Backlog (ordered by value; the orchestrator picks from the top)

Status: [ ] todo, [~] in progress, [x] done.

Now

Branch protection rules (force-push and deletion per pattern)
M3: issues, comments, labels, milestones, assignees, #N/@user linking, closing keywords from commits

Repo settings: description, website, visibility toggle (public/private), default branch change, archive/unarchive
Repo rename (with repo_redirects so old URLs and clone URLs keep working) and transfer to another user
Collaborators UI: add/remove users with a role (Read, Triage, Write, Maintain, Admin)
Explore page: list public repos, search by name
Stars (star/unstar, count, "starred" tab on profile)

Login throttling / rate limiting (per IP and per account) for login, git HTTP auth and token auth
TOTP 2FA with recovery codes (the schema is ready for it)
User deletion with ghost-user reassignment of issues and comments
Password change, email change, admin password reset
Audit log (security-relevant events: logins, key and token changes, deletions, protection changes)

Forks (git clone --bare --local, hardlinked objects, no alternates) and same-repo branch PRs
refs/pull/N/head, mergeability via merge-tree --write-tree, three-dot diff, merge strategies (merge, squash, ff) with CAS ref update
PR list, compare page (forks read via GIT_ALTERNATE_OBJECT_DIRECTORIES, no writes on GET), PR view with commits and files tabs, editing
PR end-to-end test over real git; merge errors shown in the merge box
M4b: reviews (approve / request changes / comment), line comments on the files tab, outdated marking
"Recent pushes: Compare & pull request" banner on the repo home
Delete the head branch after merge (button)
Required approvals and other merge rules as part of branch protection
Review line-position remapping (outdated is per file today), dismissed reviews keep their original verb

Webhooks (HMAC-SHA256, delivery log, retries, SSRF guard)
Webhook follow-ups: audit entries, sent headers in the delivery log
Notifications (in-app inbox for mentions, assignments, comments on watched issues)
Push and pull mirrors (contract: docs/mirrors-interfaces.md)
Mirror follow-ups: add a pull mirror in settings to an empty repo; e2e pull over real HTTP; pin git's DNS to the checked address (rebinding race)
Backups: verified sets (DB snapshot + bundles), scheduler with retention and healthchecks, fsck schedule, /admin/backups, restore command, docs/backup.md
Replication to the standby (push --mirror after each push, hourly reconcile by refs checksum, DB snapshots; /admin/replication; runbook in docs/backup.md)
Commit status API (for the future CI runner)

Edit history viewer: an "edited" marker linking to past versions (store read fn for edit_history)
Default label set on repo creation (bug, enhancement, documentation, …)
Issue reactions
Issue locking (reactions must then hide buttons), issue templates, pinned issues
The "Archived" banner shows only on the repo home and settings pages; repo_head should take the Repo (or RepoCtx) so every repo page gets it automatically

A shared test fixture test_support::app(dir) -> (AppState, Router): Config and AppState literals are copied into about 8 test modules, and every new field breaks them all
Store read pool: one writer connection plus 4 query_only readers (Store::read_conn); pure-SELECT functions use the readers (rules in the Store doc comment, proof in crates/forge-core/tests/read_pool.rs)
Login and git auth throttling (throttle.rs, client_ip.rs, trusted_proxies)

Releases with attachments (object_store), LFS (batch API, SSH git-lfs-authenticate, pointer display, admin lfs-gc)
Code search
Signed commit verification (SSH/GPG) badges
Compression for HTML pages (tower-http layer with a text-only, path-excluding policy; docs/architecture.md §5.6)

forge-ci crate: .forge/ci.toml parsing and validation, triggers, runner protocol types, secret masking
Schema and store: runners, registration tokens, runs, jobs, artifacts, sealed secrets
Scheduling on push, tag, PR and manual runs; fork PR approval; commit statuses; lost-runner reaper; retention
Runner API: register, long-poll claim, logs, heartbeat and cancel, artifacts, finish; job-token git read
Run, job and live-log pages; cancel, re-run, approve; artifact downloads
Repo secrets settings page and /admin/runners
forge-runner binary: rootless podman executor, workspace checkout, log streaming, artifacts, timeouts
CI end-to-end test and docs/ci.md

Images: in-process registry pull, digest-verified blob cache, safe layer unpacking (whiteouts, no escapes), GC
Sandbox: forge-runner __sandbox helper on youki libcontainer (rootless userns, pure-Rust seccomp via seccompiler, no caps, overlay rootfs, cgroup limits)
BuiltinExecutor as the default, forge-runner check, runner config and docs/ci.md updates

Subordinate id mapping via newuidmap/newgidmap, auto fallback to single uid, __sandbox-rm
Image layers unpacked with real ownership inside the mapped userns (__sandbox-unpack)
Sandbox, executor, config ([sandbox] userns), check and docs use the mapping

O1 organizations core (accounts of kind org, members, teams, authz)
O2 organizations UI (org pages, owner select, transfer to org)
M1 mail core (lettre, outbox worker, admin mail settings)
M2 mail flows (password reset, email verification, invites; notification emails move to M3)
M3 notification emails (per-user opt-out on /settings/notifications, threaded by Message-ID)
W1 wiki (git-backed, web editing, clone/push, backups/replication)
D1 discussions
S1 snippets
T1 theme and language preferences (dark mode toggle)
I18 i18n infrastructure (En/Tr) and the shell, auth and settings pages
I18b remaining pages translated (11 per-group key modules in i18n/, Turkish review pass done)
I18c shared time/size/visibility helpers localised
A1 security advisories (OSV, opt-in)
P1 repo transfer acceptance
LFS media route moved to /-/media/ (branch named media no longer shadowed)