bdeshi
d80885a412
Found by /invariants: a symlink under static/ pointing outside the site root answered 500. The guard held — os.Root refused it and no bytes escaped — but the response confirmed the path was there, where every other miss answers 404. Same reasoning as a hidden bundle answering 404 rather than 403 (ADR-0024). serveStatic now stats through the rooted FS first, so a directory, a missing file, and a refused name are one answer. That also folds the old noListing and staticFS into one function, since "cannot serve this" was already their shared job. The test uses a real temp directory rather than a MapFS, because the guard under test belongs to os.Root; verified it fails with 500 against the previous code before keeping it. Splitting web_test.go at the seam the package already had — resolve_test.go for what a path means, web_test.go for what happens once it resolves — because it crossed FILE_LOC_WARN. Same response as content.go at entry 9.
khosra
A flat-file personal publishing engine in Go. Point the binary at a directory of Markdown and it becomes an owned, networked home for fiction, webcomics, art, and essays, in English and Bengali. The site's content lives in its own repository, not this one (ADR-0011).
Build and run
Needs Go 1.26+ and git; nothing else.
make build # or: go build -o khosra ./cmd/khosra
make run SITE=/path/to/site # or: ./khosra -site /path/to/site
make test
make verify # everything the project enforces — green before every commit
make help lists targets. make is a convenience wrapper; go build, go test and
./scripts/verify.sh work on their own and are what the gate uses.
A site root is a directory holding content/, and optionally static/ and templates/. It lives in its
own repository, not this one — the binary is pointed at it.
If you are a human: start at HARNESS.md — what the scaffolding is, how to use it, and what to decide.
If you are an agent: start at CLAUDE.md — the constitution and the read order. It is loaded for you automatically; this file is not a prerequisite and nothing here is a rule.