Everlock 0.7.0

The 0.7.0 release tightens who may do what. Access now derives solely from explicit grants, git repositories can hand out a contributor role that opens pull requests without touching branches, and vault instances are administered from the admin console like every other backend. Inbound mail gained DMARC verification, and pushes to large repositories no longer die at the SSH rekey. Binaries are on the download page; container images are published under the 0.7 tag family (cr.everlock.sh/everlock:0.7-qwen3, cr.everlock.sh/everlock:0.7-smolvlm).

Highlights

• Vault accounts are administered from the CLI. /vault accounts list <instance> shows an instance's accounts with the everlock user each was provisioned for, and /vault accounts delete <instance> <email> removes an account together with the data it owns — personal ciphers and their attachments, folders, sends, and organization memberships. The listing's orgs on delete column states per account what happens to its organizations, so the outcome is visible before the delete. /vault create now grants its caller Owner on http/vault/<name>, matching how calendar, image, and git instances hand ownership to their creator.
• A contributor role for git. writer on */git/<repo>:pulls allows pushing refs/pull/* — opening, updating, and closing pull requests — with no access to refs/heads/* or refs/tags/*. Paired with a container reader, that is the standard contributor: may propose changes, may not touch branches. Receive-pack authorizes every ref update in a push individually, so allowed updates apply while denied ones answer ng <ref> access denied. Existing repo writer/owner grants cover :pulls already.
• Inbound DMARC verification. Received mail is checked against the sender's published DMARC policy, combining SPF and DKIM outcomes with From-domain alignment. The verdict lands in the message sidecar, in the Authentication-Results header as a dmarc= clause, and in rules.toml as a dmarc_result condition, so filtering policy can act on aligned authentication. Every verified DKIM signature is now reported as its own clause with signing domain and selector, so a downstream consumer can check alignment from the trace header alone.
• Every admin listing renders as a table. /users list, /users grants, /groups list, /server info, /server settings list, /jobs list, /dns info, and /git pr list use the shared table primitive — content-sized columns that stay aligned when a value outgrows its column. Structured outlets receive these results as table items.

Breaking

• Access derives solely from explicit grants. The access check used to accept any actor whose login equaled the namespace segment of the requested path, so a user named after an image instance, site, registry, or calendar was its Owner by name collision alone. That rule is gone: every path is closed until a grant opens it. Deployments that relied on it need explicit grants after upgrading — mailboxes via /users grant <login> */mail/<domain>:<mailbox> owner, git repositories named after their user via /users grant <login> */git/<repo> owner.
• Admin CLI verbs are unified on create/delete. /users add, /groups add, and /users ssh-keys add are now /users create, /groups create, and /users ssh-keys create; /users passwd is /users password. Scripts driving the console need the new spelling, and the projections rename with them (MCP users_add → users_create, users_passwd → users_password; HTTP POST /api/users/passwd → POST /api/users/password). The AI assistant's tools follow the same convention: add_user and add_group are create_user and create_group. grant/revoke and assign/unassign keep their domain verbs.
• /git pr commands authorize per repository. They move off the system-admin tier: list needs repo reader, open/close a :pulls writer, and merge a repo writer, because a merge writes the target branch.

Fixes

• Clones larger than a gigabyte finish. SSH renegotiates session keys after about a gigabyte of transfer, and only key-exchange messages may cross the wire while that runs. Queued pack data used to go out mid exchange, which OpenSSH treats as a protocol error, so git clone of a large repository died with early EOF. Queued data now waits for the exchange to finish — about one round trip — and goes out under the new keys.
• Deleting a ref by push actually deletes it. git push origin :<ref>, and any push whose new value is the zero OID, reported success but wrote a ref file of forty zeros; the corrupt ref then broke the repository's ref listing and gc. Deletes now remove the ref, in the push, /git pr close, and merge paths alike.
• /git pr list reports an empty repository as empty instead of rendering a table with no rows once every pull request has been merged or closed.

Upgrading

Self-updating servers pick 0.7.0 up on their daily check. For a manual upgrade, download the new binary (or pull the new image tag) and restart — stores, mail, and all versioned content carry over untouched. Check /users grants before or right after the upgrade: access that came from a name collision rather than a grant needs a grant now, and mailboxes are the common case. The full list of changes is in the changelog.