ffa)
• node: canonicalize and 404-on-no-match in remove_label (#344) (#530) (8c9e4ad)
• node: carry discovery onto the per-(oid, repo) incompleteness marker (bd0bef1)
• node: charge discovery's probes against the per-run read budget (bc20236)
• node: clamp every admission-held DB await in the CID resolver (bad82b3)
• node: close quarantine bypass on encrypted blobs, visibility routes, and sibling mutations (#566) (66fe646)
• node: close review findings on the owner-push default (2f0174c)
• node: close three host-class gaps in the public-URL gate (#346) (76ca04f)
• node: count a completed fetch once per fetch, not per stateless-RPC POST (1c690c1)
• node: count fetch completion from the response outcome, not the request (5a5d4e1)
• node: drop withheld-subtree trees from the replication pin set (#382) (19a7ce2)
• node: durable post-receive outbox for receive-pack (#26 split 1/4) (#558) (f68d0dd)
• node: encrypt webhook HMAC secrets at rest and redact from Debug (#575) (4fc041a)
• node: enforce owner-only push by default (cdbda19)
• node: Escape LIKE metacharacters in certificate prefix search (eeafa1f)
• node: Escape LIKE wildcards in certificate prefix search (96d8123)
• node: fail pin_git_object when the add response carries no Hash (#528) (47c6e6c)
• node: fence a repo publish on the write attempt that owns it (#285) (ed76adf)
• node: gate /ipfs/pins and /arweave/anchors behind authentication (#121) (#543) (d3845ce)
• node: gate agent-task reads behind visibility rules (#553) (4cd0a6a)
• node: gate bounty mutations on repo read before status checks (#529) (8eedb93)
• node: gate GET /ipfs/{cid} tree objects so a withheld subtree's structure can't leak (#135) (21f8cb6)
• node: gate replica register/unregister on repo read visibility (#445) (0303222)
• node: gate two Unix-only tests so the crate compiles on Windows (5a7a77b), closes #228
• node: give each discovery row its own slice of the pass budget (22560b0)
• node: harden peer readiness state (6bd8f41)
• node: hold fork to the same repo-name rules as every other creation route (#412) (fc87586)
• node: honor pre-assigned task assignee on claim (#550) (a4026e8)
• node: implement reconciliation sweep as durability backstop (#218) (#551) (a2262d9)
• node: make creation-route rate limit configurable; fix(gl): surface real errors on pr create failure (#560) (3c1ee27)
• node: make metrics::init race-safe with Once (c45ec96)
• node: make the pin-source incompleteness marker per (object, repo) (5575da4)
• node: map ipfs/arweave DB outages to 503 via bare ? (#251) (0e2328b)
• node: map ipfs/arweave DB outages to 503 via bare ? (#251) (c29a91a)
• node: mint a continuation when a ceiling stops the /ipfs scan mid-page (69cfbd4)
• node: never hand back a continuation that made no progress (76f6300)
• node: opaque AppError::Internal and AppError::Db HTTP bodies (#226) (241b366)
• node: opaque AppError::Internal and AppError::Db HTTP bodies (#226) (d192028)
• node: opaque GraphQL DB error messages (#250) (c10ccf1)
• node: order the CID candidate list so it cannot depend on heap order (366b599)
• node: owner-gate create_task repo_id against hosted repos (#541) (bac49f1)
• node: persist the libp2p identity instead of deriving it from the node DID (#324) (c301a68)
• node: pin no-redirect and bound the body read on the iCaptcha public-key fetch (#574) (d15f194)
• node: port discovery's candidate load onto the paged repo query (4c665fb)
• node: preserve legacy peer compatibility (547f9ae)
• node: reconcile public-read messaging with per-repo enforcement (#439) (0366f18)
• node: record a discovered source and its marker in one commit (9babb5e)
• node: reject revision syntax in issue ids and drop service passthrough (#521) (421f03a)
• node: repair source-less legacy pins by bounded additive discovery (d88c0c7)
• node: require Content-Digest on a signed request (#306) (189aad9)
• node: resolve issue ids from git refnames, not request input (#526) (3063719)
• node: resume the /ipfs scan per candidate so a starved one is not skipped (d0635d9)
• node: rewind the pin repair sweep cursor on every completed walk (1b44b12)
• node: rotate discovery candidates across traversals (4fdfa1c)
• node: scope bounty aggregates to anonymously-listable repos (#477) (#527) (317a155)
• node: scope the refs listing by the canonical repo slug (#388) (131bb95)
• node: size the ipfs work floor for provenance walks plus one full search (dc5daa1)
• node: stop reporting a Kubo pin whose DB record never landed (f839fb9)
• node: stop the /ipfs size probe reporting a fault as a missing object (ed6355e)
• node: use readiness for peer liveness (225644a)
• node: use readiness for peer liveness (1a841a9)
• node: validate git branch refs to close option injection (#379) (6233bd9)
• node: validate ref-update SHAs are hex, not just length 40 (#433) (911be4d)
• node: version ref_certificates for forward compat (#26 split 3/4) (#548) (38bab41)
• release: bump icaptcha-client with the rest of the workspace (6668525)
• repo_store: use SHA-256 for stable advisory-lock key (#210) (c380f9c)
• repo_store: use SHA-256 for stable advisory-lock key (#210) (89e10d0)
• review: assert the read-timeout postcondition and drop the socket clone (4d9bd5a)
• review: bound the probe's channel waits and stop overstating the handshake (d4e5ecf)
• review: bound token key, rule bytes, and the discovery load (e6cfb58)
• review: keep the resume token on every terminal that still holds one (8c39cfd)
• review: make the coupled sites findable and pin two more properties (a7e8e35)
• review: make the LIKE escape independent of the SQL parser mode (1d3987b), closes #319
• review: mint a continuation at every ceiling and widen the token (342dd48)
• test: match SHA-256 advisory-lock key in receive-pack deadline test (c68e1b0)
• whoami: update registered status handling on 404 response (75b0df8)

This PR was generated with Release Please. See documentation.