T

jeffryandClaude Opus 5 76f5aef17a marmalade: reviewed — ssh is needed nowhere, and write access nowhere either

Every operation is HTTPS on 443. Measured that partial clone with the blob filter
works over gitea's smart HTTP, so list never needed ssh; I had built and measured
it over ssh out of habit.

The tool writes only to the working tree — a fetched document, a lock, a facet —
and never commits or pushes, so it needs no write credential anywhere, including
this repository. Same reason cart gives for an agent committing and not pushing:
the consequences of a push land on people it cannot experience. write:repository
should never appear on a token this tool holds.

The exception is published check, which needs an identity that is not the owner's.
That is not an ssh problem and not solvable by scoping — it is the command's point.
Anonymous or a reader credential, both HTTPS, and checked-as-owner-proves-nothing
when neither is held.

One untested assumption, and it is load-bearing: whether a read-scoped PAT
authenticates git over HTTPS and not only the API and raw files. Those are
different paths in gitea and only the second was ever measured. If it needs a
broader scope, that is the sole argument for keeping ssh for list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

2026-09-07 14:29:13 -04:00

.loom

marmalade: reviewed — ssh is needed nowhere, and write access nowhere either

2026-09-07 14:29:13 -04:00

README.md

osprey converts: the design is the log, and the cart is gone

2026-09-07 13:50:56 -04:00

README.md

loom-cli

Not built. A small tool for the operations a person should not do by hand: fetch a document you depend on, and find out when it changed.

The design is in .loom/event-log.md, not in a spec. Every entry says what was decided and the belief that could turn out false, so you can see which parts are load-bearing and which were guesses. Everything tagged osprey was decided in one round.

Three commands. pull adopts a document and writes its lock; check asks every publisher whether their copy has moved; reachable asks whether somebody who is not you can fetch what you published. None of them repairs anything.

bedrock and externals, under .loom/externals/, are not discardable. Read them as given — accommodating them is what makes this a loom tool rather than some other thing.