ADR 0032 - Public home and GitHub distribution edge

The canonical source home is cheshirecube; GitHub is the public distribution edge for everything a user’s machine fetches directly; the import path is the vanity domain madtea.lol.

• Status: Accepted (2026-08-16); Amended 2026-08-16 (#380); Superseded by ADR 0033 (2026-08-17)
• Date: 2026-08-16
• Tracking: #380

Amendment (2026-08-16, #380): SHA-256 forces a synced copy, not a push mirror

The canonical repo is SHA-256, as all our Forgejo repos are. GitHub is SHA-1 only and cannot host a SHA-256 repository, so the “push mirror” named in the Decision and Plumbing sections below is impossible. The decision is unchanged

• GitHub is still the go-get source and the distribution edge - but the mechanism changes:

• The go-get source is an independent SHA-1 copy of the source on GitHub, maintained by a one-way sync (git fast-export --signed-tags=strip piped to git fast-import), not a git push mirror. The SHA-1 output is deterministic from the source content and stable across runs.

• The sync runs in cheshirecube CI on each push and tag, before GoReleaser publishes, so the release tag exists on GitHub.

• Commits and tags on the GitHub copy are unsigned; fast-export strips the SHA-256 signatures, which cannot re-verify against the re-hashed commits. Release artifacts stay GPG-signed and are what madtea update verifies (ADR 0012), so end-user trust is intact. GitHub commit SHAs differ from cheshirecube but are stable and do not affect Go modules.

• Runbook: docs/contributing/github-source-sync.md, which replaces the push-mirror runbook.

Context

Where madtea lives and how it is distributed was settled in practice but never recorded, so it kept being re-opened. This ADR records it once.

The repository has moved forges over time (the module path history runs gitea to Codeberg to cheshirecube). Each move used to force an import-path change and a config sweep, because the import path was tied to the forge host.

Two forces shape the decision:

1. Reach. Corporate networks reliably allowlist github.com. They do not reliably allow a self-hosted forge on a new domain. Any install channel a user’s machine fetches directly from a self-hosted host can fail behind such a proxy.
2. Portability. A vanity import path decouples the module name from the forge, so a future forge move costs zero import churn.

Decision

• Canonical source home - code, issues, and contributions live at git.cheshirecube.cloud/sixfold-space/madtea.
• Public distribution edge - GitHub, under github.com/sixfold-space, serves everything a user’s machine fetches directly: release binaries, the curl installer, the self-updater download base, the Homebrew tap, the Scoop bucket, the Claude Code plugin marketplace, and the go-get mirror.
• Import identity - the module path is the vanity domain madtea.lol. The go-import meta tag on madtea.lol points Go at the GitHub mirror github.com/sixfold-space/madtea. The import path never names a forge, so it survives a forge move.
• Plumbing - cheshirecube pushes to the GitHub mirror (branches and tags) via a push mirror. GoReleaser publishes release, tap, and scoop artifacts to GitHub. The self-updater downloads from GitHub.

The split is deliberate: the source home a person browses and files issues against (cheshirecube) is a different role from the distribution edge a machine fetches from (GitHub). One host does not have to serve both.

Consequences

• go install madtea.lol/cmd/madtea@latest resolves through proxy.golang.org, which fetches the vanity meta and clones the GitHub mirror server-side. The user’s machine only contacts the Go proxy, so this channel is firewall-robust.
• The module path change is breaking for direct Go importers. It resolves only from the first release tagged after the rename, because Go reads the module path from go.mod at the requested tag. Earlier tags keep the old path.
• The GitHub mirror must carry the renamed go.mod and every new release tag, or go get fails. The push-mirror runbook is docs/contributing/github-push-mirror.md.
• GitHub is a read-only downstream mirror. Contributions go to cheshirecube; a commit made directly on GitHub is lost at the next sync.
• Refines the install story of ADR 0010 and the self-updater source of ADR 0012 by naming GitHub as the artifact host; it does not change the tag-driven release model or the trust-on-first-use update flow. Related to ADR 0025 (origin-first forge resolution), which continues to resolve the forge from the checkout’s own origin.