integrate forge/: compose + serve entries, probe, docs to 35 plugins / 456 tests

The demo server now seeds itself into its own forge — push this repo
to /forge/<you>/plugins.git and browse the forge's source in the forge.
NEXT records the tier-2 plan (issues as pod resources) and its seam
asks (api.authorize collaborators, api.events webhooks).

Author: melvincarvalho

AGENT.md

@@ -161,6 +161,7 @@ Full ranking in `NOTES.md`. The ones you'll hit:
 | an object-storage / S3-style gateway | `s3/` | loopback LDP + hand-rolled XML + SigV4 |
 | a DID / identity document | `didweb/` | podsRoot scan + key derivation |
 | a dev/tooling subsystem | `gitscratch/` | shell a system binary via CGI |
+| a hosted-content web app (forge, wiki, …) | `forge/` | CGI plumbing + server-rendered GitHub-light UI + JSON API, zero deps/build |
 | a posting protocol (IndieWeb-style, client-discovered endpoint) | `micropub/` | pod bearer as the protocol token + loopback writes |
 | a data-export / archive download | `backup/` | loopback container walk streamed into a hand-rolled format |
 | an ops/observability endpoint | `metrics/` | node builtins + an `api.fastify` hook (scope: all plugins, never core) |
@@ -195,8 +196,8 @@ Full ranking in `NOTES.md`. The ones you'll hit:
 
 ## Current state
 
-34 plugins (7 ports + 27 features) + the two-server `federation-demo/`,
-407 tests, all green (`npm test`).
+35 plugins (7 ports + 28 features) + the two-server `federation-demo/`,
+456 tests, all green (`npm test`).
 A four-axis security review ([SECURITY.md](./SECURITY.md)) hardened the
 inbound-federation and query surfaces; the WAC-deferral pattern held.
 `compose.test.js` runs every plugin on a single server from pure config.

ISSUES.md

@@ -45,6 +45,7 @@ evidence. Legend:
 | — | `shortlink/` | link shortener for pod URLs (pluginDir persistence, 11th witness) |
 | #463/#464-adj | `admin/` | operator home — the wp-admin gap analysis; every missing pillar names a seam |
 | #583-adj | `gallery/` | pod photo/media gallery — first `api.mountApp` consumer; zero required config |
+| #322-next | `forge/` | personal git forge — persistent push-to-create hosting, GitHub-light UI, JSON API |
 
 Plus seven **ports of bundled features** proving the migration path for
 #564 / #164: `relay/` `webrtc/` `terminal/` `tunnel/` `notifications/`
@@ -118,7 +119,7 @@ shipped upstream** (the loader plus four seams and the id fix in JSS
 0.0.218/0.0.219, each consumed here), **2 more plugin-able with no
 blocker**, **4 clusters blocked on a named seam** (each with a
 proof-of-need consumer), the rest core-by-nature or product-scale.
-**34 plugins total, 407 tests** (plus the two-server `federation-demo/`
+**35 plugins total, 456 tests** (plus the two-server `federation-demo/`
 scenario). The plugin api reaches most of the backlog today; ranked by
 demand, the seams that would unlock the most next are `api.authorize`
 (4 consumers, 3 hard-blocked) and `api.events` (7 consumers — matrix

NEXT.md

@@ -8,7 +8,7 @@ plugin), `NOTES.md` (the findings/seams — the real deliverable), and
 
 ## Where things stand
 
-- **34 plugins, 407 tests, all green** (`npm test`; the three
+- **35 plugins, 456 tests, all green** (`npm test`; the three
   `notifications/` fs.watch tests need a free inotify instance — see
   Footguns), all pushed to
   `github.com/JavaScriptSolidServer/plugins` (branch `gh-pages`).
@@ -180,6 +180,12 @@ Still genuinely plugin-shaped and distinct:
   (capability + shortlink composition), a music/podcast pod (gallery's
   Range finding makes byte-range playback free), a turn-based game over
   relay + pod state. Demos compose existing plugins; loopback only.
+- **forge/ tier 2** (tier 1 SHIPPED 2026-07-12: push-to-create hosting,
+  GitHub-light UI, JSON API — see forge/README Findings). Tier 2 =
+  issues + comments **as pod resources** (WAC-governed, portable — the
+  thing Gitea structurally can't offer), repo settings, profile pages.
+  Tier 3 = PRs/forks (git CLI can merge; the UI is the work). Wants:
+  api.authorize for collaborators, api.events for webhooks.
 - **Phanpy Wave B — real federation** (Wave A is DONE, 2026-07-12: the
   mastodon/ shim is Phanpy-grade for local use — timelines, threads,
   media, notifications from the AP inbox, PKCE; serve a Phanpy dist at

README.md

@@ -92,14 +92,15 @@ README and NOTES.md, ship the closest honest approximation.
 | `shortlink/` | — | link shortener for pod URLs (deliberately not an open redirector) |
 | `admin/` | — | **the capstone**: wp-admin-style operator home; each missing pillar names its seam |
 | `gallery/` | — | pod photo/media gallery — first `api.mountApp` (#583) consumer; zero required config |
+| `forge/` | #322-next | personal git forge — push-to-create hosting, GitHub-light UI, JSON API; zero deps, zero build |
 
 Plus one directory that is a scenario, not a plugin:
 [`federation-demo/`](./federation-demo/) — **two** JSS instances federating
 over loopback (webfinger discovery, a cross-origin Follow, plugin-signed
 delivery); run `node federation-demo/demo.js` for the narrated version.
 
-**407 tests, all green** (`npm test`), including `compose.test.js` — all
-thirty-four plugins on one server from pure config, pods + WAC intact
+**456 tests, all green** (`npm test`), including `compose.test.js` — all
+thirty-five plugins on one server from pure config, pods + WAC intact
 beside them. Findings consolidated in [NOTES.md](./NOTES.md); the full
 plugin-tagged backlog triaged in [ISSUES.md](./ISSUES.md); the build guide
 is [AGENT.md](./AGENT.md); the maintainer-facing summary — what to add

compose.test.js

@@ -96,6 +96,7 @@ describe('composition: every plugin on one server', () => {
         // Zero config on purpose — gallery/ is the first plugin needing none
         // (origin via api.serverInfo, container defaults to the caller's pod).
         { module: at('gallery/plugin.js'), prefix: '/gallery' },
+        { module: at('forge/plugin.js'), prefix: '/forge' },
         {
           module: at('remotestorage/plugin.js'),
           prefix: '/remotestorage',
@@ -350,6 +351,17 @@ describe('composition: every plugin on one server', () => {
     assert.strictEqual(res.status, 400);
   });
 
+  it('forge: the repo list answers; an anonymous push is refused', async () => {
+    const page = await fetch(`${base}/forge/`);
+    assert.strictEqual(page.status, 200);
+    assert.match(page.headers.get('content-type') || '', /text\/html/);
+    const api = await fetch(`${base}/forge/api/repos`);
+    assert.strictEqual(api.status, 200);
+    assert.ok(Array.isArray((await api.json()).repos));
+    const push = await fetch(`${base}/forge/nobody/x.git/info/refs?service=git-receive-pack`);
+    assert.strictEqual(push.status, 401);
+  });
+
   it('gallery: the page answers anonymously; an anonymous upload is refused', async () => {
     const page = await fetch(`${base}/gallery`);
     assert.strictEqual(page.status, 200);

serve.js

@@ -104,6 +104,7 @@ const fastify = createServer({
     // Zero config on purpose — gallery/ needs none (api.serverInfo origin,
     // container defaults to the caller's own pod).
     { module: at('gallery/plugin.js'), prefix: '/gallery' },
+    { module: at('forge/plugin.js'), prefix: '/forge' },
     // webfinger/ above owns /.well-known/webfinger — the witnessed collision
     // (remotestorage/README.md) — so remotestorage stands down here.
     { module: at('remotestorage/plugin.js'), prefix: '/remotestorage', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://localhost:${PORT}`, claimWellKnown: false } },
@@ -188,6 +189,7 @@ console.log(`  backup:         GET ${PUBLIC_URL}/backup/<pod>/  → .tar.gz of w
 console.log(`  shortlink:      POST ${PUBLIC_URL}/short  (auth; local targets only)`);
 console.log(`  oembed:         GET ${PUBLIC_URL}/oembed?url=<pod-resource-url>  (link unfurling)`);
 console.log(`  gallery:        ${PUBLIC_URL}/gallery  (photo/media gallery; streaming upload)`);
+console.log(`  forge:          ${PUBLIC_URL}/forge/  (git hosting; push http://.../forge/<you>/<repo>.git)`);
 console.log(`  jmap:           GET ${PUBLIC_URL}/jmap/session  (JMAP mail over the pod)`);
 console.log(`  remotestorage:  ${PUBLIC_URL}/remotestorage/<user>/<category>/…  (rS clients)`);
 console.log(`  metrics:        GET ${PUBLIC_URL}/metrics/healthz | /metrics/metrics  (Prometheus${process.env.METRICS_TOKEN ? ', token-guarded' : ''})`);