[Zarathos94]

Weft replaces Forgejo as the plaza's version control. It is part of the hub (one binary, its own storage, no Postgres): agents work in lanes, every turn is a signed draft, a change lands through the review graph, and git is only an export. Forgejo, the git relays and the plaza-git tools are gone. The owner connects GitHub, GitLab or Forgejo repositories at the account, organisation or repository level and chooses what the plaza may use.

Weft (crates/weft)

• The store: an append-only, hash-chained log of signed statements (Ed25519), file contents by BLAKE3 in zstd packs (large files as content-defined chunks), and state by replay. Who may sign what is enforced on replay: agents on their own lanes and never reviewing their own change; the hub for lanes, queues and landing; the owner for repos, rules and rulings.
• Packs, diffs and change trees: tree-sitter grammars as WebAssembly (19 to start), loaded only when a file needs one. A change tree names the definitions a revision changes, what they touch, who wrote each line across drafts, renames by lineage, and divergence from other open lanes.
• weft serve: loopback only, behind the internal token. It serves repos, changes, revisions, diffs, blame, symbol history, queries, the op log, packs and events, applies path rules on reads and STOP ALL on writes, and moves objects by hash only. A node's weft serve --cache answers its VMs from disk.
• Landing: one queue per ref. Changes merge by lines and, where lines clash, by definition. Stacked lanes, reverts, re-checks of the merged candidate, and weft bisect.
• Git, one way: Weft reads and writes git itself (objects, packs, smart HTTP). After a landing, the export writes one commit per intent, authored by the owner as the platform knows them, with no AI credits, signed with the hub's SSH key, fast-forward only. Import reads a repository's first-parent history once and checks every tree against git's. This repository's 1,129 commits import with every tree matching.
• Releases: notes from the intents landed since the last release, artifacts with SLSA provenance, the owner's signature, a signed tag and a GitHub Release.

The hub

• apid starts weft serve beside it and is its only door: the owner's /v1/weft, the agents' gateway (each agent's statements signed with its own key from the vault), and node caches.
• A claimed task opens its lane; the harness checks it out and snapshots every turn with its tool calls. The worker's done seals the lane. A task is done, and its worker paid, when its change lands. A clash or a failed re-check sends it back to its worker.
• The review graph: versioned recipes (code, docs and research to start); steps as work items for agents of the step's role, never the worker; checks with measured scores; findings anchored to definitions and carried into the next round; a new rework state with two rounds before the owner decides; and the owner's review card (Pass, Send back, Fail). Every verdict is a review record in Weft, signed by its reviewer.
• After a landing, the recipe's post-land suite runs on main. A failure lands a signed revert at once and opens a fix task.
• The owner's direct edits land at once as their own changes.
• The cut-over: git.rs, the agents' git relay, the owner's smart-HTTP relay, /v1/git and the plaza_git tool are removed, as are setup's Forgejo container and checks. The IDE, plan documents and the editor mirror read Weft. An editor session linked to a repository works in a lane of its own.

Git platforms

• GitHub: the plaza's own GitHub App, created from a manifest in one click and installed on an account or an organisation, where GitHub's own picker chooses the repositories. Installing signs the owner in, so exports are authored by them.
• GitLab and Forgejo (Codeberg, Gitea): an OAuth app the owner registers, signed in with PKCE and renewed automatically.
• Any of them: a pasted token for the account, one organisation or group, or one repository.
• Choose what the plaza may use: every repository of a namespace, or the ones named. Connecting a granted repository to a project imports its history once (if the project has none) and can register the hub's signing key on the owner's account.
• Secrets live in the vault, which now takes the hub's own consumers as hub:<id> bindings. Weft's keys used a binding the vault refused, so they had quietly fallen back to files; they now go into the vault, and the existing files are still read.
• The browser comes back to a public callback that acts only on a state an owner's call made, once, within 15 minutes.

Consoles

• Web: History in place of Git (landings, lanes, a change's sign-off chain, releases, the map, files with blame), the review graph on a task, the owner's review card, Recipes, and Git platforms.
• Desktop: History, the review card in Approvals, Setup's Weft row, and Git platforms.
• CLI: agentplaza weft, tasks review, tasks rule, recipes, and platforms.
• OpenAPI, Bruno, the architecture doc, README and a Git platforms guide are updated.

macOS

The whole workspace builds, tests and lints on macOS. agent-harness imported Linux-only modules without a gate, so it did not compile there, on main as well. The vmm's hvf code had a clippy finding.

Verification

• cargo test --workspace (133 suites), cargo clippy --workspace --all-targets -- -D warnings and npm --prefix apps/web run check pass on macOS. The agent harness's Linux tests pass in Docker as a non-root user (266).
• End to end on a scratch hub: a code task went through rework and the owner's ruling to landing, then a git export of one commit per intent. A research brief was sent back on a measured accuracy finding, then landed.
• Git platforms, end to end against stand-ins for GitHub, GitLab and Forgejo and real local git repositories: the app is created and installed on an organisation, a repository is connected with its history imported, and the next edit is exported as the owner. A GitLab sign-in can connect only the repository it granted, and a Forgejo repository token reaches only its repository. Expired or unknown states are refused. The web screen was also clicked through on a demo hub.
• Not covered: real github.com, GitLab or Codeberg accounts. The GitHub App's permission names are confirmed only when the app is created for real. The desktop's new screens were not checked by eye; their tests and clippy pass.

For review

• Weft is the only history. There is no Forgejo data to migrate.
• Exports are one-way. A platform's own commits come back only when the owner adopts them, as a lane that goes through review.

🤖 Generated with Claude Code

[github-actions]

Tests: passed

Where	Result	Passed	Failed	Time
Linux arm64	passed	669	0	10 s
Linux x86_64	passed	3623	0	43 s
macOS Intel	passed	3088	0	55 s
macOS Apple Silicon: build only (cannot run here)	passed
Windows arm64: build only (cannot run here)	passed
Windows x64	passed	3128	0	101 s

_{Commit 7ba87c2 · the run}

[github-actions]

Lint: passed

Check	Result
rustfmt	passed
clippy (warnings fail)	passed
cargo deny (advisories, licences, sources)	passed
migrations (applied ones unchanged, new ones in order)	passed

_{Commit 7ba87c2 · the run}

[github-actions]

Web console: passed

Check	Result
type-check	passed
build (with the wasm engine)	passed
tests	passed

_{Commit 7ba87c2 · the run}

[github-actions]

Hub API (Bruno): passed

215/215 API requests pass · 135/504 operations tested · 17 fuzzing findings (reported, they do not fail the pull request)

The report

_{Commit 7ba87c2 · the run}