worklyn / zukapublic

Two things that had to arrive together: a repository nobody can open in a
browser is not meaningfully public, and a viewer with nothing public to show
has no audience.

Visibility is private by default, and a record written before the field
existed deserialises to private — absence meaning public would have published
every repository on the host on the first upgrade that understood it.

Anonymous access lives in one function, open_public_repo. It grants read and
cannot be asked for anything else: there is no anonymous write to refuse
because there is no way to spell it. A presented-but-rejected credential
stays rejected on both the viewer and the git wire rather than silently
becoming an anonymous visitor.

The viewer is server-rendered from this binary: no bundler, no CDN, no
client framework, because the product ships as one file a stranger drops on
a VM. Markdown drops raw HTML and rewrites link schemes — pulldown-cmark
emits destinations verbatim, so a README could otherwise carry a
javascript: href.