Module control 

The control plane this listener answers from: gunnar-core, directly (the ACL model).

What this replaced

Two local traits, seam::AuthDirectory and seam::RepoResolver, written while gunnar-core was being built in parallel. They are gone, and this is not a trait: there is one identity table and one catalog, they are gunnar-core’s, and putting an interface in front of them would only be somewhere for a second answer to live (one implementation).

The bug the seam had, which is why this is a rewrite and not a rename

Both seam traits returned Option. gunnar-core returns Result, and deliberately: the table lives in storage (the Arrow-IPC ref log), a read can fail, and the ACL model spells out that may(...) must not be a bare bool because the safe-looking invention for the failure case (“no access”) turns a storage fault into a silent permission denial. Any adapter from Result to Option has to make exactly that invention.

So the Result is carried all the way through Dispatch::authorise and lands as its own DispatchError::Store variant: separate from Denied, logged as a fault, and never reported to the client as “you may not have this repository”.

Structs

Control

The identity table and the repository catalog, together.

Enums

AnonymousPolicy

The --anonymous knob (the browse replica). Anonymous reads of public repositories are either served here (Allow, the default and every pre-2026-09 server) or refused with a line that names the browse replica they are served by (Refuse). Strangers cost CPU and bandwidth on the box that also takes the paying writes; the browse replica is where that cost belongs, and the primary sends them there rather than quietly 404-ing.