Trust does something: Until shows its date, and a repo can follow several trusted forks at once #9004

A repository can now follow any number of sources, and Trusted sources shows each entry's date and days left. I ran the tests for what I changed, plus bun scripts/gate.ts and tsc, and all are green. I did not run the full suite, so the forge's check will. Nothing has been tried against a live forge yet.

Live test (for the owner): please follow the four sources once this is out and note the result on this pull. The tests use a fake Forgejo that answers info/refs, with the tip staged as a fetch leaves it. They never fetch a real remote.

What changed

• Trusted list dates. It reads "Until 2026-12-02 (29 days left)". "Just now" was timeAgo on a future date. A date-only entry is active, and a test proves it. A date that doesn't exist (2026-02-31 used to roll into March) and any other shape are refused. The terminal screen shows the same words.
• Followed sources. Repository settings has a new "Followed sources" card with one line per source. It shows where, the branch, which account@host it is trusted as, and where the last check stands. Remove is one click. The add box takes one source per line, address [branch] [as account], so all four go in one submit, and a bad line is named without blocking the rest.
• Reading a source. It is read anonymously, or with the actor's connected origin when that origin is the address's https origin. Checks run every 30 minutes and on "Check sources now". There are 20 sources at most per repository, and the existing single upstream is untouched. A migrated repository links back by adding its old address.
• Trusted commits. A new commit on a trusted account's source opens one stamped pull, upstream/<source>-<tip7>. The next commit moves that pull instead of opening another. Everyone else's pull is stamped too but waits as a guest.
• Conflicts. A conflicting head opens one issue for the crew, and no second while it is open. An agent's pull that closes that issue carries the source. A guest writing "Closes #N" gains nothing.
• Big first fold. A fold of 50 commits or more is still one pull. It and the crew's conflict resolutions are reviewed by the crew before they land, rather than passing on trust alone. All of them land by true merge.

Decisions to check

• Trust account. For …/apps/foundry.git the address's owner would be apps, not benjivers. So a forge admin who is a person may write as benjivers. Nobody else can name the account, and it is never read from anything the source says. For foundry, use:

https://forge-apps.benjivers.com/apps/foundry.git main as benjivers

• Migration. 20261104100000-follow-sources is new, with its pin. It adds repo_source and source_conflict, and a big column on pull_source.
• Events. New events repo.source_added and repo.source_removed go to repository admins only.
• Docs. docs/features/trusted-sources.md has the how-to.

Not done

• Interfaces. There is no API, MCP or terminal door for sources yet, only the settings page.
• Link-back. A migrated repo is not pre-filled with where it came from. You paste the address.
• Crew-review test. The crew-review hold is tested through the flag that drives it (needsCrewReview), not through a full autonomy sweep.

Closes #9003

A repository can now follow any number of sources, and Trusted sources shows each entry's date and days left. I ran the tests for what I changed, plus bun scripts/gate.ts and tsc, and all are green. I did not run the full suite, so the forge's check will. Nothing has been tried against a live forge yet.

Live test (for the owner): please follow the four sources once this is out and note the result on this pull. The tests use a fake Forgejo that answers info/refs, with the tip staged as a fetch leaves it. They never fetch a real remote.

What changed

• Trusted list dates. It reads "Until 2026-12-02 (29 days left)". "Just now" was timeAgo on a future date. A date-only entry is active, and a test proves it. A date that doesn't exist (2026-02-31 used to roll into March) and any other shape are refused. The terminal screen shows the same words.
• Followed sources. Repository settings has a new "Followed sources" card with one line per source. It shows where, the branch, which account@host it is trusted as, and where the last check stands. Remove is one click. The add box takes one source per line, address [branch] [as account], so all four go in one submit, and a bad line is named without blocking the rest.
• Reading a source. It is read anonymously, or with the actor's connected origin when that origin is the address's https origin. Checks run every 30 minutes and on "Check sources now". There are 20 sources at most per repository, and the existing single upstream is untouched. A migrated repository links back by adding its old address.
• Trusted commits. A new commit on a trusted account's source opens one stamped pull, upstream/<source>-<tip7>. The next commit moves that pull instead of opening another. Everyone else's pull is stamped too but waits as a guest.
• Conflicts. A conflicting head opens one issue for the crew, and no second while it is open. An agent's pull that closes that issue carries the source. A guest writing "Closes #N" gains nothing.
• Big first fold. A fold of 50 commits or more is still one pull. It and the crew's conflict resolutions are reviewed by the crew before they land, rather than passing on trust alone. All of them land by true merge.

Decisions to check

• Trust account. For …/apps/foundry.git the address's owner would be apps, not benjivers. So a forge admin who is a person may write as benjivers. Nobody else can name the account, and it is never read from anything the source says. For foundry, use:

https://forge-apps.benjivers.com/apps/foundry.git main as benjivers

• Migration. 20261104100000-follow-sources is new, with its pin. It adds repo_source and source_conflict, and a big column on pull_source.
• Events. New events repo.source_added and repo.source_removed go to repository admins only.
• Docs. docs/features/trusted-sources.md has the how-to.

Not done

• Interfaces. There is no API, MCP or terminal door for sources yet, only the settings page.
• Link-back. A migrated repo is not pre-filled with where it came from. You paste the address.
• Crew-review test. The crew-review hold is tested through the flag that drives it (needsCrewReview), not through a full autonomy sweep.

The check failed on two commit-message rules, not on code or tests. I added the missing lines in a new commit and pushed it. I didn't touch the code. bun scripts/gate.ts now exits 0 locally; I haven't seen the forge's check result on the new push yet.

• Why now. The commit now carries a "Why now:" line saying the owner is waiting to fold in four trusted forks and nothing can follow more than one parent yet.
• Try. It also carries a "Try:" line: on the preview, open a repository's Settings → Followed sources and add a line, then open /settings/trusted to read the dates.

What changed in the pull

• Followed sources. A repository can follow any number of sources, added one per line in settings. A new commit from a trusted account's source opens or updates one stamped pull, and a conflict goes to the crew once.
• Trusted dates. Trusted sources now show the end date and the days left.
• Big folds. A fold of 50 or more commits is reviewed by the crew before it lands.

Still open

• The live test against the four real sources is still the owner's to do and note on the pull. The tests use a fake Forgejo.
• There is no API, MCP or terminal door for sources yet, only the settings page.

I've addressed items 1–5 and the migrated-repo link-back from item 6 in a new commit. The live test and the real-merge check are not done. bun x tsc --noEmit, bun scripts/gate.ts, bun scripts/design-lint.ts and the 96 tests I picked all pass. I did not run the full suite: scripts/fast.ts called the diff too broad to name, so the forge's check runs the rest.

What changed

1. Terminal door.

- There is a new screen, src/tui/screens/sources.ts, reached with s on the repository's About card. - a adds a source, x removes the one under the cursor, and u checks them all now. - It goes through the same actions as the settings page, so it has the same repository-admin gate. A non-admin is offered nothing. - Because the actions append the same events, a settings page that is open updates when the terminal writes. - s is not in ENTRIES: the gate is repository admin, not site admin, and the follow keys already live on the About card. - The test drives the screen, checks that the bus hears repo.source_added and repo.source_removed, and checks that a non-admin changes nothing.

1. time(). It now takes { date: true } and shows the calendar day. src/web/pages/trusted.ts uses it for the end date and for the stop time, so the hand-rolled <time> markup is gone.
2. Crew-review hold.

- reviewed() is now exported. - A test shows that a trusted big-fold pull holds in reviewed() without an approval and passes once it is small. Dropping the !needsCrewReview check would fail it. - Adoption tests: an agent's pull closing the conflict issue is stamped, and a guest's is not.

1. foldsIn() is a pure read again. adoptResolution is exported and called explicitly when a pull is opened (openPull) and when a pull's body is edited (editIssue). A test shows that asking foldsIn does not stamp a pull.
2. Clock sweep. checkDue runs source checks four at a time and starts no new check after 10 minutes. Each check already had a 120-second limit (CHECK_TIMEOUT_MS). Whatever is left is due at the next tick.
3. Link-back. For a repository with no sources yet, the add box is pre-filled with <migrated-from url> main. A test covers it.

SSRF. A source address is fetched through vettedEnv(url, authEnv, REMOTE_PROTOCOLS), the same call as the repository's own upstream and the mirror fetch. The host is vetted, the address that passed is pinned, and only https and http are allowed. The change adds no second fetch path. This is also written in docs/features/trusted-sources.md.

Not done

• The live test on the preview is still pending.
• Box 4 is still shown only against a fake forge. A real 149-commit fold has not been tried.

Try it. Open a repository's About card in the terminal and press s. Open Settings → Followed sources on the web in another window: adds and removes appear without a reload.

I merged main into the branch and pushed it. The only conflict was the import block in src/actions/pulls.ts. I kept main's new imports and kept my adoptResolution import in the trusted-sources line.

bun x tsc --noEmit and bun scripts/gate.ts are clean. I ran four test files: test/follow-sources.test.ts, test/trusted-sources.test.ts, test/trusted-fold.test.ts and test/autonomy.test.ts. All 89 tests pass. I did not run the full suite; the forge's check runs it on the push.

Left #9003 open: 2 unticked items remain (One big first fold (149 commits and 90 conflicting files for jmoran) doesn't flood: it becomes one pull, reviewed by the crew, and lands by true merge (#8935).; Live-tested: I'll follow the four sources once it's out, so note it on the pull.).