chore(main): release 0.8.0

[github-actions]

🤖 I have created a release beep boop

0.8.0 (2026-08-26)

⚠ BREAKING CHANGES

• node: git-receive-pack now rejects a push whose authenticated DID is not the repo owner, returning 403 before any ref update is applied. Delegated and CI keys count as non-owners: a UCAN git/push capability is verified but not yet honored for authorization, so an agent pushing under its own DID cannot push while this is on. Set GITLAWB_ENFORCE_OWNER_PUSH=false during a rolling upgrade, or have automation push as the repo owner, until scoped collaborator / UCAN-delegated push rights land.

Features

• core: carry the resumed candidate's identity in the scan token (2656718)
• node,git: cap concurrent served git ops with a 503 load-shed (#62) (5981257)

Bug Fixes

• attest: use strict Ed25519 verification with regression test (1fcbbbd)
• ci: add tested release tag resolver (1b65f70)
• ci: recognize namespaced test attributes in pr-triage's needs-tests check (1989fcc)
• ci: reject unsafe release dispatch tags (7b365b0)
• ci: reject unsafe release dispatch tags (0b990d6)
• core: count distinct signer DIDs in certificate threshold check (3993fd1)
• core: Count distinct signer DIDs in certificate threshold check (50d3cbb)
• core: enforce strict RFC 8032 Ed25519 signature verification (425ebf4)
• core: put the redirect predicate behind a feature so core stays lean (c82a70a)
• core: refuse a redirect that rewrites the signed request-target (5c0d6f3)
• core: share the origin-scoped redirect rule with the git helper (ba44a01)
• core: use strict Ed25519 signature verification (a6c13be)
• git-remote: abort fetch on EOF without POSTing; harden the real-git test harness (#192) (1cb930c)
• git-remote: drive multi-round fetch as a v0 stateless-RPC client loop (#117) (5fdf155)
• git-remote: drive multi-round fetch as a v0 stateless-RPC client loop (#117) (a64b141)
• git-remote: normalize the shim's accepted socket to blocking (10e0840)
• git-remote: normalize the shim's accepted socket to blocking (#192) (8d7f95f)
• git-remote: reject malformed pkt-line length headers instead of flushing (8c04043)
• git-remote: skip content-free flush rounds in the fetch loop (#117) (68ba492)
• gl: accept the resume token the incomplete-scan message tells you to pass (181f617)
• gl: assert 404 verdict and harden transport error handling in whoami (#220) (a329174)
• gl: assert whoami 404 verdict and preserve transport error cause (#220) (b4007a5)
• gl: follow scan continuations in gl ipfs get, bounded three ways (9a8d190)
• gl: only report registered: false on 404 in whoami (#220) (21c74c6)
• gl: only report registered: false on 404 in whoami (#220) (fd78cfa)
• gl: only report registered: false on 404 in whoami (#220) (3cc15cf)
• gl: only report registered: false on 404 in whoami (#220) (16cc3b3)
• gl: only report registered: false on 404 in whoami (#220) (3f41df5)
• gl: only report registered: false on 404 in whoami (#220) (b0e5cc0)
• gl: only report registered: false on 404 in whoami (#220) (12bc759)
• gl: only report registered: false on 404 in whoami (#220) (10e3492)
• gl: only report registered: false on 404 in whoami (#220) (c10f2ca)
• gl: only report registered: false on 404 in whoami (#220) (3add535)
• gl: only report registered: false on 404 in whoami (#220) (fdd1103)
• gl: read whoami error bodies through CappedBody.text (bfc44f9)
• gl: read whoami error bodies through CappedBody.text (4725146)
• gl: require non-empty error message and use ephemeral port in whoami tests (#220) (a27a267)
• gl: sanitize full transport error chain in whoami, remove raw error attachment (#220) (39ce655)
• gl: stop carrying request signatures to a host the node redirected us to (de3f230)
• infra: serialize the upgrade and write compose through a unique temp path (888fab6)
• ipfs: page the legacy CID scan instead of materializing every repo (4985e38)
• node,infra,macos: make the owner-push opt-out reach every launch path (1f0d9ff)
• node: bind a peer row to its DID so only its keyholder can repoint it (#273) (8d38043)
• node: bound legacy readiness fallback (5af14c2)
• node: bound peer failure tracking (74f7554)
• node: bound the fruitless reads one sweep run will spend (e4aaae8)
• node: bound the legacy CID scan and let the caller carry its position (22f4db9)
• node: bound the legacy scan's query by the remaining row budget (21e6873)
• node: bound the legacy-repair read by the pin batch deadline (ea2219b)
• node: bound the pin loops' DB work by the batch deadline, both lanes (9984e08)
• node: bound the pre-walk CID resolve on its own short budget (0d7711c)
• node: bring the Pinata pin path back into lockstep with the Kubo one (4681f54)
• node: budget provenance and fallback walks separately (ae96ffa)
• node: carry discovery onto the per-(oid, repo) incompleteness marker (bd0bef1)
• node: charge discovery's probes against the per-run read budget (bc20236)
• node: clamp every admission-held DB await in the CID resolver (bad82b3)
• node: close review findings on the owner-push default (2f0174c)
• node: count a completed fetch once per fetch, not per stateless-RPC POST (1c690c1)
• node: count fetch completion from the response outcome, not the request (5a5d4e1)
• node: enforce owner-only push by default (cdbda19)
• node: Escape LIKE metacharacters in certificate prefix search (eeafa1f)
• node: Escape LIKE wildcards in certificate prefix search (96d8123)
• node: gate GET /ipfs/{cid} tree objects so a withheld subtree's structure can't leak (#135) (21f8cb6)
• node: gate two Unix-only tests so the crate compiles on Windows (5a7a77b), closes #228
• node: give each discovery row its own slice of the pass budget (22560b0)
• node: harden peer readiness state (6bd8f41)
• node: make metrics::init race-safe with Once (c45ec96)
• node: make the pin-source incompleteness marker per (object, repo) (5575da4)
• node: map ipfs/arweave DB outages to 503 via bare ? (#251) (0e2328b)
• node: map ipfs/arweave DB outages to 503 via bare ? (#251) (c29a91a)
• node: mint a continuation when a ceiling stops the /ipfs scan mid-page (69cfbd4)
• node: never hand back a continuation that made no progress (76f6300)
• node: opaque AppError::Internal and AppError::Db HTTP bodies (#226) (241b366)
• node: opaque AppError::Internal and AppError::Db HTTP bodies (#226) (d192028)
• node: opaque GraphQL DB error messages (#250) (c10ccf1)
• node: order the CID candidate list so it cannot depend on heap order (366b599)
• node: port discovery's candidate load onto the paged repo query (4c665fb)
• node: preserve legacy peer compatibility (547f9ae)
• node: record a discovered source and its marker in one commit (9babb5e)
• node: repair source-less legacy pins by bounded additive discovery (d88c0c7)
• node: resume the /ipfs scan per candidate so a starved one is not skipped (d0635d9)
• node: rewind the pin repair sweep cursor on every completed walk (1b44b12)
• node: rotate discovery candidates across traversals (4fdfa1c)
• node: size the ipfs work floor for provenance walks plus one full search (dc5daa1)
• node: stop reporting a Kubo pin whose DB record never landed (f839fb9)
• node: stop the /ipfs size probe reporting a fault as a missing object (ed6355e)
• node: use readiness for peer liveness (225644a)
• node: use readiness for peer liveness (1a841a9)
• release: bump icaptcha-client with the rest of the workspace (6668525)
• repo_store: use SHA-256 for stable advisory-lock key (#210) (c380f9c)
• repo_store: use SHA-256 for stable advisory-lock key (#210) (89e10d0)
• review: assert the read-timeout postcondition and drop the socket clone (4d9bd5a)
• review: bound the probe's channel waits and stop overstating the handshake (d4e5ecf)
• review: bound token key, rule bytes, and the discovery load (e6cfb58)
• review: keep the resume token on every terminal that still holds one (8c39cfd)
• review: make the coupled sites findable and pin two more properties (a7e8e35)
• review: make the LIKE escape independent of the SQL parser mode (1d3987b), closes #319
• review: mint a continuation at every ceiling and widen the token (342dd48)
• test: match SHA-256 advisory-lock key in receive-pack deadline test (c68e1b0)
• whoami: update registered status handling on 404 response (75b0df8)

---

This PR was generated with Release Please. See documentation.

[euxaristia]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

[coderabbitai]

Warning

Review limit reached

@euxaristia, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e8104f9-a9ef-4ea0-b6d6-bbaa020eaf98

📥 Commits

Reviewing files that changed from the base of the PR and between e4c7458 and e070bf2.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• .release-please-manifest.json
• CHANGELOG.md
• crates/git-remote-gitlawb/Cargo.toml
• crates/gitlawb-attest/Cargo.toml
• crates/gitlawb-core/Cargo.toml
• crates/gitlawb-node/Cargo.toml
• crates/gl/Cargo.toml
• crates/icaptcha-client/Cargo.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[euxaristia]

Mechanically this is clean: pure version bumps (0.7.1 to 0.8.0 across the manifests and lockfile, including the long-owed icaptcha-client alignment), a generated changelog, no workflow edits, no checkout or token changes, CI green, and main has not moved past the changelogged commit. No migration-number conflicts with the in-flight PR stacks (those claim v27+; this touches none).

The question I want on the record before this is merged is a release-risk one: v0.8.0 would ship with eight open sev:high issues unfixed on main: #469 (uncapped anonymous Kademlia resolution), #470 (unbounded ref-update notify fields), #471 (encrypted-blob serving with no size cap), #484 (anonymous unbounded PR diffs), #485 (stats loads the full inventory per request), #487 (Tigris cold-acquire RAM buffering), #491 (silent identity regeneration), and #492 (DID-control not proven at registration). It also carries a BREAKING CHANGE (owner-only push default). None of these have open fix PRs except via the #462-#466 stack. If shipping them in 0.8.0 is an accepted risk, fine; if not, this release is worth holding until the in-flight bounds work lands. Whoever merges should make that call explicitly rather than by default.