# Backlog (ordered by value; the orchestrator picks from the top)

Status: `[ ]` todo, `[~]` in progress, `[x]` done.

## Now
- [x] Branch protection rules (force-push and deletion per pattern)
- [x] M3: issues, comments, labels, milestones, assignees, `#N`/`@user` linking, closing keywords from commits

## Next: repo management (small, high value)
- [x] Repo settings: description, website, visibility toggle (public/private), default branch change, archive/unarchive
- [x] Repo rename (with `repo_redirects` so old URLs and clone URLs keep working) and transfer to another user
- [x] Collaborators UI: add/remove users with a role (Read, Triage, Write, Maintain, Admin)
- [x] Explore page: list public repos, search by name
- [x] Stars (star/unstar, count, "starred" tab on profile)

## Security and accounts
- [x] Login throttling / rate limiting (per IP and per account) for login, git HTTP auth and token auth
- [x] TOTP 2FA with recovery codes (the schema is ready for it)
- [x] User deletion with ghost-user reassignment of issues and comments
- [x] Password change, email change, admin password reset
- [x] Audit log (security-relevant events: logins, key and token changes, deletions, protection changes)

## M4: pull requests
- [x] Forks (`git clone --bare --local`, hardlinked objects, no alternates) and same-repo branch PRs
- [x] `refs/pull/N/head`, mergeability via `merge-tree --write-tree`, three-dot diff, merge strategies (merge, squash, ff) with CAS ref update
- [x] PR list, compare page (forks read via `GIT_ALTERNATE_OBJECT_DIRECTORIES`, no writes on GET), PR view with commits and files tabs, editing
- [x] PR end-to-end test over real git; merge errors shown in the merge box
- [x] M4b: reviews (approve / request changes / comment), line comments on the files tab, outdated marking
- [x] "Recent pushes: Compare & pull request" banner on the repo home
- [x] Delete the head branch after merge (button)
- [x] Required approvals and other merge rules as part of branch protection
- [x] Review line-position remapping (outdated is per file today), dismissed reviews keep their original verb

## M5: integrations and reliability
- [x] Webhooks (HMAC-SHA256, delivery log, retries, SSRF guard)
- [x] Webhook follow-ups: audit entries, sent headers in the delivery log
- [x] Notifications (in-app inbox for mentions, assignments, comments on watched issues)
- [x] Push and pull mirrors (contract: `docs/mirrors-interfaces.md`)
- [x] Mirror follow-ups: add a pull mirror in settings to an empty repo; e2e pull over real HTTP; pin git's DNS to the checked address (rebinding race)
- [x] Backups: verified sets (DB snapshot + bundles), scheduler with retention and healthchecks, `fsck` schedule, `/admin/backups`, restore command, `docs/backup.md`
- [x] Replication to the standby (`push --mirror` after each push, hourly reconcile by refs checksum, DB snapshots; `/admin/replication`; runbook in `docs/backup.md`)
- [x] Commit status API (for the future CI runner)

## M3 follow-ups
- [x] Edit history viewer: an "edited" marker linking to past versions (store read fn for `edit_history`)
- [x] Default label set on repo creation (bug, enhancement, documentation, …)
- [x] Issue reactions
- [x] Issue locking (reactions must then hide buttons), issue templates, pinned issues

- [x] The "Archived" banner shows only on the repo home and settings pages; `repo_head` should take the Repo (or RepoCtx) so every repo page gets it automatically

## Tech debt
- [x] A shared test fixture `test_support::app(dir) -> (AppState, Router)`: Config and AppState literals are copied into about 8 test modules, and every new field breaks them all
- [x] Store read pool: one writer connection plus 4 `query_only` readers (`Store::read_conn`); pure-SELECT functions use the readers (rules in the `Store` doc comment, proof in `crates/forge-core/tests/read_pool.rs`)
- [x] Login and git auth throttling (`throttle.rs`, `client_ip.rs`, `trusted_proxies`)

## Later
- [x] Releases with attachments (object_store), LFS (batch API, SSH `git-lfs-authenticate`, pointer display, `admin lfs-gc`)
- [x] Code search
- [x] Signed commit verification (SSH/GPG) badges
- [x] Compression for HTML pages (tower-http layer with a text-only, path-excluding policy; `docs/architecture.md` §5.6)

## M6: CI (contract: `docs/ci-interfaces.md`)
- [x] `forge-ci` crate: `.forge/ci.toml` parsing and validation, triggers, runner protocol types, secret masking
- [x] Schema and store: runners, registration tokens, runs, jobs, artifacts, sealed secrets
- [x] Scheduling on push, tag, PR and manual runs; fork PR approval; commit statuses; lost-runner reaper; retention
- [x] Runner API: register, long-poll claim, logs, heartbeat and cancel, artifacts, finish; job-token git read
- [x] Run, job and live-log pages; cancel, re-run, approve; artifact downloads
- [x] Repo secrets settings page and `/admin/runners`
- [x] `forge-runner` binary: rootless podman executor, workspace checkout, log streaming, artifacts, timeouts
- [x] CI end-to-end test and `docs/ci.md`

## Runner without podman (contract: `docs/ci-builtin-executor.md`)
- [x] Images: in-process registry pull, digest-verified blob cache, safe layer unpacking (whiteouts, no escapes), GC
- [x] Sandbox: `forge-runner __sandbox` helper on youki `libcontainer` (rootless userns, pure-Rust seccomp via seccompiler, no caps, overlay rootfs, cgroup limits)
- [x] `BuiltinExecutor` as the default, `forge-runner check`, runner config and `docs/ci.md` updates

## CI sandbox v2 (contract: `docs/ci-sandbox-v2.md`)
- [x] Subordinate id mapping via newuidmap/newgidmap, auto fallback to single uid, `__sandbox-rm`
- [x] Image layers unpacked with real ownership inside the mapped userns (`__sandbox-unpack`)
- [x] Sandbox, executor, config (`[sandbox] userns`), `check` and docs use the mapping

## Wave C (contract: `docs/wave-c-interfaces.md`)
- [x] O1 organizations core (accounts of kind org, members, teams, authz)
- [x] O2 organizations UI (org pages, owner select, transfer to org)
- [x] M1 mail core (lettre, outbox worker, admin mail settings)
- [x] M2 mail flows (password reset, email verification, invites; notification emails move to M3)
- [x] M3 notification emails (per-user opt-out on `/settings/notifications`, threaded by Message-ID)
- [x] W1 wiki (git-backed, web editing, clone/push, backups/replication)
- [x] D1 discussions
- [x] S1 snippets
- [x] T1 theme and language preferences (dark mode toggle)
- [x] I18 i18n infrastructure (En/Tr) and the shell, auth and settings pages
- [x] I18b remaining pages translated (11 per-group key modules in i18n/, Turkish review pass done)
- [x] I18c shared time/size/visibility helpers localised
- [x] A1 security advisories (OSV, opt-in)
- [x] P1 repo transfer acceptance
- [x] LFS media route moved to `/-/media/` (branch named `media` no longer shadowed)