Ting/Jostoph
Watch
2
0
Fork
You've already forked Jostoph
 2
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions
Page: Home
Pages
Home OpenSpec 103 forge identity lifecycle audit OpenSpec documentation-log grooming-log incident-postmortems
2 Home
codexo edited this page 2026-08-21 19:01:40 +00:00
Table of contents

Jostoph

Ting's Forgejo steward. This wiki carries what the code cannot state about itself: how the parts compose, and where this repository sits in the estate. How to run it, its CLI, its rules and its deployment are the README's — read there, not here.

State as of the wiki pass of 2026-08-21, at main 70fdb495 — the same commit the pass of 2026-08-14 read; nothing has landed on main since.

Where it sits in the estate

  • Substrate: lar.ad/jostoph-rs, consumed through the public midgard/jostoph-rs mirror so the build needs no forge credential. The substrate is main-only by design (owner, 2026-08-10, #11) — which is why .fastlane.toml names dendrite and the three nixops4-providers flakes and not it.
  • The forge's stateful resources — the webhook, push mirrors, deploy keys — are reconciled by the Forgejo nixops4 provider in lar.ad/flake-ops (#3), by the owner's ruling of 2026-08-05. This repository only declares them. The hook's secret is minted by OpenBao (flake-ops#67 phase 3); the deployment itself is flake-ops#75.
  • Instance defaults (DEFAULT_BRANCH, DEFAULT_MERGE_STYLE, DEFAULT_DELETE_BRANCH_AFTER_MERGE) are applied in flake-ops and declared here so one document holds both halves of the same policy.
  • Ting/Ting's PROJECTS.md names no project that holds this repository (read 2026-08-14). Recorded in documentation-log, not resolved here.

What composes what

Part Where What it is
The rules src/policy.rs the ascent! Datalog program: how requirement is judged
Their parameters nix/policy.nix → policy/ting.json (dev default), version 4 what the estate requires
Webhook listener src/forgejo.rs Forgejo's wire format, signature-verified
Durable audit trail src/audit.rs the file behind the substrate's in-memory ring
Delivery record src/record.rs one enriched record per verified delivery
Forge reconciler src/reconcile.rs conform / conform --apply
Conformance findings src/conformance.rs roster, kinds
Packaging nix/overlay.nix → package.nix, policy.nix, forgejo.nix
Units nix/module.nix jostoph.service; jostoph-roster.service + timer under conformance.enable

The CLI is one binary, src/main.rs: serve, roster, conform, kinds, replay, manifest, check.

What acts, and what only declares

The answering service performs nothing and holds no token. The only command in this repository that mutates the forge is jostoph conform --apply, and it reaches exactly two families of endpoint: {api}/repos/{owner}/{name} and {api}/orgs/{org}/labels. No unit generated by nix/module.nix reconciles the webhook.

Deviates: the README's "What it does today" states that "the webhook-reconcile unit converges the hook". No such unit exists in nix/module.nix, and webhook convergence is ruled to belong to the Forgejo nixops4 provider (owner, 2026-08-05; nix/forgejo.nix header; commit 94535c9d). Flagged in Ting/Jostoph#82. Restated in new words — "webhook reconciliation ... can act" — by the open PR #86, and flagged there. Recorded, not ratified.

Files outside the crate

resolve-new.rs sits at the repository root. It is jostoph-rs's dispatch and resolution program — it opens use crate::event::Event; and use crate::gate::{Effect, GateDecl, Verdict};, modules this crate does not define — and nothing builds it: Cargo.toml names one binary at src/main.rs, whose module tree is audit, conformance, forgejo, policy, reconcile, record.

Deviates: substrate source in a repository whose perimeter puts the substrate out of scope (#1), added by merged PR #20 outside that pull request's own declared Boundary. Flagged in Ting/Jostoph#82. Recorded, not ratified.

Logs