git gud.

Bare git on disk with a Postgres cache in front. Embedded SSH daemon — DB-backed key auth, no system git user. LFS too.

3-way merge, fork sync, compare any two refs, and conflicts resolved in the browser. Diffs render hunk-by-hunk with syntax-highlighted lines; large diffs keep their hunks out of the DOM until you open the file.

Point any forgejo-runner at it. Matrices across architectures, needs and outputs, concurrency groups, and every trigger you'd reach for — push, pull_request(_target), dispatch with inputs, schedule, workflow_run. A commit status per job, required checks in branch protection, re-run and cancel that actually stop the runner.

Each job gets a token that works only while it runs, only on its own repository, and only as far as its permissions: say. Fork pull requests wait for a maintainer's approval and run with no secrets and a read-only token.

ForgeFed over ActivityPub: federated PRs, federated reviews (Like/Dislike), federated comments. HTTP-signed; allowlist by default.

Per-repo interaction policy, quarantine queue, rate limits, peer-block suggestions, and a reversible 'replace with mod message' that keeps the original visible to admins + author.

Org and repo admins see the reports about their content — not just the instance admin — and can ban someone from one repo or from every repo an org owns. A ban stops them writing and folds away what they already wrote, at render time, so lifting it restores everything.

Assign reviewers, or take a chip suggesting who actually reviews here. One standing verdict each, not a pile of contradictory rows. Optional rules: block merging while changes are requested, require N approvals, stop authors approving their own — admins can override, and the override is recorded.

Comment on a line, or propose the replacement in a suggestion block that anyone with write access can commit. Refuses rather than guesses — if the branch moved since, it says so, and the ref update is a compare-and-swap so a concurrent push can't be clobbered.

Pushes, renames, labels, reviews, edits and moderation in one timeline per issue and PR. Body edits fold their before/after into a collapsed diff. Writing #42 leaves a backlink in that item's history, so a reference reads from both ends.

Seven topic tags per repo plus one derived from its primary language, browsable at /tags. Syms — stars, but with a set of symbols. Listings filter, sort and paginate with links you can send someone.

TOTP authenticator apps, FIDO2 security keys (YubiKey, passkeys, Touch ID), recovery codes. Sudo mode in front of every credential change, and optional instance-wide enforcement with a grace window.

Secrets encrypted under a key it refuses to boot without. Wrong passwords, sign-in emails and sign-ups rate limited. Outbound requests refuse private addresses. Uploaded bytes never render on the forge's own origin.

GFM with cross-references — `#42` links to whichever issue or PR that number actually is, `#x2a` works too, `owner/repo#42` crosses repos. Quote-reply on every comment.

Define labels once at the org; every repo inherits unless it opts out. Color picker with a 16-swatch palette and a live preview badge.

Every repository gets a sister .wiki.git, edited through the UI or cloned and pushed like any repo.

Containers, PyPI, Hex, Cargo, apt and raw files, served by the forge. CI publishes with its job token — no stored secret — and one signing key per org covers everything it ships.

Import a GitHub org or user, a GitLab group, or any git URL, each on its own background job with live progress. Keep them in sync on demand or hourly, mirrored or reconciled.

CI runs, logs and re-runs, workflow dispatch, fork-run approval, issues and pull requests from your phone or your terminal. Pair a phone by scanning a QR code; the device is its token.

User + org profile pages at /u/:handle and /orgs/:handle. Bio, location, socials, pinned repos (drag-to-reorder, up to 7), and an auto-created alice/alice README repo that renders inline.

0.3em GitHub-style bar above the file tree, click for /stats/languages or /stats/committers. Computed lazily by Oban from cached blob + commit metadata — no extra git walks on the request path.

Three registration modes — open, invite-only (default), closed. Single-use invite links generated from /users/settings/invites, revocable anytime. Org members manageable from settings with a last-admin guard.