feat: make metadata/manifest GET endpoint publicly accessible (#676 )

Remove reqRepoReader auth requirement from GET /repos/{owner}/{repo}/metadata and /manifest endpoints. PUT (update) still requires token + admin.
2026-06-21 10:18:07 -05:00
168 changed files with 5223 additions and 5897 deletions
@@ -120,6 +120,3 @@ prime/

 # A Makefile for custom make targets
 Makefile.local
-
-# Local clone of the MCP server (separate repo, not a submodule of this project)
-/mcp-mokogitea-api/
@@ -0,0 +1,42 @@
+# MokoGitea
+
+Fork of Gitea -- self-hosted Git service at git.mokoconsulting.tech. Go backend + TypeScript frontend.
+
+## Quick Reference
+
+| Field | Value |
+|---|---|
+| **Language** | Go 1.26+ / TypeScript |
+| **Module** | `code.mokoconsulting.tech/MokoConsulting/MokoGitea` |
+| **Branch** | develop on `dev`, merge to `main` (protected) |
+| **Wiki** | [MokoGitea Wiki](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki) |
+
+## Commands
+
+```bash
+make help             # List all available targets
+make fmt              # Format .go files
+make lint-go          # Lint Go code
+make lint-js          # Lint TypeScript
+make tidy             # After go.mod changes
+make build            # Build binary
+
+# Testing
+go test -run '^TestName$' ./modulepath/        # Single Go test
+pnpm exec vitest <path-filter>                 # Single JS test
+GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e  # Single Playwright test
+```
+
+## Rules
+
+- Add current year copyright header on new `.go` files
+- No trailing whitespace in edited files
+- Conventional Commits for commit messages and PR titles
+- Never force-push, amend, or squash unless asked -- use new commits
+- Preserve existing code comments
+- TypeScript: use `!` (non-null assertion) not `?.`/`??` when value is known to exist
+- CSS: prefer `flex-*` helpers over per-child `tw-ml-*`/`tw-mr-*` margins
+- Add `Co-Authored-By` lines to all commits
+- **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
+- **Attribution**: `Authored-by: Moko Consulting`
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/mokoplatform/wiki/Home)
@@ -0,0 +1,110 @@
+---
+name: Architecture Decision Record (ADR)
+about: Propose or document an architectural decision
+title: '[ADR] '
+labels: 'architecture, decision'
+assignees: ''
+
+---
+
+
+## ADR Number
+ADR-XXXX
+
+## Status
+- [ ] Proposed
+- [ ] Accepted
+- [ ] Deprecated
+- [ ] Superseded by ADR-XXXX
+
+## Context
+Describe the issue or problem that motivates this decision.
+
+## Decision
+State the architecture decision and provide rationale.
+
+## Consequences
+### Positive
+- List positive consequences
+
+### Negative
+- List negative consequences or trade-offs
+
+### Neutral
+- List neutral aspects
+
+## Alternatives Considered
+### Alternative 1
+- Description
+- Pros
+- Cons
+- Why not chosen
+
+### Alternative 2
+- Description
+- Pros
+- Cons
+- Why not chosen
+
+## Implementation Plan
+1. Step 1
+2. Step 2
+3. Step 3
+
+## Stakeholders
+- **Decision Makers**: @user1, @user2
+- **Consulted**: @user3, @user4
+- **Informed**: team-name
+
+## Technical Details
+### Architecture Diagram
+```
+[Add diagram or link]
+```
+
+### Dependencies
+- Dependency 1
+- Dependency 2
+
+### Impact Analysis
+- **Performance**: [Impact description]
+- **Security**: [Impact description]
+- **Scalability**: [Impact description]
+- **Maintainability**: [Impact description]
+
+## Testing Strategy
+- [ ] Unit tests
+- [ ] Integration tests
+- [ ] Performance tests
+- [ ] Security tests
+
+## Documentation
+- [ ] Architecture documentation updated
+- [ ] API documentation updated
+- [ ] Developer guide updated
+- [ ] Runbook created
+
+## Migration Path
+Describe how to migrate from current state to new architecture.
+
+## Rollback Plan
+Describe how to rollback if issues occur.
+
+## Timeline
+- **Proposal Date**:
+- **Decision Date**:
+- **Implementation Start**:
+- **Expected Completion**:
+
+## References
+- Related ADRs:
+- External resources:
+- RFCs:
+
+## Review Checklist
+- [ ] Aligns with enterprise architecture principles
+- [ ] Security implications reviewed
+- [ ] Performance implications reviewed
+- [ ] Cost implications reviewed
+- [ ] Compliance requirements met
+- [ ] Team consensus achieved
@@ -0,0 +1,48 @@
+---
+name: Bug Report
+about: Report a bug or issue with the project
+title: '[BUG] '
+labels: 'bug'
+assignees: ''
+
+---
+
+
+## Bug Description
+A clear and concise description of what the bug is.
+
+## Steps to Reproduce
+1. Go to '...'
+2. Click on '...'
+3. Scroll down to '...'
+4. See error
+
+## Expected Behavior
+A clear and concise description of what you expected to happen.
+
+## Actual Behavior
+A clear and concise description of what actually happened.
+
+## Screenshots
+If applicable, add screenshots to help explain your problem.
+
+## Environment
+- **Project**: [e.g., MokoDoliTools, moko-cassiopeia]
+- **Version**: [e.g., 1.2.3]
+- **Platform**: [e.g., Dolibarr 18.0, Joomla 5.0]
+- **PHP Version**: [e.g., 8.1]
+- **Database**: [e.g., MySQL 8.0, PostgreSQL 14]
+- **Browser** (if applicable): [e.g., Chrome 120, Firefox 121]
+- **OS**: [e.g., Ubuntu 22.04, Windows 11]
+
+## Additional Context
+Add any other context about the problem here.
+
+## Possible Solution
+If you have suggestions on how to fix the issue, please describe them here.
+
+## Checklist
+- [ ] I have searched for similar issues before creating this one
+- [ ] I have provided all the requested information
+- [ ] I have tested this on the latest stable version
+- [ ] I have checked the documentation and couldn't find a solution
@@ -0,0 +1,18 @@
+---
+blank_issues_enabled: true
+contact_links:
+  - name: 💼 Enterprise Support
+    url: https://mokoconsulting.tech/enterprise
+    about: Enterprise-level support and consultation services
+  - name: 💬 Ask a Question
+    url: https://mokoconsulting.tech/
+    about: Get help or ask questions through our website
+  - name: 📚 MokoStandards Documentation
+    url: https://code.mokoconsulting.tech/MokoConsulting/mokoplatform
+    about: View our coding standards and best practices
+  - name: 🔒 Report a Security Vulnerability
+    url: https://code.mokoconsulting.tech/mokoconsulting-tech/.github-private/security/advisories/new
+    about: Report security vulnerabilities privately (for critical issues)
+  - name: 💡 Community Discussions
+    url: https://github.com/orgs/mokoconsulting-tech/discussions
+    about: Join community discussions and Q&A
@@ -0,0 +1,52 @@
+---
+name: Documentation Issue
+about: Report an issue with documentation
+title: '[DOCS] '
+labels: 'documentation'
+assignees: ''
+
+---
+
+
+## Documentation Issue
+
+**Location**: 
+<!-- Specify the file, page, or section with the issue -->
+
+## Issue Type
+<!-- Mark the relevant option with an "x" -->
+- [ ] Typo or grammar error
+- [ ] Outdated information
+- [ ] Missing documentation
+- [ ] Unclear explanation
+- [ ] Broken links
+- [ ] Missing examples
+- [ ] Other (specify below)
+
+## Description
+<!-- Clearly describe the documentation issue -->
+
+## Current Content
+<!-- Quote or describe the current documentation (if applicable) -->
+```
+Current text here
+```
+
+## Suggested Improvement
+<!-- Provide your suggestion for how to improve the documentation -->
+```
+Suggested text here
+```
+
+## Additional Context
+<!-- Add any other context, screenshots, or references -->
+
+## Standards Alignment
+- [ ] Follows MokoStandards documentation guidelines
+- [ ] Uses en_US/en_GB localization
+- [ ] Includes proper SPDX headers where applicable
+
+## Checklist
+- [ ] I have searched for similar documentation issues
+- [ ] I have provided a clear description
+- [ ] I have suggested an improvement (if applicable)
@@ -0,0 +1,51 @@
+---
+name: Feature Request
+about: Suggest a new feature or enhancement
+title: '[FEATURE] '
+labels: 'enhancement'
+assignees: ''
+
+---
+
+
+## Feature Description
+A clear and concise description of the feature you'd like to see.
+
+## Problem or Use Case
+Describe the problem this feature would solve or the use case it addresses.
+Ex. I'm always frustrated when [...]
+
+## Proposed Solution
+A clear and concise description of what you want to happen.
+
+## Alternative Solutions
+A clear and concise description of any alternative solutions or features you've considered.
+
+## Benefits
+Describe how this feature would benefit users:
+- Who would use this feature?
+- What problems does it solve?
+- What value does it add?
+
+## Implementation Details (Optional)
+If you have ideas about how this could be implemented, share them here:
+- Technical approach
+- Files/components that might need changes
+- Any concerns or challenges you foresee
+
+## Additional Context
+Add any other context, mockups, or screenshots about the feature request here.
+
+## Relevant Standards
+Does this relate to any standards in [MokoStandards](https://code.mokoconsulting.tech/MokoConsulting/MokoStandards)?
+- [ ] Accessibility (WCAG 2.1 AA)
+- [ ] Localization (en_US/en_GB)
+- [ ] Security best practices
+- [ ] Code quality standards
+- [ ] Other: [specify]
+
+## Checklist
+- [ ] I have searched for similar feature requests before creating this one
+- [ ] I have clearly described the use case and benefits
+- [ ] I have considered alternative solutions
+- [ ] This feature aligns with the project's goals and scope
@@ -0,0 +1,82 @@
+---
+name: Question
+about: Ask a question about usage, features, or best practices
+title: '[QUESTION] '
+labels: ['question']
+assignees: ['jmiller']
+---
+
+
+## Question
+
+**Your question:**
+
+
+## Context
+
+**What are you trying to accomplish?**
+
+
+**What have you already tried?**
+
+
+**Category**:
+- [ ] Script usage
+- [ ] Configuration
+- [ ] Workflow setup
+- [ ] Documentation interpretation
+- [ ] Best practices
+- [ ] Integration
+- [ ] Other: __________
+
+## Environment (if relevant)
+
+**Your setup**:
+- Operating System:
+- Version:
+
+## What You've Researched
+
+**Documentation reviewed**:
+- [ ] README.md
+- [ ] Project documentation
+- [ ] Other (specify): __________
+
+**Similar issues/questions found**:
+- #
+- #
+
+## Expected Outcome
+
+**What result are you hoping for?**
+
+
+## Code/Configuration Samples
+
+**Relevant code or configuration** (if applicable):
+
+```bash
+# Your code here
+```
+
+## Additional Context
+
+**Any other relevant information:**
+
+
+**Screenshots** (if helpful):
+
+
+## Urgency
+
+- [ ] Urgent (blocking work)
+- [ ] Normal (can work on other things meanwhile)
+- [ ] Low priority (just curious)
+
+## Checklist
+
+- [ ] I have searched existing issues and discussions
+- [ ] I have reviewed relevant documentation
+- [ ] I have provided sufficient context
+- [ ] I have included code/configuration samples if relevant
+- [ ] This is a genuine question (not a bug report or feature request)
@@ -0,0 +1,126 @@
+---
+name: Request for Comments (RFC)
+about: Propose a significant change for community discussion
+title: '[RFC] '
+labels: 'rfc, discussion'
+assignees: ''
+
+---
+
+
+## RFC Summary
+One-paragraph summary of the proposal.
+
+## Motivation
+Why are we doing this? What use cases does it support? What is the expected outcome?
+
+## Detailed Design
+### Overview
+Provide a detailed explanation of the proposed change.
+
+### API Changes (if applicable)
+```php
+// Before
+function oldApi($param1) { }
+
+// After
+function newApi($param1, $param2) { }
+```
+
+### User Experience Changes
+Describe how users will interact with this change.
+
+### Implementation Approach
+High-level implementation strategy.
+
+## Drawbacks
+Why should we *not* do this?
+
+## Alternatives
+What other designs have been considered? What is the impact of not doing this?
+
+### Alternative 1
+- Description
+- Trade-offs
+
+### Alternative 2
+- Description
+- Trade-offs
+
+## Adoption Strategy
+How will existing users adopt this? Is this a breaking change?
+
+### Migration Guide
+```bash
+# Steps to migrate
+```
+
+### Deprecation Timeline
+- **Announcement**:
+- **Deprecation**:
+- **Removal**:
+
+## Unresolved Questions
+- Question 1
+- Question 2
+
+## Future Possibilities
+What future work does this enable?
+
+## Impact Assessment
+### Performance
+Expected performance impact.
+
+### Security
+Security considerations and implications.
+
+### Compatibility
+- **Backward Compatible**: [Yes / No]
+- **Breaking Changes**: [List]
+
+### Maintenance
+Long-term maintenance considerations.
+
+## Community Input
+### Stakeholders
+- [ ] Core team
+- [ ] Module developers
+- [ ] End users
+- [ ] Enterprise customers
+
+### Feedback Period
+**Duration**: [e.g., 2 weeks]
+**Deadline**: [date]
+
+## Implementation Timeline
+### Phase 1: Design
+- [ ] RFC discussion
+- [ ] Design finalization
+- [ ] Approval
+
+### Phase 2: Implementation
+- [ ] Core implementation
+- [ ] Tests
+- [ ] Documentation
+
+### Phase 3: Release
+- [ ] Beta release
+- [ ] Feedback collection
+- [ ] Stable release
+
+## Success Metrics
+How will we measure success?
+- Metric 1
+- Metric 2
+
+## References
+- Related RFCs:
+- External documentation:
+- Prior art:
+
+## Open Questions for Community
+1. Question 1?
+2. Question 2?
+
+---
+**Note**: This RFC is open for community discussion. Please provide feedback in the comments below.
@@ -0,0 +1,51 @@
+---
+name: Security Vulnerability Report
+about: Report a security vulnerability (use only for non-critical issues)
+title: '[SECURITY] '
+labels: 'security'
+assignees: ''
+
+---
+
+
+## ⚠️ IMPORTANT: Private Disclosure Required
+
+**For critical security vulnerabilities, DO NOT use this template.**
+Follow the process in [SECURITY.md](../SECURITY.md) for responsible disclosure.
+
+Use this template only for:
+- Security improvements
+- Non-critical security suggestions
+- Security documentation updates
+
+---
+
+## Security Issue
+
+**Severity**: 
+<!-- Low, Medium, or informational only -->
+
+## Description
+<!-- Describe the security concern or improvement suggestion -->
+
+## Affected Components
+<!-- List the affected files, features, or components -->
+
+## Suggested Mitigation
+<!-- Describe how this could be addressed -->
+
+## Standards Reference
+Does this relate to security standards in [MokoStandards](https://code.mokoconsulting.tech/MokoConsulting/MokoStandards)?
+- [ ] SPDX license identifiers
+- [ ] Secret management
+- [ ] Dependency security
+- [ ] Access control
+- [ ] Other: [specify]
+
+## Additional Context
+<!-- Add any other context about the security concern -->
+
+## Checklist
+- [ ] This is NOT a critical vulnerability requiring private disclosure
+- [ ] I have reviewed the SECURITY.md policy
+- [ ] I have provided sufficient detail for evaluation
@@ -0,0 +1,9 @@
+---
+name: ".mokogitea Test Template"
+about: "Verify .mokogitea issue templates work"
+labels: ["test"]
+---
+
+This template was loaded from `.mokogitea/ISSUE_TEMPLATE/`.
+
+If you can see this, the `.mokogitea` dot-folder feature is working.
@@ -0,0 +1,24 @@
+---
+name: Version Bump
+about: Request or track a version change
+title: '[VERSION] '
+labels: 'version, type: version'
+assignees: 'jmiller'
+---
+
+## Version Change
+
+**Current version**: <!-- e.g., 01.02.03 -->
+**Requested version**: <!-- e.g., 01.03.00 -->
+**Change type**: <!-- patch / minor / major -->
+
+## Reason
+
+<!-- Why is this version bump needed? -->
+
+## Checklist
+
+- [ ] README.md `VERSION:` field updated
+- [ ] CHANGELOG.md entry added
+- [ ] Module descriptor version updated (Dolibarr: `$this->version`, Joomla: `<version>`)
+- [ ] All file headers will be auto-propagated by `sync-version-on-merge` workflow
@@ -0,0 +1,251 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokoplatform.Automation
+# REPO: https://code.mokoconsulting.tech/MokoConsulting/mokoplatform
+# PATH: /.gitea/workflows/branch-protection.yml
+# BRIEF: Apply standardised branch protection rules to all governed repositories
+#
+# +========================================================================+
+# |                   BRANCH PROTECTION SETUP                              |
+# +========================================================================+
+# |                                                                        |
+# |  Applies protection rules for: main, dev, rc, beta, alpha       |
+# |                                                                        |
+# |  main  — Require PR, block rejected reviews, no force push             |
+# |  dev   — Allow push, no force push, no delete                          |
+# |  rc  — Allow push, no force push, no delete                          |
+# |  beta — Allow push, no force push, no delete                         |
+# |  alpha — Allow push, no force push, no delete                        |
+# |                                                                        |
+# |  jmiller has override authority on all branches.                       |
+# |                                                                        |
+# +========================================================================+
+
+name: Branch Protection Setup
+
+on:
+  schedule:
+    - cron: '0 2 * * 1'  # Weekly Monday 02:00 UTC
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Preview mode (no changes)'
+        required: false
+        type: boolean
+        default: false
+      repos:
+        description: 'Comma-separated repo names (empty = all governed repos)'
+        required: false
+        type: string
+        default: ''
+
+env:
+  GITEA_URL: https://code.mokoconsulting.tech
+  GITEA_ORG: MokoConsulting
+
+permissions:
+  contents: read
+
+jobs:
+  protect:
+    name: Apply Branch Protection Rules
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Determine target repos
+        id: repos
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+        run: |
+          API="${GITEA_URL}/api/v1"
+
+          # Platform/standards/infra repos to exclude
+          EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private MokoStandards mokoplatform MokoTesting"
+          EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
+
+          if [ -n "${{ inputs.repos }}" ]; then
+            # User-specified repos
+            REPOS=$(echo "${{ inputs.repos }}" | tr ',' ' ')
+          else
+            # Fetch all org repos
+            PAGE=1
+            REPOS=""
+            while true; do
+              BATCH=$(curl -sS \
+                -H "Authorization: token ${GA_TOKEN}" \
+                "${API}/orgs/${GITEA_ORG}/repos?page=${PAGE}&limit=50" \
+                | jq -r '.[].name // empty')
+              [ -z "$BATCH" ] && break
+              REPOS="$REPOS $BATCH"
+              PAGE=$((PAGE + 1))
+            done
+
+            # Filter out excluded repos
+            FILTERED=""
+            for REPO in $REPOS; do
+              SKIP=false
+              for EX in $EXCLUDE; do
+                if [ "$REPO" = "$EX" ]; then
+                  SKIP=true
+                  break
+                fi
+              done
+              if [ "$SKIP" = "false" ]; then
+                FILTERED="$FILTERED $REPO"
+              fi
+            done
+            REPOS="$FILTERED"
+          fi
+
+          echo "repos=$REPOS" >> "$GITHUB_OUTPUT"
+          COUNT=$(echo "$REPOS" | wc -w)
+          echo "📋 Target repos (${COUNT}): $REPOS"
+
+      - name: Apply protection rules
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          DRY_RUN: ${{ inputs.dry_run || 'false' }}
+        run: |
+          API="${GITEA_URL}/api/v1"
+          REPOS="${{ steps.repos.outputs.repos }}"
+
+          SUCCESS=0
+          FAILED=0
+          SKIPPED=0
+
+          # ── Rule definitions ──────────────────────────────────────
+          # Only the CI bot (jmiller token) can push directly.
+          # All human contributors must use PRs.
+          # Force push disabled on all branches.
+
+          RULE_MAIN='{
+            "rule_name": "main",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "dismiss_stale_approvals": true,
+            "block_on_rejected_reviews": true,
+            "block_on_outdated_branch": false,
+            "priority": 1
+          }'
+
+          RULE_DEV='{
+            "rule_name": "dev",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 2
+          }'
+
+          RULE_RC='{
+            "rule_name": "rc",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 3
+          }'
+
+          RULE_BETA='{
+            "rule_name": "beta",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 4
+          }'
+
+          RULE_ALPHA='{
+            "rule_name": "alpha",
+            "enable_push": true,
+            "enable_push_whitelist": true,
+            "push_whitelist_usernames": ["jmiller"],
+            "enable_force_push": false,
+            "enable_force_push_allowlist": false,
+            "force_push_allowlist_usernames": [],
+            "enable_merge_whitelist": false,
+            "required_approvals": 0,
+            "block_on_rejected_reviews": false,
+            "priority": 5
+          }'
+
+          RULES=("$RULE_MAIN" "$RULE_DEV" "$RULE_RC" "$RULE_BETA" "$RULE_ALPHA")
+          RULE_NAMES=("main" "dev" "rc" "beta" "alpha")
+
+          # ── Apply rules to each repo ──────────────────────────────
+          for REPO in $REPOS; do
+            echo ""
+            echo "═══ ${REPO} ═══"
+
+            for i in "${!RULES[@]}"; do
+              RULE="${RULES[$i]}"
+              NAME="${RULE_NAMES[$i]}"
+
+              if [ "$DRY_RUN" = "true" ]; then
+                echo "  [DRY RUN] Would apply rule: ${NAME}"
+                SKIPPED=$((SKIPPED + 1))
+                continue
+              fi
+
+              # Delete existing rule if present (idempotent recreate)
+              ENCODED_NAME=$(echo "$NAME" | sed 's|/|%2F|g')
+              curl -sS -o /dev/null -w "" \
+                -X DELETE \
+                -H "Authorization: token ${GA_TOKEN}" \
+                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections/${ENCODED_NAME}" 2>/dev/null || true
+
+              # Create rule
+              RESPONSE=$(curl -sS -w "\n%{http_code}" \
+                -X POST \
+                -H "Authorization: token ${GA_TOKEN}" \
+                -H "Content-Type: application/json" \
+                -d "$RULE" \
+                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections")
+
+              HTTP=$(echo "$RESPONSE" | tail -1)
+              BODY=$(echo "$RESPONSE" | sed '$d')
+
+              if [ "$HTTP" = "201" ]; then
+                echo "  ✅ ${NAME}"
+                SUCCESS=$((SUCCESS + 1))
+              else
+                echo "  ❌ ${NAME} (HTTP ${HTTP}): $(echo "$BODY" | jq -r '.message // .' 2>/dev/null | head -1)"
+                FAILED=$((FAILED + 1))
+              fi
+            done
+          done
+
+          # ── Summary ───────────────────────────────────────────────
+          echo ""
+          echo "════════════════════════════════════════"
+          echo "  ✅ Success: ${SUCCESS}"
+          echo "  ❌ Failed:  ${FAILED}"
+          echo "  ⏭️  Skipped: ${SKIPPED}"
+          echo "════════════════════════════════════════"
+
+          if [ "$FAILED" -gt 0 ]; then
+            echo "::warning::${FAILED} rule(s) failed to apply"
+          fi
@@ -0,0 +1,42 @@
+<!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue -->
+
+<!--
+    1. Please speak English, this is the language all maintainers can speak and write.
+    2. Please ask questions or configuration/deploy problems on our Discord
+       server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
+    3. Please take a moment to check that your issue doesn't already exist.
+    4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
+    5. Please give all relevant information below for bug reports, because
+       incomplete details will be handled as an invalid report.
+-->
+
+- Gitea version (or commit ref):
+- Git version:
+- Operating system:
+  <!-- Please include information on whether you built gitea yourself, used one of our downloads or are using some other package -->
+  <!-- Please also tell us how you are running gitea, e.g. if it is being run from docker, a command-line, systemd etc. --->
+  <!-- If you are using a package or systemd tell us what distribution you are using -->
+- Database (use `[x]`):
+  - [ ] PostgreSQL
+  - [ ] MySQL
+  - [ ] MSSQL
+  - [ ] SQLite
+- Can you reproduce the bug at https://demo.gitea.com:
+  - [ ] Yes (provide example URL)
+  - [ ] No
+- Log gist:
+<!-- It really is important to provide pertinent logs -->
+<!-- Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help -->
+<!-- In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini -->
+
+## Description
+<!-- If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please
+     disable the proxy/CDN fully and connect to gitea directly to confirm
+     the issue still persists without those services. -->
+
+...
+
+
+## Screenshots
+
+<!-- **If this issue involves the Web Interface, please include a screenshot** -->
@@ -0,0 +1,66 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/auto-bump.yml
+# VERSION: 09.02.00
+# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
+
+name: "Universal: Auto Version Bump"
+
+on:
+  push:
+    branches:
+      - dev
+      - rc
+      - 'feature/**'
+      - 'patch/**'
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    name: Version Bump
+    runs-on: release
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip bump]') &&
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup mokocli tools
+        run: |
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+          if [ -d "/opt/mokocli/cli" ]; then
+            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
+          else
+            git clone --depth 1 --branch main --quiet \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+              /tmp/mokocli
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
+          fi
+
+      - name: Bump version
+        run: |
+          php ${MOKO_CLI}/version_auto_bump.php \
+            --path . --branch "${GITHUB_REF_NAME}" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
@@ -0,0 +1,421 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/universal/auto-release.yml.template
+# VERSION: 05.00.00
+# BRIEF: Universal build & release � detects platform from manifest.xml
+#
+# +========================================================================+
+# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
+# +========================================================================+
+# |                                                                        |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
+# |                                                                        |
+# |  Platform-specific:                                                    |
+# |    joomla:   XML manifest, type-prefixed packages                      |
+# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
+# |    generic:  README-only, no update stream                             |
+# |                                                                        |
+# +========================================================================+
+
+name: "Universal: Build & Release"
+
+on:
+  pull_request:
+    types: [opened, closed]
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      action:
+        description: 'Action to perform'
+        required: false
+        type: choice
+        default: release
+        options:
+          - release
+          - promote-rc
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+permissions:
+  contents: write
+
+jobs:
+  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────
+  promote-rc:
+    name: Promote to RC
+    runs-on: release
+    if: >-
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli
+            composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: Rename branch to rc
+        run: |
+          php ${MOKO_CLI}/branch_rename.php \
+            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
+            --pr "${{ github.event.pull_request.number }}"
+
+      - name: Checkout rc and configure git
+        run: |
+          git fetch origin rc
+          git checkout rc
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+      - name: Publish RC release
+        run: |
+          php ${MOKO_CLI}/release_publish.php \
+            --path . --stability rc --bump minor --branch rc \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+
+      - name: Update RC release notes from CHANGELOG.md
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Extract [Unreleased] section from changelog
+          NOTES=""
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          fi
+          [ -z "$NOTES" ] && NOTES="Release candidate"
+
+          # Find the RC release and update its body
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/release-candidate" \
+            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "RC release notes updated from CHANGELOG.md"
+          fi
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
+          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
+
+  # ── Merged PR → Build & Release (or promote RC to stable) ────────────────────
+  release:
+    name: Build & Release Pipeline
+    runs-on: release
+    if: >-
+      github.event.pull_request.merged == true ||
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          fetch-depth: 0
+
+      - name: Configure git for bot pushes
+        run: |
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+      - name: Check for merge conflict markers
+        run: |
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          if [ -n "$CONFLICTS" ]; then
+            echo "::error::Merge conflict markers found — aborting release"
+            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "No conflict markers found"
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
+        run: |
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli
+            composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: "Detect platform"
+        id: platform
+        run: |
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
+
+      - name: "Determine version bump level"
+        id: bump
+        run: |
+          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
+          # Feature/dev branches: bump minor for the new stable release
+          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
+          case "$HEAD_REF" in
+            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
+            *)                               BUMP="minor" ;;
+          esac
+          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
+          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+
+      - name: "Publish stable release"
+        run: |
+          BUMP_FLAG=""
+          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
+            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
+          fi
+          php ${MOKO_CLI}/release_publish.php \
+            --path . --stability stable ${BUMP_FLAG} --branch main \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+
+      - name: "Read published version"
+        id: version
+        run: |
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=stable" >> "$GITHUB_OUTPUT"
+          echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+          echo "branch=main" >> "$GITHUB_OUTPUT"
+          echo "Published version: ${VERSION}"
+
+      - name: Update release notes and promote changelog
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Get the stable release info (version and ID)
+          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
+          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
+          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
+          VERSION=$(python3 -c "
+          import json, sys, re
+          r = json.load(sys.stdin)
+          name = r.get('name', '')
+          m = re.search(r'(\d+\.\d+\.\d+)', name)
+          print(m.group(1) if m else '')
+          " <<< "$RELEASE_JSON" 2>/dev/null || true)
+
+          # Extract [Unreleased] section from changelog
+          NOTES=""
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          fi
+          [ -z "$NOTES" ] && NOTES="Stable release"
+
+          # Update release body via API
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
+          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
+            DATE=$(date +%Y-%m-%d)
+            python3 -c "
+          import sys
+          version, date = sys.argv[1], sys.argv[2]
+          content = open('CHANGELOG.md').read()
+          old = '## [Unreleased]'
+          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
+          content = content.replace(old, new, 1)
+          open('CHANGELOG.md', 'w').write(content)
+          " "$VERSION" "$DATE"
+            git add CHANGELOG.md
+            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
+            git push origin main || true
+            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
+          fi
+
+      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
+      - name: "Step 9: Mirror release to GitHub"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          secrets.GH_MIRROR_TOKEN != ''
+        continue-on-error: true
+        run: |
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_mirror.php \
+            --version "$VERSION" --tag "$RELEASE_TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
+            --branch main 2>&1 || true
+          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
+
+      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
+      - name: "Step 10: Push main to GitHub mirror"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          secrets.GH_MIRROR_TOKEN != ''
+        continue-on-error: true
+        run: |
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
+          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
+          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
+            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
+          git fetch origin main --depth=1
+          git push github origin/main:refs/heads/main --force 2>/dev/null \
+            && echo "main branch pushed to GitHub mirror" \
+            || echo "WARNING: GitHub mirror push failed"
+
+      - name: "Step 11: Delete rc branch and recreate dev from main"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Delete rc branch (ephemeral — created by promote-rc)
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/branches/rc" 2>/dev/null \
+            && echo "Deleted rc branch" || echo "rc branch not found"
+
+          # Delete dev branch
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
+
+          # Recreate dev from main (now includes version bump + changelog promotion)
+          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API_BASE}/branches" \
+            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
+
+          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
+
+      - name: "Step 12: Create version branch from main"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          BRANCH_NAME="version/${VERSION}"
+          MAIN_SHA=$(git rev-parse HEAD)
+
+          # Delete old version branch if it exists (same version re-release)
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
+
+          # Create version/XX.YY.ZZ from main
+          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
+
+          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
+
+
+
+      # -- Dolibarr post-release: Reset dev version -----------------------------
+      - name: "Post-release: Reset dev version"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/version_reset_dev.php \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
+            --branch dev --path . 2>&1 || true
+
+      # -- Summary --------------------------------------------------------------
+      - name: Pipeline Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
+            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
+            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
+            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
+            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+          fi
@@ -0,0 +1,48 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/branch-cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Delete feature branches after PR merge
+
+name: "Branch Cleanup"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  cleanup:
+    name: Delete merged branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref != 'dev' &&
+      github.event.pull_request.head.ref != 'main'
+
+    steps:
+      - name: Delete source branch
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          elif [ "$STATUS" = "404" ]; then
+            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
+          fi
@@ -0,0 +1,10 @@
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Cascade disabled — auto-release handles dev recreation"
@@ -0,0 +1,191 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.gitea/workflows/ci-generic.yml
+# VERSION: 01.00.00
+# BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
+
+name: "Generic: Project CI"
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Lint & Validate ───────────────────────────────────────────────────
+  lint:
+    name: Lint & Validate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect toolchain
+        id: detect
+        run: |
+          HAS_PHP=false
+          HAS_NODE=false
+          [ -f "composer.json" ] && HAS_PHP=true
+          [ -f "package.json" ] && HAS_NODE=true
+          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
+          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
+          echo "Toolchain: PHP=$HAS_PHP Node=$HAS_NODE"
+
+      - name: Setup PHP
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+          php -v
+
+      - name: Setup Node.js
+        if: steps.detect.outputs.has_node == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install PHP dependencies
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "composer.json" ]; then
+            composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
+          fi
+
+      - name: Install Node.js dependencies
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "package.json" ]; then
+            npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true
+          fi
+
+      - name: PHP syntax check
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              echo "::error file=${file}::PHP syntax error"
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -not -path "./node_modules/*" -print0)
+
+          echo "## PHP Lint" >> $GITHUB_STEP_SUMMARY
+          if [ "$ERRORS" -eq 0 ]; then
+            echo "All PHP files passed syntax check." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "${ERRORS} file(s) with syntax errors." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+      - name: TypeScript/JavaScript lint
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "node_modules/.bin/eslint" ]; then
+            npx eslint src/ --quiet 2>&1 || { echo "::error::ESLint errors found"; exit 1; }
+            echo "## ESLint" >> $GITHUB_STEP_SUMMARY
+            echo "All files passed ESLint." >> $GITHUB_STEP_SUMMARY
+          elif [ -f ".eslintrc.json" ] || [ -f ".eslintrc.js" ] || [ -f "eslint.config.js" ]; then
+            echo "::warning::ESLint config found but eslint not installed"
+          else
+            echo "No ESLint configured — skipping"
+          fi
+
+      - name: TypeScript compile check
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "tsconfig.json" ] && [ -f "node_modules/.bin/tsc" ]; then
+            npx tsc --noEmit 2>&1 || { echo "::error::TypeScript compilation errors"; exit 1; }
+            echo "## TypeScript" >> $GITHUB_STEP_SUMMARY
+            echo "TypeScript compilation passed." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: PHPStan static analysis
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "phpstan.neon" ] && [ -f "vendor/bin/phpstan" ]; then
+            vendor/bin/phpstan analyse --no-progress 2>&1 || { echo "::warning::PHPStan found issues"; }
+          fi
+
+  # ── Tests ─────────────────────────────────────────────────────────────
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    needs: lint
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect toolchain
+        id: detect
+        run: |
+          HAS_PHP=false
+          HAS_NODE=false
+          [ -f "composer.json" ] && HAS_PHP=true
+          [ -f "package.json" ] && HAS_NODE=true
+          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
+          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
+
+      - name: Setup PHP
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: Setup Node.js
+        if: steps.detect.outputs.has_node == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: |
+          [ -f "composer.json" ] && composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
+          [ -f "package.json" ] && { npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true; }
+
+      - name: Run PHP tests
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "vendor/bin/phpunit" ]; then
+            vendor/bin/phpunit --testdox 2>&1
+            echo "## PHPUnit" >> $GITHUB_STEP_SUMMARY
+            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
+          elif [ -f "phpunit.xml" ] || [ -f "phpunit.xml.dist" ]; then
+            echo "::warning::PHPUnit config found but phpunit not installed"
+          else
+            echo "No PHPUnit configured — skipping"
+          fi
+
+      - name: Run Node.js tests
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if jq -e '.scripts.test' package.json > /dev/null 2>&1; then
+            npm test 2>&1
+            echo "## Node.js Tests" >> $GITHUB_STEP_SUMMARY
+            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No test script in package.json — skipping"
+          fi
+
+      - name: Build check
+        run: |
+          if [ -f "Makefile" ]; then
+            make build 2>&1 || echo "::warning::Build failed or not configured"
+          elif [ -f "package.json" ] && jq -e '.scripts.build' package.json > /dev/null 2>&1; then
+            npm run build 2>&1 || echo "::warning::Build failed"
+          fi
@@ -0,0 +1,87 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.gitea/workflows/cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
+
+name: "Universal: Repository Cleanup"
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'  # Weekly on Sunday at 03:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  cleanup:
+    name: Clean Merged Branches
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GA_TOKEN }}
+
+      - name: Delete merged branches
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+        run: |
+          echo "=== Merged Branch Cleanup ==="
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+
+          # List branches via API
+          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+            "${API}/branches?limit=50" | jq -r '.[].name')
+
+          DELETED=0
+          for BRANCH in $BRANCHES; do
+            # Skip protected branches
+            case "$BRANCH" in
+              main|master|develop|release/*|hotfix/*) continue ;;
+            esac
+
+            # Check if branch is merged into main
+            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
+              echo "  Deleting merged branch: ${BRANCH}"
+              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+                "${API}/branches/${BRANCH}" 2>/dev/null || true
+              DELETED=$((DELETED + 1))
+            fi
+          done
+
+          echo "Deleted ${DELETED} merged branch(es)"
+
+      - name: Clean old workflow runs
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+        run: |
+          echo "=== Workflow Run Cleanup ==="
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
+
+          # Get old completed runs
+          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+            "${API}/actions/runs?status=completed&limit=50" | \
+            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
+
+          DELETED=0
+          for RUN_ID in $RUNS; do
+            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
+            DELETED=$((DELETED + 1))
+          done
+
+          echo "Deleted ${DELETED} old workflow run(s)"
@@ -0,0 +1,76 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+name: "Publish to Composer"
+
+on:
+  push:
+    tags:
+      - 'v*'
+      - '[0-9]*.[0-9]*.[0-9]*'
+  release:
+    types: [published]
+  workflow_dispatch:
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  publish:
+    name: Publish Package
+    runs-on: ubuntu-latest
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip publish]')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+
+      - name: Install dependencies
+        run: composer install --no-dev --no-interaction --prefer-dist --quiet
+
+      - name: Determine version
+        id: version
+        run: |
+          VERSION=$(php -r "echo json_decode(file_get_contents('composer.json'))->version;")
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Package version: ${VERSION}"
+
+      # Gitea Composer Registry — auto-publishes from tags
+      # The tag push itself registers the package at:
+      # https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer
+      - name: Verify Gitea registry
+        run: |
+          echo "Gitea Composer registry auto-publishes from tags."
+          echo "Package available at: ${GITEA_URL}/api/packages/MokoConsulting/composer"
+          echo "Install: composer require mokoconsulting/mokocli"
+
+      # Packagist — notify of new version
+      - name: Notify Packagist
+        if: secrets.PACKAGIST_TOKEN != ''
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          echo "Notifying Packagist of version ${VERSION}..."
+          curl -sf -X POST \
+            -H "Content-Type: application/json" \
+            -d '{"repository":{"url":"https://git.mokoconsulting.tech/MokoConsulting/mokocli"}}' \
+            "https://packagist.org/api/update-package?username=mokoconsulting&apiToken=${{ secrets.PACKAGIST_TOKEN }}" \
+            && echo "Packagist notified" \
+            || echo "::warning::Packagist notification failed (package may not be registered yet)"
+
+      - name: Summary
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          echo "## Composer Package Published" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Registry | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Gitea | \`composer require mokoconsulting/mokocli:${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Packagist | \`composer require mokoconsulting/mokocli\` |" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,126 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Deploy
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
+# PATH: /templates/workflows/joomla/deploy-manual.yml.template
+# VERSION: 04.07.00
+# BRIEF: Manual SFTP deploy to dev server for Joomla repos
+
+name: "Universal: Deploy to Dev (Manual)"
+
+on:
+  workflow_dispatch:
+    inputs:
+      clear_remote:
+        description: 'Delete all remote files before uploading'
+        required: false
+        default: 'false'
+        type: boolean
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+
+jobs:
+  deploy:
+    name: SFTP Deploy to Dev
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup PHP
+        run: |
+          php -v && composer --version
+
+      - name: Setup MokoStandards tools
+        env:
+          GA_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN || secrets.GA_TOKEN || github.token }}
+          MOKO_CLONE_HOST: ${{ secrets.GA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GA_TOKEN || github.token }}"}}'
+        run: |
+          git clone --depth 1 --branch main --quiet \
+            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
+            /tmp/mokostandards-api 2>/dev/null || true
+          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
+            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+          fi
+
+      - name: Check FTP configuration
+        id: check
+        env:
+          HOST: ${{ vars.DEV_FTP_HOST }}
+          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
+          PORT: ${{ vars.DEV_FTP_PORT }}
+        run: |
+          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
+            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "host=$HOST" >> "$GITHUB_OUTPUT"
+
+          REMOTE="${PATH_VAR%/}"
+          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
+
+          [ -z "$PORT" ] && PORT="22"
+          echo "port=$PORT" >> "$GITHUB_OUTPUT"
+
+      - name: Deploy via SFTP
+        if: steps.check.outputs.skip != 'true'
+        env:
+          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
+          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
+          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
+
+          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
+            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
+            > /tmp/sftp-config.json
+
+          if [ -n "$SFTP_KEY" ]; then
+            echo "$SFTP_KEY" > /tmp/deploy_key
+            chmod 600 /tmp/deploy_key
+            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
+          else
+            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
+          fi
+
+          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
+          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
+
+          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
+          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
+            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
+          else
+            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
+          fi
+
+          rm -f /tmp/deploy_key /tmp/sftp-config.json
+
+      - name: Summary
+        if: always()
+        run: |
+          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
+            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
+          fi
@@ -0,0 +1,151 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build MokoGitea Docker image, push to registry, and deploy
+
+name: Deploy MokoGitea
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag'
+        required: true
+        default: 'latest'
+      environment:
+        description: 'Target environment'
+        required: true
+        default: 'dev'
+        type: choice
+        options:
+          - dev
+          - production
+
+concurrency:
+  group: deploy-mokogitea
+  cancel-in-progress: false
+
+env:
+  REGISTRY: git.mokoconsulting.tech
+  IMAGE: mokoconsulting/mokogitea
+  DEPLOY_HOST: git.mokoconsulting.tech
+  DEPLOY_PORT: 2918
+  DEPLOY_USER: mokoconsulting
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source (for version detection)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine settings
+        id: config
+        run: |
+          if [ "${{ github.event_name }}" = "push" ]; then
+            VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
+            ENV="production"
+          else
+            VERSION="${{ github.event.inputs.version }}"
+            ENV="${{ github.event.inputs.environment }}"
+          fi
+          if [ "$ENV" = "production" ]; then
+            echo "compose_dir=/opt/gitea" >> $GITHUB_OUTPUT
+            echo "container=mokogitea" >> $GITHUB_OUTPUT
+            echo "source_dir=/opt/gitea/source" >> $GITHUB_OUTPUT
+            echo "branch=main" >> $GITHUB_OUTPUT
+            echo "tag=$VERSION" >> $GITHUB_OUTPUT
+          else
+            echo "compose_dir=/opt/gitea-dev" >> $GITHUB_OUTPUT
+            echo "container=mokogitea-dev" >> $GITHUB_OUTPUT
+            echo "source_dir=/opt/gitea-dev/source" >> $GITHUB_OUTPUT
+            echo "branch=dev" >> $GITHUB_OUTPUT
+            echo "tag=$VERSION-dev" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+          BRANCH: ${{ steps.config.outputs.branch }}
+          SOURCE_DIR: ${{ steps.config.outputs.source_dir }}
+          COMPOSE_DIR: ${{ steps.config.outputs.compose_dir }}
+          CONTAINER: ${{ steps.config.outputs.container }}
+        run: |
+          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
+          IMAGE_FMT='Image: ${{ '{{' }}.Config.Image${{ '}}' }}'
+
+          ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
+          set -e
+          echo 'SSH connected'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+          free -m | head -3
+
+          echo 'Pulling source...'
+          if [ ! -d $SOURCE_DIR/.git ]; then
+            git clone -b $BRANCH https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git $SOURCE_DIR
+          fi
+          cd $SOURCE_DIR
+          # Ensure remote points to MokoGitea-Fork (not the upstream fork)
+          git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
+          git fetch origin $BRANCH
+          git reset --hard origin/$BRANCH
+
+          echo 'Building Docker image...'
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG \
+            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo '$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
+          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG
+          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
+
+          echo 'Restarting container...'
+          cd $COMPOSE_DIR
+          sed -i 's|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:$TAG|' docker-compose.yml
+          docker compose up -d $CONTAINER
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format='$HEALTH_FMT' $CONTAINER 2>/dev/null | grep -q healthy; then
+              echo 'Container healthy!'
+              docker inspect --format='$IMAGE_FMT' $CONTAINER
+              exit 0
+            fi
+            echo "Waiting... (attempt \$i/8)"
+          done
+          echo 'Health check failed'
+          docker logs $CONTAINER --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify
+        run: |
+          sleep 5
+          curl -sf https://${{ env.DEPLOY_HOST }}/api/healthz && echo " API healthy"
+
+      - name: Notify on failure
+        if: failure()
+        run: echo "::error::Deploy failed for ${{ steps.config.outputs.tag }}"
@@ -0,0 +1,92 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Security
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# PATH: /templates/workflows/gitleaks.yml.template
+# VERSION: 01.00.00
+# BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
+#
+# +========================================================================+
+# |                        SECRET SCANNING                                 |
+# +========================================================================+
+# |                                                                        |
+# |  Scans commits for leaked secrets using Gitleaks.                      |
+# |                                                                        |
+# |  - PR scan: only new commits in the PR                                 |
+# |  - Scheduled: full repo scan weekly                                    |
+# |  - Alerts via ntfy on findings                                         |
+# |                                                                        |
+# +========================================================================+
+
+name: "Universal: Secret Scanning"
+
+on:
+  schedule:
+    - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+
+jobs:
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Scan for secrets
+        id: scan
+        run: |
+          echo "### Secret Scanning" >> $GITHUB_STEP_SUMMARY
+          ARGS="--source . --verbose --report-format json --report-path /tmp/gitleaks-report.json"
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # Scan only PR commits
+            ARGS="$ARGS --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+            echo "Scanning PR commits only" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "Full repository scan" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if gitleaks detect $ARGS 2>&1; then
+            echo "result=clean" >> "$GITHUB_OUTPUT"
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "result=found" >> "$GITHUB_OUTPUT"
+            FINDINGS=$(jq length /tmp/gitleaks-report.json 2>/dev/null || echo "unknown")
+            echo "**${FINDINGS} potential secret(s) detected.**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Review the findings and rotate any exposed credentials immediately." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+      - name: Notify on findings
+        if: failure() && steps.scan.outputs.result == 'found'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} — secrets detected in code" \
+            -H "Tags: rotating_light,key" \
+            -H "Priority: urgent" \
+            -d "Gitleaks found potential secrets. Review and rotate credentials immediately." \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true
@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Automation
+# VERSION: 01.00.00
+# BRIEF: Auto-create feature branch when an issue is opened
+
+name: "Universal: Issue Branch"
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: write
+  issues: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  create-branch:
+    name: Create feature branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create branch and comment
+        run: |
+          TOKEN="${{ secrets.GA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          ISSUE_NUM="${{ github.event.issue.number }}"
+          ISSUE_TITLE="${{ github.event.issue.title }}"
+
+          # Build slug from title: lowercase, replace non-alnum with dash, trim
+          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          BRANCH="feature/${ISSUE_NUM}-${SLUG}"
+
+          # Check dev branch exists
+          DEV_EXISTS=$(curl -sf -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/branches/dev" 2>/dev/null || echo "000")
+
+          if [ "${DEV_EXISTS}" != "200" ]; then
+            echo "No dev branch -- skipping"
+            exit 0
+          fi
+
+          # Create branch from dev
+          HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API}/branches" \
+            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"dev\"}" 2>/dev/null || echo "000")
+
+          if [ "${HTTP}" = "201" ]; then
+            echo "Created branch: ${BRANCH}"
+
+            # Comment on issue with branch link
+            REPO_URL="${GITEA_URL}/${{ github.repository }}"
+            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
+
+            curl -sf -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              "${API}/issues/${ISSUE_NUM}/comments" \
+              -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
+
+            echo "Commented on issue #${ISSUE_NUM}"
+          else
+            echo "Failed to create branch (HTTP ${HTTP}) -- may already exist"
+          fi
@@ -0,0 +1,70 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.gitea/workflows/notify.yml
+# VERSION: 01.00.00
+# BRIEF: Push notifications via ntfy on release success or workflow failure
+
+name: "Universal: Notifications"
+
+on:
+  workflow_run:
+    workflows:
+      - "Joomla Build & Release"
+      - "Joomla Extension CI"
+      - "Deploy"
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-releases' }}
+
+jobs:
+  notify:
+    name: Send Notification
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.conclusion == 'success' ||
+      github.event.workflow_run.conclusion == 'failure'
+
+    steps:
+      - name: Notify on success (releases only)
+        if: >-
+          github.event.workflow_run.conclusion == 'success' &&
+          contains(github.event.workflow_run.name, 'Release')
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS \
+            -H "Title: ${REPO} released" \
+            -H "Tags: white_check_mark,package" \
+            -H "Priority: default" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} completed successfully." \
+            "${NTFY_URL}/${NTFY_TOPIC}"
+
+      - name: Notify on failure
+        if: github.event.workflow_run.conclusion == 'failure'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS \
+            -H "Title: ${REPO} workflow failed" \
+            -H "Tags: x,warning" \
+            -H "Priority: high" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} failed. Check the run for details." \
+            "${NTFY_URL}/${NTFY_TOPIC}"
@@ -0,0 +1,51 @@
+name: Publish MCP to npm
+on:
+  push:
+    branches: [main]
+    paths:
+      - '.mokogitea/mcp/**'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install and build
+        working-directory: .mokogitea/mcp
+        run: |
+          npm ci
+          npx tsc
+
+      - name: Check version change
+        id: version
+        working-directory: .mokogitea/mcp
+        run: |
+          LOCAL_VERSION=$(node -p "require('./package.json').version")
+          NPM_VERSION=$(npm view @mokoconsulting/mokogitea-mcp version 2>/dev/null || echo "0.0.0")
+          if [ "$LOCAL_VERSION" != "$NPM_VERSION" ]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+            echo "Version changed: $NPM_VERSION -> $LOCAL_VERSION"
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "Version unchanged: $LOCAL_VERSION"
+          fi
+
+      - name: Publish to npm
+        if: steps.version.outputs.changed == 'true'
+        working-directory: .mokogitea/mcp
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish to Gitea registry
+        if: steps.version.outputs.changed == 'true'
+        working-directory: .mokogitea/mcp
+        run: |
+          npm publish --registry ${{ github.server_url }}/api/packages/${{ github.repository_owner }}/npm/ \
+            --//$(echo "${{ github.server_url }}" | sed 's|https://||')/api/packages/${{ github.repository_owner }}/npm/:_authToken=${{ secrets.MOKOGITEA_TOKEN }}
@@ -0,0 +1,534 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
+# PATH: /templates/workflows/universal/pr-check.yml.template
+# VERSION: 09.23.00
+# BRIEF: PR gate — branch policy + code validation before merge
+
+name: "Universal: PR Check"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Branch Policy ──────────────────────────────────────────────────────
+  branch-policy:
+    name: Branch Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch merge target
+        run: |
+          HEAD="${{ github.head_ref }}"
+          BASE="${{ github.base_ref }}"
+
+          echo "PR: ${HEAD} → ${BASE}"
+
+          ALLOWED=true
+          REASON=""
+
+          case "$HEAD" in
+            feature/*|feat/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Feature branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            fix/*|bugfix/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Fix branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            patch/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+                ALLOWED=false
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+              fi
+              ;;
+            hotfix/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
+              fi
+              ;;
+            rc)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="RC branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+            dev)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Dev branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+          esac
+
+          if [ "$ALLOWED" = false ]; then
+            echo "::error::${REASON}"
+            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
+            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "Branch policy: OK (${HEAD} → ${BASE})"
+          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
+
+  # ── Secret Scanning ──────────────────────────────────────────────────
+  gitleaks:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Scan PR commits for secrets
+        run: |
+          if gitleaks detect --source . --verbose \
+            --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} 2>&1; then
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::error::Potential secrets detected in PR commits"
+            exit 1
+          fi
+
+  # ── Code Validation ────────────────────────────────────────────────────
+  validate:
+    name: Validate PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check for merge conflict markers
+        run: |
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          if [ -n "$CONFLICTS" ]; then
+            echo "::error::Merge conflict markers found in source files"
+            echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "No conflict markers found"
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Read platform from XML manifest (<platform> tag) or plain text fallback
+          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
+          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          [ -z "$PLATFORM" ] && PLATFORM="generic"
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+
+      - name: Setup PHP
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: PHP syntax check
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          echo "PHP lint: ${ERRORS} error(s)"
+          [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
+
+      - name: Joomla JEXEC guard check
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            # Skip vendor, node_modules, and index.html stub files
+            case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
+            # Check first 10 lines for JEXEC or JPATH guard
+            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
+              echo "::error file=${file}::Missing JEXEC guard: ${file}"
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -path "*/src/*" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::${ERRORS} PHP file(s) missing defined('_JEXEC') or die guard"
+            echo "## JEXEC Guard Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "${ERRORS} file(s) in src/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "JEXEC guard: OK"
+
+      - name: Joomla directory listing protection
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          MISSING=0
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && exit 0
+          while IFS= read -r dir; do
+            if [ ! -f "${dir}/index.html" ]; then
+              echo "::warning::Missing index.html in ${dir} (directory listing protection)"
+              MISSING=$((MISSING + 1))
+            fi
+          done < <(find "$SOURCE_DIR" -type d -not -path "./.git/*" -not -path "*/vendor/*" -not -path "*/node_modules/*")
+          if [ "$MISSING" -gt 0 ]; then
+            echo "## Directory Protection" >> $GITHUB_STEP_SUMMARY
+            echo "${MISSING} director(ies) missing index.html" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "Directory protection: ${MISSING} missing (advisory)"
+
+      - name: Joomla script file and asset checks
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+          [ -z "$MANIFEST" ] && exit 0
+          MANIFEST_DIR=$(dirname "$MANIFEST")
+
+          # Check scriptfile exists if declared
+          SCRIPTFILE=$(sed -n 's/.*<scriptfile>\([^<]*\)<\/scriptfile>.*/\1/p' "$MANIFEST" 2>/dev/null)
+          if [ -n "$SCRIPTFILE" ]; then
+            if [ ! -f "${MANIFEST_DIR}/${SCRIPTFILE}" ]; then
+              echo "::error::Manifest declares <scriptfile>${SCRIPTFILE}</scriptfile> but file not found at ${MANIFEST_DIR}/${SCRIPTFILE}"
+              ERRORS=$((ERRORS + 1))
+            else
+              echo "Script file: ${MANIFEST_DIR}/${SCRIPTFILE} (OK)"
+            fi
+          fi
+
+          # Require joomla.asset.json and validate it
+          ASSET_JSON=$(find "$MANIFEST_DIR" -name "joomla.asset.json" -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$ASSET_JSON" ]; then
+            echo "::error::joomla.asset.json not found — Joomla asset system is required"
+            ERRORS=$((ERRORS + 1))
+          else
+            if command -v php &> /dev/null; then
+              php -r "json_decode(file_get_contents('$ASSET_JSON')); if(json_last_error()!==JSON_ERROR_NONE){echo json_last_error_msg();exit(1);}" 2>&1 || {
+                echo "::error::joomla.asset.json is not valid JSON"
+                ERRORS=$((ERRORS + 1))
+              }
+            fi
+            echo "joomla.asset.json: valid"
+          fi
+
+          # Validate all XML files in src/ are well-formed
+          XML_ERRORS=0
+          if command -v php &> /dev/null; then
+            while IFS= read -r -d '' xmlfile; do
+              if ! php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$xmlfile'); if(!\$x){foreach(libxml_get_errors() as \$e) echo trim(\$e->message) . ' in $xmlfile'; exit(1);}" 2>&1; then
+                XML_ERRORS=$((XML_ERRORS + 1))
+              fi
+            done < <(find "$MANIFEST_DIR" -name "*.xml" -not -path "./.git/*" -print0)
+          fi
+          if [ "$XML_ERRORS" -gt 0 ]; then
+            echo "::error::${XML_ERRORS} XML file(s) are malformed"
+            ERRORS=$((ERRORS + 1))
+          else
+            echo "XML well-formedness: OK"
+          fi
+
+          [ "$ERRORS" -gt 0 ] && exit 1
+          echo "Joomla asset checks: OK"
+
+      - name: Validate platform manifest
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+              if [ -z "$MANIFEST" ]; then
+                echo "::warning::No Joomla manifest found (WaaS site)"
+                exit 0
+              fi
+              echo "Manifest: ${MANIFEST}"
+              if command -v php &> /dev/null; then
+                php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$MANIFEST'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::Manifest XML is malformed"; exit 1; }
+              fi
+              for ELEMENT in name version description; do
+                grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
+              done
+              # Block legacy raw/branch update server URLs on MokoGitea
+              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
+              if [ -n "$RAW_URLS" ]; then
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "$RAW_URLS"
+                exit 1
+              fi
+              echo "Joomla manifest valid"
+              ;;
+            dolibarr)
+              MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
+              if [ -z "$MOD_FILE" ]; then
+                echo "::error::No mod*.class.php found"
+                exit 1
+              fi
+              echo "Dolibarr module: ${MOD_FILE}"
+              ;;
+            *)
+              echo "Generic platform — no manifest validation"
+              ;;
+          esac
+
+      - name: Check update stream format
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              if [ -f "updates.xml" ]; then
+                if command -v php &> /dev/null; then
+                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
+                fi
+                echo "updates.xml valid"
+              fi
+              ;;
+            dolibarr)
+              [ -f "update.txt" ] && echo "update.txt present" || echo "::warning::No update.txt"
+              ;;
+          esac
+
+      - name: Validate Joomla language files
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          WARNINGS=0
+
+          # Require both en-GB and en-US language directories
+          LANG_ROOT=$(find . -path "*/language" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$LANG_ROOT" ]; then
+            echo "No language/ directory found — skipping"
+            exit 0
+          fi
+
+          if [ ! -d "$LANG_ROOT/en-GB" ]; then
+            echo "::error::Missing en-GB language directory (${LANG_ROOT}/en-GB)"
+            ERRORS=$((ERRORS + 1))
+          fi
+          if [ ! -d "$LANG_ROOT/en-US" ]; then
+            echo "::error::Missing en-US language directory (${LANG_ROOT}/en-US)"
+            ERRORS=$((ERRORS + 1))
+          fi
+
+          # Check that en-GB and en-US have matching .ini files
+          if [ -d "$LANG_ROOT/en-GB" ] && [ -d "$LANG_ROOT/en-US" ]; then
+            for GB_INI in "$LANG_ROOT/en-GB"/*.ini; do
+              [ ! -f "$GB_INI" ] && continue
+              US_INI="$LANG_ROOT/en-US/$(basename "$GB_INI")"
+              if [ ! -f "$US_INI" ]; then
+                echo "::error::$(basename "$GB_INI") exists in en-GB but missing from en-US"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+            for US_INI in "$LANG_ROOT/en-US"/*.ini; do
+              [ ! -f "$US_INI" ] && continue
+              GB_INI="$LANG_ROOT/en-GB/$(basename "$US_INI")"
+              if [ ! -f "$GB_INI" ]; then
+                echo "::error::$(basename "$US_INI") exists in en-US but missing from en-GB"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+          fi
+
+          # Find all .ini language files
+          INI_FILES=$(find . -path "*/language/*/*.ini" -not -path "./.git/*" 2>/dev/null)
+          if [ -z "$INI_FILES" ]; then
+            echo "No .ini language files found"
+            [ "$ERRORS" -gt 0 ] && exit 1
+            exit 0
+          fi
+
+          echo "Found $(echo "$INI_FILES" | wc -l) language file(s)"
+
+          for FILE in $INI_FILES; do
+            FNAME=$(basename "$FILE")
+            LINENUM=0
+            SEEN_KEYS=""
+
+            while IFS= read -r line || [ -n "$line" ]; do
+              LINENUM=$((LINENUM + 1))
+
+              # Skip empty lines and comments
+              [ -z "$line" ] && continue
+              echo "$line" | grep -qE '^\s*;' && continue
+              echo "$line" | grep -qE '^\s*$' && continue
+
+              # Must match KEY="VALUE" format
+              if ! echo "$line" | grep -qE '^[A-Z_][A-Z0-9_]*=".*"$'; then
+                echo "::error file=${FILE},line=${LINENUM}::Malformed line: ${line}"
+                ERRORS=$((ERRORS + 1))
+                continue
+              fi
+
+              # Extract key and check for duplicates
+              KEY=$(echo "$line" | sed 's/=.*//')
+              if echo "$SEEN_KEYS" | grep -qx "$KEY"; then
+                echo "::error file=${FILE},line=${LINENUM}::Duplicate key: ${KEY}"
+                ERRORS=$((ERRORS + 1))
+              fi
+              SEEN_KEYS="${SEEN_KEYS}
+          ${KEY}"
+            done < "$FILE"
+
+            echo "  ${FILE}: checked ${LINENUM} lines"
+          done
+
+          # Cross-check en-GB vs en-US key consistency
+          GB_DIR=$(find . -path "*/language/en-GB" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          US_DIR=$(find . -path "*/language/en-US" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+
+          if [ -n "$GB_DIR" ] && [ -n "$US_DIR" ]; then
+            for GB_FILE in "$GB_DIR"/*.ini; do
+              [ ! -f "$GB_FILE" ] && continue
+              FNAME=$(basename "$GB_FILE")
+              US_FILE="$US_DIR/$FNAME"
+              [ ! -f "$US_FILE" ] && continue
+
+              GB_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$GB_FILE" 2>/dev/null | sort)
+              US_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$US_FILE" 2>/dev/null | sort)
+
+              # Keys in en-GB but not en-US
+              MISSING_US=$(comm -23 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_US" ]; then
+                echo "::warning::Keys in en-GB/$FNAME but missing from en-US/$FNAME:"
+                echo "$MISSING_US" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+
+              # Keys in en-US but not en-GB
+              MISSING_GB=$(comm -13 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_GB" ]; then
+                echo "::warning::Keys in en-US/$FNAME but missing from en-GB/$FNAME:"
+                echo "$MISSING_GB" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+            done
+          fi
+
+          {
+            echo "### Language File Validation"
+            echo "| Metric | Count |"
+            echo "|---|---|"
+            echo "| Files checked | $(echo "$INI_FILES" | wc -l) |"
+            echo "| Errors | ${ERRORS} |"
+            echo "| Warnings | ${WARNINGS} |"
+          } >> $GITHUB_STEP_SUMMARY
+
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::Language validation failed with ${ERRORS} error(s)"
+            exit 1
+          fi
+          echo "Language files: OK (${WARNINGS} warning(s))"
+
+      - name: Check changelog has unreleased entry
+        run: |
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::No CHANGELOG.md found"
+            exit 0
+          fi
+          # Check for content under [Unreleased] section
+          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md missing [Unreleased] section"
+            exit 1
+          fi
+          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
+          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
+          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
+            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
+            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
+            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
+
+      - name: Verify package source
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          if [ ! -d "$SOURCE_DIR" ]; then
+            echo "::warning::No src/ or htdocs/ directory"
+            exit 0
+          fi
+          FILE_COUNT=$(find "$SOURCE_DIR" -type f | wc -l)
+          echo "Source: ${FILE_COUNT} files"
+          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }
+
+  # ── Pre-Release RC Build ─────────────────────────────────────────────────
+  pre-release:
+    name: Build RC Package
+    runs-on: ubuntu-latest
+    needs: [branch-policy, validate]
+
+    steps:
+      - name: Trigger RC pre-release
+        env:
+          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.head_ref }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
+          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
+
+  # ── Issue Reporter ──────────────────────────────────────────────────────
+  report-issues:
+    name: Report Issues
+    runs-on: ubuntu-latest
+    needs: [branch-policy, validate]
+    if: >-
+      always() &&
+      needs.validate.result == 'failure'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: automation/ci-issue-reporter.sh
+          sparse-checkout-cone-mode: false
+
+      - name: "File issue for PR validation failure"
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x automation/ci-issue-reporter.sh
+          ./automation/ci-issue-reporter.sh \
+            --gate "PR Validation" \
+            --workflow "PR Check" \
+            --severity error \
+            --details "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
@@ -0,0 +1,170 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Auto-build RC release on PR to main, update RC update stream
+
+name: "PR RC Release"
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  REGISTRY: code.mokoconsulting.tech
+  IMAGE: mokoconsulting/mokogitea
+
+permissions:
+  contents: write
+
+jobs:
+  rc-release:
+    name: Build RC Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check target branch
+        id: guard
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+        run: |
+          echo "PR target: ${BASE_BRANCH}"
+          if [ "$BASE_BRANCH" != "main" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Skipping RC — only for PRs targeting main"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout PR branch
+        if: steps.guard.outputs.skip != 'true'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Determine RC version
+        if: steps.guard.outputs.skip != 'true'
+        id: version
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          BASE_VERSION=$(sed -n 's/.*<version>\(.*\)<\/version>.*/\1/p' updates.xml | head -1)
+          [ -z "$BASE_VERSION" ] && BASE_VERSION="04.00.00"
+          RC_VERSION="${BASE_VERSION}-rc.${PR_NUMBER}"
+          RC_TAG="v1.26.1-moko.${RC_VERSION}"
+          echo "version=$RC_VERSION" >> "$GITHUB_OUTPUT"
+          echo "tag=$RC_TAG" >> "$GITHUB_OUTPUT"
+          echo "RC version: $RC_VERSION (tag: $RC_TAG)"
+
+      - name: Update updates.xml RC channel
+        if: steps.guard.outputs.skip != 'true'
+        env:
+          RC_VERSION: ${{ steps.version.outputs.version }}
+          RC_TAG: ${{ steps.version.outputs.tag }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          DOCKER_TAG="${REGISTRY}/${IMAGE}:${RC_TAG}"
+
+          python3 << 'PYEOF'
+          import os, re
+
+          rc_version = os.environ["RC_VERSION"]
+          rc_tag = os.environ["RC_TAG"]
+          pr_url = os.environ["PR_URL"]
+          pr_num = os.environ["PR_NUM"]
+          docker_tag = os.environ["REGISTRY"] + "/" + os.environ["IMAGE"] + ":" + rc_tag
+
+          entry = f"""  <update>
+            <name>MokoGitea</name>
+            <description>MokoGitea RC from PR #{pr_num}</description>
+            <element>mokogitea</element>
+            <type>application</type>
+            <version>{rc_version}</version>
+            <client>server</client>
+            <tags><tag>rc</tag></tags>
+            <infourl title="MokoGitea RC">{pr_url}</infourl>
+            <downloads>
+              <downloadurl type="full" format="docker">{docker_tag}</downloadurl>
+            </downloads>
+            <sha256></sha256>
+            <targetplatform name="mokogitea" version="((1\\.25\\.)|(1\\.26\\.))" />
+            <maintainer>Moko Consulting</maintainer>
+            <maintainerurl>https://mokoconsulting.tech</maintainerurl>
+          </update>"""
+
+          content = open("updates.xml").read()
+          # Remove existing RC entry
+          content = re.sub(
+              r"\s*<update>[\s\S]*?<tag>rc</tag>[\s\S]*?</update>",
+              "",
+              content,
+          )
+          # Insert before </updates>
+          content = content.replace("</updates>", entry + "\n</updates>")
+          open("updates.xml", "w").write(content)
+          print(f"Updated updates.xml with RC entry: {rc_version}")
+          PYEOF
+
+      - name: Create RC release
+        if: steps.guard.outputs.skip != 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          RC_TAG: ${{ steps.version.outputs.tag }}
+          RC_VERSION: ${{ steps.version.outputs.version }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          API_BASE: https://${{ env.REGISTRY }}/api/v1/repos/${{ github.repository }}
+        run: |
+          # Delete existing RC release/tag if present
+          curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
+            "${API_BASE}/releases/tags/${RC_TAG}" 2>/dev/null || true
+          curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" \
+            "${API_BASE}/tags/${RC_TAG}" 2>/dev/null || true
+
+          # Create prerelease
+          python3 << PYEOF
+          import json, os, urllib.request
+
+          api = os.environ["API_BASE"]
+          token = os.environ["GITEA_TOKEN"]
+          payload = json.dumps({
+              "tag_name": os.environ["RC_TAG"],
+              "target_commitish": os.environ["HEAD_SHA"],
+              "name": f"RC: {os.environ['PR_TITLE']}",
+              "body": f"Release candidate from PR #{os.environ['PR_NUMBER']}\n\nPR: {os.environ['PR_URL']}\nDocker: docker pull {os.environ['REGISTRY']}/{os.environ['IMAGE']}:{os.environ['RC_TAG']}",
+              "draft": False,
+              "prerelease": True,
+          }).encode()
+
+          req = urllib.request.Request(
+              f"{api}/releases",
+              data=payload,
+              headers={
+                  "Authorization": f"token {token}",
+                  "Content-Type": "application/json",
+              },
+              method="POST",
+          )
+          with urllib.request.urlopen(req) as resp:
+              result = json.loads(resp.read())
+              print(f"Created RC release: {result.get('tag_name')}")
+          PYEOF
+
+      - name: Commit updates.xml
+        if: steps.guard.outputs.skip != 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          git config user.name "MokoGitea Bot"
+          git config user.email "deploy@mokoconsulting.tech"
+          git add updates.xml
+          if git diff --cached --quiet; then
+            echo "No changes to updates.xml"
+          else
+            git commit -m "chore(ci): update RC stream for PR #${PR_NUM}"
+            git push origin "HEAD:${HEAD_REF}" || echo "Push failed"
+          fi
@@ -0,0 +1,252 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/pre-release.yml.template
+# VERSION: 05.01.00
+# BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
+
+name: "Universal: Pre-Release"
+
+on:
+  push:
+    branches:
+      - dev
+      - 'fix/**'
+      - 'patch/**'
+      - 'hotfix/**'
+      - 'bugfix/**'
+      - 'chore/**'
+      - alpha
+      - beta
+      - rc
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Pre-release channel'
+        required: true
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - release-candidate
+
+permissions:
+  contents: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+jobs:
+  build:
+    name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
+    runs-on: release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'push'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          ref: ${{ github.ref_name }}
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/cli/manifest_element.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Auto-detect and update platform if not set in manifest
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output
+
+      - name: Resolve metadata and bump version
+        id: meta
+        run: |
+          # Auto-detect stability from branch name on push, or use input on dispatch
+          if [ "${{ github.event_name }}" = "push" ]; then
+            case "${{ github.ref_name }}" in
+              rc)    STABILITY="release-candidate" ;;
+              alpha) STABILITY="alpha" ;;
+              beta)  STABILITY="beta" ;;
+              *)     STABILITY="development" ;;
+            esac
+          else
+            STABILITY="${{ inputs.stability || 'development' }}"
+          fi
+
+          case "$STABILITY" in
+            development)        SUFFIX="-dev";   TAG="development" ;;
+            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
+            beta)               SUFFIX="-beta";  TAG="beta" ;;
+            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
+          esac
+
+          # Bump version via CLI: patch for dev/alpha/beta, minor for RC
+          case "$STABILITY" in
+            release-candidate) BUMP="minor" ;;
+            *)                 BUMP="patch" ;;
+          esac
+
+          php ${MOKO_CLI}/version_bump.php --path . $([ "$BUMP" = "minor" ] && echo "--minor") 2>/dev/null || true
+
+          # Set stability suffix and verify consistency
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "00.00.01")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch "${{ github.ref_name }}" --stability "$STABILITY" 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Ensure licensing tags (updateservers, dlid) if enabled in manifest.xml
+          php ${MOKO_CLI}/manifest_licensing.php --path . --fix 2>/dev/null || true
+
+          # Append suffix for output
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi
+
+          # Commit version bump
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git add -A
+          git diff --cached --quiet || {
+            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
+            git push origin HEAD 2>&1
+          }
+
+          # Auto-detect element via manifest_element.php
+          php ${MOKO_CLI}/manifest_element.php \
+            --path . --version "$VERSION" --stability "$STABILITY" \
+            --repo "${GITEA_REPO}" --github-output
+
+          # Read back element outputs
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
+
+          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
+
+      - name: Create release
+        id: release
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
+
+      - name: Update release notes from CHANGELOG.md
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+
+          # Extract [Unreleased] section from changelog (everything between [Unreleased] and next ## heading)
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+            [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
+          else
+            NOTES="Release ${VERSION}"
+          fi
+
+          # Update release body via API
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+            "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+      - name: Build package and upload
+        id: package
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --output /tmp || true
+
+      # updates.xml is generated dynamically by MokoGitea license server
+      # No need to build, commit, or sync updates.xml from workflows
+
+      - name: "Delete lesser pre-release channels (cascade)"
+        continue-on-error: true
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          php ${MOKO_CLI}/release_cascade.php \
+            --stability "${{ steps.meta.outputs.stability }}" \
+            --token "${TOKEN}" \
+            --api-base "${API_BASE}"
+
+      - name: Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
+          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,66 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/rc-revert.yml
+# VERSION: 09.23.00
+# BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
+
+name: "RC Revert"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  revert:
+    name: Rename rc/ back to dev/
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == false &&
+      startsWith(github.event.pull_request.head.ref, 'rc/')
+
+    steps:
+      - name: Rename branch
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          SUFFIX="${BRANCH#rc/}"
+          DEV_BRANCH="dev/${SUFFIX}"
+          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          # Create dev/ branch from rc/ branch
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
+            "${API}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "201" ]; then
+            echo "Created branch: ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"
+            exit 1
+          fi
+
+          # Delete rc/ branch
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
+          fi
+
+          echo "### RC Reverted" >> $GITHUB_STEP_SUMMARY
+          echo "${BRANCH} → ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,712 @@
+# ============================================================================
+# Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Validation
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/joomla/repo_health.yml.template
+# VERSION: 09.23.00
+# BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
+# ============================================================================
+
+name: "Generic: Repo Health"
+
+defaults:
+  run:
+    shell: bash
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: 'Validation profile: all, scripts, or repo'
+        required: true
+        default: all
+        type: choice
+        options:
+          - all
+          - scripts
+          - repo
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  # Scripts governance policy
+  SCRIPTS_REQUIRED_DIRS:
+  SCRIPTS_ALLOWED_DIRS: scripts,scripts/fix,scripts/lib,scripts/release,scripts/run,scripts/validate
+
+  # Repo health policy
+  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogitea/workflows/
+  REPO_OPTIONAL_FILES: SECURITY.md,GOVERNANCE.md,.editorconfig,.gitattributes,.gitignore,README.md,docs/
+  REPO_DISALLOWED_DIRS:
+  REPO_DISALLOWED_FILES: TODO.md,todo.md
+
+  # Extended checks toggles
+  EXTENDED_CHECKS: "true"
+
+  # File / directory variables
+  DOCS_INDEX: docs/docs-index.md
+  SCRIPT_DIR: scripts
+  WORKFLOWS_DIR: .mokogitea/workflows
+  SHELLCHECK_PATTERN: '*.sh'
+  SPDX_FILE_GLOBS: '*.sh,*.php,*.js,*.ts,*.css,*.xml,*.yml,*.yaml'
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  access_check:
+    name: Access control
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    outputs:
+      allowed: ${{ steps.perm.outputs.allowed }}
+      permission: ${{ steps.perm.outputs.permission }}
+
+    steps:
+      - name: Check actor permission (admin only)
+        id: perm
+        env:
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          ALLOWED=false
+          PERMISSION=unknown
+          METHOD=""
+
+          # Hardcoded authorized users — always allowed
+          case "$ACTOR" in
+            jmiller|gitea-actions[bot])
+              ALLOWED=true
+              PERMISSION=admin
+              METHOD="hardcoded allowlist"
+              ;;
+            *)
+              # Detect platform and check permissions via API
+              API_BASE="${GITHUB_API_URL:-${GITEA_API_URL:-https://api.github.com}}"
+              RESP=$(curl -sf -H "Authorization: token ${TOKEN}" \
+                "${API_BASE}/repos/${REPO}/collaborators/${ACTOR}/permission" 2>/dev/null || echo '{}')
+              PERMISSION=$(echo "$RESP" | grep -oP '"permission"\s*:\s*"\K[^"]+' || echo "unknown")
+              if [ "$PERMISSION" = "admin" ] || [ "$PERMISSION" = "maintain" ] || [ "$PERMISSION" = "owner" ]; then
+                ALLOWED=true
+              fi
+              METHOD="collaborator API"
+              ;;
+          esac
+
+          echo "permission=${PERMISSION}" >> "$GITHUB_OUTPUT"
+          echo "allowed=${ALLOWED}" >> "$GITHUB_OUTPUT"
+
+          {
+            echo "## Access Authorization"
+            echo ""
+            echo "| Field | Value |"
+            echo "|-------|-------|"
+            echo "| **Actor** | \`${ACTOR}\` |"
+            echo "| **Repository** | \`${REPO}\` |"
+            echo "| **Permission** | \`${PERMISSION}\` |"
+            echo "| **Method** | ${METHOD} |"
+            echo "| **Authorized** | ${ALLOWED} |"
+            echo ""
+            if [ "$ALLOWED" = "true" ]; then
+              echo "${ACTOR} authorized (${METHOD})"
+            else
+              echo "${ACTOR} is NOT authorized. Requires admin or maintain role."
+            fi
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Deny execution when not permitted
+        if: ${{ steps.perm.outputs.allowed != 'true' }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' 'ERROR: Access denied. Admin permission required.' >> "${GITHUB_STEP_SUMMARY}"
+          exit 1
+
+  scripts_governance:
+    name: Scripts governance
+    needs: access_check
+    if: ${{ needs.access_check.outputs.allowed == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Scripts folder checks
+        env:
+          PROFILE_RAW: ${{ github.event.inputs.profile }}
+        run: |
+          set -euo pipefail
+
+          profile="${PROFILE_RAW:-all}"
+          case "${profile}" in
+            all|scripts|repo) ;;
+            *)
+              printf '%s\n' "ERROR: Unknown profile: ${profile}" >> "${GITHUB_STEP_SUMMARY}"
+              exit 1
+              ;;
+          esac
+
+          if [ "${profile}" = 'repo' ]; then
+            {
+              printf '%s\n' '### Scripts governance'
+              printf '%s\n' "Profile: ${profile}"
+              printf '%s\n' 'Status: SKIPPED'
+              printf '%s\n' 'Reason: profile excludes scripts governance'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          if [ ! -d "${SCRIPT_DIR}" ]; then
+            {
+              printf '%s\n' '### Scripts governance'
+              printf '%s\n' 'Status: OK (advisory)'
+              printf '%s\n' 'scripts/ directory not present. No scripts governance enforced.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          if [ -n "${SCRIPTS_REQUIRED_DIRS:-}" ]; then IFS=',' read -r -a required_dirs <<< "${SCRIPTS_REQUIRED_DIRS}"; else required_dirs=(); fi
+          IFS=',' read -r -a allowed_dirs <<< "${SCRIPTS_ALLOWED_DIRS}"
+
+          missing_dirs=()
+          unapproved_dirs=()
+
+          for d in "${required_dirs[@]}"; do
+            req="${d%/}"
+            [ ! -d "${req}" ] && missing_dirs+=("${req}/")
+          done
+
+          while IFS= read -r d; do
+            allowed=false
+            for a in "${allowed_dirs[@]}"; do
+              a_norm="${a%/}"
+              [ "${d%/}" = "${a_norm}" ] && allowed=true
+            done
+            [ "${allowed}" = false ] && unapproved_dirs+=("${d%/}/")
+          done < <(find "${SCRIPT_DIR}" -maxdepth 1 -mindepth 1 -type d 2>/dev/null | sed 's#^\./##')
+
+          {
+            printf '%s\n' '### Scripts governance'
+            printf '%s\n' "Profile: ${profile}"
+            printf '%s\n' '| Area | Status | Notes |'
+            printf '%s\n' '|---|---|---|'
+
+            if [ "${#missing_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' '| Required directories | Warning | Missing required subfolders |'
+            else
+              printf '%s\n' '| Required directories | OK | All required subfolders present |'
+            fi
+
+            if [ "${#unapproved_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' '| Directory policy | Warning | Unapproved directories detected |'
+            else
+              printf '%s\n' '| Directory policy | OK | No unapproved directories |'
+            fi
+
+            printf '%s\n' '| Enforcement mode | Advisory | scripts folder is optional |'
+            printf '\n'
+
+            if [ "${#missing_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' 'Missing required script directories:'
+              for m in "${missing_dirs[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            else
+              printf '%s\n' 'Missing required script directories: none.'
+              printf '\n'
+            fi
+
+            if [ "${#unapproved_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' 'Unapproved script directories detected:'
+              for m in "${unapproved_dirs[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            else
+              printf '%s\n' 'Unapproved script directories detected: none.'
+              printf '\n'
+            fi
+
+            printf '%s\n' 'Scripts governance completed in advisory mode.'
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+  repo_health:
+    name: Repository health
+    needs: access_check
+    if: ${{ needs.access_check.outputs.allowed == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Repository health checks
+        env:
+          PROFILE_RAW: ${{ github.event.inputs.profile }}
+        run: |
+          set -euo pipefail
+
+          profile="${PROFILE_RAW:-all}"
+          case "${profile}" in
+            all|scripts|repo) ;;
+            *)
+              printf '%s\n' "ERROR: Unknown profile: ${profile}" >> "${GITHUB_STEP_SUMMARY}"
+              exit 1
+              ;;
+          esac
+
+          if [ "${profile}" = 'scripts' ]; then
+            {
+              printf '%s\n' '### Repository health'
+              printf '%s\n' "Profile: ${profile}"
+              printf '%s\n' 'Status: SKIPPED'
+              printf '%s\n' 'Reason: profile excludes repository health'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          IFS=',' read -r -a required_artifacts <<< "${REPO_REQUIRED_ARTIFACTS}"
+          IFS=',' read -r -a optional_files <<< "${REPO_OPTIONAL_FILES}"
+          if [ -n "${REPO_DISALLOWED_DIRS:-}" ]; then IFS=',' read -r -a disallowed_dirs <<< "${REPO_DISALLOWED_DIRS}"; else disallowed_dirs=(); fi
+          IFS=',' read -r -a disallowed_files <<< "${REPO_DISALLOWED_FILES:-}"
+
+          missing_required=()
+          missing_optional=()
+
+          # Source directory: src/ or htdocs/ (either is valid for extension repos)
+          SOURCE_DIR=""
+          if [ -d "src" ]; then
+            SOURCE_DIR="src"
+          elif [ -d "htdocs" ]; then
+            SOURCE_DIR="htdocs"
+          elif [ -d "deploy" ] || [ -d "cli" ] || [ -d "monitoring" ]; then
+            # Platform/tooling repos don't need src/
+            SOURCE_DIR=""
+          else
+            missing_required+=("src/ or htdocs/ (source directory required)")
+          fi
+
+          for item in "${required_artifacts[@]}"; do
+            if printf '%s' "${item}" | grep -q '/$'; then
+              d="${item%/}"
+              [ ! -d "${d}" ] && missing_required+=("${item}")
+            else
+              [ ! -f "${item}" ] && missing_required+=("${item}")
+            fi
+          done
+
+          for f in "${optional_files[@]}"; do
+            if printf '%s' "${f}" | grep -q '/$'; then
+              d="${f%/}"
+              [ ! -d "${d}" ] && missing_optional+=("${f}")
+            else
+              [ ! -f "${f}" ] && missing_optional+=("${f}")
+            fi
+          done
+
+          for d in "${disallowed_dirs[@]}"; do
+            d_norm="${d%/}"
+            [ -d "${d_norm}" ] && missing_required+=("${d_norm}/ (disallowed)")
+          done
+
+          for f in "${disallowed_files[@]}"; do
+            [ -f "${f}" ] && missing_required+=("${f} (disallowed)")
+          done
+
+          git fetch origin --prune
+
+          dev_paths=()
+          dev_branches=()
+
+          while IFS= read -r b; do
+            name="${b#origin/}"
+            if [ "${name}" = 'dev' ]; then
+              dev_branches+=("${name}")
+            else
+              dev_paths+=("${name}")
+            fi
+          done < <(git branch -r --list 'origin/dev*' | sed 's/^ *//')
+
+          if [ "${#dev_paths[@]}" -eq 0 ] && [ "${#dev_branches[@]}" -eq 0 ]; then
+            missing_required+=("dev or dev/* branch")
+          fi
+
+          content_warnings=()
+
+          if [ -f 'CHANGELOG.md' ] && ! grep -Eq '^# Changelog' CHANGELOG.md; then
+            content_warnings+=("CHANGELOG.md missing '# Changelog' header")
+          fi
+
+          if [ -f 'CHANGELOG.md' ] && grep -Eq '^[# ]*Unreleased' CHANGELOG.md; then
+            content_warnings+=("CHANGELOG.md contains Unreleased section (review release readiness)")
+          fi
+
+          if [ -f 'LICENSE' ] && ! grep -qiE 'GNU GENERAL PUBLIC LICENSE|GPL' LICENSE; then
+            content_warnings+=("LICENSE does not look like a GPL text")
+          fi
+
+          if [ -f 'README.md' ] && ! grep -qiE 'moko|Moko' README.md; then
+            content_warnings+=("README.md missing expected brand keyword")
+          fi
+
+          export PROFILE_RAW="${profile}"
+          export MISSING_REQUIRED="$(printf '%s\n' "${missing_required[@]:-}")"
+          export MISSING_OPTIONAL="$(printf '%s\n' "${missing_optional[@]:-}")"
+          export CONTENT_WARNINGS="$(printf '%s\n' "${content_warnings[@]:-}")"
+
+          report_json=$(printf '{"profile":"%s","missing_required":%d,"missing_optional":%d,"content_warnings":%d}'             "$profile" "${#missing_required[@]}" "${#missing_optional[@]}" "${#content_warnings[@]}")
+
+          {
+            printf '%s\n' '### Repository health'
+            printf '%s\n' "Profile: ${profile}"
+            printf '%s\n' '| Metric | Value |'
+            printf '%s\n' '|---|---|'
+            printf '%s\n' "| Missing required | ${#missing_required[@]} |"
+            printf '%s\n' "| Missing optional | ${#missing_optional[@]} |"
+            printf '%s\n' "| Content warnings | ${#content_warnings[@]} |"
+            printf '\n'
+
+            printf '%s\n' '### Guardrails report (JSON)'
+            printf '%s\n' '```json'
+            printf '%s\n' "${report_json}"
+            printf '%s\n' '```'
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+          if [ "${#missing_required[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Missing required repo artifacts'
+              for m in "${missing_required[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '%s\n' 'ERROR: Guardrails failed. Missing required repository artifacts.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 1
+          fi
+
+          if [ "${#missing_optional[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Missing optional repo artifacts'
+              for m in "${missing_optional[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          if [ "${#content_warnings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Repo content warnings'
+              for m in "${content_warnings[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          # -- Joomla-specific checks --
+          joomla_findings=()
+
+          MANIFEST="$(find . -maxdepth 2 -name '*.xml' -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)"
+          if [ -z "${MANIFEST}" ]; then
+            joomla_findings+=("Joomla XML manifest not found (no *.xml with <extension> tag)")
+          else
+            if ! grep -qP '<version>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <version> tag missing")
+            fi
+            if ! grep -qP 'type="(component|module|plugin|library|package|template|language)"' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: type attribute missing or invalid")
+            fi
+            if ! grep -qP '<name>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <name> tag missing")
+            fi
+            if ! grep -qP '<author>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <author> tag missing")
+            fi
+            if ! grep -qP '<namespace' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <namespace> missing (required for Joomla 5+)")
+            fi
+          fi
+
+          INI_COUNT="$(find . -name '*.ini' -type f 2>/dev/null | wc -l)"
+          if [ "${INI_COUNT}" -eq 0 ]; then
+            joomla_findings+=("No .ini language files found")
+          fi
+
+          if [ ! -f 'updates.xml' ]; then
+            joomla_findings+=("updates.xml missing in root (required for Joomla update server)")
+          fi
+
+          if [ -n "${SOURCE_DIR}" ]; then
+            INDEX_DIRS=("${SOURCE_DIR}" "${SOURCE_DIR}/admin" "${SOURCE_DIR}/site")
+            for dir in "${INDEX_DIRS[@]}"; do
+              if [ -d "${dir}" ] && [ ! -f "${dir}/index.html" ]; then
+                joomla_findings+=("${dir}/index.html missing (directory listing protection)")
+              fi
+            done
+          fi
+
+          if [ "${#joomla_findings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Joomla extension checks'
+              printf '%s\n' '| Check | Status |'
+              printf '%s\n' '|---|---|'
+              for f in "${joomla_findings[@]}"; do
+                printf '%s\n' "| ${f} | Warning |"
+              done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          else
+            {
+              printf '%s\n' '### Joomla extension checks'
+              printf '%s\n' 'All Joomla-specific checks passed.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          extended_enabled="${EXTENDED_CHECKS:-true}"
+          extended_findings=()
+
+          if [ "${extended_enabled}" = 'true' ]; then
+            if [ -f '.github/CODEOWNERS' ] || [ -f 'CODEOWNERS' ] || [ -f 'docs/CODEOWNERS' ]; then
+              :
+            else
+              extended_findings+=("CODEOWNERS not found (.github/CODEOWNERS preferred)")
+            fi
+
+            if ls "${WORKFLOWS_DIR}"/*.yml >/dev/null 2>&1 || ls "${WORKFLOWS_DIR}"/*.yaml >/dev/null 2>&1; then
+              bad_refs="$(grep -RIn --include='*.yml' --include='*.yaml' -E '^[[:space:]]*uses:[[:space:]]*[^#]+@(main|master)\b' "${WORKFLOWS_DIR}" 2>/dev/null || true)"
+              if [ -n "${bad_refs}" ]; then
+                extended_findings+=("Workflows reference actions @main/@master (pin versions): see log excerpt")
+                {
+                  printf '%s\n' '### Workflow pinning advisory'
+                  printf '%s\n' 'Found uses: entries pinned to main/master:'
+                  printf '%s\n' '```'
+                  printf '%s\n' "${bad_refs}"
+                  printf '%s\n' '```'
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            if [ -f "${DOCS_INDEX}" ]; then
+              missing_links=""
+              while IFS= read -r docline; do
+                for link in $(echo "$docline" | grep -oE '\]\([^)]+\)' | sed 's/\](//' | sed 's/)$//' || true); do
+                  case "$link" in http://*|https://*|"#"*|mailto:*) continue ;; esac
+                  linkpath="${link%%#*}"
+                  linkpath="${linkpath%%\?*}"
+                  [ -z "$linkpath" ] && continue
+                  if [ "${linkpath:0:1}" = "/" ]; then
+                    testpath="${linkpath#/}"
+                  else
+                    testpath="$(dirname "${DOCS_INDEX}")/${linkpath}"
+                  fi
+                  [ ! -e "$testpath" ] && missing_links="${missing_links}${testpath} "
+                done
+              done < "${DOCS_INDEX}"
+              if [ -n "${missing_links}" ]; then
+                extended_findings+=("docs/docs-index.md contains broken relative links")
+                {
+                  printf '%s\n' '### Docs index link integrity'
+                  printf '%s\n' 'Broken relative links:'
+                  for bl in ${missing_links}; do
+                    printf '%s\n' "- ${bl}"
+                  done
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            if [ -d "${SCRIPT_DIR}" ]; then
+              if ! command -v shellcheck >/dev/null 2>&1; then
+                sudo apt-get update -qq
+                sudo apt-get install -y shellcheck >/dev/null
+              fi
+
+              sc_out=''
+              while IFS= read -r shf; do
+                [ -z "${shf}" ] && continue
+                out_one="$(shellcheck -S warning -x "${shf}" 2>/dev/null || true)"
+                if [ -n "${out_one}" ]; then
+                  sc_out="${sc_out}${out_one}\n"
+                fi
+              done < <(find "${SCRIPT_DIR}" -type f -name "${SHELLCHECK_PATTERN}" 2>/dev/null | sort)
+
+              if [ -n "${sc_out}" ]; then
+                extended_findings+=("ShellCheck warnings detected (advisory)")
+                sc_head="$(printf '%s' "${sc_out}" | head -n 200)"
+                {
+                  printf '%s\n' '### ShellCheck (advisory)'
+                  printf '%s\n' '```'
+                  printf '%s\n' "${sc_head}"
+                  printf '%s\n' '```'
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            spdx_missing=()
+            IFS=',' read -r -a spdx_globs <<< "${SPDX_FILE_GLOBS}"
+            spdx_args=()
+            for g in "${spdx_globs[@]}"; do spdx_args+=("${g}"); done
+
+            while IFS= read -r f; do
+              [ -z "${f}" ] && continue
+              if ! head -n 40 "${f}" | grep -q 'SPDX-License-Identifier:'; then
+                spdx_missing+=("${f}")
+              fi
+            done < <(git ls-files "${spdx_args[@]}" 2>/dev/null || true)
+
+            if [ "${#spdx_missing[@]}" -gt 0 ]; then
+              extended_findings+=("SPDX header missing in some tracked files (advisory)")
+              {
+                printf '%s\n' '### SPDX header advisory'
+                printf '%s\n' 'Files missing SPDX-License-Identifier (first 40 lines scan):'
+                for f in "${spdx_missing[@]}"; do printf '%s\n' "- ${f}"; done
+                printf '\n'
+              } >> "${GITHUB_STEP_SUMMARY}"
+            fi
+
+            stale_cutoff_days=180
+            stale_branches="$(git for-each-ref --format='%(refname:short) %(committerdate:unix)' refs/remotes/origin 2>/dev/null | awk -v now="$(date +%s)" -v days="${stale_cutoff_days}" '{if (now-$2 > days*86400) print $1}' | head -50)"
+            if [ -n "${stale_branches}" ]; then
+              extended_findings+=("Stale remote branches detected (advisory)")
+              {
+                printf '%s\n' '### Git hygiene advisory'
+                printf '%s\n' "Branches with last commit older than ${stale_cutoff_days} days (sample up to 50):"
+                while IFS= read -r b; do [ -n "${b}" ] && printf '%s\n' "- ${b}"; done <<< "${stale_branches}"
+                printf '\n'
+              } >> "${GITHUB_STEP_SUMMARY}"
+            fi
+          fi
+
+          {
+            printf '%s\n' '### Guardrails coverage matrix'
+            printf '%s\n' '| Domain | Status | Notes |'
+            printf '%s\n' '|---|---|---|'
+            printf '%s\n' '| Access control | OK | Admin-only execution gate |'
+            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGitea |'
+            printf '%s\n' '| Scripts governance | OK | Directory policy and advisory reporting |'
+            printf '%s\n' '| Repo required artifacts | OK | Required, optional, disallowed enforcement |'
+            printf '%s\n' '| Repo content heuristics | OK | Brand, license, changelog structure |'
+            if [ "${extended_enabled}" = 'true' ]; then
+              if [ "${#extended_findings[@]}" -gt 0 ]; then
+                printf '%s\n' '| Extended checks | Warning | See extended findings below |'
+              else
+                printf '%s\n' '| Extended checks | OK | No findings |'
+              fi
+            else
+              printf '%s\n' '| Extended checks | SKIPPED | EXTENDED_CHECKS disabled |'
+            fi
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+          if [ "${extended_enabled}" = 'true' ] && [ "${#extended_findings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Extended findings (advisory)'
+              for f in "${extended_findings[@]}"; do printf '%s\n' "- ${f}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          printf '%s\n' 'Repository health guardrails passed.' >> "${GITHUB_STEP_SUMMARY}"
+
+
+  site-health:
+    name: Site Health
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+
+      - name: Uptime check
+        if: env.URLS != ''
+        run: |
+          echo "$URLS" > /tmp/urls.txt
+          php monitoring/uptime-probe.php --urls /tmp/urls.txt --timeout 15 || echo "::warning::Some sites are down"
+          rm -f /tmp/urls.txt
+        env:
+          URLS: ${{ vars.MONITORED_URLS }}
+
+      - name: SSL certificate check
+        if: env.DOMAINS != ''
+        run: |
+          echo "$DOMAINS" > /tmp/domains.txt
+          php monitoring/ssl-check.php --domains /tmp/domains.txt --warn-days 30 || echo "::warning::SSL certificates expiring soon"
+          rm -f /tmp/domains.txt
+        env:
+          DOMAINS: ${{ vars.MONITORED_DOMAINS }}
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "### Site Health" >> $GITHUB_STEP_SUMMARY
+          echo "Uptime and SSL checks completed." >> $GITHUB_STEP_SUMMARY
+
+  # ═══════════════════════════════════════════════════════════════════════
+  # Issue Reporter — file issues for failed gates
+  # ═══════════════════════════════════════════════════════════════════════
+  report-issues:
+    name: "Report Issues"
+    runs-on: ubuntu-latest
+    needs: [access_check, scripts_governance, repo_health]
+    if: >-
+      always() &&
+      (needs.scripts_governance.result == 'failure' ||
+       needs.repo_health.result == 'failure')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: automation/ci-issue-reporter.sh
+          sparse-checkout-cone-mode: false
+
+      - name: "File issues for failed gates"
+        env:
+          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x automation/ci-issue-reporter.sh
+          REPORTER="./automation/ci-issue-reporter.sh"
+          WF="Repo Health"
+
+          report_gate() {
+            local gate="$1" result="$2" details="$3"
+            if [ "$result" = "failure" ]; then
+              "$REPORTER" --gate "$gate" --details "$details" --workflow "$WF" --severity error
+            fi
+          }
+
+          report_gate "Scripts Governance" \
+            "${{ needs.scripts_governance.result }}" \
+            "Scripts directory policy violations detected. Review required and allowed directories."
+
+          report_gate "Repository Health" \
+            "${{ needs.repo_health.result }}" \
+            "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
@@ -0,0 +1,82 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.gitea/workflows/security-audit.yml
+# VERSION: 01.00.00
+# BRIEF: Dependency vulnerability scanning for composer and npm packages
+
+name: "Universal: Security Audit"
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'composer.json'
+      - 'composer.lock'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+
+jobs:
+  audit:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Composer audit
+        if: hashFiles('composer.lock') != ''
+        run: |
+          echo "=== Composer Security Audit ==="
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli composer >/dev/null 2>&1
+          fi
+          composer audit --format=plain 2>&1 | tee /tmp/composer-audit.txt
+          RESULT=$?
+          if [ $RESULT -ne 0 ]; then
+            echo "::warning::Composer vulnerabilities found"
+            echo "composer_vulnerable=true" >> "$GITHUB_ENV"
+          else
+            echo "No known vulnerabilities in composer dependencies"
+          fi
+
+      - name: NPM audit
+        if: hashFiles('package-lock.json') != ''
+        run: |
+          echo "=== NPM Security Audit ==="
+          npm audit --production 2>&1 | tee /tmp/npm-audit.txt || true
+          if npm audit --production 2>&1 | grep -q "found 0 vulnerabilities"; then
+            echo "No known vulnerabilities in npm dependencies"
+          else
+            echo "::warning::NPM vulnerabilities found"
+            echo "npm_vulnerable=true" >> "$GITHUB_ENV"
+          fi
+
+      - name: Notify on vulnerabilities
+        if: env.composer_vulnerable == 'true' || env.npm_vulnerable == 'true'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} has vulnerable dependencies" \
+            -H "Tags: lock,warning" \
+            -H "Priority: high" \
+            -d "Security audit found vulnerabilities. Review dependency updates." \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true
@@ -0,0 +1,12 @@
+# Test workflow to verify .mokogitea/ directory is discovered
+name: Test .mokogitea workflows
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify .mokogitea
+        run: echo "This workflow ran from .mokogitea/workflows/ — feature works!"
@@ -0,0 +1,167 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Sync upstream Gitea bug fixes into MokoGitea issue tracker
+
+name: Upstream Bug Sync
+
+on:
+  schedule:
+    - cron: '0 8 * * *'  # daily at 08:00 UTC
+  workflow_dispatch:
+    inputs:
+      days_back:
+        description: 'How many days back to scan (default: 7)'
+        required: false
+        default: '7'
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Sync upstream bugs
+        env:
+          GH_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_URL: https://code.mokoconsulting.tech
+          MOKOGITEA_REPO: MokoConsulting/MokoGitea
+          UPSTREAM_BRANCH: release/v1.26
+          DAYS_BACK: ${{ github.event.inputs.days_back || '7' }}
+        run: |
+          python3 << 'PYEOF'
+          import json, os, re, sys, urllib.parse, urllib.request
+          from datetime import datetime, timedelta, timezone
+
+          GH_TOKEN = os.environ["GH_TOKEN"]
+          MOKO_TOKEN = os.environ["MOKOGITEA_TOKEN"]
+          MOKO_URL = os.environ["MOKOGITEA_URL"]
+          MOKO_REPO = os.environ["MOKOGITEA_REPO"]
+          BRANCH = os.environ["UPSTREAM_BRANCH"]
+          DAYS = int(os.environ.get("DAYS_BACK", "7"))
+
+          # Label IDs in MokoGitea
+          LABELS = {
+              "type_bug": 5757, "upstream": 5758, "security": 5032,
+              "critical": 5018, "high": 5019, "medium": 5020, "low": 5021,
+          }
+
+          def gh_get(url):
+              req = urllib.request.Request(url, headers={
+                  "Authorization": f"token {GH_TOKEN}",
+                  "Accept": "application/vnd.github.v3+json",
+              })
+              with urllib.request.urlopen(req) as r:
+                  return json.loads(r.read())
+
+          def moko_get(path):
+              req = urllib.request.Request(f"{MOKO_URL}/api/v1/{path}", headers={
+                  "Authorization": f"token {MOKO_TOKEN}",
+              })
+              with urllib.request.urlopen(req) as r:
+                  return json.loads(r.read())
+
+          def moko_post(path, data):
+              payload = json.dumps(data).encode()
+              req = urllib.request.Request(f"{MOKO_URL}/api/v1/{path}",
+                  data=payload, method="POST", headers={
+                      "Authorization": f"token {MOKO_TOKEN}",
+                      "Content-Type": "application/json",
+                  })
+              with urllib.request.urlopen(req) as r:
+                  return json.loads(r.read())
+
+          # ── Step 1: Find recently merged upstream PRs ──
+          since = (datetime.now(timezone.utc) - timedelta(days=DAYS)).strftime("%Y-%m-%dT%H:%M:%SZ")
+          query = f"repo:go-gitea/gitea is:pr is:merged base:{BRANCH} merged:>={since}"
+          encoded = urllib.parse.quote(query)
+          print(f"Scanning: {query}")
+
+          result = gh_get(f"https://api.github.com/search/issues?q={encoded}&per_page=100&sort=updated&order=desc")
+          total = result["total_count"]
+          print(f"Found {total} merged PRs in the last {DAYS} days")
+
+          if total == 0:
+              print("Nothing to sync.")
+              sys.exit(0)
+
+          # ── Step 2: Filter for bug/security fixes ──
+          bugs = []
+          for pr in result["items"]:
+              title = pr["title"]
+              label_names = [l["name"].lower() for l in pr.get("labels", [])]
+              is_fix = title.lower().startswith("fix")
+              is_security = any("security" in l for l in label_names) or "[security]" in title.lower()
+              is_bug = any("bug" in l for l in label_names)
+
+              if not (is_fix or is_security or is_bug):
+                  continue
+
+              refs = re.findall(r"#(\d+)", title)
+              severity = "critical" if is_security and "[security]" in title.lower() else \
+                         "high" if is_security else "medium"
+
+              bugs.append({
+                  "number": pr["number"], "title": title, "url": pr["html_url"],
+                  "severity": severity, "is_security": is_security, "refs": refs,
+                  "merged": pr.get("pull_request", {}).get("merged_at", "")[:10],
+              })
+
+          print(f"Filtered to {len(bugs)} bug/security fixes")
+          if not bugs:
+              sys.exit(0)
+
+          # ── Step 3: Collect already-tracked PR numbers ──
+          tracked = set()
+          for state in ["open", "closed"]:
+              try:
+                  issues = moko_get(f"repos/{MOKO_REPO}/issues?state={state}&type=issues&limit=50&labels=upstream")
+                  for iss in issues:
+                      text = (iss.get("body") or "") + " " + (iss.get("title") or "")
+                      tracked.update(re.findall(r"(?:#|/pull/)(\d{4,})", text))
+              except Exception:
+                  pass
+
+          print(f"Already tracked: {len(tracked)} upstream PRs")
+
+          # ── Step 4: Create issues for new bugs ──
+          created = skipped = errors = 0
+          for bug in bugs:
+              if any(r in tracked for r in bug["refs"]):
+                  print(f"  SKIP #{bug['number']}: {bug['title'][:55]} (tracked)")
+                  skipped += 1
+                  continue
+
+              labels = [LABELS["type_bug"], LABELS["upstream"], LABELS[bug["severity"]]]
+              if bug["is_security"]:
+                  labels.append(LABELS["security"])
+
+              body = (
+                  f"## Summary\n\n"
+                  f"Upstream bug fix merged into `{BRANCH}`.\n\n"
+                  f"## Upstream Reference\n\n"
+                  f"- PR: {bug['url']}\n"
+                  f"- Merged: {bug['merged']}\n"
+                  f"- Branch: {BRANCH}\n\n"
+                  f"## Severity: {bug['severity'].title()}"
+                  f"{'  (security)' if bug['is_security'] else ''}\n\n"
+                  f"## Action\n\n"
+                  f"Cherry-pick from upstream `{BRANCH}` branch.\n\n"
+                  f"---\n"
+                  f"*Auto-created by upstream-bug-sync workflow*\n"
+                  f"*Authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>*"
+              )
+
+              try:
+                  iss = moko_post(f"repos/{MOKO_REPO}/issues", {
+                      "title": bug["title"], "body": body, "labels": labels,
+                  })
+                  print(f"  CREATED #{iss['number']}: {bug['title'][:55]}")
+                  created += 1
+              except Exception as e:
+                  print(f"  ERROR #{bug['number']}: {e}")
+                  errors += 1
+
+          print(f"\n=== Done: {created} created, {skipped} skipped, {errors} errors ===")
+          PYEOF
@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
+# VERSION: 01.01.00
+# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
+
+name: "Universal: Workflow Sync Trigger"
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  sync:
+    name: Sync workflows to live repos
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')
+
+    steps:
+      - name: Determine platform from repo name
+        id: platform
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          case "$REPO" in
+            Template-Joomla)   PLATFORM="joomla" ;;
+            Template-Dolibarr) PLATFORM="dolibarr" ;;
+            Template-Go)       PLATFORM="go" ;;
+            Template-MCP)      PLATFORM="mcp" ;;
+            Template-Generic)  PLATFORM="" ;;
+            *)                 PLATFORM="" ;;
+          esac
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-all}"
+
+      - name: Clone mokocli
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+
+      - name: Install dependencies
+        run: |
+          cd /tmp/mokocli
+          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+
+      - name: Run workflow sync
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          ARGS="--token ${MOKOGITEA_TOKEN}"
+          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
+          ARGS="${ARGS} --phase repos"
+
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ -n "$PLATFORM" ]; then
+            ARGS="${ARGS} --platform-filter ${PLATFORM}"
+          fi
+
+          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}
@@ -3,28 +3,6 @@
 ## [Unreleased]

 ### Added
- Code security scanner: pattern-based detection of SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded credentials, and weak cryptography across Go/PHP/Python/JS/TS (#552)
- Cascade merge: auto-create PRs to downstream branches after merge with configurable rules per repo (#460)
- Issue status presets: 4 built-in templates (default, software-development, support-tickets, bug-tracking) with API + web UI (#507)
- Cross-org status migration: copy status definitions from one org to another via API (#507)
- Auto-create default teams on org creation: Developers (write), Reviewers (read), CI/CD (actions+packages) (#513)
- Branch protection delete allowlist: configurable per-user/team/deploy-key allowlist for deleting protected branches (#696)
- Workflow subdirectory discovery: workflows in subdirectories of `.mokogitea/workflows/` are now auto-discovered (#693)
- API token scope `read:licensing` / `write:licensing` for licensing endpoints (#697)
- Edit API token scopes: PATCH /users/{username}/tokens/{id} API endpoint + web UI edit button (#697)
- Wiki full-text search: case-insensitive search across all wiki page titles and content (#550)
- Wiki search API: GET /wiki/search?q=term with paginated JSON results (#550)
- Metadata deploy fields: deploy_host, deploy_port, deploy_user, deploy_path, docker_image, docker_registry, container_name, health_url (#692)
- Security scanning API: REST endpoints for alerts, config, and on-demand scans (GET/PATCH /security/alerts, /security/config, POST /security/scan) (#692)
- Pre-receive hook secret blocking: push rejection when block_on_push enabled and secrets detected in commits (#692)
- Metadata API partial updates: PUT /metadata now merges only sent fields instead of replacing all
- Wiki revision diff: line-by-line diff view per commit in wiki page history (#667)
- Wiki categories: YAML frontmatter `categories:` with category index page (#668)
- Wiki template transclusion: `{{template:Name|key=val}}` with `_Template/` folder (#671)
- Wiki enhanced ToC: collapsible, inline via frontmatter, sticky sidebar (#673)
- Wiki folder ACL: `_access.yml` per-folder write protection (#674)
- Wiki print view and ZIP export of all wiki pages (#675)
- Wiki features documentation page in org wiki (standards/Wiki-Features)
 - DLID licensing system: license, entitlement, activation, product_tier, audit_log tables (v359 migration)
 - License CRUD with CRC32-checksummed DLID generation and format validation
 - Entitlement model with tier-based rebuild and custom entitlement preservation
@@ -32,68 +10,6 @@
 - 13 seeded product tiers from base to enterprise
 - DLID-gated update XML endpoint: GET /api/v1/licensing/updates/{product}.xml
 - Profile repo fallback chain: .mokogitea > .profile > .github
- Metadata/manifest GET endpoint publicly accessible without auth (#676)
- Org wiki: folder-based collapsible tree sidebar, _Sidebar.md overrides (#680)
- Wiki backlinks: "What links here" page showing all pages referencing current page (#669)
- Wiki wikilinks: [[Page Name]] and [[Page|Display Text]] syntax with red links for missing pages (#666)
- Required baseline issue statuses: Open and Closed are indestructible (is_required flag) (#681)
- Issue status API response includes is_required field
- Wiki recent changes page: cross-page edit activity with pagination (#670)
- Wiki page rename with automatic redirects via YAML frontmatter (#672)
-
-### Security
- Cherry-pick upstream v1.26.3: LFS reject unknown SSH sub-verbs to prevent auth bypass (#38015)
- Cherry-pick upstream v1.26.3: bound CODEOWNERS regex match time — ReDoS prevention (#38025)
- Cherry-pick upstream v1.26.3: require merged PR to bypass fork PR approval gate (#38041)
- Cherry-pick upstream v1.26.3: LFS require Code-unit access for cross-repo object reuse (#38050)
- Cherry-pick upstream v1.26.3: hostmatcher block reserved IP ranges — SSRF prevention (#38059)
- Cherry-pick upstream v1.26.3: bound debian ParseControlFile — DoS prevention (#38055)
- Cherry-pick upstream v1.26.3: feed token scope, migration SSRF, notification redaction (#38147)
- Cherry-pick upstream v1.26.3: OIDC ignore stale external login links to organizations (#38141)
- Cherry-pick upstream v1.26.3: 2FA timing, branch delete auth, org labels visibility, merge upstream auth (#38151)
- Cherry-pick upstream v1.26.3: allow git clone of private repos with anonymous code access (#38146)
- Cherry-pick upstream v1.26.3: hostmatcher patch incorrect private IP list (#38173)
- Cherry-pick upstream v1.26.4: do not auto-reactivate disabled users on OAuth2 callback (#38183)
- Cherry-pick upstream v1.26.4: walk git log context error handling — regression fix (#38185)
-
-### Fixed
- Org Teams page: list now renders — the handler wrote `ctx.Data["OrgListTeams"]` but the template reads `.Teams`, so the page showed header/nav but no teams (#720)
- Issue type: now editable after creation for users with issue write permission — the sidebar gated editing on a `FieldEditFlags` data key that was never populated (always read-only); now uses `HasIssuesOrPullsWritePermission` like the priority field (#721)
- Admin config form: radio inputs (e.g. instance landing page Mode) no longer throw "Unsupported config form value mapping", which had aborted all JS init on the admin settings page
- PR check branch policy: allow `fix/*` → `main` and `patch/*` → `main` to match documented policy (was rejecting fix/patch PRs to main)
- PR check platform detection: guard for missing `.mokogitea/manifest.xml` so the Validate PR job no longer aborts under `set -e` (manifest replaced by metadata API)
- Remove dangling `mcp-mokogitea-api` submodule gitlink (no `.gitmodules` entry) that broke `submodule update --init` at checkout, failing all PR build/release jobs; ignore the local clone path
- PR RC Release workflow: no-op cleanly when `updates.xml` is absent (generic repos) instead of aborting the "Determine RC version" step under `set -e`
- PR check: platform detection now queries metadata API instead of removed manifest.xml
- Cherry-pick upstream v1.26.2: handle empty pull request files view to allow reviews (#37783)
- Cherry-pick upstream v1.26.2: fix "run as root" check with snap container detection (#37622)
- Cherry-pick upstream: ack re-sent UpdateLog finalize idempotently (#37885)
- Cherry-pick upstream: reject workflow_dispatch for workflows without that trigger (#37660)
- Cherry-pick upstream: keep action run title clickable when commit subject is a URL (#37867)
- Cherry-pick upstream: exclude workflow_call from workflow trigger detection (#37894)
- API token edit: reject empty scope update requests with 400 instead of silently succeeding
- Workflow token auth: pr-check.yml pre-release dispatch was silently failing due to env var / curl reference mismatch
- Workflow tokens: standardize all GA_TOKEN/GITEA_TOKEN/GITEA_URL env vars to MOKOGITEA_TOKEN/MOKOGITEA_URL across all workflow files in 5 template repos + MokoCLI (65+ files)
- CI issue reporter: rename GITEA_TOKEN/GITEA_URL to MOKOGITEA_TOKEN/MOKOGITEA_URL in automation/ci-issue-reporter.sh
- Workflow sync trigger: add workflow_dispatch event, fix if-condition to allow manual dispatch, add PHP install step for non-PHP runners
- Deploy workflow: merge dev health check into deploy job to avoid runner status reporting failures on inter-job handoff
- Licensing API: handle DB write errors in UpdateLicense, UpdateTier, DeleteTier instead of silently discarding
- Wiki API: fix findEntryForFile URL-decode fallback for non-ASCII page names
- Metadata settings template 500 error: removed reference to deleted Version field
- Wiki recent changes: use commit.MessageTitle() instead of commit.Message()
- Wiki backlinks: proper URL encoding for subdirectory pages
- Wiki wikilinks: page existence lookup normalizes spaces and hyphens
- Issue statuses template: garbled em-dash character replaced
-
-### Changed
- Custom workflows moved to `.mokogitea/workflows/custom/`: deploy-mokogitea, deploy-dev, cascade-dev, pr-rc-release, test-mokogitea, upstream-bug-sync
- Issue status seed defaults: Open, In Progress, Waiting, In Review, Closed, Won't Fix
- Pre-release workflow: auto-bump skipped for non-Joomla repos (platform check)
- CI issue reporter: moved to MokoCLI (cli/ci_issue_reporter.sh), pr-check and repo-health now use ci-issue-reporter.yml reusable workflow
-
-### Removed
- Workflows: gitleaks.yml, npm-publish.yml, notify.yml, workflow-sync-trigger.yml, composer-publish.yml, deploy-manual.yml, security-audit.yml (not applicable to Go repo)
- automation/ci-issue-reporter.sh: moved to MokoCLI as centralized CLI tool

 ## [06.19.00] --- 2026-06-20

@@ -1,36 +1,38 @@
 # MokoGitea

-Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org metadata, CI standardization, and project board API.
+Moko fork of Gitea — adding project board REST API endpoints and custom enhancements

-![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square)
+![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square) ![Wiki](https://img.shields.io/badge/wiki-MokoGitea-blue?style=flat-square)
+
+
+Custom Gitea fork with Project Board API

 ---

-## Key Features
+## Pages

- **Wiki System** -- wikilinks, categories, backlinks, template transclusion, revision diffs, rename redirects, folder ACL, enhanced ToC, print view, ZIP export ([details](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/standards/Wiki-Features))
- **DLID Licensing** -- license management, entitlements, domain activations, ed25519-signed downloads
- **API Token Scope Editing** -- edit token scopes via API (PATCH) or web UI after creation
- **Issue Statuses** -- custom workflow statuses per org with required baseline protection, presets, cross-org migration
- **Cascade Merge** -- auto-create PRs to downstream branches after merge with configurable rules per repo
- **Security Scanning** -- secret detection (pre-receive blocking) + code analysis (SQL injection, XSS, command injection, path traversal, and more) with REST API for alerts, config, and on-demand scans
- **Default Org Teams** -- auto-create Developers, Reviewers, and CI/CD teams on org creation
- **Org Metadata** -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
- **Branch Protection** -- delete allowlist for protected branches (per-user/team/deploy-key)
- **Project Board API** -- REST endpoints for project columns and cards
- **CI Infrastructure** -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
- **Dev Deploy Gate** -- builds deploy to dev environment first, production checks dev health
+- [Branding](https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki/Branding)
+- [Deployment](https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki/Deployment)
+- [Project API](Project API)
+- [roadmap](https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki/roadmap)
+
+---
+
+**Category:** Infrastructure | **Platform:** [MokoPlatform wiki](https://code.mokoconsulting.tech/MokoConsulting/MokoPlatform/wiki)
+
+---
+
+
+
+---

 ## Documentation

- [Org Wiki](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/) -- standards, CLI reference, API docs
- [Wiki Features](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/standards/Wiki-Features) -- all 10 wiki enhancements
- [Licensing API](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/api/Licensing-API)
- [Repo Wiki](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork/wiki/) -- feature docs, API reference, operations
+Full documentation is available on the [Wiki](https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki).

 ## Contributing

-See the [org wiki](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/) for development guidelines, coding standards, and contribution instructions.
+See the wiki for development guidelines and contribution instructions.

 ## License

@@ -38,4 +40,4 @@ This project is licensed under the GNU General Public License v3.0 or later -- s

 ---

-*[Moko Consulting](https://mokoconsulting.tech)*
+*[Moko Consulting](https://mokoconsulting.tech) -- [MokoStandards](https://code.mokoconsulting.tech/MokoConsulting/MokoPlatform/wiki/Home)*
@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Automation.CI
+# INGROUP: moko-platform.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /automation/ci-issue-reporter.sh
+# VERSION: 09.23.00
+# BRIEF: Creates or updates a Gitea issue when a CI gate fails.
+#        Deduplicates by searching open issues with the "ci-auto" label
+#        whose title matches the gate. If a matching issue exists, a comment
+#        is appended instead of opening a duplicate.
+# ============================================================================
+
+set -euo pipefail
+
+# ── Defaults ────────────────────────────────────────────────────────────────
+GITEA_URL="${GITEA_URL:-https://git.mokoconsulting.tech}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+REPO="${GITHUB_REPOSITORY:-}"
+RUN_URL="${GITHUB_SERVER_URL:-${GITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
+LABEL_NAME="ci-auto"
+LABEL_COLOR="#e11d48"
+
+GATE=""
+DETAILS=""
+SEVERITY="error"
+WORKFLOW=""
+
+# ── Parse arguments ─────────────────────────────────────────────────────────
+usage() {
+  cat <<EOF
+Usage: ci-issue-reporter.sh --gate NAME --details TEXT [OPTIONS]
+
+Required:
+  --gate      CI gate name (e.g. "Code Quality", "Self-Health")
+  --details   Human-readable failure description
+
+Optional:
+  --severity  "error" (default) or "warning"
+  --workflow  Workflow name for the issue title
+  --repo      owner/repo (default: \$GITHUB_REPOSITORY)
+  --run-url   URL to the CI run (auto-detected from env)
+  --token     Gitea API token (default: \$GITEA_TOKEN)
+  --url       Gitea base URL (default: \$GITEA_URL)
+EOF
+  exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --gate)     GATE="$2";       shift 2 ;;
+    --details)  DETAILS="$2";    shift 2 ;;
+    --severity) SEVERITY="$2";   shift 2 ;;
+    --workflow) WORKFLOW="$2";   shift 2 ;;
+    --repo)     REPO="$2";      shift 2 ;;
+    --run-url)  RUN_URL="$2";   shift 2 ;;
+    --token)    GITEA_TOKEN="$2"; shift 2 ;;
+    --url)      GITEA_URL="$2"; shift 2 ;;
+    -h|--help)  usage ;;
+    *)          echo "Unknown option: $1"; usage ;;
+  esac
+done
+
+[[ -z "$GATE" ]]         && { echo "ERROR: --gate is required"; usage; }
+[[ -z "$DETAILS" ]]      && { echo "ERROR: --details is required"; usage; }
+[[ -z "$GITEA_TOKEN" ]]  && { echo "ERROR: GITEA_TOKEN not set"; exit 1; }
+[[ -z "$REPO" ]]         && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }
+
+API="${GITEA_URL}/api/v1/repos/${REPO}"
+
+# ── Build title ─────────────────────────────────────────────────────────────
+if [[ -n "$WORKFLOW" ]]; then
+  TITLE="[CI] ${WORKFLOW}: ${GATE} failed"
+else
+  TITLE="[CI] ${GATE} failed"
+fi
+
+# ── Ensure label exists ─────────────────────────────────────────────────────
+ensure_label() {
+  local exists
+  exists=$(curl -sf -o /dev/null -w '%{http_code}' \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${API}/labels" 2>/dev/null || echo "000")
+
+  if [[ "$exists" == "200" ]]; then
+    # Check if label already exists
+    local found
+    found=$(curl -sf \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -o "\"name\":\"${LABEL_NAME}\"" || true)
+
+    if [[ -z "$found" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/labels" \
+        -d "{\"name\":\"${LABEL_NAME}\",\"color\":\"${LABEL_COLOR}\",\"description\":\"Auto-created by CI issue reporter\"}" \
+        > /dev/null 2>&1 || true
+    fi
+  fi
+}
+
+# ── Search for existing open issue ──────────────────────────────────────────
+find_existing_issue() {
+  # URL-encode the gate name for the query
+  local query
+  query=$(printf '%s' "[CI] ${GATE}" | sed 's/ /%20/g; s/\[/%5B/g; s/\]/%5D/g')
+
+  local response
+  response=$(curl -sf \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${API}/issues?type=issues&state=open&labels=${LABEL_NAME}&q=${query}&limit=5" \
+    2>/dev/null || echo "[]")
+
+  # Extract the first matching issue number
+  echo "$response" \
+    | grep -oP '"number":\s*\K[0-9]+' \
+    | head -1
+}
+
+# ── Build issue body ────────────────────────────────────────────────────────
+build_body() {
+  local severity_badge
+  if [[ "$SEVERITY" == "error" ]]; then
+    severity_badge="**Severity:** Error"
+  else
+    severity_badge="**Severity:** Warning"
+  fi
+
+  cat <<BODY
+## CI Gate Failure: ${GATE}
+
+${severity_badge}
+**Workflow:** ${WORKFLOW:-unknown}
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+### Details
+
+${DETAILS}
+
+### Resolution
+
+Fix the issue described above and push a new commit. This issue will be closed automatically when the gate passes, or can be closed manually.
+
+---
+*Auto-created by [ci-issue-reporter](${GITEA_URL}/${REPO}/src/branch/main/automation/ci-issue-reporter.sh)*
+BODY
+}
+
+# ── Build comment body (for existing issues) ────────────────────────────────
+build_comment() {
+  cat <<COMMENT
+### CI failure recurrence
+
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+${DETAILS}
+COMMENT
+}
+
+# ── Main ────────────────────────────────────────────────────────────────────
+ensure_label
+
+EXISTING=$(find_existing_issue)
+
+if [[ -n "$EXISTING" ]]; then
+  # Append comment to existing issue
+  COMMENT_BODY=$(build_comment)
+  COMMENT_JSON=$(printf '%s' "$COMMENT_BODY" | python3 -c "
+import sys, json
+print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)
+
+  HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues/${EXISTING}/comments" \
+    -d "${COMMENT_JSON}" 2>/dev/null || echo "000")
+
+  if [[ "$HTTP" == "201" ]]; then
+    echo "Commented on existing issue #${EXISTING}"
+  else
+    echo "WARNING: Failed to comment on issue #${EXISTING} (HTTP ${HTTP})"
+  fi
+else
+  # Create new issue
+  ISSUE_BODY=$(build_body)
+  ISSUE_JSON=$(python3 -c "
+import sys, json
+body = sys.stdin.read()
+print(json.dumps({
+    'title': sys.argv[1],
+    'body': body,
+    'labels': []
+}))" "$TITLE" <<< "$ISSUE_BODY" 2>/dev/null)
+
+  # Create the issue
+  RESPONSE=$(curl -sf -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues" \
+    -d "${ISSUE_JSON}" 2>/dev/null || echo "{}")
+
+  ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
+
+  if [[ -n "$ISSUE_NUM" ]]; then
+    # Apply label (separate call — more reliable across Gitea versions)
+    LABEL_ID=$(curl -sf \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"${LABEL_NAME}\")" \
+      | head -1 || true)
+
+    if [[ -n "$LABEL_ID" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/issues/${ISSUE_NUM}/labels" \
+        -d "{\"labels\":[${LABEL_ID}]}" \
+        > /dev/null 2>&1 || true
+    fi
+
+    echo "Created issue #${ISSUE_NUM}: ${TITLE}"
+  else
+    echo "WARNING: Failed to create issue"
+    echo "Response: ${RESPONSE}"
+  fi
+fi
@@ -113,25 +113,23 @@ func handleCliResponseExtra(extra private.ResponseExtra) error {
 	return nil
 }

-// getAccessMode maps an SSH git/LFS verb to the access mode it requires, with
-// ok=false for an unrecognised verb. Callers MUST reject the request when ok is
-// false: AccessModeNone would otherwise pass the `userMode < mode` permission
-// check in routers/private/serv.go and grant access.
-func getAccessMode(verb, lfsVerb string) (mode perm.AccessMode, ok bool) {
+func getAccessMode(verb, lfsVerb string) perm.AccessMode {
 	switch verb {
 	case git.CmdVerbUploadPack, git.CmdVerbUploadArchive:
-		return perm.AccessModeRead, true
+		return perm.AccessModeRead
 	case git.CmdVerbReceivePack:
-		return perm.AccessModeWrite, true
+		return perm.AccessModeWrite
 	case git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:
 		switch lfsVerb {
 		case git.CmdSubVerbLfsUpload:
-			return perm.AccessModeWrite, true
+			return perm.AccessModeWrite
 		case git.CmdSubVerbLfsDownload:
-			return perm.AccessModeRead, true
+			return perm.AccessModeRead
 		}
 	}
-	return perm.AccessModeNone, false
+	// should be unreachable
+	setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb)
+	return perm.AccessModeNone
 }

 func runServ(ctx context.Context, c *cli.Command) error {
@@ -249,10 +247,7 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		}
 	}

-	requestedMode, ok := getAccessMode(verb, lfsVerb)
-	if !ok {
-		return fail(ctx, "Unknown git command", "Unknown git command %s %s", verb, lfsVerb)
-	}
+	requestedMode := getAccessMode(verb, lfsVerb)

 	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {
@@ -1,56 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"testing"
-
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetAccessMode(t *testing.T) {
-	cases := []struct {
-		verb, lfsVerb string
-		expected      perm.AccessMode
-	}{
-		{git.CmdVerbUploadPack, "", perm.AccessModeRead},
-		{git.CmdVerbUploadArchive, "", perm.AccessModeRead},
-		{git.CmdVerbReceivePack, "", perm.AccessModeWrite},
-		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
-		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
-		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
-		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
-	}
-	for _, tc := range cases {
-		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
-			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
-			assert.True(t, ok)
-			assert.Equal(t, tc.expected, mode)
-		})
-	}
-}
-
-// TestGetAccessModeUnknownVerb locks in the invariant that getAccessMode reports
-// ok=false for unrecognised verbs and LFS sub-verbs, so runServ rejects them. An
-// unknown verb has no valid access mode; if it were treated as AccessModeNone (0)
-// it would pass the `userMode < mode` permission check in routers/private/serv.go
-// and hand out valid LFS JWTs for any private repository.
-func TestGetAccessModeUnknownVerb(t *testing.T) {
-	cases := []struct{ verb, lfsVerb string }{
-		{git.CmdVerbLfsAuthenticate, ""},
-		{git.CmdVerbLfsAuthenticate, "badverb"},
-		{git.CmdVerbLfsTransfer, "badverb"},
-		{"git-unknown-verb", ""},
-	}
-	for _, tc := range cases {
-		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
-			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
-			assert.False(t, ok)
-			assert.Equal(t, perm.AccessModeNone, mode)
-		})
-	}
-}
@@ -51,6 +51,8 @@ ROOT_PATH = /data/gitea/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *

 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION
@@ -48,6 +48,8 @@ ROOT_PATH = $GITEA_WORK_DIR/data/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *

 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION
@@ -64,6 +64,7 @@ type FindRunOptions struct {
 	Ref              string // the commit/tag/… that caused this workflow
 	TriggerUserID    int64
 	TriggerEvent     webhook_module.HookEventType
+	Approved         bool // not util.OptionalBool, it works only when it's true
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
@@ -80,6 +81,9 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.TriggerUserID > 0 {
 		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
 	}
+	if opts.Approved {
+		cond = cond.And(builder.Gt{"`action_run`.approved_by": 0})
+	}
 	if len(opts.Status) > 0 {
 		cond = cond.And(builder.In("`action_run`.status", opts.Status))
 	}
@@ -24,7 +24,6 @@ const (
 	AccessTokenScopeCategoryIssue
 	AccessTokenScopeCategoryRepository
 	AccessTokenScopeCategoryUser
-	AccessTokenScopeCategoryLicensing
 )

 // AllAccessTokenScopeCategories contains all access token scope categories
@@ -38,7 +37,6 @@ var AllAccessTokenScopeCategories = []AccessTokenScopeCategory{
 	AccessTokenScopeCategoryIssue,
 	AccessTokenScopeCategoryRepository,
 	AccessTokenScopeCategoryUser,
-	AccessTokenScopeCategoryLicensing,
 }

 // AccessTokenScopeLevel represents the access levels without a given scope category
@@ -84,9 +82,6 @@ const (

 	AccessTokenScopeReadUser  AccessTokenScope = "read:user"
 	AccessTokenScopeWriteUser AccessTokenScope = "write:user"
-
-	AccessTokenScopeReadLicensing  AccessTokenScope = "read:licensing"
-	AccessTokenScopeWriteLicensing AccessTokenScope = "write:licensing"
 )

 // accessTokenScopeBitmap represents a bitmap of access token scopes.
@@ -98,8 +93,7 @@ const (
 	accessTokenScopeAllBits accessTokenScopeBitmap = accessTokenScopeWriteActivityPubBits |
 		accessTokenScopeWriteAdminBits | accessTokenScopeWriteMiscBits | accessTokenScopeWriteNotificationBits |
 		accessTokenScopeWriteOrganizationBits | accessTokenScopeWritePackageBits | accessTokenScopeWriteIssueBits |
-		accessTokenScopeWriteRepositoryBits | accessTokenScopeWriteUserBits |
-		accessTokenScopeWriteLicensingBits
+		accessTokenScopeWriteRepositoryBits | accessTokenScopeWriteUserBits

 	accessTokenScopePublicOnlyBits accessTokenScopeBitmap = 1 << iota

@@ -130,9 +124,6 @@ const (
 	accessTokenScopeReadUserBits  accessTokenScopeBitmap = 1 << iota
 	accessTokenScopeWriteUserBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadUserBits

-	accessTokenScopeReadLicensingBits  accessTokenScopeBitmap = 1 << iota
-	accessTokenScopeWriteLicensingBits accessTokenScopeBitmap = 1<<iota | accessTokenScopeReadLicensingBits
-
 	// The current implementation only supports up to 64 token scopes.
 	// If we need to support > 64 scopes,
 	// refactoring the whole implementation in this file (and only this file) is needed.
@@ -151,7 +142,6 @@ var allAccessTokenScopes = []AccessTokenScope{
 	AccessTokenScopeWriteIssue, AccessTokenScopeReadIssue,
 	AccessTokenScopeWriteRepository, AccessTokenScopeReadRepository,
 	AccessTokenScopeWriteUser, AccessTokenScopeReadUser,
-	AccessTokenScopeWriteLicensing, AccessTokenScopeReadLicensing,
 }

 // allAccessTokenScopeBits contains all access token scopes.
@@ -176,8 +166,6 @@ var allAccessTokenScopeBits = map[AccessTokenScope]accessTokenScopeBitmap{
 	AccessTokenScopeWriteRepository:   accessTokenScopeWriteRepositoryBits,
 	AccessTokenScopeReadUser:          accessTokenScopeReadUserBits,
 	AccessTokenScopeWriteUser:         accessTokenScopeWriteUserBits,
-	AccessTokenScopeReadLicensing:     accessTokenScopeReadLicensingBits,
-	AccessTokenScopeWriteLicensing:    accessTokenScopeWriteLicensingBits,
 }

 // readAccessTokenScopes maps a scope category to the read permission scope
@@ -192,7 +180,6 @@ var accessTokenScopes = map[AccessTokenScopeLevel]map[AccessTokenScopeCategory]A
 		AccessTokenScopeCategoryIssue:        AccessTokenScopeReadIssue,
 		AccessTokenScopeCategoryRepository:   AccessTokenScopeReadRepository,
 		AccessTokenScopeCategoryUser:         AccessTokenScopeReadUser,
-		AccessTokenScopeCategoryLicensing:    AccessTokenScopeReadLicensing,
 	},
 	Write: {
 		AccessTokenScopeCategoryActivityPub:  AccessTokenScopeWriteActivityPub,
@@ -204,7 +191,6 @@ var accessTokenScopes = map[AccessTokenScopeLevel]map[AccessTokenScopeCategory]A
 		AccessTokenScopeCategoryIssue:        AccessTokenScopeWriteIssue,
 		AccessTokenScopeCategoryRepository:   AccessTokenScopeWriteRepository,
 		AccessTokenScopeCategoryUser:         AccessTokenScopeWriteUser,
-		AccessTokenScopeCategoryLicensing:    AccessTokenScopeWriteLicensing,
 	},
 }

@@ -384,7 +370,7 @@ func (bitmap accessTokenScopeBitmap) toScope() AccessTokenScope {
 	scope := AccessTokenScope(strings.Join(scopes, ","))
 	scope = AccessTokenScope(strings.ReplaceAll(
 		string(scope),
-		"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,write:licensing",
+		"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user",
 		"all",
 	))
 	return scope
@@ -17,13 +17,13 @@ type scopeTestNormalize struct {
 }

 func TestAccessTokenScope_Normalize(t *testing.T) {
-	assert.Equal(t, []string{"activitypub", "admin", "issue", "licensing", "misc", "notification", "organization", "package", "repository", "user"}, GetAccessTokenCategories())
+	assert.Equal(t, []string{"activitypub", "admin", "issue", "misc", "notification", "organization", "package", "repository", "user"}, GetAccessTokenCategories())
 	tests := []scopeTestNormalize{
 		{"", "", nil},
 		{"write:misc,write:notification,read:package,write:notification,public-only", "public-only,write:misc,write:notification,read:package", nil},
 		{"all", "all", nil},
-		{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,write:licensing", "all", nil},
-		{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,write:licensing,public-only", "public-only,all", nil},
+		{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user", "all", nil},
+		{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user,public-only", "public-only,all", nil},
 	}

 	for _, scope := range GetAccessTokenCategories() {
@@ -21,7 +21,6 @@ import (

 	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/pbkdf2"
-	"xorm.io/builder"
 )

 //
@@ -105,43 +104,20 @@ func (t *TwoFactor) SetSecret(secretString string) error {
 	return nil
 }

-// validateTOTP validates the provided passcode. It does not consume the passcode; all login
-// surfaces must go through ValidateAndConsumeTOTP so that a passcode cannot be redeemed twice.
-func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
+// ValidateTOTP validates the provided passcode.
+func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
 	decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
 	if err != nil {
-		return false, fmt.Errorf("validateTOTP invalid base64: %w", err)
+		return false, fmt.Errorf("ValidateTOTP invalid base64: %w", err)
 	}
 	secretBytes, err := secret.AesDecrypt(t.getEncryptionKey(), decodedStoredSecret)
 	if err != nil {
-		return false, fmt.Errorf("validateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
+		return false, fmt.Errorf("ValidateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
 	}
 	secretStr := string(secretBytes)
 	return totp.Validate(passcode, secretStr), nil
 }

-// ValidateAndConsumeTOTP validates the passcode and atomically records it as used so that the
-// same passcode cannot be redeemed more than once (RFC 6238 §5.2). It returns false for an
-// invalid passcode as well as for a replay, including the case where a concurrent request with
-// the same passcode won the race first. All TOTP login surfaces must go through this helper.
-func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
-	ok, err := t.validateTOTP(passcode)
-	if err != nil || !ok {
-		return false, err
-	}
-	// Conditional update: only a row whose stored passcode differs from this one is updated, so a
-	// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
-	// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
-	t.LastUsedPasscode = passcode
-	n, err := db.GetEngine(ctx).ID(t.ID).
-		Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
-		Cols("last_used_passcode").Update(t)
-	if err != nil {
-		return false, err
-	}
-	return n == 1, nil
-}
-
 // NewTwoFactor creates a new two-factor authentication token.
 func NewTwoFactor(ctx context.Context, t *TwoFactor) error {
 	_, err := db.GetEngine(ctx).Insert(t)
@@ -1,47 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package auth_test
-
-import (
-	"testing"
-	"time"
-
-	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
-
-	"github.com/pquerna/otp/totp"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	key, err := totp.Generate(totp.GenerateOpts{SecretSize: 40, Issuer: "gitea-test", AccountName: "consume"})
-	require.NoError(t, err)
-
-	tfa := &auth_model.TwoFactor{UID: 1}
-	require.NoError(t, tfa.SetSecret(key.Secret()))
-	require.NoError(t, auth_model.NewTwoFactor(t.Context(), tfa))
-
-	passcode, err := totp.GenerateCode(key.Secret(), time.Now())
-	require.NoError(t, err)
-
-	// first use of a valid passcode succeeds
-	ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
-	require.NoError(t, err)
-	assert.True(t, ok)
-
-	// replaying the same passcode is refused, even when still inside the TOTP validity window
-	reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
-	require.NoError(t, err)
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
-	require.NoError(t, err)
-	assert.False(t, ok)
-
-	// an invalid passcode is rejected without consuming anything
-	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
-	require.NoError(t, err)
-	assert.False(t, ok)
-}
@@ -196,10 +196,7 @@ func LFSObjectAccessible(ctx context.Context, user *user_model.User, oid string)
 		count, err := db.GetEngine(ctx).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 		return count > 0, err
 	}
-	// LFS objects are repository code content, so authorization must require
-	// Code-unit access; other unit accesses (e.g. Issues) must not authorize
-	// reuse of an existing LFS object across repositories.
-	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)
+	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
 	count, err := db.GetEngine(ctx).Where(cond).Join("INNER", "repository", "`lfs_meta_object`.repository_id = `repository`.id").Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 	return count > 0, err
 }
@@ -223,7 +220,7 @@ func LFSAutoAssociate(ctx context.Context, metas []*LFSMetaObject, user *user_mo
 			newMetas := make([]*LFSMetaObject, 0, len(metas))
 			cond := builder.In(
 				"`lfs_meta_object`.repository_id",
-				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)),
+				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)),
 			)
 			if err := db.GetEngine(ctx).Cols("oid").Where(cond).In("oid", oids...).GroupBy("oid").Find(&newMetas); err != nil {
 				return err
@@ -51,12 +51,6 @@ type ProtectedBranch struct {
 	WhitelistActionsUser          bool     `xorm:"NOT NULL DEFAULT false"`
 	MergeWhitelistActionsUser     bool     `xorm:"NOT NULL DEFAULT false"`
 	ForcePushAllowlistActionsUser bool     `xorm:"NOT NULL DEFAULT false"`
-	CanDelete                     bool     `xorm:"NOT NULL DEFAULT false"`
-	EnableDeleteAllowlist         bool     `xorm:"NOT NULL DEFAULT false"`
-	DeleteAllowlistUserIDs        []int64  `xorm:"JSON TEXT"`
-	DeleteAllowlistTeamIDs        []int64  `xorm:"JSON TEXT"`
-	DeleteAllowlistDeployKeys     bool     `xorm:"NOT NULL DEFAULT false"`
-	DeleteAllowlistActionsUser    bool     `xorm:"NOT NULL DEFAULT false"`
 	EnableStatusCheck             bool     `xorm:"NOT NULL DEFAULT false"`
 	StatusCheckContexts           []string `xorm:"JSON TEXT"`
 	EnableApprovalsWhitelist      bool     `xorm:"NOT NULL DEFAULT false"`
@@ -200,46 +194,6 @@ func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user
 	return in && protectBranch.CanUserPush(ctx, user)
 }

-// CanUserDelete returns if some user could delete this protected branch
-func (protectBranch *ProtectedBranch) CanUserDelete(ctx context.Context, user *user_model.User) bool {
-	if !protectBranch.CanDelete {
-		return false
-	}
-
-	if user.IsActions() && protectBranch.DeleteAllowlistActionsUser {
-		return true
-	}
-
-	if !protectBranch.EnableDeleteAllowlist {
-		if err := protectBranch.LoadRepo(ctx); err != nil {
-			log.Error("LoadRepo: %v", err)
-			return false
-		}
-
-		isAdmin, err := access_model.HasAccessUnit(ctx, user, protectBranch.Repo, unit.TypeCode, perm.AccessModeAdmin)
-		if err != nil {
-			log.Error("HasAccessUnit: %v", err)
-			return false
-		}
-		return isAdmin
-	}
-
-	if slices.Contains(protectBranch.DeleteAllowlistUserIDs, user.ID) {
-		return true
-	}
-
-	if len(protectBranch.DeleteAllowlistTeamIDs) == 0 {
-		return false
-	}
-
-	in, err := organization.IsUserInTeams(ctx, user.ID, protectBranch.DeleteAllowlistTeamIDs)
-	if err != nil {
-		log.Error("IsUserInTeams: %v", err)
-		return false
-	}
-	return in
-}
-
 // IsUserMergeWhitelisted checks if some user is whitelisted to merge to this branch
 func IsUserMergeWhitelisted(ctx context.Context, protectBranch *ProtectedBranch, userID int64, permissionInRepo access_model.Permission) bool {
 	// Allow the actions bot user if explicitly whitelisted.
@@ -411,9 +365,6 @@ type WhitelistOptions struct {

 	ApprovalsUserIDs []int64
 	ApprovalsTeamIDs []int64
-
-	DeleteUserIDs []int64
-	DeleteTeamIDs []int64
 }

 // UpdateProtectBranch saves branch protection options of repository.
@@ -479,18 +430,6 @@ func UpdateProtectBranch(ctx context.Context, repo *repo_model.Repository, prote
 	}
 	protectBranch.ApprovalsWhitelistTeamIDs = whitelist

-	whitelist, err = updateUserWhitelist(ctx, repo, protectBranch.DeleteAllowlistUserIDs, opts.DeleteUserIDs)
-	if err != nil {
-		return err
-	}
-	protectBranch.DeleteAllowlistUserIDs = whitelist
-
-	whitelist, err = updateTeamWhitelist(ctx, repo, protectBranch.DeleteAllowlistTeamIDs, opts.DeleteTeamIDs)
-	if err != nil {
-		return err
-	}
-	protectBranch.DeleteAllowlistTeamIDs = whitelist
-
 	// Looks like it's a new rule
 	if protectBranch.ID == 0 {
 		// as it's a new rule and if priority was not set, we need to calc it.
@@ -635,15 +574,14 @@ func DeleteProtectedBranch(ctx context.Context, repo *repo_model.Repository, id

 // removeIDsFromProtectedBranch is a helper function to remove IDs from protected branch options
 func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userID, teamID int64, columnNames []string) error {
-	lenUserIDs, lenForcePushIDs, lenApprovalIDs, lenMergeIDs, lenDeleteIDs := len(p.WhitelistUserIDs), len(p.ForcePushAllowlistUserIDs), len(p.ApprovalsWhitelistUserIDs), len(p.MergeWhitelistUserIDs), len(p.DeleteAllowlistUserIDs)
-	lenTeamIDs, lenForcePushTeamIDs, lenApprovalTeamIDs, lenMergeTeamIDs, lenDeleteTeamIDs := len(p.WhitelistTeamIDs), len(p.ForcePushAllowlistTeamIDs), len(p.ApprovalsWhitelistTeamIDs), len(p.MergeWhitelistTeamIDs), len(p.DeleteAllowlistTeamIDs)
+	lenUserIDs, lenForcePushIDs, lenApprovalIDs, lenMergeIDs := len(p.WhitelistUserIDs), len(p.ForcePushAllowlistUserIDs), len(p.ApprovalsWhitelistUserIDs), len(p.MergeWhitelistUserIDs)
+	lenTeamIDs, lenForcePushTeamIDs, lenApprovalTeamIDs, lenMergeTeamIDs := len(p.WhitelistTeamIDs), len(p.ForcePushAllowlistTeamIDs), len(p.ApprovalsWhitelistTeamIDs), len(p.MergeWhitelistTeamIDs)

 	if userID > 0 {
 		p.WhitelistUserIDs = util.SliceRemoveAll(p.WhitelistUserIDs, userID)
 		p.ForcePushAllowlistUserIDs = util.SliceRemoveAll(p.ForcePushAllowlistUserIDs, userID)
 		p.ApprovalsWhitelistUserIDs = util.SliceRemoveAll(p.ApprovalsWhitelistUserIDs, userID)
 		p.MergeWhitelistUserIDs = util.SliceRemoveAll(p.MergeWhitelistUserIDs, userID)
-		p.DeleteAllowlistUserIDs = util.SliceRemoveAll(p.DeleteAllowlistUserIDs, userID)
 	}

 	if teamID > 0 {
@@ -651,19 +589,16 @@ func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userI
 		p.ForcePushAllowlistTeamIDs = util.SliceRemoveAll(p.ForcePushAllowlistTeamIDs, teamID)
 		p.ApprovalsWhitelistTeamIDs = util.SliceRemoveAll(p.ApprovalsWhitelistTeamIDs, teamID)
 		p.MergeWhitelistTeamIDs = util.SliceRemoveAll(p.MergeWhitelistTeamIDs, teamID)
-		p.DeleteAllowlistTeamIDs = util.SliceRemoveAll(p.DeleteAllowlistTeamIDs, teamID)
 	}

 	if (lenUserIDs != len(p.WhitelistUserIDs) ||
 		lenForcePushIDs != len(p.ForcePushAllowlistUserIDs) ||
 		lenApprovalIDs != len(p.ApprovalsWhitelistUserIDs) ||
-		lenMergeIDs != len(p.MergeWhitelistUserIDs) ||
-		lenDeleteIDs != len(p.DeleteAllowlistUserIDs)) ||
+		lenMergeIDs != len(p.MergeWhitelistUserIDs)) ||
 		(lenTeamIDs != len(p.WhitelistTeamIDs) ||
 			lenForcePushTeamIDs != len(p.ForcePushAllowlistTeamIDs) ||
 			lenApprovalTeamIDs != len(p.ApprovalsWhitelistTeamIDs) ||
-			lenMergeTeamIDs != len(p.MergeWhitelistTeamIDs) ||
-			lenDeleteTeamIDs != len(p.DeleteAllowlistTeamIDs)) {
+			lenMergeTeamIDs != len(p.MergeWhitelistTeamIDs)) {
 		if _, err := db.GetEngine(ctx).ID(p.ID).Cols(columnNames...).Update(p); err != nil {
 			return fmt.Errorf("updateProtectedBranches: %v", err)
 		}
@@ -678,7 +613,6 @@ func RemoveUserIDFromProtectedBranch(ctx context.Context, p *ProtectedBranch, us
 		"force_push_allowlist_user_i_ds",
 		"merge_whitelist_user_i_ds",
 		"approvals_whitelist_user_i_ds",
-		"delete_allowlist_user_i_ds",
 	}
 	return removeIDsFromProtectedBranch(ctx, p, userID, 0, columnNames)
 }
@@ -690,7 +624,6 @@ func RemoveTeamIDFromProtectedBranch(ctx context.Context, p *ProtectedBranch, te
 		"force_push_allowlist_team_i_ds",
 		"merge_whitelist_team_i_ds",
 		"approvals_whitelist_team_i_ds",
-		"delete_allowlist_team_i_ds",
 	}
 	return removeIDsFromProtectedBranch(ctx, p, 0, teamID, columnNames)
 }
@@ -22,7 +22,6 @@ type IssueStatusDef struct {
 	Color       string             `xorm:"VARCHAR(7)"`  // hex color, e.g. "#e11d48"
 	Description string             `xorm:"TEXT"`
 	ClosesIssue bool               `xorm:"NOT NULL DEFAULT false 'closes_issue'"`
-	IsRequired  bool               `xorm:"NOT NULL DEFAULT false 'is_required'"` // cannot be deleted
 	SortOrder   int                `xorm:"NOT NULL DEFAULT 0 'sort_order'"`
 	IsActive    bool               `xorm:"NOT NULL DEFAULT true 'is_active'"`
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
@@ -33,211 +32,6 @@ func (IssueStatusDef) TableName() string {
 	return "issue_status_def"
 }

-// ──────────────────────────────────────────────────────────────────────
-// Presets
-// ──────────────────────────────────────────────────────────────────────
-
-// StatusPresetEntry defines a single status in a preset template.
-type StatusPresetEntry struct {
-	Name        string
-	Color       string
-	Description string
-	ClosesIssue bool
-	IsRequired  bool
-}
-
-// StatusPreset defines a named collection of status definitions.
-type StatusPreset struct {
-	Name        string
-	Description string
-	Statuses    []StatusPresetEntry
-}
-
-// StatusPresets is the registry of built-in status presets.
-var StatusPresets = map[string]*StatusPreset{
-	"default": {
-		Name:        "default",
-		Description: "General-purpose workflow (default seed)",
-		Statuses: []StatusPresetEntry{
-			{Name: "Open", Color: "#2563eb", Description: "New or active issue", ClosesIssue: false, IsRequired: true},
-			{Name: "In Progress", Color: "#7c3aed", Description: "Work is actively being done"},
-			{Name: "Waiting", Color: "#f59e0b", Description: "Blocked or waiting for input"},
-			{Name: "In Review", Color: "#0891b2", Description: "PR submitted, awaiting review"},
-			{Name: "Closed", Color: "#16a34a", Description: "Completed or resolved", ClosesIssue: true, IsRequired: true},
-			{Name: "Won't Fix", Color: "#6b7280", Description: "Decided not to address", ClosesIssue: true},
-		},
-	},
-	"software-development": {
-		Name:        "software-development",
-		Description: "Software development lifecycle",
-		Statuses: []StatusPresetEntry{
-			{Name: "Open", Color: "#2563eb", Description: "New or active issue", IsRequired: true},
-			{Name: "In Progress", Color: "#7c3aed", Description: "Developer is working on this"},
-			{Name: "In Review", Color: "#0891b2", Description: "Pull request submitted, awaiting review"},
-			{Name: "Testing", Color: "#d97706", Description: "Being tested or in QA"},
-			{Name: "Closed", Color: "#16a34a", Description: "Completed, merged, and deployed", ClosesIssue: true, IsRequired: true},
-			{Name: "Won't Fix", Color: "#6b7280", Description: "Decided not to address", ClosesIssue: true},
-		},
-	},
-	"support-tickets": {
-		Name:        "support-tickets",
-		Description: "Customer support ticket workflow",
-		Statuses: []StatusPresetEntry{
-			{Name: "New", Color: "#2563eb", Description: "Ticket received, not yet triaged", IsRequired: true},
-			{Name: "Assigned", Color: "#7c3aed", Description: "Assigned to a support agent"},
-			{Name: "Waiting for Customer", Color: "#f59e0b", Description: "Awaiting customer response"},
-			{Name: "In Progress", Color: "#0891b2", Description: "Agent is actively working on this"},
-			{Name: "Resolved", Color: "#16a34a", Description: "Issue resolved, awaiting confirmation", ClosesIssue: true},
-			{Name: "Closed", Color: "#059669", Description: "Confirmed resolved", ClosesIssue: true, IsRequired: true},
-		},
-	},
-	"bug-tracking": {
-		Name:        "bug-tracking",
-		Description: "Bug lifecycle tracking",
-		Statuses: []StatusPresetEntry{
-			{Name: "New", Color: "#2563eb", Description: "Bug reported, not yet triaged", IsRequired: true},
-			{Name: "Confirmed", Color: "#dc2626", Description: "Bug confirmed and reproducible"},
-			{Name: "In Progress", Color: "#7c3aed", Description: "Developer is working on a fix"},
-			{Name: "Fixed", Color: "#0891b2", Description: "Fix implemented, awaiting verification"},
-			{Name: "Verified", Color: "#16a34a", Description: "Fix verified by QA"},
-			{Name: "Closed", Color: "#059669", Description: "Bug resolved and closed", ClosesIssue: true, IsRequired: true},
-			{Name: "Won't Fix", Color: "#6b7280", Description: "Decided not to fix", ClosesIssue: true},
-		},
-	},
-}
-
-// StatusPresetNames returns the list of available preset names in display order.
-func StatusPresetNames() []string {
-	return []string{"default", "software-development", "support-tickets", "bug-tracking"}
-}
-
-// ApplyStatusPreset replaces all non-required statuses for an org with a preset.
-// Required statuses (Open/Closed) are preserved if they already exist; the preset's
-// required entries are created if missing. Non-required statuses are soft-deleted
-// (is_active=false) and the preset's non-required entries are inserted.
-func ApplyStatusPreset(ctx context.Context, orgID int64, presetName string) error {
-	preset, ok := StatusPresets[presetName]
-	if !ok {
-		return db.ErrNotExist{Resource: "StatusPreset", ID: 0}
-	}
-
-	existing, err := GetAllIssueStatusDefsByOrg(ctx, orgID)
-	if err != nil {
-		return err
-	}
-
-	// Build lookup of existing statuses by name
-	existingByName := make(map[string]*IssueStatusDef, len(existing))
-	for _, d := range existing {
-		existingByName[d.Name] = d
-	}
-
-	// Deactivate all non-required existing statuses
-	for _, d := range existing {
-		if d.IsRequired {
-			continue
-		}
-		if d.IsActive {
-			d.IsActive = false
-			if _, err := db.GetEngine(ctx).ID(d.ID).Cols("is_active").Update(d); err != nil {
-				return err
-			}
-		}
-	}
-
-	// Apply preset entries
-	for i, entry := range preset.Statuses {
-		if ex, found := existingByName[entry.Name]; found {
-			// Update existing status to match preset
-			ex.Color = entry.Color
-			ex.Description = entry.Description
-			ex.ClosesIssue = entry.ClosesIssue
-			ex.SortOrder = i
-			ex.IsActive = true
-			if _, err := db.GetEngine(ctx).ID(ex.ID).AllCols().Update(ex); err != nil {
-				return err
-			}
-		} else {
-			// Create new status
-			def := &IssueStatusDef{
-				OrgID:       orgID,
-				Name:        entry.Name,
-				Color:       entry.Color,
-				Description: entry.Description,
-				ClosesIssue: entry.ClosesIssue,
-				IsRequired:  entry.IsRequired,
-				SortOrder:   i,
-				IsActive:    true,
-			}
-			if _, err := db.GetEngine(ctx).Insert(def); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// CopyStatusesFromOrg copies all active status definitions from srcOrgID to dstOrgID.
-// Existing non-required statuses in dstOrgID are deactivated first.
-func CopyStatusesFromOrg(ctx context.Context, srcOrgID, dstOrgID int64) error {
-	srcDefs, err := GetIssueStatusDefsByOrg(ctx, srcOrgID)
-	if err != nil {
-		return err
-	}
-
-	existing, err := GetAllIssueStatusDefsByOrg(ctx, dstOrgID)
-	if err != nil {
-		return err
-	}
-
-	existingByName := make(map[string]*IssueStatusDef, len(existing))
-	for _, d := range existing {
-		existingByName[d.Name] = d
-	}
-
-	// Deactivate non-required existing statuses
-	for _, d := range existing {
-		if d.IsRequired {
-			continue
-		}
-		if d.IsActive {
-			d.IsActive = false
-			if _, err := db.GetEngine(ctx).ID(d.ID).Cols("is_active").Update(d); err != nil {
-				return err
-			}
-		}
-	}
-
-	// Copy source statuses
-	for _, src := range srcDefs {
-		if ex, found := existingByName[src.Name]; found {
-			ex.Color = src.Color
-			ex.Description = src.Description
-			ex.ClosesIssue = src.ClosesIssue
-			ex.SortOrder = src.SortOrder
-			ex.IsActive = true
-			if _, err := db.GetEngine(ctx).ID(ex.ID).AllCols().Update(ex); err != nil {
-				return err
-			}
-		} else {
-			def := &IssueStatusDef{
-				OrgID:       dstOrgID,
-				Name:        src.Name,
-				Color:       src.Color,
-				Description: src.Description,
-				ClosesIssue: src.ClosesIssue,
-				IsRequired:  src.IsRequired,
-				SortOrder:   src.SortOrder,
-				IsActive:    true,
-			}
-			if _, err := db.GetEngine(ctx).Insert(def); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
 // ──────────────────────────────────────────────────────────────────────
 // Queries
 // ──────────────────────────────────────────────────────────────────────
@@ -262,15 +56,14 @@ func GetIssueStatusDefsByOrg(ctx context.Context, orgID int64) ([]*IssueStatusDe
 }

 // seedDefaultIssueStatuses creates the standard status presets for an org.
-// Open and Closed are required (is_required=true) and cannot be deleted.
 func seedDefaultIssueStatuses(ctx context.Context, orgID int64) error {
 	defaults := []*IssueStatusDef{
-		{OrgID: orgID, Name: "Open", Color: "#2563eb", Description: "New or active issue", ClosesIssue: false, IsRequired: true, SortOrder: 0, IsActive: true},
-		{OrgID: orgID, Name: "In Progress", Color: "#7c3aed", Description: "Work is actively being done", SortOrder: 1, IsActive: true},
-		{OrgID: orgID, Name: "Waiting", Color: "#f59e0b", Description: "Blocked or waiting for input", SortOrder: 2, IsActive: true},
-		{OrgID: orgID, Name: "In Review", Color: "#0891b2", Description: "PR submitted, awaiting review", SortOrder: 3, IsActive: true},
-		{OrgID: orgID, Name: "Closed", Color: "#16a34a", Description: "Completed or resolved", ClosesIssue: true, IsRequired: true, SortOrder: 4, IsActive: true},
+		{OrgID: orgID, Name: "In Progress", Color: "#2563eb", Description: "Work is actively being done", SortOrder: 1, IsActive: true},
+		{OrgID: orgID, Name: "Needs Info", Color: "#f59e0b", Description: "Waiting for more information", SortOrder: 2, IsActive: true},
+		{OrgID: orgID, Name: "Blocked", Color: "#dc2626", Description: "Cannot proceed due to dependency", SortOrder: 3, IsActive: true},
+		{OrgID: orgID, Name: "Resolved", Color: "#16a34a", Description: "Fix implemented and verified", ClosesIssue: true, SortOrder: 4, IsActive: true},
 		{OrgID: orgID, Name: "Won't Fix", Color: "#6b7280", Description: "Decided not to address", ClosesIssue: true, SortOrder: 5, IsActive: true},
+		{OrgID: orgID, Name: "Duplicate", Color: "#8b5cf6", Description: "Already tracked elsewhere", ClosesIssue: true, SortOrder: 6, IsActive: true},
 	}
 	for _, d := range defaults {
 		if _, err := db.GetEngine(ctx).Insert(d); err != nil {
@@ -318,37 +111,13 @@ func UpdateIssueStatusDef(ctx context.Context, def *IssueStatusDef) error {
 	return err
 }

-// ErrStatusRequired is returned when trying to delete a required status.
-type ErrStatusRequired struct {
-	ID   int64
-	Name string
-}
-
-func (e ErrStatusRequired) Error() string {
-	return "status is required and cannot be deleted"
-}
-
-// IsErrStatusRequired checks if an error is ErrStatusRequired.
-func IsErrStatusRequired(err error) bool {
-	_, ok := err.(ErrStatusRequired)
-	return ok
-}
-
 // DeleteIssueStatusDef deletes a status definition and clears references on issues.
-// Returns ErrStatusRequired if the status is marked as required.
 func DeleteIssueStatusDef(ctx context.Context, id int64) error {
-	def, err := GetIssueStatusDefByID(ctx, id)
-	if err != nil {
-		return err
-	}
-	if def.IsRequired {
-		return ErrStatusRequired{ID: def.ID, Name: def.Name}
-	}
 	// Clear status_id on all issues that reference this definition
 	if _, err := db.GetEngine(ctx).Exec("UPDATE issue SET status_id = 0 WHERE status_id = ?", id); err != nil {
 		return err
 	}
-	_, err = db.GetEngine(ctx).ID(id).Delete(new(IssueStatusDef))
+	_, err := db.GetEngine(ctx).ID(id).Delete(new(IssueStatusDef))
 	return err
 }

@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"io"
 	"strings"
-	"time"

 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
@@ -861,11 +860,6 @@ func GetCodeOwnersFromContent(ctx context.Context, data string) ([]*CodeOwnerRul
 	return rules, warnings
 }

-// codeOwnerMatchTimeout bounds a single pattern match so a crafted pattern
-// cannot stall via catastrophic backtracking. See also the aggregate budget
-// enforced by the caller across the whole rules×files match loop.
-const codeOwnerMatchTimeout = 150 * time.Millisecond
-
 type CodeOwnerRule struct {
 	Rule     *regexp2.Regexp // it supports negative lookahead, does better for end users
 	Negative bool
@@ -894,8 +888,6 @@ func ParseCodeOwnersLine(ctx context.Context, tokens []string) (*CodeOwnerRule,
 		warnings = append(warnings, fmt.Sprintf("incorrect codeowner regexp: %s", err))
 		return nil, warnings
 	}
-	// Bound matching time so user-supplied patterns cannot stall PR creation via catastrophic backtracking.
-	rule.Rule.MatchTimeout = codeOwnerMatchTimeout

 	for _, user := range tokens[1:] {
 		user = strings.TrimPrefix(user, "@")
@@ -4,9 +4,7 @@
 package issues_test

 import (
-	"strings"
 	"testing"
-	"time"

 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
@@ -41,7 +39,6 @@ func TestPullRequest(t *testing.T) {
 	t.Run("DeleteOrphanedObjects", testDeleteOrphanedObjects)
 	t.Run("ParseCodeOwnersLine", testParseCodeOwnersLine)
 	t.Run("CodeOwnerAbsolutePathPatterns", testCodeOwnerAbsolutePathPatterns)
-	t.Run("CodeOwnerPatternMatchTimeout", testCodeOwnerPatternMatchTimeout)
 	t.Run("GetApprovers", testGetApprovers)
 	t.Run("GetPullRequestByMergedCommit", testGetPullRequestByMergedCommit)
 	t.Run("Migrate_InsertPullRequests", testMigrateInsertPullRequests)
@@ -373,22 +370,6 @@ func testCodeOwnerAbsolutePathPatterns(t *testing.T) {
 	}
 }

-// testCodeOwnerPatternMatchTimeout ensures user-supplied CODEOWNERS patterns
-// cannot stall pull request processing through catastrophic regex backtracking:
-// each compiled rule must enforce a bounded match time.
-func testCodeOwnerPatternMatchTimeout(t *testing.T) {
-	rules, _ := issues_model.GetCodeOwnersFromContent(t.Context(), "(a+)+ @user5\n")
-	require.Len(t, rules, 1)
-
-	maliciousInput := strings.Repeat("a", 30) + "X"
-	start := time.Now()
-	_, err := rules[0].Rule.MatchString(maliciousInput)
-	elapsed := time.Since(start)
-
-	require.Error(t, err, "expected MatchTimeout error on pathological input")
-	assert.Less(t, elapsed, time.Second, "match timeout did not bound regex evaluation; took %s", elapsed)
-}
-
 func testGetApprovers(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 5})
 	// Official reviews are already deduplicated. Allow unofficial reviews
@@ -436,9 +436,6 @@ func prepareMigrationTasks() []*migration {
 		newMigration(356, "Rename package_type to extension_type in repo manifest", v1_27.RenamePackageTypeToExtensionType),
 		newMigration(357, "Drop display_name from repo manifest and update stream config", v1_27.DropDisplayNameColumns),
 		newMigration(358, "Add licensing tables (license, entitlement, activation, product_tier)", v1_27.AddLicensingTables),
-		newMigration(359, "Add deploy fields to repo manifest", v1_27.AddDeployFieldsToRepoManifest),
-		newMigration(360, "Add delete allowlist to protected branch", v1_27.AddDeleteAllowlistToProtectedBranch),
-		newMigration(361, "Add cascade merge rule table", v1_27.AddCascadeMergeRuleTable),
 	}
 	return preparedMigrations
 }
@@ -1,23 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package v1_27
-
-import (
-	"xorm.io/xorm"
-)
-
-// AddDeployFieldsToRepoManifest adds deploy configuration columns to repo_manifest.
-func AddDeployFieldsToRepoManifest(x *xorm.Engine) error {
-	type RepoManifest struct {
-		DeployHost      string `xorm:"VARCHAR(255) 'deploy_host'"`
-		DeployPort      string `xorm:"VARCHAR(10) 'deploy_port'"`
-		DeployUser      string `xorm:"VARCHAR(100) 'deploy_user'"`
-		DeployPath      string `xorm:"TEXT 'deploy_path'"`
-		DockerImage     string `xorm:"VARCHAR(255) 'docker_image'"`
-		DockerRegistry  string `xorm:"VARCHAR(255) 'docker_registry'"`
-		ContainerName   string `xorm:"VARCHAR(100) 'container_name'"`
-		HealthURL       string `xorm:"TEXT 'health_url'"`
-	}
-	return x.Sync(new(RepoManifest))
-}
@@ -1,20 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package v1_27
-
-import (
-	"xorm.io/xorm"
-)
-
-func AddDeleteAllowlistToProtectedBranch(x *xorm.Engine) error {
-	type ProtectedBranch struct {
-		CanDelete                  bool    `xorm:"NOT NULL DEFAULT false"`
-		EnableDeleteAllowlist      bool    `xorm:"NOT NULL DEFAULT false"`
-		DeleteAllowlistUserIDs     []int64 `xorm:"JSON TEXT"`
-		DeleteAllowlistTeamIDs     []int64 `xorm:"JSON TEXT"`
-		DeleteAllowlistDeployKeys  bool    `xorm:"NOT NULL DEFAULT false"`
-		DeleteAllowlistActionsUser bool    `xorm:"NOT NULL DEFAULT false"`
-	}
-	return x.Sync(new(ProtectedBranch))
-}
@@ -1,24 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package v1_27
-
-import (
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
-
-	"xorm.io/xorm"
-)
-
-func AddCascadeMergeRuleTable(x *xorm.Engine) error {
-	type CascadeMergeRule struct {
-		ID           int64              `xorm:"pk autoincr"`
-		RepoID       int64              `xorm:"UNIQUE(s) INDEX NOT NULL"`
-		SourceBranch string             `xorm:"UNIQUE(s) VARCHAR(255) NOT NULL"`
-		TargetBranch string             `xorm:"UNIQUE(s) VARCHAR(255) NOT NULL"`
-		Enabled      bool               `xorm:"NOT NULL DEFAULT true"`
-		AutoMerge    bool               `xorm:"NOT NULL DEFAULT false"`
-		CreatedUnix  timeutil.TimeStamp `xorm:"created"`
-		UpdatedUnix  timeutil.TimeStamp `xorm:"updated"`
-	}
-	return x.Sync(new(CascadeMergeRule))
-}
@@ -323,60 +323,6 @@ func (org *Organization) UnitPermission(ctx context.Context, doer *user_model.Us
 }

 // CreateOrganization creates record of a new organization.
-// DefaultTeamSpec defines a team to auto-create when a new organization is created.
-type DefaultTeamSpec struct {
-	Name                    string
-	Description             string
-	AccessMode              perm.AccessMode
-	IncludesAllRepositories bool
-	CanCreateOrgRepo        bool
-	Units                   map[unit.Type]perm.AccessMode
-}
-
-// DefaultOrgTeams is the list of teams created for every new organization
-// (in addition to the mandatory Owners team). Override in tests or via init.
-var DefaultOrgTeams = []DefaultTeamSpec{
-	{
-		Name:                    "Developers",
-		Description:             "Members with write access to code, issues, and pull requests",
-		AccessMode:              perm.AccessModeWrite,
-		IncludesAllRepositories: true,
-		Units: map[unit.Type]perm.AccessMode{
-			unit.TypeCode:         perm.AccessModeWrite,
-			unit.TypeIssues:       perm.AccessModeWrite,
-			unit.TypePullRequests: perm.AccessModeWrite,
-			unit.TypeReleases:     perm.AccessModeRead,
-			unit.TypeWiki:         perm.AccessModeWrite,
-			unit.TypeProjects:     perm.AccessModeWrite,
-		},
-	},
-	{
-		Name:                    "Reviewers",
-		Description:             "Members with read access for code review",
-		AccessMode:              perm.AccessModeRead,
-		IncludesAllRepositories: true,
-		Units: map[unit.Type]perm.AccessMode{
-			unit.TypeCode:         perm.AccessModeRead,
-			unit.TypeIssues:       perm.AccessModeRead,
-			unit.TypePullRequests: perm.AccessModeRead,
-			unit.TypeReleases:     perm.AccessModeRead,
-			unit.TypeWiki:         perm.AccessModeRead,
-		},
-	},
-	{
-		Name:                    "CI/CD",
-		Description:             "Members with write access to actions and packages",
-		AccessMode:              perm.AccessModeWrite,
-		IncludesAllRepositories: true,
-		Units: map[unit.Type]perm.AccessMode{
-			unit.TypeCode:     perm.AccessModeRead,
-			unit.TypeActions:  perm.AccessModeWrite,
-			unit.TypePackages: perm.AccessModeWrite,
-			unit.TypeReleases: perm.AccessModeWrite,
-		},
-	},
-}
-
 func CreateOrganization(ctx context.Context, org *Organization, owner *user_model.User) (err error) {
 	if !owner.CanCreateOrganization() {
 		return ErrUserNotAllowedCreateOrg{}
@@ -402,7 +348,7 @@ func CreateOrganization(ctx context.Context, org *Organization, owner *user_mode
 	}
 	org.UseCustomAvatar = true
 	org.MaxRepoCreation = -1
-	org.NumTeams = 1 + len(DefaultOrgTeams)
+	org.NumTeams = 1
 	org.NumMembers = 1
 	org.Type = user_model.UserTypeOrganization

@@ -467,37 +413,6 @@ func CreateOrganization(ctx context.Context, org *Organization, owner *user_mode
 		}); err != nil {
 			return fmt.Errorf("insert team-user relation: %w", err)
 		}
-
-		for _, spec := range DefaultOrgTeams {
-			dt := &Team{
-				OrgID:                   org.ID,
-				LowerName:               strings.ToLower(spec.Name),
-				Name:                    spec.Name,
-				Description:             spec.Description,
-				AccessMode:              spec.AccessMode,
-				IncludesAllRepositories: spec.IncludesAllRepositories,
-				CanCreateOrgRepo:        spec.CanCreateOrgRepo,
-			}
-			if err = db.Insert(ctx, dt); err != nil {
-				return fmt.Errorf("insert default team %q: %w", spec.Name, err)
-			}
-
-			dtUnits := make([]TeamUnit, 0, len(spec.Units))
-			for tp, am := range spec.Units {
-				dtUnits = append(dtUnits, TeamUnit{
-					OrgID:      org.ID,
-					TeamID:     dt.ID,
-					Type:       tp,
-					AccessMode: am,
-				})
-			}
-			if len(dtUnits) > 0 {
-				if err = db.Insert(ctx, &dtUnits); err != nil {
-					return fmt.Errorf("insert default team %q units: %w", spec.Name, err)
-				}
-			}
-		}
-
 		return nil
 	})
 }
@@ -1,63 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package repo
-
-import (
-	"context"
-
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
-)
-
-type CascadeMergeRule struct {
-	ID           int64              `xorm:"pk autoincr"`
-	RepoID       int64              `xorm:"UNIQUE(s) INDEX NOT NULL"`
-	SourceBranch string             `xorm:"UNIQUE(s) VARCHAR(255) NOT NULL"`
-	TargetBranch string             `xorm:"UNIQUE(s) VARCHAR(255) NOT NULL"`
-	Enabled      bool               `xorm:"NOT NULL DEFAULT true"`
-	AutoMerge    bool               `xorm:"NOT NULL DEFAULT false"`
-	CreatedUnix  timeutil.TimeStamp `xorm:"created"`
-	UpdatedUnix  timeutil.TimeStamp `xorm:"updated"`
-}
-
-func init() {
-	db.RegisterModel(new(CascadeMergeRule))
-}
-
-func GetCascadeRulesByRepoID(ctx context.Context, repoID int64) ([]*CascadeMergeRule, error) {
-	rules := make([]*CascadeMergeRule, 0)
-	return rules, db.GetEngine(ctx).Where("repo_id = ?", repoID).Find(&rules)
-}
-
-func GetCascadeRulesForBranch(ctx context.Context, repoID int64, sourceBranch string) ([]*CascadeMergeRule, error) {
-	rules := make([]*CascadeMergeRule, 0)
-	return rules, db.GetEngine(ctx).Where("repo_id = ? AND source_branch = ? AND enabled = ?", repoID, sourceBranch, true).Find(&rules)
-}
-
-func GetCascadeRuleByID(ctx context.Context, id int64) (*CascadeMergeRule, error) {
-	rule := &CascadeMergeRule{ID: id}
-	has, err := db.GetEngine(ctx).Get(rule)
-	if err != nil {
-		return nil, err
-	}
-	if !has {
-		return nil, nil
-	}
-	return rule, nil
-}
-
-func CreateCascadeRule(ctx context.Context, rule *CascadeMergeRule) error {
-	_, err := db.GetEngine(ctx).Insert(rule)
-	return err
-}
-
-func UpdateCascadeRule(ctx context.Context, rule *CascadeMergeRule) error {
-	_, err := db.GetEngine(ctx).ID(rule.ID).Cols("source_branch", "target_branch", "enabled", "auto_merge").Update(rule)
-	return err
-}
-
-func DeleteCascadeRule(ctx context.Context, repoID, id int64) error {
-	_, err := db.GetEngine(ctx).Where("id = ? AND repo_id = ?", id, repoID).Delete(&CascadeMergeRule{})
-	return err
-}
@@ -50,16 +50,6 @@ type RepoMetadata struct {
 	ExtensionType string `xorm:"VARCHAR(50) 'extension_type'"` // component, module, plugin, package, template, library, file
 	EntryPoint  string `xorm:"TEXT 'entry_point'"`          // build entry point path

-	// deploy section
-	DeployHost     string `xorm:"VARCHAR(255) 'deploy_host'"`     // SSH host for deploy
-	DeployPort     string `xorm:"VARCHAR(10) 'deploy_port'"`      // SSH port (default 2918)
-	DeployUser     string `xorm:"VARCHAR(100) 'deploy_user'"`     // SSH user
-	DeployPath     string `xorm:"TEXT 'deploy_path'"`              // remote path for source/compose
-	DockerImage    string `xorm:"VARCHAR(255) 'docker_image'"`    // e.g. mokoconsulting/mokogitea
-	DockerRegistry string `xorm:"VARCHAR(255) 'docker_registry'"` // e.g. git.mokoconsulting.tech
-	ContainerName  string `xorm:"VARCHAR(100) 'container_name'"`  // Docker container name
-	HealthURL      string `xorm:"TEXT 'health_url'"`               // health check URL after deploy
-
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"UPDATED 'updated_unix'"`
 }
@@ -47,7 +47,7 @@ func OrderBy(orderBy string) any {
 }

 func whereOrderConditions(e db.Engine, conditions []any) db.Engine {
-	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic. FIXME: some tables do not have "id" column
+	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic
 	for _, condition := range conditions {
 		switch cond := condition.(type) {
 		case *testCond:
@@ -80,11 +80,8 @@ func init() {
 }

 // GetExternalLogin checks if a externalID in loginSourceID scope already exists
-func GetExternalLogin(ctx context.Context, loginSourceID int64, externalID string) (*ExternalLoginUser, bool, error) {
-	return db.Get[ExternalLoginUser](ctx, builder.Eq{
-		"external_id":     externalID,
-		"login_source_id": loginSourceID,
-	})
+func GetExternalLogin(ctx context.Context, externalLoginUser *ExternalLoginUser) (bool, error) {
+	return db.GetEngine(ctx).Get(externalLoginUser)
 }

 // LinkExternalToUser link the external user to the user
@@ -121,12 +118,6 @@ func RemoveAllAccountLinks(ctx context.Context, user *User) error {
 	return err
 }

-// RemoveExternalLoginByExternalID removes a specific external login link by its provider-side identifier.
-func RemoveExternalLoginByExternalID(ctx context.Context, loginSourceID int64, externalID string) error {
-	_, err := db.GetEngine(ctx).Where("external_id=? AND login_source_id=?", externalID, loginSourceID).Delete(new(ExternalLoginUser))
-	return err
-}
-
 // GetUserIDByExternalUserID get user id according to provider and userID
 func GetUserIDByExternalUserID(ctx context.Context, provider, userID string) (int64, error) {
 	var id int64
@@ -298,9 +298,6 @@ func toGitContext(input map[string]any) *model.GithubContext {
 	return gitContext
 }

-// workflowCallEvent is only fired by another workflow's `uses:`, so it is excluded from trigger detection.
-const workflowCallEvent = "workflow_call"
-
 func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 	switch rawOn.Kind {
 	case yaml.ScalarNode:
@@ -309,9 +306,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		if err != nil {
 			return nil, err
 		}
-		if val == workflowCallEvent {
-			return []*Event{}, nil
-		}
 		return []*Event{
 			{Name: val},
 		}, nil
@@ -325,9 +319,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		for _, v := range val {
 			switch t := v.(type) {
 			case string:
-				if t == workflowCallEvent {
-					continue
-				}
 				res = append(res, &Event{Name: t})
 			default:
 				return nil, fmt.Errorf("invalid type %T", t)
@@ -341,9 +332,6 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		}
 		res := make([]*Event, 0, len(events))
 		for i, k := range events {
-			if k == workflowCallEvent {
-				continue
-			}
 			v := triggers[i]
 			switch v.Kind {
 			case yaml.ScalarNode:
@@ -254,53 +254,6 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
-		{
-			// `workflow_call` is only fired by another workflow's `uses:`, so ParseRawOn intentionally excludes it from trigger detection.
-			input: `on:
-  workflow_call:
-    inputs:
-      env:
-        type: string
-        required: true
-    outputs:
-      sha:
-        value: ${{ jobs.build.outputs.commit }}
-    secrets:
-      DEPLOY_KEY:
-        required: true
-`,
-			result: []*Event{},
-		},
-		{
-			// Mixed: a workflow that is both callable AND triggered by push. Only the "push" event surfaces.
-			input: `on:
-  workflow_call:
-    inputs:
-      env:
-        type: string
-  push:
-    branches: [main]
-`,
-			result: []*Event{
-				{
-					Name: "push",
-					acts: map[string][]string{"branches": {"main"}},
-				},
-			},
-		},
-		{
-			// Scalar form: a purely reusable workflow has no event triggers.
-			input:  "on: workflow_call",
-			result: []*Event{},
-		},
-		{
-			// Sequence form: `workflow_call` is excluded while sibling events are kept.
-			input: "on:\n  - push\n  - workflow_call\n  - pull_request",
-			result: []*Event{
-				{Name: "push"},
-				{Name: "pull_request"},
-			},
-		},
 	}
 	for _, kase := range kases {
 		t.Run(kase.input, func(t *testing.T) {
@@ -78,18 +78,6 @@ func TestIsWorkflow(t *testing.T) {
 			path:     ".gitea/workflows2/test.yml",
 			expected: false,
 		},
-		{
-			name:     "subdirectory workflow",
-			dirs:     []string{".gitea/workflows"},
-			path:     ".gitea/workflows/custom/deploy.yml",
-			expected: true,
-		},
-		{
-			name:     "deeply nested subdirectory workflow",
-			dirs:     []string{".mokogitea/workflows"},
-			path:     ".mokogitea/workflows/custom/deploy/staging.yaml",
-			expected: true,
-		},
 		{
 			name:     "unrelated path",
 			dirs:     []string{".gitea/workflows", ".github/workflows"},
@@ -106,7 +106,7 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 // GetLastCommitForPaths returns last commit information
 func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
 	// We read backwards from the commit to obtain all of the commits
-	revs, err := walkGitLog(ctx, commit.repo, commit, treePath, paths...)
+	revs, err := WalkGitLog(ctx, commit.repo, commit, treePath, paths...)
 	if err != nil {
 		return nil, err
 	}
@@ -1,54 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !gogit
-
-package git
-
-import (
-	"context"
-	"path/filepath"
-	"testing"
-
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/test"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/util"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestEntries_GetCommitsInfo_ContextErr(t *testing.T) {
-	repo, err := OpenRepository(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
-	require.NoError(t, err)
-	defer repo.Close()
-
-	commit, err := repo.GetCommit("feaf4ba6bc635fec442f46ddd4512416ec43c2c2")
-	require.NoError(t, err)
-	entries, err := commit.Tree.ListEntries()
-	require.NoError(t, err)
-
-	countCommitInfosCommit := func(infos []CommitInfo) (nilCommits, nonNilCommits int) {
-		for _, info := range infos {
-			nilCommits += util.Iif(info.Commit == nil, 1, 0)
-			nonNilCommits += util.Iif(info.Commit != nil, 1, 0)
-		}
-		return nilCommits, nonNilCommits
-	}
-
-	ctx, cancel := context.WithCancel(t.Context())
-	defer test.MockVariableValue(&walkGitLogDebugBeforeNext)()
-
-	walkGitLogDebugBeforeNext = cancel
-	commitInfos, _, err := entries.GetCommitsInfo(ctx, "/any/repo-link", commit, "")
-	assert.NoError(t, err)
-	nilCommits, nonNilCommits := countCommitInfosCommit(commitInfos)
-	assert.Equal(t, 0, nonNilCommits) // no commit info due to canceled (or deadline-exceeded) context
-	assert.Equal(t, 3, nilCommits)
-
-	walkGitLogDebugBeforeNext = nil
-	commitInfos, _, err = entries.GetCommitsInfo(t.Context(), "/any/repo-link", commit, "")
-	assert.NoError(t, err)
-	nilCommits, nonNilCommits = countCommitInfosCommit(commitInfos)
-	assert.Equal(t, 3, nonNilCommits)
-	assert.Equal(t, 0, nilCommits)
-}
@@ -32,7 +32,7 @@ func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string
 		entryPaths[i] = entry.Name()
 	}

-	_, err = walkGitLog(ctx, c.repo, c, treePath, entryPaths...)
+	_, err = WalkGitLog(ctx, c.repo, c, treePath, entryPaths...)
 	if err != nil {
 		return err
 	}
@@ -1,8 +1,6 @@
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT

-//go:build !gogit
-
 package git

 import (
@@ -20,8 +18,10 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
 )

-// logNameStatusRepo opens git log --raw in the provided repo and returns a parser
-func logNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) *logNameStatusRepoParser {
+// LogNameStatusRepo opens git log --raw in the provided repo and returns a stdin pipe, a stdout reader and cancel function
+func LogNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) (*bufio.Reader, func()) {
+	// Lets also create a context so that we can absolutely ensure that the command should die when we're done
+
 	cmd := gitcmd.NewCommand()
 	cmd.AddArguments("log", "--name-status", "-c", "--format=commit%x00%H %P%x00", "--parents", "--no-renames", "-t", "-z").AddDynamicArguments(head)

@@ -54,62 +54,77 @@ func logNameStatusRepo(ctx context.Context, repository, head, treepath string, p
 	ctx, ctxCancel := context.WithCancel(ctx)
 	go func() {
 		err := cmd.WithDir(repository).RunWithStderr(ctx)
-		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, context.DeadlineExceeded) {
+		if err != nil && !errors.Is(err, context.Canceled) {
 			log.Error("Unable to run git command %v: %v", cmd.LogString(), err)
 		}
 	}()

 	bufReader := bufio.NewReaderSize(stdoutReader, 32*1024)
-	return &logNameStatusRepoParser{
-		treepath: treepath,
-		paths:    paths,
-		rd:       bufReader,
-		close: func() {
-			ctxCancel()
-			stdoutReaderClose()
-		},
+
+	return bufReader, func() {
+		ctxCancel()
+		stdoutReaderClose()
 	}
 }

-// logNameStatusRepoParser parses a git log raw output from LogRawRepo
-type logNameStatusRepoParser struct {
+// LogNameStatusRepoParser parses a git log raw output from LogRawRepo
+type LogNameStatusRepoParser struct {
 	treepath string
 	paths    []string
 	next     []byte
 	buffull  bool
 	rd       *bufio.Reader
-	close    func()
+	cancel   func()
 }

-// logNameStatusCommitData represents a commit artifact from git log raw
-type logNameStatusCommitData struct {
+// NewLogNameStatusRepoParser returns a new parser for a git log raw output
+func NewLogNameStatusRepoParser(ctx context.Context, repository, head, treepath string, paths ...string) *LogNameStatusRepoParser {
+	rd, cancel := LogNameStatusRepo(ctx, repository, head, treepath, paths...)
+	return &LogNameStatusRepoParser{
+		treepath: treepath,
+		paths:    paths,
+		rd:       rd,
+		cancel:   cancel,
+	}
+}
+
+// LogNameStatusCommitData represents a commit artefact from git log raw
+type LogNameStatusCommitData struct {
 	CommitID  string
 	ParentIDs []string
 	Paths     []bool
 }

-// walkNext returns the next LogStatusCommitData
-func (g *logNameStatusRepoParser) walkNext(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*logNameStatusCommitData, error) {
+// Next returns the next LogStatusCommitData
+func (g *LogNameStatusRepoParser) Next(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*LogNameStatusCommitData, error) {
 	var err error
 	if len(g.next) == 0 {
 		g.buffull = false
 		g.next, err = g.rd.ReadSlice('\x00')
-		switch {
-		case errors.Is(err, bufio.ErrBufferFull):
-			g.buffull = true
-		case err != nil:
-			return nil, err
+		if err != nil {
+			switch err {
+			case bufio.ErrBufferFull:
+				g.buffull = true
+			case io.EOF:
+				return nil, nil //nolint:nilnil // return nil to signal EOF
+			default:
+				return nil, err
+			}
 		}
 	}

-	ret := logNameStatusCommitData{}
+	ret := LogNameStatusCommitData{}
 	if bytes.Equal(g.next, []byte("commit\000")) {
 		g.next, err = g.rd.ReadSlice('\x00')
-		switch {
-		case errors.Is(err, bufio.ErrBufferFull):
-			g.buffull = true
-		case err != nil:
-			return nil, err
+		if err != nil {
+			switch err {
+			case bufio.ErrBufferFull:
+				g.buffull = true
+			case io.EOF:
+				return nil, nil //nolint:nilnil // return nil to signal EOF
+			default:
+				return nil, err
+			}
 		}
 	}

@@ -258,10 +273,13 @@ diffloop:
 	}
 }

-var walkGitLogDebugBeforeNext func() // is used to simulate various edge git process cases
+// Close closes the parser
+func (g *LogNameStatusRepoParser) Close() {
+	g.cancel()
+}

-// walkGitLog walks the git log --name-status for the head commit in the provided treepath and files
-func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
+// WalkGitLog walks the git log --name-status for the head commit in the provided treepath and files
+func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
 	headRef := head.ID.String()

 	tree, err := head.SubTree(treepath)
@@ -304,9 +322,11 @@ func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st
 		}
 	}

-	g := logNameStatusRepo(ctx, repo.Path, head.ID.String(), treepath, paths...)
-	// don't use defer g.cancel() here as g may change its value - instead wrap in a func
-	defer func() { g.close() }()
+	g := NewLogNameStatusRepoParser(ctx, repo.Path, head.ID.String(), treepath, paths...)
+	// don't use defer g.Close() here as g may change its value - instead wrap in a func
+	defer func() {
+		g.Close()
+	}()

 	results := make([]string, len(paths))
 	remaining := len(paths)
@@ -320,16 +340,25 @@ func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st

 heaploop:
 	for {
-		if walkGitLogDebugBeforeNext != nil {
-			walkGitLogDebugBeforeNext()
+		select {
+		case <-ctx.Done():
+			if ctx.Err() == context.DeadlineExceeded {
+				break heaploop
+			}
+			g.Close()
+			return nil, ctx.Err()
+		default:
 		}
-		current, err := g.walkNext(treepath, path2idx, changed, maxpathlen)
-		if ctx.Err() != nil {
-			break heaploop // context is either canceled or deadline exceeded - break the loop and return what we have so far
-		} else if errors.Is(err, io.EOF) {
-			break heaploop // reached to the end of log output
-		} else if err != nil {
-			return nil, err // other unknown errors
+		current, err := g.Next(treepath, path2idx, changed, maxpathlen)
+		if err != nil {
+			if errors.Is(err, context.DeadlineExceeded) {
+				break heaploop
+			}
+			g.Close()
+			return nil, err
+		}
+		if current == nil {
+			break heaploop
 		}
 		parentRemaining.Remove(current.CommitID)
 		for i, found := range current.Paths {
@@ -366,14 +395,14 @@ heaploop:
 		if remaining <= nextRestart {
 			commitSinceNextRestart++
 			if 4*commitSinceNextRestart > 3*commitSinceLastEmptyParent {
+				g.Close()
 				remainingPaths := make([]string, 0, len(paths))
 				for i, pth := range paths {
 					if results[i] == "" {
 						remainingPaths = append(remainingPaths, pth)
 					}
 				}
-				g.close()
-				g = logNameStatusRepo(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
+				g = NewLogNameStatusRepoParser(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
 				parentRemaining = make(container.Set[string])
 				nextRestart = (remaining * 3) / 4
 				continue heaploop
@@ -381,6 +410,7 @@ heaploop:
 		}
 		parentRemaining.AddMultiple(current.ParentIDs...)
 	}
+	g.Close()

 	resultsMap := map[string]string{}
 	for i, pth := range paths {
@@ -121,9 +121,6 @@ func Clone(ctx context.Context, from, to string, opts CloneRepoOptions) error {
 	}

 	cmd := gitcmd.NewCommand().AddArguments("clone")
-	// Never follow HTTP redirects: no clone caller needs them, and a remote redirecting to an
-	// otherwise-blocked address would be an SSRF vector (e.g. migrating from an attacker URL).
-	cmd.AddArguments("-c", "http.followRedirects=false")
 	if opts.SkipTLSVerify {
 		cmd.AddArguments("-c", "http.sslVerify=false")
 	}
@@ -4,10 +4,7 @@
 package git

 import (
-	"net/http"
-	"net/http/httptest"
 	"path/filepath"
-	"sync/atomic"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -22,23 +19,3 @@ func TestRepoIsEmpty(t *testing.T) {
 	assert.NoError(t, err)
 	assert.True(t, isEmpty)
 }
-
-// TestCloneRefusesRedirects ensures Clone never follows HTTP redirects, so a remote
-// cannot redirect to an otherwise-blocked address (SSRF, e.g. during migration).
-func TestCloneRefusesRedirects(t *testing.T) {
-	var targetHit atomic.Bool
-	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		targetHit.Store(true)
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer target.Close()
-
-	redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, target.URL+r.URL.Path, http.StatusFound)
-	}))
-	defer redirect.Close()
-
-	err := Clone(t.Context(), redirect.URL, filepath.Join(t.TempDir(), "dst"), CloneRepoOptions{})
-	assert.Error(t, err)
-	assert.False(t, targetHit.Load(), "git must not follow the redirect to the target")
-}
@@ -8,7 +8,6 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
-	"sync"
 )

 // HostMatchList is used to check if a host or IP is in a list.
@@ -24,61 +23,10 @@ type HostMatchList struct {
 	ipNets []*net.IPNet
 }

-// MatchBuiltinExternal A valid global-unicast IP that is neither private (see MatchBuiltinPrivate)
-// nor a reserved special-purpose range (see reservedIPNets); i.e. a routable host on the public internet.
+// MatchBuiltinExternal A valid non-private unicast IP, all hosts on public internet are matched
 const MatchBuiltinExternal = "external"

-// reservedIPNets are special-purpose ranges that net.IP.IsPrivate omits but that must not be
-// treated as public/external destinations (CGNAT, cloud metadata, IPv6 transition, etc.). We layer
-// these on top of net.IP.IsPrivate (RFC 1918 / RFC 4193) so future additions to Go's IsPrivate are
-// picked up automatically, while still covering the ranges it leaves out; otherwise the default
-// allow-list would let authenticated users reach cloud metadata, internal, and IPv6 transition
-// endpoints (SSRF), and a "private" block-list would fail to catch them.
-var reservedIPNets = sync.OnceValue(func() []*net.IPNet {
-	var nets []*net.IPNet
-	for _, cidr := range []string{
-		// IPv4
-		"100.64.0.0/10",    // RFC 6598 Carrier-Grade NAT
-		"168.63.129.16/32", // Azure WireServer metadata endpoint
-		"192.0.0.0/24",     // RFC 6890 IETF protocol assignments
-		"192.0.2.0/24",     // RFC 5737 TEST-NET-1
-		"192.88.99.0/24",   // RFC 7526 6to4 relay anycast (deprecated)
-		"198.18.0.0/15",    // RFC 2544 benchmarking
-		"198.51.100.0/24",  // RFC 5737 TEST-NET-2
-		"203.0.113.0/24",   // RFC 5737 TEST-NET-3
-		// IPv6
-		"100::/64",       // RFC 6666 discard-only
-		"64:ff9b::/96",   // RFC 6052 NAT64 (can embed IPv4 such as 169.254.169.254)
-		"64:ff9b:1::/48", // RFC 8215 local-use NAT64
-		"2001::/32",      // RFC 4380 Teredo tunneling (embeds IPv4)
-		"2001:10::/28",   // RFC 4843 ORCHID (deprecated)
-		"2001:20::/28",   // RFC 7343 ORCHIDv2
-		"2001:db8::/32",  // RFC 3849 documentation
-		"2002::/16",      // RFC 3056 6to4 (embeds IPv4)
-	} {
-		_, ipNet, err := net.ParseCIDR(cidr)
-		if err != nil {
-			panic("hostmatcher: invalid reserved CIDR " + cidr + ": " + err.Error())
-		}
-		nets = append(nets, ipNet)
-	}
-	return nets
-})
-
-// isReservedIP reports whether ip falls in reserved special-purpose
-// range (see reservedIPNets) that must not be considered a public/external destination.
-func isReservedIP(ip net.IP) bool {
-	for _, ipNet := range reservedIPNets() {
-		if ipNet.Contains(ip) {
-			return true
-		}
-	}
-	return false
-}
-
-// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7),
-// plus the reserved special-purpose ranges in reservedIPNets (CGNAT, NAT64, cloud metadata, etc.).
-// Also called LAN/Intranet.
+// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
 const MatchBuiltinPrivate = "private"

 // MatchBuiltinLoopback 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
@@ -145,22 +93,18 @@ func (hl *HostMatchList) checkPattern(host string) bool {
 	return false
 }

-// matchesIP determines if the given IP matches any of the configured rules
-func (hl *HostMatchList) matchesIP(ip net.IP) bool {
+func (hl *HostMatchList) checkIP(ip net.IP) bool {
 	if slices.Contains(hl.patterns, "*") {
 		return true
 	}
 	for _, builtin := range hl.builtins {
 		switch builtin {
 		case MatchBuiltinExternal:
-			// External address must be a global unicast, must not be in reserved range and must not be in private range
-			if ip.IsGlobalUnicast() && !isReservedIP(ip) && !ip.IsPrivate() {
+			if ip.IsGlobalUnicast() && !ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinPrivate:
-			// Private address must be global unicast, must not be in range we explicitly exclude for security reasons
-			// and must be in private range
-			if ip.IsGlobalUnicast() && !isReservedIP(ip) && ip.IsPrivate() {
+			if ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinLoopback:
@@ -191,7 +135,7 @@ func (hl *HostMatchList) MatchHostName(host string) bool {
 		return true
 	}
 	if ip := net.ParseIP(hostname); ip != nil {
-		return hl.matchesIP(ip)
+		return hl.checkIP(ip)
 	}
 	return false
 }
@@ -202,7 +146,7 @@ func (hl *HostMatchList) MatchIPAddr(ip net.IP) bool {
 		return false
 	}
 	host := ip.String() // nil-safe, we will get "<nil>" if ip is nil
-	return hl.checkPattern(host) || hl.matchesIP(ip)
+	return hl.checkPattern(host) || hl.checkIP(ip)
 }

 // MatchHostOrIP checks if the host or IP matches an allow/deny(block) list
@@ -159,60 +159,3 @@ func TestHostOrIPMatchesList(t *testing.T) {
 	}
 	test(cases)
 }
-
-// TestReservedRanges ensures special-purpose ranges that net.IP.IsPrivate misses are kept out of the
-// "external" allow-list (the default for webhook delivery and repository migrations) and folded into
-// the "private" block-list, so they cannot be used for SSRF to metadata/internal endpoints.
-func TestReservedRanges(t *testing.T) {
-	external := ParseHostMatchList("", "external")
-	private := ParseHostMatchList("", "private")
-
-	// legitimate public destinations: external, not private
-	for _, ip := range []string{"8.8.8.8", "1.1.1.1", "2001:4860:4860::8888", "1000::1"} {
-		addr := net.ParseIP(ip)
-		assert.Truef(t, external.MatchIPAddr(addr), "public ip %s should be external", ip)
-		assert.Falsef(t, private.MatchIPAddr(addr), "public ip %s should not be private", ip)
-	}
-
-	// RFC 1918 / RFC 4193 private ranges (now folded into privateIPNets instead of net.IP.IsPrivate):
-	// not external, blockable as private. Includes range edges to guard the CIDR boundaries.
-	for _, ip := range []string{
-		"10.0.0.0", "10.255.255.255", // 10.0.0.0/8
-		"172.16.0.0", "172.31.255.255", // 172.16.0.0/12
-		"192.168.0.0", "192.168.255.255", // 192.168.0.0/16
-		"fc00::", "fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", // fc00::/7
-	} {
-		addr := net.ParseIP(ip)
-		assert.Falsef(t, external.MatchIPAddr(addr), "private ip %s must not be external", ip)
-		assert.Truef(t, private.MatchIPAddr(addr), "private ip %s should match private block-list", ip)
-	}
-
-	// 172.32.0.0 is just outside 172.16.0.0/12: a public destination, not private
-	if addr := net.ParseIP("172.32.0.0"); assert.NotNil(t, addr) {
-		assert.True(t, external.MatchIPAddr(addr), "172.32.0.0 should be external")
-		assert.False(t, private.MatchIPAddr(addr), "172.32.0.0 should not be private")
-	}
-
-	// reserved ranges that IsPrivate does not cover: not external, but blockable as private
-	for _, ip := range []string{
-		"100.64.0.1",         // CGNAT
-		"100.127.255.254",    // CGNAT
-		"168.63.129.16",      // Azure WireServer
-		"192.0.2.1",          // TEST-NET-1
-		"198.18.0.1",         // benchmarking
-		"198.51.100.1",       // TEST-NET-2
-		"203.0.113.1",        // TEST-NET-3
-		"169.254.169.254",    // Cloud metadata
-		"192.88.99.1",        // 6to4 relay anycast
-		"64:ff9b::1",         // NAT64
-		"64:ff9b::a9fe:a9fe", // NAT64 embedding 169.254.169.254
-		"2001::1",            // Teredo
-		"2002::1",            // 6to4
-		"2001:db8::1",        // documentation
-		"fe80::1",            // link local address
-	} {
-		addr := net.ParseIP(ip)
-		assert.Falsef(t, external.MatchIPAddr(addr), "reserved ip %s must not be external", ip)
-		assert.Falsef(t, private.MatchIPAddr(addr), "reserved ip %s should match private block-list", ip)
-	}
-}
@@ -175,25 +175,16 @@ var emojiProcessors = []processor{
 	emojiProcessor,
 }

-// isBareURLSubject reports whether the (HTML-escaped) commit subject content
-// is entirely a single URL, ignoring leading/trailing whitespace.
-func isBareURLSubject(content string) bool {
-	s := strings.TrimSpace(html.UnescapeString(content))
-	if s == "" {
-		return false
-	}
-	m := common.GlobalVars().LinkRegex.FindStringIndex(s)
-	return m != nil && m[0] == 0 && m[1] == len(s)
-}
-
 // PostProcessCommitMessageSubject will use the same logic as PostProcess and
 // PostProcessCommitMessage, but will disable the shortLinkProcessor and
-// emailAddressProcessor, and wraps the whole subject in defaultLink.
+// emailAddressProcessor, will add a defaultLinkProcessor if defaultLink is set,
+// which changes every text node into a link to the passed default link.
 func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content string) (string, error) {
 	procs := []processor{
 		fullIssuePatternProcessor,
 		comparePatternProcessor,
 		fullHashPatternProcessor,
+		linkProcessor,
 		mentionProcessor,
 		issueIndexPatternProcessor,
 		commitCrossReferencePatternProcessor,
@@ -201,15 +192,6 @@ func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content st
 		emojiShortCodeProcessor,
 		emojiProcessor,
 	}
-	// When the whole subject is a bare URL, linkProcessor would turn it into
-	// a competing anchor and hijack the surrounding defaultLink wrapper, leaving
-	// the subject visually unclickable. Match GitHub: render such subjects as
-	// plain text inside defaultLink. Partial URLs inside larger text still become
-	// their own links (nested anchors aren't legal HTML, so the outer defaultLink
-	// naturally breaks on that span, same as on GitHub).
-	if !isBareURLSubject(content) {
-		procs = append(procs, linkProcessor)
-	}
 	procs = append(procs, func(ctx *RenderContext, node *html.Node) {
 		ch := &html.Node{Parent: node, Type: html.TextNode, Data: node.Data}
 		node.Type = html.ElementNode
@@ -146,26 +146,15 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 	var depends strings.Builder
 	var control strings.Builder

-	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files
-	s := bufio.NewScanner(r)
+	s := bufio.NewScanner(io.TeeReader(r, &control))
 	for s.Scan() {
 		line := s.Text()

 		trimmed := strings.TrimSpace(line)
 		if trimmed == "" {
-			// A binary package control file holds exactly one stanza. Stop at the
-			// blank line that terminates it, otherwise a crafted control file could
-			// smuggle additional stanzas (with attacker-chosen Filename/Package
-			// fields) into the generated repository "Packages" index.
-			if control.Len() == 0 {
-				continue
-			}
-			break
+			continue
 		}

-		control.WriteString(line)
-		control.WriteByte('\n')
-
 		if line[0] == ' ' || line[0] == '\t' {
 			switch key {
 			case "Description":
@@ -184,19 +184,4 @@ func TestParseControlFile(t *testing.T) {
 			assert.NotNil(t, p)
 		}
 	})
-
-	t.Run("SingleStanzaOnly", func(t *testing.T) {
-		// A control file with a trailing stanza must not leak the extra fields into
-		// p.Control, otherwise buildPackagesIndices would emit a second package entry
-		// with an attacker-chosen Filename into the repository "Packages" index.
-		content := bytes.NewBufferString("Package: realpkg\nVersion: 1.0.0\nArchitecture: amd64\nMaintainer: a <a@b.c>\nDescription: real\n\nPackage: openssl\nVersion: 99.0\nArchitecture: amd64\nFilename: pool/main/o/openssl/evil.deb\nDescription: spoofed\n")
-
-		p, err := ParseControlFile(content)
-		assert.NoError(t, err)
-		assert.NotNil(t, p)
-		assert.Equal(t, "realpkg", p.Name)
-		assert.Equal(t, "1.0.0", p.Version)
-		assert.NotContains(t, p.Control, "openssl")
-		assert.NotContains(t, p.Control, "evil.deb")
-	})
 }
@@ -14,7 +14,6 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/optional"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/user"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/util"
 )

 // settings
@@ -198,38 +197,32 @@ func loadLoginNotificationFrom(cfg ConfigProvider) {

 func loadRunModeFrom(rootCfg ConfigProvider) {
 	rootSec := rootCfg.Section("")
-	mustNotRunAsRoot(rootSec)
-
-	runModeValue := os.Getenv("GITEA_RUN_MODE")
-	runModeValue = util.IfZero(runModeValue, rootSec.Key("RUN_MODE").String())
-	// non-dev mode is treated as prod mode, to protect users from accidentally running in dev mode if there is a typo in this value.
-	IsProd = !strings.EqualFold(runModeValue, "dev") // TODO: can use case-sensitive comparing in the future
-	RunMode = util.Iif(IsProd, "prod", "dev")
-
-	// there is a separate check: mustCurrentRunUserMatch (IsRunUserMatchCurrentUser)
 	RunUser = rootSec.Key("RUN_USER").MustString(user.CurrentUsername())
-}
-
-func mustNotRunAsRoot(rootSec ConfigSection) {
-	if os.Getuid() != 0 {
-		return
-	}
-
-	mustRunAsRoot := os.Getenv("SNAP") != "" && os.Getenv("SNAP_NAME") != "" // snap container runs the app as uid=0
-	if mustRunAsRoot {
-		return
-	}

 	// The following is a purposefully undocumented option. Please do not run Gitea as root. It will only cause future headaches.
 	// Please don't use root as a bandaid to "fix" something that is broken, instead the broken thing should instead be fixed properly.
-	allowRunAsRoot := ConfigSectionKeyBool(rootSec, "I_AM_BEING_UNSAFE_RUNNING_AS_ROOT") || // check gitea config
-		optional.ParseBool(os.Getenv("GITEA_I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")).Value() // check gitea env var
-
-	if !allowRunAsRoot {
-		// Special thanks to VLC which inspired the wording of this messaging.
-		log.Fatal("Gitea is not supposed to be run as root. If you need to use privileged TCP ports please instead use `setcap` and the `cap_net_bind_service` permission.")
+	unsafeAllowRunAsRoot := ConfigSectionKeyBool(rootSec, "I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")
+	unsafeAllowRunAsRoot = unsafeAllowRunAsRoot || optional.ParseBool(os.Getenv("GITEA_I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")).Value()
+	RunMode = os.Getenv("GITEA_RUN_MODE")
+	if RunMode == "" {
+		RunMode = rootSec.Key("RUN_MODE").MustString("prod")
+	}
+
+	// non-dev mode is treated as prod mode, to protect users from accidentally running in dev mode if there is a typo in this value.
+	RunMode = strings.ToLower(RunMode)
+	if RunMode != "dev" {
+		RunMode = "prod"
+	}
+	IsProd = RunMode != "dev"
+
+	// check if we run as root
+	if os.Getuid() == 0 {
+		if !unsafeAllowRunAsRoot {
+			// Special thanks to VLC which inspired the wording of this messaging.
+			log.Fatal("Gitea is not supposed to be run as root. Sorry. If you need to use privileged TCP ports please instead use setcap and the `cap_net_bind_service` permission")
+		}
+		log.Critical("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
 	}
-	log.Warn("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
 }

 // HasInstallLock checks the install-lock in ConfigProvider directly, because sometimes the config file is not loaded into setting variables yet.
@@ -165,28 +165,9 @@ type IssueStatusDef struct {
 	Color       string `json:"color"`
 	Description string `json:"description"`
 	ClosesIssue bool   `json:"closes_issue"`
-	IsRequired  bool   `json:"is_required"`
 	SortOrder   int    `json:"sort_order"`
 }

-// StatusPresetEntry represents a single status in a preset template.
-// swagger:model
-type StatusPresetEntry struct {
-	Name        string `json:"name"`
-	Color       string `json:"color"`
-	Description string `json:"description"`
-	ClosesIssue bool   `json:"closes_issue"`
-	IsRequired  bool   `json:"is_required"`
-}
-
-// StatusPreset represents a named status preset template.
-// swagger:model
-type StatusPreset struct {
-	Name        string               `json:"name"`
-	Description string               `json:"description"`
-	Statuses    []*StatusPresetEntry  `json:"statuses"`
-}
-
 // IssuePriorityDef represents an org-level issue priority definition
 // swagger:model
 type IssuePriorityDef struct {
@@ -48,13 +48,7 @@ type BranchProtection struct {
 	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
 	ForcePushAllowlistDeployKeys  bool     `json:"force_push_allowlist_deploy_keys"`
-	ForcePushAllowlistActionsUser  bool     `json:"force_push_allowlist_actions_user"`
-	EnableDelete                  bool     `json:"enable_delete"`
-	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
-	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
-	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
-	DeleteAllowlistDeployKeys     bool     `json:"delete_allowlist_deploy_keys"`
-	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
@@ -99,13 +93,7 @@ type CreateBranchProtectionOption struct {
 	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
 	ForcePushAllowlistDeployKeys  bool     `json:"force_push_allowlist_deploy_keys"`
-	ForcePushAllowlistActionsUser  bool     `json:"force_push_allowlist_actions_user"`
-	EnableDelete                  bool     `json:"enable_delete"`
-	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
-	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
-	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
-	DeleteAllowlistDeployKeys     bool     `json:"delete_allowlist_deploy_keys"`
-	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
@@ -141,13 +129,7 @@ type EditBranchProtectionOption struct {
 	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
 	ForcePushAllowlistDeployKeys  *bool    `json:"force_push_allowlist_deploy_keys"`
-	ForcePushAllowlistActionsUser  *bool    `json:"force_push_allowlist_actions_user"`
-	EnableDelete                  *bool    `json:"enable_delete"`
-	EnableDeleteAllowlist         *bool    `json:"enable_delete_allowlist"`
-	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
-	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
-	DeleteAllowlistDeployKeys     *bool    `json:"delete_allowlist_deploy_keys"`
-	DeleteAllowlistActionsUser    *bool    `json:"delete_allowlist_actions_user"`
+	ForcePushAllowlistActionsUser *bool    `json:"force_push_allowlist_actions_user"`
 	EnableMergeWhitelist          *bool    `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
@@ -1,33 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package structs
-
-import "time"
-
-// CascadeMergeRule represents a cascade merge rule
-type CascadeMergeRule struct {
-	ID           int64     `json:"id"`
-	SourceBranch string    `json:"source_branch"`
-	TargetBranch string    `json:"target_branch"`
-	Enabled      bool      `json:"enabled"`
-	AutoMerge    bool      `json:"auto_merge"`
-	CreatedAt    time.Time `json:"created_at"`
-	UpdatedAt    time.Time `json:"updated_at"`
-}
-
-// CreateCascadeMergeRuleOption options for creating a cascade merge rule
-type CreateCascadeMergeRuleOption struct {
-	SourceBranch string `json:"source_branch" binding:"Required"`
-	TargetBranch string `json:"target_branch" binding:"Required"`
-	Enabled      *bool  `json:"enabled"`
-	AutoMerge    *bool  `json:"auto_merge"`
-}
-
-// EditCascadeMergeRuleOption options for editing a cascade merge rule
-type EditCascadeMergeRuleOption struct {
-	SourceBranch *string `json:"source_branch"`
-	TargetBranch *string `json:"target_branch"`
-	Enabled      *bool   `json:"enabled"`
-	AutoMerge    *bool   `json:"auto_merge"`
-}
@@ -40,16 +40,6 @@ type CreateAccessTokenOption struct {
 	Scopes []string `json:"scopes"`
 }

-// EditAccessTokenOption options when editing access token scopes
-// swagger:model EditAccessTokenOption
-type EditAccessTokenOption struct {
-	// The new name for the token (optional)
-	Name string `json:"name"`
-	// The new scopes for the token
-	// example: ["read:repository", "write:issue"]
-	Scopes []string `json:"scopes"`
-}
-
 // CreateOAuth2ApplicationOptions holds options to create an oauth2 application
 type CreateOAuth2ApplicationOptions struct {
 	// The name of the OAuth2 application
@@ -140,18 +140,6 @@ com 88fc37a3c0a4dda553bdcfc80c178a58247f42fb mit
 		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject(testInput(), "https://example.com/link", mockRepo))
 	})

-	t.Run("RenderCommitMessageLinkSubjectURLOnly", func(t *testing.T) {
-		// a bare URL in the subject must not hijack the default link
-		expected := `<a href="https://example.com/link" class="muted">https://example.com/file.bin</a>`
-		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject("https://example.com/file.bin", "https://example.com/link", mockRepo))
-	})
-
-	t.Run("RenderCommitMessageLinkSubjectPartialURL", func(t *testing.T) {
-		// a URL embedded in larger subject text still becomes its own link
-		expected := `<a href="https://example.com/link" class="muted">see </a><a href="https://example.com/x" data-markdown-generated-content="">https://example.com/x</a><a href="https://example.com/link" class="muted"> here</a>`
-		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject("see https://example.com/x here", "https://example.com/link", mockRepo))
-	})
-
 	t.Run("RenderIssueTitle", func(t *testing.T) {
 		defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 		expected := `  space @mention-user<SPACE><SPACE>
@@ -855,8 +855,6 @@
  "settings.access_token_deletion_confirm_action": "Delete",
  "settings.access_token_deletion_desc": "Deleting a token will revoke access to your account for applications using it. This cannot be undone. Continue?",
  "settings.delete_token_success": "The token has been deleted. Applications using it no longer have access to your account.",
-  "settings.edit_token_scopes": "Edit Token Scopes",
-  "settings.update_token_success": "Token scopes have been updated successfully.",
  "settings.repo_and_org_access": "Repository and Organization Access",
  "settings.permissions_public_only": "Public only",
  "settings.permissions_access_all": "All (public, private, and limited)",
@@ -2439,17 +2437,6 @@
  "repo.settings.protect_force_push_allowlist_teams": "Allowlisted teams for force pushing:",
  "repo.settings.protect_force_push_allowlist_deploy_keys": "Allowlist deploy keys with push access to force push.",
  "repo.settings.protect_force_push_allowlist_actions_user": "Allowlist actions bot user to force push.",
-  "repo.settings.event_delete": "Branch Deletion",
-  "repo.settings.protect_disable_delete": "Disable Deletion",
-  "repo.settings.protect_disable_delete_desc": "This branch cannot be deleted.",
-  "repo.settings.protect_enable_delete_all": "Enable Deletion",
-  "repo.settings.protect_enable_delete_all_desc": "Anyone with admin access will be allowed to delete this branch.",
-  "repo.settings.protect_enable_delete_allowlist": "Allowlist Restricted Deletion",
-  "repo.settings.protect_enable_delete_allowlist_desc": "Only allowlisted users or teams will be allowed to delete this branch.",
-  "repo.settings.protect_delete_allowlist_users": "Allowlisted users for deletion:",
-  "repo.settings.protect_delete_allowlist_teams": "Allowlisted teams for deletion:",
-  "repo.settings.protect_delete_allowlist_deploy_keys": "Allowlist deploy keys with write access to delete.",
-  "repo.settings.protect_delete_allowlist_actions_user": "Allowlist actions bot user to delete.",
  "repo.settings.protect_merge_whitelist_committers": "Enable Merge Allowlist",
  "repo.settings.protect_merge_whitelist_committers_desc": "Allow only allowlisted users or teams to merge pull requests into this branch.",
  "repo.settings.protect_merge_whitelist_users": "Allowlisted users for merging:",
@@ -3009,11 +2996,6 @@
  "org.settings.issue_status_created": "Issue status created.",
  "org.settings.issue_status_updated": "Issue status updated.",
  "org.settings.issue_status_deleted": "Issue status deleted.",
-  "org.settings.issue_status_presets": "Status Presets",
-  "org.settings.issue_status_presets_desc": "Apply a preset template to replace your current statuses. Required statuses (Open/Closed) are preserved; others are deactivated and replaced.",
-  "org.settings.issue_status_preset_apply": "Apply Preset",
-  "org.settings.issue_status_preset_confirm": "This will deactivate your current custom statuses and replace them with the selected preset. Required statuses are preserved. Continue?",
-  "org.settings.issue_status_preset_applied": "Status preset applied successfully.",
  "org.settings.issue_priorities": "Issue Priorities",
  "org.settings.issue_priorities_desc": "Define priority levels for all repositories in this organization. Priorities appear in the issue sidebar.",
  "org.settings.issue_priorities_empty": "No custom issue priorities defined yet.",
@@ -261,32 +261,16 @@ func (s *Service) UpdateLog(
 	}
 	ack := task.LogLength

-	// Trim rows the runner already had acked.
-	var rows []*runnerv1.LogRow
-	if req.Msg.Index <= ack && int64(len(req.Msg.Rows))+req.Msg.Index > ack {
-		rows = req.Msg.Rows[ack-req.Msg.Index:]
+	if len(req.Msg.Rows) == 0 || req.Msg.Index > ack || int64(len(req.Msg.Rows))+req.Msg.Index <= ack {
+		res.Msg.AckIndex = ack
+		return res, nil
 	}

-	// Ack a re-sent finalize idempotently. Appending new rows past the seal errors.
 	if task.LogInStorage {
-		if len(rows) > 0 {
-			return nil, status.Errorf(codes.AlreadyExists, "log file has been archived")
-		}
-		res.Msg.AckIndex = ack
-		return res, nil
+		return nil, status.Errorf(codes.AlreadyExists, "log file has been archived")
 	}

-	// Bail unless we have new rows or a NoMore to finalize. Even with
-	// NoMore, bail when the runner has outrun the server — archiving a
-	// log with a gap is worse than asking it to retry.
-	if len(rows) == 0 && (!req.Msg.NoMore || req.Msg.Index > ack) {
-		res.Msg.AckIndex = ack
-		return res, nil
-	}
-
-	// WriteLogs is called even with no rows: with offset==0 it bootstraps
-	// an empty DBFS file so TransferLogs below has something to read when
-	// the runner finalizes a task that produced no log output.
+	rows := req.Msg.Rows[ack-req.Msg.Index:]
 	ns, err := actions.WriteLogs(ctx, task.LogFilename, task.LogSize, rows)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "unable to append logs to dbfs file: %v", err)
@@ -294,9 +294,6 @@ func checkTokenPublicOnly() func(ctx *context.APIContext) {
 					ctx.APIError(http.StatusForbidden, "token scope is limited to public packages")
 					return
 				}
-			case auth_model.AccessTokenScopeCategoryLicensing:
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public resources, licensing is not available")
-				return
 			}
 		}
 	}
@@ -508,79 +505,41 @@ func reqOrgOwnership() func(ctx *context.APIContext) {
 	}
 }

-// reqOrgVisible requires the organization to be visible to the doer, or a site admin
-func reqOrgVisible() func(ctx *context.APIContext) {
-	return func(ctx *context.APIContext) {
-		if ctx.Org.Organization == nil {
-			setting.PanicInDevOrTesting("reqOrgVisible: unprepared context")
-			ctx.APIErrorInternal(errors.New("reqOrgVisible: unprepared context"))
-			return
-		}
-		if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
-			ctx.APIErrorNotFound()
-			return
-		}
-	}
-}
-
-func teamAccessPrivileged(ctx *context.APIContext) (orgID int64, privileged, ok bool) {
-	if ctx.IsUserSiteAdmin() {
-		return 0, true, true
-	}
-	if ctx.Org.Team == nil {
-		setting.PanicInDevOrTesting("teamAccess: unprepared context")
-		ctx.APIErrorInternal(errors.New("teamAccess: unprepared context"))
-		return 0, false, false
-	}
-
-	orgID = ctx.Org.Team.OrgID
-	isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return 0, false, false
-	} else if isOwner {
-		return orgID, true, true
-	}
-
-	isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return 0, false, false
-	}
-	return orgID, isTeamMember, true
-}
-
-func denyNonTeamMember(ctx *context.APIContext, orgID int64) {
-	isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-	} else if isOrgMember {
-		ctx.APIError(http.StatusForbidden, "Must be a team member")
-	} else {
-		ctx.APIErrorNotFound()
-	}
-}
-
-// reqTeamReadAccess allows callers who can list the team to read its metadata.
-// Not sufficient for mutations — use reqOrgOwnership() or reqTeamMembership() for those.
-func reqTeamReadAccess() func(ctx *context.APIContext) {
-	return func(ctx *context.APIContext) {
-		orgID, privileged, ok := teamAccessPrivileged(ctx)
-		if !ok || privileged {
-			return
-		}
-		denyNonTeamMember(ctx, orgID)
-	}
-}
-
-// reqTeamMembership user should be a team member, or a site admin
+// reqTeamMembership user should be an team member, or a site admin
 func reqTeamMembership() func(ctx *context.APIContext) {
 	return func(ctx *context.APIContext) {
-		orgID, privileged, ok := teamAccessPrivileged(ctx)
-		if !ok || privileged {
+		if ctx.IsUserSiteAdmin() {
+			return
+		}
+		if ctx.Org.Team == nil {
+			setting.PanicInDevOrTesting("reqTeamMembership: unprepared context")
+			ctx.APIErrorInternal(errors.New("reqTeamMembership: unprepared context"))
+			return
+		}
+
+		orgID := ctx.Org.Team.OrgID
+		isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
+		if err != nil {
+			ctx.APIErrorInternal(err)
+			return
+		} else if isOwner {
+			return
+		}
+
+		if isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID); err != nil {
+			ctx.APIErrorInternal(err)
+			return
+		} else if !isTeamMember {
+			isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
+			if err != nil {
+				ctx.APIErrorInternal(err)
+			} else if isOrgMember {
+				ctx.APIError(http.StatusForbidden, "Must be a team member")
+			} else {
+				ctx.APIErrorNotFound()
+			}
 			return
 		}
-		denyNonTeamMember(ctx, orgID)
 	}
 }

@@ -1045,9 +1004,7 @@ func Routes() *web.Router {
 				m.Group("/tokens", func() {
 					m.Combo("").Get(user.ListAccessTokens).
 						Post(bind(api.CreateAccessTokenOption{}), reqToken(), user.CreateAccessToken)
-					m.Combo("/{id}").
-						Patch(bind(api.EditAccessTokenOption{}), reqToken(), user.UpdateAccessToken).
-						Delete(reqToken(), user.DeleteAccessToken)
+					m.Combo("/{id}").Delete(reqToken(), user.DeleteAccessToken)
 				}, reqSelfOrAdmin(), reqBasicOrRevProxyAuth())

 				m.Get("/activities/feeds", user.ListUserActivityFeeds)
@@ -1300,23 +1257,6 @@ func Routes() *web.Router {
 					})
 					m.Post("/priority", bind(api.UpdateBranchProtectionPriories{}), mustNotBeArchived, repo.UpdateBranchProtectionPriories)
 				}, reqToken(), reqAdmin())
-				m.Group("/cascade_rules", func() {
-					m.Get("", repo.ListCascadeRules)
-					m.Post("", mustNotBeArchived, repo.CreateCascadeRule)
-					m.Group("/{id}", func() {
-						m.Get("", repo.GetCascadeRule)
-						m.Patch("", mustNotBeArchived, repo.EditCascadeRule)
-						m.Delete("", mustNotBeArchived, repo.DeleteCascadeRule)
-					})
-				}, reqToken(), reqAdmin())
-				m.Group("/security", func() {
-					m.Get("/alerts", repo.ListSecurityAlerts)
-					m.Get("/alerts/{id}", repo.GetSecurityAlert)
-					m.Patch("/alerts/{id}", reqToken(), reqAdmin(), repo.UpdateSecurityAlert)
-					m.Post("/scan", reqToken(), reqAdmin(), repo.TriggerSecurityScan)
-					m.Get("/config", repo.GetSecurityConfig)
-					m.Patch("/config", reqToken(), reqAdmin(), repo.UpdateSecurityConfig)
-				}, reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(true))
 				m.Group("/tags", func() {
 					m.Get("", repo.ListTags)
 					m.Get("/*", repo.GetTag)
@@ -1374,7 +1314,6 @@ func Routes() *web.Router {
 					m.Get("/revisions/*", repo.ListPageRevisions)
 					m.Post("/new", reqToken(), mustNotBeArchived, reqRepoWriter(unit.TypeWiki), bind(api.CreateWikiPageOptions{}), repo.NewWikiPage)
 					m.Get("/pages", repo.ListWikiPages)
-					m.Get("/search", repo.SearchWikiPages)
 				}, mustEnableWiki)
 				m.Post("/markup", reqToken(), bind(api.MarkupOption{}), misc.Markup)
 				m.Post("/markdown", reqToken(), bind(api.MarkdownOption{}), misc.Markdown)
@@ -1800,7 +1739,7 @@ func Routes() *web.Router {
 				m.Combo("/{id}").Get(reqToken(), org.GetLabel).
 					Patch(reqToken(), reqOrgOwnership(), bind(api.EditLabelOption{}), org.EditLabel).
 					Delete(reqToken(), reqOrgOwnership(), org.DeleteLabel)
-			}, reqOrgVisible())
+			})
 			m.Group("/hooks", func() {
 				m.Combo("").Get(org.ListHooks).
 					Post(bind(api.CreateHookOption{}), org.CreateHook)
@@ -1837,11 +1776,6 @@ func Routes() *web.Router {
 				m.Delete("/{id}", reqToken(), reqOrgOwnership(), org.DeleteOrgCustomField)
 			})
 			m.Get("/issue-statuses", org.ListIssueStatuses)
-			m.Group("/issue-statuses", func() {
-				m.Get("/presets", org.ListIssueStatusPresets)
-				m.Post("/presets/{preset}", reqToken(), reqOrgOwnership(), org.ApplyIssueStatusPreset)
-				m.Post("/copy/{source_org}", reqToken(), reqOrgOwnership(), org.CopyIssueStatusesFromOrg)
-			})
 			m.Get("/issue-priorities", org.ListIssuePriorities)
 			m.Get("/issue-types", org.ListIssueTypes)
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(true), checkTokenPublicOnly())
@@ -1859,12 +1793,12 @@ func Routes() *web.Router {
 			m.Group("/repos", func() {
 				m.Get("", reqToken(), org.GetTeamRepos)
 				m.Combo("/{org}/{reponame}").
-					Put(reqToken(), reqTeamMembership(), org.AddTeamRepository).
-					Delete(reqToken(), reqTeamMembership(), org.RemoveTeamRepository).
+					Put(reqToken(), org.AddTeamRepository).
+					Delete(reqToken(), org.RemoveTeamRepository).
 					Get(reqToken(), org.GetTeamRepo)
 			})
 			m.Get("/activities/feeds", org.ListTeamActivityFeeds)
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamReadAccess(), checkTokenPublicOnly())
+		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamMembership(), checkTokenPublicOnly())

 		m.Group("/admin", func() {
 			m.Group("/cron", func() {
@@ -1957,7 +1891,7 @@ func Routes() *web.Router {

 			// Authenticated license detail
 			m.Get("/{dlid}/status", reqToken(), licensing.Status)
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryLicensing))
+		})
 	}, sudo())

 	return m
@@ -207,10 +207,7 @@ func UpdateLicense(ctx *context.APIContext) {
 	}
 	if len(cols) > 0 {
 		cols = append(cols, "updated_at")
-		if _, err := db.GetEngine(ctx).ID(id).Cols(cols...).Update(license); err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		}
+		db.GetEngine(ctx).ID(id).Cols(cols...).Update(license)
 	}

 	ctx.JSON(http.StatusOK, licenseToJSON(ctx, license))
@@ -402,10 +399,7 @@ func UpdateTier(ctx *context.APIContext) {
 	}

 	if len(cols) > 0 {
-		if _, err := db.GetEngine(ctx).ID(id).Cols(cols...).Update(tier); err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		}
+		db.GetEngine(ctx).ID(id).Cols(cols...).Update(tier)
 	}

 	ctx.JSON(http.StatusOK, tierToJSON(tier))
@@ -433,10 +427,7 @@ func DeleteTier(ctx *context.APIContext) {
 		return
 	}

-	if _, err := db.GetEngine(ctx).ID(id).Delete(new(licensing_model.ProductTier)); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
+	db.GetEngine(ctx).ID(id).Delete(new(licensing_model.ProductTier))
 	ctx.Status(http.StatusNoContent)
 }

@@ -6,26 +6,11 @@ package org
 import (
 	"net/http"

-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
-	org_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
 	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
 )

-// checkOrgVisibility returns true if the current user can view org metadata.
-// Public orgs are visible to everyone. Private/limited orgs require authentication.
-func checkOrgVisibility(ctx *context.APIContext) bool {
-	if ctx.Org.Organization.Visibility == api.VisibleTypePublic {
-		return true
-	}
-	if ctx.Doer == nil {
-		ctx.APIErrorNotFound()
-		return false
-	}
-	return true
-}
-
 // ListIssueStatuses returns active issue status definitions for an org.
 func ListIssueStatuses(ctx *context.APIContext) {
 	// swagger:operation GET /orgs/{org}/issue-statuses organization orgListIssueStatuses
@@ -49,10 +34,6 @@ func ListIssueStatuses(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"

-	if !checkOrgVisibility(ctx) {
-		return
-	}
-
 	defs, err := issues_model.GetIssueStatusDefsByOrg(ctx, ctx.Org.Organization.ID)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -66,7 +47,6 @@ func ListIssueStatuses(ctx *context.APIContext) {
 			Color:       d.Color,
 			Description: d.Description,
 			ClosesIssue: d.ClosesIssue,
-			IsRequired:  d.IsRequired,
 			SortOrder:   d.SortOrder,
 		})
 	}
@@ -96,10 +76,6 @@ func ListIssuePriorities(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"

-	if !checkOrgVisibility(ctx) {
-		return
-	}
-
 	defs, err := issues_model.GetIssuePriorityDefsByOrg(ctx, ctx.Org.Organization.ID)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -142,10 +118,6 @@ func ListIssueTypes(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"

-	if !checkOrgVisibility(ctx) {
-		return
-	}
-
 	defs, err := issues_model.GetIssueTypeDefsByOrg(ctx, ctx.Org.Organization.ID)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -164,124 +136,3 @@ func ListIssueTypes(ctx *context.APIContext) {
 	}
 	ctx.JSON(http.StatusOK, result)
 }
-
-// ListIssueStatusPresets returns the available status preset templates.
-func ListIssueStatusPresets(ctx *context.APIContext) {
-	// swagger:operation GET /orgs/{org}/issue-statuses/presets organization orgListIssueStatusPresets
-	// ---
-	// summary: List available issue status presets
-	// produces:
-	// - application/json
-	// parameters:
-	// - name: org
-	//   in: path
-	//   description: name of the organization
-	//   type: string
-	//   required: true
-	// responses:
-	//   "200":
-	//     description: "StatusPresetList"
-
-	result := make([]*api.StatusPreset, 0, len(issues_model.StatusPresetNames()))
-	for _, name := range issues_model.StatusPresetNames() {
-		preset := issues_model.StatusPresets[name]
-		statuses := make([]*api.StatusPresetEntry, 0, len(preset.Statuses))
-		for _, s := range preset.Statuses {
-			statuses = append(statuses, &api.StatusPresetEntry{
-				Name:        s.Name,
-				Color:       s.Color,
-				Description: s.Description,
-				ClosesIssue: s.ClosesIssue,
-				IsRequired:  s.IsRequired,
-			})
-		}
-		result = append(result, &api.StatusPreset{
-			Name:        preset.Name,
-			Description: preset.Description,
-			Statuses:    statuses,
-		})
-	}
-	ctx.JSON(http.StatusOK, result)
-}
-
-// ApplyIssueStatusPreset applies a status preset to an organization.
-func ApplyIssueStatusPreset(ctx *context.APIContext) {
-	// swagger:operation POST /orgs/{org}/issue-statuses/presets/{preset} organization orgApplyIssueStatusPreset
-	// ---
-	// summary: Apply a status preset to an organization
-	// parameters:
-	// - name: org
-	//   in: path
-	//   description: name of the organization
-	//   type: string
-	//   required: true
-	// - name: preset
-	//   in: path
-	//   description: preset name
-	//   type: string
-	//   required: true
-	// responses:
-	//   "204":
-	//     description: "StatusPresetApplied"
-	//   "404":
-	//     "$ref": "#/responses/notFound"
-
-	presetName := ctx.PathParam("preset")
-	if err := issues_model.ApplyStatusPreset(ctx, ctx.Org.Organization.ID, presetName); err != nil {
-		if db.IsErrNotExist(err) {
-			ctx.APIErrorNotFound()
-		} else {
-			ctx.APIErrorInternal(err)
-		}
-		return
-	}
-	ctx.Status(http.StatusNoContent)
-}
-
-// CopyIssueStatusesFromOrg copies status definitions from another organization.
-func CopyIssueStatusesFromOrg(ctx *context.APIContext) {
-	// swagger:operation POST /orgs/{org}/issue-statuses/copy/{source_org} organization orgCopyIssueStatuses
-	// ---
-	// summary: Copy issue statuses from another organization
-	// parameters:
-	// - name: org
-	//   in: path
-	//   description: target organization name
-	//   type: string
-	//   required: true
-	// - name: source_org
-	//   in: path
-	//   description: source organization name to copy from
-	//   type: string
-	//   required: true
-	// responses:
-	//   "204":
-	//     description: "StatusesCopied"
-	//   "404":
-	//     "$ref": "#/responses/notFound"
-
-	sourceOrgName := ctx.PathParam("source_org")
-	sourceOrg, err := org_model.GetOrgByName(ctx, sourceOrgName)
-	if err != nil {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	if sourceOrg.Visibility != api.VisibleTypePublic && !ctx.Doer.IsAdmin {
-		isMember, err := org_model.IsOrganizationMember(ctx, sourceOrg.ID, ctx.Doer.ID)
-		if err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		}
-		if !isMember {
-			ctx.APIErrorNotFound()
-			return
-		}
-	}
-
-	if err := issues_model.CopyStatusesFromOrg(ctx, sourceOrg.ID, ctx.Org.Organization.ID); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	ctx.Status(http.StatusNoContent)
-}
@@ -1081,8 +1081,6 @@ func ActionsDispatchWorkflow(ctx *context.APIContext) {
 			ctx.APIError(http.StatusNotFound, err)
 		} else if errors.Is(err, util.ErrPermissionDenied) {
 			ctx.APIError(http.StatusForbidden, err)
-		} else if errors.Is(err, util.ErrInvalidArgument) {
-			ctx.APIError(http.StatusUnprocessableEntity, err)
 		} else {
 			ctx.APIErrorInternal(err)
 		}
@@ -693,15 +693,6 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		ctx.APIErrorInternal(err)
 		return
 	}
-	deleteAllowlistUsers, err := user_model.GetUserIDsByNames(ctx, form.DeleteAllowlistUsernames, false)
-	if err != nil {
-		if user_model.IsErrUserNotExist(err) {
-			ctx.APIError(http.StatusUnprocessableEntity, err)
-			return
-		}
-		ctx.APIErrorInternal(err)
-		return
-	}
 	mergeWhitelistUsers, err := user_model.GetUserIDsByNames(ctx, form.MergeWhitelistUsernames, false)
 	if err != nil {
 		if user_model.IsErrUserNotExist(err) {
@@ -720,7 +711,7 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		ctx.APIErrorInternal(err)
 		return
 	}
-	var whitelistTeams, forcePushAllowlistTeams, deleteAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
+	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
 	if repo.Owner.IsOrganization() {
 		whitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.PushWhitelistTeams, false)
 		if err != nil {
@@ -740,15 +731,6 @@ func CreateBranchProtection(ctx *context.APIContext) {
 			ctx.APIErrorInternal(err)
 			return
 		}
-		deleteAllowlistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.DeleteAllowlistTeams, false)
-		if err != nil {
-			if organization.IsErrTeamNotExist(err) {
-				ctx.APIError(http.StatusUnprocessableEntity, err)
-				return
-			}
-			ctx.APIErrorInternal(err)
-			return
-		}
 		mergeWhitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.MergeWhitelistTeams, false)
 		if err != nil {
 			if organization.IsErrTeamNotExist(err) {
@@ -781,10 +763,6 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		EnableForcePushAllowlist:      form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist,
 		ForcePushAllowlistDeployKeys:  form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist && form.ForcePushAllowlistDeployKeys,
 		ForcePushAllowlistActionsUser: form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist && form.ForcePushAllowlistActionsUser,
-		CanDelete:                     form.EnableDelete,
-		EnableDeleteAllowlist:         form.EnableDelete && form.EnableDeleteAllowlist,
-		DeleteAllowlistDeployKeys:     form.EnableDelete && form.EnableDeleteAllowlist && form.DeleteAllowlistDeployKeys,
-		DeleteAllowlistActionsUser:    form.EnableDelete && form.EnableDeleteAllowlist && form.DeleteAllowlistActionsUser,
 		EnableMergeWhitelist:          form.EnableMergeWhitelist,
 		MergeWhitelistActionsUser:     form.EnableMergeWhitelist && form.MergeWhitelistActionsUser,
 		EnableStatusCheck:             form.EnableStatusCheck,
@@ -807,8 +785,6 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		TeamIDs:          whitelistTeams,
 		ForcePushUserIDs: forcePushAllowlistUsers,
 		ForcePushTeamIDs: forcePushAllowlistTeams,
-		DeleteUserIDs:    deleteAllowlistUsers,
-		DeleteTeamIDs:    deleteAllowlistTeams,
 		MergeUserIDs:     mergeWhitelistUsers,
 		MergeTeamIDs:     mergeWhitelistTeams,
 		ApprovalsUserIDs: approvalsWhitelistUsers,
@@ -935,32 +911,6 @@ func EditBranchProtection(ctx *context.APIContext) {
 		}
 	}

-	if form.EnableDelete != nil {
-		if !*form.EnableDelete {
-			protectBranch.CanDelete = false
-			protectBranch.EnableDeleteAllowlist = false
-			protectBranch.DeleteAllowlistDeployKeys = false
-			protectBranch.DeleteAllowlistActionsUser = false
-		} else {
-			protectBranch.CanDelete = true
-			if form.EnableDeleteAllowlist != nil {
-				if !*form.EnableDeleteAllowlist {
-					protectBranch.EnableDeleteAllowlist = false
-					protectBranch.DeleteAllowlistDeployKeys = false
-					protectBranch.DeleteAllowlistActionsUser = false
-				} else {
-					protectBranch.EnableDeleteAllowlist = true
-					if form.DeleteAllowlistDeployKeys != nil {
-						protectBranch.DeleteAllowlistDeployKeys = *form.DeleteAllowlistDeployKeys
-					}
-					if form.DeleteAllowlistActionsUser != nil {
-						protectBranch.DeleteAllowlistActionsUser = *form.DeleteAllowlistActionsUser
-					}
-				}
-			}
-		}
-	}
-
 	if form.Priority != nil {
 		protectBranch.Priority = *form.Priority
 	}
@@ -1027,7 +977,7 @@ func EditBranchProtection(ctx *context.APIContext) {
 		protectBranch.BlockAdminMergeOverride = *form.BlockAdminMergeOverride
 	}

-	var whitelistUsers, forcePushAllowlistUsers, deleteAllowlistUsers, mergeWhitelistUsers, approvalsWhitelistUsers []int64
+	var whitelistUsers, forcePushAllowlistUsers, mergeWhitelistUsers, approvalsWhitelistUsers []int64
 	if form.PushWhitelistUsernames != nil {
 		whitelistUsers, err = user_model.GetUserIDsByNames(ctx, form.PushWhitelistUsernames, false)
 		if err != nil {
@@ -1054,19 +1004,6 @@ func EditBranchProtection(ctx *context.APIContext) {
 	} else {
 		forcePushAllowlistUsers = protectBranch.ForcePushAllowlistUserIDs
 	}
-	if form.DeleteAllowlistUsernames != nil {
-		deleteAllowlistUsers, err = user_model.GetUserIDsByNames(ctx, form.DeleteAllowlistUsernames, false)
-		if err != nil {
-			if user_model.IsErrUserNotExist(err) {
-				ctx.APIError(http.StatusUnprocessableEntity, err)
-				return
-			}
-			ctx.APIErrorInternal(err)
-			return
-		}
-	} else {
-		deleteAllowlistUsers = protectBranch.DeleteAllowlistUserIDs
-	}
 	if form.MergeWhitelistUsernames != nil {
 		mergeWhitelistUsers, err = user_model.GetUserIDsByNames(ctx, form.MergeWhitelistUsernames, false)
 		if err != nil {
@@ -1094,7 +1031,7 @@ func EditBranchProtection(ctx *context.APIContext) {
 		approvalsWhitelistUsers = protectBranch.ApprovalsWhitelistUserIDs
 	}

-	var whitelistTeams, forcePushAllowlistTeams, deleteAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
+	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
 	if repo.Owner.IsOrganization() {
 		if form.PushWhitelistTeams != nil {
 			whitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.PushWhitelistTeams, false)
@@ -1122,19 +1059,6 @@ func EditBranchProtection(ctx *context.APIContext) {
 		} else {
 			forcePushAllowlistTeams = protectBranch.ForcePushAllowlistTeamIDs
 		}
-		if form.DeleteAllowlistTeams != nil {
-			deleteAllowlistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.DeleteAllowlistTeams, false)
-			if err != nil {
-				if organization.IsErrTeamNotExist(err) {
-					ctx.APIError(http.StatusUnprocessableEntity, err)
-					return
-				}
-				ctx.APIErrorInternal(err)
-				return
-			}
-		} else {
-			deleteAllowlistTeams = protectBranch.DeleteAllowlistTeamIDs
-		}
 		if form.MergeWhitelistTeams != nil {
 			mergeWhitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.MergeWhitelistTeams, false)
 			if err != nil {
@@ -1168,8 +1092,6 @@ func EditBranchProtection(ctx *context.APIContext) {
 		TeamIDs:          whitelistTeams,
 		ForcePushUserIDs: forcePushAllowlistUsers,
 		ForcePushTeamIDs: forcePushAllowlistTeams,
-		DeleteUserIDs:    deleteAllowlistUsers,
-		DeleteTeamIDs:    deleteAllowlistTeams,
 		MergeUserIDs:     mergeWhitelistUsers,
 		MergeTeamIDs:     mergeWhitelistTeams,
 		ApprovalsUserIDs: approvalsWhitelistUsers,
@@ -1365,9 +1287,6 @@ func MergeUpstream(ctx *context.APIContext) {
 		} else if errors.Is(err, util.ErrNotExist) {
 			ctx.APIError(http.StatusNotFound, err)
 			return
-		} else if errors.Is(err, util.ErrPermissionDenied) {
-			ctx.APIError(http.StatusForbidden, err.Error())
-			return
 		}
 		ctx.APIErrorInternal(err)
 		return
@@ -1,151 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package repo
-
-import (
-	"encoding/json"
-	"net/http"
-
-	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
-	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
-)
-
-func toCascadeRuleAPI(rule *repo_model.CascadeMergeRule) *api.CascadeMergeRule {
-	return &api.CascadeMergeRule{
-		ID:           rule.ID,
-		SourceBranch: rule.SourceBranch,
-		TargetBranch: rule.TargetBranch,
-		Enabled:      rule.Enabled,
-		AutoMerge:    rule.AutoMerge,
-		CreatedAt:    rule.CreatedUnix.AsTime(),
-		UpdatedAt:    rule.UpdatedUnix.AsTime(),
-	}
-}
-
-func ListCascadeRules(ctx *context.APIContext) {
-	rules, err := repo_model.GetCascadeRulesByRepoID(ctx, ctx.Repo.Repository.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	apiRules := make([]*api.CascadeMergeRule, len(rules))
-	for i, rule := range rules {
-		apiRules[i] = toCascadeRuleAPI(rule)
-	}
-	ctx.JSON(http.StatusOK, apiRules)
-}
-
-func CreateCascadeRule(ctx *context.APIContext) {
-	var req api.CreateCascadeMergeRuleOption
-	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
-		ctx.APIError(http.StatusBadRequest, err)
-		return
-	}
-
-	if req.SourceBranch == "" || req.TargetBranch == "" {
-		ctx.APIError(http.StatusUnprocessableEntity, "source_branch and target_branch are required")
-		return
-	}
-
-	if req.SourceBranch == req.TargetBranch {
-		ctx.APIError(http.StatusUnprocessableEntity, "source_branch and target_branch must be different")
-		return
-	}
-
-	rule := &repo_model.CascadeMergeRule{
-		RepoID:       ctx.Repo.Repository.ID,
-		SourceBranch: req.SourceBranch,
-		TargetBranch: req.TargetBranch,
-		Enabled:      true,
-	}
-	if req.Enabled != nil {
-		rule.Enabled = *req.Enabled
-	}
-	if req.AutoMerge != nil {
-		rule.AutoMerge = *req.AutoMerge
-	}
-
-	if err := repo_model.CreateCascadeRule(ctx, rule); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	ctx.JSON(http.StatusCreated, toCascadeRuleAPI(rule))
-}
-
-func GetCascadeRule(ctx *context.APIContext) {
-	rule, err := repo_model.GetCascadeRuleByID(ctx, ctx.PathParamInt64("id"))
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	if rule == nil || rule.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound()
-		return
-	}
-	ctx.JSON(http.StatusOK, toCascadeRuleAPI(rule))
-}
-
-func EditCascadeRule(ctx *context.APIContext) {
-	rule, err := repo_model.GetCascadeRuleByID(ctx, ctx.PathParamInt64("id"))
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	if rule == nil || rule.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	var req api.EditCascadeMergeRuleOption
-	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
-		ctx.APIError(http.StatusBadRequest, err)
-		return
-	}
-
-	if req.SourceBranch != nil {
-		rule.SourceBranch = *req.SourceBranch
-	}
-	if req.TargetBranch != nil {
-		rule.TargetBranch = *req.TargetBranch
-	}
-	if req.Enabled != nil {
-		rule.Enabled = *req.Enabled
-	}
-	if req.AutoMerge != nil {
-		rule.AutoMerge = *req.AutoMerge
-	}
-
-	if rule.SourceBranch == rule.TargetBranch {
-		ctx.APIError(http.StatusUnprocessableEntity, "source_branch and target_branch must be different")
-		return
-	}
-
-	if err := repo_model.UpdateCascadeRule(ctx, rule); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, toCascadeRuleAPI(rule))
-}
-
-func DeleteCascadeRule(ctx *context.APIContext) {
-	rule, err := repo_model.GetCascadeRuleByID(ctx, ctx.PathParamInt64("id"))
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	if rule == nil || rule.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	if err := repo_model.DeleteCascadeRule(ctx, ctx.Repo.Repository.ID, rule.ID); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	ctx.Status(http.StatusNoContent)
-}
@@ -32,16 +32,6 @@ type apiMetadata struct {
 	Language         string `json:"language"`
 	ExtensionType      string `json:"extension_type"`
 	EntryPoint       string `json:"entry_point"`
-
-	// deploy
-	DeployHost     string `json:"deploy_host,omitempty"`
-	DeployPort     string `json:"deploy_port,omitempty"`
-	DeployUser     string `json:"deploy_user,omitempty"`
-	DeployPath     string `json:"deploy_path,omitempty"`
-	DockerImage    string `json:"docker_image,omitempty"`
-	DockerRegistry string `json:"docker_registry,omitempty"`
-	ContainerName  string `json:"container_name,omitempty"`
-	HealthURL      string `json:"health_url,omitempty"`
 }

 // GetRepoMetadata returns the manifest settings for a repository.
@@ -91,14 +81,6 @@ func GetRepoMetadata(ctx *context.APIContext) {
 		Language:         m.Language,
 		ExtensionType:      m.ExtensionType,
 		EntryPoint:       m.EntryPoint,
-		DeployHost:       m.DeployHost,
-		DeployPort:       m.DeployPort,
-		DeployUser:       m.DeployUser,
-		DeployPath:       m.DeployPath,
-		DockerImage:      m.DockerImage,
-		DockerRegistry:   m.DockerRegistry,
-		ContainerName:    m.ContainerName,
-		HealthURL:        m.HealthURL,
 	})
 }

@@ -114,58 +96,34 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/Manifest"
-	// Decode into a map to detect which fields were actually sent.
-	var raw map[string]any
-	if err := json.NewDecoder(ctx.Req.Body).Decode(&raw); err != nil {
+	var req apiMetadata
+	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
 		ctx.APIError(http.StatusBadRequest, err)
 		return
 	}

-	// Load existing metadata (or create defaults).
-	m, _ := repo_model.GetRepoMetadata(ctx, ctx.Repo.Repository.ID)
-	if m == nil {
-		m = &repo_model.RepoMetadata{
-			RepoID:      ctx.Repo.Repository.ID,
-			Name:        ctx.Repo.Repository.Name,
-			Org:         ctx.Repo.Repository.OwnerName,
-			Description: ctx.Repo.Repository.Description,
-		}
-	}
+	m := &repo_model.RepoMetadata{
+		RepoID:           ctx.Repo.Repository.ID,
+		Name:             req.Name,
+		Org:              req.Org,
+		Description:      req.Description,

-	// Apply only the fields present in the request.
-	setStr := func(key string, target *string) {
-		if v, ok := raw[key]; ok {
-			if s, ok := v.(string); ok {
-				*target = s
-			}
-		}
+		LicenseSPDX:      req.LicenseSPDX,
+		LicenseName:      req.LicenseName,
+		VersionPrefix:    req.VersionPrefix,
+		ElementName:      req.ElementName,
+		Platform:         req.Platform,
+		StandardsVersion: req.StandardsVersion,
+		StandardsSource:  req.StandardsSource,
+		Maintainer:       req.Maintainer,
+		MaintainerURL:    req.MaintainerURL,
+		InfoURL:          req.InfoURL,
+		TargetVersion:    req.TargetVersion,
+		PHPMinimum:       req.PHPMinimum,
+		Language:         req.Language,
+		ExtensionType:      req.ExtensionType,
+		EntryPoint:       req.EntryPoint,
 	}
-	setStr("name", &m.Name)
-	setStr("org", &m.Org)
-	setStr("description", &m.Description)
-	setStr("license_spdx", &m.LicenseSPDX)
-	setStr("license_name", &m.LicenseName)
-	setStr("version_prefix", &m.VersionPrefix)
-	setStr("element_name", &m.ElementName)
-	setStr("platform", &m.Platform)
-	setStr("standards_version", &m.StandardsVersion)
-	setStr("standards_source", &m.StandardsSource)
-	setStr("maintainer", &m.Maintainer)
-	setStr("maintainer_url", &m.MaintainerURL)
-	setStr("info_url", &m.InfoURL)
-	setStr("target_version", &m.TargetVersion)
-	setStr("php_minimum", &m.PHPMinimum)
-	setStr("language", &m.Language)
-	setStr("extension_type", &m.ExtensionType)
-	setStr("entry_point", &m.EntryPoint)
-	setStr("deploy_host", &m.DeployHost)
-	setStr("deploy_port", &m.DeployPort)
-	setStr("deploy_user", &m.DeployUser)
-	setStr("deploy_path", &m.DeployPath)
-	setStr("docker_image", &m.DockerImage)
-	setStr("docker_registry", &m.DockerRegistry)
-	setStr("container_name", &m.ContainerName)
-	setStr("health_url", &m.HealthURL)

 	if err := repo_model.CreateOrUpdateRepoMetadata(ctx, m); err != nil {
 		ctx.APIErrorInternal(err)
@@ -193,13 +151,5 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 		Language:         m.Language,
 		ExtensionType:      m.ExtensionType,
 		EntryPoint:       m.EntryPoint,
-		DeployHost:       m.DeployHost,
-		DeployPort:       m.DeployPort,
-		DeployUser:       m.DeployUser,
-		DeployPath:       m.DeployPath,
-		DockerImage:      m.DockerImage,
-		DockerRegistry:   m.DockerRegistry,
-		ContainerName:    m.ContainerName,
-		HealthURL:        m.HealthURL,
 	})
 }
@@ -1,220 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package repo
-
-import (
-	"encoding/json"
-	"net/http"
-	"time"
-
-	security_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/security"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
-	security_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/security"
-)
-
-type apiSecurityAlert struct {
-	ID          int64     `json:"id"`
-	Scanner     string    `json:"scanner"`
-	Severity    string    `json:"severity"`
-	Status      string    `json:"status"`
-	RuleID      string    `json:"rule_id"`
-	Title       string    `json:"title"`
-	Description string    `json:"description,omitempty"`
-	FilePath    string    `json:"file_path,omitempty"`
-	LineNumber  int       `json:"line_number,omitempty"`
-	CommitSHA   string    `json:"commit_sha,omitempty"`
-	Fingerprint string    `json:"fingerprint"`
-	CreatedAt   time.Time `json:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at"`
-}
-
-type apiSecurityConfig struct {
-	Enabled       bool `json:"enabled"`
-	BlockOnPush   bool `json:"block_on_push"`
-	SecretScanner bool `json:"secret_scanner"`
-	DependScanner bool `json:"depend_scanner"`
-	CodeScanner   bool `json:"code_scanner"`
-}
-
-// ListSecurityAlerts returns all security alerts for a repo.
-func ListSecurityAlerts(ctx *context.APIContext) {
-	status := ctx.FormString("status")
-	repoID := ctx.Repo.Repository.ID
-
-	var alerts []*security_model.SecurityAlert
-	var err error
-
-	switch status {
-	case "", "active":
-		alerts, err = security_model.GetActiveAlerts(ctx, repoID)
-	default:
-		alerts, err = security_model.GetAllAlerts(ctx, repoID)
-	}
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	result := make([]*apiSecurityAlert, len(alerts))
-	for i, a := range alerts {
-		result[i] = toAPISecurityAlert(a)
-	}
-	ctx.JSON(http.StatusOK, result)
-}
-
-// GetSecurityAlert returns a single security alert.
-func GetSecurityAlert(ctx *context.APIContext) {
-	id := ctx.PathParamInt64("id")
-	alert, err := security_model.GetAlertByID(ctx, id)
-	if err != nil {
-		ctx.APIErrorNotFound()
-		return
-	}
-	if alert.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound()
-		return
-	}
-	ctx.JSON(http.StatusOK, toAPISecurityAlert(alert))
-}
-
-// UpdateSecurityAlert changes the status of a security alert.
-func UpdateSecurityAlert(ctx *context.APIContext) {
-	id := ctx.PathParamInt64("id")
-	alert, err := security_model.GetAlertByID(ctx, id)
-	if err != nil {
-		ctx.APIErrorNotFound()
-		return
-	}
-	if alert.RepoID != ctx.Repo.Repository.ID {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	var req struct {
-		Status string `json:"status"`
-	}
-	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
-		ctx.APIError(http.StatusUnprocessableEntity, err)
-		return
-	}
-
-	status := security_model.AlertStatus(req.Status)
-	if status != security_model.AlertStatusResolved && status != security_model.AlertStatusDismissed {
-		ctx.APIError(http.StatusUnprocessableEntity, "status must be 'resolved' or 'dismissed'")
-		return
-	}
-
-	if err := security_model.UpdateAlertStatus(ctx, id, status, ctx.Doer.ID); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	alert, _ = security_model.GetAlertByID(ctx, id)
-	ctx.JSON(http.StatusOK, toAPISecurityAlert(alert))
-}
-
-// TriggerSecurityScan runs all enabled scanners against HEAD.
-func TriggerSecurityScan(ctx *context.APIContext) {
-	commit := ctx.Repo.Commit
-	if commit == nil {
-		ctx.APIError(http.StatusBadRequest, "no commits in repository")
-		return
-	}
-
-	security_service.ScanOnPush(ctx, ctx.Repo.Repository, commit)
-
-	alerts, err := security_model.GetActiveAlerts(ctx, ctx.Repo.Repository.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	result := make([]*apiSecurityAlert, len(alerts))
-	for i, a := range alerts {
-		result[i] = toAPISecurityAlert(a)
-	}
-	ctx.JSON(http.StatusOK, result)
-}
-
-// GetSecurityConfig returns the scanner config for a repo.
-func GetSecurityConfig(ctx *context.APIContext) {
-	cfg, err := security_model.GetScannerConfig(ctx, ctx.Repo.Repository.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-	ctx.JSON(http.StatusOK, toAPISecurityConfig(cfg))
-}
-
-// UpdateSecurityConfig updates the scanner config for a repo.
-func UpdateSecurityConfig(ctx *context.APIContext) {
-	var req struct {
-		Enabled       *bool `json:"enabled"`
-		BlockOnPush   *bool `json:"block_on_push"`
-		SecretScanner *bool `json:"secret_scanner"`
-		DependScanner *bool `json:"depend_scanner"`
-		CodeScanner   *bool `json:"code_scanner"`
-	}
-	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
-		ctx.APIError(http.StatusUnprocessableEntity, err)
-		return
-	}
-
-	cfg, err := security_model.GetScannerConfig(ctx, ctx.Repo.Repository.ID)
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	if req.Enabled != nil {
-		cfg.Enabled = *req.Enabled
-	}
-	if req.BlockOnPush != nil {
-		cfg.BlockOnPush = *req.BlockOnPush
-	}
-	if req.SecretScanner != nil {
-		cfg.SecretScanner = *req.SecretScanner
-	}
-	if req.DependScanner != nil {
-		cfg.DependScanner = *req.DependScanner
-	}
-	if req.CodeScanner != nil {
-		cfg.CodeScanner = *req.CodeScanner
-	}
-
-	if err := security_model.SaveScannerConfig(ctx, cfg); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, toAPISecurityConfig(cfg))
-}
-
-func toAPISecurityAlert(a *security_model.SecurityAlert) *apiSecurityAlert {
-	return &apiSecurityAlert{
-		ID:          a.ID,
-		Scanner:     string(a.Scanner),
-		Severity:    string(a.Severity),
-		Status:      string(a.Status),
-		RuleID:      a.RuleID,
-		Title:       a.Title,
-		Description: a.Description,
-		FilePath:    a.FilePath,
-		LineNumber:  a.LineNumber,
-		CommitSHA:   a.CommitSHA,
-		Fingerprint: a.Fingerprint,
-		CreatedAt:   a.CreatedUnix.AsTime(),
-		UpdatedAt:   a.UpdatedUnix.AsTime(),
-	}
-}
-
-func toAPISecurityConfig(cfg *security_model.SecurityScannerConfig) *apiSecurityConfig {
-	return &apiSecurityConfig{
-		Enabled:       cfg.Enabled,
-		BlockOnPush:   cfg.BlockOnPush,
-		SecretScanner: cfg.SecretScanner,
-		DependScanner: cfg.DependScanner,
-		CodeScanner:   cfg.CodeScanner,
-	}
-}
@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"strings"

 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
@@ -462,148 +461,10 @@ func ListPageRevisions(ctx *context.APIContext) {
 	ctx.JSON(http.StatusOK, convert.ToWikiCommitList(commitsHistory, commitsCount))
 }

-// SearchWikiPages searches wiki page titles and content.
-func SearchWikiPages(ctx *context.APIContext) {
-	// swagger:operation GET /repos/{owner}/{repo}/wiki/search repository repoSearchWikiPages
-	// ---
-	// summary: Search wiki pages
-	// produces:
-	// - application/json
-	// parameters:
-	// - name: owner
-	//   in: path
-	//   description: owner of the repo
-	//   type: string
-	//   required: true
-	// - name: repo
-	//   in: path
-	//   description: name of the repo
-	//   type: string
-	//   required: true
-	// - name: q
-	//   in: query
-	//   description: search query
-	//   type: string
-	//   required: true
-	// - name: page
-	//   in: query
-	//   description: page number of results to return (1-based)
-	//   type: integer
-	// - name: limit
-	//   in: query
-	//   description: page size of results
-	//   type: integer
-	// responses:
-	//   "200":
-	//     description: "SearchResults"
-	//   "404":
-	//     "$ref": "#/responses/notFound"
-
-	query := strings.TrimSpace(ctx.FormString("q"))
-	if query == "" {
-		ctx.JSON(http.StatusOK, []interface{}{})
-		return
-	}
-
-	wikiRepo, commit := findWikiRepoCommit(ctx)
-	if wikiRepo != nil {
-		defer wikiRepo.Close()
-	}
-	if ctx.Written() {
-		return
-	}
-
-	queryLower := strings.ToLower(query)
-
-	type WikiSearchResult struct {
-		PageName string `json:"page_name"`
-		PageURL  string `json:"page_url"`
-		Context  string `json:"context,omitempty"`
-	}
-
-	entries, err := commit.ListEntriesRecursiveFast()
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	var results []WikiSearchResult
-	for _, entry := range entries {
-		if !entry.IsRegular() || !strings.HasSuffix(entry.Name(), ".md") {
-			continue
-		}
-		baseName := strings.TrimSuffix(entry.Name(), ".md")
-		// Extract just the filename without path for special file check
-		parts := strings.Split(baseName, "/")
-		shortName := parts[len(parts)-1]
-		if shortName == "_Sidebar" || shortName == "_Footer" {
-			continue
-		}
-
-		blob := entry.Blob()
-		content, err := blob.GetBlobContent(setting.UI.MaxDisplayFileSize)
-		if err != nil {
-			continue
-		}
-
-		titleMatch := strings.Contains(strings.ToLower(baseName), queryLower)
-		contentMatch := strings.Contains(strings.ToLower(content), queryLower)
-
-		if !titleMatch && !contentMatch {
-			continue
-		}
-
-		contextLine := ""
-		if contentMatch {
-			for _, line := range strings.Split(content, "\n") {
-				if strings.Contains(strings.ToLower(line), queryLower) {
-					contextLine = strings.TrimSpace(line)
-					if len(contextLine) > 200 {
-						contextLine = contextLine[:200] + "..."
-					}
-					break
-				}
-			}
-		}
-
-		wikiName, err := wiki_service.GitPathToWebPath(entry.Name())
-		if err != nil {
-			continue
-		}
-		_, displayName := wiki_service.WebPathToUserTitle(wikiName)
-
-		results = append(results, WikiSearchResult{
-			PageName: displayName,
-			PageURL:  string(wikiName),
-			Context:  contextLine,
-		})
-	}
-
-	// Pagination
-	page := max(ctx.FormInt("page"), 1)
-	limit := ctx.FormInt("limit")
-	if limit <= 0 {
-		limit = setting.API.DefaultPagingNum
-	}
-	total := len(results)
-	start := (page - 1) * limit
-	end := start + limit
-	if start > total {
-		start = total
-	}
-	if end > total {
-		end = total
-	}
-
-	ctx.SetLinkHeader(int64(total), limit)
-	ctx.SetTotalCountHeader(int64(total))
-	ctx.JSON(http.StatusOK, results[start:end])
-}
-
 // findEntryForFile finds the tree entry for a target filepath.
 func findEntryForFile(commit *git.Commit, target string) (*git.TreeEntry, error) {
 	entry, err := commit.GetTreeEntryByPath(target)
-	if err != nil && !git.IsErrNotExist(err) {
+	if err != nil {
 		return nil, err
 	}
 	if entry != nil {
@@ -209,106 +209,6 @@ func DeleteAccessToken(ctx *context.APIContext) {
 	ctx.Status(http.StatusNoContent)
 }

-// UpdateAccessToken update access token scopes
-func UpdateAccessToken(ctx *context.APIContext) {
-	// swagger:operation PATCH /users/{username}/tokens/{id} user userUpdateAccessToken
-	// ---
-	// summary: Update an access token's scopes
-	// consumes:
-	// - application/json
-	// produces:
-	// - application/json
-	// parameters:
-	// - name: username
-	//   in: path
-	//   description: username of the user whose token is to be updated
-	//   type: string
-	//   required: true
-	// - name: id
-	//   in: path
-	//   description: id of the token to update
-	//   type: integer
-	//   format: int64
-	//   required: true
-	// - name: body
-	//   in: body
-	//   schema:
-	//     "$ref": "#/definitions/EditAccessTokenOption"
-	// responses:
-	//   "200":
-	//     "$ref": "#/responses/AccessToken"
-	//   "400":
-	//     "$ref": "#/responses/error"
-	//   "403":
-	//     "$ref": "#/responses/forbidden"
-	//   "404":
-	//     "$ref": "#/responses/notFound"
-
-	tokenID, _ := strconv.ParseInt(ctx.PathParam("id"), 0, 64)
-	if tokenID == 0 {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	tokens, err := db.Find[auth_model.AccessToken](ctx, auth_model.ListAccessTokensOptions{
-		UserID: ctx.ContextUser.ID,
-	})
-	if err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	var token *auth_model.AccessToken
-	for _, t := range tokens {
-		if t.ID == tokenID {
-			token = t
-			break
-		}
-	}
-	if token == nil {
-		ctx.APIErrorNotFound()
-		return
-	}
-
-	form := web.GetForm(ctx).(*api.EditAccessTokenOption)
-
-	if form.Name == "" && len(form.Scopes) == 0 {
-		ctx.APIError(http.StatusBadRequest, "must provide name or scopes to update")
-		return
-	}
-
-	if form.Name != "" {
-		token.Name = form.Name
-	}
-
-	if len(form.Scopes) > 0 {
-		scope, err := auth_model.AccessTokenScope(strings.Join(form.Scopes, ",")).Normalize()
-		if err != nil {
-			ctx.APIError(http.StatusBadRequest, fmt.Errorf("invalid access token scope: %w", err))
-			return
-		}
-		if scope == "" {
-			ctx.APIError(http.StatusBadRequest, "access token must have a scope")
-			return
-		}
-		token.Scope = scope
-	}
-
-	if err := auth_model.UpdateAccessToken(ctx, token); err != nil {
-		ctx.APIErrorInternal(err)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, &api.AccessToken{
-		ID:             token.ID,
-		Name:           token.Name,
-		TokenLastEight: token.TokenLastEight,
-		Scopes:         token.Scope.StringSlice(),
-		Created:        token.CreatedUnix.AsTime(),
-		Updated:        token.UpdatedUnix.AsTime(),
-	})
-}
-
 // CreateOauth2Application is the handler to create a new OAuth2 Application for the authenticated user
 func CreateOauth2Application(ctx *context.APIContext) {
 	// swagger:operation POST /user/applications/oauth2 user userCreateOAuth2Application
@@ -38,7 +38,6 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/auth"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/auth/source/oauth2"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/automerge"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/cascade"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/cron"
 	feed_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/feed"
 	indexer_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/indexer"
@@ -154,7 +153,6 @@ func InitWebInstalled(ctx context.Context) {
 	mustInit(webhook.Init)
 	mustInit(pull_service.Init)
 	mustInit(automerge.Init)
-	cascade.Init()
 	mustInit(task.Init)
 	mustInit(repo_migrations.Init)
 	eventsource.GetManager().Init()
@@ -26,7 +26,6 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/agit"
 	gitea_context "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
 	pull_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/pull"
-	security_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/security"
 )

 type preReceiveContext struct {
@@ -41,6 +40,9 @@ type preReceiveContext struct {
 	canCreatePullRequest        bool
 	checkedCanCreatePullRequest bool

+	canWriteCode        bool
+	checkedCanWriteCode bool
+
 	protectedTags    []*git_model.ProtectedTag
 	gotProtectedTags bool

@@ -48,36 +50,24 @@ type preReceiveContext struct {

 	opts *private.HookOptions

-	// this context should only contain shared variables, mutable variables like "current branch name" shouldn't be put here
-	canWriteCodeUnitCached *bool
+	branchName string
 }

-func (ctx *preReceiveContext) canWriteCodeUnit() bool {
-	if ctx.canWriteCodeUnitCached == nil {
-		var canWrite bool
-		if ctx.loadPusherAndPermission() {
-			canWrite = ctx.userPerm.CanWrite(unit.TypeCode) || ctx.deployKeyAccessMode >= perm_model.AccessModeWrite
+// CanWriteCode returns true if pusher can write code
+func (ctx *preReceiveContext) CanWriteCode() bool {
+	if !ctx.checkedCanWriteCode {
+		if !ctx.loadPusherAndPermission() {
+			return false
 		}
-		ctx.canWriteCodeUnitCached = &canWrite
+		ctx.canWriteCode = issues_model.CanMaintainerWriteToBranch(ctx, ctx.userPerm, ctx.branchName, ctx.user) || ctx.deployKeyAccessMode >= perm_model.AccessModeWrite
+		ctx.checkedCanWriteCode = true
 	}
-	return *ctx.canWriteCodeUnitCached
+	return ctx.canWriteCode
 }

-// canWriteCodeRef returns true if pusher can write to the code ref (branch/tag/commit)
-func (ctx *preReceiveContext) canWriteCodeRef(refFullName git.RefName) bool {
-	if ctx.canWriteCodeUnit() {
-		return true
-	}
-	// then check whether if the pusher is a maintainer who can write the PR author's head repo branch
-	if !refFullName.IsBranch() {
-		return false
-	}
-	return issues_model.CanMaintainerWriteToBranch(ctx, ctx.userPerm, refFullName.BranchName(), ctx.user)
-}
-
-// assertCanWriteRef returns true if pusher can write to the code ref, otherwise it responds with 403 Forbidden and returns false
-func (ctx *preReceiveContext) assertCanWriteRef(refFullName git.RefName) bool {
-	if !ctx.canWriteCodeRef(refFullName) {
+// AssertCanWriteCode returns true if pusher can write code
+func (ctx *preReceiveContext) AssertCanWriteCode() bool {
+	if !ctx.CanWriteCode() {
 		if ctx.Written() {
 			return false
 		}
@@ -139,7 +129,7 @@ func HookPreReceive(ctx *gitea_context.PrivateContext) {
 		case git.DefaultFeatures().SupportProcReceive && refFullName.IsFor():
 			preReceiveFor(ourCtx, refFullName)
 		default:
-			ourCtx.assertCanWriteRef(refFullName)
+			ourCtx.AssertCanWriteCode()
 		}
 		if ctx.Written() {
 			return
@@ -151,8 +141,9 @@ func HookPreReceive(ctx *gitea_context.PrivateContext) {

 func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, refFullName git.RefName) {
 	branchName := refFullName.BranchName()
+	ctx.branchName = branchName

-	if !ctx.assertCanWriteRef(refFullName) {
+	if !ctx.AssertCanWriteCode() {
 		return
 	}

@@ -160,25 +151,6 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 	gitRepo := ctx.Repo.GitRepo
 	objectFormat := ctx.Repo.GetObjectFormat()

-	if newCommitID != objectFormat.EmptyObjectID().String() {
-		newCommit, err := gitRepo.GetCommit(newCommitID)
-		if err != nil {
-			log.Error("Secret scan: failed to get commit %s in %-v: %v", newCommitID[:12], repo, err)
-		} else {
-			if findings := security_service.ScanPushForSecrets(ctx, repo.ID, newCommit); len(findings) > 0 {
-				msg := fmt.Sprintf("Push rejected: %d secret(s) detected in commit %s", len(findings), newCommitID[:12])
-				for _, f := range findings {
-					msg += fmt.Sprintf("\n  - %s in %s:%d", f.Title, f.FilePath, f.LineNumber)
-				}
-				log.Warn("Secret scan blocked push to %s in %-v: %d findings", branchName, repo, len(findings))
-				ctx.JSON(http.StatusForbidden, private.Response{
-					UserMsg: msg,
-				})
-				return
-			}
-		}
-	}
-
 	defaultBranch := repo.DefaultBranch
 	if ctx.opts.IsWiki && repo.DefaultWikiBranch != "" {
 		defaultBranch = repo.DefaultWikiBranch
@@ -210,29 +182,12 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 	//
 	// First of all we need to enforce absolutely:
 	//
-	// 1. Detect and prevent deletion of the branch (unless user is in delete allowlist)
+	// 1. Detect and prevent deletion of the branch
 	if newCommitID == objectFormat.EmptyObjectID().String() {
-		canDelete := false
-		if ctx.opts.DeployKeyID != 0 {
-			canDelete = protectBranch.CanDelete && (!protectBranch.EnableDeleteAllowlist || protectBranch.DeleteAllowlistDeployKeys)
-		} else {
-			user, err := user_model.GetUserByID(ctx, ctx.opts.UserID)
-			if err != nil {
-				log.Error("Unable to GetUserByID for delete check in %-v: %v", repo, err)
-				ctx.JSON(http.StatusInternalServerError, private.Response{
-					Err: fmt.Sprintf("Unable to GetUserByID: %v", err),
-				})
-				return
-			}
-			canDelete = protectBranch.CanUserDelete(ctx, user)
-		}
-		if !canDelete {
-			log.Warn("Forbidden: Branch: %s in %-v is protected from deletion", branchName, repo)
-			ctx.JSON(http.StatusForbidden, private.Response{
-				UserMsg: fmt.Sprintf("branch %s is protected from deletion", branchName),
-			})
-			return
-		}
+		log.Warn("Forbidden: Branch: %s in %-v is protected from deletion", branchName, repo)
+		ctx.JSON(http.StatusForbidden, private.Response{
+			UserMsg: fmt.Sprintf("branch %s is protected from deletion", branchName),
+		})
 		return
 	}

@@ -449,7 +404,7 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 }

 func preReceiveTag(ctx *preReceiveContext, refFullName git.RefName) {
-	if !ctx.assertCanWriteRef(refFullName) {
+	if !ctx.AssertCanWriteCode() {
 		return
 	}

@@ -1,70 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package private
-
-import (
-	"testing"
-
-	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm/access"
-	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/contexttest"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestPreReceiveCanWriteCodePerBranch ensures the maintainer-edit write grant is evaluated against
-// the exact ref being pushed on every call, derived from that ref rather than shared mutable state.
-// Otherwise a per-branch grant (an open PR with "allow edits from maintainers") could be batched
-// together with a protected branch or a tag to escalate into full repository write.
-func TestPreReceiveCanWriteCodePerBranch(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 10})
-	headRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 11})
-	require.NoError(t, baseRepo.LoadOwner(t.Context()))
-	require.NoError(t, headRepo.LoadOwner(t.Context()))
-
-	// An open PR from the head repo owner, with maintainer edits allowed: this grants the base
-	// repo owner write access to exactly this head branch and nothing else.
-	pr := &issues_model.PullRequest{
-		Issue: &issues_model.Issue{
-			RepoID:   baseRepo.ID,
-			PosterID: headRepo.OwnerID,
-		},
-		HeadRepoID:          headRepo.ID,
-		BaseRepoID:          baseRepo.ID,
-		HeadBranch:          "granted-branch",
-		BaseBranch:          "master",
-		AllowMaintainerEdit: true,
-	}
-	require.NoError(t, issues_model.NewPullRequest(t.Context(), baseRepo, pr.Issue, nil, nil, pr))
-
-	// The pusher is the base repo owner (the maintainer) with only read access on the head repo.
-	maintainer := baseRepo.Owner
-	headPerm, err := access.GetIndividualUserRepoPermission(t.Context(), headRepo, maintainer)
-	require.NoError(t, err)
-
-	mockCtx, _ := contexttest.MockPrivateContext(t, "/")
-	ctx := &preReceiveContext{
-		PrivateContext: mockCtx,
-		loadedPusher:   true,
-		user:           maintainer,
-		userPerm:       headPerm,
-	}
-
-	// The granted branch must be writable...
-	assert.True(t, ctx.canWriteCodeRef(git.RefNameFromBranch("granted-branch")))
-
-	// ...but another branch in the same push must NOT inherit that grant.
-	assert.False(t, ctx.canWriteCodeRef(git.RefNameFromBranch("master")))
-
-	// ...and a tag sharing the granted branch's name must NOT inherit it either: the grant is
-	// scoped to PR head branches, so a non-branch ref can never match it. (A tag ref already
-	// yields an empty branch name, so this guards the per-ref evaluation, not the IsBranch check.)
-	assert.False(t, ctx.canWriteCodeRef(git.RefNameFromTag("granted-branch")))
-}
@@ -58,14 +58,14 @@ func TwoFactorPost(ctx *context.Context) {
 		return
 	}

-	// Validate the passcode and atomically consume it to prevent reuse/replay.
-	ok, err := twofa.ValidateAndConsumeTOTP(ctx, form.Passcode)
+	// Validate the passcode with the stored TOTP secret.
+	ok, err := twofa.ValidateTOTP(form.Passcode)
 	if err != nil {
 		ctx.ServerError("UserSignIn", err)
 		return
 	}

-	if ok {
+	if ok && twofa.LastUsedPasscode != form.Passcode {
 		remember := ctx.Session.Get("twofaRemember").(bool)
 		u, err := user_model.GetUserByID(ctx, id)
 		if err != nil {
@@ -81,6 +81,12 @@ func TwoFactorPost(ctx *context.Context) {
 			}
 		}

+		twofa.LastUsedPasscode = form.Passcode
+		if err = auth.UpdateTwoFactor(ctx, twofa); err != nil {
+			ctx.ServerError("UserSignIn", err)
+			return
+		}
+
 		_ = ctx.Session.Set(session.KeyUserHasTwoFactorAuth, true)
 		handleSignIn(ctx, u, remember)
 		return
@@ -368,21 +368,9 @@ func handleOAuth2SignIn(ctx *context.Context, authSource *auth.Source, u *user_m

 	opts := &user_service.UpdateOptions{}

-	// HINT: OAUTH-AUTO-SYNC-USER-ACTIVATION: see services/auth/source/oauth2/source_sync.go
-	// Reactivate user only if they were disabled by the OAuth2 auto sync cron (invalid_grant),
-	// which clears AccessToken/RefreshToken/ExpiresAt on the ExternalLoginUser row
-	// An admin-disabled user has no such signature, so we leave IsActive alone
-	// and let verifyAuthWithOptions route them through the prohibit-login / activate page.
+	// Reactivate user if they are deactivated
 	if !u.IsActive {
-		extLogin, hasExt, err := user_model.GetExternalLogin(ctx, authSource.ID, gothUser.UserID)
-		if err != nil {
-			ctx.ServerError("GetExternalLogin", err)
-			return
-		}
-		isDisabledByAutoSync := hasExt && extLogin.RefreshToken == ""
-		if isDisabledByAutoSync {
-			opts.IsActive = optional.Some(true)
-		}
+		opts.IsActive = optional.Some(true)
 	}

 	// Update GroupClaims
@@ -526,33 +514,17 @@ func oAuth2UserLoginCallback(ctx *context.Context, authSource *auth.Source, requ
 	}

 	// search in external linked users
-	externalLoginUser, hasUser, err := user_model.GetExternalLogin(ctx, authSource.ID, gothUser.UserID)
+	externalLoginUser := &user_model.ExternalLoginUser{
+		ExternalID:    gothUser.UserID,
+		LoginSourceID: authSource.ID,
+	}
+	hasUser, err = user_model.GetExternalLogin(request.Context(), externalLoginUser)
 	if err != nil {
 		return nil, goth.User{}, err
 	}
 	if hasUser {
-		user, err = user_model.GetUserByID(ctx, externalLoginUser.UserID)
-		if err != nil && !user_model.IsErrUserNotExist(err) {
-			return nil, goth.User{}, err
-		}
-		if err == nil && user.IsIndividual() {
-			return user, gothUser, nil
-		}
-
-		// The external login record is stale: the linked user no longer exists, or it exists but is
-		// not an individual user (only individual users can sign in, so a link pointing at an
-		// organization, bot or remote user can never resolve). Remove it so the next sign-in can
-		// relink the external account to the correct user. Nothing is lost, because the link is
-		// recreated automatically on the next sign-in.
-		reason := "linked user does not exist"
-		if err == nil {
-			reason = fmt.Sprintf("linked user type is %d", user.Type)
-		}
-		log.Warn("Ignoring stale external login link [external-id=%s login-source-id=%d user-id=%d]: %s", externalLoginUser.ExternalID, externalLoginUser.LoginSourceID, externalLoginUser.UserID, reason)
-
-		if err := user_model.RemoveExternalLoginByExternalID(ctx, externalLoginUser.LoginSourceID, externalLoginUser.ExternalID); err != nil {
-			return nil, goth.User{}, err
-		}
+		user, err = user_model.GetUserByID(request.Context(), externalLoginUser.UserID)
+		return user, gothUser, err
 	}

 	// no user found to login
--- a/Show More
+++ b/Show More